- !24596 [sync]urma: fix workqueue use-after-free in ubagg_exit teardown sequence - urma: fix workqueue use-after-free in ubagg_exit teardown sequence - !24607 ub: udma: Optimize udma jetty id access logic. - ub: udma: Optimize udma jetty id access logic. - !24640 [sync]urma: limit ubcore logs in reuse paths - urma: fix workqueue use-after-free in ubagg_exit teardown sequence - !24669 mm/madvise: add MADV_FCMA_ENABLE to set PF_FOLIO_CMA via madvise - mm/madvise: add MADV_FCMA_ENABLE to set PF_FOLIO_CMA via madvise - !24702 [sync]urma: retry import jetty/jfr on EIO from tpid reuse failure - urma: retry import jetty/jfr on EIO from tpid reuse failure - urma: limit ubagg connect exchange logs * Fri Jul 10 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-145.3.18.151.20260710.aae66044906b - !24753 [sync]urma: drain jfe event lists in batches to avoid soft-lockup - urma: drain jfe event lists in batches to avoid soft-lockup - urma: reduce ubagg topo log noise - !24748 [sync]urma: free completion events outside jfe lock - urma: free jfe events outside lock - urma: free completion events outside jfe lock - !24742 urma: Fix the issue of inaccurate timing for some functions in DFX - !24741 [sync]urma: fix UAF of accessing token_id in log. - urma: Fix the issue of inaccurate timing for some functions in DFX - urma: fix UAF of accessing token_id in log. - !24734 [sync]urma: fix tpid_reuse attached to vtpn causes use_after_free - urma: fix tpid_reuse attached to vtpn causes use_after_free - !24804 [sync]urma: use vzalloc for ubmad tjetty and ini_rtbuffer - !24774 [sync]urma: ratelimit import jetty/jfr error logs - urma: use vzalloc for ubmad tjetty and ini_rtbuffer - !24792 [sync]urma: fix UAF of accessing jfs/jetty in log. - urma: fix UAF of accessing jfs/jetty in log. - urma: ratelimit import jetty/jfr error logs - !24845 [sync]ub/ubdevshm: Support for acquiring va is a sub-range of registered va - ub/ubdevshm: Support for acquiring va is a sub-range of registered va - !24802 [sync]urma: use xarray for ubagg/ubcore session lookup - urma: use xarray for ubagg/ubcore session lookup - !24814 [sync]urma: make ratelimit burst configurable for ubcore/uburma/ubagg - urma: make ratelimit burst configurable for ubcore/uburma/ubagg * Wed Jul 22 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-145.3.22.153.20260722.158daf1d8dea - !24942 [sync]urma: drop param_set_uint_minmax for ratelimit burst setters - urma: drop param_set_uint_minmax for ratelimit burst setters - !25840 sync CVE LTS and bugfix from OLK-6.6 d33ffc8f8580 to 334dfd575ba5 - cgroup/rstat: avoid disabling irqs for O(num_cpu) - netfilter: bridge: eb_tables: close module init race - crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents - netfilter: ebtables: move to two-stage removal scheme - crypto: qat - protect service table iterations with service_lock - Bluetooth: eir: Fix stack OOB write when prepending the Flags AD - drm/edid: fix OOB read in drm_parse_tiled_block() - proc: protect ptrace_may_access() with exec_update_lock (FD links) - vfio/pci: Latch disable_idle_d3 per device - bpf: Fix UAF in sock clone early bailouts - bpf: Disable xfrm_decode_session hook attachment - bpf,fork: wipe ->bpf_storage before bailouts that access it - KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() - crypto: qat - validate RSA CRT component lengths - bpf: Clear rb node linkage when freeing bpf_rb_root - bpf: Add validation for bpf_set_retval argument - bpf: Reject sleepable BPF_LSM_CGROUP programs at load time - bpf: Fix setting retval to -EPERM for cgroup hooks not returning errno - bpf: Guard __get_user acesss with access_ok for uprobe_multi data - i2c: core: fix adapter registration race - ALSA: hda/cs35l41: Fix firmware load work teardown - vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc - iommufd: Break the loop on failure in iommufd_fault_fops_read() - posix-cpu-timers: Prevent UAF caused by non-leader exec() race - iio: event: Fix event FIFO reset race - hwrng: virtio: clamp device-reported used.len at copy_data() - crypto: drbg - Fix returning success on failure in CTR_DRBG - crypto: ecc - Fix carry overflow in vli multiplication - crypto: pcrypt - restore callback for non-parallel fallback - net: openvswitch: reject oversized nested action attrs - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page - e1000e: Fix out-of-bounds MMIO access by validating BAR0 size - xsched: enforce permissions on attribute access - xsched: restrict vstream management to privileged users - rme: use DMA API for virtio in realm world - udf: validate sparing table length as an entry count, not a byte count - smb: client: harden POSIX SID length parsing - smb: client: mask server-provided mode to 07777 in modefromsid - smb: client: Fix next buffer leak in receive_encrypted_standard() - nvmet-auth: validate reply message payload bounds against transfer length - bpf: Reject fragmented frames in devmap - bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized - mm/huge_memory: update file PMD counter before folio_put() - sctp: fix uninit-value in __sctp_rcv_asconf_lookup() - smb: client: reject overlapping data areas in SMB2 responses - smb: client: restrict implied bcc[0] exemption to responses without data area - io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item - writeback: drop now-unnecessary rcu_barrier() in cgroup_writeback_umount() - writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() - writeback: Fix use after free in inode_switch_wbs_work_fn() - writeback: Avoid contention on wb->list_lock when switching inodes - block: skip sync_blockdev() on surprise removal in bdev_mark_dead() - mm: do file ownership checks with the proper mount idmap - tracing: Bound synthetic-field strings with seq_buf - perf/core: Detach event groups during remove_on_exec - bpf: Allow LPM map access from sleepable BPF programs - bpf: Consistently use bpf_rcu_lock_held() everywhere - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC - udf: validate VAT header length against the VAT inode size - isofs: bound Rock Ridge symlink components to the SL record - udf: validate free block extents against the partition length - config: arm64: update CONFIG_FTRACE_STARTUP_TEST not set - crypto: qat - Return pointer directly in adf_ctl_alloc_resources - crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() - drivers/base/memory: set mem->altmap after successful device registration - serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails - serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero - NFS: Prevent resource leak in nfs_alloc_server() - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr - nfsd: check get_user() return when reading princhashlen - fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode - fbdev: modedb: fix a possible UAF in fb_find_mode() - fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var - power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path - 9p: avoid putting oldfid in p9_client_walk() error path - ocfs2: reject oversized group bitmap descriptors - rpmsg: char: Fix use-after-free on probe error path - fpga: region: fix use-after-free in child_regions_with_firmware() - irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove - pNFS: Fix use-after-free in pnfs_update_layout() - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done - hdlc_ppp: sync per-proto timers before freeing hdlc state - gfs2: fix use-after-free in gfs2_qd_dealloc - exfat: fix potential use-after-free in exfat_find_dir_entry() - bpf: use kvfree() for replaced sysctl write buffer - f2fs: keep atomic write retry from zeroing original data - f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node() - f2fs: validate ACL entry sizes in f2fs_acl_from_disk() - f2fs: fix to round down start offset of fallocate for pin file - f2fs: validate compress cache inode only when enabled - wifi: iwlwifi: mvm: fix race condition in PTP removal - wifi: rtw88: usb: fix memory leaks on USB write failures - wifi: rtw88: increase TX report timeout to fix race condition - wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor - wifi: ath11k: fix warning when unbinding - wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S - keys: Pin request_key_auth payload in instantiate paths - KEYS: fix overflow in keyctl_pkey_params_get_2() - err.h: use __always_inline on all error pointer helpers - fbdev: fix use-after-free in store_modes() - NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR - apparmor: mediate the implicit connect of TCP fast open sendmsg - net: skmsg: preserve sg.copy across SG transforms - mac802154: llsec: add skb_cow_data() before in-place crypto - af_unix: Set gc_in_progress to true in unix_gc(). - ntfs3: reject direct userspace writes to reserved $LX* xattrs - ipv4: account for fraggap on the paged allocation path - inet: add indirect call wrapper for getfrag() calls - ipv6: account for fraggap on the paged allocation path - batman-adv: tvlv: avoid race of cifsnotfound handler state - batman-adv: tvlv: enforce 2-byte alignment - batman-adv: dat: prevent false sharing between VLANs - batman-adv: tt: track roam count per VID - batman-adv: tt: don't merge change entries with different VIDs - batman-adv: tp_meter: handle overlapping packets - batman-adv: tp_meter: prevent parallel modifications of last_recv - batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE - batman-adv: tp_meter: restrict number of unacked list entries - batman-adv: v: prevent OGM aggregation on disabled hardif - batman-adv: frag: avoid underflow of TTL - batman-adv: frag: ensure fragment is writable before modifying TTL - batman-adv: fix (m|b)cast csum after decrementing TTL - batman-adv: ensure bcast is writable before modifying TTL - batman-adv: tp_meter: initialize last_recv_time during init - batman-adv: prevent ELP transmission interval underflow - batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE - batman-adv: tp_meter: add only finished tp_vars to lists - batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection - batman-adv: tp_meter: fix fast recovery precondition - batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd - batman-adv: tp_meter: avoid window underflow - batman-adv: tp_meter: initialize dec_cwnd explicitly - batman-adv: tp_meter: initialize dup_acks explicitly - batman-adv: tp_meter: keep unacked list in ascending ordered - eventpoll: rename ep_remove_safe() back to ep_remove() - file: add fput() cleanup helper - media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si - ksmbd: reject non-VALID session in compound request branch - scripts/sorttable: Fix endianness handling in build-time mcount sort - scripts/sorttable: Allow matches to functions before function entry - scripts/sorttable: Use normal sort if theres no relocs in the mcount section - ftrace: Check against is_kernel_text() instead of kaslr_offset() - ftrace: Test mcount_loc addr before calling ftrace_call_addr() - ftrace: Do not over-allocate ftrace memory - ftrace: Have ftrace pages output reflect freed pages - ftrace: Update the mcount_loc check of skipped entries - scripts/sorttable: Zero out weak functions in mcount_loc table - scripts/sorttable: Always use an array for the mcount_loc sorting - scripts/sorttable: Have mcount rela sort use direct values - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 - scripts/sorttable: Use a structure of function pointers for elf helpers - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly - scripts/sorttable: Move code from sorttable.h into sorttable.c - scripts/sorttable: Use uint64_t for mcount sorting - scripts/sorttable: Add helper functions for Elf_Sym - scripts/sorttable: Add helper functions for Elf_Shdr - scripts/sorttable: Add helper functions for Elf_Ehdr - scripts/sorttable: Convert Elf_Sym MACRO over to a union - scripts/sorttable: Replace Elf_Shdr Macro with a union - scripts/sorttable: Convert Elf_Ehdr to union - scripts/sorttable: Make compare_extable() into two functions - scripts/sorttable: Have the ORC code use the _r() functions to read - scripts/sorttable: Remove unneeded Elf_Rel - scripts/sorttable: Remove unused write functions - scripts/sorttable: Remove unused macro defines - fuse: re-lock request before replacing page cache folio - slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD - slimbus: qcom-ngd-ctrl: Fix up platform_driver registration - rxrpc: Fix the ACK parser to extract the SACK table for parsing - net: phonet: free phonet_device after RCU grace period - phonet: Pass net and ifindex to phonet_address_notify(). - phonet: Pass ifindex to fill_addr(). - Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs - hv: utils: handle and propagate errors in kvp_register - regulator: core: fix locking in regulator_resolve_supply() error path - ring-buffer: Remove ring_buffer_read_prepare_sync() - selftests/bpf: Update comments find_equal_scalars->sync_linked_regs - af_unix: Reject SIOCATMARK on non-stream sockets - selftests/bpf: Add test to ensure kprobe_multi is not sleepable - agp/amd64: Fix broken error propagation in agp_amd64_probe() - net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() - i2c: stub: Reject I2C block transfers with invalid length - RDMA/bnxt_re: zero shared page before exposing to userspace - KVM: VMX: Update SVI during runtime APICv activation - ARM: fix branch predictor hardening - ARM: fix hash_name() fault - ARM: allow __do_kernel_fault() to report execution of memory faults - ARM: group is_permission_fault() with is_translation_fault() - debugobjects: Dont call fill_pool() in early boot hardirq context - debugobjects: Do not fill_pool() if pi_blocked_on - debugobjects: Use LD_WAIT_CONFIG instead of LD_WAIT_SLEEP - debugobjects: Allow to refill the pool before SYSTEM_SCHEDULING - batman-adv: tt: prevent TVLV entry number overflow - drm/v3d: Skip CSD when it has zeroed workgroups - drm/v3d: Store the active job inside the queue's state - iov_iter: Fix potential underflow in iov_iter_extract_xarray_pages() - urma: add check type in free driver obj - smb: client: fix double-free in SMB2_close() replay - smb: client: fix double-free in SMB2_flush() replay - smb: client: fix query_info() replay double-free - smb: client: fix query directory replay double-free - smb: client: fix double-free in SMB2_open() replay - smb: client: fix double-free in SMB2_ioctl() replay - smb: client: fix change notify replay double-free - HID: lg-g15: cancel pending work on remove to fix a use-after-free - HID: multitouch: fix out-of-bounds bit access on mt_io_flags - tracing: Prevent out-of-bounds read in glob matching - sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT - !25616 sync CVE LTS and bugfix from OLK-6.6 b72db20c0437 to d33ffc8f8580 - KVM: x86: hyper-v: Bound the bank index when querying sparse banks - MIPS: DEC: Prevent initial console buffer from landing in XKPHYS - ksmbd: fix durable reconnect error path file lifetime - ksmbd: fix use-after-free in smb2_open during durable reconnect - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query - USB: iowarrior: fix use-after-free on disconnect race - usb: iowarrior: remove inherent race with minor number - USB: iowarrior: fix use-after-free on disconnect - apparmor: fix use-after-free in rawdata dedup loop - tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR - bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops - rbd: eliminate a race in lock_dwork draining on unmap - blk-cgroup: fix UAF in __blkcg_rstat_flush() - net: Fix kabi breakage of struct tc_action - net/sched: act_api: use RCU with deferred freeing for action lifecycle - net: Fix kabi breakage of struct header_ops - bonding: prevent potential infinite loop in bond_header_parse() - bonding: fix type confusion in bond_setup_by_slave() - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc - ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL - ASoC: cs35l56: Fix missing calls to wm_adsp2_remove() - time: Fix off-by-one in compat settimeofday() usec validation - scsi: target: Fix hexadecimal CHAP_I handling - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink - ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY - ksmbd: add a permission check for FSCTL_SET_ZERO_DATA - ksmbd: add per-handle permission check to FILE_LINK_INFORMATION - mptcp: fix missing wakeups in edge scenarios - mptcp: add-addr: always drop other suboptions - ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 - RDMA/umem: fix kernel-doc warnings - mm/migrate: don't call folio_putback_active_hugetlb() on dst hugetlb folio - usb: typec: ucsi: Don't update power_supply on power role change if not connected - serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() - thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() - usb: typec: ucsi: Check if power role change actually happened before handling - usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind - usb: dwc3: xilinx: fix error handling in zynqmp init error paths - usb: musb: omap2430: Fix use-after-free in omap2430_probe() - tty: serial: samsung: Remove redundant port lock acquisition in rx helpers - tty: serial: samsung: use u32 for register interactions - serial: samsung_tty: Use port lock wrappers - ALSA: firewire-motu: Protect register DSP event queue positions - memfd: deny writeable mappings when implying SEAL_WRITE - iio: dac: ad5686: fix ref bit initialization for single-channel parts - usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure - iio: chemical: scd30: fix division by zero in write_raw - iio: chemical: scd30: Use guard(mutex) to allow early returns - iio: gyro: adis16260: fix division by zero in write_raw - Bluetooth: hci_qca: Convert timeout from jiffies to ms - Bluetooth: hci_qca: Migrate to serdev specific shutdown function - serdev: Provide a bustype shutdown function - serdev: make serdev_bus_type const - mm/damon/sysfs-schemes: delete tried region in regions_rmdirs() - mptcp: do not drop partial packets - mptcp: introduce the mptcp_init_skb helper - iio: adc: npcm: fix unbalanced clk_disable_unprepare() - iio: adc: npcm: Convert to platform remove callback returning void - octeontx2-pf: avoid double free of pool->stack on AQ init failure - af_unix: Fix UAF read of tail->len in unix_stream_data_wait() - af_unix: Cache state->msg in unix_stream_read_generic(). - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg - net: hsr: defer node table free until after RCU readers - mptcp: pm: fix ADD_ADDR timer infinite retry on option space insufficient - ice: fix VF queue configuration with low MTU values - mptcp: reset rcv wnd on disconnect - mptcp: cleanup fallback dummy mapping generation - octeontx2-af: CGX: add bounds check to cgx_speed_mbps index - octeontx2-af: replace deprecated strncpy with strscpy - cgroup/cpuset: Reset DL migration state on can_attach() failure - fbdev/vt8500lcdfb: Initialize fb_ops with fbdev macros - soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get() - driver core: reject devices with unregistered buses - drm/amd/display: Use krealloc_array() in dal_vector_reserve() - drm/amdgpu: restart the CS if some parts of the VM are still invalidated - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 - drm/amdkfd: fix NULL dereference in get_queue_ids() - slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock - slimbus: qcom-ngd-ctrl: fix OF node refcount - thunderbolt: Limit XDomain response copy to actual frame size - sctp: stream: fully roll back denied add-stream state - mmc: sdhci: add signal voltage switch in sdhci_resume_host - mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC - mmc: litex_mmc: Set mandatory idle clocks before CMD0 - mmc: core: Fix host controller programming for fixed driver type - mm/hugetlb: restore reservation on error in hugetlb folio copy paths - octeontx2-af: fix memory leak in rvu_setup_hw_resources() - nvmem: layouts: onie-tlv: fix hang on unknown types - net: rds: clear i_sends on setup unwind - net: mv643xx: fix OF node refcount - net/mlx5: Reorder completion before putting command entry in cmd_work_handler - misc: fastrpc: fix use-after-free race in fastrpc_map_create - misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context - Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard - i2c: tegra: Fix NOIRQ suspend/resume - i2c: stm32f7: fix timing computation ignoring i2c-analog-filter - i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() - pidfd: refuse access to tasks that have started exiting harder - ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write - vsock/vmci: fix sk_ack_backlog leak on failed handshake - wifi: nl80211: reject oversized EMA RNR lists - selftests: mptcp: add test for extra_subflows underflow on userspace PM - mptcp: sockopt: check timestamping ret value - mptcp: allow subflow rcv wnd to shrink - mptcp: close TOCTOU race while computing rcv_wnd - mptcp: fix retransmission loop when csum is enabled - ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow - ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O - ARM: socfpga: Fix OF node refcount leak in SMP setup - mm/damon/ops-common: call folio_test_lru() after folio_get() - drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info() - ALSA: timer: Fix UAF at snd_timer_user_params() - USB: serial: option: add usb-id for Dell Wireless DW5826e-m - xfrm: espintcp: do not reuse an in-progress partial send - ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL - mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation - tracing/probes: Point the error offset correctly for eprobe argument error - netfilter: nft_tunnel: fix use-after-free on object destroy - clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time - net: mvpp2: build skb from XDP-adjusted data on XDP_PASS - net: mvpp2: refill RX buffers before XDP or skb use - net: mvpp2: Add metadata support for xdp mode - netfilter: nf_log: validate MAC header was set before dumping it - rds: mark snapshot pages dirty in rds_info_getsockopt() - net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion - r8152: handle the return value of usb_reset_device() - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove - net: phy: clean the sfp upstream if phy probing fails - net/mlx4: avoid GCC 10 __bad_copy_from() false positive - ASoC: wm_adsp: Fix NULL dereference when removing firmware controls - arm64: tlb: Allow XZR argument to TLBI ops - KVM: arm64: Remove VPIPT I-cache handling - tools/rv: Fix cleanup after failed trace setup - time: Fix off-by-one in settimeofday() usec validation - ipmi: Fix rcu_read_unlock to srcu_read_unlock in handle_read_event_rsp - ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() - vxlan: vnifilter: fix spurious notification on VNI update - vxlan: vnifilter: send notification on VNI add - octeontx2-af: npc: Fix CPT channel mask in npc_install_flow - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown - ptp: vclock: Switch from RCU to SRCU - net: fec: fix pinctrl default state restore order on resume - net: lan743x: permit VLAN-tagged packets up to configured MTU - net: garp: fix unsigned integer underflow in garp_pdu_parse_attr - hsr: Remove WARN_ONCE() in hsr_addr_is_self(). - net: Annotate sk->sk_write_space() for UDP SOCKMAP. - pcnet32: stop holding device spin lock during napi_complete_done - drm/imx: Fix three kernel-doc warnings in dcss-scaler.c - 6lowpan: fix off-by-one in multicast context address compression - netfilter: xt_NFQUEUE: prefer raw_smp_processor_id - tee: optee: prevent use-after-free when the client exits before the supplicant - net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS - Disable -Wattribute-alias for clang-23 and newer - RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug - USB: serial: mct_u232: fix memory corruption with small endpoint - usb: core: Fix SuperSpeed root hub wMaxPacketSize - serial: zs: Convert to use a platform device - serial: dz: Convert to use a platform device - serial: dz: Fix bootconsole handover lockup - xhci: tegra: Fix ghost USB device on dual-role port unplug - USB: serial: digi_acceleport: fix memory corruption with small endpoints - landlock: Fix handling of disconnected directories - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync - USB: serial: cypress_m8: fix memory corruption with small endpoint - serial: zs: Switch to using channel reset - serial: zs: Fix bootconsole handover lockup - serial: dz: Fix bootconsole message clobbering at chip reset - drm/amdkfd: Check for pdd drm file first in CRIU restore path - drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger - drm/amdkfd: fix NULL pointer bug in svm_range_set_attr - serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma - serial: zs: Fix swapped RI/DSR modem line transition counting - serial: sh-sci: fix memory region release in error path - serial: qcom-geni: fix UART_RX_PAR_EN bit position - serial: altera_jtaguart: handle uart_add_one_port() failures - drm/amd/pm/si: Disregard vblank time when no displays are connected - drm/i915: Fix potential UAF in TTM object purge - drm/hyperv: validate VMBus packet size in receive callback - drm/hyperv: validate resolution_count and fix WIN8 fallback - scsi: target: iscsi: Validate CHAP_R length before base64 decode - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 - scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker - thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow - thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() - usb: gadget: f_fs: copy only received bytes on short ep0 read - usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports - usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling - usb: gadget: f_hid: fix device reference leak in hidg_alloc() - usb: gadget: net2280: Fix double free in probe error path - USB: serial: mct_u232: fix missing interrupt-in transfer sanity check - USB: serial: mxuport: fix memory corruption with small endpoint - USB: serial: keyspan: fix missing indat transfer sanity check - USB: serial: cypress_m8: validate interrupt packet headers - USB: serial: belkin_sa: validate interrupt status length - USB: serial: option: add MeiG SRM813Q - usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize - usb: usbtmc: check URB actual_length for interrupt-IN notifications - usbip: vudc: Fix use after free bug in vudc_remove due to race condition - usb: storage: Add quirks for PNY Elite Portable SSD - USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers - usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval - usb: chipidea: core: convert ci_role_switch to local variable - tty: serial: pch_uart: add check for dma_alloc_coherent() - counter: Fix refcount leak in counter_alloc() error path - comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() - comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() - Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 - Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem - Input: xpad - add support for ASUS ROG RAIKIRI II - Input: xpad - add "Nova 2 Lite" from GameSir - ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks - ASoC: qcom: q6asm-dai: close stream only when running - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check - xfrm: ah: use skb_to_full_sk in async output callbacks - xfrm: route MIGRATE notifications to caller's netns - nfc: hci: fix out-of-bounds read in HCP header parsing - iommu, debugobjects: avoid gcc-16.1 section mismatch warnings - HID: wacom: Fix OOB write in wacom_hid_set_device_mode() - ip6: vti: Use ip6_tnl.net in vti6_changelink(). - xfrm: input: hold netns during deferred transport reinjection - ipv6: validate extension header length before copying to cmsg - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). - ipv6: exthdrs: refresh nh after handling HAO option - ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() - macsec: fix replay protection at XPN lower-PN wrap - bpf: sockmap: fix tail fragment offset in bpf_msg_push_data - Input: elan_i2c - validate firmware size before use - usb: dwc2: Fix use after free in debug code - usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles - usb: cdns3: gadget: fix request skipping after clearing halt - USB: serial: omninet: fix memory corruption with small endpoint - iio: buffer: hw-consumer: fix use-after-free in error path - iio: light: cm3323: fix reg_conf not being initialized correctly - iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL - iio: temperature: tsys01: fix broken PROM checksum validation - iio: ssp_sensors: cancel delayed work_refresh on remove - iio: gyro: itg3200: fix i2c read into the wrong stack location - iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw - iio: dac: ad5686: acquire lock when doing powerdown control - iio: dac: ad5686: fix input raw value check - iio: dac: max5821: fix return value check in powerdown sync - iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux - wireguard: send: append trailer after expanding head - KVM: arm64: PMU: Preserve AArch32 counter low bits - parport: Fix race between port and client registration - Input: xpad - fix out-of-bounds access for Share button - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock - Bluetooth: ISO: fix UAF in iso_recv_frame - Bluetooth: HIDP: fix missing length checks in hidp_input_report() - auxdisplay: line-display: fix OOB read on zero-length message_store() - hpfs: fix a crash if hpfs_map_dnode_bitmap fails - Bluetooth: btusb: Allow firmware re-download when version matches - HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse - Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() - USB: serial: safe_serial: fix memory corruption with small endpoint - usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT - usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() - usb: typec: altmodes/displayport: validate count before reading Status Update VDO - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO - usb: typec: ucsi: ccg: reject firmware images without a ':' record header - iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer - soc/tegra: pmc: Fix unsafe generic_handle_irq() call - hwmon: (pmbus/adm1266) serialize NVMEM blackbox read with pmbus_lock - hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock - of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() - phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X - drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used - drm/dp: Add eDP 1.5 bit definition - drm/i915/psr: Read Intel DPCD workaround register - drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register - media: rc: fix race between unregister and urb/irq callbacks - batman-adv: bla: avoid double decrement of bla.num_requests - batman-adv: tt: avoid empty VLAN responses - batman-adv: tt: fix TOCTOU race for reported vlans - batman-adv: tp_meter: directly shut down timer on cleanup - batman-adv: tp_meter: avoid role confusion in tp_list - batman-adv: iv: recover OGM scheduling after forward packet error - batman-adv: tvlv: reject oversized TVLV packets - batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface - batman-adv: tt: reject oversized local TVLV buffers - batman-adv: tvlv: abort OGM send on tvlv append failure - net: skbuff: fix pskb_carve leaking zcopy pages - ipv6: fix possible infinite loop in fib6_select_path() - ipv6: fix possible infinite loop in rt6_fill_node() - sctp: fix race between sctp_wait_for_connect and peeloff - net: mana: Add NULL guards in teardown path to prevent panic on attach failure - gpio: rockchip: convert bank->clk to devm_clk_get_enabled() - Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() - ethtool: eeprom: add more safeties to EEPROM Netlink fallback - ethtool: eeprom: add missing ethnl_ops_begin() / _complete() during fallback - bonding: refuse to enslave CAN devices - Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() - ASoC: codecs: simple-mux: Fix enum control bounds check - ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() - gpio: mxc: fix irq_high handling - net: hsr: fix potential OOB access in supervision frame handling - ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues - net/iucv: fix locking in .getsockopt - net/smc: Do not re-initialize smc hashtables - net: netlink: don't set nsid on local notifications - net: netlink: fix sending unassigned nsid after assigned one - vsock: keep poll shutdown state consistent - netfilter: nf_tables: fix dst corruption in same register operation - netfilter: bitwise: add support for doing AND, OR and XOR directly - netfilter: bitwise: rename some boolean operation functions - netfilter: ebtables: fix OOB read in compat_mtw_from_user - netfilter: xt_cpu: prefer raw_smp_processor_id - netfilter: synproxy: refresh tcphdr after skb_ensure_writable - xfrm: Check for underflow in xfrm_state_mtu - nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() - nfc: llcp: Fix use-after-free in llcp_sock_release() - net: cpsw_new: Fix potential unregister of netdev that has not been registered yet - drm: Remove plane hsub/vsub alignment requirement for core helpers - net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net: mctp: ensure our nlmsg responses are initialised - Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size - MIPS: smp: report dying CPU to RCU in stop_this_cpu() - LoongArch: Report dying CPU to RCU in stop_this_cpu() - irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT - tls: Flush backlog before waiting for a new record - net: ethernet: cortina: No mapping is a dropped rx - batman-adv: fix batadv_skb_is_frag() kernel-doc - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled - Bluetooth: ISO: fix malformed ISO_END/CONT handling - Bluetooth: MGMT: Fix backward compatibility with userspace - security/keys: fix missed RCU read section on lookup - LoongArch: kprobes: Fix handling of fatal unrecoverable recursions - pds_core: ensure null-termination for firmware version strings - pds_core: add an error code check in pdsc_dl_info_get - net: mana: validate rx_req_idx to prevent out-of-bounds array access - ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove() - gpio: cdev: check if uAPI v2 config attributes are correctly zeroed - gpiolib: cdev: use !mem_is_zero() instead of memchr_inv(s, 0, n) - string: add mem_is_zero() helper to check if memory area is all zeros - bpf, skmsg: fix verdict sk_data_ready racing with ktls rx - net: ag71xx: check error for platform_get_irq - Bluetooth: btmtk: rename btmediatek_data - Bluetooth: btusb: mediatek: refactor the function btusb_mtk_reset - Bluetooth: btmtk: add the function to get the fw name - ALSA: seq: Serialize UMP output teardown with event_input - ALSA: seq: ump: Use guard() for locking - pds_core: fix debugfs_lookup dentry leak and error handling - pds_core: fix error handling in pdsc_devcmd_wait - bridge: mcast: Fix a possible use-after-free when removing a bridge port - net: bridge: Flush multicast groups when snooping is disabled - RDMA/rtrs: Fix use-after-free in path file creation cleanup - platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL - platform/x86: intel-hid: Check ACPI_HANDLE() against NULL - platform/x86: hp_accel: Check ACPI_COMPANION() against NULL - platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer - net: dsa: mt7530: preserve VLAN tags on trapped link-local frames - net: dsa: mt7530: rename mt753x_bpdu_port_fw enum to mt753x_to_cpu_fw - net: dsa: mt7530: fix FDB entries not aging out with short timeout - wifi: ath11k: fix peer resolution on rx path when peer_id=0 - drm/msm/snapshot: fix dumping of the unaligned regions - spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache() - net/mlx5: Do not restore destination-less TC rules - tls: Preserve sk_err across recvmsg() when data has been copied - x86/xen: Fix xen_e820_swap_entry_with_ram() - net: phy: DP83TC811: add reading of abilities - net: phy: c45: add genphy_c45_pma_read_ext_abilities() function - net: tls: prevent chain-after-chain in plain text SG - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot - powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise() - drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN - drm/msm/dsi: don't dump registers past the mapped region - ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics - net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint - accel/qaic: Add overflow check to remap_pfn_range during mmap - HID: quirks: really enable the intended work around for appledisplay - wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm() - wifi: ath11k: fix error path leaks in some WMI WOW calls - net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS reference - net: ethernet: cortina: Carry over frag counter - net: ethernet: cortina: Drop half-assembled SKB - net: ethernet: cortina: Make RX SKB per-port - netfs: Fix overrun check in netfs_extract_user_iter() - zonefs: handle integer overflow in zonefs_fname_to_fno - irqchip/ath79-cpu: Remove unused function - phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access - net: lan966x: avoid unregistering netdev on register failure - ice: fix locking in ice_dcb_rebuild() - tcp: Fix imbalanced icsk_accept_queue count. - test_kprobes: clear kprobes between test runs - kprobes: skip non-symbol addresses in kprobe_add_ksym_blacklist() - netfilter: x_tables: unregister the templates first - ALSA: hda: cs35l56: Put ACPI device after setting companion - ARM: integrator: Fix early initialization - pinctrl: qcom: Fix wakeirq map by removing disconnected irqs for sm8150 - kunit: config: KUNIT_DEBUGFS should depend on DEBUG_FS - kunit: config: Enable KUNIT_DEBUGFS by default - firmware: arm_ffa: Skip free_pages on RX buffer alloc failure - firmware: arm_ffa: Check for NULL FF-A ID table while driver registration - HID: uclogic: Fix regression of input name assignment - hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors - hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe() - hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe() - hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in get_multiple - hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR - hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer - hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer - hwmon: (pmbus/adm1266) reject implausible blackbox record_count - hwmon: (pmbus/adm1266) seed timestamp from the real-time clock - batman-adv: tt: fix negative tt_buff_len - batman-adv: tt: fix negative last_changeset_len - batman-adv: tp_meter: fix race condition in send error reporting - batman-adv: tp_meter: avoid use of uninit sender vars - batman-adv: bla: fix report_work leak on backbone_gw purge - batman-adv: frag: disallow unicast fragment in fragment - batman-adv: fix fragment reassembly length accounting - batman-adv: dat: handle forward allocation error - batman-adv: clear current gateway during teardown - batman-adv: mcast: fix use-after-free in orig_node RCU release - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async - drm/amd/display: Validate GPIO pin LUT table size before iterating - drm/amd/display: Fix integer overflow in bios_get_image() - drm/bridge: megachips: remove bridge when irq request fails - drm/bridge: it66121: acquire reset GPIO in probe - drm/virtio: use uninterruptible resv lock for plane updates - device property: set fwnode->secondary to NULL in fwnode_init() - LoongArch: Remove unused code to avoid build warning - RDMA/siw: Reject MPA FPDU length underflow before signed receive math - spi: ti-qspi: fix use-after-free after DMA setup failure - spi: sprd: fix error pointer deref after DMA setup failure - scsi: isci: Fix use-after-free in device removal path - phy: tegra: xusb: Fix per-pad high-speed termination calibration - spi: qup: fix error pointer deref after DMA setup failure - drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe - KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits - arm64: probes: Handle probes on hinted conditional branch instructions - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() - ice: fix setting promisc mode while adding VID filter - ixgbevf: fix use-after-free in VEPA multicast source pruning - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 - wifi: ath11k: clear shared SRNG pointer state on restart - vsock/vmci: fix UAF when peer resets connection during handshake - ring-buffer: Fix reporting of missed events in iterator - qed: fix double free in qed_cxt_tables_alloc() - netfilter: ipset: stop hash:* range iteration at end - netfilter: nf_queue: hold bridge skb->dev while queued - netfilter: ip6t_hbh: reject oversized option lists - net: ifb: report ethtool stats over num_tx_queues - net: bcmgenet: keep RBUF EEE/PM disabled - phonet/pep: disable BH around forwarded sk_receive_skb() - Bluetooth: MGMT: validate Add Extended Advertising Data length - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths - Bluetooth: bnep: Fix UAF read of dev->name - Bluetooth: ISO: drop ISO_END frames received without prior ISO_START - net: wwan: iosm: fix potential memory leaks in ipc_imem_init() - drivers/base/memory: fix memory block reference leak in poison accounting - efi: Allocate runtime workqueue before ACPI init - ALSA: asihpi: Fix potential OOB array access at reading cache - ALSA: pcm: Don't setup bogus iov_iter for silencing - ALSA: ua101: Reject too-short USB descriptors - hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX - smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() - ksmbd: fix null pointer dereference in compare_guid_key() - mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break() - sysfs: don't remove existing directory on update failure - Revert "af_unix: Reject SIOCATMARK on non-stream sockets" - Revert "s390/cio: Update purge function to unregister the unused subchannels" - Revert "ice: Remove jumbo_remove step from TX path" - Revert "ice: fix double-free of tx_buf skb" - Revert "x86/vdso: Fix output operand size of RDPID" - wifi: mac80211: check tdls flag in ieee80211_tdls_oper - s390/debug: Reject zero-length input before trimming a newline - mptcp: pm: ADD_ADDR rtx: free sk if last - mptcp: sync the msk->sndbuf at accept() time - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close - netfilter: revalidate bridge ports - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp - net: bonding: fix NULL pointer dereference in bond_do_ioctl() - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() - udp: clear skb->dev before running a sockmap verdict - crypto: nx - Fix packed layout in struct nx842_crypto_header - crypto: nx - Use static_assert() to check struct sizes - batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown - Revert "ALSA: pcmtest: fix reference leak on failed device registration" - media: rc: ttusbir: fix inverted error logic - media: rc: igorplugusb: fix control request setup packet - batman-adv: tp_meter: fix tp_num leak on kmalloc failure - batman-adv: stop tp_meter sessions during mesh teardown - ALSA: seq: Fix UMP group 16 filtering - ALSA: seq: Notify client and port info changes - ALSA: core: Serialize deferred fasync state checks - ALSA: misc: Use guard() for spin locks - ALSA: hda: cs35l56: Propagate ASP TX source control errors - crypto: nx - Avoid -Wflex-array-member-not-at-end warning - ksmbd: reset rcount per connection in ksmbd_conn_wait_idle_sess_id() - media: rc: igorplugusb: heed coherency rules - ALSA: aoa: Skip devices with no codecs in i2sbus_resume() - media: rc: ttusbir: respect DMA coherency rules - ALSA: aoa: i2sbus: clear stale prepared state - ALSA: aoa: Use guard() for mutex locks - f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally - ksmbd: replace connection list with hash table - ksmbd: use msleep instaed of schedule_timeout_interruptible() - f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io() - smb: move some duplicate definitions to common/smbacl.h - iommu/amd: serialize sequence allocation under concurrent TLB invalidations - x86/shstk: Prevent deadlock during shstk sigreturn - ALSA: pcmtest: Fix resource leaks in module init error paths - ALSA: pcmtest: fix reference leak on failed device registration - ALSA: 6fire: Fix input volume change detection - ALSA: caiaq: Fix control_put() result and cache rollback - ALSA: core: Fix potential data race at fasync handling - Revert "ALSA: usb-audio: Cap the packet size pre-calculations" - ipv6: sit: reload inner IPv6 header after GSO offloads - net: guard timestamp cmsgs to real error queue skbs - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() - netfilter: x_tables: avoid leaking percpu counter pointers - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush - netfilter: require Ethernet MAC header before using eth_hdr() - netfilter: nft_fib: fix stale stack leak via the OIFNAME register - vsock/virtio: reset connection on receiving queue overflow - vsock/virtio: fix skb overhead accounting to preserve full buf_alloc - vsock/virtio: fix potential unbounded skb queue - mptcp: pm: ADD_ADDR rtx: always decrease sk refcount - mptcp: pm: ADD_ADDR rtx: allow ID 0 - ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers - srcu: Use irq_work to start GP in tiny SRCU - irqwork: Move data struct to a types header - types: move struct rcuwait into types.h - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets - wifi: iwlwifi: fix 22000 series SMEM parsing - wifi: iwlwifi: allow IWL_FW_CHECK() with just a string - x86: shadow stacks: proper error handling for mmap lock - net: mvpp2: sync RX data at the hardware packet offset - net: mvpp2: limit XDP frame size to the RX buffer - batman-adv: fix tp_meter counter underflow during shutdown - batman-adv: v: stop OGMv2 on disabled interface - ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger - spi: mpc52xx: fix controller deregistration - thunderbolt: Bound root directory content to block size - selinux: fix overlayfs mmap() and mprotect() access checks - lsm: add backing_file LSM hooks - fs: constify file ptr in backing_file accessor helpers - fs: prepare for adding LSM blob to backing_file - selftests/bpf: Add tests for ld_{abs,ind} failure path in subprogs - bpf: Fix ld_{abs,ind} failure path analysis in subprogs - KVM: x86: Fix shadow paging use-after-free due to unexpected role - Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref - Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() - fix kabi for ppp_defs.h - pppoe: drop PFC frames - netfilter: nat: use kfree_rcu to release ops - drm/i915/gem: Fix phys BO pread/pwrite with offset - selinux: allow multiple opens of /sys/fs/selinux/policy - ksmbd: make ksmbd thread names distinct by client IP - ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path - ALSA: caiaq: Don't abort when no input device is available - ALSA: caiaq: fix usb_dev refcount leak on probe failure - ALSA: caiaq: Handle probe errors properly - ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow - USB: cdc-acm: Fix bit overlap and move quirk definitions to header - ALSA: caiaq: take a reference on the USB device in create_card() - ALSA: usb-audio: apply quirk for MOONDROP JU Jiu - ksmbd: use check_add_overflow() to prevent u16 DACL size overflow - ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment - smb: server: fix max_connections off-by-one in tcp accept path - smb: server: fix active_num_conn leak on transport allocation failure - usb: port: add delay after usb_hub_set_port_power() - USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen - usb: storage: Expand range of matched versions for VL817 quirks entry - xfrm: Wait for RCU readers during policy netns exit - KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing - mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison - thunderbolt: Clamp XDomain response data copy to allocation size - bpf: return VMA snapshot from task_vma iterator - bpf: switch task_vma iterator from mmap_lock to per-VMA locks - bpf: fix mm lifecycle in open-coded task_vma iterator - netfilter: nft_ct: bail out on template ct in get eval - drm/amd/display: Bound VBIOS record-chain walk loops - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size - drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() - netfilter: conntrack_irc: fix possible out-of-bounds read - drm/vc4: fix krealloc() memory leak - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error - f2fs: fix data loss caused by incorrect use of nat_entry flag - bnxt_en: Fix NULL pointer dereference - ipv6: mcast: Fix use-after-free when processing MLD queries - ipvs: clear the svc scheduler ptr early on edit - netfilter: synproxy: add mutex to guard hook reference counting - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list - net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr - netlabel: validate unlabeled address and mask attribute lengths - netfilter: bridge: make ebt_snat ARP rewrite writable - tcp: restrict SO_ATTACH_FILTER to priv users - ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER - Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig - misc: fastrpc: fix DMA address corruption due to find_vma misuse - misc: fastrpc: Fix NULL pointer dereference in rpmsg callback - gpio: mvebu: fix NULL pointer dereference in suspend/resume - Bluetooth: fix memory leak in error path of hci_alloc_dev() - Bluetooth: bnep: reject short frames before parsing - Bluetooth: RFCOMM: validate skb length in MCC handlers - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams - RDMA/srp: bound SRP_RSP sense copy by the received length - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN - net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure - sched/psi: fix race between file release and pressure write - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase - rculist: add list_splice_rcu() for private lists - net: skbuff: fix missing zerocopy reference in pskb_carve helpers - ip6_vti: set netns_immutable on the fallback device. - wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() - wifi: rtw88: debugfs: support multiple adapters debugging - erofs: fix use-after-free on sbi->sync_decompress - net: openvswitch: fix possible kfree_skb of ERR_PTR - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() - md: wake raid456 reshape waiters before suspend - dm cache policy smq: check allocation under invalidate lock - Bluetooth: MGMT: validate advertising TLV before type checks - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend - USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL - USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam - USB: serial: option: add support for Rolling Wireless RW135R-GL - USB: serial: io_edgeport: add support for Blackbox IC135A - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr - netfilter: flowtable: strictly check for maximum number of actions - fuse: reject fuse_notify() pagecache ops on directories - fs/mbcache: cancel shrink work before destroying the cache - smb/client: fix possible infinite loop and oob read in symlink_data() - fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp - ata: libata-scsi: do not needlessly defer commands when using PMP with FBS - ata: libata-scsi: do not use the deferred QC feature on PMPs with CBS - ata: libata-scsi: do not use the deferred QC feature for ATA_DEFER_PORT - ata: libata-scsi: improve readability of ata_scsi_qc_issue() - ata: libata-scsi: fix requeue of deferred ATA PASS-THROUGH commands - ata: libata-eh: Fix detection of deferred qc timeouts - ata: libata: cancel pending work after clearing deferred_qc - ata: libata-core: fix cancellation of a port deferred qc work - ata: libata-scsi: rename and improve ata_qc_done() - ata: libata-scsi: simplify ata_scsi_requeue_deferred_qc() - ata: libata-sata: simplify ata_sas_queuecmd() - ata: libata-core: improve tag checks in ata_qc_issue() - ata: libata-eh: correctly handle deferred qc timeouts - ata: libata-scsi: avoid Non-NCQ command starvation - ata: libata: Introduce ata_port_eh_scheduled() - ext4: handle wraparound when searching for blocks for indirect mapped blocks - ext4: fix error pointer dereference in ext4_mb_load_buddy_gfp() - ext4: always allocate blocks only from groups inode can use - ext4: fix e4b bitmap inconsistency reports - ext4: convert bd_buddy_page to bd_buddy_folio - ext4: convert bd_bitmap_page to bd_bitmap_folio - Revert "ext4: fix e4b bitmap inconsistency reports" - ext4: cleanup for ext4_map_blocks - ext4: rename EXT4_GET_BLOCKS_PRE_IO - ext4: drop extent cache when splitting extent fails - ext4: drop extent cache after doing PARTIAL_VALID1 zeroout - ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O - ext4: correct the comments place for EXT4_EXT_MAY_ZEROOUT - ext4: get rid of ppath in ext4_ext_handle_unwritten_extents() - ext4: get rid of ppath in ext4_ext_convert_to_initialized() - ext4: get rid of ppath in ext4_split_convert_extents() - ext4: get rid of ppath in ext4_split_extent() - ext4: get rid of ppath in ext4_force_split_extent_at() - ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 - ext4: subdivide EXT4_EXT_DATA_VALID1 - Revert "ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O" - ext4: get rid of ppath in ext4_split_extent_at() - ext4: get rid of ppath in ext4_ext_insert_extent() - ext4: get rid of ppath in get_ext_path() - ext4: add new ext4_ext_path_brelse() helper - !24596 [sync]urma: fix workqueue use-after-free in ubagg_exit teardown sequence - urma: fix workqueue use-after-free in ubagg_exit teardown sequence - !24607 ub: udma: Optimize udma jetty id access logic. - ub: udma: Optimize udma jetty id access logic. - !24640 [sync]urma: limit ubcore logs in reuse paths - urma: fix workqueue use-after-free in ubagg_exit teardown sequence - !24669 mm/madvise: add MADV_FCMA_ENABLE to set PF_FOLIO_CMA via madvise - mm/madvise: add MADV_FCMA_ENABLE to set PF_FOLIO_CMA via madvise - !24702 [sync]urma: retry import jetty/jfr on EIO from tpid reuse failure - urma: retry import jetty/jfr on EIO from tpid reuse failure - urma: limit ubagg connect exchange logs * Fri Jul 10 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-145.3.18.151.20260710.aae66044906b - !24753 [sync]urma: drain jfe event lists in batches to avoid soft-lockup - urma: drain jfe event lists in batches to avoid soft-lockup - urma: reduce ubagg topo log noise - !24748 [sync]urma: free completion events outside jfe lock - urma: free jfe events outside lock - urma: free completion events outside jfe lock - !24742 urma: Fix the issue of inaccurate timing for some functions in DFX - !24741 [sync]urma: fix UAF of accessing token_id in log. - urma: Fix the issue of inaccurate timing for some functions in DFX - urma: fix UAF of accessing token_id in log. - !24734 [sync]urma: fix tpid_reuse attached to vtpn causes use_after_free - urma: fix tpid_reuse attached to vtpn causes use_after_free - !24804 [sync]urma: use vzalloc for ubmad tjetty and ini_rtbuffer - !24774 [sync]urma: ratelimit import jetty/jfr error logs - urma: use vzalloc for ubmad tjetty and ini_rtbuffer - !24792 [sync]urma: fix UAF of accessing jfs/jetty in log. - urma: fix UAF of accessing jfs/jetty in log. - urma: ratelimit import jetty/jfr error logs - !24845 [sync]ub/ubdevshm: Support for acquiring va is a sub-range of registered va - ub/ubdevshm: Support for acquiring va is a sub-range of registered va - !24802 [sync]urma: use xarray for ubagg/ubcore session lookup - urma: use xarray for ubagg/ubcore session lookup - !24814 [sync]urma: make ratelimit burst configurable for ubcore/uburma/ubagg - urma: make ratelimit burst configurable for ubcore/uburma/ubagg * Wed Jul 22 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-145.3.22.153.20260722.158daf1d8dea - !24942 [sync]urma: drop param_set_uint_minmax for ratelimit burst setters - urma: drop param_set_uint_minmax for ratelimit burst setters - !25840 sync CVE LTS and bugfix from OLK-6.6 d33ffc8f8580 to 334dfd575ba5 - cgroup/rstat: avoid disabling irqs for O(num_cpu) - netfilter: bridge: eb_tables: close module init race - crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents - netfilter: ebtables: move to two-stage removal scheme - crypto: qat - protect service table iterations with service_lock - Bluetooth: eir: Fix stack OOB write when prepending the Flags AD - drm/edid: fix OOB read in drm_parse_tiled_block() - proc: protect ptrace_may_access() with exec_update_lock (FD links) - vfio/pci: Latch disable_idle_d3 per device - bpf: Fix UAF in sock clone early bailouts - bpf: Disable xfrm_decode_session hook attachment - bpf,fork: wipe ->bpf_storage before bailouts that access it - KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() - crypto: qat - validate RSA CRT component lengths - bpf: Clear rb node linkage when freeing bpf_rb_root - bpf: Add validation for bpf_set_retval argument - bpf: Reject sleepable BPF_LSM_CGROUP programs at load time - bpf: Fix setting retval to -EPERM for cgroup hooks not returning errno - bpf: Guard __get_user acesss with access_ok for uprobe_multi data - i2c: core: fix adapter registration race - ALSA: hda/cs35l41: Fix firmware load work teardown - vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc - iommufd: Break the loop on failure in iommufd_fault_fops_read() - posix-cpu-timers: Prevent UAF caused by non-leader exec() race - iio: event: Fix event FIFO reset race - hwrng: virtio: clamp device-reported used.len at copy_data() - crypto: drbg - Fix returning success on failure in CTR_DRBG - crypto: ecc - Fix carry overflow in vli multiplication - crypto: pcrypt - restore callback for non-parallel fallback - net: openvswitch: reject oversized nested action attrs - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page - e1000e: Fix out-of-bounds MMIO access by validating BAR0 size - xsched: enforce permissions on attribute access - xsched: restrict vstream management to privileged users - rme: use DMA API for virtio in realm world - udf: validate sparing table length as an entry count, not a byte count - smb: client: harden POSIX SID length parsing - smb: client: mask server-provided mode to 07777 in modefromsid - smb: client: Fix next buffer leak in receive_encrypted_standard() - nvmet-auth: validate reply message payload bounds against transfer length - bpf: Reject fragmented frames in devmap - bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized - mm/huge_memory: update file PMD counter before folio_put() - sctp: fix uninit-value in __sctp_rcv_asconf_lookup() - smb: client: reject overlapping data areas in SMB2 responses - smb: client: restrict implied bcc[0] exemption to responses without data area - io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item - writeback: drop now-unnecessary rcu_barrier() in cgroup_writeback_umount() - writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() - writeback: Fix use after free in inode_switch_wbs_work_fn() - writeback: Avoid contention on wb->list_lock when switching inodes - block: skip sync_blockdev() on surprise removal in bdev_mark_dead() - mm: do file ownership checks with the proper mount idmap - tracing: Bound synthetic-field strings with seq_buf - perf/core: Detach event groups during remove_on_exec - bpf: Allow LPM map access from sleepable BPF programs - bpf: Consistently use bpf_rcu_lock_held() everywhere - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC - udf: validate VAT header length against the VAT inode size - isofs: bound Rock Ridge symlink components to the SL record - udf: validate free block extents against the partition length - config: arm64: update CONFIG_FTRACE_STARTUP_TEST not set - crypto: qat - Return pointer directly in adf_ctl_alloc_resources - crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() - drivers/base/memory: set mem->altmap after successful device registration - serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails - serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero - NFS: Prevent resource leak in nfs_alloc_server() - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr - nfsd: check get_user() return when reading princhashlen - fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode - fbdev: modedb: fix a possible UAF in fb_find_mode() - fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var - power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path - 9p: avoid putting oldfid in p9_client_walk() error path - ocfs2: reject oversized group bitmap descriptors - rpmsg: char: Fix use-after-free on probe error path - fpga: region: fix use-after-free in child_regions_with_firmware() - irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove - pNFS: Fix use-after-free in pnfs_update_layout() - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done - hdlc_ppp: sync per-proto timers before freeing hdlc state - gfs2: fix use-after-free in gfs2_qd_dealloc - exfat: fix potential use-after-free in exfat_find_dir_entry() - bpf: use kvfree() for replaced sysctl write buffer - f2fs: keep atomic write retry from zeroing original data - f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node() - f2fs: validate ACL entry sizes in f2fs_acl_from_disk() - f2fs: fix to round down start offset of fallocate for pin file - f2fs: validate compress cache inode only when enabled - wifi: iwlwifi: mvm: fix race condition in PTP removal - wifi: rtw88: usb: fix memory leaks on USB write failures - wifi: rtw88: increase TX report timeout to fix race condition - wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor - wifi: ath11k: fix warning when unbinding - wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S - keys: Pin request_key_auth payload in instantiate paths - KEYS: fix overflow in keyctl_pkey_params_get_2() - err.h: use __always_inline on all error pointer helpers - fbdev: fix use-after-free in store_modes() - NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR - apparmor: mediate the implicit connect of TCP fast open sendmsg - net: skmsg: preserve sg.copy across SG transforms - mac802154: llsec: add skb_cow_data() before in-place crypto - af_unix: Set gc_in_progress to true in unix_gc(). - ntfs3: reject direct userspace writes to reserved $LX* xattrs - ipv4: account for fraggap on the paged allocation path - inet: add indirect call wrapper for getfrag() calls - ipv6: account for fraggap on the paged allocation path - batman-adv: tvlv: avoid race of cifsnotfound handler state - batman-adv: tvlv: enforce 2-byte alignment - batman-adv: dat: prevent false sharing between VLANs - batman-adv: tt: track roam count per VID - batman-adv: tt: don't merge change entries with different VIDs - batman-adv: tp_meter: handle overlapping packets - batman-adv: tp_meter: prevent parallel modifications of last_recv - batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE - batman-adv: tp_meter: restrict number of unacked list entries - batman-adv: v: prevent OGM aggregation on disabled hardif - batman-adv: frag: avoid underflow of TTL - batman-adv: frag: ensure fragment is writable before modifying TTL - batman-adv: fix (m|b)cast csum after decrementing TTL - batman-adv: ensure bcast is writable before modifying TTL - batman-adv: tp_meter: initialize last_recv_time during init - batman-adv: prevent ELP transmission interval underflow - batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE - batman-adv: tp_meter: add only finished tp_vars to lists - batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection - batman-adv: tp_meter: fix fast recovery precondition - batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd - batman-adv: tp_meter: avoid window underflow - batman-adv: tp_meter: initialize dec_cwnd explicitly - batman-adv: tp_meter: initialize dup_acks explicitly - batman-adv: tp_meter: keep unacked list in ascending ordered - eventpoll: rename ep_remove_safe() back to ep_remove() - file: add fput() cleanup helper - media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si - ksmbd: reject non-VALID session in compound request branch - scripts/sorttable: Fix endianness handling in build-time mcount sort - scripts/sorttable: Allow matches to functions before function entry - scripts/sorttable: Use normal sort if theres no relocs in the mcount section - ftrace: Check against is_kernel_text() instead of kaslr_offset() - ftrace: Test mcount_loc addr before calling ftrace_call_addr() - ftrace: Do not over-allocate ftrace memory - ftrace: Have ftrace pages output reflect freed pages - ftrace: Update the mcount_loc check of skipped entries - scripts/sorttable: Zero out weak functions in mcount_loc table - scripts/sorttable: Always use an array for the mcount_loc sorting - scripts/sorttable: Have mcount rela sort use direct values - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 - scripts/sorttable: Use a structure of function pointers for elf helpers - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly - scripts/sorttable: Move code from sorttable.h into sorttable.c - scripts/sorttable: Use uint64_t for mcount sorting - scripts/sorttable: Add helper functions for Elf_Sym - scripts/sorttable: Add helper functions for Elf_Shdr - scripts/sorttable: Add helper functions for Elf_Ehdr - scripts/sorttable: Convert Elf_Sym MACRO over to a union - scripts/sorttable: Replace Elf_Shdr Macro with a union - scripts/sorttable: Convert Elf_Ehdr to union - scripts/sorttable: Make compare_extable() into two functions - scripts/sorttable: Have the ORC code use the _r() functions to read - scripts/sorttable: Remove unneeded Elf_Rel - scripts/sorttable: Remove unused write functions - scripts/sorttable: Remove unused macro defines - fuse: re-lock request before replacing page cache folio - slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD - slimbus: qcom-ngd-ctrl: Fix up platform_driver registration - rxrpc: Fix the ACK parser to extract the SACK table for parsing - net: phonet: free phonet_device after RCU grace period - phonet: Pass net and ifindex to phonet_address_notify(). - phonet: Pass ifindex to fill_addr(). - Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs - hv: utils: handle and propagate errors in kvp_register - regulator: core: fix locking in regulator_resolve_supply() error path - ring-buffer: Remove ring_buffer_read_prepare_sync() - selftests/bpf: Update comments find_equal_scalars->sync_linked_regs - af_unix: Reject SIOCATMARK on non-stream sockets - selftests/bpf: Add test to ensure kprobe_multi is not sleepable - agp/amd64: Fix broken error propagation in agp_amd64_probe() - net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() - i2c: stub: Reject I2C block transfers with invalid length - RDMA/bnxt_re: zero shared page before exposing to userspace - KVM: VMX: Update SVI during runtime APICv activation - ARM: fix branch predictor hardening - ARM: fix hash_name() fault - ARM: allow __do_kernel_fault() to report execution of memory faults - ARM: group is_permission_fault() with is_translation_fault() - debugobjects: Dont call fill_pool() in early boot hardirq context - debugobjects: Do not fill_pool() if pi_blocked_on - debugobjects: Use LD_WAIT_CONFIG instead of LD_WAIT_SLEEP - debugobjects: Allow to refill the pool before SYSTEM_SCHEDULING - batman-adv: tt: prevent TVLV entry number overflow - drm/v3d: Skip CSD when it has zeroed workgroups - drm/v3d: Store the active job inside the queue's state - iov_iter: Fix potential underflow in iov_iter_extract_xarray_pages() - urma: add check type in free driver obj - smb: client: fix double-free in SMB2_close() replay - smb: client: fix double-free in SMB2_flush() replay - smb: client: fix query_info() replay double-free - smb: client: fix query directory replay double-free - smb: client: fix double-free in SMB2_open() replay - smb: client: fix double-free in SMB2_ioctl() replay - smb: client: fix change notify replay double-free - HID: lg-g15: cancel pending work on remove to fix a use-after-free - HID: multitouch: fix out-of-bounds bit access on mt_io_flags - tracing: Prevent out-of-bounds read in glob matching - sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT - !25616 sync CVE LTS and bugfix from OLK-6.6 b72db20c0437 to d33ffc8f8580 - KVM: x86: hyper-v: Bound the bank index when querying sparse banks - MIPS: DEC: Prevent initial console buffer from landing in XKPHYS - ksmbd: fix durable reconnect error path file lifetime - ksmbd: fix use-after-free in smb2_open during durable reconnect - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query - USB: iowarrior: fix use-after-free on disconnect race - usb: iowarrior: remove inherent race with minor number - USB: iowarrior: fix use-after-free on disconnect - apparmor: fix use-after-free in rawdata dedup loop - tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR - bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops - rbd: eliminate a race in lock_dwork draining on unmap - blk-cgroup: fix UAF in __blkcg_rstat_flush() - net: Fix kabi breakage of struct tc_action - net/sched: act_api: use RCU with deferred freeing for action lifecycle - net: Fix kabi breakage of struct header_ops - bonding: prevent potential infinite loop in bond_header_parse() - bonding: fix type confusion in bond_setup_by_slave() - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc - ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL - ASoC: cs35l56: Fix missing calls to wm_adsp2_remove() - time: Fix off-by-one in compat settimeofday() usec validation - scsi: target: Fix hexadecimal CHAP_I handling - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink - ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY - ksmbd: add a permission check for FSCTL_SET_ZERO_DATA - ksmbd: add per-handle permission check to FILE_LINK_INFORMATION - mptcp: fix missing wakeups in edge scenarios - mptcp: add-addr: always drop other suboptions - ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 - RDMA/umem: fix kernel-doc warnings - mm/migrate: don't call folio_putback_active_hugetlb() on dst hugetlb folio - usb: typec: ucsi: Don't update power_supply on power role change if not connected - serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() - thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() - usb: typec: ucsi: Check if power role change actually happened before handling - usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind - usb: dwc3: xilinx: fix error handling in zynqmp init error paths - usb: musb: omap2430: Fix use-after-free in omap2430_probe() - tty: serial: samsung: Remove redundant port lock acquisition in rx helpers - tty: serial: samsung: use u32 for register interactions - serial: samsung_tty: Use port lock wrappers - ALSA: firewire-motu: Protect register DSP event queue positions - memfd: deny writeable mappings when implying SEAL_WRITE - iio: dac: ad5686: fix ref bit initialization for single-channel parts - usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure - iio: chemical: scd30: fix division by zero in write_raw - iio: chemical: scd30: Use guard(mutex) to allow early returns - iio: gyro: adis16260: fix division by zero in write_raw - Bluetooth: hci_qca: Convert timeout from jiffies to ms - Bluetooth: hci_qca: Migrate to serdev specific shutdown function - serdev: Provide a bustype shutdown function - serdev: make serdev_bus_type const - mm/damon/sysfs-schemes: delete tried region in regions_rmdirs() - mptcp: do not drop partial packets - mptcp: introduce the mptcp_init_skb helper - iio: adc: npcm: fix unbalanced clk_disable_unprepare() - iio: adc: npcm: Convert to platform remove callback returning void - octeontx2-pf: avoid double free of pool->stack on AQ init failure - af_unix: Fix UAF read of tail->len in unix_stream_data_wait() - af_unix: Cache state->msg in unix_stream_read_generic(). - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg - net: hsr: defer node table free until after RCU readers - mptcp: pm: fix ADD_ADDR timer infinite retry on option space insufficient - ice: fix VF queue configuration with low MTU values - mptcp: reset rcv wnd on disconnect - mptcp: cleanup fallback dummy mapping generation - octeontx2-af: CGX: add bounds check to cgx_speed_mbps index - octeontx2-af: replace deprecated strncpy with strscpy - cgroup/cpuset: Reset DL migration state on can_attach() failure - fbdev/vt8500lcdfb: Initialize fb_ops with fbdev macros - soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get() - driver core: reject devices with unregistered buses - drm/amd/display: Use krealloc_array() in dal_vector_reserve() - drm/amdgpu: restart the CS if some parts of the VM are still invalidated - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 - drm/amdkfd: fix NULL dereference in get_queue_ids() - slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock - slimbus: qcom-ngd-ctrl: fix OF node refcount - thunderbolt: Limit XDomain response copy to actual frame size - sctp: stream: fully roll back denied add-stream state - mmc: sdhci: add signal voltage switch in sdhci_resume_host - mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC - mmc: litex_mmc: Set mandatory idle clocks before CMD0 - mmc: core: Fix host controller programming for fixed driver type - mm/hugetlb: restore reservation on error in hugetlb folio copy paths - octeontx2-af: fix memory leak in rvu_setup_hw_resources() - nvmem: layouts: onie-tlv: fix hang on unknown types - net: rds: clear i_sends on setup unwind - net: mv643xx: fix OF node refcount - net/mlx5: Reorder completion before putting command entry in cmd_work_handler - misc: fastrpc: fix use-after-free race in fastrpc_map_create - misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context - Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard - i2c: tegra: Fix NOIRQ suspend/resume - i2c: stm32f7: fix timing computation ignoring i2c-analog-filter - i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() - pidfd: refuse access to tasks that have started exiting harder - ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write - vsock/vmci: fix sk_ack_backlog leak on failed handshake - wifi: nl80211: reject oversized EMA RNR lists - selftests: mptcp: add test for extra_subflows underflow on userspace PM - mptcp: sockopt: check timestamping ret value - mptcp: allow subflow rcv wnd to shrink - mptcp: close TOCTOU race while computing rcv_wnd - mptcp: fix retransmission loop when csum is enabled - ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow - ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O - ARM: socfpga: Fix OF node refcount leak in SMP setup - mm/damon/ops-common: call folio_test_lru() after folio_get() - drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info() - ALSA: timer: Fix UAF at snd_timer_user_params() - USB: serial: option: add usb-id for Dell Wireless DW5826e-m - xfrm: espintcp: do not reuse an in-progress partial send - ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL - mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation - tracing/probes: Point the error offset correctly for eprobe argument error - netfilter: nft_tunnel: fix use-after-free on object destroy - clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time - net: mvpp2: build skb from XDP-adjusted data on XDP_PASS - net: mvpp2: refill RX buffers before XDP or skb use - net: mvpp2: Add metadata support for xdp mode - netfilter: nf_log: validate MAC header was set before dumping it - rds: mark snapshot pages dirty in rds_info_getsockopt() - net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion - r8152: handle the return value of usb_reset_device() - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove - net: phy: clean the sfp upstream if phy probing fails - net/mlx4: avoid GCC 10 __bad_copy_from() false positive - ASoC: wm_adsp: Fix NULL dereference when removing firmware controls - arm64: tlb: Allow XZR argument to TLBI ops - KVM: arm64: Remove VPIPT I-cache handling - tools/rv: Fix cleanup after failed trace setup - time: Fix off-by-one in settimeofday() usec validation - ipmi: Fix rcu_read_unlock to srcu_read_unlock in handle_read_event_rsp - ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() - vxlan: vnifilter: fix spurious notification on VNI update - vxlan: vnifilter: send notification on VNI add - octeontx2-af: npc: Fix CPT channel mask in npc_install_flow - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown - ptp: vclock: Switch from RCU to SRCU - net: fec: fix pinctrl default state restore order on resume - net: lan743x: permit VLAN-tagged packets up to configured MTU - net: garp: fix unsigned integer underflow in garp_pdu_parse_attr - hsr: Remove WARN_ONCE() in hsr_addr_is_self(). - net: Annotate sk->sk_write_space() for UDP SOCKMAP. - pcnet32: stop holding device spin lock during napi_complete_done - drm/imx: Fix three kernel-doc warnings in dcss-scaler.c - 6lowpan: fix off-by-one in multicast context address compression - netfilter: xt_NFQUEUE: prefer raw_smp_processor_id - tee: optee: prevent use-after-free when the client exits before the supplicant - net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS - Disable -Wattribute-alias for clang-23 and newer - RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug - USB: serial: mct_u232: fix memory corruption with small endpoint - usb: core: Fix SuperSpeed root hub wMaxPacketSize - serial: zs: Convert to use a platform device - serial: dz: Convert to use a platform device - serial: dz: Fix bootconsole handover lockup - xhci: tegra: Fix ghost USB device on dual-role port unplug - USB: serial: digi_acceleport: fix memory corruption with small endpoints - landlock: Fix handling of disconnected directories - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync - USB: serial: cypress_m8: fix memory corruption with small endpoint - serial: zs: Switch to using channel reset - serial: zs: Fix bootconsole handover lockup - serial: dz: Fix bootconsole message clobbering at chip reset - drm/amdkfd: Check for pdd drm file first in CRIU restore path - drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger - drm/amdkfd: fix NULL pointer bug in svm_range_set_attr - serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma - serial: zs: Fix swapped RI/DSR modem line transition counting - serial: sh-sci: fix memory region release in error path - serial: qcom-geni: fix UART_RX_PAR_EN bit position - serial: altera_jtaguart: handle uart_add_one_port() failures - drm/amd/pm/si: Disregard vblank time when no displays are connected - drm/i915: Fix potential UAF in TTM object purge - drm/hyperv: validate VMBus packet size in receive callback - drm/hyperv: validate resolution_count and fix WIN8 fallback - scsi: target: iscsi: Validate CHAP_R length before base64 decode - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 - scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker - thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow - thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() - usb: gadget: f_fs: copy only received bytes on short ep0 read - usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports - usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling - usb: gadget: f_hid: fix device reference leak in hidg_alloc() - usb: gadget: net2280: Fix double free in probe error path - USB: serial: mct_u232: fix missing interrupt-in transfer sanity check - USB: serial: mxuport: fix memory corruption with small endpoint - USB: serial: keyspan: fix missing indat transfer sanity check - USB: serial: cypress_m8: validate interrupt packet headers - USB: serial: belkin_sa: validate interrupt status length - USB: serial: option: add MeiG SRM813Q - usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize - usb: usbtmc: check URB actual_length for interrupt-IN notifications - usbip: vudc: Fix use after free bug in vudc_remove due to race condition - usb: storage: Add quirks for PNY Elite Portable SSD - USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers - usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval - usb: chipidea: core: convert ci_role_switch to local variable - tty: serial: pch_uart: add check for dma_alloc_coherent() - counter: Fix refcount leak in counter_alloc() error path - comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() - comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() - Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 - Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem - Input: xpad - add support for ASUS ROG RAIKIRI II - Input: xpad - add "Nova 2 Lite" from GameSir - ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks - ASoC: qcom: q6asm-dai: close stream only when running - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check - xfrm: ah: use skb_to_full_sk in async output callbacks - xfrm: route MIGRATE notifications to caller's netns - nfc: hci: fix out-of-bounds read in HCP header parsing - iommu, debugobjects: avoid gcc-16.1 section mismatch warnings - HID: wacom: Fix OOB write in wacom_hid_set_device_mode() - ip6: vti: Use ip6_tnl.net in vti6_changelink(). - xfrm: input: hold netns during deferred transport reinjection - ipv6: validate extension header length before copying to cmsg - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). - ipv6: exthdrs: refresh nh after handling HAO option - ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() - macsec: fix replay protection at XPN lower-PN wrap - bpf: sockmap: fix tail fragment offset in bpf_msg_push_data - Input: elan_i2c - validate firmware size before use - usb: dwc2: Fix use after free in debug code - usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles - usb: cdns3: gadget: fix request skipping after clearing halt - USB: serial: omninet: fix memory corruption with small endpoint - iio: buffer: hw-consumer: fix use-after-free in error path - iio: light: cm3323: fix reg_conf not being initialized correctly - iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL - iio: temperature: tsys01: fix broken PROM checksum validation - iio: ssp_sensors: cancel delayed work_refresh on remove - iio: gyro: itg3200: fix i2c read into the wrong stack location - iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw - iio: dac: ad5686: acquire lock when doing powerdown control - iio: dac: ad5686: fix input raw value check - iio: dac: max5821: fix return value check in powerdown sync - iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux - wireguard: send: append trailer after expanding head - KVM: arm64: PMU: Preserve AArch32 counter low bits - parport: Fix race between port and client registration - Input: xpad - fix out-of-bounds access for Share button - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock - Bluetooth: ISO: fix UAF in iso_recv_frame - Bluetooth: HIDP: fix missing length checks in hidp_input_report() - auxdisplay: line-display: fix OOB read on zero-length message_store() - hpfs: fix a crash if hpfs_map_dnode_bitmap fails - Bluetooth: btusb: Allow firmware re-download when version matches - HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse - Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() - USB: serial: safe_serial: fix memory corruption with small endpoint - usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT - usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() - usb: typec: altmodes/displayport: validate count before reading Status Update VDO - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO - usb: typec: ucsi: ccg: reject firmware images without a ':' record header - iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer - soc/tegra: pmc: Fix unsafe generic_handle_irq() call - hwmon: (pmbus/adm1266) serialize NVMEM blackbox read with pmbus_lock - hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock - of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() - phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X - drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used - drm/dp: Add eDP 1.5 bit definition - drm/i915/psr: Read Intel DPCD workaround register - drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register - media: rc: fix race between unregister and urb/irq callbacks - batman-adv: bla: avoid double decrement of bla.num_requests - batman-adv: tt: avoid empty VLAN responses - batman-adv: tt: fix TOCTOU race for reported vlans - batman-adv: tp_meter: directly shut down timer on cleanup - batman-adv: tp_meter: avoid role confusion in tp_list - batman-adv: iv: recover OGM scheduling after forward packet error - batman-adv: tvlv: reject oversized TVLV packets - batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface - batman-adv: tt: reject oversized local TVLV buffers - batman-adv: tvlv: abort OGM send on tvlv append failure - net: skbuff: fix pskb_carve leaking zcopy pages - ipv6: fix possible infinite loop in fib6_select_path() - ipv6: fix possible infinite loop in rt6_fill_node() - sctp: fix race between sctp_wait_for_connect and peeloff - net: mana: Add NULL guards in teardown path to prevent panic on attach failure - gpio: rockchip: convert bank->clk to devm_clk_get_enabled() - Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() - ethtool: eeprom: add more safeties to EEPROM Netlink fallback - ethtool: eeprom: add missing ethnl_ops_begin() / _complete() during fallback - bonding: refuse to enslave CAN devices - Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() - ASoC: codecs: simple-mux: Fix enum control bounds check - ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() - gpio: mxc: fix irq_high handling - net: hsr: fix potential OOB access in supervision frame handling - ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues - net/iucv: fix locking in .getsockopt - net/smc: Do not re-initialize smc hashtables - net: netlink: don't set nsid on local notifications - net: netlink: fix sending unassigned nsid after assigned one - vsock: keep poll shutdown state consistent - netfilter: nf_tables: fix dst corruption in same register operation - netfilter: bitwise: add support for doing AND, OR and XOR directly - netfilter: bitwise: rename some boolean operation functions - netfilter: ebtables: fix OOB read in compat_mtw_from_user - netfilter: xt_cpu: prefer raw_smp_processor_id - netfilter: synproxy: refresh tcphdr after skb_ensure_writable - xfrm: Check for underflow in xfrm_state_mtu - nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() - nfc: llcp: Fix use-after-free in llcp_sock_release() - net: cpsw_new: Fix potential unregister of netdev that has not been registered yet - drm: Remove plane hsub/vsub alignment requirement for core helpers - net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net: mctp: ensure our nlmsg responses are initialised - Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size - MIPS: smp: report dying CPU to RCU in stop_this_cpu() - LoongArch: Report dying CPU to RCU in stop_this_cpu() - irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT - tls: Flush backlog before waiting for a new record - net: ethernet: cortina: No mapping is a dropped rx - batman-adv: fix batadv_skb_is_frag() kernel-doc - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled - Bluetooth: ISO: fix malformed ISO_END/CONT handling - Bluetooth: MGMT: Fix backward compatibility with userspace - security/keys: fix missed RCU read section on lookup - LoongArch: kprobes: Fix handling of fatal unrecoverable recursions - pds_core: ensure null-termination for firmware version strings - pds_core: add an error code check in pdsc_dl_info_get - net: mana: validate rx_req_idx to prevent out-of-bounds array access - ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove() - gpio: cdev: check if uAPI v2 config attributes are correctly zeroed - gpiolib: cdev: use !mem_is_zero() instead of memchr_inv(s, 0, n) - string: add mem_is_zero() helper to check if memory area is all zeros - bpf, skmsg: fix verdict sk_data_ready racing with ktls rx - net: ag71xx: check error for platform_get_irq - Bluetooth: btmtk: rename btmediatek_data - Bluetooth: btusb: mediatek: refactor the function btusb_mtk_reset - Bluetooth: btmtk: add the function to get the fw name - ALSA: seq: Serialize UMP output teardown with event_input - ALSA: seq: ump: Use guard() for locking - pds_core: fix debugfs_lookup dentry leak and error handling - pds_core: fix error handling in pdsc_devcmd_wait - bridge: mcast: Fix a possible use-after-free when removing a bridge port - net: bridge: Flush multicast groups when snooping is disabled - RDMA/rtrs: Fix use-after-free in path file creation cleanup - platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL - platform/x86: intel-hid: Check ACPI_HANDLE() against NULL - platform/x86: hp_accel: Check ACPI_COMPANION() against NULL - platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer - net: dsa: mt7530: preserve VLAN tags on trapped link-local frames - net: dsa: mt7530: rename mt753x_bpdu_port_fw enum to mt753x_to_cpu_fw - net: dsa: mt7530: fix FDB entries not aging out with short timeout - wifi: ath11k: fix peer resolution on rx path when peer_id=0 - drm/msm/snapshot: fix dumping of the unaligned regions - spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache() - net/mlx5: Do not restore destination-less TC rules - tls: Preserve sk_err across recvmsg() when data has been copied - x86/xen: Fix xen_e820_swap_entry_with_ram() - net: phy: DP83TC811: add reading of abilities - net: phy: c45: add genphy_c45_pma_read_ext_abilities() function - net: tls: prevent chain-after-chain in plain text SG - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot - powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise() - drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN - drm/msm/dsi: don't dump registers past the mapped region - ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics - net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint - accel/qaic: Add overflow check to remap_pfn_range during mmap - HID: quirks: really enable the intended work around for appledisplay - wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm() - wifi: ath11k: fix error path leaks in some WMI WOW calls - net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS reference - net: ethernet: cortina: Carry over frag counter - net: ethernet: cortina: Drop half-assembled SKB - net: ethernet: cortina: Make RX SKB per-port - netfs: Fix overrun check in netfs_extract_user_iter() - zonefs: handle integer overflow in zonefs_fname_to_fno - irqchip/ath79-cpu: Remove unused function - phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access - net: lan966x: avoid unregistering netdev on register failure - ice: fix locking in ice_dcb_rebuild() - tcp: Fix imbalanced icsk_accept_queue count. - test_kprobes: clear kprobes between test runs - kprobes: skip non-symbol addresses in kprobe_add_ksym_blacklist() - netfilter: x_tables: unregister the templates first - ALSA: hda: cs35l56: Put ACPI device after setting companion - ARM: integrator: Fix early initialization - pinctrl: qcom: Fix wakeirq map by removing disconnected irqs for sm8150 - kunit: config: KUNIT_DEBUGFS should depend on DEBUG_FS - kunit: config: Enable KUNIT_DEBUGFS by default - firmware: arm_ffa: Skip free_pages on RX buffer alloc failure - firmware: arm_ffa: Check for NULL FF-A ID table while driver registration - HID: uclogic: Fix regression of input name assignment - hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors - hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe() - hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe() - hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in get_multiple - hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR - hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer - hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer - hwmon: (pmbus/adm1266) reject implausible blackbox record_count - hwmon: (pmbus/adm1266) seed timestamp from the real-time clock - batman-adv: tt: fix negative tt_buff_len - batman-adv: tt: fix negative last_changeset_len - batman-adv: tp_meter: fix race condition in send error reporting - batman-adv: tp_meter: avoid use of uninit sender vars - batman-adv: bla: fix report_work leak on backbone_gw purge - batman-adv: frag: disallow unicast fragment in fragment - batman-adv: fix fragment reassembly length accounting - batman-adv: dat: handle forward allocation error - batman-adv: clear current gateway during teardown - batman-adv: mcast: fix use-after-free in orig_node RCU release - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async - drm/amd/display: Validate GPIO pin LUT table size before iterating - drm/amd/display: Fix integer overflow in bios_get_image() - drm/bridge: megachips: remove bridge when irq request fails - drm/bridge: it66121: acquire reset GPIO in probe - drm/virtio: use uninterruptible resv lock for plane updates - device property: set fwnode->secondary to NULL in fwnode_init() - LoongArch: Remove unused code to avoid build warning - RDMA/siw: Reject MPA FPDU length underflow before signed receive math - spi: ti-qspi: fix use-after-free after DMA setup failure - spi: sprd: fix error pointer deref after DMA setup failure - scsi: isci: Fix use-after-free in device removal path - phy: tegra: xusb: Fix per-pad high-speed termination calibration - spi: qup: fix error pointer deref after DMA setup failure - drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe - KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits - arm64: probes: Handle probes on hinted conditional branch instructions - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() - ice: fix setting promisc mode while adding VID filter - ixgbevf: fix use-after-free in VEPA multicast source pruning - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 - wifi: ath11k: clear shared SRNG pointer state on restart - vsock/vmci: fix UAF when peer resets connection during handshake - ring-buffer: Fix reporting of missed events in iterator - qed: fix double free in qed_cxt_tables_alloc() - netfilter: ipset: stop hash:* range iteration at end - netfilter: nf_queue: hold bridge skb->dev while queued - netfilter: ip6t_hbh: reject oversized option lists - net: ifb: report ethtool stats over num_tx_queues - net: bcmgenet: keep RBUF EEE/PM disabled - phonet/pep: disable BH around forwarded sk_receive_skb() - Bluetooth: MGMT: validate Add Extended Advertising Data length - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths - Bluetooth: bnep: Fix UAF read of dev->name - Bluetooth: ISO: drop ISO_END frames received without prior ISO_START - net: wwan: iosm: fix potential memory leaks in ipc_imem_init() - drivers/base/memory: fix memory block reference leak in poison accounting - efi: Allocate runtime workqueue before ACPI init - ALSA: asihpi: Fix potential OOB array access at reading cache - ALSA: pcm: Don't setup bogus iov_iter for silencing - ALSA: ua101: Reject too-short USB descriptors - hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX - smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() - ksmbd: fix null pointer dereference in compare_guid_key() - mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break() - sysfs: don't remove existing directory on update failure - Revert "af_unix: Reject SIOCATMARK on non-stream sockets" - Revert "s390/cio: Update purge function to unregister the unused subchannels" - Revert "ice: Remove jumbo_remove step from TX path" - Revert "ice: fix double-free of tx_buf skb" - Revert "x86/vdso: Fix output operand size of RDPID" - wifi: mac80211: check tdls flag in ieee80211_tdls_oper - s390/debug: Reject zero-length input before trimming a newline - mptcp: pm: ADD_ADDR rtx: free sk if last - mptcp: sync the msk->sndbuf at accept() time - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close - netfilter: revalidate bridge ports - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp - net: bonding: fix NULL pointer dereference in bond_do_ioctl() - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() - udp: clear skb->dev before running a sockmap verdict - crypto: nx - Fix packed layout in struct nx842_crypto_header - crypto: nx - Use static_assert() to check struct sizes - batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown - Revert "ALSA: pcmtest: fix reference leak on failed device registration" - media: rc: ttusbir: fix inverted error logic - media: rc: igorplugusb: fix control request setup packet - batman-adv: tp_meter: fix tp_num leak on kmalloc failure - batman-adv: stop tp_meter sessions during mesh teardown - ALSA: seq: Fix UMP group 16 filtering - ALSA: seq: Notify client and port info changes - ALSA: core: Serialize deferred fasync state checks - ALSA: misc: Use guard() for spin locks - ALSA: hda: cs35l56: Propagate ASP TX source control errors - crypto: nx - Avoid -Wflex-array-member-not-at-end warning - ksmbd: reset rcount per connection in ksmbd_conn_wait_idle_sess_id() - media: rc: igorplugusb: heed coherency rules - ALSA: aoa: Skip devices with no codecs in i2sbus_resume() - media: rc: ttusbir: respect DMA coherency rules - ALSA: aoa: i2sbus: clear stale prepared state - ALSA: aoa: Use guard() for mutex locks - f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally - ksmbd: replace connection list with hash table - ksmbd: use msleep instaed of schedule_timeout_interruptible() - f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io() - smb: move some duplicate definitions to common/smbacl.h - iommu/amd: serialize sequence allocation under concurrent TLB invalidations - x86/shstk: Prevent deadlock during shstk sigreturn - ALSA: pcmtest: Fix resource leaks in module init error paths - ALSA: pcmtest: fix reference leak on failed device registration - ALSA: 6fire: Fix input volume change detection - ALSA: caiaq: Fix control_put() result and cache rollback - ALSA: core: Fix potential data race at fasync handling - Revert "ALSA: usb-audio: Cap the packet size pre-calculations" - ipv6: sit: reload inner IPv6 header after GSO offloads - net: guard timestamp cmsgs to real error queue skbs - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() - netfilter: x_tables: avoid leaking percpu counter pointers - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush - netfilter: require Ethernet MAC header before using eth_hdr() - netfilter: nft_fib: fix stale stack leak via the OIFNAME register - vsock/virtio: reset connection on receiving queue overflow - vsock/virtio: fix skb overhead accounting to preserve full buf_alloc - vsock/virtio: fix potential unbounded skb queue - mptcp: pm: ADD_ADDR rtx: always decrease sk refcount - mptcp: pm: ADD_ADDR rtx: allow ID 0 - ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers - srcu: Use irq_work to start GP in tiny SRCU - irqwork: Move data struct to a types header - types: move struct rcuwait into types.h - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets - wifi: iwlwifi: fix 22000 series SMEM parsing - wifi: iwlwifi: allow IWL_FW_CHECK() with just a string - x86: shadow stacks: proper error handling for mmap lock - net: mvpp2: sync RX data at the hardware packet offset - net: mvpp2: limit XDP frame size to the RX buffer - batman-adv: fix tp_meter counter underflow during shutdown - batman-adv: v: stop OGMv2 on disabled interface - ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger - spi: mpc52xx: fix controller deregistration - thunderbolt: Bound root directory content to block size - selinux: fix overlayfs mmap() and mprotect() access checks - lsm: add backing_file LSM hooks - fs: constify file ptr in backing_file accessor helpers - fs: prepare for adding LSM blob to backing_file - selftests/bpf: Add tests for ld_{abs,ind} failure path in subprogs - bpf: Fix ld_{abs,ind} failure path analysis in subprogs - KVM: x86: Fix shadow paging use-after-free due to unexpected role - Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref - Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() - fix kabi for ppp_defs.h - pppoe: drop PFC frames - netfilter: nat: use kfree_rcu to release ops - drm/i915/gem: Fix phys BO pread/pwrite with offset - selinux: allow multiple opens of /sys/fs/selinux/policy - ksmbd: make ksmbd thread names distinct by client IP - ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path - ALSA: caiaq: Don't abort when no input device is available - ALSA: caiaq: fix usb_dev refcount leak on probe failure - ALSA: caiaq: Handle probe errors properly - ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow - USB: cdc-acm: Fix bit overlap and move quirk definitions to header - ALSA: caiaq: take a reference on the USB device in create_card() - ALSA: usb-audio: apply quirk for MOONDROP JU Jiu - ksmbd: use check_add_overflow() to prevent u16 DACL size overflow - ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment - smb: server: fix max_connections off-by-one in tcp accept path - smb: server: fix active_num_conn leak on transport allocation failure - usb: port: add delay after usb_hub_set_port_power() - USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen - usb: storage: Expand range of matched versions for VL817 quirks entry - xfrm: Wait for RCU readers during policy netns exit - KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing - mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison - thunderbolt: Clamp XDomain response data copy to allocation size - bpf: return VMA snapshot from task_vma iterator - bpf: switch task_vma iterator from mmap_lock to per-VMA locks - bpf: fix mm lifecycle in open-coded task_vma iterator - netfilter: nft_ct: bail out on template ct in get eval - drm/amd/display: Bound VBIOS record-chain walk loops - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size - drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() - netfilter: conntrack_irc: fix possible out-of-bounds read - drm/vc4: fix krealloc() memory leak - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error - f2fs: fix data loss caused by incorrect use of nat_entry flag - bnxt_en: Fix NULL pointer dereference - ipv6: mcast: Fix use-after-free when processing MLD queries - ipvs: clear the svc scheduler ptr early on edit - netfilter: synproxy: add mutex to guard hook reference counting - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list - net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr - netlabel: validate unlabeled address and mask attribute lengths - netfilter: bridge: make ebt_snat ARP rewrite writable - tcp: restrict SO_ATTACH_FILTER to priv users - ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER - Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig - misc: fastrpc: fix DMA address corruption due to find_vma misuse - misc: fastrpc: Fix NULL pointer dereference in rpmsg callback - gpio: mvebu: fix NULL pointer dereference in suspend/resume - Bluetooth: fix memory leak in error path of hci_alloc_dev() - Bluetooth: bnep: reject short frames before parsing - Bluetooth: RFCOMM: validate skb length in MCC handlers - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams - RDMA/srp: bound SRP_RSP sense copy by the received length - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN - net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure - sched/psi: fix race between file release and pressure write - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase - rculist: add list_splice_rcu() for private lists - net: skbuff: fix missing zerocopy reference in pskb_carve helpers - ip6_vti: set netns_immutable on the fallback device. - wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() - wifi: rtw88: debugfs: support multiple adapters debugging - erofs: fix use-after-free on sbi->sync_decompress - net: openvswitch: fix possible kfree_skb of ERR_PTR - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() - md: wake raid456 reshape waiters before suspend - dm cache policy smq: check allocation under invalidate lock - Bluetooth: MGMT: validate advertising TLV before type checks - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend - USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL - USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam - USB: serial: option: add support for Rolling Wireless RW135R-GL - USB: serial: io_edgeport: add support for Blackbox IC135A - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr - netfilter: flowtable: strictly check for maximum number of actions - fuse: reject fuse_notify() pagecache ops on directories - fs/mbcache: cancel shrink work before destroying the cache - smb/client: fix possible infinite loop and oob read in symlink_data() - fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp - ata: libata-scsi: do not needlessly defer commands when using PMP with FBS - ata: libata-scsi: do not use the deferred QC feature on PMPs with CBS - ata: libata-scsi: do not use the deferred QC feature for ATA_DEFER_PORT - ata: libata-scsi: improve readability of ata_scsi_qc_issue() - ata: libata-scsi: fix requeue of deferred ATA PASS-THROUGH commands - ata: libata-eh: Fix detection of deferred qc timeouts - ata: libata: cancel pending work after clearing deferred_qc - ata: libata-core: fix cancellation of a port deferred qc work - ata: libata-scsi: rename and improve ata_qc_done() - ata: libata-scsi: simplify ata_scsi_requeue_deferred_qc() - ata: libata-sata: simplify ata_sas_queuecmd() - ata: libata-core: improve tag checks in ata_qc_issue() - ata: libata-eh: correctly handle deferred qc timeouts - ata: libata-scsi: avoid Non-NCQ command starvation - ata: libata: Introduce ata_port_eh_scheduled() - ext4: handle wraparound when searching for blocks for indirect mapped blocks - ext4: fix error pointer dereference in ext4_mb_load_buddy_gfp() - ext4: always allocate blocks only from groups inode can use - ext4: fix e4b bitmap inconsistency reports - ext4: convert bd_buddy_page to bd_buddy_folio - ext4: convert bd_bitmap_page to bd_bitmap_folio - Revert "ext4: fix e4b bitmap inconsistency reports" - ext4: cleanup for ext4_map_blocks - ext4: rename EXT4_GET_BLOCKS_PRE_IO - ext4: drop extent cache when splitting extent fails - ext4: drop extent cache after doing PARTIAL_VALID1 zeroout - ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O - ext4: correct the comments place for EXT4_EXT_MAY_ZEROOUT - ext4: get rid of ppath in ext4_ext_handle_unwritten_extents() - ext4: get rid of ppath in ext4_ext_convert_to_initialized() - ext4: get rid of ppath in ext4_split_convert_extents() - ext4: get rid of ppath in ext4_split_extent() - ext4: get rid of ppath in ext4_force_split_extent_at() - ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 - ext4: subdivide EXT4_EXT_DATA_VALID1 - Revert "ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O" - ext4: get rid of ppath in ext4_split_extent_at() - ext4: get rid of ppath in ext4_ext_insert_extent() - ext4: get rid of ppath in get_ext_path() - ext4: add new ext4_ext_path_brelse() helper - !24596 [sync]urma: fix workqueue use-after-free in ubagg_exit teardown sequence - urma: fix workqueue use-after-free in ubagg_exit teardown sequence - !24607 ub: udma: Optimize udma jetty id access logic. - ub: udma: Optimize udma jetty id access logic. - !24640 [sync]urma: limit ubcore logs in reuse paths - urma: fix workqueue use-after-free in ubagg_exit teardown sequence - !24669 mm/madvise: add MADV_FCMA_ENABLE to set PF_FOLIO_CMA via madvise - mm/madvise: add MADV_FCMA_ENABLE to set PF_FOLIO_CMA via madvise - !24702 [sync]urma: retry import jetty/jfr on EIO from tpid reuse failure - urma: retry import jetty/jfr on EIO from tpid reuse failure - urma: limit ubagg connect exchange logs * Fri Jul 10 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-145.3.18.151.20260710.aae66044906b - !24753 [sync]urma: drain jfe event lists in batches to avoid soft-lockup - urma: drain jfe event lists in batches to avoid soft-lockup - urma: reduce ubagg topo log noise - !24748 [sync]urma: free completion events outside jfe lock - urma: free jfe events outside lock - urma: free completion events outside jfe lock - !24742 urma: Fix the issue of inaccurate timing for some functions in DFX - !24741 [sync]urma: fix UAF of accessing token_id in log. - urma: Fix the issue of inaccurate timing for some functions in DFX - urma: fix UAF of accessing token_id in log. - !24734 [sync]urma: fix tpid_reuse attached to vtpn causes use_after_free - urma: fix tpid_reuse attached to vtpn causes use_after_free - !24804 [sync]urma: use vzalloc for ubmad tjetty and ini_rtbuffer - !24774 [sync]urma: ratelimit import jetty/jfr error logs - urma: use vzalloc for ubmad tjetty and ini_rtbuffer - !24792 [sync]urma: fix UAF of accessing jfs/jetty in log. - urma: fix UAF of accessing jfs/jetty in log. - urma: ratelimit import jetty/jfr error logs - !24845 [sync]ub/ubdevshm: Support for acquiring va is a sub-range of registered va - ub/ubdevshm: Support for acquiring va is a sub-range of registered va - !24802 [sync]urma: use xarray for ubagg/ubcore session lookup - urma: use xarray for ubagg/ubcore session lookup - !24814 [sync]urma: make ratelimit burst configurable for ubcore/uburma/ubagg - urma: make ratelimit burst configurable for ubcore/uburma/ubagg * Wed Jul 22 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-145.3.22.153.20260722.158daf1d8dea - !24942 [sync]urma: drop param_set_uint_minmax for ratelimit burst setters - urma: drop param_set_uint_minmax for ratelimit burst setters - !25840 sync CVE LTS and bugfix from OLK-6.6 d33ffc8f8580 to 334dfd575ba5 - cgroup/rstat: avoid disabling irqs for O(num_cpu) - netfilter: bridge: eb_tables: close module init race - crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents - netfilter: ebtables: move to two-stage removal scheme - crypto: qat - protect service table iterations with service_lock - Bluetooth: eir: Fix stack OOB write when prepending the Flags AD - drm/edid: fix OOB read in drm_parse_tiled_block() - proc: protect ptrace_may_access() with exec_update_lock (FD links) - vfio/pci: Latch disable_idle_d3 per device - bpf: Fix UAF in sock clone early bailouts - bpf: Disable xfrm_decode_session hook attachment - bpf,fork: wipe ->bpf_storage before bailouts that access it - KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() - crypto: qat - validate RSA CRT component lengths - bpf: Clear rb node linkage when freeing bpf_rb_root - bpf: Add validation for bpf_set_retval argument - bpf: Reject sleepable BPF_LSM_CGROUP programs at load time - bpf: Fix setting retval to -EPERM for cgroup hooks not returning errno - bpf: Guard __get_user acesss with access_ok for uprobe_multi data - i2c: core: fix adapter registration race - ALSA: hda/cs35l41: Fix firmware load work teardown - vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc - iommufd: Break the loop on failure in iommufd_fault_fops_read() - posix-cpu-timers: Prevent UAF caused by non-leader exec() race - iio: event: Fix event FIFO reset race - hwrng: virtio: clamp device-reported used.len at copy_data() - crypto: drbg - Fix returning success on failure in CTR_DRBG - crypto: ecc - Fix carry overflow in vli multiplication - crypto: pcrypt - restore callback for non-parallel fallback - net: openvswitch: reject oversized nested action attrs - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page - e1000e: Fix out-of-bounds MMIO access by validating BAR0 size - xsched: enforce permissions on attribute access - xsched: restrict vstream management to privileged users - rme: use DMA API for virtio in realm world - udf: validate sparing table length as an entry count, not a byte count - smb: client: harden POSIX SID length parsing - smb: client: mask server-provided mode to 07777 in modefromsid - smb: client: Fix next buffer leak in receive_encrypted_standard() - nvmet-auth: validate reply message payload bounds against transfer length - bpf: Reject fragmented frames in devmap - bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized - mm/huge_memory: update file PMD counter before folio_put() - sctp: fix uninit-value in __sctp_rcv_asconf_lookup() - smb: client: reject overlapping data areas in SMB2 responses - smb: client: restrict implied bcc[0] exemption to responses without data area - io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item - writeback: drop now-unnecessary rcu_barrier() in cgroup_writeback_umount() - writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() - writeback: Fix use after free in inode_switch_wbs_work_fn() - writeback: Avoid contention on wb->list_lock when switching inodes - block: skip sync_blockdev() on surprise removal in bdev_mark_dead() - mm: do file ownership checks with the proper mount idmap - tracing: Bound synthetic-field strings with seq_buf - perf/core: Detach event groups during remove_on_exec - bpf: Allow LPM map access from sleepable BPF programs - bpf: Consistently use bpf_rcu_lock_held() everywhere - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC - udf: validate VAT header length against the VAT inode size - isofs: bound Rock Ridge symlink components to the SL record - udf: validate free block extents against the partition length - config: arm64: update CONFIG_FTRACE_STARTUP_TEST not set - crypto: qat - Return pointer directly in adf_ctl_alloc_resources - crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() - drivers/base/memory: set mem->altmap after successful device registration - serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails - serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero - NFS: Prevent resource leak in nfs_alloc_server() - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr - nfsd: