- !20552 ub: udma: fix some code issues. - !20313 Fix CVE-2025-40220 - !20321 nvme: fix admin request_queue lifetime - !20512 PM / devfreq: hisi: Fix potential UAF in OPP handling - !20544 Fix CVE-2025-71147 - !20548 v4 net: LTS-6.6 backport - !20503 Fix CVE-2025-39713 - !20133 Fix CVE-2025-39721 - !20438 Fix CVE-2025-38659 - !20264 Fix CVE-2025-40277 - !20340 Fix CVE-2025-40271 - !20319 Fix CVE-2025-40237 - !20392 vfs: Don't leak disconnected dentries on umount - !20554 iommu/s390: Implement blocking domain - !20489 [OLK-6.6][linux-6.6.y sync] Backport 6.6.101-6.6.102 LTS Patches - !20513 ACPI: PCC: Fix race condition by removing static qualifier - !20468 drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer - !20483 rcu: Protect ->defer_qs_iw_pending from data race - !20510 drivers/ub/sentry: fix primary eid index value - !20553 ub: cdma: support separated page table feature - ub: udma: fix some code issues. - !20480 iommu/ummu-core: fix error invalidate tid - !20561 iommu/ummu: Add ummu sva independent page table parameter - ub: udma: bugfix related to 2m_hugepage. - ub: udma: support for separate page tables - ub: udma: delete debugfs code. - ub: udma: bugfix related to ctrlq function. - ub: udma: verify get cqe/ae aux info out addr and len. - ub: cdma: support separated page table feature - iommu/ummu: Add ummu sva independent page table parameter - iommu: Adjust PLB refresh timing in 'grant' and 'ungrant' - !20505 Fix CVE-2026-23035 - iommu/s390: Implement blocking domain - drivers/ub/sentry: fix primary eid index value - !20535 libceph: make decode_pool() more resilient against corrupted osdmaps - !20536 mm/page_alloc: change all pageblocks migrate type on coalescing - !20537 mm/secretmem: fix use-after-free race in fault handler - !20538 wifi: avoid kernel-infoleak from struct iw_point - !20539 net: usb: rtl8150: fix memory leak on usb_submit_urb() failure - !20440 PCI/AER: Fix NULL pointer access by aer_info - !20262 Fix CVE-2025-68176 - netfilter: nf_reject: don't leak dst refcount for loopback packets - net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error - page_pool: always add GFP_NOWARN for ATOMIC allocations - virtio-net: fix received length check in big packets - net: bridge: fix use-after-free due to MST port state bypass - vsock: Ignore signal/timeout on connect() if already established - tls: make sure to abort the stream if headers are bogus - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI - xfrm: Duplicate SPI Handling - tls: handle data disappearing from under the TLS ULP - net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing - bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls - Bluetooth: hci_core: Fix use-after-free in vhci_flush() - KEYS: trusted: Fix a memory leak in tpm2_load_cmd - !20237 Fix CVE-2025-68724 - !20459 Fix CVE-2025-71131 - !20525 Fix CVE-2025-68816 - !20529 CVE-2025-68172 - net: usb: rtl8150: fix memory leak on usb_submit_urb() failure - !20370 Revert "Revert "RDMA/hns: Fix mismatch exception rollback"" - wifi: avoid kernel-infoleak from struct iw_point - mm/secretmem: fix use-after-free race in fault handler - mm/page_alloc: change all pageblocks migrate type on coalescing - libceph: make decode_pool() more resilient against corrupted osdmaps - pps: Fix kabi breakage of struct pps_device for last_fetched_ev - sched: Fix kabi breakage of struct task_struct for saved_state - crypto: aspeed - fix double free caused by devm - !20515 Bluetooth: bcsp: receive data only if registered - !20507 Fix CVE-2025-40358 - !20450 ub: ubase&unic: Fix some bug in concurrent process - !20452 iommu/ummu: Fix some bugs and optimize the code implementation - !20451 iommu/ummu: Add the function of creating devices with SVA-separated - !20500 mm: fix the inaccurate memory statistics issue for users - net/mlx5: fw_tracer, Validate format string parameters - Bluetooth: bcsp: receive data only if registered - ACPI: PCC: Fix race condition by removing static qualifier - ACPI: CPPC: Fix missing PCC check for guaranteed_perf - iommu/ummu: Add the function of creating devices with SVA-separated - iommu/ummu-core: fix error invalidate tid - riscv: stacktrace: Disable KASAN checks for non-current tasks - !20497 arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() - !20496 drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies - !20495 iommu/amd: Avoid stack buffer overflow from kernel cmdline - !20494 HID: core: Harden s32ton() against conversion to 0 bits - !20493 iommu: Fix two issues in iommu_copy_struct_from_user() - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv - PM / devfreq: hisi: Fix potential UAF in OPP handling - media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() - !20487 interference: Fix uninitialized ifs_clock compiling issue - MIPS: mm: kmalloc tlb_vpn array to avoid stack overflow - MIPS: mm: Prevent a TLB shutdown on initial uniquification - mm: fix the inaccurate memory statistics issue for users - mm: add config option for atomic mode in mm counter - Revert "mm: fix the inaccurate memory statistics issue for users" - !20444 net/mlx5e: Fix crash on profile change rollback failure - !20442 net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv - arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() - drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies - iommu/amd: Avoid stack buffer overflow from kernel cmdline - HID: core: Harden s32ton() against conversion to 0 bits - iommu: Fix two issues in iommu_copy_struct_from_user() - SUNRPC: call xs_sock_process_cmsg for all cmsg - flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read - !20374 [OLK 6.6]Use Hygon IBRS and IBPB rather than software-based mitigation to mitigate Retbleed and SRSO. - !20227 Rename leapioraid to leapraid and release v2.0 - mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery - MIPS: mm: tlb-r4k: Uniquify TLB entries on init - x86/fpu: Delay instruction pointer fixup until after warning - ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx() - ALSA: intel_hdmi: Fix off-by-one error in __hdmi_lpe_audio_probe() - x86/sev: Evict cache lines during SNP memory validation - net: usbnet: Fix the wrong netif_carrier_on() call - net: usbnet: Avoid potential RCU stall on LINK_CHANGE event - Bluetooth: btusb: Add USB ID 3625:010b for TP-LINK Archer TX10UB Nano - sched,freezer: Remove unnecessary warning in __thaw_task - freezer,sched: Clean saved_state when restoring it during thaw - freezer,sched: Do not restore saved_state of a thawed task - freezer,sched: Use saved_state to reduce some spurious wakeups - sched/core: Remove ifdeffery for saved_state - i2c: stm32f7: unmap DMA mapped buffer - i2c: stm32f7: simplify status messages in case of errors - i2c: stm32f7: perform most of irq job in threaded handler - i2c: stm32f7: use dev_err_probe upon calls of devm_request_irq - i2c: stm32f7: Use devm_clk_get_enabled() - USB: serial: option: add Foxconn T99W709 - smb: server: Fix extension string in ksmbd_extract_shortname() - ksmbd: fix corrupted mtime and ctime in smb2_open - ksmbd: fix Preauh_HashValue race condition - ksmbd: fix null pointer dereference error in generate_encryptionkey - vsock: Do not allow binding to VMADDR_PORT_ANY - selftests/perf_events: Add a mmap() correctness test - smb: client: return an error if rdma_connect does not return within 5 seconds - smb: client: let recv_done() cleanup before notifying the callers. - smb: client: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already - smb: client: make use of common smbdirect_socket - smb: smbdirect: add smbdirect_socket.h - smb: client: Correct typos in multiple comments across various files - smb: client: Use min() macro - smb: server: let recv_done() avoid touching data_transfer after cleanup/move - smb: server: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already - ALSA: hda/ca0132: Fix missing error handling in ca0132_alt_select_out() - irqchip: Build IMX_MU_MSI only on ARM - net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing - sunrpc: fix client side handling of tls alerts - net/sched: taprio: enforce minimum value for picos_per_byte - net: drop UFO packets in udp_rcv_segment() - ipv6: reject malicious packets in ipv6_gso_segment() - net/mlx5: Correctly set gso_segs when LRO is used - netlink: specs: ethtool: fix module EEPROM input/output arguments - net: ipa: add IPA v5.1 and v5.5 to ipa_version_string() - phy: mscc: Fix parsing of unicast frames - netpoll: prevent hanging NAPI when netcons gets enabled - md/md-cluster: handle REMOVE message earlier - NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY - NFS: Fix wakeup of __nfs_lookup_revalidate() in unblock_revalidate() - sched: Add test_and_clear_wake_up_bit() and atomic_dec_and_wake_up() - pNFS/flexfiles: don't attempt pnfs on fatal DS errors - PCI: pnv_php: Fix surprise plug detection and recovery - powerpc/eeh: Export eeh_unfreeze_pe() - PCI: pnv_php: Work around switches with broken presence detection - kconfig: qconf: fix ConfigList::updateListAllforAll() - scsi: sd: Make sd shutdown issue START STOP UNIT appropriately - scsi: ufs: core: Use link recovery when h8 exit fails during runtime resume - scsi: Revert "scsi: iscsi: Fix HW conn removal use after free" - scsi: mpt3sas: Fix a fw_event memory leak - vfio/pci: Separate SR-IOV VF dev_set - vfio/pds: Fix missing detach_ioas op - vfio: Prevent open_count decrement to negative - vfio: Fix unbalanced vfio_df_close call in no-iommu mode - f2fs: fix to calculate dirty data during has_not_enough_free_secs() - f2fs: fix to update upper_p in __get_secs_required() correctly - f2fs: vm_unmap_ram() may be called from an invalid context - f2fs: fix to avoid out-of-boundary access in devs.path - f2fs: doc: fix wrong quota mount option description - f2fs: fix KMSAN uninit-value in extent_info usage - rtc: rv3028: fix incorrect maximum clock rate handling - rtc: pcf8563: fix incorrect maximum clock rate handling - rtc: pcf85063: fix incorrect maximum clock rate handling - rtc: nct3018y: fix incorrect maximum clock rate handling - rtc: hym8563: fix incorrect maximum clock rate handling - rtc: ds1307: fix incorrect maximum clock rate handling - ucount: fix atomic_long_inc_below() argument type - module: Restore the moduleparam prefix length check - apparmor: fix loop detection used in conflicting attachment resolution - apparmor: ensure WB_HISTORY_SIZE value is a power of 2 - bpf: Check netfilter ctx accesses are aligned - bpf: Check flow_dissector ctx accesses are aligned - vhost-scsi: Fix log flooding with target does not exist errors - mtd: rawnand: atmel: set pmecc data setup time - mtd: rawnand: rockchip: Add missing check after DMA map - mtd: rawnand: atmel: Fix dma_mapping_error() address - jfs: fix metapage reference count leak in dbAllocCtl - crypto: qat - fix seq_file position update in adf_ring_next() - crypto: qat - fix DMA direction for compression on GEN2 devices - perf tools: Remove libtraceevent in .gitignore - sh: Do not use hyphen in exported variable name - ASoC: fsl_xcvr: get channel status data when PHY is not exists - dmaengine: nbpfaxi: Add missing check after DMA map - dmaengine: mv_xor: Fix missing check after DMA map and missing unmap - fs/orangefs: Allow 2 more characters in do_c_string() - PCI: endpoint: pci-epf-vntb: Fix the incorrect usage of __iomem attribute - soundwire: stream: restore params when prepare ports fail - crypto: img-hash - Fix dma_unmap_sg() nents value - crypto: keembay - Fix dma_unmap_sg() nents value - hwrng: mtk - handle devm_pm_runtime_enable errors - watchdog: ziirave_wdt: check record length in ziirave_firm_verify() - scsi: isci: Fix dma_unmap_sg() nents value - scsi: mvsas: Fix dma_unmap_sg() nents value - scsi: elx: efct: Fix dma_unmap_sg() nents value - scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value - clk: sunxi-ng: v3s: Fix de clock definition - perf tests bp_account: Fix leaked file descriptor - kernel: trace: preemptirq_delay_test: use offstack cpu mask - crypto: inside-secure - Fix `dma_unmap_sg()` nents value - perf sched: Fix memory leaks in 'perf sched latency' - perf sched: Fix memory leaks for evsel->priv in timehist - perf sched: Free thread->priv using priv_destructor - perf dso: Add missed dso__put to dso__load_kcore - perf tools: Fix use-after-free in help_unknown_cmd() - Fix dma_unmap_sg() nents value - clk: clk-axi-clkgen: fix fpfd_max frequency for zynq - fanotify: sanitize handle_type values when reporting fid - pinctrl: sunxi: Fix memory leak on krealloc failure - PCI: endpoint: pci-epf-vntb: Return -ENOENT if pci_epc_get_next_free_bar() fails - crypto: arm/aes-neonbs - work around gcc-15 warning - power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set - power: supply: cpcap-charger: Fix null check for power_supply_get_by_name - clk: xilinx: vcu: unregister pll_post only if registered correctly - media: v4l2-ctrls: Fix H264 SEPARATE_COLOUR_PLANE check - mtd: fix possible integer overflow in erase_xfer() - crypto: marvell/cesa - Fix engine load inaccuracy - crypto: qat - use unmanaged allocation for dc_data - crypto: sun8i-ce - fix nents passed to dma_unmap_sg() - PCI: rockchip-host: Fix "Unexpected Completion" log message - bpf/preload: Don't select USERMODE_DRIVER - ipv6: annotate data-races around rt->fib6_nsiblings - ipv6: fix possible infinite loop in fib6_info_uses_dev() - vrf: Drop existing dst reference in vrf_ip6_input_dst - selftests: rtnetlink.sh: remove esp4_offload after test - net/mlx5e: Clear Read-Only port buffer size in PBMC before update - netfilter: xt_nfacct: don't assume acct name is null-terminated - can: kvaser_usb: Assign netdev.dev_port based on device channel index - can: kvaser_pciefd: Store device channel index - can: peak_usb: fix USB FD devices potential malfunction - tools/rv: Do not skip idle in trace - Bluetooth: hci_event: Mask data status from LE ext adv reports - kcsan: test: Initialize dummy variable - wifi: mac80211: Write cnt before copying in ieee80211_copy_rnr_beacon() - wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE - wifi: ath12k: fix endianness handling while accessing wmi service bit - wifi: mac80211: Check 802.11 encaps offloading in ieee80211_tx_h_select_key() - wifi: mac80211: Don't call fq_flow_idx() for management frames - wifi: mac80211: Do not schedule stopped TXQs - wifi: plfxlc: Fix error handling in usb driver probe - wifi: mac80211: reject TDLS operations when station is not associated - iommu/amd: Fix geometry.aperture_end for V2 tables - mwl8k: Add missing check after DMA map - wifi: rtl8xxxu: Fix RX skb size for aggregation disabled - tcp: call tcp_measure_rcv_mss() for ooo packets - xen/gntdev: remove struct gntdev_copy_batch from stack - net_sched: act_ctinfo: use atomic64_t for three counters - net/sched: Restrict conditions for adding duplicating netems to qdisc tree - um: rtc: Avoid shadowing err in uml_rtc_start() - arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX - netfilter: nf_tables: adjust lockdep assertions handling - netfilter: nf_tables: Drop dead code from fill_*_info routines - fbcon: Fix outdated registered_fb reference in comment - drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value - m68k: Don't unregister boot console needlessly - drm/msm/dpu: Fill in min_prefill_lines for SC8180X - kselftest/arm64: Fix check for setting new VLs in sve-ptrace - net: dst: annotate data-races around dst->input - tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range - wifi: ath11k: clear initialized flag for deinit-ed srng lists - iwlwifi: Add missing check for alloc_ordered_workqueue - wifi: iwlwifi: Fix memory leak in iwl_mvm_init() - wifi: rtl818x: Kill URBs before clearing tx status queue - wifi: rtw89: avoid NULL dereference when RX problematic packet on unsupported 6 GHz band - caif: reduce stack size, again - bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure - drm/vmwgfx: Fix Host-Backed userspace on Guest-Backed kernel - net: ipv6: ip6mr: Fix in/out netdev to pass to the FORWARD chain - selftests/bpf: fix signedness bug in redir_partial() - bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls - bpf, sockmap: Fix psock incorrectly pointing to sk - drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed - staging: nvec: Fix incorrect null termination of battery manufacturer - interconnect: qcom: sc8180x: specify num_nodes - interconnect: qcom: sc8280xp: specify num_links for qnm_a1noc_cfg - soc: qcom: pmic_glink: fix OF node leak - samples: mei: Fix building on musl libc - cpufreq: Initialize cpufreq-based frequency-invariance later - cpufreq: intel_pstate: Always use HWP_DESIRED_PERF in passive mode - arm64: dts: imx8mn-beacon: Fix HS400 USDHC clock speed - arm64: dts: imx8mm-beacon: Fix HS400 USDHC clock speed - ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface - soc/tegra: cbb: Clear ERR_FORCE register with ERR_STATUS - arm: dts: ti: omap: Fixup pinheader typo - usb: early: xhci-dbc: Fix early_ioremap leak - powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw() - pps: fix poll support - staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() - spi: stm32: Check for cfg availability in stm32_spi_probe - usb: misc: apple-mfi-fastcharge: Make power supply names unique - usb: host: xhci-plat: fix incorrect type for of_match variable in xhci_plat_probe() - ARM: dts: vfxxx: Correctly use two tuples for timer address - arm64: dts: qcom: msm8976: Make blsp_dma controlled-remotely - arm64: dts: qcom: sc7180: Expand IMEM region - arm64: dts: qcom: sdm845: Expand IMEM region - soc: qcom: QMI encoding/decoding for big endian - selftests: Fix errno checking in syscall_user_dispatch test - ASoC: mediatek: use reserved memory or enable buffer pre-allocation - gfs2: No more self recovery - Revert "fs/ntfs3: Replace inode_trylock with inode_lock" - hfs: make splice write available again - hfsplus: make splice write available again - ublk: use vmalloc for ublk_device's __queues - fs_context: fix parameter name in infofc() macro - audit,module: restore audit logging in load failure case - ASoC: amd: yc: add DMI quirk for ASUS M6501RM - ASoC: Intel: fix SND_SOC_SOF dependencies - ASoC: amd: yc: Add DMI entries to support HP 15-fb1xxx - ethernet: intel: fix building with large NR_CPUS - ASoC: amd: yc: Add DMI quirk for HP Laptop 17 cp-2033dx - interference: Fix uninitialized ifs_clock compiling issue - iommu/ummu: optimize log printing - !20455 Fix compilation failure caused by PR#20174 - !20302 CVE-2026-22980 - !20142 CVE-2025-68803 - !20261 ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency - !20435 fix CVE-2026-22998 - !20433 scsi: target: Reset t_task_cdb pointer in error case - !20432 scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" - !20431 block: Use RCU in blk_mq_[un - !20307 tpm: Cap the number of PCR banks - !20062 xfs: Add xfs_dir3_leaf_header_check() in leaf/leafn read - !20157 v2 md: backport from mainline - rcu: Protect ->defer_qs_iw_pending from data race - platform/x86/intel/pmt: fix compilation failure caused by PR#20174 - iommu/ummu: optimize kv cache memory management - iommu/ummu: optimize permission table management - iommu/ummu: remove check for eid_type while del eid - iommu/ummu: optimize the code implementation - drivers/perf: fix ummu-pmu data reading exception - iommu/ummu: IOMMU_DOMAIN_BLOCKED type don not sync tct - drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer - crypto: seqiv - Do not use req->iv after crypto_aead_encrypt - net: unic: Notify mami of the bond ip change. - ub: ubase: Support for UE link by ctrlq message - ub: ubase: send a deactivate req in removing - ub: ubase: Querying TPG/TP contexts in the chip is no longer supported after enabling safe mode. - ub: ubase: Use an independent thread for the ctrlq workqueue. - !20368 ubcore: fix logging and permission for route query. - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id - !20344 ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr - net: unic: Fix the ummu 0xa event that occurs when modifying queues and resetting concurrent scenarios - ub: ubase: Add KABI compatibility - ub: ubase: fixing the issue of cdma ctp_req_vl parameter configuration - ub: ubase: add PMU IDEV interrupt supported abilities. - ub: ubase: Delete the tid mask for eq, jfs, jfr, and jfc context - ub: ubase: Set the completion event interrupt to auto - net: unic: fix poll tx read old skb cause a UAF bug - !20249 Fix CVE-2025-38489 - !20250 Fix CVE-2025-38480 - !20378 Fix CVE-2025-39838 - !20430 Fix CVE-2025-39942 - !20351 Fix CVE-2025-71149 - !20375 Fix CVE-2025-71150 - !20323 Fix CVE-2025-38730 - !20320 Fix CVE-2025-68814 - !20314 Fix CVE-2025-71072 - !20315 Fix CVE-2025-68794 - !20403 bpf: Check skb->transport_header is set in bpf_skb_check_mtu - !20402 bpf: Do not let BPF test infra emit invalid GSO types to stack - !20401 tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() - !20400 netfilter: nft_ct: add seqadj extension for natted connections - !20399 net: xfrm: Fix CVE-2025-40215 - !20398 net/sched: sch_qfq: Fix null-deref in agg_dequeue - !20397 bpf: Reject narrower access to pointer ctx fields - !20396 Bluetooth: eir: Fix possible crashes on eir_create_adv_data - !20394 IB/mlx5: Fix potential deadlock in MR deregistration - !20367 ub: cdma: cdma uaf bugfix - net/mlx5e: Fix crash on profile change rollback failure - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv - PCI/AER: Fix NULL pointer access by aer_info - gfs2: No more self recovery - drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE - crypto: qat - flush misc workqueue during device shutdown - !20174 Backport PMT spec 3.0 support - !20366 [Hygon][6.6][Bugfix]: Resolve FPU state corruption between atomic and non-atomic contexts - !19814 [OLK-6.6] Batch flushing user memory encrytion status change - !20393 [OLK-6.6][linux-6.6.y sync] Backport 6.6.100-6.6.101 LTS Patches - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec - nvmet-tcp: remove boilerplate code - scsi: target: Reset t_task_cdb pointer in error case - scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" - block: Use RCU in blk_mq_[un]quiesce_tagset() instead of set->tag_list_lock - ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size - ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer - smb: server: let recv_done() consistently call put_recvmsg/smb_direct_disconnect_rdma_connection - smb: server: remove separate empty_recvmsg_queue - !20384 ub:ubus: Fix ubus link message and pool device error - !20389 gfs2: Prevent recursive memory reclaim - !20388 *** fix CVE-2025-38062 *** - !20387 KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced - !20386 pinctrl: check the return value of pinmux_ops::get_function_name() - !20385 iommu/amd/pgtbl: Fix possible race while increase page table level - ub:ubus: Not cfg access during surprise down - ub:hisi-ubus: Delete validate_pa err print - PCI: cadence: Check for the existence of cdns_pcie::ops before using it - can: netlink: can_changelink(): allow disabling of automatic restart - Revert "selftests/bpf: Add a cgroup prog bpf_get_ns_current_pid_tgid() test" - drm/sched: Remove optimization that causes hang when killing dependent jobs - ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS - bpf: Check skb->transport_header is set in bpf_skb_check_mtu - bpf: Do not let BPF test infra emit invalid GSO types to stack - tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() - netfilter: nft_ct: add seqadj extension for natted connections - xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added - xfrm: delete x->tunnel as we delete x - x86/hw-vuln:Support hardware-based mitigation for Retbleed and SRSO via Hygon IBRS to avoid performance degradation caused by software-based mitigation. - net/sched: sch_qfq: Fix null-deref in agg_dequeue - bpf: Reject narrower access to pointer ctx fields - Bluetooth: eir: Fix possible crashes on eir_create_adv_data - IB/mlx5: Fix potential deadlock in MR deregistration - ub:ubus: Fix ubus link message and pool device error - ub:hisi-ubus: cq poller maximum handle 64 cqe per time - ub:hisi-ubus:Fix vdm message print error - ub:ubus:Fix ubus interrupt release issue - wifi: mt76: mt7921: prevent decap offload config before STA initialization - mtd: rawnand: qcom: Fix last codeword read in qcom_param_page_type_exec() - iio: hid-sensor-prox: Restore lost scale assignments - iio: hid-sensor-prox: Fix incorrect OFFSET calculation - crypto: powerpc/poly1305 - add depends on BROKEN for now - erofs: address D-cache aliasing - drm/i915/dp: Fix 2.7 Gbps DP_LINK_BW value on g4x - ALSA: hda: Add missing NVIDIA HDA codec IDs - ALSA: hda/tegra: Add Tegra264 support - comedi: comedi_test: Fix possible deletion of uninitialized timers - usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach - usb: typec: tcpm: allow switching to mode accessory to mux properly - usb: typec: tcpm: allow to use sink in accessory mode - drm/amdkfd: Don't call mmput from MMU notifier callback - mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n - selftests: mptcp: connect: also cover checksum - selftests: mptcp: connect: also cover alt modes - resource: fix false warning in __request_region() - gve: Fix stuck TX queue for DQ queue format - e1000e: ignore uninitialized checksum word on tgp - e1000e: disregard NVM checksum on tgp when valid checksum bit is not set - dpaa2-switch: Fix device reference count leak in MAC endpoint handling - dpaa2-eth: Fix device reference count leak in MAC endpoint handling - ALSA: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx - sprintf.h requires stdarg.h - bus: fsl-mc: Fix potential double device reference in fsl_mc_get_endpoint() - i2c: virtio: Avoid hang by using interruptible completion wait - i2c: tegra: Fix reset error handling with ACPI - platform/x86: ideapad-laptop: Fix kbd backlight not remembered among boots - can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode - can: dev: can_restart(): move debug message and stats after successful restart - can: dev: can_restart(): reverse logic to remove need for goto - i40e: When removing VF MAC filters, only check PF-set MAC - i40e: report VF tx_dropped with tx_errors instead of tx_discards - i40e: Add rx_missed_errors for buffer exhaustion - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch - net/mlx5: Fix memory leak in cmd_exec() - staging: vchiq_arm: Make vchiq_shutdown never fail - x86/hyperv: Fix usage of cpu_online_mask to get valid cpu - regmap: fix potential memory leak of regmap_bus - iio: adc: ad7949: use spi_is_bpw_supported() - interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1 node - RDMA/core: Rate limit GID cache warning messages - virtio_ring: Fix error reporting in virtqueue_resize - !20348 [OLK-6.6][linux-6.6.y sync] Backport 6.6.99-6.6.100 LTS Patches - !20346 tracing: Fix crash on synthetic stacktrace field usage - vfs: Don't leak disconnected dentries on umount - !20334 Fix CVE-2025-68780 - gfs2: Prevent recursive memory reclaim - amd/amdkfd: enhance kfd process check in switch partition - drm/amdkfd: allow compute partition mode switch with cgroup exclusions - KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced - pinctrl: check the return value of pinmux_ops::get_function_name() - iommu/amd/pgtbl: Fix possible race while increase page table level - !19966 nvme-fc: use lock accessing port_state and rport state - ASoC: fsl_sai: replace regmap_write with regmap_update_bits - comedi: Fix use of uninitialized data in insn_rw_emulate_bits() - cifs: prevent NULL pointer dereference in UTF16 conversion - ksmbd: Fix refcount leak when invalid session is found on session lookup - ubcore: fix logging and permission for route query. - !20232 driver/coda: VirtCCA supports MSI device DA - Revert "Revert "RDMA/hns: Fix mismatch exception rollback"" - !20197 ub: udma&ubase: fix a bug that caused long reboot time - x86: Resolve FPU state corruption between atomic and non-atomic contexts - ub: cdma: cdma uaf bugfix - ub: cdma: jfs call trace bugfix - !20353 x86/fpu: Clear XSTATE_BV[i - s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again - KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls - nvmem: layouts: u-boot-env: remove crc32 endianness conversion - i2c: omap: fix deprecated of_property_read_bool() use - ASoC: fsl_sai: Force a software reset when starting in consumer mode - regulator: pwm-regulator: Manage boot-on with disabled PWM channels - regulator: pwm-regulator: Calculate the output voltage for disabled PWMs - i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe() - i2c: omap: Fix an error handling path in omap_i2c_probe() - i2c: omap: Add support for setting mux - usb: dwc3: qcom: Don't leave BCR asserted - usb: hub: Don't try to recover devices lost during warm reset. - usb: hub: Fix flushing of delayed work used for post resume purposes - usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm - usb: hub: fix detection of high tier USB3 devices behind suspended hubs - arm64: Filter out SME hwcaps when FEAT_SME isn't implemented - ipv6: make addrconf_wq single threaded - !20354 cpufreq/sched: Explicitly synchronize limits_changed flag handling - sched/deadline: only set free_cpus for online runqueues - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 - cpufreq/sched: Explicitly synchronize limits_changed flag handling - io_uring/poll: correctly handle io_poll_add() return value on update - shmem: fix recovery on rename failures - io_uring: fix filename leak in __io_openat_prep() - Revert "cgroup_freezer: cgroup_freezing: Check if not frozen" - rxrpc: Fix transmission of an abort in response to an abort - rxrpc: Fix recv-recv race of completed call - net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree - net: bridge: Do not offload IGMP/MLD messages - hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf - netfilter: nf_conntrack: fix crash due to removal of uninitialised entry - ipv6: mcast: Delay put pmc->idev in mld_del_delrec() - net/mlx5: Correctly set gso_size when LRO is used - Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID - Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout - Bluetooth: SMP: If an unallowed command is received consider it a failure - Bluetooth: hci_sync: fix connectable extended advertising when using static random address - hwmon: (corsair-cpro) Validate the size of the received input buffer - selftests: net: increase inter-packet timeout in udpgro.sh - wifi: cfg80211: remove scan request n_channels counted_by - nvme: fix misaccounting of nvme-mpath inflight I/O - net: phy: Don't register LEDs for genphy - nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list() - rpl: Fix use-after-free in rpl_do_srh_inline(). - block: fix kobject leak in blk_unregister_queue - net: emaclite: Fix missing pointer increment in aligned_read() - soundwire: amd: fix for clearing command status register - soundwire: amd: fix for handling slave alerts after link is down - comedi: Fix use of uninitialized data in insn_rw_emulate_bits() - comedi: Fix some signed shift left operations - comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large - comedi: das6402: Fix bit shift out of bounds - comedi: das16m1: Fix bit shift out of bounds - comedi: aio_iiro_16: Fix bit shift out of bounds - comedi: pcl812: Fix bit shift out of bounds - iio: adc: stm32-adc: Fix race in installing chained IRQ handler - iio: adc: max1363: Reorder mode_list[] entries - iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] - iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush - soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled - soc: aspeed: lpc-snoop: Cleanup resources in stack-order - s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again - pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov - net: libwx: properly reset Rx ring descriptor - net: libwx: remove duplicate page_pool_put_full_page() - mmc: sdhci_am654: Workaround for Errata i2312 - mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models - mmc: bcm2835: Fix dma_unmap_sg() nents value - memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() - isofs: Verify inode mode when loading from disk - dmaengine: nbpfaxi: Fix memory corruption in probe() - af_packet: fix soft lockup issue caused by tpacket_snd() - af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() - arm64: dts: rockchip: use cs-gpios for spi1 on ringneck - arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on - arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency - net/mlx5: Update the list of the PCI supported devices - phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() - io_uring/poll: fix POLLERR handling - ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS - drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume - tracing/osnoise: Fix crash in timerlat_dump_stack() - spi: Add check for 8-bit transfer with 8 IO mode support - pch_uart: Fix dma_sync_sg_for_device() nents value - thunderbolt: Fix bit masking in tb_dp_port_set_hops() - i2c: stm32: fix the device used for the DMA map - tracing: Fix crash on synthetic stacktrace field usage - usb: musb: fix gadget state on disconnect - USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI - USB: serial: option: add Foxconn T99W640 - USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition - phy: tegra: xusb: Disable periodic tracking on Tegra234 - phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode - phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr - fs/proc: fix uaf in proc_readdir_de() - io_uring/net: commit partial buffers on retry - nvme: fix admin request_queue lifetime - fs/notify: call exportfs_encode_fid with s_umount - iomap: adjust read range correctly for non-block-aligned positions - fuse: fix livelock in synchronous file put from fuseblk workers - tpm: Cap the number of PCR banks - nfsd: provide locking for v4_end_grace - Revert "nfsd: provide locking for v4_end_grace" - config: enable config for PMT discovery driver - platform/x86/intel/pmt/discovery: use valid device pointer in dev_err_probe - platform/x86/intel/pmt: Fix kobject memory leak on init failure - platform/x86/intel/pmt: fix a crashlog NULL pointer access - platform/x86/intel/pmt: fix build dependency for kunit test - platform/x86/intel/pmt/discovery: fix format string warning - platform/x86/intel/pmt/discovery: Fix size_t specifiers for 32-bit - platform/x86/intel/pmt: KUNIT test for PMT Enhanced Discovery API - platform/x86/intel/pmt/telemetry: Add API to retrieve telemetry regions by feature - platform/x86/intel/pmt/discovery: Get telemetry attributes - platform/x86/intel/tpmi: Get OOBMSM CPU mapping from TPMI - platform/x86/intel/vsec: Set OOBMSM to CPU mapping - platform/x86/intel/tpmi: Relocate platform info to intel_vsec.h - docs: Add ABI documentation for intel_pmt feature directories - platform/x86/intel/pmt: Add PMT Discovery driver - sysfs: Fix crash on empty group attributes array - sysfs: Introduce a mechanism to hide static attribute_groups - platform/x86/intel/vsec: Add new Discovery feature - platform/x86/intel/vsec: Skip driverless features - platform/x86/intel/vsec: Skip absent features during initialization - platform/x86/intel/vsec: Add device links to enforce dependencies - platform/x86/intel/vsec: Create wrapper to walk PCI config space - platform/x86/intel/vsec: Add private data for per-device data - MAINTAINERS: Add link to documentation of Intel PMT ABI - platform/x86/intel/pmt: allow user offset for PMT callbacks - driver/coda: VirtCCA supports MSI device DA - ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency - Rename leapioraid to leapraid and release v2.0 - ub: udma: fix a bug that caused long reboot time. - ub: ubase: Accelerate when ctrl node is shutting down - platform/x86/intel/pmt: Use PMT callbacks - platform/x86/intel/vsec: Add PMT read callbacks - platform/x86/intel/vsec.h: Move to include/linux - md: prevent incorrect update of resync/recovery offset - md/raid1: Fix data corruption for degraded array with slow disk - md/raid1: set max_sectors during early return from choose_slow_rdev() - md-cluster: fix no recovery job when adding/re-adding a disk - md-cluster: fix hanging issue while a new disk adding - md/raid5: recheck if reshape has finished with device_lock held - md-cluster: Constify struct md_cluster_operations - md: Remove unneeded semicolon - md/raid5: fix spares errors about rcu usage - dm-raid: Fix WARN_ON_ONCE check for sync_thread in raid_resume - md: pass in max_sectors for pers->sync_request() - md: factor out helpers for different sync_action in md_do_sync() - md: replace last_sync_action with new enum type - md: use new helpers in md_do_sync() - md: don't fail action_store() if sync_thread is not registered - md: remove parameter check_seq for stop_sync_thread() - md: replace sysfs api sync_action with new helpers - md: factor out helper to start reshape from action_store() - md: add new helpers for sync_action - md: add a new enum type sync_action - md: rearrange recovery_flags - md/raid0: don't free conf on raid0_run failure - md: make md_flush_request() more readable - md: change the return value type of md_write_start to void - md: Revert "md: Fix overflow in is_mddev_idle" - md: don't account sync_io if iostats of the disk is disabled - md: Fix overflow in is_mddev_idle - md: add check for sleepers in md_wakeup_thread() - md: add a mddev_is_dm helper - md: add a mddev_add_trace_msg helper - md: add a mddev_trace_remap helper - dm-raid456, md/raid456: fix a deadlock for dm-raid456 while io concurrent with reshape - dm-raid: add a new helper prepare_suspend() in md_personality - dm-raid: really frozen sync_thread during suspend - md: add a new helper reshape_interrupted() - md: export helper md_is_rdwr() - md: export helpers to stop sync_thread - md: don't clear MD_RECOVERY_FROZEN for new dm-raid until resume - md/raid1: factor out helpers to choose the best rdev from read_balance() - md/raid1: factor out the code to manage sequential IO - md/raid1: factor out choose_bb_rdev() from read_balance() - md/raid1: factor out choose_slow_rdev() from read_balance() - md/raid1: factor out read_first_rdev() from read_balance() - md/raid1-10: factor out a new helper raid1_should_read_first() - md/raid1-10: add a helper raid1_check_read_range() - md/raid1: fix choose next idle in read_balance() - md/raid1: record nonrot rdevs while adding/removing rdevs to conf - md/raid1: factor out helpers to add rdev to conf - md: add a new helper rdev_has_badblock() - md: check mddev->pers before calling md_set_readonly() - md: clean up openers check in do_md_stop() and md_set_readonly() - md: sync blockdev before stopping raid or setting readonly - md: factor out a helper to sync mddev - md: return directly before setting did_set_md_closing - md: changed the switch of RAID_VERSION to if - md: merge the check of capabilities into md_ioctl_valid() - md: Don't suspend the array for interrupted reshape - md: Don't register sync_thread for reshape directly - md: Make sure md_do_sync() will set MD_RECOVERY_DONE - md: Don't ignore read-only array in md_check_recovery() - md: Don't ignore suspended array in md_check_recovery() - md: get rdev->mddev with READ_ONCE() - md: remove redundant md_wakeup_thread() - md: remove redundant check of 'mddev->sync_thread' - md: fix a suspicious RCU usage warning - raid: Remove now superfluous sentinel element from ctl_table array - NFSD: NFSv4 file creation neglects setting ACL - nfsd: set security label during create operations - xfs: Add xfs_dir3_leaf_header_check() in leaf/leafn read - nvme-fc: use lock accessing port_state and rport state - x86/mm: Batch flushing user memory encrytion status change - !20588 [OLK-6.6] Revert "x86/csv: Enhance CMA memory usage reporting for CSV3" - Revert "x86/csv: Enhance CMA memory usage reporting for CSV3" - !20576 media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg() - !20575 RDMA/cm: Fix leaking the multicast GID table reference - !20580 RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly - !20551 Fix CVE-2025-68785 - !20478 f2fs: fix to avoid potential deadlock - !20501 [OLK-6.6] backport important bugfix for bnxt driver from upstream linux-6.6.y - !20520 Fix CVE-2026-23038 - !20424 net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup - !20425 mlx5: Fix default values in create CQ - RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly - media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg() - RDMA/cm: Fix leaking the multicast GID table reference - net: openvswitch: fix middle attribute validation in push_nsh() action - net: openvswitch: remove never-working support for setting nsh fields - pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() - bnxt_en: Fix potential data corruption with HW GRO/LRO - f2fs: fix to avoid potential deadlock - mlx5: Fix default values in create CQ - net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup - riscv kernel upgrade to 6.6.0-138.0.0 - Fixed system hang when boot systemd on spacemit k3 - riscv: perf vendor events: fix lrw core PMU event mapping - !20727 v2 bpf: sockmap fixes - !20741 scsi: qla2xxx: Sanitize payload size to prevent member overflow - !20744 fix CVE-2025-38449 - !20763 net: usb: asix: validate PHY address before use - !20762 smc91x: fix broken irq-context in PREEMPT_RT - !20293 [Hygon][6.6][EDAC] The width of hash value is 2 bits for Hygon family 18h model 6h processors - !20290 [Hygon][6.6][Bugfix] Bug fix for EDAC to use unicast instead of broadcast on hygon family 18h model 4h - !20289 [Hygon][6.6][Bugfix] Bug fix for EDAC to correct the address translation on hygon family 18h model 4h - !20245 KVM: arm64: Refactor exit handlers - !20246 KVM: arm64: Mark some header functions as inline - !19005 [Hygon] [OLK-6.6] [Bugfix] Fix memory bandwidth counter width for Hygon QoS - !20292 [Hygon][6.6][TSC Adjust] Backport x86 TSC adjust patch - !20273 [Hygon][6.6][Bugfix] Get correct CPU LLC ID in guest for Hygon processors - !20722 [OLK-6.6][linux-6.6.y sync] Backport 6.6.104-6.6.106 LTS Patches - !20667 fix CVE-2024-50102 - !20736 netfilter: nf_tables: remove redundant chain validation on register store - !20758 ub: ubase: Fixed the alarm issue caused by the initialization of the structure variable definition. - !20721 obmm: reduce log noise for successful export/import/preimport - net: usb: asix: validate PHY address before use - smc91x: fix broken irq-context in PREEMPT_RT - !20731 devlink: rate: Unset parent pointer in devl_rate_nodes_destroy - !20732 libceph: return the handler error from mon_handle_auth_done() - !20743 mm: slub: avoid wake up kswapd in set_track_prepare - ub: ubase: Fixed the alarm issue caused by the initialization of the structure variable definition. - !20750 ub: cdma: adapted to UMMU interface changes - !20713 urma: DFX of log in kernel - urma: optimize log levels for kernel space - ub: cdma: adapted to UMMU interface changes - wifi: ath11k: avoid bit operation on key flags - drm/mediatek: fix potential OF node use-after-free - cpufreq: intel_pstate: Check IDA only before MSR_IA32_PERF_CTL writes - wifi: cfg80211: sme: store capped length in __cfg80211_connect_result() - !20708 ub:hisi-ubus: Add create bus instance ummu bypass - drm: fix kabi for struct drm_framebuffer - drm/framebuffer: Acquire internal references on GEM handles - drm/gem: Acquire references on GEM handles for framebuffers - mm: slub: avoid wake up kswapd in set_track_prepare - scsi: qla2xxx: Sanitize payload size to prevent member overflow - netfilter: nf_tables: remove redundant chain validation on register store - libceph: return the handler error from mon_handle_auth_done() - devlink: rate: Unset parent pointer in devl_rate_nodes_destroy - Documentation/hw-vuln: Add VMSCAPE documentation - dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status() - riscv: use lw when reading int cpu in asm_per_cpu - mm: slub: avoid wake up kswapd in set_track_prepare - tools: gpio: remove the include directory on make clean - tools: gpio: rm .*.cmd on make clean - drm/amd/amdgpu: Fix missing error return on kzalloc failure - drm/amdgpu: Replace DRM_* with dev_* in amdgpu_psp.c - perf bpf-event: Fix use-after-free in synthesis - drm/bridge: ti-sn65dsi86: fix REFCLK setting - spi: spi-fsl-lpspi: Clear status register after disabling the module - spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort - spi: spi-fsl-lpspi: Set correct chip-select polarity bit - spi: spi-fsl-lpspi: Fix transmissions when using CONT - hwmon: mlxreg-fan: Prevent fans from getting stuck at 0 RPM - pcmcia: omap: Add missing check for platform_get_resource - Revert "drm/amdgpu: Avoid extra evict-restore process." - ALSA: hda/realtek: Fix headset mic for TongFang X6[AF]R5xxY - ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model - drm/mediatek: Fix device/node reference count leaks in mtk_drm_get_all_drm_priv - drm/mediatek: Fix using wrong drm private data to bind mediatek-drm - drm/mediatek: Add crtc path enum for all_drm_priv array - vmxnet3: update MTU after device quiesce - net: dsa: microchip: linearize skb for tail-tagging switches - net: dsa: microchip: update tag_ksz masks for KSZ9477 family - dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status() - ALSA: hda/realtek - Add new HP ZBook laptop with micmute led fixup - ALSA: hda/realtek: Add support for HP Agusta using CS35L41 HDA - iio: pressure: mprls0025pa: use aligned_s64 for timestamp - iio: chemical: pms7003: use aligned_s64 for timestamp - iio: imu: inv_mpu6050: align buffer for timestamp - thermal/drivers/mediatek/lvts: Disable low offset IRQ for minimum threshold - nouveau: fix disabling the nonstall irq due to storm code - cpufreq: intel_pstate: Unchecked MSR aceess in legacy mode - net: pcs: rzn1-miic: Correct MODCTRL register offset - platform/x86/amd/pmc: Add TUXEDO IB Pro Gen10 AMD to spurious 8042 quirks list - drm/amdgpu: drop hw access in non-DC audio fini - wifi: mt76: mt7996: Initialize hdr before passing to skb_put_data() - wifi: mwifiex: Initialize the chan_stats array to zero - tcp_bpf: Fix copied value in tcp_bpf_sendmsg - skmsg: Return copied bytes in sk_msg_memcopy_from_iter - tcp_bpf: Add sk_rmem_alloc related logic for tcp_bpf ingress redirection - Revert "bpf, sockmap: Add sk_rmem_alloc check for sockmap" - ALSA: usb-audio: Add mute TLV for playback volumes on some devices - phy: mscc: Stop taking ts_lock for tx_queue and use its own lock - selftest: net: Fix weird setsockopt() in bind_bhash.c. - net: atm: fix memory leak in atm_register_sysfs when device_register fail - ax25: properly unshare skbs in ax25_kiss_rcv() - mctp: return -ENOPROTOOPT for unknown getsockopt options - net/smc: Remove validation of reserved bits in CLC Decline message - ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init() - net: thunder_bgx: decrement cleanup index before use - net: thunder_bgx: add a missing of_node_put - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() - wifi: libertas: cap SSID len in lbs_associate() - wifi: cw1200: cap SSID length in cw1200_do_join() - net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets - wifi: ath11k: fix group data packet drops during rekey - wifi: ath11k: avoid forward declaration of ath11k_mac_start_vdev_delay() - wifi: ath11k: rename ath11k_start_vdev_delay() - wifi: ath11k: Introduce and use ath11k_sta_to_arsta() - net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() - macsec: read MACSEC_SA_ATTR_PN with nla_get_uint - netlink: add variable-length / auto integers - net: macb: Fix tx_ptr_lock locking - icmp: fix icmp_ndo_send address translation for reply direction - mISDN: Fix memory leak in dsp_hwec_enable() - xirc2ps_cs: fix register access when enabling FullDuplex - netfilter: conntrack: helper: Replace -EEXIST by -EBUSY - wifi: cfg80211: fix use-after-free in cmp_bss() - arm64: dts: imx8mp: Fix missing microSD slot vqmmc on Data Modul i.MX8M Plus eDM SBC - arm64: dts: imx8mp: Fix missing microSD slot vqmmc on DH electronics i.MX8M Plus DHCOM - tee: optee: ffa: fix a typo of "optee_ffa_api_is_compatible" - arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro - Bluetooth: hci_sync: Avoid adding default advertising on startup - cpupower: Fix a bug where the -t option of the set subcommand was not working. - drm/amd/display: Don't warn when missing DCE encoder caps - cdc_ncm: Flag Intel OEM version of Fibocom L850-GL as WWAN - LoongArch: Save LBT before FPU in setup_sigcontext() - btrfs: avoid load/store tearing races when checking if an inode was logged - btrfs: fix race between setting last_dir_index_offset and inode logging - btrfs: fix race between logging inode and checking if it was logged before - bpf: Fix oob access in cgroup local storage - !20556 urma: fix update topo logic - !20639 [OLK-6.6][linux-6.6.y sync] Backport 6.6.103-6.6.104 LTS Patches - !20641 [OLK-6.6][linux-6.6.y sync] LoongArch: Add more instruction opcodes and emit_* helpers - !20560 *** fix CVE-2025-38062 *** - !20662 pNFS: Fix a deadlock when returning a delegation during open() - ub:hisi-ubus: Add create bus instance ummu bypass - Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" - Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set" - HID: mcp2221: Handle reads greater than 60 bytes - HID: mcp2221: Don't set bus speed on every transfer - net/mlx5: SF, Fix add port error handling - drm/nouveau/disp: Always accept linear modifier - smb3 client: fix return code mapping of remap_file_range - net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions - dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted - HID: wacom: Add a new Art Pen 2 - HID: logitech: Add ids for G PRO 2 LIGHTSPEED - HID: quirks: add support for Legion Go dual dinput modes - net: stmmac: Set CIC bit only for TX queues with COE - net: stmmac: xgmac: Correct supported speed modes - net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts - net/mlx5e: Set local Xoff after FW update - net/mlx5e: Update and set Xon/Xoff upon port speed set - net/mlx5e: Update and set Xon/Xoff upon MTU set - net/mlx5: Nack sync reset when SFs are present - net/mlx5: Convert SF port_indices xarray to function_ids xarray - net/mlx5: Use devlink port pointer to get the pointer of container SF struct - net/mlx5: Call mlx5_sf_id_erase() once in mlx5_sf_dealloc() - phy: mscc: Fix when PTP clock is register and unregister - net: dlink: fix multicast stats being counted incorrectly - dt-bindings: display/msm: qcom,mdp5: drop lut clock - drm/nouveau: remove unused memory target test - drm/nouveau: remove unused increment in gm200_flcn_pio_imem_wr - Bluetooth: hci_sync: fix set_local_name race condition - Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced - Bluetooth: hci_event: Mark connection as closed during suspend disconnect - Bluetooth: hci_event: Treat UNKNOWN_CONN_ID on disconnect as success - HID: input: report battery status changes immediately - HID: input: rename hidinput_set_battery_charge_status() - powerpc/kvm: Fix ifdef to remove build warning - drm/msm: Defer fd_install in SUBMIT ioctl - vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() - ACPI: EC: Add device to acpi_ec_no_wakeup[] qurik list - erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC - ASoC: codecs: tx-macro: correct tx_macro_component_drv name - smb: client: fix race with concurrent opens in unlink(2) - scsi: core: sysfs: Correct sysfs attributes access rights - of: dynamic: Fix use after free in of_changeset_add_prop_helper() - of: Add a helper to free property struct - mips: lantiq: xway: sysctrl: rename the etop node - mips: dts: lantiq: danube: add missing burst length property - pinctrl: STMFX: add missing HAS_IOMEM dependency - of: dynamic: Fix memleak when of_pci_add_properties() failed - !20684 urma: adjust urma log format - !20355 udp: Deal with race between UDP socket address change and rehash - !20627 Fixes CVE-2025-38627 - !20702 CVE-2025-39948 - !20701 netfilter: ctnetlink: remove refcounting in expectation dumpers - !20700 CVE-2025-38678 - !20703 CVE-2025-38491 - !20690 tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. - obmm: reduce log noise for successful export/import/preimport - mptcp: avoid deadlock on fallback while reinjecting - mptcp: plug races between subflow fail and subflow creation - mptcp: make fallback action and fallback decision atomic - ice: fix Rx page leak on multi-buffer frames - ice: fix incorrect counter for buffer allocation failures - ice: stop storing XDP verdict within ice_rx_buf - ice: gather page_count()'s of each frag right before XDP prog call - ice: Introduce ice_xdp_buff - netfilter: ctnetlink: remove refcounting in expectation dumpers - netfilter: nf_tables: reject duplicate device on updates - netfilter: nf_tables: Introduce functions freeing nft_hook objects - netfilter: nf_tables: Fix percpu address space issues in nf_tables_api.c - err.h: add ERR_PTR_PCPU(), PTR_ERR_PCPU() and IS_ERR_PCPU() macros - tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. - !20498 Fix CVE-2025-71118 - !20608 pmdomain: arm: scmi: Fix genpd leak on provider registration failure - !20679 x86/CPU/AMD: Add RDSEED fix for Zen5 - !20650 fix cve-2025-40300 - !20661 Input: alps - fix use-after-free bugs caused by dev3_register_work - !20664 backport some net bugfix from 6.6 lts - urma: adjust urma log format - !20678 ub: udma: close debug switch load parameters. - ub: udma: close debug switch load parameters. - x86/CPU/AMD: Add RDSEED fix for Zen5 - !20630 net: LTS-6.6 bugfix backport - !20632 net/sched: sch_qfq: do not free existing class in qfq_change_class() - !20631 macvlan: fix possible UAF in macvlan_forward_source() - !20628 Fix CVE-2025-39910 - !20659 v2 Fix CVE-2025-22090 - !20506 XSched: Update XSched manual - !20647 media: imon: make send_packet() more robust - !20646 ksm: use range-walk function to jump over holes in scan_get_next_rmap_item - !20645 fbcon: Set fb_display[i - !20648 parse_longname(): strrchr() expects NUL-terminated string - !20621 urma: modify log level - !20602 urma: fix the jfe uaf issue that occurred during the killall process. - !20567 urma:change log level and pass status 9 - !20640 iio: common: st_sensors: Fix use of uninitialize device structs - !20634 usb: gadget: udc: fix use-after-free in usb_gadget_state_work - !20633 net: dsa: properly keep track of conduit reference - !20635 fix CVE-2025-68231 - !20651 mm/slub: avoid accessing metadata when pointer is invalid in object_err() - !20649 drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb - !20652 mm/vmalloc: fix data race in show_numa_info() - x86: uaccess: don't use runtime-const rewriting in modules - x86: fix off-by-one in access_ok() - x86: fix user address masking non-canonical speculation issue - x86/uaccess: Zero the 8-byte get_range case on failure on 32-bit - x86/uaccess: Improve the 8-byte getuser() case - x86: fix whitespace in runtime-const assembler output - dcache: keep dentry_hashtable or d_hash_shift even when not used - runtime constants: add x86 architecture support - runtime constants: deal with old decrepit linkers - x86/uaccess: Add missing __force to casts in __access_ok() and valid_user_address() - !20345 arm64: entry: xcall/xint: make asm conditionals compatible with clang IAS - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). - libceph: replace BUG_ON with bounds check for map->max_osd - libceph: prevent potential out-of-bounds writes in handle_auth_session_key() - libceph: fix potential use-after-free in have_mon_and_osd_map() - sctp: Hold sock lock while iterating over address list - sctp: Prevent TOCTOU out-of-bounds write - sctp: Hold RCU read lock while iterating over address list - tipc: Fix use-after-free in tipc_mon_reinit_self(). - sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto - sctp: avoid NULL dereference when chunk data buffer is missing - bpf: Explicitly check accesses to bpf_sock_addr - ipvs: Defer ip_vs_ftp unregister during netns cleanup - nexthop: Forbid FDB status change while nexthop is in a group - netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). - net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer - sctp: initialize more fields in sctp_v6_from_sk() - pNFS: Fix a deadlock when returning a delegation during open() - Input: alps - fix use-after-free bugs caused by dev3_register_work - x86/cpu: Get CPU LLC ID from CPUID 0x8000001d in guest for Hygon processors - kernel/fork: only call untrack_pfn_clear() on VMAs duplicated for fork() - mm: (un)track_pfn_copy() fix + doc improvements - x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range() - !20642 mtdchar: fix integer overflow in read/write ioctls - mm/vmalloc: fix data race in show_numa_info() - mm/slub: avoid accessing metadata when pointer is invalid in object_err() - config: enable CONFIG_MITIGATION_VMESCAPE by default on x86 - x86/vmscape: Enable the mitigation - x86/vmscape: Enumerate VMSCAPE bug - x86/vmscape: Add conditional IBPB mitigation - drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb - parse_longname(): strrchr() expects NUL-terminated string - media: imon: make send_packet() more robust - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item - fbcon: Set fb_display[i]->mode to NULL when the mode is released - !20569 CVE-2024-35808 - mtdchar: fix integer overflow in read/write ioctls - !20619 Fix CVE-2026-22991 - !20612 net: hns3: extend HCLGE_FD_AD_COUNTER_NUM to 8 bits - LoongArch: Add more instruction opcodes and emit_* helpers - iio: common: st_sensors: Fix use of uninitialize device structs - !20581 null_blk: fix kmemleak by releasing references to fault configfs items - mm/mempool: fix poisoning order>0 pages with HIGHMEM - mm/page_poison: replace kmap_atomic() with kmap_local_page() - mm/mempool: replace kmap_atomic() with kmap_local_page() - usb: gadget: udc: fix use-after-free in usb_gadget_state_work - net: dsa: properly keep track of conduit reference - net/sched: sch_qfq: do not free existing class in qfq_change_class() - macvlan: fix possible UAF in macvlan_forward_source() - netfilter: nft_objref: validate objref and objrefmap expressions - arp: do not assume dev_hard_header() does not change skb->head - ip6_gre: make ip6gre_header() robust - netfilter: nf_tables: avoid chain re-validation if possible - netfilter: nf_tables: drop unused 3rd argument from validate callback ops - Revert "netfilter: nft_objref: validate objref and objrefmap expressions" - bpf: Fix reference count leak in bpf_prog_test_run_xdp() - net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset - ethtool: Avoid overflowing userspace buffer on stats query - ipvs: fix ipv4 null-ptr-deref in route error path - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() - !20596 mm/page_alloc: prevent pcp corruption with SMP=n - !20598 team: fix check for port enabled in team_queue_override_port_prio_changed() - !18823 hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio - mm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc() - kasan: avoid sleepable page allocation from atomic context - f2fs: compress: fix UAF of f2fs_inode_info in f2fs_free_dic - f2fs: compress: change the first parameter of page_array_{alloc,free} to sbi - !20583 [OLK-6.6][linux-6.6.y sync] Backport 6.6.102-6.6.103 LTS Patches - !20460 fbdev: Fix vmalloc out-of-bounds write in fast_imageblit - urma:fix log level and pass status 9 - urma: modify log level - !20592 CVE-2025-71141 fixup - !20594 CVE-2025-39744 fixup - !20607 powerpc/64s/slb: Fix SLB multihit issue during SLB preload - !20606 mm/huge_memory: fix NULL pointer deference when splitting folio - !20604 Fix CVE-2026-22984 - !20603 Fix CVE-2026-23021 - !20600 Fix CVE-2026-22990 - urma: fix the jfe uaf issue that occurred during the killall process. - !20380 pswiotlb: Adapt to the IOMMU DMA API upgraded by IOMMUFD - libceph: make free_choose_arg_map() resilient to partial allocation - drm/dp: Change AUX DPCD probe address from LANE0_1_STATUS to TRAINING_PATTERN_SET - net: hns3: extend HCLGE_FD_AD_COUNTER_NUM to 8 bits - net: hns3: extend HCLGE_FD_AD_QID to 11 bits - net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue - net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M - Revert "net: hns3: add support for FD counter" - !20587 dmaengine: stm32: dmamux: fix device leak on route allocation - pmdomain: arm: scmi: Fix genpd leak on provider registration failure - powerpc/64s/slb: Fix SLB multihit issue during SLB preload - mm/huge_memory: fix NULL pointer deference when splitting folio - !20562 LoongArch: BPF: Sign extend kfunc call arguments - !20470 ipv4: Fix reference count leak when using error routes with nexthop objects - !20471 net: sock: fix hardened usercopy panic in sock_recv_errqueue - !20472 net: fix memory leak in skb_segment_list for GRO packets - !20473 ipv4: ip_gre: make ipgre_header() robust - !20469 SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf - !20476 ipv6: Fix use-after-free in inet6_addr_del(). - !20477 svcrdma: bound check rq_pages index in inline path - !20578 ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() - !20579 fix CVE-2025-68768 - !20542 Fix NFS deadlock - USB: storage: Remove subclass and protocol overrides from Novatek quirk - cpuidle: governors: menu: Select polling state in some more cases - cpuidle: governors: menu: Rearrange main loop in menu_select() - cpuidle: menu: Update documentation after previous changes - Revert "drm/tegra: dsi: Clear enable register if powered by bootloader" - parisc: Remove spurious if statement from raw_copy_from_user() - ata: libata-scsi: Fix system suspend for a security locked drive - Revert "drm/amdgpu: fix incorrect vm flags to map bo" - mfd: axp20x: Set explicit ID for regulator cell if no IRQ line is present - drm/amd/display: use udelay rather than fsleep - sched/fair: Revert max_newidle_lb_cost bump - net: ipv4: fix regression in local-broadcast routes - tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers - PM: runtime: Do not clear needs_force_resume with enabled runtime PM - usb: typec: ucsi: psy: Set max current to zero when disconnected - io_uring/rw: cast rw->flags assignment to rwf_t - Documentation: ACPI: i2c-muxes: fix I2C device references - s390/hypfs: Enable limited access during lockdown - s390/hypfs: Avoid unnecessary ioctl registration in debugfs - ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation - net/mlx5e: Preserve shared buffer capacity during headroom updates - net/mlx5: Base ECVF devlink port attrs from 0 - Octeontx2-af: Skip overlap check for SPI field - bonding: send LACPDUs periodically in passive mode after receiving partner's LACPDU - bonding: Add independent control state machine - bonding: update LACP activity flag after setting lacp_active - net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate - ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc - gve: prevent ethtool ops after shutdown - phy: mscc: Fix timestamping for vsc8584 - net: ethernet: mtk_ppe: add RCU lock around dev_fill_forward_path - ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add - net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM - ALSA: usb-audio: Fix size validation in convert_chmap_v3() - mlxsw: spectrum: Forward packets with an IPv4 link-local source IP - Bluetooth: hci_conn: do return error from hci_enhanced_setup_sync() - Bluetooth: hci_event: fix MTU for BN == 0 in CIS Established - scsi: qla4xxx: Prevent a potential error pointer dereference - RDMA/bnxt_re: Fix to initialize the PBL array - RDMA/bnxt_re: Fix to remove workload check in SRQ limit path - RDMA/bnxt_re: Fix to do SRQ armena by default - RDMA/erdma: Fix ignored return value of init_kernel_qp - iosys-map: Fix undefined behavior in iosys_map_clear() - cgroup/cpuset: Use static_branch_enable_cpuslocked() on cpusets_insane_config_key - spi: spi-fsl-lpspi: Clamp too high speed_hz - usb: typec: maxim_contaminant: disable low power mode when reading comparator values - usb: typec: maxim_contaminant: re-enable cc toggle if cc is open and port is clean - iio: imu: inv_icm42600: change invalid data error to -EBUSY - iio: imu: inv_icm42600: Convert to uXX and sXX integer types - iio: imu: inv_icm42600: use = { } instead of memset() - iio: imu: inv_icm42600: switch timestamp type from int64_t __aligned(8) to aligned_s64 - iio: temperature: maxim_thermocouple: use DMA-safe buffer for spi_read() - iio: light: as73211: Ensure buffer holes are zeroed - tls: fix handling of zero-length records on the rx_list - powerpc/boot: Fix build with gcc 15 - mmc: sdhci-pci-gli: GL9763e: Mask the replay timer timeout of AER - compiler: remove __ADDRESSABLE_ASM{_STR,}() again - drm/amd/display: Don't overclock DCE 6 by 15% - usb: dwc3: pci: add support for the Intel Wildcat Lake - usb: dwc3: Ignore late xferNotReady event to prevent halt timeout - USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles - usb: storage: realtek_cr: Use correct byte order for bcs->Residue - USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera - usb: renesas-xhci: Fix External ROM access timeouts - usb: core: hcd: fix accessing unmapped memory in SINGLE_STEP_SET_FEATURE test - comedi: Make insn_rw_emulate_bits() do insn->n samples - usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive - cdx: Fix off-by-one error in cdx_rpmsg_probe() - most: core: Drop device reference after usage in get_channel() - iio: proximity: isl29501: fix buffered read on big-endian systems - iio: pressure: bmp280: Use IS_ERR() in bmp280_common_probe() - fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable() - drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS - cpuidle: governors: menu: Avoid selecting states with too much latency - cpuidle: menu: Remove iowait influence - mmc: sdhci-pci-gli: Add a new function to simplify the code - mmc: sdhci-pci-gli: Use PCI AER definitions, not hard-coded values - mptcp: disable add_addr retransmission when timeout is 0 - mptcp: remove duplicate sk_reset_timer call - use uniform permission checks for all mount propagation changes - arm64: dts: ti: k3-am62-main: Remove eMMC High Speed DDR support - scsi: mpi3mr: Serialize admin queue BAR writes on 32-bit systems - scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers - scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE - PCI: imx6: Add IMX8MM_EP and IMX8MP_EP fixed 256-byte BAR 4 in epc_features - PCI: imx6: Delay link start until configfs 'start' written - PCI: rockchip: Set Target Link Speed to 5.0 GT/s before retraining - PCI: rockchip: Use standard PCIe definitions - drm/amd/display: Fill display clock and vblank time in dce110_fill_display_configs - drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs - drm/amd/display: Fix DP audio DTO1 clock source on DCE 6. - drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3 - ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and EliteBook 830 G6 - mm/debug_vm_pgtable: clear page table entries at destroy_args() - squashfs: fix memory leak in squashfs_fill_super - mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for consistency - memstick: Fix deadlock by moving removing flag earlier - KVM: arm64: Fix kernel BUG() due to bad backport of FPSIMD/SVE/SME fix - sched/fair: Fix frequency selection for non-invariant case - kbuild: userprogs: use correct linker when mixing clang and GNU ld - ata: libata-scsi: Return aborted command when missing sense and result TF - PM: runtime: Take active children into account in pm_runtime_get_if_in_use() - PM: runtime: Simplify pm_runtime_get_if_active() usage - ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig - usb: dwc3: imx8mp: fix device leak at unbind - wifi: mac80211: check basic rates validity in sta_link_apply_parameters - KVM: x86: Take irqfds.lock when adding/deleting IRQ bypass producer - s390/mm: Remove possible false-positive warning in pte_free_defer() - btrfs: send: make fs_path_len() inline and constify its argument - btrfs: send: use fallocate for hole punching with send stream v2 - btrfs: send: avoid path allocation for the current inode when issuing commands - btrfs: send: keep the current inode's path cached - btrfs: send: add and use helper to rename current inode when processing refs - btrfs: send: only use boolean variables at process_recorded_refs() - btrfs: send: factor out common logic when sending xattrs - btrfs: populate otime when logging an inode item - btrfs: constify more pointer parameters - btrfs: fix ssd_spread overallocation - btrfs: open code timespec64 in struct btrfs_inode - xfs: fully decouple XFS_IBULK* flags from XFS_IWALK* flags - btrfs: abort transaction on unexpected eb generation at btrfs_copy_root() - btrfs: always abort transaction on failure to add block group to free space tree - btrfs: move transaction aborts to the error site in add_block_group_free_space() - btrfs: qgroup: fix race between quota disable and quota rescan ioctl - usb: typec: fusb302: cache PD RX state - block: Make REQ_OP_ZONE_FINISH a write operation - block: reject invalid operation in submit_bio_noacct - leds: flash: leds-qcom-flash: Fix registry access after re-bind - leds: flash: leds-qcom-flash: Limit LED current based on thermal condition - selftests/memfd: add test for mapping write-sealed memfd read-only - mm: update memfd seal write check to include F_SEAL_WRITE - mptcp: pm: kernel: flush: do not reset ADD_ADDR limit - mptcp: drop skb if MPTCP skb extension allocation fails - ipv6: sr: Fix MAC comparison to be constant-time - drm/amd/display: Don't overwrite dce60_clk_mgr - drm/amd/display: Add primary plane to commits for correct VRR handling - drm/amdkfd: Destroy KFD debugfs after destroy KFD wq - drm/amdgpu: update mmhub 3.0.1 client id mappings - drm/amdgpu: Avoid extra evict-restore process. - drm/amd: Restore cached power limit during resume - media: venus: venc: Clamp param smaller than 1fps and bigger than 240 - media: venus: vdec: Clamp param smaller than 1fps and bigger than 240. - media: venus: protect against spurious interrupts during probe - media: venus: hfi: explicitly release IRQ during teardown - media: qcom: camss: cleanup media device allocated resource on error path - media: ov2659: Fix memory leaks in ov2659_probe() - media: usbtv: Lock resolution while streaming - media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free() - media: verisilicon: Fix AV1 decoder clock frequency - media: vivid: fix wrong pixel_array control size - media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init() - media: hi556: correct the test pattern configuration - media: gspca: Add bounds checking to firmware parser - parisc: Update comments in make_insert_tlb - parisc: Try to fixup kernel exception in bad_area_nosemaphore path of do_page_fault() - parisc: Rename pte_needs_flush() to pte_needs_cache_flush() in cache.c - parisc: Makefile: explain that 64BIT requires both 32-bit and 64-bit compilers - parisc: Define and use set_pte_at() - parisc: Check region is readable by user in raw_copy_from_user() - soc/tegra: pmc: Ensure power-domains are in a known state - f2fs: fix to avoid out-of-boundary access in dnode page - phy: qcom: phy-qcom-m31: Update IPQ5332 M31 USB phy initialization sequence - vhost/vsock: Avoid allocating arbitrarily-sized SKBs - PCI: endpoint: Fix configfs group removal on driver teardown - PCI: endpoint: Fix configfs group list head handling - mtd: rawnand: renesas: Add missing check after DMA map - mtd: rawnand: fsmc: Add missing check after DMA map - mtd: spinand: propagate spinand_wait() errors from spinand_write_page() - mtd: spi-nor: Fix spi_nor_try_unlock_all() - hwmon: (gsc-hwmon) fix fan pwm setpoint show functions - pwm: mediatek: Fix duty and period setting - pwm: mediatek: Handle hardware enable and clock enable separately - pwm: imx-tpm: Reset counter if CMOD is 0 - wifi: ath11k: fix dest ring-buffer corruption when ring is full - wifi: ath11k: fix source ring-buffer corruption - wifi: ath11k: fix dest ring-buffer corruption - wifi: ath12k: fix dest ring-buffer corruption when ring is full - wifi: ath12k: fix source ring-buffer corruption - wifi: ath12k: fix dest ring-buffer corruption - wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table() - iio: adc: ad_sigma_delta: change to buffer predisable - zynq_fpga: use sgtable-based scatterlist wrappers - scsi: ufs: ufs-pci: Fix default runtime and system PM levels - scsi: ufs: ufs-pci: Fix hibernate state transition for Intel MTL-like host controllers - ata: libata-scsi: Fix ata_to_sense_error() status handling - scsi: mpi3mr: Fix race between config read submit and interrupt completion - dt-bindings: display: sprd,sharkl3-dsi-host: Fix missing clocks constraints - dt-bindings: display: sprd,sharkl3-dpu: Fix missing clocks constraints - arm64: dts: ti: k3-am62-verdin: Enable pull-ups on I2C buses - arm64: dts: ti: k3-am62a7-sk: fix pinmux for main_uart1 - arm64: dts: ti: k3-pinctrl: Enable Schmitt Trigger by default - btrfs: zoned: fix write time activation failure for metadata block group - ext4: fix hole length calculation overflow in non-extent inodes - ext4: don't try to clear the orphan_present feature block device is r/o - ext4: fix reserved gdt blocks handling in fsmap - ext4: fix fsmap end of range reporting with bigalloc - ext4: check fast symlink for ea_inode correctly - tracing: fprobe-event: Sanitize wildcard for fprobe event name - crypto: qat - lower priority for skcipher and aead algorithms - lib/crypto: mips/chacha: Fix clang build and remove unneeded byteswap - vt: defkeymap: Map keycodes above 127 to K_HOLE - vt: keyboard: Don't process Unicode characters in K_OFF mode - bus: mhi: host: Fix endianness of BHI vector table - usb: dwc3: meson-g12a: fix device leaks at unbind - usb: musb: omap2430: fix device leak at unbind - usb: gadget: udc: renesas_usb3: fix device leak at unbind - usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init() - m68k: Fix lost column on framebuffer debug console - platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister() - cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table() - rcu: Fix racy re-initialization of irq_work causing hangs - HID: apple: avoid setting up battery timer for devices without battery - HID: magicmouse: avoid setting up battery timer when not needed - RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages - tools/nolibc: fix spelling of FD_SETBITMASK in FD_* macros - media: uvcvideo: Do not mark valid metadata as invalid - media: venus: Fix OOB read due to missing payload bound check - parisc: Makefile: fix a typo in palo.conf - fbdev: Fix vmalloc out-of-bounds write in fast_imageblit - btrfs: do not allow relocation of partially dropped subvolumes - btrfs: zoned: do not select metadata BG as finish target - btrfs: clear dirty status from extent buffer on error at insert_new_root() - btrfs: zoned: do not remove unwritten non-data block group - btrfs: abort transaction during log replay if walk_log_tree() failed - btrfs: zoned: use filesystem size not disk size for reclaim decision - cdc-acm: fix race between initial clearing halt and open - thunderbolt: Fix copy+paste error in match_service_id() - usb: typec: ucsi: Update power_supply on power role change - misc: rtsx: usb: Ensure mmc child device is active when card is present - iommufd: Report unmapped bytes in the error path of iopt_unmap_iova_range - cifs: reset iface weights when we cannot find a candidate - drm/amdgpu: fix incorrect vm flags to map bo - scsi: lpfc: Remove redundant assignment to avoid memory leak - rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe - pNFS: Handle RPC size limit for layoutcommits - pNFS: Fix disk addr range check in block/scsi layout - pNFS: Fix stripe mapping in block/scsi layout - ASoC: Intel: avs: Fix uninitialized pointer error in probe() - net: phy: smsc: add proper reset flags for LAN8710A - ipmi: Fix strcpy source and destination the same - kconfig: lxdialog: fix 'space' to (de)select options - kconfig: gconf: fix potential memory leak in renderer_edited() - kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed() - ipmi: Use dev_warn_ratelimited() for incorrect message warnings - vfio/mlx5: fix possible overflow in tracking max message size - scsi: aacraid: Stop using PCI_IRQ_AFFINITY - scsi: target: core: Generate correct identifiers for PR OUT transport IDs - scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans - kconfig: nconf: Ensure null termination where strncpy is used - vfio/type1: conditional rescheduling while pinning - kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c - f2fs: check the generic conditions first - exfat: add cluster chain loop check for dir - i2c: Force DLL0945 touchpad i2c freq to 100khz - apparmor: use the condition in AA_BUG_FMT even with debug disabled - dm-table: fix checking for rq stackable devices - dm-mpath: don't print the "loaded" message if registering fails - i3c: master: Initialize ret in i3c_i2c_notifier_call() - i3c: don't fail if GETHDRCAP is unsupported - apparmor: shift ouid when mediating hard links in userns - rtc: ds1307: handle oscillator stop flag (OSF) for ds1341 - i3c: add missing include to internal header - module: Prevent silent truncation of module name in delete_module(2) - md: dm-zoned-target: Initialize return variable r to avoid uninitialized use - soundwire: Move handle_nested_irq outside of sdw_dev_lock - soundwire: amd: serialize amd manager resume sequence during pm_prepare - crypto: octeontx2 - add timeout for load_fvc completion poll - media: uvcvideo: Fix bandwidth issue for Alcor camera - media: usb: hdpvr: disable zero-length read messages - media: tc358743: Increase FIFO trigger level to 374 - media: tc358743: Return an appropriate colorspace from tc358743_set_fmt - media: tc358743: Check I2C succeeded during probe - pinctrl: stm32: Manage irq affinity settings - scsi: mpi3mr: Correctly handle ATA device errors - scsi: mpt3sas: Correctly handle ATA device errors - power: supply: qcom_battmgr: Add lithium-polymer entry - RDMA/core: reduce stack using in nldev_stat_get_doit() - dmaengine: stm32-dma: configure next sg only if there are more than 2 sgs - leds: leds-lp50xx: Handle reg to get correct multi_index - media: v4l2-common: Reduce warnings about missing V4L2_CID_LINK_FREQ control - MIPS: lantiq: falcon: sysctrl: fix request memory check logic - crypto: jitter - fix intermediary handling - watchdog: iTCO_wdt: Report error if timeout configuration fails - MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free} - clk: qcom: ipq5018: keep XO clock always on - hwmon: (emc2305) Set initial PWM minimum value during probe based on thermal state - watchdog: dw_wdt: Fix default timeout - fs/orangefs: use snprintf() instead of sprintf() - phy: rockchip-pcie: Properly disable TEST_WRITE strobe signal - mfd: axp20x: Set explicit ID for AXP313 regulator - clk: tegra: periph: Fix error handling and resolve unsigned compare warning - fbdev: fix potential buffer overflow in do_register_framebuffer() - cifs: Fix calling CIFSFindFirst() for root path without msearch - watchdog: sbsa: Adjust keepalive timeout to avoid MediaTek WS0 race condition - drm/amd/display: Avoid configuring PSR granularity if PSR-SU not supported - drm/amd/display: Only finalize atomic_obj if it was initialized - vhost: fail early when __vhost_add_used() fails - vsock/virtio: Resize receive buffers so that each SKB fits in a 4K page - net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325 - rcu: Fix rcu_read_unlock() deadloop due to IRQ work - drm/amd/display: Avoid trying AUX transactions on disconnected ports - selftests/bpf: Fix a user_ringbuf failure with arm64 64KB page size - bpf: Make reg_not_null() true for CONST_PTR_TO_MAP - uapi: in6: restore visibility of most IPv6 socket options - drm/ttm: Should to return the evict error - drm: renesas: rz-du: mipi_dsi: Add min check for VCLK range - net: ncsi: Fix buffer overflow in fetching version id - ionic: clean dbpage in de-init - wifi: rtlwifi: fix possible skb memory leak in _rtl_pci_init_one_rxdesc() - ptp: Use ratelimite for freerun error message - bpftool: Fix JSON writer resource leak in version command - net: dsa: b53: prevent SWITCH_CTRL access on BCM5325 - net: dsa: b53: prevent DIS_LEARNING access on BCM5325 - net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325 - net: dsa: b53: fix b53_imp_vlan_setup for BCM5325 - gve: Return error for unknown admin queue command - net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs - net: vlan: Make is_vlan_dev() a stub when VLAN is not configured - drm/amd: Allow printing VanGogh OD SCLK levels without setting dpm to manual - dpaa_eth: don't use fixed_phy_change_carrier - wifi: iwlegacy: Check rate_idx range after addition - netmem: fix skb_frag_address_safe with unreadable skbs - powerpc: floppy: Add missing checks after DMA map - wifi: ath12k: Decrement TID on RX peer frag setup error handling - wifi: ath12k: Enable REO queue lookup table feature on QCN9274 hw2.0 - wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`. - wifi: mac80211: update radar_required in channel context after channel switch - drm/amd/display: Fix 'failed to blank crtc!' - wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect - wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd() - wifi: ath12k: Add memset and update default rate value in wmi tx completion - drm/amd/display: Separate set_gsl from set_gsl_source_select - net: fec: allow disable coalescing - net: atlantic: add set_power to fw_ops for atl2 to fix wol - net: thunderbolt: Fix the parameter passing of tb_xdomain_enable_paths()/tb_xdomain_disable_paths() - net: thunderbolt: Enable end-to-end flow control also in transmit - kselftest/arm64: Specify SVE data when testing VL set in sve-ptrace - wifi: mt76: mt7915: mcu: re-init MCU before loading FW patch - wifi: rtw89: Disable deep power saving for USB/SDIO - wifi: rtw89: Fix rtw89_mac_power_switch() for USB - drm/msm: use trylock for debugfs - wifi: mac80211: fix rx link assignment for non-MLO stations - ipv6: mcast: Check inet6_dev->dead under idev->mc_lock in __ipv6_dev_mc_inc(). - (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer - wifi: mac80211: don't complete management TX on SAE commit - sched/fair: Bump sd->max_newidle_lb_cost when newidle balance fails - s390/stp: Remove udelay from stp_sync_clock() - wifi: iwlwifi: mvm: fix scan request validation - um: Re-evaluate thread flags repeatedly - wifi: iwlwifi: mvm: set gtk id also in older FWs - perf/cxlpmu: Remove unintended newline from IRQ name format string - net: phy: micrel: Add ksz9131_resume() - net: thunderx: Fix format-truncation warning in bgx_acpi_match_id() - net: ipv4: fix incorrect MTU in broadcast routes - wifi: cfg80211: Fix interface type validation - net: mctp: Prevent duplicate binds - arm64: Mark kernel as tainted on SAE and SError panic - net/mlx5e: Properly access RCU protected qdisc_sleeping variable - net: ag71xx: Add missing check after DMA map - et131x: Add missing check after DMA map - wifi: rtw89: Lower the timeout in rtw89_fw_read_c2h_reg() for USB - be2net: Use correct byte order and format string for TCP seq and ack_seq - s390/time: Use monotonic clock in get_cycles() - wifi: cfg80211: reject HTC bit for management frames - ktest.pl: Prevent recursion of default variable options - wifi: ath12k: Correct tid cleanup when tid setup fails - net: usb: cdc-ncm: check for filtering capability - xen/netfront: Fix TX response spurious interrupts - Bluetooth: hci_sock: Reset cookie to zero in hci_sock_free_cookie() - powerpc/thp: tracing: Hide hugepage events under CONFIG_PPC_BOOK3S_64 - ASoC: qcom: use drvdata instead of component to keep id - ASoC: codecs: rt5640: Retry DEVICE_ID verification - iio: adc: ad7768-1: Ensure SYNC_IN pulse minimum timing requirement - ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros - ALSA: pcm: Rewrite recalculate_boundary() to avoid costly loop - platform/chrome: cros_ec_typec: Defer probe on missing EC parent - platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches - soc: qcom: mdt_loader: Actually use the e_phoff - imx8m-blk-ctrl: set ISI panic write hurry level - pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop() - usb: core: usb_submit_urb: downgrade type check - usb: typec: intel_pmc_mux: Defer probe if SCU IPC isn't present - ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4 - ASoC: hdac_hdmi: Rate limit logging on connection and disconnection - ALSA: hda: Disable jack polling at shutdown - ALSA: hda: Handle the jack polling always via a work - mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode() - mei: bus: Check for still connected devices in mei_cl_bus_dev_release() - char: misc: Fix improper and inaccurate error code returned by misc_init() - reset: brcmstb: Enable reset drivers for ARCH_BCM2835 - pps: clients: gpio: fix interrupt handling order in remove path - ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path - mmc: sdhci-msm: Ensure SD card power isn't ON when card removed - ACPI: processor: fix acpi_object initialization - PM: sleep: console: Fix the black screen issue - thermal: sysfs: Return ENODATA instead of EAGAIN for reads - PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit() - firmware: tegra: Fix IVC dependency problems - ACPI: PRM: Reduce unnecessary printing to avoid user confusion - selftests: tracing: Use mutex_unlock for testing glob filter - tools/build: Fix s390(x) cross-compilation with clang - gpio: tps65912: check the return value of regmap_update_bits() - iio: adc: ad_sigma_delta: don't overallocate scan buffer - tools/nolibc: define time_t in terms of __kernel_old_time_t - thermal/drivers/qcom-spmi-temp-alarm: Enable stage 2 shutdown when required - ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed - EDAC/synopsys: Clear the ECC counters on init - gpio: wcd934x: check the return value of regmap_update_bits() - remoteproc: imx_rproc: skip clock enable when M-core is managed by the SCU - soc: qcom: rpmh-rsc: Add RSC version 4 support - usb: xhci: Avoid showing errors during surprise removal - usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command - usb: xhci: Avoid showing warnings for dying controller - usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default - selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t - cpufreq: CPPC: Mark driver with NEED_UPDATE_LIMITS flag - platform/x86/amd: pmc: Add Lenovo Yoga 6 13ALC6 to pmc quirk list - usb: xhci: print xhci->xhc_state when queue_command failed - tracefs: Add d_delete to remove negative dentries - securityfs: don't pin dentries twice, once is enough... - fix locking in efi_secret_unlink() - ext2: Handle fiemap on empty files to prevent EINVAL - fs/ntfs3: correctly create symlink for relative path - fs/ntfs3: Add sanity check for file name - better lockdep annotations for simple_recursive_removal() - hfs: fix not erasing deleted b-tree node issue - drbd: add missing kref_get in handle_write_conflicts - udf: Verify partition map count - gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops - nvme-pci: try function level reset on init failure - smb/server: avoid deadlock when linking with ReplaceIfExists - arm64: Handle KCOV __init vs inline mismatches - ptp: prevent possible ABBA deadlock in ptp_clock_freerun() - intel_idle: Allow loading ACPI tables for any family - net: ti: icss-iep: Fix incorrect type for return value in extts_enable() - netfilter: ctnetlink: fix refcount leak on table dump - udp: also consider secpath when evaluating ipsec use for checksumming - KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs - KVM: nVMX: Check vmcs12->guest_ia32_debugctl on nested VM-Enter - KVM: VMX: Extract checking of guest's DEBUGCTL into helper - KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported - KVM: VMX: Handle forced exit due to preemption timer in fastpath - KVM: VMX: Re-enter guest in fastpath for "spurious" preemption timer exits - KVM: x86: Plumb "force_immediate_exit" into kvm_entry() tracepoint - libceph: prevent potential out-of-bounds reads in handle_auth_done() - net: usb: pegasus: fix memory leak in update_eth_regs_async() - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() - !20540 urma: added support for ipoverurma - team: fix check for port enabled in team_queue_override_port_prio_changed() - mm/page_alloc: prevent pcp corruption with SMP=n - !20528 Fix CVE-2025-71083 - KVM: nVMX: Defer SVI update to vmcs01 on EOI when L2 is active w/o VID - KVM: x86: Plumb in the vCPU to kvm_x86_ops.hwapic_isr_update() - KVM: SVM: Set RFLAGS.IF=1 in C code, to get VMRUN out of the STI shadow - smb: client: don't wait for info->send_pending == 0 on error - smb: client: let send_done() cleanup before calling smbd_disconnect_rdma_connection() - ACPI: processor: perflib: Move problematic pr->performance check - ACPI: processor: perflib: Fix initial _PPC limit application - Documentation: ACPI: Fix parent device references - fs: Prevent file descriptor table allocations exceeding INT_MAX - sunvdc: Balance device refcount in vdc_port_mpgroup_check - PCI: Extend isolated function probing to LoongArch - NFSD: detect mismatch of file handle and delegation stateid in OPEN op - net: dpaa: fix device leak when querying time stamp info - net: ti: icss-iep: fix device and OF node leaks at probe - net: mtk_eth_soc: fix device leak at probe - net: enetc: fix device and OF node leak at probe - net: gianfar: fix device leak when querying time stamp info - net: phy: micrel: fix KSZ8081/KSZ8091 cable test - gpio: mlxbf3: use platform_get_irq_optional() - gpio: mlxbf2: use platform_get_irq_optional() - gpio: virtio: Fix config space reading. - ALSA: hda/realtek: Add Framework Laptop 13 (AMD Ryzen AI 300) to quirks - ALSA: hda/realtek: Fix headset mic on HONOR BRB-X - ALSA: usb-audio: Validate UAC3 cluster segment descriptors - rcu: Fix racy re-initialization of irq_work causing hangs - rcu: Fix rcu_read_unlock() deadloop due to IRQ work - drm/tilcdc: Fix removal actions in case of failed probe - drm/tilcdc: request and mapp iomem with devres - urma: fix update topo logic - dmaengine: stm32: dmamux: fix device leak on route allocation - pswiotlb: Adapt to the IOMMU DMA API upgraded by IOMMUFD - null_blk: fix kmemleak by releasing references to fault configfs items - inet: frags: flush pending skbs in fqdir_pre_exit() - inet: frags: add inet_frag_queue_flush() - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() - md/dm-raid: don't clear MD_RECOVERY_FROZEN after setting frozen - md/dm-raid: don't call md_reap_sync_thread() directly - ACPICA: Avoid walking the Namespace if start_node is NULL - arm64: entry: xcall/xint: make asm conditionals compatible with clang IAS - LoongArch: BPF: Sign extend kfunc call arguments - genirq/msi:: Fix kabi break of struct msi_desc - genirq/msi: Store the IOMMU IOVA directly in msi_desc instead of iommu_cookie - NFS: Fix a deadlock involving nfs_release_folio() - Revert "[Huawei] Revert "NFS: fix up nfs_release_folio() to try to release the page"" - urma: added support for ipoverurma - drm/ttm: Avoid NULL pointer deref for evicted BOs - XSched: Update XSched manual - svcrdma: bound check rq_pages