check get_user() return when reading princhashlen - fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode - fbdev: modedb: fix a possible UAF in fb_find_mode() - fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var - power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path - 9p: avoid putting oldfid in p9_client_walk() error path - ocfs2: reject oversized group bitmap descriptors - rpmsg: char: Fix use-after-free on probe error path - fpga: region: fix use-after-free in child_regions_with_firmware() - irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove - pNFS: Fix use-after-free in pnfs_update_layout() - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done - hdlc_ppp: sync per-proto timers before freeing hdlc state - gfs2: fix use-after-free in gfs2_qd_dealloc - exfat: fix potential use-after-free in exfat_find_dir_entry() - bpf: use kvfree() for replaced sysctl write buffer - f2fs: keep atomic write retry from zeroing original data - f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node() - f2fs: validate ACL entry sizes in f2fs_acl_from_disk() - f2fs: fix to round down start offset of fallocate for pin file - f2fs: validate compress cache inode only when enabled - wifi: iwlwifi: mvm: fix race condition in PTP removal - wifi: rtw88: usb: fix memory leaks on USB write failures - wifi: rtw88: increase TX report timeout to fix race condition - wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor - wifi: ath11k: fix warning when unbinding - wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S - keys: Pin request_key_auth payload in instantiate paths - KEYS: fix overflow in keyctl_pkey_params_get_2() - err.h: use __always_inline on all error pointer helpers - fbdev: fix use-after-free in store_modes() - NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR - apparmor: mediate the implicit connect of TCP fast open sendmsg - net: skmsg: preserve sg.copy across SG transforms - mac802154: llsec: add skb_cow_data() before in-place crypto - af_unix: Set gc_in_progress to true in unix_gc(). - ntfs3: reject direct userspace writes to reserved $LX* xattrs - ipv4: account for fraggap on the paged allocation path - inet: add indirect call wrapper for getfrag() calls - ipv6: account for fraggap on the paged allocation path - batman-adv: tvlv: avoid race of cifsnotfound handler state - batman-adv: tvlv: enforce 2-byte alignment - batman-adv: dat: prevent false sharing between VLANs - batman-adv: tt: track roam count per VID - batman-adv: tt: don't merge change entries with different VIDs - batman-adv: tp_meter: handle overlapping packets - batman-adv: tp_meter: prevent parallel modifications of last_recv - batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE - batman-adv: tp_meter: restrict number of unacked list entries - batman-adv: v: prevent OGM aggregation on disabled hardif - batman-adv: frag: avoid underflow of TTL - batman-adv: frag: ensure fragment is writable before modifying TTL - batman-adv: fix (m|b)cast csum after decrementing TTL - batman-adv: ensure bcast is writable before modifying TTL - batman-adv: tp_meter: initialize last_recv_time during init - batman-adv: prevent ELP transmission interval underflow - batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE - batman-adv: tp_meter: add only finished tp_vars to lists - batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection - batman-adv: tp_meter: fix fast recovery precondition - batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd - batman-adv: tp_meter: avoid window underflow - batman-adv: tp_meter: initialize dec_cwnd explicitly - batman-adv: tp_meter: initialize dup_acks explicitly - batman-adv: tp_meter: keep unacked list in ascending ordered - eventpoll: rename ep_remove_safe() back to ep_remove() - file: add fput() cleanup helper - media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si - ksmbd: reject non-VALID session in compound request branch - scripts/sorttable: Fix endianness handling in build-time mcount sort - scripts/sorttable: Allow matches to functions before function entry - scripts/sorttable: Use normal sort if theres no relocs in the mcount section - ftrace: Check against is_kernel_text() instead of kaslr_offset() - ftrace: Test mcount_loc addr before calling ftrace_call_addr() - ftrace: Do not over-allocate ftrace memory - ftrace: Have ftrace pages output reflect freed pages - ftrace: Update the mcount_loc check of skipped entries - scripts/sorttable: Zero out weak functions in mcount_loc table - scripts/sorttable: Always use an array for the mcount_loc sorting - scripts/sorttable: Have mcount rela sort use direct values - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 - scripts/sorttable: Use a structure of function pointers for elf helpers - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly - scripts/sorttable: Move code from sorttable.h into sorttable.c - scripts/sorttable: Use uint64_t for mcount sorting - scripts/sorttable: Add helper functions for Elf_Sym - scripts/sorttable: Add helper functions for Elf_Shdr - scripts/sorttable: Add helper functions for Elf_Ehdr - scripts/sorttable: Convert Elf_Sym MACRO over to a union - scripts/sorttable: Replace Elf_Shdr Macro with a union - scripts/sorttable: Convert Elf_Ehdr to union - scripts/sorttable: Make compare_extable() into two functions - scripts/sorttable: Have the ORC code use the _r() functions to read - scripts/sorttable: Remove unneeded Elf_Rel - scripts/sorttable: Remove unused write functions - scripts/sorttable: Remove unused macro defines - fuse: re-lock request before replacing page cache folio - slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD - slimbus: qcom-ngd-ctrl: Fix up platform_driver registration - rxrpc: Fix the ACK parser to extract the SACK table for parsing - net: phonet: free phonet_device after RCU grace period - phonet: Pass net and ifindex to phonet_address_notify(). - phonet: Pass ifindex to fill_addr(). - Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs - hv: utils: handle and propagate errors in kvp_register - regulator: core: fix locking in regulator_resolve_supply() error path - ring-buffer: Remove ring_buffer_read_prepare_sync() - selftests/bpf: Update comments find_equal_scalars->sync_linked_regs - af_unix: Reject SIOCATMARK on non-stream sockets - selftests/bpf: Add test to ensure kprobe_multi is not sleepable - agp/amd64: Fix broken error propagation in agp_amd64_probe() - net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() - i2c: stub: Reject I2C block transfers with invalid length - RDMA/bnxt_re: zero shared page before exposing to userspace - KVM: VMX: Update SVI during runtime APICv activation - ARM: fix branch predictor hardening - ARM: fix hash_name() fault - ARM: allow __do_kernel_fault() to report execution of memory faults - ARM: group is_permission_fault() with is_translation_fault() - debugobjects: Dont call fill_pool() in early boot hardirq context - debugobjects: Do not fill_pool() if pi_blocked_on - debugobjects: Use LD_WAIT_CONFIG instead of LD_WAIT_SLEEP - debugobjects: Allow to refill the pool before SYSTEM_SCHEDULING - batman-adv: tt: prevent TVLV entry number overflow - drm/v3d: Skip CSD when it has zeroed workgroups - drm/v3d: Store the active job inside the queue's state - iov_iter: Fix potential underflow in iov_iter_extract_xarray_pages() - urma: add check type in free driver obj - smb: client: fix double-free in SMB2_close() replay - smb: client: fix double-free in SMB2_flush() replay - smb: client: fix query_info() replay double-free - smb: client: fix query directory replay double-free - smb: client: fix double-free in SMB2_open() replay - smb: client: fix double-free in SMB2_ioctl() replay - smb: client: fix change notify replay double-free - HID: lg-g15: cancel pending work on remove to fix a use-after-free - HID: multitouch: fix out-of-bounds bit access on mt_io_flags - tracing: Prevent out-of-bounds read in glob matching - sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT - !25616 sync CVE LTS and bugfix from OLK-6.6 b72db20c0437 to d33ffc8f8580 - KVM: x86: hyper-v: Bound the bank index when querying sparse banks - MIPS: DEC: Prevent initial console buffer from landing in XKPHYS - ksmbd: fix durable reconnect error path file lifetime - ksmbd: fix use-after-free in smb2_open during durable reconnect - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query - USB: iowarrior: fix use-after-free on disconnect race - usb: iowarrior: remove inherent race with minor number - USB: iowarrior: fix use-after-free on disconnect - apparmor: fix use-after-free in rawdata dedup loop - tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR - bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops - rbd: eliminate a race in lock_dwork draining on unmap - blk-cgroup: fix UAF in __blkcg_rstat_flush() - net: Fix kabi breakage of struct tc_action - net/sched: act_api: use RCU with deferred freeing for action lifecycle - net: Fix kabi breakage of struct header_ops - bonding: prevent potential infinite loop in bond_header_parse() - bonding: fix type confusion in bond_setup_by_slave() - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc - ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL - ASoC: cs35l56: Fix missing calls to wm_adsp2_remove() - time: Fix off-by-one in compat settimeofday() usec validation - scsi: target: Fix hexadecimal CHAP_I handling - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink - ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY - ksmbd: add a permission check for FSCTL_SET_ZERO_DATA - ksmbd: add per-handle permission check to FILE_LINK_INFORMATION - mptcp: fix missing wakeups in edge scenarios - mptcp: add-addr: always drop other suboptions - ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 - RDMA/umem: fix kernel-doc warnings - mm/migrate: don't call folio_putback_active_hugetlb() on dst hugetlb folio - usb: typec: ucsi: Don't update power_supply on power role change if not connected - serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() - thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() - usb: typec: ucsi: Check if power role change actually happened before handling - usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind - usb: dwc3: xilinx: fix error handling in zynqmp init error paths - usb: musb: omap2430: Fix use-after-free in omap2430_probe() - tty: serial: samsung: Remove redundant port lock acquisition in rx helpers - tty: serial: samsung: use u32 for register interactions - serial: samsung_tty: Use port lock wrappers - ALSA: firewire-motu: Protect register DSP event queue positions - memfd: deny writeable mappings when implying SEAL_WRITE - iio: dac: ad5686: fix ref bit initialization for single-channel parts - usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure - iio: chemical: scd30: fix division by zero in write_raw - iio: chemical: scd30: Use guard(mutex) to allow early returns - iio: gyro: adis16260: fix division by zero in write_raw - Bluetooth: hci_qca: Convert timeout from jiffies to ms - Bluetooth: hci_qca: Migrate to serdev specific shutdown function - serdev: Provide a bustype shutdown function - serdev: make serdev_bus_type const - mm/damon/sysfs-schemes: delete tried region in regions_rmdirs() - mptcp: do not drop partial packets - mptcp: introduce the mptcp_init_skb helper - iio: adc: npcm: fix unbalanced clk_disable_unprepare() - iio: adc: npcm: Convert to platform remove callback returning void - octeontx2-pf: avoid double free of pool->stack on AQ init failure - af_unix: Fix UAF read of tail->len in unix_stream_data_wait() - af_unix: Cache state->msg in unix_stream_read_generic(). - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg - net: hsr: defer node table free until after RCU readers - mptcp: pm: fix ADD_ADDR timer infinite retry on option space insufficient - ice: fix VF queue configuration with low MTU values - mptcp: reset rcv wnd on disconnect - mptcp: cleanup fallback dummy mapping generation - octeontx2-af: CGX: add bounds check to cgx_speed_mbps index - octeontx2-af: replace deprecated strncpy with strscpy - cgroup/cpuset: Reset DL migration state on can_attach() failure - fbdev/vt8500lcdfb: Initialize fb_ops with fbdev macros - soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get() - driver core: reject devices with unregistered buses - drm/amd/display: Use krealloc_array() in dal_vector_reserve() - drm/amdgpu: restart the CS if some parts of the VM are still invalidated - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 - drm/amdkfd: fix NULL dereference in get_queue_ids() - slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock - slimbus: qcom-ngd-ctrl: fix OF node refcount - thunderbolt: Limit XDomain response copy to actual frame size - sctp: stream: fully roll back denied add-stream state - mmc: sdhci: add signal voltage switch in sdhci_resume_host - mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC - mmc: litex_mmc: Set mandatory idle clocks before CMD0 - mmc: core: Fix host controller programming for fixed driver type - mm/hugetlb: restore reservation on error in hugetlb folio copy paths - octeontx2-af: fix memory leak in rvu_setup_hw_resources() - nvmem: layouts: onie-tlv: fix hang on unknown types - net: rds: clear i_sends on setup unwind - net: mv643xx: fix OF node refcount - net/mlx5: Reorder completion before putting command entry in cmd_work_handler - misc: fastrpc: fix use-after-free race in fastrpc_map_create - misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context - Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard - i2c: tegra: Fix NOIRQ suspend/resume - i2c: stm32f7: fix timing computation ignoring i2c-analog-filter - i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() - pidfd: refuse access to tasks that have started exiting harder - ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write - vsock/vmci: fix sk_ack_backlog leak on failed handshake - wifi: nl80211: reject oversized EMA RNR lists - selftests: mptcp: add test for extra_subflows underflow on userspace PM - mptcp: sockopt: check timestamping ret value - mptcp: allow subflow rcv wnd to shrink - mptcp: close TOCTOU race while computing rcv_wnd - mptcp: fix retransmission loop when csum is enabled - ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow - ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O - ARM: socfpga: Fix OF node refcount leak in SMP setup - mm/damon/ops-common: call folio_test_lru() after folio_get() - drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info() - ALSA: timer: Fix UAF at snd_timer_user_params() - USB: serial: option: add usb-id for Dell Wireless DW5826e-m - xfrm: espintcp: do not reuse an in-progress partial send - ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL - mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation - tracing/probes: Point the error offset correctly for eprobe argument error - netfilter: nft_tunnel: fix use-after-free on object destroy - clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time - net: mvpp2: build skb from XDP-adjusted data on XDP_PASS - net: mvpp2: refill RX buffers before XDP or skb use - net: mvpp2: Add metadata support for xdp mode - netfilter: nf_log: validate MAC header was set before dumping it - rds: mark snapshot pages dirty in rds_info_getsockopt() - net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion - r8152: handle the return value of usb_reset_device() - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove - net: phy: clean the sfp upstream if phy probing fails - net/mlx4: avoid GCC 10 __bad_copy_from() false positive - ASoC: wm_adsp: Fix NULL dereference when removing firmware controls - arm64: tlb: Allow XZR argument to TLBI ops - KVM: arm64: Remove VPIPT I-cache handling - tools/rv: Fix cleanup after failed trace setup - time: Fix off-by-one in settimeofday() usec validation - ipmi: Fix rcu_read_unlock to srcu_read_unlock in handle_read_event_rsp - ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() - vxlan: vnifilter: fix spurious notification on VNI update - vxlan: vnifilter: send notification on VNI add - octeontx2-af: npc: Fix CPT channel mask in npc_install_flow - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown - ptp: vclock: Switch from RCU to SRCU - net: fec: fix pinctrl default state restore order on resume - net: lan743x: permit VLAN-tagged packets up to configured MTU - net: garp: fix unsigned integer underflow in garp_pdu_parse_attr - hsr: Remove WARN_ONCE() in hsr_addr_is_self(). - net: Annotate sk->sk_write_space() for UDP SOCKMAP. - pcnet32: stop holding device spin lock during napi_complete_done - drm/imx: Fix three kernel-doc warnings in dcss-scaler.c - 6lowpan: fix off-by-one in multicast context address compression - netfilter: xt_NFQUEUE: prefer raw_smp_processor_id - tee: optee: prevent use-after-free when the client exits before the supplicant - net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS - Disable -Wattribute-alias for clang-23 and newer - RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug - USB: serial: mct_u232: fix memory corruption with small endpoint - usb: core: Fix SuperSpeed root hub wMaxPacketSize - serial: zs: Convert to use a platform device - serial: dz: Convert to use a platform device - serial: dz: Fix bootconsole handover lockup - xhci: tegra: Fix ghost USB device on dual-role port unplug - USB: serial: digi_acceleport: fix memory corruption with small endpoints - landlock: Fix handling of disconnected directories - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync - USB: serial: cypress_m8: fix memory corruption with small endpoint - serial: zs: Switch to using channel reset - serial: zs: Fix bootconsole handover lockup - serial: dz: Fix bootconsole message clobbering at chip reset - drm/amdkfd: Check for pdd drm file first in CRIU restore path - drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger - drm/amdkfd: fix NULL pointer bug in svm_range_set_attr - serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma - serial: zs: Fix swapped RI/DSR modem line transition counting - serial: sh-sci: fix memory region release in error path - serial: qcom-geni: fix UART_RX_PAR_EN bit position - serial: altera_jtaguart: handle uart_add_one_port() failures - drm/amd/pm/si: Disregard vblank time when no displays are connected - drm/i915: Fix potential UAF in TTM object purge - drm/hyperv: validate VMBus packet size in receive callback - drm/hyperv: validate resolution_count and fix WIN8 fallback - scsi: target: iscsi: Validate CHAP_R length before base64 decode - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 - scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker - thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow - thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() - usb: gadget: f_fs: copy only received bytes on short ep0 read - usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports - usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling - usb: gadget: f_hid: fix device reference leak in hidg_alloc() - usb: gadget: net2280: Fix double free in probe error path - USB: serial: mct_u232: fix missing interrupt-in transfer sanity check - USB: serial: mxuport: fix memory corruption with small endpoint - USB: serial: keyspan: fix missing indat transfer sanity check - USB: serial: cypress_m8: validate interrupt packet headers - USB: serial: belkin_sa: validate interrupt status length - USB: serial: option: add MeiG SRM813Q - usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize - usb: usbtmc: check URB actual_length for interrupt-IN notifications - usbip: vudc: Fix use after free bug in vudc_remove due to race condition - usb: storage: Add quirks for PNY Elite Portable SSD - USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers - usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval - usb: chipidea: core: convert ci_role_switch to local variable - tty: serial: pch_uart: add check for dma_alloc_coherent() - counter: Fix refcount leak in counter_alloc() error path - comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() - comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() - Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 - Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem - Input: xpad - add support for ASUS ROG RAIKIRI II - Input: xpad - add "Nova 2 Lite" from GameSir - ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks - ASoC: qcom: q6asm-dai: close stream only when running - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check - xfrm: ah: use skb_to_full_sk in async output callbacks - xfrm: route MIGRATE notifications to caller's netns - nfc: hci: fix out-of-bounds read in HCP header parsing - iommu, debugobjects: avoid gcc-16.1 section mismatch warnings - HID: wacom: Fix OOB write in wacom_hid_set_device_mode() - ip6: vti: Use ip6_tnl.net in vti6_changelink(). - xfrm: input: hold netns during deferred transport reinjection - ipv6: validate extension header length before copying to cmsg - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). - ipv6: exthdrs: refresh nh after handling HAO option - ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() - macsec: fix replay protection at XPN lower-PN wrap - bpf: sockmap: fix tail fragment offset in bpf_msg_push_data - Input: elan_i2c - validate firmware size before use - usb: dwc2: Fix use after free in debug code - usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles - usb: cdns3: gadget: fix request skipping after clearing halt - USB: serial: omninet: fix memory corruption with small endpoint - iio: buffer: hw-consumer: fix use-after-free in error path - iio: light: cm3323: fix reg_conf not being initialized correctly - iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL - iio: temperature: tsys01: fix broken PROM checksum validation - iio: ssp_sensors: cancel delayed work_refresh on remove - iio: gyro: itg3200: fix i2c read into the wrong stack location - iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw - iio: dac: ad5686: acquire lock when doing powerdown control - iio: dac: ad5686: fix input raw value check - iio: dac: max5821: fix return value check in powerdown sync - iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux - wireguard: send: append trailer after expanding head - KVM: arm64: PMU: Preserve AArch32 counter low bits - parport: Fix race between port and client registration - Input: xpad - fix out-of-bounds access for Share button - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock - Bluetooth: ISO: fix UAF in iso_recv_frame - Bluetooth: HIDP: fix missing length checks in hidp_input_report() - auxdisplay: line-display: fix OOB read on zero-length message_store() - hpfs: fix a crash if hpfs_map_dnode_bitmap fails - Bluetooth: btusb: Allow firmware re-download when version matches - HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse - Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() - USB: serial: safe_serial: fix memory corruption with small endpoint - usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT - usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() - usb: typec: altmodes/displayport: validate count before reading Status Update VDO - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO - usb: typec: ucsi: ccg: reject firmware images without a ':' record header - iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer - soc/tegra: pmc: Fix unsafe generic_handle_irq() call - hwmon: (pmbus/adm1266) serialize NVMEM blackbox read with pmbus_lock - hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock - of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() - phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X - drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used - drm/dp: Add eDP 1.5 bit definition - drm/i915/psr: Read Intel DPCD workaround register - drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register - media: rc: fix race between unregister and urb/irq callbacks - batman-adv: bla: avoid double decrement of bla.num_requests - batman-adv: tt: avoid empty VLAN responses - batman-adv: tt: fix TOCTOU race for reported vlans - batman-adv: tp_meter: directly shut down timer on cleanup - batman-adv: tp_meter: avoid role confusion in tp_list - batman-adv: iv: recover OGM scheduling after forward packet error - batman-adv: tvlv: reject oversized TVLV packets - batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface - batman-adv: tt: reject oversized local TVLV buffers - batman-adv: tvlv: abort OGM send on tvlv append failure - net: skbuff: fix pskb_carve leaking zcopy pages - ipv6: fix possible infinite loop in fib6_select_path() - ipv6: fix possible infinite loop in rt6_fill_node() - sctp: fix race between sctp_wait_for_connect and peeloff - net: mana: Add NULL guards in teardown path to prevent panic on attach failure - gpio: rockchip: convert bank->clk to devm_clk_get_enabled() - Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() - ethtool: eeprom: add more safeties to EEPROM Netlink fallback - ethtool: eeprom: add missing ethnl_ops_begin() / _complete() during fallback - bonding: refuse to enslave CAN devices - Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() - ASoC: codecs: simple-mux: Fix enum control bounds check - ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() - gpio: mxc: fix irq_high handling - net: hsr: fix potential OOB access in supervision frame handling - ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues - net/iucv: fix locking in .getsockopt - net/smc: Do not re-initialize smc hashtables - net: netlink: don't set nsid on local notifications - net: netlink: fix sending unassigned nsid after assigned one - vsock: keep poll shutdown state consistent - netfilter: nf_tables: fix dst corruption in same register operation - netfilter: bitwise: add support for doing AND, OR and XOR directly - netfilter: bitwise: rename some boolean operation functions - netfilter: ebtables: fix OOB read in compat_mtw_from_user - netfilter: xt_cpu: prefer raw_smp_processor_id - netfilter: synproxy: refresh tcphdr after skb_ensure_writable - xfrm: Check for underflow in xfrm_state_mtu - nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() - nfc: llcp: Fix use-after-free in llcp_sock_release() - net: cpsw_new: Fix potential unregister of netdev that has not been registered yet - drm: Remove plane hsub/vsub alignment requirement for core helpers - net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net: mctp: ensure our nlmsg responses are initialised - Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size - MIPS: smp: report dying CPU to RCU in stop_this_cpu() - LoongArch: Report dying CPU to RCU in stop_this_cpu() - irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT - tls: Flush backlog before waiting for a new record - net: ethernet: cortina: No mapping is a dropped rx - batman-adv: fix batadv_skb_is_frag() kernel-doc - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled - Bluetooth: ISO: fix malformed ISO_END/CONT handling - Bluetooth: MGMT: Fix backward compatibility with userspace - security/keys: fix missed RCU read section on lookup - LoongArch: kprobes: Fix handling of fatal unrecoverable recursions - pds_core: ensure null-termination for firmware version strings - pds_core: add an error code check in pdsc_dl_info_get - net: mana: validate rx_req_idx to prevent out-of-bounds array access - ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove() - gpio: cdev: check if uAPI v2 config attributes are correctly zeroed - gpiolib: cdev: use !mem_is_zero() instead of memchr_inv(s, 0, n) - string: add mem_is_zero() helper to check if memory area is all zeros - bpf, skmsg: fix verdict sk_data_ready racing with ktls rx - net: ag71xx: check error for platform_get_irq - Bluetooth: btmtk: rename btmediatek_data - Bluetooth: btusb: mediatek: refactor the function btusb_mtk_reset - Bluetooth: btmtk: add the function to get the fw name - ALSA: seq: Serialize UMP output teardown with event_input - ALSA: seq: ump: Use guard() for locking - pds_core: fix debugfs_lookup dentry leak and error handling - pds_core: fix error handling in pdsc_devcmd_wait - bridge: mcast: Fix a possible use-after-free when removing a bridge port - net: bridge: Flush multicast groups when snooping is disabled - RDMA/rtrs: Fix use-after-free in path file creation cleanup - platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL - platform/x86: intel-hid: Check ACPI_HANDLE() against NULL - platform/x86: hp_accel: Check ACPI_COMPANION() against NULL - platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer - net: dsa: mt7530: preserve VLAN tags on trapped link-local frames - net: dsa: mt7530: rename mt753x_bpdu_port_fw enum to mt753x_to_cpu_fw - net: dsa: mt7530: fix FDB entries not aging out with short timeout - wifi: ath11k: fix peer resolution on rx path when peer_id=0 - drm/msm/snapshot: fix dumping of the unaligned regions - spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache() - net/mlx5: Do not restore destination-less TC rules - tls: Preserve sk_err across recvmsg() when data has been copied - x86/xen: Fix xen_e820_swap_entry_with_ram() - net: phy: DP83TC811: add reading of abilities - net: phy: c45: add genphy_c45_pma_read_ext_abilities() function - net: tls: prevent chain-after-chain in plain text SG - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot - powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise() - drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN - drm/msm/dsi: don't dump registers past the mapped region - ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics - net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint - accel/qaic: Add overflow check to remap_pfn_range during mmap - HID: quirks: really enable the intended work around for appledisplay - wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm() - wifi: ath11k: fix error path leaks in some WMI WOW calls - net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS reference - net: ethernet: cortina: Carry over frag counter - net: ethernet: cortina: Drop half-assembled SKB - net: ethernet: cortina: Make RX SKB per-port - netfs: Fix overrun check in netfs_extract_user_iter() - zonefs: handle integer overflow in zonefs_fname_to_fno - irqchip/ath79-cpu: Remove unused function - phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access - net: lan966x: avoid unregistering netdev on register failure - ice: fix locking in ice_dcb_rebuild() - tcp: Fix imbalanced icsk_accept_queue count. - test_kprobes: clear kprobes between test runs - kprobes: skip non-symbol addresses in kprobe_add_ksym_blacklist() - netfilter: x_tables: unregister the templates first - ALSA: hda: cs35l56: Put ACPI device after setting companion - ARM: integrator: Fix early initialization - pinctrl: qcom: Fix wakeirq map by removing disconnected irqs for sm8150 - kunit: config: KUNIT_DEBUGFS should depend on DEBUG_FS - kunit: config: Enable KUNIT_DEBUGFS by default - firmware: arm_ffa: Skip free_pages on RX buffer alloc failure - firmware: arm_ffa: Check for NULL FF-A ID table while driver registration - HID: uclogic: Fix regression of input name assignment - hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors - hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe() - hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe() - hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in get_multiple - hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR - hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer - hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer - hwmon: (pmbus/adm1266) reject implausible blackbox record_count - hwmon: (pmbus/adm1266) seed timestamp from the real-time clock - batman-adv: tt: fix negative tt_buff_len - batman-adv: tt: fix negative last_changeset_len - batman-adv: tp_meter: fix race condition in send error reporting - batman-adv: tp_meter: avoid use of uninit sender vars - batman-adv: bla: fix report_work leak on backbone_gw purge - batman-adv: frag: disallow unicast fragment in fragment - batman-adv: fix fragment reassembly length accounting - batman-adv: dat: handle forward allocation error - batman-adv: clear current gateway during teardown - batman-adv: mcast: fix use-after-free in orig_node RCU release - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async - drm/amd/display: Validate GPIO pin LUT table size before iterating - drm/amd/display: Fix integer overflow in bios_get_image() - drm/bridge: megachips: remove bridge when irq request fails - drm/bridge: it66121: acquire reset GPIO in probe - drm/virtio: use uninterruptible resv lock for plane updates - device property: set fwnode->secondary to NULL in fwnode_init() - LoongArch: Remove unused code to avoid build warning - RDMA/siw: Reject MPA FPDU length underflow before signed receive math - spi: ti-qspi: fix use-after-free after DMA setup failure - spi: sprd: fix error pointer deref after DMA setup failure - scsi: isci: Fix use-after-free in device removal path - phy: tegra: xusb: Fix per-pad high-speed termination calibration - spi: qup: fix error pointer deref after DMA setup failure - drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe - KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits - arm64: probes: Handle probes on hinted conditional branch instructions - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() - ice: fix setting promisc mode while adding VID filter - ixgbevf: fix use-after-free in VEPA multicast source pruning - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 - wifi: ath11k: clear shared SRNG pointer state on restart - vsock/vmci: fix UAF when peer resets connection during handshake - ring-buffer: Fix reporting of missed events in iterator - qed: fix double free in qed_cxt_tables_alloc() - netfilter: ipset: stop hash:* range iteration at end - netfilter: nf_queue: hold bridge skb->dev while queued - netfilter: ip6t_hbh: reject oversized option lists - net: ifb: report ethtool stats over num_tx_queues - net: bcmgenet: keep RBUF EEE/PM disabled - phonet/pep: disable BH around forwarded sk_receive_skb() - Bluetooth: MGMT: validate Add Extended Advertising Data length - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths - Bluetooth: bnep: Fix UAF read of dev->name - Bluetooth: ISO: drop ISO_END frames received without prior ISO_START - net: wwan: iosm: fix potential memory leaks in ipc_imem_init() - drivers/base/memory: fix memory block reference leak in poison accounting - efi: Allocate runtime workqueue before ACPI init - ALSA: asihpi: Fix potential OOB array access at reading cache - ALSA: pcm: Don't setup bogus iov_iter for silencing - ALSA: ua101: Reject too-short USB descriptors - hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX - smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() - ksmbd: fix null pointer dereference in compare_guid_key() - mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break() - sysfs: don't remove existing directory on update failure - Revert "af_unix: Reject SIOCATMARK on non-stream sockets" - Revert "s390/cio: Update purge function to unregister the unused subchannels" - Revert "ice: Remove jumbo_remove step from TX path" - Revert "ice: fix double-free of tx_buf skb" - Revert "x86/vdso: Fix output operand size of RDPID" - wifi: mac80211: check tdls flag in ieee80211_tdls_oper - s390/debug: Reject zero-length input before trimming a newline - mptcp: pm: ADD_ADDR rtx: free sk if last - mptcp: sync the msk->sndbuf at accept() time - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close - netfilter: revalidate bridge ports - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp - net: bonding: fix NULL pointer dereference in bond_do_ioctl() - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() - udp: clear skb->dev before running a sockmap verdict - crypto: nx - Fix packed layout in struct nx842_crypto_header - crypto: nx - Use static_assert() to check struct sizes - batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown - Revert "ALSA: pcmtest: fix reference leak on failed device registration" - media: rc: ttusbir: fix inverted error logic - media: rc: igorplugusb: fix control request setup packet - batman-adv: tp_meter: fix tp_num leak on kmalloc failure - batman-adv: stop tp_meter sessions during mesh teardown - ALSA: seq: Fix UMP group 16 filtering - ALSA: seq: Notify client and port info changes - ALSA: core: Serialize deferred fasync state checks - ALSA: misc: Use guard() for spin locks - ALSA: hda: cs35l56: Propagate ASP TX source control errors - crypto: nx - Avoid -Wflex-array-member-not-at-end warning - ksmbd: reset rcount per connection in ksmbd_conn_wait_idle_sess_id() - media: rc: igorplugusb: heed coherency rules - ALSA: aoa: Skip devices with no codecs in i2sbus_resume() - media: rc: ttusbir: respect DMA coherency rules - ALSA: aoa: i2sbus: clear stale prepared state - ALSA: aoa: Use guard() for mutex locks - f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally - ksmbd: replace connection list with hash table - ksmbd: use msleep instaed of schedule_timeout_interruptible() - f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io() - smb: move some duplicate definitions to common/smbacl.h - iommu/amd: serialize sequence allocation under concurrent TLB invalidations - x86/shstk: Prevent deadlock during shstk sigreturn - ALSA: pcmtest: Fix resource leaks in module init error paths - ALSA: pcmtest: fix reference leak on failed device registration - ALSA: 6fire: Fix input volume change detection - ALSA: caiaq: Fix control_put() result and cache rollback - ALSA: core: Fix potential data race at fasync handling - Revert "ALSA: usb-audio: Cap the packet size pre-calculations" - ipv6: sit: reload inner IPv6 header after GSO offloads - net: guard timestamp cmsgs to real error queue skbs - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() - netfilter: x_tables: avoid leaking percpu counter pointers - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush - netfilter: require Ethernet MAC header before using eth_hdr() - netfilter: nft_fib: fix stale stack leak via the OIFNAME register - vsock/virtio: reset connection on receiving queue overflow - vsock/virtio: fix skb overhead accounting to preserve full buf_alloc - vsock/virtio: fix potential unbounded skb queue - mptcp: pm: ADD_ADDR rtx: always decrease sk refcount - mptcp: pm: ADD_ADDR rtx: allow ID 0 - ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers - srcu: Use irq_work to start GP in tiny SRCU - irqwork: Move data struct to a types header - types: move struct rcuwait into types.h - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets - wifi: iwlwifi: fix 22000 series SMEM parsing - wifi: iwlwifi: allow IWL_FW_CHECK() with just a string - x86: shadow stacks: proper error handling for mmap lock - net: mvpp2: sync RX data at the hardware packet offset - net: mvpp2: limit XDP frame size to the RX buffer - batman-adv: fix tp_meter counter underflow during shutdown - batman-adv: v: stop OGMv2 on disabled interface - ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger - spi: mpc52xx: fix controller deregistration - thunderbolt: Bound root directory content to block size - selinux: fix overlayfs mmap() and mprotect() access checks - lsm: add backing_file LSM hooks - fs: constify file ptr in backing_file accessor helpers - fs: prepare for adding LSM blob to backing_file - selftests/bpf: Add tests for ld_{abs,ind} failure path in subprogs - bpf: Fix ld_{abs,ind} failure path analysis in subprogs - KVM: x86: Fix shadow paging use-after-free due to unexpected role - Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref - Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() - fix kabi for ppp_defs.h - pppoe: drop PFC frames - netfilter: nat: use kfree_rcu to release ops - drm/i915/gem: Fix phys BO pread/pwrite with offset - selinux: allow multiple opens of /sys/fs/selinux/policy - ksmbd: make ksmbd thread names distinct by client IP - ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path - ALSA: caiaq: Don't abort when no input device is available - ALSA: caiaq: fix usb_dev refcount leak on probe failure - ALSA: caiaq: Handle probe errors properly - ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow - USB: cdc-acm: Fix bit overlap and move quirk definitions to header - ALSA: caiaq: take a reference on the USB device in create_card() - ALSA: usb-audio: apply quirk for MOONDROP JU Jiu - ksmbd: use check_add_overflow() to prevent u16 DACL size overflow - ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment - smb: server: fix max_connections off-by-one in tcp accept path - smb: server: fix active_num_conn leak on transport allocation failure - usb: port: add delay after usb_hub_set_port_power() - USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen - usb: storage: Expand range of matched versions for VL817 quirks entry - xfrm: Wait for RCU readers during policy netns exit - KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing - mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison - thunderbolt: Clamp XDomain response data copy to allocation size - bpf: return VMA snapshot from task_vma iterator - bpf: switch task_vma iterator from mmap_lock to per-VMA locks - bpf: fix mm lifecycle in open-coded task_vma iterator - netfilter: nft_ct: bail out on template ct in get eval - drm/amd/display: Bound VBIOS record-chain walk loops - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size - drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() - netfilter: conntrack_irc: fix possible out-of-bounds read - drm/vc4: fix krealloc() memory leak - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error - f2fs: fix data loss caused by incorrect use of nat_entry flag - bnxt_en: Fix NULL pointer dereference - ipv6: mcast: Fix use-after-free when processing MLD queries - ipvs: clear the svc scheduler ptr early on edit - netfilter: synproxy: add mutex to guard hook reference counting - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list - net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr - netlabel: validate unlabeled address and mask attribute lengths - netfilter: bridge: make ebt_snat ARP rewrite writable - tcp: restrict SO_ATTACH_FILTER to priv users - ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER - Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig - misc: fastrpc: fix DMA address corruption due to find_vma misuse - misc: fastrpc: Fix NULL pointer dereference in rpmsg callback - gpio: mvebu: fix NULL pointer dereference in suspend/resume - Bluetooth: fix memory leak in error path of hci_alloc_dev() - Bluetooth: bnep: reject short frames before parsing - Bluetooth: RFCOMM: validate skb length in MCC handlers - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams - RDMA/srp: bound SRP_RSP sense copy by the received length - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN - net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure - sched/psi: fix race between file release and pressure write - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase - rculist: add list_splice_rcu() for private lists - net: skbuff: fix missing zerocopy reference in pskb_carve helpers - ip6_vti: set netns_immutable on the fallback device. - wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() - wifi: rtw88: debugfs: support multiple adapters debugging - erofs: fix use-after-free on sbi->sync_decompress - net: openvswitch: fix possible kfree_skb of ERR_PTR - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() - md: wake raid456 reshape waiters before suspend - dm cache policy smq: check allocation under invalidate lock - Bluetooth: MGMT: validate advertising TLV before type checks - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend - USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL - USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam - USB: serial: option: add support for Rolling Wireless RW135R-GL - USB: serial: io_edgeport: add support for Blackbox IC135A - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr - netfilter: flowtable: strictly check for maximum number of actions - fuse: reject fuse_notify() pagecache ops on directories - fs/mbcache: cancel shrink work before destroying the cache - smb/client: fix possible infinite loop and oob read in symlink_data() - fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp - ata: libata-scsi: do not needlessly defer commands when using PMP with FBS - ata: libata-scsi: do not use the deferred QC feature on PMPs with CBS - ata: libata-scsi: do not use the deferred QC feature for ATA_DEFER_PORT - ata: libata-scsi: improve readability of ata_scsi_qc_issue() - ata: libata-scsi: fix requeue of deferred ATA PASS-THROUGH commands - ata: libata-eh: Fix detection of deferred qc timeouts - ata: libata: cancel pending work after clearing deferred_qc - ata: libata-core: fix cancellation of a port deferred qc work - ata: libata-scsi: rename and improve ata_qc_done() - ata: libata-scsi: simplify ata_scsi_requeue_deferred_qc() - ata: libata-sata: simplify ata_sas_queuecmd() - ata: libata-core: improve tag checks in ata_qc_issue() - ata: libata-eh: correctly handle deferred qc timeouts - ata: libata-scsi: avoid Non-NCQ command starvation - ata: libata: Introduce ata_port_eh_scheduled() - ext4: handle wraparound when searching for blocks for indirect mapped blocks - ext4: fix error pointer dereference in ext4_mb_load_buddy_gfp() - ext4: always allocate blocks only from groups inode can use - ext4: fix e4b bitmap inconsistency reports - ext4: convert bd_buddy_page to bd_buddy_folio - ext4: convert bd_bitmap_page to bd_bitmap_folio - Revert "ext4: fix e4b bitmap inconsistency reports" - ext4: cleanup for ext4_map_blocks - ext4: rename EXT4_GET_BLOCKS_PRE_IO - ext4: drop extent cache when splitting extent fails - ext4: drop extent cache after doing PARTIAL_VALID1 zeroout - ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O - ext4: correct the comments place for EXT4_EXT_MAY_ZEROOUT - ext4: get rid of ppath in ext4_ext_handle_unwritten_extents() - ext4: get rid of ppath in ext4_ext_convert_to_initialized() - ext4: get rid of ppath in ext4_split_convert_extents() - ext4: get rid of ppath in ext4_split_extent() - ext4: get rid of ppath in ext4_force_split_extent_at() - ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 - ext4: subdivide EXT4_EXT_DATA_VALID1 - Revert "ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O" - ext4: get rid of ppath in ext4_split_extent_at() - ext4: get rid of ppath in ext4_ext_insert_extent() - ext4: get rid of ppath in get_ext_path() - ext4: add new ext4_ext_path_brelse() helper - !24596 [sync]urma: fix workqueue use-after-free in ubagg_exit teardown sequence - urma: fix workqueue use-after-free in ubagg_exit teardown sequence - !24607 ub: udma: Optimize udma jetty id access logic. - ub: udma: Optimize udma jetty id access logic. - !24640 [sync]urma: limit ubcore logs in reuse paths - urma: fix workqueue use-after-free in ubagg_exit teardown sequence - !24669 mm/madvise: add MADV_FCMA_ENABLE to set PF_FOLIO_CMA via madvise - mm/madvise: add MADV_FCMA_ENABLE to set PF_FOLIO_CMA via madvise - !24702 [sync]urma: retry import jetty/jfr on EIO from tpid reuse failure - urma: retry import jetty/jfr on EIO from tpid reuse failure - urma: limit ubagg connect exchange logs * Fri Jul 10 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-145.3.18.151.20260710.aae66044906b - !24753 [sync]urma: drain jfe event lists in batches to avoid soft-lockup - urma: drain jfe event lists in batches to avoid soft-lockup - urma: reduce ubagg topo log noise - !24748 [sync]urma: free completion events outside jfe lock - urma: free jfe events outside lock - urma: free completion events outside jfe lock - !24742 urma: Fix the issue of inaccurate timing for some functions in DFX - !24741 [sync]urma: fix UAF of accessing token_id in log. - urma: Fix the issue of inaccurate timing for some functions in DFX - urma: fix UAF of accessing token_id in log. - !24734 [sync]urma: fix tpid_reuse attached to vtpn causes use_after_free - urma: fix tpid_reuse attached to vtpn causes use_after_free - !24804 [sync]urma: use vzalloc for ubmad tjetty and ini_rtbuffer - !24774 [sync]urma: ratelimit import jetty/jfr error logs - urma: use vzalloc for ubmad tjetty and ini_rtbuffer - !24792 [sync]urma: fix UAF of accessing jfs/jetty in log. - urma: fix UAF of accessing jfs/jetty in log. - urma: ratelimit import jetty/jfr error logs - !24845 [sync]ub/ubdevshm: Support for acquiring va is a sub-range of registered va - ub/ubdevshm: Support for acquiring va is a sub-range of registered va - !24802 [sync]urma: use xarray for ubagg/ubcore session lookup - urma: use xarray for ubagg/ubcore session lookup - !24814 [sync]urma: make ratelimit burst configurable for ubcore/uburma/ubagg - urma: make ratelimit burst configurable for ubcore/uburma/ubagg * Wed Jul 22 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-145.3.22.153.20260722.158daf1d8dea - !24942 [sync]urma: drop param_set_uint_minmax for ratelimit burst setters - urma: drop param_set_uint_minmax for ratelimit burst setters - !25840 sync CVE LTS and bugfix from OLK-6.6 d33ffc8f8580 to 334dfd575ba5 - cgroup/rstat: avoid disabling irqs for O(num_cpu) - netfilter: bridge: eb_tables: close module init race - crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents - netfilter: ebtables: move to two-stage removal scheme - crypto: qat - protect service table iterations with service_lock - Bluetooth: eir: Fix stack OOB write when prepending the Flags AD - drm/edid: fix OOB read in drm_parse_tiled_block() - proc: protect ptrace_may_access() with exec_update_lock (FD links) - vfio/pci: Latch disable_idle_d3 per device - bpf: Fix UAF in sock clone early bailouts - bpf: Disable xfrm_decode_session hook attachment - bpf,fork: wipe ->bpf_storage before bailouts that access it - KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() - crypto: qat - validate RSA CRT component lengths - bpf: Clear rb node linkage when freeing bpf_rb_root - bpf: Add validation for bpf_set_retval argument - bpf: Reject sleepable BPF_LSM_CGROUP programs at load time - bpf: Fix setting retval to -EPERM for cgroup hooks not returning errno - bpf: Guard __get_user acesss with access_ok for uprobe_multi data - i2c: core: fix adapter registration race - ALSA: hda/cs35l41: Fix firmware load work teardown - vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc - iommufd: Break the loop on failure in iommufd_fault_fops_read() - posix-cpu-timers: Prevent UAF caused by non-leader exec() race - iio: event: Fix event FIFO reset race - hwrng: virtio: clamp device-reported used.len at copy_data() - crypto: drbg - Fix returning success on failure in CTR_DRBG - crypto: ecc - Fix carry overflow in vli multiplication - crypto: pcrypt - restore callback for non-parallel fallback - net: openvswitch: reject oversized nested action attrs - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page - e1000e: Fix out-of-bounds MMIO access by validating BAR0 size - xsched: enforce permissions on attribute access - xsched: restrict vstream management to privileged users - rme: use DMA API for virtio in realm world - udf: validate sparing table length as an entry count, not a byte count - smb: client: harden POSIX SID length parsing - smb: client: mask server-provided mode to 07777 in modefromsid - smb: client: Fix next buffer leak in receive_encrypted_standard() - nvmet-auth: validate reply message payload bounds against transfer length - bpf: Reject fragmented frames in devmap - bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized - mm/huge_memory: update file PMD counter before folio_put() - sctp: fix uninit-value in __sctp_rcv_asconf_lookup() - smb: client: reject overlapping data areas in SMB2 responses - smb: client: restrict implied bcc[0] exemption to responses without data area - io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item - writeback: drop now-unnecessary rcu_barrier() in cgroup_writeback_umount() - writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() - writeback: Fix use after free in inode_switch_wbs_work_fn() - writeback: Avoid contention on wb->list_lock when switching inodes - block: skip sync_blockdev() on surprise removal in bdev_mark_dead() - mm: do file ownership checks with the proper mount idmap - tracing: Bound synthetic-field strings with seq_buf - perf/core: Detach event groups during remove_on_exec - bpf: Allow LPM map access from sleepable BPF programs - bpf: Consistently use bpf_rcu_lock_held() everywhere - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC - udf: validate VAT header length against the VAT inode size - isofs: bound Rock Ridge symlink components to the SL record - udf: validate free block extents against the partition length - config: arm64: update CONFIG_FTRACE_STARTUP_TEST not set - crypto: qat - Return pointer directly in adf_ctl_alloc_resources - crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() - drivers/base/memory: set mem->altmap after successful device registration - serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails - serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero - NFS: Prevent resource leak in nfs_alloc_server() - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr - nfsd: check get_user() return when reading princhashlen - fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode - fbdev: modedb: fix a possible UAF in fb_find_mode() - fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var - power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path - 9p: avoid putting oldfid in p9_client_walk() error path - ocfs2: reject oversized group bitmap descriptors - rpmsg: char: Fix use-after-free on probe error path - fpga: region: fix use-after-free in child_regions_with_firmware() - irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove - pNFS: Fix use-after-free in pnfs_update_layout() - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done - hdlc_ppp: sync per-proto timers before freeing hdlc state - gfs2: fix use-after-free in gfs2_qd_dealloc - exfat: fix potential use-after-free in exfat_find_dir_entry() - bpf: use kvfree() for replaced sysctl write buffer - f2fs: keep atomic write retry from zeroing original data - f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node() - f2fs: validate ACL entry sizes in f2fs_acl_from_disk() - f2fs: fix to round down start offset of fallocate for pin file - f2fs: validate compress cache inode only when enabled - wifi: iwlwifi: mvm: fix race condition in PTP removal - wifi: rtw88: usb: fix memory leaks on USB write failures - wifi: rtw88: increase TX report timeout to fix race condition - wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor - wifi: ath11k: fix warning when unbinding - wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S - keys: Pin request_key_auth payload in instantiate paths - KEYS: fix overflow in keyctl_pkey_params_get_2() - err.h: use __always_inline on all error pointer helpers - fbdev: fix use-after-free in store_modes() - NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR - apparmor: mediate the implicit connect of TCP fast open sendmsg - net: skmsg: preserve sg.copy across SG transforms - mac802154: llsec: add skb_cow_data() before in-place crypto - af_unix: Set gc_in_progress to true in unix_gc(). - ntfs3: reject direct userspace writes to reserved $LX* xattrs - ipv4: account for fraggap on the paged allocation path - inet: add indirect call wrapper for getfrag() calls - ipv6: account for fraggap on the paged allocation path - batman-adv: tvlv: avoid race of cifsnotfound handler state - batman-adv: tvlv: enforce 2-byte alignment - batman-adv: dat: prevent false sharing between VLANs - batman-adv: tt: track roam count per VID - batman-adv: tt: don't merge change entries with different VIDs - batman-adv: tp_meter: handle overlapping packets - batman-adv: tp_meter: prevent parallel modifications of last_recv - batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE - batman-adv: tp_meter: restrict number of unacked list entries - batman-adv: v: prevent OGM aggregation on disabled hardif - batman-adv: frag: avoid underflow of TTL - batman-adv: frag: ensure fragment is writable before modifying TTL - batman-adv: fix (m|b)cast csum after decrementing TTL - batman-adv: ensure bcast is writable before modifying TTL - batman-adv: tp_meter: initialize last_recv_time during init - batman-adv: prevent ELP transmission interval underflow - batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE - batman-adv: tp_meter: add only finished tp_vars to lists - batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection - batman-adv: tp_meter: fix fast recovery precondition - batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd - batman-adv: tp_meter: avoid window underflow - batman-adv: tp_meter: initialize dec_cwnd explicitly - batman-adv: tp_meter: initialize dup_acks explicitly - batman-adv: tp_meter: keep unacked list in ascending ordered - eventpoll: rename ep_remove_safe() back to ep_remove() - file: add fput() cleanup helper - media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si - ksmbd: reject non-VALID session in compound request branch - scripts/sorttable: Fix endianness handling in build-time mcount sort - scripts/sorttable: Allow matches to functions before function entry - scripts/sorttable: Use normal sort if theres no relocs in the mcount section - ftrace: Check against is_kernel_text() instead of kaslr_offset() - ftrace: Test mcount_loc addr before calling ftrace_call_addr() - ftrace: Do not over-allocate ftrace memory - ftrace: Have ftrace pages output reflect freed pages - ftrace: Update the mcount_loc check of skipped entries - scripts/sorttable: Zero out weak functions in mcount_loc table - scripts/sorttable: Always use an array for the mcount_loc sorting - scripts/sorttable: Have mcount rela sort use direct values - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 - scripts/sorttable: Use a structure of function pointers for elf helpers - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly - scripts/sorttable: Move code from sorttable.h into sorttable.c - scripts/sorttable: Use uint64_t for mcount sorting - scripts/sorttable: Add helper functions for Elf_Sym - scripts/sorttable: Add helper functions for Elf_Shdr - scripts/sorttable: Add helper functions for Elf_Ehdr - scripts/sorttable: Convert Elf_Sym MACRO over to a union - scripts/sorttable: Replace Elf_Shdr Macro with a union - scripts/sorttable: Convert Elf_Ehdr to union - scripts/sorttable: Make compare_extable() into two functions - scripts/sorttable: Have the ORC code use the _r() functions to read - scripts/sorttable: Remove unneeded Elf_Rel - scripts/sorttable: Remove unused write functions - scripts/sorttable: Remove unused macro defines - fuse: re-lock request before replacing page cache folio - slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD - slimbus: qcom-ngd-ctrl: Fix up platform_driver registration - rxrpc: Fix the ACK parser to extract the SACK table for parsing - net: phonet: free phonet_device after RCU grace period - phonet: Pass net and ifindex to phonet_address_notify(). - phonet: Pass ifindex to fill_addr(). - Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs - hv: utils: handle and propagate errors in kvp_register - regulator: core: fix locking in regulator_resolve_supply() error path - ring-buffer: Remove ring_buffer_read_prepare_sync() - selftests/bpf: Update comments find_equal_scalars->sync_linked_regs - af_unix: Reject SIOCATMARK on non-stream sockets - selftests/bpf: Add test to ensure kprobe_multi is not sleepable - agp/amd64: Fix broken error propagation in agp_amd64_probe() - net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() - i2c: stub: Reject I2C block transfers with invalid length - RDMA/bnxt_re: zero shared page before exposing to userspace - KVM: VMX: Update SVI during runtime APICv activation - ARM: fix branch predictor hardening - ARM: fix hash_name() fault - ARM: allow __do_kernel_fault() to report execution of memory faults - ARM: group is_permission_fault() with is_translation_fault() - debugobjects: Dont call fill_pool() in early boot hardirq context - debugobjects: Do not fill_pool() if pi_blocked_on - debugobjects: Use LD_WAIT_CONFIG instead of LD_WAIT_SLEEP - debugobjects: Allow to refill the pool before SYSTEM_SCHEDULING - batman-adv: tt: prevent TVLV entry number overflow - drm/v3d: Skip CSD when it has zeroed workgroups - drm/v3d: Store the active job inside the queue's state - iov_iter: Fix potential underflow in iov_iter_extract_xarray_pages() - urma: add check type in free driver obj - smb: client: fix double-free in SMB2_close() replay - smb: client: fix double-free in SMB2_flush() replay - smb: client: fix query_info() replay double-free - smb: client: fix query directory replay double-free - smb: client: fix double-free in SMB2_open() replay - smb: client: fix double-free in SMB2_ioctl() replay - smb: client: fix change notify replay double-free - HID: lg-g15: cancel pending work on remove to fix a use-after-free - HID: multitouch: fix out-of-bounds bit access on mt_io_flags - tracing: Prevent out-of-bounds read in glob matching - sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT - !25616 sync CVE LTS and bugfix from OLK-6.6 b72db20c0437 to d33ffc8f8580 - KVM: x86: hyper-v: Bound the bank index when querying sparse banks - MIPS: DEC: Prevent initial console buffer from landing in XKPHYS - ksmbd: fix durable reconnect error path file lifetime - ksmbd: fix use-after-free in smb2_open during durable reconnect - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query - USB: iowarrior: fix use-after-free on disconnect race - usb: iowarrior: remove inherent race with minor number - USB: iowarrior: fix use-after-free on disconnect - apparmor: fix use-after-free in rawdata dedup loop - tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR - bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops - rbd: eliminate a race in lock_dwork draining on unmap - blk-cgroup: fix UAF in __blkcg_rstat_flush() - net: Fix kabi breakage of struct tc_action - net/sched: act_api: use RCU with deferred freeing for action lifecycle - net: Fix kabi breakage of struct header_ops - bonding: prevent potential infinite loop in bond_header_parse() - bonding: fix type confusion in bond_setup_by_slave() - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc - ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL - ASoC: cs35l56: Fix missing calls to wm_adsp2_remove() - time: Fix off-by-one in compat settimeofday() usec validation - scsi: target: Fix hexadecimal CHAP_I handling - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink - ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY - ksmbd: add a permission check for FSCTL_SET_ZERO_DATA - ksmbd: add per-handle permission check to FILE_LINK_INFORMATION - mptcp: fix missing wakeups in edge scenarios - mptcp: add-addr: always drop other suboptions - ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 - RDMA/umem: fix kernel-doc warnings - mm/migrate: don't call folio_putback_active_hugetlb() on dst hugetlb folio - usb: typec: ucsi: Don't update power_supply on power role change if not connected - serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() - thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() - usb: typec: ucsi: Check if power role change actually happened before handling - usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind - usb: dwc3: xilinx: fix error handling in zynqmp init error paths - usb: musb: omap2430: Fix use-after-free in omap2430_probe() - tty: serial: samsung: Remove redundant port lock acquisition in rx helpers - tty: serial: samsung: use u32 for register interactions - serial: samsung_tty: Use port lock wrappers - ALSA: firewire-motu: Protect register DSP event queue positions - memfd: deny writeable mappings when implying SEAL_WRITE - iio: dac: ad5686: fix ref bit initialization for single-channel parts - usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure - iio: chemical: scd30: fix division by zero in write_raw - iio: chemical: scd30: Use guard(mutex) to allow early returns - iio: gyro: adis16260: fix division by zero in write_raw - Bluetooth: hci_qca: Convert timeout from jiffies to ms - Bluetooth: hci_qca: Migrate to serdev specific shutdown function - serdev: Provide a bustype shutdown function - serdev: make serdev_bus_type const - mm/damon/sysfs-schemes: delete tried region in regions_rmdirs() - mptcp: do not drop partial packets - mptcp: introduce the mptcp_init_skb helper - iio: adc: npcm: fix unbalanced clk_disable_unprepare() - iio: adc: npcm: Convert to platform remove callback returning void - octeontx2-pf: avoid double free of pool->stack on AQ init failure - af_unix: Fix UAF read of tail->len in unix_stream_data_wait() - af_unix: Cache state->msg in unix_stream_read_generic(). - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg - net: hsr: defer node table free until after RCU readers - mptcp: pm: fix ADD_ADDR timer infinite retry on option space insufficient - ice: fix VF queue configuration with low MTU values - mptcp: reset rcv wnd on disconnect - mptcp: cleanup fallback dummy mapping generation - octeontx2-af: CGX: add bounds check to cgx_speed_mbps index - octeontx2-af: replace deprecated strncpy with strscpy - cgroup/cpuset: Reset DL migration state on can_attach() failure - fbdev/vt8500lcdfb: Initialize fb_ops with fbdev macros - soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get() - driver core: reject devices with unregistered buses - drm/amd/display: Use krealloc_array() in dal_vector_reserve() - drm/amdgpu: restart the CS if some parts of the VM are still invalidated - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 - drm/amdkfd: fix NULL dereference in get_queue_ids() - slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock - slimbus: qcom-ngd-ctrl: fix OF node refcount - thunderbolt: Limit XDomain response copy to actual frame size - sctp: stream: fully roll back denied add-stream state - mmc: sdhci: add signal voltage switch in sdhci_resume_host - mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC - mmc: litex_mmc: Set mandatory idle clocks before CMD0 - mmc: core: Fix host controller programming for fixed driver type - mm/hugetlb: restore reservation on error in hugetlb folio copy paths - octeontx2-af: fix memory leak in rvu_setup_hw_resources() - nvmem: layouts: onie-tlv: fix hang on unknown types - net: rds: clear i_sends on setup unwind - net: mv643xx: fix OF node refcount - net/mlx5: Reorder completion before putting command entry in cmd_work_handler - misc: fastrpc: fix use-after-free race in fastrpc_map_create - misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context - Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard - i2c: tegra: Fix NOIRQ suspend/resume - i2c: stm32f7: fix timing computation ignoring i2c-analog-filter - i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() - pidfd: refuse access to tasks that have started exiting harder - ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write - vsock/vmci: fix sk_ack_backlog leak on failed handshake - wifi: nl80211: reject oversized EMA RNR lists - selftests: mptcp: add test for extra_subflows underflow on userspace PM - mptcp: sockopt: check timestamping ret value - mptcp: allow subflow rcv wnd to shrink - mptcp: close TOCTOU race while computing rcv_wnd - mptcp: fix retransmission loop when csum is enabled - ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow - ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O - ARM: socfpga: Fix OF node refcount leak in SMP setup - mm/damon/ops-common: call folio_test_lru() after folio_get() - drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info() - ALSA: timer: Fix UAF at snd_timer_user_params() - USB: serial: option: add usb-id for Dell Wireless DW5826e-m - xfrm: espintcp: do not reuse an in-progress partial send - ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL - mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation - tracing/probes: Point the error offset correctly for eprobe argument error - netfilter: nft_tunnel: fix use-after-free on object destroy - clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time - net: mvpp2: build skb from XDP-adjusted data on XDP_PASS - net: mvpp2: refill RX buffers before XDP or skb use - net: mvpp2: Add metadata support for xdp mode - netfilter: nf_log: validate MAC header was set before dumping it - rds: mark snapshot pages dirty in rds_info_getsockopt() - net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion - r8152: handle the return value of usb_reset_device() - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove - net: phy: clean the sfp upstream if phy probing fails - net/mlx4: avoid GCC 10 __bad_copy_from() false positive - ASoC: wm_adsp: Fix NULL dereference when removing firmware controls - arm64: tlb: Allow XZR argument to TLBI ops - KVM: arm64: Remove VPIPT I-cache handling - tools/rv: Fix cleanup after failed trace setup - time: Fix off-by-one in settimeofday() usec validation - ipmi: Fix rcu_read_unlock to srcu_read_unlock in handle_read_event_rsp - ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() - vxlan: vnifilter: fix spurious notification on VNI update - vxlan: vnifilter: send notification on VNI add - octeontx2-af: npc: Fix CPT channel mask in npc_install_flow - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown - ptp: vclock: Switch from RCU to SRCU - net: fec: fix pinctrl default state restore order on resume - net: lan743x: permit VLAN-tagged packets up to configured MTU - net: garp: fix unsigned integer underflow in garp_pdu_parse_attr - hsr: Remove WARN_ONCE() in hsr_addr_is_self(). - net: Annotate sk->sk_write_space() for UDP SOCKMAP. - pcnet32: stop holding device spin lock during napi_complete_done - drm/imx: Fix three kernel-doc warnings in dcss-scaler.c - 6lowpan: fix off-by-one in multicast context address compression - netfilter: xt_NFQUEUE: prefer raw_smp_processor_id - tee: optee: prevent use-after-free when the client exits before the supplicant - net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS - Disable -Wattribute-alias for clang-23 and newer - RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug - USB: serial: mct_u232: fix memory corruption with small endpoint - usb: core: Fix SuperSpeed root hub wMaxPacketSize - serial: zs: Convert to use a platform device - serial: dz: Convert to use a platform device - serial: dz: Fix bootconsole handover lockup - xhci: tegra: Fix ghost USB device on dual-role port unplug - USB: serial: digi_acceleport: fix memory corruption with small endpoints - landlock: Fix handling of disconnected directories - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync - USB: serial: cypress_m8: fix memory corruption with small endpoint - serial: zs: Switch to using channel reset - serial: zs: Fix bootconsole handover lockup - serial: dz: Fix bootconsole message clobbering at chip reset - drm/amdkfd: Check for pdd drm file first in CRIU restore path - drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger - drm/amdkfd: fix NULL pointer bug in svm_range_set_attr - serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma - serial: zs: Fix swapped RI/DSR modem line transition counting - serial: sh-sci: fix memory region release in error path - serial: qcom-geni: fix UART_RX_PAR_EN bit position - serial: altera_jtaguart: handle uart_add_one_port() failures - drm/amd/pm/si: Disregard vblank time when no displays are connected - drm/i915: Fix potential UAF in TTM object purge - drm/hyperv: validate VMBus packet size in receive callback - drm/hyperv: validate resolution_count and fix WIN8 fallback - scsi: target: iscsi: Validate CHAP_R length before base64 decode - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 - scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker - thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow - thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() - usb: gadget: f_fs: copy only received bytes on short ep0 read - usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports - usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling - usb: gadget: f_hid: fix device reference leak in hidg_alloc() - usb: gadget: net2280: Fix double free in probe error path - USB: serial: mct_u232: fix missing interrupt-in transfer sanity check - USB: serial: mxuport: fix memory corruption with small endpoint - USB: serial: keyspan: fix missing indat transfer sanity check - USB: serial: cypress_m8: validate interrupt packet headers - USB: serial: belkin_sa: validate interrupt status length - USB: serial: option: add MeiG SRM813Q - usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize - usb: usbtmc: check URB actual_length for interrupt-IN notifications - usbip: vudc: Fix use after free bug in vudc_remove due to race condition - usb: storage: Add quirks for PNY Elite Portable SSD - USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers - usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval - usb: chipidea: core: convert ci_role_switch to local variable - tty: serial: pch_uart: add check for dma_alloc_coherent() - counter: Fix refcount leak in counter_alloc() error path - comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() - comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() - Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 - Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem - Input: xpad - add support for ASUS ROG RAIKIRI II - Input: xpad - add "Nova 2 Lite" from GameSir - ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks - ASoC: qcom: q6asm-dai: close stream only when running - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check - xfrm: ah: use skb_to_full_sk in async output callbacks - xfrm: route MIGRATE notifications to caller's netns - nfc: hci: fix out-of-bounds read in HCP header parsing - iommu, debugobjects: avoid gcc-16.1 section mismatch warnings - HID: wacom: Fix OOB write in wacom_hid_set_device_mode() - ip6: vti: Use ip6_tnl.net in vti6_changelink(). - xfrm: input: hold netns during deferred transport reinjection - ipv6: validate extension header length before copying to cmsg - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). - ipv6: exthdrs: refresh nh after handling HAO option - ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() - macsec: fix replay protection at XPN lower-PN wrap - bpf: sockmap: fix tail fragment offset in bpf_msg_push_data - Input: elan_i2c - validate firmware size before use - usb: dwc2: Fix use after free in debug code - usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles - usb: cdns3: gadget: fix request skipping after clearing halt - USB: serial: omninet: fix memory corruption with small endpoint - iio: buffer: hw-consumer: fix use-after-free in error path - iio: light: cm3323: fix reg_conf not being initialized correctly - iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL - iio: temperature: tsys01: fix broken PROM checksum validation - iio: ssp_sensors: cancel delayed work_refresh on remove - iio: gyro: itg3200: fix i2c read into the wrong stack location - iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw - iio: dac: ad5686: acquire lock when doing powerdown control - iio: dac: ad5686: fix input raw value check - iio: dac: max5821: fix return value check in powerdown sync - iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux - wireguard: send: append trailer after expanding head - KVM: arm64: PMU: Preserve AArch32 counter low bits - parport: Fix race between port and client registration - Input: xpad - fix out-of-bounds access for Share button - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock - Bluetooth: ISO: fix UAF in iso_recv_frame - Bluetooth: HIDP: fix missing length checks in hidp_input_report() - auxdisplay: line-display: fix OOB read on zero-length message_store() - hpfs: fix a crash if hpfs_map_dnode_bitmap fails - Bluetooth: btusb: Allow firmware re-download when version matches - HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse - Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() - USB: serial: safe_serial: fix memory corruption with small endpoint - usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT - usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() - usb: typec: altmodes/displayport: validate count before reading Status Update VDO - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO - usb: typec: ucsi: ccg: reject firmware images without a ':' record header - iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer - soc/tegra: pmc: Fix unsafe generic_handle_irq() call - hwmon: (pmbus/adm1266) serialize NVMEM blackbox read with pmbus_lock - hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock - of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() - phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X - drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used - drm/dp: Add eDP 1.5 bit definition - drm/i915/psr: Read Intel DPCD workaround register - drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register - media: rc: fix race between unregister and urb/irq callbacks - batman-adv: bla: avoid double decrement of bla.num_requests - batman-adv: tt: avoid empty VLAN responses - batman-adv: tt: fix TOCTOU race for reported vlans - batman-adv: tp_meter: directly shut down timer on cleanup - batman-adv: tp_meter: avoid role confusion in tp_list - batman-adv: iv: recover OGM scheduling after forward packet error - batman-adv: tvlv: reject oversized TVLV packets - batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface - batman-adv: tt: reject oversized local TVLV buffers - batman-adv: tvlv: abort OGM send on tvlv append failure - net: skbuff: fix pskb_carve leaking zcopy pages - ipv6: fix possible infinite loop in fib6_select_path() - ipv6: fix possible infinite loop in rt6_fill_node() - sctp: fix race between sctp_wait_for_connect and peeloff - net: mana: Add NULL guards in teardown path to prevent panic on attach failure - gpio: rockchip: convert bank->clk to devm_clk_get_enabled() - Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() - ethtool: eeprom: add more safeties to EEPROM Netlink fallback - ethtool: eeprom: add missing ethnl_ops_begin() / _complete() during fallback - bonding: refuse to enslave CAN devices - Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() - ASoC: codecs: simple-mux: Fix enum control bounds check - ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() - gpio: mxc: fix irq_high handling - net: hsr: fix potential OOB access in supervision frame handling - ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues - net/iucv: fix locking in .getsockopt - net/smc: Do not re-initialize smc hashtables - net: netlink: don't set nsid on local notifications - net: netlink: fix sending unassigned nsid after assigned one - vsock: keep poll shutdown state consistent - netfilter: nf_tables: fix dst corruption in same register operation - netfilter: bitwise: add support for doing AND, OR and XOR directly - netfilter: bitwise: rename some boolean operation functions - netfilter: ebtables: fix OOB read in compat_mtw_from_user - netfilter: xt_cpu: prefer raw_smp_processor_id - netfilter: synproxy: refresh tcphdr after skb_ensure_writable - xfrm: Check for underflow in xfrm_state_mtu - nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() - nfc: llcp: Fix use-after-free in llcp_sock_release() - net: cpsw_new: Fix potential unregister of netdev that has not been registered yet - drm: Remove plane hsub/vsub alignment requirement for core helpers - net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net: mctp: ensure our nlmsg responses are initialised - Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size - MIPS: smp: report dying CPU to RCU in stop_this_cpu() - LoongArch: Report dying CPU to RCU in stop_this_cpu() - irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT - tls: Flush backlog before waiting for a new record - net: ethernet: cortina: No mapping is a dropped rx - batman-adv: fix batadv_skb_is_frag() kernel-doc - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled - Bluetooth: ISO: fix malformed ISO_END/CONT handling - Bluetooth: MGMT: Fix backward compatibility with userspace - security/keys: fix missed RCU read section on lookup - LoongArch: kprobes: Fix handling of fatal unrecoverable recursions - pds_core: ensure null-termination for firmware version strings - pds_core: add an error code check in pdsc_dl_info_get - net: mana: validate rx_req_idx to prevent out-of-bounds array access - ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove() - gpio: cdev: check if uAPI v2 config attributes are correctly zeroed - gpiolib: cdev: use !mem_is_zero() instead of memchr_inv(s, 0, n) - string: add mem_is_zero() helper to check if memory area is all zeros - bpf, skmsg: fix verdict sk_data_ready racing with ktls rx - net: ag71xx: check error for platform_get_irq - Bluetooth: btmtk: rename btmediatek_data - Bluetooth: btusb: mediatek: refactor the function btusb_mtk_reset - Bluetooth: btmtk: add the function to get the fw name - ALSA: seq: Serialize UMP output teardown with event_input - ALSA: seq: ump: Use guard() for locking - pds_core: fix debugfs_lookup dentry leak and error handling - pds_core: fix error handling in pdsc_devcmd_wait - bridge: mcast: Fix a possible use-after-free when removing a bridge port - net: bridge: Flush multicast groups when snooping is disabled - RDMA/rtrs: Fix use-after-free in path file creation cleanup - platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL - platform/x86: intel-hid: Check ACPI_HANDLE() against NULL - platform/x86: hp_accel: Check ACPI_COMPANION() against NULL - platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer - net: dsa: mt7530: preserve VLAN tags on trapped link-local frames - net: dsa: mt7530: rename mt753x_bpdu_port_fw enum to mt753x_to_cpu_fw - net: dsa: mt7530: fix FDB entries not aging out with short timeout - wifi: ath11k: fix peer resolution on rx path when peer_id=0 - drm/msm/snapshot: fix dumping of the unaligned regions - spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache() - net/mlx5: Do not restore destination-less TC rules - tls: Preserve sk_err across recvmsg() when data has been copied - x86/xen: Fix xen_e820_swap_entry_with_ram() - net: phy: DP83TC811: add reading of abilities - net: phy: c45: add genphy_c45_pma_read_ext_abilities() function - net: tls: prevent chain-after-chain in plain text SG - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot - powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise() - drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN - drm/msm/dsi: don't dump registers past the mapped region - ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics - net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint - accel/qaic: Add overflow check to remap_pfn_range during mmap - HID: quirks: really enable the intended work around for appledisplay - wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm() - wifi: ath11k: fix error path leaks in some WMI WOW calls - net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS reference - net: ethernet: cortina: Carry over frag counter - net: ethernet: cortina: Drop half-assembled SKB - net: ethernet: cortina: Make RX SKB per-port - netfs: Fix overrun check in netfs_extract_user_iter() - zonefs: handle integer overflow in zonefs_fname_to_fno - irqchip/ath79-cpu: Remove unused function - phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access - net: lan966x: avoid unregistering netdev on register failure - ice: fix locking in ice_dcb_rebuild() - tcp: Fix imbalanced icsk_accept_queue count. - test_kprobes: clear kprobes between test runs - kprobes: skip non-symbol addresses in kprobe_add_ksym_blacklist() - netfilter: x_tables: unregister the templates first - ALSA: hda: cs35l56: Put ACPI device after setting companion - ARM: integrator: Fix early initialization - pinctrl: qcom: Fix wakeirq map by removing disconnected irqs for sm8150 - kunit: config: KUNIT_DEBUGFS should depend on DEBUG_FS - kunit: config: Enable KUNIT_DEBUGFS by default - firmware: arm_ffa: Skip free_pages on RX buffer alloc failure - firmware: arm_ffa: Check for NULL FF-A ID table while driver registration - HID: uclogic: Fix regression of input name assignment - hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors - hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe() - hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe() - hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in get_multiple - hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR - hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer - hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer - hwmon: (pmbus/adm1266) reject implausible blackbox record_count - hwmon: (pmbus/adm1266) seed timestamp from the real-time clock - batman-adv: tt: fix negative tt_buff_len - batman-adv: tt: fix negative last_changeset_len - batman-adv: tp_meter: fix race condition in send error reporting - batman-adv: tp_meter: avoid use of uninit sender vars - batman-adv: bla: fix report_work leak on backbone_gw purge - batman-adv: frag: disallow unicast fragment in fragment - batman-adv: fix fragment reassembly length accounting - batman-adv: dat: handle forward allocation error - batman-adv: clear current gateway during teardown - batman-adv: mcast: fix use-after-free in orig_node RCU release - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async - drm/amd/display: Validate GPIO pin LUT table size before iterating - drm/amd/display: Fix integer overflow in bios_get_image() - drm/bridge: megachips: remove bridge when irq request fails - drm/bridge: it66121: acquire reset GPIO in probe - drm/virtio: use uninterruptible resv lock for plane updates - device property: set fwnode->secondary to NULL in fwnode_init() - LoongArch: Remove unused code to avoid build warning - RDMA/siw: Reject MPA FPDU length underflow before signed receive math - spi: ti-qspi: fix use-after-free after DMA setup failure - spi: sprd: fix error pointer deref after DMA setup failure - scsi: isci: Fix use-after-free in device removal path - phy: tegra: xusb: Fix per-pad high-speed termination calibration - spi: qup: fix error pointer deref after DMA setup failure - drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe - KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits - arm64: probes: Handle probes on hinted conditional branch instructions - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() - ice: fix setting promisc mode while adding VID filter - ixgbevf: fix use-after-free in VEPA multicast source pruning - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 - wifi: ath11k: clear shared SRNG pointer state on restart - vsock/vmci: fix UAF when peer resets connection during handshake - ring-buffer: Fix reporting of missed events in iterator - qed: fix double free in qed_cxt_tables_alloc() - netfilter: ipset: stop hash:* range iteration at end - netfilter: nf_queue: hold bridge skb->dev while queued - netfilter: ip6t_hbh: reject oversized option lists - net: ifb: report ethtool stats over num_tx_queues - net: bcmgenet: keep RBUF EEE/PM disabled - phonet/pep: disable BH around forwarded sk_receive_skb() - Bluetooth: MGMT: validate Add Extended Advertising Data length - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths - Bluetooth: bnep: Fix UAF read of dev->name - Bluetooth: ISO: drop ISO_END frames received without prior ISO_START - net: wwan: iosm: fix potential memory leaks in ipc_imem_init() - drivers/base/memory: fix memory block reference leak in poison accounting - efi: Allocate runtime workqueue before ACPI init - ALSA: asihpi: Fix potential OOB array access at reading cache - ALSA: pcm: Don't setup bogus iov_iter for silencing - ALSA: ua101: Reject too-short USB descriptors - hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX - smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() - ksmbd: fix null pointer dereference in compare_guid_key() - mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break() - sysfs: don't remove existing directory on update failure - Revert "af_unix: Reject SIOCATMARK on non-stream sockets" - Revert "s390/cio: Update purge function to unregister the unused subchannels" - Revert "ice: Remove jumbo_remove step from TX path" - Revert "ice: fix double-free of tx_buf skb" - Revert "x86/vdso: Fix output operand size of RDPID" - wifi: mac80211: check tdls flag in ieee80211_tdls_oper - s390/debug: Reject zero-length input before trimming a newline - mptcp: pm: ADD_ADDR rtx: free sk if last - mptcp: sync the msk->sndbuf at accept() time - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close - netfilter: revalidate bridge ports - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp - net: bonding: fix NULL pointer dereference in bond_do_ioctl() - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() - udp: clear skb->dev before running a sockmap verdict - crypto: nx - Fix packed layout in struct nx842_crypto_header - crypto: nx - Use static_assert() to check struct sizes - batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown - Revert "ALSA: pcmtest: fix reference leak on failed device registration" - media: rc: ttusbir: fix inverted error logic - media: rc: igorplugusb: fix control request setup packet - batman-adv: tp_meter: fix tp_num leak on kmalloc failure - batman-adv: stop tp_meter sessions during mesh teardown - ALSA: seq: Fix UMP group 16 filtering - ALSA: seq: Notify client and port info changes - ALSA: core: Serialize deferred fasync state checks - ALSA: misc: Use guard() for spin locks - ALSA: hda: cs35l56: Propagate ASP TX source control errors - crypto: nx - Avoid -Wflex-array-member-not-at-end warning - ksmbd: reset rcount per connection in ksmbd_conn_wait_idle_sess_id() - media: rc: igorplugusb: heed coherency rules - ALSA: aoa: Skip devices with no codecs in i2sbus_resume() - media: rc: ttusbir: respect DMA coherency rules - ALSA: aoa: i2sbus: clear stale prepared state - ALSA: aoa: Use guard() for mutex locks - f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally - ksmbd: replace connection list with hash table - ksmbd: use msleep instaed of schedule_timeout_interruptible() - f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io() - smb: move some duplicate definitions to common/smbacl.h - iommu/amd: serialize sequence allocation under concurrent TLB invalidations - x86/shstk: Prevent deadlock during shstk sigreturn - ALSA: pcmtest: Fix resource leaks in module init error paths - ALSA: pcmtest: fix reference leak on failed device registration - ALSA: 6fire: Fix input volume change detection - ALSA: caiaq: Fix control_put() result and cache rollback - ALSA: core: Fix potential data race at fasync handling - Revert "ALSA: usb-audio: Cap the packet size pre-calculations" - ipv6: sit: reload inner IPv6 header after GSO offloads - net: guard timestamp cmsgs to real error queue skbs - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() - netfilter: x_tables: avoid leaking percpu counter pointers - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush - netfilter: require Ethernet MAC header before using eth_hdr() - netfilter: nft_fib: fix stale stack leak via the OIFNAME register - vsock/virtio: reset connection on receiving queue overflow - vsock/virtio: fix skb overhead accounting to preserve full buf_alloc - vsock/virtio: fix potential unbounded skb queue - mptcp: pm: ADD_ADDR rtx: always decrease sk refcount - mptcp: pm: ADD_ADDR rtx: allow ID 0 - ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers - srcu: Use irq_work to start GP in tiny SRCU - irqwork: Move data struct to a types header - types: move struct rcuwait into types.h - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets - wifi: iwlwifi: fix 22000 series SMEM parsing - wifi: iwlwifi: allow IWL_FW_CHECK() with just a string - x86: shadow stacks: proper error handling for mmap lock - net: mvpp2: sync RX data at the hardware packet offset - net: mvpp2: limit XDP frame size to the RX buffer - batman-adv: fix tp_meter counter underflow during shutdown - batman-adv: v: stop OGMv2 on disabled interface - ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger - spi: mpc52xx: fix controller deregistration - thunderbolt: Bound root directory content to block size - selinux: fix overlayfs mmap() and mprotect() access checks - lsm: add backing_file LSM hooks - fs: constify file ptr in backing_file accessor helpers - fs: prepare for adding LSM blob to backing_file - selftests/bpf: Add tests for ld_{abs,ind} failure path in subprogs - bpf: Fix ld_{abs,ind} failure path analysis in subprogs - KVM: x86: Fix shadow paging use-after-free due to unexpected role - Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref - Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() - fix kabi for ppp_defs.h - pppoe: drop PFC frames - netfilter: nat: use kfree_rcu to release ops - drm/i915/gem: Fix phys BO pread/pwrite with offset - selinux: allow multiple opens of /sys/fs/selinux/policy - ksmbd: make ksmbd thread names distinct by client IP - ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path - ALSA: caiaq: Don't abort when no input device is available - ALSA: caiaq: fix usb_dev refcount leak on probe failure - ALSA: caiaq: Handle probe errors properly - ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow - USB: cdc-acm: Fix bit overlap and move quirk definitions to header - ALSA: caiaq: take a reference on the USB device in create_card() - ALSA: usb-audio: apply quirk for MOONDROP JU Jiu - ksmbd: use check_add_overflow() to prevent u16 DACL size overflow - ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment - smb: server: fix max_connections off-by-one in tcp accept path - smb: server: fix active_num_conn leak on transport allocation failure - usb: port: add delay after usb_hub_set_port_power() - USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen - usb: storage: Expand range of matched versions for VL817 quirks entry - xfrm: Wait for RCU readers during policy netns exit - KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing - mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison - thunderbolt: Clamp XDomain response data copy to allocation size - bpf: return VMA snapshot from task_vma iterator - bpf: switch task_vma iterator from mmap_lock to per-VMA locks - bpf: fix mm lifecycle in open-coded task_vma iterator - netfilter: nft_ct: bail out on template ct in get eval - drm/amd/display: Bound VBIOS record-chain walk loops - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size - drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() - netfilter: conntrack_irc: fix possible out-of-bounds read - drm/vc4: fix krealloc() memory leak - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error - f2fs: fix data loss caused by incorrect use of nat_entry flag - bnxt_en: Fix NULL pointer dereference - ipv6: mcast: Fix use-after-free when processing MLD queries - ipvs: clear the svc scheduler ptr early on edit - netfilter: synproxy: add mutex to guard hook reference counting - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list - net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr - netlabel: validate unlabeled address and mask attribute lengths - netfilter: bridge: make ebt_snat ARP rewrite writable - tcp: restrict SO_ATTACH_FILTER to priv users - ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER - Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig - misc: fastrpc: fix DMA address corruption due to find_vma misuse - misc: fastrpc: Fix NULL pointer dereference in rpmsg callback - gpio: mvebu: fix NULL pointer dereference in suspend/resume - Bluetooth: fix memory leak in error path of hci_alloc_dev() - Bluetooth: bnep: reject short frames before parsing - Bluetooth: RFCOMM: validate skb length in MCC handlers - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams - RDMA/srp: bound SRP_RSP sense copy by the received length - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN - net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure - sched/psi: fix race between file release and pressure write - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase - rculist: add list_splice_rcu() for private lists - net: skbuff: fix missing zerocopy reference in pskb_carve helpers - ip6_vti: set netns_immutable on the fallback device. - wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() - wifi: rtw88: debugfs: support multiple adapters debugging - erofs: fix use-after-free on sbi->sync_decompress - net: openvswitch: fix possible kfree_skb of ERR_PTR - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() - md: wake raid456 reshape waiters before suspend - dm cache policy smq: check allocation under invalidate lock - Bluetooth: MGMT: validate advertising TLV before type checks - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend - USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL - USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam - USB: serial: option: add support for Rolling Wireless RW135R-GL - USB: serial: io_edgeport: add support for Blackbox IC135A - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr - netfilter: flowtable: strictly check for maximum number of actions - fuse: reject fuse_notify() pagecache ops on directories - fs/mbcache: cancel shrink work before destroying the cache - smb/client: fix possible infinite loop and oob read in symlink_data() - fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp - ata: libata-scsi: do not needlessly defer commands when using PMP with FBS - ata: libata-scsi: do not use the deferred QC feature on PMPs with CBS - ata: libata-scsi: do not use the deferred QC feature for ATA_DEFER_PORT - ata: libata-scsi: improve readability of ata_scsi_qc_issue() - ata: libata-scsi: fix requeue of deferred ATA PASS-THROUGH commands - ata: libata-eh: Fix detection of deferred qc timeouts - ata: libata: cancel pending work after clearing deferred_qc - ata: libata-core: fix cancellation of a port deferred qc work - ata: libata-scsi: rename and improve ata_qc_done() - ata: libata-scsi: simplify ata_scsi_requeue_deferred_qc() - ata: libata-sata: simplify ata_sas_queuecmd() - ata: libata-core: improve tag checks in ata_qc_issue() - ata: libata-eh: correctly handle deferred qc timeouts - ata: libata-scsi: avoid Non-NCQ command starvation - ata: libata: Introduce ata_port_eh_scheduled() - ext4: handle wraparound when searching for blocks for indirect mapped blocks - ext4: fix error pointer dereference in ext4_mb_load_buddy_gfp() - ext4: always allocate blocks only from groups inode can use - ext4: fix e4b bitmap inconsistency reports - ext4: convert bd_buddy_page to bd_buddy_folio - ext4: convert bd_bitmap_page to bd_bitmap_folio - Revert "ext4: fix e4b bitmap inconsistency reports" - ext4: cleanup for ext4_map_blocks - ext4: rename EXT4_GET_BLOCKS_PRE_IO - ext4: drop extent cache when splitting extent fails - ext4: drop extent cache after doing PARTIAL_VALID1 zeroout - ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O - ext4: correct the comments place for EXT4_EXT_MAY_ZEROOUT - ext4: get rid of ppath in ext4_ext_handle_unwritten_extents() - ext4: get rid of ppath in ext4_ext_convert_to_initialized() - ext4: get rid of ppath in ext4_split_convert_extents() - ext4: get rid of ppath in ext4_split_extent() - ext4: get rid of ppath in ext4_force_split_extent_at() - ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 - ext4: subdivide EXT4_EXT_DATA_VALID1 - Revert "ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O" - ext4: get rid of ppath in ext4_split_extent_at() - ext4: get rid of ppath in ext4_ext_insert_extent() - ext4: get rid of ppath in get_ext_path() - ext4: add new ext4_ext_path_brelse() helper - !24596 [sync]urma: fix workqueue use-after-free in ubagg_exit teardown sequence - urma: fix workqueue use-after-free in ubagg_exit teardown sequence - !24607 ub: udma: Optimize udma jetty id access logic. - ub: udma: Optimize udma jetty id access logic. - !24640 [sync]urma: limit ubcore logs in reuse paths - urma: fix workqueue use-after-free in ubagg_exit teardown sequence - !24669 mm/madvise: add MADV_FCMA_ENABLE to set PF_FOLIO_CMA via madvise - mm/madvise: add MADV_FCMA_ENABLE to set PF_FOLIO_CMA via madvise - !24702 [sync]urma: retry import jetty/jfr on EIO from tpid reuse failure - urma: retry import jetty/jfr on EIO from tpid reuse failure - urma: limit ubagg connect exchange logs * Fri Jul 10 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-145.3.18.151.20260710.aae66044906b - !24753 [sync]urma: drain jfe event lists in batches to avoid soft-lockup - urma: drain jfe event lists in batches to avoid soft-lockup - urma: reduce ubagg topo log noise - !24748 [sync]urma: free completion events outside jfe lock - urma: free jfe events outside lock - urma: free completion events outside jfe lock - !24742 urma: Fix the issue of inaccurate timing for some functions in DFX - !24741 [sync]urma: fix UAF of accessing token_id in log. - urma: Fix the issue of inaccurate timing for some functions in DFX - urma: fix UAF of accessing token_id in log. - !24734 [sync]urma: fix tpid_reuse attached to vtpn causes use_after_free - urma: fix tpid_reuse attached to vtpn causes use_after_free - !24804 [sync]urma: use vzalloc for ubmad tjetty and ini_rtbuffer - !24774 [sync]urma: ratelimit import jetty/jfr error logs - urma: use vzalloc for ubmad tjetty and ini_rtbuffer - !24792 [sync]urma: fix UAF of accessing jfs/jetty in log. - urma: fix UAF of accessing jfs/jetty in log. - urma: ratelimit import jetty/jfr error logs - !24845 [sync]ub/ubdevshm: Support for acquiring va is a sub-range of registered va - ub/ubdevshm: Support for acquiring va is a sub-range of registered va - !24802 [sync]urma: use xarray for ubagg/ubcore session lookup - urma: use xarray for ubagg/ubcore session lookup - !24814 [sync]urma: make ratelimit burst configurable for ubcore/uburma/ubagg - urma: make ratelimit burst configurable for ubcore/uburma/ubagg * Wed Jul 22 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-145.3.22.153.20260722.158daf1d8dea - !24942 [sync]urma: drop param_set_uint_minmax for ratelimit burst setters - urma: drop param_set_uint_minmax for ratelimit burst setters - !25840 sync CVE LTS and bugfix from OLK-6.6 d33ffc8f8580 to 334dfd575ba5 - cgroup/rstat: avoid disabling irqs for O(num_cpu) - netfilter: bridge: eb_tables: close module init race - crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents - netfilter: ebtables: move to two-stage removal scheme - crypto: qat - protect service table iterations with service_lock - Bluetooth: eir: Fix stack OOB write when prepending the Flags AD - drm/edid: fix OOB read in drm_parse_tiled_block() - proc: protect ptrace_may_access() with exec_update_lock (FD links) - vfio/pci: Latch disable_idle_d3 per device - bpf: Fix UAF in sock clone early bailouts - bpf: Disable xfrm_decode_session hook attachment - bpf,fork: wipe ->bpf_storage before bailouts that access it - KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() - crypto: qat - validate RSA CRT component lengths - bpf: Clear rb node linkage when freeing bpf_rb_root - bpf: Add validation for bpf_set_retval argument - bpf: Reject sleepable BPF_LSM_CGROUP programs at load time - bpf: Fix setting retval to -EPERM for cgroup hooks not returning errno - bpf: Guard __get_user acesss with access_ok for uprobe_multi data - i2c: core: fix adapter registration race - ALSA: hda/cs35l41: Fix firmware load work teardown - vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc - iommufd: Break the loop on failure in iommufd_fault_fops_read() - posix-cpu-timers: Prevent UAF caused by non-leader exec() race - iio: event: Fix event FIFO reset race - hwrng: virtio: clamp device-reported used.len at copy_data() - crypto: drbg - Fix returning success on failure in CTR_DRBG - crypto: ecc - Fix carry overflow in vli multiplication - crypto: pcrypt - restore callback for non-parallel fallback - net: openvswitch: reject oversized nested action attrs - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page - e1000e: Fix out-of-bounds MMIO access by validating BAR0 size - xsched: enforce permissions on attribute access - xsched: restrict vstream management to privileged users - rme: use DMA API for virtio in realm world - udf: validate sparing table length as an entry count, not a byte count - smb: client: harden POSIX SID length parsing - smb: client: mask server-provided mode to 07777 in modefromsid - smb: client: Fix next buffer leak in receive_encrypted_standard() - nvmet-auth: validate reply message payload bounds against transfer length - bpf: Reject fragmented frames in devmap - bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized - mm/huge_memory: update file PMD counter before folio_put() - sctp: fix uninit-value in __sctp_rcv_asconf_lookup() - smb: client: reject overlapping data areas in SMB2 responses - smb: client: restrict implied bcc[0] exemption to responses without data area - io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item - writeback: drop now-unnecessary rcu_barrier() in cgroup_writeback_umount() - writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() - writeback: Fix use after free in inode_switch_wbs_work_fn() - writeback: Avoid contention on wb->list_lock when switching inodes - block: skip sync_blockdev() on surprise removal in bdev_mark_dead() - mm: do file ownership checks with the proper mount idmap - tracing: Bound synthetic-field strings with seq_buf - perf/core: Detach event groups during remove_on_exec - bpf: Allow LPM map access from sleepable BPF programs - bpf: Consistently use bpf_rcu_lock_held() everywhere - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC - udf: validate VAT header length against the VAT inode size - isofs: bound Rock Ridge symlink components to the SL record - udf: validate free block extents against the partition length - config: arm64: update CONFIG_FTRACE_STARTUP_TEST not set - crypto: qat - Return pointer directly in adf_ctl_alloc_resources - crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() - drivers/base/memory: set mem->altmap after successful device registration - serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails - serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero - NFS: Prevent resource leak in nfs_alloc_server() - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr - nfsd: check get_user() return when reading princhashlen - fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode - fbdev: modedb: fix a possible UAF in fb_find_mode() - fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var - power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path - 9p: avoid putting oldfid in p9_client_walk() error path - ocfs2: reject oversized group bitmap descriptors - rpmsg: char: Fix use-after-free on probe error path - fpga: region: fix use-after-free in child_regions_with_firmware() - irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove - pNFS: Fix use-after-free in pnfs_update_layout() - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done - hdlc_ppp: sync per-proto timers before freeing hdlc state - gfs2: fix use-after-free in gfs2_qd_dealloc - exfat: fix potential use-after-free in exfat_find_dir_entry() - bpf: use kvfree() for replaced sysctl write buffer - f2fs: keep atomic write retry from zeroing original data - f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node() - f2fs: validate ACL entry sizes in f2fs_acl_from_disk() - f2fs: fix to round down start offset of fallocate for pin file - f2fs: validate compress cache inode only when enabled - wifi: iwlwifi: mvm: fix race condition in PTP removal - wifi: rtw88: usb: fix memory leaks on USB write failures - wifi: rtw88: increase TX report timeout to fix race condition - wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor - wifi: ath11k: fix warning when unbinding - wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S - keys: Pin request_key_auth payload in instantiate paths - KEYS: fix overflow in keyctl_pkey_params_get_2() - err.h: use __always_inline on all error pointer helpers - fbdev: fix use-after-free in store_modes() - NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR - apparmor: mediate the implicit connect of TCP fast open sendmsg - net: skmsg: preserve sg.copy across SG transforms - mac802154: llsec: add skb_cow_data() before in-place crypto - af_unix: Set gc_in_progress to true in unix_gc(). - ntfs3: reject direct userspace writes to reserved $LX* xattrs - ipv4: account for fraggap on the paged allocation path - inet: add indirect call wrapper for getfrag() calls - ipv6: account for fraggap on the paged allocation path - batman-adv: tvlv: avoid race of cifsnotfound handler state - batman-adv: tvlv: enforce 2-byte alignment - batman-adv: dat: prevent false sharing between VLANs - batman-adv: tt: track roam count per VID - batman-adv: tt: don't merge change entries with different VIDs - batman-adv: tp_meter: handle overlapping packets - batman-adv: tp_meter: prevent parallel modifications of last_recv - batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE - batman-adv: tp_meter: restrict number of unacked list entries - batman-adv: v: prevent OGM aggregation on disabled hardif - batman-adv: frag: avoid underflow of TTL - batman-adv: frag: ensure fragment is writable before modifying TTL - batman-adv: fix (m|b)cast csum after decrementing TTL - batman-adv: ensure bcast is writable before modifying TTL - batman-adv: tp_meter: initialize last_recv_time during init - batman-adv: prevent ELP transmission interval underflow - batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE - batman-adv: tp_meter: add only finished tp_vars to lists - batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection - batman-adv: tp_meter: fix fast recovery precondition - batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd - batman-adv: tp_meter: avoid window underflow - batman-adv: tp_meter: initialize dec_cwnd explicitly - batman-adv: tp_meter: initialize dup_acks explicitly - batman-adv: tp_meter: keep unacked list in ascending ordered - eventpoll: rename ep_remove_safe() back to ep_remove() - file: add fput() cleanup helper - media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si - ksmbd: reject non-VALID session in compound request branch - scripts/sorttable: Fix endianness handling in build-time mcount sort - scripts/sorttable: Allow matches to functions before function entry - scripts/sorttable: Use normal sort if theres no relocs in the mcount section - ftrace: Check against is_kernel_text() instead of kaslr_offset() - ftrace: Test mcount_loc addr before calling ftrace_call_addr() - ftrace: Do not over-allocate ftrace memory - ftrace: Have ftrace pages output reflect freed pages - ftrace: Update the mcount_loc check of skipped entries - scripts/sorttable: Zero out weak functions in mcount_loc table - scripts/sorttable: Always use an array for the mcount_loc sorting - scripts/sorttable: Have mcount rela sort use direct values - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 - scripts/sorttable: Use a structure of function pointers for elf helpers - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly - scripts/sorttable: Move code from sorttable.h into sorttable.c - scripts/sorttable: Use uint64_t for mcount sorting - scripts/sorttable: Add helper functions for Elf_Sym - scripts/sorttable: Add helper functions for Elf_Shdr - scripts/sorttable: Add helper functions for Elf_Ehdr - scripts/sorttable: Convert Elf_Sym MACRO over to a union - scripts/sorttable: Replace Elf_Shdr Macro with a union - scripts/sorttable: Convert Elf_Ehdr to union - scripts/sorttable: Make compare_extable() into two functions - scripts/sorttable: Have the ORC code use the _r() functions to read - scripts/sorttable: Remove unneeded Elf_Rel - scripts/sorttable: Remove unused write functions - scripts/sorttable: Remove unused macro defines - fuse: re-lock request before replacing page cache folio - slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD - slimbus: qcom-ngd-ctrl: Fix up platform_driver registration - rxrpc: Fix the ACK parser to extract the SACK table for parsing - net: phonet: free phonet_device after RCU grace period - phonet: Pass net and ifindex to phonet_address_notify(). - phonet: Pass ifindex to fill_addr(). - Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs - hv: utils: handle and propagate errors in kvp_register - regulator: core: fix locking in regulator_resolve_supply() error path - ring-buffer: Remove ring_buffer_read_prepare_sync() - selftests/bpf: Update comments find_equal_scalars->sync_linked_regs - af_unix: Reject SIOCATMARK on non-stream sockets - selftests/bpf: Add test to ensure kprobe_multi is not sleepable - agp/amd64: Fix broken error propagation in agp_amd64_probe() - net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() - i2c: stub: Reject I2C block transfers with invalid length - RDMA/bnxt_re: zero shared page before exposing to userspace - KVM: VMX: Update SVI during runtime APICv activation - ARM: fix branch predictor hardening - ARM: fix hash_name() fault - ARM: allow __do_kernel_fault() to report execution of memory faults - ARM: group is_permission_fault() with is_translation_fault() - debugobjects: Dont call fill_pool() in early boot hardirq context - debugobjects: Do not fill_pool() if pi_blocked_on - debugobjects: Use LD_WAIT_CONFIG instead of LD_WAIT_SLEEP - debugobjects: Allow to refill the pool before SYSTEM_SCHEDULING - batman-adv: tt: prevent TVLV entry number overflow - drm/v3d: Skip CSD when it has zeroed workgroups - drm/v3d: Store the active job inside the queue's state - iov_iter: Fix potential underflow in iov_iter_extract_xarray_pages() - urma: add check type in free driver obj - smb: client: fix double-free in SMB2_close() replay - smb: client: fix double-free in SMB2_flush() replay - smb: client: fix query_info() replay double-free - smb: client: fix query directory replay double-free - smb: client: fix double-free in SMB2_open() replay - smb: client: fix double-free in SMB2_ioctl() replay - smb: client: fix change notify replay double-free - HID: lg-g15: cancel pending work on remove to fix a use-after-free - HID: multitouch: fix out-of-bounds bit access on mt_io_flags - tracing: Prevent out-of-bounds read in glob matching - sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT - !25616 sync CVE LTS and bugfix from OLK-6.6 b72db20c0437 to d33ffc8f8580 - KVM: x86: hyper-v: Bound the bank index when querying sparse banks - MIPS: DEC: Prevent initial console buffer from landing in XKPHYS - ksmbd: fix durable reconnect error path file lifetime - ksmbd: fix use-after-free in smb2_open during durable reconnect - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query - USB: iowarrior: fix use-after-free on disconnect race - usb: iowarrior: remove inherent race with minor number - USB: iowarrior: fix use-after-free on disconnect - apparmor: fix use-after-free in rawdata dedup loop - tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR - bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops - rbd: eliminate a race in lock_dwork draining on unmap - blk-cgroup: fix UAF in __blkcg_rstat_flush() - net: Fix kabi breakage of struct tc_action - net/sched: act_api: use RCU with deferred freeing for action lifecycle - net: Fix kabi breakage of struct header_ops - bonding: prevent potential infinite loop in bond_header_parse() - bonding: fix type confusion in bond_setup_by_slave() - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc - ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL - ASoC: cs35l56: Fix missing calls to wm_adsp2_remove() - time: Fix off-by-one in compat settimeofday() usec validation - scsi: target: Fix hexadecimal CHAP_I handling - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink - ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY - ksmbd: add a permission check for FSCTL_SET_ZERO_DATA - ksmbd: add per-handle permission check to FILE_LINK_INFORMATION - mptcp: fix missing wakeups in edge scenarios - mptcp: add-addr: always drop other suboptions - ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 - RDMA/umem: fix kernel-doc warnings - mm/migrate: don't call folio_putback_active_hugetlb() on dst hugetlb folio - usb: typec: ucsi: Don't update power_supply on power role change if not connected - serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() - thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() - usb: typec: ucsi: Check if power role change actually happened before handling - usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind - usb: dwc3: xilinx: fix error handling in zynqmp init error paths - usb: musb: omap2430: Fix use-after-free in omap2430_probe() - tty: serial: samsung: Remove redundant port lock acquisition in rx helpers - tty: serial: samsung: use u32 for register interactions - serial: samsung_tty: Use port lock wrappers - ALSA: firewire-motu: Protect register DSP event queue positions - memfd: deny writeable mappings when implying SEAL_WRITE - iio: dac: ad5686: fix ref bit initialization for single-channel parts - usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure - iio: chemical: scd30: fix division by zero in write_raw - iio: chemical: scd30: Use guard(mutex) to allow early returns - iio: gyro: adis16260: fix division by zero in write_raw - Bluetooth: hci_qca: Convert timeout from jiffies to ms - Bluetooth: hci_qca: Migrate to serdev specific shutdown function - serdev: Provide a bustype shutdown function - serdev: make serdev_bus_type const - mm/damon/sysfs-schemes: delete tried region in regions_rmdirs() - mptcp: do not drop partial packets - mptcp: introduce the mptcp_init_skb helper - iio: adc: npcm: fix unbalanced clk_disable_unprepare() - iio: adc: npcm: Convert to platform remove callback returning void - octeontx2-pf: avoid double free of pool->stack on AQ init failure - af_unix: Fix UAF read of tail->len in unix_stream_data_wait() - af_unix: Cache state->msg in unix_stream_read_generic(). - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg - net: hsr: defer node table free until after RCU readers - mptcp: pm: fix ADD_ADDR timer infinite retry on option space insufficient - ice: fix VF queue configuration with low MTU values - mptcp: reset rcv wnd on disconnect - mptcp: cleanup fallback dummy mapping generation - octeontx2-af: CGX: add bounds check to cgx_speed_mbps index - octeontx2-af: replace deprecated strncpy with strscpy - cgroup/cpuset: Reset DL migration state on can_attach() failure - fbdev/vt8500lcdfb: Initialize fb_ops with fbdev macros - soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get() - driver core: reject devices with unregistered buses - drm/amd/display: Use krealloc_array() in dal_vector_reserve() - drm/amdgpu: restart the CS if some parts of the VM are still invalidated - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 - drm/amdkfd: fix NULL dereference in get_queue_ids() - slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock - slimbus: qcom-ngd-ctrl: fix OF node refcount - thunderbolt: Limit XDomain response copy to actual frame size - sctp: stream: fully roll back denied add-stream state - mmc: sdhci: add signal voltage switch in sdhci_resume_host - mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC - mmc: litex_mmc: Set mandatory idle clocks before CMD0 - mmc: core: Fix host controller programming for fixed driver type - mm/hugetlb: restore reservation on error in hugetlb folio copy paths - octeontx2-af: fix memory leak in rvu_setup_hw_resources() - nvmem: layouts: onie-tlv: fix hang on unknown types - net: rds: clear i_sends on setup unwind - net: mv643xx: fix OF node refcount - net/mlx5: Reorder completion before putting command entry in cmd_work_handler - misc: fastrpc: fix use-after-free race in fastrpc_map_create - misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context - Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard - i2c: tegra: Fix NOIRQ suspend/resume - i2c: stm32f7: fix timing computation ignoring i2c-analog-filter - i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() - pidfd: refuse access to tasks that have started exiting harder - ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write - vsock/vmci: fix sk_ack_backlog leak on failed handshake - wifi: nl80211: reject oversized EMA RNR lists - selftests: mptcp: add test for extra_subflows underflow on userspace PM - mptcp: sockopt: check timestamping ret value - mptcp: allow subflow rcv wnd to shrink - mptcp: close TOCTOU race while computing rcv_wnd - mptcp: fix retransmission loop when csum is enabled - ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow - ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O - ARM: socfpga: Fix OF node refcount leak in SMP setup - mm/damon/ops-common: call folio_test_lru() after folio_get() - drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info() - ALSA: timer: Fix UAF at snd_timer_user_params() - USB: serial: option: add usb-id for Dell Wireless DW5826e-m - xfrm: espintcp: do not reuse an in-progress partial send - ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL - mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation - tracing/probes: Point the error offset correctly for eprobe argument error - netfilter: nft_tunnel: fix use-after-free on object destroy - clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time - net: mvpp2: build skb from XDP-adjusted data on XDP_PASS - net: mvpp2: refill RX buffers before XDP or skb use - net: mvpp2: Add metadata support for xdp mode - netfilter: nf_log: validate MAC header was set before dumping it - rds: mark snapshot pages dirty in rds_info_getsockopt() - net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion - r8152: handle the return value of usb_reset_device() - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove - net: phy: clean the sfp upstream if phy probing fails - net/mlx4: avoid GCC 10 __bad_copy_from() false positive - ASoC: wm_adsp: Fix NULL dereference when removing firmware controls - arm64: tlb: Allow XZR argument to TLBI ops - KVM: arm64: Remove VPIPT I-cache handling - tools/rv: Fix cleanup after failed trace setup - time: Fix off-by-one in settimeofday() usec validation - ipmi: Fix rcu_read_unlock to srcu_read_unlock in handle_read_event_rsp - ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() - vxlan: vnifilter: fix spurious notification on VNI update - vxlan: vnifilter: send notification on VNI add - octeontx2-af: npc: Fix CPT channel mask in npc_install_flow - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown - ptp: vclock: Switch from RCU to SRCU - net: fec: fix pinctrl default state restore order on resume - net: lan743x: permit VLAN-tagged packets up to configured MTU - net: garp: fix unsigned integer underflow in garp_pdu_parse_attr - hsr: Remove WARN_ONCE() in hsr_addr_is_self(). - net: Annotate sk->sk_write_space() for UDP SOCKMAP. - pcnet32: stop holding device spin lock during napi_complete_done - drm/imx: Fix three kernel-doc warnings in dcss-scaler.c - 6lowpan: fix off-by-one in multicast context address compression - netfilter: xt_NFQUEUE: prefer raw_smp_processor_id - tee: optee: prevent use-after-free when the client exits before the supplicant - net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS - Disable -Wattribute-alias for clang-23 and newer - RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug - USB: serial: mct_u232: fix memory corruption with small endpoint - usb: core: Fix SuperSpeed root hub wMaxPacketSize - serial: zs: Convert to use a platform device - serial: dz: Convert to use a platform device - serial: dz: Fix bootconsole handover lockup - xhci: tegra: Fix ghost USB device on dual-role port unplug - USB: serial: digi_acceleport: fix memory corruption with small endpoints - landlock: Fix handling of disconnected directories - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync - USB: serial: cypress_m8: fix memory corruption with small endpoint - serial: zs: Switch to using channel reset - serial: zs: Fix bootconsole handover lockup - serial: dz: Fix bootconsole message clobbering at chip reset - drm/amdkfd: Check for pdd drm file first in CRIU restore path - drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger - drm/amdkfd: fix NULL pointer bug in svm_range_set_attr - serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma - serial: zs: Fix swapped RI/DSR modem line transition counting - serial: sh-sci: fix memory region release in error path - serial: qcom-geni: fix UART_RX_PAR_EN bit position - serial: altera_jtaguart: handle uart_add_one_port() failures - drm/amd/pm/si: Disregard vblank time when no displays are connected - drm/i915: Fix potential UAF in TTM object purge - drm/hyperv: validate VMBus packet size in receive callback - drm/hyperv: validate resolution_count and fix WIN8 fallback - scsi: target: iscsi: Validate CHAP_R length before base64 decode - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 - scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker - thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow - thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() - usb: gadget: f_fs: copy only received bytes on short ep0 read - usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports - usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling - usb: gadget: f_hid: fix device reference leak in hidg_alloc() - usb: gadget: net2280: Fix double free in probe error path - USB: serial: mct_u232: fix missing interrupt-in transfer sanity check - USB: serial: mxuport: fix memory corruption with small endpoint - USB: serial: keyspan: fix missing indat transfer sanity check - USB: serial: cypress_m8: validate interrupt packet headers - USB: serial: belkin_sa: validate interrupt status length - USB: serial: option: add MeiG SRM813Q - usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize - usb: usbtmc: check URB actual_length for interrupt-IN notifications - usbip: vudc: Fix use after free bug in vudc_remove due to race condition - usb: storage: Add quirks for PNY Elite Portable SSD - USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers - usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval - usb: chipidea: core: convert ci_role_switch to local variable - tty: serial: pch_uart: add check for dma_alloc_coherent() - counter: Fix refcount leak in counter_alloc() error path - comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() - comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() - Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 - Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem - Input: xpad - add support for ASUS ROG RAIKIRI II - Input: xpad - add "Nova 2 Lite" from GameSir - ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks - ASoC: qcom: q6asm-dai: close stream only when running - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check - xfrm: ah: use skb_to_full_sk in async output callbacks - xfrm: route MIGRATE notifications to caller's netns - nfc: hci: fix out-of-bounds read in HCP header parsing - iommu, debugobjects: avoid gcc-16.1 section mismatch warnings - HID: wacom: Fix OOB write in wacom_hid_set_device_mode() - ip6: vti: Use ip6_tnl.net in vti6_changelink(). - xfrm: input: hold netns during deferred transport reinjection - ipv6: validate extension header length before copying to cmsg - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). - ipv6: exthdrs: refresh nh after handling HAO option - ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() - macsec: fix replay protection at XPN lower-PN wrap - bpf: sockmap: fix tail fragment offset in bpf_msg_push_data - Input: elan_i2c - validate firmware size before use - usb: dwc2: Fix use after free in debug code - usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles - usb: cdns3: gadget: fix request skipping after clearing halt - USB: serial: omninet: fix memory corruption with small endpoint - iio: buffer: hw-consumer: fix use-after-free in error path - iio: light: cm3323: fix reg_conf not being initialized correctly - iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL - iio: temperature: tsys01: fix broken PROM checksum validation - iio: ssp_sensors: cancel delayed work_refresh on remove - iio: gyro: itg3200: fix i2c read into the wrong stack location - iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw - iio: dac: ad5686: acquire lock when doing powerdown control - iio: dac: ad5686: fix input raw value check - iio: dac: max5821: fix return value check in powerdown sync - iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux - wireguard: send: append trailer after expanding head - KVM: arm64: PMU: Preserve AArch32 counter low bits - parport: Fix race between port and client registration - Input: xpad - fix out-of-bounds access for Share button - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock - Bluetooth: ISO: fix UAF in iso_recv_frame - Bluetooth: HIDP: fix missing length checks in hidp_input_report() - auxdisplay: line-display: fix OOB read on zero-length message_store() - hpfs: fix a crash if hpfs_map_dnode_bitmap fails - Bluetooth: btusb: Allow firmware re-download when version matches - HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse - Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() - USB: serial: safe_serial: fix memory corruption with small endpoint - usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT - usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() - usb: typec: altmodes/displayport: validate count before reading Status Update VDO - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO - usb: typec: ucsi: ccg: reject firmware images without a ':' record header - iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer - soc/tegra: pmc: Fix unsafe generic_handle_irq() call - hwmon: (pmbus/adm1266) serialize NVMEM blackbox read with pmbus_lock - hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock - of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() - phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X - drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used - drm/dp: Add eDP 1.5 bit definition - drm/i915/psr: Read Intel DPCD workaround register - drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register - media: rc: fix race between unregister and urb/irq callbacks - batman-adv: bla: avoid double decrement of bla.num_requests - batman-adv: tt: avoid empty VLAN responses - batman-adv: tt: fix TOCTOU race for reported vlans - batman-adv: tp_meter: directly shut down timer on cleanup - batman-adv: tp_meter: avoid role confusion in tp_list - batman-adv: iv: recover OGM scheduling after forward packet error - batman-adv: tvlv: reject oversized TVLV packets - batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface - batman-adv: tt: reject oversized local TVLV buffers - batman-adv: tvlv: abort OGM send on tvlv append failure - net: skbuff: fix pskb_carve leaking zcopy pages - ipv6: fix possible infinite loop in fib6_select_path() - ipv6: fix possible infinite loop in rt6_fill_node() - sctp: fix race between sctp_wait_for_connect and peeloff - net: mana: Add NULL guards in teardown path to prevent panic on attach failure - gpio: rockchip: convert bank->clk to devm_clk_get_enabled() - Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() - ethtool: eeprom: add more safeties to EEPROM Netlink fallback - ethtool: eeprom: add missing ethnl_ops_begin() / _complete() during fallback - bonding: refuse to enslave CAN devices - Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() - ASoC: codecs: simple-mux: Fix enum control bounds check - ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() - gpio: mxc: fix irq_high handling - net: hsr: fix potential OOB access in supervision frame handling - ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues - net/iucv: fix locking in .getsockopt - net/smc: Do not re-initialize smc hashtables - net: netlink: don't set nsid on local notifications - net: netlink: fix sending unassigned nsid after assigned one - vsock: keep poll shutdown state consistent - netfilter: nf_tables: fix dst corruption in same register operation - netfilter: bitwise: add support for doing AND, OR and XOR directly - netfilter: bitwise: rename some boolean operation functions - netfilter: ebtables: fix OOB read in compat_mtw_from_user - netfilter: xt_cpu: prefer raw_smp_processor_id - netfilter: synproxy: refresh tcphdr after skb_ensure_writable - xfrm: Check for underflow in xfrm_state_mtu - nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() - nfc: llcp: Fix use-after-free in llcp_sock_release() - net: cpsw_new: Fix potential unregister of netdev that has not been registered yet - drm: Remove plane hsub/vsub alignment requirement for core helpers - net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net: mctp: ensure our nlmsg responses are initialised - Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size - MIPS: smp: report dying CPU to RCU in stop_this_cpu() - LoongArch: Report dying CPU to RCU in stop_this_cpu() - irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT - tls: Flush backlog before waiting for a new record - net: ethernet: cortina: No mapping is a dropped rx - batman-adv: fix batadv_skb_is_frag() kernel-doc - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled - Bluetooth: ISO: fix malformed ISO_END/CONT handling - Bluetooth: MGMT: Fix backward compatibility with userspace - security/keys: fix missed RCU read section on lookup - LoongArch: kprobes: Fix handling of fatal unrecoverable recursions - pds_core: ensure null-termination for firmware version strings - pds_core: add an error code check in pdsc_dl_info_get - net: mana: validate rx_req_idx to prevent out-of-bounds array access - ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove() - gpio: cdev: check if uAPI v2 config attributes are correctly zeroed - gpiolib: cdev: use !mem_is_zero() instead of memchr_inv(s, 0, n) - string: add mem_is_zero() helper to check if memory area is all zeros - bpf, skmsg: fix verdict sk_data_ready racing with ktls rx - net: ag71xx: check error for platform_get_irq - Bluetooth: btmtk: rename btmediatek_data - Bluetooth: btusb: mediatek: refactor the function btusb_mtk_reset - Bluetooth: btmtk: add the function to get the fw name - ALSA: seq: Serialize UMP output teardown with event_input - ALSA: seq: ump: Use guard() for locking - pds_core: fix debugfs_lookup dentry leak and error handling - pds_core: fix error handling in pdsc_devcmd_wait - bridge: mcast: Fix a possible use-after-free when removing a bridge port - net: bridge: Flush multicast groups when snooping is disabled - RDMA/rtrs: Fix use-after-free in path file creation cleanup - platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL - platform/x86: intel-hid: Check ACPI_HANDLE() against NULL - platform/x86: hp_accel: Check ACPI_COMPANION() against NULL - platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer - net: dsa: mt7530: preserve VLAN tags on trapped link-local frames - net: dsa: mt7530: rename mt753x_bpdu_port_fw enum to mt753x_to_cpu_fw - net: dsa: mt7530: fix FDB entries not aging out with short timeout - wifi: ath11k: fix peer resolution on rx path when peer_id=0 - drm/msm/snapshot: fix dumping of the unaligned regions - spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache() - net/mlx5: Do not restore destination-less TC rules - tls: Preserve sk_err across recvmsg() when data has been copied - x86/xen: Fix xen_e820_swap_entry_with_ram() - net: phy: DP83TC811: add reading of abilities - net: phy: c45: add genphy_c45_pma_read_ext_abilities() function - net: tls: prevent chain-after-chain in plain text SG - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot - powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise() - drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN - drm/msm/dsi: don't dump registers past the mapped region - ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics - net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint - accel/qaic: Add overflow check to remap_pfn_range during mmap - HID: quirks: really enable the intended work around for appledisplay - wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm() - wifi: ath11k: fix error path leaks in some WMI WOW calls - net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS reference - net: ethernet: cortina: Carry over frag counter - net: ethernet: cortina: Drop half-assembled SKB - net: ethernet: cortina: Make RX SKB per-port - netfs: Fix overrun check in netfs_extract_user_iter() - zonefs: handle integer overflow in zonefs_fname_to_fno - irqchip/ath79-cpu: Remove unused function - phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access - net: lan966x: avoid unregistering netdev on register failure - ice: fix locking in ice_dcb_rebuild() - tcp: Fix imbalanced icsk_accept_queue count. - test_kprobes: clear kprobes between test runs - kprobes: skip non-symbol addresses in kprobe_add_ksym_blacklist() - netfilter: x_tables: unregister the templates first - ALSA: hda: cs35l56: Put ACPI device after setting companion - ARM: integrator: Fix early initialization - pinctrl: qcom: Fix wakeirq map by removing disconnected irqs for sm8150 - kunit: config: KUNIT_DEBUGFS should depend on DEBUG_FS - kunit: config: Enable KUNIT_DEBUGFS by default - firmware: arm_ffa: Skip free_pages on RX buffer alloc failure - firmware: arm_ffa: Check for NULL FF-A ID table while driver registration - HID: uclogic: Fix regression of input name assignment - hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors - hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe() - hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe() - hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in get_multiple - hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR - hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer - hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer - hwmon: (pmbus/adm1266) reject implausible blackbox record_count - hwmon: (pmbus/adm1266) seed timestamp from the real-time clock - batman-adv: tt: fix negative tt_buff_len - batman-adv: tt: fix negative last_changeset_len - batman-adv: tp_meter: fix race condition in send error reporting - batman-adv: tp_meter: avoid use of uninit sender vars - batman-adv: bla: fix report_work leak on backbone_gw purge - batman-adv: frag: disallow unicast fragment in fragment - batman-adv: fix fragment reassembly length accounting - batman-adv: dat: handle forward allocation error - batman-adv: clear current gateway during teardown - batman-adv: mcast: fix use-after-free in orig_node RCU release - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async - drm/amd/display: Validate GPIO pin LUT table size before iterating - drm/amd/display: Fix integer overflow in bios_get_image() - drm/bridge: megachips: remove bridge when irq request fails - drm/bridge: it66121: acquire reset GPIO in probe - drm/virtio: use uninterruptible resv lock for plane updates - device property: set fwnode->secondary to NULL in fwnode_init() - LoongArch: Remove unused code to avoid build warning - RDMA/siw: Reject MPA FPDU length underflow before signed receive math - spi: ti-qspi: fix use-after-free after DMA setup failure - spi: sprd: fix error pointer deref after DMA setup failure - scsi: isci: Fix use-after-free in device removal path - phy: tegra: xusb: Fix per-pad high-speed termination calibration - spi: qup: fix error pointer deref after DMA setup failure - drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe - KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits - arm64: probes: Handle probes on hinted conditional branch instructions - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() - ice: fix setting promisc mode while adding VID filter - ixgbevf: fix use-after-free in VEPA multicast source pruning - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 - wifi: ath11k: clear shared SRNG pointer state on restart - vsock/vmci: fix UAF when peer resets connection during handshake - ring-buffer: Fix reporting of missed events in iterator - qed: fix double free in qed_cxt_tables_alloc() - netfilter: ipset: stop hash:* range iteration at end - netfilter: nf_queue: hold bridge skb->dev while queued - netfilter: ip6t_hbh: reject oversized option lists - net: ifb: report ethtool stats over num_tx_queues - net: bcmgenet: keep RBUF EEE/PM disabled - phonet/pep: disable BH around forwarded sk_receive_skb() - Bluetooth: MGMT: validate Add Extended Advertising Data length - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths - Bluetooth: bnep: Fix UAF read of dev->name - Bluetooth: ISO: drop ISO_END frames received without prior ISO_START - net: wwan: iosm: fix potential memory leaks in ipc_imem_init() - drivers/base/memory: fix memory block reference leak in poison accounting - efi: Allocate runtime workqueue before ACPI init - ALSA: asihpi: Fix potential OOB array access at reading cache - ALSA: pcm: Don't setup bogus iov_iter for silencing - ALSA: ua101: Reject too-short USB descriptors - hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX - smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() - ksmbd: fix null pointer dereference in compare_guid_key() - mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break() - sysfs: don't remove existing directory on update failure - Revert "af_unix: Reject SIOCATMARK on non-stream sockets" - Revert "s390/cio: Update purge function to unregister the unused subchannels" - Revert "ice: Remove jumbo_remove step from TX path" - Revert "ice: fix double-free of tx_buf skb" - Revert "x86/vdso: Fix output operand size of RDPID" - wifi: mac80211: check tdls flag in ieee80211_tdls_oper - s390/debug: Reject zero-length input before trimming a newline - mptcp: pm: ADD_ADDR rtx: free sk if last - mptcp: sync the msk->sndbuf at accept() time - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close - netfilter: revalidate bridge ports - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp - net: bonding: fix NULL pointer dereference in bond_do_ioctl() - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() - udp: clear skb->dev before running a sockmap verdict - crypto: nx - Fix packed layout in struct nx842_crypto_header - crypto: nx - Use static_assert() to check struct sizes - batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown - Revert "ALSA: pcmtest: fix reference leak on failed device registration" - media: rc: ttusbir: fix inverted error logic - media: rc: igorplugusb: fix control request setup packet - batman-adv: tp_meter: fix tp_num leak on kmalloc failure - batman-adv: stop tp_meter sessions during mesh teardown - ALSA: seq: Fix UMP group 16 filtering - ALSA: seq: Notify client and port info changes - ALSA: core: Serialize deferred fasync state checks - ALSA: misc: Use guard() for spin locks - ALSA: hda: cs35l56: Propagate ASP TX source control errors - crypto: nx - Avoid -Wflex-array-member-not-at-end warning - ksmbd: reset rcount per connection in ksmbd_conn_wait_idle_sess_id() - media: rc: igorplugusb: heed coherency rules - ALSA: aoa: Skip devices with no codecs in i2sbus_resume() - media: rc: ttusbir: respect DMA coherency rules - ALSA: aoa: i2sbus: clear stale prepared state - ALSA: aoa: Use guard() for mutex locks - f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally - ksmbd: replace connection list with hash table - ksmbd: use msleep instaed of schedule_timeout_interruptible() - f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io() - smb: move some duplicate definitions to common/smbacl.h - iommu/amd: serialize sequence allocation under concurrent TLB invalidations - x86/shstk: Prevent deadlock during shstk sigreturn - ALSA: pcmtest: Fix resource leaks in module init error paths - ALSA: pcmtest: fix reference leak on failed device registration - ALSA: 6fire: Fix input volume change detection - ALSA: caiaq: Fix control_put() result and cache rollback - ALSA: core: Fix potential data race at fasync handling - Revert "ALSA: usb-audio: Cap the packet size pre-calculations" - ipv6: sit: reload inner IPv6 header after GSO offloads - net: guard timestamp cmsgs to real error queue skbs - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() - netfilter: x_tables: avoid leaking percpu counter pointers - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush - netfilter: require Ethernet MAC header before using eth_hdr() - netfilter: nft_fib: fix stale stack leak via the OIFNAME register - vsock/virtio: reset connection on receiving queue overflow - vsock/virtio: fix skb overhead accounting to preserve full buf_alloc - vsock/virtio: fix potential unbounded skb queue - mptcp: pm: ADD_ADDR rtx: always decrease sk refcount - mptcp: pm: ADD_ADDR rtx: allow ID 0 - ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers - srcu: Use irq_work to start GP in tiny SRCU - irqwork: Move data struct to a types header - types: move struct rcuwait into types.h - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets - wifi: iwlwifi: fix 22000 series SMEM parsing - wifi: iwlwifi: allow IWL_FW_CHECK() with just a string - x86: shadow stacks: proper error handling for mmap lock - net: mvpp2: sync RX data at the hardware packet offset - net: mvpp2: limit XDP frame size to the RX buffer - batman-adv: fix tp_meter counter underflow during shutdown - batman-adv: v: stop OGMv2 on disabled interface - ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger - spi: mpc52xx: fix controller deregistration - thunderbolt: Bound root directory content to block size - selinux: fix overlayfs mmap() and mprotect() access checks - lsm: add backing_file LSM hooks - fs: constify file ptr in backing_file accessor helpers - fs: prepare for adding LSM blob to backing_file - selftests/bpf: Add tests for ld_{abs,ind} failure path in subprogs - bpf: Fix ld_{abs,ind} failure path analysis in subprogs - KVM: x86: Fix shadow paging use-after-free due to unexpected role - Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref - Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() - fix kabi for ppp_defs.h - pppoe: drop PFC frames - netfilter: nat: use kfree_rcu to release ops - drm/i915/gem: Fix phys BO pread/pwrite with offset - selinux: allow multiple opens of /sys/fs/selinux/policy - ksmbd: make ksmbd thread names distinct by client IP - ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path - ALSA: caiaq: Don't abort when no input device is available - ALSA: caiaq: fix usb_dev refcount leak on probe failure - ALSA: caiaq: Handle probe errors properly - ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow - USB: cdc-acm: Fix bit overlap and move quirk definitions to header - ALSA: caiaq: take a reference on the USB device in create_card() - ALSA: usb-audio: apply quirk for MOONDROP JU Jiu - ksmbd: use check_add_overflow() to prevent u16 DACL size overflow - ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment - smb: server: fix max_connections off-by-one in tcp accept path - smb: server: fix active_num_conn leak on transport allocation failure - usb: port: add delay after usb_hub_set_port_power() - USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen - usb: storage: Expand range of matched versions for VL817 quirks entry - xfrm: Wait for RCU readers during policy netns exit - KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing - mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison - thunderbolt: Clamp XDomain response data copy to allocation size - bpf: return VMA snapshot from task_vma iterator - bpf: switch task_vma iterator from mmap_lock to per-VMA locks - bpf: fix mm lifecycle in open-coded task_vma iterator - netfilter: nft_ct: bail out on template ct in get eval - drm/amd/display: Bound VBIOS record-chain walk loops - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size - drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() - netfilter: conntrack_irc: fix possible out-of-bounds read - drm/vc4: fix krealloc() memory leak - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error - f2fs: fix data loss caused by incorrect use of nat_entry flag - bnxt_en: Fix NULL pointer dereference - ipv6: mcast: Fix use-after-free when processing MLD queries - ipvs: clear the svc scheduler ptr early on edit - netfilter: synproxy: add mutex to guard hook reference counting - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list - net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr - netlabel: validate unlabeled address and mask attribute lengths - netfilter: bridge: make ebt_snat ARP rewrite writable - tcp: restrict SO_ATTACH_FILTER to priv users - ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER - Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig - misc: fastrpc: fix DMA address corruption due to find_vma misuse - misc: fastrpc: Fix NULL pointer dereference in rpmsg callback - gpio: mvebu: fix NULL pointer dereference in suspend/resume - Bluetooth: fix memory leak in error path of hci_alloc_dev() - Bluetooth: bnep: reject short frames before parsing - Bluetooth: RFCOMM: validate skb length in MCC handlers - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams - RDMA/srp: bound SRP_RSP sense copy by the received length - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN - net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure - sched/psi: fix race between file release and pressure write - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase - rculist: add list_splice_rcu() for private lists - net: skbuff: fix missing zerocopy reference in pskb_carve helpers - ip6_vti: set netns_immutable on the fallback device. - wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() - wifi: rtw88: debugfs: support multiple adapters debugging - erofs: fix use-after-free on sbi->sync_decompress - net: openvswitch: fix possible kfree_skb of ERR_PTR - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() - md: wake raid456 reshape waiters before suspend - dm cache policy smq: check allocation under invalidate lock - Bluetooth: MGMT: validate advertising TLV before type checks - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend - USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL - USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam - USB: serial: option: add support for Rolling Wireless RW135R-GL - USB: serial: io_edgeport: add support for Blackbox IC135A - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr - netfilter: flowtable: strictly check for maximum number of actions - fuse: reject fuse_notify() pagecache ops on directories - fs/mbcache: cancel shrink work before destroying the cache - smb/client: fix possible infinite loop and oob read in symlink_data() - fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp - ata: libata-scsi: do not needlessly defer commands when using PMP with FBS - ata: libata-scsi: do not use the deferred QC feature on PMPs with CBS - ata: libata-scsi: do not use the deferred QC feature for ATA_DEFER_PORT - ata: libata-scsi: improve readability of ata_scsi_qc_issue() - ata: libata-scsi: fix requeue of deferred ATA PASS-THROUGH commands - ata: libata-eh: Fix detection of deferred qc timeouts - ata: libata: cancel pending work after clearing deferred_qc - ata: libata-core: fix cancellation of a port deferred qc work - ata: libata-scsi: rename and improve ata_qc_done() - ata: libata-scsi: simplify ata_scsi_requeue_deferred_qc() - ata: libata-sata: simplify ata_sas_queuecmd() - ata: libata-core: improve tag checks in ata_qc_issue() - ata: libata-eh: correctly handle deferred qc timeouts - ata: libata-scsi: avoid Non-NCQ command starvation - ata: libata: Introduce ata_port_eh_scheduled() - ext4: handle wraparound when searching for blocks for indirect mapped blocks - ext4: fix error pointer dereference in ext4_mb_load_buddy_gfp() - ext4: always allocate blocks only from groups inode can use - ext4: fix e4b bitmap inconsistency reports - ext4: convert bd_buddy_page to bd_buddy_folio - ext4: convert bd_bitmap_page to bd_bitmap_folio - Revert "ext4: fix e4b bitmap inconsistency reports" - ext4: cleanup for ext4_map_blocks - ext4: rename EXT4_GET_BLOCKS_PRE_IO - ext4: drop extent cache when splitting extent fails - ext4: drop extent cache after doing PARTIAL_VALID1 zeroout - ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O - ext4: correct the comments place for EXT4_EXT_MAY_ZEROOUT - ext4: get rid of ppath in ext4_ext_handle_unwritten_extents() - ext4: get rid of ppath in ext4_ext_convert_to_initialized() - ext4: get rid of ppath in ext4_split_convert_extents() - ext4: get rid of ppath in ext4_split_extent() - ext4: get rid of ppath in ext4_force_split_extent_at() - ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 - ext4: subdivide EXT4_EXT_DATA_VALID1 - Revert "ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O" - ext4: get rid of ppath in ext4_split_extent_at() - ext4: get rid of ppath in ext4_ext_insert_extent() - ext4: get rid of ppath in get_ext_path() - ext4: add new ext4_ext_path_brelse() helper - !24596 [sync]urma: fix workqueue use-after-free in ubagg_exit teardown sequence - urma: fix workqueue use-after-free in ubagg_exit teardown sequence - !24607 ub: udma: Optimize udma jetty id access logic. - ub: udma: Optimize udma jetty id access logic. - !24640 [sync]urma: limit ubcore logs in reuse paths - urma: fix workqueue use-after-free in ubagg_exit teardown sequence - !24669 mm/madvise: add MADV_FCMA_ENABLE to set PF_FOLIO_CMA via madvise - mm/madvise: add MADV_FCMA_ENABLE to set PF_FOLIO_CMA via madvise - !24702 [sync]urma: retry import jetty/jfr on EIO from tpid reuse failure - urma: retry import jetty/jfr on EIO from tpid reuse failure - urma: limit ubagg connect exchange logs * Fri Jul 10 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-145.3.18.151.20260710.aae66044906b - !24753 [sync]urma: drain jfe event lists in batches to avoid soft-lockup - urma: drain jfe event lists in batches to avoid soft-lockup - urma: reduce ubagg topo log noise - !24748 [sync]urma: free completion events outside jfe lock - urma: free jfe events outside lock - urma: free completion events outside jfe lock - !24742 urma: Fix the issue of inaccurate timing for some functions in DFX - !24741 [sync]urma: fix UAF of accessing token_id in log. - urma: Fix the issue of inaccurate timing for some functions in DFX - urma: fix UAF of accessing token_id in log. - !24734 [sync]urma: fix tpid_reuse attached to vtpn causes use_after_free - urma: fix tpid_reuse attached to vtpn causes use_after_free - !24804 [sync]urma: use vzalloc for ubmad tjetty and ini_rtbuffer - !24774 [sync]urma: ratelimit import jetty/jfr error logs - urma: use vzalloc for ubmad tjetty and ini_rtbuffer - !24792 [sync]urma: fix UAF of accessing jfs/jetty in log. - urma: fix UAF of accessing jfs/jetty in log. - urma: ratelimit import jetty/jfr error logs - !24845 [sync]ub/ubdevshm: Support for acquiring va is a sub-range of registered va - ub/ubdevshm: Support for acquiring va is a sub-range of registered va - !24802 [sync]urma: use xarray for ubagg/ubcore session lookup - urma: use xarray for ubagg/ubcore session lookup - !24814 [sync]urma: make ratelimit burst configurable for ubcore/uburma/ubagg - urma: make ratelimit burst configurable for ubcore/uburma/ubagg * Wed Jul 22 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-145.3.22.153.20260722.158daf1d8dea - !24942 [sync]urma: drop param_set_uint_minmax for ratelimit burst setters - urma: drop param_set_uint_minmax for ratelimit burst setters - !25840 sync CVE LTS and bugfix from OLK-6.6 d33ffc8f8580 to 334dfd575ba5 - cgroup/rstat: avoid disabling irqs for O(num_cpu) - netfilter: bridge: eb_tables: close module init race - crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents - netfilter: ebtables: move to two-stage removal scheme - crypto: qat - protect service table iterations with service_lock - Bluetooth: eir: Fix stack OOB write when prepending the Flags AD - drm/edid: fix OOB read in drm_parse_tiled_block() - proc: protect ptrace_may_access() with exec_update_lock (FD links) - vfio/pci: Latch disable_idle_d3 per device - bpf: Fix UAF in sock clone early bailouts - bpf: Disable xfrm_decode_session hook attachment - bpf,fork: wipe ->bpf_storage before bailouts that access it - KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() - crypto: qat - validate RSA CRT component lengths - bpf: Clear rb node linkage when freeing bpf_rb_root - bpf: Add validation for bpf_set_retval argument - bpf: Reject sleepable BPF_LSM_CGROUP programs at load time - bpf: Fix setting retval to -EPERM for cgroup hooks not returning errno - bpf: Guard __get_user acesss with access_ok for uprobe_multi data - i2c: core: fix adapter registration race - ALSA: hda/cs35l41: Fix firmware load work teardown - vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc - iommufd: Break the loop on failure in iommufd_fault_fops_read() - posix-cpu-timers: Prevent UAF caused by non-leader exec() race - iio: event: Fix event FIFO reset race - hwrng: virtio: clamp device-reported used.len at copy_data() - crypto: drbg - Fix returning success on failure in CTR_DRBG - crypto: ecc - Fix carry overflow in vli multiplication - crypto: pcrypt - restore callback for non-parallel fallback - net: openvswitch: reject oversized nested action attrs - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page - e1000e: Fix out-of-bounds MMIO access by validating BAR0 size - xsched: enforce permissions on attribute access - xsched: restrict vstream management to privileged users - rme: use DMA API for virtio in realm world - udf: validate sparing table length as an entry count, not a byte count - smb: client: harden POSIX SID length parsing - smb: client: mask server-provided mode to 07777 in modefromsid - smb: client: Fix next buffer leak in receive_encrypted_standard() - nvmet-auth: validate reply message payload bounds against transfer length - bpf: Reject fragmented frames in devmap - bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized - mm/huge_memory: update file PMD counter before folio_put() - sctp: fix uninit-value in __sctp_rcv_asconf_lookup() - smb: client: reject overlapping data areas in SMB2 responses - smb: client: restrict implied bcc[0] exemption to responses without data area - io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item - writeback: drop now-unnecessary rcu_barrier() in cgroup_writeback_umount() - writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() - writeback: Fix use after free in inode_switch_wbs_work_fn() - writeback: Avoid contention on wb->list_lock when switching inodes - block: skip sync_blockdev() on surprise removal in bdev_mark_dead() - mm: do file ownership checks with the proper mount idmap - tracing: Bound synthetic-field strings with seq_buf - perf/core: Detach event groups during remove_on_exec - bpf: Allow LPM map access from sleepable BPF programs - bpf: Consistently use bpf_rcu_lock_held() everywhere - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC - udf: validate VAT header length against the VAT inode size - isofs: bound Rock Ridge symlink components to the SL record - udf: validate free block extents against the partition length - config: arm64: update CONFIG_FTRACE_STARTUP_TEST not set - crypto: qat - Return pointer directly in adf_ctl_alloc_resources - crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() - drivers/base/memory: set mem->altmap after successful device registration - serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails - serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero - NFS: Prevent resource leak in nfs_alloc_server() - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr - nfsd: check get_user() return when reading princhashlen - fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode - fbdev: modedb: fix a possible UAF in fb_find_mode() - fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var - power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path - 9p: avoid putting oldfid in p9_client_walk() error path - ocfs2: reject oversized group bitmap descriptors - rpmsg: char: Fix use-after-free on probe error path - fpga: region: fix use-after-free in child_regions_with_firmware() - irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove - pNFS: Fix use-after-free in pnfs_update_layout() - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done - hdlc_ppp: sync per-proto timers before freeing hdlc state - gfs2: fix use-after-free in gfs2_qd_dealloc - exfat: fix potential use-after-free in exfat_find_dir_entry() - bpf: use kvfree() for replaced sysctl write buffer - f2fs: keep atomic write retry from zeroing original data - f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node() - f2fs: validate ACL entry sizes in f2fs_acl_from_disk() - f2fs: fix to round down start offset of fallocate for pin file - f2fs: validate compress cache inode only when enabled - wifi: iwlwifi: mvm: fix race condition in PTP removal - wifi: rtw88: usb: fix memory leaks on USB write failures - wifi: rtw88: increase TX report timeout to fix race condition - wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor - wifi: ath11k: fix warning when unbinding - wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S - keys: Pin request_key_auth payload in instantiate paths - KEYS: fix overflow in keyctl_pkey_params_get_2() - err.h: use __always_inline on all error pointer helpers - fbdev: fix use-after-free in store_modes() - NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR - apparmor: mediate the implicit connect of TCP fast open sendmsg - net: skmsg: preserve sg.copy across SG transforms - mac802154: llsec: add skb_cow_data() before in-place crypto - af_unix: Set gc_in_progress to true in unix_gc(). - ntfs3: reject direct userspace writes to reserved $LX* xattrs - ipv4: account for fraggap on the paged allocation path - inet: add indirect call wrapper for getfrag() calls - ipv6: account for fraggap on the paged allocation path - batman-adv: tvlv: avoid race of cifsnotfound handler state - batman-adv: tvlv: enforce 2-byte alignment - batman-adv: dat: prevent false sharing between VLANs - batman-adv: tt: track roam count per VID - batman-adv: tt: don't merge change entries with different VIDs - batman-adv: tp_meter: handle overlapping packets - batman-adv: tp_meter: prevent parallel modifications of last_recv - batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE - batman-adv: tp_meter: restrict number of unacked list entries - batman-adv: v: prevent OGM aggregation on disabled hardif - batman-adv: frag: avoid underflow of TTL - batman-adv: frag: ensure fragment is writable before modifying TTL - batman-adv: fix (m|b)cast csum after decrementing TTL - batman-adv: ensure bcast is writable before modifying TTL - batman-adv: tp_meter: initialize last_recv_time during init - batman-adv: prevent ELP transmission interval underflow - batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE - batman-adv: tp_meter: add only finished tp_vars to lists - batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection - batman-adv: tp_meter: fix fast recovery precondition - batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd - batman-adv: tp_meter: avoid window underflow - batman-adv: tp_meter: initialize dec_cwnd explicitly - batman-adv: tp_meter: initialize dup_acks explicitly - batman-adv: tp_meter: keep unacked list in ascending ordered - eventpoll: rename ep_remove_safe() back to ep_remove() - file: add fput() cleanup helper - media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si - ksmbd: reject non-VALID session in compound request branch - scripts/sorttable: Fix endianness handling in build-time mcount sort - scripts/sorttable: Allow matches to functions before function entry - scripts/sorttable: Use normal sort if theres no relocs in the mcount section - ftrace: Check against is_kernel_text() instead of kaslr_offset() - ftrace: Test mcount_loc addr before calling ftrace_call_addr() - ftrace: Do not over-allocate ftrace memory - ftrace: Have ftrace pages output reflect freed pages - ftrace: Update the mcount_loc check of skipped entries - scripts/sorttable: Zero out weak functions in mcount_loc table - scripts/sorttable: Always use an array for the mcount_loc sorting - scripts/sorttable: Have mcount rela sort use direct values - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 - scripts/sorttable: Use a structure of function pointers for elf helpers - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly - scripts/sorttable: Move code from sorttable.h into sorttable.c - scripts/sorttable: Use uint64_t for mcount sorting - scripts/sorttable: Add helper functions for Elf_Sym - scripts/sorttable: Add helper functions for Elf_Shdr - scripts/sorttable: Add helper functions for Elf_Ehdr - scripts/sorttable: Convert Elf_Sym MACRO over to a union - scripts/sorttable: Replace Elf_Shdr Macro with a union - scripts/sorttable: Convert Elf_Ehdr to union - scripts/sorttable: Make compare_extable() into two functions - scripts/sorttable: Have the ORC code use the _r() functions to read - scripts/sorttable: Remove unneeded Elf_Rel - scripts/sorttable: Remove unused write functions - scripts/sorttable: Remove unused macro defines - fuse: re-lock request before replacing page cache folio - slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD - slimbus: qcom-ngd-ctrl: Fix up platform_driver registration - rxrpc: Fix the ACK parser to extract the SACK table for parsing - net: phonet: free phonet_device after RCU grace period - phonet: Pass net and ifindex to phonet_address_notify(). - phonet: Pass ifindex to fill_addr(). - Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs - hv: utils: handle and propagate errors in kvp_register - regulator: core: fix locking in regulator_resolve_supply() error path - ring-buffer: Remove ring_buffer_read_prepare_sync() - selftests/bpf: Update comments find_equal_scalars->sync_linked_regs - af_unix: Reject SIOCATMARK on non-stream sockets - selftests/bpf: Add test to ensure kprobe_multi is not sleepable - agp/amd64: Fix broken error propagation in agp_amd64_probe() - net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() - i2c: stub: Reject I2C block transfers with invalid length - RDMA/bnxt_re: zero shared page before exposing to userspace - KVM: VMX: Update SVI during runtime APICv activation - ARM: fix branch predictor hardening - ARM: fix hash_name() fault - ARM: allow __do_kernel_fault() to report execution of memory faults - ARM: group is_permission_fault() with is_translation_fault() - debugobjects: Dont call fill_pool() in early boot hardirq context - debugobjects: Do not fill_pool() if pi_blocked_on - debugobjects: Use LD_WAIT_CONFIG instead of LD_WAIT_SLEEP - debugobjects: Allow to refill the pool before SYSTEM_SCHEDULING - batman-adv: tt: prevent TVLV entry number overflow - drm/v3d: Skip CSD when it has zeroed workgroups - drm/v3d: Store the active job inside the queue's state - iov_iter: Fix potential underflow in iov_iter_extract_xarray_pages() - urma: add check type in free driver obj - smb: client: fix double-free in SMB2_close() replay - smb: client: fix double-free in SMB2_flush() replay - smb: client: fix query_info() replay double-free - smb: client: fix query directory replay double-free - smb: client: fix double-free in SMB2_open() replay - smb: client: fix double-free in SMB2_ioctl() replay - smb: client: fix change notify replay double-free - HID: lg-g15: cancel pending work on remove to fix a use-after-free - HID: multitouch: fix out-of-bounds bit access on mt_io_flags - tracing: Prevent out-of-bounds read in glob matching - sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT - !25616 sync CVE LTS and bugfix from OLK-6.6 b72db20c0437 to d33ffc8f8580 - KVM: x86: hyper-v: Bound the bank index when querying sparse banks - MIPS: DEC: Prevent initial console buffer from landing in XKPHYS - ksmbd: fix durable reconnect error path file lifetime - ksmbd: fix use-after-free in smb2_open during durable reconnect - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query - USB: iowarrior: fix use-after-free on disconnect race - usb: iowarrior: remove inherent race with minor number - USB: iowarrior: fix use-after-free on disconnect - apparmor: fix use-after-free in rawdata dedup loop - tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR - bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops - rbd: eliminate a race in lock_dwork draining on unmap - blk-cgroup: fix UAF in __blkcg_rstat_flush() - net: Fix kabi breakage of struct tc_action - net/sched: act_api: use RCU with deferred freeing for action lifecycle - net: Fix kabi breakage of struct header_ops - bonding: prevent potential infinite loop in bond_header_parse() - bonding: fix type confusion in bond_setup_by_slave() - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc - ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL - ASoC: cs35l56: Fix missing calls to wm_adsp2_remove() - time: Fix off-by-one in compat settimeofday() usec validation - scsi: target: Fix hexadecimal CHAP_I handling - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink - ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY - ksmbd: add a permission check for FSCTL_SET_ZERO_DATA - ksmbd: add per-handle permission check to FILE_LINK_INFORMATION - mptcp: fix missing wakeups in edge scenarios - mptcp: add-addr: always drop other suboptions - ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 - RDMA/umem: fix kernel-doc warnings - mm/migrate: don't call folio_putback_active_hugetlb() on dst hugetlb folio - usb: typec: ucsi: Don't update power_supply on power role change if not connected - serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() - thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() - usb: typec: ucsi: Check if power role change actually happened before handling - usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind - usb: dwc3: xilinx: fix error handling in zynqmp init error paths - usb: musb: omap2430: Fix use-after-free in omap2430_probe() - tty: serial: samsung: Remove redundant port lock acquisition in rx helpers - tty: serial: samsung: use u32 for register interactions - serial: samsung_tty: Use port lock wrappers - ALSA: firewire-motu: Protect register DSP event queue positions - memfd: deny writeable mappings when implying SEAL_WRITE - iio: dac: ad5686: fix ref bit initialization for single-channel parts - usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure - iio: chemical: scd30: fix division by zero in write_raw - iio: chemical: scd30: Use guard(mutex) to allow early returns - iio: gyro: adis16260: fix division by zero in write_raw - Bluetooth: hci_qca: Convert timeout from jiffies to ms - Bluetooth: hci_qca: Migrate to serdev specific shutdown function - serdev: Provide a bustype shutdown function - serdev: make serdev_bus_type const - mm/damon/sysfs-schemes: delete tried region in regions_rmdirs() - mptcp: do not drop partial packets - mptcp: introduce the mptcp_init_skb helper - iio: adc: npcm: fix unbalanced clk_disable_unprepare() - iio: adc: npcm: Convert to platform remove callback returning void - octeontx2-pf: avoid double free of pool->stack on AQ init failure - af_unix: Fix UAF read of tail->len in unix_stream_data_wait() - af_unix: Cache state->msg in unix_stream_read_generic(). - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg - net: hsr: defer node table free until after RCU readers - mptcp: pm: fix ADD_ADDR timer infinite retry on option space insufficient - ice: fix VF queue configuration with low MTU values - mptcp: reset rcv wnd on disconnect - mptcp: cleanup fallback dummy mapping generation - octeontx2-af: CGX: add bounds check to cgx_speed_mbps index - octeontx2-af: replace deprecated strncpy with strscpy - cgroup/cpuset: Reset DL migration state on can_attach() failure - fbdev/vt8500lcdfb: Initialize fb_ops with fbdev macros - soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get() - driver core: reject devices with unregistered buses - drm/amd/display: Use krealloc_array() in dal_vector_reserve() - drm/amdgpu: restart the CS if some parts of the VM are still invalidated - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 - drm/amdkfd: fix NULL dereference in get_queue_ids() - slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock - slimbus: qcom-ngd-ctrl: fix OF node refcount - thunderbolt: Limit XDomain response copy to actual frame size - sctp: stream: fully roll back denied add-stream state - mmc: sdhci: add signal voltage switch in sdhci_resume_host - mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC - mmc: litex_mmc: Set mandatory idle clocks before CMD0 - mmc: core: Fix host controller programming for fixed driver type - mm/hugetlb: restore reservation on error in hugetlb folio copy paths - octeontx2-af: fix memory leak in rvu_setup_hw_resources() - nvmem: layouts: onie-tlv: fix hang on unknown types - net: rds: clear i_sends on setup unwind - net: mv643xx: fix OF node refcount - net/mlx5: Reorder completion before putting command entry in cmd_work_handler - misc: fastrpc: fix use-after-free race in fastrpc_map_create - misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context - Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard - i2c: tegra: Fix NOIRQ suspend/resume - i2c: stm32f7: fix timing computation ignoring i2c-analog-filter - i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() - pidfd: refuse access to tasks that have started exiting harder - ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write - vsock/vmci: fix sk_ack_backlog leak on failed handshake - wifi: nl80211: reject oversized EMA RNR lists - selftests: mptcp: add test for extra_subflows underflow on userspace PM - mptcp: sockopt: check timestamping ret value - mptcp: allow subflow rcv wnd to shrink - mptcp: close TOCTOU race while computing rcv_wnd - mptcp: fix retransmission loop when csum is enabled - ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow - ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O - ARM: socfpga: Fix OF node refcount leak in SMP setup - mm/damon/ops-common: call folio_test_lru() after folio_get() - drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info() - ALSA: timer: Fix UAF at snd_timer_user_params() - USB: serial: option: add usb-id for Dell Wireless DW5826e-m - xfrm: espintcp: do not reuse an in-progress partial send - ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL - mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation - tracing/probes: Point the error offset correctly for eprobe argument error - netfilter: nft_tunnel: fix use-after-free on object destroy - clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time - net: mvpp2: build skb from XDP-adjusted data on XDP_PASS - net: mvpp2: refill RX buffers before XDP or skb use - net: mvpp2: Add metadata support for xdp mode - netfilter: nf_log: validate MAC header was set before dumping it - rds: mark snapshot pages dirty in rds_info_getsockopt() - net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion - r8152: handle the return value of usb_reset_device() - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove - net: phy: clean the sfp upstream if phy probing fails - net/mlx4: avoid GCC 10 __bad_copy_from() false positive - ASoC: wm_adsp: Fix NULL dereference when removing firmware controls - arm64: tlb: Allow XZR argument to TLBI ops - KVM: arm64: Remove VPIPT I-cache handling - tools/rv: Fix cleanup after failed trace setup - time: Fix off-by-one in settimeofday() usec validation - ipmi: Fix rcu_read_unlock to srcu_read_unlock in handle_read_event_rsp - ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() - vxlan: vnifilter: fix spurious notification on VNI update - vxlan: vnifilter: send notification on VNI add - octeontx2-af: npc: Fix CPT channel mask in npc_install_flow - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown - ptp: vclock: Switch from RCU to SRCU - net: fec: fix pinctrl default state restore order on resume - net: lan743x: permit VLAN-tagged packets up to configured MTU - net: garp: fix unsigned integer underflow in garp_pdu_parse_attr - hsr: Remove WARN_ONCE() in hsr_addr_is_self(). - net: Annotate sk->sk_write_space() for UDP SOCKMAP. - pcnet32: stop holding device spin lock during napi_complete_done - drm/imx: Fix three kernel-doc warnings in dcss-scaler.c - 6lowpan: fix off-by-one in multicast context address compression - netfilter: xt_NFQUEUE: prefer raw_smp_processor_id - tee: optee: prevent use-after-free when the client exits before the supplicant - net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS - Disable -Wattribute-alias for clang-23 and newer - RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug - USB: serial: mct_u232: fix memory corruption with small endpoint - usb: core: Fix SuperSpeed root hub wMaxPacketSize - serial: zs: Convert to use a platform device - serial: dz: Convert to use a platform device - serial: dz: Fix bootconsole handover lockup - xhci: tegra: Fix ghost USB device on dual-role port unplug - USB: serial: digi_acceleport: fix memory corruption with small endpoints - landlock: Fix handling of disconnected directories - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync - USB: serial: cypress_m8: fix memory corruption with small endpoint - serial: zs: Switch to using channel reset - serial: zs: Fix bootconsole handover lockup - serial: dz: Fix bootconsole message clobbering at chip reset - drm/amdkfd: Check for pdd drm file first in CRIU restore path - drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger - drm/amdkfd: fix NULL pointer bug in svm_range_set_attr - serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma - serial: zs: Fix swapped RI/DSR modem line transition counting - serial: sh-sci: fix memory region release in error path - serial: qcom-geni: fix UART_RX_PAR_EN bit position - serial: altera_jtaguart: handle uart_add_one_port() failures - drm/amd/pm/si: Disregard vblank time when no displays are connected - drm/i915: Fix potential UAF in TTM object purge - drm/hyperv: validate VMBus packet size in receive callback - drm/hyperv: validate resolution_count and fix WIN8 fallback - scsi: target: iscsi: Validate CHAP_R length before base64 decode - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 - scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker - thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow - thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() - usb: gadget: f_fs: copy only received bytes on short ep0 read - usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports - usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling - usb: gadget: f_hid: fix device reference leak in hidg_alloc() - usb: gadget: net2280: Fix double free in probe error path - USB: serial: mct_u232: fix missing interrupt-in transfer sanity check - USB: serial: mxuport: fix memory corruption with small endpoint - USB: serial: keyspan: fix missing indat transfer sanity check - USB: serial: cypress_m8: validate interrupt packet headers - USB: serial: belkin_sa: validate interrupt status length - USB: serial: option: add MeiG SRM813Q - usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize - usb: usbtmc: check URB actual_length for interrupt-IN notifications - usbip: vudc: Fix use after free bug in vudc_remove due to race condition - usb: storage: Add quirks for PNY Elite Portable SSD - USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers - usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval - usb: chipidea: core: convert ci_role_switch to local variable - tty: serial: pch_uart: add check for dma_alloc_coherent() - counter: Fix refcount leak in counter_alloc() error path - comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() - comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() - Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 - Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem - Input: xpad - add support for ASUS ROG RAIKIRI II - Input: xpad - add "Nova 2 Lite" from GameSir - ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks - ASoC: qcom: q6asm-dai: close stream only when running - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check - xfrm: ah: use skb_to_full_sk in async output callbacks - xfrm: route MIGRATE notifications to caller's netns - nfc: hci: fix out-of-bounds read in HCP header parsing - iommu, debugobjects: avoid gcc-16.1 section mismatch warnings - HID: wacom: Fix OOB write in wacom_hid_set_device_mode() - ip6: vti: Use ip6_tnl.net in vti6_changelink(). - xfrm: input: hold netns during deferred transport reinjection - ipv6: validate extension header length before copying to cmsg - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). - ipv6: exthdrs: refresh nh after handling HAO option - ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() - macsec: fix replay protection at XPN lower-PN wrap - bpf: sockmap: fix tail fragment offset in bpf_msg_push_data - Input: elan_i2c - validate firmware size before use - usb: dwc2: Fix use after free in debug code - usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles - usb: cdns3: gadget: fix request skipping after clearing halt - USB: serial: omninet: fix memory corruption with small endpoint - iio: buffer: hw-consumer: fix use-after-free in error path - iio: light: cm3323: fix reg_conf not being initialized correctly - iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL - iio: temperature: tsys01: fix broken PROM checksum validation - iio: ssp_sensors: cancel delayed work_refresh on remove - iio: gyro: itg3200: fix i2c read into the wrong stack location - iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw - iio: dac: ad5686: acquire lock when doing powerdown control - iio: dac: ad5686: fix input raw value check - iio: dac: max5821: fix return value check in powerdown sync - iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux - wireguard: send: append trailer after expanding head - KVM: arm64: PMU: Preserve AArch32 counter low bits - parport: Fix race between port and client registration - Input: xpad - fix out-of-bounds access for Share button - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock - Bluetooth: ISO: fix UAF in iso_recv_frame - Bluetooth: HIDP: fix missing length checks in hidp_input_report() - auxdisplay: line-display: fix OOB read on zero-length message_store() - hpfs: fix a crash if hpfs_map_dnode_bitmap fails - Bluetooth: btusb: Allow firmware re-download when version matches - HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse - Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() - USB: serial: safe_serial: fix memory corruption with small endpoint - usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT - usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() - usb: typec: altmodes/displayport: validate count before reading Status Update VDO - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO - usb: typec: ucsi: ccg: reject firmware images without a ':' record header - iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer - soc/tegra: pmc: Fix unsafe generic_handle_irq() call - hwmon: (pmbus/adm1266) serialize NVMEM blackbox read with pmbus_lock - hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock - of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() - phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X - drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used - drm/dp: Add eDP 1.5 bit definition - drm/i915/psr: Read Intel DPCD workaround register - drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register - media: rc: fix race between unregister and urb/irq callbacks - batman-adv: bla: avoid double decrement of bla.num_requests - batman-adv: tt: avoid empty VLAN responses - batman-adv: tt: fix TOCTOU race for reported vlans - batman-adv: tp_meter: directly shut down timer on cleanup - batman-adv: tp_meter: avoid role confusion in tp_list - batman-adv: iv: recover OGM scheduling after forward packet error - batman-adv: tvlv: reject oversized TVLV packets - batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface - batman-adv: tt: reject oversized local TVLV buffers - batman-adv: tvlv: abort OGM send on tvlv append failure - net: skbuff: fix pskb_carve leaking zcopy pages - ipv6: fix possible infinite loop in fib6_select_path() - ipv6: fix possible infinite loop in rt6_fill_node() - sctp: fix race between sctp_wait_for_connect and peeloff - net: mana: Add NULL guards in teardown path to prevent panic on attach failure - gpio: rockchip: convert bank->clk to devm_clk_get_enabled() - Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() - ethtool: eeprom: add more safeties to EEPROM Netlink fallback - ethtool: eeprom: add missing ethnl_ops_begin() / _complete() during fallback - bonding: refuse to enslave CAN devices - Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() - ASoC: codecs: simple-mux: Fix enum control bounds check - ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() - gpio: mxc: fix irq_high handling - net: hsr: fix potential OOB access in supervision frame handling - ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues - net/iucv: fix locking in .getsockopt - net/smc: Do not re-initialize smc hashtables - net: netlink: don't set nsid on local notifications - net: netlink: fix sending unassigned nsid after assigned one - vsock: keep poll shutdown state consistent - netfilter: nf_tables: fix dst corruption in same register operation - netfilter: bitwise: add support for doing AND, OR and XOR directly - netfilter: bitwise: rename some boolean operation functions - netfilter: ebtables: fix OOB read in compat_mtw_from_user - netfilter: xt_cpu: prefer raw_smp_processor_id - netfilter: synproxy: refresh tcphdr after skb_ensure_writable - xfrm: Check for underflow in xfrm_state_mtu - nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() - nfc: llcp: Fix use-after-free in llcp_sock_release() - net: cpsw_new: Fix potential unregister of netdev that has not been registered yet - drm: Remove plane hsub/vsub alignment requirement for core helpers - net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net: mctp: ensure our nlmsg responses are initialised - Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size - MIPS: smp: report dying CPU to RCU in stop_this_cpu() - LoongArch: Report dying CPU to RCU in stop_this_cpu() - irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT - tls: Flush backlog before waiting for a new record - net: ethernet: cortina: No mapping is a dropped rx - batman-adv: fix batadv_skb_is_frag() kernel-doc - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled - Bluetooth: ISO: fix malformed ISO_END/CONT handling - Bluetooth: MGMT: Fix backward compatibility with userspace - security/keys: fix missed RCU read section on lookup - LoongArch: kprobes: Fix handling of fatal unrecoverable recursions - pds_core: ensure null-termination for firmware version strings - pds_core: add an error code check in pdsc_dl_info_get - net: mana: validate rx_req_idx to prevent out-of-bounds array access - ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove() - gpio: cdev: check if uAPI v2 config attributes are correctly zeroed - gpiolib: cdev: use !mem_is_zero() instead of memchr_inv(s, 0, n) - string: add mem_is_zero() helper to check if memory area is all zeros - bpf, skmsg: fix verdict sk_data_ready racing with ktls rx - net: ag71xx: check error for platform_get_irq - Bluetooth: btmtk: rename btmediatek_data - Bluetooth: btusb: mediatek: refactor the function btusb_mtk_reset - Bluetooth: btmtk: add the function to get the fw name - ALSA: seq: Serialize UMP output teardown with event_input - ALSA: seq: ump: Use guard() for locking - pds_core: fix debugfs_lookup dentry leak and error handling - pds_core: fix error handling in pdsc_devcmd_wait - bridge: mcast: Fix a possible use-after-free when removing a bridge port - net: bridge: Flush multicast groups when snooping is disabled - RDMA/rtrs: Fix use-after-free in path file creation cleanup - platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL - platform/x86: intel-hid: Check ACPI_HANDLE() against NULL - platform/x86: hp_accel: Check ACPI_COMPANION() against NULL - platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer - net: dsa: mt7530: preserve VLAN tags on trapped link-local frames - net: dsa: mt7530: rename mt753x_bpdu_port_fw enum to mt753x_to_cpu_fw - net: dsa: mt7530: fix FDB entries not aging out with short timeout - wifi: ath11k: fix peer resolution on rx path when peer_id=0 - drm/msm/snapshot: fix dumping of the unaligned regions - spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache() - net/mlx5: Do not restore destination-less TC rules - tls: Preserve sk_err across recvmsg() when data has been copied - x86/xen: Fix xen_e820_swap_entry_with_ram() - net: phy: DP83TC811: add reading of abilities - net: phy: c45: add genphy_c45_pma_read_ext_abilities() function - net: tls: prevent chain-after-chain in plain text SG - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot - powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise() - drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN - drm/msm/dsi: don't dump registers past the mapped region - ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics - net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint - accel/qaic: Add overflow check to remap_pfn_range during mmap - HID: quirks: really enable the intended work around for appledisplay - wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm() - wifi: ath11k: fix error path leaks in some WMI WOW calls - net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS reference - net: ethernet: cortina: Carry over frag counter - net: ethernet: cortina: Drop half-assembled SKB - net: ethernet: cortina: Make RX SKB per-port - netfs: Fix overrun check in netfs_extract_user_iter() - zonefs: handle integer overflow in zonefs_fname_to_fno - irqchip/ath79-cpu: Remove unused function - phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access - net: lan966x: avoid unregistering netdev on register failure - ice: fix locking in ice_dcb_rebuild() - tcp: Fix imbalanced icsk_accept_queue count. - test_kprobes: clear kprobes between test runs - kprobes: skip non-symbol addresses in kprobe_add_ksym_blacklist() - netfilter: x_tables: unregister the templates first - ALSA: hda: cs35l56: Put ACPI device after setting companion - ARM: integrator: Fix early initialization - pinctrl: qcom: Fix wakeirq map by removing disconnected irqs for sm8150 - kunit: config: KUNIT_DEBUGFS should depend on DEBUG_FS - kunit: config: Enable KUNIT_DEBUGFS by default - firmware: arm_ffa: Skip free_pages on RX buffer alloc failure - firmware: arm_ffa: Check for NULL FF-A ID table while driver registration - HID: uclogic: Fix regression of input name assignment - hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors - hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe() - hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe() - hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in get_multiple - hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR - hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer - hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer - hwmon: (pmbus/adm1266) reject implausible blackbox record_count - hwmon: (pmbus/adm1266) seed timestamp from the real-time clock - batman-adv: tt: fix negative tt_buff_len - batman-adv: tt: fix negative last_changeset_len - batman-adv: tp_meter: fix race condition in send error reporting - batman-adv: tp_meter: avoid use of uninit sender vars - batman-adv: bla: fix report_work leak on backbone_gw purge - batman-adv: frag: disallow unicast fragment in fragment - batman-adv: fix fragment reassembly length accounting - batman-adv: dat: handle forward allocation error - batman-adv: clear current gateway during teardown - batman-adv: mcast: fix use-after-free in orig_node RCU release - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async - drm/amd/display: Validate GPIO pin LUT table size before iterating - drm/amd/display: Fix integer overflow in bios_get_image() - drm/bridge: megachips: remove bridge when irq request fails - drm/bridge: it66121: acquire reset GPIO in probe - drm/virtio: use uninterruptible resv lock for plane updates - device property: set fwnode->secondary to NULL in fwnode_init() - LoongArch: Remove unused code to avoid build warning - RDMA/siw: Reject MPA FPDU length underflow before signed receive math - spi: ti-qspi: fix use-after-free after DMA setup failure - spi: sprd: fix error pointer deref after DMA setup failure - scsi: isci: Fix use-after-free in device removal path - phy: tegra: xusb: Fix per-pad high-speed termination calibration - spi: qup: fix error pointer deref after DMA setup failure - drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe - KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits - arm64: probes: Handle probes on hinted conditional branch instructions - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() - ice: fix setting promisc mode while adding VID filter - ixgbevf: fix use-after-free in VEPA multicast source pruning - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 - wifi: ath11k: clear shared SRNG pointer state on restart - vsock/vmci: fix UAF when peer resets connection during handshake - ring-buffer: Fix reporting of missed events in iterator - qed: fix double free in qed_cxt_tables_alloc() - netfilter: ipset: stop hash:* range iteration at end - netfilter: nf_queue: hold bridge skb->dev while queued - netfilter: ip6t_hbh: reject oversized option lists - net: ifb: report ethtool stats over num_tx_queues - net: bcmgenet: keep RBUF EEE/PM disabled - phonet/pep: disable BH around forwarded sk_receive_skb() - Bluetooth: MGMT: validate Add Extended Advertising Data length - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths - Bluetooth: bnep: Fix UAF read of dev->name - Bluetooth: ISO: drop ISO_END frames received without prior ISO_START - net: wwan: iosm: fix potential memory leaks in ipc_imem_init() - drivers/base/memory: fix memory block reference leak in poison accounting - efi: Allocate runtime workqueue before ACPI init - ALSA: asihpi: Fix potential OOB array access at reading cache - ALSA: pcm: Don't setup bogus iov_iter for silencing - ALSA: ua101: Reject too-short USB descriptors - hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX - smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() - ksmbd: fix null pointer dereference in compare_guid_key() - mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break() - sysfs: don't remove existing directory on update failure - Revert "af_unix: Reject SIOCATMARK on non-stream sockets" - Revert "s390/cio: Update purge function to unregister the unused subchannels" - Revert "ice: Remove jumbo_remove step from TX path" - Revert "ice: fix double-free of tx_buf skb" - Revert "x86/vdso: Fix output operand size of RDPID" - wifi: mac80211: check tdls flag in ieee80211_tdls_oper - s390/debug: Reject zero-length input before trimming a newline - mptcp: pm: ADD_ADDR rtx: free sk if last - mptcp: sync the msk->sndbuf at accept() time - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close - netfilter: revalidate bridge ports - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp - net: bonding: fix NULL pointer dereference in bond_do_ioctl() - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() - udp: clear skb->dev before running a sockmap verdict - crypto: nx - Fix packed layout in struct nx842_crypto_header - crypto: nx - Use static_assert() to check struct sizes - batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown - Revert "ALSA: pcmtest: fix reference leak on failed device registration" - media: rc: ttusbir: fix inverted error logic - media: rc: igorplugusb: fix control request setup packet - batman-adv: tp_meter: fix tp_num leak on kmalloc failure - batman-adv: stop tp_meter sessions during mesh teardown - ALSA: seq: Fix UMP group 16 filtering - ALSA: seq: Notify client and port info changes - ALSA: core: Serialize deferred fasync state checks - ALSA: misc: Use guard() for spin locks - ALSA: hda: cs35l56: Propagate ASP TX source control errors - crypto: nx - Avoid -Wflex-array-member-not-at-end warning - ksmbd: reset rcount per connection in ksmbd_conn_wait_idle_sess_id() - media: rc: igorplugusb: heed coherency rules - ALSA: aoa: Skip devices with no codecs in i2sbus_resume() - media: rc: ttusbir: respect DMA coherency rules - ALSA: aoa: i2sbus: clear stale prepared state - ALSA: aoa: Use guard() for mutex locks - f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally - ksmbd: replace connection list with hash table - ksmbd: use msleep instaed of schedule_timeout_interruptible() - f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io() - smb: move some duplicate definitions to common/smbacl.h - iommu/amd: serialize sequence allocation under concurrent TLB invalidations - x86/shstk: Prevent deadlock during shstk sigreturn - ALSA: pcmtest: Fix resource leaks in module init error paths - ALSA: pcmtest: fix reference leak on failed device registration - ALSA: 6fire: Fix input volume change detection - ALSA: caiaq: Fix control_put() result and cache rollback - ALSA: core: Fix potential data race at fasync handling - Revert "ALSA: usb-audio: Cap the packet size pre-calculations" - ipv6: sit: reload inner IPv6 header after GSO offloads - net: guard timestamp cmsgs to real error queue skbs - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() - netfilter: x_tables: avoid leaking percpu counter pointers - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush - netfilter: require Ethernet MAC header before using eth_hdr() - netfilter: nft_fib: fix stale stack leak via the OIFNAME register - vsock/virtio: reset connection on receiving queue overflow - vsock/virtio: fix skb overhead accounting to preserve full buf_alloc - vsock/virtio: fix potential unbounded skb queue - mptcp: pm: ADD_ADDR rtx: always decrease sk refcount - mptcp: pm: ADD_ADDR rtx: allow ID 0 - ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers - srcu: Use irq_work to start GP in tiny SRCU - irqwork: Move data struct to a types header - types: move struct rcuwait into types.h - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets - wifi: iwlwifi: fix 22000 series SMEM parsing - wifi: iwlwifi: allow IWL_FW_CHECK() with just a string - x86: shadow stacks: proper error handling for mmap lock - net: mvpp2: sync RX data at the hardware packet offset - net: mvpp2: limit XDP frame size to the RX buffer - batman-adv: fix tp_meter counter underflow during shutdown - batman-adv: v: stop OGMv2 on disabled interface - ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger - spi: mpc52xx: fix controller deregistration - thunderbolt: Bound root directory content to block size - selinux: fix overlayfs mmap() and mprotect() access checks - lsm: add backing_file LSM hooks - fs: constify file ptr in backing_file accessor helpers - fs: prepare for adding LSM blob to backing_file - selftests/bpf: Add tests for ld_{abs,ind} failure path in subprogs - bpf: Fix ld_{abs,ind} failure path analysis in subprogs - KVM: x86: Fix shadow paging use-after-free due to unexpected role - Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref - Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() - fix kabi for ppp_defs.h - pppoe: drop PFC frames - netfilter: nat: use kfree_rcu to release ops - drm/i915/gem: Fix phys BO pread/pwrite with offset - selinux: allow multiple opens of /sys/fs/selinux/policy - ksmbd: make ksmbd thread names distinct by client IP - ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path - ALSA: caiaq: Don't abort when no input device is available - ALSA: caiaq: fix usb_dev refcount leak on probe failure - ALSA: caiaq: Handle probe errors properly - ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow - USB: cdc-acm: Fix bit overlap and move quirk definitions to header - ALSA: caiaq: take a reference on the USB device in create_card() - ALSA: usb-audio: apply quirk for MOONDROP JU Jiu - ksmbd: use check_add_overflow() to prevent u16 DACL size overflow - ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment - smb: server: fix max_connections off-by-one in tcp accept path - smb: server: fix active_num_conn leak on transport allocation failure - usb: port: add delay after usb_hub_set_port_power() - USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen - usb: storage: Expand range of matched versions for VL817 quirks entry - xfrm: Wait for RCU readers during policy netns exit - KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing - mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison - thunderbolt: Clamp XDomain response data copy to allocation size - bpf: return VMA snapshot from task_vma iterator - bpf: switch task_vma iterator from mmap_lock to per-VMA locks - bpf: fix mm lifecycle in open-coded task_vma iterator - netfilter: nft_ct: bail out on template ct in get eval - drm/amd/display: Bound VBIOS record-chain walk loops - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size - drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() - netfilter: conntrack_irc: fix possible out-of-bounds read - drm/vc4: fix krealloc() memory leak - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error - f2fs: fix data loss caused by incorrect use of nat_entry flag - bnxt_en: Fix NULL pointer dereference - ipv6: mcast: Fix use-after-free when processing MLD queries - ipvs: clear the svc scheduler ptr early on edit - netfilter: synproxy: add mutex to guard hook reference counting - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list - net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr - netlabel: validate unlabeled address and mask attribute lengths - netfilter: bridge: make ebt_snat ARP rewrite writable - tcp: restrict SO_ATTACH_FILTER to priv users - ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER - Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig - misc: fastrpc: fix DMA address corruption due to find_vma misuse - misc: fastrpc: Fix NULL pointer dereference in rpmsg callback - gpio: mvebu: fix NULL pointer dereference in suspend/resume - Bluetooth: fix memory leak in error path of hci_alloc_dev() - Bluetooth: bnep: reject short frames before parsing - Bluetooth: RFCOMM: validate skb length in MCC handlers - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams - RDMA/srp: bound SRP_RSP sense copy by the received length - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN - net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure - sched/psi: fix race between file release and pressure write - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase - rculist: add list_splice_rcu() for private lists - net: skbuff: fix missing zerocopy reference in pskb_carve helpers - ip6_vti: set netns_immutable on the fallback device. - wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() - wifi: rtw88: debugfs: support multiple adapters debugging - erofs: fix use-after-free on sbi->sync_decompress - net: openvswitch: fix possible kfree_skb of ERR_PTR - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() - md: wake raid456 reshape waiters before suspend - dm cache policy smq: check allocation under invalidate lock - Bluetooth: MGMT: validate advertising TLV before type checks - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend - USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL - USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam - USB: serial: option: add support for Rolling Wireless RW135R-GL - USB: serial: io_edgeport: add support for Blackbox IC135A - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr - netfilter: flowtable: strictly check for maximum number of actions - fuse: reject fuse_notify() pagecache ops on directories - fs/mbcache: cancel shrink work before destroying the cache - smb/client: fix possible infinite loop and oob read in symlink_data() - fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp - ata: libata-scsi: do not needlessly defer commands when using PMP with FBS - ata: libata-scsi: do not use the deferred QC feature on PMPs with CBS - ata: libata-scsi: do not use the deferred QC feature for ATA_DEFER_PORT - ata: libata-scsi: improve readability of ata_scsi_qc_issue() - ata: libata-scsi: fix requeue of deferred ATA PASS-THROUGH commands - ata: libata-eh: Fix detection of deferred qc timeouts - ata: libata: cancel pending work after clearing deferred_qc - ata: libata-core: fix cancellation of a port deferred qc work - ata: libata-scsi: rename and improve ata_qc_done() - ata: libata-scsi: simplify ata_scsi_requeue_deferred_qc() - ata: libata-sata: simplify ata_sas_queuecmd() - ata: libata-core: improve tag checks in ata_qc_issue() - ata: libata-eh: correctly handle deferred qc timeouts - ata: libata-scsi: avoid Non-NCQ command starvation - ata: libata: Introduce ata_port_eh_scheduled() - ext4: handle wraparound when searching for blocks for indirect mapped blocks - ext4: fix error pointer dereference in ext4_mb_load_buddy_gfp() - ext4: always allocate blocks only from groups inode can use - ext4: fix e4b bitmap inconsistency reports - ext4: convert bd_buddy_page to bd_buddy_folio - ext4: convert bd_bitmap_page to bd_bitmap_folio - Revert "ext4: fix e4b bitmap inconsistency reports" - ext4: cleanup for ext4_map_blocks - ext4: rename EXT4_GET_BLOCKS_PRE_IO - ext4: drop extent cache when splitting extent fails - ext4: drop extent cache after doing PARTIAL_VALID1 zeroout - ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O - ext4: correct the comments place for EXT4_EXT_MAY_ZEROOUT - ext4: get rid of ppath in ext4_ext_handle_unwritten_extents() - ext4: get rid of ppath in ext4_ext_convert_to_initialized() - ext4: get rid of ppath in ext4_split_convert_extents() - ext4: get rid of ppath in ext4_split_extent() - ext4: get rid of ppath in ext4_force_split_extent_at() - ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 - ext4: subdivide EXT4_EXT_DATA_VALID1 - Revert "ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O" - ext4: get rid of ppath in ext4_split_extent_at() - ext4: get rid of ppath in ext4_ext_insert_extent() - ext4: get rid of ppath in get_ext_path() - ext4: add new ext4_ext_path_brelse() helper - !24596 [sync]urma: fix workqueue use-after-free in ubagg_exit teardown sequence - urma: fix workqueue use-after-free in ubagg_exit teardown sequence - !24607 ub: udma: Optimize udma jetty id access logic. - ub: udma: Optimize udma jetty id access logic. - !24640 [sync]urma: limit ubcore logs in reuse paths - urma: fix workqueue use-after-free in ubagg_exit teardown sequence - !24669 mm/madvise: add MADV_FCMA_ENABLE to set PF_FOLIO_CMA via madvise - mm/madvise: add MADV_FCMA_ENABLE to set PF_FOLIO_CMA via madvise - !24702 [sync]urma: retry import jetty/jfr on EIO from tpid reuse failure - urma: retry import jetty/jfr on EIO from tpid reuse failure - urma: limit ubagg connect exchange logs * Fri Jul 10 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-145.3.18.151.20260710.aae66044906b - !24753 [sync]urma: drain jfe event lists in batches to avoid soft-lockup - urma: drain jfe event lists in batches to avoid soft-lockup - urma: reduce ubagg topo log noise - !24748 [sync]urma: free completion events outside jfe lock - urma: free jfe events outside lock - urma: free completion events outside jfe lock - !24742 urma: Fix the issue of inaccurate timing for some functions in DFX - !24741 [sync]urma: fix UAF of accessing token_id in log. - urma: Fix the issue of inaccurate timing for some functions in DFX - urma: fix UAF of accessing token_id in log. - !24734 [sync]urma: fix tpid_reuse attached to vtpn causes use_after_free - urma: fix tpid_reuse attached to vtpn causes use_after_free - !24804 [sync]urma: use vzalloc for ubmad tjetty and ini_rtbuffer - !24774 [sync]urma: ratelimit import jetty/jfr error logs - urma: use vzalloc for ubmad tjetty and ini_rtbuffer - !24792 [sync]urma: fix UAF of accessing jfs/jetty in log. - urma: fix UAF of accessing jfs/jetty in log. - urma: ratelimit import jetty/jfr error logs - !24845 [sync]ub/ubdevshm: Support for acquiring va is a sub-range of registered va - ub/ubdevshm: Support for acquiring va is a sub-range of registered va - !24802 [sync]urma: use xarray for ubagg/ubcore session lookup - urma: use xarray for ubagg/ubcore session lookup - !24814 [sync]urma: make ratelimit burst configurable for ubcore/uburma/ubagg - urma: make ratelimit burst configurable for ubcore/uburma/ubagg * Wed Jul 22 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-145.3.22.153.20260722.158daf1d8dea - !24942 [sync]urma: drop param_set_uint_minmax for ratelimit burst setters - urma: drop param_set_uint_minmax for ratelimit burst setters - !25840 sync CVE LTS and bugfix from OLK-6.6 d33ffc8f8580 to 334dfd575ba5 - cgroup/rstat: avoid disabling irqs for O(num_cpu) - netfilter: bridge: eb_tables: close module init race - crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents - netfilter: ebtables: move to two-stage removal scheme - crypto: qat - protect service table iterations with service_lock - Bluetooth: eir: Fix stack OOB write when prepending the Flags AD - drm/edid: fix OOB read in drm_parse_tiled_block() - proc: protect ptrace_may_access() with exec_update_lock (FD links) - vfio/pci: Latch disable_idle_d3 per device - bpf: Fix UAF in sock clone early bailouts - bpf: Disable xfrm_decode_session hook attachment - bpf,fork: wipe ->bpf_storage before bailouts that access it - KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() - crypto: qat - validate RSA CRT component lengths - bpf: Clear rb node linkage when freeing bpf_rb_root - bpf: Add validation for bpf_set_retval argument - bpf: Reject sleepable BPF_LSM_CGROUP programs at load time - bpf: Fix setting retval to -EPERM for cgroup hooks not returning errno - bpf: Guard __get_user acesss with access_ok for uprobe_multi data - i2c: core: fix adapter registration race - ALSA: hda/cs35l41: Fix firmware load work teardown - vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc - iommufd: Break the loop on failure in iommufd_fault_fops_read() - posix-cpu-timers: Prevent UAF caused by non-leader exec() race - iio: event: Fix event FIFO reset race - hwrng: virtio: clamp device-reported used.len at copy_data() - crypto: drbg - Fix returning success on failure in CTR_DRBG - crypto: ecc - Fix carry overflow in vli multiplication - crypto: pcrypt - restore callback for non-parallel fallback - net: openvswitch: reject oversized nested action attrs - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page - e1000e: Fix out-of-bounds MMIO access by validating BAR0 size - xsched: enforce permissions on attribute access - xsched: restrict vstream management to privileged users - rme: use DMA API for virtio in realm world - udf: validate sparing table length as an entry count, not a byte count - smb: client: harden POSIX SID length parsing - smb: client: mask server-provided mode to 07777 in modefromsid - smb: client: Fix next buffer leak in receive_encrypted_standard() - nvmet-auth: validate reply message payload bounds against transfer length - bpf: Reject fragmented frames in devmap - bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized - mm/huge_memory: update file PMD counter before folio_put() - sctp: fix uninit-value in __sctp_rcv_asconf_lookup() - smb: client: reject overlapping data areas in SMB2 responses - smb: client: restrict implied bcc[0] exemption to responses without data area - io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item - writeback: drop now-unnecessary rcu_barrier() in cgroup_writeback_umount() - writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() - writeback: Fix use after free in inode_switch_wbs_work_fn() - writeback: Avoid contention on wb->list_lock when switching inodes - block: skip sync_blockdev() on surprise removal in bdev_mark_dead() - mm: do file ownership checks with the proper mount idmap - tracing: Bound synthetic-field strings with seq_buf - perf/core: Detach event groups during remove_on_exec - bpf: Allow LPM map access from sleepable BPF programs - bpf: Consistently use bpf_rcu_lock_held() everywhere - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC - udf: validate VAT header length against the VAT inode size - isofs: bound Rock Ridge symlink components to the SL record - udf: validate free block extents against the partition length - config: arm64: update CONFIG_FTRACE_STARTUP_TEST not set - crypto: qat - Return pointer directly in adf_ctl_alloc_resources - crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() - drivers/base/memory: set mem->altmap after successful device registration - serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails - serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero - NFS: Prevent resource leak in nfs_alloc_server() - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr - nfsd: check get_user() return when reading princhashlen - fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode - fbdev: modedb: fix a possible UAF in fb_find_mode() - fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var - power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path - 9p: avoid putting oldfid in p9_client_walk() error path - ocfs2: reject oversized group bitmap descriptors - rpmsg: char: Fix use-after-free on probe error path - fpga: region: fix use-after-free in child_regions_with_firmware() - irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove - pNFS: Fix use-after-free in pnfs_update_layout() - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done - hdlc_ppp: sync per-proto timers before freeing hdlc state - gfs2: fix use-after-free in gfs2_qd_dealloc - exfat: fix potential use-after-free in exfat_find_dir_entry() - bpf: use kvfree() for replaced sysctl write buffer - f2fs: keep atomic write retry from zeroing original data - f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node() - f2fs: validate ACL entry sizes in f2fs_acl_from_disk() - f2fs: fix to round down start offset of fallocate for pin file - f2fs: validate compress cache inode only when enabled - wifi: iwlwifi: mvm: fix race condition in PTP removal - wifi: rtw88: usb: fix memory leaks on USB write failures - wifi: rtw88: increase TX report timeout to fix race condition - wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor - wifi: ath11k: fix warning when unbinding - wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S - keys: Pin request_key_auth payload in instantiate paths - KEYS: fix overflow in keyctl_pkey_params_get_2() - err.h: use __always_inline on all error pointer helpers - fbdev: fix use-after-free in store_modes() - NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR - apparmor: mediate the implicit connect of TCP fast open sendmsg - net: skmsg: preserve sg.copy across SG transforms - mac802154: llsec: add skb_cow_data() before in-place crypto - af_unix: Set gc_in_progress to true in unix_gc(). - ntfs3: reject direct userspace writes to reserved $LX* xattrs - ipv4: account for fraggap on the paged allocation path - inet: add indirect call wrapper for getfrag() calls - ipv6: account for fraggap on the paged allocation path - batman-adv: tvlv: avoid race of cifsnotfound handler state - batman-adv: tvlv: enforce 2-byte alignment - batman-adv: dat: prevent false sharing between VLANs - batman-adv: tt: track roam count per VID - batman-adv: tt: don't merge change entries with different VIDs - batman-adv: tp_meter: handle overlapping packets - batman-adv: tp_meter: prevent parallel modifications of last_recv - batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE - batman-adv: tp_meter: restrict number of unacked list entries - batman-adv: v: prevent OGM aggregation on disabled hardif - batman-adv: frag: avoid underflow of TTL - batman-adv: frag: ensure fragment is writable before modifying TTL - batman-adv: fix (m|b)cast csum after decrementing TTL - batman-adv: ensure bcast is writable before modifying TTL - batman-adv: tp_meter: initialize last_recv_time during init - batman-adv: prevent ELP transmission interval underflow - batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE - batman-adv: tp_meter: add only finished tp_vars to lists - batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection - batman-adv: tp_meter: fix fast recovery precondition - batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd - batman-adv: tp_meter: avoid window underflow - batman-adv: tp_meter: initialize dec_cwnd explicitly - batman-adv: tp_meter: initialize dup_acks explicitly - batman-adv: tp_meter: keep unacked list in ascending ordered - eventpoll: rename ep_remove_safe() back to ep_remove() - file: add fput() cleanup helper - media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si - ksmbd: reject non-VALID session in compound request branch - scripts/sorttable: Fix endianness handling in build-time mcount sort - scripts/sorttable: Allow matches to functions before function entry - scripts/sorttable: Use normal sort if theres no relocs in the mcount section - ftrace: Check against is_kernel_text() instead of kaslr_offset() - ftrace: Test mcount_loc addr before calling ftrace_call_addr() - ftrace: Do not over-allocate ftrace memory - ftrace: Have ftrace pages output reflect freed pages - ftrace: Update the mcount_loc check of skipped entries - scripts/sorttable: Zero out weak functions in mcount_loc table - scripts/sorttable: Always use an array for the mcount_loc sorting - scripts/sorttable: Have mcount rela sort use direct values - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 - scripts/sorttable: Use a structure of function pointers for elf helpers - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly - scripts/sorttable: Move code from sorttable.h into sorttable.c - scripts/sorttable: Use uint64_t for mcount sorting - scripts/sorttable: Add helper functions for Elf_Sym - scripts/sorttable: Add helper functions for Elf_Shdr - scripts/sorttable: Add helper functions for Elf_Ehdr - scripts/sorttable: Convert Elf_Sym MACRO over to a union - scripts/sorttable: Replace Elf_Shdr Macro with a union - scripts/sorttable: Convert Elf_Ehdr to union - scripts/sorttable: Make compare_extable() into two functions - scripts/sorttable: Have the ORC code use the _r() functions to read - scripts/sorttable: Remove unneeded Elf_Rel - scripts/sorttable: Remove unused write functions - scripts/sorttable: Remove unused macro defines - fuse: re-lock request before replacing page cache folio - slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD - slimbus: qcom-ngd-ctrl: Fix up platform_driver registration - rxrpc: Fix the ACK parser to extract the SACK table for parsing - net: phonet: free phonet_device after RCU grace period - phonet: Pass net and ifindex to phonet_address_notify(). - phonet: Pass ifindex to fill_addr(). - Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs - hv: utils: handle and propagate errors in kvp_register - regulator: core: fix locking in regulator_resolve_supply() error path - ring-buffer: Remove ring_buffer_read_prepare_sync() - selftests/bpf: Update comments find_equal_scalars->sync_linked_regs - af_unix: Reject SIOCATMARK on non-stream sockets - selftests/bpf: Add test to ensure kprobe_multi is not sleepable - agp/amd64: Fix broken error propagation in agp_amd64_probe() - net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() - i2c: stub: Reject I2C block transfers with invalid length - RDMA/bnxt_re: zero shared page before exposing to userspace - KVM: VMX: Update SVI during runtime APICv activation - ARM: fix branch predictor hardening - ARM: fix hash_name() fault - ARM: allow __do_kernel_fault() to report execution of memory faults - ARM: group is_permission_fault() with is_translation_fault() - debugobjects: Dont call fill_pool() in early boot hardirq context - debugobjects: Do not fill_pool() if pi_blocked_on - debugobjects: Use LD_WAIT_CONFIG instead of LD_WAIT_SLEEP - debugobjects: Allow to refill the pool before SYSTEM_SCHEDULING - batman-adv: tt: prevent TVLV entry number overflow - drm/v3d: Skip CSD when it has zeroed workgroups - drm/v3d: Store the active job inside the queue's state - iov_iter: Fix potential underflow in iov_iter_extract_xarray_pages() - urma: add check type in free driver obj - smb: client: fix double-free in SMB2_close() replay - smb: client: fix double-free in SMB2_flush() replay - smb: client: fix query_info() replay double-free - smb: client: fix query directory replay double-free - smb: client: fix double-free in SMB2_open() replay - smb: client: fix double-free in SMB2_ioctl() replay - smb: client: fix change notify replay double-free - HID: lg-g15: cancel pending work on remove to fix a use-after-free - HID: multitouch: fix out-of-bounds bit access on mt_io_flags - tracing: Prevent out-of-bounds read in glob matching - sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT - !25616 sync CVE LTS and bugfix from OLK-6.6 b72db20c0437 to d33ffc8f8580 - KVM: x86: hyper-v: Bound the bank index when querying sparse banks - MIPS: DEC: Prevent initial console buffer from landing in XKPHYS - ksmbd: fix durable reconnect error path file lifetime - ksmbd: fix use-after-free in smb2_open during durable reconnect - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query - USB: iowarrior: fix use-after-free on disconnect race - usb: iowarrior: remove inherent race with minor number - USB: iowarrior: fix use-after-free on disconnect - apparmor: fix use-after-free in rawdata dedup loop - tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR - bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops - rbd: eliminate a race in lock_dwork draining on unmap - blk-cgroup: fix UAF in __blkcg_rstat_flush() - net: Fix kabi breakage of struct tc_action - net/sched: act_api: use RCU with deferred freeing for action lifecycle - net: Fix kabi breakage of struct header_ops - bonding: prevent potential infinite loop in bond_header_parse() - bonding: fix type confusion in bond_setup_by_slave() - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc - ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL - ASoC: cs35l56: Fix missing calls to wm_adsp2_remove() - time: Fix off-by-one in compat settimeofday() usec validation - scsi: target: Fix hexadecimal CHAP_I handling - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink - ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY - ksmbd: add a permission check for FSCTL_SET_ZERO_DATA - ksmbd: add per-handle permission check to FILE_LINK_INFORMATION - mptcp: fix missing wakeups in edge scenarios - mptcp: add-addr: always drop other suboptions - ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 - RDMA/umem: fix kernel-doc warnings - mm/migrate: don't call folio_putback_active_hugetlb() on dst hugetlb folio - usb: typec: ucsi: Don't update power_supply on power role change if not connected - serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() - thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() - usb: typec: ucsi: Check if power role change actually happened before handling - usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind - usb: dwc3: xilinx: fix error handling in zynqmp init error paths - usb: musb: omap2430: Fix use-after-free in omap2430_probe() - tty: serial: samsung: Remove redundant port lock acquisition in rx helpers - tty: serial: samsung: use u32 for register interactions - serial: samsung_tty: Use port lock wrappers - ALSA: firewire-motu: Protect register DSP event queue positions - memfd: deny writeable mappings when implying SEAL_WRITE - iio: dac: ad5686: fix ref bit initialization for single-channel parts - usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure - iio: chemical: scd30: fix division by zero in write_raw - iio: chemical: scd30: Use guard(mutex) to allow early returns - iio: gyro: adis16260: fix division by zero in write_raw - Bluetooth: hci_qca: Convert timeout from jiffies to ms - Bluetooth: hci_qca: Migrate to serdev specific shutdown function - serdev: Provide a bustype shutdown function - serdev: make serdev_bus_type const - mm/damon/sysfs-schemes: delete tried region in regions_rmdirs() - mptcp: do not drop partial packets - mptcp: introduce the mptcp_init_skb helper - iio: adc: npcm: fix unbalanced clk_disable_unprepare() - iio: adc: npcm: Convert to platform remove callback returning void - octeontx2-pf: avoid double free of pool->stack on AQ init failure - af_unix: Fix UAF read of tail->len in unix_stream_data_wait() - af_unix: Cache state->msg in unix_stream_read_generic(). - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg - net: hsr: defer node table free until after RCU readers - mptcp: pm: fix ADD_ADDR timer infinite retry on option space insufficient - ice: fix VF queue configuration with low MTU values - mptcp: reset rcv wnd on disconnect - mptcp: cleanup fallback dummy mapping generation - octeontx2-af: CGX: add bounds check to cgx_speed_mbps index - octeontx2-af: replace deprecated strncpy with strscpy - cgroup/cpuset: Reset DL migration state on can_attach() failure - fbdev/vt8500lcdfb: Initialize fb_ops with fbdev macros - soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get() - driver core: reject devices with unregistered buses - drm/amd/display: Use krealloc_array() in dal_vector_reserve() - drm/amdgpu: restart the CS if some parts of the VM are still invalidated - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 - drm/amdkfd: fix NULL dereference in get_queue_ids() - slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock - slimbus: qcom-ngd-ctrl: fix OF node refcount - thunderbolt: Limit XDomain response copy to actual frame size - sctp: stream: fully roll back denied add-stream state - mmc: sdhci: add signal voltage switch in sdhci_resume_host - mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC - mmc: litex_mmc: Set mandatory idle clocks before CMD0 - mmc: core: Fix host controller programming for fixed driver type - mm/hugetlb: restore reservation on error in hugetlb folio copy paths - octeontx2-af: fix memory leak in rvu_setup_hw_resources() - nvmem: layouts: onie-tlv: fix hang on unknown types - net: rds: clear i_sends on setup unwind - net: mv643xx: fix OF node refcount - net/mlx5: Reorder completion before putting command entry in cmd_work_handler - misc: fastrpc: fix use-after-free race in fastrpc_map_create - misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context - Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard - i2c: tegra: Fix NOIRQ suspend/resume - i2c: stm32f7: fix timing computation ignoring i2c-analog-filter - i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() - pidfd: refuse access to tasks that have started exiting harder - ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write - vsock/vmci: fix sk_ack_backlog leak on failed handshake - wifi: nl80211: reject oversized EMA RNR lists - selftests: mptcp: add test for extra_subflows underflow on userspace PM - mptcp: sockopt: check timestamping ret value - mptcp: allow subflow rcv wnd to shrink - mptcp: close TOCTOU race while computing rcv_wnd - mptcp: fix retransmission loop when csum is enabled - ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow - ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O - ARM: socfpga: Fix OF node refcount leak in SMP setup - mm/damon/ops-common: call folio_test_lru() after folio_get() - drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info() - ALSA: timer: Fix UAF at snd_timer_user_params() - USB: serial: option: add usb-id for Dell Wireless DW5826e-m - xfrm: espintcp: do not reuse an in-progress partial send - ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL - mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation - tracing/probes: Point the error offset correctly for eprobe argument error - netfilter: nft_tunnel: fix use-after-free on object destroy - clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time - net: mvpp2: build skb from XDP-adjusted data on XDP_PASS - net: mvpp2: refill RX buffers before XDP or skb use - net: mvpp2: Add metadata support for xdp mode - netfilter: nf_log: validate MAC header was set before dumping it - rds: mark snapshot pages dirty in rds_info_getsockopt() - net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion - r8152: handle the return value of usb_reset_device() - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove - net: phy: clean the sfp upstream if phy probing fails - net/mlx4: avoid GCC 10 __bad_copy_from() false positive - ASoC: wm_adsp: Fix NULL dereference when removing firmware controls - arm64: tlb: Allow XZR argument to TLBI ops - KVM: arm64: Remove VPIPT I-cache handling - tools/rv: Fix cleanup after failed trace setup - time: Fix off-by-one in settimeofday() usec validation - ipmi: Fix rcu_read_unlock to srcu_read_unlock in handle_read_event_rsp - ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() - vxlan: vnifilter: fix spurious notification on VNI update - vxlan: vnifilter: send notification on VNI add - octeontx2-af: npc: Fix CPT channel mask in npc_install_flow - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown - ptp: vclock: Switch from RCU to SRCU - net: fec: fix pinctrl default state restore order on resume - net: lan743x: permit VLAN-tagged packets up to configured MTU - net: garp: fix unsigned integer underflow in garp_pdu_parse_attr - hsr: Remove WARN_ONCE() in hsr_addr_is_self(). - net: Annotate sk->sk_write_space() for UDP SOCKMAP. - pcnet32: stop holding device spin lock during napi_complete_done - drm/imx: Fix three kernel-doc warnings in dcss-scaler.c - 6lowpan: fix off-by-one in multicast context address compression - netfilter: xt_NFQUEUE: prefer raw_smp_processor_id - tee: optee: prevent use-after-free when the client exits before the supplicant - net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS - Disable -Wattribute-alias for clang-23 and newer - RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug - USB: serial: mct_u232: fix memory corruption with small endpoint - usb: core: Fix SuperSpeed root hub wMaxPacketSize - serial: zs: Convert to use a platform device - serial: dz: Convert to use a platform device - serial: dz: Fix bootconsole handover lockup - xhci: tegra: Fix ghost USB device on dual-role port unplug - USB: serial: digi_acceleport: fix memory corruption with small endpoints - landlock: Fix handling of disconnected directories - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync - USB: serial: cypress_m8: fix memory corruption with small endpoint - serial: zs: Switch to using channel reset - serial: zs: Fix bootconsole handover lockup - serial: dz: Fix bootconsole message clobbering at chip reset - drm/amdkfd: Check for pdd drm file first in CRIU restore path - drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger - drm/amdkfd: fix NULL pointer bug in svm_range_set_attr - serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma - serial: zs: Fix swapped RI/DSR modem line transition counting - serial: sh-sci: fix memory region release in error path - serial: qcom-geni: fix UART_RX_PAR_EN bit position - serial: altera_jtaguart: handle uart_add_one_port() failures - drm/amd/pm/si: Disregard vblank time when no displays are connected - drm/i915: Fix potential UAF in TTM object purge - drm/hyperv: validate VMBus packet size in receive callback - drm/hyperv: validate resolution_count and fix WIN8 fallback - scsi: target: iscsi: Validate CHAP_R length before base64 decode - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 - scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker - thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow - thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() - usb: gadget: f_fs: copy only received bytes on short ep0 read - usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports - usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling - usb: gadget: f_hid: fix device reference leak in hidg_alloc() - usb: gadget: net2280: Fix double free in probe error path - USB: serial: mct_u232: fix missing interrupt-in transfer sanity check - USB: serial: mxuport: fix memory corruption with small endpoint - USB: serial: keyspan: fix missing indat transfer sanity check - USB: serial: cypress_m8: validate interrupt packet headers - USB: serial: belkin_sa: validate interrupt status length - USB: serial: option: add MeiG SRM813Q - usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize - usb: usbtmc: check URB actual_length for interrupt-IN notifications - usbip: vudc: Fix use after free bug in vudc_remove due to race condition - usb: storage: Add quirks for PNY Elite Portable SSD - USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers - usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval - usb: chipidea: core: convert ci_role_switch to local variable - tty: serial: pch_uart: add check for dma_alloc_coherent() - counter: Fix refcount leak in counter_alloc() error path - comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() - comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() - Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 - Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem - Input: xpad - add support for ASUS ROG RAIKIRI II - Input: xpad - add "Nova 2 Lite" from GameSir - ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks - ASoC: qcom: q6asm-dai: close stream only when running - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check - xfrm: ah: use skb_to_full_sk in async output callbacks - xfrm: route MIGRATE notifications to caller's netns - nfc: hci: fix out-of-bounds read in HCP header parsing - iommu, debugobjects: avoid gcc-16.1 section mismatch warnings - HID: wacom: Fix OOB write in wacom_hid_set_device_mode() - ip6: vti: Use ip6_tnl.net in vti6_changelink(). - xfrm: input: hold netns during deferred transport reinjection - ipv6: validate extension header length before copying to cmsg - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). - ipv6: exthdrs: refresh nh after handling HAO option - ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() - macsec: fix replay protection at XPN lower-PN wrap - bpf: sockmap: fix tail fragment offset in bpf_msg_push_data - Input: elan_i2c - validate firmware size before use - usb: dwc2: Fix use after free in debug code - usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles - usb: cdns3: gadget: fix request skipping after clearing halt - USB: serial: omninet: fix memory corruption with small endpoint - iio: buffer: hw-consumer: fix use-after-free in error path - iio: light: cm3323: fix reg_conf not being initialized correctly - iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL - iio: temperature: tsys01: fix broken PROM checksum validation - iio: ssp_sensors: cancel delayed work_refresh on remove - iio: gyro: itg3200: fix i2c read into the wrong stack location - iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw - iio: dac: ad5686: acquire lock when doing powerdown control - iio: dac: ad5686: fix input raw value check - iio: dac: max5821: fix return value check in powerdown sync - iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux - wireguard: send: append trailer after expanding head - KVM: arm64: PMU: Preserve AArch32 counter low bits - parport: Fix race between port and client registration - Input: xpad - fix out-of-bounds access for Share button - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock - Bluetooth: ISO: fix UAF in iso_recv_frame - Bluetooth: HIDP: fix missing length checks in hidp_input_report() - auxdisplay: line-display: fix OOB read on zero-length message_store() - hpfs: fix a crash if hpfs_map_dnode_bitmap fails - Bluetooth: btusb: Allow firmware re-download when version matches - HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse - Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() - USB: serial: safe_serial: fix memory corruption with small endpoint - usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT - usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() - usb: typec: altmodes/displayport: validate count before reading Status Update VDO - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO - usb: typec: ucsi: ccg: reject firmware images without a ':' record header - iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer - soc/tegra: pmc: Fix unsafe generic_handle_irq() call - hwmon: (pmbus/adm1266) serialize NVMEM blackbox read with pmbus_lock - hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock - of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() - phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X - drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used - drm/dp: Add eDP 1.5 bit definition - drm/i915/psr: Read Intel DPCD workaround register - drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register - media: rc: fix race between unregister and urb/irq callbacks - batman-adv: bla: avoid double decrement of bla.num_requests - batman-adv: tt: avoid empty VLAN responses - batman-adv: tt: fix TOCTOU race for reported vlans - batman-adv: tp_meter: directly shut down timer on cleanup - batman-adv: tp_meter: avoid role confusion in tp_list - batman-adv: iv: recover OGM scheduling after forward packet error - batman-adv: tvlv: reject oversized TVLV packets - batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface - batman-adv: tt: reject oversized local TVLV buffers - batman-adv: tvlv: abort OGM send on tvlv append failure - net: skbuff: fix pskb_carve leaking zcopy pages - ipv6: fix possible infinite loop in fib6_select_path() - ipv6: fix possible infinite loop in rt6_fill_node() - sctp: fix race between sctp_wait_for_connect and peeloff - net: mana: Add NULL guards in teardown path to prevent panic on attach failure - gpio: rockchip: convert bank->clk to devm_clk_get_enabled() - Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() - ethtool: eeprom: add more safeties to EEPROM Netlink fallback - ethtool: eeprom: add missing ethnl_ops_begin() / _complete() during fallback - bonding: refuse to enslave CAN devices - Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() - ASoC: codecs: simple-mux: Fix enum control bounds check - ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() - gpio: mxc: fix irq_high handling - net: hsr: fix potential OOB access in supervision frame handling - ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues - net/iucv: fix locking in .getsockopt - net/smc: Do not re-initialize smc hashtables - net: netlink: don't set nsid on local notifications - net: netlink: fix sending unassigned nsid after assigned one - vsock: keep poll shutdown state consistent - netfilter: nf_tables: fix dst corruption in same register operation - netfilter: bitwise: add support for doing AND, OR and XOR directly - netfilter: bitwise: rename some boolean operation functions - netfilter: ebtables: fix OOB read in compat_mtw_from_user - netfilter: xt_cpu: prefer raw_smp_processor_id - netfilter: synproxy: refresh tcphdr after skb_ensure_writable - xfrm: Check for underflow in xfrm_state_mtu - nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() - nfc: llcp: Fix use-after-free in llcp_sock_release() - net: cpsw_new: Fix potential unregister of netdev that has not been registered yet - drm: Remove plane hsub/vsub alignment requirement for core helpers - net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net: mctp: ensure our nlmsg responses are initialised - Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size - MIPS: smp: report dying CPU to RCU in stop_this_cpu() - LoongArch: Report dying CPU to RCU in stop_this_cpu() - irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT - tls: Flush backlog before waiting for a new record - net: ethernet: cortina: No mapping is a dropped rx - batman-adv: fix batadv_skb_is_frag() kernel-doc - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled - Bluetooth: ISO: fix malformed ISO_END/CONT handling - Bluetooth: MGMT: Fix backward compatibility with userspace - security/keys: fix missed RCU read section on lookup - LoongArch: kprobes: Fix handling of fatal unrecoverable recursions - pds_core: ensure null-termination for firmware version strings - pds_core: add an error code check in pdsc_dl_info_get - net: mana: validate rx_req_idx to prevent out-of-bounds array access - ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove() - gpio: cdev: check if uAPI v2 config attributes are correctly zeroed - gpiolib: cdev: use !mem_is_zero() instead of memchr_inv(s, 0, n) - string: add mem_is_zero() helper to check if memory area is all zeros - bpf, skmsg: fix verdict sk_data_ready racing with ktls rx - net: ag71xx: check error for platform_get_irq - Bluetooth: btmtk: rename btmediatek_data - Bluetooth: btusb: mediatek: refactor the function btusb_mtk_reset - Bluetooth: btmtk: add the function to get the fw name - ALSA: seq: Serialize UMP output teardown with event_input - ALSA: seq: ump: Use guard() for locking - pds_core: fix debugfs_lookup dentry leak and error handling - pds_core: fix error handling in pdsc_devcmd_wait - bridge: mcast: Fix a possible use-after-free when removing a bridge port - net: bridge: Flush multicast groups when snooping is disabled - RDMA/rtrs: Fix use-after-free in path file creation cleanup - platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL - platform/x86: intel-hid: Check ACPI_HANDLE() against NULL - platform/x86: hp_accel: Check ACPI_COMPANION() against NULL - platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer - net: dsa: mt7530: preserve VLAN tags on trapped link-local frames - net: dsa: mt7530: rename mt753x_bpdu_port_fw enum to mt753x_to_cpu_fw - net: dsa: mt7530: fix FDB entries not aging out with short timeout - wifi: ath11k: fix peer resolution on rx path when peer_id=0 - drm/msm/snapshot: fix dumping of the unaligned regions - spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache() - net/mlx5: Do not restore destination-less TC rules - tls: Preserve sk_err across recvmsg() when data has been copied - x86/xen: Fix xen_e820_swap_entry_with_ram() - net: phy: DP83TC811: add reading of abilities - net: phy: c45: add genphy_c45_pma_read_ext_abilities() function - net: tls: prevent chain-after-chain in plain text SG - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot - powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise() - drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN - drm/msm/dsi: don't dump registers past the mapped region - ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics - net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint - accel/qaic: Add overflow check to remap_pfn_range during mmap - HID: quirks: really enable the intended work around for appledisplay - wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm() - wifi: ath11k: fix error path leaks in some WMI WOW calls - net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS reference - net: ethernet: cortina: Carry over frag counter - net: ethernet: cortina: Drop half-assembled SKB - net: ethernet: cortina: Make RX SKB per-port - netfs: Fix overrun check in netfs_extract_user_iter() - zonefs: handle integer overflow in zonefs_fname_to_fno - irqchip/ath79-cpu: Remove unused function - phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access - net: lan966x: avoid unregistering netdev on register failure - ice: fix locking in ice_dcb_rebuild() - tcp: Fix imbalanced icsk_accept_queue count. - test_kprobes: clear kprobes between test runs - kprobes: skip non-symbol addresses in kprobe_add_ksym_blacklist() - netfilter: x_tables: unregister the templates first - ALSA: hda: cs35l56: Put ACPI device after setting companion - ARM: integrator: Fix early initialization - pinctrl: qcom: Fix wakeirq map by removing disconnected irqs for sm8150 - kunit: config: KUNIT_DEBUGFS should depend on DEBUG_FS - kunit: config: Enable KUNIT_DEBUGFS by default - firmware: arm_ffa: Skip free_pages on RX buffer alloc failure - firmware: arm_ffa: Check for NULL FF-A ID table while driver registration - HID: uclogic: Fix regression of input name assignment - hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors - hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe() - hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe() - hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in get_multiple - hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR - hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer - hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer - hwmon: (pmbus/adm1266) reject implausible blackbox record_count - hwmon: (pmbus/adm1266) seed timestamp from the real-time clock - batman-adv: tt: fix negative tt_buff_len - batman-adv: tt: fix negative last_changeset_len - batman-adv: tp_meter: fix race condition in send error reporting - batman-adv: tp_meter: avoid use of uninit sender vars - batman-adv: bla: fix report_work leak on backbone_gw purge - batman-adv: frag: disallow unicast fragment in fragment - batman-adv: fix fragment reassembly length accounting - batman-adv: dat: handle forward allocation error - batman-adv: clear current gateway during teardown - batman-adv: mcast: fix use-after-free in orig_node RCU release - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async - drm/amd/display: Validate GPIO pin LUT table size before iterating - drm/amd/display: Fix integer overflow in bios_get_image() - drm/bridge: megachips: remove bridge when irq request fails - drm/bridge: it66121: acquire reset GPIO in probe - drm/virtio: use uninterruptible resv lock for plane updates - device property: set fwnode->secondary to NULL in fwnode_init() - LoongArch: Remove unused code to avoid build warning - RDMA/siw: Reject MPA FPDU length underflow before signed receive math - spi: ti-qspi: fix use-after-free after DMA setup failure - spi: sprd: fix error pointer deref after DMA setup failure - scsi: isci: Fix use-after-free in device removal path - phy: tegra: xusb: Fix per-pad high-speed termination calibration - spi: qup: fix error pointer deref after DMA setup failure - drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe - KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits - arm64: probes: Handle probes on hinted conditional branch instructions - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() - ice: fix setting promisc mode while adding VID filter - ixgbevf: fix use-after-free in VEPA multicast source pruning - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 - wifi: ath11k: clear shared SRNG pointer state on restart - vsock/vmci: fix UAF when peer resets connection during handshake - ring-buffer: Fix reporting of missed events in iterator - qed: fix double free in qed_cxt_tables_alloc() - netfilter: ipset: stop hash:* range iteration at end - netfilter: nf_queue: hold bridge skb->dev while queued - netfilter: ip6t_hbh: reject oversized option lists - net: ifb: report ethtool stats over num_tx_queues - net: bcmgenet: keep RBUF EEE/PM disabled - phonet/pep: disable BH around forwarded sk_receive_skb() - Bluetooth: MGMT: validate Add Extended Advertising Data length - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths - Bluetooth: bnep: Fix UAF read of dev->name - Bluetooth: ISO: drop ISO_END frames received without prior ISO_START - net: wwan: iosm: fix potential memory leaks in ipc_imem_init() - drivers/base/memory: fix memory block reference leak in poison accounting - efi: Allocate runtime workqueue before ACPI init - ALSA: asihpi: Fix potential OOB array access at reading cache - ALSA: pcm: Don't setup bogus iov_iter for silencing - ALSA: ua101: Reject too-short USB descriptors - hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX - smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() - ksmbd: fix null pointer dereference in compare_guid_key() - mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break() - sysfs: don't remove existing directory on update failure - Revert "af_unix: Reject SIOCATMARK on non-stream sockets" - Revert "s390/cio: Update purge function to unregister the unused subchannels" - Revert "ice: Remove jumbo_remove step from TX path" - Revert "ice: fix double-free of tx_buf skb" - Revert "x86/vdso: Fix output operand size of RDPID" - wifi: mac80211: check tdls flag in ieee80211_tdls_oper - s390/debug: Reject zero-length input before trimming a newline - mptcp: pm: ADD_ADDR rtx: free sk if last - mptcp: sync the msk->sndbuf at accept() time - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close - netfilter: revalidate bridge ports - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp - net: bonding: fix NULL pointer dereference in bond_do_ioctl() - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() - udp: clear skb->dev before running a sockmap verdict - crypto: nx - Fix packed layout in struct nx842_crypto_header - crypto: nx - Use static_assert() to check struct sizes - batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown - Revert "ALSA: pcmtest: fix reference leak on failed device registration" - media: rc: ttusbir: fix inverted error logic - media: rc: igorplugusb: fix control request setup packet - batman-adv: tp_meter: fix tp_num leak on kmalloc failure - batman-adv: stop tp_meter sessions during mesh teardown - ALSA: seq: Fix UMP group 16 filtering - ALSA: seq: Notify client and port info changes - ALSA: core: Serialize deferred fasync state checks - ALSA: misc: Use guard() for spin locks - ALSA: hda: cs35l56: Propagate ASP TX source control errors - crypto: nx - Avoid -Wflex-array-member-not-at-end warning - ksmbd: reset rcount per connection in ksmbd_conn_wait_idle_sess_id() - media: rc: igorplugusb: heed coherency rules - ALSA: aoa: Skip devices with no codecs in i2sbus_resume() - media: rc: ttusbir: respect DMA coherency rules - ALSA: aoa: i2sbus: clear stale prepared state - ALSA: aoa: Use guard() for mutex locks - f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally - ksmbd: replace connection list with hash table - ksmbd: use msleep instaed of schedule_timeout_interruptible() - f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io() - smb: move some duplicate definitions to common/smbacl.h - iommu/amd: serialize sequence allocation under concurrent TLB invalidations - x86/shstk: Prevent deadlock during shstk sigreturn - ALSA: pcmtest: Fix resource leaks in module init error paths - ALSA: pcmtest: fix reference leak on failed device registration - ALSA: 6fire: Fix input volume change detection - ALSA: caiaq: Fix control_put() result and cache rollback - ALSA: core: Fix potential data race at fasync handling - Revert "ALSA: usb-audio: Cap the packet size pre-calculations" - ipv6: sit: reload inner IPv6 header after GSO offloads - net: guard timestamp cmsgs to real error queue skbs - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() - netfilter: x_tables: avoid leaking percpu counter pointers - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush - netfilter: require Ethernet MAC header before using eth_hdr() - netfilter: nft_fib: fix stale stack leak via the OIFNAME register - vsock/virtio: reset connection on receiving queue overflow - vsock/virtio: fix skb overhead accounting to preserve full buf_alloc - vsock/virtio: fix potential unbounded skb queue - mptcp: pm: ADD_ADDR rtx: always decrease sk refcount - mptcp: pm: ADD_ADDR rtx: allow ID 0 - ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers - srcu: Use irq_work to start GP in tiny SRCU - irqwork: Move data struct to a types header - types: move struct rcuwait into types.h - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets - wifi: iwlwifi: fix 22000 series SMEM parsing - wifi: iwlwifi: allow IWL_FW_CHECK() with just a string - x86: shadow stacks: proper error handling for mmap lock - net: mvpp2: sync RX data at the hardware packet offset - net: mvpp2: limit XDP frame size to the RX buffer - batman-adv: fix tp_meter counter underflow during shutdown - batman-adv: v: stop OGMv2 on disabled interface - ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger - spi: mpc52xx: fix controller deregistration - thunderbolt: Bound root directory content to block size - selinux: fix overlayfs mmap() and mprotect() access checks - lsm: add backing_file LSM hooks - fs: constify file ptr in backing_file accessor helpers - fs: prepare for adding LSM blob to backing_file - selftests/bpf: Add tests for ld_{abs,ind} failure path in subprogs - bpf: Fix ld_{abs,ind} failure path analysis in subprogs - KVM: x86: Fix shadow paging use-after-free due to unexpected role - Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref - Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() - fix kabi for ppp_defs.h - pppoe: drop PFC frames - netfilter: nat: use kfree_rcu to release ops - drm/i915/gem: Fix phys BO pread/pwrite with offset - selinux: allow multiple opens of /sys/fs/selinux/policy - ksmbd: make ksmbd thread names distinct by client IP - ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path - ALSA: caiaq: Don't abort when no input device is available - ALSA: caiaq: fix usb_dev refcount leak on probe failure - ALSA: caiaq: Handle probe errors properly - ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow - USB: cdc-acm: Fix bit overlap and move quirk definitions to header - ALSA: caiaq: take a reference on the USB device in create_card() - ALSA: usb-audio: apply quirk for MOONDROP JU Jiu - ksmbd: use check_add_overflow() to prevent u16 DACL size overflow - ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment - smb: server: fix max_connections off-by-one in tcp accept path - smb: server: fix active_num_conn leak on transport allocation failure - usb: port: add delay after usb_hub_set_port_power() - USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen - usb: storage: Expand range of matched versions for VL817 quirks entry - xfrm: Wait for RCU readers during policy netns exit - KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing - mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison - thunderbolt: Clamp XDomain response data copy to allocation size - bpf: return VMA snapshot from task_vma iterator - bpf: switch task_vma iterator from mmap_lock to per-VMA locks - bpf: fix mm lifecycle in open-coded task_vma iterator - netfilter: nft_ct: bail out on template ct in get eval - drm/amd/display: Bound VBIOS record-chain walk loops - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size - drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() - netfilter: conntrack_irc: fix possible out-of-bounds read - drm/vc4: fix krealloc() memory leak - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error - f2fs: fix data loss caused by incorrect use of nat_entry flag - bnxt_en: Fix NULL pointer dereference - ipv6: mcast: Fix use-after-free when processing MLD queries - ipvs: clear the svc scheduler ptr early on edit - netfilter: synproxy: add mutex to guard hook reference counting - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list - net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr - netlabel: validate unlabeled address and mask attribute lengths - netfilter: bridge: make ebt_snat ARP rewrite writable - tcp: restrict SO_ATTACH_FILTER to priv users - ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER - Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig - misc: fastrpc: fix DMA address corruption due to find_vma misuse - misc: fastrpc: Fix NULL pointer dereference in rpmsg callback - gpio: mvebu: fix NULL pointer dereference in suspend/resume - Bluetooth: fix memory leak in error path of hci_alloc_dev() - Bluetooth: bnep: reject short frames before parsing - Bluetooth: RFCOMM: validate skb length in MCC handlers - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams - RDMA/srp: bound SRP_RSP sense copy by the received length - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN - net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure - sched/psi: fix race between file release and pressure write - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase - rculist: add list_splice_rcu() for private lists - net: skbuff: fix missing zerocopy reference in pskb_carve helpers - ip6_vti: set netns_immutable on the fallback device. - wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() - wifi: rtw88: debugfs: support multiple adapters debugging - erofs: fix use-after-free on sbi->sync_decompress - net: openvswitch: fix possible kfree_skb of ERR_PTR - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() - md: wake raid456 reshape waiters before suspend - dm cache policy smq: check allocation under invalidate lock - Bluetooth: MGMT: validate advertising TLV before type checks - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend - USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL - USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam - USB: serial: option: add support for Rolling Wireless RW135R-GL - USB: serial: io_edgeport: add support for Blackbox IC135A - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr - netfilter: flowtable: strictly check for maximum number of actions - fuse: reject fuse_notify() pagecache ops on directories - fs/mbcache: cancel shrink work before destroying the cache - smb/client: fix possible infinite loop and oob read in symlink_data() - fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp - ata: libata-scsi: do not needlessly defer commands when using PMP with FBS - ata: libata-scsi: do not use the deferred QC feature on PMPs with CBS - ata: libata-scsi: do not use the deferred QC feature for ATA_DEFER_PORT - ata: libata-scsi: improve readability of ata_scsi_qc_issue() - ata: libata-scsi: fix requeue of deferred ATA PASS-THROUGH commands - ata: libata-eh: Fix detection of deferred qc timeouts - ata: libata: cancel pending work after clearing deferred_qc - ata: libata-core: fix cancellation of a port deferred qc work - ata: libata-scsi: rename and improve ata_qc_done() - ata: libata-scsi: simplify ata_scsi_requeue_deferred_qc() - ata: libata-sata: simplify ata_sas_queuecmd() - ata: libata-core: improve tag checks in ata_qc_issue() - ata: libata-eh: correctly handle deferred qc timeouts - ata: libata-scsi: avoid Non-NCQ command starvation - ata: libata: Introduce ata_port_eh_scheduled() - ext4: handle wraparound when searching for blocks for indirect mapped blocks - ext4: fix error pointer dereference in ext4_mb_load_buddy_gfp() - ext4: always allocate blocks only from groups inode can use - ext4: fix e4b bitmap inconsistency reports - ext4: convert bd_buddy_page to bd_buddy_folio - ext4: convert bd_bitmap_page to bd_bitmap_folio - Revert "ext4: fix e4b bitmap inconsistency reports" - ext4: cleanup for ext4_map_blocks - ext4: rename EXT4_GET_BLOCKS_PRE_IO - ext4: drop extent cache when splitting extent fails - ext4: drop extent cache after doing PARTIAL_VALID1 zeroout - ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O - ext4: correct the comments place for EXT4_EXT_MAY_ZEROOUT - ext4: get rid of ppath in ext4_ext_handle_unwritten_extents() - ext4: get rid of ppath in ext4_ext_convert_to_initialized() - ext4: get rid of ppath in ext4_split_convert_extents() - ext4: get rid of ppath in ext4_split_extent() - ext4: get rid of ppath in ext4_force_split_extent_at() - ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 - ext4: subdivide EXT4_EXT_DATA_VALID1 - Revert "ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O" - ext4: get rid of ppath in ext4_split_extent_at() - ext4: get rid of ppath in ext4_ext_insert_extent() - ext4: get rid of ppath in get_ext_path() - ext4: add new ext4_ext_path_brelse() helper - !24596 [sync]urma: fix workqueue use-after-free in ubagg_exit teardown sequence - urma: fix workqueue use-after-free in ubagg_exit teardown sequence - !24607 ub: udma: Optimize udma jetty id access logic. - ub: udma: Optimize udma jetty id access logic. - !24640 [sync]urma: limit ubcore logs in reuse paths - urma: fix workqueue use-after-free in ubagg_exit teardown sequence - !24669 mm/madvise: add MADV_FCMA_ENABLE to set PF_FOLIO_CMA via madvise - mm/madvise: add MADV_FCMA_ENABLE to set PF_FOLIO_CMA via madvise - !24702 [sync]urma: retry import jetty/jfr on EIO from tpid reuse failure - urma: retry import jetty/jfr on EIO from tpid reuse failure - urma: limit ubagg connect exchange logs * Fri Jul 10 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-145.3.18.151.20260710.aae66044906b - !24753 [sync]urma: drain jfe event lists in batches to avoid soft-lockup - urma: drain jfe event lists in batches to avoid soft-lockup - urma: reduce ubagg topo log noise - !24748 [sync]urma: free completion events outside jfe lock - urma: free jfe events outside lock - urma: free completion events outside jfe lock - !24742 urma: Fix the issue of inaccurate timing for some functions in DFX - !24741 [sync]urma: fix UAF of accessing token_id in log. - urma: Fix the issue of inaccurate timing for some functions in DFX - urma: fix UAF of accessing token_id in log. - !24734 [sync]urma: fix tpid_reuse attached to vtpn causes use_after_free - urma: fix tpid_reuse attached to vtpn causes use_after_free - !24804 [sync]urma: use vzalloc for ubmad tjetty and ini_rtbuffer - !24774 [sync]urma: ratelimit import jetty/jfr error logs - urma: use vzalloc for ubmad tjetty and ini_rtbuffer - !24792 [sync]urma: fix UAF of accessing jfs/jetty in log. - urma: fix UAF of accessing jfs/jetty in log. - urma: ratelimit import jetty/jfr error logs - !24845 [sync]ub/ubdevshm: Support for acquiring va is a sub-range of registered va - ub/ubdevshm: Support for acquiring va is a sub-range of registered va - !24802 [sync]urma: use xarray for ubagg/ubcore session lookup - urma: use xarray for ubagg/ubcore session lookup - !24814 [sync]urma: make ratelimit burst configurable for ubcore/uburma/ubagg - urma: make ratelimit burst configurable for ubcore/uburma/ubagg * Wed Jul 22 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-145.3.22.153.20260722.158daf1d8dea - !24942 [sync]urma: drop param_set_uint_minmax for ratelimit burst setters - urma: drop param_set_uint_minmax for ratelimit burst setters - !25840 sync CVE LTS and bugfix from OLK-6.6 d33ffc8f8580 to 334dfd575ba5 - cgroup/rstat: avoid disabling irqs for O(num_cpu) - netfilter: bridge: eb_tables: close module init race - crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents - netfilter: ebtables: move to two-stage removal scheme - crypto: qat - protect service table iterations with service_lock - Bluetooth: eir: Fix stack OOB write when prepending the Flags AD - drm/edid: fix OOB read in drm_parse_tiled_block() - proc: protect ptrace_may_access() with exec_update_lock (FD links) - vfio/pci: Latch disable_idle_d3 per device - bpf: Fix UAF in sock clone early bailouts - bpf: Disable xfrm_decode_session hook attachment - bpf,fork: wipe ->bpf_storage before bailouts that access it - KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() - crypto: qat - validate RSA CRT component lengths - bpf: Clear rb node linkage when freeing bpf_rb_root - bpf: Add validation for bpf_set_retval argument - bpf: Reject sleepable BPF_LSM_CGROUP programs at load time - bpf: Fix setting retval to -EPERM for cgroup hooks not returning errno - bpf: Guard __get_user acesss with access_ok for uprobe_multi data - i2c: core: fix adapter registration race - ALSA: hda/cs35l41: Fix firmware load work teardown - vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc - iommufd: Break the loop on failure in iommufd_fault_fops_read() - posix-cpu-timers: Prevent UAF caused by non-leader exec() race - iio: event: Fix event FIFO reset race - hwrng: virtio: clamp device-reported used.len at copy_data() - crypto: drbg - Fix returning success on failure in CTR_DRBG - crypto: ecc - Fix carry overflow in vli multiplication - crypto: pcrypt - restore callback for non-parallel fallback - net: openvswitch: reject oversized nested action attrs - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page - e1000e: Fix out-of-bounds MMIO access by validating BAR0 size - xsched: enforce permissions on attribute access - xsched: restrict vstream management to privileged users - rme: use DMA API for virtio in realm world - udf: validate sparing table length as an entry count, not a byte count - smb: client: harden POSIX SID length parsing - smb: client: mask server-provided mode to 07777 in modefromsid - smb: client: Fix next buffer leak in receive_encrypted_standard() - nvmet-auth: validate reply message payload bounds against transfer length - bpf: Reject fragmented frames in devmap - bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized - mm/huge_memory: update file PMD counter before folio_put() - sctp: fix uninit-value in __sctp_rcv_asconf_lookup() - smb: client: reject overlapping data areas in SMB2 responses - smb: client: restrict implied bcc[0] exemption to responses without data area - io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item - writeback: drop now-unnecessary rcu_barrier() in cgroup_writeback_umount() - writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() - writeback: Fix use after free in inode_switch_wbs_work_fn() - writeback: Avoid contention on wb->list_lock when switching inodes - block: skip sync_blockdev() on surprise removal in bdev_mark_dead() - mm: do file ownership checks with the proper mount idmap - tracing: Bound synthetic-field strings with seq_buf - perf/core: Detach event groups during remove_on_exec - bpf: Allow LPM map access from sleepable BPF programs - bpf: Consistently use bpf_rcu_lock_held() everywhere - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC - udf: validate VAT header length against the VAT inode size - isofs: bound Rock Ridge symlink components to the SL record - udf: validate free block extents against the partition length - config: arm64: update CONFIG_FTRACE_STARTUP_TEST not set - crypto: qat - Return pointer directly in adf_ctl_alloc_resources - crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() - drivers/base/memory: set mem->altmap after successful device registration - serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails - serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero - NFS: Prevent resource leak in nfs_alloc_server() - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr - nfsd: check get_user() return when reading princhashlen - fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode - fbdev: modedb: fix a possible UAF in fb_find_mode() - fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var - power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path - 9p: avoid putting oldfid in p9_client_walk() error path - ocfs2: reject oversized group bitmap descriptors - rpmsg: char: Fix use-after-free on probe error path - fpga: region: fix use-after-free in child_regions_with_firmware() - irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove - pNFS: Fix use-after-free in pnfs_update_layout() - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done - hdlc_ppp: sync per-proto timers before freeing hdlc state - gfs2: fix use-after-free in gfs2_qd_dealloc - exfat: fix potential use-after-free in exfat_find_dir_entry() - bpf: use kvfree() for replaced sysctl write buffer - f2fs: keep atomic write retry from zeroing original data - f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node() - f2fs: validate ACL entry sizes in f2fs_acl_from_disk() - f2fs: fix to round down start offset of fallocate for pin file - f2fs: validate compress cache inode only when enabled - wifi: iwlwifi: mvm: fix race condition in PTP removal - wifi: rtw88: usb: fix memory leaks on USB write failures - wifi: rtw88: increase TX report timeout to fix race condition - wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor - wifi: ath11k: fix warning when unbinding - wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S - keys: Pin request_key_auth payload in instantiate paths - KEYS: fix overflow in keyctl_pkey_params_get_2() - err.h: use __always_inline on all error pointer helpers - fbdev: fix use-after-free in store_modes() - NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR - apparmor: mediate the implicit connect of TCP fast open sendmsg - net: skmsg: preserve sg.copy across SG transforms - mac802154: llsec: add skb_cow_data() before in-place crypto - af_unix: Set gc_in_progress to true in unix_gc(). - ntfs3: reject direct userspace writes to reserved $LX* xattrs - ipv4: account for fraggap on the paged allocation path - inet: add indirect call wrapper for getfrag() calls - ipv6: account for fraggap on the paged allocation path - batman-adv: tvlv: avoid race of cifsnotfound handler state - batman-adv: tvlv: enforce 2-byte alignment - batman-adv: dat: prevent false sharing between VLANs - batman-adv: tt: track roam count per VID - batman-adv: tt: don't merge change entries with different VIDs - batman-adv: tp_meter: handle overlapping packets - batman-adv: tp_meter: prevent parallel modifications of last_recv - batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE - batman-adv: tp_meter: restrict number of unacked list entries - batman-adv: v: prevent OGM aggregation on disabled hardif - batman-adv: frag: avoid underflow of TTL - batman-adv: frag: ensure fragment is writable before modifying TTL - batman-adv: fix (m|b)cast csum after decrementing TTL - batman-adv: ensure bcast is writable before modifying TTL - batman-adv: tp_meter: initialize last_recv_time during init - batman-adv: prevent ELP transmission interval underflow - batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE - batman-adv: tp_meter: add only finished tp_vars to lists - batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection - batman-adv: tp_meter: fix fast recovery precondition - batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd - batman-adv: tp_meter: avoid window underflow - batman-adv: tp_meter: initialize dec_cwnd explicitly - batman-adv: tp_meter: initialize dup_acks explicitly - batman-adv: tp_meter: keep unacked list in ascending ordered - eventpoll: rename ep_remove_safe() back to ep_remove() - file: add fput() cleanup helper - media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si - ksmbd: reject non-VALID session in compound request branch - scripts/sorttable: Fix endianness handling in build-time mcount sort - scripts/sorttable: Allow matches to functions before function entry - scripts/sorttable: Use normal sort if theres no relocs in the mcount section - ftrace: Check against is_kernel_text() instead of kaslr_offset() - ftrace: Test mcount_loc addr before calling ftrace_call_addr() - ftrace: Do not over-allocate ftrace memory - ftrace: Have ftrace pages output reflect freed pages - ftrace: Update the mcount_loc check of skipped entries - scripts/sorttable: Zero out weak functions in mcount_loc table - scripts/sorttable: Always use an array for the mcount_loc sorting - scripts/sorttable: Have mcount rela sort use direct values - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 - scripts/sorttable: Use a structure of function pointers for elf helpers - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly - scripts/sorttable: Move code from sorttable.h into sorttable.c - scripts/sorttable: Use uint64_t for mcount sorting - scripts/sorttable: Add helper functions for Elf_Sym - scripts/sorttable: Add helper functions for Elf_Shdr - scripts/sorttable: Add helper functions for Elf_Ehdr - scripts/sorttable: Convert Elf_Sym MACRO over to a union - scripts/sorttable: Replace Elf_Shdr Macro with a union - scripts/sorttable: Convert Elf_Ehdr to union - scripts/sorttable: Make compare_extable() into two functions - scripts/sorttable: Have the ORC code use the _r() functions to read - scripts/sorttable: Remove unneeded Elf_Rel - scripts/sorttable: Remove unused write functions - scripts/sorttable: Remove unused macro defines - fuse: re-lock request before replacing page cache folio - slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD - slimbus: qcom-ngd-ctrl: Fix up platform_driver registration - rxrpc: Fix the ACK parser to extract the SACK table for parsing - net: phonet: free phonet_device after RCU grace period - phonet: Pass net and ifindex to phonet_address_notify(). - phonet: Pass ifindex to fill_addr(). - Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs - hv: utils: handle and propagate errors in kvp_register - regulator: core: fix locking in regulator_resolve_supply() error path - ring-buffer: Remove ring_buffer_read_prepare_sync() - selftests/bpf: Update comments find_equal_scalars->sync_linked_regs - af_unix: Reject SIOCATMARK on non-stream sockets - selftests/bpf: Add test to ensure kprobe_multi is not sleepable - agp/amd64: Fix broken error propagation in agp_amd64_probe() - net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() - i2c: stub: Reject I2C block transfers with invalid length - RDMA/bnxt_re: zero shared page before exposing to userspace - KVM: VMX: Update SVI during runtime APICv activation - ARM: fix branch predictor hardening - ARM: fix hash_name() fault - ARM: allow __do_kernel_fault() to report execution of memory faults - ARM: group is_permission_fault() with is_translation_fault() - debugobjects: Dont call fill_pool() in early boot hardirq context - debugobjects: Do not fill_pool() if pi_blocked_on - debugobjects: Use LD_WAIT_CONFIG instead of LD_WAIT_SLEEP - debugobjects: Allow to refill the pool before SYSTEM_SCHEDULING - batman-adv: tt: prevent TVLV entry number overflow - drm/v3d: Skip CSD when it has zeroed workgroups - drm/v3d: Store the active job inside the queue's state - iov_iter: Fix potential underflow in iov_iter_extract_xarray_pages() - urma: add check type in free driver obj - smb: client: fix double-free in SMB2_close() replay - smb: client: fix double-free in SMB2_flush() replay - smb: client: fix query_info() replay double-free - smb: client: fix query directory replay double-free - smb: client: fix double-free in SMB2_open() replay - smb: client: fix double-free in SMB2_ioctl() replay - smb: client: fix change notify replay double-free - HID: lg-g15: cancel pending work on remove to fix a use-after-free - HID: multitouch: fix out-of-bounds bit access on mt_io_flags - tracing: Prevent out-of-bounds read in glob matching - sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT - !25616 sync CVE LTS and bugfix from OLK-6.6 b72db20c0437 to d33ffc8f8580 - KVM: x86: hyper-v: Bound the bank index when querying sparse banks - MIPS: DEC: Prevent initial console buffer from landing in XKPHYS - ksmbd: fix durable reconnect error path file lifetime - ksmbd: fix use-after-free in smb2_open during durable reconnect - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query - USB: iowarrior: fix use-after-free on disconnect race - usb: iowarrior: remove inherent race with minor number - USB: iowarrior: fix use-after-free on disconnect - apparmor: fix use-after-free in rawdata dedup loop - tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR - bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops - rbd: eliminate a race in lock_dwork draining on unmap - blk-cgroup: fix UAF in __blkcg_rstat_flush() - net: Fix kabi breakage of struct tc_action - net/sched: act_api: use RCU with deferred freeing for action lifecycle - net: Fix kabi breakage of struct header_ops - bonding: prevent potential infinite loop in bond_header_parse() - bonding: fix type confusion in bond_setup_by_slave() - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc - ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL - ASoC: cs35l56: Fix missing calls to wm_adsp2_remove() - time: Fix off-by-one in compat settimeofday() usec validation - scsi: target: Fix hexadecimal CHAP_I handling - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink - ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY - ksmbd: add a permission check for FSCTL_SET_ZERO_DATA - ksmbd: add per-handle permission check to FILE_LINK_INFORMATION - mptcp: fix missing wakeups in edge scenarios - mptcp: add-addr: always drop other suboptions - ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 - RDMA/umem: fix kernel-doc warnings - mm/migrate: don't call folio_putback_active_hugetlb() on dst hugetlb folio - usb: typec: ucsi: Don't update power_supply on power role change if not connected - serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() - thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() - usb: typec: ucsi: Check if power role change actually happened before handling - usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind - usb: dwc3: xilinx: fix error handling in zynqmp init error paths - usb: musb: omap2430: Fix use-after-free in omap2430_probe() - tty: serial: samsung: Remove redundant port lock acquisition in rx helpers - tty: serial: samsung: use u32 for register interactions - serial: samsung_tty: Use port lock wrappers - ALSA: firewire-motu: Protect register DSP event queue positions - memfd: deny writeable mappings when implying SEAL_WRITE - iio: dac: ad5686: fix ref bit initialization for single-channel parts - usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure - iio: chemical: scd30: fix division by zero in write_raw - iio: chemical: scd30: Use guard(mutex) to allow early returns - iio: gyro: adis16260: fix division by zero in write_raw - Bluetooth: hci_qca: Convert timeout from jiffies to ms - Bluetooth: hci_qca: Migrate to serdev specific shutdown function - serdev: Provide a bustype shutdown function - serdev: make serdev_bus_type const - mm/damon/sysfs-schemes: delete tried region in regions_rmdirs() - mptcp: do not drop partial packets - mptcp: introduce the mptcp_init_skb helper - iio: adc: npcm: fix unbalanced clk_disable_unprepare() - iio: adc: npcm: Convert to platform remove callback returning void - octeontx2-pf: avoid double free of pool->stack on AQ init failure - af_unix: Fix UAF read of tail->len in unix_stream_data_wait() - af_unix: Cache state->msg in unix_stream_read_generic(). - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg - net: hsr: defer node table free until after RCU readers - mptcp: pm: fix ADD_ADDR timer infinite retry on option space insufficient - ice: fix VF queue configuration with low MTU values - mptcp: reset rcv wnd on disconnect - mptcp: cleanup fallback dummy mapping generation - octeontx2-af: CGX: add bounds check to cgx_speed_mbps index - octeontx2-af: replace deprecated strncpy with strscpy - cgroup/cpuset: Reset DL migration state on can_attach() failure - fbdev/vt8500lcdfb: Initialize fb_ops with fbdev macros - soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get() - driver core: reject devices with unregistered buses - drm/amd/display: Use krealloc_array() in dal_vector_reserve() - drm/amdgpu: restart the CS if some parts of the VM are still invalidated - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 - drm/amdkfd: fix NULL dereference in get_queue_ids() - slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock - slimbus: qcom-ngd-ctrl: fix OF node refcount - thunderbolt: Limit XDomain response copy to actual frame size - sctp: stream: fully roll back denied add-stream state - mmc: sdhci: add signal voltage switch in sdhci_resume_host - mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC - mmc: litex_mmc: Set mandatory idle clocks before CMD0 - mmc: core: Fix host controller programming for fixed driver type - mm/hugetlb: restore reservation on error in hugetlb folio copy paths - octeontx2-af: fix memory leak in rvu_setup_hw_resources() - nvmem: layouts: onie-tlv: fix hang on unknown types - net: rds: clear i_sends on setup unwind - net: mv643xx: fix OF node refcount - net/mlx5: Reorder completion before putting command entry in cmd_work_handler - misc: fastrpc: fix use-after-free race in fastrpc_map_create - misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context - Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard - i2c: tegra: Fix NOIRQ suspend/resume - i2c: stm32f7: fix timing computation ignoring i2c-analog-filter - i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() - pidfd: refuse access to tasks that have started exiting harder - ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write - vsock/vmci: fix sk_ack_backlog leak on failed handshake - wifi: nl80211: reject oversized EMA RNR lists - selftests: mptcp: add test for extra_subflows underflow on userspace PM - mptcp: sockopt: check timestamping ret value - mptcp: allow subflow rcv wnd to shrink - mptcp: close TOCTOU race while computing rcv_wnd - mptcp: fix retransmission loop when csum is enabled - ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow - ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O - ARM: socfpga: Fix OF node refcount leak in SMP setup - mm/damon/ops-common: call folio_test_lru() after folio_get() - drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info() - ALSA: timer: Fix UAF at snd_timer_user_params() - USB: serial: option: add usb-id for Dell Wireless DW5826e-m - xfrm: espintcp: do not reuse an in-progress partial send - ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL - mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation - tracing/probes: Point the error offset correctly for eprobe argument error - netfilter: nft_tunnel: fix use-after-free on object destroy - clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time - net: mvpp2: build skb from XDP-adjusted data on XDP_PASS - net: mvpp2: refill RX buffers before XDP or skb use - net: mvpp2: Add metadata support for xdp mode - netfilter: nf_log: validate MAC header was set before dumping it - rds: mark snapshot pages dirty in rds_info_getsockopt() - net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion - r8152: handle the return value of usb_reset_device() - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove - net: phy: clean the sfp upstream if phy probing fails - net/mlx4: avoid GCC 10 __bad_copy_from() false positive - ASoC: wm_adsp: Fix NULL dereference when removing firmware controls - arm64: tlb: Allow XZR argument to TLBI ops - KVM: arm64: Remove VPIPT I-cache handling - tools/rv: Fix cleanup after failed trace setup - time: Fix off-by-one in settimeofday() usec validation - ipmi: Fix rcu_read_unlock to srcu_read_unlock in handle_read_event_rsp - ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() - vxlan: vnifilter: fix spurious notification on VNI update - vxlan: vnifilter: send notification on VNI add - octeontx2-af: npc: Fix CPT channel mask in npc_install_flow - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown - ptp: vclock: Switch from RCU to SRCU - net: fec: fix pinctrl default state restore order on resume - net: lan743x: permit VLAN-tagged packets up to configured MTU - net: garp: fix unsigned integer underflow in garp_pdu_parse_attr - hsr: Remove WARN_ONCE() in hsr_addr_is_self(). - net: Annotate sk->sk_write_space() for UDP SOCKMAP. - pcnet32: stop holding device spin lock during napi_complete_done - drm/imx: Fix three kernel-doc warnings in dcss-scaler.c - 6lowpan: fix off-by-one in multicast context address compression - netfilter: xt_NFQUEUE: prefer raw_smp_processor_id - tee: optee: prevent use-after-free when the client exits before the supplicant - net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS - Disable -Wattribute-alias for clang-23 and newer - RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug - USB: serial: mct_u232: fix memory corruption with small endpoint - usb: core: Fix SuperSpeed root hub wMaxPacketSize - serial: zs: Convert to use a platform device - serial: dz: Convert to use a platform device - serial: dz: Fix bootconsole handover lockup - xhci: tegra: Fix ghost USB device on dual-role port unplug - USB: serial: digi_acceleport: fix memory corruption with small endpoints - landlock: Fix handling of disconnected directories - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync - USB: serial: cypress_m8: fix memory corruption with small endpoint - serial: zs: Switch to using channel reset - serial: zs: Fix bootconsole handover lockup - serial: dz: Fix bootconsole message clobbering at chip reset - drm/amdkfd: Check for pdd drm file first in CRIU restore path - drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger - drm/amdkfd: fix NULL pointer bug in svm_range_set_attr - serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma - serial: zs: Fix swapped RI/DSR modem line transition counting - serial: sh-sci: fix memory region release in error path - serial: qcom-geni: fix UART_RX_PAR_EN bit position - serial: altera_jtaguart: handle uart_add_one_port() failures - drm/amd/pm/si: Disregard vblank time when no displays are connected - drm/i915: Fix potential UAF in TTM object purge - drm/hyperv: validate VMBus packet size in receive callback - drm/hyperv: validate resolution_count and fix WIN8 fallback - scsi: target: iscsi: Validate CHAP_R length before base64 decode - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 - scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker - thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow - thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() - usb: gadget: f_fs: copy only received bytes on short ep0 read - usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports - usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling - usb: gadget: f_hid: fix device reference leak in hidg_alloc() - usb: gadget: net2280: Fix double free in probe error path - USB: serial: mct_u232: fix missing interrupt-in transfer sanity check - USB: serial: mxuport: fix memory corruption with small endpoint - USB: serial: keyspan: fix missing indat transfer sanity check - USB: serial: cypress_m8: validate interrupt packet headers - USB: serial: belkin_sa: validate interrupt status length - USB: serial: option: add MeiG SRM813Q - usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize - usb: usbtmc: check URB actual_length for interrupt-IN notifications - usbip: vudc: Fix use after free bug in vudc_remove due to race condition - usb: storage: Add quirks for PNY Elite Portable SSD - USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers - usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval - usb: chipidea: core: convert ci_role_switch to local variable - tty: serial: pch_uart: add check for dma_alloc_coherent() - counter: Fix refcount leak in counter_alloc() error path - comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() - comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() - Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 - Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem - Input: xpad - add support for ASUS ROG RAIKIRI II - Input: xpad - add "Nova 2 Lite" from GameSir - ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks - ASoC: qcom: q6asm-dai: close stream only when running - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check - xfrm: ah: use skb_to_full_sk in async output callbacks - xfrm: route MIGRATE notifications to caller's netns - nfc: hci: fix out-of-bounds read in HCP header parsing - iommu, debugobjects: avoid gcc-16.1 section mismatch warnings - HID: wacom: Fix OOB write in wacom_hid_set_device_mode() - ip6: vti: Use ip6_tnl.net in vti6_changelink(). - xfrm: input: hold netns during deferred transport reinjection - ipv6: validate extension header length before copying to cmsg - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). - ipv6: exthdrs: refresh nh after handling HAO option - ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() - macsec: fix replay protection at XPN lower-PN wrap - bpf: sockmap: fix tail fragment offset in bpf_msg_push_data - Input: elan_i2c - validate firmware size before use - usb: dwc2: Fix use after free in debug code - usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles - usb: cdns3: gadget: fix request skipping after clearing halt - USB: serial: omninet: fix memory corruption with small endpoint - iio: buffer: hw-consumer: fix use-after-free in error path - iio: light: cm3323: fix reg_conf not being initialized correctly - iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL - iio: temperature: tsys01: fix broken PROM checksum validation - iio: ssp_sensors: cancel delayed work_refresh on remove - iio: gyro: itg3200: fix i2c read into the wrong stack location - iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw - iio: dac: ad5686: acquire lock when doing powerdown control - iio: dac: ad5686: fix input raw value check - iio: dac: max5821: fix return value check in powerdown sync - iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux - wireguard: send: append trailer after expanding head - KVM: arm64: PMU: Preserve AArch32 counter low bits - parport: Fix race between port and client registration - Input: xpad - fix out-of-bounds access for Share button - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock - Bluetooth: ISO: fix UAF in iso_recv_frame - Bluetooth: HIDP: fix missing length checks in hidp_input_report() - auxdisplay: line-display: fix OOB read on zero-length message_store() - hpfs: fix a crash if hpfs_map_dnode_bitmap fails - Bluetooth: btusb: Allow firmware re-download when version matches - HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse - Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() - USB: serial: safe_serial: fix memory corruption with small endpoint - usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT - usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() - usb: typec: altmodes/displayport: validate count before reading Status Update VDO - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO - usb: typec: ucsi: ccg: reject firmware images without a ':' record header - iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer - soc/tegra: pmc: Fix unsafe generic_handle_irq() call - hwmon: (pmbus/adm1266) serialize NVMEM blackbox read with pmbus_lock - hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock - of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() - phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X - drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used - drm/dp: Add eDP 1.5 bit definition - drm/i915/psr: Read Intel DPCD workaround register - drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register - media: rc: fix race between unregister and urb/irq callbacks - batman-adv: bla: avoid double decrement of bla.num_requests - batman-adv: tt: avoid empty VLAN responses - batman-adv: tt: fix TOCTOU race for reported vlans - batman-adv: tp_meter: directly shut down timer on cleanup - batman-adv: tp_meter: avoid role confusion in tp_list - batman-adv: iv: recover OGM scheduling after forward packet error - batman-adv: tvlv: reject oversized TVLV packets - batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface - batman-adv: tt: reject oversized local TVLV buffers - batman-adv: tvlv: abort OGM send on tvlv append failure - net: skbuff: fix pskb_carve leaking zcopy pages - ipv6: fix possible infinite loop in fib6_select_path() - ipv6: fix possible infinite loop in rt6_fill_node() - sctp: fix race between sctp_wait_for_connect and peeloff - net: mana: Add NULL guards in teardown path to prevent panic on attach failure - gpio: rockchip: convert bank->clk to devm_clk_get_enabled() - Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() - ethtool: eeprom: add more safeties to EEPROM Netlink fallback - ethtool: eeprom: add missing ethnl_ops_begin() / _complete() during fallback - bonding: refuse to enslave CAN devices - Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() - ASoC: codecs: simple-mux: Fix enum control bounds check - ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() - gpio: mxc: fix irq_high handling - net: hsr: fix potential OOB access in supervision frame handling - ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues - net/iucv: fix locking in .getsockopt - net/smc: Do not re-initialize smc hashtables - net: netlink: don't set nsid on local notifications - net: netlink: fix sending unassigned nsid after assigned one - vsock: keep poll shutdown state consistent - netfilter: nf_tables: fix dst corruption in same register operation - netfilter: bitwise: add support for doing AND, OR and XOR directly - netfilter: bitwise: rename some boolean operation functions - netfilter: ebtables: fix OOB read in compat_mtw_from_user - netfilter: xt_cpu: prefer raw_smp_processor_id - netfilter: synproxy: refresh tcphdr after skb_ensure_writable - xfrm: Check for underflow in xfrm_state_mtu - nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() - nfc: llcp: Fix use-after-free in llcp_sock_release() - net: cpsw_new: Fix potential unregister of netdev that has not been registered yet - drm: Remove plane hsub/vsub alignment requirement for core helpers - net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net: mctp: ensure our nlmsg responses are initialised - Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size - MIPS: smp: report dying CPU to RCU in stop_this_cpu() - LoongArch: Report dying CPU to RCU in stop_this_cpu() - irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT - tls: Flush backlog before waiting for a new record - net: ethernet: cortina: No mapping is a dropped rx - batman-adv: fix batadv_skb_is_frag() kernel-doc - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled - Bluetooth: ISO: fix malformed ISO_END/CONT handling - Bluetooth: MGMT: Fix backward compatibility with userspace - security/keys: fix missed RCU read section on lookup - LoongArch: kprobes: Fix handling of fatal unrecoverable recursions - pds_core: ensure null-termination for firmware version strings - pds_core: add an error code check in pdsc_dl_info_get - net: mana: validate rx_req_idx to prevent out-of-bounds array access - ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove() - gpio: cdev: check if uAPI v2 config attributes are correctly zeroed - gpiolib: cdev: use !mem_is_zero() instead of memchr_inv(s, 0, n) - string: add mem_is_zero() helper to check if memory area is all zeros - bpf, skmsg: fix verdict sk_data_ready racing with ktls rx - net: ag71xx: check error for platform_get_irq - Bluetooth: btmtk: rename btmediatek_data - Bluetooth: btusb: mediatek: refactor the function btusb_mtk_reset - Bluetooth: btmtk: add the function to get the fw name - ALSA: seq: Serialize UMP output teardown with event_input - ALSA: seq: ump: Use guard() for locking - pds_core: fix debugfs_lookup dentry leak and error handling - pds_core: fix error handling in pdsc_devcmd_wait - bridge: mcast: Fix a possible use-after-free when removing a bridge port - net: bridge: Flush multicast groups when snooping is disabled - RDMA/rtrs: Fix use-after-free in path file creation cleanup - platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL - platform/x86: intel-hid: Check ACPI_HANDLE() against NULL - platform/x86: hp_accel: Check ACPI_COMPANION() against NULL - platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer - net: dsa: mt7530: preserve VLAN tags on trapped link-local frames - net: dsa: mt7530: rename mt753x_bpdu_port_fw enum to mt753x_to_cpu_fw - net: dsa: mt7530: fix FDB entries not aging out with short timeout - wifi: ath11k: fix peer resolution on rx path when peer_id=0 - drm/msm/snapshot: fix dumping of the unaligned regions - spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache() - net/mlx5: Do not restore destination-less TC rules - tls: Preserve sk_err across recvmsg() when data has been copied - x86/xen: Fix xen_e820_swap_entry_with_ram() - net: phy: DP83TC811: add reading of abilities - net: phy: c45: add genphy_c45_pma_read_ext_abilities() function - net: tls: prevent chain-after-chain in plain text SG - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot - powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise() - drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN - drm/msm/dsi: don't dump registers past the mapped region - ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics - net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint - accel/qaic: Add overflow check to remap_pfn_range during mmap - HID: quirks: really enable the intended work around for appledisplay - wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm() - wifi: ath11k: fix error path leaks in some WMI WOW calls - net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS reference - net: ethernet: cortina: Carry over frag counter - net: ethernet: cortina: Drop half-assembled SKB - net: ethernet: cortina: Make RX SKB per-port - netfs: Fix overrun check in netfs_extract_user_iter() - zonefs: handle integer overflow in zonefs_fname_to_fno - irqchip/ath79-cpu: Remove unused function - phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access - net: lan966x: avoid unregistering netdev on register failure - ice: fix locking in ice_dcb_rebuild() - tcp: Fix imbalanced icsk_accept_queue count. - test_kprobes: clear kprobes between test runs - kprobes: skip non-symbol addresses in kprobe_add_ksym_blacklist() - netfilter: x_tables: unregister the templates first - ALSA: hda: cs35l56: Put ACPI device after setting companion - ARM: integrator: Fix early initialization - pinctrl: qcom: Fix wakeirq map by removing disconnected irqs for sm8150 - kunit: config: KUNIT_DEBUGFS should depend on DEBUG_FS - kunit: config: Enable KUNIT_DEBUGFS by default - firmware: arm_ffa: Skip free_pages on RX buffer alloc failure - firmware: arm_ffa: Check for NULL FF-A ID table while driver registration - HID: uclogic: Fix regression of input name assignment - hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors - hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe() - hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe() - hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in get_multiple - hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR - hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer - hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer - hwmon: (pmbus/adm1266) reject implausible blackbox record_count - hwmon: (pmbus/adm1266) seed timestamp from the real-time clock - batman-adv: tt: fix negative tt_buff_len - batman-adv: tt: fix negative last_changeset_len - batman-adv: tp_meter: fix race condition in send error reporting - batman-adv: tp_meter: avoid use of uninit sender vars - batman-adv: bla: fix report_work leak on backbone_gw purge - batman-adv: frag: disallow unicast fragment in fragment - batman-adv: fix fragment reassembly length accounting - batman-adv: dat: handle forward allocation error - batman-adv: clear current gateway during teardown - batman-adv: mcast: fix use-after-free in orig_node RCU release - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async - drm/amd/display: Validate GPIO pin LUT table size before iterating - drm/amd/display: Fix integer overflow in bios_get_image() - drm/bridge: megachips: remove bridge when irq request fails - drm/bridge: it66121: acquire reset GPIO in probe - drm/virtio: use uninterruptible resv lock for plane updates - device property: set fwnode->secondary to NULL in fwnode_init() - LoongArch: Remove unused code to avoid build warning - RDMA/siw: Reject MPA FPDU length underflow before signed receive math - spi: ti-qspi: fix use-after-free after DMA setup failure - spi: sprd: fix error pointer deref after DMA setup failure - scsi: isci: Fix use-after-free in device removal path - phy: tegra: xusb: Fix per-pad high-speed termination calibration - spi: qup: fix error pointer deref after DMA setup failure - drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe - KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits - arm64: probes: Handle probes on hinted conditional branch instructions - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() - ice: fix setting promisc mode while adding VID filter - ixgbevf: fix use-after-free in VEPA multicast source pruning - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 - wifi: ath11k: clear shared SRNG pointer state on restart - vsock/vmci: fix UAF when peer resets connection during handshake - ring-buffer: Fix reporting of missed events in iterator - qed: fix double free in qed_cxt_tables_alloc() - netfilter: ipset: stop hash:* range iteration at end - netfilter: nf_queue: hold bridge skb->dev while queued - netfilter: ip6t_hbh: reject oversized option lists - net: ifb: report ethtool stats over num_tx_queues - net: bcmgenet: keep RBUF EEE/PM disabled - phonet/pep: disable BH around forwarded sk_receive_skb() - Bluetooth: MGMT: validate Add Extended Advertising Data length - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths - Bluetooth: bnep: Fix UAF read of dev->name - Bluetooth: ISO: drop ISO_END frames received without prior ISO_START - net: wwan: iosm: fix potential memory leaks in ipc_imem_init() - drivers/base/memory: fix memory block reference leak in poison accounting - efi: Allocate runtime workqueue before ACPI init - ALSA: asihpi: Fix potential OOB array access at reading cache - ALSA: pcm: Don't setup bogus iov_iter for silencing - ALSA: ua101: Reject too-short USB descriptors - hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX - smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() - ksmbd: fix null pointer dereference in compare_guid_key() - mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break() - sysfs: don't remove existing directory on update failure - Revert "af_unix: Reject SIOCATMARK on non-stream sockets" - Revert "s390/cio: Update purge function to unregister the unused subchannels" - Revert "ice: Remove jumbo_remove step from TX path" - Revert "ice: fix double-free of tx_buf skb" - Revert "x86/vdso: Fix output operand size of RDPID" - wifi: mac80211: check tdls flag in ieee80211_tdls_oper - s390/debug: Reject zero-length input before trimming a newline - mptcp: pm: ADD_ADDR rtx: free sk if last - mptcp: sync the msk->sndbuf at accept() time - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close - netfilter: revalidate bridge ports - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp - net: bonding: fix NULL pointer dereference in bond_do_ioctl() - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() - udp: clear skb->dev before running a sockmap verdict - crypto: nx - Fix packed layout in struct nx842_crypto_header - crypto: nx - Use static_assert() to check struct sizes - batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown - Revert "ALSA: pcmtest: fix reference leak on failed device registration" - media: rc: ttusbir: fix inverted error logic - media: rc: igorplugusb: fix control request setup packet - batman-adv: tp_meter: fix tp_num leak on kmalloc failure - batman-adv: stop tp_meter sessions during mesh teardown - ALSA: seq: Fix UMP group 16 filtering - ALSA: seq: Notify client and port info changes - ALSA: core: Serialize deferred fasync state checks - ALSA: misc: Use guard() for spin locks - ALSA: hda: cs35l56: Propagate ASP TX source control errors - crypto: nx - Avoid -Wflex-array-member-not-at-end warning - ksmbd: reset rcount per connection in ksmbd_conn_wait_idle_sess_id() - media: rc: igorplugusb: heed coherency rules - ALSA: aoa: Skip devices with no codecs in i2sbus_resume() - media: rc: ttusbir: respect DMA coherency rules - ALSA: aoa: i2sbus: clear stale prepared state - ALSA: aoa: Use guard() for mutex locks - f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally - ksmbd: replace connection list with hash table - ksmbd: use msleep instaed of schedule_timeout_interruptible() - f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io() - smb: move some duplicate definitions to common/smbacl.h - iommu/amd: serialize sequence allocation under concurrent TLB invalidations - x86/shstk: Prevent deadlock during shstk sigreturn - ALSA: pcmtest: Fix resource leaks in module init error paths - ALSA: pcmtest: fix reference leak on failed device registration - ALSA: 6fire: Fix input volume change detection - ALSA: caiaq: Fix control_put() result and cache rollback - ALSA: core: Fix potential data race at fasync handling - Revert "ALSA: usb-audio: Cap the packet size pre-calculations" - ipv6: sit: reload inner IPv6 header after GSO offloads - net: guard timestamp cmsgs to real error queue skbs - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() - netfilter: x_tables: avoid leaking percpu counter pointers - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush - netfilter: require Ethernet MAC header before using eth_hdr() - netfilter: nft_fib: fix stale stack leak via the OIFNAME register - vsock/virtio: reset connection on receiving queue overflow - vsock/virtio: fix skb overhead accounting to preserve full buf_alloc - vsock/virtio: fix potential unbounded skb queue - mptcp: pm: ADD_ADDR rtx: always decrease sk refcount - mptcp: pm: ADD_ADDR rtx: allow ID 0 - ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers - srcu: Use irq_work to start GP in tiny SRCU - irqwork: Move data struct to a types header - types: move struct rcuwait into types.h - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets - wifi: iwlwifi: fix 22000 series SMEM parsing - wifi: iwlwifi: allow IWL_FW_CHECK() with just a string - x86: shadow stacks: proper error handling for mmap lock - net: mvpp2: sync RX data at the hardware packet offset - net: mvpp2: limit XDP frame size to the RX buffer - batman-adv: fix tp_meter counter underflow during shutdown - batman-adv: v: stop OGMv2 on disabled interface - ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger - spi: mpc52xx: fix controller deregistration - thunderbolt: Bound root directory content to block size - selinux: fix overlayfs mmap() and mprotect() access checks - lsm: add backing_file LSM hooks - fs: constify file ptr in backing_file accessor helpers - fs: prepare for adding LSM blob to backing_file - selftests/bpf: Add tests for ld_{abs,ind} failure path in subprogs - bpf: Fix ld_{abs,ind} failure path analysis in subprogs - KVM: x86: Fix shadow paging use-after-free due to unexpected role - Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref - Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() - fix kabi for ppp_defs.h - pppoe: drop PFC frames - netfilter: nat: use kfree_rcu to release ops - drm/i915/gem: Fix phys BO pread/pwrite with offset - selinux: allow multiple opens of /sys/fs/selinux/policy - ksmbd: make ksmbd thread names distinct by client IP - ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path - ALSA: caiaq: Don't abort when no input device is available - ALSA: caiaq: fix usb_dev refcount leak on probe failure - ALSA: caiaq: Handle probe errors properly - ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow - USB: cdc-acm: Fix bit overlap and move quirk definitions to header - ALSA: caiaq: take a reference on the USB device in create_card() - ALSA: usb-audio: apply quirk for MOONDROP JU Jiu - ksmbd: use check_add_overflow() to prevent u16 DACL size overflow - ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment - smb: server: fix max_connections off-by-one in tcp accept path - smb: server: fix active_num_conn leak on transport allocation failure - usb: port: add delay after usb_hub_set_port_power() - USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen - usb: storage: Expand range of matched versions for VL817 quirks entry - xfrm: Wait for RCU readers during policy netns exit - KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing - mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison - thunderbolt: Clamp XDomain response data copy to allocation size - bpf: return VMA snapshot from task_vma iterator - bpf: switch task_vma iterator from mmap_lock to per-VMA locks - bpf: fix mm lifecycle in open-coded task_vma iterator - netfilter: nft_ct: bail out on template ct in get eval - drm/amd/display: Bound VBIOS record-chain walk loops - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size - drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() - netfilter: conntrack_irc: fix possible out-of-bounds read - drm/vc4: fix krealloc() memory leak - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error - f2fs: fix data loss caused by incorrect use of nat_entry flag - bnxt_en: Fix NULL pointer dereference - ipv6: mcast: Fix use-after-free when processing MLD queries - ipvs: clear the svc scheduler ptr early on edit - netfilter: synproxy: add mutex to guard hook reference counting - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list - net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr - netlabel: validate unlabeled address and mask attribute lengths - netfilter: bridge: make ebt_snat ARP rewrite writable - tcp: restrict SO_ATTACH_FILTER to priv users - ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER - Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig - misc: fastrpc: fix DMA address corruption due to find_vma misuse - misc: fastrpc: Fix NULL pointer dereference in rpmsg callback - gpio: mvebu: fix NULL pointer dereference in suspend/resume - Bluetooth: fix memory leak in error path of hci_alloc_dev() - Bluetooth: bnep: reject short frames before parsing - Bluetooth: RFCOMM: validate skb length in MCC handlers - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams - RDMA/srp: bound SRP_RSP sense copy by the received length - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN - net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure - sched/psi: fix race between file release and pressure write - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase - rculist: add list_splice_rcu() for private lists - net: skbuff: fix missing zerocopy reference in pskb_carve helpers - ip6_vti: set netns_immutable on the fallback device. - wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() - wifi: rtw88: debugfs: support multiple adapters debugging - erofs: fix use-after-free on sbi->sync_decompress - net: openvswitch: fix possible kfree_skb of ERR_PTR - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() - md: wake raid456 reshape waiters before suspend - dm cache policy smq: check allocation under invalidate lock - Bluetooth: MGMT: validate advertising TLV before type checks - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend - USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL - USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam - USB: serial: option: add support for Rolling Wireless RW135R-GL - USB: serial: io_edgeport: add support for Blackbox IC135A - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr - netfilter: flowtable: strictly check for maximum number of actions - fuse: reject fuse_notify() pagecache ops on directories - fs/mbcache: cancel shrink work before destroying the cache - smb/client: fix possible infinite loop and oob read in symlink_data() - fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp - ata: libata-scsi: do not needlessly defer commands when using PMP with FBS - ata: libata-scsi: do not use the deferred QC feature on PMPs with CBS - ata: libata-scsi: do not use the deferred QC feature for ATA_DEFER_PORT - ata: libata-scsi: improve readability of ata_scsi_qc_issue() - ata: libata-scsi: fix requeue of deferred ATA PASS-THROUGH commands - ata: libata-eh: Fix detection of deferred qc timeouts - ata: libata: cancel pending work after clearing deferred_qc - ata: libata-core: fix cancellation of a port deferred qc work - ata: libata-scsi: rename and improve ata_qc_done() - ata: libata-scsi: simplify ata_scsi_requeue_deferred_qc() - ata: libata-sata: simplify ata_sas_queuecmd() - ata: libata-core: improve tag checks in ata_qc_issue() - ata: libata-eh: correctly handle deferred qc timeouts - ata: libata-scsi: avoid Non-NCQ command starvation - ata: libata: Introduce ata_port_eh_scheduled() - ext4: handle wraparound when searching for blocks for indirect mapped blocks - ext4: fix error pointer dereference in ext4_mb_load_buddy_gfp() - ext4: always allocate blocks only from groups inode can use - ext4: fix e4b bitmap inconsistency reports - ext4: convert bd_buddy_page to bd_buddy_folio - ext4: convert bd_bitmap_page to bd_bitmap_folio - Revert "ext4: fix e4b bitmap inconsistency reports" - ext4: cleanup for ext4_map_blocks - ext4: rename EXT4_GET_BLOCKS_PRE_IO - ext4: drop extent cache when splitting extent fails - ext4: drop extent cache after doing PARTIAL_VALID1 zeroout - ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O - ext4: correct the comments place for EXT4_EXT_MAY_ZEROOUT - ext4: get rid of ppath in ext4_ext_handle_unwritten_extents() - ext4: get rid of ppath in ext4_ext_convert_to_initialized() - ext4: get rid of ppath in ext4_split_convert_extents() - ext4: get rid of ppath in ext4_split_extent() - ext4: get rid of ppath in ext4_force_split_extent_at() - ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 - ext4: subdivide EXT4_EXT_DATA_VALID1 - Revert "ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O" - ext4: get rid of ppath in ext4_split_extent_at() - ext4: get rid of ppath in ext4_ext_insert_extent() - ext4: get rid of ppath in get_ext_path() - ext4: add new ext4_ext_path_brelse() helper - !24596 [sync]urma: fix workqueue use-after-free in ubagg_exit teardown sequence - urma: fix workqueue use-after-free in ubagg_exit teardown sequence - !24607 ub: udma: Optimize udma jetty id access logic. - ub: udma: Optimize udma jetty id access logic. - !24640 [sync]urma: limit ubcore logs in reuse paths - urma: fix workqueue use-after-free in ubagg_exit teardown sequence - !24669 mm/madvise: add MADV_FCMA_ENABLE to set PF_FOLIO_CMA via madvise - mm/madvise: add MADV_FCMA_ENABLE to set PF_FOLIO_CMA via madvise - !24702 [sync]urma: retry import jetty/jfr on EIO from tpid reuse failure - urma: retry import jetty/jfr on EIO from tpid reuse failure - urma: limit ubagg connect exchange logs * Fri Jul 10 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-145.3.18.151.20260710.aae66044906b - !24753 [sync]urma: drain jfe event lists in batches to avoid soft-lockup - urma: drain jfe event lists in batches to avoid soft-lockup - urma: reduce ubagg topo log noise - !24748 [sync]urma: free completion events outside jfe lock - urma: free jfe events outside lock - urma: free completion events outside jfe lock - !24742 urma: Fix the issue of inaccurate timing for some functions in DFX - !24741 [sync]urma: fix UAF of accessing token_id in log. - urma: Fix the issue of inaccurate timing for some functions in DFX - urma: fix UAF of accessing token_id in log. - !24734 [sync]urma: fix tpid_reuse attached to vtpn causes use_after_free - urma: fix tpid_reuse attached to vtpn causes use_after_free - !24804 [sync]urma: use vzalloc for ubmad tjetty and ini_rtbuffer - !24774 [sync]urma: ratelimit import jetty/jfr error logs - urma: use vzalloc for ubmad tjetty and ini_rtbuffer - !24792 [sync]urma: fix UAF of accessing jfs/jetty in log. - urma: fix UAF of accessing jfs/jetty in log. - urma: ratelimit import jetty/jfr error logs - !24845 [sync]ub/ubdevshm: Support for acquiring va is a sub-range of registered va - ub/ubdevshm: Support for acquiring va is a sub-range of registered va - !24802 [sync]urma: use xarray for ubagg/ubcore session lookup - urma: use xarray for ubagg/ubcore session lookup - !24814 [sync]urma: make ratelimit burst configurable for ubcore/uburma/ubagg - urma: make ratelimit burst configurable for ubcore/uburma/ubagg * Wed Jul 22 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-145.3.22.153.20260722.158daf1d8dea - !24942 [sync]urma: drop param_set_uint_minmax for ratelimit burst setters - urma: drop param_set_uint_minmax for ratelimit burst setters - !25840 sync CVE LTS and bugfix from OLK-6.6 d33ffc8f8580 to 334dfd575ba5 - cgroup/rstat: avoid disabling irqs for O(num_cpu) - netfilter: bridge: eb_tables: close module init race - crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents - netfilter: ebtables: move to two-stage removal scheme - crypto: qat - protect service table iterations with service_lock - Bluetooth: eir: Fix stack OOB write when prepending the Flags AD - drm/edid: fix OOB read in drm_parse_tiled_block() - proc: protect ptrace_may_access() with exec_update_lock (FD links) - vfio/pci: Latch disable_idle_d3 per device - bpf: Fix UAF in sock clone early bailouts - bpf: Disable xfrm_decode_session hook attachment - bpf,fork: wipe ->bpf_storage before bailouts that access it - KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() - crypto: qat - validate RSA CRT component lengths - bpf: Clear rb node linkage when freeing bpf_rb_root - bpf: Add validation for bpf_set_retval argument - bpf: Reject sleepable BPF_LSM_CGROUP programs at load time - bpf: Fix setting retval to -EPERM for cgroup hooks not returning errno - bpf: Guard __get_user acesss with access_ok for uprobe_multi data - i2c: core: fix adapter registration race - ALSA: hda/cs35l41: Fix firmware load work teardown - vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc - iommufd: Break the loop on failure in iommufd_fault_fops_read() - posix-cpu-timers: Prevent UAF caused by non-leader exec() race - iio: event: Fix event FIFO reset race - hwrng: virtio: clamp device-reported used.len at copy_data() - crypto: drbg - Fix returning success on failure in CTR_DRBG - crypto: ecc - Fix carry overflow in vli multiplication - crypto: pcrypt - restore callback for non-parallel fallback - net: openvswitch: reject oversized nested action attrs - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page - e1000e: Fix out-of-bounds MMIO access by validating BAR0 size - xsched: enforce permissions on attribute access - xsched: restrict vstream management to privileged users - rme: use DMA API for virtio in realm world - udf: validate sparing table length as an entry count, not a byte count - smb: client: harden POSIX SID length parsing - smb: client: mask server-provided mode to 07777 in modefromsid - smb: client: Fix next buffer leak in receive_encrypted_standard() - nvmet-auth: validate reply message payload bounds against transfer length - bpf: Reject fragmented frames in devmap - bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized - mm/huge_memory: update file PMD counter before folio_put() - sctp: fix uninit-value in __sctp_rcv_asconf_lookup() - smb: client: reject overlapping data areas in SMB2 responses - smb: client: restrict implied bcc[0] exemption to responses without data area - io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item - writeback: drop now-unnecessary rcu_barrier() in cgroup_writeback_umount() - writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() - writeback: Fix use after free in inode_switch_wbs_work_fn() - writeback: Avoid contention on wb->list_lock when switching inodes - block: skip sync_blockdev() on surprise removal in bdev_mark_dead() - mm: do file ownership checks with the proper mount idmap - tracing: Bound synthetic-field strings with seq_buf - perf/core: Detach event groups during remove_on_exec - bpf: Allow LPM map access from sleepable BPF programs - bpf: Consistently use bpf_rcu_lock_held() everywhere - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC - udf: validate VAT header length against the VAT inode size - isofs: bound Rock Ridge symlink components to the SL record - udf: validate free block extents against the partition length - config: arm64: update CONFIG_FTRACE_STARTUP_TEST not set - crypto: qat - Return pointer directly in adf_ctl_alloc_resources - crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() - drivers/base/memory: set mem->altmap after successful device registration - serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails - serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero - NFS: Prevent resource leak in nfs_alloc_server() - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr - nfsd: check get_user() return when reading princhashlen - fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode - fbdev: modedb: fix a possible UAF in fb_find_mode() - fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var - power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path - 9p: avoid putting oldfid in p9_client_walk() error path - ocfs2: reject oversized group bitmap descriptors - rpmsg: char: Fix use-after-free on probe error path - fpga: region: fix use-after-free in child_regions_with_firmware() - irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove - pNFS: Fix use-after-free in pnfs_update_layout() - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done - hdlc_ppp: sync per-proto timers before freeing hdlc state - gfs2: fix use-after-free in gfs2_qd_dealloc - exfat: fix potential use-after-free in exfat_find_dir_entry() - bpf: use kvfree() for replaced sysctl write buffer - f2fs: keep atomic write retry from zeroing original data - f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node() - f2fs: validate ACL entry sizes in f2fs_acl_from_disk() - f2fs: fix to round down start offset of fallocate for pin file - f2fs: validate compress cache inode only when enabled - wifi: iwlwifi: mvm: fix race condition in PTP removal - wifi: rtw88: usb: fix memory leaks on USB write failures - wifi: rtw88: increase TX report timeout to fix race condition - wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor - wifi: ath11k: fix warning when unbinding - wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S - keys: Pin request_key_auth payload in instantiate paths - KEYS: fix overflow in keyctl_pkey_params_get_2() - err.h: use __always_inline on all error pointer helpers - fbdev: fix use-after-free in store_modes() - NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR - apparmor: mediate the implicit connect of TCP fast open sendmsg - net: skmsg: preserve sg.copy across SG transforms - mac802154: llsec: add skb_cow_data() before in-place crypto - af_unix: Set gc_in_progress to true in unix_gc(). - ntfs3: reject direct userspace writes to reserved $LX* xattrs - ipv4: account for fraggap on the paged allocation path - inet: add indirect call wrapper for getfrag() calls - ipv6: account for fraggap on the paged allocation path - batman-adv: tvlv: avoid race of cifsnotfound handler state - batman-adv: tvlv: enforce 2-byte alignment - batman-adv: dat: prevent false sharing between VLANs - batman-adv: tt: track roam count per VID - batman-adv: tt: don't merge change entries with different VIDs - batman-adv: tp_meter: handle overlapping packets - batman-adv: tp_meter: prevent parallel modifications of last_recv - batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE - batman-adv: tp_meter: restrict number of unacked list entries - batman-adv: v: prevent OGM aggregation on disabled hardif - batman-adv: frag: avoid underflow of TTL - batman-adv: frag: ensure fragment is writable before modifying TTL - batman-adv: fix (m|b)cast csum after decrementing TTL - batman-adv: ensure bcast is writable before modifying TTL - batman-adv: tp_meter: initialize last_recv_time during init - batman-adv: prevent ELP transmission interval underflow - batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE - batman-adv: tp_meter: add only finished tp_vars to lists - batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection - batman-adv: tp_meter: fix fast recovery precondition - batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd - batman-adv: tp_meter: avoid window underflow - batman-adv: tp_meter: initialize dec_cwnd explicitly - batman-adv: tp_meter: initialize dup_acks explicitly - batman-adv: tp_meter: keep unacked list in ascending ordered - eventpoll: rename ep_remove_safe() back to ep_remove() - file: add fput() cleanup helper - media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si - ksmbd: reject non-VALID session in compound request branch - scripts/sorttable: Fix endianness handling in build-time mcount sort - scripts/sorttable: Allow matches to functions before function entry - scripts/sorttable: Use normal sort if theres no relocs in the mcount section - ftrace: Check against is_kernel_text() instead of kaslr_offset() - ftrace: Test mcount_loc addr before calling ftrace_call_addr() - ftrace: Do not over-allocate ftrace memory - ftrace: Have ftrace pages output reflect freed pages - ftrace: Update the mcount_loc check of skipped entries - scripts/sorttable: Zero out weak functions in mcount_loc table - scripts/sorttable: Always use an array for the mcount_loc sorting - scripts/sorttable: Have mcount rela sort use direct values - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 - scripts/sorttable: Use a structure of function pointers for elf helpers - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly - scripts/sorttable: Move code from sorttable.h into sorttable.c - scripts/sorttable: Use uint64_t for mcount sorting - scripts/sorttable: Add helper functions for Elf_Sym - scripts/sorttable: Add helper functions for Elf_Shdr - scripts/sorttable: Add helper functions for Elf_Ehdr - scripts/sorttable: Convert Elf_Sym MACRO over to a union - scripts/sorttable: Replace Elf_Shdr Macro with a union - scripts/sorttable: Convert Elf_Ehdr to union - scripts/sorttable: Make compare_extable() into two functions - scripts/sorttable: Have the ORC code use the _r() functions to read - scripts/sorttable: Remove unneeded Elf_Rel - scripts/sorttable: Remove unused write functions - scripts/sorttable: Remove unused macro defines - fuse: re-lock request before replacing page cache folio - slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD - slimbus: qcom-ngd-ctrl: Fix up platform_driver registration - rxrpc: Fix the ACK parser to extract the SACK table for parsing - net: phonet: free phonet_device after RCU grace period - phonet: Pass net and ifindex to phonet_address_notify(). - phonet: Pass ifindex to fill_addr(). - Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs - hv: utils: handle and propagate errors in kvp_register - regulator: core: fix locking in regulator_resolve_supply() error path - ring-buffer: Remove ring_buffer_read_prepare_sync() - selftests/bpf: Update comments find_equal_scalars->sync_linked_regs - af_unix: Reject SIOCATMARK on non-stream sockets - selftests/bpf: Add test to ensure kprobe_multi is not sleepable - agp/amd64: Fix broken error propagation in agp_amd64_probe() - net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() - i2c: stub: Reject I2C block transfers with invalid length - RDMA/bnxt_re: zero shared page before exposing to userspace - KVM: VMX: Update SVI during runtime APICv activation - ARM: fix branch predictor hardening - ARM: fix hash_name() fault - ARM: allow __do_kernel_fault() to report execution of memory faults - ARM: group is_permission_fault() with is_translation_fault() - debugobjects: Dont call fill_pool() in early boot hardirq context - debugobjects: Do not fill_pool() if pi_blocked_on - debugobjects: Use LD_WAIT_CONFIG instead of LD_WAIT_SLEEP - debugobjects: Allow to refill the pool before SYSTEM_SCHEDULING - batman-adv: tt: prevent TVLV entry number overflow - drm/v3d: Skip CSD when it has zeroed workgroups - drm/v3d: Store the active job inside the queue's state - iov_iter: Fix potential underflow in iov_iter_extract_xarray_pages() - urma: add check type in free driver obj - smb: client: fix double-free in SMB2_close() replay - smb: client: fix double-free in SMB2_flush() replay - smb: client: fix query_info() replay double-free - smb: client: fix query directory replay double-free - smb: client: fix double-free in SMB2_open() replay - smb: client: fix double-free in SMB2_ioctl() replay - smb: client: fix change notify replay double-free - HID: lg-g15: cancel pending work on remove to fix a use-after-free - HID: multitouch: fix out-of-bounds bit access on mt_io_flags - tracing: Prevent out-of-bounds read in glob matching - sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT - !25616 sync CVE LTS and bugfix from OLK-6.6 b72db20c0437 to d33ffc8f8580 - KVM: x86: hyper-v: Bound the bank index when querying sparse banks - MIPS: DEC: Prevent initial console buffer from landing in XKPHYS - ksmbd: fix durable reconnect error path file lifetime - ksmbd: fix use-after-free in smb2_open during durable reconnect - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query - USB: iowarrior: fix use-after-free on disconnect race - usb: iowarrior: remove inherent race with minor number - USB: iowarrior: fix use-after-free on disconnect - apparmor: fix use-after-free in rawdata dedup loop - tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR - bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops - rbd: eliminate a race in lock_dwork draining on unmap - blk-cgroup: fix UAF in __blkcg_rstat_flush() - net: Fix kabi breakage of struct tc_action - net/sched: act_api: use RCU with deferred freeing for action lifecycle - net: Fix kabi breakage of struct header_ops - bonding: prevent potential infinite loop in bond_header_parse() - bonding: fix type confusion in bond_setup_by_slave() - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc - ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL - ASoC: cs35l56: Fix missing calls to wm_adsp2_remove() - time: Fix off-by-one in compat settimeofday() usec validation - scsi: target: Fix hexadecimal CHAP_I handling - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink - ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY - ksmbd: add a permission check for FSCTL_SET_ZERO_DATA - ksmbd: add per-handle permission check to FILE_LINK_INFORMATION - mptcp: fix missing wakeups in edge scenarios - mptcp: add-addr: always drop other suboptions - ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 - RDMA/umem: fix kernel-doc warnings - mm/migrate: don't call folio_putback_active_hugetlb() on dst hugetlb folio - usb: typec: ucsi: Don't update power_supply on power role change if not connected - serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() - thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() - usb: typec: ucsi: Check if power role change actually happened before handling - usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind - usb: dwc3: xilinx: fix error handling in zynqmp init error paths - usb: musb: omap2430: Fix use-after-free in omap2430_probe() - tty: serial: samsung: Remove redundant port lock acquisition in rx helpers - tty: serial: samsung: use u32 for register interactions - serial: samsung_tty: Use port lock wrappers - ALSA: firewire-motu: Protect register DSP event queue positions - memfd: deny writeable mappings when implying SEAL_WRITE - iio: dac: ad5686: fix ref bit initialization for single-channel parts - usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure - iio: chemical: scd30: fix division by zero in write_raw - iio: chemical: scd30: Use guard(mutex) to allow early returns - iio: gyro: adis16260: fix division by zero in write_raw - Bluetooth: hci_qca: Convert timeout from jiffies to ms - Bluetooth: hci_qca: Migrate to serdev specific shutdown function - serdev: Provide a bustype shutdown function - serdev: make serdev_bus_type const - mm/damon/sysfs-schemes: delete tried region in regions_rmdirs() - mptcp: do not drop partial packets - mptcp: introduce the mptcp_init_skb helper - iio: adc: npcm: fix unbalanced clk_disable_unprepare() - iio: adc: npcm: Convert to platform remove callback returning void - octeontx2-pf: avoid double free of pool->stack on AQ init failure - af_unix: Fix UAF read of tail->len in unix_stream_data_wait() - af_unix: Cache state->msg in unix_stream_read_generic(). - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg - net: hsr: defer node table free until after RCU readers - mptcp: pm: fix ADD_ADDR timer infinite retry on option space insufficient - ice: fix VF queue configuration with low MTU values - mptcp: reset rcv wnd on disconnect - mptcp: cleanup fallback dummy mapping generation - octeontx2-af: CGX: add bounds check to cgx_speed_mbps index - octeontx2-af: replace deprecated strncpy with strscpy - cgroup/cpuset: Reset DL migration state on can_attach() failure - fbdev/vt8500lcdfb: Initialize fb_ops with fbdev macros - soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get() - driver core: reject devices with unregistered buses - drm/amd/display: Use krealloc_array() in dal_vector_reserve() - drm/amdgpu: restart the CS if some parts of the VM are still invalidated - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 - drm/amdkfd: fix NULL dereference in get_queue_ids() - slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock - slimbus: qcom-ngd-ctrl: fix OF node refcount - thunderbolt: Limit XDomain response copy to actual frame size - sctp: stream: fully roll back denied add-stream state - mmc: sdhci: add signal voltage switch in sdhci_resume_host - mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC - mmc: litex_mmc: Set mandatory idle clocks before CMD0 - mmc: core: Fix host controller programming for fixed driver type - mm/hugetlb: restore reservation on error in hugetlb folio copy paths - octeontx2-af: fix memory leak in rvu_setup_hw_resources() - nvmem: layouts: onie-tlv: fix hang on unknown types - net: rds: clear i_sends on setup unwind - net: mv643xx: fix OF node refcount - net/mlx5: Reorder completion before putting command entry in cmd_work_handler - misc: fastrpc: fix use-after-free race in fastrpc_map_create - misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context - Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard - i2c: tegra: Fix NOIRQ suspend/resume - i2c: stm32f7: fix timing computation ignoring i2c-analog-filter - i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() - pidfd: refuse access to tasks that have started exiting harder - ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write - vsock/vmci: fix sk_ack_backlog leak on failed handshake - wifi: nl80211: reject oversized EMA RNR lists - selftests: mptcp: add test for extra_subflows underflow on userspace PM - mptcp: sockopt: check timestamping ret value - mptcp: allow subflow rcv wnd to shrink - mptcp: close TOCTOU race while computing rcv_wnd - mptcp: fix retransmission loop when csum is enabled - ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow - ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O - ARM: socfpga: Fix OF node refcount leak in SMP setup - mm/damon/ops-common: call folio_test_lru() after folio_get() - drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info() - ALSA: timer: Fix UAF at snd_timer_user_params() - USB: serial: option: add usb-id for Dell Wireless DW5826e-m - xfrm: espintcp: do not reuse an in-progress partial send - ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL - mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation - tracing/probes: Point the error offset correctly for eprobe argument error - netfilter: nft_tunnel: fix use-after-free on object destroy - clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time - net: mvpp2: build skb from XDP-adjusted data on XDP_PASS - net: mvpp2: refill RX buffers before XDP or skb use - net: mvpp2: Add metadata support for xdp mode - netfilter: nf_log: validate MAC header was set before dumping it - rds: mark snapshot pages dirty in rds_info_getsockopt() - net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion - r8152: handle the return value of usb_reset_device() - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove - net: phy: clean the sfp upstream if phy probing fails - net/mlx4: avoid GCC 10 __bad_copy_from() false positive - ASoC: wm_adsp: Fix NULL dereference when removing firmware controls - arm64: tlb: Allow XZR argument to TLBI ops - KVM: arm64: Remove VPIPT I-cache handling - tools/rv: Fix cleanup after failed trace setup - time: Fix off-by-one in settimeofday() usec validation - ipmi: Fix rcu_read_unlock to srcu_read_unlock in handle_read_event_rsp - ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() - vxlan: vnifilter: fix spurious notification on VNI update - vxlan: vnifilter: send notification on VNI add - octeontx2-af: npc: Fix CPT channel mask in npc_install_flow - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown - ptp: vclock: Switch from RCU to SRCU - net: fec: fix pinctrl default state restore order on resume - net: lan743x: permit VLAN-tagged packets up to configured MTU - net: garp: fix unsigned integer underflow in garp_pdu_parse_attr - hsr: Remove WARN_ONCE() in hsr_addr_is_self(). - net: Annotate sk->sk_write_space() for UDP SOCKMAP. - pcnet32: stop holding device spin lock during napi_complete_done - drm/imx: Fix three kernel-doc warnings in dcss-scaler.c - 6lowpan: fix off-by-one in multicast context address compression - netfilter: xt_NFQUEUE: prefer raw_smp_processor_id - tee: optee: prevent use-after-free when the client exits before the supplicant - net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS - Disable -Wattribute-alias for clang-23 and newer - RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug - USB: serial: mct_u232: fix memory corruption with small endpoint - usb: core: Fix SuperSpeed root hub wMaxPacketSize - serial: zs: Convert to use a platform device - serial: dz: Convert to use a platform device - serial: dz: Fix bootconsole handover lockup - xhci: tegra: Fix ghost USB device on dual-role port unplug - USB: serial: digi_acceleport: fix memory corruption with small endpoints - landlock: Fix handling of disconnected directories - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync - USB: serial: cypress_m8: fix memory corruption with small endpoint - serial: zs: Switch to using channel reset - serial: zs: Fix bootconsole handover lockup - serial: dz: Fix bootconsole message clobbering at chip reset - drm/amdkfd: Check for pdd drm file first in CRIU restore path - drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger - drm/amdkfd: fix NULL pointer bug in svm_range_set_attr - serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma - serial: zs: Fix swapped RI/DSR modem line transition counting - serial: sh-sci: fix memory region release in error path - serial: qcom-geni: fix UART_RX_PAR_EN bit position - serial: altera_jtaguart: handle uart_add_one_port() failures - drm/amd/pm/si: Disregard vblank time when no displays are connected - drm/i915: Fix potential UAF in TTM object purge - drm/hyperv: validate VMBus packet size in receive callback - drm/hyperv: validate resolution_count and fix WIN8 fallback - scsi: target: iscsi: Validate CHAP_R length before base64 decode - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 - scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker - thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow - thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() - usb: gadget: f_fs: copy only received bytes on short ep0 read - usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports - usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling - usb: gadget: f_hid: fix device reference leak in hidg_alloc() - usb: gadget: net2280: Fix double free in probe error path - USB: serial: mct_u232: fix missing interrupt-in transfer sanity check - USB: serial: mxuport: fix memory corruption with small endpoint - USB: serial: keyspan: fix missing indat transfer sanity check - USB: serial: cypress_m8: validate interrupt packet headers - USB: serial: belkin_sa: validate interrupt status length - USB: serial: option: add MeiG SRM813Q - usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize - usb: usbtmc: check URB actual_length for interrupt-IN notifications - usbip: vudc: Fix use after free bug in vudc_remove due to race condition - usb: storage: Add quirks for PNY Elite Portable SSD - USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers - usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval - usb: chipidea: core: convert ci_role_switch to local variable - tty: serial: pch_uart: add check for dma_alloc_coherent() - counter: Fix refcount