index in inline path - ipv6: Fix use-after-free in inet6_addr_del(). - ipv4: ip_gre: make ipgre_header() robust - net: fix memory leak in skb_segment_list for GRO packets - net: sock: fix hardened usercopy panic in sock_recv_errqueue - ipv4: Fix reference count leak when using error routes with nexthop objects - SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf - fbdev: Fix vmalloc out-of-bounds write in fast_imageblit - udp: Deal with race between UDP socket address change and rehash - EDAC/amd64: The width of hash value is 2 bits for Hygon family 18h model 6h processors - x86/tsc: Use topology_max_packages() to get package number - EDAC/amd64: Use unicast instead of broadcast to access the cs_config register - EDAC/amd64: Correct the address translation for hygon family 18h model 4h - KVM: arm64: Mark some header functions as inline - KVM: arm64: Refactor exit handlers - x86/resctrl: Fix memory bandwidth counter width for Hygon CPUs - hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio - !20820 ub/obmm: add sysfs interface for mempool statistics & bugfixes - ub/obmm: fix wrong pxm_numa parameter validation - ub/obmm: Remove unused parameters from obmm_addr_check.c - ub/obmm: Enhance mem_allocator_granu validation - ub/obmm: simplify allocator naming scheme - ub/obmm: fix allow_slow logic and optimize conti_alloc_memory - ub/obmm: add sysfs interface with fine-grained memory statistics - !20804 net: hv_netvsc: reject RSS hash key programming without RX indirection table - !20813 migrate: correct lock ordering for hugetlb file folios - !20812 libceph: make calc_target() set t->paused, not just clear it - !20719 drivers/ub/sentry: some bugfix - !20798 urma: log should not retrieve eid_idx from uctx - !20808 urma: support triple bonding device - urma: log should not retrieve eid_idx from uctx - migrate: correct lock ordering for hugetlb file folios - libceph: make calc_target() set t->paused, not just clear it - !20745 vfio platform VFIO support for hisi05a1 devices - urma: support triple bonding device - net: hv_netvsc: reject RSS hash key programming without RX indirection table - !20789 gic: Add hip09 support for HISILICON_ERRATUM_165010801 - !20726 tracing: Add recursion protection in kernel stack trace recording - !20668 irqchip/gic-v3-its: Avoid truncating memory addresses - !20795 ub: udma: support query and set qos info. - !20791 Migration/urma:optimize performance in live migration. - ub: udma: Support for UE link establishment message. - Migration/urma: optimize performance in live migration. - !20787 ub: cdma: modify the method of assigning values to the structure - !20759 ubcore: hotfix route query for port eid on the same node. - ub: udma: support query and set qos info. - Revert "ub: ubase: Support for RC saved by queue granularity" - ubcore: hotfix route query for port eid on the same node. - !20676 urma: set/get sl - !20765 urma: bugfix of UAF and double free in ubcm - !20778 ub: ubase&unic: Fixes some bugfix in resetting and dfx ability - gic: Add hip09 support for HISILICON_ERRATUM_165010801 - vfio/platform: Add CONFIG_VFIO_HISI05A1 to openeuler_defconfig and turn it on by default - vfio/platform: VFIO support for hisi05a1 devices - ub: cdma: modify the method of assigning values to the structure - urma: set/get sl - ub: ubase: support to query ub dl pkt stats and real-time peak bandwidth - ub: ubase: Support for RC saved by queue granularity - ub: ubase: Traverse mailbox AE events using interrupts and polling. - ub: ubase: Modify ubase ctrlq trace to distinguish between MUE and UE messages - net: unic: The function of dumping himac registers is added. - ub: ubase: Fix MAC is_pfc sync, optimize list ops and code style - ub: ubase: Retain the initial tm qset configuration and restore it - net: unic: Fixed an issue in the bond IP address notification and pause configuration when an exception occurs. - ub: ubase: Add a retransmission function to improve reliability. - net: unic: Increase the readability and reliability of loopback code - net: unic: Synchronize the code modify for ip management and deactivation - net: unic: Increase the readability and reliability of VLAN feature. - net: unic: Added unic DFX log information. - ub: ubase: Add and correct comments for some functions and data structures - net: unic: Notify MAMI when the bond port status changes - ub: ubase: Support for HIMAC reset during ELR reset and Optimize ELR reset - !20768 iommu/ummu-core: Fix separate page table compatibility - !20665 [OLK-6.6] Enhance CMA memory usage reporting for CSV3 - !20764 net: hns3: fix double free issue for tx spare buffer - urma: bugfix of UAF and double free in ubcm - iommu/ummu-core: Fix separate page table compatibility - net: hns3: fix double free issue for tx spare buffer - drivers/ub/sentry: fix memory leak in sentry_msg_helper - drivers/ub/sentry: initialize some variables - drivers/ub/sentry: fix potential buffer overflow in convert_str_to_smh_msg() - drivers/ub/sentry: fix potential null pointer reference in sentry_uvb_comm - drivers/ub/sentry: add input parameter verification for exported symbols - tracing: Add recursion protection in kernel stack trace recording - x86/csv: Enhance CMA memory usage reporting for CSV3 - irqchip/gic-v3-its: Avoid truncating memory addresses - change the package name of 64KB page size kernel to kernel-64k - !20704 kernel support hisi-cca-da - !20180 [virtCCA Live Migration 2]virtcca secure cvm supports live migration - !20905 v2 KVM: arm64: Fix softirq masking in FPSIMD register saving sequence - !20965 iommu/ummu: Optimized TID invalidation and tdev initialization - !20964 iommu/ummu: Support TID and EID Granularity for MPAM - !20970 ub: ubase&unic: Supporting the black box capability of the ubase&unic driver - hisi-cca-da: Start dev by rsi call - hisi-cca-da: Set ripas of the bar region as RIPAS_DEV - hisi-cca-da: Support swiotlb and realm memory use - hisi-cca-da: Add smmu info when dev attach - hisi-cca-da: Transfer realm msix access to rmm - hisi-cca-da: Support pcipc sriov capability - hisi-cca-da: Delay realm memory release to kvm_destroy_realm - hisi-cca-da: Create realm s2 host pgtable and map msi mmio to rmm - hisi-cca-da: Add cca realm s2 pgtable framework - hisi-cca-da: Use bitmap to determine whether the command can be forwarded - hisi-cca-da: Restrict Realm SMMU to stage-2 domain only - hisi-cca-da: Add cmd forward mechanism in realm smmu - hisi-cca-da: Add realm smmu event and gerror irq initialization - hisi-cca-da: Add realm smmu stream table initialization - hisi-cca-da: Add realm smmu cmdq and evtq initialization - hisi-cca-da: Add realm smmu initialization - hisi-cca-da: Add relam iommu support to iommufd - hisi-cca-da: Add realm iommu support for vfio-iommu-type1 - hisi-cca-da: Support dev map and unmap - hisi-cca-da: Support dev validate and dev start - hisi-cca-da: VFIO support ccada - hisi-cca-da: Support dev delegate and dev attach - hisi-cca-da: Support root dev delegate and dev init - hisi-cca-da: Add hisilicon extension smc and ccada cmd - hisi-cca-da: Add hisi ccada feature config - !20751 ARM CCA supports hugepage - !20944 ub: ubmempfd: supports for D2H mapping and demapping - !20888 HiSock Enhancement - ub: ubase&unic: Supporting the black box capability of the ubase&unic driver. - net: unic: Resolve the residual MAC address problem - net: unic: Optimized the code for the cmd structure and FEC function. - ub: ubase: add log for post mailbox timeout - ub: ubus: Remove black box header file to include dir - rme: Remove the secret bit of the vring desc addr - rme: improve hisi-cca data mmap and destroy method - !20943 uvb: fix wd_obtain logic err - !20942 urma: fix bond device id not release - !20892 dcache: Limit the minimal number of bucket to two - rme: isolate page when do delegation to avoid migration - rme: hisi-cca supports different levels for mapping ram - rme: rename ccal to hisi-cca - rme: support set ripas for ccal realm vm - rme: support destroy ram data for ccal realm vm - rme: support populate region for ccal realm vm - rme: support map ram for ccal realm vm - rme: support config ccal realm vm - rme: support ccal RMI calls - rme: realm vm supports wfx handler - !20952 urma: introduce ipourma module - iommu/ummu-core: Simplifies tdev initialization resources - iommu/ummu: Optimized log printing - iommu/ummu: Use passed gfp_mask in map_pages callback - uvb: fix wd_obtain logic err - !20949 ub: udma: support user ctl function. - urma: fix bond device id not release - !20901 drivers/ub/sentry: some bugfix - ub: ubmempfd: supports for D2H mapping and demapping - ub: ubmempfd: supports providing services to the QEMU process through file nodes - [virtCCA Live Migration 2]virtcca secure cvm supports live migration - urma: query priority and enable bit, support ring size configuration - urma: implement debugfs, improve boundary checks and error handling logic - urma: implement data plane interaction and statistics - urma: implement ipourma network device operations - urma: ipourma resource management - urma: ipourma resource management and err code - urma: introduce ipourma main module - iommu/ummu: Optimized the TID invalidation configuration - iommu/ummu: Optimized SVA permission table memory allocation approach - iommu/ummu: Adapt UMMU SVA interface adjustment - iommu/ummu: Support TID and EID Granularity for MPAM - !20848 [OLK-6.6] backport important bugfix for nvme driver from upstream linux-6.6.y - !20847 urma: sl resource query error - !20908 [OLK-6.6][linux-6.6.y sync] Backport 6.6.108-6.6.110 LTS Patches - !20084 Loongarch: Enable CONFIG_CRYPTO_XTS for disk encryption - !20929 PCI: Fix NVMe link speed downgrade to 2.5GT/s during hotplug - drivers/ub/sentry: fix check input parameters - ub: udma: support user ctl function. - ub: udma: support uboe function. - ub: udma: bugfix related to query aux info. - !20935 ub: ubmem_vmmu: supports IOMMU driver for the UB memory MMU in VMs - drivers/ub/sentry: do not use magic numbers - !20876 urma: Kernel-mode specific implementations file for Jetty extension interface - urma: sl resource query error - !20873 sunrpc: fix NULL pointer dereference in rpcb_register_inet6 and rpcb_register_inet4 - !20875 sunrpc: fix race in cache cleanup causing stale nextcheck time - ub: ubmem_vmmu: supports IOMMU driver for the UB memory MMU in VMs - ub: ubmem_vmmu: supports parsing and configuring the hardware node information - ub: ubmem_vmmu: HiSilicon ubmem_vmmu Architecture Implementation - !20806 Fix CVE-2025-71225 - !20896 scsi: qla2xxx: Free sp in error path to fix system crash - !20894 scsi: qla2xxx: Delay module unload while fabric scan in progress - !20893 scsi: qla2xxx: Validate sp before freeing associated memory - !20802 Fix CVE-2026-23110 - urma: Kernel-mode specific implementations file for Jetty extension interface - drivers/ub/sentry: fix memory leak in process_urma_data() - drivers/ub/sentry: initialize some variables - PCI: Fix NVMe link speed downgrade to 2.5GT/s during hotplug - !20770 ub: ubdevshm: supports the memory user to obtain and release shared memory - Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 - mm: consider non-anon swap cache folios in folio_expected_ref_count() - mm: simplify folio_expected_ref_count() - ASoC: qcom: audioreach: fix potential null pointer dereference - gcc-plugins: Remove TODO_verify_il for GCC >= 16 - crypto: sha256 - fix crash at kexec - drm/i915/backlight: Return immediately when scale() finds invalid parameters - minmax.h: remove some #defines that are only expanded once - minmax.h: simplify the variants of clamp() - minmax.h: move all the clamp() definitions after the min/max() ones - minmax.h: use BUILD_BUG_ON_MSG() for the lo < hi test in clamp() - minmax.h: reduce the #define expansion of min(), max() and clamp() - minmax.h: update some comments - minmax.h: add whitespace around operators and after commas - minmax: fix up min3() and max3() too - minmax: improve macro expansion and type checking - minmax: don't use max() in situations that want a C constant expression - minmax: simplify min()/max()/clamp() implementation - minmax: make generic MIN() and MAX() macros available everywhere - drm/ast: Use msleep instead of mdelay for edid read - gpiolib: Extend software-node support to support secondary software-nodes - ARM: bcm: Select ARM_GIC_V3 for ARCH_BRCMSTB - s390/cpum_cf: Fix uninitialized warning after backport of ce971233242b - kmsan: fix out-of-bounds access to shadow memory - afs: Fix potential null pointer dereference in afs_put_server - ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address - i40e: improve VF MAC filters accounting - i40e: add mask to apply valid bits for itr_idx - HID: asus: add support for missing PX series fn keys - drm/gma500: Fix null dereference in hdmi teardown - octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() - net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port - net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() - net: dsa: lantiq_gswip: do also enable or disable cpu port - selftests: fib_nexthops: Fix creation of non-FDB nexthops - net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS - bnxt_en: correct offset handling for IPv6 destination address - vhost: Take a reference on the task in struct vhost_task. - Bluetooth: hci_sync: Fix hci_resume_advertising_sync - ethernet: rvu-af: Remove slash from the driver name - can: peak_usb: fix shift-out-of-bounds issue - can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow - can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow - can: hi311x: populate ndo_change_mtu() to prevent buffer overflow - can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow - bpf: Reject bpf_timer for PREEMPT_RT - can: rcar_can: rcar_can_resume(): fix s2ram with PSCI - wifi: virt_wifi: Fix page fault on connect - cpufreq: Initialize cpufreq-based invariance before subsys - ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients - arm64: dts: imx8mp: Correct thermal sensor index - mm: folio_may_be_lru_cached() unless folio_test_large() - mm/gup: local lru_add_drain() to avoid lru_add_drain_all() - mm/gup: check ref_count instead of lru before migration - mm: add folio_expected_ref_count() for reference count calculation - mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked" - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions - ALSA: usb-audio: Add mute TLV for playback volumes on more devices - ALSA: usb-audio: move mixer_quirks' min_mute into common quirk - ALSA: usb-audio: Add DSD support for Comtrue USB Audio device - i2c: designware: Add quirk for Intel Xe - mmc: sdhci-cadence: add Mobileye eyeQ support - usb: core: Add 0x prefix to quirks debug output - ALSA: usb-audio: Fix build with CONFIG_INPUT=n - ALSA: usb-audio: Convert comma to semicolon - ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 - ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks - ALSA: usb-audio: Simplify NULL comparison in mixer_quirks - ALSA: usb-audio: Avoid multiple assignments in mixer_quirks - ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks - ALSA: usb-audio: Fix block comments in mixer_quirks - firewire: core: fix overlooked update of subsystem ABI version - scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE - !20843 [OLK-6.6][linux-6.6.y sync] Backport 6.6.107-6.6.108 LTS Patches - !20869 ub:hisi-ubus: fix bug of security smatch - !20861 CVE-2026-23163 - ub: ubdevshm: supports the memory user to obtain and release shared memory - ub: ubdevshm: supports granting and revoking shared memory permissions - ub: ubdevshm: supports the registration and deregistration of shared memory segments - ub: ubdevshm: supports the registration and deregistration - KVM: arm64: Fix softirq masking in FPSIMD register saving sequence - !20886 Fix CVE-2026-23205 - !20803 Fix CVE-2026-23112 - !20868 sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure - !20811 smb/server: fix refcount leak in smb2_open() - !20810 smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() - !20809 smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() - sunrpc: fix NULL pointer dereference in rpcb_register_inet6 and rpcb_register_inet4 - sunrpc: fix race in cache cleanup causing stale nextcheck time - scsi: qla2xxx: Free sp in error path to fix system crash - scsi: qla2xxx: Delay module unload while fabric scan in progress - scsi: qla2xxx: Validate sp before freeing associated memory - dcache: Limit the minimal number of bucket to two - !20872 Fix CVE-2026-23220 - !20846 Fix CVE-2026-23193 - !20815 Fix CVE-2026-23216 - !20859 Fix CVE-2026-23179 - !20871 CVE-2026-23096 - !20858 ub: ubase: resolve the cmdq crq overflow problem - bpf: Deprecate hisock unused kfuncs and orig ingress logic - bpf: Add local connect support for hisock - bpf: Add ipv4-mapped ipv6 addr support for hisock - bpf: Add target comm parse to hisock_cmd - bpf: Add multi port parse to hisock_cmd - bpf: Only deploy hisock in server - bpf: Apply BPF_HISOCK_INGRESS to hisock ingress - bpf: Add bpf_handle_ingress/egress_ptype kfunc - bpf: Add bpf_get_skb_ethhdr kfunc - bpf: Add bpf_set_ingress/egress_dev kfunc - bpf: Add bpf_set_ingress_dst kfunc - bpf: Add BPF_HISOCK_INGRESS attach type - cgroup: make cgroup_bpf_prog_attach work when cgroup2 is not mounted - smb: client: fix potential UAF and double free in smb2_open_file() - smb/client: fix memory leak in smb2_open_file() - !20852 ASoC: amd: fix memory leak in acp3x pdm dma ops - ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths - uacce: fix cdev handling in the cleanup path - Revert "uacce: fix for cdev memory leak" - ub:hisi-ubus: fix bug of security smatch - ub:ubus: injected route event - ub:ubus: Black Box Development - !20865 urma: urma support uboe - sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure - urma: urma support uboe - !20857 ub_fwctl driver adds support for querying some functions - ub:ub_fwctl:Add illegal verification for scc - ub:ub_fwctl:Support querying the historical status of port links - drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove - drm/amdkfd: Don't use sw fault filter if retry cam enabled - ub:ub_fwctl:Support querying firmware version numbers - ub: ub_fwctl: Support querying real-time bandwidth statistics - ub:ub_fwctl:Support querying statistical indicators at the ub port and uboe port levels - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() - !20854 [URMA] add ping server for urma_ping - urma: add ping server - ub: ubase: resolve the cmdq crq overflow problem - ub: ubase: Optimized the QoS code naming to improve code readability. - ub: ubase&unic: optimizing code and configuration settings. - net: unic: not support query and configure ip by control plane in UBoE - net: unic: fix the automatically enable uc guid promisc mode. - !20844 urma:kernel header of userctl - urma: Kernel-mode header file for Jetty extension interface - ASoC: amd: fix memory leak in acp3x pdm dma ops - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() - phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again) - ACPICA: Work around bogus -Wstringop-overread warning since GCC 11 - !20835 Fix CVE-2026-23084 - minmax: add a few more MIN_T/MAX_T users - minmax: simplify and clarify min_t()/max_t() implementation - minmax: avoid overly complicated constant expressions in VM code - rtc: pcf2127: fix SPI command byte for PCF2131 backport - xhci: dbc: Fix full DbC transfer ring after several reconnects - xhci: dbc: decouple endpoint allocation from initialization - phy: ti: omap-usb2: fix device leak at unbind - phy: Use device_get_match_data() - drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path - ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message - ASoC: wm8974: Correct PLL rate rounding - ASoC: wm8940: Correct typo in control name - ASoC: wm8940: Correct PLL rate rounding - io_uring: include dying ring in task_work "should cancel" state - io_uring: backport io_should_terminate_tw() - ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx - selftests: mptcp: avoid spurious errors on TCP disconnect - selftests: mptcp: connect: catch IO errors on listen side - rds: ib: Increment i_fastreg_wrs before bailing out - KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active - mmc: mvsdio: Fix dma_unmap_sg() nents value - ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S - ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface - btrfs: tree-checker: fix the incorrect inode ref size check - iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page() - LoongArch: Check the return value when creating kobj - LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled - LoongArch: Update help info of ARCH_STRICT_ALIGN - nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* - octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() - net: liquidio: fix overflow in octeon_init_instr_queue() - bonding: don't set oif to bond dev when getting NS target destination - net/mlx5e: Consider aggregated port speed during rate configuration - i40e: remove redundant memory barrier when cleaning Tx descs - net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure - selftests: mptcp: sockopt: fix error messages - mptcp: tfo: record 'deny join id0' info - mptcp: set remote_deny_join_id0 on SYN recv - dpaa2-switch: fix buffer pool seeding for control traffic - btrfs: fix invalid extref key setup when replaying dentry - pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch - wifi: mac80211: fix incorrect type for ret - wifi: mac80211: increase scan_ies_len for S1G - ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported - !20769 [OLK-6.6][linux-6.6.y sync] Backport 6.6.106-6.6.107 LTS Patches - be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list - !20776 ub:ubfi: Release the chosen node - !20817 CVE-2026-23094 - !20819 dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() - ub:ubus: Add port num check - !20379 [OLK-6.6][sync from OLK-5.10]io_uring: Support forcing sq thread to be idle and woken up by hrtimer - !20830 sched/soft_domain: Increasing NR_MAX_CLUSTER to 32 - sched/soft_domain: Increasing NR_MAX_CLUSTER to 32 - btrfs: fix incorrect readahead expansion length - x86: disable image size check for test builds - drm/i915/power: fix size for for_each_set_bit() in abox iteration - drm/amdgpu: fix a memory leak in fence cleanup when unloading - net: mdiobus: release reset_gpio in mdiobus_unregister_device() - phy: ti-pipe3: fix device leak at unbind - phy: tegra: xusb: fix device and OF node leak at probe - dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate - usb: gadget: midi2: Fix MIDI2 IN EP max packet size - usb: gadget: midi2: Fix missing UMP group attributes initialization - USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels - RISC-V: Remove unnecessary include from compat.h - hrtimer: Rename __hrtimer_hres_active() to hrtimer_hres_active() - hrtimer: Remove unused function - regulator: sy7636a: fix lifecycle of power good gpio - dmaengine: ti: edma: Fix memory allocation size for queue_priority_map - hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr - hsr: use rtnl lock when iterating over ports - net: hsr: Add VLAN CTAG filter support - net: hsr: Add support for MC filtering at the slave device - can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB - can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails - can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed - igb: fix link test skipping when interface is admin down - docs: networking: can: change bcm_msg_head frames member to support flexible array - tunnels: reset the GSO metadata before reusing the skb - net: bridge: Bounce invalid boolopts - net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() - USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions - USB: serial: option: add Telit Cinterion FN990A w/audio compositions - dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks - serial: sc16is7xx: fix bug in flow control levels init - tty: hvc_console: Call hvc_kick in hvc_write unconditionally - Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups" - Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table - Input: iqs7222 - avoid enabling unused interrupts - mm/khugepaged: fix the address passed to notifier on testing young - btrfs: fix corruption reading compressed range when block size is smaller than page size - btrfs: use readahead_expand() on compressed extents - mm/damon/sysfs: fix use-after-free in state_show() - mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing - mtd: nand: raw: atmel: Fix comment in timings preparation - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages - drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time - mm/damon/core: set quota->charged_from to jiffies at first charge window - fuse: prevent overflow in copy_file_range return value - fuse: check if copy_file_range() returns larger than requested size - mtd: rawnand: stm32_fmc2: fix ECC overwrite - mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer - net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups - i2c: i801: Hide Intel Birch Stream SoC TCO WDT - ocfs2: fix recursive semaphore deadlock in fiemap call - mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN - compiler-clang.h: define __SANITIZE_*__ macros only when undefined - EDAC/altera: Delete an inappropriate dma_free_coherent() call - rcu-tasks: Maintain real-time response in rcu_tasks_postscan() - rcu-tasks: Eliminate deadlocks involving do_exit() and RCU tasks - rcu-tasks: Maintain lists to eliminate RCU-tasks/do_exit() deadlocks - s390/cpum_cf: Deny all sampling events by counter PMU - NFSv4/flexfiles: Fix layout merge mirror check. - NFSv4.2: Serialise O_DIRECT i/o and copy range - NFSv4.2: Serialise O_DIRECT i/o and clone range - NFSv4.2: Serialise O_DIRECT i/o and fallocate() - NFS: Serialise O_DIRECT i/o and truncate() - fs/nfs/io: make nfs_start_io_*() killable - ftrace/samples: Fix function size computation - NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server - NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set - media: i2c: imx214: Fix link frequency validation - NFSD: nfsd_unlink() clobbers non-zero status returned from fh_fill_pre_attrs() - nfsd: Fix a regression in nfsd_setattr() - kasan: fix GCC mem-intrinsic prefix with sw tags - kunit: kasan_test: disable fortify string checker on kasan_strings() test - io_uring: fix kabi broken in struct io_ring_ctx - io_uring: Support forcing sq thread to be idle and woken up by hrtimer - dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() - uacce: fix isolate sysfs check condition - Revert "uacce: fix isolate sysfs check condition" - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() - smb/server: fix refcount leak in smb2_open() - smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() - smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() - md: suspend array while updating raid_disks via sysfs - scsi: core: Wake up the error handler when final completions race against each other - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec - ub:ubfi: Release the chosen node - ub:ubus: Delete unused functions - Loongarch: Enable CONFIG_CRYPTO_XTS for disk encryption - Add sw64 support in kernel.spec - !21194 hisi-cca-da: Revert smmu realm enabled condition for arm_smmu_domain_finalise. - !21192 urma: bugfix of ubagg&ubcore&uburma - !21183 platform/x86: classmate-laptop: Add missing NULL pointer checks - urma: bugfix of ubagg&ubcore&uburma - hisi-cca-da: Revert smmu realm enabled condition for arm_smmu_domain_finalise. - platform/x86: classmate-laptop: Add missing NULL pointer checks - !21167 urma: fix kernel codecheck issues. - !21174 urma: change return value for provider err - !21127 urma: copy linked ports when importing bond jetty/seg - !20247 ubcore: query primary eid in ipourma loopback mode. - !21077 Fix hisi cca bugs - ubcore: route query refine and ipo loopback adapt. - hisi-cca-da: Transfer PCIe ECAM access requests to RMM for realm device. - hisi-cca-da: Write NS STE for PF drivers. - hisi-cca-da: Provide IO interfaces - hisi-cca-da: Destroy mmu stage2 pagetable after closing vfio devices - !21045 scsi: hisi_sas: Fix NULL pointer exception when do user_scan() - hisi-cca-da: Automatically unbind PF/VF drivers and prevent probe. - !21165 tools/interference: add ifstool utility for kernel interference statistics - !21166 urma: fix jfce uaf in batch cleanup - !21043 urma: fix tjetty ref in ping server - urma: change return value for provider err - !21128 sched/rt: Skip currently executing CPU in rto_next_cpu() - !21129 procfs: fix missing RCU protection when reading real_parent in do_task_stat() - urma: fix jfce uaf in batch cleanup - !21074 ipmi: Add HiSilicon IPMI Page Soft Offline driver - !21076 [OLK-6.6][linux-6.6.y sync] Backport 6.6.112-6.6.113 LTS Patches - urma: fix kernel codecheck issues. - tools/interference: add ifstool utility for kernel interference statistics - !20291 [Hygon][6.6][Bugfix] Bug fix for EDAC decode address fail issue on Hygon Dhyana processor - !21092 kexec: derive purgatory entry from symbol - !21154 sched: Add SOFT_DOMAIN feature interface for cgroup2 - !21153 fix CVE-2025-39981 - Revert "hisi-cca-da: Delay realm memory release to kvm_destroy_realm" - urma: fix tjetty ref in ping server - rme: Enforce isolation to solve compile error without config CONFIG_HISI_CCA - hisi-cca-da: Improve hisi cca dev validate and delegate - hisi-cca-da: Fix smmu enable rme problem - hisi-cca-da: Fix msi region shared problem - sched: Add SOFT_DOMAIN feature interface for cgroup2 - Bluetooth: MGMT: Fix memory leak in set_ssp_complete - Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete - overflow: Introduce __DEFINE_FLEX for having no initializer - overflow: Fix direct struct member initialization in _DEFINE_FLEX() - overflow: Change DEFINE_FLEX to take __counted_by member - overflow: add DEFINE_FLEX() for on-stack allocs - Bluetooth: MGMT: Fix possible UAFs - Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete() - !21103 Revert "mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()" - !21104 v2 vsock/virtio: cap TX credit to local buffer size - !21070 Fixes CVE-2026-23100 - !21135 RDMA/hns: Support configure and query the CNP DSCP through sysfs - !21088 ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref - RDMA/hns: Support configure and query the CNP DSCP through sysfs - RDMA/hns: Support query FW cap bit - RDMA/hns: Support query HW ID. - !20934 smb/server: fix refcount leak in parse_durable_handle_context() - !21004 regmap: Fix race condition in hwspinlock irqsave routine - !19568 [OLK-6.6]fix txgbe clang compile warning - urma: copy linked ports when importing bond jetty/seg - procfs: fix missing RCU protection when reading real_parent in do_task_stat() - sched/rt: Skip currently executing CPU in rto_next_cpu() - !21073 scsi: qla2xxx: Fix bsg_done() causing double free - !21114 CVE-2024-57979 - !21113 iommu: disable SVA when CONFIG_X86 is set - !20957 dmaengine: xilinx: xdma: Fix regmap max_register - !21087 net: unic: Multiple stability fixes for tx timeout, DFX capability and concurrent activation/reset - pps: Fix a use-after-free - fix kabi - pps: Fix a use-after-free - !21078 of: unittest: Fix memory leak in unittest_data_add() - !21079 *** fix CVE-2026-23208 *** - !21082 ALSA: aloop: Fix racy access at PCM trigger - !21083 bus: fsl-mc: fix use-after-free in driver_override_show() - iommu: disable SVA when CONFIG_X86 is set - vsock/virtio: cap TX credit to local buffer size - Revert "mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()" - !20983 Fix CVE-2026-23139 - !20878 Fix CVE-2026-23230 - kexec: derive purgatory entry from symbol - lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC - PCI/IOV: Fix race between SR-IOV enable/disable and hotplug - Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" - rtc: interface: Alarm race handling should not discard preceding error - perf test stat tests: Fix for virtualized machines - perf test stat: Update test expectations and events - perf test stat: Avoid hybrid assumption when virtualized - writeback: Avoid excessively long inode switching times - writeback: Avoid softlockup when switching many inodes - cramfs: Verify inode mode when loading from disk - fs: Add 'initramfs_options' to set initramfs mount options - minixfs: Verify inode mode when loading from disk - irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume - irqchip/sifive-plic: Make use of __assign_bit() - selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled - s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG - s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL - s390/bpf: Describe the frame using a struct instead of constants - s390/bpf: Centralize frame offset calculations - s390/bpf: Change seen_reg to a mask - ACPI: property: Do not pass NULL handles to acpi_attach_data() - ACPI: property: Add code comments explaining what is going on - ACPI: property: Disregard references in data-only subnode lists - ACPI: battery: Add synchronization between interface updates - ACPI: battery: Check for error code from devm_mutex_init() call - ACPI: battery: initialize mutexes through devm_ APIs - ACPI: battery: allocate driver data through devm_ APIs - arm64: mte: Do not flag the zero page as PG_mte_tagged - ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref - !20790 dm: use bio_clone_blkg_association - ipmi: Add HiSilicon IPMI Page Soft Offline driver - net: unic: Resolve network unavailability caused by concurrent activation and reset - net: unic: Provide the DFX capability for querying MNG table - net: unic: Delete the elr reset process after the tx timeout - bus: fsl-mc: fix use-after-free in driver_override_show() - ALSA: aloop: Fix racy access at PCM trigger - ALSA: usb-audio: Use the right limit for PCM OOB check - ALSA: usb-audio: Prevent excessive number of frames - of: unittest: Fix memory leak in unittest_data_add() - !21034 CVE-2026-23140 - !21016 net: fix segmentation of forwarding fraglist GRO - !21017 mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() - !21018 CVE-2026-23209 - !21019 ipv6: annotate data-race in ndisc_router_discovery() - !20881 ipvlan: Make the addrs_lock be per port - rme: Imporve range delegate - btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() - PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release - PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() - misc: fastrpc: Save actual DMA size in fastrpc_map structure - misc: fastrpc: Add missing dev_err newlines - mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag - mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type - mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value - media: mc: Clear minor number before put device - lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older - ACPICA: Allow to skip Global Lock initialization - ext4: validate ea_ino and size in check_xattrs - ext4: correctly handle queries for metadata mappings - ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() - nfsd: nfserr_jukebox in nlm_fopen should lead to a retry - NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() - mm/damon/vaddr: do not repeat pte_offset_map_lock() until success - mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 - mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations - wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 - wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again - selftests: mptcp: join: validate C-flag + def limit - spi: cadence-quadspi: Flush posted register writes before DAC access - spi: cadence-quadspi: Flush posted register writes before INDAC access - PCI: tegra194: Handle errors in BPMP response - PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() - PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock - PCI: rcar-host: Drop PMSR spinlock - PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit - PCI/AER: Support errors introduced by PCIe r6.0 - PCI/AER: Fix missing uevent on recovery when a reset is requested - PCI/ERR: Fix uevent on failure to recover - PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV - PCI/sysfs: Ensure devices are powered for config reads - PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock - rseq/selftests: Use weak symbol reference, not definition, to link with glibc - rtc: interface: Fix long-standing race when setting alarm - rtc: interface: Ensure alarm irq is enabled when UIE is enabled - memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe - mmc: core: SPI mode remove cmd7 - mtd: rawnand: fsmc: Default to autodetect buswidth - xtensa: simdisk: add input size check in proc_write_simdisk - sparc: fix error handling in scan_one_device() - sparc64: fix hugetlb for sun4u - scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() - sched/deadline: Fix race in push_dl_task() - pwm: berlin: Fix wrong register in suspend/resume - powerpc/pseries/msi: Fix potential underflow and leak issue - powerpc/powernv/pci: Fix underflow and leak issue - power: supply: max77976_charger: fix constant current reporting - pinctrl: samsung: Drop unused S3C24xx driver data - nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk - parisc: don't reference obsolete termio struct for TC* constants - openat2: don't trigger automounts with RESOLVE_NO_XDEV - of: unittest: Fix device reference count leak in of_unittest_pci_node_verify - lib/genalloc: fix device leak in of_gen_pool_get() - KEYS: trusted_tpm1: Compare HMAC values in constant time - iommu/vt-d: PRS isn't usable if PDS isn't supported - iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume - init: handle bootloader identifier in kernel parameters - iio: xilinx-ams: Unmask interrupts after updating alarms - iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK - iio: frequency: adf4350: Fix prescaler usage. - iio: dac: ad5421: use int type to store negative error codes - iio: dac: ad5360: use int type to store negative error codes - fs/ntfs3: Fix a resource leak bug in wnd_extend() - fbdev: Fix logic error in "offb" name match - crypto: rockchip - Fix dma_unmap_sg() nents value - crypto: atmel - Fix dma_unmap_sg() direction - crypto: aspeed - Fix dma_unmap_sg() direction - copy_sighand: Handle architectures where sizeof(unsigned long) < sizeof(u64) - bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() - bus: mhi: ep: Fix chained transfer handling in read path - btrfs: avoid potential out-of-bounds in btrfs_encode_fh() - blk-crypto: fix missing blktrace bio split events - drm/nouveau: fix bad ret code in nouveau_bo_move_prep - drm/rcar-du: dsi: Fix 1/2/3 lane support - media: lirc: Fix error handling in lirc_register() - media: venus: firmware: Use correct reset sequence for IRIS2 - media: pci: ivtv: Add missing check after DMA map - media: mc: Fix MUST_CONNECT handling for pads with no links - media: i2c: mt9v111: fix incorrect type for ret - media: cx18: Add missing check after DMA map - firmware: meson_sm: fix device leak at probe - xen/events: Update virq_to_irq on migration - xen/events: Return -EEXIST for bound VIRQs - xen/manage: Fix suspend error path - xen/events: Cleanup find_virq() return codes - dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required - ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init - arm64: dts: ti: k3-am62a-main: Fix main padcfg length - arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees - arm64: dts: qcom: msm8939: Add missing MDSS reset - arm64: dts: qcom: msm8916: Add missing MDSS reset - ACPI: debug: fix signedness issues in read/write helpers - ACPI: property: Fix buffer properties extraction for subnodes - gpio: wcd934x: mark the GPIO controller as sleeping - tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single - smb: client: fix missing timestamp updates after utime(2) - bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() - drm/amd/display: Properly disable scaling on DCE6 - drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 - drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs - drm/amdgpu: Add additional DCE6 SCL registers - mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes - mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call - tcp: take care of zero tp->window_clamp in tcp_set_rcvlowat() - perf python: split Clang options when invoking Popen - tools build: Align warning options with perf - net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe - drm/vmwgfx: Fix copy-paste typo in validation - net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() - LoongArch: Init acpi_gbl_use_global_lock to false - LoongArch: Remove CONFIG_ACPI_TABLE_UPGRADE in platform_init() - ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size - scsi: mvsas: Fix use-after-free bugs in mvs_work_queue - clk: tegra: do not overallocate memory for bpmp clocks - clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver - clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() - clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() - clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m - perf evsel: Ensure the fallback message is always written to - perf tools: Add fallback for exclude_guest - perf test: Add a test for default perf stat command - perf test: Don't leak workload gopipe in PERF_RECORD_* - perf session: Fix handling when buffer exceeds 2 GiB - perf arm_spe: Correct memory level for remote access - perf arm_spe: Correct setting remote access - rtc: optee: fix memory leak on driver removal - rtc: x1205: Fix Xicor X1205 vendor prefix - perf util: Fix compression checks returning -1 as bool - clk: at91: peripheral: fix return value - libperf event: Ensure tracing data is multiple of 8 sized - perf evsel: Avoid container_of on a NULL leader - asm-generic/io.h: Skip trace helpers if rwmmio events are disabled - iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE - clocksource/drivers/clps711x: Fix resource leaks in error paths - fscontext: do not consume log entries when returning -EMSGSIZE - fs: always return zero on success from replace_fd() - !21067 [OLK-6.6][linux-6.6.y sync] Backport 6.6.111-6.6.112 LTS Patches - scsi: qla2xxx: Fix bsg_done() causing double free - !21065 Fix CVE-2026-23069 - !21062 v4 Support multi-level cgroup - !20987 Fix CVE-2026-23212 - !20982 Fix CVE-2026-23119 - !20979 Fix CVE-2026-23111 - !20974 Fix CVE-2026-23099 - !20973 Fix CVE-2026-23105 - !20972 Fix CVE-2026-23074 - !20884 ksmbd: add chann_lock to protect ksmbd_chann_list xarray - !20947 Fix CVE-2026-23101 - ext4: clear i_state_flags when alloc inode - misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup - Revert "wifi: ath10k: avoid unnecessary wait for service ready message" - fs/ntfs3: fix mount failure for sparse runs in run_unpack() - !20825 efivarfs: fix error propagation in efivar_entry_get() - !20824 io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop - !20950 ub:ubus: protect iterator ue_list and mue_list with ub_bus_sem - mm/rmap: fix two comments related to huge_pmd_unshare() - mm/hugetlb: fix two comments related to huge_pmd_unshare() - mm/hugetlb: fix hugetlb_pmd_shared() - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count - !20728 drivers: Update vendor name of Chengdu NorthLink Technology N5/N6 Series Network Card Drivers - vsock/virtio: fix potential underflow in virtio_transport_get_credit() - !21001 Fix CVE-2026-23229 - usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call - arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode - !20999 Fix CVE-2026-23173 - usb: typec: tipd: Clear interrupts first - bus: fsl-mc: Check return value of platform_get_resource() - remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() - Input: atmel_mxt_ts - allow reset GPIO to sleep - misc: fastrpc: Skip reference for DMA handles - misc: fastrpc: fix possible map leak in fastrpc_put_args - misc: fastrpc: Fix fastrpc_map_lookup operation - nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() - ext4: fix checks for orphan inodes - ksmbd: fix error code overwriting in smb2_get_info_filesystem() - LoongArch: Automatically disable kaslr if boot from kexec_file - mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() - mfd: rz-mtu3: Fix MTU5 NFCR register offset - ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down - ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() - vhost: vringh: Modify the return value check - net/mlx5: fw reset, add reset timeout work - net/mlx5: pagealloc: Fix reclaim race during command interface teardown - net/mlx5: Stop polling for command response if interface goes down - net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable - nfp: fix RSS hash key size when RSS is not supported - mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands - drivers/base/node: fix double free in register_one_node() - hwrng: ks-sa - fix division by zero in ks_sa_rng_init - KEYS: X.509: Fix Basic Constraints CA flag parsing - Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements - Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO - vhost: vringh: Fix copy_to_iter return value check - RDMA/siw: Always report immediate post SQ errors - usb: vhci-hcd: Prevent suspending virtually attached devices - NFSv4.1: fix backchannel max_resp_sz verification check - coresight: trbe: Return NULL pointer for allocation failures - coresight: etm4x: Support atclk - coresight-etm4x: Conditionally access register TRCEXTINSELR - remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice - PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() - vfio/pds: replace bitmap_free with vfree - sparc: fix accurate exception reporting in copy_{from,to}_user for M7 - sparc: fix accurate exception reporting in copy_to_user for Niagara 4 - sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara - sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III - wifi: mac80211: fix Rx packet handling when pubsta information is not available - wifi: ath10k: avoid unnecessary wait for service ready message - Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram - IB/sa: Fix sa_local_svc_timeout_ms read race - RDMA/core: Resolve MAC of next-hop device without ARP support - f2fs: fix zero-sized extent for precache extents - scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() - scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() - scsi: qla2xxx: edif: Fix incorrect sign of error code - ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message - f2fs: fix to truncate first page in error path of f2fs_truncate() - f2fs: fix to update map->m_next_extent correctly in f2fs_map_blocks() - wifi: mt76: fix potential memory leak in mt76_wmac_probe() - RDMA/cm: Rate limit destroy CM ID timeout error message - drivers/base/node: handle error properly in register_one_node() - watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog - ipvs: Use READ_ONCE/WRITE_ONCE for ipvs->enable - iio: consumers: Fix offset handling in iio_convert_raw_to_processed() - iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() - fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist - fs: ntfs3: Fix integer overflow in run_unpack() - drm/msm/dpu: fix incorrect type for ret - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping - ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping - misc: genwqe: Fix incorrect cmd field being reported in error - usb: gadget: configfs: Correctly set use_os_string at bind - usb: phy: twl6030: Fix incorrect type for ret - drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() - tcp: fix __tcp_close() to only send RST when required - PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation - wifi: mwifiex: send world regulatory domain to driver - drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) - drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) - drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) - drm/amd/pm: Adjust si_upload_smc_data register programming (v3) - drm/amd/pm: Fix si_upload_smc_data (v3) - drm/amd/pm: Disable ULV even if unsupported (v3) - drm/amdgpu: Power up UVD 3 for FW validation (v2) - coresight: Only register perf symlink for sinks with alloc_buffer - inet: ping: check sock_net() in ping_get_port() and ping_lookup() - media: st-delta: avoid excessive stack usage - ALSA: lx_core: use int type to store negative error codes - media: rj54n1cb0c: Fix memleak in rj54n1_probe() - scsi: myrs: Fix dma_alloc_coherent() error check - hwrng: nomadik - add ARM_AMBA dependency - crypto: keembay - Add missing check after sg_nents_for_len() - drm/amd/display: Remove redundant semicolons - serial: max310x: Add error checking in probe() - usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls - usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup - phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 - media: zoran: Remove zoran_fh structure - drm/bridge: it6505: select REGMAP_I2C - f2fs: fix condition in __allow_reserved_blocks() - drm/radeon/r600_cs: clean up of dead code in r600_cs - drm/panel: novatek-nt35560: Fix invalid return value - bpf: Enforce expected_attach_type for tailcall compatibility - i2c: designware: Add disabling clocks when probe fails - i2c: designware: Fix clock issue when PM is disabled - i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD - thermal/drivers/qcom/lmh: Add missing IRQ includes - thermal/drivers/qcom: Make LMH select QCOM_SCM - hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems - once: fix race by moving DO_ONCE to separate section - smp: Fix up and expand the smp_call_function_many() kerneldoc - selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported - i3c: master: svc: Recycle unused IBI slot - i3c: master: svc: Use manual response for IBI events - ACPICA: Fix largest possible resource descriptor index - pwm: tiehrpwm: Fix corner case in clock divisor calculation - arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible - arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value - arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names - cpuidle: qcom-spm: fix device and OF node leaks at probe - firmware: firmware: meson-sm: fix compile-test default - arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 - null_blk: Fix the description of the cache_size module argument - pinctrl: renesas: Use int type to store negative error codes - power: supply: cw2015: Fix a alignment coding style issue - PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() - ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property - ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS - ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax - block: use int to store blk_stack_limits() return value - selftests/nolibc: fix EXPECT_NZ macro - regulator: scmi: Use int type to store negative error codes - arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map - ARM: at91: pm: fix MCKx restore routine - pinctrl: meson-gxl: add missing i2c_d pinmux - soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS - leds: flash: leds-qcom-flash: Update torch current clamp setting - ARM: dts: renesas: porter: Fix CAN pin group - libbpf: Fix reuse of DEVMAP - bpf: Remove migrate_disable in kprobe_multi_link_prog_run - bpf/selftests: Fix test_tcpnotify_user - regmap: Remove superfluous check for !config in __regmap_init() - arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 - x86/vdso: Fix output operand size of RDPID - smb: server: fix IRD/ORD negotiation with the client - coresight: trbe: Prevent overflow in PERF_IDX2OFF() - gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote - selftests: arm64: Check fread return value in exec_target - seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast - init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD - filelock: add FL_RECLAIM to show_fl_flags() macro - !21022 KVM: Don't clobber irqfd routing type when deassigning irqfd - !20998 ceph: fix oops due to invalid pointer for kfree() in parse_longname() - !21023 l2tp: avoid one data-race in l2tp_tunnel_del_work() - xsched: fix potential NULL dereference in xsched_quota_timeout_update - xsched: remove the standalone xcu_cfs_cg_deinit() helper - xsched: restructure xcu_cgrp_subsys teardown to align with cpu_cgrp_subsys lifecycle - xsched: simplify root group check by direct comparison with root_xcg - xsched: replace magic number with SCHED_CLASS_MAX_LENGTH for scheduler class string length - xsched/core: immediate cleanup of remaining operators on task exit - xsched: add init_fair_xsched_group() for XCU-specific fair group initialization - xsched: modify xcu_cg_initialize_components helper - xsched: refactor xsched_entity initialization - xsched: change rq_init() parameter from struct xsched_cu to struct xsched_rq - xsched: harden and clarify xcu_move_task() logic - xsched: move throttling-related fields from xsched_group_xcu_priv to xsched_rq_cfs - xsched/quota: add throttled flag to cfs_rq for robust hierarchical enqueue under throttling - xsched/quota: support multi-level cgroup - xsched: remove redundant xcu parameter from dequeue_ctx - xsched: update group shares using xcu_grp_shares_add/sub helpers - xsched: delete unused code - xsched/cfs: propagate group activation/deactivation up the hierarchy - xsched/cfs: move xruntime updates to pick/put paths - xsched: add has_running hook to xsched classes for wake-up eligibility check - !21012 [OLK-6.6][linux-6.6.y sync] Backport 6.6.110-6.6.111 LTS Patches - scsi: hisi_sas: Fix NULL pointer exception when do user_scan() - !21013 CVE-2026-23177 - !21007 bonding: fix use-after-free due to enslave fail after slave array update - !21006 net: Fix CVE-2026-23204 - bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path - bpf, test_run: Subtract size of xdp_frame from allowed metadata size - bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN - bpf: Make variables in bpf_prog_test_run_xdp less confusing - bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K - !21015 libceph: reset sparse-read state in osd_fault() - !21024 ub: udma: bugfix related to print messages. - !20980 Fix CVE-2026-23126 - !20922 Fix CVE-2026-23133 - ub: udma: bugfix related to print messages. - l2tp: avoid one data-race in l2tp_tunnel_del_work() - KVM: Don't clobber irqfd routing type when deassigning irqfd - ipv6: annotate data-race in ndisc_router_discovery() - macvlan: observe an RCU grace period in macvlan_common_newlink() error path - macvlan: fix error recovery in macvlan_common_newlink() - mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() - net: fix segmentation of forwarding fraglist GRO - can: rcar_canfd: Fix CAN-FD mode as default - libceph: reset sparse-read state in osd_fault() - !21008 uvb: fix cis call return value and obtain - mm, shmem: prevent infinite loop on truncate race - mm/shmem, swap: fix race of truncate and swap entry split - net/9p: fix double req put in p9_fd_cancelled - riscv: mm: Do not restrict mmap address based on hint - riscv: mm: Use hint address in mmap if available - driver core/PM: Set power.no_callbacks along with power.no_pm - serial: stm32: allow selecting console when the driver is module - hid: fix I2C read buffer overflow in raw_event() for mcp2221 - ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free - ALSA: usb-audio: Kill timer properly at removal - platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list - can: rcar_canfd: Fix controller mode setting - can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled - btrfs: ref-verify: handle damaged extent root tree - ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue - perf subcmd: avoid crash in exclude_cmds when excludes is empty - platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list - dm-integrity: limit MAX_TAG_SIZE to 255 - ASoC: amd: acp: Adjust pdm gain value - wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 - USB: serial: option: add SIMCom 8230C compositions - media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe - !20931 Fix CVE-2026-23060 - uvb: fix cis call return value and obtain - bonding: fix use-after-free due to enslave fail after slave array update - net/sched: cls_u32: use skb_header_pointer_careful() - net: add skb_header_pointer_careful() helper - regmap: Fix race condition in hwspinlock irqsave routine - crypto: virtio - Add spinlock protection with virtqueue notification - net/mlx5e: TC, delete flows only for existing peers - !20967 net: hns3: modify code of judging if SMMU DMA is enabled - ceph: fix oops due to invalid pointer for kfree() in parse_longname() - !20969 Fix CVE-2026-23125 - !20948 v4 arm64: Add memory poison recovery support for various paths - !20975 CVE-2026-23102 - !20977 v4 support apei_page_offline_policy - bonding: annotate data-races around slave->last_rx - netfilter: nf_conncount: update last_gc only when GC has been performed - bonding: provide a net pointer to __skb_flow_dissect() - netdevsim: fix a race issue related to the operation on bpf_bound_progs list - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() - apei/ghes: Add sysctl interface to control soft-offline page isolation - Revert "mm/memory-failure: support disabling soft offline for HugeTLB pages" - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - arm64/fpsimd: signal: Fix restoration of SVE context - arm64/fpsimd: signal: Consistently read FPSIMD context - arm64/fpsimd: signal: Mandate SVE payload for streaming-mode state - bonding: limit BOND_MODE_8023AD to Ethernet devices - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag - net/sched: Enforce that teql can only be used as root qdisc - sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT - drivers/net: Update vendor name of Chengdu NorthLink Technology N5/N6 Series Network Card Drivers - net: hns3: modify code of judging if SMMU DMA is enabled - dmaengine: xilinx: xdma: Fix regmap max_register - ub:ubus: protect iterator ue_list and mue_list with ub_bus_sem - ub:ubus: Avoid getting empty uent from ubc - ub:hisi-ubus: Use GFP_ATOMIC when alloc memory - arm64: send sig fault for user task when apei_claim_sea fails - arm64: add ras log during do_sea - arm64: move getting valid siaddr to the top of do_sea - arm64: mm: shmem: support poison recovery from shmem_file_read_iter() - arm64: fs: support poison recovery from __kernel_read() - iov_iter: add mc support for copy_page_to_iter - arm64: mm: support recovery from copy_{from/to}_user_page() - iov_iter: get rid of 'copy_mc' flag - leds: led-class: Only Add LED to leds_list when it is fully ready - wifi: ath10k: fix dma_free_coherent() pointer - smb/server: fix refcount leak in parse_durable_handle_context() - ksmbd: add chann_lock to protect ksmbd_chann_list xarray - ipvlan: Make the addrs_lock be per port - smb: client: split cached_fid bitfields to avoid shared-byte RMW races - efivarfs: fix error propagation in efivar_entry_get() - io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop - dm: use bio_clone_blkg_association - RAS/AMD/ATL: fix error nodes per socket on for Hygon Dhyana processor - net: txgbe: fix clang compile warning - !20552 ub: udma: fix some code issues. - !20313 Fix CVE-2025-40220 - !20321 nvme: fix admin request_queue lifetime - !20512 PM / devfreq: hisi: Fix potential UAF in OPP handling - !20544 Fix CVE-2025-71147 - !20548 v4 net: LTS-6.6 backport - !20503 Fix CVE-2025-39713 - !20133 Fix CVE-2025-39721 - !20438 Fix CVE-2025-38659 - !20264 Fix CVE-2025-40277 - !20340 Fix CVE-2025-40271 - !20319 Fix CVE-2025-40237 - !20392 vfs: Don't leak disconnected dentries on umount - !20554 iommu/s390: Implement blocking domain - !20489 [OLK-6.6][linux-6.6.y sync] Backport 6.6.101-6.6.102 LTS Patches - !20513 ACPI: PCC: Fix race condition by removing static qualifier - !20468 drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer - !20483 rcu: Protect ->defer_qs_iw_pending from data race - !20510 drivers/ub/sentry: fix primary eid index value - !20553 ub: cdma: support separated page table feature - ub: udma: fix some code issues. - !20480 iommu/ummu-core: fix error invalidate tid - !20561 iommu/ummu: Add ummu sva independent page table parameter - ub: udma: bugfix related to 2m_hugepage. - ub: udma: support for separate page tables - ub: udma: delete debugfs code. - ub: udma: bugfix related to ctrlq function. - ub: udma: verify get cqe/ae aux info out addr and len. - ub: cdma: support separated page table feature - iommu/ummu: Add ummu sva independent page table parameter - iommu: Adjust PLB refresh timing in 'grant' and 'ungrant' - !20505 Fix CVE-2026-23035 - iommu/s390: Implement blocking domain - drivers/ub/sentry: fix primary eid index value - !20535 libceph: make decode_pool() more resilient against corrupted osdmaps - !20536 mm/page_alloc: change all pageblocks migrate type on coalescing - !20537 mm/secretmem: fix use-after-free race in fault handler - !20538 wifi: avoid kernel-infoleak from struct iw_point - !20539 net: usb: rtl8150: fix memory leak on usb_submit_urb() failure - !20440 PCI/AER: Fix NULL pointer access by aer_info - !20262 Fix CVE-2025-68176 - netfilter: nf_reject: don't leak dst refcount for loopback packets - net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error - page_pool: always add GFP_NOWARN for ATOMIC allocations - virtio-net: fix received length check in big packets - net: bridge: fix use-after-free due to MST port state bypass - vsock: Ignore signal/timeout on connect() if already established - tls: make sure to abort the stream if headers are bogus - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI - xfrm: Duplicate SPI Handling - tls: handle data disappearing from under the TLS ULP - net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing - bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls - Bluetooth: hci_core: Fix use-after-free in vhci_flush() - KEYS: trusted: Fix a memory leak in tpm2_load_cmd - !20237 Fix CVE-2025-68724 - !20459 Fix CVE-2025-71131 - !20525 Fix CVE-2025-68816 - !20529 CVE-2025-68172 - net: usb: rtl8150: fix memory leak on usb_submit_urb() failure - !20370 Revert "Revert "RDMA/hns: Fix mismatch exception rollback"" - wifi: avoid kernel-infoleak from struct iw_point - mm/secretmem: fix use-after-free race in fault handler - mm/page_alloc: change all pageblocks migrate type on coalescing - libceph: make decode_pool() more resilient against corrupted osdmaps - pps: Fix kabi breakage of struct pps_device for last_fetched_ev - sched: Fix kabi breakage of struct task_struct for saved_state - crypto: aspeed - fix double free caused by devm - !20515 Bluetooth: bcsp: receive data only if registered - !20507 Fix CVE-2025-40358 - !20450 ub: ubase&unic: Fix some bug in concurrent process - !20452 iommu/ummu: Fix some bugs and optimize the code implementation - !20451 iommu/ummu: Add the function of creating devices with SVA-separated - !20500 mm: fix the inaccurate memory statistics issue for users - net/mlx5: fw_tracer, Validate format string parameters - Bluetooth: bcsp: receive data only if registered - ACPI: PCC: Fix race condition by removing static qualifier - ACPI: CPPC: Fix missing PCC check for guaranteed_perf - iommu/ummu: Add the function of creating devices with SVA-separated - iommu/ummu-core: fix error invalidate tid - riscv: stacktrace: Disable KASAN checks for non-current tasks - !20497 arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() - !20496 drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies - !20495 iommu/amd: Avoid stack buffer overflow from kernel cmdline - !20494 HID: core: Harden s32ton() against conversion to 0 bits - !20493 iommu: Fix two issues in iommu_copy_struct_from_user() - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv - PM / devfreq: hisi: Fix potential UAF in OPP handling - media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() - !20487 interference: Fix uninitialized ifs_clock compiling issue - MIPS: mm: kmalloc tlb_vpn array to avoid stack overflow - MIPS: mm: Prevent a TLB shutdown on initial uniquification - mm: fix the inaccurate memory statistics issue for users - mm: add config option for atomic mode in mm counter - Revert "mm: fix the inaccurate memory statistics issue for users" - !20444 net/mlx5e: Fix crash on profile change rollback failure - !20442 net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv - arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() - drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies - iommu/amd: Avoid stack buffer overflow from kernel cmdline - HID: core: Harden s32ton() against conversion to 0 bits - iommu: Fix two issues in iommu_copy_struct_from_user() - SUNRPC: call xs_sock_process_cmsg for all cmsg - flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read - !20374 [OLK 6.6]Use Hygon IBRS and IBPB rather than software-based mitigation to mitigate Retbleed and SRSO. - !20227 Rename leapioraid to leapraid and release v2.0 - mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery - MIPS: mm: tlb-r4k: Uniquify TLB entries on init - x86/fpu: Delay instruction pointer fixup until after warning - ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx() - ALSA: intel_hdmi: Fix off-by-one error in __hdmi_lpe_audio_probe() - x86/sev: Evict cache lines during SNP memory validation - net: usbnet: Fix the wrong netif_carrier_on() call - net: usbnet: Avoid potential RCU stall on LINK_CHANGE event - Bluetooth: btusb: Add USB ID 3625:010b for TP-LINK Archer TX10UB Nano - sched,freezer: Remove unnecessary warning in __thaw_task - freezer,sched: Clean saved_state when restoring it during thaw - freezer,sched: Do not restore saved_state of a thawed task - freezer,sched: Use saved_state to reduce some spurious wakeups - sched/core: Remove ifdeffery for saved_state - i2c: stm32f7: unmap DMA mapped buffer - i2c: stm32f7: simplify status messages in case of errors - i2c: stm32f7: perform most of irq job in threaded handler - i2c: stm32f7: use dev_err_probe upon calls of devm_request_irq - i2c: stm32f7: Use devm_clk_get_enabled() - USB: serial: option: add Foxconn T99W709 - smb: server: Fix extension string in ksmbd_extract_shortname() - ksmbd: fix corrupted mtime and ctime in smb2_open - ksmbd: fix Preauh_HashValue race condition - ksmbd: fix null pointer dereference error in generate_encryptionkey - vsock: Do not allow binding to VMADDR_PORT_ANY - selftests/perf_events: Add a mmap() correctness test - smb: client: return an error if rdma_connect does not return within 5 seconds - smb: client: let recv_done() cleanup before notifying the callers. - smb: client: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already - smb: client: make use of common smbdirect_socket - smb: smbdirect: add smbdirect_socket.h - smb: client: Correct typos in multiple comments across various files - smb: client: Use min() macro - smb: server: let recv_done() avoid touching data_transfer after cleanup/move - smb: server: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already - ALSA: hda/ca0132: Fix missing error handling in ca0132_alt_select_out() - irqchip: Build IMX_MU_MSI only on ARM - net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing - sunrpc: fix client side handling of tls alerts - net/sched: taprio: enforce minimum value for picos_per_byte - net: drop UFO packets in udp_rcv_segment() - ipv6: reject malicious packets in ipv6_gso_segment() - net/mlx5: Correctly set gso_segs when LRO is used - netlink: specs: ethtool: fix module EEPROM input/output arguments - net: ipa: add IPA v5.1 and v5.5 to ipa_version_string() - phy: mscc: Fix parsing of unicast frames - netpoll: prevent hanging NAPI when netcons gets enabled - md/md-cluster: handle REMOVE message earlier - NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY - NFS: Fix wakeup of __nfs_lookup_revalidate() in unblock_revalidate() - sched: Add test_and_clear_wake_up_bit() and atomic_dec_and_wake_up() - pNFS/flexfiles: don't attempt pnfs on fatal DS errors - PCI: pnv_php: Fix surprise plug detection and recovery - powerpc/eeh: Export eeh_unfreeze_pe() - PCI: pnv_php: Work around switches with broken presence detection - kconfig: qconf: fix ConfigList::updateListAllforAll() - scsi: sd: Make sd shutdown issue START STOP UNIT appropriately - scsi: ufs: core: Use link recovery when h8 exit fails during runtime resume - scsi: Revert "scsi: iscsi: Fix HW conn removal use after free" - scsi: mpt3sas: Fix a fw_event memory leak - vfio/pci: Separate SR-IOV VF dev_set - vfio/pds: Fix missing detach_ioas op - vfio: Prevent open_count decrement to negative - vfio: Fix unbalanced vfio_df_close call in no-iommu mode - f2fs: fix to calculate dirty data during has_not_enough_free_secs() - f2fs: fix to update upper_p in __get_secs_required() correctly - f2fs: vm_unmap_ram() may be called from an invalid context - f2fs: fix to avoid out-of-boundary access in devs.path - f2fs: doc: fix wrong quota mount option description - f2fs: fix KMSAN uninit-value in extent_info usage - rtc: rv3028: fix incorrect maximum clock rate handling - rtc: pcf8563: fix incorrect maximum clock rate handling - rtc: pcf85063: fix incorrect maximum clock rate handling - rtc: nct3018y: fix incorrect maximum clock rate handling - rtc: hym8563: fix incorrect maximum clock rate handling - rtc: ds1307: fix incorrect maximum clock rate handling - ucount: fix atomic_long_inc_below() argument type - module: Restore the moduleparam prefix length check - apparmor: fix loop detection used in conflicting attachment resolution - apparmor: ensure WB_HISTORY_SIZE value is a power of 2 - bpf: Check netfilter ctx accesses are aligned - bpf: Check flow_dissector ctx accesses are aligned - vhost-scsi: Fix log flooding with target does not exist errors - mtd: rawnand: atmel: set pmecc data setup time - mtd: rawnand: rockchip: Add missing check after DMA map - mtd: rawnand: atmel: Fix dma_mapping_error() address - jfs: fix metapage reference count leak in dbAllocCtl - crypto: qat - fix seq_file position update in adf_ring_next() - crypto: qat - fix DMA direction for compression on GEN2 devices - perf tools: Remove libtraceevent in .gitignore - sh: Do not use hyphen in exported variable name - ASoC: fsl_xcvr: get channel status data when PHY is not exists - dmaengine: nbpfaxi: Add missing check after DMA map - dmaengine: mv_xor: Fix missing check after DMA map and missing unmap - fs/orangefs: Allow 2 more characters in do_c_string() - PCI: endpoint: pci-epf-vntb: Fix the incorrect usage of __iomem attribute - soundwire: stream: restore params when prepare ports fail - crypto: img-hash - Fix dma_unmap_sg() nents value - crypto: keembay - Fix dma_unmap_sg() nents value - hwrng: mtk - handle devm_pm_runtime_enable errors - watchdog: ziirave_wdt: check record length in ziirave_firm_verify() - scsi: isci: Fix dma_unmap_sg() nents value - scsi: mvsas: Fix dma_unmap_sg() nents value - scsi: elx: efct: Fix dma_unmap_sg() nents value - scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value - clk: sunxi-ng: v3s: Fix de clock definition - perf tests bp_account: Fix leaked file descriptor - kernel: trace: preemptirq_delay_test: use offstack cpu mask - crypto: inside-secure - Fix `dma_unmap_sg()` nents value - perf sched: Fix memory leaks in 'perf sched latency' - perf sched: Fix memory leaks for evsel->priv in timehist - perf sched: Free thread->priv using priv_destructor - perf dso: Add missed dso__put to dso__load_kcore - perf tools: Fix use-after-free in help_unknown_cmd() - Fix dma_unmap_sg() nents value - clk: clk-axi-clkgen: fix fpfd_max frequency for zynq - fanotify: sanitize handle_type values when reporting fid - pinctrl: sunxi: Fix memory leak on krealloc failure - PCI: endpoint: pci-epf-vntb: Return -ENOENT if pci_epc_get_next_free_bar() fails - crypto: arm/aes-neonbs - work around gcc-15 warning - power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set - power: supply: cpcap-charger: Fix null check for power_supply_get_by_name - clk: xilinx: vcu: unregister pll_post only if registered correctly - media: v4l2-ctrls: Fix H264 SEPARATE_COLOUR_PLANE check - mtd: fix possible integer overflow in erase_xfer() - crypto: marvell/cesa - Fix engine load inaccuracy - crypto: qat - use unmanaged allocation for dc_data - crypto: sun8i-ce - fix nents passed to dma_unmap_sg() - PCI: rockchip-host: Fix "Unexpected Completion" log message - bpf/preload: Don't select USERMODE_DRIVER - ipv6: annotate data-races around rt->fib6_nsiblings - ipv6: fix possible infinite loop in fib6_info_uses_dev() - vrf: Drop existing dst reference in vrf_ip6_input_dst - selftests: rtnetlink.sh: remove esp4_offload after test - net/mlx5e: Clear Read-Only port buffer size in PBMC before update - netfilter: xt_nfacct: don't assume acct name is null-terminated - can: kvaser_usb: Assign netdev.dev_port based on device channel index - can: kvaser_pciefd: Store device channel index - can: peak_usb: fix USB FD devices potential malfunction - tools/rv: Do not skip idle in trace - Bluetooth: hci_event: Mask data status from LE ext adv reports - kcsan: test: Initialize dummy variable - wifi: mac80211: Write cnt before copying in ieee80211_copy_rnr_beacon() - wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE - wifi: ath12k: fix endianness handling while accessing wmi service bit - wifi: mac80211: Check 802.11 encaps offloading in ieee80211_tx_h_select_key() - wifi: mac80211: Don't call fq_flow_idx() for management frames - wifi: mac80211: Do not schedule stopped TXQs - wifi: plfxlc: Fix error handling in usb driver probe - wifi: mac80211: reject TDLS operations when station is not associated - iommu/amd: Fix geometry.aperture_end for V2 tables - mwl8k: Add missing check after DMA map - wifi: rtl8xxxu: Fix RX skb size for aggregation disabled - tcp: call tcp_measure_rcv_mss() for ooo packets - xen/gntdev: remove struct gntdev_copy_batch from stack - net_sched: act_ctinfo: use atomic64_t for three counters - net/sched: Restrict conditions for adding duplicating netems to qdisc tree - um: rtc: Avoid shadowing err in uml_rtc_start() - arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX - netfilter: nf_tables: adjust lockdep assertions handling - netfilter: nf_tables: Drop dead code from fill_*_info routines - fbcon: Fix outdated registered_fb reference in comment - drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value - m68k: Don't unregister boot console needlessly - drm/msm/dpu: Fill in min_prefill_lines for SC8180X - kselftest/arm64: Fix check for setting new VLs in sve-ptrace - net: dst: annotate data-races around dst->input - tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range - wifi: ath11k: clear initialized flag for deinit-ed srng lists - iwlwifi: Add missing check for alloc_ordered_workqueue - wifi: iwlwifi: Fix memory leak in iwl_mvm_init() - wifi: rtl818x: Kill URBs before clearing tx status queue - wifi: rtw89: avoid NULL dereference when RX problematic packet on unsupported 6 GHz band - caif: reduce stack size, again - bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure - drm/vmwgfx: Fix Host-Backed userspace on Guest-Backed kernel - net: ipv6: ip6mr: Fix in/out netdev to pass to the FORWARD chain - selftests/bpf: fix signedness bug in redir_partial() - bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls - bpf, sockmap: Fix psock incorrectly pointing to sk - drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed - staging: nvec: Fix incorrect null termination of battery manufacturer - interconnect: qcom: sc8180x: specify num_nodes - interconnect: qcom: sc8280xp: specify num_links for qnm_a1noc_cfg - soc: qcom: pmic_glink: fix OF node leak - samples: mei: Fix building on musl libc - cpufreq: Initialize cpufreq-based frequency-invariance later - cpufreq: intel_pstate: Always use HWP_DESIRED_PERF in passive mode - arm64: dts: imx8mn-beacon: Fix HS400 USDHC clock speed - arm64: dts: imx8mm-beacon: Fix HS400 USDHC clock speed - ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface - soc/tegra: cbb: Clear ERR_FORCE register with ERR_STATUS - arm: dts: ti: omap: Fixup pinheader typo - usb: early: xhci-dbc: Fix early_ioremap leak - powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw() - pps: fix poll support - staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() - spi: stm32: Check for cfg availability in stm32_spi_probe - usb: misc: apple-mfi-fastcharge: Make power supply names unique - usb: host: xhci-plat: fix incorrect type for of_match variable in xhci_plat_probe() - ARM: dts: vfxxx: Correctly use two tuples for timer address - arm64: dts: qcom: msm8976: Make blsp_dma controlled-remotely - arm64: dts: qcom: sc7180: Expand IMEM region - arm64: dts: qcom: sdm845: Expand IMEM region - soc: qcom: QMI encoding/decoding for big endian - selftests: Fix errno checking in syscall_user_dispatch test - ASoC: mediatek: use reserved memory or enable buffer pre-allocation - gfs2: No more self recovery - Revert "fs/ntfs3: Replace inode_trylock with inode_lock" - hfs: make splice write available again - hfsplus: make splice write available again - ublk: use vmalloc for ublk_device's __queues - fs_context: fix parameter name in infofc() macro - audit,module: restore audit logging in load failure case - ASoC: amd: yc: add DMI quirk for ASUS M6501RM - ASoC: Intel: fix SND_SOC_SOF dependencies - ASoC: amd: yc: Add DMI entries to support HP 15-fb1xxx - ethernet: intel: fix building with large NR_CPUS - ASoC: amd: yc: Add DMI quirk for HP Laptop 17 cp-2033dx - interference: Fix uninitialized ifs_clock compiling issue - iommu/ummu: optimize log printing - !20455 Fix compilation failure caused by PR#20174 - !20302 CVE-2026-22980 - !20142 CVE-2025-68803 - !20261 ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency - !20435 fix CVE-2026-22998 - !20433 scsi: target: Reset t_task_cdb pointer in error case - !20432 scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" - !20431 block: Use RCU in blk_mq_[un - !20307 tpm: Cap the number of PCR banks - !20062 xfs: Add xfs_dir3_leaf_header_check() in leaf/leafn read - !20157 v2 md: backport from mainline - rcu: Protect ->defer_qs_iw_pending from data race - platform/x86/intel/pmt: fix compilation failure caused by PR#20174 - iommu/ummu: optimize kv cache memory management - iommu/ummu: optimize permission table management - iommu/ummu: remove check for eid_type while del eid - iommu/ummu: optimize the code implementation - drivers/perf: fix ummu-pmu data reading exception - iommu/ummu: IOMMU_DOMAIN_BLOCKED type don not sync tct - drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer - crypto: seqiv - Do not use req->iv after crypto_aead_encrypt - net: unic: Notify mami of the bond ip change. - ub: ubase: Support for UE link by ctrlq message - ub: ubase: send a deactivate req in removing - ub: ubase: Querying TPG/TP contexts in the chip is no longer supported after enabling safe mode. - ub: ubase: Use an independent thread for the ctrlq workqueue. - !20368 ubcore: fix logging and permission for route query. - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id - !20344 ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr - net: unic: Fix the ummu 0xa event that occurs when modifying queues and resetting concurrent scenarios - ub: ubase: Add KABI compatibility - ub: ubase: fixing the issue of cdma ctp_req_vl parameter configuration - ub: ubase: add PMU IDEV interrupt supported abilities. - ub: ubase: Delete the tid mask for eq, jfs, jfr, and jfc context - ub: ubase: Set the completion event interrupt to auto - net: unic: fix poll tx read old skb cause a UAF bug - !20249 Fix CVE-2025-38489 - !20250 Fix CVE-2025-38480 - !20378 Fix CVE-2025-39838 - !20430 Fix CVE-2025-39942 - !20351 Fix CVE-2025-71149 - !20375 Fix CVE-2025-71150 - !20323 Fix CVE-2025-38730 - !20320 Fix CVE-2025-68814 - !20314 Fix CVE-2025-71072 - !20315 Fix CVE-2025-68794 - !20403 bpf: Check skb->transport_header is set in bpf_skb_check_mtu - !20402 bpf: Do not let BPF test infra emit invalid GSO types to stack - !20401 tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() - !20400 netfilter: nft_ct: add seqadj extension for natted connections - !20399 net: xfrm: Fix CVE-2025-40215 - !20398 net/sched: sch_qfq: Fix null-deref in agg_dequeue - !20397 bpf: Reject narrower access to pointer ctx fields - !20396 Bluetooth: eir: Fix possible crashes on eir_create_adv_data - !20394 IB/mlx5: Fix potential deadlock in MR deregistration - !20367 ub: cdma: cdma uaf bugfix - net/mlx5e: Fix crash on profile change rollback failure - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv - PCI/AER: Fix NULL pointer access by aer_info - gfs2: No more self recovery - drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE - crypto: qat - flush misc workqueue during device shutdown - !20174 Backport PMT spec 3.0 support - !20366 [Hygon][6.6][Bugfix]: Resolve FPU state corruption between atomic and non-atomic contexts - !19814 [OLK-6.6] Batch flushing user memory encrytion status change - !20393 [OLK-6.6][linux-6.6.y sync] Backport 6.6.100-6.6.101 LTS Patches - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec - nvmet-tcp: remove boilerplate code - scsi: target: Reset t_task_cdb pointer in error case - scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" - block: Use RCU in blk_mq_[un]quiesce_tagset() instead of set->tag_list_lock - ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size - ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer - smb: server: let recv_done() consistently call put_recvmsg/smb_direct_disconnect_rdma_connection - smb: server: remove separate empty_recvmsg_queue - !20384 ub:ubus: Fix ubus link message and pool device error - !20389 gfs2: Prevent recursive memory reclaim - !20388 *** fix CVE-2025-38062 *** - !20387 KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced - !20386 pinctrl: check the return value of pinmux_ops::get_function_name() - !20385 iommu/amd/pgtbl: Fix possible race while increase page table level - ub:ubus: Not cfg access during surprise down - ub:hisi-ubus: Delete validate_pa err print - PCI: cadence: Check for the existence of cdns_pcie::ops before using it - can: netlink: can_changelink(): allow disabling of automatic restart - Revert "selftests/bpf: Add a cgroup prog bpf_get_ns_current_pid_tgid() test" - drm/sched: Remove optimization that causes hang when killing dependent jobs - ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS - bpf: Check skb->transport_header is set in bpf_skb_check_mtu - bpf: Do not let BPF test infra emit invalid GSO types to stack - tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() - netfilter: nft_ct: add seqadj extension for natted connections - xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added - xfrm: delete x->tunnel as we delete x - x86/hw-vuln:Support hardware-based mitigation for Retbleed and SRSO via Hygon IBRS to avoid performance degradation caused by software-based mitigation. - net/sched: sch_qfq: Fix null-deref in agg_dequeue - bpf: Reject narrower access to pointer ctx fields - Bluetooth: eir: Fix possible crashes on eir_create_adv_data - IB/mlx5: Fix potential deadlock in MR deregistration - ub:ubus: Fix ubus link message and pool device error - ub:hisi-ubus: cq poller maximum handle 64 cqe per time - ub:hisi-ubus:Fix vdm message print error - ub:ubus:Fix ubus interrupt release issue - wifi: mt76: mt7921: prevent decap offload config before STA initialization - mtd: rawnand: qcom: Fix last codeword read in qcom_param_page_type_exec() - iio: hid-sensor-prox: Restore lost scale assignments - iio: hid-sensor-prox: Fix incorrect OFFSET calculation - crypto: powerpc/poly1305 - add depends on BROKEN for now - erofs: address D-cache aliasing - drm/i915/dp: Fix 2.7 Gbps DP_LINK_BW value on g4x - ALSA: hda: Add missing NVIDIA HDA codec IDs - ALSA: hda/tegra: Add Tegra264 support - comedi: comedi_test: Fix possible deletion of uninitialized timers - usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach - usb: typec: tcpm: allow switching to mode accessory to mux properly - usb: typec: tcpm: allow to use sink in accessory mode - drm/amdkfd: Don't call mmput from MMU notifier callback - mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n - selftests: mptcp: connect: also cover checksum - selftests: mptcp: connect: also cover alt modes - resource: fix false warning in __request_region() - gve: Fix stuck TX queue for DQ queue format - e1000e: ignore uninitialized checksum word on tgp - e1000e: disregard NVM checksum on tgp when valid checksum bit is not set - dpaa2-switch: Fix device reference count leak in MAC endpoint handling - dpaa2-eth: Fix device reference count leak in MAC endpoint handling - ALSA: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx - sprintf.h requires stdarg.h - bus: fsl-mc: Fix potential double device reference in fsl_mc_get_endpoint() - i2c: virtio: Avoid hang by using interruptible completion wait - i2c: tegra: Fix reset error handling with ACPI - platform/x86: ideapad-laptop: Fix kbd backlight not remembered among boots - can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode - can: dev: can_restart(): move debug message and stats after successful restart - can: dev: can_restart(): reverse logic to remove need for goto - i40e: When removing VF MAC filters, only check PF-set MAC - i40e: report VF tx_dropped with tx_errors instead of tx_discards - i40e: Add rx_missed_errors for buffer exhaustion - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch - net/mlx5: Fix memory leak in cmd_exec() - staging: vchiq_arm: Make vchiq_shutdown never fail - x86/hyperv: Fix usage of cpu_online_mask to get valid cpu - regmap: fix potential memory leak of regmap_bus - iio: adc: ad7949: use spi_is_bpw_supported() - interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1 node - RDMA/core: Rate limit GID cache warning messages - virtio_ring: Fix error reporting in virtqueue_resize - !20348 [OLK-6.6][linux-6.6.y sync] Backport 6.6.99-6.6.100 LTS Patches - !20346 tracing: Fix crash on synthetic stacktrace field usage - vfs: Don't leak disconnected dentries on umount - !20334 Fix CVE-2025-68780 - gfs2: Prevent recursive memory reclaim - amd/amdkfd: enhance kfd process check in switch partition - drm/amdkfd: allow compute partition mode switch with cgroup exclusions - KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced - pinctrl: check the return value of pinmux_ops::get_function_name() - iommu/amd/pgtbl: Fix possible race while increase page table level - !19966 nvme-fc: use lock accessing port_state and rport state - ASoC: fsl_sai: replace regmap_write with regmap_update_bits - comedi: Fix use of uninitialized data in insn_rw_emulate_bits() - cifs: prevent NULL pointer dereference in UTF16 conversion - ksmbd: Fix refcount leak when invalid session is found on session lookup - ubcore: fix logging and permission for route query. - !20232 driver/coda: VirtCCA supports MSI device DA - Revert "Revert "RDMA/hns: Fix mismatch exception rollback"" - !20197 ub: udma&ubase: fix a bug that caused long reboot time - x86: Resolve FPU state corruption between atomic and non-atomic contexts - ub: cdma: cdma uaf bugfix - ub: cdma: jfs call trace bugfix - !20353 x86/fpu: Clear XSTATE_BV[i - s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again - KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls - nvmem: layouts: u-boot-env: remove crc32 endianness conversion - i2c: omap: fix deprecated of_property_read_bool() use - ASoC: fsl_sai: Force a software reset when starting in consumer mode - regulator: pwm-regulator: Manage boot-on with disabled PWM channels - regulator: pwm-regulator: Calculate the output voltage for disabled PWMs - i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe() - i2c: omap: Fix an error handling path in omap_i2c_probe() - i2c: omap: Add support for setting mux - usb: dwc3: qcom: Don't leave BCR asserted - usb: hub: Don't try to recover devices lost during warm reset. - usb: hub: Fix flushing of delayed work used for post resume purposes - usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm - usb: hub: fix detection of high tier USB3 devices behind suspended hubs - arm64: Filter out SME hwcaps when FEAT_SME isn't implemented - ipv6: make addrconf_wq single threaded - !20354 cpufreq/sched: Explicitly synchronize limits_changed flag handling - sched/deadline: only set free_cpus for online runqueues - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 - cpufreq/sched: Explicitly synchronize limits_changed flag handling - io_uring/poll: correctly handle io_poll_add() return value on update - shmem: fix recovery on rename failures - io_uring: fix filename leak in __io_openat_prep() - Revert "cgroup_freezer: cgroup_freezing: Check if not frozen" - rxrpc: Fix transmission of an abort in response to an abort - rxrpc: Fix recv-recv race of completed call - net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree - net: bridge: Do not offload IGMP/MLD messages - hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf - netfilter: nf_conntrack: fix crash due to removal of uninitialised entry - ipv6: mcast: Delay put pmc->idev in mld_del_delrec() - net/mlx5: Correctly set gso_size when LRO is used - Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID - Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout - Bluetooth: SMP: If an unallowed command is received consider it a failure - Bluetooth: hci_sync: fix connectable extended advertising when using static random address - hwmon: (corsair-cpro) Validate the size of the received input buffer - selftests: net: increase inter-packet timeout in udpgro.sh - wifi: cfg80211: remove scan request n_channels counted_by - nvme: fix misaccounting of nvme-mpath inflight I/O - net: phy: Don't register LEDs for genphy - nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list() - rpl: Fix use-after-free in rpl_do_srh_inline(). - block: fix kobject leak in blk_unregister_queue - net: emaclite: Fix missing pointer increment in aligned_read() - soundwire: amd: fix for clearing command status register - soundwire: amd: fix for handling slave alerts after link is down - comedi: Fix use of uninitialized data in insn_rw_emulate_bits() - comedi: Fix some signed shift left operations - comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large - comedi: das6402: Fix bit shift out of bounds - comedi: das16m1: Fix bit shift out of bounds - comedi: aio_iiro_16: Fix bit shift out of bounds - comedi: pcl812: Fix bit shift out of bounds - iio: adc: stm32-adc: Fix race in installing chained IRQ handler - iio: adc: max1363: Reorder mode_list[] entries - iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] - iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush - soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled - soc: aspeed: lpc-snoop: Cleanup resources in stack-order - s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again - pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov - net: libwx: properly reset Rx ring descriptor - net: libwx: remove duplicate page_pool_put_full_page() - mmc: sdhci_am654: Workaround for Errata i2312 - mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models - mmc: bcm2835: Fix dma_unmap_sg() nents value - memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() - isofs: Verify inode mode when loading from disk - dmaengine: nbpfaxi: Fix memory corruption in probe() - af_packet: fix soft lockup issue caused by tpacket_snd() - af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() - arm64: dts: rockchip: use cs-gpios for spi1 on ringneck - arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on - arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency - net/mlx5: Update the list of the PCI supported devices - phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() - io_uring/poll: fix POLLERR handling - ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS - drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume - tracing/osnoise: Fix crash in timerlat_dump_stack() - spi: Add check for 8-bit transfer with 8 IO mode support - pch_uart: Fix dma_sync_sg_for_device() nents value - thunderbolt: Fix bit masking in tb_dp_port_set_hops() - i2c: stm32: fix the device used for the DMA map - tracing: Fix crash on synthetic stacktrace field usage - usb: musb: fix gadget state on disconnect - USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI - USB: serial: option: add Foxconn T99W640 - USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition - phy: tegra: xusb: Disable periodic tracking on Tegra234 - phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode - phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr - fs/proc: fix uaf in proc_readdir_de() - io_uring/net: commit partial buffers on retry - nvme: fix admin request_queue lifetime - fs/notify: call exportfs_encode_fid with s_umount - iomap: adjust read range correctly for non-block-aligned positions - fuse: fix livelock in synchronous file put from fuseblk workers - tpm: Cap the number of PCR banks - nfsd: provide locking for v4_end_grace - Revert "nfsd: provide locking for v4_end_grace" - config: enable config for PMT discovery driver - platform/x86/intel/pmt/discovery: use valid device pointer in dev_err_probe - platform/x86/intel/pmt: Fix kobject memory leak on init failure - platform/x86/intel/pmt: fix a crashlog NULL pointer access - platform/x86/intel/pmt: fix build dependency for kunit test - platform/x86/intel/pmt/discovery: fix format string warning - platform/x86/intel/pmt/discovery: Fix size_t specifiers for 32-bit - platform/x86/intel/pmt: KUNIT test for PMT Enhanced Discovery API - platform/x86/intel/pmt/telemetry: Add API to retrieve telemetry regions by feature - platform/x86/intel/pmt/discovery: Get telemetry attributes - platform/x86/intel/tpmi: Get OOBMSM CPU mapping from TPMI - platform/x86/intel/vsec: Set OOBMSM to CPU mapping - platform/x86/intel/tpmi: Relocate platform info to intel_vsec.h - docs: Add ABI documentation for intel_pmt feature directories - platform/x86/intel/pmt: Add PMT Discovery driver - sysfs: Fix crash on empty group attributes array - sysfs: Introduce a mechanism to hide static attribute_groups - platform/x86/intel/vsec: Add new Discovery feature - platform/x86/intel/vsec: Skip driverless features - platform/x86/intel/vsec: Skip absent features during initialization - platform/x86/intel/vsec: Add device links to enforce dependencies - platform/x86/intel/vsec: Create wrapper to walk PCI config space - platform/x86/intel/vsec: Add private data for per-device data - MAINTAINERS: Add link to documentation of Intel PMT ABI - platform/x86/intel/pmt: allow user offset for PMT callbacks - driver/coda: VirtCCA supports MSI device DA - ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency - Rename leapioraid to leapraid and release v2.0 - ub: udma: fix a bug that caused long reboot time. - ub: ubase: Accelerate when ctrl node is shutting down - platform/x86/intel/pmt: Use PMT callbacks - platform/x86/intel/vsec: Add PMT read callbacks - platform/x86/intel/vsec.h: Move to include/linux - md: prevent incorrect update of resync/recovery offset - md/raid1: Fix data corruption for degraded array with slow disk - md/raid1: set max_sectors during early return from choose_slow_rdev() - md-cluster: fix no recovery job when adding/re-adding a disk - md-cluster: fix hanging issue while a new disk adding - md/raid5: recheck if reshape has finished with device_lock held - md-cluster: Constify struct md_cluster_operations - md: Remove unneeded semicolon - md/raid5: fix spares errors about rcu usage - dm-raid: Fix WARN_ON_ONCE check for sync_thread in raid_resume - md: pass in max_sectors for pers->sync_request() - md: factor out helpers for different sync_action in md_do_sync() - md: replace last_sync_action with new enum type - md: use new helpers in md_do_sync() - md: don't fail action_store() if sync_thread is not registered - md: remove parameter check_seq for stop_sync_thread() - md: replace sysfs api sync_action with new helpers - md: factor out helper to start reshape from action_store() - md: add new helpers for sync_action - md: add a new enum type sync_action - md: rearrange recovery_flags - md/raid0: don't free conf on raid0_run failure - md: make md_flush_request() more readable - md: change the return value type of md_write_start to void - md: Revert "md: Fix overflow in is_mddev_idle" - md: don't account sync_io if iostats of the disk is disabled - md: Fix overflow in is_mddev_idle - md: add check for sleepers in md_wakeup_thread() - md: add a mddev_is_dm helper - md: add a mddev_add_trace_msg helper - md: add a mddev_trace_remap helper - dm-raid456, md/raid456: fix a deadlock for dm-raid456 while io concurrent with reshape - dm-raid: add a new helper prepare_suspend() in md_personality - dm-raid: really frozen sync_thread during suspend - md: add a new helper reshape_interrupted() - md: export helper md_is_rdwr() - md: export helpers to stop sync_thread - md: don't clear MD_RECOVERY_FROZEN for new dm-raid until resume - md/raid1: factor out helpers to choose the best rdev from read_balance() - md/raid1: factor out the code to manage sequential IO - md/raid1: factor out choose_bb_rdev() from read_balance() - md/raid1: factor out choose_slow_rdev() from read_balance() - md/raid1: factor out read_first_rdev() from read_balance() - md/raid1-10: factor out a new helper raid1_should_read_first() - md/raid1-10: add a helper raid1_check_read_range() - md/raid1: fix choose next idle in read_balance() - md/raid1: record nonrot rdevs while adding/removing rdevs to conf - md/raid1: factor out helpers to add rdev to conf - md: add a new helper rdev_has_badblock() - md: check mddev->pers before calling md_set_readonly() - md: clean up openers check in do_md_stop() and md_set_readonly() - md: sync blockdev before stopping raid or setting readonly - md: factor out a helper to sync mddev - md: return directly before setting did_set_md_closing - md: changed the switch of RAID_VERSION to if - md: merge the check of capabilities into md_ioctl_valid() - md: Don't suspend the array for interrupted reshape - md: Don't register sync_thread for reshape directly - md: Make sure md_do_sync() will set MD_RECOVERY_DONE - md: Don't ignore read-only array in md_check_recovery() - md: Don't ignore suspended array in md_check_recovery() - md: get rdev->mddev with READ_ONCE() - md: remove redundant md_wakeup_thread() - md: remove redundant check of 'mddev->sync_thread' - md: fix a suspicious RCU usage warning - raid: Remove now superfluous sentinel element from ctl_table array - NFSD: NFSv4 file creation neglects setting ACL - nfsd: set security label during create operations - xfs: Add xfs_dir3_leaf_header_check() in leaf/leafn read - nvme-fc: use lock accessing port_state and rport state - x86/mm: Batch flushing user memory encrytion status change - !20588 [OLK-6.6] Revert "x86/csv: Enhance CMA memory usage reporting for CSV3" - Revert "x86/csv: Enhance CMA memory usage reporting for CSV3" - !20576 media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg() - !20575 RDMA/cm: Fix leaking the multicast GID table reference - !20580 RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly - !20551 Fix CVE-2025-68785 - !20478 f2fs: fix to avoid potential deadlock - !20501 [OLK-6.6] backport important bugfix for bnxt driver from upstream linux-6.6.y - !20520 Fix CVE-2026-23038 - !20424 net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup - !20425 mlx5: Fix default values in create CQ - RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly - media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg() - RDMA/cm: Fix leaking the multicast GID table reference - net: openvswitch: fix middle attribute validation in push_nsh() action - net: openvswitch: remove never-working support for setting nsh fields - pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() - bnxt_en: Fix potential data corruption with HW GRO/LRO - f2fs: fix to avoid potential deadlock - mlx5: Fix default values in create CQ - net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup - riscv kernel upgrade to 6.6.0-138.0.0 - Fixed system hang when boot systemd on spacemit k3 - riscv: perf vendor events: fix lrw core PMU event mapping - !20727 v2 bpf: sockmap fixes - !20741 scsi: qla2xxx: Sanitize payload size to prevent member overflow - !20744 fix CVE-2025-38449 - !20763 net: usb: asix: validate PHY address before use - !20762 smc91x: fix broken irq-context in PREEMPT_RT - !20293 [Hygon][6.6][EDAC] The width of hash value is 2 bits for Hygon family 18h model 6h processors - !20290 [Hygon][6.6][Bugfix] Bug fix for EDAC to use unicast instead of broadcast on hygon family 18h model 4h - !20289 [Hygon][6.6][Bugfix] Bug fix for EDAC to correct the address translation on hygon family 18h model 4h - !20245 KVM: arm64: Refactor exit handlers - !20246 KVM: arm64: Mark some header functions as inline - !19005 [Hygon] [OLK-6.6] [Bugfix] Fix memory bandwidth counter width for Hygon QoS - !20292 [Hygon][6.6][TSC Adjust] Backport x86 TSC adjust patch - !20273 [Hygon][6.6][Bugfix] Get correct CPU LLC ID in guest for Hygon processors - !20722 [OLK-6.6][linux-6.6.y sync] Backport 6.6.104-6.6.106 LTS Patches - !20667 fix CVE-2024-50102 - !20736 netfilter: nf_tables: remove redundant chain validation on register store - !20758 ub: ubase: Fixed the alarm issue caused by the initialization of the structure variable definition. - !20721 obmm: reduce log noise for successful export/import/preimport - net: usb: asix: validate PHY address before use - smc91x: fix broken irq-context in PREEMPT_RT - !20731 devlink: rate: Unset parent pointer in devl_rate_nodes_destroy - !20732 libceph: return the handler error from mon_handle_auth_done() - !20743 mm: slub: avoid wake up kswapd in set_track_prepare - ub: ubase: Fixed the alarm issue caused by the initialization of the structure variable definition. - !20750 ub: cdma: adapted to UMMU interface changes - !20713 urma: DFX of log in kernel - urma: optimize log levels for kernel space - ub: cdma: adapted to UMMU interface changes - wifi: ath11k: avoid bit operation on key flags - drm/mediatek: fix potential OF node use-after-free - cpufreq: intel_pstate: Check IDA only before MSR_IA32_PERF_CTL writes - wifi: cfg80211: sme: store capped length in __cfg80211_connect_result() - !20708 ub:hisi-ubus: Add create bus instance ummu bypass - drm: fix kabi for struct drm_framebuffer - drm/framebuffer: Acquire internal references on GEM handles - drm/gem: Acquire references on GEM handles for framebuffers - mm: slub: avoid wake up kswapd in set_track_prepare - scsi: qla2xxx: Sanitize payload size to prevent member overflow - netfilter: nf_tables: remove redundant chain validation on register store - libceph: return the handler error from mon_handle_auth_done() - devlink: rate: Unset parent pointer in devl_rate_nodes_destroy - Documentation/hw-vuln: Add VMSCAPE documentation - dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status() - riscv: use lw when reading int cpu in asm_per_cpu - mm: slub: avoid wake up kswapd in set_track_prepare - tools: gpio: remove the include directory on make clean - tools: gpio: rm .*.cmd on make clean - drm/amd/amdgpu: Fix missing error return on kzalloc failure - drm/amdgpu: Replace DRM_* with dev_* in amdgpu_psp.c - perf bpf-event: Fix use-after-free in synthesis - drm/bridge: ti-sn65dsi86: fix REFCLK setting - spi: spi-fsl-lpspi: Clear status register after disabling the module - spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort - spi: spi-fsl-lpspi: Set correct chip-select polarity bit - spi: spi-fsl-lpspi: Fix transmissions when using CONT - hwmon: mlxreg-fan: Prevent fans from getting stuck at 0 RPM - pcmcia: omap: Add missing check for platform_get_resource - Revert "drm/amdgpu: Avoid extra evict-restore process." - ALSA: hda/realtek: Fix headset mic for TongFang X6[AF]R5xxY - ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model - drm/mediatek: Fix device/node reference count leaks in mtk_drm_get_all_drm_priv - drm/mediatek: Fix using wrong drm private data to bind mediatek-drm - drm/mediatek: Add crtc path enum for all_drm_priv array - vmxnet3: update MTU after device quiesce - net: dsa: microchip: linearize skb for tail-tagging switches - net: dsa: microchip: update tag_ksz masks for KSZ9477 family - dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status() - ALSA: hda/realtek - Add new HP ZBook laptop with micmute led fixup - ALSA: hda/realtek: Add support for HP Agusta using CS35L41 HDA - iio: pressure: mprls0025pa: use aligned_s64 for timestamp - iio: chemical: pms7003: use aligned_s64 for timestamp - iio: imu: inv_mpu6050: align buffer for timestamp - thermal/drivers/mediatek/lvts: Disable low offset IRQ for minimum threshold - nouveau: fix disabling the nonstall irq due to storm code - cpufreq: intel_pstate: Unchecked MSR aceess in legacy mode - net: pcs: rzn1-miic: Correct MODCTRL register offset - platform/x86/amd/pmc: Add TUXEDO IB Pro Gen10 AMD to spurious 8042 quirks list - drm/amdgpu: drop hw access in non-DC audio fini - wifi: mt76: mt7996: Initialize hdr before passing to skb_put_data() - wifi: mwifiex: Initialize the chan_stats array to zero - tcp_bpf: Fix copied value in tcp_bpf_sendmsg - skmsg: Return copied bytes in sk_msg_memcopy_from_iter - tcp_bpf: Add sk_rmem_alloc related logic for tcp_bpf ingress redirection - Revert "bpf, sockmap: Add sk_rmem_alloc check for sockmap" - ALSA: usb-audio: Add mute TLV for playback volumes on some devices - phy: mscc: Stop taking ts_lock for tx_queue and use its own lock - selftest: net: Fix weird setsockopt() in bind_bhash.c. - net: atm: fix memory leak in atm_register_sysfs when device_register fail - ax25: properly unshare skbs in ax25_kiss_rcv() - mctp: return -ENOPROTOOPT for unknown getsockopt options - net/smc: Remove validation of reserved bits in CLC Decline message - ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init() - net: thunder_bgx: decrement cleanup index before use - net: thunder_bgx: add a missing of_node_put - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() - wifi: libertas: cap SSID len in lbs_associate() - wifi: cw1200: cap SSID length in cw1200_do_join() - net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets - wifi: ath11k: fix group data packet drops during rekey - wifi: ath11k: avoid forward declaration of ath11k_mac_start_vdev_delay() - wifi: ath11k: rename ath11k_start_vdev_delay() - wifi: ath11k: Introduce and use ath11k_sta_to_arsta() - net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() - macsec: read MACSEC_SA_ATTR_PN with nla_get_uint - netlink: add variable-length / auto integers - net: macb: Fix tx_ptr_lock locking - icmp: fix icmp_ndo_send address translation for reply direction - mISDN: Fix memory leak in dsp_hwec_enable() - xirc2ps_cs: fix register access when enabling FullDuplex - netfilter: conntrack: helper: Replace -EEXIST by -EBUSY - wifi: cfg80211: fix use-after-free in cmp_bss() - arm64: dts: imx8mp: Fix missing microSD slot vqmmc on Data Modul i.MX8M Plus eDM SBC - arm64: dts: imx8mp: Fix missing microSD slot vqmmc on DH electronics i.MX8M Plus DHCOM - tee: optee: ffa: fix a typo of "optee_ffa_api_is_compatible" - arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro - Bluetooth: hci_sync: Avoid adding default advertising on startup - cpupower: Fix a bug where the -t option of the set subcommand was not working. - drm/amd/display: Don't warn when missing DCE encoder caps - cdc_ncm: Flag Intel OEM version of Fibocom L850-GL as WWAN - LoongArch: Save LBT before FPU in setup_sigcontext() - btrfs: avoid load/store tearing races when checking if an inode was logged - btrfs: fix race between setting last_dir_index_offset and inode logging - btrfs: fix race between logging inode and checking if it was logged before - bpf: Fix oob access in cgroup local storage - !20556 urma: fix update topo logic - !20639 [OLK-6.6][linux-6.6.y sync] Backport 6.6.103-6.6.104 LTS Patches - !20641 [OLK-6.6][linux-6.6.y sync] LoongArch: Add more instruction opcodes and emit_* helpers - !20560 *** fix CVE-2025-38062 *** - !20662 pNFS: Fix a deadlock when returning a delegation during open() - ub:hisi-ubus: Add create bus instance ummu bypass - Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" - Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set" - HID: mcp2221: Handle reads greater than 60 bytes - HID: mcp2221: Don't set bus speed on every transfer - net/mlx5: SF, Fix add port error handling - drm/nouveau/disp: Always accept linear modifier - smb3 client: fix return code mapping of remap_file_range - net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions - dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted - HID: wacom: Add a new Art Pen 2 - HID: logitech: Add ids for G PRO 2 LIGHTSPEED - HID: quirks: add support for Legion Go dual dinput modes - net: stmmac: Set CIC bit only for TX queues with COE - net: stmmac: xgmac: Correct supported speed modes - net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts - net/mlx5e: Set local Xoff after FW update - net/mlx5e: Update and set Xon/Xoff upon port speed set - net/mlx5e: Update and set Xon/Xoff upon MTU set - net/mlx5: Nack sync reset when SFs are present - net/mlx5: Convert SF port_indices xarray to function_ids xarray - net/mlx5: Use devlink port pointer to get the pointer of container SF struct - net/mlx5: Call mlx5_sf_id_erase() once in mlx5_sf_dealloc() - phy: mscc: Fix when PTP clock is register and unregister - net: dlink: fix multicast stats being counted incorrectly - dt-bindings: display/msm: qcom,mdp5: drop lut clock - drm/nouveau: remove unused memory target test - drm/nouveau: remove unused increment in gm200_flcn_pio_imem_wr - Bluetooth: hci_sync: fix set_local_name race condition - Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced - Bluetooth: hci_event: Mark connection as closed during suspend disconnect - Bluetooth: hci_event: Treat UNKNOWN_CONN_ID on disconnect as success - HID: input: report battery status changes immediately - HID: input: rename hidinput_set_battery_charge_status() - powerpc/kvm: Fix ifdef to remove build warning - drm/msm: Defer fd_install in SUBMIT ioctl - vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() - ACPI: EC: Add device to acpi_ec_no_wakeup[] qurik list - erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC - ASoC: codecs: tx-macro: correct tx_macro_component_drv name - smb: client: fix race with concurrent opens in unlink(2) - scsi: core: sysfs: Correct sysfs attributes access rights - of: dynamic: Fix use after free in of_changeset_add_prop_helper() - of: Add a helper to free property struct - mips: lantiq: xway: sysctrl: rename the etop node - mips: dts: lantiq: danube: add missing burst length property - pinctrl: STMFX: add missing HAS_IOMEM dependency - of: dynamic: Fix memleak when of_pci_add_properties() failed - !20684 urma: adjust urma log format - !20355 udp: Deal with race between UDP socket address change and rehash - !20627 Fixes CVE-2025-38627 - !20702 CVE-2025-39948 - !20701 netfilter: ctnetlink: remove refcounting in expectation dumpers - !20700 CVE-2025-38678 - !20703 CVE-2025-38491 - !20690 tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. - obmm: reduce log noise for successful export/import/preimport - mptcp: avoid deadlock on fallback while reinjecting - mptcp: plug races between subflow fail and subflow creation - mptcp: make fallback action and fallback decision atomic - ice: fix Rx page leak on multi-buffer frames - ice: fix incorrect counter for buffer allocation failures - ice: stop storing XDP verdict within ice_rx_buf - ice: gather page_count()'s of each frag right before XDP prog call - ice: Introduce ice_xdp_buff - netfilter: ctnetlink: remove refcounting in expectation dumpers - netfilter: nf_tables: reject duplicate device on updates - netfilter: nf_tables: Introduce functions freeing nft_hook objects - netfilter: nf_tables: Fix percpu address space issues in nf_tables_api.c - err.h: add ERR_PTR_PCPU(), PTR_ERR_PCPU() and IS_ERR_PCPU() macros - tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. - !20498 Fix CVE-2025-71118 - !20608 pmdomain: arm: scmi: Fix genpd leak on provider registration failure - !20679 x86/CPU/AMD: Add RDSEED fix for Zen5 - !20650 fix cve-2025-40300 - !20661 Input: alps - fix use-after-free bugs caused by dev3_register_work - !20664 backport some net bugfix from 6.6 lts - urma: adjust urma log format - !20678 ub: udma: close debug switch load parameters. - ub: udma: close debug switch load parameters. - x86/CPU/AMD: Add RDSEED fix for Zen5 - !20630 net: LTS-6.6 bugfix backport - !20632 net/sched: sch_qfq: do not free existing class in qfq_change_class() - !20631 macvlan: fix possible UAF in macvlan_forward_source() - !20628 Fix CVE-2025-39910 - !20659 v2 Fix CVE-2025-22090 - !20506 XSched: Update XSched manual - !20647 media: imon: make send_packet() more robust - !20646 ksm: use range-walk function to jump over holes in scan_get_next_rmap_item - !20645 fbcon: Set fb_display[i - !20648 parse_longname(): strrchr() expects NUL-terminated string - !20621 urma: modify log level - !20602 urma: fix the jfe uaf issue that occurred during the killall process. - !20567 urma:change log level and pass status 9 - !20640 iio: common: st_sensors: Fix use of uninitialize device structs - !20634 usb: gadget: udc: fix use-after-free in usb_gadget_state_work - !20633 net: dsa: properly keep track of conduit reference - !20635 fix CVE-2025-68231 - !20651 mm/slub: avoid accessing metadata when pointer is invalid in object_err() - !20649 drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb - !20652 mm/vmalloc: fix data race in show_numa_info() - x86: uaccess: don't use runtime-const rewriting in modules - x86: fix off-by-one in access_ok() - x86: fix user address masking non-canonical speculation issue - x86/uaccess: Zero the 8-byte get_range case on failure on 32-bit - x86/uaccess: Improve the 8-byte getuser() case - x86: fix whitespace in runtime-const assembler output - dcache: keep dentry_hashtable or d_hash_shift even when not used - runtime constants: add x86 architecture support - runtime constants: deal with old decrepit linkers - x86/uaccess: Add missing __force to casts in __access_ok() and valid_user_address() - !20345 arm64: entry: xcall/xint: make asm conditionals compatible with clang IAS - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). - libceph: replace BUG_ON with bounds check for map->max_osd - libceph: prevent potential out-of-bounds writes in handle_auth_session_key() - libceph: fix potential use-after-free in have_mon_and_osd_map() - sctp: Hold sock lock while iterating over address list - sctp: Prevent TOCTOU out-of-bounds write - sctp: Hold RCU read lock while iterating over address list - tipc: Fix use-after-free in tipc_mon_reinit_self(). - sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto - sctp: avoid NULL dereference when chunk data buffer is missing - bpf: Explicitly check accesses to bpf_sock_addr - ipvs: Defer ip_vs_ftp unregister during netns cleanup - nexthop: Forbid FDB status change while nexthop is in a group - netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). - net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer - sctp: initialize more fields in sctp_v6_from_sk() - pNFS: Fix a deadlock when returning a delegation during open() - Input: alps - fix use-after-free bugs caused by dev3_register_work - x86/cpu: Get CPU LLC ID from CPUID 0x8000001d in guest for Hygon processors - kernel/fork: only call untrack_pfn_clear() on VMAs duplicated for fork() - mm: (un)track_pfn_copy() fix + doc improvements - x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range() - !20642 mtdchar: fix integer overflow in read/write ioctls - mm/vmalloc: fix data race in show_numa_info() - mm/slub: avoid accessing metadata when pointer is invalid in object_err() - config: enable CONFIG_MITIGATION_VMESCAPE by default on x86 - x86/vmscape: Enable the mitigation - x86/vmscape: Enumerate VMSCAPE bug - x86/vmscape: Add conditional IBPB mitigation - drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb - parse_longname(): strrchr() expects NUL-terminated string - media: imon: make send_packet() more robust - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item - fbcon: Set fb_display[i]->mode to NULL when the mode is released - !20569 CVE-2024-35808 - mtdchar: fix integer overflow in read/write ioctls - !20619 Fix CVE-2026-22991 - !20612 net: hns3: extend HCLGE_FD_AD_COUNTER_NUM to 8 bits - LoongArch: Add more instruction opcodes and emit_* helpers - iio: common: st_sensors: Fix use of uninitialize device structs - !20581 null_blk: fix kmemleak by releasing references to fault configfs items - mm/mempool: fix poisoning order>0 pages with HIGHMEM - mm/page_poison: replace kmap_atomic() with kmap_local_page() - mm/mempool: replace kmap_atomic() with kmap_local_page() - usb: gadget: udc: fix use-after-free in usb_gadget_state_work - net: dsa: properly keep track of conduit reference - net/sched: sch_qfq: do not free existing class in qfq_change_class() - macvlan: fix possible UAF in macvlan_forward_source() - netfilter: nft_objref: validate objref and objrefmap expressions - arp: do not assume dev_hard_header() does not change skb->head - ip6_gre: make ip6gre_header() robust - netfilter: nf_tables: avoid chain re-validation if possible - netfilter: nf_tables: drop unused 3rd argument from validate callback ops - Revert "netfilter: nft_objref: validate objref and objrefmap expressions" - bpf: Fix reference count leak in bpf_prog_test_run_xdp() - net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset - ethtool: Avoid overflowing userspace buffer on stats query - ipvs: fix ipv4 null-ptr-deref in route error path - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() - !20596 mm/page_alloc: prevent pcp corruption with SMP=n - !20598 team: fix check for port enabled in team_queue_override_port_prio_changed() - !18823 hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio - mm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc() - kasan: avoid sleepable page allocation from atomic context - f2fs: compress: fix UAF of f2fs_inode_info in f2fs_free_dic - f2fs: compress: change the first parameter of page_array_{alloc,free} to sbi - !20583 [OLK-6.6][linux-6.6.y sync] Backport 6.6.102-6.6.103 LTS Patches - !20460 fbdev: Fix vmalloc out-of-bounds write in fast_imageblit - urma:fix log level and pass status 9 - urma: modify log level - !20592 CVE-2025-71141 fixup - !20594 CVE-2025-39744 fixup - !20607 powerpc/64s/slb: Fix SLB multihit issue during SLB preload - !20606 mm/huge_memory: fix NULL pointer deference when splitting folio - !20604 Fix CVE-2026-22984 - !20603 Fix CVE-2026-23021 - !20600 Fix CVE-2026-22990 - urma: fix the jfe uaf issue that occurred during the killall process. - !20380 pswiotlb: Adapt to the IOMMU DMA API upgraded by IOMMUFD - libceph: make free_choose_arg_map() resilient to partial allocation - drm/dp: Change AUX DPCD probe address from LANE0_1_STATUS to TRAINING_PATTERN_SET - net: hns3: extend HCLGE_FD_AD_COUNTER_NUM to 8 bits - net: hns3: extend HCLGE_FD_AD_QID to 11 bits - net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue - net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M - Revert "net: hns3: add support for FD counter" - !20587 dmaengine: stm32: dmamux: fix device leak on route allocation - pmdomain: arm: scmi: Fix genpd leak on provider registration failure - powerpc/64s/slb: Fix SLB multihit issue during SLB preload - mm/huge_memory: fix NULL pointer deference when splitting folio - !20562 LoongArch: BPF: Sign extend kfunc call arguments - !20470 ipv4: Fix reference count leak when using error routes with nexthop objects - !20471 net: sock: fix hardened usercopy panic in sock_recv_errqueue - !20472 net: fix memory leak in skb_segment_list for GRO packets - !20473 ipv4: ip_gre: make ipgre_header() robust - !20469 SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf - !20476 ipv6: Fix use-after-free in inet6_addr_del(). - !20477 svcrdma: bound check rq_pages index in inline path - !20578 ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() - !20579 fix CVE-2025-68768 - !20542 Fix NFS deadlock - USB: storage: Remove subclass and protocol overrides from Novatek quirk - cpuidle: governors: menu: Select polling state in some more cases - cpuidle: governors: menu: Rearrange main loop in menu_select() - cpuidle: menu: Update documentation after previous changes - Revert "drm/tegra: dsi: Clear enable register if powered by bootloader" - parisc: Remove spurious if statement from raw_copy_from_user() - ata: libata-scsi: Fix system suspend for a security locked drive - Revert "drm/amdgpu: fix incorrect vm flags to map bo" - mfd: axp20x: Set explicit ID for regulator cell if no IRQ line is present - drm/amd/display: use udelay rather than fsleep - sched/fair: Revert max_newidle_lb_cost bump - net: ipv4: fix regression in local-broadcast routes - tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers - PM: runtime: Do not clear needs_force_resume with enabled runtime PM - usb: typec: ucsi: psy: Set max current to zero when disconnected - io_uring/rw: cast rw->flags assignment to rwf_t - Documentation: ACPI: i2c-muxes: fix I2C device references - s390/hypfs: Enable limited access during lockdown - s390/hypfs: Avoid unnecessary ioctl registration in debugfs - ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation - net/mlx5e: Preserve shared buffer capacity during headroom updates - net/mlx5: Base ECVF devlink port attrs from 0 - Octeontx2-af: Skip overlap check for SPI field - bonding: send LACPDUs periodically in passive mode after receiving partner's LACPDU - bonding: Add independent control state machine - bonding: update LACP activity flag after setting lacp_active - net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate - ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc - gve: prevent ethtool ops after shutdown - phy: mscc: Fix timestamping for vsc8584 - net: ethernet: mtk_ppe: add RCU lock around dev_fill_forward_path - ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add - net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM - ALSA: usb-audio: Fix size validation in convert_chmap_v3() - mlxsw: spectrum: Forward packets with an IPv4 link-local source IP - Bluetooth: hci_conn: do return error from hci_enhanced_setup_sync() - Bluetooth: hci_event: fix MTU for BN == 0 in CIS Established - scsi: qla4xxx: Prevent a potential error pointer dereference - RDMA/bnxt_re: Fix to initialize the PBL array - RDMA/bnxt_re: Fix to remove workload check in SRQ limit path - RDMA/bnxt_re: Fix to do SRQ armena by default - RDMA/erdma: Fix ignored return value of init_kernel_qp - iosys-map: Fix undefined behavior in iosys_map_clear() - cgroup/cpuset: Use static_branch_enable_cpuslocked() on cpusets_insane_config_key - spi: spi-fsl-lpspi: Clamp too high speed_hz - usb: typec: maxim_contaminant: disable low power mode when reading comparator values - usb: typec: maxim_contaminant: re-enable cc toggle if cc is open and port is clean - iio: imu: inv_icm42600: change invalid data error to -EBUSY - iio: imu: inv_icm42600: Convert to uXX and sXX integer types - iio: imu: inv_icm42600: use = { } instead of memset() - iio: imu: inv_icm42600: switch timestamp type from int64_t __aligned(8) to aligned_s64 - iio: temperature: maxim_thermocouple: use DMA-safe buffer for spi_read() - iio: light: as73211: Ensure buffer holes are zeroed - tls: fix handling of zero-length records on the rx_list - powerpc/boot: Fix build with gcc 15 - mmc: sdhci-pci-gli: GL9763e: Mask the replay timer timeout of AER - compiler: remove __ADDRESSABLE_ASM{_STR,}() again - drm/amd/display: Don't overclock DCE 6 by 15% - usb: dwc3: pci: add support for the Intel Wildcat Lake - usb: dwc3: Ignore late xferNotReady event to prevent halt timeout - USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles - usb: storage: realtek_cr: Use correct byte order for bcs->Residue - USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera - usb: renesas-xhci: Fix External ROM access timeouts - usb: core: hcd: fix accessing unmapped memory in SINGLE_STEP_SET_FEATURE test - comedi: Make insn_rw_emulate_bits() do insn->n samples - usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive - cdx: Fix off-by-one error in cdx_rpmsg_probe() - most: core: Drop device reference after usage in get_channel() - iio: proximity: isl29501: fix buffered read on big-endian systems - iio: pressure: bmp280: Use IS_ERR() in bmp280_common_probe() - fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable() - drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS - cpuidle: governors: menu: Avoid selecting states with too much latency - cpuidle: menu: Remove iowait influence - mmc: sdhci-pci-gli: Add a new function to simplify the code - mmc: sdhci-pci-gli: Use PCI AER definitions, not hard-coded values - mptcp: disable add_addr retransmission when timeout is 0 - mptcp: remove duplicate sk_reset_timer call - use uniform permission checks for all mount propagation changes - arm64: dts: ti: k3-am62-main: Remove eMMC High Speed DDR support - scsi: mpi3mr: Serialize admin queue BAR writes on 32-bit systems - scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers - scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE - PCI: imx6: Add IMX8MM_EP and IMX8MP_EP fixed 256-byte BAR 4 in epc_features - PCI: imx6: Delay link start until configfs 'start' written - PCI: rockchip: Set Target Link Speed to 5.0 GT/s before retraining - PCI: rockchip: Use standard PCIe definitions - drm/amd/display: Fill display clock and vblank time in dce110_fill_display_configs - drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs - drm/amd/display: Fix DP audio DTO1 clock source on DCE 6. - drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3 - ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and EliteBook 830 G6 - mm/debug_vm_pgtable: clear page table entries at destroy_args() - squashfs: fix memory leak in squashfs_fill_super - mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for consistency - memstick: Fix deadlock by moving removing flag earlier - KVM: arm64: Fix kernel BUG() due to bad backport of FPSIMD/SVE/SME fix - sched/fair: Fix frequency selection for non-invariant case - kbuild: userprogs: use correct linker when mixing clang and GNU ld - ata: libata-scsi: Return aborted command when missing sense and result TF - PM: runtime: Take active children into account in pm_runtime_get_if_in_use() - PM: runtime: Simplify pm_runtime_get_if_active() usage - ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig - usb: dwc3: imx8mp: fix device leak at unbind - wifi: mac80211: check basic rates validity in sta_link_apply_parameters - KVM: x86: Take irqfds.lock when adding/deleting IRQ bypass producer - s390/mm: Remove possible false-positive warning in pte_free_defer() - btrfs: send: make fs_path_len() inline and constify its argument - btrfs: send: use fallocate for hole punching with send stream v2 - btrfs: send: avoid path allocation for the current inode when issuing commands - btrfs: send: keep the current inode's path cached - btrfs: send: add and use helper to rename current inode when processing refs - btrfs: send: only use boolean variables at process_recorded_refs() - btrfs: send: factor out common logic when sending xattrs - btrfs: populate otime when logging an inode item - btrfs: constify more pointer parameters - btrfs: fix ssd_spread overallocation - btrfs: open code timespec64 in struct btrfs_inode - xfs: fully decouple XFS_IBULK* flags from XFS_IWALK* flags - btrfs: abort transaction on unexpected eb generation at btrfs_copy_root() - btrfs: always abort transaction on failure to add block group to free space tree - btrfs: move transaction aborts to the error site in add_block_group_free_space() - btrfs: qgroup: fix race between quota disable and quota rescan ioctl - usb: typec: fusb302: cache PD RX state - block: Make REQ_OP_ZONE_FINISH a write operation - block: reject invalid operation in submit_bio_noacct - leds: flash: leds-qcom-flash: Fix registry access after re-bind - leds: flash: leds-qcom-flash: Limit LED current based on thermal condition - selftests/memfd: add test for mapping write-sealed memfd read-only - mm: update memfd seal write check to include F_SEAL_WRITE - mptcp: pm: kernel: flush: do not reset ADD_ADDR limit - mptcp: drop skb if MPTCP skb extension allocation fails - ipv6: sr: Fix MAC comparison to be constant-time - drm/amd/display: Don't overwrite dce60_clk_mgr - drm/amd/display: Add primary plane to commits for correct VRR handling - drm/amdkfd: Destroy KFD debugfs after destroy KFD wq - drm/amdgpu: update mmhub 3.0.1 client id mappings - drm/amdgpu: Avoid extra evict-restore process. - drm/amd: Restore cached power limit during resume - media: venus: venc: Clamp param smaller than 1fps and bigger than 240 - media: venus: vdec: Clamp param smaller than 1fps and bigger than 240. - media: venus: protect against spurious interrupts during probe - media: venus: hfi: explicitly release IRQ during teardown - media: qcom: camss: cleanup media device allocated resource on error path - media: ov2659: Fix memory leaks in ov2659_probe() - media: usbtv: Lock resolution while streaming - media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free() - media: verisilicon: Fix AV1 decoder clock frequency - media: vivid: fix wrong pixel_array control size - media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init() - media: hi556: correct the test pattern configuration - media: gspca: Add bounds checking to firmware parser - parisc: Update comments in make_insert_tlb - parisc: Try to fixup kernel exception in bad_area_nosemaphore path of do_page_fault() - parisc: Rename pte_needs_flush() to pte_needs_cache_flush() in cache.c - parisc: Makefile: explain that 64BIT requires both 32-bit and 64-bit compilers - parisc: Define and use set_pte_at() - parisc: Check region is readable by user in raw_copy_from_user() - soc/tegra: pmc: Ensure power-domains are in a known state - f2fs: fix to avoid out-of-boundary access in dnode page - phy: qcom: phy-qcom-m31: Update IPQ5332 M31 USB phy initialization sequence - vhost/vsock: Avoid allocating arbitrarily-sized SKBs - PCI: endpoint: Fix configfs group removal on driver teardown - PCI: endpoint: Fix configfs group list head handling - mtd: rawnand: renesas: Add missing check after DMA map - mtd: rawnand: fsmc: Add missing check after DMA map - mtd: spinand: propagate spinand_wait() errors from spinand_write_page() - mtd: spi-nor: Fix spi_nor_try_unlock_all() - hwmon: (gsc-hwmon) fix fan pwm setpoint show functions - pwm: mediatek: Fix duty and period setting - pwm: mediatek: Handle hardware enable and clock enable separately - pwm: imx-tpm: Reset counter if CMOD is 0 - wifi: ath11k: fix dest ring-buffer corruption when ring is full - wifi: ath11k: fix source ring-buffer corruption - wifi: ath11k: fix dest ring-buffer corruption - wifi: ath12k: fix dest ring-buffer corruption when ring is full - wifi: ath12k: fix source ring-buffer corruption - wifi: ath12k: fix dest ring-buffer corruption - wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table() - iio: adc: ad_sigma_delta: change to buffer predisable - zynq_fpga: use sgtable-based scatterlist wrappers - scsi: ufs: ufs-pci: Fix default runtime and system PM levels - scsi: ufs: ufs-pci: Fix hibernate state transition for Intel MTL-like host controllers - ata: libata-scsi: Fix ata_to_sense_error() status handling - scsi: mpi3mr: Fix race between config read submit and interrupt completion - dt-bindings: display: sprd,sharkl3-dsi-host: Fix missing clocks constraints - dt-bindings: display: sprd,sharkl3-dpu: Fix missing clocks constraints - arm64: dts: ti: k3-am62-verdin: Enable pull-ups on I2C buses - arm64: dts: ti: k3-am62a7-sk: fix pinmux for main_uart1 - arm64: dts: ti: k3-pinctrl: Enable Schmitt Trigger by default - btrfs: zoned: fix write time activation failure for metadata block group - ext4: fix hole length calculation overflow in non-extent inodes - ext4: don't try to clear the orphan_present feature block device is r/o - ext4: fix reserved gdt blocks handling in fsmap - ext4: fix fsmap end of range reporting with bigalloc - ext4: check fast symlink for ea_inode correctly - tracing: fprobe-event: Sanitize wildcard for fprobe event name - crypto: qat - lower priority for skcipher and aead algorithms - lib/crypto: mips/chacha: Fix clang build and remove unneeded byteswap - vt: defkeymap: Map keycodes above 127 to K_HOLE - vt: keyboard: Don't process Unicode characters in K_OFF mode - bus: mhi: host: Fix endianness of BHI vector table - usb: dwc3: meson-g12a: fix device leaks at unbind - usb: musb: omap2430: fix device leak at unbind - usb: gadget: udc: renesas_usb3: fix device leak at unbind - usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init() - m68k: Fix lost column on framebuffer debug console - platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister() - cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table() - rcu: Fix racy re-initialization of irq_work causing hangs - HID: apple: avoid setting up battery timer for devices without battery - HID: magicmouse: avoid setting up battery timer when not needed - RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages - tools/nolibc: fix spelling of FD_SETBITMASK in FD_* macros - media: uvcvideo: Do not mark valid metadata as invalid - media: venus: Fix OOB read due to missing payload bound check - parisc: Makefile: fix a typo in palo.conf - fbdev: Fix vmalloc out-of-bounds write in fast_imageblit - btrfs: do not allow relocation of partially dropped subvolumes - btrfs: zoned: do not select metadata BG as finish target - btrfs: clear dirty status from extent buffer on error at insert_new_root() - btrfs: zoned: do not remove unwritten non-data block group - btrfs: abort transaction during log replay if walk_log_tree() failed - btrfs: zoned: use filesystem size not disk size for reclaim decision - cdc-acm: fix race between initial clearing halt and open - thunderbolt: Fix copy+paste error in match_service_id() - usb: typec: ucsi: Update power_supply on power role change - misc: rtsx: usb: Ensure mmc child device is active when card is present - iommufd: Report unmapped bytes in the error path of iopt_unmap_iova_range - cifs: reset iface weights when we cannot find a candidate - drm/amdgpu: fix incorrect vm flags to map bo - scsi: lpfc: Remove redundant assignment to avoid memory leak - rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe - pNFS: Handle RPC size limit for layoutcommits - pNFS: Fix disk addr range check in block/scsi layout - pNFS: Fix stripe mapping in block/scsi layout - ASoC: Intel: avs: Fix uninitialized pointer error in probe() - net: phy: smsc: add proper reset flags for LAN8710A - ipmi: Fix strcpy source and destination the same - kconfig: lxdialog: fix 'space' to (de)select options - kconfig: gconf: fix potential memory leak in renderer_edited() - kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed() - ipmi: Use dev_warn_ratelimited() for incorrect message warnings - vfio/mlx5: fix possible overflow in tracking max message size - scsi: aacraid: Stop using PCI_IRQ_AFFINITY - scsi: target: core: Generate correct identifiers for PR OUT transport IDs - scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans - kconfig: nconf: Ensure null termination where strncpy is used - vfio/type1: conditional rescheduling while pinning - kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c - f2fs: check the generic conditions first - exfat: add cluster chain loop check for dir - i2c: Force DLL0945 touchpad i2c freq to 100khz - apparmor: use the condition in AA_BUG_FMT even with debug disabled - dm-table: fix checking for rq stackable devices - dm-mpath: don't print the "loaded" message if registering fails - i3c: master: Initialize ret in i3c_i2c_notifier_call() - i3c: don't fail if GETHDRCAP is unsupported - apparmor: shift ouid when mediating hard links in userns - rtc: ds1307: handle oscillator stop flag (OSF) for ds1341 - i3c: add missing include to internal header - module: Prevent silent truncation of module name in delete_module(2) - md: dm-zoned-target: Initialize return variable r to avoid uninitialized use - soundwire: Move handle_nested_irq outside of sdw_dev_lock - soundwire: amd: serialize amd manager resume sequence during pm_prepare - crypto: octeontx2 - add timeout for load_fvc completion poll - media: uvcvideo: Fix bandwidth issue for Alcor camera - media: usb: hdpvr: disable zero-length read messages - media: tc358743: Increase FIFO trigger level to 374 - media: tc358743: Return an appropriate colorspace from tc358743_set_fmt - media: tc358743: Check I2C succeeded during probe - pinctrl: stm32: Manage irq affinity settings - scsi: mpi3mr: Correctly handle ATA device errors - scsi: mpt3sas: Correctly handle ATA device errors - power: supply: qcom_battmgr: Add lithium-polymer entry - RDMA/core: reduce stack using in nldev_stat_get_doit() - dmaengine: stm32-dma: configure next sg only if there are more than 2 sgs - leds: leds-lp50xx: Handle reg to get correct multi_index - media: v4l2-common: Reduce warnings about missing V4L2_CID_LINK_FREQ control - MIPS: lantiq: falcon: sysctrl: fix request memory check logic - crypto: jitter - fix intermediary handling - watchdog: iTCO_wdt: Report error if timeout configuration fails - MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free} - clk: qcom: ipq5018: keep XO clock always on - hwmon: (emc2305) Set initial PWM minimum value during probe based on thermal state - watchdog: dw_wdt: Fix default timeout - fs/orangefs: use snprintf() instead of sprintf() - phy: rockchip-pcie: Properly disable TEST_WRITE strobe signal - mfd: axp20x: Set explicit ID for AXP313 regulator - clk: tegra: periph: Fix error handling and resolve unsigned compare warning - fbdev: fix potential buffer overflow in do_register_framebuffer() - cifs: Fix calling CIFSFindFirst() for root path without msearch - watchdog: sbsa: Adjust keepalive timeout to avoid MediaTek WS0 race condition - drm/amd/display: Avoid configuring PSR granularity if PSR-SU not supported - drm/amd/display: Only finalize atomic_obj if it was initialized - vhost: fail early when __vhost_add_used() fails - vsock/virtio: Resize receive buffers so that each SKB fits in a 4K page - net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325 - rcu: Fix rcu_read_unlock() deadloop due to IRQ work - drm/amd/display: Avoid trying AUX transactions on disconnected ports - selftests/bpf: Fix a user_ringbuf failure with arm64 64KB page size - bpf: Make reg_not_null() true for CONST_PTR_TO_MAP - uapi: in6: restore visibility of most IPv6 socket options - drm/ttm: Should to return the evict error - drm: renesas: rz-du: mipi_dsi: Add min check for VCLK range - net: ncsi: Fix buffer overflow in fetching version id - ionic: clean dbpage in de-init - wifi: rtlwifi: fix possible skb memory leak in _rtl_pci_init_one_rxdesc() - ptp: Use ratelimite for freerun error message - bpftool: Fix JSON writer resource leak in version command - net: dsa: b53: prevent SWITCH_CTRL access on BCM5325 - net: dsa: b53: prevent DIS_LEARNING access on BCM5325 - net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325 - net: dsa: b53: fix b53_imp_vlan_setup for BCM5325 - gve: Return error for unknown admin queue command - net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs - net: vlan: Make is_vlan_dev() a stub when VLAN is not configured - drm/amd: Allow printing VanGogh OD SCLK levels without setting dpm to manual - dpaa_eth: don't use fixed_phy_change_carrier - wifi: iwlegacy: Check rate_idx range after addition - netmem: fix skb_frag_address_safe with unreadable skbs - powerpc: floppy: Add missing checks after DMA map - wifi: ath12k: Decrement TID on RX peer frag setup error handling - wifi: ath12k: Enable REO queue lookup table feature on QCN9274 hw2.0 - wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`. - wifi: mac80211: update radar_required in channel context after channel switch - drm/amd/display: Fix 'failed to blank crtc!' - wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect - wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd() - wifi: ath12k: Add memset and update default rate value in wmi tx completion - drm/amd/display: Separate set_gsl from set_gsl_source_select - net: fec: allow disable coalescing - net: atlantic: add set_power to fw_ops for atl2 to fix wol - net: thunderbolt: Fix the parameter passing of tb_xdomain_enable_paths()/tb_xdomain_disable_paths() - net: thunderbolt: Enable end-to-end flow control also in transmit - kselftest/arm64: Specify SVE data when testing VL set in sve-ptrace - wifi: mt76: mt7915: mcu: re-init MCU before loading FW patch - wifi: rtw89: Disable deep power saving for USB/SDIO - wifi: rtw89: Fix rtw89_mac_power_switch() for USB - drm/msm: use trylock for debugfs - wifi: mac80211: fix rx link assignment for non-MLO stations - ipv6: mcast: Check inet6_dev->dead under idev->mc_lock in __ipv6_dev_mc_inc(). - (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer - wifi: mac80211: don't complete management TX on SAE commit - sched/fair: Bump sd->max_newidle_lb_cost when newidle balance fails - s390/stp: Remove udelay from stp_sync_clock() - wifi: iwlwifi: mvm: fix scan request validation - um: Re-evaluate thread flags repeatedly - wifi: iwlwifi: mvm: set gtk id also in older FWs - perf/cxlpmu: Remove unintended newline from IRQ name format string - net: phy: micrel: Add ksz9131_resume() - net: thunderx: Fix format-truncation warning in bgx_acpi_match_id() - net: ipv4: fix incorrect MTU in broadcast routes - wifi: cfg80211: Fix interface type validation - net: mctp: Prevent duplicate binds - arm64: Mark kernel as tainted on SAE and SError panic - net/mlx5e: Properly access RCU protected qdisc_sleeping variable - net: ag71xx: Add missing check after DMA map - et131x: Add missing check after DMA map - wifi: rtw89: Lower the timeout in rtw89_fw_read_c2h_reg() for USB - be2net: Use correct byte order and format string for TCP seq and ack_seq - s390/time: Use monotonic clock in get_cycles() - wifi: cfg80211: reject HTC bit for management frames - ktest.pl: Prevent recursion of default variable options - wifi: ath12k: Correct tid cleanup when tid setup fails - net: usb: cdc-ncm: check for filtering capability - xen/netfront: Fix TX response spurious interrupts - Bluetooth: hci_sock: Reset cookie to zero in hci_sock_free_cookie() - powerpc/thp: tracing: Hide hugepage events under CONFIG_PPC_BOOK3S_64 - ASoC: qcom: use drvdata instead of component to keep id - ASoC: codecs: rt5640: Retry DEVICE_ID verification - iio: adc: ad7768-1: Ensure SYNC_IN pulse minimum timing requirement - ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros - ALSA: pcm: Rewrite recalculate_boundary() to avoid costly loop - platform/chrome: cros_ec_typec: Defer probe on missing EC parent - platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches - soc: qcom: mdt_loader: Actually use the e_phoff - imx8m-blk-ctrl: set ISI panic write hurry level - pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop() - usb: core: usb_submit_urb: downgrade type check - usb: typec: intel_pmc_mux: Defer probe if SCU IPC isn't present - ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4 - ASoC: hdac_hdmi: Rate limit logging on connection and disconnection - ALSA: hda: Disable jack polling at shutdown - ALSA: hda: Handle the jack polling always via a work - mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode() - mei: bus: Check for still connected devices in mei_cl_bus_dev_release() - char: misc: Fix improper and inaccurate error code returned by misc_init() - reset: brcmstb: Enable reset drivers for ARCH_BCM2835 - pps: clients: gpio: fix interrupt handling order in remove path - ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path - mmc: sdhci-msm: Ensure SD card power isn't ON when card removed - ACPI: processor: fix acpi_object initialization - PM: sleep: console: Fix the black screen issue - thermal: sysfs: Return ENODATA instead of EAGAIN for reads - PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit() - firmware: tegra: Fix IVC dependency problems - ACPI: PRM: Reduce unnecessary printing to avoid user confusion - selftests: tracing: Use mutex_unlock for testing glob filter - tools/build: Fix s390(x) cross-compilation with clang - gpio: tps65912: check the return value of regmap_update_bits() - iio: adc: ad_sigma_delta: don't overallocate scan buffer - tools/nolibc: define time_t in terms of __kernel_old_time_t - thermal/drivers/qcom-spmi-temp-alarm: Enable stage 2 shutdown when required - ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed - EDAC/synopsys: Clear the ECC counters on init - gpio: wcd934x: check the return value of regmap_update_bits() - remoteproc: imx_rproc: skip clock enable when M-core is managed by the SCU - soc: qcom: rpmh-rsc: Add RSC version 4 support - usb: xhci: Avoid showing errors during surprise removal - usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command - usb: xhci: Avoid showing warnings for dying controller - usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default - selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t - cpufreq: CPPC: Mark driver with NEED_UPDATE_LIMITS flag - platform/x86/amd: pmc: Add Lenovo Yoga 6 13ALC6 to pmc quirk list - usb: xhci: print xhci->xhc_state when queue_command failed - tracefs: Add d_delete to remove negative dentries - securityfs: don't pin dentries twice, once is enough... - fix locking in efi_secret_unlink() - ext2: Handle fiemap on empty files to prevent EINVAL - fs/ntfs3: correctly create symlink for relative path - fs/ntfs3: Add sanity check for file name - better lockdep annotations for simple_recursive_removal() - hfs: fix not erasing deleted b-tree node issue - drbd: add missing kref_get in handle_write_conflicts - udf: Verify partition map count - gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops - nvme-pci: try function level reset on init failure - smb/server: avoid deadlock when linking with ReplaceIfExists - arm64: Handle KCOV __init vs inline mismatches - ptp: prevent possible ABBA deadlock in ptp_clock_freerun() - intel_idle: Allow loading ACPI tables for any family - net: ti: icss-iep: Fix incorrect type for return value in extts_enable() - netfilter: ctnetlink: fix refcount leak on table dump - udp: also consider secpath when evaluating ipsec use for checksumming - KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs - KVM: nVMX: Check vmcs12->guest_ia32_debugctl on nested VM-Enter - KVM: VMX: Extract checking of guest's DEBUGCTL into helper - KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported - KVM: VMX: Handle forced exit due to preemption timer in fastpath - KVM: VMX: Re-enter guest in fastpath for "spurious" preemption timer exits - KVM: x86: Plumb "force_immediate_exit" into kvm_entry() tracepoint - libceph: prevent potential out-of-bounds reads in handle_auth_done() - net: usb: pegasus: fix memory leak in update_eth_regs_async() - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() - !20540 urma: added support for ipoverurma - team: fix check for port enabled in team_queue_override_port_prio_changed() - mm/page_alloc: prevent pcp corruption with SMP=n - !20528 Fix CVE-2025-71083 - KVM: nVMX: Defer SVI update to vmcs01 on EOI when L2 is active w/o VID - KVM: x86: Plumb in the vCPU to kvm_x86_ops.hwapic_isr_update() - KVM: SVM: Set RFLAGS.IF=1 in C code, to get VMRUN out of the STI shadow - smb: client: don't wait for info->send_pending == 0 on error - smb: client: let send_done() cleanup before calling smbd_disconnect_rdma_connection() - ACPI: processor: perflib: Move problematic pr->performance check - ACPI: processor: perflib: Fix initial _PPC limit application - Documentation: ACPI: Fix parent device references - fs: Prevent file descriptor table allocations exceeding INT_MAX - sunvdc: Balance device refcount in vdc_port_mpgroup_check - PCI: Extend isolated function probing to LoongArch - NFSD: detect mismatch of file handle and delegation stateid in OPEN op - net: dpaa: fix device leak when querying time stamp info - net: ti: icss-iep: fix device and OF node leaks at probe - net: mtk_eth_soc: fix device leak at probe - net: enetc: fix device and OF node leak at probe - net: gianfar: fix device leak when querying time stamp info - net: phy: micrel: fix KSZ8081/KSZ8091 cable test - gpio: mlxbf3: use platform_get_irq_optional() - gpio: mlxbf2: use platform_get_irq_optional() - gpio: virtio: Fix config space reading. - ALSA: hda/realtek: Add Framework Laptop 13 (AMD Ryzen AI 300) to quirks - ALSA: hda/realtek: Fix headset mic on HONOR BRB-X - ALSA: usb-audio: Validate UAC3 cluster segment descriptors - rcu: Fix racy re-initialization of irq_work causing hangs - rcu: Fix rcu_read_unlock() deadloop due to IRQ work - drm/tilcdc: Fix removal actions in case of failed probe - drm/tilcdc: request and mapp iomem with devres - urma: fix update topo logic - dmaengine: stm32: dmamux: fix device leak on route allocation - pswiotlb: Adapt to the IOMMU DMA API upgraded by IOMMUFD - null_blk: fix kmemleak by releasing references to fault configfs items - inet: frags: flush pending skbs in fqdir_pre_exit() - inet: frags: add inet_frag_queue_flush() - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() - md/dm-raid: don't clear MD_RECOVERY_FROZEN after setting frozen - md/dm-raid: don't call md_reap_sync_thread() directly - ACPICA: Avoid walking the Namespace if start_node is NULL - arm64: entry: xcall/xint: make asm conditionals compatible with clang IAS - LoongArch: BPF: Sign extend kfunc call arguments - genirq/msi:: Fix kabi break of struct msi_desc - genirq/msi: Store the IOMMU IOVA directly in msi_desc instead of iommu_cookie - NFS: Fix a deadlock involving nfs_release_folio() - Revert "[Huawei] Revert "NFS: fix up nfs_release_folio() to try to release the page"" - urma: added support for ipoverurma - drm/ttm: Avoid NULL pointer deref for evicted BOs - XSched: Update XSched manual - svcrdma: bound check rq_pages index in inline path - ipv6: Fix use-after-free in inet6_addr_del(). - ipv4: ip_gre: make ipgre_header() robust - net: fix memory leak in skb_segment_list for GRO packets - net: sock: fix hardened usercopy panic in sock_recv_errqueue - ipv4: Fix reference count leak when using error routes with nexthop objects - SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf - fbdev: Fix vmalloc out-of-bounds write in fast_imageblit - udp: Deal with race between UDP socket address change and rehash - EDAC/amd64: The width of hash value is 2 bits for Hygon family 18h model 6h processors - x86/tsc: Use topology_max_packages() to get package number - EDAC/amd64: Use unicast instead of broadcast to access the cs_config register - EDAC/amd64: Correct the address translation for hygon family 18h model 4h - KVM: arm64: Mark some header functions as inline - KVM: arm64: Refactor exit handlers - x86/resctrl: Fix memory bandwidth counter width for Hygon CPUs - hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio - !20820 ub/obmm: add sysfs interface for mempool statistics & bugfixes - ub/obmm: fix wrong pxm_numa parameter validation - ub/obmm: Remove unused parameters from obmm_addr_check.c - ub/obmm: Enhance mem_allocator_granu validation - ub/obmm: simplify allocator naming scheme - ub/obmm: fix allow_slow logic and optimize conti_alloc_memory - ub/obmm: add sysfs interface with fine-grained memory statistics - !20804 net: hv_netvsc: reject RSS hash key programming without RX indirection table - !20813 migrate: correct lock ordering for hugetlb file folios - !20812 libceph: make calc_target() set t->paused, not just clear it - !20719 drivers/ub/sentry: some bugfix - !20798 urma: log should not retrieve eid_idx from uctx - !20808 urma: support triple bonding device - urma: log should not retrieve eid_idx from uctx - migrate: correct lock ordering for hugetlb file folios - libceph: make calc_target() set t->paused, not just clear it - !20745 vfio platform VFIO support for hisi05a1 devices - urma: support triple bonding device - net: hv_netvsc: reject RSS hash key programming without RX indirection table - !20789 gic: Add hip09 support for HISILICON_ERRATUM_165010801 - !20726 tracing: Add recursion protection in kernel stack trace recording - !20668 irqchip/gic-v3-its: Avoid truncating memory addresses - !20795 ub: udma: support query and set qos info. - !20791 Migration/urma:optimize performance in live migration. - ub: udma: Support for UE link establishment message. - Migration/urma: optimize performance in live migration. - !20787 ub: cdma: modify the method of assigning values to the structure - !20759 ubcore: hotfix route query for port eid on the same node. - ub: udma: support query and set qos info. - Revert "ub: ubase: Support for RC saved by queue granularity" - ubcore: hotfix route query for port eid on the same node. - !20676 urma: set/get sl - !20765 urma: bugfix of UAF and double free in ubcm - !20778 ub: ubase&unic: Fixes some bugfix in resetting and dfx ability - gic: Add hip09 support for HISILICON_ERRATUM_165010801 - vfio/platform: Add CONFIG_VFIO_HISI05A1 to openeuler_defconfig and turn it on by default - vfio/platform: VFIO support for hisi05a1 devices - ub: cdma: modify the method of assigning values to the structure - urma: set/get sl - ub: ubase: support to query ub dl pkt stats and real-time peak bandwidth - ub: ubase: Support for RC saved by queue granularity - ub: ubase: Traverse mailbox AE events using interrupts and polling. - ub: ubase: Modify ubase ctrlq trace to distinguish between MUE and UE messages - net: unic: The function of dumping himac registers is added. - ub: ubase: Fix MAC is_pfc sync, optimize list ops and code style - ub: ubase: Retain the initial tm qset configuration and restore it - net: unic: Fixed an issue in the bond IP address notification and pause configuration when an exception occurs. - ub: ubase: Add a retransmission function to improve reliability. - net: unic: Increase the readability and reliability of loopback code - net: unic: Synchronize the code modify for ip management and deactivation - net: unic: Increase the readability and reliability of VLAN feature. - net: unic: Added unic DFX log information. - ub: ubase: Add and correct comments for some functions and data structures - net: unic: Notify MAMI when the bond port status changes - ub: ubase: Support for HIMAC reset during ELR reset and Optimize ELR reset - !20768 iommu/ummu-core: Fix separate page table compatibility - !20665 [OLK-6.6] Enhance CMA memory usage reporting for CSV3 - !20764 net: hns3: fix double free issue for tx spare buffer - urma: bugfix of UAF and double free in ubcm - iommu/ummu-core: Fix separate page table compatibility - net: hns3: fix double free issue for tx spare buffer - drivers/ub/sentry: fix memory leak in sentry_msg_helper - drivers/ub/sentry: initialize some variables - drivers/ub/sentry: fix potential buffer overflow in convert_str_to_smh_msg() - drivers/ub/sentry: fix potential null pointer reference in sentry_uvb_comm - drivers/ub/sentry: add input parameter verification for exported symbols - tracing: Add recursion protection in kernel stack trace recording - x86/csv: Enhance CMA memory usage reporting for CSV3 - irqchip/gic-v3-its: Avoid truncating memory addresses - change the package name of 64KB page size kernel to kernel-64k - !20704 kernel support hisi-cca-da - !20180 [virtCCA Live Migration 2]virtcca secure cvm supports live migration - !20905 v2 KVM: arm64: Fix softirq masking in FPSIMD register saving sequence - !20965 iommu/ummu: Optimized TID invalidation and tdev initialization - !20964 iommu/ummu: Support TID and EID Granularity for MPAM - !20970 ub: ubase&unic: Supporting the black box capability of the ubase&unic driver - hisi-cca-da: Start dev by rsi call - hisi-cca-da: Set ripas of the bar region as RIPAS_DEV - hisi-cca-da: Support swiotlb and realm memory use - hisi-cca-da: Add smmu info when dev attach - hisi-cca-da: Transfer realm msix access to rmm - hisi-cca-da: Support pcipc sriov capability - hisi-cca-da: Delay realm memory release to kvm_destroy_realm - hisi-cca-da: Create realm s2 host pgtable and map msi mmio to rmm - hisi-cca-da: Add cca realm s2 pgtable framework - hisi-cca-da: Use bitmap to determine whether the command can be forwarded - hisi-cca-da: Restrict Realm SMMU to stage-2 domain only - hisi-cca-da: Add cmd forward mechanism in realm smmu - hisi-cca-da: Add realm smmu event and gerror irq initialization - hisi-cca-da: Add realm smmu stream table initialization - hisi-cca-da: Add realm smmu cmdq and evtq initialization - hisi-cca-da: Add realm smmu initialization - hisi-cca-da: Add relam iommu support to iommufd - hisi-cca-da: Add realm iommu support for vfio-iommu-type1 - hisi-cca-da: Support dev map and unmap - hisi-cca-da: Support dev validate and dev start - hisi-cca-da: VFIO support ccada - hisi-cca-da: Support dev delegate and dev attach - hisi-cca-da: Support root dev delegate and dev init - hisi-cca-da: Add hisilicon extension smc and ccada cmd - hisi-cca-da: Add hisi ccada feature config - !20751 ARM CCA supports hugepage - !20944 ub: ubmempfd: supports for D2H mapping and demapping - !20888 HiSock Enhancement - ub: ubase&unic: Supporting the black box capability of the ubase&unic driver. - net: unic: Resolve the residual MAC address problem - net: unic: Optimized the code for the cmd structure and FEC function. - ub: ubase: add log for post mailbox timeout - ub: ubus: Remove black box header file to include dir - rme: Remove the secret bit of the vring desc addr - rme: improve hisi-cca data mmap and destroy method - !20943 uvb: fix wd_obtain logic err - !20942 urma: fix bond device id not release - !20892 dcache: Limit the minimal number of bucket to two - rme: isolate page when do delegation to avoid migration - rme: hisi-cca supports different levels for mapping ram - rme: rename ccal to hisi-cca - rme: support set ripas for ccal realm vm - rme: support destroy ram data for ccal realm vm - rme: support populate region for ccal realm vm - rme: support map ram for ccal realm vm - rme: support config ccal realm vm - rme: support ccal RMI calls - rme: realm vm supports wfx handler - !20952 urma: introduce ipourma module - iommu/ummu-core: Simplifies tdev initialization resources - iommu/ummu: Optimized log printing - iommu/ummu: Use passed gfp_mask in map_pages callback - uvb: fix wd_obtain logic err - !20949 ub: udma: support user ctl function. - urma: fix bond device id not release - !20901 drivers/ub/sentry: some bugfix - ub: ubmempfd: supports for D2H mapping and demapping - ub: ubmempfd: supports providing services to the QEMU process through file nodes - [virtCCA Live Migration 2]virtcca secure cvm supports live migration - urma: query priority and enable bit, support ring size configuration - urma: implement debugfs, improve boundary checks and error handling logic - urma: implement data plane interaction and statistics - urma: implement ipourma network device operations - urma: ipourma resource management - urma: ipourma resource management and err code - urma: introduce ipourma main module - iommu/ummu: Optimized the TID invalidation configuration - iommu/ummu: Optimized SVA permission table memory allocation approach - iommu/ummu: Adapt UMMU SVA interface adjustment - iommu/ummu: Support TID and EID Granularity for MPAM - !20848 [OLK-6.6] backport important bugfix for nvme driver from upstream linux-6.6.y - !20847 urma: sl resource query error - !20908 [OLK-6.6][linux-6.6.y sync] Backport 6.6.108-6.6.110 LTS Patches - !20084 Loongarch: Enable CONFIG_CRYPTO_XTS for disk encryption - !20929 PCI: Fix NVMe link speed downgrade to 2.5GT/s during hotplug - drivers/ub/sentry: fix check input parameters - ub: udma: support user ctl function. - ub: udma: support uboe function. - ub: udma: bugfix related to query aux info. - !20935 ub: ubmem_vmmu: supports IOMMU driver for the UB memory MMU in VMs - drivers/ub/sentry: do not use magic numbers - !20876 urma: Kernel-mode specific implementations file for Jetty extension interface - urma: sl resource query error - !20873 sunrpc: fix NULL pointer dereference in rpcb_register_inet6 and rpcb_register_inet4 - !20875 sunrpc: fix race in cache cleanup causing stale nextcheck time - ub: ubmem_vmmu: supports IOMMU driver for the UB memory MMU in VMs - ub: ubmem_vmmu: supports parsing and configuring the hardware node information - ub: ubmem_vmmu: HiSilicon ubmem_vmmu Architecture Implementation - !20806 Fix CVE-2025-71225 - !20896 scsi: qla2xxx: Free sp in error path to fix system crash - !20894 scsi: qla2xxx: Delay module unload while fabric scan in progress - !20893 scsi: qla2xxx: Validate sp before freeing associated memory - !20802 Fix CVE-2026-23110 - urma: Kernel-mode specific implementations file for Jetty extension interface - drivers/ub/sentry: fix memory leak in process_urma_data() - drivers/ub/sentry: initialize some variables - PCI: Fix NVMe link speed downgrade to 2.5GT/s during hotplug - !20770 ub: ubdevshm: supports the memory user to obtain and release shared memory - Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 - mm: consider non-anon swap cache folios in folio_expected_ref_count() - mm: simplify folio_expected_ref_count() - ASoC: qcom: audioreach: fix potential null pointer dereference - gcc-plugins: Remove TODO_verify_il for GCC >= 16 - crypto: sha256 - fix crash at kexec - drm/i915/backlight: Return immediately when scale() finds invalid parameters - minmax.h: remove some #defines that are only expanded once - minmax.h: simplify the variants of clamp() - minmax.h: move all the clamp() definitions after the min/max() ones - minmax.h: use BUILD_BUG_ON_MSG() for the lo < hi test in clamp() - minmax.h: reduce the #define expansion of min(), max() and clamp() - minmax.h: update some comments - minmax.h: add whitespace around operators and after commas - minmax: fix up min3() and max3() too - minmax: improve macro expansion and type checking - minmax: don't use max() in situations that want a C constant expression - minmax: simplify min()/max()/clamp() implementation - minmax: make generic MIN() and MAX() macros available everywhere - drm/ast: Use msleep instead of mdelay for edid read - gpiolib: Extend software-node support to support secondary software-nodes - ARM: bcm: Select ARM_GIC_V3 for ARCH_BRCMSTB - s390/cpum_cf: Fix uninitialized warning after backport of ce971233242b - kmsan: fix out-of-bounds access to shadow memory - afs: Fix potential null pointer dereference in afs_put_server - ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address - i40e: improve VF MAC filters accounting - i40e: add mask to apply valid bits for itr_idx - HID: asus: add support for missing PX series fn keys - drm/gma500: Fix null dereference in hdmi teardown - octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() - net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port - net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() - net: dsa: lantiq_gswip: do also enable or disable cpu port - selftests: fib_nexthops: Fix creation of non-FDB nexthops - net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS - bnxt_en: correct offset handling for IPv6 destination address - vhost: Take a reference on the task in struct vhost_task. - Bluetooth: hci_sync: Fix hci_resume_advertising_sync - ethernet: rvu-af: Remove slash from the driver name - can: peak_usb: fix shift-out-of-bounds issue - can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow - can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow - can: hi311x: populate ndo_change_mtu() to prevent buffer overflow - can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow - bpf: Reject bpf_timer for PREEMPT_RT - can: rcar_can: rcar_can_resume(): fix s2ram with PSCI - wifi: virt_wifi: Fix page fault on connect - cpufreq: Initialize cpufreq-based invariance before subsys - ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients - arm64: dts: imx8mp: Correct thermal sensor index - mm: folio_may_be_lru_cached() unless folio_test_large() - mm/gup: local lru_add_drain() to avoid lru_add_drain_all() - mm/gup: check ref_count instead of lru before migration - mm: add folio_expected_ref_count() for reference count calculation - mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked" - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions - ALSA: usb-audio: Add mute TLV for playback volumes on more devices - ALSA: usb-audio: move mixer_quirks' min_mute into common quirk - ALSA: usb-audio: Add DSD support for Comtrue USB Audio device - i2c: designware: Add quirk for Intel Xe - mmc: sdhci-cadence: add Mobileye eyeQ support - usb: core: Add 0x prefix to quirks debug output - ALSA: usb-audio: Fix build with CONFIG_INPUT=n - ALSA: usb-audio: Convert comma to semicolon - ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 - ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks - ALSA: usb-audio: Simplify NULL comparison in mixer_quirks - ALSA: usb-audio: Avoid multiple assignments in mixer_quirks - ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks - ALSA: usb-audio: Fix block comments in mixer_quirks - firewire: core: fix overlooked update of subsystem ABI version - scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE - !20843 [OLK-6.6][linux-6.6.y sync] Backport 6.6.107-6.6.108 LTS Patches - !20869 ub:hisi-ubus: fix bug of security smatch - !20861 CVE-2026-23163 - ub: ubdevshm: supports the memory user to obtain and release shared memory - ub: ubdevshm: supports granting and revoking shared memory permissions - ub: ubdevshm: supports the registration and deregistration of shared memory segments - ub: ubdevshm: supports the registration and deregistration - KVM: arm64: Fix softirq masking in FPSIMD register saving sequence - !20886 Fix CVE-2026-23205 - !20803 Fix CVE-2026-23112 - !20868 sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure - !20811 smb/server: fix refcount leak in smb2_open() - !20810 smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() - !20809 smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() - sunrpc: fix NULL pointer dereference in rpcb_register_inet6 and rpcb_register_inet4 - sunrpc: fix race in cache cleanup causing stale nextcheck time - scsi: qla2xxx: Free sp in error path to fix system crash - scsi: qla2xxx: Delay module unload while fabric scan in progress - scsi: qla2xxx: Validate sp before freeing associated memory - dcache: Limit the minimal number of bucket to two - !20872 Fix CVE-2026-23220 - !20846 Fix CVE-2026-23193 - !20815 Fix CVE-2026-23216 - !20859 Fix CVE-2026-23179 - !20871 CVE-2026-23096 - !20858 ub: ubase: resolve the cmdq crq overflow problem - bpf: Deprecate hisock unused kfuncs and orig ingress logic - bpf: Add local connect support for hisock - bpf: Add ipv4-mapped ipv6 addr support for hisock - bpf: Add target comm parse to hisock_cmd - bpf: Add multi port parse to hisock_cmd - bpf: Only deploy hisock in server - bpf: Apply BPF_HISOCK_INGRESS to hisock ingress - bpf: Add bpf_handle_ingress/egress_ptype kfunc - bpf: Add bpf_get_skb_ethhdr kfunc - bpf: Add bpf_set_ingress/egress_dev kfunc - bpf: Add bpf_set_ingress_dst kfunc - bpf: Add BPF_HISOCK_INGRESS attach type - cgroup: make cgroup_bpf_prog_attach work when cgroup2 is not mounted - smb: client: fix potential UAF and double free in smb2_open_file() - smb/client: fix memory leak in smb2_open_file() - !20852 ASoC: amd: fix memory leak in acp3x pdm dma ops - ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths - uacce: fix cdev handling in the cleanup path - Revert "uacce: fix for cdev memory leak" - ub:hisi-ubus: fix bug of security smatch - ub:ubus: injected route event - ub:ubus: Black Box Development - !20865 urma: urma support uboe - sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure - urma: urma support uboe - !20857 ub_fwctl driver adds support for querying some functions - ub:ub_fwctl:Add illegal verification for scc - ub:ub_fwctl:Support querying the historical status of port links - drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove - drm/amdkfd: Don't use sw fault filter if retry cam enabled - ub:ub_fwctl:Support querying firmware version numbers - ub: ub_fwctl: Support querying real-time bandwidth statistics - ub:ub_fwctl:Support querying statistical indicators at the ub port and uboe port levels - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() - !20854 [URMA] add ping server for urma_ping - urma: add ping server - ub: ubase: resolve the cmdq crq overflow problem - ub: ubase: Optimized the QoS code naming to improve code readability. - ub: ubase&unic: optimizing code and configuration settings. - net: unic: not support query and configure ip by control plane in UBoE - net: unic: fix the automatically enable uc guid promisc mode. - !20844 urma:kernel header of userctl - urma: Kernel-mode header file for Jetty extension interface - ASoC: amd: fix memory leak in acp3x pdm dma ops - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() - phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again) - ACPICA: Work around bogus -Wstringop-overread warning since GCC 11 - !20835 Fix CVE-2026-23084 - minmax: add a few more MIN_T/MAX_T users - minmax: simplify and clarify min_t()/max_t() implementation - minmax: avoid overly complicated constant expressions in VM code - rtc: pcf2127: fix SPI command byte for PCF2131 backport - xhci: dbc: Fix full DbC transfer ring after several reconnects - xhci: dbc: decouple endpoint allocation from initialization - phy: ti: omap-usb2: fix device leak at unbind - phy: Use device_get_match_data() - drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path - ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message - ASoC: wm8974: Correct PLL rate rounding - ASoC: wm8940: Correct typo in control name - ASoC: wm8940: Correct PLL rate rounding - io_uring: include dying ring in task_work "should cancel" state - io_uring: backport io_should_terminate_tw() - ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx - selftests: mptcp: avoid spurious errors on TCP disconnect - selftests: mptcp: connect: catch IO errors on listen side - rds: ib: Increment i_fastreg_wrs before bailing out - KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active - mmc: mvsdio: Fix dma_unmap_sg() nents value - ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S - ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface - btrfs: tree-checker: fix the incorrect inode ref size check - iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page() - LoongArch: Check the return value when creating kobj - LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled - LoongArch: Update help info of ARCH_STRICT_ALIGN - nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* - octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() - net: liquidio: fix overflow in octeon_init_instr_queue() - bonding: don't set oif to bond dev when getting NS target destination - net/mlx5e: Consider aggregated port speed during rate configuration - i40e: remove redundant memory barrier when cleaning Tx descs - net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure - selftests: mptcp: sockopt: fix error messages - mptcp: tfo: record 'deny join id0' info - mptcp: set remote_deny_join_id0 on SYN recv - dpaa2-switch: fix buffer pool seeding for control traffic - btrfs: fix invalid extref key setup when replaying dentry - pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch - wifi: mac80211: fix incorrect type for ret - wifi: mac80211: increase scan_ies_len for S1G - ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported - !20769 [OLK-6.6][linux-6.6.y sync] Backport 6.6.106-6.6.107 LTS Patches - be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list - !20776 ub:ubfi: Release the chosen node - !20817 CVE-2026-23094 - !20819 dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() - ub:ubus: Add port num check - !20379 [OLK-6.6][sync from OLK-5.10]io_uring: Support forcing sq thread to be idle and woken up by hrtimer - !20830 sched/soft_domain: Increasing NR_MAX_CLUSTER to 32 - sched/soft_domain: Increasing NR_MAX_CLUSTER to 32 - btrfs: fix incorrect readahead expansion length - x86: disable image size check for test builds - drm/i915/power: fix size for for_each_set_bit() in abox iteration - drm/amdgpu: fix a memory leak in fence cleanup when unloading - net: mdiobus: release reset_gpio in mdiobus_unregister_device() - phy: ti-pipe3: fix device leak at unbind - phy: tegra: xusb: fix device and OF node leak at probe - dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate - usb: gadget: midi2: Fix MIDI2 IN EP max packet size - usb: gadget: midi2: Fix missing UMP group attributes initialization - USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels - RISC-V: Remove unnecessary include from compat.h - hrtimer: Rename __hrtimer_hres_active() to hrtimer_hres_active() - hrtimer: Remove unused function - regulator: sy7636a: fix lifecycle of power good gpio - dmaengine: ti: edma: Fix memory allocation size for queue_priority_map - hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr - hsr: use rtnl lock when iterating over ports - net: hsr: Add VLAN CTAG filter support - net: hsr: Add support for MC filtering at the slave device - can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB - can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails - can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed - igb: fix link test skipping when interface is admin down - docs: networking: can: change bcm_msg_head frames member to support flexible array - tunnels: reset the GSO metadata before reusing the skb - net: bridge: Bounce invalid boolopts - net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() - USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions - USB: serial: option: add Telit Cinterion FN990A w/audio compositions - dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks - serial: sc16is7xx: fix bug in flow control levels init - tty: hvc_console: Call hvc_kick in hvc_write unconditionally - Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups" - Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table - Input: iqs7222 - avoid enabling unused interrupts - mm/khugepaged: fix the address passed to notifier on testing young - btrfs: fix corruption reading compressed range when block size is smaller than page size - btrfs: use readahead_expand() on compressed extents - mm/damon/sysfs: fix use-after-free in state_show() - mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing - mtd: nand: raw: atmel: Fix comment in timings preparation - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages - drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time - mm/damon/core: set quota->charged_from to jiffies at first charge window - fuse: prevent overflow in copy_file_range return value - fuse: check if copy_file_range() returns larger than requested size - mtd: rawnand: stm32_fmc2: fix ECC overwrite - mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer - net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups - i2c: i801: Hide Intel Birch Stream SoC TCO WDT - ocfs2: fix recursive semaphore deadlock in fiemap call - mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN - compiler-clang.h: define __SANITIZE_*__ macros only when undefined - EDAC/altera: Delete an inappropriate dma_free_coherent() call - rcu-tasks: Maintain real-time response in rcu_tasks_postscan() - rcu-tasks: Eliminate deadlocks involving do_exit() and RCU tasks - rcu-tasks: Maintain lists to eliminate RCU-tasks/do_exit() deadlocks - s390/cpum_cf: Deny all sampling events by counter PMU - NFSv4/flexfiles: Fix layout merge mirror check. - NFSv4.2: Serialise O_DIRECT i/o and copy range - NFSv4.2: Serialise O_DIRECT i/o and clone range - NFSv4.2: Serialise O_DIRECT i/o and fallocate() - NFS: Serialise O_DIRECT i/o and truncate() - fs/nfs/io: make nfs_start_io_*() killable - ftrace/samples: Fix function size computation - NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server - NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set - media: i2c: imx214: Fix link frequency validation - NFSD: nfsd_unlink() clobbers non-zero status returned from fh_fill_pre_attrs() - nfsd: Fix a regression in nfsd_setattr() - kasan: fix GCC mem-intrinsic prefix with sw tags - kunit: kasan_test: disable fortify string checker on kasan_strings() test - io_uring: fix kabi broken in struct io_ring_ctx - io_uring: Support forcing sq thread to be idle and woken up by hrtimer - dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() - uacce: fix isolate sysfs check condition - Revert "uacce: fix isolate sysfs check condition" - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() - smb/server: fix refcount leak in smb2_open() - smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() - smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() - md: suspend array while updating raid_disks via sysfs - scsi: core: Wake up the error handler when final completions race against each other - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec - ub:ubfi: Release the chosen node - ub:ubus: Delete unused functions - Loongarch: Enable CONFIG_CRYPTO_XTS for disk encryption - Add sw64 support in kernel.spec - !21194 hisi-cca-da: Revert smmu realm enabled condition for arm_smmu_domain_finalise. - !21192 urma: bugfix of ubagg&ubcore&uburma - !21183 platform/x86: classmate-laptop: Add missing NULL pointer checks - urma: bugfix of ubagg&ubcore&uburma - hisi-cca-da: Revert smmu realm enabled condition for arm_smmu_domain_finalise. - platform/x86: classmate-laptop: Add missing NULL pointer checks - !21167 urma: fix kernel codecheck issues. - !21174 urma: change return value for provider err - !21127 urma: copy linked ports when importing bond jetty/seg - !20247 ubcore: query primary eid in ipourma loopback mode. - !21077 Fix hisi cca bugs - ubcore: route query refine and ipo loopback adapt. - hisi-cca-da: Transfer PCIe ECAM access requests to RMM for realm device. - hisi-cca-da: Write NS STE for PF drivers. - hisi-cca-da: Provide IO interfaces - hisi-cca-da: Destroy mmu stage2 pagetable after closing vfio devices - !21045 scsi: hisi_sas: Fix NULL pointer exception when do user_scan() - hisi-cca-da: Automatically unbind PF/VF drivers and prevent probe. - !21165 tools/interference: add ifstool utility for kernel interference statistics - !21166 urma: fix jfce uaf in batch cleanup - !21043 urma: fix tjetty ref in ping server - urma: change return value for provider err - !21128 sched/rt: Skip currently executing CPU in rto_next_cpu() - !21129 procfs: fix missing RCU protection when reading real_parent in do_task_stat() - urma: fix jfce uaf in batch cleanup - !21074 ipmi: Add HiSilicon IPMI Page Soft Offline driver - !21076 [OLK-6.6][linux-6.6.y sync] Backport 6.6.112-6.6.113 LTS Patches - urma: fix kernel codecheck issues. - tools/interference: add ifstool utility for kernel interference statistics - !20291 [Hygon][6.6][Bugfix] Bug fix for EDAC decode address fail issue on Hygon Dhyana processor - !21092 kexec: derive purgatory entry from symbol - !21154 sched: Add SOFT_DOMAIN feature interface for cgroup2 - !21153 fix CVE-2025-39981 - Revert "hisi-cca-da: Delay realm memory release to kvm_destroy_realm" - urma: fix tjetty ref in ping server - rme: Enforce isolation to solve compile error without config CONFIG_HISI_CCA - hisi-cca-da: Improve hisi cca dev validate and delegate - hisi-cca-da: Fix smmu enable rme problem - hisi-cca-da: Fix msi region shared problem - sched: Add SOFT_DOMAIN feature interface for cgroup2 - Bluetooth: MGMT: Fix memory leak in set_ssp_complete - Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete - overflow: Introduce __DEFINE_FLEX for having no initializer - overflow: Fix direct struct member initialization in _DEFINE_FLEX() - overflow: Change DEFINE_FLEX to take __counted_by member - overflow: add DEFINE_FLEX() for on-stack allocs - Bluetooth: MGMT: Fix possible UAFs - Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete() - !21103 Revert "mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()" - !21104 v2 vsock/virtio: cap TX credit to local buffer size - !21070 Fixes CVE-2026-23100 - !21135 RDMA/hns: Support configure and query the CNP DSCP through sysfs - !21088 ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref - RDMA/hns: Support configure and query the CNP DSCP through sysfs - RDMA/hns: Support query FW cap bit - RDMA/hns: Support query HW ID. - !20934 smb/server: fix refcount leak in parse_durable_handle_context() - !21004 regmap: Fix race condition in hwspinlock irqsave routine - !19568 [OLK-6.6]fix txgbe clang compile warning - urma: copy linked ports when importing bond jetty/seg - procfs: fix missing RCU protection when reading real_parent in do_task_stat() - sched/rt: Skip currently executing CPU in rto_next_cpu() - !21073 scsi: qla2xxx: Fix bsg_done() causing double free - !21114 CVE-2024-57979 - !21113 iommu: disable SVA when CONFIG_X86 is set - !20957 dmaengine: xilinx: xdma: Fix regmap max_register - !21087 net: unic: Multiple stability fixes for tx timeout, DFX capability and concurrent activation/reset - pps: Fix a use-after-free - fix kabi - pps: Fix a use-after-free - !21078 of: unittest: Fix memory leak in unittest_data_add() - !21079 *** fix CVE-2026-23208 *** - !21082 ALSA: aloop: Fix racy access at PCM trigger - !21083 bus: fsl-mc: fix use-after-free in driver_override_show() - iommu: disable SVA when CONFIG_X86 is set - vsock/virtio: cap TX credit to local buffer size - Revert "mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()" - !20983 Fix CVE-2026-23139 - !20878 Fix CVE-2026-23230 - kexec: derive purgatory entry from symbol - lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC - PCI/IOV: Fix race between SR-IOV enable/disable and hotplug - Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" - rtc: interface: Alarm race handling should not discard