leak in counter_alloc() error path - comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() - comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() - Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 - Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem - Input: xpad - add support for ASUS ROG RAIKIRI II - Input: xpad - add "Nova 2 Lite" from GameSir - ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks - ASoC: qcom: q6asm-dai: close stream only when running - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check - xfrm: ah: use skb_to_full_sk in async output callbacks - xfrm: route MIGRATE notifications to caller's netns - nfc: hci: fix out-of-bounds read in HCP header parsing - iommu, debugobjects: avoid gcc-16.1 section mismatch warnings - HID: wacom: Fix OOB write in wacom_hid_set_device_mode() - ip6: vti: Use ip6_tnl.net in vti6_changelink(). - xfrm: input: hold netns during deferred transport reinjection - ipv6: validate extension header length before copying to cmsg - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). - ipv6: exthdrs: refresh nh after handling HAO option - ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() - macsec: fix replay protection at XPN lower-PN wrap - bpf: sockmap: fix tail fragment offset in bpf_msg_push_data - Input: elan_i2c - validate firmware size before use - usb: dwc2: Fix use after free in debug code - usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles - usb: cdns3: gadget: fix request skipping after clearing halt - USB: serial: omninet: fix memory corruption with small endpoint - iio: buffer: hw-consumer: fix use-after-free in error path - iio: light: cm3323: fix reg_conf not being initialized correctly - iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL - iio: temperature: tsys01: fix broken PROM checksum validation - iio: ssp_sensors: cancel delayed work_refresh on remove - iio: gyro: itg3200: fix i2c read into the wrong stack location - iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw - iio: dac: ad5686: acquire lock when doing powerdown control - iio: dac: ad5686: fix input raw value check - iio: dac: max5821: fix return value check in powerdown sync - iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux - wireguard: send: append trailer after expanding head - KVM: arm64: PMU: Preserve AArch32 counter low bits - parport: Fix race between port and client registration - Input: xpad - fix out-of-bounds access for Share button - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock - Bluetooth: ISO: fix UAF in iso_recv_frame - Bluetooth: HIDP: fix missing length checks in hidp_input_report() - auxdisplay: line-display: fix OOB read on zero-length message_store() - hpfs: fix a crash if hpfs_map_dnode_bitmap fails - Bluetooth: btusb: Allow firmware re-download when version matches - HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse - Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() - USB: serial: safe_serial: fix memory corruption with small endpoint - usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT - usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() - usb: typec: altmodes/displayport: validate count before reading Status Update VDO - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO - usb: typec: ucsi: ccg: reject firmware images without a ':' record header - iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer - soc/tegra: pmc: Fix unsafe generic_handle_irq() call - hwmon: (pmbus/adm1266) serialize NVMEM blackbox read with pmbus_lock - hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock - of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() - phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X - drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used - drm/dp: Add eDP 1.5 bit definition - drm/i915/psr: Read Intel DPCD workaround register - drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register - media: rc: fix race between unregister and urb/irq callbacks - batman-adv: bla: avoid double decrement of bla.num_requests - batman-adv: tt: avoid empty VLAN responses - batman-adv: tt: fix TOCTOU race for reported vlans - batman-adv: tp_meter: directly shut down timer on cleanup - batman-adv: tp_meter: avoid role confusion in tp_list - batman-adv: iv: recover OGM scheduling after forward packet error - batman-adv: tvlv: reject oversized TVLV packets - batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface - batman-adv: tt: reject oversized local TVLV buffers - batman-adv: tvlv: abort OGM send on tvlv append failure - net: skbuff: fix pskb_carve leaking zcopy pages - ipv6: fix possible infinite loop in fib6_select_path() - ipv6: fix possible infinite loop in rt6_fill_node() - sctp: fix race between sctp_wait_for_connect and peeloff - net: mana: Add NULL guards in teardown path to prevent panic on attach failure - gpio: rockchip: convert bank->clk to devm_clk_get_enabled() - Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() - ethtool: eeprom: add more safeties to EEPROM Netlink fallback - ethtool: eeprom: add missing ethnl_ops_begin() / _complete() during fallback - bonding: refuse to enslave CAN devices - Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() - ASoC: codecs: simple-mux: Fix enum control bounds check - ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() - gpio: mxc: fix irq_high handling - net: hsr: fix potential OOB access in supervision frame handling - ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues - net/iucv: fix locking in .getsockopt - net/smc: Do not re-initialize smc hashtables - net: netlink: don't set nsid on local notifications - net: netlink: fix sending unassigned nsid after assigned one - vsock: keep poll shutdown state consistent - netfilter: nf_tables: fix dst corruption in same register operation - netfilter: bitwise: add support for doing AND, OR and XOR directly - netfilter: bitwise: rename some boolean operation functions - netfilter: ebtables: fix OOB read in compat_mtw_from_user - netfilter: xt_cpu: prefer raw_smp_processor_id - netfilter: synproxy: refresh tcphdr after skb_ensure_writable - xfrm: Check for underflow in xfrm_state_mtu - nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() - nfc: llcp: Fix use-after-free in llcp_sock_release() - net: cpsw_new: Fix potential unregister of netdev that has not been registered yet - drm: Remove plane hsub/vsub alignment requirement for core helpers - net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net: mctp: ensure our nlmsg responses are initialised - Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size - MIPS: smp: report dying CPU to RCU in stop_this_cpu() - LoongArch: Report dying CPU to RCU in stop_this_cpu() - irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT - tls: Flush backlog before waiting for a new record - net: ethernet: cortina: No mapping is a dropped rx - batman-adv: fix batadv_skb_is_frag() kernel-doc - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled - Bluetooth: ISO: fix malformed ISO_END/CONT handling - Bluetooth: MGMT: Fix backward compatibility with userspace - security/keys: fix missed RCU read section on lookup - LoongArch: kprobes: Fix handling of fatal unrecoverable recursions - pds_core: ensure null-termination for firmware version strings - pds_core: add an error code check in pdsc_dl_info_get - net: mana: validate rx_req_idx to prevent out-of-bounds array access - ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove() - gpio: cdev: check if uAPI v2 config attributes are correctly zeroed - gpiolib: cdev: use !mem_is_zero() instead of memchr_inv(s, 0, n) - string: add mem_is_zero() helper to check if memory area is all zeros - bpf, skmsg: fix verdict sk_data_ready racing with ktls rx - net: ag71xx: check error for platform_get_irq - Bluetooth: btmtk: rename btmediatek_data - Bluetooth: btusb: mediatek: refactor the function btusb_mtk_reset - Bluetooth: btmtk: add the function to get the fw name - ALSA: seq: Serialize UMP output teardown with event_input - ALSA: seq: ump: Use guard() for locking - pds_core: fix debugfs_lookup dentry leak and error handling - pds_core: fix error handling in pdsc_devcmd_wait - bridge: mcast: Fix a possible use-after-free when removing a bridge port - net: bridge: Flush multicast groups when snooping is disabled - RDMA/rtrs: Fix use-after-free in path file creation cleanup - platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL - platform/x86: intel-hid: Check ACPI_HANDLE() against NULL - platform/x86: hp_accel: Check ACPI_COMPANION() against NULL - platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer - net: dsa: mt7530: preserve VLAN tags on trapped link-local frames - net: dsa: mt7530: rename mt753x_bpdu_port_fw enum to mt753x_to_cpu_fw - net: dsa: mt7530: fix FDB entries not aging out with short timeout - wifi: ath11k: fix peer resolution on rx path when peer_id=0 - drm/msm/snapshot: fix dumping of the unaligned regions - spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache() - net/mlx5: Do not restore destination-less TC rules - tls: Preserve sk_err across recvmsg() when data has been copied - x86/xen: Fix xen_e820_swap_entry_with_ram() - net: phy: DP83TC811: add reading of abilities - net: phy: c45: add genphy_c45_pma_read_ext_abilities() function - net: tls: prevent chain-after-chain in plain text SG - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot - powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise() - drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN - drm/msm/dsi: don't dump registers past the mapped region - ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics - net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint - accel/qaic: Add overflow check to remap_pfn_range during mmap - HID: quirks: really enable the intended work around for appledisplay - wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm() - wifi: ath11k: fix error path leaks in some WMI WOW calls - net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS reference - net: ethernet: cortina: Carry over frag counter - net: ethernet: cortina: Drop half-assembled SKB - net: ethernet: cortina: Make RX SKB per-port - netfs: Fix overrun check in netfs_extract_user_iter() - zonefs: handle integer overflow in zonefs_fname_to_fno - irqchip/ath79-cpu: Remove unused function - phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access - net: lan966x: avoid unregistering netdev on register failure - ice: fix locking in ice_dcb_rebuild() - tcp: Fix imbalanced icsk_accept_queue count. - test_kprobes: clear kprobes between test runs - kprobes: skip non-symbol addresses in kprobe_add_ksym_blacklist() - netfilter: x_tables: unregister the templates first - ALSA: hda: cs35l56: Put ACPI device after setting companion - ARM: integrator: Fix early initialization - pinctrl: qcom: Fix wakeirq map by removing disconnected irqs for sm8150 - kunit: config: KUNIT_DEBUGFS should depend on DEBUG_FS - kunit: config: Enable KUNIT_DEBUGFS by default - firmware: arm_ffa: Skip free_pages on RX buffer alloc failure - firmware: arm_ffa: Check for NULL FF-A ID table while driver registration - HID: uclogic: Fix regression of input name assignment - hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors - hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe() - hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe() - hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in get_multiple - hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR - hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer - hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer - hwmon: (pmbus/adm1266) reject implausible blackbox record_count - hwmon: (pmbus/adm1266) seed timestamp from the real-time clock - batman-adv: tt: fix negative tt_buff_len - batman-adv: tt: fix negative last_changeset_len - batman-adv: tp_meter: fix race condition in send error reporting - batman-adv: tp_meter: avoid use of uninit sender vars - batman-adv: bla: fix report_work leak on backbone_gw purge - batman-adv: frag: disallow unicast fragment in fragment - batman-adv: fix fragment reassembly length accounting - batman-adv: dat: handle forward allocation error - batman-adv: clear current gateway during teardown - batman-adv: mcast: fix use-after-free in orig_node RCU release - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async - drm/amd/display: Validate GPIO pin LUT table size before iterating - drm/amd/display: Fix integer overflow in bios_get_image() - drm/bridge: megachips: remove bridge when irq request fails - drm/bridge: it66121: acquire reset GPIO in probe - drm/virtio: use uninterruptible resv lock for plane updates - device property: set fwnode->secondary to NULL in fwnode_init() - LoongArch: Remove unused code to avoid build warning - RDMA/siw: Reject MPA FPDU length underflow before signed receive math - spi: ti-qspi: fix use-after-free after DMA setup failure - spi: sprd: fix error pointer deref after DMA setup failure - scsi: isci: Fix use-after-free in device removal path - phy: tegra: xusb: Fix per-pad high-speed termination calibration - spi: qup: fix error pointer deref after DMA setup failure - drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe - KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits - arm64: probes: Handle probes on hinted conditional branch instructions - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() - ice: fix setting promisc mode while adding VID filter - ixgbevf: fix use-after-free in VEPA multicast source pruning - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 - wifi: ath11k: clear shared SRNG pointer state on restart - vsock/vmci: fix UAF when peer resets connection during handshake - ring-buffer: Fix reporting of missed events in iterator - qed: fix double free in qed_cxt_tables_alloc() - netfilter: ipset: stop hash:* range iteration at end - netfilter: nf_queue: hold bridge skb->dev while queued - netfilter: ip6t_hbh: reject oversized option lists - net: ifb: report ethtool stats over num_tx_queues - net: bcmgenet: keep RBUF EEE/PM disabled - phonet/pep: disable BH around forwarded sk_receive_skb() - Bluetooth: MGMT: validate Add Extended Advertising Data length - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths - Bluetooth: bnep: Fix UAF read of dev->name - Bluetooth: ISO: drop ISO_END frames received without prior ISO_START - net: wwan: iosm: fix potential memory leaks in ipc_imem_init() - drivers/base/memory: fix memory block reference leak in poison accounting - efi: Allocate runtime workqueue before ACPI init - ALSA: asihpi: Fix potential OOB array access at reading cache - ALSA: pcm: Don't setup bogus iov_iter for silencing - ALSA: ua101: Reject too-short USB descriptors - hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX - smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() - ksmbd: fix null pointer dereference in compare_guid_key() - mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break() - sysfs: don't remove existing directory on update failure - Revert "af_unix: Reject SIOCATMARK on non-stream sockets" - Revert "s390/cio: Update purge function to unregister the unused subchannels" - Revert "ice: Remove jumbo_remove step from TX path" - Revert "ice: fix double-free of tx_buf skb" - Revert "x86/vdso: Fix output operand size of RDPID" - wifi: mac80211: check tdls flag in ieee80211_tdls_oper - s390/debug: Reject zero-length input before trimming a newline - mptcp: pm: ADD_ADDR rtx: free sk if last - mptcp: sync the msk->sndbuf at accept() time - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close - netfilter: revalidate bridge ports - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp - net: bonding: fix NULL pointer dereference in bond_do_ioctl() - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() - udp: clear skb->dev before running a sockmap verdict - crypto: nx - Fix packed layout in struct nx842_crypto_header - crypto: nx - Use static_assert() to check struct sizes - batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown - Revert "ALSA: pcmtest: fix reference leak on failed device registration" - media: rc: ttusbir: fix inverted error logic - media: rc: igorplugusb: fix control request setup packet - batman-adv: tp_meter: fix tp_num leak on kmalloc failure - batman-adv: stop tp_meter sessions during mesh teardown - ALSA: seq: Fix UMP group 16 filtering - ALSA: seq: Notify client and port info changes - ALSA: core: Serialize deferred fasync state checks - ALSA: misc: Use guard() for spin locks - ALSA: hda: cs35l56: Propagate ASP TX source control errors - crypto: nx - Avoid -Wflex-array-member-not-at-end warning - ksmbd: reset rcount per connection in ksmbd_conn_wait_idle_sess_id() - media: rc: igorplugusb: heed coherency rules - ALSA: aoa: Skip devices with no codecs in i2sbus_resume() - media: rc: ttusbir: respect DMA coherency rules - ALSA: aoa: i2sbus: clear stale prepared state - ALSA: aoa: Use guard() for mutex locks - f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally - ksmbd: replace connection list with hash table - ksmbd: use msleep instaed of schedule_timeout_interruptible() - f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io() - smb: move some duplicate definitions to common/smbacl.h - iommu/amd: serialize sequence allocation under concurrent TLB invalidations - x86/shstk: Prevent deadlock during shstk sigreturn - ALSA: pcmtest: Fix resource leaks in module init error paths - ALSA: pcmtest: fix reference leak on failed device registration - ALSA: 6fire: Fix input volume change detection - ALSA: caiaq: Fix control_put() result and cache rollback - ALSA: core: Fix potential data race at fasync handling - Revert "ALSA: usb-audio: Cap the packet size pre-calculations" - ipv6: sit: reload inner IPv6 header after GSO offloads - net: guard timestamp cmsgs to real error queue skbs - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() - netfilter: x_tables: avoid leaking percpu counter pointers - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush - netfilter: require Ethernet MAC header before using eth_hdr() - netfilter: nft_fib: fix stale stack leak via the OIFNAME register - vsock/virtio: reset connection on receiving queue overflow - vsock/virtio: fix skb overhead accounting to preserve full buf_alloc - vsock/virtio: fix potential unbounded skb queue - mptcp: pm: ADD_ADDR rtx: always decrease sk refcount - mptcp: pm: ADD_ADDR rtx: allow ID 0 - ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers - srcu: Use irq_work to start GP in tiny SRCU - irqwork: Move data struct to a types header - types: move struct rcuwait into types.h - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets - wifi: iwlwifi: fix 22000 series SMEM parsing - wifi: iwlwifi: allow IWL_FW_CHECK() with just a string - x86: shadow stacks: proper error handling for mmap lock - net: mvpp2: sync RX data at the hardware packet offset - net: mvpp2: limit XDP frame size to the RX buffer - batman-adv: fix tp_meter counter underflow during shutdown - batman-adv: v: stop OGMv2 on disabled interface - ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger - spi: mpc52xx: fix controller deregistration - thunderbolt: Bound root directory content to block size - selinux: fix overlayfs mmap() and mprotect() access checks - lsm: add backing_file LSM hooks - fs: constify file ptr in backing_file accessor helpers - fs: prepare for adding LSM blob to backing_file - selftests/bpf: Add tests for ld_{abs,ind} failure path in subprogs - bpf: Fix ld_{abs,ind} failure path analysis in subprogs - KVM: x86: Fix shadow paging use-after-free due to unexpected role - Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref - Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() - fix kabi for ppp_defs.h - pppoe: drop PFC frames - netfilter: nat: use kfree_rcu to release ops - drm/i915/gem: Fix phys BO pread/pwrite with offset - selinux: allow multiple opens of /sys/fs/selinux/policy - ksmbd: make ksmbd thread names distinct by client IP - ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path - ALSA: caiaq: Don't abort when no input device is available - ALSA: caiaq: fix usb_dev refcount leak on probe failure - ALSA: caiaq: Handle probe errors properly - ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow - USB: cdc-acm: Fix bit overlap and move quirk definitions to header - ALSA: caiaq: take a reference on the USB device in create_card() - ALSA: usb-audio: apply quirk for MOONDROP JU Jiu - ksmbd: use check_add_overflow() to prevent u16 DACL size overflow - ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment - smb: server: fix max_connections off-by-one in tcp accept path - smb: server: fix active_num_conn leak on transport allocation failure - usb: port: add delay after usb_hub_set_port_power() - USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen - usb: storage: Expand range of matched versions for VL817 quirks entry - xfrm: Wait for RCU readers during policy netns exit - KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing - mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison - thunderbolt: Clamp XDomain response data copy to allocation size - bpf: return VMA snapshot from task_vma iterator - bpf: switch task_vma iterator from mmap_lock to per-VMA locks - bpf: fix mm lifecycle in open-coded task_vma iterator - netfilter: nft_ct: bail out on template ct in get eval - drm/amd/display: Bound VBIOS record-chain walk loops - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size - drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() - netfilter: conntrack_irc: fix possible out-of-bounds read - drm/vc4: fix krealloc() memory leak - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error - f2fs: fix data loss caused by incorrect use of nat_entry flag - bnxt_en: Fix NULL pointer dereference - ipv6: mcast: Fix use-after-free when processing MLD queries - ipvs: clear the svc scheduler ptr early on edit - netfilter: synproxy: add mutex to guard hook reference counting - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list - net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr - netlabel: validate unlabeled address and mask attribute lengths - netfilter: bridge: make ebt_snat ARP rewrite writable - tcp: restrict SO_ATTACH_FILTER to priv users - ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER - Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig - misc: fastrpc: fix DMA address corruption due to find_vma misuse - misc: fastrpc: Fix NULL pointer dereference in rpmsg callback - gpio: mvebu: fix NULL pointer dereference in suspend/resume - Bluetooth: fix memory leak in error path of hci_alloc_dev() - Bluetooth: bnep: reject short frames before parsing - Bluetooth: RFCOMM: validate skb length in MCC handlers - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams - RDMA/srp: bound SRP_RSP sense copy by the received length - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN - net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure - sched/psi: fix race between file release and pressure write - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase - rculist: add list_splice_rcu() for private lists - net: skbuff: fix missing zerocopy reference in pskb_carve helpers - ip6_vti: set netns_immutable on the fallback device. - wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() - wifi: rtw88: debugfs: support multiple adapters debugging - erofs: fix use-after-free on sbi->sync_decompress - net: openvswitch: fix possible kfree_skb of ERR_PTR - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() - md: wake raid456 reshape waiters before suspend - dm cache policy smq: check allocation under invalidate lock - Bluetooth: MGMT: validate advertising TLV before type checks - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend - USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL - USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam - USB: serial: option: add support for Rolling Wireless RW135R-GL - USB: serial: io_edgeport: add support for Blackbox IC135A - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr - netfilter: flowtable: strictly check for maximum number of actions - fuse: reject fuse_notify() pagecache ops on directories - fs/mbcache: cancel shrink work before destroying the cache - smb/client: fix possible infinite loop and oob read in symlink_data() - fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp - ata: libata-scsi: do not needlessly defer commands when using PMP with FBS - ata: libata-scsi: do not use the deferred QC feature on PMPs with CBS - ata: libata-scsi: do not use the deferred QC feature for ATA_DEFER_PORT - ata: libata-scsi: improve readability of ata_scsi_qc_issue() - ata: libata-scsi: fix requeue of deferred ATA PASS-THROUGH commands - ata: libata-eh: Fix detection of deferred qc timeouts - ata: libata: cancel pending work after clearing deferred_qc - ata: libata-core: fix cancellation of a port deferred qc work - ata: libata-scsi: rename and improve ata_qc_done() - ata: libata-scsi: simplify ata_scsi_requeue_deferred_qc() - ata: libata-sata: simplify ata_sas_queuecmd() - ata: libata-core: improve tag checks in ata_qc_issue() - ata: libata-eh: correctly handle deferred qc timeouts - ata: libata-scsi: avoid Non-NCQ command starvation - ata: libata: Introduce ata_port_eh_scheduled() - ext4: handle wraparound when searching for blocks for indirect mapped blocks - ext4: fix error pointer dereference in ext4_mb_load_buddy_gfp() - ext4: always allocate blocks only from groups inode can use - ext4: fix e4b bitmap inconsistency reports - ext4: convert bd_buddy_page to bd_buddy_folio - ext4: convert bd_bitmap_page to bd_bitmap_folio - Revert "ext4: fix e4b bitmap inconsistency reports" - ext4: cleanup for ext4_map_blocks - ext4: rename EXT4_GET_BLOCKS_PRE_IO - ext4: drop extent cache when splitting extent fails - ext4: drop extent cache after doing PARTIAL_VALID1 zeroout - ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O - ext4: correct the comments place for EXT4_EXT_MAY_ZEROOUT - ext4: get rid of ppath in ext4_ext_handle_unwritten_extents() - ext4: get rid of ppath in ext4_ext_convert_to_initialized() - ext4: get rid of ppath in ext4_split_convert_extents() - ext4: get rid of ppath in ext4_split_extent() - ext4: get rid of ppath in ext4_force_split_extent_at() - ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 - ext4: subdivide EXT4_EXT_DATA_VALID1 - Revert "ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O" - ext4: get rid of ppath in ext4_split_extent_at() - ext4: get rid of ppath in ext4_ext_insert_extent() - ext4: get rid of ppath in get_ext_path() - ext4: add new ext4_ext_path_brelse() helper - !24596 [sync]urma: fix workqueue use-after-free in ubagg_exit teardown sequence - urma: fix workqueue use-after-free in ubagg_exit teardown sequence - !24607 ub: udma: Optimize udma jetty id access logic. - ub: udma: Optimize udma jetty id access logic. - !24640 [sync]urma: limit ubcore logs in reuse paths - urma: fix workqueue use-after-free in ubagg_exit teardown sequence - !24669 mm/madvise: add MADV_FCMA_ENABLE to set PF_FOLIO_CMA via madvise - mm/madvise: add MADV_FCMA_ENABLE to set PF_FOLIO_CMA via madvise - !24702 [sync]urma: retry import jetty/jfr on EIO from tpid reuse failure - urma: retry import jetty/jfr on EIO from tpid reuse failure - urma: limit ubagg connect exchange logs * Fri Jul 10 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-145.3.18.151.20260710.aae66044906b - !24753 [sync]urma: drain jfe event lists in batches to avoid soft-lockup - urma: drain jfe event lists in batches to avoid soft-lockup - urma: reduce ubagg topo log noise - !24748 [sync]urma: free completion events outside jfe lock - urma: free jfe events outside lock - urma: free completion events outside jfe lock - !24742 urma: Fix the issue of inaccurate timing for some functions in DFX - !24741 [sync]urma: fix UAF of accessing token_id in log. - urma: Fix the issue of inaccurate timing for some functions in DFX - urma: fix UAF of accessing token_id in log. - !24734 [sync]urma: fix tpid_reuse attached to vtpn causes use_after_free - urma: fix tpid_reuse attached to vtpn causes use_after_free - !24804 [sync]urma: use vzalloc for ubmad tjetty and ini_rtbuffer - !24774 [sync]urma: ratelimit import jetty/jfr error logs - urma: use vzalloc for ubmad tjetty and ini_rtbuffer - !24792 [sync]urma: fix UAF of accessing jfs/jetty in log. - urma: fix UAF of accessing jfs/jetty in log. - urma: ratelimit import jetty/jfr error logs - !24845 [sync]ub/ubdevshm: Support for acquiring va is a sub-range of registered va - ub/ubdevshm: Support for acquiring va is a sub-range of registered va - !24802 [sync]urma: use xarray for ubagg/ubcore session lookup - urma: use xarray for ubagg/ubcore session lookup - !24814 [sync]urma: make ratelimit burst configurable for ubcore/uburma/ubagg - urma: make ratelimit burst configurable for ubcore/uburma/ubagg * Wed Jul 22 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-145.3.22.153.20260722.158daf1d8dea - !24942 [sync]urma: drop param_set_uint_minmax for ratelimit burst setters - urma: drop param_set_uint_minmax for ratelimit burst setters - !25840 sync CVE LTS and bugfix from OLK-6.6 d33ffc8f8580 to 334dfd575ba5 - cgroup/rstat: avoid disabling irqs for O(num_cpu) - netfilter: bridge: eb_tables: close module init race - crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents - netfilter: ebtables: move to two-stage removal scheme - crypto: qat - protect service table iterations with service_lock - Bluetooth: eir: Fix stack OOB write when prepending the Flags AD - drm/edid: fix OOB read in drm_parse_tiled_block() - proc: protect ptrace_may_access() with exec_update_lock (FD links) - vfio/pci: Latch disable_idle_d3 per device - bpf: Fix UAF in sock clone early bailouts - bpf: Disable xfrm_decode_session hook attachment - bpf,fork: wipe ->bpf_storage before bailouts that access it - KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() - crypto: qat - validate RSA CRT component lengths - bpf: Clear rb node linkage when freeing bpf_rb_root - bpf: Add validation for bpf_set_retval argument - bpf: Reject sleepable BPF_LSM_CGROUP programs at load time - bpf: Fix setting retval to -EPERM for cgroup hooks not returning errno - bpf: Guard __get_user acesss with access_ok for uprobe_multi data - i2c: core: fix adapter registration race - ALSA: hda/cs35l41: Fix firmware load work teardown - vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc - iommufd: Break the loop on failure in iommufd_fault_fops_read() - posix-cpu-timers: Prevent UAF caused by non-leader exec() race - iio: event: Fix event FIFO reset race - hwrng: virtio: clamp device-reported used.len at copy_data() - crypto: drbg - Fix returning success on failure in CTR_DRBG - crypto: ecc - Fix carry overflow in vli multiplication - crypto: pcrypt - restore callback for non-parallel fallback - net: openvswitch: reject oversized nested action attrs - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page - e1000e: Fix out-of-bounds MMIO access by validating BAR0 size - xsched: enforce permissions on attribute access - xsched: restrict vstream management to privileged users - rme: use DMA API for virtio in realm world - udf: validate sparing table length as an entry count, not a byte count - smb: client: harden POSIX SID length parsing - smb: client: mask server-provided mode to 07777 in modefromsid - smb: client: Fix next buffer leak in receive_encrypted_standard() - nvmet-auth: validate reply message payload bounds against transfer length - bpf: Reject fragmented frames in devmap - bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized - mm/huge_memory: update file PMD counter before folio_put() - sctp: fix uninit-value in __sctp_rcv_asconf_lookup() - smb: client: reject overlapping data areas in SMB2 responses - smb: client: restrict implied bcc[0] exemption to responses without data area - io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item - writeback: drop now-unnecessary rcu_barrier() in cgroup_writeback_umount() - writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() - writeback: Fix use after free in inode_switch_wbs_work_fn() - writeback: Avoid contention on wb->list_lock when switching inodes - block: skip sync_blockdev() on surprise removal in bdev_mark_dead() - mm: do file ownership checks with the proper mount idmap - tracing: Bound synthetic-field strings with seq_buf - perf/core: Detach event groups during remove_on_exec - bpf: Allow LPM map access from sleepable BPF programs - bpf: Consistently use bpf_rcu_lock_held() everywhere - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC - udf: validate VAT header length against the VAT inode size - isofs: bound Rock Ridge symlink components to the SL record - udf: validate free block extents against the partition length - config: arm64: update CONFIG_FTRACE_STARTUP_TEST not set - crypto: qat - Return pointer directly in adf_ctl_alloc_resources - crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() - drivers/base/memory: set mem->altmap after successful device registration - serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails - serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero - NFS: Prevent resource leak in nfs_alloc_server() - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr - nfsd: check get_user() return when reading princhashlen - fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode - fbdev: modedb: fix a possible UAF in fb_find_mode() - fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var - power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path - 9p: avoid putting oldfid in p9_client_walk() error path - ocfs2: reject oversized group bitmap descriptors - rpmsg: char: Fix use-after-free on probe error path - fpga: region: fix use-after-free in child_regions_with_firmware() - irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove - pNFS: Fix use-after-free in pnfs_update_layout() - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done - hdlc_ppp: sync per-proto timers before freeing hdlc state - gfs2: fix use-after-free in gfs2_qd_dealloc - exfat: fix potential use-after-free in exfat_find_dir_entry() - bpf: use kvfree() for replaced sysctl write buffer - f2fs: keep atomic write retry from zeroing original data - f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node() - f2fs: validate ACL entry sizes in f2fs_acl_from_disk() - f2fs: fix to round down start offset of fallocate for pin file - f2fs: validate compress cache inode only when enabled - wifi: iwlwifi: mvm: fix race condition in PTP removal - wifi: rtw88: usb: fix memory leaks on USB write failures - wifi: rtw88: increase TX report timeout to fix race condition - wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor - wifi: ath11k: fix warning when unbinding - wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S - keys: Pin request_key_auth payload in instantiate paths - KEYS: fix overflow in keyctl_pkey_params_get_2() - err.h: use __always_inline on all error pointer helpers - fbdev: fix use-after-free in store_modes() - NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR - apparmor: mediate the implicit connect of TCP fast open sendmsg - net: skmsg: preserve sg.copy across SG transforms - mac802154: llsec: add skb_cow_data() before in-place crypto - af_unix: Set gc_in_progress to true in unix_gc(). - ntfs3: reject direct userspace writes to reserved $LX* xattrs - ipv4: account for fraggap on the paged allocation path - inet: add indirect call wrapper for getfrag() calls - ipv6: account for fraggap on the paged allocation path - batman-adv: tvlv: avoid race of cifsnotfound handler state - batman-adv: tvlv: enforce 2-byte alignment - batman-adv: dat: prevent false sharing between VLANs - batman-adv: tt: track roam count per VID - batman-adv: tt: don't merge change entries with different VIDs - batman-adv: tp_meter: handle overlapping packets - batman-adv: tp_meter: prevent parallel modifications of last_recv - batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE - batman-adv: tp_meter: restrict number of unacked list entries - batman-adv: v: prevent OGM aggregation on disabled hardif - batman-adv: frag: avoid underflow of TTL - batman-adv: frag: ensure fragment is writable before modifying TTL - batman-adv: fix (m|b)cast csum after decrementing TTL - batman-adv: ensure bcast is writable before modifying TTL - batman-adv: tp_meter: initialize last_recv_time during init - batman-adv: prevent ELP transmission interval underflow - batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE - batman-adv: tp_meter: add only finished tp_vars to lists - batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection - batman-adv: tp_meter: fix fast recovery precondition - batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd - batman-adv: tp_meter: avoid window underflow - batman-adv: tp_meter: initialize dec_cwnd explicitly - batman-adv: tp_meter: initialize dup_acks explicitly - batman-adv: tp_meter: keep unacked list in ascending ordered - eventpoll: rename ep_remove_safe() back to ep_remove() - file: add fput() cleanup helper - media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si - ksmbd: reject non-VALID session in compound request branch - scripts/sorttable: Fix endianness handling in build-time mcount sort - scripts/sorttable: Allow matches to functions before function entry - scripts/sorttable: Use normal sort if theres no relocs in the mcount section - ftrace: Check against is_kernel_text() instead of kaslr_offset() - ftrace: Test mcount_loc addr before calling ftrace_call_addr() - ftrace: Do not over-allocate ftrace memory - ftrace: Have ftrace pages output reflect freed pages - ftrace: Update the mcount_loc check of skipped entries - scripts/sorttable: Zero out weak functions in mcount_loc table - scripts/sorttable: Always use an array for the mcount_loc sorting - scripts/sorttable: Have mcount rela sort use direct values - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 - scripts/sorttable: Use a structure of function pointers for elf helpers - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly - scripts/sorttable: Move code from sorttable.h into sorttable.c - scripts/sorttable: Use uint64_t for mcount sorting - scripts/sorttable: Add helper functions for Elf_Sym - scripts/sorttable: Add helper functions for Elf_Shdr - scripts/sorttable: Add helper functions for Elf_Ehdr - scripts/sorttable: Convert Elf_Sym MACRO over to a union - scripts/sorttable: Replace Elf_Shdr Macro with a union - scripts/sorttable: Convert Elf_Ehdr to union - scripts/sorttable: Make compare_extable() into two functions - scripts/sorttable: Have the ORC code use the _r() functions to read - scripts/sorttable: Remove unneeded Elf_Rel - scripts/sorttable: Remove unused write functions - scripts/sorttable: Remove unused macro defines - fuse: re-lock request before replacing page cache folio - slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD - slimbus: qcom-ngd-ctrl: Fix up platform_driver registration - rxrpc: Fix the ACK parser to extract the SACK table for parsing - net: phonet: free phonet_device after RCU grace period - phonet: Pass net and ifindex to phonet_address_notify(). - phonet: Pass ifindex to fill_addr(). - Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs - hv: utils: handle and propagate errors in kvp_register - regulator: core: fix locking in regulator_resolve_supply() error path - ring-buffer: Remove ring_buffer_read_prepare_sync() - selftests/bpf: Update comments find_equal_scalars->sync_linked_regs - af_unix: Reject SIOCATMARK on non-stream sockets - selftests/bpf: Add test to ensure kprobe_multi is not sleepable - agp/amd64: Fix broken error propagation in agp_amd64_probe() - net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() - i2c: stub: Reject I2C block transfers with invalid length - RDMA/bnxt_re: zero shared page before exposing to userspace - KVM: VMX: Update SVI during runtime APICv activation - ARM: fix branch predictor hardening - ARM: fix hash_name() fault - ARM: allow __do_kernel_fault() to report execution of memory faults - ARM: group is_permission_fault() with is_translation_fault() - debugobjects: Dont call fill_pool() in early boot hardirq context - debugobjects: Do not fill_pool() if pi_blocked_on - debugobjects: Use LD_WAIT_CONFIG instead of LD_WAIT_SLEEP - debugobjects: Allow to refill the pool before SYSTEM_SCHEDULING - batman-adv: tt: prevent TVLV entry number overflow - drm/v3d: Skip CSD when it has zeroed workgroups - drm/v3d: Store the active job inside the queue's state - iov_iter: Fix potential underflow in iov_iter_extract_xarray_pages() - urma: add check type in free driver obj - smb: client: fix double-free in SMB2_close() replay - smb: client: fix double-free in SMB2_flush() replay - smb: client: fix query_info() replay double-free - smb: client: fix query directory replay double-free - smb: client: fix double-free in SMB2_open() replay - smb: client: fix double-free in SMB2_ioctl() replay - smb: client: fix change notify replay double-free - HID: lg-g15: cancel pending work on remove to fix a use-after-free - HID: multitouch: fix out-of-bounds bit access on mt_io_flags - tracing: Prevent out-of-bounds read in glob matching - sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT - !25616 sync CVE LTS and bugfix from OLK-6.6 b72db20c0437 to d33ffc8f8580 - KVM: x86: hyper-v: Bound the bank index when querying sparse banks - MIPS: DEC: Prevent initial console buffer from landing in XKPHYS - ksmbd: fix durable reconnect error path file lifetime - ksmbd: fix use-after-free in smb2_open during durable reconnect - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query - USB: iowarrior: fix use-after-free on disconnect race - usb: iowarrior: remove inherent race with minor number - USB: iowarrior: fix use-after-free on disconnect - apparmor: fix use-after-free in rawdata dedup loop - tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR - bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops - rbd: eliminate a race in lock_dwork draining on unmap - blk-cgroup: fix UAF in __blkcg_rstat_flush() - net: Fix kabi breakage of struct tc_action - net/sched: act_api: use RCU with deferred freeing for action lifecycle - net: Fix kabi breakage of struct header_ops - bonding: prevent potential infinite loop in bond_header_parse() - bonding: fix type confusion in bond_setup_by_slave() - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc - ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL - ASoC: cs35l56: Fix missing calls to wm_adsp2_remove() - time: Fix off-by-one in compat settimeofday() usec validation - scsi: target: Fix hexadecimal CHAP_I handling - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink - ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY - ksmbd: add a permission check for FSCTL_SET_ZERO_DATA - ksmbd: add per-handle permission check to FILE_LINK_INFORMATION - mptcp: fix missing wakeups in edge scenarios - mptcp: add-addr: always drop other suboptions - ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 - RDMA/umem: fix kernel-doc warnings - mm/migrate: don't call folio_putback_active_hugetlb() on dst hugetlb folio - usb: typec: ucsi: Don't update power_supply on power role change if not connected - serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() - thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() - usb: typec: ucsi: Check if power role change actually happened before handling - usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind - usb: dwc3: xilinx: fix error handling in zynqmp init error paths - usb: musb: omap2430: Fix use-after-free in omap2430_probe() - tty: serial: samsung: Remove redundant port lock acquisition in rx helpers - tty: serial: samsung: use u32 for register interactions - serial: samsung_tty: Use port lock wrappers - ALSA: firewire-motu: Protect register DSP event queue positions - memfd: deny writeable mappings when implying SEAL_WRITE - iio: dac: ad5686: fix ref bit initialization for single-channel parts - usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure - iio: chemical: scd30: fix division by zero in write_raw - iio: chemical: scd30: Use guard(mutex) to allow early returns - iio: gyro: adis16260: fix division by zero in write_raw - Bluetooth: hci_qca: Convert timeout from jiffies to ms - Bluetooth: hci_qca: Migrate to serdev specific shutdown function - serdev: Provide a bustype shutdown function - serdev: make serdev_bus_type const - mm/damon/sysfs-schemes: delete tried region in regions_rmdirs() - mptcp: do not drop partial packets - mptcp: introduce the mptcp_init_skb helper - iio: adc: npcm: fix unbalanced clk_disable_unprepare() - iio: adc: npcm: Convert to platform remove callback returning void - octeontx2-pf: avoid double free of pool->stack on AQ init failure - af_unix: Fix UAF read of tail->len in unix_stream_data_wait() - af_unix: Cache state->msg in unix_stream_read_generic(). - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg - net: hsr: defer node table free until after RCU readers - mptcp: pm: fix ADD_ADDR timer infinite retry on option space insufficient - ice: fix VF queue configuration with low MTU values - mptcp: reset rcv wnd on disconnect - mptcp: cleanup fallback dummy mapping generation - octeontx2-af: CGX: add bounds check to cgx_speed_mbps index - octeontx2-af: replace deprecated strncpy with strscpy - cgroup/cpuset: Reset DL migration state on can_attach() failure - fbdev/vt8500lcdfb: Initialize fb_ops with fbdev macros - soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get() - driver core: reject devices with unregistered buses - drm/amd/display: Use krealloc_array() in dal_vector_reserve() - drm/amdgpu: restart the CS if some parts of the VM are still invalidated - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 - drm/amdkfd: fix NULL dereference in get_queue_ids() - slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock - slimbus: qcom-ngd-ctrl: fix OF node refcount - thunderbolt: Limit XDomain response copy to actual frame size - sctp: stream: fully roll back denied add-stream state - mmc: sdhci: add signal voltage switch in sdhci_resume_host - mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC - mmc: litex_mmc: Set mandatory idle clocks before CMD0 - mmc: core: Fix host controller programming for fixed driver type - mm/hugetlb: restore reservation on error in hugetlb folio copy paths - octeontx2-af: fix memory leak in rvu_setup_hw_resources() - nvmem: layouts: onie-tlv: fix hang on unknown types - net: rds: clear i_sends on setup unwind - net: mv643xx: fix OF node refcount - net/mlx5: Reorder completion before putting command entry in cmd_work_handler - misc: fastrpc: fix use-after-free race in fastrpc_map_create - misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context - Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard - i2c: tegra: Fix NOIRQ suspend/resume - i2c: stm32f7: fix timing computation ignoring i2c-analog-filter - i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() - pidfd: refuse access to tasks that have started exiting harder - ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write - vsock/vmci: fix sk_ack_backlog leak on failed handshake - wifi: nl80211: reject oversized EMA RNR lists - selftests: mptcp: add test for extra_subflows underflow on userspace PM - mptcp: sockopt: check timestamping ret value - mptcp: allow subflow rcv wnd to shrink - mptcp: close TOCTOU race while computing rcv_wnd - mptcp: fix retransmission loop when csum is enabled - ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow - ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O - ARM: socfpga: Fix OF node refcount leak in SMP setup - mm/damon/ops-common: call folio_test_lru() after folio_get() - drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info() - ALSA: timer: Fix UAF at snd_timer_user_params() - USB: serial: option: add usb-id for Dell Wireless DW5826e-m - xfrm: espintcp: do not reuse an in-progress partial send - ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL - mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation - tracing/probes: Point the error offset correctly for eprobe argument error - netfilter: nft_tunnel: fix use-after-free on object destroy - clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time - net: mvpp2: build skb from XDP-adjusted data on XDP_PASS - net: mvpp2: refill RX buffers before XDP or skb use - net: mvpp2: Add metadata support for xdp mode - netfilter: nf_log: validate MAC header was set before dumping it - rds: mark snapshot pages dirty in rds_info_getsockopt() - net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion - r8152: handle the return value of usb_reset_device() - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove - net: phy: clean the sfp upstream if phy probing fails - net/mlx4: avoid GCC 10 __bad_copy_from() false positive - ASoC: wm_adsp: Fix NULL dereference when removing firmware controls - arm64: tlb: Allow XZR argument to TLBI ops - KVM: arm64: Remove VPIPT I-cache handling - tools/rv: Fix cleanup after failed trace setup - time: Fix off-by-one in settimeofday() usec validation - ipmi: Fix rcu_read_unlock to srcu_read_unlock in handle_read_event_rsp - ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() - vxlan: vnifilter: fix spurious notification on VNI update - vxlan: vnifilter: send notification on VNI add - octeontx2-af: npc: Fix CPT channel mask in npc_install_flow - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown - ptp: vclock: Switch from RCU to SRCU - net: fec: fix pinctrl default state restore order on resume - net: lan743x: permit VLAN-tagged packets up to configured MTU - net: garp: fix unsigned integer underflow in garp_pdu_parse_attr - hsr: Remove WARN_ONCE() in hsr_addr_is_self(). - net: Annotate sk->sk_write_space() for UDP SOCKMAP. - pcnet32: stop holding device spin lock during napi_complete_done - drm/imx: Fix three kernel-doc warnings in dcss-scaler.c - 6lowpan: fix off-by-one in multicast context address compression - netfilter: xt_NFQUEUE: prefer raw_smp_processor_id - tee: optee: prevent use-after-free when the client exits before the supplicant - net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS - Disable -Wattribute-alias for clang-23 and newer - RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug - USB: serial: mct_u232: fix memory corruption with small endpoint - usb: core: Fix SuperSpeed root hub wMaxPacketSize - serial: zs: Convert to use a platform device - serial: dz: Convert to use a platform device - serial: dz: Fix bootconsole handover lockup - xhci: tegra: Fix ghost USB device on dual-role port unplug - USB: serial: digi_acceleport: fix memory corruption with small endpoints - landlock: Fix handling of disconnected directories - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync - USB: serial: cypress_m8: fix memory corruption with small endpoint - serial: zs: Switch to using channel reset - serial: zs: Fix bootconsole handover lockup - serial: dz: Fix bootconsole message clobbering at chip reset - drm/amdkfd: Check for pdd drm file first in CRIU restore path - drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger - drm/amdkfd: fix NULL pointer bug in svm_range_set_attr - serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma - serial: zs: Fix swapped RI/DSR modem line transition counting - serial: sh-sci: fix memory region release in error path - serial: qcom-geni: fix UART_RX_PAR_EN bit position - serial: altera_jtaguart: handle uart_add_one_port() failures - drm/amd/pm/si: Disregard vblank time when no displays are connected - drm/i915: Fix potential UAF in TTM object purge - drm/hyperv: validate VMBus packet size in receive callback - drm/hyperv: validate resolution_count and fix WIN8 fallback - scsi: target: iscsi: Validate CHAP_R length before base64 decode - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 - scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker - thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow - thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() - usb: gadget: f_fs: copy only received bytes on short ep0 read - usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports - usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling - usb: gadget: f_hid: fix device reference leak in hidg_alloc() - usb: gadget: net2280: Fix double free in probe error path - USB: serial: mct_u232: fix missing interrupt-in transfer sanity check - USB: serial: mxuport: fix memory corruption with small endpoint - USB: serial: keyspan: fix missing indat transfer sanity check - USB: serial: cypress_m8: validate interrupt packet headers - USB: serial: belkin_sa: validate interrupt status length - USB: serial: option: add MeiG SRM813Q - usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize - usb: usbtmc: check URB actual_length for interrupt-IN notifications - usbip: vudc: Fix use after free bug in vudc_remove due to race condition - usb: storage: Add quirks for PNY Elite Portable SSD - USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers - usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval - usb: chipidea: core: convert ci_role_switch to local variable - tty: serial: pch_uart: add check for dma_alloc_coherent() - counter: Fix refcount leak in counter_alloc() error path - comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() - comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() - Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 - Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem - Input: xpad - add support for ASUS ROG RAIKIRI II - Input: xpad - add "Nova 2 Lite" from GameSir - ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks - ASoC: qcom: q6asm-dai: close stream only when running - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check - xfrm: ah: use skb_to_full_sk in async output callbacks - xfrm: route MIGRATE notifications to caller's netns - nfc: hci: fix out-of-bounds read in HCP header parsing - iommu, debugobjects: avoid gcc-16.1 section mismatch warnings - HID: wacom: Fix OOB write in wacom_hid_set_device_mode() - ip6: vti: Use ip6_tnl.net in vti6_changelink(). - xfrm: input: hold netns during deferred transport reinjection - ipv6: validate extension header length before copying to cmsg - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). - ipv6: exthdrs: refresh nh after handling HAO option - ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() - macsec: fix replay protection at XPN lower-PN wrap - bpf: sockmap: fix tail fragment offset in bpf_msg_push_data - Input: elan_i2c - validate firmware size before use - usb: dwc2: Fix use after free in debug code - usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles - usb: cdns3: gadget: fix request skipping after clearing halt - USB: serial: omninet: fix memory corruption with small endpoint - iio: buffer: hw-consumer: fix use-after-free in error path - iio: light: cm3323: fix reg_conf not being initialized correctly - iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL - iio: temperature: tsys01: fix broken PROM checksum validation - iio: ssp_sensors: cancel delayed work_refresh on remove - iio: gyro: itg3200: fix i2c read into the wrong stack location - iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw - iio: dac: ad5686: acquire lock when doing powerdown control - iio: dac: ad5686: fix input raw value check - iio: dac: max5821: fix return value check in powerdown sync - iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux - wireguard: send: append trailer after expanding head - KVM: arm64: PMU: Preserve AArch32 counter low bits - parport: Fix race between port and client registration - Input: xpad - fix out-of-bounds access for Share button - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock - Bluetooth: ISO: fix UAF in iso_recv_frame - Bluetooth: HIDP: fix missing length checks in hidp_input_report() - auxdisplay: line-display: fix OOB read on zero-length message_store() - hpfs: fix a crash if hpfs_map_dnode_bitmap fails - Bluetooth: btusb: Allow firmware re-download when version matches - HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse - Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() - USB: serial: safe_serial: fix memory corruption with small endpoint - usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT - usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() - usb: typec: altmodes/displayport: validate count before reading Status Update VDO - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO - usb: typec: ucsi: ccg: reject firmware images without a ':' record header - iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer - soc/tegra: pmc: Fix unsafe generic_handle_irq() call - hwmon: (pmbus/adm1266) serialize NVMEM blackbox read with pmbus_lock - hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock - of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() - phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X - drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used - drm/dp: Add eDP 1.5 bit definition - drm/i915/psr: Read Intel DPCD workaround register - drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register - media: rc: fix race between unregister and urb/irq callbacks - batman-adv: bla: avoid double decrement of bla.num_requests - batman-adv: tt: avoid empty VLAN responses - batman-adv: tt: fix TOCTOU race for reported vlans - batman-adv: tp_meter: directly shut down timer on cleanup - batman-adv: tp_meter: avoid role confusion in tp_list - batman-adv: iv: recover OGM scheduling after forward packet error - batman-adv: tvlv: reject oversized TVLV packets - batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface - batman-adv: tt: reject oversized local TVLV buffers - batman-adv: tvlv: abort OGM send on tvlv append failure - net: skbuff: fix pskb_carve leaking zcopy pages - ipv6: fix possible infinite loop in fib6_select_path() - ipv6: fix possible infinite loop in rt6_fill_node() - sctp: fix race between sctp_wait_for_connect and peeloff - net: mana: Add NULL guards in teardown path to prevent panic on attach failure - gpio: rockchip: convert bank->clk to devm_clk_get_enabled() - Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() - ethtool: eeprom: add more safeties to EEPROM Netlink fallback - ethtool: eeprom: add missing ethnl_ops_begin() / _complete() during fallback - bonding: refuse to enslave CAN devices - Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() - ASoC: codecs: simple-mux: Fix enum control bounds check - ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() - gpio: mxc: fix irq_high handling - net: hsr: fix potential OOB access in supervision frame handling - ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues - net/iucv: fix locking in .getsockopt - net/smc: Do not re-initialize smc hashtables - net: netlink: don't set nsid on local notifications - net: netlink: fix sending unassigned nsid after assigned one - vsock: keep poll shutdown state consistent - netfilter: nf_tables: fix dst corruption in same register operation - netfilter: bitwise: add support for doing AND, OR and XOR directly - netfilter: bitwise: rename some boolean operation functions - netfilter: ebtables: fix OOB read in compat_mtw_from_user - netfilter: xt_cpu: prefer raw_smp_processor_id - netfilter: synproxy: refresh tcphdr after skb_ensure_writable - xfrm: Check for underflow in xfrm_state_mtu - nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() - nfc: llcp: Fix use-after-free in llcp_sock_release() - net: cpsw_new: Fix potential unregister of netdev that has not been registered yet - drm: Remove plane hsub/vsub alignment requirement for core helpers - net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net: mctp: ensure our nlmsg responses are initialised - Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size - MIPS: smp: report dying CPU to RCU in stop_this_cpu() - LoongArch: Report dying CPU to RCU in stop_this_cpu() - irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT - tls: Flush backlog before waiting for a new record - net: ethernet: cortina: No mapping is a dropped rx - batman-adv: fix batadv_skb_is_frag() kernel-doc - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled - Bluetooth: ISO: fix malformed ISO_END/CONT handling - Bluetooth: MGMT: Fix backward compatibility with userspace - security/keys: fix missed RCU read section on lookup - LoongArch: kprobes: Fix handling of fatal unrecoverable recursions - pds_core: ensure null-termination for firmware version strings - pds_core: add an error code check in pdsc_dl_info_get - net: mana: validate rx_req_idx to prevent out-of-bounds array access - ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove() - gpio: cdev: check if uAPI v2 config attributes are correctly zeroed - gpiolib: cdev: use !mem_is_zero() instead of memchr_inv(s, 0, n) - string: add mem_is_zero() helper to check if memory area is all zeros - bpf, skmsg: fix verdict sk_data_ready racing with ktls rx - net: ag71xx: check error for platform_get_irq - Bluetooth: btmtk: rename btmediatek_data - Bluetooth: btusb: mediatek: refactor the function btusb_mtk_reset - Bluetooth: btmtk: add the function to get the fw name - ALSA: seq: Serialize UMP output teardown with event_input - ALSA: seq: ump: Use guard() for locking - pds_core: fix debugfs_lookup dentry leak and error handling - pds_core: fix error handling in pdsc_devcmd_wait - bridge: mcast: Fix a possible use-after-free when removing a bridge port - net: bridge: Flush multicast groups when snooping is disabled - RDMA/rtrs: Fix use-after-free in path file creation cleanup - platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL - platform/x86: intel-hid: Check ACPI_HANDLE() against NULL - platform/x86: hp_accel: Check ACPI_COMPANION() against NULL - platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer - net: dsa: mt7530: preserve VLAN tags on trapped link-local frames - net: dsa: mt7530: rename mt753x_bpdu_port_fw enum to mt753x_to_cpu_fw - net: dsa: mt7530: fix FDB entries not aging out with short timeout - wifi: ath11k: fix peer resolution on rx path when peer_id=0 - drm/msm/snapshot: fix dumping of the unaligned regions - spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache() - net/mlx5: Do not restore destination-less TC rules - tls: Preserve sk_err across recvmsg() when data has been copied - x86/xen: Fix xen_e820_swap_entry_with_ram() - net: phy: DP83TC811: add reading of abilities - net: phy: c45: add genphy_c45_pma_read_ext_abilities() function - net: tls: prevent chain-after-chain in plain text SG - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot - powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise() - drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN - drm/msm/dsi: don't dump registers past the mapped region - ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics - net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint - accel/qaic: Add overflow check to remap_pfn_range during mmap - HID: quirks: really enable the intended work around for appledisplay - wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm() - wifi: ath11k: fix error path leaks in some WMI WOW calls - net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS reference - net: ethernet: cortina: Carry over frag counter - net: ethernet: cortina: Drop half-assembled SKB - net: ethernet: cortina: Make RX SKB per-port - netfs: Fix overrun check in netfs_extract_user_iter() - zonefs: handle integer overflow in zonefs_fname_to_fno - irqchip/ath79-cpu: Remove unused function - phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access - net: lan966x: avoid unregistering netdev on register failure - ice: fix locking in ice_dcb_rebuild() - tcp: Fix imbalanced icsk_accept_queue count. - test_kprobes: clear kprobes between test runs - kprobes: skip non-symbol addresses in kprobe_add_ksym_blacklist() - netfilter: x_tables: unregister the templates first - ALSA: hda: cs35l56: Put ACPI device after setting companion - ARM: integrator: Fix early initialization - pinctrl: qcom: Fix wakeirq map by removing disconnected irqs for sm8150 - kunit: config: KUNIT_DEBUGFS should depend on DEBUG_FS - kunit: config: Enable KUNIT_DEBUGFS by default - firmware: arm_ffa: Skip free_pages on RX buffer alloc failure - firmware: arm_ffa: Check for NULL FF-A ID table while driver registration - HID: uclogic: Fix regression of input name assignment - hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors - hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe() - hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe() - hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in get_multiple - hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR - hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer - hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer - hwmon: (pmbus/adm1266) reject implausible blackbox record_count - hwmon: (pmbus/adm1266) seed timestamp from the real-time clock - batman-adv: tt: fix negative tt_buff_len - batman-adv: tt: fix negative last_changeset_len - batman-adv: tp_meter: fix race condition in send error reporting - batman-adv: tp_meter: avoid use of uninit sender vars - batman-adv: bla: fix report_work leak on backbone_gw purge - batman-adv: frag: disallow unicast fragment in fragment - batman-adv: fix fragment reassembly length accounting - batman-adv: dat: handle forward allocation error - batman-adv: clear current gateway during teardown - batman-adv: mcast: fix use-after-free in orig_node RCU release - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async - drm/amd/display: Validate GPIO pin LUT table size before iterating - drm/amd/display: Fix integer overflow in bios_get_image() - drm/bridge: megachips: remove bridge when irq request fails - drm/bridge: it66121: acquire reset GPIO in probe - drm/virtio: use uninterruptible resv lock for plane updates - device property: set fwnode->secondary to NULL in fwnode_init() - LoongArch: Remove unused code to avoid build warning - RDMA/siw: Reject MPA FPDU length underflow before signed receive math - spi: ti-qspi: fix use-after-free after DMA setup failure - spi: sprd: fix error pointer deref after DMA setup failure - scsi: isci: Fix use-after-free in device removal path - phy: tegra: xusb: Fix per-pad high-speed termination calibration - spi: qup: fix error pointer deref after DMA setup failure - drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe - KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits - arm64: probes: Handle probes on hinted conditional branch instructions - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() - ice: fix setting promisc mode while adding VID filter - ixgbevf: fix use-after-free in VEPA multicast source pruning - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 - wifi: ath11k: clear shared SRNG pointer state on restart - vsock/vmci: fix UAF when peer resets connection during handshake - ring-buffer: Fix reporting of missed events in iterator - qed: fix double free in qed_cxt_tables_alloc() - netfilter: ipset: stop hash:* range iteration at end - netfilter: nf_queue: hold bridge skb->dev while queued - netfilter: ip6t_hbh: reject oversized option lists - net: ifb: report ethtool stats over num_tx_queues - net: bcmgenet: keep RBUF EEE/PM disabled - phonet/pep: disable BH around forwarded sk_receive_skb() - Bluetooth: MGMT: validate Add Extended Advertising Data length - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths - Bluetooth: bnep: Fix UAF read of dev->name - Bluetooth: ISO: drop ISO_END frames received without prior ISO_START - net: wwan: iosm: fix potential memory leaks in ipc_imem_init() - drivers/base/memory: fix memory block reference leak in poison accounting - efi: Allocate runtime workqueue before ACPI init - ALSA: asihpi: Fix potential OOB array access at reading cache - ALSA: pcm: Don't setup bogus iov_iter for silencing - ALSA: ua101: Reject too-short USB descriptors - hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX - smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() - ksmbd: fix null pointer dereference in compare_guid_key() - mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break() - sysfs: don't remove existing directory on update failure - Revert "af_unix: Reject SIOCATMARK on non-stream sockets" - Revert "s390/cio: Update purge function to unregister the unused subchannels" - Revert "ice: Remove jumbo_remove step from TX path" - Revert "ice: fix double-free of tx_buf skb" - Revert "x86/vdso: Fix output operand size of RDPID" - wifi: mac80211: check tdls flag in ieee80211_tdls_oper - s390/debug: Reject zero-length input before trimming a newline - mptcp: pm: ADD_ADDR rtx: free sk if last - mptcp: sync the msk->sndbuf at accept() time - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close - netfilter: revalidate bridge ports - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp - net: bonding: fix NULL pointer dereference in bond_do_ioctl() - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() - udp: clear skb->dev before running a sockmap verdict - crypto: nx - Fix packed layout in struct nx842_crypto_header - crypto: nx - Use static_assert() to check struct sizes - batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown - Revert "ALSA: pcmtest: fix reference leak on failed device registration" - media: rc: ttusbir: fix inverted error logic - media: rc: igorplugusb: fix control request setup packet - batman-adv: tp_meter: fix tp_num leak on kmalloc failure - batman-adv: stop tp_meter sessions during mesh teardown - ALSA: seq: Fix UMP group 16 filtering - ALSA: seq: Notify client and port info changes - ALSA: core: Serialize deferred fasync state checks - ALSA: misc: Use guard() for spin locks - ALSA: hda: cs35l56: Propagate ASP TX source control errors - crypto: nx - Avoid -Wflex-array-member-not-at-end warning - ksmbd: reset rcount per connection in ksmbd_conn_wait_idle_sess_id() - media: rc: igorplugusb: heed coherency rules - ALSA: aoa: Skip devices with no codecs in i2sbus_resume() - media: rc: ttusbir: respect DMA coherency rules - ALSA: aoa: i2sbus: clear stale prepared state - ALSA: aoa: Use guard() for mutex locks - f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally - ksmbd: replace connection list with hash table - ksmbd: use msleep instaed of schedule_timeout_interruptible() - f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io() - smb: move some duplicate definitions to common/smbacl.h - iommu/amd: serialize sequence allocation under concurrent TLB invalidations - x86/shstk: Prevent deadlock during shstk sigreturn - ALSA: pcmtest: Fix resource leaks in module init error paths - ALSA: pcmtest: fix reference leak on failed device registration - ALSA: 6fire: Fix input volume change detection - ALSA: caiaq: Fix control_put() result and cache rollback - ALSA: core: Fix potential data race at fasync handling - Revert "ALSA: usb-audio: Cap the packet size pre-calculations" - ipv6: sit: reload inner IPv6 header after GSO offloads - net: guard timestamp cmsgs to real error queue skbs - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() - netfilter: x_tables: avoid leaking percpu counter pointers - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush - netfilter: require Ethernet MAC header before using eth_hdr() - netfilter: nft_fib: fix stale stack leak via the OIFNAME register - vsock/virtio: reset connection on receiving queue overflow - vsock/virtio: fix skb overhead accounting to preserve full buf_alloc - vsock/virtio: fix potential unbounded skb queue - mptcp: pm: ADD_ADDR rtx: always decrease sk refcount - mptcp: pm: ADD_ADDR rtx: allow ID 0 - ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers - srcu: Use irq_work to start GP in tiny SRCU - irqwork: Move data struct to a types header - types: move struct rcuwait into types.h - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets - wifi: iwlwifi: fix 22000 series SMEM parsing - wifi: iwlwifi: allow IWL_FW_CHECK() with just a string - x86: shadow stacks: proper error handling for mmap lock - net: mvpp2: sync RX data at the hardware packet offset - net: mvpp2: limit XDP frame size to the RX buffer - batman-adv: fix tp_meter counter underflow during shutdown - batman-adv: v: stop OGMv2 on disabled interface - ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger - spi: mpc52xx: fix controller deregistration - thunderbolt: Bound root directory content to block size - selinux: fix overlayfs mmap() and mprotect() access checks - lsm: add backing_file LSM hooks - fs: constify file ptr in backing_file accessor helpers - fs: prepare for adding LSM blob to backing_file - selftests/bpf: Add tests for ld_{abs,ind} failure path in subprogs - bpf: Fix ld_{abs,ind} failure path analysis in subprogs - KVM: x86: Fix shadow paging use-after-free due to unexpected role - Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref - Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() - fix kabi for ppp_defs.h - pppoe: drop PFC frames - netfilter: nat: use kfree_rcu to release ops - drm/i915/gem: Fix phys BO pread/pwrite with offset - selinux: allow multiple opens of /sys/fs/selinux/policy - ksmbd: make ksmbd thread names distinct by client IP - ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path - ALSA: caiaq: Don't abort when no input device is available - ALSA: caiaq: fix usb_dev refcount leak on probe failure - ALSA: caiaq: Handle probe errors properly - ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow - USB: cdc-acm: Fix bit overlap and move quirk definitions to header - ALSA: caiaq: take a reference on the USB device in create_card() - ALSA: usb-audio: apply quirk for MOONDROP JU Jiu - ksmbd: use check_add_overflow() to prevent u16 DACL size overflow - ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment - smb: server: fix max_connections off-by-one in tcp accept path - smb: server: fix active_num_conn leak on transport allocation failure - usb: port: add delay after usb_hub_set_port_power() - USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen - usb: storage: Expand range of matched versions for VL817 quirks entry - xfrm: Wait for RCU readers during policy netns exit - KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing - mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison - thunderbolt: Clamp XDomain response data copy to allocation size - bpf: return VMA snapshot from task_vma iterator - bpf: switch task_vma iterator from mmap_lock to per-VMA locks - bpf: fix mm lifecycle in open-coded task_vma iterator - netfilter: nft_ct: bail out on template ct in get eval - drm/amd/display: Bound VBIOS record-chain walk loops - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size - drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() - netfilter: conntrack_irc: fix possible out-of-bounds read - drm/vc4: fix krealloc() memory leak - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error - f2fs: fix data loss caused by incorrect use of nat_entry flag - bnxt_en: Fix NULL pointer dereference - ipv6: mcast: Fix use-after-free when processing MLD queries - ipvs: clear the svc scheduler ptr early on edit - netfilter: synproxy: add mutex to guard hook reference counting - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list - net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr - netlabel: validate unlabeled address and mask attribute lengths - netfilter: bridge: make ebt_snat ARP rewrite writable - tcp: restrict SO_ATTACH_FILTER to priv users - ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER - Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig - misc: fastrpc: fix DMA address corruption due to find_vma misuse - misc: fastrpc: Fix NULL pointer dereference in rpmsg callback - gpio: mvebu: fix NULL pointer dereference in suspend/resume - Bluetooth: fix memory leak in error path of hci_alloc_dev() - Bluetooth: bnep: reject short frames before parsing - Bluetooth: RFCOMM: validate skb length in MCC handlers - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams - RDMA/srp: bound SRP_RSP sense copy by the received length - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN - net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure - sched/psi: fix race between file release and pressure write - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase - rculist: add list_splice_rcu() for private lists - net: skbuff: fix missing zerocopy reference in pskb_carve helpers - ip6_vti: set netns_immutable on the fallback device. - wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() - wifi: rtw88: debugfs: support multiple adapters debugging - erofs: fix use-after-free on sbi->sync_decompress - net: openvswitch: fix possible kfree_skb of ERR_PTR - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() - md: wake raid456 reshape waiters before suspend - dm cache policy smq: check allocation under invalidate lock - Bluetooth: MGMT: validate advertising TLV before type checks - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend - USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL - USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam - USB: serial: option: add support for Rolling Wireless RW135R-GL - USB: serial: io_edgeport: add support for Blackbox IC135A - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr - netfilter: flowtable: strictly check for maximum number of actions - fuse: reject fuse_notify() pagecache ops on directories - fs/mbcache: cancel shrink work before destroying the cache - smb/client: fix possible infinite loop and oob read in symlink_data() - fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp - ata: libata-scsi: do not needlessly defer commands when using PMP with FBS - ata: libata-scsi: do not use the deferred QC feature on PMPs with CBS - ata: libata-scsi: do not use the deferred QC feature for ATA_DEFER_PORT - ata: libata-scsi: improve readability of ata_scsi_qc_issue() - ata: libata-scsi: fix requeue of deferred ATA PASS-THROUGH commands - ata: libata-eh: Fix detection of deferred qc timeouts - ata: libata: cancel pending work after clearing deferred_qc - ata: libata-core: fix cancellation of a port deferred qc work - ata: libata-scsi: rename and improve ata_qc_done() - ata: libata-scsi: simplify ata_scsi_requeue_deferred_qc() - ata: libata-sata: simplify ata_sas_queuecmd() - ata: libata-core: improve tag checks in ata_qc_issue() - ata: libata-eh: correctly handle deferred qc timeouts - ata: libata-scsi: avoid Non-NCQ command starvation - ata: libata: Introduce ata_port_eh_scheduled() - ext4: handle wraparound when searching for blocks for indirect mapped blocks - ext4: fix error pointer dereference in ext4_mb_load_buddy_gfp() - ext4: always allocate blocks only from groups inode can use - ext4: fix e4b bitmap inconsistency reports - ext4: convert bd_buddy_page to bd_buddy_folio - ext4: convert bd_bitmap_page to bd_bitmap_folio - Revert "ext4: fix e4b bitmap inconsistency reports" - ext4: cleanup for ext4_map_blocks - ext4: rename EXT4_GET_BLOCKS_PRE_IO - ext4: drop extent cache when splitting extent fails - ext4: drop extent cache after doing PARTIAL_VALID1 zeroout - ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O - ext4: correct the comments place for EXT4_EXT_MAY_ZEROOUT - ext4: get rid of ppath in ext4_ext_handle_unwritten_extents() - ext4: get rid of ppath in ext4_ext_convert_to_initialized() - ext4: get rid of ppath in ext4_split_convert_extents() - ext4: get rid of ppath in ext4_split_extent() - ext4: get rid of ppath in ext4_force_split_extent_at() - ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 - ext4: subdivide EXT4_EXT_DATA_VALID1 - Revert "ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O" - ext4: get rid of ppath in ext4_split_extent_at() - ext4: get rid of ppath in ext4_ext_insert_extent() - ext4: get rid of ppath in get_ext_path() - ext4: add new ext4_ext_path_brelse() helper - !24596 [sync]urma: fix workqueue use-after-free in ubagg_exit teardown sequence - urma: fix workqueue use-after-free in ubagg_exit teardown sequence - !24607 ub: udma: Optimize udma jetty id access logic. - ub: udma: Optimize udma jetty id access logic. - !24640 [sync]urma: limit ubcore logs in reuse paths - urma: fix workqueue use-after-free in ubagg_exit teardown sequence - !24669 mm/madvise: add MADV_FCMA_ENABLE to set PF_FOLIO_CMA via madvise - mm/madvise: add MADV_FCMA_ENABLE to set PF_FOLIO_CMA via madvise - !24702 [sync]urma: retry import jetty/jfr on EIO from tpid reuse failure - urma: retry import jetty/jfr on EIO from tpid reuse failure - urma: limit ubagg connect exchange logs * Fri Jul 10 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-145.3.18.151.20260710.aae66044906b - !24753 [sync]urma: drain jfe event lists in batches to avoid soft-lockup - urma: drain jfe event lists in batches to avoid soft-lockup - urma: reduce ubagg topo log noise - !24748 [sync]urma: free completion events outside jfe lock - urma: free jfe events outside lock - urma: free completion events outside jfe lock - !24742 urma: Fix the issue of inaccurate timing for some functions in DFX - !24741 [sync]urma: fix UAF of accessing token_id in log. - urma: Fix the issue of inaccurate timing for some functions in DFX - urma: fix UAF of accessing token_id in log. - !24734 [sync]urma: fix tpid_reuse attached to vtpn causes use_after_free - urma: fix tpid_reuse attached to vtpn causes use_after_free - !24804 [sync]urma: use vzalloc for ubmad tjetty and ini_rtbuffer - !24774 [sync]urma: ratelimit import jetty/jfr error logs - urma: use vzalloc for ubmad tjetty and ini_rtbuffer - !24792 [sync]urma: fix UAF of accessing jfs/jetty in log. - urma: fix UAF of accessing jfs/jetty in log. - urma: ratelimit import jetty/jfr error logs - !24845 [sync]ub/ubdevshm: Support for acquiring va is a sub-range of registered va - ub/ubdevshm: Support for acquiring va is a sub-range of registered va - !24802 [sync]urma: use xarray for ubagg/ubcore session lookup - urma: use xarray for ubagg/ubcore session lookup - !24814 [sync]urma: make ratelimit burst configurable for ubcore/uburma/ubagg - urma: make ratelimit burst configurable for ubcore/uburma/ubagg * Wed Jul 22 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-145.3.22.153.20260722.158daf1d8dea - !24942 [sync]urma: drop param_set_uint_minmax for ratelimit burst setters - urma: drop param_set_uint_minmax for ratelimit burst setters - !25840 sync CVE LTS and bugfix from OLK-6.6 d33ffc8f8580 to 334dfd575ba5 - cgroup/rstat: avoid disabling irqs for O(num_cpu) - netfilter: bridge: eb_tables: close module init race - crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents - netfilter: ebtables: move to two-stage removal scheme - crypto: qat - protect service table iterations with service_lock - Bluetooth: eir: Fix stack OOB write when prepending the Flags AD - drm/edid: fix OOB read in drm_parse_tiled_block() - proc: protect ptrace_may_access() with exec_update_lock (FD links) - vfio/pci: Latch disable_idle_d3 per device - bpf: Fix UAF in sock clone early bailouts - bpf: Disable xfrm_decode_session hook attachment - bpf,fork: wipe ->bpf_storage before bailouts that access it - KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() - crypto: qat - validate RSA CRT component lengths - bpf: Clear rb node linkage when freeing bpf_rb_root - bpf: Add validation for bpf_set_retval argument - bpf: Reject sleepable BPF_LSM_CGROUP programs at load time - bpf: Fix setting retval to -EPERM for cgroup hooks not returning errno - bpf: Guard __get_user acesss with access_ok for uprobe_multi data - i2c: core: fix adapter registration race - ALSA: hda/cs35l41: Fix firmware load work teardown - vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc - iommufd: Break the loop on failure in iommufd_fault_fops_read() - posix-cpu-timers: Prevent UAF caused by non-leader exec() race - iio: event: Fix event FIFO reset race - hwrng: virtio: clamp device-reported used.len at copy_data() - crypto: drbg - Fix returning success on failure in CTR_DRBG - crypto: ecc - Fix carry overflow in vli multiplication - crypto: pcrypt - restore callback for non-parallel fallback - net: openvswitch: reject oversized nested action attrs - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page - e1000e: Fix out-of-bounds MMIO access by validating BAR0 size - xsched: enforce permissions on attribute access - xsched: restrict vstream management to privileged users - rme: use DMA API for virtio in realm world - udf: validate sparing table length as an entry count, not a byte count - smb: client: harden POSIX SID length parsing - smb: client: mask server-provided mode to 07777 in modefromsid - smb: client: Fix next buffer leak in receive_encrypted_standard() - nvmet-auth: validate reply message payload bounds against transfer length - bpf: Reject fragmented frames in devmap - bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized - mm/huge_memory: update file PMD counter before folio_put() - sctp: fix uninit-value in __sctp_rcv_asconf_lookup() - smb: client: reject overlapping data areas in SMB2 responses - smb: client: restrict implied bcc[0] exemption to responses without data area - io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item - writeback: drop now-unnecessary rcu_barrier() in cgroup_writeback_umount() - writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() - writeback: Fix use after free in inode_switch_wbs_work_fn() - writeback: Avoid contention on wb->list_lock when switching inodes - block: skip sync_blockdev() on surprise removal in bdev_mark_dead() - mm: do file ownership checks with the proper mount idmap - tracing: Bound synthetic-field strings with seq_buf - perf/core: Detach event groups during remove_on_exec - bpf: Allow LPM map access from sleepable BPF programs - bpf: Consistently use bpf_rcu_lock_held() everywhere - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC - udf: validate VAT header length against the VAT inode size - isofs: bound Rock Ridge symlink components to the SL record - udf: validate free block extents against the partition length - config: arm64: update CONFIG_FTRACE_STARTUP_TEST not set - crypto: qat - Return pointer directly in adf_ctl_alloc_resources - crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() - drivers/base/memory: set mem->altmap after successful device registration - serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails - serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero - NFS: Prevent resource leak in nfs_alloc_server() - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr - nfsd: check get_user() return when reading princhashlen - fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode - fbdev: modedb: fix a possible UAF in fb_find_mode() - fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var - power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path - 9p: avoid putting oldfid in p9_client_walk() error path - ocfs2: reject oversized group bitmap descriptors - rpmsg: char: Fix use-after-free on probe error path - fpga: region: fix use-after-free in child_regions_with_firmware() - irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove - pNFS: Fix use-after-free in pnfs_update_layout() - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done - hdlc_ppp: sync per-proto timers before freeing hdlc state - gfs2: fix use-after-free in gfs2_qd_dealloc - exfat: fix potential use-after-free in exfat_find_dir_entry() - bpf: use kvfree() for replaced sysctl write buffer - f2fs: keep atomic write retry from zeroing original data - f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node() - f2fs: validate ACL entry sizes in f2fs_acl_from_disk() - f2fs: fix to round down start offset of fallocate for pin file - f2fs: validate compress cache inode only when enabled - wifi: iwlwifi: mvm: fix race condition in PTP removal - wifi: rtw88: usb: fix memory leaks on USB write failures - wifi: rtw88: increase TX report timeout to fix race condition - wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor - wifi: ath11k: fix warning when unbinding - wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S - keys: Pin request_key_auth payload in instantiate paths - KEYS: fix overflow in keyctl_pkey_params_get_2() - err.h: use __always_inline on all error pointer helpers - fbdev: fix use-after-free in store_modes() - NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR - apparmor: mediate the implicit connect of TCP fast open sendmsg - net: skmsg: preserve sg.copy across SG transforms - mac802154: llsec: add skb_cow_data() before in-place crypto - af_unix: Set gc_in_progress to true in unix_gc(). - ntfs3: reject direct userspace writes to reserved $LX* xattrs - ipv4: account for fraggap on the paged allocation path - inet: add indirect call wrapper for getfrag() calls - ipv6: account for fraggap on the paged allocation path - batman-adv: tvlv: avoid race of cifsnotfound handler state - batman-adv: tvlv: enforce 2-byte alignment - batman-adv: dat: prevent false sharing between VLANs - batman-adv: tt: track roam count per VID - batman-adv: tt: don't merge change entries with different VIDs - batman-adv: tp_meter: handle overlapping packets - batman-adv: tp_meter: prevent parallel modifications of last_recv - batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE - batman-adv: tp_meter: restrict number of unacked list entries - batman-adv: v: prevent OGM aggregation on disabled hardif - batman-adv: frag: avoid underflow of TTL - batman-adv: frag: ensure fragment is writable before modifying TTL - batman-adv: fix (m|b)cast csum after decrementing TTL - batman-adv: ensure bcast is writable before modifying TTL - batman-adv: tp_meter: initialize last_recv_time during init - batman-adv: prevent ELP transmission interval underflow - batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE - batman-adv: tp_meter: add only finished tp_vars to lists - batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection - batman-adv: tp_meter: fix fast recovery precondition - batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd - batman-adv: tp_meter: avoid window underflow - batman-adv: tp_meter: initialize dec_cwnd explicitly - batman-adv: tp_meter: initialize dup_acks explicitly - batman-adv: tp_meter: keep unacked list in ascending ordered - eventpoll: rename ep_remove_safe() back to ep_remove() - file: add fput() cleanup helper - media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si - ksmbd: reject non-VALID session in compound request branch - scripts/sorttable: Fix endianness handling in build-time mcount sort - scripts/sorttable: Allow matches to functions before function entry - scripts/sorttable: Use normal sort if theres no relocs in the mcount section - ftrace: Check against is_kernel_text() instead of kaslr_offset() - ftrace: Test mcount_loc addr before calling ftrace_call_addr() - ftrace: Do not over-allocate ftrace memory - ftrace: Have ftrace pages output reflect freed pages - ftrace: Update the mcount_loc check of skipped entries - scripts/sorttable: Zero out weak functions in mcount_loc table - scripts/sorttable: Always use an array for the mcount_loc sorting - scripts/sorttable: Have mcount rela sort use direct values - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 - scripts/sorttable: Use a structure of function pointers for elf helpers - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly - scripts/sorttable: Move code from sorttable.h into sorttable.c - scripts/sorttable: Use uint64_t for mcount sorting - scripts/sorttable: Add helper functions for Elf_Sym - scripts/sorttable: Add helper functions for Elf_Shdr - scripts/sorttable: Add helper functions for Elf_Ehdr - scripts/sorttable: Convert Elf_Sym MACRO over to a union - scripts/sorttable: Replace Elf_Shdr Macro with a union - scripts/sorttable: Convert Elf_Ehdr to union - scripts/sorttable: Make compare_extable() into two functions - scripts/sorttable: Have the ORC code use the _r() functions to read - scripts/sorttable: Remove unneeded Elf_Rel - scripts/sorttable: Remove unused write functions - scripts/sorttable: Remove unused macro defines - fuse: re-lock request before replacing page cache folio - slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD - slimbus: qcom-ngd-ctrl: Fix up platform_driver registration - rxrpc: Fix the ACK parser to extract the SACK table for parsing - net: phonet: free phonet_device after RCU grace period - phonet: Pass net and ifindex to phonet_address_notify(). - phonet: Pass ifindex to fill_addr(). - Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs - hv: utils: handle and propagate errors in kvp_register - regulator: core: fix locking in regulator_resolve_supply() error path - ring-buffer: Remove ring_buffer_read_prepare_sync() - selftests/bpf: Update comments find_equal_scalars->sync_linked_regs - af_unix: Reject SIOCATMARK on non-stream sockets - selftests/bpf: Add test to ensure kprobe_multi is not sleepable - agp/amd64: Fix broken error propagation in agp_amd64_probe() - net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() - i2c: stub: Reject I2C block transfers with invalid length - RDMA/bnxt_re: zero shared page before exposing to userspace - KVM: VMX: Update SVI during runtime APICv activation - ARM: fix branch predictor hardening - ARM: fix hash_name() fault - ARM: allow __do_kernel_fault() to report execution of memory faults - ARM: group is_permission_fault() with is_translation_fault() - debugobjects: Dont call fill_pool() in early boot hardirq context - debugobjects: Do not fill_pool() if pi_blocked_on - debugobjects: Use LD_WAIT_CONFIG instead of LD_WAIT_SLEEP - debugobjects: Allow to refill the pool before SYSTEM_SCHEDULING - batman-adv: tt: prevent TVLV entry number overflow - drm/v3d: Skip CSD when it has zeroed workgroups - drm/v3d: Store the active job inside the queue's state - iov_iter: Fix potential underflow in iov_iter_extract_xarray_pages() - urma: add check type in free driver obj - smb: client: fix double-free in SMB2_close() replay - smb: client: fix double-free in SMB2_flush() replay - smb: client: fix query_info() replay double-free - smb: client: fix query directory replay double-free - smb: client: fix double-free in SMB2_open() replay - smb: client: fix double-free in SMB2_ioctl() replay - smb: client: fix change notify replay double-free - HID: lg-g15: cancel pending work on remove to fix a use-after-free - HID: multitouch: fix out-of-bounds bit access on mt_io_flags - tracing: Prevent out-of-bounds read in glob matching - sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT - !25616 sync CVE LTS and bugfix from OLK-6.6 b72db20c0437 to d33ffc8f8580 - KVM: x86: hyper-v: Bound the bank index when querying sparse banks - MIPS: DEC: Prevent initial console buffer from landing in XKPHYS - ksmbd: fix durable reconnect error path file lifetime - ksmbd: fix use-after-free in smb2_open during durable reconnect - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query - USB: iowarrior: fix use-after-free on disconnect race - usb: iowarrior: remove inherent race with minor number - USB: iowarrior: fix use-after-free on disconnect - apparmor: fix use-after-free in rawdata dedup loop - tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR - bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops - rbd: eliminate a race in lock_dwork draining on unmap - blk-cgroup: fix UAF in __blkcg_rstat_flush() - net: Fix kabi breakage of struct tc_action - net/sched: act_api: use RCU with deferred freeing for action lifecycle - net: Fix kabi breakage of struct header_ops - bonding: prevent potential infinite loop in bond_header_parse() - bonding: fix type confusion in bond_setup_by_slave() - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc - ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL - ASoC: cs35l56: Fix missing calls to wm_adsp2_remove() - time: Fix off-by-one in compat settimeofday() usec validation - scsi: target: Fix hexadecimal CHAP_I handling - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink - ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY - ksmbd: add a permission check for FSCTL_SET_ZERO_DATA - ksmbd: add per-handle permission check to FILE_LINK_INFORMATION - mptcp: fix missing wakeups in edge scenarios - mptcp: add-addr: always drop other suboptions - ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 - RDMA/umem: fix kernel-doc warnings - mm/migrate: don't call folio_putback_active_hugetlb() on dst hugetlb folio - usb: typec: ucsi: Don't update power_supply on power role change if not connected - serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() - thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() - usb: typec: ucsi: Check if power role change actually happened before handling - usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind - usb: dwc3: xilinx: fix error handling in zynqmp init error paths - usb: musb: omap2430: Fix use-after-free in omap2430_probe() - tty: serial: samsung: Remove redundant port lock acquisition in rx helpers - tty: serial: samsung: use u32 for register interactions - serial: samsung_tty: Use port lock wrappers - ALSA: firewire-motu: Protect register DSP event queue positions - memfd: deny writeable mappings when implying SEAL_WRITE - iio: dac: ad5686: fix ref bit initialization for single-channel parts - usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure - iio: chemical: scd30: fix division by zero in write_raw - iio: chemical: scd30: Use guard(mutex) to allow early returns - iio: gyro: adis16260: fix division by zero in write_raw - Bluetooth: hci_qca: Convert timeout from jiffies to ms - Bluetooth: hci_qca: Migrate to serdev specific shutdown function - serdev: Provide a bustype shutdown function - serdev: make serdev_bus_type const - mm/damon/sysfs-schemes: delete tried region in regions_rmdirs() - mptcp: do not drop partial packets - mptcp: introduce the mptcp_init_skb helper - iio: adc: npcm: fix unbalanced clk_disable_unprepare() - iio: adc: npcm: Convert to platform remove callback returning void - octeontx2-pf: avoid double free of pool->stack on AQ init failure - af_unix: Fix UAF read of tail->len in unix_stream_data_wait() - af_unix: Cache state->msg in unix_stream_read_generic(). - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg - net: hsr: defer node table free until after RCU readers - mptcp: pm: fix ADD_ADDR timer infinite retry on option space insufficient - ice: fix VF queue configuration with low MTU values - mptcp: reset rcv wnd on disconnect - mptcp: cleanup fallback dummy mapping generation - octeontx2-af: CGX: add bounds check to cgx_speed_mbps index - octeontx2-af: replace deprecated strncpy with strscpy - cgroup/cpuset: Reset DL migration state on can_attach() failure - fbdev/vt8500lcdfb: Initialize fb_ops with fbdev macros - soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get() - driver core: reject devices with unregistered buses - drm/amd/display: Use krealloc_array() in dal_vector_reserve() - drm/amdgpu: restart the CS if some parts of the VM are still invalidated - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 - drm/amdkfd: fix NULL dereference in get_queue_ids() - slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock - slimbus: qcom-ngd-ctrl: fix OF node refcount - thunderbolt: Limit XDomain response copy to actual frame size - sctp: stream: fully roll back denied add-stream state - mmc: sdhci: add signal voltage switch in sdhci_resume_host - mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC - mmc: litex_mmc: Set mandatory idle clocks before CMD0 - mmc: core: Fix host controller programming for fixed driver type - mm/hugetlb: restore reservation on error in hugetlb folio copy paths - octeontx2-af: fix memory leak in rvu_setup_hw_resources() - nvmem: layouts: onie-tlv: fix hang on unknown types - net: rds: clear i_sends on setup unwind - net: mv643xx: fix OF node refcount - net/mlx5: Reorder completion before putting command entry in cmd_work_handler - misc: fastrpc: fix use-after-free race in fastrpc_map_create - misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context - Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard - i2c: tegra: Fix NOIRQ suspend/resume - i2c: stm32f7: fix timing computation ignoring i2c-analog-filter - i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() - pidfd: refuse access to tasks that have started exiting harder - ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write - vsock/vmci: fix sk_ack_backlog leak on failed handshake - wifi: nl80211: reject oversized EMA RNR lists - selftests: mptcp: add test for extra_subflows underflow on userspace PM - mptcp: sockopt: check timestamping ret value - mptcp: allow subflow rcv wnd to shrink - mptcp: close TOCTOU race while computing rcv_wnd - mptcp: fix retransmission loop when csum is enabled - ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow - ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O - ARM: socfpga: Fix OF node refcount leak in SMP setup - mm/damon/ops-common: call folio_test_lru() after folio_get() - drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info() - ALSA: timer: Fix UAF at snd_timer_user_params() - USB: serial: option: add usb-id for Dell Wireless DW5826e-m - xfrm: espintcp: do not reuse an in-progress partial send - ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL - mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation - tracing/probes: Point the error offset correctly for eprobe argument error - netfilter: nft_tunnel: fix use-after-free on object destroy - clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time - net: mvpp2: build skb from XDP-adjusted data on XDP_PASS - net: mvpp2: refill RX buffers before XDP or skb use - net: mvpp2: Add metadata support for xdp mode - netfilter: nf_log: validate MAC header was set before dumping it - rds: mark snapshot pages dirty in rds_info_getsockopt() - net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion - r8152: handle the return value of usb_reset_device() - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove - net: phy: clean the sfp upstream if phy probing fails - net/mlx4: avoid GCC 10 __bad_copy_from() false positive - ASoC: wm_adsp: Fix NULL dereference when removing firmware controls - arm64: tlb: Allow XZR argument to TLBI ops - KVM: arm64: Remove VPIPT I-cache handling - tools/rv: Fix cleanup after failed trace setup - time: Fix off-by-one in settimeofday() usec validation - ipmi: Fix rcu_read_unlock to srcu_read_unlock in handle_read_event_rsp - ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() - vxlan: vnifilter: fix spurious notification on VNI update - vxlan: vnifilter: send notification on VNI add - octeontx2-af: npc: Fix CPT channel mask in npc_install_flow - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown - ptp: vclock: Switch from RCU to SRCU - net: fec: fix pinctrl default state restore order on resume - net: lan743x: permit VLAN-tagged packets up to configured MTU - net: garp: fix unsigned integer underflow in garp_pdu_parse_attr - hsr: Remove WARN_ONCE() in hsr_addr_is_self(). - net: Annotate sk->sk_write_space() for UDP SOCKMAP. - pcnet32: stop holding device spin lock during napi_complete_done - drm/imx: Fix three kernel-doc warnings in dcss-scaler.c - 6lowpan: fix off-by-one in multicast context address compression - netfilter: xt_NFQUEUE: prefer raw_smp_processor_id - tee: optee: prevent use-after-free when the client exits before the supplicant - net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS - Disable -Wattribute-alias for clang-23 and newer - RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug - USB: serial: mct_u232: fix memory corruption with small endpoint - usb: core: Fix SuperSpeed root hub wMaxPacketSize - serial: zs: Convert to use a platform device - serial: dz: Convert to use a platform device - serial: dz: Fix bootconsole handover lockup - xhci: tegra: Fix ghost USB device on dual-role port unplug - USB: serial: digi_acceleport: fix memory corruption with small endpoints - landlock: Fix handling of disconnected directories - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync - USB: serial: cypress_m8: fix memory corruption with small endpoint - serial: zs: Switch to using channel reset - serial: zs: Fix bootconsole handover lockup - serial: dz: Fix bootconsole message clobbering at chip reset - drm/amdkfd: Check for pdd drm file first in CRIU restore path - drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger - drm/amdkfd: fix NULL pointer bug in svm_range_set_attr - serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma - serial: zs: Fix swapped RI/DSR modem line transition counting - serial: sh-sci: fix memory region release in error path - serial: qcom-geni: fix UART_RX_PAR_EN bit position - serial: altera_jtaguart: handle uart_add_one_port() failures - drm/amd/pm/si: Disregard vblank time when no displays are connected - drm/i915: Fix potential UAF in TTM object purge - drm/hyperv: validate VMBus packet size in receive callback - drm/hyperv: validate resolution_count and fix WIN8 fallback - scsi: target: iscsi: Validate CHAP_R length before base64 decode - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 - scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker - thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow - thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() - usb: gadget: f_fs: copy only received bytes on short ep0 read - usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports - usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling - usb: gadget: f_hid: fix device reference leak in hidg_alloc() - usb: gadget: net2280: Fix double free in probe error path - USB: serial: mct_u232: fix missing interrupt-in transfer sanity check - USB: serial: mxuport: fix memory corruption with small endpoint - USB: serial: keyspan: fix missing indat transfer sanity check - USB: serial: cypress_m8: validate interrupt packet headers - USB: serial: belkin_sa: validate interrupt status length - USB: serial: option: add MeiG SRM813Q - usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize - usb: usbtmc: check URB actual_length for interrupt-IN notifications - usbip: vudc: Fix use after free bug in vudc_remove due to race condition - usb: storage: Add quirks for PNY Elite Portable SSD - USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers - usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval - usb: chipidea: core: convert ci_role_switch to local variable - tty: serial: pch_uart: add check for dma_alloc_coherent() - counter: Fix refcount leak in counter_alloc() error path - comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() - comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() - Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 - Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem - Input: xpad - add support for ASUS ROG RAIKIRI II - Input: xpad - add "Nova 2 Lite" from GameSir - ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks - ASoC: qcom: q6asm-dai: close stream only when running - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check - xfrm: ah: use skb_to_full_sk in async output callbacks - xfrm: route MIGRATE notifications to caller's netns - nfc: hci: fix out-of-bounds read in HCP header parsing - iommu, debugobjects: avoid gcc-16.1 section mismatch warnings - HID: wacom: Fix OOB write in wacom_hid_set_device_mode() - ip6: vti: Use ip6_tnl.net in vti6_changelink(). - xfrm: input: hold netns during deferred transport reinjection - ipv6: validate extension header length before copying to cmsg - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). - ipv6: exthdrs: refresh nh after handling HAO option - ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() - macsec: fix replay protection at XPN lower-PN wrap - bpf: sockmap: fix tail fragment offset in bpf_msg_push_data - Input: elan_i2c - validate firmware size before use - usb: dwc2: Fix use after free in debug code - usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles - usb: cdns3: gadget: fix request skipping after clearing halt - USB: serial: omninet: fix memory corruption with small endpoint - iio: buffer: hw-consumer: fix use-after-free in error path - iio: light: cm3323: fix reg_conf not being initialized correctly - iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL - iio: temperature: tsys01: fix broken PROM checksum validation - iio: ssp_sensors: cancel delayed work_refresh on remove - iio: gyro: itg3200: fix i2c read into the wrong stack location - iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw - iio: dac: ad5686: acquire lock when doing powerdown control - iio: dac: ad5686: fix input raw value check - iio: dac: max5821: fix return value check in powerdown sync - iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux - wireguard: send: append trailer after expanding head - KVM: arm64: PMU: Preserve AArch32 counter low bits - parport: Fix race between port and client registration - Input: xpad - fix out-of-bounds access for Share button - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock - Bluetooth: ISO: fix UAF in iso_recv_frame - Bluetooth: HIDP: fix missing length checks in hidp_input_report() - auxdisplay: line-display: fix OOB read on zero-length message_store() - hpfs: fix a crash if hpfs_map_dnode_bitmap fails - Bluetooth: btusb: Allow firmware re-download when version matches - HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse - Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() - USB: serial: safe_serial: fix memory corruption with small endpoint - usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT - usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() - usb: typec: altmodes/displayport: validate count before reading Status Update VDO - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO - usb: typec: ucsi: ccg: reject firmware images without a ':' record header - iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer - soc/tegra: pmc: Fix unsafe generic_handle_irq() call - hwmon: (pmbus/adm1266) serialize NVMEM blackbox read with pmbus_lock - hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock - of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() - phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X - drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used - drm/dp: Add eDP 1.5 bit definition - drm/i915/psr: Read Intel DPCD workaround register - drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register - media: rc: fix race between unregister and urb/irq callbacks - batman-adv: bla: avoid double decrement of bla.num_requests - batman-adv: tt: avoid empty VLAN responses - batman-adv: tt: fix TOCTOU race for reported vlans - batman-adv: tp_meter: directly shut down timer on cleanup - batman-adv: tp_meter: avoid role confusion in tp_list - batman-adv: iv: recover OGM scheduling after forward packet error - batman-adv: tvlv: reject oversized TVLV packets - batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface - batman-adv: tt: reject oversized local TVLV buffers - batman-adv: tvlv: abort OGM send on tvlv append failure - net: skbuff: fix pskb_carve leaking zcopy pages - ipv6: fix possible infinite loop in fib6_select_path() - ipv6: fix possible infinite loop in rt6_fill_node() - sctp: fix race between sctp_wait_for_connect and peeloff - net: mana: Add NULL guards in teardown path to prevent panic on attach failure - gpio: rockchip: convert bank->clk to devm_clk_get_enabled() - Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() - ethtool: eeprom: add more safeties to EEPROM Netlink fallback - ethtool: eeprom: add missing ethnl_ops_begin() / _complete() during fallback - bonding: refuse to enslave CAN devices - Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() - ASoC: codecs: simple-mux: Fix enum control bounds check - ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() - gpio: mxc: fix irq_high handling - net: hsr: fix potential OOB access in supervision frame handling - ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues - net/iucv: fix locking in .getsockopt - net/smc: Do not re-initialize smc hashtables - net: netlink: don't set nsid on local notifications - net: netlink: fix sending unassigned nsid after assigned one - vsock: keep poll shutdown state consistent - netfilter: nf_tables: fix dst corruption in same register operation - netfilter: bitwise: add support for doing AND, OR and XOR directly - netfilter: bitwise: rename some boolean operation functions - netfilter: ebtables: fix OOB read in compat_mtw_from_user - netfilter: xt_cpu: prefer raw_smp_processor_id - netfilter: synproxy: refresh tcphdr after skb_ensure_writable - xfrm: Check for underflow in xfrm_state_mtu - nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() - nfc: llcp: Fix use-after-free in llcp_sock_release() - net: cpsw_new: Fix potential unregister of netdev that has not been registered yet - drm: Remove plane hsub/vsub alignment requirement for core helpers - net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net: mctp: ensure our nlmsg responses are initialised - Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size - MIPS: smp: report dying CPU to RCU in stop_this_cpu() - LoongArch: Report dying CPU to RCU in stop_this_cpu() - irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT - tls: Flush backlog before waiting for a new record - net: ethernet: cortina: No mapping is a dropped rx - batman-adv: fix batadv_skb_is_frag() kernel-doc - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled - Bluetooth: ISO: fix malformed ISO_END/CONT handling - Bluetooth: MGMT: Fix backward compatibility with userspace - security/keys: fix missed RCU read section on lookup - LoongArch: kprobes: Fix handling of fatal unrecoverable recursions - pds_core: ensure null-termination for firmware version strings - pds_core: add an error code check in pdsc_dl_info_get - net: mana: validate rx_req_idx to prevent out-of-bounds array access - ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove() - gpio: cdev: check if uAPI v2 config attributes are correctly zeroed - gpiolib: cdev: use !mem_is_zero() instead of memchr_inv(s, 0, n) - string: add mem_is_zero() helper to check if memory area is all zeros - bpf, skmsg: fix verdict sk_data_ready racing with ktls rx - net: ag71xx: check error for platform_get_irq - Bluetooth: btmtk: rename btmediatek_data - Bluetooth: btusb: mediatek: refactor the function btusb_mtk_reset - Bluetooth: btmtk: add the function to get the fw name - ALSA: seq: Serialize UMP output teardown with event_input - ALSA: seq: ump: Use guard() for locking - pds_core: fix debugfs_lookup dentry leak and error handling - pds_core: fix error handling in pdsc_devcmd_wait - bridge: mcast: Fix a possible use-after-free when removing a bridge port - net: bridge: Flush multicast groups when snooping is disabled - RDMA/rtrs: Fix use-after-free in path file creation cleanup - platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL - platform/x86: intel-hid: Check ACPI_HANDLE() against NULL - platform/x86: hp_accel: Check ACPI_COMPANION() against NULL - platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer - net: dsa: mt7530: preserve VLAN tags on trapped link-local frames - net: dsa: mt7530: rename mt753x_bpdu_port_fw enum to mt753x_to_cpu_fw - net: dsa: mt7530: fix FDB entries not aging out with short timeout - wifi: ath11k: fix peer resolution on rx path when peer_id=0 - drm/msm/snapshot: fix dumping of the unaligned regions - spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache() - net/mlx5: Do not restore destination-less TC rules - tls: Preserve sk_err across recvmsg() when data has been copied - x86/xen: Fix xen_e820_swap_entry_with_ram() - net: phy: DP83TC811: add reading of abilities - net: phy: c45: add genphy_c45_pma_read_ext_abilities() function - net: tls: prevent chain-after-chain in plain text SG - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot - powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise() - drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN - drm/msm/dsi: don't dump registers past the mapped region - ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics - net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint - accel/qaic: Add overflow check to remap_pfn_range during mmap - HID: quirks: really enable the intended work around for appledisplay - wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm() - wifi: ath11k: fix error path leaks in some WMI WOW calls - net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS reference - net: ethernet: cortina: Carry over frag counter - net: ethernet: cortina: Drop half-assembled SKB - net: ethernet: cortina: Make RX SKB per-port - netfs: Fix overrun check in netfs_extract_user_iter() - zonefs: handle integer overflow in zonefs_fname_to_fno - irqchip/ath79-cpu: Remove unused function - phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access - net: lan966x: avoid unregistering netdev on register failure - ice: fix locking in ice_dcb_rebuild() - tcp: Fix imbalanced icsk_accept_queue count. - test_kprobes: clear kprobes between test runs - kprobes: skip non-symbol addresses in kprobe_add_ksym_blacklist() - netfilter: x_tables: unregister the templates first - ALSA: hda: cs35l56: Put ACPI device after setting companion - ARM: integrator: Fix early initialization - pinctrl: qcom: Fix wakeirq map by removing disconnected irqs for sm8150 - kunit: config: KUNIT_DEBUGFS should depend on DEBUG_FS - kunit: config: Enable KUNIT_DEBUGFS by default - firmware: arm_ffa: Skip free_pages on RX buffer alloc failure - firmware: arm_ffa: Check for NULL FF-A ID table while driver registration - HID: uclogic: Fix regression of input name assignment - hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors - hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe() - hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe() - hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in get_multiple - hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR - hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer - hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer - hwmon: (pmbus/adm1266) reject implausible blackbox record_count - hwmon: (pmbus/adm1266) seed timestamp from the real-time clock - batman-adv: tt: fix negative tt_buff_len - batman-adv: tt: fix negative last_changeset_len - batman-adv: tp_meter: fix race condition in send error reporting - batman-adv: tp_meter: avoid use of uninit sender vars - batman-adv: bla: fix report_work leak on backbone_gw purge - batman-adv: frag: disallow unicast fragment in fragment - batman-adv: fix fragment reassembly length accounting - batman-adv: dat: handle forward allocation error - batman-adv: clear current gateway during teardown - batman-adv: mcast: fix use-after-free in orig_node RCU release - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async - drm/amd/display: Validate GPIO pin LUT table size before iterating - drm/amd/display: Fix integer overflow in bios_get_image() - drm/bridge: megachips: remove bridge when irq request fails - drm/bridge: it66121: acquire reset GPIO in probe - drm/virtio: use uninterruptible resv lock for plane updates - device property: set fwnode->secondary to NULL in fwnode_init() - LoongArch: Remove unused code to avoid build warning - RDMA/siw: Reject MPA FPDU length underflow before signed receive math - spi: ti-qspi: fix use-after-free after DMA setup failure - spi: sprd: fix error pointer deref after DMA setup failure - scsi: isci: Fix use-after-free in device removal path - phy: tegra: xusb: Fix per-pad high-speed termination calibration - spi: qup: fix error pointer deref after DMA setup failure - drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe - KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits - arm64: probes: Handle probes on hinted conditional branch instructions - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() - ice: fix setting promisc mode while adding VID filter - ixgbevf: fix use-after-free in VEPA multicast source pruning - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 - wifi: ath11k: clear shared SRNG pointer state on restart - vsock/vmci: fix UAF when peer resets connection during handshake - ring-buffer: Fix reporting of missed events in iterator - qed: fix double free in qed_cxt_tables_alloc() - netfilter: ipset: stop hash:* range iteration at end - netfilter: nf_queue: hold bridge skb->dev while queued - netfilter: ip6t_hbh: reject oversized option lists - net: ifb: report ethtool stats over num_tx_queues - net: bcmgenet: keep RBUF EEE/PM disabled - phonet/pep: disable BH around forwarded sk_receive_skb() - Bluetooth: MGMT: validate Add Extended Advertising Data length - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths - Bluetooth: bnep: Fix UAF read of dev->name - Bluetooth: ISO: drop ISO_END frames received without prior ISO_START - net: wwan: iosm: fix potential memory leaks in ipc_imem_init() - drivers/base/memory: fix memory block reference leak in poison accounting - efi: Allocate runtime workqueue before ACPI init - ALSA: asihpi: Fix potential OOB array access at reading cache - ALSA: pcm: Don't setup bogus iov_iter for silencing - ALSA: ua101: Reject too-short USB descriptors - hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX - smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() - ksmbd: fix null pointer dereference in compare_guid_key() - mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break() - sysfs: don't remove existing directory on update failure - Revert "af_unix: Reject SIOCATMARK on non-stream sockets" - Revert "s390/cio: Update purge function to unregister the unused subchannels" - Revert "ice: Remove jumbo_remove step from TX path" - Revert "ice: fix double-free of tx_buf skb" - Revert "x86/vdso: Fix output operand size of RDPID" - wifi: mac80211: check tdls flag in ieee80211_tdls_oper - s390/debug: Reject zero-length input before trimming a newline - mptcp: pm: ADD_ADDR rtx: free sk if last - mptcp: sync the msk->sndbuf at accept() time - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close - netfilter: revalidate bridge ports - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp - net: bonding: fix NULL pointer dereference in bond_do_ioctl() - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() - udp: clear skb->dev before running a sockmap verdict - crypto: nx - Fix packed layout in struct nx842_crypto_header - crypto: nx - Use static_assert() to check struct sizes - batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown - Revert "ALSA: pcmtest: fix reference leak on failed device registration" - media: rc: ttusbir: fix inverted error logic - media: rc: igorplugusb: fix control request setup packet - batman-adv: tp_meter: fix tp_num leak on kmalloc failure - batman-adv: stop tp_meter sessions during mesh teardown - ALSA: seq: Fix UMP group 16 filtering - ALSA: seq: Notify client and port info changes - ALSA: core: Serialize deferred fasync state checks - ALSA: misc: Use guard() for spin locks - ALSA: hda: cs35l56: Propagate ASP TX source control errors - crypto: nx - Avoid -Wflex-array-member-not-at-end warning - ksmbd: reset rcount per connection in ksmbd_conn_wait_idle_sess_id() - media: rc: igorplugusb: heed coherency rules - ALSA: aoa: Skip devices with no codecs in i2sbus_resume() - media: rc: ttusbir: respect DMA coherency rules - ALSA: aoa: i2sbus: clear stale prepared state - ALSA: aoa: Use guard() for mutex locks - f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally - ksmbd: replace connection list with hash table - ksmbd: use msleep instaed of schedule_timeout_interruptible() - f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io() - smb: move some duplicate definitions to common/smbacl.h - iommu/amd: serialize sequence allocation under concurrent TLB invalidations - x86/shstk: Prevent deadlock during shstk sigreturn - ALSA: pcmtest: Fix resource leaks in module init error paths - ALSA: pcmtest: fix reference leak on failed device registration - ALSA: 6fire: Fix input volume change detection - ALSA: caiaq: Fix control_put() result and cache rollback - ALSA: core: Fix potential data race at fasync handling - Revert "ALSA: usb-audio: Cap the packet size pre-calculations" - ipv6: sit: reload inner IPv6 header after GSO offloads - net: guard timestamp cmsgs to real error queue skbs - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() - netfilter: x_tables: avoid leaking percpu counter pointers - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush - netfilter: require Ethernet MAC header before using eth_hdr() - netfilter: nft_fib: fix stale stack leak via the OIFNAME register - vsock/virtio: reset connection on receiving queue overflow - vsock/virtio: fix skb overhead accounting to preserve full buf_alloc - vsock/virtio: fix potential unbounded skb queue - mptcp: pm: ADD_ADDR rtx: always decrease sk refcount - mptcp: pm: ADD_ADDR rtx: allow ID 0 - ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers - srcu: Use irq_work to start GP in tiny SRCU - irqwork: Move data struct to a types header - types: move struct rcuwait into types.h - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets - wifi: iwlwifi: fix 22000 series SMEM parsing - wifi: iwlwifi: allow IWL_FW_CHECK() with just a string - x86: shadow stacks: proper error handling for mmap lock - net: mvpp2: sync RX data at the hardware packet offset - net: mvpp2: limit XDP frame size to the RX buffer - batman-adv: fix tp_meter counter underflow during shutdown - batman-adv: v: stop OGMv2 on disabled interface - ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger - spi: mpc52xx: fix controller deregistration - thunderbolt: Bound root directory content to block size - selinux: fix overlayfs mmap() and mprotect() access checks - lsm: add backing_file LSM hooks - fs: constify file ptr in backing_file accessor helpers - fs: prepare for adding LSM blob to backing_file - selftests/bpf: Add tests for ld_{abs,ind} failure path in subprogs - bpf: Fix ld_{abs,ind} failure path analysis in subprogs - KVM: x86: Fix shadow paging use-after-free due to unexpected role - Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref - Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() - fix kabi for ppp_defs.h - pppoe: drop PFC frames - netfilter: nat: use kfree_rcu to release ops - drm/i915/gem: Fix phys BO pread/pwrite with offset - selinux: allow multiple opens of /sys/fs/selinux/policy - ksmbd: make ksmbd thread names distinct by client IP - ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path - ALSA: caiaq: Don't abort when no input device is available - ALSA: caiaq: fix usb_dev refcount leak on probe failure - ALSA: caiaq: Handle probe errors properly - ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow - USB: cdc-acm: Fix bit overlap and move quirk definitions to header - ALSA: caiaq: take a reference on the USB device in create_card() - ALSA: usb-audio: apply quirk for MOONDROP JU Jiu - ksmbd: use check_add_overflow() to prevent u16 DACL size overflow - ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment - smb: server: fix max_connections off-by-one in tcp accept path - smb: server: fix active_num_conn leak on transport allocation failure - usb: port: add delay after usb_hub_set_port_power() - USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen - usb: storage: Expand range of matched versions for VL817 quirks entry - xfrm: Wait for RCU readers during policy netns exit - KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing - mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison - thunderbolt: Clamp XDomain response data copy to allocation size - bpf: return VMA snapshot from task_vma iterator - bpf: switch task_vma iterator from mmap_lock to per-VMA locks - bpf: fix mm lifecycle in open-coded task_vma iterator - netfilter: nft_ct: bail out on template ct in get eval - drm/amd/display: Bound VBIOS record-chain walk loops - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size - drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() - netfilter: conntrack_irc: fix possible out-of-bounds read - drm/vc4: fix krealloc() memory leak - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error - f2fs: fix data loss caused by incorrect use of nat_entry flag - bnxt_en: Fix NULL pointer dereference - ipv6: mcast: Fix use-after-free when processing MLD queries - ipvs: clear the svc scheduler ptr early on edit - netfilter: synproxy: add mutex to guard hook reference counting - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list - net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr - netlabel: validate unlabeled address and mask attribute lengths - netfilter: bridge: make ebt_snat ARP rewrite writable - tcp: restrict SO_ATTACH_FILTER to priv users - ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER - Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig - misc: fastrpc: fix DMA address corruption due to find_vma misuse - misc: fastrpc: Fix NULL pointer dereference in rpmsg callback - gpio: mvebu: fix NULL pointer dereference in suspend/resume - Bluetooth: fix memory leak in error path of hci_alloc_dev() - Bluetooth: bnep: reject short frames before parsing - Bluetooth: RFCOMM: validate skb length in MCC handlers - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams - RDMA/srp: bound SRP_RSP sense copy by the received length - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN - net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure - sched/psi: fix race between file release and pressure write - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase - rculist: add list_splice_rcu() for private lists - net: skbuff: fix missing zerocopy reference in pskb_carve helpers - ip6_vti: set netns_immutable on the fallback device. - wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() - wifi: rtw88: debugfs: support multiple adapters debugging - erofs: fix use-after-free on sbi->sync_decompress - net: openvswitch: fix possible kfree_skb of ERR_PTR - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() - md: wake raid456 reshape waiters before suspend - dm cache policy smq: check allocation under invalidate lock - Bluetooth: MGMT: validate advertising TLV before type checks - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend - USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL - USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam - USB: serial: option: add support for Rolling Wireless RW135R-GL - USB: serial: io_edgeport: add support for Blackbox IC135A - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr - netfilter: flowtable: strictly check for maximum number of actions - fuse: reject fuse_notify() pagecache ops on directories - fs/mbcache: cancel shrink work before destroying the cache - smb/client: fix possible infinite loop and oob read in symlink_data() - fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp - ata: libata-scsi: do not needlessly defer commands when using PMP with FBS - ata: libata-scsi: do not use the deferred QC feature on PMPs with CBS - ata: libata-scsi: do not use the deferred QC feature for ATA_DEFER_PORT - ata: libata-scsi: improve readability of ata_scsi_qc_issue() - ata: libata-scsi: fix requeue of deferred ATA PASS-THROUGH commands - ata: libata-eh: Fix detection of deferred qc timeouts - ata: libata: cancel pending work after clearing deferred_qc - ata: libata-core: fix cancellation of a port deferred qc work - ata: libata-scsi: rename and improve ata_qc_done() - ata: libata-scsi: simplify ata_scsi_requeue_deferred_qc() - ata: libata-sata: simplify ata_sas_queuecmd() - ata: libata-core: improve tag checks in ata_qc_issue() - ata: libata-eh: correctly handle deferred qc timeouts - ata: libata-scsi: avoid Non-NCQ command starvation - ata: libata: Introduce ata_port_eh_scheduled() - ext4: handle wraparound when searching for blocks for indirect mapped blocks - ext4: fix error pointer dereference in ext4_mb_load_buddy_gfp() - ext4: always allocate blocks only from groups inode can use - ext4: fix e4b bitmap inconsistency reports - ext4: convert bd_buddy_page to bd_buddy_folio - ext4: convert bd_bitmap_page to bd_bitmap_folio - Revert "ext4: fix e4b bitmap inconsistency reports" - ext4: cleanup for ext4_map_blocks - ext4: rename EXT4_GET_BLOCKS_PRE_IO - ext4: drop extent cache when splitting extent fails - ext4: drop extent cache after doing PARTIAL_VALID1 zeroout - ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O - ext4: correct the comments place for EXT4_EXT_MAY_ZEROOUT - ext4: get rid of ppath in ext4_ext_handle_unwritten_extents() - ext4: get rid of ppath in ext4_ext_convert_to_initialized() - ext4: get rid of ppath in ext4_split_convert_extents() - ext4: get rid of ppath in ext4_split_extent() - ext4: get rid of ppath in ext4_force_split_extent_at() - ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 - ext4: subdivide EXT4_EXT_DATA_VALID1 - Revert "ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O" - ext4: get rid of ppath in ext4_split_extent_at() - ext4: get rid of ppath in ext4_ext_insert_extent() - ext4: get rid of ppath in get_ext_path() - ext4: add new ext4_ext_path_brelse() helper - !24596 [sync]urma: fix workqueue use-after-free in ubagg_exit teardown sequence - urma: fix workqueue use-after-free in ubagg_exit teardown sequence - !24607 ub: udma: Optimize udma jetty id access logic. - ub: udma: Optimize udma jetty id access logic. - !24640 [sync]urma: limit ubcore logs in reuse paths - urma: fix workqueue use-after-free in ubagg_exit teardown sequence - !24669 mm/madvise: add MADV_FCMA_ENABLE to set PF_FOLIO_CMA via madvise - mm/madvise: add MADV_FCMA_ENABLE to set PF_FOLIO_CMA via madvise - !24702 [sync]urma: retry import jetty/jfr on EIO from tpid reuse failure - urma: retry import jetty/jfr on EIO from tpid reuse failure - urma: limit ubagg connect exchange logs * Fri Jul 10 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-145.3.18.151.20260710.aae66044906b - !24753 [sync]urma: drain jfe event lists in batches to avoid soft-lockup - urma: drain jfe event lists in batches to avoid soft-lockup - urma: reduce ubagg topo log noise - !24748 [sync]urma: free completion events outside jfe lock - urma: free jfe events outside lock - urma: free completion events outside jfe lock - !24742 urma: Fix the issue of inaccurate timing for some functions in DFX - !24741 [sync]urma: fix UAF of accessing token_id in log. - urma: Fix the issue of inaccurate timing for some functions in DFX - urma: fix UAF of accessing token_id in log. - !24734 [sync]urma: fix tpid_reuse attached to vtpn causes use_after_free - urma: fix tpid_reuse attached to vtpn causes use_after_free - !24804 [sync]urma: use vzalloc for ubmad tjetty and ini_rtbuffer - !24774 [sync]urma: ratelimit import jetty/jfr error logs - urma: use vzalloc for ubmad tjetty and ini_rtbuffer - !24792 [sync]urma: fix UAF of accessing jfs/jetty in log. - urma: fix UAF of accessing jfs/jetty in log. - urma: ratelimit import jetty/jfr error logs - !24845 [sync]ub/ubdevshm: Support for acquiring va is a sub-range of registered va - ub/ubdevshm: Support for acquiring va is a sub-range of registered va - !24802 [sync]urma: use xarray for ubagg/ubcore session lookup - urma: use xarray for ubagg/ubcore session lookup - !24814 [sync]urma: make ratelimit burst configurable for ubcore/uburma/ubagg - urma: make ratelimit burst configurable for ubcore/uburma/ubagg * Wed Jul 22 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-145.3.22.153.20260722.158daf1d8dea - !24942 [sync]urma: drop param_set_uint_minmax for ratelimit burst setters - urma: drop param_set_uint_minmax for ratelimit burst setters - !25840 sync CVE LTS and bugfix from OLK-6.6 d33ffc8f8580 to 334dfd575ba5 - cgroup/rstat: avoid disabling irqs for O(num_cpu) - netfilter: bridge: eb_tables: close module init race - crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents - netfilter: ebtables: move to two-stage removal scheme - crypto: qat - protect service table iterations with service_lock - Bluetooth: eir: Fix stack OOB write when prepending the Flags AD - drm/edid: fix OOB read in drm_parse_tiled_block() - proc: protect ptrace_may_access() with exec_update_lock (FD links) - vfio/pci: Latch disable_idle_d3 per device - bpf: Fix UAF in sock clone early bailouts - bpf: Disable xfrm_decode_session hook attachment - bpf,fork: wipe ->bpf_storage before bailouts that access it - KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() - crypto: qat - validate RSA CRT component lengths - bpf: Clear rb node linkage when freeing bpf_rb_root - bpf: Add validation for bpf_set_retval argument - bpf: Reject sleepable BPF_LSM_CGROUP programs at load time - bpf: Fix setting retval to -EPERM for cgroup hooks not returning errno - bpf: Guard __get_user acesss with access_ok for uprobe_multi data - i2c: core: fix adapter registration race - ALSA: hda/cs35l41: Fix firmware load work teardown - vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc - iommufd: Break the loop on failure in iommufd_fault_fops_read() - posix-cpu-timers: Prevent UAF caused by non-leader exec() race - iio: event: Fix event FIFO reset race - hwrng: virtio: clamp device-reported used.len at copy_data() - crypto: drbg - Fix returning success on failure in CTR_DRBG - crypto: ecc - Fix carry overflow in vli multiplication - crypto: pcrypt - restore callback for non-parallel fallback - net: openvswitch: reject oversized nested action attrs - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page - e1000e: Fix out-of-bounds MMIO access by validating BAR0 size - xsched: enforce permissions on attribute access - xsched: restrict vstream management to privileged users - rme: use DMA API for virtio in realm world - udf: validate sparing table length as an entry count, not a byte count - smb: client: harden POSIX SID length parsing - smb: client: mask server-provided mode to 07777 in modefromsid - smb: client: Fix next buffer leak in receive_encrypted_standard() - nvmet-auth: validate reply message payload bounds against transfer length - bpf: Reject fragmented frames in devmap - bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized - mm/huge_memory: update file PMD counter before folio_put() - sctp: fix uninit-value in __sctp_rcv_asconf_lookup() - smb: client: reject overlapping data areas in SMB2 responses - smb: client: restrict implied bcc[0] exemption to responses without data area - io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item - writeback: drop now-unnecessary rcu_barrier() in cgroup_writeback_umount() - writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() - writeback: Fix use after free in inode_switch_wbs_work_fn() - writeback: Avoid contention on wb->list_lock when switching inodes - block: skip sync_blockdev() on surprise removal in bdev_mark_dead() - mm: do file ownership checks with the proper mount idmap - tracing: Bound synthetic-field strings with seq_buf - perf/core: Detach event groups during remove_on_exec - bpf: Allow LPM map access from sleepable BPF programs - bpf: Consistently use bpf_rcu_lock_held() everywhere - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC - udf: validate VAT header length against the VAT inode size - isofs: bound Rock Ridge symlink components to the SL record - udf: validate free block extents against the partition length - config: arm64: update CONFIG_FTRACE_STARTUP_TEST not set - crypto: qat - Return pointer directly in adf_ctl_alloc_resources - crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() - drivers/base/memory: set mem->altmap after successful device registration - serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails - serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero - NFS: Prevent resource leak in nfs_alloc_server() - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr - nfsd: check get_user() return when reading princhashlen - fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode - fbdev: modedb: fix a possible UAF in fb_find_mode() - fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var - power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path - 9p: avoid putting oldfid in p9_client_walk() error path - ocfs2: reject oversized group bitmap descriptors - rpmsg: char: Fix use-after-free on probe error path - fpga: region: fix use-after-free in child_regions_with_firmware() - irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove - pNFS: Fix use-after-free in pnfs_update_layout() - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done - hdlc_ppp: sync per-proto timers before freeing hdlc state - gfs2: fix use-after-free in gfs2_qd_dealloc - exfat: fix potential use-after-free in exfat_find_dir_entry() - bpf: use kvfree() for replaced sysctl write buffer - f2fs: keep atomic write retry from zeroing original data - f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node() - f2fs: validate ACL entry sizes in f2fs_acl_from_disk() - f2fs: fix to round down start offset of fallocate for pin file - f2fs: validate compress cache inode only when enabled - wifi: iwlwifi: mvm: fix race condition in PTP removal - wifi: rtw88: usb: fix memory leaks on USB write failures - wifi: rtw88: increase TX report timeout to fix race condition - wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor - wifi: ath11k: fix warning when unbinding - wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S - keys: Pin request_key_auth payload in instantiate paths - KEYS: fix overflow in keyctl_pkey_params_get_2() - err.h: use __always_inline on all error pointer helpers - fbdev: fix use-after-free in store_modes() - NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR - apparmor: mediate the implicit connect of TCP fast open sendmsg - net: skmsg: preserve sg.copy across SG transforms - mac802154: llsec: add skb_cow_data() before in-place crypto - af_unix: Set gc_in_progress to true in unix_gc(). - ntfs3: reject direct userspace writes to reserved $LX* xattrs - ipv4: account for fraggap on the paged allocation path - inet: add indirect call wrapper for getfrag() calls - ipv6: account for fraggap on the paged allocation path - batman-adv: tvlv: avoid race of cifsnotfound handler state - batman-adv: tvlv: enforce 2-byte alignment - batman-adv: dat: prevent false sharing between VLANs - batman-adv: tt: track roam count per VID - batman-adv: tt: don't merge change entries with different VIDs - batman-adv: tp_meter: handle overlapping packets - batman-adv: tp_meter: prevent parallel modifications of last_recv - batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE - batman-adv: tp_meter: restrict number of unacked list entries - batman-adv: v: prevent OGM aggregation on disabled hardif - batman-adv: frag: avoid underflow of TTL - batman-adv: frag: ensure fragment is writable before modifying TTL - batman-adv: fix (m|b)cast csum after decrementing TTL - batman-adv: ensure bcast is writable before modifying TTL - batman-adv: tp_meter: initialize last_recv_time during init - batman-adv: prevent ELP transmission interval underflow - batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE - batman-adv: tp_meter: add only finished tp_vars to lists - batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection - batman-adv: tp_meter: fix fast recovery precondition - batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd - batman-adv: tp_meter: avoid window underflow - batman-adv: tp_meter: initialize dec_cwnd explicitly - batman-adv: tp_meter: initialize dup_acks explicitly - batman-adv: tp_meter: keep unacked list in ascending ordered - eventpoll: rename ep_remove_safe() back to ep_remove() - file: add fput() cleanup helper - media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si - ksmbd: reject non-VALID session in compound request branch - scripts/sorttable: Fix endianness handling in build-time mcount sort - scripts/sorttable: Allow matches to functions before function entry - scripts/sorttable: Use normal sort if theres no relocs in the mcount section - ftrace: Check against is_kernel_text() instead of kaslr_offset() - ftrace: Test mcount_loc addr before calling ftrace_call_addr() - ftrace: Do not over-allocate ftrace memory - ftrace: Have ftrace pages output reflect freed pages - ftrace: Update the mcount_loc check of skipped entries - scripts/sorttable: Zero out weak functions in mcount_loc table - scripts/sorttable: Always use an array for the mcount_loc sorting - scripts/sorttable: Have mcount rela sort use direct values - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 - scripts/sorttable: Use a structure of function pointers for elf helpers - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly - scripts/sorttable: Move code from sorttable.h into sorttable.c - scripts/sorttable: Use uint64_t for mcount sorting - scripts/sorttable: Add helper functions for Elf_Sym - scripts/sorttable: Add helper functions for Elf_Shdr - scripts/sorttable: Add helper functions for Elf_Ehdr - scripts/sorttable: Convert Elf_Sym MACRO over to a union - scripts/sorttable: Replace Elf_Shdr Macro with a union - scripts/sorttable: Convert Elf_Ehdr to union - scripts/sorttable: Make compare_extable() into two functions - scripts/sorttable: Have the ORC code use the _r() functions to read - scripts/sorttable: Remove unneeded Elf_Rel - scripts/sorttable: Remove unused write functions - scripts/sorttable: Remove unused macro defines - fuse: re-lock request before replacing page cache folio - slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD - slimbus: qcom-ngd-ctrl: Fix up platform_driver registration - rxrpc: Fix the ACK parser to extract the SACK table for parsing - net: phonet: free phonet_device after RCU grace period - phonet: Pass net and ifindex to phonet_address_notify(). - phonet: Pass ifindex to fill_addr(). - Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs - hv: utils: handle and propagate errors in kvp_register - regulator: core: fix locking in regulator_resolve_supply() error path - ring-buffer: Remove ring_buffer_read_prepare_sync() - selftests/bpf: Update comments find_equal_scalars->sync_linked_regs - af_unix: Reject SIOCATMARK on non-stream sockets - selftests/bpf: Add test to ensure kprobe_multi is not sleepable - agp/amd64: Fix broken error propagation in agp_amd64_probe() - net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() - i2c: stub: Reject I2C block transfers with invalid length - RDMA/bnxt_re: zero shared page before exposing to userspace - KVM: VMX: Update SVI during runtime APICv activation - ARM: fix branch predictor hardening - ARM: fix hash_name() fault - ARM: allow __do_kernel_fault() to report execution of memory faults - ARM: group is_permission_fault() with is_translation_fault() - debugobjects: Dont call fill_pool() in early boot hardirq context - debugobjects: Do not fill_pool() if pi_blocked_on - debugobjects: Use LD_WAIT_CONFIG instead of LD_WAIT_SLEEP - debugobjects: Allow to refill the pool before SYSTEM_SCHEDULING - batman-adv: tt: prevent TVLV entry number overflow - drm/v3d: Skip CSD when it has zeroed workgroups - drm/v3d: Store the active job inside the queue's state - iov_iter: Fix potential underflow in iov_iter_extract_xarray_pages() - urma: add check type in free driver obj - smb: client: fix double-free in SMB2_close() replay - smb: client: fix double-free in SMB2_flush() replay - smb: client: fix query_info() replay double-free - smb: client: fix query directory replay double-free - smb: client: fix double-free in SMB2_open() replay - smb: client: fix double-free in SMB2_ioctl() replay - smb: client: fix change notify replay double-free - HID: lg-g15: cancel pending work on remove to fix a use-after-free - HID: multitouch: fix out-of-bounds bit access on mt_io_flags - tracing: Prevent out-of-bounds read in glob matching - sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT - !25616 sync CVE LTS and bugfix from OLK-6.6 b72db20c0437 to d33ffc8f8580 - KVM: x86: hyper-v: Bound the bank index when querying sparse banks - MIPS: DEC: Prevent initial console buffer from landing in XKPHYS - ksmbd: fix durable reconnect error path file lifetime - ksmbd: fix use-after-free in smb2_open during durable reconnect - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query - USB: iowarrior: fix use-after-free on disconnect race - usb: iowarrior: remove inherent race with minor number - USB: iowarrior: fix use-after-free on disconnect - apparmor: fix use-after-free in rawdata dedup loop - tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR - bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops - rbd: eliminate a race in lock_dwork draining on unmap - blk-cgroup: fix UAF in __blkcg_rstat_flush() - net: Fix kabi breakage of struct tc_action - net/sched: act_api: use RCU with deferred freeing for action lifecycle - net: Fix kabi breakage of struct header_ops - bonding: prevent potential infinite loop in bond_header_parse() - bonding: fix type confusion in bond_setup_by_slave() - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc - ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL - ASoC: cs35l56: Fix missing calls to wm_adsp2_remove() - time: Fix off-by-one in compat settimeofday() usec validation - scsi: target: Fix hexadecimal CHAP_I handling - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink - ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY - ksmbd: add a permission check for FSCTL_SET_ZERO_DATA - ksmbd: add per-handle permission check to FILE_LINK_INFORMATION - mptcp: fix missing wakeups in edge scenarios - mptcp: add-addr: always drop other suboptions - ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 - RDMA/umem: fix kernel-doc warnings - mm/migrate: don't call folio_putback_active_hugetlb() on dst hugetlb folio - usb: typec: ucsi: Don't update power_supply on power role change if not connected - serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() - thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() - usb: typec: ucsi: Check if power role change actually happened before handling - usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind - usb: dwc3: xilinx: fix error handling in zynqmp init error paths - usb: musb: omap2430: Fix use-after-free in omap2430_probe() - tty: serial: samsung: Remove redundant port lock acquisition in rx helpers - tty: serial: samsung: use u32 for register interactions - serial: samsung_tty: Use port lock wrappers - ALSA: firewire-motu: Protect register DSP event queue positions - memfd: deny writeable mappings when implying SEAL_WRITE - iio: dac: ad5686: fix ref bit initialization for single-channel parts - usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure - iio: chemical: scd30: fix division by zero in write_raw - iio: chemical: scd30: Use guard(mutex) to allow early returns - iio: gyro: adis16260: fix division by zero in write_raw - Bluetooth: hci_qca: Convert timeout from jiffies to ms - Bluetooth: hci_qca: Migrate to serdev specific shutdown function - serdev: Provide a bustype shutdown function - serdev: make serdev_bus_type const - mm/damon/sysfs-schemes: delete tried region in regions_rmdirs() - mptcp: do not drop partial packets - mptcp: introduce the mptcp_init_skb helper - iio: adc: npcm: fix unbalanced clk_disable_unprepare() - iio: adc: npcm: Convert to platform remove callback returning void - octeontx2-pf: avoid double free of pool->stack on AQ init failure - af_unix: Fix UAF read of tail->len in unix_stream_data_wait() - af_unix: Cache state->msg in unix_stream_read_generic(). - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg - net: hsr: defer node table free until after RCU readers - mptcp: pm: fix ADD_ADDR timer infinite retry on option space insufficient - ice: fix VF queue configuration with low MTU values - mptcp: reset rcv wnd on disconnect - mptcp: cleanup fallback dummy mapping generation - octeontx2-af: CGX: add bounds check to cgx_speed_mbps index - octeontx2-af: replace deprecated strncpy with strscpy - cgroup/cpuset: Reset DL migration state on can_attach() failure - fbdev/vt8500lcdfb: Initialize fb_ops with fbdev macros - soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get() - driver core: reject devices with unregistered buses - drm/amd/display: Use krealloc_array() in dal_vector_reserve() - drm/amdgpu: restart the CS if some parts of the VM are still invalidated - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 - drm/amdkfd: fix NULL dereference in get_queue_ids() - slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock - slimbus: qcom-ngd-ctrl: fix OF node refcount - thunderbolt: Limit XDomain response copy to actual frame size - sctp: stream: fully roll back denied add-stream state - mmc: sdhci: add signal voltage switch in sdhci_resume_host - mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC - mmc: litex_mmc: Set mandatory idle clocks before CMD0 - mmc: core: Fix host controller programming for fixed driver type - mm/hugetlb: restore reservation on error in hugetlb folio copy paths - octeontx2-af: fix memory leak in rvu_setup_hw_resources() - nvmem: layouts: onie-tlv: fix hang on unknown types - net: rds: clear i_sends on setup unwind - net: mv643xx: fix OF node refcount - net/mlx5: Reorder completion before putting command entry in cmd_work_handler - misc: fastrpc: fix use-after-free race in fastrpc_map_create - misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context - Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard - i2c: tegra: Fix NOIRQ suspend/resume - i2c: stm32f7: fix timing computation ignoring i2c-analog-filter - i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() - pidfd: refuse access to tasks that have started exiting harder - ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write - vsock/vmci: fix sk_ack_backlog leak on failed handshake - wifi: nl80211: reject oversized EMA RNR lists - selftests: mptcp: add test for extra_subflows underflow on userspace PM - mptcp: sockopt: check timestamping ret value - mptcp: allow subflow rcv wnd to shrink - mptcp: close TOCTOU race while computing rcv_wnd - mptcp: fix retransmission loop when csum is enabled - ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow - ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O - ARM: socfpga: Fix OF node refcount leak in SMP setup - mm/damon/ops-common: call folio_test_lru() after folio_get() - drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info() - ALSA: timer: Fix UAF at snd_timer_user_params() - USB: serial: option: add usb-id for Dell Wireless DW5826e-m - xfrm: espintcp: do not reuse an in-progress partial send - ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL - mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation - tracing/probes: Point the error offset correctly for eprobe argument error - netfilter: nft_tunnel: fix use-after-free on object destroy - clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time - net: mvpp2: build skb from XDP-adjusted data on XDP_PASS - net: mvpp2: refill RX buffers before XDP or skb use - net: mvpp2: Add metadata support for xdp mode - netfilter: nf_log: validate MAC header was set before dumping it - rds: mark snapshot pages dirty in rds_info_getsockopt() - net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion - r8152: handle the return value of usb_reset_device() - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove - net: phy: clean the sfp upstream if phy probing fails - net/mlx4: avoid GCC 10 __bad_copy_from() false positive - ASoC: wm_adsp: Fix NULL dereference when removing firmware controls - arm64: tlb: Allow XZR argument to TLBI ops - KVM: arm64: Remove VPIPT I-cache handling - tools/rv: Fix cleanup after failed trace setup - time: Fix off-by-one in settimeofday() usec validation - ipmi: Fix rcu_read_unlock to srcu_read_unlock in handle_read_event_rsp - ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() - vxlan: vnifilter: fix spurious notification on VNI update - vxlan: vnifilter: send notification on VNI add - octeontx2-af: npc: Fix CPT channel mask in npc_install_flow - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown - ptp: vclock: Switch from RCU to SRCU - net: fec: fix pinctrl default state restore order on resume - net: lan743x: permit VLAN-tagged packets up to configured MTU - net: garp: fix unsigned integer underflow in garp_pdu_parse_attr - hsr: Remove WARN_ONCE() in hsr_addr_is_self(). - net: Annotate sk->sk_write_space() for UDP SOCKMAP. - pcnet32: stop holding device spin lock during napi_complete_done - drm/imx: Fix three kernel-doc warnings in dcss-scaler.c - 6lowpan: fix off-by-one in multicast context address compression - netfilter: xt_NFQUEUE: prefer raw_smp_processor_id - tee: optee: prevent use-after-free when the client exits before the supplicant - net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS - Disable -Wattribute-alias for clang-23 and newer - RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug - USB: serial: mct_u232: fix memory corruption with small endpoint - usb: core: Fix SuperSpeed root hub wMaxPacketSize - serial: zs: Convert to use a platform device - serial: dz: Convert to use a platform device - serial: dz: Fix bootconsole handover lockup - xhci: tegra: Fix ghost USB device on dual-role port unplug - USB: serial: digi_acceleport: fix memory corruption with small endpoints - landlock: Fix handling of disconnected directories - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync - USB: serial: cypress_m8: fix memory corruption with small endpoint - serial: zs: Switch to using channel reset - serial: zs: Fix bootconsole handover lockup - serial: dz: Fix bootconsole message clobbering at chip reset - drm/amdkfd: Check for pdd drm file first in CRIU restore path - drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger - drm/amdkfd: fix NULL pointer bug in svm_range_set_attr - serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma - serial: zs: Fix swapped RI/DSR modem line transition counting - serial: sh-sci: fix memory region release in error path - serial: qcom-geni: fix UART_RX_PAR_EN bit position - serial: altera_jtaguart: handle uart_add_one_port() failures - drm/amd/pm/si: Disregard vblank time when no displays are connected - drm/i915: Fix potential UAF in TTM object purge - drm/hyperv: validate VMBus packet size in receive callback - drm/hyperv: validate resolution_count and fix WIN8 fallback - scsi: target: iscsi: Validate CHAP_R length before base64 decode - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 - scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker - thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow - thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() - usb: gadget: f_fs: copy only received bytes on short ep0 read - usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports - usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling - usb: gadget: f_hid: fix device reference leak in hidg_alloc() - usb: gadget: net2280: Fix double free in probe error path - USB: serial: mct_u232: fix missing interrupt-in transfer sanity check - USB: serial: mxuport: fix memory corruption with small endpoint - USB: serial: keyspan: fix missing indat transfer sanity check - USB: serial: cypress_m8: validate interrupt packet headers - USB: serial: belkin_sa: validate interrupt status length - USB: serial: option: add MeiG SRM813Q - usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize - usb: usbtmc: check URB actual_length for interrupt-IN notifications - usbip: vudc: Fix use after free bug in vudc_remove due to race condition - usb: storage: Add quirks for PNY Elite Portable SSD - USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers - usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval - usb: chipidea: core: convert ci_role_switch to local variable - tty: serial: pch_uart: add check for dma_alloc_coherent() - counter: Fix refcount leak in counter_alloc() error path - comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() - comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() - Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 - Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem - Input: xpad - add support for ASUS ROG RAIKIRI II - Input: xpad - add "Nova 2 Lite" from GameSir - ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks - ASoC: qcom: q6asm-dai: close stream only when running - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check - xfrm: ah: use skb_to_full_sk in async output callbacks - xfrm: route MIGRATE notifications to caller's netns - nfc: hci: fix out-of-bounds read in HCP header parsing - iommu, debugobjects: avoid gcc-16.1 section mismatch warnings - HID: wacom: Fix OOB write in wacom_hid_set_device_mode() - ip6: vti: Use ip6_tnl.net in vti6_changelink(). - xfrm: input: hold netns during deferred transport reinjection - ipv6: validate extension header length before copying to cmsg - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). - ipv6: exthdrs: refresh nh after handling HAO option - ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() - macsec: fix replay protection at XPN lower-PN wrap - bpf: sockmap: fix tail fragment offset in bpf_msg_push_data - Input: elan_i2c - validate firmware size before use - usb: dwc2: Fix use after free in debug code - usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles - usb: cdns3: gadget: fix request skipping after clearing halt - USB: serial: omninet: fix memory corruption with small endpoint - iio: buffer: hw-consumer: fix use-after-free in error path - iio: light: cm3323: fix reg_conf not being initialized correctly - iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL - iio: temperature: tsys01: fix broken PROM checksum validation - iio: ssp_sensors: cancel delayed work_refresh on remove - iio: gyro: itg3200: fix i2c read into the wrong stack location - iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw - iio: dac: ad5686: acquire lock when doing powerdown control - iio: dac: ad5686: fix input raw value check - iio: dac: max5821: fix return value check in powerdown sync - iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux - wireguard: send: append trailer after expanding head - KVM: arm64: PMU: Preserve AArch32 counter low bits - parport: Fix race between port and client registration - Input: xpad - fix out-of-bounds access for Share button - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock - Bluetooth: ISO: fix UAF in iso_recv_frame - Bluetooth: HIDP: fix missing length checks in hidp_input_report() - auxdisplay: line-display: fix OOB read on zero-length message_store() - hpfs: fix a crash if hpfs_map_dnode_bitmap fails - Bluetooth: btusb: Allow firmware re-download when version matches - HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse - Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() - USB: serial: safe_serial: fix memory corruption with small endpoint - usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT - usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() - usb: typec: altmodes/displayport: validate count before reading Status Update VDO - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO - usb: typec: ucsi: ccg: reject firmware images without a ':' record header - iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer - soc/tegra: pmc: Fix unsafe generic_handle_irq() call - hwmon: (pmbus/adm1266) serialize NVMEM blackbox read with pmbus_lock - hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock - of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() - phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X - drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used - drm/dp: Add eDP 1.5 bit definition - drm/i915/psr: Read Intel DPCD workaround register - drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register - media: rc: fix race between unregister and urb/irq callbacks - batman-adv: bla: avoid double decrement of bla.num_requests - batman-adv: tt: avoid empty VLAN responses - batman-adv: tt: fix TOCTOU race for reported vlans - batman-adv: tp_meter: directly shut down timer on cleanup - batman-adv: tp_meter: avoid role confusion in tp_list - batman-adv: iv: recover OGM scheduling after forward packet error - batman-adv: tvlv: reject oversized TVLV packets - batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface - batman-adv: tt: reject oversized local TVLV buffers - batman-adv: tvlv: abort OGM send on tvlv append failure - net: skbuff: fix pskb_carve leaking zcopy pages - ipv6: fix possible infinite loop in fib6_select_path() - ipv6: fix possible infinite loop in rt6_fill_node() - sctp: fix race between sctp_wait_for_connect and peeloff - net: mana: Add NULL guards in teardown path to prevent panic on attach failure - gpio: rockchip: convert bank->clk to devm_clk_get_enabled() - Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() - ethtool: eeprom: add more safeties to EEPROM Netlink fallback - ethtool: eeprom: add missing ethnl_ops_begin() / _complete() during fallback - bonding: refuse to enslave CAN devices - Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() - ASoC: codecs: simple-mux: Fix enum control bounds check - ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() - gpio: mxc: fix irq_high handling - net: hsr: fix potential OOB access in supervision frame handling - ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues - net/iucv: fix locking in .getsockopt - net/smc: Do not re-initialize smc hashtables - net: netlink: don't set nsid on local notifications - net: netlink: fix sending unassigned nsid after assigned one - vsock: keep poll shutdown state consistent - netfilter: nf_tables: fix dst corruption in same register operation - netfilter: bitwise: add support for doing AND, OR and XOR directly - netfilter: bitwise: rename some boolean operation functions - netfilter: ebtables: fix OOB read in compat_mtw_from_user - netfilter: xt_cpu: prefer raw_smp_processor_id - netfilter: synproxy: refresh tcphdr after skb_ensure_writable - xfrm: Check for underflow in xfrm_state_mtu - nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() - nfc: llcp: Fix use-after-free in llcp_sock_release() - net: cpsw_new: Fix potential unregister of netdev that has not been registered yet - drm: Remove plane hsub/vsub alignment requirement for core helpers - net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net: mctp: ensure our nlmsg responses are initialised - Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size - MIPS: smp: report dying CPU to RCU in stop_this_cpu() - LoongArch: Report dying CPU to RCU in stop_this_cpu() - irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT - tls: Flush backlog before waiting for a new record - net: ethernet: cortina: No mapping is a dropped rx - batman-adv: fix batadv_skb_is_frag() kernel-doc - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled - Bluetooth: ISO: fix malformed ISO_END/CONT handling - Bluetooth: MGMT: Fix backward compatibility with userspace - security/keys: fix missed RCU read section on lookup - LoongArch: kprobes: Fix handling of fatal unrecoverable recursions - pds_core: ensure null-termination for firmware version strings - pds_core: add an error code check in pdsc_dl_info_get - net: mana: validate rx_req_idx to prevent out-of-bounds array access - ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove() - gpio: cdev: check if uAPI v2 config attributes are correctly zeroed - gpiolib: cdev: use !mem_is_zero() instead of memchr_inv(s, 0, n) - string: add mem_is_zero() helper to check if memory area is all zeros - bpf, skmsg: fix verdict sk_data_ready racing with ktls rx - net: ag71xx: check error for platform_get_irq - Bluetooth: btmtk: rename btmediatek_data - Bluetooth: btusb: mediatek: refactor the function btusb_mtk_reset - Bluetooth: btmtk: add the function to get the fw name - ALSA: seq: Serialize UMP output teardown with event_input - ALSA: seq: ump: Use guard() for locking - pds_core: fix debugfs_lookup dentry leak and error handling - pds_core: fix error handling in pdsc_devcmd_wait - bridge: mcast: Fix a possible use-after-free when removing a bridge port - net: bridge: Flush multicast groups when snooping is disabled - RDMA/rtrs: Fix use-after-free in path file creation cleanup - platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL - platform/x86: intel-hid: Check ACPI_HANDLE() against NULL - platform/x86: hp_accel: Check ACPI_COMPANION() against NULL - platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer - net: dsa: mt7530: preserve VLAN tags on trapped link-local frames - net: dsa: mt7530: rename mt753x_bpdu_port_fw enum to mt753x_to_cpu_fw - net: dsa: mt7530: fix FDB entries not aging out with short timeout - wifi: ath11k: fix peer resolution on rx path when peer_id=0 - drm/msm/snapshot: fix dumping of the unaligned regions - spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache() - net/mlx5: Do not restore destination-less TC rules - tls: Preserve sk_err across recvmsg() when data has been copied - x86/xen: Fix xen_e820_swap_entry_with_ram() - net: phy: DP83TC811: add reading of abilities - net: phy: c45: add genphy_c45_pma_read_ext_abilities() function - net: tls: prevent chain-after-chain in plain text SG - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot - powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise() - drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN - drm/msm/dsi: don't dump registers past the mapped region - ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics - net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint - accel/qaic: Add overflow check to remap_pfn_range during mmap - HID: quirks: really enable the intended work around for appledisplay - wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm() - wifi: ath11k: fix error path leaks in some WMI WOW calls - net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS reference - net: ethernet: cortina: Carry over frag counter - net: ethernet: cortina: Drop half-assembled SKB - net: ethernet: cortina: Make RX SKB per-port - netfs: Fix overrun check in netfs_extract_user_iter() - zonefs: handle integer overflow in zonefs_fname_to_fno - irqchip/ath79-cpu: Remove unused function - phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access - net: lan966x: avoid unregistering netdev on register failure - ice: fix locking in ice_dcb_rebuild() - tcp: Fix imbalanced icsk_accept_queue count. - test_kprobes: clear kprobes between test runs - kprobes: skip non-symbol addresses in kprobe_add_ksym_blacklist() - netfilter: x_tables: unregister the templates first - ALSA: hda: cs35l56: Put ACPI device after setting companion - ARM: integrator: Fix early initialization - pinctrl: qcom: Fix wakeirq map by removing disconnected irqs for sm8150 - kunit: config: KUNIT_DEBUGFS should depend on DEBUG_FS - kunit: config: Enable KUNIT_DEBUGFS by default - firmware: arm_ffa: Skip free_pages on RX buffer alloc failure - firmware: arm_ffa: Check for NULL FF-A ID table while driver registration - HID: uclogic: Fix regression of input name assignment - hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors - hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe() - hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe() - hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in get_multiple - hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR - hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer - hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer - hwmon: (pmbus/adm1266) reject implausible blackbox record_count - hwmon: (pmbus/adm1266) seed timestamp from the real-time clock - batman-adv: tt: fix negative tt_buff_len - batman-adv: tt: fix negative last_changeset_len - batman-adv: tp_meter: fix race condition in send error reporting - batman-adv: tp_meter: avoid use of uninit sender vars - batman-adv: bla: fix report_work leak on backbone_gw purge - batman-adv: frag: disallow unicast fragment in fragment - batman-adv: fix fragment reassembly length accounting - batman-adv: dat: handle forward allocation error - batman-adv: clear current gateway during teardown - batman-adv: mcast: fix use-after-free in orig_node RCU release - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async - drm/amd/display: Validate GPIO pin LUT table size before iterating - drm/amd/display: Fix integer overflow in bios_get_image() - drm/bridge: megachips: remove bridge when irq request fails - drm/bridge: it66121: acquire reset GPIO in probe - drm/virtio: use uninterruptible resv lock for plane updates - device property: set fwnode->secondary to NULL in fwnode_init() - LoongArch: Remove unused code to avoid build warning - RDMA/siw: Reject MPA FPDU length underflow before signed receive math - spi: ti-qspi: fix use-after-free after DMA setup failure - spi: sprd: fix error pointer deref after DMA setup failure - scsi: isci: Fix use-after-free in device removal path - phy: tegra: xusb: Fix per-pad high-speed termination calibration - spi: qup: fix error pointer deref after DMA setup failure - drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe - KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits - arm64: probes: Handle probes on hinted conditional branch instructions - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() - ice: fix setting promisc mode while adding VID filter - ixgbevf: fix use-after-free in VEPA multicast source pruning - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 - wifi: ath11k: clear shared SRNG pointer state on restart - vsock/vmci: fix UAF when peer resets connection during handshake - ring-buffer: Fix reporting of missed events in iterator - qed: fix double free in qed_cxt_tables_alloc() - netfilter: ipset: stop hash:* range iteration at end - netfilter: nf_queue: hold bridge skb->dev while queued - netfilter: ip6t_hbh: reject oversized option lists - net: ifb: report ethtool stats over num_tx_queues - net: bcmgenet: keep RBUF EEE/PM disabled - phonet/pep: disable BH around forwarded sk_receive_skb() - Bluetooth: MGMT: validate Add Extended Advertising Data length - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths - Bluetooth: bnep: Fix UAF read of dev->name - Bluetooth: ISO: drop ISO_END frames received without prior ISO_START - net: wwan: iosm: fix potential memory leaks in ipc_imem_init() - drivers/base/memory: fix memory block reference leak in poison accounting - efi: Allocate runtime workqueue before ACPI init - ALSA: asihpi: Fix potential OOB array access at reading cache - ALSA: pcm: Don't setup bogus iov_iter for silencing - ALSA: ua101: Reject too-short USB descriptors - hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX - smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() - ksmbd: fix null pointer dereference in compare_guid_key() - mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break() - sysfs: don't remove existing directory on update failure - Revert "af_unix: Reject SIOCATMARK on non-stream sockets" - Revert "s390/cio: Update purge function to unregister the unused subchannels" - Revert "ice: Remove jumbo_remove step from TX path" - Revert "ice: fix double-free of tx_buf skb" - Revert "x86/vdso: Fix output operand size of RDPID" - wifi: mac80211: check tdls flag in ieee80211_tdls_oper - s390/debug: Reject zero-length input before trimming a newline - mptcp: pm: ADD_ADDR rtx: free sk if last - mptcp: sync the msk->sndbuf at accept() time - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close - netfilter: revalidate bridge ports - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp - net: bonding: fix NULL pointer dereference in bond_do_ioctl() - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() - udp: clear skb->dev before running a sockmap verdict - crypto: nx - Fix packed layout in struct nx842_crypto_header - crypto: nx - Use static_assert() to check struct sizes - batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown - Revert "ALSA: pcmtest: fix reference leak on failed device registration" - media: rc: ttusbir: fix inverted error logic - media: rc: igorplugusb: fix control request setup packet - batman-adv: tp_meter: fix tp_num leak on kmalloc failure - batman-adv: stop tp_meter sessions during mesh teardown - ALSA: seq: Fix UMP group 16 filtering - ALSA: seq: Notify client and port info changes - ALSA: core: Serialize deferred fasync state checks - ALSA: misc: Use guard() for spin locks - ALSA: hda: cs35l56: Propagate ASP TX source control errors - crypto: nx - Avoid -Wflex-array-member-not-at-end warning - ksmbd: reset rcount per connection in ksmbd_conn_wait_idle_sess_id() - media: rc: igorplugusb: heed coherency rules - ALSA: aoa: Skip devices with no codecs in i2sbus_resume() - media: rc: ttusbir: respect DMA coherency rules - ALSA: aoa: i2sbus: clear stale prepared state - ALSA: aoa: Use guard() for mutex locks - f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally - ksmbd: replace connection list with hash table - ksmbd: use msleep instaed of schedule_timeout_interruptible() - f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io() - smb: move some duplicate definitions to common/smbacl.h - iommu/amd: serialize sequence allocation under concurrent TLB invalidations - x86/shstk: Prevent deadlock during shstk sigreturn - ALSA: pcmtest: Fix resource leaks in module init error paths - ALSA: pcmtest: fix reference leak on failed device registration - ALSA: 6fire: Fix input volume change detection - ALSA: caiaq: Fix control_put() result and cache rollback - ALSA: core: Fix potential data race at fasync handling - Revert "ALSA: usb-audio: Cap the packet size pre-calculations" - ipv6: sit: reload inner IPv6 header after GSO offloads - net: guard timestamp cmsgs to real error queue skbs - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() - netfilter: x_tables: avoid leaking percpu counter pointers - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush - netfilter: require Ethernet MAC header before using eth_hdr() - netfilter: nft_fib: fix stale stack leak via the OIFNAME register - vsock/virtio: reset connection on receiving queue overflow - vsock/virtio: fix skb overhead accounting to preserve full buf_alloc - vsock/virtio: fix potential unbounded skb queue - mptcp: pm: ADD_ADDR rtx: always decrease sk refcount - mptcp: pm: ADD_ADDR rtx: allow ID 0 - ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers - srcu: Use irq_work to start GP in tiny SRCU - irqwork: Move data struct to a types header - types: move struct rcuwait into types.h - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets - wifi: iwlwifi: fix 22000 series SMEM parsing - wifi: iwlwifi: allow IWL_FW_CHECK() with just a string - x86: shadow stacks: proper error handling for mmap lock - net: mvpp2: sync RX data at the hardware packet offset - net: mvpp2: limit XDP frame size to the RX buffer - batman-adv: fix tp_meter counter underflow during shutdown - batman-adv: v: stop OGMv2 on disabled interface - ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger - spi: mpc52xx: fix controller deregistration - thunderbolt: Bound root directory content to block size - selinux: fix overlayfs mmap() and mprotect() access checks - lsm: add backing_file LSM hooks - fs: constify file ptr in backing_file accessor helpers - fs: prepare for adding LSM blob to backing_file - selftests/bpf: Add tests for ld_{abs,ind} failure path in subprogs - bpf: Fix ld_{abs,ind} failure path analysis in subprogs - KVM: x86: Fix shadow paging use-after-free due to unexpected role - Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref - Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() - fix kabi for ppp_defs.h - pppoe: drop PFC frames - netfilter: nat: use kfree_rcu to release ops - drm/i915/gem: Fix phys BO pread/pwrite with offset - selinux: allow multiple opens of /sys/fs/selinux/policy - ksmbd: make ksmbd thread names distinct by client IP - ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path - ALSA: caiaq: Don't abort when no input device is available - ALSA: caiaq: fix usb_dev refcount leak on probe failure - ALSA: caiaq: Handle probe errors properly - ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow - USB: cdc-acm: Fix bit overlap and move quirk definitions to header - ALSA: caiaq: take a reference on the USB device in create_card() - ALSA: usb-audio: apply quirk for MOONDROP JU Jiu - ksmbd: use check_add_overflow() to prevent u16 DACL size overflow - ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment - smb: server: fix max_connections off-by-one in tcp accept path - smb: server: fix active_num_conn leak on transport allocation failure - usb: port: add delay after usb_hub_set_port_power() - USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen - usb: storage: Expand range of matched versions for VL817 quirks entry - xfrm: Wait for RCU readers during policy netns exit - KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing - mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison - thunderbolt: Clamp XDomain response data copy to allocation size - bpf: return VMA snapshot from task_vma iterator - bpf: switch task_vma iterator from mmap_lock to per-VMA locks - bpf: fix mm lifecycle in open-coded task_vma iterator - netfilter: nft_ct: bail out on template ct in get eval - drm/amd/display: Bound VBIOS record-chain walk loops - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size - drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() - netfilter: conntrack_irc: fix possible out-of-bounds read - drm/vc4: fix krealloc() memory leak - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error - f2fs: fix data loss caused by incorrect use of nat_entry flag - bnxt_en: Fix NULL pointer dereference - ipv6: mcast: Fix use-after-free when processing MLD queries - ipvs: clear the svc scheduler ptr early on edit - netfilter: synproxy: add mutex to guard hook reference counting - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list - net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr - netlabel: validate unlabeled address and mask attribute lengths - netfilter: bridge: make ebt_snat ARP rewrite writable - tcp: restrict SO_ATTACH_FILTER to priv users - ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER - Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig - misc: fastrpc: fix DMA address corruption due to find_vma misuse - misc: fastrpc: Fix NULL pointer dereference in rpmsg callback - gpio: mvebu: fix NULL pointer dereference in suspend/resume - Bluetooth: fix memory leak in error path of hci_alloc_dev() - Bluetooth: bnep: reject short frames before parsing - Bluetooth: RFCOMM: validate skb length in MCC handlers - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams - RDMA/srp: bound SRP_RSP sense copy by the received length - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN - net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure - sched/psi: fix race between file release and pressure write - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase - rculist: add list_splice_rcu() for private lists - net: skbuff: fix missing zerocopy reference in pskb_carve helpers - ip6_vti: set netns_immutable on the fallback device. - wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() - wifi: rtw88: debugfs: support multiple adapters debugging - erofs: fix use-after-free on sbi->sync_decompress - net: openvswitch: fix possible kfree_skb of ERR_PTR - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() - md: wake raid456 reshape waiters before suspend - dm cache policy smq: check allocation under invalidate lock - Bluetooth: MGMT: validate advertising TLV before type checks - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend - USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL - USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam - USB: serial: option: add support for Rolling Wireless RW135R-GL - USB: serial: io_edgeport: add support for Blackbox IC135A - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr - netfilter: flowtable: strictly check for maximum number of actions - fuse: reject fuse_notify() pagecache ops on directories - fs/mbcache: cancel shrink work before destroying the cache - smb/client: fix possible infinite loop and oob read in symlink_data() - fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp - ata: libata-scsi: do not needlessly defer commands when using PMP with FBS - ata: libata-scsi: do not use the deferred QC feature on PMPs with CBS - ata: libata-scsi: do not use the deferred QC feature for ATA_DEFER_PORT - ata: libata-scsi: improve readability of ata_scsi_qc_issue() - ata: libata-scsi: fix requeue of deferred ATA PASS-THROUGH commands - ata: libata-eh: Fix detection of deferred qc timeouts - ata: libata: cancel pending work after clearing deferred_qc - ata: libata-core: fix cancellation of a port deferred qc work - ata: libata-scsi: rename and improve ata_qc_done() - ata: libata-scsi: simplify ata_scsi_requeue_deferred_qc() - ata: libata-sata: simplify ata_sas_queuecmd() - ata: libata-core: improve tag checks in ata_qc_issue() - ata: libata-eh: correctly handle deferred qc timeouts - ata: libata-scsi: avoid Non-NCQ command starvation - ata: libata: Introduce ata_port_eh_scheduled() - ext4: handle wraparound when searching for blocks for indirect mapped blocks - ext4: fix error pointer dereference in ext4_mb_load_buddy_gfp() - ext4: always allocate blocks only from groups inode can use - ext4: fix e4b bitmap inconsistency reports - ext4: convert bd_buddy_page to bd_buddy_folio - ext4: convert bd_bitmap_page to bd_bitmap_folio - Revert "ext4: fix e4b bitmap inconsistency reports" - ext4: cleanup for ext4_map_blocks - ext4: rename EXT4_GET_BLOCKS_PRE_IO - ext4: drop extent cache when splitting extent fails - ext4: drop extent cache after doing PARTIAL_VALID1 zeroout - ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O - ext4: correct the comments place for EXT4_EXT_MAY_ZEROOUT - ext4: get rid of ppath in ext4_ext_handle_unwritten_extents() - ext4: get rid of ppath in ext4_ext_convert_to_initialized() - ext4: get rid of ppath in ext4_split_convert_extents() - ext4: get rid of ppath in ext4_split_extent() - ext4: get rid of ppath in ext4_force_split_extent_at() - ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 - ext4: subdivide EXT4_EXT_DATA_VALID1 - Revert "ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O" - ext4: get rid of ppath in ext4_split_extent_at() - ext4: get rid of ppath in ext4_ext_insert_extent() - ext4: get rid of ppath in get_ext_path() - ext4: add new ext4_ext_path_brelse() helper - !24596 [sync]urma: fix workqueue use-after-free in ubagg_exit teardown sequence - urma: fix workqueue use-after-free in ubagg_exit teardown sequence - !24607 ub: udma: Optimize udma jetty id access logic. - ub: udma: Optimize udma jetty id access logic. - !24640 [sync]urma: limit ubcore logs in reuse paths - urma: fix workqueue use-after-free in ubagg_exit teardown sequence - !24669 mm/madvise: add MADV_FCMA_ENABLE to set PF_FOLIO_CMA via madvise - mm/madvise: add MADV_FCMA_ENABLE to set PF_FOLIO_CMA via madvise - !24702 [sync]urma: retry import jetty/jfr on EIO from tpid reuse failure - urma: retry import jetty/jfr on EIO from tpid reuse failure - urma: limit ubagg connect exchange logs * Fri Jul 10 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-145.3.18.151.20260710.aae66044906b - !24753 [sync]urma: drain jfe event lists in batches to avoid soft-lockup - urma: drain jfe event lists in batches to avoid soft-lockup - urma: reduce ubagg topo log noise - !24748 [sync]urma: free completion events outside jfe lock - urma: free jfe events outside lock - urma: free completion events outside jfe lock - !24742 urma: Fix the issue of inaccurate timing for some functions in DFX - !24741 [sync]urma: fix UAF of accessing token_id in log. - urma: Fix the issue of inaccurate timing for some functions in DFX - urma: fix UAF of accessing token_id in log. - !24734 [sync]urma: fix tpid_reuse attached to vtpn causes use_after_free - urma: fix tpid_reuse attached to vtpn causes use_after_free - !24804 [sync]urma: use vzalloc for ubmad tjetty and ini_rtbuffer - !24774 [sync]urma: ratelimit import jetty/jfr error logs - urma: use vzalloc for ubmad tjetty and ini_rtbuffer - !24792 [sync]urma: fix UAF of accessing jfs/jetty in log. - urma: fix UAF of accessing jfs/jetty in log. - urma: ratelimit import jetty/jfr error logs - !24845 [sync]ub/ubdevshm: Support for acquiring va is a sub-range of registered va - ub/ubdevshm: Support for acquiring va is a sub-range of registered va - !24802 [sync]urma: use xarray for ubagg/ubcore session lookup - urma: use xarray for ubagg/ubcore session lookup - !24814 [sync]urma: make ratelimit burst configurable for ubcore/uburma/ubagg - urma: make ratelimit burst configurable for ubcore/uburma/ubagg * Wed Jul 22 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-145.3.22.153.20260722.158daf1d8dea - !24942 [sync]urma: drop param_set_uint_minmax for ratelimit burst setters - urma: drop param_set_uint_minmax for ratelimit burst setters - !25840 sync CVE LTS and bugfix from OLK-6.6 d33ffc8f8580 to 334dfd575ba5 - cgroup/rstat: avoid disabling irqs for O(num_cpu) - netfilter: bridge: eb_tables: close module init race - crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents - netfilter: ebtables: move to two-stage removal scheme - crypto: qat - protect service table iterations with service_lock - Bluetooth: eir: Fix stack OOB write when prepending the Flags AD - drm/edid: fix OOB read in drm_parse_tiled_block() - proc: protect ptrace_may_access() with exec_update_lock (FD links) - vfio/pci: Latch disable_idle_d3 per device - bpf: Fix UAF in sock clone early bailouts - bpf: Disable xfrm_decode_session hook attachment - bpf,fork: wipe ->bpf_storage before bailouts that access it - KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() - crypto: qat - validate RSA CRT component lengths - bpf: Clear rb node linkage when freeing bpf_rb_root - bpf: Add validation for bpf_set_retval argument - bpf: Reject sleepable BPF_LSM_CGROUP programs at load time - bpf: Fix setting retval to -EPERM for cgroup hooks not returning errno - bpf: Guard __get_user acesss with access_ok for uprobe_multi data - i2c: core: fix adapter registration race - ALSA: hda/cs35l41: Fix firmware load work teardown - vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc - iommufd: Break the loop on failure in iommufd_fault_fops_read() - posix-cpu-timers: Prevent UAF caused by non-leader exec() race - iio: event: Fix event FIFO reset race - hwrng: virtio: clamp device-reported used.len at copy_data() - crypto: drbg - Fix returning success on failure in CTR_DRBG - crypto: ecc - Fix carry overflow in vli multiplication - crypto: pcrypt - restore callback for non-parallel fallback - net: openvswitch: reject oversized nested action attrs - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page - e1000e: Fix out-of-bounds MMIO access by validating BAR0 size - xsched: enforce permissions on attribute access - xsched: restrict vstream management to privileged users - rme: use DMA API for virtio in realm world - udf: validate sparing table length as an entry count, not a byte count - smb: client: harden POSIX SID length parsing - smb: client: mask server-provided mode to 07777 in modefromsid - smb: client: Fix next buffer leak in receive_encrypted_standard() - nvmet-auth: validate reply message payload bounds against transfer length - bpf: Reject fragmented frames in devmap - bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized - mm/huge_memory: update file PMD counter before folio_put() - sctp: fix uninit-value in __sctp_rcv_asconf_lookup() - smb: client: reject overlapping data areas in SMB2 responses - smb: client: restrict implied bcc[0] exemption to responses without data area - io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item - writeback: drop now-unnecessary rcu_barrier() in cgroup_writeback_umount() - writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() - writeback: Fix use after free in inode_switch_wbs_work_fn() - writeback: Avoid contention on wb->list_lock when switching inodes - block: skip sync_blockdev() on surprise removal in bdev_mark_dead() - mm: do file ownership checks with the proper mount idmap - tracing: Bound synthetic-field strings with seq_buf - perf/core: Detach event groups during remove_on_exec - bpf: Allow LPM map access from sleepable BPF programs - bpf: Consistently use bpf_rcu_lock_held() everywhere - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC - udf: validate VAT header length against the VAT inode size - isofs: bound Rock Ridge symlink components to the SL record - udf: validate free block extents against the partition length - config: arm64: update CONFIG_FTRACE_STARTUP_TEST not set - crypto: qat - Return pointer directly in adf_ctl_alloc_resources - crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() - drivers/base/memory: set mem->altmap after successful device registration - serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails - serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero - NFS: Prevent resource leak in nfs_alloc_server() - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr - nfsd: check get_user() return when reading princhashlen - fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode - fbdev: modedb: fix a possible UAF in fb_find_mode() - fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var - power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path - 9p: avoid putting oldfid in p9_client_walk() error path - ocfs2: reject oversized group bitmap descriptors - rpmsg: char: Fix use-after-free on probe error path - fpga: region: fix use-after-free in child_regions_with_firmware() - irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove - pNFS: Fix use-after-free in pnfs_update_layout() - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done - hdlc_ppp: sync per-proto timers before freeing hdlc state - gfs2: fix use-after-free in gfs2_qd_dealloc - exfat: fix potential use-after-free in exfat_find_dir_entry() - bpf: use kvfree() for replaced sysctl write buffer - f2fs: keep atomic write retry from zeroing original data - f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node() - f2fs: validate ACL entry sizes in f2fs_acl_from_disk() - f2fs: fix to round down start offset of fallocate for pin file - f2fs: validate compress cache inode only when enabled - wifi: iwlwifi: mvm: fix race condition in PTP removal - wifi: rtw88: usb: fix memory leaks on USB write failures - wifi: rtw88: increase TX report timeout to fix race condition - wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor - wifi: ath11k: fix warning when unbinding - wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S - keys: Pin request_key_auth payload in instantiate paths - KEYS: fix overflow in keyctl_pkey_params_get_2() - err.h: use __always_inline on all error pointer helpers - fbdev: fix use-after-free in store_modes() - NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR - apparmor: mediate the implicit connect of TCP fast open sendmsg - net: skmsg: preserve sg.copy across SG transforms - mac802154: llsec: add skb_cow_data() before in-place crypto - af_unix: Set gc_in_progress to true in unix_gc(). - ntfs3: reject direct userspace writes to reserved $LX* xattrs - ipv4: account for fraggap on the paged allocation path - inet: add indirect call wrapper for getfrag() calls - ipv6: account for fraggap on the paged allocation path - batman-adv: tvlv: avoid race of cifsnotfound handler state - batman-adv: tvlv: enforce 2-byte alignment - batman-adv: dat: prevent false sharing between VLANs - batman-adv: tt: track roam count per VID - batman-adv: tt: don't merge change entries with different VIDs - batman-adv: tp_meter: handle overlapping packets - batman-adv: tp_meter: prevent parallel modifications of last_recv - batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE - batman-adv: tp_meter: restrict number of unacked list entries - batman-adv: v: prevent OGM aggregation on disabled hardif - batman-adv: frag: avoid underflow of TTL - batman-adv: frag: ensure fragment is writable before modifying TTL - batman-adv: fix (m|b)cast csum after decrementing TTL - batman-adv: ensure bcast is writable before modifying TTL - batman-adv: tp_meter: initialize last_recv_time during init - batman-adv: prevent ELP transmission interval underflow - batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE - batman-adv: tp_meter: add only finished tp_vars to lists - batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection - batman-adv: tp_meter: fix fast recovery precondition - batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd - batman-adv: tp_meter: avoid window underflow - batman-adv: tp_meter: initialize dec_cwnd explicitly - batman-adv: tp_meter: initialize dup_acks explicitly - batman-adv: tp_meter: keep unacked list in ascending ordered - eventpoll: rename ep_remove_safe() back to ep_remove() - file: add fput() cleanup helper - media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si - ksmbd: reject non-VALID session in compound request branch - scripts/sorttable: Fix endianness handling in build-time mcount sort - scripts/sorttable: Allow matches to functions before function entry - scripts/sorttable: Use normal sort if theres no relocs in the mcount section - ftrace: Check against is_kernel_text() instead of kaslr_offset() - ftrace: Test mcount_loc addr before calling ftrace_call_addr() - ftrace: Do not over-allocate ftrace memory - ftrace: Have ftrace pages output reflect freed pages - ftrace: Update the mcount_loc check of skipped entries - scripts/sorttable: Zero out weak functions in mcount_loc table - scripts/sorttable: Always use an array for the mcount_loc sorting - scripts/sorttable: Have mcount rela sort use direct values - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 - scripts/sorttable: Use a structure of function pointers for elf helpers - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly - scripts/sorttable: Move code from sorttable.h into sorttable.c - scripts/sorttable: Use uint64_t for mcount sorting - scripts/sorttable: Add helper functions for Elf_Sym - scripts/sorttable: Add helper functions for Elf_Shdr - scripts/sorttable: Add helper functions for Elf_Ehdr - scripts/sorttable: Convert Elf_Sym MACRO over to a union - scripts/sorttable: Replace Elf_Shdr Macro with a union - scripts/sorttable: Convert Elf_Ehdr to union - scripts/sorttable: Make compare_extable() into two functions - scripts/sorttable: Have the ORC code use the _r() functions to read - scripts/sorttable: Remove unneeded Elf_Rel - scripts/sorttable: Remove unused write functions - scripts/sorttable: Remove unused macro defines - fuse: re-lock request before replacing page cache folio - slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD - slimbus: qcom-ngd-ctrl: Fix up platform_driver registration - rxrpc: Fix the ACK parser to extract the SACK table for parsing - net: phonet: free phonet_device after RCU grace period - phonet: Pass net and ifindex to phonet_address_notify(). - phonet: Pass ifindex to fill_addr(). - Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs - hv: utils: handle and propagate errors in kvp_register - regulator: core: fix locking in regulator_resolve_supply() error path - ring-buffer: Remove ring_buffer_read_prepare_sync() - selftests/bpf: Update comments find_equal_scalars->sync_linked_regs - af_unix: Reject SIOCATMARK on non-stream sockets - selftests/bpf: Add test to ensure kprobe_multi is not sleepable - agp/amd64: Fix broken error propagation in agp_amd64_probe() - net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() - i2c: stub: Reject I2C block transfers with invalid length - RDMA/bnxt_re: zero shared page before exposing to userspace - KVM: VMX: Update SVI during runtime APICv activation - ARM: fix branch predictor hardening - ARM: fix hash_name() fault - ARM: allow __do_kernel_fault() to report execution of memory faults - ARM: group is_permission_fault() with is_translation_fault() - debugobjects: Dont call fill_pool() in early boot hardirq context - debugobjects: Do not fill_pool() if pi_blocked_on - debugobjects: Use LD_WAIT_CONFIG instead of LD_WAIT_SLEEP - debugobjects: Allow to refill the pool before SYSTEM_SCHEDULING - batman-adv: tt: prevent TVLV entry number overflow - drm/v3d: Skip CSD when it has zeroed workgroups - drm/v3d: Store the active job inside the queue's state - iov_iter: Fix potential underflow in iov_iter_extract_xarray_pages() - urma: add check type in free driver obj - smb: client: fix double-free in SMB2_close() replay - smb: client: fix double-free in SMB2_flush() replay - smb: client: fix query_info() replay double-free - smb: client: fix query directory replay double-free - smb: client: fix double-free in SMB2_open() replay - smb: client: fix double-free in SMB2_ioctl() replay - smb: client: fix change notify replay double-free - HID: lg-g15: cancel pending work on remove to fix a use-after-free - HID: multitouch: fix out-of-bounds bit access on mt_io_flags - tracing: Prevent out-of-bounds read in glob matching - sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT - !25616 sync CVE LTS and bugfix from OLK-6.6 b72db20c0437 to d33ffc8f8580 - KVM: x86: hyper-v: Bound the bank index when querying sparse banks - MIPS: DEC: Prevent initial console buffer from landing in XKPHYS - ksmbd: fix durable reconnect error path file lifetime - ksmbd: fix use-after-free in smb2_open during durable reconnect - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query - USB: iowarrior: fix use-after-free on disconnect race - usb: iowarrior: remove inherent race with minor number - USB: iowarrior: fix use-after-free on disconnect - apparmor: fix use-after-free in rawdata dedup loop - tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR - bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops - rbd: eliminate a race in lock_dwork draining on unmap - blk-cgroup: fix UAF in __blkcg_rstat_flush() - net: Fix kabi breakage of struct tc_action - net/sched: act_api: use RCU with deferred freeing for action lifecycle - net: Fix kabi breakage of struct header_ops - bonding: prevent potential infinite loop in bond_header_parse() - bonding: fix type confusion in bond_setup_by_slave() - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc - ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL - ASoC: cs35l56: Fix missing calls to wm_adsp2_remove() - time: Fix off-by-one in compat settimeofday() usec validation - scsi: target: Fix hexadecimal CHAP_I handling - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink - ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY - ksmbd: add a permission check for FSCTL_SET_ZERO_DATA - ksmbd: add per-handle permission check to FILE_LINK_INFORMATION - mptcp: fix missing wakeups in edge scenarios - mptcp: add-addr: always drop other suboptions - ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 - RDMA/umem: fix kernel-doc warnings - mm/migrate: don't call folio_putback_active_hugetlb() on dst hugetlb folio - usb: typec: ucsi: Don't update power_supply on power role change if not connected - serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() - thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() - usb: typec: ucsi: Check if power role change actually happened before handling - usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind - usb: dwc3: xilinx: fix error handling in zynqmp init error paths - usb: musb: omap2430: Fix use-after-free in omap2430_probe() - tty: serial: samsung: Remove redundant port lock acquisition in rx helpers - tty: serial: samsung: use u32 for register interactions - serial: samsung_tty: Use port lock wrappers - ALSA: firewire-motu: Protect register DSP event queue positions - memfd: deny writeable mappings when implying SEAL_WRITE - iio: dac: ad5686: fix ref bit initialization for single-channel parts - usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure - iio: chemical: scd30: fix division by zero in write_raw - iio: chemical: scd30: Use guard(mutex) to allow early returns - iio: gyro: adis16260: fix division by zero in write_raw - Bluetooth: hci_qca: Convert timeout from jiffies to ms - Bluetooth: hci_qca: Migrate to serdev specific shutdown function - serdev: Provide a bustype shutdown function - serdev: make serdev_bus_type const - mm/damon/sysfs-schemes: delete tried region in regions_rmdirs() - mptcp: do not drop partial packets - mptcp: introduce the mptcp_init_skb helper - iio: adc: npcm: fix unbalanced clk_disable_unprepare() - iio: adc: npcm: Convert to platform remove callback returning void - octeontx2-pf: avoid double free of pool->stack on AQ init failure - af_unix: Fix UAF read of tail->len in unix_stream_data_wait() - af_unix: Cache state->msg in unix_stream_read_generic(). - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg - net: hsr: defer node table free until after RCU readers - mptcp: pm: fix ADD_ADDR timer infinite retry on option space insufficient - ice: fix VF queue configuration with low MTU values - mptcp: reset rcv wnd on disconnect - mptcp: cleanup fallback dummy mapping generation - octeontx2-af: CGX: add bounds check to cgx_speed_mbps index - octeontx2-af: replace deprecated strncpy with strscpy - cgroup/cpuset: Reset DL migration state on can_attach() failure - fbdev/vt8500lcdfb: Initialize fb_ops with fbdev macros - soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get() - driver core: reject devices with unregistered buses - drm/amd/display: Use krealloc_array() in dal_vector_reserve() - drm/amdgpu: restart the CS if some parts of the VM are still invalidated - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 - drm/amdkfd: fix NULL dereference in get_queue_ids() - slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock - slimbus: qcom-ngd-ctrl: fix OF node refcount - thunderbolt: Limit XDomain response copy to actual frame size - sctp: stream: fully roll back denied add-stream state - mmc: sdhci: add signal voltage switch in sdhci_resume_host - mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC - mmc: litex_mmc: Set mandatory idle clocks before CMD0 - mmc: core: Fix host controller programming for fixed driver type - mm/hugetlb: restore reservation on error in hugetlb folio copy paths - octeontx2-af: fix memory leak in rvu_setup_hw_resources() - nvmem: layouts: onie-tlv: fix hang on unknown types - net: rds: clear i_sends on setup unwind - net: mv643xx: fix OF node refcount - net/mlx5: Reorder completion before putting command entry in cmd_work_handler - misc: fastrpc: fix use-after-free race in fastrpc_map_create - misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context - Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard - i2c: tegra: Fix NOIRQ suspend/resume - i2c: stm32f7: fix timing computation ignoring i2c-analog-filter - i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() - pidfd: refuse access to tasks that have started exiting harder - ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write - vsock/vmci: fix sk_ack_backlog leak on failed handshake - wifi: nl80211: reject oversized EMA RNR lists - selftests: mptcp: add test for extra_subflows underflow on userspace PM - mptcp: sockopt: check timestamping ret value - mptcp: allow subflow rcv wnd to shrink - mptcp: close TOCTOU race while computing rcv_wnd - mptcp: fix retransmission loop when csum is enabled - ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow - ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O - ARM: socfpga: Fix OF node refcount leak in SMP setup - mm/damon/ops-common: call folio_test_lru() after folio_get() - drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info() - ALSA: timer: Fix UAF at snd_timer_user_params() - USB: serial: option: add usb-id for Dell Wireless DW5826e-m - xfrm: espintcp: do not reuse an in-progress partial send - ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL - mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation - tracing/probes: Point the error offset correctly for eprobe argument error - netfilter: nft_tunnel: fix use-after-free on object destroy - clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time - net: mvpp2: build skb from XDP-adjusted data on XDP_PASS - net: mvpp2: refill RX buffers before XDP or skb use - net: mvpp2: Add metadata support for xdp mode - netfilter: nf_log: validate MAC header was set before dumping it - rds: mark snapshot pages dirty in rds_info_getsockopt() - net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion - r8152: handle the return value of usb_reset_device() - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove - net: phy: clean the sfp upstream if phy probing fails - net/mlx4: avoid GCC 10 __bad_copy_from() false positive - ASoC: wm_adsp: Fix NULL dereference when removing firmware controls - arm64: tlb: Allow XZR argument to TLBI ops - KVM: arm64: Remove VPIPT I-cache handling - tools/rv: Fix cleanup after failed trace setup - time: Fix off-by-one in settimeofday() usec validation - ipmi: Fix rcu_read_unlock to srcu_read_unlock in handle_read_event_rsp - ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() - vxlan: vnifilter: fix spurious notification on VNI update - vxlan: vnifilter: send notification on VNI add - octeontx2-af: npc: Fix CPT channel mask in npc_install_flow - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown - ptp: vclock: Switch from RCU to SRCU - net: fec: fix pinctrl default state restore order on resume - net: lan743x: permit VLAN-tagged packets up to configured MTU - net: garp: fix unsigned integer underflow in garp_pdu_parse_attr - hsr: Remove WARN_ONCE() in hsr_addr_is_self(). - net: Annotate sk->sk_write_space() for UDP SOCKMAP. - pcnet32: stop holding device spin lock during napi_complete_done - drm/imx: Fix three kernel-doc warnings in dcss-scaler.c - 6lowpan: fix off-by-one in multicast context address compression - netfilter: xt_NFQUEUE: prefer raw_smp_processor_id - tee: optee: prevent use-after-free when the client exits before the supplicant - net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS - Disable -Wattribute-alias for clang-23 and newer - RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug - USB: serial: mct_u232: fix memory corruption with small endpoint - usb: core: Fix SuperSpeed root hub wMaxPacketSize - serial: zs: Convert to use a platform device - serial: dz: Convert to use a platform device - serial: dz: Fix bootconsole handover lockup - xhci: tegra: Fix ghost USB device on dual-role port unplug - USB: serial: digi_acceleport: fix memory corruption with small endpoints - landlock: Fix handling of disconnected directories - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync - USB: serial: cypress_m8: fix memory corruption with small endpoint - serial: zs: Switch to using channel reset - serial: zs: Fix bootconsole handover lockup - serial: dz: Fix bootconsole message clobbering at chip reset - drm/amdkfd: Check for pdd drm file first in CRIU restore path - drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger - drm/amdkfd: fix NULL pointer bug in svm_range_set_attr - serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma - serial: zs: Fix swapped RI/DSR modem line transition counting - serial: sh-sci: fix memory region release in error path - serial: qcom-geni: fix UART_RX_PAR_EN bit position - serial: altera_jtaguart: handle uart_add_one_port() failures - drm/amd/pm/si: Disregard vblank time when no displays are connected - drm/i915: Fix potential UAF in TTM object purge - drm/hyperv: validate VMBus packet size in receive callback - drm/hyperv: validate resolution_count and fix WIN8 fallback - scsi: target: iscsi: Validate CHAP_R length before base64 decode - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 - scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker - thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow - thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() - usb: gadget: f_fs: copy only received bytes on short ep0 read - usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports - usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling - usb: gadget: f_hid: fix device reference leak in hidg_alloc() - usb: gadget: net2280: Fix double free in probe error path - USB: serial: mct_u232: fix missing interrupt-in transfer sanity check - USB: serial: mxuport: fix memory corruption with small endpoint - USB: serial: keyspan: fix missing indat transfer sanity check - USB: serial: cypress_m8: validate interrupt packet headers - USB: serial: belkin_sa: validate interrupt status length - USB: serial: option: add MeiG SRM813Q - usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize - usb: usbtmc: check URB actual_length for interrupt-IN notifications - usbip: vudc: Fix use after free bug in vudc_remove due to race condition - usb: storage: Add quirks for PNY Elite Portable SSD - USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers - usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval - usb: chipidea: core: convert ci_role_switch to local variable - tty: serial: pch_uart: add check for dma_alloc_coherent() - counter: Fix refcount leak in counter_alloc() error path - comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() - comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() - Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 - Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem - Input: xpad - add support for ASUS ROG RAIKIRI II - Input: xpad - add "Nova 2 Lite" from GameSir - ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks - ASoC: qcom: q6asm-dai: close stream only when running - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check - xfrm: ah: use skb_to_full_sk in async output callbacks - xfrm: route MIGRATE notifications to caller's netns - nfc: hci: fix out-of-bounds read in HCP header parsing - iommu, debugobjects: avoid gcc-16.1 section mismatch warnings - HID: wacom: Fix OOB write in wacom_hid_set_device_mode() - ip6: vti: Use ip6_tnl.net in vti6_changelink(). - xfrm: input: hold netns during deferred transport reinjection - ipv6: validate extension header length before copying to cmsg - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). - ipv6: exthdrs: refresh nh after handling HAO option - ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() - macsec: fix replay protection at XPN lower-PN wrap - bpf: sockmap: fix tail fragment offset in bpf_msg_push_data - Input: elan_i2c - validate firmware size before use - usb: dwc2: Fix use after free in debug code - usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles - usb: cdns3: gadget: fix request skipping after clearing halt - USB: serial: omninet: fix memory corruption with small endpoint - iio: buffer: hw-consumer: fix use-after-free in error path - iio: light: cm3323: fix reg_conf not being initialized correctly - iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL - iio: temperature: tsys01: fix broken PROM checksum validation - iio: ssp_sensors: cancel delayed work_refresh on remove - iio: gyro: itg3200: fix i2c read into the wrong stack location - iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw - iio: dac: ad5686: acquire lock when doing powerdown control - iio: dac: ad5686: fix input raw value check - iio: dac: max5821: fix return value check in powerdown sync - iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux - wireguard: send: append trailer after expanding head - KVM: arm64: PMU: Preserve AArch32 counter low bits - parport: Fix race between port and client registration - Input: xpad - fix out-of-bounds access for Share button - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock - Bluetooth: ISO: fix UAF in iso_recv_frame - Bluetooth: HIDP: fix missing length checks in hidp_input_report() - auxdisplay: line-display: fix OOB read on zero-length message_store() - hpfs: fix a crash if hpfs_map_dnode_bitmap fails - Bluetooth: btusb: Allow firmware re-download when version matches - HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse - Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() - USB: serial: safe_serial: fix memory corruption with small endpoint - usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT - usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() - usb: typec: altmodes/displayport: validate count before reading Status Update VDO - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO - usb: typec: ucsi: ccg: reject firmware images without a ':' record header - iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer - soc/tegra: pmc: Fix unsafe generic_handle_irq() call - hwmon: (pmbus/adm1266) serialize NVMEM blackbox read with pmbus_lock - hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock - of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() - phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X - drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used - drm/dp: Add eDP 1.5 bit definition - drm/i915/psr: Read Intel DPCD workaround register - drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register - media: rc: fix race between unregister and urb/irq callbacks - batman-adv: bla: avoid double decrement of bla.num_requests - batman-adv: tt: avoid empty VLAN responses - batman-adv: tt: fix TOCTOU race for reported vlans - batman-adv: tp_meter: directly shut down timer on cleanup - batman-adv: tp_meter: avoid role confusion in tp_list - batman-adv: iv: recover OGM scheduling after forward packet error - batman-adv: tvlv: reject oversized TVLV packets - batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface - batman-adv: tt: reject oversized local TVLV buffers - batman-adv: tvlv: abort OGM send on tvlv append failure - net: skbuff: fix pskb_carve leaking zcopy pages - ipv6: fix possible infinite loop in fib6_select_path() - ipv6: fix possible infinite loop in rt6_fill_node() - sctp: fix race between sctp_wait_for_connect and peeloff - net: mana: Add NULL guards in teardown path to prevent panic on attach failure - gpio: rockchip: convert bank->clk to devm_clk_get_enabled() - Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() - ethtool: eeprom: add more safeties to EEPROM Netlink fallback - ethtool: eeprom: add missing ethnl_ops_begin() / _complete() during fallback - bonding: refuse to enslave CAN devices - Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() - ASoC: codecs: simple-mux: Fix enum control bounds check - ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() - gpio: mxc: fix irq_high handling - net: hsr: fix potential OOB access in supervision frame handling - ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues - net/iucv: fix locking in .getsockopt - net/smc: Do not re-initialize smc hashtables - net: netlink: don't set nsid on local notifications - net: netlink: fix sending unassigned nsid after assigned one - vsock: keep poll shutdown state consistent - netfilter: nf_tables: fix dst corruption in same register operation - netfilter: bitwise: add support for doing AND, OR and XOR directly - netfilter: bitwise: rename some boolean operation functions - netfilter: ebtables: fix OOB read in compat_mtw_from_user - netfilter: xt_cpu: prefer raw_smp_processor_id - netfilter: synproxy: refresh tcphdr after skb_ensure_writable - xfrm: Check for underflow in xfrm_state_mtu - nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() - nfc: llcp: Fix use-after-free in llcp_sock_release() - net: cpsw_new: Fix potential unregister of netdev that has not been registered yet - drm: Remove plane hsub/vsub alignment requirement for core helpers - net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net: mctp: ensure our nlmsg responses are initialised - Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size - MIPS: smp: report dying CPU to RCU in stop_this_cpu() - LoongArch: Report dying CPU to RCU in stop_this_cpu() - irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT - tls: Flush backlog before waiting for a new record - net: ethernet: cortina: No mapping is a dropped rx - batman-adv: fix batadv_skb_is_frag() kernel-doc - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled - Bluetooth: ISO: fix malformed ISO_END/CONT handling - Bluetooth: MGMT: Fix backward compatibility with userspace - security/keys: fix missed RCU read section on lookup - LoongArch: kprobes: Fix handling of fatal unrecoverable recursions - pds_core: ensure null-termination for firmware version strings - pds_core: add an error code check in pdsc_dl_info_get - net: mana: validate rx_req_idx to prevent out-of-bounds array access - ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove() - gpio: cdev: check if uAPI v2 config attributes are correctly zeroed - gpiolib: cdev: use !mem_is_zero() instead of memchr_inv(s, 0, n) - string: add mem_is_zero() helper to check if memory area is all zeros - bpf, skmsg: fix verdict sk_data_ready racing with ktls rx - net: ag71xx: check error for platform_get_irq - Bluetooth: btmtk: rename btmediatek_data - Bluetooth: btusb: mediatek: refactor the function btusb_mtk_reset - Bluetooth: btmtk: add the function to get the fw name - ALSA: seq: Serialize UMP output teardown with event_input - ALSA: seq: ump: Use guard() for locking - pds_core: fix debugfs_lookup dentry leak and error handling - pds_core: fix error handling in pdsc_devcmd_wait - bridge: mcast: Fix a possible use-after-free when removing a bridge port - net: bridge: Flush multicast groups when snooping is disabled - RDMA/rtrs: Fix use-after-free in path file creation cleanup - platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL - platform/x86: intel-hid: Check ACPI_HANDLE() against NULL - platform/x86: hp_accel: Check ACPI_COMPANION() against NULL - platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer - net: dsa: mt7530: preserve VLAN tags on trapped link-local frames - net: dsa: mt7530: rename mt753x_bpdu_port_fw enum to mt753x_to_cpu_fw - net: dsa: mt7530: fix FDB entries not aging out with short timeout - wifi: ath11k: fix peer resolution on rx path when peer_id=0 - drm/msm/snapshot: fix dumping of the unaligned regions - spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache() - net/mlx5: Do not restore destination-less TC rules - tls: Preserve sk_err across recvmsg() when data has been copied - x86/xen: Fix xen_e820_swap_entry_with_ram() - net: phy: DP83TC811: add reading of abilities - net: phy: c45: add genphy_c45_pma_read_ext_abilities() function - net: tls: prevent chain-after-chain in plain text SG - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot - powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise() - drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN - drm/msm/dsi: don't dump registers past the mapped region - ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics - net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint - accel/qaic: Add overflow check to remap_pfn_range during mmap - HID: quirks: really enable the intended work around for appledisplay - wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm() - wifi: ath11k: fix error path leaks in some WMI WOW calls - net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS reference - net: ethernet: cortina: Carry over frag counter - net: ethernet: cortina: Drop half-assembled SKB - net: ethernet: cortina: Make RX SKB per-port - netfs: Fix overrun check in netfs_extract_user_iter() - zonefs: handle integer overflow in zonefs_fname_to_fno - irqchip/ath79-cpu: Remove unused function - phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access - net: lan966x: avoid unregistering netdev on register failure - ice: fix locking in ice_dcb_rebuild() - tcp: Fix imbalanced icsk_accept_queue count. - test_kprobes: clear kprobes between test runs - kprobes: skip non-symbol addresses in kprobe_add_ksym_blacklist() - netfilter: x_tables: unregister the templates first - ALSA: hda: cs35l56: Put ACPI device after setting companion - ARM: integrator: Fix early initialization - pinctrl: qcom: Fix wakeirq map by removing disconnected irqs for sm8150 - kunit: config: KUNIT_DEBUGFS should depend on DEBUG_FS - kunit: config: Enable KUNIT_DEBUGFS by default - firmware: arm_ffa: Skip free_pages on RX buffer alloc failure - firmware: arm_ffa: Check for NULL FF-A ID table while driver registration - HID: uclogic: Fix regression of input name assignment - hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors - hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe() - hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe() - hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in get_multiple - hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR - hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer - hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer - hwmon: (pmbus/adm1266) reject implausible blackbox record_count - hwmon: (pmbus/adm1266) seed timestamp from the real-time clock - batman-adv: tt: fix negative tt_buff_len - batman-adv: tt: fix negative last_changeset_len - batman-adv: tp_meter: fix race condition in send error reporting - batman-adv: tp_meter: avoid use of uninit sender vars - batman-adv: bla: fix report_work leak on backbone_gw purge - batman-adv: frag: disallow unicast fragment in fragment - batman-adv: fix fragment reassembly length accounting - batman-adv: dat: handle forward allocation error - batman-adv: clear current gateway during teardown - batman-adv: mcast: fix use-after-free in orig_node RCU release - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async - drm/amd/display: Validate GPIO pin LUT table size before iterating - drm/amd/display: Fix integer overflow in bios_get_image() - drm/bridge: megachips: remove bridge when irq request fails - drm/bridge: it66121: acquire reset GPIO in probe - drm/virtio: use uninterruptible resv lock for plane updates - device property: set fwnode->secondary to NULL in fwnode_init() - LoongArch: Remove unused code to avoid build warning - RDMA/siw: Reject MPA FPDU length underflow before signed receive math - spi: ti-qspi: fix use-after-free after DMA setup failure - spi: sprd: fix error pointer deref after DMA setup failure - scsi: isci: Fix use-after-free in device removal path - phy: tegra: xusb: Fix per-pad high-speed termination calibration - spi: qup: fix error pointer deref after DMA setup failure - drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe - KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits - arm64: probes: Handle probes on hinted conditional branch instructions - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() - ice: fix setting promisc mode while adding VID filter - ixgbevf: fix use-after-free in VEPA multicast source pruning - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 - wifi: ath11k: clear shared SRNG pointer state on restart - vsock/vmci: fix UAF when peer resets connection during handshake - ring-buffer: Fix reporting of missed events in iterator - qed: fix double free in qed_cxt_tables_alloc() - netfilter: ipset: stop hash:* range iteration at end - netfilter: nf_queue: hold bridge skb->dev while queued - netfilter: ip6t_hbh: reject oversized option lists - net: ifb: report ethtool stats over num_tx_queues - net: bcmgenet: keep RBUF EEE/PM disabled - phonet/pep: disable BH around forwarded sk_receive_skb() - Bluetooth: MGMT: validate Add Extended Advertising Data length - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths - Bluetooth: bnep: Fix UAF read of dev->name - Bluetooth: ISO: drop ISO_END frames received without prior ISO_START - net: wwan: iosm: fix potential memory leaks in ipc_imem_init() - drivers/base/memory: fix memory block reference leak in poison accounting - efi: Allocate runtime workqueue before ACPI init - ALSA: asihpi: Fix potential OOB array access at reading cache - ALSA: pcm: Don't setup bogus iov_iter for silencing - ALSA: ua101: Reject too-short USB descriptors - hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX - smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() - ksmbd: fix null pointer dereference in compare_guid_key() - mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break() - sysfs: don't remove existing directory on update failure - Revert "af_unix: Reject SIOCATMARK on non-stream sockets" - Revert "s390/cio: Update purge function to unregister the unused subchannels" - Revert "ice: Remove jumbo_remove step from TX path" - Revert "ice: fix double-free of tx_buf skb" - Revert "x86/vdso: Fix output operand size of RDPID" - wifi: mac80211: check tdls flag in ieee80211_tdls_oper - s390/debug: Reject zero-length input before trimming a newline - mptcp: pm: ADD_ADDR rtx: free sk if last - mptcp: sync the msk->sndbuf at accept() time - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close - netfilter: revalidate bridge ports - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp - net: bonding: fix NULL pointer dereference in bond_do_ioctl() - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() - udp: clear skb->dev before running a sockmap verdict - crypto: nx - Fix packed layout in struct nx842_crypto_header - crypto: nx - Use static_assert() to check struct sizes - batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown - Revert "ALSA: pcmtest: fix reference leak on failed device registration" - media: rc: ttusbir: fix inverted error logic - media: rc: igorplugusb: fix control request setup packet - batman-adv: tp_meter: fix tp_num leak on kmalloc failure - batman-adv: stop tp_meter sessions during mesh teardown - ALSA: seq: Fix UMP group 16 filtering - ALSA: seq: Notify client and port info changes - ALSA: core: Serialize deferred fasync state checks - ALSA: misc: Use guard() for spin locks - ALSA: hda: cs35l56: Propagate ASP TX source control errors - crypto: nx - Avoid -Wflex-array-member-not-at-end warning - ksmbd: reset rcount per connection in ksmbd_conn_wait_idle_sess_id() - media: rc: igorplugusb: heed coherency rules - ALSA: aoa: Skip devices with no codecs in i2sbus_resume() - media: rc: ttusbir: respect DMA coherency rules - ALSA: aoa: i2sbus: clear stale prepared state - ALSA: aoa: Use guard() for mutex locks - f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally - ksmbd: replace connection list with hash table - ksmbd: use msleep instaed of schedule_timeout_interruptible() - f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io() - smb: move some duplicate definitions to common/smbacl.h - iommu/amd: serialize sequence allocation under concurrent TLB invalidations - x86/shstk: Prevent deadlock during shstk sigreturn - ALSA: pcmtest: Fix resource leaks in module init error paths - ALSA: pcmtest: fix reference leak on failed device registration - ALSA: 6fire: Fix input volume change detection - ALSA: caiaq: Fix control_put() result and cache rollback - ALSA: core: Fix potential data race at fasync handling - Revert "ALSA: usb-audio: Cap the packet size pre-calculations" - ipv6: sit: reload inner IPv6 header after GSO offloads - net: guard timestamp cmsgs to real error queue skbs - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() - netfilter: x_tables: avoid leaking percpu counter pointers - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush - netfilter: require Ethernet MAC header before using eth_hdr() - netfilter: nft_fib: fix stale stack leak via the OIFNAME register - vsock/virtio: reset connection on receiving queue overflow - vsock/virtio: fix skb overhead accounting to preserve full buf_alloc - vsock/virtio: fix potential unbounded skb queue - mptcp: pm: ADD_ADDR rtx: always decrease sk refcount - mptcp: pm: ADD_ADDR rtx: allow ID 0 - ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers - srcu: Use irq_work to start GP in tiny SRCU - irqwork: Move data struct to a types header - types: move struct rcuwait into types.h - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets - wifi: iwlwifi: fix 22000 series SMEM parsing - wifi: iwlwifi: allow IWL_FW_CHECK() with just a string - x86: shadow stacks: proper error handling for mmap lock - net: mvpp2: sync RX data at the hardware packet offset - net: mvpp2: limit XDP frame size to the RX buffer - batman-adv: fix tp_meter counter underflow during shutdown - batman-adv: v: stop OGMv2 on disabled interface - ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger - spi: mpc52xx: fix controller deregistration - thunderbolt: Bound root directory content to block size - selinux: fix overlayfs mmap() and mprotect() access checks - lsm: add backing_file LSM hooks - fs: constify file ptr in backing_file accessor helpers - fs: prepare for adding LSM blob to backing_file - selftests/bpf: Add tests for ld_{abs,ind} failure path in subprogs - bpf: Fix ld_{abs,ind} failure path analysis in subprogs - KVM: x86: Fix shadow paging use-after-free due to unexpected role - Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref - Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() - fix kabi for ppp_defs.h - pppoe: drop PFC frames - netfilter: nat: use kfree_rcu to release ops - drm/i915/gem: Fix phys BO pread/pwrite with offset - selinux: allow multiple opens of /sys/fs/selinux/policy - ksmbd: make ksmbd thread names distinct by client IP - ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path - ALSA: caiaq: Don't abort when no input device is available - ALSA: caiaq: fix usb_dev refcount leak on probe failure - ALSA: caiaq: Handle probe errors properly - ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow - USB: cdc-acm: Fix bit overlap and move quirk definitions to header - ALSA: caiaq: take a reference on the USB device in create_card() - ALSA: usb-audio: apply quirk for MOONDROP JU Jiu - ksmbd: use check_add_overflow() to prevent u16 DACL size overflow - ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment - smb: server: fix max_connections off-by-one in tcp accept path - smb: server: fix active_num_conn leak on transport allocation failure - usb: port: add delay after usb_hub_set_port_power() - USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen - usb: storage: Expand range of matched versions for VL817 quirks entry - xfrm: Wait for RCU readers during policy netns exit - KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing - mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison - thunderbolt: Clamp XDomain response data copy to allocation size - bpf: return VMA snapshot from task_vma iterator - bpf: switch task_vma iterator from mmap_lock to per-VMA locks - bpf: fix mm lifecycle in open-coded task_vma iterator - netfilter: nft_ct: bail out on template ct in get eval - drm/amd/display: Bound VBIOS record-chain walk loops - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size - drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() - netfilter: conntrack_irc: fix possible out-of-bounds read - drm/vc4: fix krealloc() memory leak - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error - f2fs: fix data loss caused by incorrect use of nat_entry flag - bnxt_en: Fix NULL pointer dereference - ipv6: mcast: Fix use-after-free when processing MLD queries - ipvs: clear the svc scheduler ptr early on edit - netfilter: synproxy: add mutex to guard hook reference counting - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list - net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr - netlabel: validate unlabeled address and mask attribute lengths - netfilter: bridge: make ebt_snat ARP rewrite writable - tcp: restrict SO_ATTACH_FILTER to priv users - ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER - Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig - misc: fastrpc: fix DMA address corruption due to find_vma misuse - misc: fastrpc: Fix NULL pointer dereference in rpmsg callback - gpio: mvebu: fix NULL pointer dereference in suspend/resume - Bluetooth: fix memory leak in error path of hci_alloc_dev() - Bluetooth: bnep: reject short frames before parsing - Bluetooth: RFCOMM: validate skb length in MCC handlers - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams - RDMA/srp: bound SRP_RSP sense copy by the received length - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN - net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure - sched/psi: fix race between file release and pressure write - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase - rculist: add list_splice_rcu() for private lists - net: skbuff: fix missing zerocopy reference in pskb_carve helpers - ip6_vti: set netns_immutable on the fallback device. - wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() - wifi: rtw88: debugfs: support multiple adapters debugging - erofs: fix use-after-free on sbi->sync_decompress - net: openvswitch: fix possible kfree_skb of ERR_PTR - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() - md: wake raid456 reshape waiters before suspend - dm cache policy smq: check allocation under invalidate lock - Bluetooth: MGMT: validate advertising TLV before type checks - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend - USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL - USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam - USB: serial: option: add support for Rolling Wireless RW135R-GL - USB: serial: io_edgeport: add support for Blackbox IC135A - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr - netfilter: flowtable: strictly check for maximum number of actions - fuse: reject fuse_notify() pagecache ops on directories - fs/mbcache: cancel shrink work before destroying the cache - smb/client: fix possible infinite loop and oob read in symlink_data() - fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp - ata: libata-scsi: do not needlessly defer commands when using PMP with FBS - ata: libata-scsi: do not use the deferred QC feature on PMPs with CBS - ata: libata-scsi: do not use the deferred QC feature for ATA_DEFER_PORT - ata: libata-scsi: improve readability of ata_scsi_qc_issue() - ata: libata-scsi: fix requeue of deferred ATA PASS-THROUGH commands - ata: libata-eh: Fix detection of deferred qc timeouts - ata: libata: cancel pending work after clearing deferred_qc - ata: libata-core: fix cancellation of a port deferred qc work - ata: libata-scsi: rename and improve ata_qc_done() - ata: libata-scsi: simplify ata_scsi_requeue_deferred_qc() - ata: libata-sata: simplify ata_sas_queuecmd() - ata: libata-core: improve tag checks in ata_qc_issue() - ata: libata-eh: correctly handle deferred qc timeouts - ata: libata-scsi: avoid Non-NCQ command starvation - ata: libata: Introduce ata_port_eh_scheduled() - ext4: handle wraparound when searching for blocks for indirect mapped blocks - ext4: fix error pointer dereference in ext4_mb_load_buddy_gfp() - ext4: always allocate blocks only from groups inode can use - ext4: fix e4b bitmap inconsistency reports - ext4: convert bd_buddy_page to bd_buddy_folio - ext4: convert bd_bitmap_page to bd_bitmap_folio - Revert "ext4: fix e4b bitmap inconsistency reports" - ext4: cleanup for ext4_map_blocks - ext4: rename EXT4_GET_BLOCKS_PRE_IO - ext4: drop extent cache when splitting extent fails - ext4: drop extent cache after doing PARTIAL_VALID1 zeroout - ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O - ext4: correct the comments place for EXT4_EXT_MAY_ZEROOUT - ext4: get rid of ppath in ext4_ext_handle_unwritten_extents() - ext4: get rid of ppath in ext4_ext_convert_to_initialized() - ext4: get rid of ppath in ext4_split_convert_extents() - ext4: get rid of ppath in ext4_split_extent() - ext4: get rid of ppath in ext4_force_split_extent_at() - ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 - ext4: subdivide EXT4_EXT_DATA_VALID1 - Revert "ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O" - ext4: get rid of ppath in ext4_split_extent_at() - ext4: get rid of ppath in ext4_ext_insert_extent() - ext4: get rid of ppath in get_ext_path() - ext4: add new ext4_ext_path_brelse() helper - !24596 [sync]urma: fix workqueue use-after-free in ubagg_exit teardown sequence - urma: fix workqueue use-after-free in ubagg_exit teardown sequence - !24607 ub: udma: Optimize udma jetty id access logic. - ub: udma: Optimize udma jetty id access logic. - !24640 [sync]urma: limit ubcore logs in reuse paths - urma: fix workqueue use-after-free in ubagg_exit teardown sequence - !24669 mm/madvise: add MADV_FCMA_ENABLE to set PF_FOLIO_CMA via madvise - mm/madvise: add MADV_FCMA_ENABLE to set PF_FOLIO_CMA via madvise - !24702 [sync]urma: retry import jetty/jfr on EIO from tpid reuse failure - urma: retry import jetty/jfr on EIO from tpid reuse failure - urma: limit ubagg connect exchange logs * Fri Jul 10 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-145.3.18.151.20260710.aae66044906b - !24753 [sync]urma: drain jfe event lists in batches to avoid soft-lockup - urma: drain jfe event lists in batches to avoid soft-lockup - urma: reduce ubagg topo log noise - !24748 [sync]urma: free completion events outside jfe lock - urma: free jfe events outside lock - urma: free completion events outside jfe lock - !24742 urma: Fix the issue of inaccurate timing for some functions in DFX - !24741 [sync]urma: fix UAF of accessing token_id in log. - urma: Fix the issue of inaccurate timing for some functions in DFX - urma: fix UAF of accessing token_id in log. - !24734 [sync]urma: fix tpid_reuse attached to vtpn causes use_after_free - urma: fix tpid_reuse attached to vtpn causes use_after_free - !24804 [sync]urma: use vzalloc for ubmad tjetty and ini_rtbuffer - !24774 [sync]urma: ratelimit import jetty/jfr error logs - urma: use vzalloc for ubmad tjetty and ini_rtbuffer - !24792 [sync]urma: fix UAF of accessing jfs/jetty in log. - urma: fix UAF of accessing jfs/jetty in log. - urma: ratelimit import jetty/jfr error logs - !24845 [sync]ub/ubdevshm: Support for acquiring va is a sub-range of registered va - ub/ubdevshm: Support for acquiring va is a sub-range of registered va - !24802 [sync]urma: use xarray for ubagg/ubcore session lookup - urma: use xarray for ubagg/ubcore session lookup - !24814 [sync]urma: make ratelimit burst configurable for ubcore/uburma/ubagg - urma: make ratelimit burst configurable for ubcore/uburma/ubagg * Wed Jul 22 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-145.3.22.153.20260722.158daf1d8dea - !24942 [sync]urma: drop param_set_uint_minmax for ratelimit burst setters - urma: drop param_set_uint_minmax for ratelimit burst setters - !25840 sync CVE LTS and bugfix from OLK-6.6 d33ffc8f8580 to 334dfd575ba5 - cgroup/rstat: avoid disabling irqs for O(num_cpu) - netfilter: bridge: eb_tables: close module init race - crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents - netfilter: ebtables: move to two-stage removal scheme - crypto: qat - protect service table iterations with service_lock - Bluetooth: eir: Fix stack OOB write when prepending the Flags AD - drm/edid: fix OOB read in drm_parse_tiled_block() - proc: protect ptrace_may_access() with exec_update_lock (FD links) - vfio/pci: Latch disable_idle_d3 per device - bpf: Fix UAF in sock clone early bailouts - bpf: Disable xfrm_decode_session hook attachment - bpf,fork: wipe ->bpf_storage before bailouts that access it - KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() - crypto: qat - validate RSA CRT component lengths - bpf: Clear rb node linkage when freeing bpf_rb_root - bpf: Add validation for bpf_set_retval argument - bpf: Reject sleepable BPF_LSM_CGROUP programs at load time - bpf: Fix setting retval to -EPERM for cgroup hooks not returning errno - bpf: Guard __get_user acesss with access_ok for uprobe_multi data - i2c: core: fix adapter registration race - ALSA: hda/cs35l41: Fix firmware load work teardown - vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc - iommufd: Break the loop on failure in iommufd_fault_fops_read() - posix-cpu-timers: Prevent UAF caused by non-leader exec() race - iio: event: Fix event FIFO reset race - hwrng: virtio: clamp device-reported used.len at copy_data() - crypto: drbg - Fix returning success on failure in CTR_DRBG - crypto: ecc - Fix carry overflow in vli multiplication - crypto: pcrypt - restore callback for non-parallel fallback - net: openvswitch: reject oversized nested action attrs - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page - e1000e: Fix out-of-bounds MMIO access by validating BAR0 size - xsched: enforce permissions on attribute access - xsched: restrict vstream management to privileged users - rme: use DMA API for virtio in realm world - udf: validate sparing table length as an entry count, not a byte count - smb: client: harden POSIX SID length parsing - smb: client: mask server-provided mode to 07777 in modefromsid - smb: client: Fix next buffer leak in receive_encrypted_standard() - nvmet-auth: validate reply message payload bounds against transfer length - bpf: Reject fragmented frames in devmap - bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized - mm/huge_memory: update file PMD counter before folio_put() - sctp: fix uninit-value in __sctp_rcv_asconf_lookup() - smb: client: reject overlapping data areas in SMB2 responses - smb: client: restrict implied bcc[0] exemption to responses without data area - io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item - writeback: drop now-unnecessary rcu_barrier() in cgroup_writeback_umount() - writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() - writeback: Fix use after free in inode_switch_wbs_work_fn() - writeback: Avoid contention on wb->list_lock when switching inodes - block: skip sync_blockdev() on surprise removal in bdev_mark_dead() - mm: do file ownership checks with the proper mount idmap - tracing: Bound synthetic-field strings with seq_buf - perf/core: Detach event groups during remove_on_exec - bpf: Allow LPM map access from sleepable BPF programs - bpf: Consistently use bpf_rcu_lock_held() everywhere - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC - udf: validate VAT header length against the VAT inode size - isofs: bound Rock Ridge symlink components to the SL record - udf: validate free block extents against the partition length - config: arm64: update CONFIG_FTRACE_STARTUP_TEST not set - crypto: qat - Return pointer directly in adf_ctl_alloc_resources - crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() - drivers/base/memory: set mem->altmap after successful device registration - serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails - serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero - NFS: Prevent resource leak in nfs_alloc_server() - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr - nfsd: check get_user() return when reading princhashlen - fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode - fbdev: modedb: fix a possible UAF in fb_find_mode() - fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var - power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path - 9p: avoid putting oldfid in p9_client_walk() error path - ocfs2: reject oversized group bitmap descriptors - rpmsg: char: Fix use-after-free on probe error path - fpga: region: fix use-after-free in child_regions_with_firmware() - irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove - pNFS: Fix use-after-free in pnfs_update_layout() - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done - hdlc_ppp: sync per-proto timers before freeing hdlc state - gfs2: fix use-after-free in gfs2_qd_dealloc - exfat: fix potential use-after-free in exfat_find_dir_entry() - bpf: use kvfree() for replaced sysctl write buffer - f2fs: keep atomic write retry from zeroing original data - f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node() - f2fs: validate ACL entry sizes in f2fs_acl_from_disk() - f2fs: fix to round down start offset of fallocate for pin file - f2fs: validate compress cache inode only when enabled - wifi: iwlwifi: mvm: fix race condition in PTP removal - wifi: rtw88: usb: fix memory leaks on USB write failures - wifi: rtw88: increase TX report timeout to fix race condition - wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor - wifi: ath11k: fix warning when unbinding - wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S - keys: Pin request_key_auth payload in instantiate paths - KEYS: fix overflow in keyctl_pkey_params_get_2() - err.h: use __always_inline on all error pointer helpers - fbdev: fix use-after-free in store_modes() - NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR - apparmor: mediate the implicit connect of TCP fast open sendmsg - net: skmsg: preserve sg.copy across SG transforms - mac802154: llsec: add skb_cow_data() before in-place crypto - af_unix: Set gc_in_progress to true in unix_gc(). - ntfs3: reject direct userspace writes to reserved $LX* xattrs - ipv4: account for fraggap on the paged allocation path - inet: add indirect call wrapper for getfrag() calls - ipv6: account for fraggap on the paged allocation path - batman-adv: tvlv: avoid race of cifsnotfound handler state - batman-adv: tvlv: enforce 2-byte alignment - batman-adv: dat: prevent false sharing between VLANs - batman-adv: tt: track roam count per VID - batman-adv: tt: don't merge change entries with different VIDs - batman-adv: tp_meter: handle overlapping packets - batman-adv: tp_meter: prevent parallel modifications of last_recv - batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE - batman-adv: tp_meter: restrict number of unacked list entries - batman-adv: v: prevent OGM aggregation on disabled hardif - batman-adv: frag: avoid underflow of TTL - batman-adv: frag: ensure fragment is writable before modifying TTL - batman-adv: fix (m|b)cast csum after decrementing TTL - batman-adv: ensure bcast is writable before modifying TTL - batman-adv: tp_meter: initialize last_recv_time during init - batman-adv: prevent ELP transmission interval underflow - batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE - batman-adv: tp_meter: add only finished tp_vars to lists - batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection - batman-adv: tp_meter: fix fast recovery precondition - batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd - batman-adv: tp_meter: avoid window underflow - batman-adv: tp_meter: initialize dec_cwnd explicitly - batman-adv: tp_meter: initialize dup_acks explicitly - batman-adv: tp_meter: keep unacked list in ascending ordered - eventpoll: rename ep_remove_safe() back to ep_remove() - file: add fput() cleanup helper - media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si - ksmbd: reject non-VALID session in compound request branch - scripts/sorttable: Fix endianness handling in build-time mcount sort - scripts/sorttable: Allow matches to functions before function entry - scripts/sorttable: Use normal sort if theres no relocs in the mcount section - ftrace: Check against is_kernel_text() instead of kaslr_offset() - ftrace: Test mcount_loc addr before calling ftrace_call_addr() - ftrace: Do not over-allocate ftrace memory - ftrace: Have ftrace pages output reflect freed pages - ftrace: Update the mcount_loc check of skipped entries - scripts/sorttable: Zero out weak functions in mcount_loc table - scripts/sorttable: Always use an array for the mcount_loc sorting - scripts/sorttable: Have mcount rela sort use direct values - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 - scripts/sorttable: Use a structure of function pointers for elf helpers - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly - scripts/sorttable: Move code from sorttable.h into sorttable.c - scripts/sorttable: Use uint64_t for mcount sorting - scripts/sorttable: Add helper functions for Elf_Sym - scripts/sorttable: Add helper functions for Elf_Shdr - scripts/sorttable: Add helper functions for Elf_Ehdr - scripts/sorttable: Convert Elf_Sym MACRO over to a union - scripts/sorttable: Replace Elf_Shdr Macro with a union - scripts/sorttable: Convert Elf_Ehdr to union - scripts/sorttable: Make compare_extable() into two functions - scripts/sorttable: Have the ORC code use the _r() functions to read - scripts/sorttable: Remove unneeded Elf_Rel - scripts/sorttable: Remove unused write functions - scripts/sorttable: Remove unused macro defines - fuse: re-lock request before replacing page cache folio - slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD - slimbus: qcom-ngd-ctrl: Fix up platform_driver registration - rxrpc: Fix the ACK parser to extract the SACK table for parsing - net: phonet: free phonet_device after RCU grace period - phonet: Pass net and ifindex to phonet_address_notify(). - phonet: Pass ifindex to fill_addr(). - Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs - hv: utils: handle and propagate errors in kvp_register - regulator: core: fix locking in regulator_resolve_supply() error path - ring-buffer: Remove ring_buffer_read_prepare_sync() - selftests/bpf: Update comments find_equal_scalars->sync_linked_regs - af_unix: Reject SIOCATMARK on non-stream sockets - selftests/bpf: Add test to ensure kprobe_multi is not sleepable - agp/amd64: Fix broken error propagation in agp_amd64_probe() - net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() - i2c: stub: Reject I2C block transfers with invalid length - RDMA/bnxt_re: zero shared page before exposing to userspace - KVM: VMX: Update SVI during runtime APICv activation - ARM: fix branch predictor hardening - ARM: fix hash_name() fault - ARM: allow __do_kernel_fault() to report execution of memory faults - ARM: group is_permission_fault() with is_translation_fault() - debugobjects: Dont call fill_pool() in early boot hardirq context - debugobjects: Do not fill_pool() if pi_blocked_on - debugobjects: Use LD_WAIT_CONFIG instead of LD_WAIT_SLEEP - debugobjects: Allow to refill the pool before SYSTEM_SCHEDULING - batman-adv: tt: prevent TVLV entry number overflow - drm/v3d: Skip CSD when it has zeroed workgroups - drm/v3d: Store the active job inside the queue's state - iov_iter: Fix potential underflow in iov_iter_extract_xarray_pages() - urma: add check type in free driver obj - smb: client: fix double-free in SMB2_close() replay - smb: client: fix double-free in SMB2_flush() replay - smb: client: fix query_info() replay double-free - smb: client: fix query directory replay double-free - smb: client: fix double-free in SMB2_open() replay - smb: client: fix double-free in SMB2_ioctl() replay - smb: client: fix change notify replay double-free - HID: lg-g15: cancel pending work on remove to fix a use-after-free - HID: multitouch: fix out-of-bounds bit access on mt_io_flags - tracing: Prevent out-of-bounds read in glob matching - sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT - !25616 sync CVE LTS and bugfix from OLK-6.6 b72db20c0437 to d33ffc8f8580 - KVM: x86: hyper-v: Bound the bank index when querying sparse banks - MIPS: DEC: Prevent initial console buffer from landing in XKPHYS - ksmbd: fix durable reconnect error path file lifetime - ksmbd: fix use-after-free in smb2_open during durable reconnect - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query - USB: iowarrior: fix use-after-free on disconnect race - usb: iowarrior: remove inherent race with minor number - USB: iowarrior: fix use-after-free on disconnect - apparmor: fix use-after-free in rawdata dedup loop - tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR - bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops - rbd: eliminate a race in lock_dwork draining on unmap - blk-cgroup: fix UAF in __blkcg_rstat_flush() - net: Fix kabi breakage of struct tc_action - net/sched: act_api: use RCU with deferred freeing for action lifecycle - net: Fix kabi breakage of struct header_ops - bonding: prevent potential infinite loop in bond_header_parse() - bonding: fix type confusion in bond_setup_by_slave() - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc - ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL - ASoC: cs35l56: Fix missing calls to wm_adsp2_remove() - time: Fix off-by-one in compat settimeofday() usec validation - scsi: target: Fix hexadecimal CHAP_I handling - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink - ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY - ksmbd: add a permission check for FSCTL_SET_ZERO_DATA - ksmbd: add per-handle permission check to FILE_LINK_INFORMATION - mptcp: fix missing wakeups in edge scenarios - mptcp: add-addr: always drop other suboptions - ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 - RDMA/umem: fix kernel-doc warnings - mm/migrate: don't call folio_putback_active_hugetlb() on dst hugetlb folio - usb: typec: ucsi: Don't update power_supply on power role change if not connected - serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() - thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() - usb: typec: ucsi: Check if power role change actually happened before handling - usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind - usb: dwc3: xilinx: fix error handling in zynqmp init error paths - usb: musb: omap2430: Fix use-after-free in omap2430_probe() - tty: serial: samsung: Remove redundant port lock acquisition in rx helpers - tty: serial: samsung: use u32 for register interactions - serial: samsung_tty: Use port lock wrappers - ALSA: firewire-motu: Protect register DSP event queue positions - memfd: deny writeable mappings when implying SEAL_WRITE - iio: dac: ad5686: fix ref bit initialization for single-channel parts - usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure - iio: chemical: scd30: fix division by zero in write_raw - iio: chemical: scd30: Use guard(mutex) to allow early returns - iio: gyro: adis16260: fix division by zero in write_raw - Bluetooth: hci_qca: Convert timeout from jiffies to ms - Bluetooth: hci_qca: Migrate to serdev specific shutdown function - serdev: Provide a bustype shutdown function - serdev: make serdev_bus_type const - mm/damon/sysfs-schemes: delete tried region in regions_rmdirs() - mptcp: do not drop partial packets - mptcp: introduce the mptcp_init_skb helper - iio: adc: npcm: fix unbalanced clk_disable_unprepare() - iio: adc: npcm: Convert to platform remove callback returning void - octeontx2-pf: avoid double free of pool->stack on AQ init failure - af_unix: Fix UAF read of tail->len in unix_stream_data_wait() - af_unix: Cache state->msg in unix_stream_read_generic(). - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg - net: hsr: defer node table free until after RCU readers - mptcp: pm: fix ADD_ADDR timer infinite retry on option space insufficient - ice: fix VF queue configuration with low MTU values - mptcp: reset rcv wnd on disconnect - mptcp: cleanup fallback dummy mapping generation - octeontx2-af: CGX: add bounds check to cgx_speed_mbps index - octeontx2-af: replace deprecated strncpy with strscpy - cgroup/cpuset: Reset DL migration state on can_attach() failure - fbdev/vt8500lcdfb: Initialize fb_ops with fbdev macros - soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get() - driver core: reject devices with unregistered buses - drm/amd/display: Use krealloc_array() in dal_vector_reserve() - drm/amdgpu: restart the CS if some parts of the VM are still invalidated - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 - drm/amdkfd: fix NULL dereference in get_queue_ids() - slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock - slimbus: qcom-ngd-ctrl: fix OF node refcount - thunderbolt: Limit XDomain response copy to actual frame size - sctp: stream: fully roll back denied add-stream state - mmc: sdhci: add signal voltage switch in sdhci_resume_host - mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC - mmc: litex_mmc: Set mandatory idle clocks before CMD0 - mmc: core: Fix host controller programming for fixed driver type - mm/hugetlb: restore reservation on error in hugetlb folio copy paths - octeontx2-af: fix memory leak in rvu_setup_hw_resources() - nvmem: layouts: onie-tlv: fix hang on unknown types - net: rds: clear i_sends on setup unwind - net: mv643xx: fix OF node refcount - net/mlx5: Reorder completion before putting command entry in cmd_work_handler - misc: fastrpc: fix use-after-free race in fastrpc_map_create - misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context - Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard - i2c: tegra: Fix NOIRQ suspend/resume - i2c: stm32f7: fix timing computation ignoring i2c-analog-filter - i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() - pidfd: refuse access to tasks that have started exiting harder - ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write - vsock/vmci: fix sk_ack_backlog leak on failed handshake - wifi: nl80211: reject oversized EMA RNR lists - selftests: mptcp: add test for extra_subflows underflow on userspace PM - mptcp: sockopt: check timestamping ret value - mptcp: allow subflow rcv wnd to shrink - mptcp: close TOCTOU race while computing rcv_wnd - mptcp: fix retransmission loop when csum is enabled - ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow - ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O - ARM: socfpga: Fix OF node refcount leak in SMP setup - mm/damon/ops-common: call folio_test_lru() after folio_get() - drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info() - ALSA: timer: Fix UAF at snd_timer_user_params() - USB: serial: option: add usb-id for Dell Wireless DW5826e-m - xfrm: espintcp: do not reuse an in-progress partial send - ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL - mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation - tracing/probes: Point the error offset correctly for eprobe argument error - netfilter: nft_tunnel: fix use-after-free on object destroy - clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time - net: mvpp2: build skb from XDP-adjusted data on XDP_PASS - net: mvpp2: refill RX buffers before XDP or skb use - net: mvpp2: Add metadata support for xdp mode - netfilter: nf_log: validate MAC header was set before dumping it - rds: mark snapshot pages dirty in rds_info_getsockopt() - net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion - r8152: handle the return value of usb_reset_device() - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove - net: phy: clean the sfp upstream if phy probing fails - net/mlx4: avoid GCC 10 __bad_copy_from() false positive - ASoC: wm_adsp: Fix NULL dereference when removing firmware controls - arm64: tlb: Allow XZR argument to TLBI ops - KVM: arm64: Remove VPIPT I-cache handling - tools/rv: Fix cleanup after failed trace setup - time: Fix off-by-one in settimeofday() usec validation - ipmi: Fix rcu_read_unlock to srcu_read_unlock in handle_read_event_rsp - ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() - vxlan: vnifilter: fix spurious notification on VNI update - vxlan: vnifilter: send notification on VNI add - octeontx2-af: npc: Fix CPT channel mask in npc_install_flow - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown - ptp: vclock: Switch from RCU to SRCU - net: fec: fix pinctrl default state restore order on resume - net: lan743x: permit VLAN-tagged packets up to configured MTU - net: garp: fix unsigned integer underflow in garp_pdu_parse_attr - hsr: Remove WARN_ONCE() in hsr_addr_is_self(). - net: Annotate sk->sk_write_space() for UDP SOCKMAP. - pcnet32: stop holding device spin lock during napi_complete_done - drm/imx: Fix three kernel-doc warnings in dcss-scaler.c - 6lowpan: fix off-by-one in multicast context address compression - netfilter: xt_NFQUEUE: prefer raw_smp_processor_id - tee: optee: prevent use-after-free when the client exits before the supplicant - net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS - Disable -Wattribute-alias for clang-23 and newer - RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug - USB: serial: mct_u232: fix memory corruption with small endpoint - usb: core: Fix SuperSpeed root hub wMaxPacketSize - serial: zs: Convert to use a platform device - serial: dz: Convert to use a platform device - serial: dz: Fix bootconsole handover lockup - xhci: tegra: Fix ghost USB device on dual-role port unplug - USB: serial: digi_acceleport: fix memory corruption with small endpoints - landlock: Fix handling of disconnected directories - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync - USB: serial: cypress_m8: fix memory corruption with small endpoint - serial: zs: Switch to using channel reset - serial: zs: Fix bootconsole handover lockup - serial: dz: Fix bootconsole message clobbering at chip reset - drm/amdkfd: Check for pdd drm file first in CRIU restore path - drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger - drm/amdkfd: fix NULL pointer bug in svm_range_set_attr - serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma - serial: zs: Fix swapped RI/DSR modem line transition counting - serial: sh-sci: fix memory region release in error path - serial: qcom-geni: fix UART_RX_PAR_EN bit position - serial: altera_jtaguart: handle uart_add_one_port() failures - drm/amd/pm/si: Disregard vblank time when no displays are connected - drm/i915: Fix potential UAF in TTM object purge - drm/hyperv: validate VMBus packet size in receive callback - drm/hyperv: validate resolution_count and fix WIN8 fallback - scsi: target: iscsi: Validate CHAP_R length before base64 decode - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 - scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker - thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow - thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() - usb: gadget: f_fs: copy only received bytes on short ep0 read - usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports - usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling - usb: gadget: f_hid: fix device reference leak in hidg_alloc() - usb: gadget: net2280: Fix double free in probe error path - USB: serial: mct_u232: fix missing interrupt-in transfer sanity check - USB: serial: mxuport: fix memory corruption with small endpoint - USB: serial: keyspan: fix missing indat transfer sanity check - USB: serial: cypress_m8: validate interrupt packet headers - USB: serial: belkin_sa: validate interrupt status length - USB: serial: option: add MeiG SRM813Q - usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize - usb: usbtmc: check URB actual_length for interrupt-IN notifications - usbip: vudc: Fix use after free bug in vudc_remove due to race condition - usb: storage: Add quirks for PNY Elite Portable SSD - USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers - usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval - usb: chipidea: core: convert ci_role_switch to local variable - tty: serial: pch_uart: add check for dma_alloc_coherent() - counter: Fix refcount leak in counter_alloc() error path - comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() - comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() - Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 - Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem - Input: xpad - add support for ASUS ROG RAIKIRI II - Input: xpad - add "Nova 2 Lite" from GameSir - ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks - ASoC: qcom: q6asm-dai: close stream only when running - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check - xfrm: ah: use skb_to_full_sk in async output callbacks - xfrm: route MIGRATE notifications to caller's netns - nfc: hci: fix out-of-bounds read in HCP header parsing - iommu, debugobjects: avoid gcc-16.1 section mismatch warnings - HID: wacom: Fix OOB write in wacom_hid_set_device_mode() - ip6: vti: Use ip6_tnl.net in vti6_changelink(). - xfrm: input: hold netns during deferred transport reinjection - ipv6: validate extension header length before copying to cmsg - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). - ipv6: exthdrs: refresh nh after handling HAO option - ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() - macsec: fix replay protection at XPN lower-PN wrap - bpf: sockmap: fix tail fragment offset in bpf_msg_push_data - Input: elan_i2c - validate firmware size before use - usb: dwc2: Fix use after free in debug code - usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles - usb: cdns3: gadget: fix request skipping after clearing halt - USB: serial: omninet: fix memory corruption with small endpoint - iio: buffer: hw-consumer: fix use-after-free in error path - iio: light: cm3323: fix reg_conf not being initialized correctly - iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL - iio: temperature: tsys01: fix broken PROM checksum validation - iio: ssp_sensors: cancel delayed work_refresh on remove - iio: gyro: itg3200: fix i2c read into the wrong stack location - iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw - iio: dac: ad5686: acquire lock when doing powerdown control - iio: dac: ad5686: fix input raw value check - iio: dac: max5821: fix return value check in powerdown sync - iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux - wireguard: send: append trailer after expanding head - KVM: arm64: PMU: Preserve AArch32 counter low bits - parport: Fix race between port and client registration - Input: xpad - fix out-of-bounds access for Share button - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock - Bluetooth: ISO: fix UAF in iso_recv_frame - Bluetooth: HIDP: fix missing length checks in hidp_input_report() - auxdisplay: line-display: fix OOB read on zero-length message_store() - hpfs: fix a crash if hpfs_map_dnode_bitmap fails - Bluetooth: btusb: Allow firmware re-download when version matches - HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse - Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() - USB: serial: safe_serial: fix memory corruption with small endpoint - usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT - usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() - usb: typec: altmodes/displayport: validate count before reading Status Update VDO - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO - usb: typec: ucsi: ccg: reject firmware images without a ':' record header - iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer - soc/tegra: pmc: Fix unsafe generic_handle_irq() call - hwmon: (pmbus/adm1266) serialize NVMEM blackbox read with pmbus_lock - hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock - of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() - phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X - drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used - drm/dp: Add eDP 1.5 bit definition - drm/i915/psr: Read Intel DPCD workaround register - drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register - media: rc: fix race between unregister and urb/irq callbacks - batman-adv: bla: avoid double decrement of bla.num_requests - batman-adv: tt: avoid empty VLAN responses - batman-adv: tt: fix TOCTOU race for reported vlans - batman-adv: tp_meter: directly shut down timer on cleanup - batman-adv: tp_meter: avoid role confusion in tp_list - batman-adv: iv: recover OGM scheduling after forward packet error - batman-adv: tvlv: reject oversized TVLV packets - batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface - batman-adv: tt: reject oversized local TVLV buffers - batman-adv: tvlv: abort OGM send on tvlv append failure - net: skbuff: fix pskb_carve leaking zcopy pages - ipv6: fix possible infinite loop in fib6_select_path() - ipv6: fix possible infinite loop in rt6_fill_node() - sctp: fix race between sctp_wait_for_connect and peeloff - net: mana: Add NULL guards in teardown path to prevent panic on attach failure - gpio: rockchip: convert bank->clk to devm_clk_get_enabled() - Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() - ethtool: eeprom: add more safeties to EEPROM Netlink fallback - ethtool: eeprom: add missing ethnl_ops_begin() / _complete() during fallback - bonding: refuse to enslave CAN devices - Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() - ASoC: codecs: simple-mux: Fix enum control bounds check - ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() - gpio: mxc: fix irq_high handling - net: hsr: fix potential OOB access in supervision frame handling - ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues - net/iucv: fix locking in .getsockopt - net/smc: Do not re-initialize smc hashtables - net: netlink: don't set nsid on local notifications - net: netlink: fix sending unassigned nsid after assigned one - vsock: keep poll shutdown state consistent - netfilter: nf_tables: fix dst corruption in same register operation - netfilter: bitwise: add support for doing AND, OR and XOR directly - netfilter: bitwise: rename some boolean operation functions - netfilter: ebtables: fix OOB read in compat_mtw_from_user - netfilter: xt_cpu: prefer raw_smp_processor_id - netfilter: synproxy: refresh tcphdr after skb_ensure_writable - xfrm: Check for underflow in xfrm_state_mtu - nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() - nfc: llcp: Fix use-after-free in llcp_sock_release() - net: cpsw_new: Fix potential unregister of netdev that has not been registered yet - drm: Remove plane hsub/vsub alignment requirement for core helpers - net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net: mctp: ensure our nlmsg responses are initialised - Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size - MIPS: smp: report dying CPU to RCU in stop_this_cpu() - LoongArch: Report dying CPU to RCU in stop_this_cpu() - irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT - tls: Flush backlog before waiting for a new record - net: ethernet: cortina: No mapping is a dropped rx - batman-adv: fix batadv_skb_is_frag() kernel-doc - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled - Bluetooth: ISO: fix malformed ISO_END/CONT handling - Bluetooth: MGMT: Fix backward compatibility with userspace - security/keys: fix missed RCU read section on lookup - LoongArch: kprobes: Fix handling of fatal unrecoverable recursions - pds_core: ensure null-termination for firmware version strings - pds_core: add an error code check in pdsc_dl_info_get - net: mana: validate rx_req_idx to prevent out-of-bounds array access - ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove() - gpio: cdev: check if uAPI v2 config attributes are correctly zeroed - gpiolib: cdev: use !mem_is_zero() instead of memchr_inv(s, 0, n) - string: add mem_is_zero() helper to check if memory area is all zeros - bpf, skmsg: fix verdict sk_data_ready racing with ktls rx - net: ag71xx: check error for platform_get_irq - Bluetooth: btmtk: rename btmediatek_data - Bluetooth: btusb: mediatek: refactor the function btusb_mtk_reset - Bluetooth: btmtk: add the function to get the fw name - ALSA: seq: Serialize UMP output teardown with event_input - ALSA: seq: ump: Use guard() for locking - pds_core: fix debugfs_lookup dentry leak and error handling - pds_core: fix error handling in pdsc_devcmd_wait - bridge: mcast: Fix a possible use-after-free when removing a bridge port - net: bridge: Flush multicast groups when snooping is disabled - RDMA/rtrs: Fix use-after-free in path file creation cleanup - platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL - platform/x86: intel-hid: Check ACPI_HANDLE() against NULL - platform/x86: hp_accel: Check ACPI_COMPANION() against NULL - platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer - net: dsa: mt7530: preserve VLAN tags on trapped link-local frames - net: dsa: mt7530: rename mt753x_bpdu_port_fw enum to mt753x_to_cpu_fw - net: dsa: mt7530: fix FDB entries not aging out with short timeout - wifi: ath11k: fix peer resolution on rx path when peer_id=0 - drm/msm/snapshot: fix dumping of the unaligned regions - spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache() - net/mlx5: Do not restore destination-less TC rules - tls: Preserve sk_err across recvmsg() when data has been copied - x86/xen: Fix xen_e820_swap_entry_with_ram() - net: phy: DP83TC811: add reading of abilities - net: phy: c45: add genphy_c45_pma_read_ext_abilities() function - net: tls: prevent chain-after-chain in plain text SG - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot - powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise() - drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN - drm/msm/dsi: don't dump registers past the mapped region - ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics - net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint - accel/qaic: Add overflow check to remap_pfn_range during mmap - HID: quirks: really enable the intended work around for appledisplay - wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm() - wifi: ath11k: fix error path leaks in some WMI WOW calls - net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS reference - net: ethernet: cortina: Carry over frag counter - net: ethernet: cortina: Drop half-assembled SKB - net: ethernet: cortina: Make RX SKB per-port - netfs: Fix overrun check in netfs_extract_user_iter() - zonefs: handle integer overflow in zonefs_fname_to_fno - irqchip/ath79-cpu: Remove unused function - phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access - net: lan966x: avoid unregistering netdev on register failure - ice: fix locking in ice_dcb_rebuild() - tcp: Fix imbalanced icsk_accept_queue count. - test_kprobes: clear kprobes between test runs - kprobes: skip non-symbol addresses in kprobe_add_ksym_blacklist() - netfilter: x_tables: unregister the templates first - ALSA: hda: cs35l56: Put ACPI device after setting companion - ARM: integrator: Fix early initialization - pinctrl: qcom: Fix wakeirq map by removing disconnected irqs for sm8150 - kunit: config: KUNIT_DEBUGFS should depend on DEBUG_FS - kunit: config: Enable KUNIT_DEBUGFS by default - firmware: arm_ffa: Skip free_pages on RX buffer alloc failure - firmware: arm_ffa: Check for NULL FF-A ID table while driver registration - HID: uclogic: Fix regression of input name assignment - hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors - hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe() - hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe() - hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in get_multiple - hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR - hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer - hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer - hwmon: (pmbus/adm1266) reject implausible blackbox record_count - hwmon: (pmbus/adm1266) seed timestamp from the real-time clock - batman-adv: tt: fix negative tt_buff_len - batman-adv: tt: fix negative last_changeset_len - batman-adv: tp_meter: fix race condition in send error reporting - batman-adv: tp_meter: avoid use of uninit sender vars - batman-adv: bla: fix report_work leak on backbone_gw purge - batman-adv: frag: disallow unicast fragment in fragment - batman-adv: fix fragment reassembly length accounting - batman-adv: dat: handle forward allocation error - batman-adv: clear current gateway during teardown - batman-adv: mcast: fix use-after-free in orig_node RCU release - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async - drm/amd/display: Validate GPIO pin LUT table size before iterating - drm/amd/display: Fix integer overflow in bios_get_image() - drm/bridge: megachips: remove bridge when irq request fails - drm/bridge: it66121: acquire reset GPIO in probe - drm/virtio: use uninterruptible resv lock for plane updates - device property: set fwnode->secondary to NULL in fwnode_init() - LoongArch: Remove unused code to avoid build warning - RDMA/siw: Reject MPA FPDU length underflow before signed receive math - spi: ti-qspi: fix use-after-free after DMA setup failure - spi: sprd: fix error pointer deref after DMA setup failure - scsi: isci: Fix use-after-free in device removal path - phy: tegra: xusb: Fix per-pad high-speed termination calibration - spi: qup: fix error pointer deref after DMA setup failure - drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe - KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits - arm64: probes: Handle probes on hinted conditional branch instructions - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() - ice: fix setting promisc mode while adding VID filter - ixgbevf: fix use-after-free in VEPA multicast source pruning - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 - wifi: ath11k: clear shared SRNG pointer state on restart - vsock/vmci: fix UAF when peer resets connection during handshake - ring-buffer: Fix reporting of missed events in iterator - qed: fix double free in qed_cxt_tables_alloc() - netfilter: ipset: stop hash:* range iteration at end - netfilter: nf_queue: hold bridge skb->dev while queued - netfilter: ip6t_hbh: reject oversized option lists - net: ifb: report ethtool stats over num_tx_queues - net: bcmgenet: keep RBUF EEE/PM disabled - phonet/pep: disable BH around forwarded sk_receive_skb() - Bluetooth: MGMT: validate Add Extended Advertising Data length - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths - Bluetooth: bnep: Fix UAF read of dev->name - Bluetooth: ISO: drop ISO_END frames received without prior ISO_START - net: wwan: iosm: fix potential memory leaks in ipc_imem_init() - drivers/base/memory: fix memory block reference leak in poison accounting - efi: Allocate runtime workqueue before ACPI init - ALSA: asihpi: Fix potential OOB array access at reading cache - ALSA: pcm: Don't setup bogus iov_iter for silencing - ALSA: ua101: Reject too-short USB descriptors - hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX - smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() - ksmbd: fix null pointer dereference in compare_guid_key() - mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break() - sysfs: don't remove existing directory on update failure - Revert "af_unix: Reject SIOCATMARK on non-stream sockets" - Revert "s390/cio: Update purge function to unregister the unused subchannels" - Revert "ice: Remove jumbo_remove step from TX path" - Revert "ice: fix double-free of tx_buf skb" - Revert "x86/vdso: Fix output operand size of RDPID" - wifi: mac80211: check tdls flag in ieee80211_tdls_oper - s390/debug: Reject zero-length input before trimming a newline - mptcp: pm: ADD_ADDR rtx: free sk if last - mptcp: sync the msk->sndbuf at accept() time - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close - netfilter: revalidate bridge ports - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp - net: bonding: fix NULL pointer dereference in bond_do_ioctl() - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() - udp: clear skb->dev before running a sockmap verdict - crypto: nx - Fix packed layout in struct nx842_crypto_header - crypto: nx - Use static_assert() to check struct sizes - batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown - Revert "ALSA: pcmtest: fix reference leak on failed device registration" - media: rc: ttusbir: fix inverted error logic - media: rc: igorplugusb: fix control request setup packet - batman-adv: tp_meter: fix tp_num leak on kmalloc failure - batman-adv: stop tp_meter sessions during mesh teardown - ALSA: seq: Fix UMP group 16 filtering - ALSA: seq: Notify client and port info changes - ALSA: core: Serialize deferred fasync state checks - ALSA: misc: Use guard() for spin locks - ALSA: hda: cs35l56: Propagate ASP TX source control errors - crypto: nx - Avoid -Wflex-array-member-not-at-end warning - ksmbd: reset rcount per connection in ksmbd_conn_wait_idle_sess_id() - media: rc: igorplugusb: heed coherency rules - ALSA: aoa: Skip devices with no codecs in i2sbus_resume() - media: rc: ttusbir: respect DMA coherency rules - ALSA: aoa: i2sbus: clear stale prepared state - ALSA: aoa: Use guard() for mutex locks - f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally - ksmbd: replace connection list with hash table - ksmbd: use msleep instaed of schedule_timeout_interruptible() - f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io() - smb: move some duplicate definitions to common/smbacl.h - iommu/amd: serialize sequence allocation under concurrent TLB invalidations - x86/shstk: Prevent deadlock during shstk sigreturn - ALSA: pcmtest: Fix resource leaks in module init error paths - ALSA: pcmtest: fix reference leak on failed device registration - ALSA: 6fire: Fix input volume change detection - ALSA: caiaq: Fix control_put() result and cache rollback - ALSA: core: Fix potential data race at fasync handling - Revert "ALSA: usb-audio: Cap the packet size pre-calculations" - ipv6: sit: reload inner IPv6 header after GSO offloads - net: guard timestamp cmsgs to real error queue skbs - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() - netfilter: x_tables: avoid leaking percpu counter pointers - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush - netfilter: require Ethernet MAC header before using eth_hdr() - netfilter: nft_fib: fix stale stack leak via the OIFNAME register - vsock/virtio: reset connection on receiving queue overflow - vsock/virtio: fix skb overhead accounting to preserve full buf_alloc - vsock/virtio: fix potential unbounded skb queue - mptcp: pm: ADD_ADDR rtx: always decrease sk refcount - mptcp: pm: ADD_ADDR rtx: allow ID 0 - ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers - srcu: Use irq_work to start GP in tiny SRCU - irqwork: Move data struct to a types header - types: move struct rcuwait into types.h - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets - wifi: iwlwifi: fix 22000 series SMEM parsing - wifi: iwlwifi: allow IWL_FW_CHECK() with just a string - x86: shadow stacks: proper error handling for mmap lock - net: mvpp2: sync RX data at the hardware packet offset - net: mvpp2: limit XDP frame size to the RX buffer - batman-adv: fix tp_meter counter underflow during shutdown - batman-adv: v: stop OGMv2 on disabled interface - ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger - spi: mpc52xx: fix controller deregistration - thunderbolt: Bound root directory content to block size - selinux: fix overlayfs mmap() and mprotect() access checks - lsm: add backing_file LSM hooks - fs: constify file ptr in backing_file accessor helpers - fs: prepare for adding LSM blob to backing_file - selftests/bpf: Add tests for ld_{abs,ind} failure path in subprogs - bpf: Fix ld_{abs,ind} failure path analysis in subprogs - KVM: x86: Fix shadow paging use-after-free due to unexpected role - Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref - Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() - fix kabi for ppp_defs.h - pppoe: drop PFC frames - netfilter: nat: use kfree_rcu to release ops - drm/i915/gem: Fix phys BO pread/pwrite with offset - selinux: allow multiple opens of /sys/fs/selinux/policy - ksmbd: make ksmbd thread names distinct by client IP - ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path - ALSA: caiaq: Don't abort when no input device is available - ALSA: caiaq: fix usb_dev refcount leak on probe failure - ALSA: caiaq: Handle probe errors properly - ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow - USB: cdc-acm: Fix bit overlap and move quirk definitions to header - ALSA: caiaq: take a reference on the USB device in create_card() - ALSA: usb-audio: apply quirk for MOONDROP JU Jiu - ksmbd: use check_add_overflow() to prevent u16 DACL size overflow - ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment - smb: server: fix max_connections off-by-one in tcp accept path - smb: server: fix active_num_conn leak on transport allocation failure - usb: port: add delay after usb_hub_set_port_power() - USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen - usb: storage: Expand range of matched versions for VL817 quirks entry - xfrm: Wait for RCU readers during policy netns exit - KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing - mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison - thunderbolt: Clamp XDomain response data copy to allocation size - bpf: return VMA snapshot from task_vma iterator - bpf: switch task_vma iterator from mmap_lock to per-VMA locks - bpf: fix mm lifecycle in open-coded task_vma iterator - netfilter: nft_ct: bail out on template ct in get eval - drm/amd/display: Bound VBIOS record-chain walk loops - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size - drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() - netfilter: conntrack_irc: fix possible out-of-bounds read - drm/vc4: fix krealloc() memory leak - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error - f2fs: fix data loss caused by incorrect use of nat_entry flag - bnxt_en: Fix NULL pointer dereference - ipv6: mcast: Fix use-after-free when processing MLD queries - ipvs: clear the svc scheduler ptr early on edit - netfilter: synproxy: add mutex to guard hook reference counting - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list - net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr - netlabel: validate unlabeled address and mask attribute lengths - netfilter: bridge: make ebt_snat ARP rewrite writable - tcp: restrict SO_ATTACH_FILTER to priv users - ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER - Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig - misc: fastrpc: fix DMA address corruption due to find_vma misuse - misc: fastrpc: Fix NULL pointer dereference in rpmsg callback - gpio: mvebu: fix NULL pointer dereference in suspend/resume - Bluetooth: fix memory leak in error path of hci_alloc_dev() - Bluetooth: bnep: reject short frames before parsing - Bluetooth: RFCOMM: validate skb length in MCC handlers - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams - RDMA/srp: bound SRP_RSP sense copy by the received length - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN - net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure - sched/psi: fix race between file release and pressure write - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase - rculist: add list_splice_rcu() for private lists - net: skbuff: fix missing zerocopy reference in pskb_carve helpers - ip6_vti: set netns_immutable on the fallback device. - wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() - wifi: rtw88: debugfs: support multiple adapters debugging - erofs: fix use-after-free on sbi->sync_decompress - net: openvswitch: fix possible kfree_skb of ERR_PTR - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() - md: wake raid456 reshape waiters before suspend - dm cache policy smq: check allocation under invalidate lock - Bluetooth: MGMT: validate advertising TLV before type checks - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend - USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL - USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam - USB: serial: option: add support for Rolling Wireless RW135R-GL - USB: serial: io_edgeport: add support for Blackbox IC135A - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr - netfilter: flowtable: strictly check for maximum number of actions - fuse: reject fuse_notify() pagecache ops on directories - fs/mbcache: cancel shrink work before destroying the cache - smb/client: fix possible infinite loop and oob read in symlink_data() - fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp - ata: libata-scsi: do not needlessly defer commands when using PMP with FBS - ata: libata-scsi: do not use the deferred QC feature on PMPs with CBS - ata: libata-scsi: do not use the deferred QC feature for ATA_DEFER_PORT - ata: libata-scsi: improve readability of ata_scsi_qc_issue() - ata: libata-scsi: fix requeue of deferred ATA PASS-THROUGH commands - ata: libata-eh: Fix detection of deferred qc timeouts - ata: libata: cancel pending work after clearing deferred_qc - ata: libata-core: fix cancellation of a port deferred qc work - ata: libata-scsi: rename and improve ata_qc_done() - ata: libata-scsi: simplify ata_scsi_requeue_deferred_qc() - ata: libata-sata: simplify ata_sas_queuecmd() - ata: libata-core: improve tag checks in ata_qc_issue() - ata: libata-eh: correctly handle deferred qc timeouts - ata: libata-scsi: avoid Non-NCQ command starvation - ata: libata: Introduce ata_port_eh_scheduled() - ext4: handle wraparound when searching for blocks for indirect mapped blocks - ext4: fix error pointer dereference in ext4_mb_load_buddy_gfp() - ext4: always allocate blocks only from groups inode can use - ext4: fix e4b bitmap inconsistency reports - ext4: convert bd_buddy_page to bd_buddy_folio - ext4: convert bd_bitmap_page to bd_bitmap_folio - Revert "ext4: fix e4b bitmap inconsistency reports" - ext4: cleanup for ext4_map_blocks - ext4: rename EXT4_GET_BLOCKS_PRE_IO - ext4: drop extent cache when splitting extent fails - ext4: drop extent cache after doing PARTIAL_VALID1 zeroout - ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O - ext4: correct the comments place for EXT4_EXT_MAY_ZEROOUT - ext4: get rid of ppath in ext4_ext_handle_unwritten_extents() - ext4: get rid of ppath in ext4_ext_convert_to_initialized() - ext4: get rid of ppath in ext4_split_convert_extents() - ext4: get rid of ppath in ext4_split_extent() - ext4: get rid of ppath in ext4_force_split_extent_at() - ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 - ext4: subdivide EXT4_EXT_DATA_VALID1 - Revert "ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O" - ext4: get rid of ppath in ext4_split_extent_at() - ext4: get rid of ppath in ext4_ext_insert_extent() - ext4: get rid of ppath in get_ext_path() - ext4: add new ext4_ext_path_brelse() helper - !24596 [sync]urma: fix workqueue use-after-free in ubagg_exit teardown sequence - urma: fix workqueue use-after-free in ubagg_exit teardown sequence - !24607 ub: udma: Optimize udma jetty id access logic. - ub: udma: Optimize udma jetty id access logic. - !24640 [sync]urma: limit ubcore logs in reuse paths - urma: fix workqueue use-after-free in ubagg_exit teardown sequence - !24669 mm/madvise: add MADV_FCMA_ENABLE to set PF_FOLIO_CMA via madvise - mm/madvise: add MADV_FCMA_ENABLE to set PF_FOLIO_CMA via madvise - !24702 [sync]urma: retry import jetty/jfr on EIO from tpid reuse failure - urma: retry import jetty/jfr on EIO from tpid reuse failure - urma: limit ubagg connect exchange logs * Fri Jul 10 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-145.3.18.151.20260710.aae66044906b - !24753 [sync]urma: drain jfe event lists in batches to avoid soft-lockup - urma: drain jfe event lists in batches to avoid soft-lockup - urma: reduce ubagg topo log noise - !24748 [sync]urma: free completion events outside jfe lock - urma: free jfe events outside lock - urma: free completion events outside jfe lock - !24742 urma: Fix the issue of inaccurate timing for some functions in DFX - !24741 [sync]urma: fix UAF of accessing token_id in log. - urma: Fix the issue of inaccurate timing for some functions in DFX - urma: fix UAF of accessing token_id in log. - !24734 [sync]urma: fix tpid_reuse attached to vtpn causes use_after_free - urma: fix tpid_reuse attached to vtpn causes use_after_free - !24804 [sync]urma: use vzalloc for ubmad tjetty and ini_rtbuffer - !24774 [sync]urma: ratelimit import jetty/jfr error logs - urma: use vzalloc for ubmad tjetty and ini_rtbuffer - !24792 [sync]urma: fix UAF of accessing jfs/jetty in log. - urma: fix UAF of accessing jfs/jetty in log. - urma: ratelimit import jetty/jfr error logs - !24845 [sync]ub/ubdevshm: Support for acquiring va is a sub-range of registered va - ub/ubdevshm: Support for acquiring va is a sub-range of registered va - !24802 [sync]urma: use xarray for ubagg/ubcore session lookup - urma: use xarray for ubagg/ubcore session lookup - !24814 [sync]urma: make ratelimit burst configurable for ubcore/uburma/ubagg - urma: make ratelimit burst configurable for ubcore/uburma/ubagg * Wed Jul 22 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-145.3.22.153.20260722.158daf1d8dea - !24942 [sync]urma: drop param_set_uint_minmax for ratelimit burst setters - urma: drop param_set_uint_minmax for ratelimit burst setters - !25840 sync CVE LTS and bugfix from OLK-6.6 d33ffc8f8580 to 334dfd575ba5 - cgroup/rstat: avoid disabling irqs for O(num_cpu) - netfilter: bridge: eb_tables: close module init race - crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents - netfilter: ebtables: move to two-stage removal scheme - crypto: qat - protect service table iterations with service_lock - Bluetooth: eir: Fix stack OOB write when prepending the Flags AD - drm/edid: fix OOB read in drm_parse_tiled_block() - proc: protect ptrace_may_access() with exec_update_lock (FD links) - vfio/pci: Latch disable_idle_d3 per device - bpf: Fix UAF in sock clone early bailouts - bpf: Disable xfrm_decode_session hook attachment - bpf,fork: wipe ->bpf_storage before bailouts that access it - KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() - crypto: qat - validate RSA CRT component lengths - bpf: Clear rb node linkage when freeing bpf_rb_root - bpf: Add validation for bpf_set_retval argument - bpf: Reject sleepable BPF_LSM_CGROUP programs at load time - bpf: Fix setting retval to -EPERM for cgroup hooks not returning errno - bpf: Guard __get_user acesss with access_ok for uprobe_multi data - i2c: core: fix adapter registration race - ALSA: hda/cs35l41: Fix firmware load work teardown - vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc - iommufd: Break the loop on failure in iommufd_fault_fops_read() - posix-cpu-timers: Prevent UAF caused by non-leader exec() race - iio: event: Fix event FIFO reset race - hwrng: virtio: clamp device-reported used.len at copy_data() - crypto: drbg - Fix returning success on failure in CTR_DRBG - crypto: ecc - Fix carry overflow in vli multiplication - crypto: pcrypt - restore callback for non-parallel fallback - net: openvswitch: reject oversized nested action attrs - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page - e1000e: Fix out-of-bounds MMIO access by validating BAR0 size - xsched: enforce permissions on attribute access - xsched: restrict vstream management to privileged users - rme: use DMA API for virtio in realm world - udf: validate sparing table length as an entry count, not a byte count - smb: client: harden POSIX SID length parsing - smb: client: mask server-provided mode to 07777 in modefromsid - smb: client: Fix next buffer leak in receive_encrypted_standard() - nvmet-auth: validate reply message payload bounds against transfer length - bpf: Reject fragmented frames in devmap - bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized - mm/huge_memory: update file PMD counter before folio_put() - sctp: fix uninit-value in __sctp_rcv_asconf_lookup() - smb: client: reject overlapping data areas in SMB2 responses - smb: client: restrict implied bcc[0] exemption to responses without data area - io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item - writeback: drop now-unnecessary rcu_barrier() in cgroup_writeback_umount() - writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() - writeback: Fix use after free in inode_switch_wbs_work_fn() - writeback: Avoid contention on wb->list_lock when switching inodes - block: skip sync_blockdev() on surprise removal in bdev_mark_dead() - mm: do file ownership checks with the proper mount idmap - tracing: Bound synthetic-field strings with seq_buf - perf/core: Detach event groups during remove_on_exec - bpf: Allow LPM map access from sleepable BPF programs - bpf: Consistently use bpf_rcu_lock_held() everywhere - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC - udf: validate VAT header length against the VAT inode size - isofs: bound Rock Ridge symlink components to the SL record - udf: validate free block extents against the partition length - config: arm64: update CONFIG_FTRACE_STARTUP_TEST not set - crypto: qat - Return pointer directly in adf_ctl_alloc_resources - crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() - drivers/base/memory: set mem->altmap after successful device registration - serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails - serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero - NFS: Prevent resource leak in nfs_alloc_server() - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr - nfsd: check get_user() return when reading princhashlen - fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode - fbdev: modedb: fix a possible UAF in fb_find_mode() - fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var - power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path - 9p: avoid putting oldfid in p9_client_walk() error path - ocfs2: reject oversized group bitmap descriptors - rpmsg: char: Fix use-after-free on probe error path - fpga: region: fix use-after-free in child_regions_with_firmware() - irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove - pNFS: Fix use-after-free in pnfs_update_layout() - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done - hdlc_ppp: sync per-proto timers before freeing hdlc state - gfs2: fix use-after-free in gfs2_qd_dealloc - exfat: fix potential use-after-free in exfat_find_dir_entry() - bpf: use kvfree() for replaced sysctl write buffer - f2fs: keep atomic write retry from zeroing original data - f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node() - f2fs: validate ACL entry sizes in f2fs_acl_from_disk() - f2fs: fix to round down start offset of fallocate for pin file - f2fs: validate compress cache inode only when enabled - wifi: iwlwifi: mvm: fix race condition in PTP removal - wifi: rtw88: usb: fix memory leaks on USB write failures - wifi: rtw88: increase TX report timeout to fix race condition - wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor - wifi: ath11k: fix warning when unbinding - wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S - keys: Pin request_key_auth payload in instantiate paths - KEYS: fix overflow in keyctl_pkey_params_get_2() - err.h: use __always_inline on all error pointer helpers - fbdev: fix use-after-free in store_modes() - NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR - apparmor: mediate the implicit connect of TCP fast open sendmsg - net: skmsg: preserve sg.copy across SG transforms - mac802154: llsec: add skb_cow_data() before in-place crypto - af_unix: Set gc_in_progress to true in unix_gc(). - ntfs3: reject direct userspace writes to reserved $LX* xattrs - ipv4: account for fraggap on the paged allocation path - inet: add indirect call wrapper for getfrag() calls - ipv6: account for fraggap on the paged allocation path - batman-adv: tvlv: avoid race of cifsnotfound handler state - batman-adv: tvlv: enforce 2-byte alignment - batman-adv: dat: prevent false sharing between VLANs - batman-adv: tt: track roam count per VID - batman-adv: tt: don't merge change entries with different VIDs - batman-adv: tp_meter: handle overlapping packets - batman-adv: tp_meter: prevent parallel modifications of last_recv - batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE - batman-adv: tp_meter: restrict number of unacked list entries - batman-adv: v: prevent OGM aggregation on disabled hardif - batman-adv: frag: avoid underflow of TTL - batman-adv: frag: ensure fragment is writable before modifying TTL - batman-adv: fix (m|b)cast csum after decrementing TTL - batman-adv: ensure bcast is writable before modifying TTL - batman-adv: tp_meter: initialize last_recv_time during init - batman-adv: prevent ELP transmission interval underflow - batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE - batman-adv: tp_meter: add only finished tp_vars to lists - batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection - batman-adv: tp_meter: fix fast recovery precondition - batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd - batman-adv: tp_meter: avoid window underflow - batman-adv: tp_meter: initialize dec_cwnd explicitly - batman-adv: tp_meter: initialize dup_acks explicitly - batman-adv: tp_meter: keep unacked list in ascending ordered - eventpoll: rename ep_remove_safe() back to ep_remove() - file: add fput() cleanup helper - media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si - ksmbd: reject non-VALID session in compound request branch - scripts/sorttable: Fix endianness handling in build-time mcount sort - scripts/sorttable: Allow matches to functions before function entry - scripts/sorttable: Use normal sort if theres no relocs in the mcount section - ftrace: Check against is_kernel_text() instead of kaslr_offset() - ftrace: Test mcount_loc addr before calling ftrace_call_addr() - ftrace: Do not over-allocate ftrace memory - ftrace: Have ftrace pages output reflect freed pages - ftrace: Update the mcount_loc check of skipped entries - scripts/sorttable: Zero out weak functions in mcount_loc table - scripts/sorttable: Always use an array for the mcount_loc sorting - scripts/sorttable: Have mcount rela sort use direct values - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 - scripts/sorttable: Use a structure of function pointers for elf helpers - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly - scripts/sorttable: Move code from sorttable.h into sorttable.c - scripts/sorttable: Use uint64_t for mcount sorting - scripts/sorttable: Add helper functions for Elf_Sym - scripts/sorttable: Add helper functions for Elf_Shdr - scripts/sorttable: Add helper functions for Elf_Ehdr - scripts/sorttable: Convert Elf_Sym MACRO over to a union - scripts/sorttable: Replace Elf_Shdr Macro with a union - scripts/sorttable: Convert Elf_Ehdr to union - scripts/sorttable: Make compare_extable() into two functions - scripts/sorttable: Have the ORC code use the _r() functions to read - scripts/sorttable: Remove unneeded Elf_Rel - scripts/sorttable: Remove unused write functions - scripts/sorttable: Remove unused macro defines - fuse: re-lock request before replacing page cache folio - slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD - slimbus: qcom-ngd-ctrl: Fix up platform_driver registration - rxrpc: Fix the ACK parser to extract the SACK table for parsing - net: phonet: free phonet_device after RCU grace period - phonet: Pass net and ifindex to phonet_address_notify(). - phonet: Pass ifindex to fill_addr(). - Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs - hv: utils: handle and propagate errors in kvp_register - regulator: core: fix locking in regulator_resolve_supply() error path - ring-buffer: Remove ring_buffer_read_prepare_sync() - selftests/bpf: Update comments find_equal_scalars->sync_linked_regs - af_unix: Reject SIOCATMARK on non-stream sockets - selftests/bpf: Add test to ensure kprobe_multi is not sleepable - agp/amd64: Fix broken error propagation in agp_amd64_probe() - net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() - i2c: stub: Reject I2C block transfers with invalid length - RDMA/bnxt_re: zero shared page before exposing to userspace - KVM: VMX: Update SVI during runtime APICv activation - ARM: fix branch predictor hardening - ARM: fix hash_name() fault - ARM: allow __do_kernel_fault() to report execution of memory faults - ARM: group is_permission_fault() with is_translation_fault() - debugobjects: Dont call fill_pool() in early boot hardirq context - debugobjects: Do not fill_pool() if pi_blocked_on - debugobjects: Use LD_WAIT_CONFIG instead of LD_WAIT_SLEEP - debugobjects: Allow to refill the pool before SYSTEM_SCHEDULING - batman-adv: tt: prevent TVLV entry number overflow - drm/v3d: Skip CSD when it has zeroed workgroups - drm/v3d: Store the active job inside the queue's state - iov_iter: Fix potential underflow in iov_iter_extract_xarray_pages() - urma: add check type in free driver obj - smb: client: fix double-free in SMB2_close() replay - smb: client: fix double-free in SMB2_flush() replay - smb: client: fix query_info() replay double-free - smb: client: fix query directory replay double-free - smb: client: fix double-free in SMB2_open() replay - smb: client: fix double-free in SMB2_ioctl() replay - smb: client: fix change notify replay double-free - HID: lg-g15: cancel pending work on remove to fix a use-after-free - HID: multitouch: fix out-of-bounds bit access on mt_io_flags - tracing: Prevent out-of-bounds read in glob matching - sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT - !25616 sync CVE LTS and bugfix from OLK-6.6 b72db20c0437 to d33ffc8f8580 - KVM: x86: hyper-v: Bound the bank index when querying sparse banks - MIPS: DEC: Prevent initial console buffer from landing in XKPHYS - ksmbd: fix durable reconnect error path file lifetime - ksmbd: fix use-after-free in smb2_open during durable reconnect - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query - USB: iowarrior: fix use-after-free on disconnect race - usb: iowarrior: remove inherent race with minor number - USB: iowarrior: fix use-after-free on disconnect - apparmor: fix use-after-free in rawdata dedup loop - tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR - bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops - rbd: eliminate a race in lock_dwork draining on unmap - blk-cgroup: fix UAF in __blkcg_rstat_flush() - net: Fix kabi breakage of struct tc_action - net/sched: act_api: use RCU with deferred freeing for action lifecycle - net: Fix kabi breakage of struct header_ops - bonding: prevent potential infinite loop in bond_header_parse() - bonding: fix type confusion in bond_setup_by_slave() - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc - ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL - ASoC: cs35l56: Fix missing calls to wm_adsp2_remove() - time: Fix off-by-one in compat settimeofday() usec validation - scsi: target: Fix hexadecimal CHAP_I handling - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink - ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY - ksmbd: add a permission check for FSCTL_SET_ZERO_DATA - ksmbd: add per-handle permission check to FILE_LINK_INFORMATION - mptcp: fix missing wakeups in edge scenarios - mptcp: add-addr: always drop other suboptions - ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 - RDMA/umem: fix kernel-doc warnings - mm/migrate: don't call folio_putback_active_hugetlb() on dst hugetlb folio - usb: typec: ucsi: Don't update power_supply on power role change if not connected - serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() - thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() - usb: typec: ucsi: Check if power role change actually happened before handling - usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind - usb: dwc3: xilinx: fix error handling in zynqmp init error paths - usb: musb: omap2430: Fix use-after-free in omap2430_probe() - tty: serial: samsung: Remove redundant port lock acquisition in rx helpers - tty: serial: samsung: use u32 for register interactions - serial: samsung_tty: Use port lock wrappers - ALSA: firewire-motu: Protect register DSP event queue positions - memfd: deny writeable mappings when implying SEAL_WRITE - iio: dac: ad5686: fix ref bit initialization for single-channel parts - usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure - iio: chemical: scd30: fix division by zero in write_raw - iio: chemical: scd30: Use guard(mutex) to allow early returns - iio: gyro: adis16260: fix division by zero in write_raw - Bluetooth: hci_qca: Convert timeout from jiffies to ms - Bluetooth: hci_qca: Migrate to serdev specific shutdown function - serdev: Provide a bustype shutdown function - serdev: make serdev_bus_type const - mm/damon/sysfs-schemes: delete tried region in regions_rmdirs() - mptcp: do not drop partial packets - mptcp: introduce the mptcp_init_skb helper - iio: adc: npcm: fix unbalanced clk_disable_unprepare() - iio: adc: npcm: Convert to platform remove callback returning void - octeontx2-pf: avoid double free of pool->stack on AQ init failure - af_unix: Fix UAF read of tail->len in unix_stream_data_wait() - af_unix: Cache state->msg in unix_stream_read_generic(). - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg - net: hsr: defer node table free until after RCU readers - mptcp: pm: fix ADD_ADDR timer infinite retry on option space insufficient - ice: fix VF queue configuration with low MTU values - mptcp: reset rcv wnd on disconnect - mptcp: cleanup fallback dummy mapping generation - octeontx2-af: CGX: add bounds check to cgx_speed_mbps index - octeontx2-af: replace deprecated strncpy with strscpy - cgroup/cpuset: Reset DL migration state on can_attach() failure - fbdev/vt8500lcdfb: Initialize fb_ops with fbdev macros - soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get() - driver core: reject devices with unregistered buses - drm/amd/display: Use krealloc_array() in dal_vector_reserve() - drm/amdgpu: restart the CS if some parts of the VM are still invalidated - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 - drm/amdkfd: fix NULL dereference in get_queue_ids() - slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock - slimbus: qcom-ngd-ctrl: fix OF node refcount - thunderbolt: Limit XDomain response copy to actual frame size - sctp: stream: fully roll back denied add-stream state - mmc: sdhci: add signal voltage switch in sdhci_resume_host - mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC - mmc: litex_mmc: Set mandatory idle clocks before CMD0 - mmc: core: Fix host controller programming for fixed driver type - mm/hugetlb: restore reservation on error in hugetlb folio copy paths - octeontx2-af: fix memory leak in rvu_setup_hw_resources() - nvmem: layouts: onie-tlv: fix hang on unknown types - net: rds: clear i_sends on setup unwind - net: mv643xx: fix OF node refcount - net/mlx5: Reorder completion before putting command entry in cmd_work_handler - misc: fastrpc: fix use-after-free race in fastrpc_map_create - misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context - Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard - i2c: tegra: Fix NOIRQ suspend/resume - i2c: stm32f7: fix timing computation ignoring i2c-analog-filter - i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() - pidfd: refuse access to tasks that have started exiting harder - ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write - vsock/vmci: fix sk_ack_backlog leak on failed handshake - wifi: nl80211: reject oversized EMA RNR lists - selftests: mptcp: add test for extra_subflows underflow on userspace PM - mptcp: sockopt: check timestamping ret value - mptcp: allow subflow rcv wnd to shrink - mptcp: close TOCTOU race while computing rcv_wnd - mptcp: fix retransmission loop when csum is enabled - ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow - ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O - ARM: socfpga: Fix OF node refcount leak in SMP setup - mm/damon/ops-common: call folio_test_lru() after folio_get() - drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info() - ALSA: timer: Fix UAF at snd_timer_user_params() - USB: serial: option: add usb-id for Dell Wireless DW5826e-m - xfrm: espintcp: do not reuse an in-progress partial send - ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL - mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation - tracing/probes: Point the error offset correctly for eprobe argument error - netfilter: nft_tunnel: fix use-after-free on object destroy - clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time - net: mvpp2: build skb from XDP-adjusted data on XDP_PASS - net: mvpp2: refill RX buffers before XDP or skb use - net: mvpp2: Add metadata support for xdp mode - netfilter: nf_log: validate MAC header was set before dumping it - rds: mark snapshot pages dirty in rds_info_getsockopt() - net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion - r8152: handle the return value of usb_reset_device() - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove - net: phy: clean the sfp upstream if phy probing fails - net/mlx4: avoid GCC 10 __bad_copy_from() false positive - ASoC: wm_adsp: Fix NULL dereference when removing firmware controls - arm64: tlb: Allow XZR argument to TLBI ops - KVM: arm64: Remove VPIPT I-cache handling - tools/rv: Fix cleanup after failed trace setup - time: Fix off-by-one in settimeofday() usec validation - ipmi: Fix rcu_read_unlock to srcu_read_unlock in handle_read_event_rsp - ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() - vxlan: vnifilter: fix spurious notification on VNI update - vxlan: vnifilter: send notification on VNI add - octeontx2-af: npc: Fix CPT channel mask in npc_install_flow - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown - ptp: vclock: Switch from RCU to SRCU - net: fec: fix pinctrl default state restore order on resume - net: lan743x: permit VLAN-tagged packets up to configured MTU - net: garp: fix unsigned integer underflow in garp_pdu_parse_attr - hsr: Remove WARN_ONCE() in hsr_addr_is_self(). - net: Annotate sk->sk_write_space() for UDP SOCKMAP. - pcnet32: stop holding device spin lock during napi_complete_done - drm/imx: Fix three kernel-doc warnings in dcss-scaler.c - 6lowpan: fix off-by-one in multicast context address compression - netfilter: xt_NFQUEUE: prefer raw_smp_processor_id - tee: optee: prevent use-after-free when the client exits before the supplicant - net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS - Disable -Wattribute-alias for clang-23 and newer - RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug - USB: serial: mct_u232: fix memory corruption with small endpoint - usb: core: Fix SuperSpeed root hub wMaxPacketSize - serial: zs: Convert to use a platform device - serial: dz: Convert to use a platform device - serial: dz: Fix bootconsole handover lockup - xhci: tegra: Fix ghost USB device on dual-role port unplug - USB: serial: digi_acceleport: fix memory corruption with small endpoints - landlock: Fix handling of disconnected directories - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync - USB: serial: cypress_m8: fix memory corruption with small endpoint - serial: zs: Switch to using channel reset - serial: zs: Fix bootconsole handover lockup - serial: dz: Fix bootconsole message clobbering at chip reset - drm/amdkfd: Check for pdd drm file first in CRIU restore path - drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger - drm/amdkfd: fix NULL pointer bug in svm_range_set_attr - serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma - serial: zs: Fix swapped RI/DSR modem line transition counting - serial: sh-sci: fix memory region release in error path - serial: qcom-geni: fix UART_RX_PAR_EN bit position - serial: altera_jtaguart: handle uart_add_one_port() failures - drm/amd/pm/si: Disregard vblank time when no displays are connected - drm/i915: Fix potential UAF in TTM object purge - drm/hyperv: validate VMBus packet size in receive callback - drm/hyperv: validate resolution_count and fix WIN8 fallback - scsi: target: iscsi: Validate CHAP_R length before base64 decode - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 - scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker - thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow - thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() - usb: gadget: f_fs: copy only received bytes on short ep0 read - usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports - usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling - usb: gadget: f_hid: fix device reference leak in hidg_alloc() - usb: gadget: net2280: Fix double free in probe error path - USB: serial: mct_u232: fix missing interrupt-in transfer sanity check - USB: serial: mxuport: fix memory corruption with small endpoint - USB: serial: keyspan: fix missing indat transfer sanity check - USB: serial: cypress_m8: validate interrupt packet headers - USB: serial: belkin_sa: validate interrupt status length - USB: serial: option: add MeiG SRM813Q - usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize - usb: usbtmc: check URB actual_length for interrupt-IN notifications - usbip: vudc: Fix use after free bug in vudc_remove due to race condition - usb: storage: Add quirks for PNY Elite Portable SSD - USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers - usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval - usb: chipidea: core: convert ci_role_switch to local variable - tty: serial: pch_uart: add check for dma_alloc_coherent() - counter: Fix refcount leak in counter_alloc() error path - comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() - comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() - Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 - Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem - Input: xpad - add support for ASUS ROG RAIKIRI II - Input: xpad - add "Nova 2 Lite" from GameSir - ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks - ASoC: qcom: q6asm-dai: close stream only when running - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check - xfrm: ah: use skb_to_full_sk in async output callbacks - xfrm: route MIGRATE notifications to caller's netns - nfc: hci: fix out-of-bounds read in HCP header parsing - iommu, debugobjects: avoid gcc-16.1 section mismatch warnings - HID: wacom: Fix OOB write in wacom_hid_set_device_mode() - ip6: vti: Use ip6_tnl.net in vti6_changelink(). - xfrm: input: hold netns during deferred transport reinjection - ipv6: validate extension header length before copying to cmsg - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). - ipv6: exthdrs: refresh nh after handling HAO option - ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() - macsec: fix replay protection at XPN lower-PN wrap - bpf: sockmap: fix tail fragment offset in bpf_msg_push_data - Input: elan_i2c - validate firmware size before use - usb: dwc2: Fix use after free in debug code - usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles - usb: cdns3: gadget: fix request skipping after clearing halt - USB: serial: omninet: fix memory corruption with small endpoint - iio: buffer: hw-consumer: fix use-after-free in error path - iio: light: cm3323: fix reg_conf not being initialized correctly - iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL - iio: temperature: tsys01: fix broken PROM checksum validation - iio: ssp_sensors: cancel delayed work_refresh on remove - iio: gyro: itg3200: fix i2c read into the wrong stack location - iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw - iio: dac: ad5686: acquire lock when doing powerdown control - iio: dac: ad5686: fix input raw value check - iio: dac: max5821: fix return value check in powerdown sync - iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux - wireguard: send: append trailer after expanding head - KVM: arm64: PMU: Preserve AArch32 counter low bits - parport: Fix race between port and client registration - Input: xpad - fix out-of-bounds access for Share button - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock - Bluetooth: ISO: fix UAF in iso_recv_frame - Bluetooth: HIDP: fix missing length checks in hidp_input_report() - auxdisplay: line-display: fix OOB read on zero-length message_store() - hpfs: fix a crash if hpfs_map_dnode_bitmap fails - Bluetooth: btusb: Allow firmware re-download when version matches - HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse - Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() - USB: serial: safe_serial: fix memory corruption with small endpoint - usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT - usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() - usb: typec: altmodes/displayport: validate count before reading Status Update VDO - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO - usb: typec: ucsi: ccg: reject firmware images without a ':' record header - iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer - soc/tegra: pmc: Fix unsafe generic_handle_irq() call - hwmon: (pmbus/adm1266) serialize NVMEM blackbox read with pmbus_lock - hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock - of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() - phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X - drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used - drm/dp: Add eDP 1.5 bit definition - drm/i915/psr: Read Intel DPCD workaround register - drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register - media: rc: fix race between unregister and urb/irq callbacks - batman-adv: bla: avoid double decrement of bla.num_requests - batman-adv: tt: avoid empty VLAN responses - batman-adv: tt: fix TOCTOU race for reported vlans - batman-adv: tp_meter: directly shut down timer on cleanup - batman-adv: tp_meter: avoid role confusion in tp_list - batman-adv: iv: recover OGM scheduling after forward packet error - batman-adv: tvlv: reject oversized TVLV packets - batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface - batman-adv: tt: reject oversized local TVLV buffers - batman-adv: tvlv: abort OGM send on tvlv append failure - net: skbuff: fix pskb_carve leaking zcopy pages - ipv6: fix possible infinite loop in fib6_select_path() - ipv6: fix possible infinite loop in rt6_fill_node() - sctp: fix race between sctp_wait_for_connect and peeloff - net: mana: Add NULL guards in teardown path to prevent panic on attach failure - gpio: rockchip: convert bank->clk to devm_clk_get_enabled() - Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() - ethtool: eeprom: add more safeties to EEPROM Netlink fallback - ethtool: eeprom: add missing ethnl_ops_begin() / _complete() during fallback - bonding: refuse to enslave CAN devices - Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() - ASoC: codecs: simple-mux: Fix enum control bounds check - ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() - gpio: mxc: fix irq_high handling - net: hsr: fix potential OOB access in supervision frame handling - ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues - net/iucv: fix locking in .getsockopt - net/smc: Do not re-initialize smc hashtables - net: netlink: don't set nsid on local notifications - net: netlink: fix sending unassigned nsid after assigned one - vsock: keep poll shutdown state consistent - netfilter: nf_tables: fix dst corruption in same register operation - netfilter: bitwise: add support for doing AND, OR and XOR directly - netfilter: bitwise: rename some boolean operation functions - netfilter: ebtables: fix OOB read in compat_mtw_from_user - netfilter: xt_cpu: prefer raw_smp_processor_id - netfilter: synproxy: refresh tcphdr after skb_ensure_writable - xfrm: Check for underflow in xfrm_state_mtu - nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() - nfc: llcp: Fix use-after-free in llcp_sock_release() - net: cpsw_new: Fix potential unregister of netdev that has not been registered yet - drm: Remove plane hsub/vsub alignment requirement for core helpers - net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net: mctp: ensure our nlmsg responses are initialised - Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size - MIPS: smp: report dying CPU to RCU in stop_this_cpu() - LoongArch: Report dying CPU to RCU in stop_this_cpu() - irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT - tls: Flush backlog before waiting for a new record - net: ethernet: cortina: No mapping is a dropped rx - batman-adv: fix batadv_skb_is_frag() kernel-doc - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled - Bluetooth: ISO: fix malformed ISO_END/CONT handling - Bluetooth: MGMT: Fix backward compatibility with userspace - security/keys: fix missed RCU read section on lookup - LoongArch: kprobes: Fix handling of fatal unrecoverable recursions - pds_core: ensure null-termination for firmware version strings - pds_core: add an error code check in pdsc_dl_info_get - net: mana: validate rx_req_idx to prevent out-of-bounds array access - ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove() - gpio: cdev: check if uAPI v2 config attributes are correctly zeroed - gpiolib: cdev: use !mem_is_zero() instead of memchr_inv(s, 0, n) - string: add mem_is_zero() helper to check if memory area is all zeros - bpf, skmsg: fix verdict sk_data_ready racing with ktls rx - net: ag71xx: check error for platform_get_irq - Bluetooth: btmtk: rename btmediatek_data - Bluetooth: btusb: mediatek: refactor the function btusb_mtk_reset - Bluetooth: btmtk: add the function to get the fw name - ALSA: seq: Serialize UMP output teardown with event_input - ALSA: seq: ump: Use guard() for locking - pds_core: fix debugfs_lookup dentry leak and error handling - pds_core: fix error handling in pdsc_devcmd_wait - bridge: mcast: Fix a possible use-after-free when removing a bridge port - net: bridge: Flush multicast groups when snooping is disabled - RDMA/rtrs: Fix use-after-free in path file creation cleanup - platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL - platform/x86: intel-hid: Check ACPI_HANDLE() against NULL - platform/x86: hp_accel: Check ACPI_COMPANION() against NULL - platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer - net: dsa: mt7530: preserve VLAN tags on trapped link-local frames - net: dsa: mt7530: rename mt753x_bpdu_port_fw enum to mt753x_to_cpu_fw - net: dsa: mt7530: fix FDB entries not aging out with short timeout - wifi: ath11k: fix peer resolution on rx path when peer_id=0 - drm/msm/snapshot: fix dumping of the unaligned regions - spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache() - net/mlx5: Do not restore destination-less TC rules - tls: Preserve sk_err across recvmsg() when data has been copied - x86/xen: Fix xen_e820_swap_entry_with_ram() - net: phy: DP83TC811: add reading of abilities - net: phy: c45: add genphy_c45_pma_read_ext_abilities() function - net: tls: prevent chain-after-chain in plain text SG - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot - powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise() - drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN - drm/msm/dsi: don't dump registers past the mapped region - ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics - net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint - accel/qaic: Add overflow check to remap_pfn_range during mmap - HID: quirks: really enable the intended work around for appledisplay - wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm() - wifi: ath11k: fix error path leaks in some WMI WOW calls - net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS reference - net: ethernet: cortina: Carry over frag counter - net: ethernet: cortina: Drop half-assembled SKB - net: ethernet: cortina: Make RX SKB per-port - netfs: Fix overrun check in netfs_extract_user_iter() - zonefs: handle integer overflow in zonefs_fname_to_fno - irqchip/ath79-cpu: Remove unused function - phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access - net: lan966x: avoid unregistering netdev on register failure - ice: fix locking in ice_dcb_rebuild() - tcp: Fix imbalanced icsk_accept_queue count. - test_kprobes: clear kprobes between test runs - kprobes: skip non-symbol addresses in kprobe_add_ksym_blacklist() - netfilter: x_tables: unregister the templates first - ALSA: hda: cs35l56: Put ACPI device after setting companion - ARM: integrator: Fix early initialization - pinctrl: qcom: Fix wakeirq map by removing disconnected irqs for sm8150 - kunit: config: KUNIT_DEBUGFS should depend on DEBUG_FS - kunit: config: Enable KUNIT_DEBUGFS by default - firmware: arm_ffa: Skip free_pages on RX buffer alloc failure - firmware: arm_ffa: Check for NULL FF-A ID table while driver registration - HID: uclogic: Fix regression of input name assignment - hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors - hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe() - hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe() - hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in get_multiple - hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR - hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer - hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer - hwmon: (pmbus/adm1266) reject implausible blackbox record_count - hwmon: (pmbus/adm1266) seed timestamp from the real-time clock - batman-adv: tt: fix negative tt_buff_len - batman-adv: tt: fix negative last_changeset_len - batman-adv: tp_meter: fix race condition in send error reporting - batman-adv: tp_meter: avoid use of uninit sender vars - batman-adv: bla: fix report_work leak on backbone_gw purge - batman-adv: frag: disallow unicast fragment in fragment - batman-adv: fix fragment reassembly length accounting - batman-adv: dat: handle forward allocation error - batman-adv: clear current gateway during teardown - batman-adv: mcast: fix use-after-free in orig_node RCU release - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async - drm/amd/display: Validate GPIO pin LUT table size before iterating - drm/amd/display: Fix integer overflow in bios_get_image() - drm/bridge: megachips: remove bridge when irq request fails - drm/bridge: it66121: acquire reset GPIO in probe - drm/virtio: use uninterruptible resv lock for plane updates - device property: set fwnode->secondary to NULL in fwnode_init() - LoongArch: Remove unused code to avoid build warning - RDMA/siw: Reject MPA FPDU length underflow before signed receive math - spi: ti-qspi: fix use-after-free after DMA setup failure - spi: sprd: fix error pointer deref after DMA setup failure - scsi: isci: Fix use-after-free in device removal path - phy: tegra: xusb: Fix per-pad high-speed termination calibration - spi: qup: fix error pointer deref after DMA setup failure - drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe - KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits - arm64: probes: Handle probes on hinted conditional branch instructions - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() - ice: fix setting promisc mode while adding VID filter - ixgbevf: fix use-after-free in VEPA multicast source pruning - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 - wifi: ath11k: clear shared SRNG pointer state on restart - vsock/vmci: fix UAF when peer resets connection during handshake - ring-buffer: Fix reporting of missed events in iterator - qed: fix double free in qed_cxt_tables_alloc() - netfilter: ipset: stop hash:* range iteration at end - netfilter: nf_queue: hold bridge skb->dev while queued - netfilter: ip6t_hbh: reject oversized option lists - net: ifb: report ethtool stats over num_tx_queues - net: bcmgenet: keep RBUF EEE/PM disabled - phonet/pep: disable BH around forwarded sk_receive_skb() - Bluetooth: MGMT: validate Add Extended Advertising Data length - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths - Bluetooth: bnep: Fix UAF read of dev->name - Bluetooth: ISO: drop ISO_END frames received without prior ISO_START - net: wwan: iosm: fix potential memory leaks in ipc_imem_init() - drivers/base/memory: fix memory block reference leak in poison accounting - efi: Allocate runtime workqueue before ACPI init - ALSA: asihpi: Fix potential OOB array access at reading cache - ALSA: pcm: Don't setup bogus iov_iter for silencing - ALSA: ua101: Reject too-short USB descriptors - hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX - smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() - ksmbd: fix null pointer dereference in compare_guid_key() - mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break() - sysfs: don't remove existing directory on update failure - Revert "af_unix: Reject SIOCATMARK on non-stream sockets" - Revert "s390/cio: Update purge function to unregister the unused subchannels" - Revert "ice: Remove jumbo_remove step from TX path" - Revert "ice: fix double-free of tx_buf skb" - Revert "x86/vdso: Fix output operand size of RDPID" - wifi: mac80211: check tdls flag in ieee80211_tdls_oper - s390/debug: Reject zero-length input before trimming a newline - mptcp: pm: ADD_ADDR rtx: free sk if last - mptcp: sync the msk->sndbuf at accept() time - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close - netfilter: revalidate bridge ports - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp - net: bonding: fix NULL pointer dereference in bond_do_ioctl() - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() - udp: clear skb->dev before running a sockmap verdict - crypto: nx - Fix packed layout in struct nx842_crypto_header - crypto: nx - Use static_assert() to check struct sizes - batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown - Revert "ALSA: pcmtest: fix reference leak on failed device registration" - media: rc: ttusbir: fix inverted error logic - media: rc: igorplugusb: fix control request setup packet - batman-adv: tp_meter: fix tp_num leak on kmalloc failure - batman-adv: stop tp_meter sessions during mesh teardown - ALSA: seq: Fix UMP group 16 filtering - ALSA: seq: Notify client and port info changes - ALSA: core: Serialize deferred fasync state checks - ALSA: misc: Use guard() for spin locks - ALSA: hda: cs35l56: Propagate ASP TX source control errors - crypto: nx - Avoid -Wflex-array-member-not-at-end warning - ksmbd: reset rcount per connection in ksmbd_conn_wait_idle_sess_id() - media: rc: igorplugusb: heed coherency rules - ALSA: aoa: Skip devices with no codecs in i2sbus_resume() - media: rc: ttusbir: respect DMA coherency rules - ALSA: aoa: i2sbus: clear stale prepared state - ALSA: aoa: Use guard() for mutex locks - f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally - ksmbd: replace connection list with hash table - ksmbd: use msleep instaed of schedule_timeout_interruptible() - f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io() - smb: move some duplicate definitions to common/smbacl.h - iommu/amd: serialize sequence allocation under concurrent TLB invalidations - x86/shstk: Prevent deadlock during shstk sigreturn - ALSA: pcmtest: Fix resource leaks in module init error paths - ALSA: pcmtest: fix reference leak on failed device registration - ALSA: 6fire: Fix input volume change detection - ALSA: caiaq: Fix control_put() result and cache rollback - ALSA: core: Fix potential data race at fasync handling - Revert "ALSA: usb-audio: Cap the packet size pre-calculations" - ipv6: sit: reload inner IPv6 header after GSO offloads - net: guard timestamp cmsgs to real error queue skbs - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() - netfilter: x_tables: avoid leaking percpu counter pointers - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush - netfilter: require Ethernet MAC header before using eth_hdr() - netfilter: nft_fib: fix stale stack leak via the OIFNAME register - vsock/virtio: reset connection on receiving queue overflow - vsock/virtio: fix skb overhead accounting to preserve full buf_alloc - vsock/virtio: fix potential unbounded skb queue - mptcp: pm: ADD_ADDR rtx: always decrease sk refcount - mptcp: pm: ADD_ADDR rtx: allow ID 0 - ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers - srcu: Use irq_work to start GP in tiny SRCU - irqwork: Move data struct to a types header - types: move struct rcuwait into types.h - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets - wifi: iwlwifi: fix 22000 series SMEM parsing - wifi: iwlwifi: allow IWL_FW_CHECK() with just a string - x86: shadow stacks: proper error handling for mmap lock - net: mvpp2: sync RX data at the hardware packet offset - net: mvpp2: limit XDP frame size to the RX buffer - batman-adv: fix tp_meter counter underflow during shutdown - batman-adv: v: stop OGMv2 on disabled interface - ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger - spi: mpc52xx: fix controller deregistration - thunderbolt: Bound root directory content to block size - selinux: fix overlayfs mmap() and mprotect() access checks - lsm: add backing_file LSM hooks - fs: constify file ptr in backing_file accessor helpers - fs: prepare for adding LSM blob to backing_file - selftests/bpf: Add tests for ld_{abs,ind} failure path in subprogs - bpf: Fix ld_{abs,ind} failure path analysis in subprogs - KVM: x86: Fix shadow paging use-after-free due to unexpected role - Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref - Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() - fix kabi for ppp_defs.h - pppoe: drop PFC frames - netfilter: nat: use kfree_rcu to release ops - drm/i915/gem: Fix phys BO pread/pwrite with offset - selinux: allow multiple opens of /sys/fs/selinux/policy - ksmbd: make ksmbd thread names distinct by client IP - ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path - ALSA: caiaq: Don't abort when no input device is available - ALSA: caiaq: fix usb_dev refcount leak on probe failure - ALSA: caiaq: Handle probe errors properly - ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow - USB: cdc-acm: Fix bit overlap and move quirk definitions to header - ALSA: caiaq: take a reference on the USB device in create_card() - ALSA: usb-audio: apply quirk for MOONDROP JU Jiu - ksmbd: use check_add_overflow() to prevent u16 DACL size overflow - ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment - smb: server: fix max_connections off-by-one in tcp accept path - smb: server: fix active_num_conn leak on transport allocation failure - usb: port: add delay after usb_hub_set_port_power() - USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen - usb: storage: Expand range of matched versions for VL817 quirks entry - xfrm: Wait for RCU readers during policy netns exit - KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing - mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison - thunderbolt: Clamp XDomain response data copy to allocation size - bpf: return VMA snapshot from task_vma iterator - bpf: switch task_vma iterator from mmap_lock to per-VMA locks - bpf: fix mm lifecycle in open-coded task_vma iterator - netfilter: nft_ct: bail out on template ct in get eval - drm/amd/display: Bound VBIOS record-chain walk loops - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size - drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() - netfilter: conntrack_irc: fix possible out-of-bounds read - drm/vc4: fix krealloc() memory leak - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error - f2fs: fix data loss caused by incorrect use of nat_entry flag - bnxt_en: Fix NULL pointer dereference - ipv6: mcast: Fix use-after-free when processing MLD queries - ipvs: clear the svc scheduler ptr early on edit - netfilter: synproxy: add mutex to guard hook reference counting - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list - net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr - netlabel: validate unlabeled address and mask attribute lengths - netfilter: bridge: make ebt_snat ARP rewrite writable - tcp: restrict SO_ATTACH_FILTER to priv users - ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER - Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig - misc: fastrpc: fix DMA address corruption due to find_vma misuse - misc: fastrpc: Fix NULL pointer dereference in rpmsg callback - gpio: mvebu: fix NULL pointer dereference in suspend/resume - Bluetooth: fix memory leak in error path of hci_alloc_dev() - Bluetooth: bnep: reject short frames before parsing - Bluetooth: RFCOMM: validate skb length in MCC handlers - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams - RDMA/srp: bound SRP_RSP sense copy by the received length - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN - net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure - sched/psi: fix race between file release and pressure write - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase - rculist: add list_splice_rcu() for private lists - net: skbuff: fix missing zerocopy reference in pskb_carve helpers - ip6_vti: set netns_immutable on the fallback device. - wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() - wifi: rtw88: debugfs: support multiple adapters debugging - erofs: fix use-after-free on sbi->sync_decompress - net: openvswitch: fix possible kfree_skb of ERR_PTR - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() - md: wake raid456 reshape waiters before suspend - dm cache policy smq: check allocation under invalidate lock - Bluetooth: MGMT: validate advertising TLV before type checks - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend - USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL - USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam - USB: serial: option: add support for Rolling Wireless RW135R-GL - USB: serial: io_edgeport: add support for Blackbox IC135A - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr - netfilter: flowtable: strictly check for maximum number of actions - fuse: reject fuse_notify() pagecache ops on directories - fs/mbcache: cancel shrink work before destroying the cache - smb/client: fix possible infinite loop and oob read in symlink_data() - fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp - ata: libata-scsi: do not needlessly defer commands when using PMP with FBS - ata: libata-scsi: do not use the deferred QC feature on PMPs with CBS - ata: libata-scsi: do not use the deferred QC feature for ATA_DEFER_PORT - ata: libata-scsi: improve readability of ata_scsi_qc_issue() - ata: libata-scsi: fix requeue of deferred ATA PASS-THROUGH commands - ata: libata-eh: Fix detection of deferred qc timeouts - ata: libata: cancel pending work after clearing deferred_qc - ata: libata-core: fix cancellation of a port deferred qc work - ata: libata-scsi: rename and improve ata_qc_done() - ata: libata-scsi: simplify ata_scsi_requeue_deferred_qc() - ata: libata-sata: simplify ata_sas_queuecmd() - ata: libata-core: improve tag checks in ata_qc_issue() - ata: libata-eh: correctly handle deferred qc timeouts - ata: libata-scsi: avoid Non-NCQ command starvation - ata: libata: Introduce ata_port_eh_scheduled() - ext4: handle wraparound when searching for blocks for indirect mapped blocks - ext4: fix error pointer dereference in ext4_mb_load_buddy_gfp() - ext4: always allocate blocks only from groups inode can use - ext4: fix e4b bitmap inconsistency reports - ext4: convert bd_buddy_page to bd_buddy_folio - ext4: convert bd_bitmap_page to bd_bitmap_folio - Revert "ext4: fix e4b bitmap inconsistency reports" - ext4: cleanup for ext4_map_blocks - ext4: rename EXT4_GET_BLOCKS_PRE_IO - ext4: drop extent cache when splitting extent fails - ext4: drop extent cache after doing PARTIAL_VALID1 zeroout - ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O - ext4: correct the comments place for EXT4_EXT_MAY_ZEROOUT - ext4: get rid of ppath in ext4_ext_handle_unwritten_extents() - ext4: get rid of ppath in ext4_ext_convert_to_initialized() - ext4: get rid of ppath in ext4_split_convert_extents() - ext4: get rid of ppath in ext4_split_extent() - ext4: get rid of ppath in ext4_force_split_extent_at() - ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 - ext4: subdivide EXT4_EXT_DATA_VALID1 - Revert "ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O" - ext4: get rid of ppath in ext4_split_extent_at() - ext4: get rid of ppath in ext4_ext_insert_extent() - ext4: get rid of ppath in get_ext_path() - ext4: add new ext4_ext_path_brelse() helper - !24596 [sync]urma: fix workqueue use-after-free in ubagg_exit teardown sequence - urma: fix workqueue use-after-free in ubagg_exit teardown sequence - !24607 ub: udma: Optimize udma jetty id access logic. - ub: udma: Optimize udma jetty id access logic. - !24640 [sync]urma: limit ubcore logs in reuse paths - urma: fix workqueue use-after-free in ubagg_exit teardown sequence - !24669 mm/madvise: add MADV_FCMA_ENABLE to set PF_FOLIO_CMA via madvise - mm/madvise: add MADV_FCMA_ENABLE to set PF_FOLIO_CMA via madvise - !24702 [sync]urma: retry import jetty/jfr on EIO from tpid reuse failure - urma: retry import jetty/jfr on EIO from tpid reuse failure - urma: limit ubagg connect exchange logs * Fri Jul 10 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-145.3.18.151.20260710.aae66044906b - !24753 [sync]urma: drain jfe event lists in batches to avoid soft-lockup - urma: drain jfe event lists in batches to avoid soft-lockup - urma: reduce ubagg topo log noise - !24748 [sync]urma: free completion events outside jfe lock - urma: free jfe events outside lock - urma: free completion events outside jfe lock - !24742 urma: Fix the issue of inaccurate timing for some functions in DFX - !24741 [sync]urma: fix UAF of accessing token_id in log. - urma: Fix the issue of inaccurate timing for some functions in DFX - urma: fix UAF of accessing token_id in log. - !24734 [sync]urma: fix tpid_reuse attached to vtpn causes use_after_free - urma: fix tpid_reuse attached to vtpn causes use_after_free - !24804 [sync]urma: use vzalloc for ubmad tjetty and ini_rtbuffer - !24774 [sync]urma: ratelimit import jetty/jfr error logs - urma: use vzalloc for ubmad tjetty and ini_rtbuffer - !24792 [sync]urma: fix UAF of accessing jfs/jetty in log. - urma: fix UAF of accessing jfs/jetty in log. - urma: ratelimit import jetty/jfr error logs - !24845 [sync]ub/ubdevshm: Support for acquiring va is a sub-range of registered va - ub/ubdevshm: Support for acquiring va is a sub-range of registered va - !24802 [sync]urma: use xarray for ubagg/ubcore session lookup - urma: use xarray for ubagg/ubcore session lookup - !24814 [sync]urma: make ratelimit burst configurable for ubcore/uburma/ubagg - urma: make ratelimit burst configurable for ubcore/uburma/ubagg * Wed Jul 22 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-145.3.22.153.20260722.158daf1d8dea - !24942 [sync]urma: drop param_set_uint_minmax for ratelimit burst setters - urma: drop param_set_uint_minmax for ratelimit burst setters - !25840 sync CVE LTS and bugfix from OLK-6.6 d33ffc8f8580 to 334dfd575ba5 - cgroup/rstat: avoid disabling irqs for O(num_cpu) - netfilter: bridge: eb_tables: close module init race - crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents - netfilter: ebtables: move to two-stage removal scheme - crypto: qat - protect service table iterations with service_lock - Bluetooth: eir: Fix stack OOB write when prepending the Flags AD - drm/edid: fix OOB read in drm_parse_tiled_block() - proc: protect ptrace_may_access() with exec_update_lock (FD links) - vfio/pci: Latch disable_idle_d3 per device - bpf: Fix UAF in sock clone early bailouts - bpf: Disable xfrm_decode_session hook attachment - bpf,fork: wipe ->bpf_storage before bailouts that access it - KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() - crypto: qat - validate RSA CRT component lengths - bpf: Clear rb node linkage when freeing bpf_rb_root - bpf: Add validation for bpf_set_retval argument - bpf: Reject sleepable BPF_LSM_CGROUP programs at load time - bpf: Fix setting retval to -EPERM for cgroup hooks not returning errno - bpf: Guard __get_user acesss with access_ok for uprobe_multi data - i2c: core: fix adapter registration race - ALSA: hda/cs35l41: Fix firmware load work teardown - vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc - iommufd: Break the loop on failure in iommufd_fault_fops_read() - posix-cpu-timers: Prevent UAF caused by non-leader exec() race - iio: event: Fix event FIFO reset race - hwrng: virtio: clamp device-reported used.len at copy_data() - crypto: drbg - Fix returning success on failure in CTR_DRBG - crypto: ecc - Fix carry overflow in vli multiplication - crypto: pcrypt - restore callback for non-parallel fallback - net: openvswitch: reject oversized nested action attrs - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page - e1000e: Fix out-of-bounds MMIO access by validating BAR0 size - xsched: enforce permissions on attribute access - xsched: restrict vstream management to privileged users - rme: use DMA API for virtio in realm world - udf: validate sparing table length as an entry count, not a byte count - smb: client: harden POSIX SID length parsing - smb: client: mask server-provided mode to 07777 in modefromsid - smb: client: Fix next buffer leak in receive_encrypted_standard() - nvmet-auth: validate reply message payload bounds against transfer length - bpf: Reject fragmented frames in devmap - bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized - mm/huge_memory: update file PMD counter before folio_put() - sctp: fix uninit-value in __sctp_rcv_asconf_lookup() - smb: client: reject overlapping data areas in SMB2 responses - smb: client: restrict implied bcc[0] exemption to responses without data area - io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item - writeback: drop now-unnecessary rcu_barrier() in cgroup_writeback_umount() - writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() - writeback: Fix use after free in inode_switch_wbs_work_fn() - writeback: Avoid contention on wb->list_lock when switching inodes - block: skip sync_blockdev() on surprise removal in bdev_mark_dead() - mm: do file ownership checks with the proper mount idmap - tracing: Bound synthetic-field strings with seq_buf - perf/core: Detach event groups during remove_on_exec - bpf: Allow LPM map access from sleepable BPF programs - bpf: Consistently use bpf_rcu_lock_held() everywhere - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC - udf: validate VAT header length against the VAT inode size - isofs: bound Rock Ridge symlink components to the SL record - udf: validate free block extents against the partition length - config: arm64: update CONFIG_FTRACE_STARTUP_TEST not set - crypto: qat - Return pointer directly in adf_ctl_alloc_resources - crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() - drivers/base/memory: set mem->altmap after successful device registration - serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails - serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero - NFS: Prevent resource leak in nfs_alloc_server() - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr - nfsd: check get_user() return when reading princhashlen - fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode - fbdev: modedb: fix a possible UAF in fb_find_mode() - fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var - power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path - 9p: avoid putting oldfid in p9_client_walk() error path - ocfs2: reject oversized group bitmap descriptors - rpmsg: char: Fix use-after-free on probe error path - fpga: region: fix use-after-free in child_regions_with_firmware() - irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove - pNFS: Fix use-after-free in pnfs_update_layout() - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done - hdlc_ppp: sync per-proto timers before freeing hdlc state - gfs2: fix use-after-free in gfs2_qd_dealloc - exfat: fix potential use-after-free in exfat_find_dir_entry() - bpf: use kvfree() for replaced sysctl write buffer - f2fs: keep atomic write retry from zeroing original data - f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node() - f2fs: validate ACL entry sizes in f2fs_acl_from_disk() - f2fs: fix to round down start offset of fallocate for pin file - f2fs: validate compress cache inode only when enabled - wifi: iwlwifi: mvm: fix race condition in PTP removal - wifi: rtw88: usb: fix memory leaks on USB write failures - wifi: rtw88: increase TX report timeout to fix race condition - wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor - wifi: ath11k: fix warning when unbinding - wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S - keys: Pin request_key_auth payload in instantiate paths - KEYS: fix overflow in keyctl_pkey_params_get_2() - err.h: use __always_inline on all error pointer helpers - fbdev: fix use-after-free in store_modes() - NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR - apparmor: mediate the implicit connect of TCP fast open sendmsg - net: skmsg: preserve sg.copy across SG transforms - mac802154: llsec: add skb_cow_data() before in-place crypto - af_unix: Set gc_in_progress to true in unix_gc(). - ntfs3: reject direct userspace writes to reserved $LX* xattrs - ipv4: account for fraggap on the paged allocation path - inet: add indirect call wrapper for getfrag() calls - ipv6: account for fraggap on the paged allocation path - batman-adv: tvlv: avoid race of cifsnotfound handler state - batman-adv: tvlv: enforce 2-byte alignment - batman-adv: dat: prevent false sharing between VLANs - batman-adv: tt: track roam count per VID - batman-adv: tt: don't merge change entries with different VIDs - batman-adv: tp_meter: handle overlapping packets - batman-adv: tp_meter: prevent parallel modifications of last_recv - batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE - batman-adv: tp_meter: restrict number of unacked list entries - batman-adv: v: prevent OGM aggregation on disabled hardif - batman-adv: frag: avoid underflow of TTL - batman-adv: frag: ensure fragment is writable before modifying TTL - batman-adv: fix (m|b)cast csum after decrementing TTL - batman-adv: ensure bcast is writable before modifying TTL - batman-adv: tp_meter: initialize last_recv_time during init - batman-adv: prevent ELP transmission interval underflow - batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE - batman-adv: tp_meter: add only finished tp_vars to lists - batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection - batman-adv: tp_meter: fix fast recovery precondition - batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd - batman-adv: tp_meter: avoid window underflow - batman-adv: tp_meter: initialize dec_cwnd explicitly - batman-adv: tp_meter: initialize dup_acks explicitly - batman-adv: tp_meter: keep unacked list in ascending ordered - eventpoll: rename ep_remove_safe() back to ep_remove() - file: add fput() cleanup helper - media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si - ksmbd: reject non-VALID session in compound request branch - scripts/sorttable: Fix endianness handling in build-time mcount sort - scripts/sorttable: Allow matches to functions before function entry - scripts/sorttable: Use normal sort if theres no relocs in the mcount section - ftrace: Check against is_kernel_text() instead of kaslr_offset() - ftrace: Test mcount_loc addr before calling ftrace_call_addr() - ftrace: Do not over-allocate ftrace memory - ftrace: Have ftrace pages output reflect freed pages - ftrace: Update the mcount_loc check of skipped entries - scripts/sorttable: Zero out weak functions in mcount_loc table - scripts/sorttable: Always use an array for the mcount_loc sorting - scripts/sorttable: Have mcount rela sort use direct values - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 - scripts/sorttable: Use a structure of function pointers for elf helpers - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly - scripts/sorttable: Move code from sorttable.h into sorttable.c - scripts/sorttable: Use uint64_t for mcount sorting - scripts/sorttable: Add helper functions for Elf_Sym - scripts/sorttable: Add helper functions for Elf_Shdr - scripts/sorttable: Add helper functions for Elf_Ehdr - scripts/sorttable: Convert Elf_Sym MACRO over to a union - scripts/sorttable: Replace Elf_Shdr Macro with a union - scripts/sorttable: Convert Elf_Ehdr to union - scripts/sorttable: Make compare_extable() into two functions - scripts/sorttable: Have the ORC code use the _r() functions to read - scripts/sorttable: Remove unneeded Elf_Rel - scripts/sorttable: Remove unused write functions - scripts/sorttable: Remove unused macro defines - fuse: re-lock request before replacing page cache folio - slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD - slimbus: qcom-ngd-ctrl: Fix up platform_driver registration - rxrpc: Fix the ACK parser to extract the SACK table for parsing - net: phonet: free phonet_device after RCU grace period - phonet: Pass net and ifindex to phonet_address_notify(). - phonet: Pass ifindex to fill_addr(). - Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs - hv: utils: handle and propagate errors in kvp_register - regulator: core: fix locking in regulator_resolve_supply() error path - ring-buffer: Remove ring_buffer_read_prepare_sync() - selftests/bpf: Update comments find_equal_scalars->sync_linked_regs - af_unix: Reject SIOCATMARK on non-stream sockets - selftests/bpf: Add test to ensure kprobe_multi is not sleepable - agp/amd64: Fix broken error propagation in agp_amd64_probe() - net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() - i2c: stub: Reject I2C block transfers with invalid length - RDMA/bnxt_re: zero shared page before exposing to userspace - KVM: VMX: Update SVI during runtime APICv activation - ARM: fix branch predictor hardening - ARM: fix hash_name() fault - ARM: allow __do_kernel_fault() to report execution of memory faults - ARM: group is_permission_fault() with is_translation_fault() - debugobjects: Dont call fill_pool() in early boot hardirq context - debugobjects: Do not fill_pool() if pi_blocked_on - debugobjects: Use LD_WAIT_CONFIG instead of LD_WAIT_SLEEP - debugobjects: Allow to refill the pool before SYSTEM_SCHEDULING - batman-adv: tt: prevent TVLV entry number overflow - drm/v3d: Skip CSD when it has zeroed workgroups - drm/v3d: Store the active job inside the queue's state - iov_iter: Fix potential underflow in iov_iter_extract_xarray_pages() - urma: add check type in free driver obj - smb: client: fix double-free in SMB2_close() replay - smb: client: fix double-free in SMB2_flush() replay - smb: client: fix query_info() replay double-free - smb: client: fix query directory replay double-free - smb: client: fix double-free in SMB2_open() replay - smb: client: fix double-free in SMB2_ioctl() replay - smb: client: fix change notify replay double-free - HID: lg-g15: cancel pending work on remove to fix a use-after-free - HID: multitouch: fix out-of-bounds bit access on mt_io_flags - tracing: Prevent out-of-bounds read in glob matching - sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT - !25616 sync CVE LTS and bugfix from OLK-6.6 b72db20c0437 to d33ffc8f8580 - KVM: x86: hyper-v: Bound the bank index when querying sparse banks - MIPS: DEC: Prevent initial console buffer from landing in XKPHYS - ksmbd: fix durable reconnect error path file lifetime - ksmbd: fix use-after-free in smb2_open during durable reconnect - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query - USB: iowarrior: fix use-after-free on disconnect race - usb: iowarrior: remove inherent race with minor number - USB: iowarrior: fix use-after-free on disconnect - apparmor: fix use-after-free in rawdata dedup loop - tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR - bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops - rbd: eliminate a race in lock_dwork draining on unmap - blk-cgroup: fix UAF in __blkcg_rstat_flush() - net: Fix kabi breakage of struct tc_action - net/sched: act_api: use RCU with deferred freeing for action lifecycle - net: Fix kabi breakage of struct header_ops - bonding: prevent potential infinite loop in bond_header_parse() - bonding: fix type confusion in bond_setup_by_slave() - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc - ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL - ASoC: cs35l56: Fix missing calls to wm_adsp2_remove() - time: Fix off-by-one in compat settimeofday() usec validation - scsi: target: Fix hexadecimal CHAP_I handling - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink - ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY - ksmbd: add a permission check for FSCTL_SET_ZERO_DATA - ksmbd: add per-handle permission check to FILE_LINK_INFORMATION - mptcp: fix missing wakeups in edge scenarios - mptcp: add-addr: always drop other suboptions - ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 - RDMA/umem: fix kernel-doc warnings - mm/migrate: don't call folio_putback_active_hugetlb() on dst hugetlb folio - usb: typec: ucsi: Don't update power_supply on power role change if not connected - serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() - thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() - usb: typec: ucsi: Check if power role change actually happened before handling - usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind - usb: dwc3: xilinx: fix error handling in zynqmp init error paths - usb: musb: omap2430: Fix use-after-free in omap2430_probe() - tty: serial: samsung: Remove redundant port lock acquisition in rx helpers - tty: serial: samsung: use u32 for register interactions - serial: samsung_tty: Use port lock wrappers - ALSA: firewire-motu: Protect register DSP event queue positions - memfd: deny writeable mappings when implying SEAL_WRITE - iio: dac: ad5686: fix ref bit initialization for single-channel parts - usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure - iio: chemical: scd30: fix division by zero in write_raw - iio: chemical: scd30: Use guard(mutex) to allow early returns - iio: gyro: adis16260: fix division by zero in write_raw - Bluetooth: hci_qca: Convert timeout from jiffies to ms - Bluetooth: hci_qca: Migrate to serdev specific shutdown function - serdev: Provide a bustype shutdown function - serdev: make serdev_bus_type const - mm/damon/sysfs-schemes: delete tried region in regions_rmdirs() - mptcp: do not drop partial packets - mptcp: introduce the mptcp_init_skb helper - iio: adc: npcm: fix unbalanced clk_disable_unprepare() - iio: adc: npcm: Convert to platform remove callback returning void - octeontx2-pf: avoid double free of pool->stack on AQ init failure - af_unix: Fix UAF read of tail->len in unix_stream_data_wait() - af_unix: Cache state->msg in unix_stream_read_generic(). - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg - net: hsr: defer node table free until after RCU readers - mptcp: pm: fix ADD_ADDR timer infinite retry on option space insufficient - ice: fix VF queue configuration with low MTU values - mptcp: reset rcv wnd on disconnect - mptcp: cleanup fallback dummy mapping generation - octeontx2-af: CGX: add bounds check to cgx_speed_mbps index - octeontx2-af: replace deprecated strncpy with strscpy - cgroup/cpuset: Reset DL migration state on can_attach() failure - fbdev/vt8500lcdfb: Initialize fb_ops with fbdev macros - soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get() - driver core: reject devices with unregistered buses - drm/amd/display: Use krealloc_array() in dal_vector_reserve() - drm/amdgpu: restart the CS if some parts of the VM are still invalidated - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 - drm/amdkfd: fix NULL dereference in get_queue_ids() - slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock - slimbus: qcom-ngd-ctrl: fix OF node refcount - thunderbolt: Limit XDomain response copy to actual frame size - sctp: stream: fully roll back denied add-stream state - mmc: sdhci: add signal voltage switch in sdhci_resume_host - mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC - mmc: litex_mmc: Set mandatory idle clocks before CMD0 - mmc: core: Fix host controller programming for fixed driver type - mm/hugetlb: restore reservation on error in hugetlb folio copy paths - octeontx2-af: fix memory leak in rvu_setup_hw_resources() - nvmem: layouts: onie-tlv: fix hang on unknown types - net: rds: clear i_sends on setup unwind - net: mv643xx: fix OF node refcount - net/mlx5: Reorder completion before putting command entry in cmd_work_handler - misc: fastrpc: fix use-after-free race in fastrpc_map_create - misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context - Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard - i2c: tegra: Fix NOIRQ suspend/resume - i2c: stm32f7: fix timing computation ignoring i2c-analog-filter - i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() - pidfd: refuse access to tasks that have started exiting harder - ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write - vsock/vmci: fix sk_ack_backlog leak on failed handshake - wifi: nl80211: reject oversized EMA RNR lists - selftests: mptcp: add test for extra_subflows underflow on userspace PM - mptcp: sockopt: check timestamping ret value - mptcp: allow subflow rcv wnd to shrink - mptcp: close TOCTOU race while computing rcv_wnd - mptcp: fix retransmission loop when csum is enabled - ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow - ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O - ARM: socfpga: Fix OF node refcount leak in SMP setup - mm/damon/ops-common: call folio_test_lru() after folio_get() - drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info() - ALSA: timer: Fix UAF at snd_timer_user_params() - USB: serial: option: add usb-id for Dell Wireless DW5826e-m - xfrm: espintcp: do not reuse an in-progress partial send - ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL - mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation - tracing/probes: Point the error offset correctly for eprobe argument error - netfilter: nft_tunnel: fix use-after-free on object destroy - clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time - net: mvpp2: build skb from XDP-adjusted data on XDP_PASS - net: mvpp2: refill RX buffers before XDP or skb use - net: mvpp2: Add metadata support for xdp mode - netfilter: nf_log: validate MAC header was set before dumping it - rds: mark snapshot pages dirty in rds_info_getsockopt() - net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion - r8152: handle the return value of usb_reset_device() - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove - net: phy: clean the sfp upstream if phy probing fails - net/mlx4: avoid GCC 10 __bad_copy_from() false positive - ASoC: wm_adsp: Fix NULL dereference when removing firmware controls - arm64: tlb: Allow XZR argument to TLBI ops - KVM: arm64: Remove VPIPT I-cache handling - tools/rv: Fix cleanup after failed trace setup - time: Fix off-by-one in settimeofday() usec validation - ipmi: Fix rcu_read_unlock to srcu_read_unlock in handle_read_event_rsp - ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() - vxlan: vnifilter: fix spurious notification on VNI update - vxlan: vnifilter: send notification on VNI add - octeontx2-af: npc: Fix CPT channel mask in npc_install_flow - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown - ptp: vclock: Switch from RCU to SRCU - net: fec: fix pinctrl default state restore order on resume - net: lan743x: permit VLAN-tagged packets up to configured MTU - net: garp: fix unsigned integer underflow in garp_pdu_parse_attr - hsr: Remove WARN_ONCE() in hsr_addr_is_self(). - net: Annotate sk->sk_write_space() for UDP SOCKMAP. - pcnet32: stop holding device spin lock during napi_complete_done - drm/imx: Fix three kernel-doc warnings in dcss-scaler.c - 6lowpan: fix off-by-one in multicast context address compression - netfilter: xt_NFQUEUE: prefer raw_smp_processor_id - tee: optee: prevent use-after-free when the client exits before the supplicant - net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS - Disable -Wattribute-alias for clang-23 and newer - RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug - USB: serial: mct_u232: fix memory corruption with small endpoint - usb: core: Fix SuperSpeed root hub wMaxPacketSize - serial: zs: Convert to use a platform device - serial: dz: Convert to use a platform device - serial: dz: Fix bootconsole handover lockup - xhci: tegra: Fix ghost USB device on dual-role port unplug - USB: serial: digi_acceleport: fix memory corruption with small endpoints - landlock: Fix handling of disconnected directories - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync - USB: serial: cypress_m8: fix memory corruption with small endpoint - serial: zs: Switch to using channel reset - serial: zs: Fix bootconsole handover lockup - serial: dz: Fix bootconsole message clobbering at chip reset - drm/amdkfd: Check for pdd drm file first in CRIU restore path - drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger - drm/amdkfd: fix NULL pointer bug in svm_range_set_attr - serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma - serial: zs: Fix swapped RI/DSR modem line transition counting - serial: sh-sci: fix memory region release in error path - serial: qcom-geni: fix UART_RX_PAR_EN bit position - serial: altera_jtaguart: handle uart_add_one_port() failures - drm/amd/pm/si: Disregard vblank time when no displays are connected - drm/i915: Fix potential UAF in TTM object purge - drm/hyperv: validate VMBus packet size in receive callback - drm/hyperv: validate resolution_count and fix WIN8 fallback - scsi: target: iscsi: Validate CHAP_R length before base64 decode - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 - scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker - thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow - thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() - usb: gadget: f_fs: copy only received bytes on short ep0 read - usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports - usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling - usb: gadget: f_hid: fix device reference leak in hidg_alloc() - usb: gadget: net2280: Fix double free in probe error path - USB: serial: mct_u232: fix missing interrupt-in transfer sanity check - USB: serial: mxuport: fix memory corruption with small endpoint - USB: serial: keyspan: fix missing indat transfer sanity check - USB: serial: cypress_m8: validate interrupt packet headers - USB: serial: belkin_sa: validate interrupt status length - USB: serial: option: add MeiG SRM813Q - usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize - usb: usbtmc: check URB actual_length for interrupt-IN notifications - usbip: vudc: Fix use after free bug in vudc_remove due to race condition - usb: storage: Add quirks for PNY Elite Portable SSD - USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers - usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval - usb: chipidea: core: convert ci_role_switch to local variable - tty: serial: pch_uart: add check for dma_alloc_coherent() - counter: Fix refcount leak in counter_alloc() error path - comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() - comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() - Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 - Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem - Input: xpad - add support for ASUS ROG RAIKIRI II - Input: xpad - add "Nova 2 Lite" from GameSir - ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks - ASoC: qcom: q6asm-dai: close stream only when running - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check - xfrm: ah: use skb_to_full_sk in async output callbacks - xfrm: route MIGRATE notifications to caller's netns - nfc: hci: fix out-of-bounds read in HCP header parsing - iommu, debugobjects: avoid gcc-16.1 section mismatch warnings - HID: wacom: Fix OOB write in wacom_hid_set_device_mode() - ip6: vti: Use ip6_tnl.net in vti6_changelink(). - xfrm: input: hold netns during deferred transport reinjection - ipv6: validate extension header length before copying to cmsg - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). - ipv6: exthdrs: refresh nh after handling HAO option - ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() - macsec: fix replay protection at XPN lower-PN wrap - bpf: sockmap: fix tail fragment offset in bpf_msg_push_data - Input: elan_i2c - validate firmware size before use - usb: dwc2: Fix use after free in debug code - usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles - usb: cdns3: gadget: fix request skipping after clearing halt - USB: serial: omninet: fix memory corruption with small endpoint - iio: buffer: hw-consumer: fix use-after-free in error path - iio: light: cm3323: fix reg_conf not being initialized correctly - iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL - iio: temperature: tsys01: fix broken PROM checksum validation - iio: ssp_sensors: cancel delayed work_refresh on remove - iio: gyro: itg3200: fix i2c read into the wrong stack location - iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw - iio: dac: ad5686: acquire lock when doing powerdown control - iio: dac: ad5686: fix input raw value check - iio: dac: max5821: fix return value check in powerdown sync - iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux - wireguard: send: append trailer after expanding head - KVM: arm64: PMU: Preserve AArch32 counter low bits - parport: Fix race between port and client registration - Input: xpad - fix out-of-bounds access for Share button - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock - Bluetooth: ISO: fix UAF in iso_recv_frame - Bluetooth: HIDP: fix missing length checks in hidp_input_report() - auxdisplay: line-display: fix OOB read on zero-length message_store() - hpfs: fix a crash if hpfs_map_dnode_bitmap fails - Bluetooth: btusb: Allow firmware re-download when version matches - HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse - Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() - USB: serial: safe_serial: fix memory corruption with small endpoint - usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT - usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() - usb: typec: altmodes/displayport: validate count before reading Status Update VDO - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO - usb: typec: ucsi: ccg: reject firmware images without a ':' record header - iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer - soc/tegra: pmc: Fix unsafe generic_handle_irq() call - hwmon: (pmbus/adm1266) serialize NVMEM blackbox read with pmbus_lock - hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock - of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() - phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X - drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used - drm/dp: Add eDP 1.5 bit definition - drm/i915/psr: Read Intel DPCD workaround register - drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register - media: rc: fix race between unregister and urb/irq callbacks - batman-adv: bla: avoid double decrement of bla.num_requests - batman-adv: tt: avoid empty VLAN responses - batman-adv: tt: fix TOCTOU race for reported vlans - batman-adv: tp_meter: directly shut down timer on cleanup - batman-adv: tp_meter: avoid role confusion in tp_list - batman-adv: iv: recover OGM scheduling after forward packet error - batman-adv: tvlv: reject oversized TVLV packets - batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface - batman-adv: tt: reject oversized local TVLV buffers - batman-adv: tvlv: abort OGM send on tvlv append failure - net: skbuff: fix pskb_carve leaking zcopy pages - ipv6: fix possible infinite loop in fib6_select_path() - ipv6: fix possible infinite loop in rt6_fill_node() - sctp: fix race between sctp_wait_for_connect and peeloff - net: mana: Add NULL guards in teardown path to prevent panic on attach failure - gpio: rockchip: convert bank->clk to devm_clk_get_enabled() - Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() - ethtool: eeprom: add more safeties to EEPROM Netlink fallback - ethtool: eeprom: add missing ethnl_ops_begin() / _complete() during fallback - bonding: refuse to enslave CAN devices - Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() - ASoC: codecs: simple-mux: Fix enum control bounds check - ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() - gpio: mxc: fix irq_high handling - net: hsr: fix potential OOB access in supervision frame handling - ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues - net/iucv: fix locking in .getsockopt - net/smc: Do not re-initialize smc hashtables - net: netlink: don't set nsid on local notifications - net: netlink: fix sending unassigned nsid after assigned one - vsock: keep poll shutdown state consistent - netfilter: nf_tables: fix dst corruption in same register operation - netfilter: bitwise: add support for doing AND, OR and XOR directly - netfilter: bitwise: rename some boolean operation functions - netfilter: ebtables: fix OOB read in compat_mtw_from_user - netfilter: xt_cpu: prefer raw_smp_processor_id - netfilter: synproxy: refresh tcphdr after skb_ensure_writable - xfrm: Check for underflow in xfrm_state_mtu - nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() - nfc: llcp: Fix use-after-free in llcp_sock_release() - net: cpsw_new: Fix potential unregister of netdev that has not been registered yet - drm: Remove plane hsub/vsub alignment requirement for core helpers - net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net: mctp: ensure our nlmsg responses are initialised - Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size - MIPS: smp: report dying CPU to RCU in stop_this_cpu() - LoongArch: Report dying CPU to RCU in stop_this_cpu() - irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT - tls: Flush backlog before waiting for a new record - net: ethernet: cortina: No mapping is a dropped rx - batman-adv: fix batadv_skb_is_frag() kernel-doc - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled - Bluetooth: ISO: fix malformed ISO_END/CONT handling - Bluetooth: MGMT: Fix backward compatibility with userspace - security/keys: fix missed RCU read section on lookup - LoongArch: kprobes: Fix handling of fatal unrecoverable recursions - pds_core: ensure null-termination for firmware version strings - pds_core: add an error code check in pdsc_dl_info_get - net: mana: validate rx_req_idx to prevent out-of-bounds array access - ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove() - gpio: cdev: check if uAPI v2 config attributes are correctly zeroed - gpiolib: cdev: use !mem_is_zero() instead of memchr_inv(s, 0, n) - string: add mem_is_zero() helper to check if memory area is all zeros - bpf, skmsg: fix verdict sk_data_ready racing with ktls rx - net: ag71xx: check error for platform_get_irq - Bluetooth: btmtk: rename btmediatek_data - Bluetooth: btusb: mediatek: refactor the function btusb_mtk_reset - Bluetooth: btmtk: add the function to get the fw name - ALSA: seq: Serialize UMP output teardown with event_input - ALSA: seq: ump: Use guard() for locking - pds_core: fix debugfs_lookup dentry leak and error handling - pds_core: fix error handling in pdsc_devcmd_wait - bridge: mcast: Fix a possible use-after-free when removing a bridge port - net: bridge: Flush multicast groups when snooping is disabled - RDMA/rtrs: Fix use-after-free in path file creation cleanup - platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL - platform/x86: intel-hid: Check ACPI_HANDLE() against NULL - platform/x86: hp_accel: Check ACPI_COMPANION() against NULL - platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer - net: dsa: mt7530: preserve VLAN tags on trapped link-local frames - net: dsa: mt7530: rename mt753x_bpdu_port_fw enum to mt753x_to_cpu_fw - net: dsa: mt7530: fix FDB entries not aging out with short timeout - wifi: ath11k: fix peer resolution on rx path when peer_id=0 - drm/msm/snapshot: fix dumping of the unaligned regions - spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache() - net/mlx5: Do not restore destination-less TC rules - tls: Preserve sk_err across recvmsg() when data has been copied - x86/xen: Fix xen_e820_swap_entry_with_ram() - net: phy: DP83TC811: add reading of abilities - net: phy: c45: add genphy_c45_pma_read_ext_abilities() function - net: tls: prevent chain-after-chain in plain text SG - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot - powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise() - drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN - drm/msm/dsi: don't dump registers past the mapped region - ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics - net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint - accel/qaic: Add overflow check to remap_pfn_range during mmap - HID: quirks: really enable the intended work around for appledisplay - wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm() - wifi: ath11k: fix error path leaks in some WMI WOW calls - net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS reference - net: ethernet: cortina: Carry over frag counter - net: ethernet: cortina: Drop half-assembled SKB - net: ethernet: cortina: Make RX SKB per-port - netfs: Fix overrun check in netfs_extract_user_iter() - zonefs: handle integer overflow in zonefs_fname_to_fno - irqchip/ath79-cpu: Remove unused function - phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access - net: lan966x: avoid unregistering netdev on register failure - ice: fix locking in ice_dcb_rebuild() - tcp: Fix imbalanced icsk_accept_queue count. - test_kprobes: clear kprobes between test runs - kprobes: skip non-symbol addresses in kprobe_add_ksym_blacklist() - netfilter: x_tables: unregister the templates first - ALSA: hda: cs35l56: Put ACPI device after setting companion - ARM: integrator: Fix early initialization - pinctrl: qcom: Fix wakeirq map by removing disconnected irqs for sm8150 - kunit: config: KUNIT_DEBUGFS should depend on DEBUG_FS - kunit: config: Enable KUNIT_DEBUGFS by default - firmware: arm_ffa: Skip free_pages on RX buffer alloc failure - firmware: arm_ffa: Check for NULL FF-A ID table while driver registration - HID: uclogic: Fix regression of input name assignment - hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors - hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe() - hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe() - hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in get_multiple - hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR - hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer - hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer - hwmon: (pmbus/adm1266) reject implausible blackbox record_count - hwmon: (pmbus/adm1266) seed timestamp from the real-time clock - batman-adv: tt: fix negative tt_buff_len - batman-adv: tt: fix negative last_changeset_len - batman-adv: tp_meter: fix race condition in send error reporting - batman-adv: tp_meter: avoid use of uninit sender vars - batman-adv: bla: fix report_work leak on backbone_gw purge - batman-adv: frag: disallow unicast fragment in fragment - batman-adv: fix fragment reassembly length accounting - batman-adv: dat: handle forward allocation error - batman-adv: clear current gateway during teardown - batman-adv: mcast: fix use-after-free in orig_node RCU release - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async - drm/amd/display: Validate GPIO pin LUT table size before iterating - drm/amd/display: Fix integer overflow in bios_get_image() - drm/bridge: megachips: remove bridge when irq request fails - drm/bridge: it66121: acquire reset GPIO in probe - drm/virtio: use uninterruptible resv lock for plane updates - device property: set fwnode->secondary to NULL in fwnode_init() - LoongArch: Remove unused code to avoid build warning - RDMA/siw: Reject MPA FPDU length underflow before signed receive math - spi: ti-qspi: fix use-after-free after DMA setup failure - spi: sprd: fix error pointer deref after DMA setup failure - scsi: isci: Fix use-after-free in device removal path - phy: tegra: xusb: Fix per-pad high-speed termination calibration - spi: qup: fix error pointer deref after DMA setup failure - drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe - KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits - arm64: probes: Handle probes on hinted conditional branch instructions - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() - ice: fix setting promisc mode while adding VID filter - ixgbevf: fix use-after-free in VEPA multicast source pruning - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 - wifi: ath11k: clear shared SRNG pointer state on restart - vsock/vmci: fix UAF when peer resets connection during handshake - ring-buffer: Fix reporting of missed events in iterator - qed: fix double free in qed_cxt_tables_alloc() - netfilter: ipset: stop hash:* range iteration at end - netfilter: nf_queue: hold bridge skb->dev while queued - netfilter: ip6t_hbh: reject oversized option lists - net: ifb: report ethtool stats over num_tx_queues - net: bcmgenet: keep RBUF EEE/PM disabled - phonet/pep: disable BH around forwarded sk_receive_skb() - Bluetooth: MGMT: validate Add Extended Advertising Data length - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths - Bluetooth: bnep: Fix UAF read of dev->name - Bluetooth: ISO: drop ISO_END frames received without prior ISO_START - net: wwan: iosm: fix potential memory leaks in ipc_imem_init() - drivers/base/memory: fix memory block reference leak in poison accounting - efi: Allocate runtime workqueue before ACPI init - ALSA: asihpi: Fix potential OOB array access at reading cache - ALSA: pcm: Don't setup bogus iov_iter for silencing - ALSA: ua101: Reject too-short USB descriptors - hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX - smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() - ksmbd: fix null pointer dereference in compare_guid_key() - mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break() - sysfs: don't remove existing directory on update failure - Revert "af_unix: Reject SIOCATMARK on non-stream sockets" - Revert "s390/cio: Update purge function to unregister the unused subchannels" - Revert "ice: Remove jumbo_remove step from TX path" - Revert "ice: fix double-free of tx_buf skb" - Revert "x86/vdso: Fix output operand size of RDPID" - wifi: mac80211: check tdls flag in ieee80211_tdls_oper - s390/debug: Reject zero-length input before trimming a newline - mptcp: pm: ADD_ADDR rtx: free sk if last - mptcp: sync the msk->sndbuf at accept() time - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close - netfilter: revalidate bridge ports - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp - net: bonding: fix NULL pointer dereference in bond_do_ioctl() - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() - udp: clear skb->dev before running a sockmap verdict - crypto: nx - Fix packed layout in struct nx842_crypto_header - crypto: nx - Use static_assert() to check struct sizes - batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown - Revert "ALSA: pcmtest: fix reference leak on failed device registration" - media: rc: ttusbir: fix inverted error logic - media: rc: igorplugusb: fix control request setup packet - batman-adv: tp_meter: fix tp_num leak on kmalloc failure - batman-adv: stop tp_meter sessions during mesh teardown - ALSA: seq: Fix UMP group 16 filtering - ALSA: seq: Notify client and port info changes - ALSA: core: Serialize deferred fasync state checks - ALSA: misc: Use guard() for spin locks - ALSA: hda: cs35l56: Propagate ASP TX source control errors - crypto: nx - Avoid -Wflex-array-member-not-at-end warning - ksmbd: reset rcount per connection in ksmbd_conn_wait_idle_sess_id() - media: rc: igorplugusb: heed coherency rules - ALSA: aoa: Skip devices with no codecs in i2sbus_resume() - media: rc: ttusbir: respect DMA coherency rules - ALSA: aoa: i2sbus: clear stale prepared state - ALSA: aoa: Use guard() for mutex locks - f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally - ksmbd: replace connection list with hash table - ksmbd: use msleep instaed of schedule_timeout_interruptible() - f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io() - smb: move some duplicate definitions to common/smbacl.h - iommu/amd: serialize sequence allocation under concurrent TLB invalidations - x86/shstk: Prevent deadlock during shstk sigreturn - ALSA: pcmtest: Fix resource leaks in module init error paths - ALSA: pcmtest: fix reference leak on failed device registration - ALSA: 6fire: Fix input volume change detection - ALSA: caiaq: Fix control_put() result and cache rollback - ALSA: core: Fix potential data race at fasync handling - Revert "ALSA: usb-audio: Cap the packet size pre-calculations" - ipv6: sit: reload inner IPv6 header after GSO offloads - net: guard timestamp cmsgs to real error queue skbs - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() - netfilter: x_tables: avoid leaking percpu counter pointers - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush - netfilter: require Ethernet MAC header before using eth_hdr() - netfilter: nft_fib: fix stale stack leak via the OIFNAME register - vsock/virtio: reset connection on receiving queue overflow - vsock/virtio: fix skb overhead accounting to preserve full buf_alloc - vsock/virtio: fix potential unbounded skb queue - mptcp: pm: ADD_ADDR rtx: always decrease sk refcount - mptcp: pm: ADD_ADDR rtx: allow ID 0 - ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers - srcu: Use irq_work to start GP in tiny SRCU - irqwork: Move data struct to a types header - types: move struct rcuwait into types.h - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets - wifi: iwlwifi: fix 22000 series SMEM parsing - wifi: iwlwifi: allow IWL_FW_CHECK() with just a string - x86: shadow stacks: proper error handling for mmap lock - net: mvpp2: sync RX data at the hardware packet offset - net: mvpp2: limit XDP frame size to the RX buffer - batman-adv: fix tp_meter counter underflow during shutdown - batman-adv: v: stop OGMv2 on disabled interface - ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger - spi: mpc52xx: fix controller deregistration - thunderbolt: Bound root directory content to block size - selinux: fix overlayfs mmap() and mprotect() access checks - lsm: add backing_file LSM hooks - fs: constify file ptr in backing_file accessor helpers - fs: prepare for adding LSM blob to backing_file - selftests/bpf: Add tests for ld_{abs,ind} failure path in subprogs - bpf: Fix ld_{abs,ind} failure path analysis in subprogs - KVM: x86: Fix shadow paging use-after-free due to unexpected role - Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref - Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() - fix kabi for ppp_defs.h - pppoe: drop PFC frames - netfilter: nat: use kfree_rcu to release ops - drm/i915/gem: Fix phys BO pread/pwrite with offset - selinux: allow multiple opens of /sys/fs/selinux/policy - ksmbd: make ksmbd thread names distinct by client IP - ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path - ALSA: caiaq: Don't abort when no input device is available - ALSA: caiaq: fix usb_dev refcount leak on probe failure - ALSA: caiaq: Handle probe errors properly - ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow - USB: cdc-acm: Fix bit overlap and move quirk definitions to header - ALSA: caiaq: take a reference on the USB device in create_card() - ALSA: usb-audio: apply quirk for MOONDROP JU Jiu - ksmbd: use check_add_overflow() to prevent u16 DACL size overflow - ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment - smb: server: fix max_connections off-by-one in tcp accept path - smb: server: fix active_num_conn leak on transport allocation failure - usb: port: add delay after usb_hub_set_port_power() - USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen - usb: storage: Expand range of matched versions for VL817 quirks entry - xfrm: Wait for RCU readers during policy netns exit - KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing - mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison - thunderbolt: Clamp XDomain response data copy to allocation size - bpf: return VMA snapshot from task_vma iterator - bpf: switch task_vma iterator from mmap_lock to per-VMA locks - bpf: fix mm lifecycle in open-coded task_vma iterator - netfilter: nft_ct: bail out on template ct in get eval - drm/amd/display: Bound VBIOS record-chain walk loops - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size - drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() - netfilter: conntrack_irc: fix possible out-of-bounds read - drm/vc4: fix krealloc() memory leak - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error - f2fs: fix data loss caused by incorrect use of nat_entry flag - bnxt_en: Fix NULL pointer dereference - ipv6: mcast: Fix use-after-free when processing MLD queries - ipvs: clear the svc scheduler ptr early on edit - netfilter: synproxy: add mutex to guard hook reference counting - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list - net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr - netlabel: validate unlabeled address and mask attribute lengths - netfilter: bridge: make ebt_snat ARP rewrite writable - tcp: restrict SO_ATTACH_FILTER to priv users - ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER - Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig - misc: fastrpc: fix DMA address corruption due to find_vma misuse - misc: fastrpc: Fix NULL pointer dereference in rpmsg callback - gpio: mvebu: fix NULL pointer dereference in suspend/resume - Bluetooth: fix memory leak in error path of hci_alloc_dev() - Bluetooth: bnep: reject short frames before parsing - Bluetooth: RFCOMM: validate skb length in MCC handlers - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams - RDMA/srp: bound SRP_RSP sense copy by the received length - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN - net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure - sched/psi: fix race between file release and pressure write - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase - rculist: add list_splice_rcu() for private lists - net: skbuff: fix missing zerocopy reference in pskb_carve helpers - ip6_vti: set netns_immutable on the fallback device. - wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() - wifi: rtw88: debugfs: support multiple adapters debugging - erofs: fix use-after-free on sbi->sync_decompress - net: openvswitch: fix possible kfree_skb of ERR_PTR - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() - md: wake raid456 reshape waiters before suspend - dm cache policy smq: check allocation under invalidate lock - Bluetooth: MGMT: validate advertising TLV before type checks - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend - USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL - USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam - USB: serial: option: add support for Rolling Wireless RW135R-GL - USB: serial: io_edgeport: add support for Blackbox IC135A - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr - netfilter: flowtable: strictly check for maximum number of actions - fuse: reject fuse_notify() pagecache ops on directories - fs/mbcache: cancel shrink work before destroying the cache - smb/client: fix possible infinite loop and oob read in symlink_data() - fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp - ata: libata-scsi: do not needlessly defer commands when using PMP with FBS - ata: libata-scsi: do not use the deferred QC feature on PMPs with CBS - ata: libata-scsi: do not use the deferred QC feature for ATA_DEFER_PORT - ata: libata-scsi: improve readability of ata_scsi_qc_issue() - ata: libata-scsi: fix requeue of deferred ATA PASS-THROUGH commands - ata: libata-eh: Fix detection of deferred qc timeouts - ata: libata: cancel pending work after clearing deferred_qc - ata: libata-core: fix cancellation of a port deferred qc work - ata: libata-scsi: rename and improve ata_qc_done() - ata: libata-scsi: simplify ata_scsi_requeue_deferred_qc() - ata: libata-sata: simplify ata_sas_queuecmd() - ata: libata-core: improve tag checks in ata_qc_issue() - ata: libata-eh: correctly handle deferred qc timeouts - ata: libata-scsi: avoid Non-NCQ command starvation - ata: libata: Introduce ata_port_eh_scheduled() - ext4: handle wraparound when searching for blocks for indirect mapped blocks - ext4: fix error pointer dereference in ext4_mb_load_buddy_gfp() - ext4: always allocate blocks only from groups inode can use - ext4: fix e4b bitmap inconsistency reports - ext4: convert bd_buddy_page to bd_buddy_folio - ext4: convert bd_bitmap_page to bd_bitmap_folio - Revert "ext4: fix e4b bitmap inconsistency reports" - ext4: cleanup for ext4_map_blocks - ext4: rename EXT4_GET_BLOCKS_PRE_IO - ext4: drop extent cache when splitting extent fails - ext4: drop extent cache after doing PARTIAL_VALID1 zeroout - ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O - ext4: correct the comments place for EXT4_EXT_MAY_ZEROOUT - ext4: get rid of ppath in ext4_ext_handle_unwritten_extents() - ext4: get rid of ppath in ext4_ext_convert_to_initialized() - ext4: get rid of ppath in ext4_split_convert_extents() - ext4: get rid of ppath in ext4_split_extent() - ext4: get rid of ppath in ext4_force_split_extent_at() - ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 - ext4: subdivide EXT4_EXT_DATA_VALID1 - Revert "ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O" - ext4: get rid of ppath in ext4_split_extent_at() - ext4: get rid of ppath in ext4_ext_insert_extent() - ext4: get rid of ppath in get_ext_path() - ext4: add new ext4_ext_path_brelse() helper - !24596 [sync]urma: fix workqueue use-after-free in ubagg_exit teardown sequence - urma: fix workqueue use-after-free in ubagg_exit teardown sequence - !24607 ub: udma: Optimize udma jetty id access logic. - ub: udma: Optimize udma jetty id access logic. - !24640 [sync]urma: limit ubcore logs in reuse paths - urma: fix workqueue use-after-free in ubagg_exit teardown sequence - !24669 mm/madvise: add MADV_FCMA_ENABLE to set PF_FOLIO_CMA via madvise - mm/madvise: add MADV_FCMA_ENABLE to set PF_FOLIO_CMA via madvise - !24702 [sync]urma: retry import jetty/jfr on EIO from tpid reuse failure - urma: retry import jetty/jfr on EIO from tpid reuse failure - urma: limit ubagg connect exchange logs * Fri Jul 10 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-145.3.18.151.20260710.aae66044906b - !24753 [sync]urma: drain jfe event lists in batches to avoid soft-lockup - urma: drain jfe event lists in batches to avoid soft-lockup - urma: reduce ubagg topo log noise - !24748 [sync]urma: free completion events outside jfe lock - urma: free jfe events outside lock - urma: free completion events outside jfe lock - !24742 urma: Fix the issue of inaccurate timing for some functions in DFX - !24741 [sync]urma: fix UAF of accessing token_id in log. - urma: Fix the issue of inaccurate timing for some functions in DFX - urma: fix UAF of accessing token_id in log. - !24734 [sync]urma: fix tpid_reuse attached to vtpn causes use_after_free - urma: fix tpid_reuse attached to vtpn causes use_after_free - !24804 [sync]urma: use vzalloc for ubmad tjetty and ini_rtbuffer - !24774 [sync]urma: ratelimit import jetty/jfr error logs - urma: use vzalloc for ubmad tjetty and ini_rtbuffer - !24792 [sync]urma: fix UAF of accessing jfs/jetty in log. - urma: fix UAF of accessing jfs/jetty in log. - urma: ratelimit import jetty/jfr error logs - !24845 [sync]ub/ubdevshm: Support for acquiring va is a sub-range of registered va - ub/ubdevshm: Support for acquiring va is a sub-range of registered va - !24802 [sync]urma: use xarray for ubagg/ubcore session lookup - urma: use xarray for ubagg/ubcore session lookup - !24814 [sync]urma: make ratelimit burst configurable for ubcore/uburma/ubagg - urma: make ratelimit burst configurable for ubcore/uburma/ubagg * Wed Jul 22 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-145.3.22.153.20260722.158daf1d8dea - !24942 [sync]urma: drop param_set_uint_minmax for ratelimit burst setters - urma: drop param_set_uint_minmax for ratelimit burst setters - !25840 sync CVE LTS and bugfix from OLK-6.6 d33ffc8f8580 to 334dfd575ba5 - cgroup/rstat: avoid disabling irqs for O(num_cpu) - netfilter: bridge: eb_tables: close module init race - crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents - netfilter: ebtables: move to two-stage removal scheme - crypto: qat - protect service table iterations with service_lock - Bluetooth: eir: Fix stack OOB write when prepending the Flags AD - drm/edid: fix OOB read in drm_parse_tiled_block() - proc: protect ptrace_may_access() with exec_update_lock (FD links) - vfio/pci: Latch disable_idle_d3 per device - bpf: Fix UAF in sock clone early bailouts - bpf: Disable xfrm_decode_session hook attachment - bpf,fork: wipe ->bpf_storage before bailouts that access it - KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() - crypto: qat - validate RSA CRT component lengths - bpf: Clear rb node linkage when freeing bpf_rb_root - bpf: Add validation for bpf_set_retval argument - bpf: Reject sleepable BPF_LSM_CGROUP programs at load time - bpf: Fix setting retval to -EPERM for cgroup hooks not returning errno - bpf: Guard __get_user acesss with access_ok for uprobe_multi data - i2c: core: fix adapter registration race - ALSA: hda/cs35l41: Fix firmware load work teardown - vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc - iommufd: Break the loop on failure in iommufd_fault_fops_read() - posix-cpu-timers: Prevent UAF caused by non-leader exec() race - iio: event: Fix event FIFO reset race - hwrng: virtio: clamp device-reported used.len at copy_data() - crypto: drbg - Fix returning success on failure in CTR_DRBG - crypto: ecc - Fix carry overflow in vli multiplication - crypto: pcrypt - restore callback for non-parallel fallback - net: openvswitch: reject oversized nested action attrs - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page - e1000e: Fix out-of-bounds MMIO access by validating BAR0 size - xsched: enforce permissions on attribute access - xsched: restrict vstream management to privileged users - rme: use DMA API for virtio in realm world - udf: validate sparing table length as an entry count, not a byte count - smb: client: harden POSIX SID length parsing - smb: client: mask server-provided mode to 07777 in modefromsid - smb: client: Fix next buffer leak in receive_encrypted_standard() - nvmet-auth: validate reply message payload bounds against transfer length - bpf: Reject fragmented frames in devmap - bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized - mm/huge_memory: update file PMD counter before folio_put() - sctp: fix uninit-value in __sctp_rcv_asconf_lookup() - smb: client: reject overlapping data areas in SMB2 responses - smb: client: restrict implied bcc[0] exemption to responses without data area - io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item - writeback: drop now-unnecessary rcu_barrier() in cgroup_writeback_umount() - writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() - writeback: Fix use after free in inode_switch_wbs_work_fn() - writeback: Avoid contention on wb->list_lock when switching inodes - block: skip sync_blockdev() on surprise removal in bdev_mark_dead() - mm: do file ownership checks with the proper mount idmap - tracing: Bound synthetic-field strings with seq_buf - perf/core: Detach event groups during remove_on_exec - bpf: Allow LPM map access from sleepable BPF programs - bpf: Consistently use bpf_rcu_lock_held() everywhere - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC - udf: validate VAT header length against the VAT inode size - isofs: bound Rock Ridge symlink components to the SL record - udf: validate free block extents against the partition length - config: arm64: update CONFIG_FTRACE_STARTUP_TEST not set - crypto: qat - Return pointer directly in adf_ctl_alloc_resources - crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() - drivers/base/memory: set mem->altmap after successful device registration - serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails - serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero - NFS: Prevent resource leak in nfs_alloc_server() - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr - nfsd: check get_user() return when reading princhashlen - fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode - fbdev: modedb: fix a possible UAF in fb_find_mode() - fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var - power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path - 9p: avoid putting oldfid in p9_client_walk() error path - ocfs2: reject oversized group bitmap descriptors - rpmsg: char: Fix use-after-free on probe error path - fpga: region: fix use-after-free in child_regions_with_firmware() - irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove - pNFS: Fix use-after-free in pnfs_update_layout() - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done - hdlc_ppp: sync per-proto timers before freeing hdlc state - gfs2: fix use-after-free in gfs2_qd_dealloc - exfat: fix potential use-after-free in exfat_find_dir_entry() - bpf: use kvfree() for replaced sysctl write buffer - f2fs: keep atomic write retry from zeroing original data - f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node() - f2fs: validate ACL entry sizes in f2fs_acl_from_disk() - f2fs: fix to round down start offset of fallocate for pin file - f2fs: validate compress cache inode only when enabled - wifi: iwlwifi: mvm: fix race condition in PTP removal - wifi: rtw88: usb: fix memory leaks on USB write failures - wifi: rtw88: increase TX report timeout to fix race condition - wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor - wifi: ath11k: fix warning when unbinding - wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S - keys: Pin request_key_auth payload in instantiate paths - KEYS: fix overflow in keyctl_pkey_params_get_2() - err.h: use __always_inline on all error pointer helpers - fbdev: fix use-after-free in store_modes() - NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR - apparmor: mediate the implicit connect of TCP fast open sendmsg - net: skmsg: preserve sg.copy across SG transforms - mac802154: llsec: add skb_cow_data() before in-place crypto - af_unix: Set gc_in_progress to true in unix_gc(). - ntfs3: reject direct userspace writes to reserved $LX* xattrs - ipv4: account for fraggap on the paged allocation path - inet: add indirect call wrapper for getfrag() calls - ipv6: account for fraggap on the paged allocation path - batman-adv: tvlv: avoid race of cifsnotfound handler state - batman-adv: tvlv: enforce 2-byte alignment - batman-adv: dat: prevent false sharing between VLANs - batman-adv: tt: track roam count per VID - batman-adv: tt: don't merge change entries with different VIDs - batman-adv: tp_meter: handle overlapping packets - batman-adv: tp_meter: prevent parallel modifications of last_recv - batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE - batman-adv: tp_meter: restrict number of unacked list entries - batman-adv: v: prevent OGM aggregation on disabled hardif - batman-adv: frag: avoid underflow of TTL - batman-adv: frag: ensure fragment is writable before modifying TTL - batman-adv: fix (m|b)cast csum after decrementing TTL - batman-adv: ensure bcast is writable before modifying TTL - batman-adv: tp_meter: initialize last_recv_time during init - batman-adv: prevent ELP transmission interval underflow - batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE - batman-adv: tp_meter: add only finished tp_vars to lists - batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection - batman-adv: tp_meter: fix fast recovery precondition - batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd - batman-adv: tp_meter: avoid window underflow - batman-adv: tp_meter: initialize dec_cwnd explicitly - batman-adv: tp_meter: initialize dup_acks explicitly - batman-adv: tp_meter: keep unacked list in ascending ordered - eventpoll: rename ep_remove_safe() back to ep_remove() - file: add fput() cleanup helper - media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si - ksmbd: reject non-VALID session in compound request branch - scripts/sorttable: Fix endianness handling in build-time mcount sort - scripts/sorttable: Allow matches to functions before function entry - scripts/sorttable: Use normal sort if theres no relocs in the mcount section - ftrace: Check against is_kernel_text() instead of kaslr_offset() - ftrace: Test mcount_loc addr before calling ftrace_call_addr() - ftrace: Do not over-allocate ftrace memory - ftrace: Have ftrace pages output reflect freed pages - ftrace: Update the mcount_loc check of skipped entries - scripts/sorttable: Zero out weak functions in mcount_loc table - scripts/sorttable: Always use an array for the mcount_loc sorting - scripts/sorttable: Have mcount rela sort use direct values - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 - scripts/sorttable: Use a structure of function pointers for elf helpers - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly - scripts/sorttable: Move code from sorttable.h into sorttable.c - scripts/sorttable: Use uint64_t for mcount sorting - scripts/sorttable: Add helper functions for Elf_Sym - scripts/sorttable: Add helper functions for Elf_Shdr - scripts/sorttable: Add helper functions for Elf_Ehdr - scripts/sorttable: Convert Elf_Sym MACRO over to a union - scripts/sorttable: Replace Elf_Shdr Macro with a union - scripts/sorttable: Convert Elf_Ehdr to union - scripts/sorttable: Make compare_extable() into two functions - scripts/sorttable: Have the ORC code use the _r() functions to read - scripts/sorttable: Remove unneeded Elf_Rel - scripts/sorttable: Remove unused write functions - scripts/sorttable: Remove unused macro defines - fuse: re-lock request before replacing page cache folio - slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD - slimbus: qcom-ngd-ctrl: Fix up platform_driver registration - rxrpc: Fix the ACK parser to extract the SACK table for parsing - net: phonet: free phonet_device after RCU grace period - phonet: Pass net and ifindex to phonet_address_notify(). - phonet: Pass ifindex to fill_addr(). - Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs - hv: utils: handle and propagate errors in kvp_register - regulator: core: fix locking in regulator_resolve_supply() error path - ring-buffer: Remove ring_buffer_read_prepare_sync() - selftests/bpf: Update comments find_equal_scalars->sync_linked_regs - af_unix: Reject SIOCATMARK on non-stream sockets - selftests/bpf: Add test to ensure kprobe_multi is not sleepable - agp/amd64: Fix broken error propagation in agp_amd64_probe() - net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() - i2c: stub: Reject I2C block transfers with invalid length - RDMA/bnxt_re: zero shared page before exposing to userspace - KVM: VMX: Update SVI during runtime APICv activation - ARM: fix branch predictor hardening - ARM: fix hash_name() fault - ARM: allow __do_kernel_fault() to report execution of memory faults - ARM: group is_permission_fault() with is_translation_fault() - debugobjects: Dont call fill_pool() in early boot hardirq context - debugobjects: Do not fill_pool() if pi_blocked_on - debugobjects: Use LD_WAIT_CONFIG instead of LD_WAIT_SLEEP - debugobjects: Allow to refill the pool before SYSTEM_SCHEDULING - batman-adv: tt: prevent TVLV entry number overflow - drm/v3d: Skip CSD when it has zeroed workgroups - drm/v3d: Store the active job inside the queue's state - iov_iter: Fix potential underflow in iov_iter_extract_xarray_pages() - urma: add check type in free driver obj - smb: client: fix double-free in SMB2_close() replay - smb: client: fix double-free in SMB2_flush() replay - smb: client: fix query_info() replay double-free - smb: client: fix query directory replay double-free - smb: client: fix double-free in SMB2_open() replay - smb: client: fix double-free in SMB2_ioctl() replay - smb: client: fix change notify replay double-free - HID: lg-g15: cancel pending work on remove to fix a use-after-free - HID: multitouch: fix out-of-bounds bit access on mt_io_flags - tracing: Prevent out-of-bounds read in glob matching - sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT - !25616 sync CVE LTS and bugfix from OLK-6.6 b72db20c0437 to d33ffc8f8580 - KVM: x86: hyper-v: Bound the bank index when querying sparse banks - MIPS: DEC: Prevent initial console buffer from landing in XKPHYS - ksmbd: fix durable reconnect error path file lifetime - ksmbd: fix use-after-free in smb2_open during durable reconnect - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query - USB: iowarrior: fix use-after-free on disconnect race - usb: iowarrior: remove inherent race with minor number - USB: iowarrior: fix use-after-free on disconnect - apparmor: fix use-after-free in rawdata dedup loop - tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR - bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops - rbd: eliminate a race in lock_dwork draining on unmap - blk-cgroup: fix UAF in __blkcg_rstat_flush() - net: Fix kabi breakage of struct tc_action - net/sched: act_api: use RCU with deferred freeing for action lifecycle - net: Fix kabi breakage of struct header_ops - bonding: prevent potential infinite loop in bond_header_parse() - bonding: fix type confusion in bond_setup_by_slave() - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc - ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL - ASoC: cs35l56: Fix missing calls to wm_adsp2_remove() - time: Fix off-by-one in compat settimeofday() usec validation - scsi: target: Fix hexadecimal CHAP_I handling - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink - ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY - ksmbd: add a permission check for FSCTL_SET_ZERO_DATA - ksmbd: add per-handle permission check to FILE_LINK_INFORMATION - mptcp: fix missing wakeups in edge scenarios - mptcp: add-addr: always drop other suboptions - ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 - RDMA/umem: fix kernel-doc warnings - mm/migrate: don't call folio_putback_active_hugetlb() on dst hugetlb folio - usb: typec: ucsi: Don't update power_supply on power role change if not connected - serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() - thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() - usb: typec: ucsi: Check if power role change actually happened before handling - usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind - usb: dwc3: xilinx: fix error handling in zynqmp init error paths - usb: musb: omap2430: Fix use-after-free in omap2430_probe() - tty: serial: samsung: Remove redundant port lock acquisition in rx helpers - tty: serial: samsung: use u32 for register interactions - serial: samsung_tty: Use port lock wrappers - ALSA: firewire-motu: Protect register DSP event queue positions - memfd: deny writeable mappings when implying SEAL_WRITE - iio: dac: ad5686: fix ref bit initialization for single-channel parts - usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure - iio: chemical: scd30: fix division by zero in write_raw - iio: chemical: scd30: Use guard(mutex) to allow early returns - iio: gyro: adis16260: fix division by zero in write_raw - Bluetooth: hci_qca: Convert timeout from jiffies to ms - Bluetooth: hci_qca: Migrate to serdev specific shutdown function - serdev: Provide a bustype shutdown function - serdev: make serdev_bus_type const - mm/damon/sysfs-schemes: delete tried region in regions_rmdirs() - mptcp: do not drop partial packets - mptcp: introduce the mptcp_init_skb helper - iio: adc: npcm: fix unbalanced clk_disable_unprepare() - iio: adc: npcm: Convert to platform remove callback returning void - octeontx2-pf: avoid double free of pool->stack on AQ init failure - af_unix: Fix UAF read of tail->len in unix_stream_data_wait() - af_unix: Cache state->msg in unix_stream_read_generic(). - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg - net: hsr: defer node table free until after RCU readers - mptcp: pm: fix ADD_ADDR timer infinite retry on option space insufficient - ice: fix VF queue configuration with low MTU values - mptcp: reset rcv wnd on disconnect - mptcp: cleanup fallback dummy mapping generation - octeontx2-af: CGX: add bounds check to cgx_speed_mbps index - octeontx2-af: replace deprecated strncpy with strscpy - cgroup/cpuset: Reset DL migration state on can_attach() failure - fbdev/vt8500lcdfb: Initialize fb_ops with fbdev macros - soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get() - driver core: reject devices with unregistered buses - drm/amd/display: Use krealloc_array() in dal_vector_reserve() - drm/amdgpu: restart the CS if some parts of the VM are still invalidated - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 - drm/amdkfd: fix NULL dereference in get_queue_ids() - slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock - slimbus: qcom-ngd-ctrl: fix OF node refcount - thunderbolt: Limit XDomain response copy to actual frame size - sctp: stream: fully roll back denied add-stream state - mmc: sdhci: add signal voltage switch in sdhci_resume_host - mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC - mmc: litex_mmc: Set mandatory idle clocks before CMD0 - mmc: core: Fix host controller programming for fixed driver type - mm/hugetlb: restore reservation on error in hugetlb folio copy paths - octeontx2-af: fix memory leak in rvu_setup_hw_resources() - nvmem: layouts: onie-tlv: fix hang on unknown types - net: rds: clear i_sends on setup unwind - net: mv643xx: fix OF node refcount - net/mlx5: Reorder completion before putting command entry in cmd_work_handler - misc: fastrpc: fix use-after-free race in fastrpc_map_create - misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context - Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard - i2c: tegra: Fix NOIRQ suspend/resume - i2c: stm32f7: fix timing computation ignoring i2c-analog-filter - i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() - pidfd: refuse access to tasks that have started exiting harder - ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write - vsock/vmci: fix sk_ack_backlog leak on failed handshake - wifi: nl80211: reject oversized EMA RNR lists - selftests: mptcp: add test for extra_subflows underflow on userspace PM - mptcp: sockopt: check timestamping ret value - mptcp: allow subflow rcv wnd to shrink - mptcp: close TOCTOU race while computing rcv_wnd - mptcp: fix retransmission loop when csum is enabled - ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow - ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O - ARM: socfpga: Fix OF node refcount leak in SMP setup - mm/damon/ops-common: call folio_test_lru() after folio_get() - drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info() - ALSA: timer: Fix UAF at snd_timer_user_params() - USB: serial: option: add usb-id for Dell Wireless DW5826e-m - xfrm: espintcp: do not reuse an in-progress partial send - ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL - mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation - tracing/probes: Point the error offset correctly for eprobe argument error - netfilter: nft_tunnel: fix use-after-free on object destroy - clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time - net: mvpp2: build skb from XDP-adjusted data on XDP_PASS - net: mvpp2: refill RX buffers before XDP or skb use - net: mvpp2: Add metadata support for xdp mode - netfilter: nf_log: validate MAC header was set before dumping it - rds: mark snapshot pages dirty in rds_info_getsockopt() - net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion - r8152: handle the return value of usb_reset_device() - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove - net: phy: clean the sfp upstream if phy probing fails - net/mlx4: avoid GCC 10 __bad_copy_from() false positive - ASoC: wm_adsp: Fix NULL dereference when removing firmware controls - arm64: tlb: Allow XZR argument to TLBI ops - KVM: arm64: Remove VPIPT I-cache handling - tools/rv: Fix cleanup after failed trace setup - time: Fix off-by-one in settimeofday() usec validation - ipmi: Fix rcu_read_unlock to srcu_read_unlock in handle_read_event_rsp - ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() - vxlan: vnifilter: fix spurious notification on VNI update - vxlan: vnifilter: send notification on VNI add - octeontx2-af: npc: Fix CPT channel mask in npc_install_flow - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown - ptp: vclock: Switch from RCU to SRCU - net: fec: fix pinctrl default state restore order on resume - net: lan743x: permit VLAN-tagged packets up to configured MTU - net: garp: fix unsigned integer underflow in garp_pdu_parse_attr - hsr: Remove WARN_ONCE() in hsr_addr_is_self(). - net: Annotate sk->sk_write_space() for UDP SOCKMAP. - pcnet32: stop holding device spin lock during napi_complete_done - drm/imx: Fix three kernel-doc warnings in dcss-scaler.c - 6lowpan: fix off-by-one in multicast context address compression - netfilter: xt_NFQUEUE: prefer raw_smp_processor_id - tee: optee: prevent use-after-free when the client exits before the supplicant - net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS - Disable -Wattribute-alias for clang-23 and newer - RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug - USB: serial: mct_u232: fix memory corruption with small endpoint - usb: core: Fix SuperSpeed root hub wMaxPacketSize - serial: zs: Convert to use a platform device - serial: dz: Convert to use a platform device - serial: dz: Fix bootconsole handover lockup - xhci: tegra: Fix ghost USB device on dual-role port unplug - USB: serial: digi_acceleport: fix memory corruption with small endpoints - landlock: Fix handling of disconnected directories - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync - USB: serial: cypress_m8: fix memory corruption with small endpoint - serial: zs: Switch to using channel reset - serial: zs: Fix bootconsole handover lockup - serial: dz: Fix bootconsole message clobbering at chip reset - drm/amdkfd: Check for pdd drm file first in CRIU restore path - drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger - drm/amdkfd: fix NULL pointer bug in svm_range_set_attr - serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma - serial: zs: Fix swapped RI/DSR modem line transition counting - serial: sh-sci: fix memory region release in error path - serial: qcom-geni: fix UART_RX_PAR_EN bit position - serial: altera_jtaguart: handle uart_add_one_port() failures - drm/amd/pm/si: Disregard vblank time when no displays are connected - drm/i915: Fix potential UAF in TTM object purge - drm/hyperv: validate VMBus packet size in receive callback - drm/hyperv: validate resolution_count and fix WIN8 fallback - scsi: target: iscsi: Validate CHAP_R length before base64 decode - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 - scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker - thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow - thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() - usb: gadget: f_fs: copy only received bytes on short ep0 read - usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports - usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling - usb: gadget: f_hid: fix device reference leak in hidg_alloc() - usb: gadget: net2280: Fix double free in probe error path - USB: serial: mct_u232: fix missing interrupt-in transfer sanity check - USB: serial: mxuport: fix memory corruption with small endpoint - USB: serial: keyspan: fix missing indat transfer sanity check - USB: serial: cypress_m8: validate interrupt packet headers - USB: serial: belkin_sa: validate interrupt status length - USB: serial: option: add MeiG SRM813Q - usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize - usb: usbtmc: check URB actual_length for interrupt-IN notifications - usbip: vudc: Fix use after free bug in vudc_remove due to race condition - usb: storage: Add quirks for PNY Elite Portable SSD - USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers - usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval - usb: chipidea: core: convert ci_role_switch to local variable - tty: serial: pch_uart: add check for dma_alloc_coherent() - counter: Fix refcount leak in counter_alloc() error path - comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() - comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() - Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 - Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem - Input: xpad - add support for ASUS ROG RAIKIRI II - Input: xpad - add "Nova 2 Lite" from GameSir - ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks - ASoC: qcom: q6asm-dai: close stream only when running - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check - xfrm: ah: use skb_to_full_sk in async output callbacks - xfrm: route MIGRATE notifications to caller's netns - nfc: hci: fix out-of-bounds read in HCP header parsing - iommu, debugobjects: avoid gcc-16.1 section mismatch warnings - HID: wacom: Fix OOB write in wacom_hid_set_device_mode() - ip6: vti: Use ip6_tnl.net in vti6_changelink(). - xfrm: input: hold netns during deferred transport reinjection - ipv6: validate extension header length before copying to cmsg - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). - ipv6: exthdrs: refresh nh after handling HAO option - ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() - macsec: fix replay protection at XPN lower-PN wrap - bpf: sockmap: fix tail fragment offset in bpf_msg_push_data - Input: elan_i2c - validate firmware size before use - usb: dwc2: Fix use after free in debug code - usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles - usb: cdns3: gadget: fix request skipping after clearing halt - USB: serial: omninet: fix memory corruption with small endpoint - iio: buffer: hw-consumer: fix use-after-free in error path - iio: light: cm3323: fix reg_conf not being initialized correctly - iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL - iio: temperature: tsys01: fix broken PROM checksum validation - iio: ssp_sensors: cancel delayed work_refresh on remove - iio: gyro: itg3200: fix i2c read into the wrong stack location - iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw - iio: dac: ad5686: acquire lock when doing powerdown control - iio: dac: ad5686: fix input raw value check - iio: dac: max5821: fix return value check in powerdown sync - iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux - wireguard: send: append trailer after expanding head - KVM: arm64: PMU: Preserve AArch32 counter low bits - parport: Fix race between port and client registration - Input: xpad - fix out-of-bounds access for Share button - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock - Bluetooth: ISO: fix UAF in iso_recv_frame - Bluetooth: HIDP: fix missing length checks in hidp_input_report() - auxdisplay: line-display: fix OOB read on zero-length message_store() - hpfs: fix a crash if hpfs_map_dnode_bitmap fails - Bluetooth: btusb: Allow firmware re-download when version matches - HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse - Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() - USB: serial: safe_serial: fix memory corruption with small endpoint - usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT - usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() - usb: typec: altmodes/displayport: validate count before reading Status Update VDO - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO - usb: typec: ucsi: ccg: reject firmware images without a ':' record header - iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer - soc/tegra: pmc: Fix unsafe generic_handle_irq() call - hwmon: (pmbus/adm1266) serialize NVMEM blackbox read with pmbus_lock - hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock - of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() - phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X - drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used - drm/dp: Add eDP 1.5 bit definition - drm/i915/psr: Read Intel DPCD workaround register - drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register - media: rc: fix race between unregister and urb/irq callbacks - batman-adv: bla: avoid double decrement of bla.num_requests - batman-adv: tt: avoid empty VLAN responses - batman-adv: tt: fix TOCTOU race for reported vlans - batman-adv: tp_meter: directly shut down timer on cleanup - batman-adv: tp_meter: avoid role confusion in tp_list - batman-adv: iv: recover OGM scheduling after forward packet error - batman-adv: tvlv: reject oversized TVLV packets - batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface - batman-adv: tt: reject oversized local TVLV buffers - batman-adv: tvlv: abort OGM send on tvlv append failure - net: skbuff: fix pskb_carve leaking zcopy pages - ipv6: fix possible infinite loop in fib6_select_path() - ipv6: fix possible infinite loop in rt6_fill_node() - sctp: fix race between sctp_wait_for_connect and peeloff - net: mana: Add NULL guards in teardown path to prevent panic on attach failure - gpio: rockchip: convert bank->clk to devm_clk_get_enabled() - Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() - ethtool: eeprom: add more safeties to EEPROM Netlink fallback - ethtool: eeprom: add missing ethnl_ops_begin() / _complete() during fallback - bonding: refuse to enslave CAN devices - Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() - ASoC: codecs: simple-mux: Fix enum control bounds check - ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() - gpio: mxc: fix irq_high handling - net: hsr: fix potential OOB access in supervision frame handling - ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues - net/iucv: fix locking in .getsockopt - net/smc: Do not re-initialize smc hashtables - net: netlink: don't set nsid on local notifications - net: netlink: fix sending unassigned nsid after assigned one - vsock: keep poll shutdown state consistent - netfilter: nf_tables: fix dst corruption in same register operation - netfilter: bitwise: add support for doing AND, OR and XOR directly - netfilter: bitwise: rename some boolean operation functions - netfilter: ebtables: fix OOB read in compat_mtw_from_user - netfilter: xt_cpu: prefer raw_smp_processor_id - netfilter: synproxy: refresh tcphdr after skb_ensure_writable - xfrm: Check for underflow in xfrm_state_mtu - nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() - nfc: llcp: Fix use-after-free in llcp_sock_release() - net: cpsw_new: Fix potential unregister of netdev that has not been registered yet - drm: Remove plane hsub/vsub alignment requirement for core helpers - net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net: mctp: ensure our nlmsg responses are initialised - Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size - MIPS: smp: report dying CPU to RCU in stop_this_cpu() - LoongArch: Report dying CPU to RCU in stop_this_cpu() - irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT - tls: Flush backlog before waiting for a new record - net: ethernet: cortina: No mapping is a dropped rx - batman-adv: fix batadv_skb_is_frag() kernel-doc - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled - Bluetooth: ISO: fix malformed ISO_END/CONT handling - Bluetooth: MGMT: Fix backward compatibility with userspace - security/keys: fix missed RCU read section on lookup - LoongArch: kprobes: Fix handling of fatal unrecoverable recursions - pds_core: ensure null-termination for firmware version strings - pds_core: add an error code check in pdsc_dl_info_get - net: mana: validate rx_req_idx to prevent out-of-bounds array access - ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove() - gpio: cdev: check if uAPI v2 config attributes are correctly zeroed - gpiolib: cdev: use !mem_is_zero() instead of memchr_inv(s, 0, n) - string: add mem_is_zero() helper to check if memory area is all zeros - bpf, skmsg: fix verdict sk_data_ready racing with ktls rx - net: ag71xx: check error for platform_get_irq - Bluetooth: btmtk: rename btmediatek_data - Bluetooth: btusb: mediatek: refactor the function btusb_mtk_reset - Bluetooth: btmtk: add the function to get the fw name - ALSA: seq: Serialize UMP output teardown with event_input - ALSA: seq: ump: Use guard() for locking - pds_core: fix debugfs_lookup dentry leak and error handling - pds_core: fix error handling in pdsc_devcmd_wait - bridge: mcast: Fix a possible use-after-free when removing a bridge port - net: bridge: Flush multicast groups when snooping is disabled - RDMA/rtrs: Fix use-after-free in path file creation cleanup - platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL - platform/x86: intel-hid: Check ACPI_HANDLE() against NULL - platform/x86: hp_accel: Check ACPI_COMPANION() against NULL - platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer - net: dsa: mt7530: preserve VLAN tags on trapped link-local frames - net: dsa: mt7530: rename mt753x_bpdu_port_fw enum to mt753x_to_cpu_fw - net: dsa: mt7530: fix FDB entries not aging out with short timeout - wifi: ath11k: fix peer resolution on rx path when peer_id=0 - drm/msm/snapshot: fix dumping of the unaligned regions - spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache() - net/mlx5: Do not restore destination-less TC rules - tls: Preserve sk_err across recvmsg() when data has been copied - x86/xen: Fix xen_e820_swap_entry_with_ram() - net: phy: DP83TC811: add reading of abilities - net: phy: c45: add genphy_c45_pma_read_ext_abilities() function - net: tls: prevent chain-after-chain in plain text SG - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot - powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise() - drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN - drm/msm/dsi: don't dump registers past the mapped region - ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics - net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint - accel/qaic: Add overflow check to remap_pfn_range during mmap - HID: quirks: really enable the intended work around for appledisplay - wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm() - wifi: ath11k: fix error path leaks in some WMI WOW calls - net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS reference - net: ethernet: cortina: Carry over frag counter - net: ethernet: cortina: Drop half-assembled SKB - net: ethernet: cortina: Make RX SKB per-port - netfs: Fix overrun check in netfs_extract_user_iter() - zonefs: handle integer overflow in zonefs_fname_to_fno - irqchip/ath79-cpu: Remove unused function - phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access - net: lan966x: avoid unregistering netdev on register failure - ice: fix locking in ice_dcb_rebuild() - tcp: Fix imbalanced icsk_accept_queue count. - test_kprobes: clear kprobes between test runs - kprobes: skip non-symbol addresses in kprobe_add_ksym_blacklist() - netfilter: x_tables: unregister the templates first - ALSA: hda: cs35l56: Put ACPI device after setting companion - ARM: integrator: Fix early initialization - pinctrl: qcom: Fix wakeirq map by removing disconnected irqs for sm8150 - kunit: config: KUNIT_DEBUGFS should depend on DEBUG_FS - kunit: config: Enable KUNIT_DEBUGFS by default - firmware: arm_ffa: Skip free_pages on RX buffer alloc failure - firmware: arm_ffa: Check for NULL FF-A ID table while driver registration - HID: uclogic: Fix regression of input name assignment - hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors - hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe() - hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe() - hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in get_multiple - hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR - hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer - hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer - hwmon: (pmbus/adm1266) reject implausible blackbox record_count - hwmon: (pmbus/adm1266) seed timestamp from the real-time clock - batman-adv: tt: fix negative tt_buff_len - batman-adv: tt: fix negative last_changeset_len - batman-adv: tp_meter: fix race condition in send error reporting - batman-adv: tp_meter: avoid use of uninit sender vars - batman-adv: bla: fix report_work leak on backbone_gw purge - batman-adv: frag: disallow unicast fragment in fragment - batman-adv: fix fragment reassembly length accounting - batman-adv: dat: handle forward allocation error - batman-adv: clear current gateway during teardown - batman-adv: mcast: fix use-after-free in orig_node RCU release - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async - drm/amd/display: Validate GPIO pin LUT table size before iterating - drm/amd/display: Fix integer overflow in bios_get_image() - drm/bridge: megachips: remove bridge when irq request fails - drm/bridge: it66121: acquire reset GPIO in probe - drm/virtio: use uninterruptible resv lock for plane updates - device property: set fwnode->secondary to NULL in fwnode_init() - LoongArch: Remove unused code to avoid build warning - RDMA/siw: Reject MPA FPDU length underflow before signed receive math - spi: ti-qspi: fix use-after-free after DMA setup failure - spi: sprd: fix error pointer deref after DMA setup failure - scsi: isci: Fix use-after-free in device removal path - phy: tegra: xusb: Fix per-pad high-speed termination calibration - spi: qup: fix error pointer deref after DMA setup failure - drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe - KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits - arm64: probes: Handle probes on hinted conditional branch instructions - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() - ice: fix setting promisc mode while adding VID filter - ixgbevf: fix use-after-free in VEPA multicast source pruning - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 - wifi: ath11k: clear shared SRNG pointer state on restart - vsock/vmci: fix UAF when peer resets connection during handshake - ring-buffer: Fix reporting of missed events in iterator - qed: fix double free in qed_cxt_tables_alloc() - netfilter: ipset: stop hash:* range iteration at end - netfilter: nf_queue: hold bridge skb->dev while queued - netfilter: ip6t_hbh: reject oversized option lists - net: ifb: report ethtool stats over num_tx_queues - net: bcmgenet: keep RBUF EEE/PM disabled - phonet/pep: disable BH around forwarded sk_receive_skb() - Bluetooth: MGMT: validate Add Extended Advertising Data length - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths - Bluetooth: bnep: Fix UAF read of dev->name - Bluetooth: ISO: drop ISO_END frames received without prior ISO_START - net: wwan: iosm: fix potential memory leaks in ipc_imem_init() - drivers/base/memory: fix memory block reference leak in poison accounting - efi: Allocate runtime workqueue before ACPI init - ALSA: asihpi: Fix potential OOB array access at reading cache - ALSA: pcm: Don't setup bogus iov_iter for silencing - ALSA: ua101: Reject too-short USB descriptors - hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX - smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() - ksmbd: fix null pointer dereference in compare_guid_key() - mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break() - sysfs: don't remove existing directory on update failure - Revert "af_unix: Reject SIOCATMARK on non-stream sockets" - Revert "s390/cio: Update purge function to unregister the unused subchannels" - Revert "ice: Remove jumbo_remove step from TX path" - Revert "ice: fix double-free of tx_buf skb" - Revert "x86/vdso: Fix output operand size of RDPID" - wifi: mac80211: check tdls flag in ieee80211_tdls_oper - s390/debug: Reject zero-length input before trimming a newline - mptcp: pm: ADD_ADDR rtx: free sk if last - mptcp: sync the msk->sndbuf at accept() time - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close - netfilter: revalidate bridge ports - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp - net: bonding: fix NULL pointer dereference in bond_do_ioctl() - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() - udp: clear skb->dev before running a sockmap verdict - crypto: nx - Fix packed layout in struct nx842_crypto_header - crypto: nx - Use static_assert() to check struct sizes - batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown - Revert "ALSA: pcmtest: fix reference leak on failed device registration" - media: rc: ttusbir: fix inverted error logic - media: rc: igorplugusb: fix control request setup packet - batman-adv: tp_meter: fix tp_num leak on kmalloc failure - batman-adv: stop tp_meter sessions during mesh teardown - ALSA: seq: Fix UMP group 16 filtering - ALSA: seq: Notify client and port info changes - ALSA: core: Serialize deferred fasync state checks - ALSA: misc: Use guard() for spin locks - ALSA: hda: cs35l56: Propagate ASP TX source control errors - crypto: nx - Avoid -Wflex-array-member-not-at-end warning - ksmbd: reset rcount per connection in ksmbd_conn_wait_idle_sess_id() - media: rc: igorplugusb: heed coherency rules - ALSA: aoa: Skip devices with no codecs in i2sbus_resume() - media: rc: ttusbir: respect DMA coherency rules - ALSA: aoa: i2sbus: clear stale prepared state - ALSA: aoa: Use guard() for mutex locks - f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally - ksmbd: replace connection list with hash table - ksmbd: use msleep instaed of schedule_timeout_interruptible() - f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io() - smb: move some duplicate definitions to common/smbacl.h - iommu/amd: serialize sequence allocation under concurrent TLB invalidations - x86/shstk: Prevent deadlock during shstk sigreturn - ALSA: pcmtest: Fix resource leaks in module init error paths - ALSA: pcmtest: fix reference leak on failed device registration - ALSA: 6fire: Fix input volume change detection - ALSA: caiaq: Fix control_put() result and cache rollback - ALSA: core: Fix potential data race at fasync handling - Revert "ALSA: usb-audio: Cap the packet size pre-calculations" - ipv6: sit: reload inner IPv6 header after GSO offloads - net: guard timestamp cmsgs to real error queue skbs - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() - netfilter: x_tables: avoid leaking percpu counter pointers - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush - netfilter: require Ethernet MAC header before using eth_hdr() - netfilter: nft_fib: fix stale stack leak via the OIFNAME register - vsock/virtio: reset connection on receiving queue overflow - vsock/virtio: fix skb overhead accounting to preserve full buf_alloc - vsock/virtio: fix potential unbounded skb queue - mptcp: pm: ADD_ADDR rtx: always decrease sk refcount - mptcp: pm: ADD_ADDR rtx: allow ID 0 - ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers - srcu: Use irq_work to start GP in tiny SRCU - irqwork: Move data struct to a types header - types: move struct rcuwait into types.h - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets - wifi: iwlwifi: fix 22000 series SMEM parsing - wifi: iwlwifi: allow IWL_FW_CHECK() with just a string - x86: shadow stacks: proper error handling for mmap lock - net: mvpp2: sync RX data at the hardware packet offset - net: mvpp2: limit XDP frame size to the RX buffer - batman-adv: fix tp_meter counter underflow during shutdown - batman-adv: v: stop OGMv2 on disabled interface - ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger - spi: mpc52xx: fix controller deregistration - thunderbolt: Bound root directory content to block size - selinux: fix overlayfs mmap() and mprotect() access checks - lsm: add backing_file LSM hooks - fs: constify file ptr in backing_file accessor helpers - fs: prepare for adding LSM blob to backing_file - selftests/bpf: Add tests for ld_{abs,ind} failure path in subprogs - bpf: Fix ld_{abs,ind} failure path analysis in subprogs - KVM: x86: Fix shadow paging use-after-free due to unexpected role - Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref - Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() - fix kabi for ppp_defs.h - pppoe: drop PFC frames - netfilter: nat: use kfree_rcu to release ops - drm/i915/gem: Fix phys BO pread/pwrite with offset - selinux: allow multiple opens of /sys/fs/selinux/policy - ksmbd: make ksmbd thread names distinct by client IP - ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path - ALSA: caiaq: Don't abort when no input device is available - ALSA: caiaq: fix usb_dev refcount leak on probe failure - ALSA: caiaq: Handle probe errors properly - ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow - USB: cdc-acm: Fix bit overlap and move quirk definitions to header - ALSA: caiaq: take a reference on the USB device in create_card() - ALSA: usb-audio: apply quirk for MOONDROP JU Jiu - ksmbd: use check_add_overflow() to prevent u16 DACL size overflow - ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment - smb: server: fix max_connections off-by-one in tcp accept path - smb: server: fix active_num_conn leak on transport allocation failure - usb: port: add delay after usb_hub_set_port_power() - USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen - usb: storage: Expand range of matched versions for VL817 quirks entry - xfrm: Wait for RCU readers during policy netns exit - KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing - mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison - thunderbolt: Clamp XDomain response data copy to allocation size - bpf: return VMA snapshot from task_vma iterator - bpf: switch task_vma iterator from mmap_lock to per-VMA locks - bpf: fix mm lifecycle in open-coded task_vma iterator - netfilter: nft_ct: bail out on template ct in get eval - drm/amd/display: Bound VBIOS record-chain walk loops - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size - drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() - netfilter: conntrack_irc: fix possible out-of-bounds read - drm/vc4: fix krealloc() memory leak - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error - f2fs: fix data loss caused by incorrect use of nat_entry flag - bnxt_en: Fix NULL pointer dereference - ipv6: mcast: Fix use-after-free when processing MLD queries - ipvs: clear the svc scheduler ptr early on edit - netfilter: synproxy: add mutex to guard hook reference counting - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list - net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr - netlabel: validate unlabeled address and mask attribute lengths - netfilter: bridge: make ebt_snat ARP rewrite writable - tcp: restrict SO_ATTACH_FILTER to priv users - ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER - Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig - misc: fastrpc: fix DMA address corruption due to find_vma misuse - misc: fastrpc: Fix NULL pointer dereference in rpmsg callback - gpio: mvebu: fix NULL pointer dereference in suspend/resume - Bluetooth: fix memory leak in error path of hci_alloc_dev() - Bluetooth: bnep: reject short frames before parsing - Bluetooth: RFCOMM: validate skb length in MCC handlers - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams - RDMA/srp: bound SRP_RSP sense copy by the received length - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN - net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure - sched/psi: fix race between file release and pressure write - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase - rculist: add list_splice_rcu() for private lists - net: skbuff: fix missing zerocopy reference in pskb_carve helpers - ip6_vti: set netns_immutable on the fallback device. - wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() - wifi: rtw88: debugfs: support multiple adapters debugging - erofs: fix use-after-free on sbi->sync_decompress - net: openvswitch: fix possible kfree_skb of ERR_PTR - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() - md: wake raid456 reshape waiters before suspend - dm cache policy smq: check allocation under invalidate lock - Bluetooth: MGMT: validate advertising TLV before type checks - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend - USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL - USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam - USB: serial: option: add support for Rolling Wireless RW135R-GL - USB: serial: io_edgeport: add support for Blackbox IC135A - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr - netfilter: flowtable: strictly check for maximum number of actions - fuse: reject fuse_notify() pagecache ops on directories - fs/mbcache: cancel shrink work before destroying the cache - smb/client: fix possible infinite loop and oob read in symlink_data() - fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp - ata: libata-scsi: do not needlessly defer commands when using PMP with FBS - ata: libata-scsi: do not use the deferred QC feature on PMPs with CBS - ata: libata-scsi: do not use the deferred QC feature for ATA_DEFER_PORT - ata: libata-scsi: improve readability of ata_scsi_qc_issue() - ata: libata-scsi: fix requeue of deferred ATA PASS-THROUGH commands - ata: libata-eh: Fix detection of deferred qc timeouts - ata: libata: cancel pending work after clearing deferred_qc - ata: libata-core: fix cancellation of a port deferred qc work - ata: libata-scsi: rename and improve ata_qc_done() - ata: libata-scsi: simplify ata_scsi_requeue_deferred_qc() - ata: libata-sata: simplify ata_sas_queuecmd() - ata: libata-core: improve tag checks in ata_qc_issue() - ata: libata-eh: correctly handle deferred qc timeouts - ata: libata-scsi: avoid Non-NCQ command starvation - ata: libata: Introduce ata_port_eh_scheduled() - ext4: handle wraparound when searching for blocks for indirect mapped blocks - ext4: fix error pointer dereference in ext4_mb_load_buddy_gfp() - ext4: always allocate blocks only from groups inode can use - ext4: fix e4b bitmap inconsistency reports - ext4: convert bd_buddy_page to bd_buddy_folio - ext4: convert bd_bitmap_page to bd_bitmap_folio - Revert "ext4: fix e4b bitmap inconsistency reports" - ext4: cleanup for ext4_map_blocks - ext4: rename EXT4_GET_BLOCKS_PRE_IO - ext4: drop extent cache when splitting extent fails - ext4: drop extent cache after doing PARTIAL_VALID1 zeroout - ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O - ext4: correct the comments place for EXT4_EXT_MAY_ZEROOUT - ext4: get rid of ppath in ext4_ext_handle_unwritten_extents() - ext4: get rid of ppath in ext4_ext_convert_to_initialized() - ext4: get rid of ppath in ext4_split_convert_extents() - ext4: get rid of ppath in ext4_split_extent() - ext4: get rid of ppath in ext4_force_split_extent_at() - ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 - ext4: subdivide EXT4_EXT_DATA_VALID1 - Revert "ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O" - ext4: get rid of ppath in ext4_split_extent_at() - ext4: get rid of ppath in ext4_ext_insert_extent() - ext4: get rid of ppath in get_ext_path() - ext4: add new ext4_ext_path_brelse() helper