preceding error - perf test stat tests: Fix for virtualized machines - perf test stat: Update test expectations and events - perf test stat: Avoid hybrid assumption when virtualized - writeback: Avoid excessively long inode switching times - writeback: Avoid softlockup when switching many inodes - cramfs: Verify inode mode when loading from disk - fs: Add 'initramfs_options' to set initramfs mount options - minixfs: Verify inode mode when loading from disk - irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume - irqchip/sifive-plic: Make use of __assign_bit() - selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled - s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG - s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL - s390/bpf: Describe the frame using a struct instead of constants - s390/bpf: Centralize frame offset calculations - s390/bpf: Change seen_reg to a mask - ACPI: property: Do not pass NULL handles to acpi_attach_data() - ACPI: property: Add code comments explaining what is going on - ACPI: property: Disregard references in data-only subnode lists - ACPI: battery: Add synchronization between interface updates - ACPI: battery: Check for error code from devm_mutex_init() call - ACPI: battery: initialize mutexes through devm_ APIs - ACPI: battery: allocate driver data through devm_ APIs - arm64: mte: Do not flag the zero page as PG_mte_tagged - ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref - !20790 dm: use bio_clone_blkg_association - ipmi: Add HiSilicon IPMI Page Soft Offline driver - net: unic: Resolve network unavailability caused by concurrent activation and reset - net: unic: Provide the DFX capability for querying MNG table - net: unic: Delete the elr reset process after the tx timeout - bus: fsl-mc: fix use-after-free in driver_override_show() - ALSA: aloop: Fix racy access at PCM trigger - ALSA: usb-audio: Use the right limit for PCM OOB check - ALSA: usb-audio: Prevent excessive number of frames - of: unittest: Fix memory leak in unittest_data_add() - !21034 CVE-2026-23140 - !21016 net: fix segmentation of forwarding fraglist GRO - !21017 mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() - !21018 CVE-2026-23209 - !21019 ipv6: annotate data-race in ndisc_router_discovery() - !20881 ipvlan: Make the addrs_lock be per port - rme: Imporve range delegate - btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() - PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release - PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() - misc: fastrpc: Save actual DMA size in fastrpc_map structure - misc: fastrpc: Add missing dev_err newlines - mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag - mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type - mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value - media: mc: Clear minor number before put device - lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older - ACPICA: Allow to skip Global Lock initialization - ext4: validate ea_ino and size in check_xattrs - ext4: correctly handle queries for metadata mappings - ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() - nfsd: nfserr_jukebox in nlm_fopen should lead to a retry - NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() - mm/damon/vaddr: do not repeat pte_offset_map_lock() until success - mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 - mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations - wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 - wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again - selftests: mptcp: join: validate C-flag + def limit - spi: cadence-quadspi: Flush posted register writes before DAC access - spi: cadence-quadspi: Flush posted register writes before INDAC access - PCI: tegra194: Handle errors in BPMP response - PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() - PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock - PCI: rcar-host: Drop PMSR spinlock - PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit - PCI/AER: Support errors introduced by PCIe r6.0 - PCI/AER: Fix missing uevent on recovery when a reset is requested - PCI/ERR: Fix uevent on failure to recover - PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV - PCI/sysfs: Ensure devices are powered for config reads - PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock - rseq/selftests: Use weak symbol reference, not definition, to link with glibc - rtc: interface: Fix long-standing race when setting alarm - rtc: interface: Ensure alarm irq is enabled when UIE is enabled - memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe - mmc: core: SPI mode remove cmd7 - mtd: rawnand: fsmc: Default to autodetect buswidth - xtensa: simdisk: add input size check in proc_write_simdisk - sparc: fix error handling in scan_one_device() - sparc64: fix hugetlb for sun4u - scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() - sched/deadline: Fix race in push_dl_task() - pwm: berlin: Fix wrong register in suspend/resume - powerpc/pseries/msi: Fix potential underflow and leak issue - powerpc/powernv/pci: Fix underflow and leak issue - power: supply: max77976_charger: fix constant current reporting - pinctrl: samsung: Drop unused S3C24xx driver data - nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk - parisc: don't reference obsolete termio struct for TC* constants - openat2: don't trigger automounts with RESOLVE_NO_XDEV - of: unittest: Fix device reference count leak in of_unittest_pci_node_verify - lib/genalloc: fix device leak in of_gen_pool_get() - KEYS: trusted_tpm1: Compare HMAC values in constant time - iommu/vt-d: PRS isn't usable if PDS isn't supported - iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume - init: handle bootloader identifier in kernel parameters - iio: xilinx-ams: Unmask interrupts after updating alarms - iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK - iio: frequency: adf4350: Fix prescaler usage. - iio: dac: ad5421: use int type to store negative error codes - iio: dac: ad5360: use int type to store negative error codes - fs/ntfs3: Fix a resource leak bug in wnd_extend() - fbdev: Fix logic error in "offb" name match - crypto: rockchip - Fix dma_unmap_sg() nents value - crypto: atmel - Fix dma_unmap_sg() direction - crypto: aspeed - Fix dma_unmap_sg() direction - copy_sighand: Handle architectures where sizeof(unsigned long) < sizeof(u64) - bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() - bus: mhi: ep: Fix chained transfer handling in read path - btrfs: avoid potential out-of-bounds in btrfs_encode_fh() - blk-crypto: fix missing blktrace bio split events - drm/nouveau: fix bad ret code in nouveau_bo_move_prep - drm/rcar-du: dsi: Fix 1/2/3 lane support - media: lirc: Fix error handling in lirc_register() - media: venus: firmware: Use correct reset sequence for IRIS2 - media: pci: ivtv: Add missing check after DMA map - media: mc: Fix MUST_CONNECT handling for pads with no links - media: i2c: mt9v111: fix incorrect type for ret - media: cx18: Add missing check after DMA map - firmware: meson_sm: fix device leak at probe - xen/events: Update virq_to_irq on migration - xen/events: Return -EEXIST for bound VIRQs - xen/manage: Fix suspend error path - xen/events: Cleanup find_virq() return codes - dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required - ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init - arm64: dts: ti: k3-am62a-main: Fix main padcfg length - arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees - arm64: dts: qcom: msm8939: Add missing MDSS reset - arm64: dts: qcom: msm8916: Add missing MDSS reset - ACPI: debug: fix signedness issues in read/write helpers - ACPI: property: Fix buffer properties extraction for subnodes - gpio: wcd934x: mark the GPIO controller as sleeping - tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single - smb: client: fix missing timestamp updates after utime(2) - bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() - drm/amd/display: Properly disable scaling on DCE6 - drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 - drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs - drm/amdgpu: Add additional DCE6 SCL registers - mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes - mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call - tcp: take care of zero tp->window_clamp in tcp_set_rcvlowat() - perf python: split Clang options when invoking Popen - tools build: Align warning options with perf - net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe - drm/vmwgfx: Fix copy-paste typo in validation - net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() - LoongArch: Init acpi_gbl_use_global_lock to false - LoongArch: Remove CONFIG_ACPI_TABLE_UPGRADE in platform_init() - ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size - scsi: mvsas: Fix use-after-free bugs in mvs_work_queue - clk: tegra: do not overallocate memory for bpmp clocks - clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver - clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() - clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() - clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m - perf evsel: Ensure the fallback message is always written to - perf tools: Add fallback for exclude_guest - perf test: Add a test for default perf stat command - perf test: Don't leak workload gopipe in PERF_RECORD_* - perf session: Fix handling when buffer exceeds 2 GiB - perf arm_spe: Correct memory level for remote access - perf arm_spe: Correct setting remote access - rtc: optee: fix memory leak on driver removal - rtc: x1205: Fix Xicor X1205 vendor prefix - perf util: Fix compression checks returning -1 as bool - clk: at91: peripheral: fix return value - libperf event: Ensure tracing data is multiple of 8 sized - perf evsel: Avoid container_of on a NULL leader - asm-generic/io.h: Skip trace helpers if rwmmio events are disabled - iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE - clocksource/drivers/clps711x: Fix resource leaks in error paths - fscontext: do not consume log entries when returning -EMSGSIZE - fs: always return zero on success from replace_fd() - !21067 [OLK-6.6][linux-6.6.y sync] Backport 6.6.111-6.6.112 LTS Patches - scsi: qla2xxx: Fix bsg_done() causing double free - !21065 Fix CVE-2026-23069 - !21062 v4 Support multi-level cgroup - !20987 Fix CVE-2026-23212 - !20982 Fix CVE-2026-23119 - !20979 Fix CVE-2026-23111 - !20974 Fix CVE-2026-23099 - !20973 Fix CVE-2026-23105 - !20972 Fix CVE-2026-23074 - !20884 ksmbd: add chann_lock to protect ksmbd_chann_list xarray - !20947 Fix CVE-2026-23101 - ext4: clear i_state_flags when alloc inode - misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup - Revert "wifi: ath10k: avoid unnecessary wait for service ready message" - fs/ntfs3: fix mount failure for sparse runs in run_unpack() - !20825 efivarfs: fix error propagation in efivar_entry_get() - !20824 io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop - !20950 ub:ubus: protect iterator ue_list and mue_list with ub_bus_sem - mm/rmap: fix two comments related to huge_pmd_unshare() - mm/hugetlb: fix two comments related to huge_pmd_unshare() - mm/hugetlb: fix hugetlb_pmd_shared() - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count - !20728 drivers: Update vendor name of Chengdu NorthLink Technology N5/N6 Series Network Card Drivers - vsock/virtio: fix potential underflow in virtio_transport_get_credit() - !21001 Fix CVE-2026-23229 - usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call - arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode - !20999 Fix CVE-2026-23173 - usb: typec: tipd: Clear interrupts first - bus: fsl-mc: Check return value of platform_get_resource() - remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() - Input: atmel_mxt_ts - allow reset GPIO to sleep - misc: fastrpc: Skip reference for DMA handles - misc: fastrpc: fix possible map leak in fastrpc_put_args - misc: fastrpc: Fix fastrpc_map_lookup operation - nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() - ext4: fix checks for orphan inodes - ksmbd: fix error code overwriting in smb2_get_info_filesystem() - LoongArch: Automatically disable kaslr if boot from kexec_file - mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() - mfd: rz-mtu3: Fix MTU5 NFCR register offset - ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down - ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() - vhost: vringh: Modify the return value check - net/mlx5: fw reset, add reset timeout work - net/mlx5: pagealloc: Fix reclaim race during command interface teardown - net/mlx5: Stop polling for command response if interface goes down - net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable - nfp: fix RSS hash key size when RSS is not supported - mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands - drivers/base/node: fix double free in register_one_node() - hwrng: ks-sa - fix division by zero in ks_sa_rng_init - KEYS: X.509: Fix Basic Constraints CA flag parsing - Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements - Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO - vhost: vringh: Fix copy_to_iter return value check - RDMA/siw: Always report immediate post SQ errors - usb: vhci-hcd: Prevent suspending virtually attached devices - NFSv4.1: fix backchannel max_resp_sz verification check - coresight: trbe: Return NULL pointer for allocation failures - coresight: etm4x: Support atclk - coresight-etm4x: Conditionally access register TRCEXTINSELR - remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice - PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() - vfio/pds: replace bitmap_free with vfree - sparc: fix accurate exception reporting in copy_{from,to}_user for M7 - sparc: fix accurate exception reporting in copy_to_user for Niagara 4 - sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara - sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III - wifi: mac80211: fix Rx packet handling when pubsta information is not available - wifi: ath10k: avoid unnecessary wait for service ready message - Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram - IB/sa: Fix sa_local_svc_timeout_ms read race - RDMA/core: Resolve MAC of next-hop device without ARP support - f2fs: fix zero-sized extent for precache extents - scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() - scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() - scsi: qla2xxx: edif: Fix incorrect sign of error code - ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message - f2fs: fix to truncate first page in error path of f2fs_truncate() - f2fs: fix to update map->m_next_extent correctly in f2fs_map_blocks() - wifi: mt76: fix potential memory leak in mt76_wmac_probe() - RDMA/cm: Rate limit destroy CM ID timeout error message - drivers/base/node: handle error properly in register_one_node() - watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog - ipvs: Use READ_ONCE/WRITE_ONCE for ipvs->enable - iio: consumers: Fix offset handling in iio_convert_raw_to_processed() - iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() - fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist - fs: ntfs3: Fix integer overflow in run_unpack() - drm/msm/dpu: fix incorrect type for ret - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping - ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping - misc: genwqe: Fix incorrect cmd field being reported in error - usb: gadget: configfs: Correctly set use_os_string at bind - usb: phy: twl6030: Fix incorrect type for ret - drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() - tcp: fix __tcp_close() to only send RST when required - PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation - wifi: mwifiex: send world regulatory domain to driver - drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) - drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) - drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) - drm/amd/pm: Adjust si_upload_smc_data register programming (v3) - drm/amd/pm: Fix si_upload_smc_data (v3) - drm/amd/pm: Disable ULV even if unsupported (v3) - drm/amdgpu: Power up UVD 3 for FW validation (v2) - coresight: Only register perf symlink for sinks with alloc_buffer - inet: ping: check sock_net() in ping_get_port() and ping_lookup() - media: st-delta: avoid excessive stack usage - ALSA: lx_core: use int type to store negative error codes - media: rj54n1cb0c: Fix memleak in rj54n1_probe() - scsi: myrs: Fix dma_alloc_coherent() error check - hwrng: nomadik - add ARM_AMBA dependency - crypto: keembay - Add missing check after sg_nents_for_len() - drm/amd/display: Remove redundant semicolons - serial: max310x: Add error checking in probe() - usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls - usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup - phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 - media: zoran: Remove zoran_fh structure - drm/bridge: it6505: select REGMAP_I2C - f2fs: fix condition in __allow_reserved_blocks() - drm/radeon/r600_cs: clean up of dead code in r600_cs - drm/panel: novatek-nt35560: Fix invalid return value - bpf: Enforce expected_attach_type for tailcall compatibility - i2c: designware: Add disabling clocks when probe fails - i2c: designware: Fix clock issue when PM is disabled - i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD - thermal/drivers/qcom/lmh: Add missing IRQ includes - thermal/drivers/qcom: Make LMH select QCOM_SCM - hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems - once: fix race by moving DO_ONCE to separate section - smp: Fix up and expand the smp_call_function_many() kerneldoc - selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported - i3c: master: svc: Recycle unused IBI slot - i3c: master: svc: Use manual response for IBI events - ACPICA: Fix largest possible resource descriptor index - pwm: tiehrpwm: Fix corner case in clock divisor calculation - arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible - arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value - arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names - cpuidle: qcom-spm: fix device and OF node leaks at probe - firmware: firmware: meson-sm: fix compile-test default - arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 - null_blk: Fix the description of the cache_size module argument - pinctrl: renesas: Use int type to store negative error codes - power: supply: cw2015: Fix a alignment coding style issue - PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() - ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property - ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS - ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax - block: use int to store blk_stack_limits() return value - selftests/nolibc: fix EXPECT_NZ macro - regulator: scmi: Use int type to store negative error codes - arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map - ARM: at91: pm: fix MCKx restore routine - pinctrl: meson-gxl: add missing i2c_d pinmux - soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS - leds: flash: leds-qcom-flash: Update torch current clamp setting - ARM: dts: renesas: porter: Fix CAN pin group - libbpf: Fix reuse of DEVMAP - bpf: Remove migrate_disable in kprobe_multi_link_prog_run - bpf/selftests: Fix test_tcpnotify_user - regmap: Remove superfluous check for !config in __regmap_init() - arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 - x86/vdso: Fix output operand size of RDPID - smb: server: fix IRD/ORD negotiation with the client - coresight: trbe: Prevent overflow in PERF_IDX2OFF() - gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote - selftests: arm64: Check fread return value in exec_target - seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast - init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD - filelock: add FL_RECLAIM to show_fl_flags() macro - !21022 KVM: Don't clobber irqfd routing type when deassigning irqfd - !20998 ceph: fix oops due to invalid pointer for kfree() in parse_longname() - !21023 l2tp: avoid one data-race in l2tp_tunnel_del_work() - xsched: fix potential NULL dereference in xsched_quota_timeout_update - xsched: remove the standalone xcu_cfs_cg_deinit() helper - xsched: restructure xcu_cgrp_subsys teardown to align with cpu_cgrp_subsys lifecycle - xsched: simplify root group check by direct comparison with root_xcg - xsched: replace magic number with SCHED_CLASS_MAX_LENGTH for scheduler class string length - xsched/core: immediate cleanup of remaining operators on task exit - xsched: add init_fair_xsched_group() for XCU-specific fair group initialization - xsched: modify xcu_cg_initialize_components helper - xsched: refactor xsched_entity initialization - xsched: change rq_init() parameter from struct xsched_cu to struct xsched_rq - xsched: harden and clarify xcu_move_task() logic - xsched: move throttling-related fields from xsched_group_xcu_priv to xsched_rq_cfs - xsched/quota: add throttled flag to cfs_rq for robust hierarchical enqueue under throttling - xsched/quota: support multi-level cgroup - xsched: remove redundant xcu parameter from dequeue_ctx - xsched: update group shares using xcu_grp_shares_add/sub helpers - xsched: delete unused code - xsched/cfs: propagate group activation/deactivation up the hierarchy - xsched/cfs: move xruntime updates to pick/put paths - xsched: add has_running hook to xsched classes for wake-up eligibility check - !21012 [OLK-6.6][linux-6.6.y sync] Backport 6.6.110-6.6.111 LTS Patches - scsi: hisi_sas: Fix NULL pointer exception when do user_scan() - !21013 CVE-2026-23177 - !21007 bonding: fix use-after-free due to enslave fail after slave array update - !21006 net: Fix CVE-2026-23204 - bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path - bpf, test_run: Subtract size of xdp_frame from allowed metadata size - bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN - bpf: Make variables in bpf_prog_test_run_xdp less confusing - bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K - !21015 libceph: reset sparse-read state in osd_fault() - !21024 ub: udma: bugfix related to print messages. - !20980 Fix CVE-2026-23126 - !20922 Fix CVE-2026-23133 - ub: udma: bugfix related to print messages. - l2tp: avoid one data-race in l2tp_tunnel_del_work() - KVM: Don't clobber irqfd routing type when deassigning irqfd - ipv6: annotate data-race in ndisc_router_discovery() - macvlan: observe an RCU grace period in macvlan_common_newlink() error path - macvlan: fix error recovery in macvlan_common_newlink() - mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() - net: fix segmentation of forwarding fraglist GRO - can: rcar_canfd: Fix CAN-FD mode as default - libceph: reset sparse-read state in osd_fault() - !21008 uvb: fix cis call return value and obtain - mm, shmem: prevent infinite loop on truncate race - mm/shmem, swap: fix race of truncate and swap entry split - net/9p: fix double req put in p9_fd_cancelled - riscv: mm: Do not restrict mmap address based on hint - riscv: mm: Use hint address in mmap if available - driver core/PM: Set power.no_callbacks along with power.no_pm - serial: stm32: allow selecting console when the driver is module - hid: fix I2C read buffer overflow in raw_event() for mcp2221 - ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free - ALSA: usb-audio: Kill timer properly at removal - platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list - can: rcar_canfd: Fix controller mode setting - can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled - btrfs: ref-verify: handle damaged extent root tree - ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue - perf subcmd: avoid crash in exclude_cmds when excludes is empty - platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list - dm-integrity: limit MAX_TAG_SIZE to 255 - ASoC: amd: acp: Adjust pdm gain value - wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 - USB: serial: option: add SIMCom 8230C compositions - media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe - !20931 Fix CVE-2026-23060 - uvb: fix cis call return value and obtain - bonding: fix use-after-free due to enslave fail after slave array update - net/sched: cls_u32: use skb_header_pointer_careful() - net: add skb_header_pointer_careful() helper - regmap: Fix race condition in hwspinlock irqsave routine - crypto: virtio - Add spinlock protection with virtqueue notification - net/mlx5e: TC, delete flows only for existing peers - !20967 net: hns3: modify code of judging if SMMU DMA is enabled - ceph: fix oops due to invalid pointer for kfree() in parse_longname() - !20969 Fix CVE-2026-23125 - !20948 v4 arm64: Add memory poison recovery support for various paths - !20975 CVE-2026-23102 - !20977 v4 support apei_page_offline_policy - bonding: annotate data-races around slave->last_rx - netfilter: nf_conncount: update last_gc only when GC has been performed - bonding: provide a net pointer to __skb_flow_dissect() - netdevsim: fix a race issue related to the operation on bpf_bound_progs list - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() - apei/ghes: Add sysctl interface to control soft-offline page isolation - Revert "mm/memory-failure: support disabling soft offline for HugeTLB pages" - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - arm64/fpsimd: signal: Fix restoration of SVE context - arm64/fpsimd: signal: Consistently read FPSIMD context - arm64/fpsimd: signal: Mandate SVE payload for streaming-mode state - bonding: limit BOND_MODE_8023AD to Ethernet devices - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag - net/sched: Enforce that teql can only be used as root qdisc - sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT - drivers/net: Update vendor name of Chengdu NorthLink Technology N5/N6 Series Network Card Drivers - net: hns3: modify code of judging if SMMU DMA is enabled - dmaengine: xilinx: xdma: Fix regmap max_register - ub:ubus: protect iterator ue_list and mue_list with ub_bus_sem - ub:ubus: Avoid getting empty uent from ubc - ub:hisi-ubus: Use GFP_ATOMIC when alloc memory - arm64: send sig fault for user task when apei_claim_sea fails - arm64: add ras log during do_sea - arm64: move getting valid siaddr to the top of do_sea - arm64: mm: shmem: support poison recovery from shmem_file_read_iter() - arm64: fs: support poison recovery from __kernel_read() - iov_iter: add mc support for copy_page_to_iter - arm64: mm: support recovery from copy_{from/to}_user_page() - iov_iter: get rid of 'copy_mc' flag - leds: led-class: Only Add LED to leds_list when it is fully ready - wifi: ath10k: fix dma_free_coherent() pointer - smb/server: fix refcount leak in parse_durable_handle_context() - ksmbd: add chann_lock to protect ksmbd_chann_list xarray - ipvlan: Make the addrs_lock be per port - smb: client: split cached_fid bitfields to avoid shared-byte RMW races - efivarfs: fix error propagation in efivar_entry_get() - io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop - dm: use bio_clone_blkg_association - RAS/AMD/ATL: fix error nodes per socket on for Hygon Dhyana processor - net: txgbe: fix clang compile warning - !20552 ub: udma: fix some code issues. - !20313 Fix CVE-2025-40220 - !20321 nvme: fix admin request_queue lifetime - !20512 PM / devfreq: hisi: Fix potential UAF in OPP handling - !20544 Fix CVE-2025-71147 - !20548 v4 net: LTS-6.6 backport - !20503 Fix CVE-2025-39713 - !20133 Fix CVE-2025-39721 - !20438 Fix CVE-2025-38659 - !20264 Fix CVE-2025-40277 - !20340 Fix CVE-2025-40271 - !20319 Fix CVE-2025-40237 - !20392 vfs: Don't leak disconnected dentries on umount - !20554 iommu/s390: Implement blocking domain - !20489 [OLK-6.6][linux-6.6.y sync] Backport 6.6.101-6.6.102 LTS Patches - !20513 ACPI: PCC: Fix race condition by removing static qualifier - !20468 drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer - !20483 rcu: Protect ->defer_qs_iw_pending from data race - !20510 drivers/ub/sentry: fix primary eid index value - !20553 ub: cdma: support separated page table feature - ub: udma: fix some code issues. - !20480 iommu/ummu-core: fix error invalidate tid - !20561 iommu/ummu: Add ummu sva independent page table parameter - ub: udma: bugfix related to 2m_hugepage. - ub: udma: support for separate page tables - ub: udma: delete debugfs code. - ub: udma: bugfix related to ctrlq function. - ub: udma: verify get cqe/ae aux info out addr and len. - ub: cdma: support separated page table feature - iommu/ummu: Add ummu sva independent page table parameter - iommu: Adjust PLB refresh timing in 'grant' and 'ungrant' - !20505 Fix CVE-2026-23035 - iommu/s390: Implement blocking domain - drivers/ub/sentry: fix primary eid index value - !20535 libceph: make decode_pool() more resilient against corrupted osdmaps - !20536 mm/page_alloc: change all pageblocks migrate type on coalescing - !20537 mm/secretmem: fix use-after-free race in fault handler - !20538 wifi: avoid kernel-infoleak from struct iw_point - !20539 net: usb: rtl8150: fix memory leak on usb_submit_urb() failure - !20440 PCI/AER: Fix NULL pointer access by aer_info - !20262 Fix CVE-2025-68176 - netfilter: nf_reject: don't leak dst refcount for loopback packets - net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error - page_pool: always add GFP_NOWARN for ATOMIC allocations - virtio-net: fix received length check in big packets - net: bridge: fix use-after-free due to MST port state bypass - vsock: Ignore signal/timeout on connect() if already established - tls: make sure to abort the stream if headers are bogus - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI - xfrm: Duplicate SPI Handling - tls: handle data disappearing from under the TLS ULP - net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing - bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls - Bluetooth: hci_core: Fix use-after-free in vhci_flush() - KEYS: trusted: Fix a memory leak in tpm2_load_cmd - !20237 Fix CVE-2025-68724 - !20459 Fix CVE-2025-71131 - !20525 Fix CVE-2025-68816 - !20529 CVE-2025-68172 - net: usb: rtl8150: fix memory leak on usb_submit_urb() failure - !20370 Revert "Revert "RDMA/hns: Fix mismatch exception rollback"" - wifi: avoid kernel-infoleak from struct iw_point - mm/secretmem: fix use-after-free race in fault handler - mm/page_alloc: change all pageblocks migrate type on coalescing - libceph: make decode_pool() more resilient against corrupted osdmaps - pps: Fix kabi breakage of struct pps_device for last_fetched_ev - sched: Fix kabi breakage of struct task_struct for saved_state - crypto: aspeed - fix double free caused by devm - !20515 Bluetooth: bcsp: receive data only if registered - !20507 Fix CVE-2025-40358 - !20450 ub: ubase&unic: Fix some bug in concurrent process - !20452 iommu/ummu: Fix some bugs and optimize the code implementation - !20451 iommu/ummu: Add the function of creating devices with SVA-separated - !20500 mm: fix the inaccurate memory statistics issue for users - net/mlx5: fw_tracer, Validate format string parameters - Bluetooth: bcsp: receive data only if registered - ACPI: PCC: Fix race condition by removing static qualifier - ACPI: CPPC: Fix missing PCC check for guaranteed_perf - iommu/ummu: Add the function of creating devices with SVA-separated - iommu/ummu-core: fix error invalidate tid - riscv: stacktrace: Disable KASAN checks for non-current tasks - !20497 arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() - !20496 drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies - !20495 iommu/amd: Avoid stack buffer overflow from kernel cmdline - !20494 HID: core: Harden s32ton() against conversion to 0 bits - !20493 iommu: Fix two issues in iommu_copy_struct_from_user() - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv - PM / devfreq: hisi: Fix potential UAF in OPP handling - media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() - !20487 interference: Fix uninitialized ifs_clock compiling issue - MIPS: mm: kmalloc tlb_vpn array to avoid stack overflow - MIPS: mm: Prevent a TLB shutdown on initial uniquification - mm: fix the inaccurate memory statistics issue for users - mm: add config option for atomic mode in mm counter - Revert "mm: fix the inaccurate memory statistics issue for users" - !20444 net/mlx5e: Fix crash on profile change rollback failure - !20442 net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv - arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() - drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies - iommu/amd: Avoid stack buffer overflow from kernel cmdline - HID: core: Harden s32ton() against conversion to 0 bits - iommu: Fix two issues in iommu_copy_struct_from_user() - SUNRPC: call xs_sock_process_cmsg for all cmsg - flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read - !20374 [OLK 6.6]Use Hygon IBRS and IBPB rather than software-based mitigation to mitigate Retbleed and SRSO. - !20227 Rename leapioraid to leapraid and release v2.0 - mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery - MIPS: mm: tlb-r4k: Uniquify TLB entries on init - x86/fpu: Delay instruction pointer fixup until after warning - ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx() - ALSA: intel_hdmi: Fix off-by-one error in __hdmi_lpe_audio_probe() - x86/sev: Evict cache lines during SNP memory validation - net: usbnet: Fix the wrong netif_carrier_on() call - net: usbnet: Avoid potential RCU stall on LINK_CHANGE event - Bluetooth: btusb: Add USB ID 3625:010b for TP-LINK Archer TX10UB Nano - sched,freezer: Remove unnecessary warning in __thaw_task - freezer,sched: Clean saved_state when restoring it during thaw - freezer,sched: Do not restore saved_state of a thawed task - freezer,sched: Use saved_state to reduce some spurious wakeups - sched/core: Remove ifdeffery for saved_state - i2c: stm32f7: unmap DMA mapped buffer - i2c: stm32f7: simplify status messages in case of errors - i2c: stm32f7: perform most of irq job in threaded handler - i2c: stm32f7: use dev_err_probe upon calls of devm_request_irq - i2c: stm32f7: Use devm_clk_get_enabled() - USB: serial: option: add Foxconn T99W709 - smb: server: Fix extension string in ksmbd_extract_shortname() - ksmbd: fix corrupted mtime and ctime in smb2_open - ksmbd: fix Preauh_HashValue race condition - ksmbd: fix null pointer dereference error in generate_encryptionkey - vsock: Do not allow binding to VMADDR_PORT_ANY - selftests/perf_events: Add a mmap() correctness test - smb: client: return an error if rdma_connect does not return within 5 seconds - smb: client: let recv_done() cleanup before notifying the callers. - smb: client: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already - smb: client: make use of common smbdirect_socket - smb: smbdirect: add smbdirect_socket.h - smb: client: Correct typos in multiple comments across various files - smb: client: Use min() macro - smb: server: let recv_done() avoid touching data_transfer after cleanup/move - smb: server: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already - ALSA: hda/ca0132: Fix missing error handling in ca0132_alt_select_out() - irqchip: Build IMX_MU_MSI only on ARM - net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing - sunrpc: fix client side handling of tls alerts - net/sched: taprio: enforce minimum value for picos_per_byte - net: drop UFO packets in udp_rcv_segment() - ipv6: reject malicious packets in ipv6_gso_segment() - net/mlx5: Correctly set gso_segs when LRO is used - netlink: specs: ethtool: fix module EEPROM input/output arguments - net: ipa: add IPA v5.1 and v5.5 to ipa_version_string() - phy: mscc: Fix parsing of unicast frames - netpoll: prevent hanging NAPI when netcons gets enabled - md/md-cluster: handle REMOVE message earlier - NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY - NFS: Fix wakeup of __nfs_lookup_revalidate() in unblock_revalidate() - sched: Add test_and_clear_wake_up_bit() and atomic_dec_and_wake_up() - pNFS/flexfiles: don't attempt pnfs on fatal DS errors - PCI: pnv_php: Fix surprise plug detection and recovery - powerpc/eeh: Export eeh_unfreeze_pe() - PCI: pnv_php: Work around switches with broken presence detection - kconfig: qconf: fix ConfigList::updateListAllforAll() - scsi: sd: Make sd shutdown issue START STOP UNIT appropriately - scsi: ufs: core: Use link recovery when h8 exit fails during runtime resume - scsi: Revert "scsi: iscsi: Fix HW conn removal use after free" - scsi: mpt3sas: Fix a fw_event memory leak - vfio/pci: Separate SR-IOV VF dev_set - vfio/pds: Fix missing detach_ioas op - vfio: Prevent open_count decrement to negative - vfio: Fix unbalanced vfio_df_close call in no-iommu mode - f2fs: fix to calculate dirty data during has_not_enough_free_secs() - f2fs: fix to update upper_p in __get_secs_required() correctly - f2fs: vm_unmap_ram() may be called from an invalid context - f2fs: fix to avoid out-of-boundary access in devs.path - f2fs: doc: fix wrong quota mount option description - f2fs: fix KMSAN uninit-value in extent_info usage - rtc: rv3028: fix incorrect maximum clock rate handling - rtc: pcf8563: fix incorrect maximum clock rate handling - rtc: pcf85063: fix incorrect maximum clock rate handling - rtc: nct3018y: fix incorrect maximum clock rate handling - rtc: hym8563: fix incorrect maximum clock rate handling - rtc: ds1307: fix incorrect maximum clock rate handling - ucount: fix atomic_long_inc_below() argument type - module: Restore the moduleparam prefix length check - apparmor: fix loop detection used in conflicting attachment resolution - apparmor: ensure WB_HISTORY_SIZE value is a power of 2 - bpf: Check netfilter ctx accesses are aligned - bpf: Check flow_dissector ctx accesses are aligned - vhost-scsi: Fix log flooding with target does not exist errors - mtd: rawnand: atmel: set pmecc data setup time - mtd: rawnand: rockchip: Add missing check after DMA map - mtd: rawnand: atmel: Fix dma_mapping_error() address - jfs: fix metapage reference count leak in dbAllocCtl - crypto: qat - fix seq_file position update in adf_ring_next() - crypto: qat - fix DMA direction for compression on GEN2 devices - perf tools: Remove libtraceevent in .gitignore - sh: Do not use hyphen in exported variable name - ASoC: fsl_xcvr: get channel status data when PHY is not exists - dmaengine: nbpfaxi: Add missing check after DMA map - dmaengine: mv_xor: Fix missing check after DMA map and missing unmap - fs/orangefs: Allow 2 more characters in do_c_string() - PCI: endpoint: pci-epf-vntb: Fix the incorrect usage of __iomem attribute - soundwire: stream: restore params when prepare ports fail - crypto: img-hash - Fix dma_unmap_sg() nents value - crypto: keembay - Fix dma_unmap_sg() nents value - hwrng: mtk - handle devm_pm_runtime_enable errors - watchdog: ziirave_wdt: check record length in ziirave_firm_verify() - scsi: isci: Fix dma_unmap_sg() nents value - scsi: mvsas: Fix dma_unmap_sg() nents value - scsi: elx: efct: Fix dma_unmap_sg() nents value - scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value - clk: sunxi-ng: v3s: Fix de clock definition - perf tests bp_account: Fix leaked file descriptor - kernel: trace: preemptirq_delay_test: use offstack cpu mask - crypto: inside-secure - Fix `dma_unmap_sg()` nents value - perf sched: Fix memory leaks in 'perf sched latency' - perf sched: Fix memory leaks for evsel->priv in timehist - perf sched: Free thread->priv using priv_destructor - perf dso: Add missed dso__put to dso__load_kcore - perf tools: Fix use-after-free in help_unknown_cmd() - Fix dma_unmap_sg() nents value - clk: clk-axi-clkgen: fix fpfd_max frequency for zynq - fanotify: sanitize handle_type values when reporting fid - pinctrl: sunxi: Fix memory leak on krealloc failure - PCI: endpoint: pci-epf-vntb: Return -ENOENT if pci_epc_get_next_free_bar() fails - crypto: arm/aes-neonbs - work around gcc-15 warning - power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set - power: supply: cpcap-charger: Fix null check for power_supply_get_by_name - clk: xilinx: vcu: unregister pll_post only if registered correctly - media: v4l2-ctrls: Fix H264 SEPARATE_COLOUR_PLANE check - mtd: fix possible integer overflow in erase_xfer() - crypto: marvell/cesa - Fix engine load inaccuracy - crypto: qat - use unmanaged allocation for dc_data - crypto: sun8i-ce - fix nents passed to dma_unmap_sg() - PCI: rockchip-host: Fix "Unexpected Completion" log message - bpf/preload: Don't select USERMODE_DRIVER - ipv6: annotate data-races around rt->fib6_nsiblings - ipv6: fix possible infinite loop in fib6_info_uses_dev() - vrf: Drop existing dst reference in vrf_ip6_input_dst - selftests: rtnetlink.sh: remove esp4_offload after test - net/mlx5e: Clear Read-Only port buffer size in PBMC before update - netfilter: xt_nfacct: don't assume acct name is null-terminated - can: kvaser_usb: Assign netdev.dev_port based on device channel index - can: kvaser_pciefd: Store device channel index - can: peak_usb: fix USB FD devices potential malfunction - tools/rv: Do not skip idle in trace - Bluetooth: hci_event: Mask data status from LE ext adv reports - kcsan: test: Initialize dummy variable - wifi: mac80211: Write cnt before copying in ieee80211_copy_rnr_beacon() - wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE - wifi: ath12k: fix endianness handling while accessing wmi service bit - wifi: mac80211: Check 802.11 encaps offloading in ieee80211_tx_h_select_key() - wifi: mac80211: Don't call fq_flow_idx() for management frames - wifi: mac80211: Do not schedule stopped TXQs - wifi: plfxlc: Fix error handling in usb driver probe - wifi: mac80211: reject TDLS operations when station is not associated - iommu/amd: Fix geometry.aperture_end for V2 tables - mwl8k: Add missing check after DMA map - wifi: rtl8xxxu: Fix RX skb size for aggregation disabled - tcp: call tcp_measure_rcv_mss() for ooo packets - xen/gntdev: remove struct gntdev_copy_batch from stack - net_sched: act_ctinfo: use atomic64_t for three counters - net/sched: Restrict conditions for adding duplicating netems to qdisc tree - um: rtc: Avoid shadowing err in uml_rtc_start() - arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX - netfilter: nf_tables: adjust lockdep assertions handling - netfilter: nf_tables: Drop dead code from fill_*_info routines - fbcon: Fix outdated registered_fb reference in comment - drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value - m68k: Don't unregister boot console needlessly - drm/msm/dpu: Fill in min_prefill_lines for SC8180X - kselftest/arm64: Fix check for setting new VLs in sve-ptrace - net: dst: annotate data-races around dst->input - tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range - wifi: ath11k: clear initialized flag for deinit-ed srng lists - iwlwifi: Add missing check for alloc_ordered_workqueue - wifi: iwlwifi: Fix memory leak in iwl_mvm_init() - wifi: rtl818x: Kill URBs before clearing tx status queue - wifi: rtw89: avoid NULL dereference when RX problematic packet on unsupported 6 GHz band - caif: reduce stack size, again - bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure - drm/vmwgfx: Fix Host-Backed userspace on Guest-Backed kernel - net: ipv6: ip6mr: Fix in/out netdev to pass to the FORWARD chain - selftests/bpf: fix signedness bug in redir_partial() - bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls - bpf, sockmap: Fix psock incorrectly pointing to sk - drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed - staging: nvec: Fix incorrect null termination of battery manufacturer - interconnect: qcom: sc8180x: specify num_nodes - interconnect: qcom: sc8280xp: specify num_links for qnm_a1noc_cfg - soc: qcom: pmic_glink: fix OF node leak - samples: mei: Fix building on musl libc - cpufreq: Initialize cpufreq-based frequency-invariance later - cpufreq: intel_pstate: Always use HWP_DESIRED_PERF in passive mode - arm64: dts: imx8mn-beacon: Fix HS400 USDHC clock speed - arm64: dts: imx8mm-beacon: Fix HS400 USDHC clock speed - ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface - soc/tegra: cbb: Clear ERR_FORCE register with ERR_STATUS - arm: dts: ti: omap: Fixup pinheader typo - usb: early: xhci-dbc: Fix early_ioremap leak - powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw() - pps: fix poll support - staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() - spi: stm32: Check for cfg availability in stm32_spi_probe - usb: misc: apple-mfi-fastcharge: Make power supply names unique - usb: host: xhci-plat: fix incorrect type for of_match variable in xhci_plat_probe() - ARM: dts: vfxxx: Correctly use two tuples for timer address - arm64: dts: qcom: msm8976: Make blsp_dma controlled-remotely - arm64: dts: qcom: sc7180: Expand IMEM region - arm64: dts: qcom: sdm845: Expand IMEM region - soc: qcom: QMI encoding/decoding for big endian - selftests: Fix errno checking in syscall_user_dispatch test - ASoC: mediatek: use reserved memory or enable buffer pre-allocation - gfs2: No more self recovery - Revert "fs/ntfs3: Replace inode_trylock with inode_lock" - hfs: make splice write available again - hfsplus: make splice write available again - ublk: use vmalloc for ublk_device's __queues - fs_context: fix parameter name in infofc() macro - audit,module: restore audit logging in load failure case - ASoC: amd: yc: add DMI quirk for ASUS M6501RM - ASoC: Intel: fix SND_SOC_SOF dependencies - ASoC: amd: yc: Add DMI entries to support HP 15-fb1xxx - ethernet: intel: fix building with large NR_CPUS - ASoC: amd: yc: Add DMI quirk for HP Laptop 17 cp-2033dx - interference: Fix uninitialized ifs_clock compiling issue - iommu/ummu: optimize log printing - !20455 Fix compilation failure caused by PR#20174 - !20302 CVE-2026-22980 - !20142 CVE-2025-68803 - !20261 ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency - !20435 fix CVE-2026-22998 - !20433 scsi: target: Reset t_task_cdb pointer in error case - !20432 scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" - !20431 block: Use RCU in blk_mq_[un - !20307 tpm: Cap the number of PCR banks - !20062 xfs: Add xfs_dir3_leaf_header_check() in leaf/leafn read - !20157 v2 md: backport from mainline - rcu: Protect ->defer_qs_iw_pending from data race - platform/x86/intel/pmt: fix compilation failure caused by PR#20174 - iommu/ummu: optimize kv cache memory management - iommu/ummu: optimize permission table management - iommu/ummu: remove check for eid_type while del eid - iommu/ummu: optimize the code implementation - drivers/perf: fix ummu-pmu data reading exception - iommu/ummu: IOMMU_DOMAIN_BLOCKED type don not sync tct - drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer - crypto: seqiv - Do not use req->iv after crypto_aead_encrypt - net: unic: Notify mami of the bond ip change. - ub: ubase: Support for UE link by ctrlq message - ub: ubase: send a deactivate req in removing - ub: ubase: Querying TPG/TP contexts in the chip is no longer supported after enabling safe mode. - ub: ubase: Use an independent thread for the ctrlq workqueue. - !20368 ubcore: fix logging and permission for route query. - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id - !20344 ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr - net: unic: Fix the ummu 0xa event that occurs when modifying queues and resetting concurrent scenarios - ub: ubase: Add KABI compatibility - ub: ubase: fixing the issue of cdma ctp_req_vl parameter configuration - ub: ubase: add PMU IDEV interrupt supported abilities. - ub: ubase: Delete the tid mask for eq, jfs, jfr, and jfc context - ub: ubase: Set the completion event interrupt to auto - net: unic: fix poll tx read old skb cause a UAF bug - !20249 Fix CVE-2025-38489 - !20250 Fix CVE-2025-38480 - !20378 Fix CVE-2025-39838 - !20430 Fix CVE-2025-39942 - !20351 Fix CVE-2025-71149 - !20375 Fix CVE-2025-71150 - !20323 Fix CVE-2025-38730 - !20320 Fix CVE-2025-68814 - !20314 Fix CVE-2025-71072 - !20315 Fix CVE-2025-68794 - !20403 bpf: Check skb->transport_header is set in bpf_skb_check_mtu - !20402 bpf: Do not let BPF test infra emit invalid GSO types to stack - !20401 tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() - !20400 netfilter: nft_ct: add seqadj extension for natted connections - !20399 net: xfrm: Fix CVE-2025-40215 - !20398 net/sched: sch_qfq: Fix null-deref in agg_dequeue - !20397 bpf: Reject narrower access to pointer ctx fields - !20396 Bluetooth: eir: Fix possible crashes on eir_create_adv_data - !20394 IB/mlx5: Fix potential deadlock in MR deregistration - !20367 ub: cdma: cdma uaf bugfix - net/mlx5e: Fix crash on profile change rollback failure - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv - PCI/AER: Fix NULL pointer access by aer_info - gfs2: No more self recovery - drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE - crypto: qat - flush misc workqueue during device shutdown - !20174 Backport PMT spec 3.0 support - !20366 [Hygon][6.6][Bugfix]: Resolve FPU state corruption between atomic and non-atomic contexts - !19814 [OLK-6.6] Batch flushing user memory encrytion status change - !20393 [OLK-6.6][linux-6.6.y sync] Backport 6.6.100-6.6.101 LTS Patches - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec - nvmet-tcp: remove boilerplate code - scsi: target: Reset t_task_cdb pointer in error case - scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" - block: Use RCU in blk_mq_[un]quiesce_tagset() instead of set->tag_list_lock - ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size - ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer - smb: server: let recv_done() consistently call put_recvmsg/smb_direct_disconnect_rdma_connection - smb: server: remove separate empty_recvmsg_queue - !20384 ub:ubus: Fix ubus link message and pool device error - !20389 gfs2: Prevent recursive memory reclaim - !20388 *** fix CVE-2025-38062 *** - !20387 KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced - !20386 pinctrl: check the return value of pinmux_ops::get_function_name() - !20385 iommu/amd/pgtbl: Fix possible race while increase page table level - ub:ubus: Not cfg access during surprise down - ub:hisi-ubus: Delete validate_pa err print - PCI: cadence: Check for the existence of cdns_pcie::ops before using it - can: netlink: can_changelink(): allow disabling of automatic restart - Revert "selftests/bpf: Add a cgroup prog bpf_get_ns_current_pid_tgid() test" - drm/sched: Remove optimization that causes hang when killing dependent jobs - ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS - bpf: Check skb->transport_header is set in bpf_skb_check_mtu - bpf: Do not let BPF test infra emit invalid GSO types to stack - tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() - netfilter: nft_ct: add seqadj extension for natted connections - xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added - xfrm: delete x->tunnel as we delete x - x86/hw-vuln:Support hardware-based mitigation for Retbleed and SRSO via Hygon IBRS to avoid performance degradation caused by software-based mitigation. - net/sched: sch_qfq: Fix null-deref in agg_dequeue - bpf: Reject narrower access to pointer ctx fields - Bluetooth: eir: Fix possible crashes on eir_create_adv_data - IB/mlx5: Fix potential deadlock in MR deregistration - ub:ubus: Fix ubus link message and pool device error - ub:hisi-ubus: cq poller maximum handle 64 cqe per time - ub:hisi-ubus:Fix vdm message print error - ub:ubus:Fix ubus interrupt release issue - wifi: mt76: mt7921: prevent decap offload config before STA initialization - mtd: rawnand: qcom: Fix last codeword read in qcom_param_page_type_exec() - iio: hid-sensor-prox: Restore lost scale assignments - iio: hid-sensor-prox: Fix incorrect OFFSET calculation - crypto: powerpc/poly1305 - add depends on BROKEN for now - erofs: address D-cache aliasing - drm/i915/dp: Fix 2.7 Gbps DP_LINK_BW value on g4x - ALSA: hda: Add missing NVIDIA HDA codec IDs - ALSA: hda/tegra: Add Tegra264 support - comedi: comedi_test: Fix possible deletion of uninitialized timers - usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach - usb: typec: tcpm: allow switching to mode accessory to mux properly - usb: typec: tcpm: allow to use sink in accessory mode - drm/amdkfd: Don't call mmput from MMU notifier callback - mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n - selftests: mptcp: connect: also cover checksum - selftests: mptcp: connect: also cover alt modes - resource: fix false warning in __request_region() - gve: Fix stuck TX queue for DQ queue format - e1000e: ignore uninitialized checksum word on tgp - e1000e: disregard NVM checksum on tgp when valid checksum bit is not set - dpaa2-switch: Fix device reference count leak in MAC endpoint handling - dpaa2-eth: Fix device reference count leak in MAC endpoint handling - ALSA: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx - sprintf.h requires stdarg.h - bus: fsl-mc: Fix potential double device reference in fsl_mc_get_endpoint() - i2c: virtio: Avoid hang by using interruptible completion wait - i2c: tegra: Fix reset error handling with ACPI - platform/x86: ideapad-laptop: Fix kbd backlight not remembered among boots - can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode - can: dev: can_restart(): move debug message and stats after successful restart - can: dev: can_restart(): reverse logic to remove need for goto - i40e: When removing VF MAC filters, only check PF-set MAC - i40e: report VF tx_dropped with tx_errors instead of tx_discards - i40e: Add rx_missed_errors for buffer exhaustion - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch - net/mlx5: Fix memory leak in cmd_exec() - staging: vchiq_arm: Make vchiq_shutdown never fail - x86/hyperv: Fix usage of cpu_online_mask to get valid cpu - regmap: fix potential memory leak of regmap_bus - iio: adc: ad7949: use spi_is_bpw_supported() - interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1 node - RDMA/core: Rate limit GID cache warning messages - virtio_ring: Fix error reporting in virtqueue_resize - !20348 [OLK-6.6][linux-6.6.y sync] Backport 6.6.99-6.6.100 LTS Patches - !20346 tracing: Fix crash on synthetic stacktrace field usage - vfs: Don't leak disconnected dentries on umount - !20334 Fix CVE-2025-68780 - gfs2: Prevent recursive memory reclaim - amd/amdkfd: enhance kfd process check in switch partition - drm/amdkfd: allow compute partition mode switch with cgroup exclusions - KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced - pinctrl: check the return value of pinmux_ops::get_function_name() - iommu/amd/pgtbl: Fix possible race while increase page table level - !19966 nvme-fc: use lock accessing port_state and rport state - ASoC: fsl_sai: replace regmap_write with regmap_update_bits - comedi: Fix use of uninitialized data in insn_rw_emulate_bits() - cifs: prevent NULL pointer dereference in UTF16 conversion - ksmbd: Fix refcount leak when invalid session is found on session lookup - ubcore: fix logging and permission for route query. - !20232 driver/coda: VirtCCA supports MSI device DA - Revert "Revert "RDMA/hns: Fix mismatch exception rollback"" - !20197 ub: udma&ubase: fix a bug that caused long reboot time - x86: Resolve FPU state corruption between atomic and non-atomic contexts - ub: cdma: cdma uaf bugfix - ub: cdma: jfs call trace bugfix - !20353 x86/fpu: Clear XSTATE_BV[i - s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again - KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls - nvmem: layouts: u-boot-env: remove crc32 endianness conversion - i2c: omap: fix deprecated of_property_read_bool() use - ASoC: fsl_sai: Force a software reset when starting in consumer mode - regulator: pwm-regulator: Manage boot-on with disabled PWM channels - regulator: pwm-regulator: Calculate the output voltage for disabled PWMs - i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe() - i2c: omap: Fix an error handling path in omap_i2c_probe() - i2c: omap: Add support for setting mux - usb: dwc3: qcom: Don't leave BCR asserted - usb: hub: Don't try to recover devices lost during warm reset. - usb: hub: Fix flushing of delayed work used for post resume purposes - usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm - usb: hub: fix detection of high tier USB3 devices behind suspended hubs - arm64: Filter out SME hwcaps when FEAT_SME isn't implemented - ipv6: make addrconf_wq single threaded - !20354 cpufreq/sched: Explicitly synchronize limits_changed flag handling - sched/deadline: only set free_cpus for online runqueues - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 - cpufreq/sched: Explicitly synchronize limits_changed flag handling - io_uring/poll: correctly handle io_poll_add() return value on update - shmem: fix recovery on rename failures - io_uring: fix filename leak in __io_openat_prep() - Revert "cgroup_freezer: cgroup_freezing: Check if not frozen" - rxrpc: Fix transmission of an abort in response to an abort - rxrpc: Fix recv-recv race of completed call - net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree - net: bridge: Do not offload IGMP/MLD messages - hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf - netfilter: nf_conntrack: fix crash due to removal of uninitialised entry - ipv6: mcast: Delay put pmc->idev in mld_del_delrec() - net/mlx5: Correctly set gso_size when LRO is used - Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID - Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout - Bluetooth: SMP: If an unallowed command is received consider it a failure - Bluetooth: hci_sync: fix connectable extended advertising when using static random address - hwmon: (corsair-cpro) Validate the size of the received input buffer - selftests: net: increase inter-packet timeout in udpgro.sh - wifi: cfg80211: remove scan request n_channels counted_by - nvme: fix misaccounting of nvme-mpath inflight I/O - net: phy: Don't register LEDs for genphy - nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list() - rpl: Fix use-after-free in rpl_do_srh_inline(). - block: fix kobject leak in blk_unregister_queue - net: emaclite: Fix missing pointer increment in aligned_read() - soundwire: amd: fix for clearing command status register - soundwire: amd: fix for handling slave alerts after link is down - comedi: Fix use of uninitialized data in insn_rw_emulate_bits() - comedi: Fix some signed shift left operations - comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large - comedi: das6402: Fix bit shift out of bounds - comedi: das16m1: Fix bit shift out of bounds - comedi: aio_iiro_16: Fix bit shift out of bounds - comedi: pcl812: Fix bit shift out of bounds - iio: adc: stm32-adc: Fix race in installing chained IRQ handler - iio: adc: max1363: Reorder mode_list[] entries - iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] - iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush - soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled - soc: aspeed: lpc-snoop: Cleanup resources in stack-order - s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again - pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov - net: libwx: properly reset Rx ring descriptor - net: libwx: remove duplicate page_pool_put_full_page() - mmc: sdhci_am654: Workaround for Errata i2312 - mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models - mmc: bcm2835: Fix dma_unmap_sg() nents value - memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() - isofs: Verify inode mode when loading from disk - dmaengine: nbpfaxi: Fix memory corruption in probe() - af_packet: fix soft lockup issue caused by tpacket_snd() - af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() - arm64: dts: rockchip: use cs-gpios for spi1 on ringneck - arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on - arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency - net/mlx5: Update the list of the PCI supported devices - phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() - io_uring/poll: fix POLLERR handling - ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS - drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume - tracing/osnoise: Fix crash in timerlat_dump_stack() - spi: Add check for 8-bit transfer with 8 IO mode support - pch_uart: Fix dma_sync_sg_for_device() nents value - thunderbolt: Fix bit masking in tb_dp_port_set_hops() - i2c: stm32: fix the device used for the DMA map - tracing: Fix crash on synthetic stacktrace field usage - usb: musb: fix gadget state on disconnect - USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI - USB: serial: option: add Foxconn T99W640 - USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition - phy: tegra: xusb: Disable periodic tracking on Tegra234 - phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode - phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr - fs/proc: fix uaf in proc_readdir_de() - io_uring/net: commit partial buffers on retry - nvme: fix admin request_queue lifetime - fs/notify: call exportfs_encode_fid with s_umount - iomap: adjust read range correctly for non-block-aligned positions - fuse: fix livelock in synchronous file put from fuseblk workers - tpm: Cap the number of PCR banks - nfsd: provide locking for v4_end_grace - Revert "nfsd: provide locking for v4_end_grace" - config: enable config for PMT discovery driver - platform/x86/intel/pmt/discovery: use valid device pointer in dev_err_probe - platform/x86/intel/pmt: Fix kobject memory leak on init failure - platform/x86/intel/pmt: fix a crashlog NULL pointer access - platform/x86/intel/pmt: fix build dependency for kunit test - platform/x86/intel/pmt/discovery: fix format string warning - platform/x86/intel/pmt/discovery: Fix size_t specifiers for 32-bit - platform/x86/intel/pmt: KUNIT test for PMT Enhanced Discovery API - platform/x86/intel/pmt/telemetry: Add API to retrieve telemetry regions by feature - platform/x86/intel/pmt/discovery: Get telemetry attributes - platform/x86/intel/tpmi: Get OOBMSM CPU mapping from TPMI - platform/x86/intel/vsec: Set OOBMSM to CPU mapping - platform/x86/intel/tpmi: Relocate platform info to intel_vsec.h - docs: Add ABI documentation for intel_pmt feature directories - platform/x86/intel/pmt: Add PMT Discovery driver - sysfs: Fix crash on empty group attributes array - sysfs: Introduce a mechanism to hide static attribute_groups - platform/x86/intel/vsec: Add new Discovery feature - platform/x86/intel/vsec: Skip driverless features - platform/x86/intel/vsec: Skip absent features during initialization - platform/x86/intel/vsec: Add device links to enforce dependencies - platform/x86/intel/vsec: Create wrapper to walk PCI config space - platform/x86/intel/vsec: Add private data for per-device data - MAINTAINERS: Add link to documentation of Intel PMT ABI - platform/x86/intel/pmt: allow user offset for PMT callbacks - driver/coda: VirtCCA supports MSI device DA - ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency - Rename leapioraid to leapraid and release v2.0 - ub: udma: fix a bug that caused long reboot time. - ub: ubase: Accelerate when ctrl node is shutting down - platform/x86/intel/pmt: Use PMT callbacks - platform/x86/intel/vsec: Add PMT read callbacks - platform/x86/intel/vsec.h: Move to include/linux - md: prevent incorrect update of resync/recovery offset - md/raid1: Fix data corruption for degraded array with slow disk - md/raid1: set max_sectors during early return from choose_slow_rdev() - md-cluster: fix no recovery job when adding/re-adding a disk - md-cluster: fix hanging issue while a new disk adding - md/raid5: recheck if reshape has finished with device_lock held - md-cluster: Constify struct md_cluster_operations - md: Remove unneeded semicolon - md/raid5: fix spares errors about rcu usage - dm-raid: Fix WARN_ON_ONCE check for sync_thread in raid_resume - md: pass in max_sectors for pers->sync_request() - md: factor out helpers for different sync_action in md_do_sync() - md: replace last_sync_action with new enum type - md: use new helpers in md_do_sync() - md: don't fail action_store() if sync_thread is not registered - md: remove parameter check_seq for stop_sync_thread() - md: replace sysfs api sync_action with new helpers - md: factor out helper to start reshape from action_store() - md: add new helpers for sync_action - md: add a new enum type sync_action - md: rearrange recovery_flags - md/raid0: don't free conf on raid0_run failure - md: make md_flush_request() more readable - md: change the return value type of md_write_start to void - md: Revert "md: Fix overflow in is_mddev_idle" - md: don't account sync_io if iostats of the disk is disabled - md: Fix overflow in is_mddev_idle - md: add check for sleepers in md_wakeup_thread() - md: add a mddev_is_dm helper - md: add a mddev_add_trace_msg helper - md: add a mddev_trace_remap helper - dm-raid456, md/raid456: fix a deadlock for dm-raid456 while io concurrent with reshape - dm-raid: add a new helper prepare_suspend() in md_personality - dm-raid: really frozen sync_thread during suspend - md: add a new helper reshape_interrupted() - md: export helper md_is_rdwr() - md: export helpers to stop sync_thread - md: don't clear MD_RECOVERY_FROZEN for new dm-raid until resume - md/raid1: factor out helpers to choose the best rdev from read_balance() - md/raid1: factor out the code to manage sequential IO - md/raid1: factor out choose_bb_rdev() from read_balance() - md/raid1: factor out choose_slow_rdev() from read_balance() - md/raid1: factor out read_first_rdev() from read_balance() - md/raid1-10: factor out a new helper raid1_should_read_first() - md/raid1-10: add a helper raid1_check_read_range() - md/raid1: fix choose next idle in read_balance() - md/raid1: record nonrot rdevs while adding/removing rdevs to conf - md/raid1: factor out helpers to add rdev to conf - md: add a new helper rdev_has_badblock() - md: check mddev->pers before calling md_set_readonly() - md: clean up openers check in do_md_stop() and md_set_readonly() - md: sync blockdev before stopping raid or setting readonly - md: factor out a helper to sync mddev - md: return directly before setting did_set_md_closing - md: changed the switch of RAID_VERSION to if - md: merge the check of capabilities into md_ioctl_valid() - md: Don't suspend the array for interrupted reshape - md: Don't register sync_thread for reshape directly - md: Make sure md_do_sync() will set MD_RECOVERY_DONE - md: Don't ignore read-only array in md_check_recovery() - md: Don't ignore suspended array in md_check_recovery() - md: get rdev->mddev with READ_ONCE() - md: remove redundant md_wakeup_thread() - md: remove redundant check of 'mddev->sync_thread' - md: fix a suspicious RCU usage warning - raid: Remove now superfluous sentinel element from ctl_table array - NFSD: NFSv4 file creation neglects setting ACL - nfsd: set security label during create operations - xfs: Add xfs_dir3_leaf_header_check() in leaf/leafn read - nvme-fc: use lock accessing port_state and rport state - x86/mm: Batch flushing user memory encrytion status change - !20588 [OLK-6.6] Revert "x86/csv: Enhance CMA memory usage reporting for CSV3" - Revert "x86/csv: Enhance CMA memory usage reporting for CSV3" - !20576 media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg() - !20575 RDMA/cm: Fix leaking the multicast GID table reference - !20580 RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly - !20551 Fix CVE-2025-68785 - !20478 f2fs: fix to avoid potential deadlock - !20501 [OLK-6.6] backport important bugfix for bnxt driver from upstream linux-6.6.y - !20520 Fix CVE-2026-23038 - !20424 net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup - !20425 mlx5: Fix default values in create CQ - RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly - media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg() - RDMA/cm: Fix leaking the multicast GID table reference - net: openvswitch: fix middle attribute validation in push_nsh() action - net: openvswitch: remove never-working support for setting nsh fields - pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() - bnxt_en: Fix potential data corruption with HW GRO/LRO - f2fs: fix to avoid potential deadlock - mlx5: Fix default values in create CQ - net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup - riscv kernel upgrade to 6.6.0-138.0.0 - Fixed system hang when boot systemd on spacemit k3 - riscv: perf vendor events: fix lrw core PMU event mapping - !20727 v2 bpf: sockmap fixes - !20741 scsi: qla2xxx: Sanitize payload size to prevent member overflow - !20744 fix CVE-2025-38449 - !20763 net: usb: asix: validate PHY address before use - !20762 smc91x: fix broken irq-context in PREEMPT_RT - !20293 [Hygon][6.6][EDAC] The width of hash value is 2 bits for Hygon family 18h model 6h processors - !20290 [Hygon][6.6][Bugfix] Bug fix for EDAC to use unicast instead of broadcast on hygon family 18h model 4h - !20289 [Hygon][6.6][Bugfix] Bug fix for EDAC to correct the address translation on hygon family 18h model 4h - !20245 KVM: arm64: Refactor exit handlers - !20246 KVM: arm64: Mark some header functions as inline - !19005 [Hygon] [OLK-6.6] [Bugfix] Fix memory bandwidth counter width for Hygon QoS - !20292 [Hygon][6.6][TSC Adjust] Backport x86 TSC adjust patch - !20273 [Hygon][6.6][Bugfix] Get correct CPU LLC ID in guest for Hygon processors - !20722 [OLK-6.6][linux-6.6.y sync] Backport 6.6.104-6.6.106 LTS Patches - !20667 fix CVE-2024-50102 - !20736 netfilter: nf_tables: remove redundant chain validation on register store - !20758 ub: ubase: Fixed the alarm issue caused by the initialization of the structure variable definition. - !20721 obmm: reduce log noise for successful export/import/preimport - net: usb: asix: validate PHY address before use - smc91x: fix broken irq-context in PREEMPT_RT - !20731 devlink: rate: Unset parent pointer in devl_rate_nodes_destroy - !20732 libceph: return the handler error from mon_handle_auth_done() - !20743 mm: slub: avoid wake up kswapd in set_track_prepare - ub: ubase: Fixed the alarm issue caused by the initialization of the structure variable definition. - !20750 ub: cdma: adapted to UMMU interface changes - !20713 urma: DFX of log in kernel - urma: optimize log levels for kernel space - ub: cdma: adapted to UMMU interface changes - wifi: ath11k: avoid bit operation on key flags - drm/mediatek: fix potential OF node use-after-free - cpufreq: intel_pstate: Check IDA only before MSR_IA32_PERF_CTL writes - wifi: cfg80211: sme: store capped length in __cfg80211_connect_result() - !20708 ub:hisi-ubus: Add create bus instance ummu bypass - drm: fix kabi for struct drm_framebuffer - drm/framebuffer: Acquire internal references on GEM handles - drm/gem: Acquire references on GEM handles for framebuffers - mm: slub: avoid wake up kswapd in set_track_prepare - scsi: qla2xxx: Sanitize payload size to prevent member overflow - netfilter: nf_tables: remove redundant chain validation on register store - libceph: return the handler error from mon_handle_auth_done() - devlink: rate: Unset parent pointer in devl_rate_nodes_destroy - Documentation/hw-vuln: Add VMSCAPE documentation - dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status() - riscv: use lw when reading int cpu in asm_per_cpu - mm: slub: avoid wake up kswapd in set_track_prepare - tools: gpio: remove the include directory on make clean - tools: gpio: rm .*.cmd on make clean - drm/amd/amdgpu: Fix missing error return on kzalloc failure - drm/amdgpu: Replace DRM_* with dev_* in amdgpu_psp.c - perf bpf-event: Fix use-after-free in synthesis - drm/bridge: ti-sn65dsi86: fix REFCLK setting - spi: spi-fsl-lpspi: Clear status register after disabling the module - spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort - spi: spi-fsl-lpspi: Set correct chip-select polarity bit - spi: spi-fsl-lpspi: Fix transmissions when using CONT - hwmon: mlxreg-fan: Prevent fans from getting stuck at 0 RPM - pcmcia: omap: Add missing check for platform_get_resource - Revert "drm/amdgpu: Avoid extra evict-restore process." - ALSA: hda/realtek: Fix headset mic for TongFang X6[AF]R5xxY - ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model - drm/mediatek: Fix device/node reference count leaks in mtk_drm_get_all_drm_priv - drm/mediatek: Fix using wrong drm private data to bind mediatek-drm - drm/mediatek: Add crtc path enum for all_drm_priv array - vmxnet3: update MTU after device quiesce - net: dsa: microchip: linearize skb for tail-tagging switches - net: dsa: microchip: update tag_ksz masks for KSZ9477 family - dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status() - ALSA: hda/realtek - Add new HP ZBook laptop with micmute led fixup - ALSA: hda/realtek: Add support for HP Agusta using CS35L41 HDA - iio: pressure: mprls0025pa: use aligned_s64 for timestamp - iio: chemical: pms7003: use aligned_s64 for timestamp - iio: imu: inv_mpu6050: align buffer for timestamp - thermal/drivers/mediatek/lvts: Disable low offset IRQ for minimum threshold - nouveau: fix disabling the nonstall irq due to storm code - cpufreq: intel_pstate: Unchecked MSR aceess in legacy mode - net: pcs: rzn1-miic: Correct MODCTRL register offset - platform/x86/amd/pmc: Add TUXEDO IB Pro Gen10 AMD to spurious 8042 quirks list - drm/amdgpu: drop hw access in non-DC audio fini - wifi: mt76: mt7996: Initialize hdr before passing to skb_put_data() - wifi: mwifiex: Initialize the chan_stats array to zero - tcp_bpf: Fix copied value in tcp_bpf_sendmsg - skmsg: Return copied bytes in sk_msg_memcopy_from_iter - tcp_bpf: Add sk_rmem_alloc related logic for tcp_bpf ingress redirection - Revert "bpf, sockmap: Add sk_rmem_alloc check for sockmap" - ALSA: usb-audio: Add mute TLV for playback volumes on some devices - phy: mscc: Stop taking ts_lock for tx_queue and use its own lock - selftest: net: Fix weird setsockopt() in bind_bhash.c. - net: atm: fix memory leak in atm_register_sysfs when device_register fail - ax25: properly unshare skbs in ax25_kiss_rcv() - mctp: return -ENOPROTOOPT for unknown getsockopt options - net/smc: Remove validation of reserved bits in CLC Decline message - ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init() - net: thunder_bgx: decrement cleanup index before use - net: thunder_bgx: add a missing of_node_put - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() - wifi: libertas: cap SSID len in lbs_associate() - wifi: cw1200: cap SSID length in cw1200_do_join() - net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets - wifi: ath11k: fix group data packet drops during rekey - wifi: ath11k: avoid forward declaration of ath11k_mac_start_vdev_delay() - wifi: ath11k: rename ath11k_start_vdev_delay() - wifi: ath11k: Introduce and use ath11k_sta_to_arsta() - net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() - macsec: read MACSEC_SA_ATTR_PN with nla_get_uint - netlink: add variable-length / auto integers - net: macb: Fix tx_ptr_lock locking - icmp: fix icmp_ndo_send address translation for reply direction - mISDN: Fix memory leak in dsp_hwec_enable() - xirc2ps_cs: fix register access when enabling FullDuplex - netfilter: conntrack: helper: Replace -EEXIST by -EBUSY - wifi: cfg80211: fix use-after-free in cmp_bss() - arm64: dts: imx8mp: Fix missing microSD slot vqmmc on Data Modul i.MX8M Plus eDM SBC - arm64: dts: imx8mp: Fix missing microSD slot vqmmc on DH electronics i.MX8M Plus DHCOM - tee: optee: ffa: fix a typo of "optee_ffa_api_is_compatible" - arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro - Bluetooth: hci_sync: Avoid adding default advertising on startup - cpupower: Fix a bug where the -t option of the set subcommand was not working. - drm/amd/display: Don't warn when missing DCE encoder caps - cdc_ncm: Flag Intel OEM version of Fibocom L850-GL as WWAN - LoongArch: Save LBT before FPU in setup_sigcontext() - btrfs: avoid load/store tearing races when checking if an inode was logged - btrfs: fix race between setting last_dir_index_offset and inode logging - btrfs: fix race between logging inode and checking if it was logged before - bpf: Fix oob access in cgroup local storage - !20556 urma: fix update topo logic - !20639 [OLK-6.6][linux-6.6.y sync] Backport 6.6.103-6.6.104 LTS Patches - !20641 [OLK-6.6][linux-6.6.y sync] LoongArch: Add more instruction opcodes and emit_* helpers - !20560 *** fix CVE-2025-38062 *** - !20662 pNFS: Fix a deadlock when returning a delegation during open() - ub:hisi-ubus: Add create bus instance ummu bypass - Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" - Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set" - HID: mcp2221: Handle reads greater than 60 bytes - HID: mcp2221: Don't set bus speed on every transfer - net/mlx5: SF, Fix add port error handling - drm/nouveau/disp: Always accept linear modifier - smb3 client: fix return code mapping of remap_file_range - net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions - dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted - HID: wacom: Add a new Art Pen 2 - HID: logitech: Add ids for G PRO 2 LIGHTSPEED - HID: quirks: add support for Legion Go dual dinput modes - net: stmmac: Set CIC bit only for TX queues with COE - net: stmmac: xgmac: Correct supported speed modes - net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts - net/mlx5e: Set local Xoff after FW update - net/mlx5e: Update and set Xon/Xoff upon port speed set - net/mlx5e: Update and set Xon/Xoff upon MTU set - net/mlx5: Nack sync reset when SFs are present - net/mlx5: Convert SF port_indices xarray to function_ids xarray - net/mlx5: Use devlink port pointer to get the pointer of container SF struct - net/mlx5: Call mlx5_sf_id_erase() once in mlx5_sf_dealloc() - phy: mscc: Fix when PTP clock is register and unregister - net: dlink: fix multicast stats being counted incorrectly - dt-bindings: display/msm: qcom,mdp5: drop lut clock - drm/nouveau: remove unused memory target test - drm/nouveau: remove unused increment in gm200_flcn_pio_imem_wr - Bluetooth: hci_sync: fix set_local_name race condition - Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced - Bluetooth: hci_event: Mark connection as closed during suspend disconnect - Bluetooth: hci_event: Treat UNKNOWN_CONN_ID on disconnect as success - HID: input: report battery status changes immediately - HID: input: rename hidinput_set_battery_charge_status() - powerpc/kvm: Fix ifdef to remove build warning - drm/msm: Defer fd_install in SUBMIT ioctl - vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() - ACPI: EC: Add device to acpi_ec_no_wakeup[] qurik list - erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC - ASoC: codecs: tx-macro: correct tx_macro_component_drv name - smb: client: fix race with concurrent opens in unlink(2) - scsi: core: sysfs: Correct sysfs attributes access rights - of: dynamic: Fix use after free in of_changeset_add_prop_helper() - of: Add a helper to free property struct - mips: lantiq: xway: sysctrl: rename the etop node - mips: dts: lantiq: danube: add missing burst length property - pinctrl: STMFX: add missing HAS_IOMEM dependency - of: dynamic: Fix memleak when of_pci_add_properties() failed - !20684 urma: adjust urma log format - !20355 udp: Deal with race between UDP socket address change and rehash - !20627 Fixes CVE-2025-38627 - !20702 CVE-2025-39948 - !20701 netfilter: ctnetlink: remove refcounting in expectation dumpers - !20700 CVE-2025-38678 - !20703 CVE-2025-38491 - !20690 tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. - obmm: reduce log noise for successful export/import/preimport - mptcp: avoid deadlock on fallback while reinjecting - mptcp: plug races between subflow fail and subflow creation - mptcp: make fallback action and fallback decision atomic - ice: fix Rx page leak on multi-buffer frames - ice: fix incorrect counter for buffer allocation failures - ice: stop storing XDP verdict within ice_rx_buf - ice: gather page_count()'s of each frag right before XDP prog call - ice: Introduce ice_xdp_buff - netfilter: ctnetlink: remove refcounting in expectation dumpers - netfilter: nf_tables: reject duplicate device on updates - netfilter: nf_tables: Introduce functions freeing nft_hook objects - netfilter: nf_tables: Fix percpu address space issues in nf_tables_api.c - err.h: add ERR_PTR_PCPU(), PTR_ERR_PCPU() and IS_ERR_PCPU() macros - tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. - !20498 Fix CVE-2025-71118 - !20608 pmdomain: arm: scmi: Fix genpd leak on provider registration failure - !20679 x86/CPU/AMD: Add RDSEED fix for Zen5 - !20650 fix cve-2025-40300 - !20661 Input: alps - fix use-after-free bugs caused by dev3_register_work - !20664 backport some net bugfix from 6.6 lts - urma: adjust urma log format - !20678 ub: udma: close debug switch load parameters. - ub: udma: close debug switch load parameters. - x86/CPU/AMD: Add RDSEED fix for Zen5 - !20630 net: LTS-6.6 bugfix backport - !20632 net/sched: sch_qfq: do not free existing class in qfq_change_class() - !20631 macvlan: fix possible UAF in macvlan_forward_source() - !20628 Fix CVE-2025-39910 - !20659 v2 Fix CVE-2025-22090 - !20506 XSched: Update XSched manual - !20647 media: imon: make send_packet() more robust - !20646 ksm: use range-walk function to jump over holes in scan_get_next_rmap_item - !20645 fbcon: Set fb_display[i - !20648 parse_longname(): strrchr() expects NUL-terminated string - !20621 urma: modify log level - !20602 urma: fix the jfe uaf issue that occurred during the killall process. - !20567 urma:change log level and pass status 9 - !20640 iio: common: st_sensors: Fix use of uninitialize device structs - !20634 usb: gadget: udc: fix use-after-free in usb_gadget_state_work - !20633 net: dsa: properly keep track of conduit reference - !20635 fix CVE-2025-68231 - !20651 mm/slub: avoid accessing metadata when pointer is invalid in object_err() - !20649 drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb - !20652 mm/vmalloc: fix data race in show_numa_info() - x86: uaccess: don't use runtime-const rewriting in modules - x86: fix off-by-one in access_ok() - x86: fix user address masking non-canonical speculation issue - x86/uaccess: Zero the 8-byte get_range case on failure on 32-bit - x86/uaccess: Improve the 8-byte getuser() case - x86: fix whitespace in runtime-const assembler output - dcache: keep dentry_hashtable or d_hash_shift even when not used - runtime constants: add x86 architecture support - runtime constants: deal with old decrepit linkers - x86/uaccess: Add missing __force to casts in __access_ok() and valid_user_address() - !20345 arm64: entry: xcall/xint: make asm conditionals compatible with clang IAS - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). - libceph: replace BUG_ON with bounds check for map->max_osd - libceph: prevent potential out-of-bounds writes in handle_auth_session_key() - libceph: fix potential use-after-free in have_mon_and_osd_map() - sctp: Hold sock lock while iterating over address list - sctp: Prevent TOCTOU out-of-bounds write - sctp: Hold RCU read lock while iterating over address list - tipc: Fix use-after-free in tipc_mon_reinit_self(). - sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto - sctp: avoid NULL dereference when chunk data buffer is missing - bpf: Explicitly check accesses to bpf_sock_addr - ipvs: Defer ip_vs_ftp unregister during netns cleanup - nexthop: Forbid FDB status change while nexthop is in a group - netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). - net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer - sctp: initialize more fields in sctp_v6_from_sk() - pNFS: Fix a deadlock when returning a delegation during open() - Input: alps - fix use-after-free bugs caused by dev3_register_work - x86/cpu: Get CPU LLC ID from CPUID 0x8000001d in guest for Hygon processors - kernel/fork: only call untrack_pfn_clear() on VMAs duplicated for fork() - mm: (un)track_pfn_copy() fix + doc improvements - x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range() - !20642 mtdchar: fix integer overflow in read/write ioctls - mm/vmalloc: fix data race in show_numa_info() - mm/slub: avoid accessing metadata when pointer is invalid in object_err() - config: enable CONFIG_MITIGATION_VMESCAPE by default on x86 - x86/vmscape: Enable the mitigation - x86/vmscape: Enumerate VMSCAPE bug - x86/vmscape: Add conditional IBPB mitigation - drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb - parse_longname(): strrchr() expects NUL-terminated string - media: imon: make send_packet() more robust - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item - fbcon: Set fb_display[i]->mode to NULL when the mode is released - !20569 CVE-2024-35808 - mtdchar: fix integer overflow in read/write ioctls - !20619 Fix CVE-2026-22991 - !20612 net: hns3: extend HCLGE_FD_AD_COUNTER_NUM to 8 bits - LoongArch: Add more instruction opcodes and emit_* helpers - iio: common: st_sensors: Fix use of uninitialize device structs - !20581 null_blk: fix kmemleak by releasing references to fault configfs items - mm/mempool: fix poisoning order>0 pages with HIGHMEM - mm/page_poison: replace kmap_atomic() with kmap_local_page() - mm/mempool: replace kmap_atomic() with kmap_local_page() - usb: gadget: udc: fix use-after-free in usb_gadget_state_work - net: dsa: properly keep track of conduit reference - net/sched: sch_qfq: do not free existing class in qfq_change_class() - macvlan: fix possible UAF in macvlan_forward_source() - netfilter: nft_objref: validate objref and objrefmap expressions - arp: do not assume dev_hard_header() does not change skb->head - ip6_gre: make ip6gre_header() robust - netfilter: nf_tables: avoid chain re-validation if possible - netfilter: nf_tables: drop unused 3rd argument from validate callback ops - Revert "netfilter: nft_objref: validate objref and objrefmap expressions" - bpf: Fix reference count leak in bpf_prog_test_run_xdp() - net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset - ethtool: Avoid overflowing userspace buffer on stats query - ipvs: fix ipv4 null-ptr-deref in route error path - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() - !20596 mm/page_alloc: prevent pcp corruption with SMP=n - !20598 team: fix check for port enabled in team_queue_override_port_prio_changed() - !18823 hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio - mm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc() - kasan: avoid sleepable page allocation from atomic context - f2fs: compress: fix UAF of f2fs_inode_info in f2fs_free_dic - f2fs: compress: change the first parameter of page_array_{alloc,free} to sbi - !20583 [OLK-6.6][linux-6.6.y sync] Backport 6.6.102-6.6.103 LTS Patches - !20460 fbdev: Fix vmalloc out-of-bounds write in fast_imageblit - urma:fix log level and pass status 9 - urma: modify log level - !20592 CVE-2025-71141 fixup - !20594 CVE-2025-39744 fixup - !20607 powerpc/64s/slb: Fix SLB multihit issue during SLB preload - !20606 mm/huge_memory: fix NULL pointer deference when splitting folio - !20604 Fix CVE-2026-22984 - !20603 Fix CVE-2026-23021 - !20600 Fix CVE-2026-22990 - urma: fix the jfe uaf issue that occurred during the killall process. - !20380 pswiotlb: Adapt to the IOMMU DMA API upgraded by IOMMUFD - libceph: make free_choose_arg_map() resilient to partial allocation - drm/dp: Change AUX DPCD probe address from LANE0_1_STATUS to TRAINING_PATTERN_SET - net: hns3: extend HCLGE_FD_AD_COUNTER_NUM to 8 bits - net: hns3: extend HCLGE_FD_AD_QID to 11 bits - net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue - net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M - Revert "net: hns3: add support for FD counter" - !20587 dmaengine: stm32: dmamux: fix device leak on route allocation - pmdomain: arm: scmi: Fix genpd leak on provider registration failure - powerpc/64s/slb: Fix SLB multihit issue during SLB preload - mm/huge_memory: fix NULL pointer deference when splitting folio - !20562 LoongArch: BPF: Sign extend kfunc call arguments - !20470 ipv4: Fix reference count leak when using error routes with nexthop objects - !20471 net: sock: fix hardened usercopy panic in sock_recv_errqueue - !20472 net: fix memory leak in skb_segment_list for GRO packets - !20473 ipv4: ip_gre: make ipgre_header() robust - !20469 SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf - !20476 ipv6: Fix use-after-free in inet6_addr_del(). - !20477 svcrdma: bound check rq_pages index in inline path - !20578 ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() - !20579 fix CVE-2025-68768 - !20542 Fix NFS deadlock - USB: storage: Remove subclass and protocol overrides from Novatek quirk - cpuidle: governors: menu: Select polling state in some more cases - cpuidle: governors: menu: Rearrange main loop in menu_select() - cpuidle: menu: Update documentation after previous changes - Revert "drm/tegra: dsi: Clear enable register if powered by bootloader" - parisc: Remove spurious if statement from raw_copy_from_user() - ata: libata-scsi: Fix system suspend for a security locked drive - Revert "drm/amdgpu: fix incorrect vm flags to map bo" - mfd: axp20x: Set explicit ID for regulator cell if no IRQ line is present - drm/amd/display: use udelay rather than fsleep - sched/fair: Revert max_newidle_lb_cost bump - net: ipv4: fix regression in local-broadcast routes - tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers - PM: runtime: Do not clear needs_force_resume with enabled runtime PM - usb: typec: ucsi: psy: Set max current to zero when disconnected - io_uring/rw: cast rw->flags assignment to rwf_t - Documentation: ACPI: i2c-muxes: fix I2C device references - s390/hypfs: Enable limited access during lockdown - s390/hypfs: Avoid unnecessary ioctl registration in debugfs - ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation - net/mlx5e: Preserve shared buffer capacity during headroom updates - net/mlx5: Base ECVF devlink port attrs from 0 - Octeontx2-af: Skip overlap check for SPI field - bonding: send LACPDUs periodically in passive mode after receiving partner's LACPDU - bonding: Add independent control state machine - bonding: update LACP activity flag after setting lacp_active - net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate - ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc - gve: prevent ethtool ops after shutdown - phy: mscc: Fix timestamping for vsc8584 - net: ethernet: mtk_ppe: add RCU lock around dev_fill_forward_path - ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add - net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM - ALSA: usb-audio: Fix size validation in convert_chmap_v3() - mlxsw: spectrum: Forward packets with an IPv4 link-local source IP - Bluetooth: hci_conn: do return error from hci_enhanced_setup_sync() - Bluetooth: hci_event: fix MTU for BN == 0 in CIS Established - scsi: qla4xxx: Prevent a potential error pointer dereference - RDMA/bnxt_re: Fix to initialize the PBL array - RDMA/bnxt_re: Fix to remove workload check in SRQ limit path - RDMA/bnxt_re: Fix to do SRQ armena by default - RDMA/erdma: Fix ignored return value of init_kernel_qp - iosys-map: Fix undefined behavior in iosys_map_clear() - cgroup/cpuset: Use static_branch_enable_cpuslocked() on cpusets_insane_config_key - spi: spi-fsl-lpspi: Clamp too high speed_hz - usb: typec: maxim_contaminant: disable low power mode when reading comparator values - usb: typec: maxim_contaminant: re-enable cc toggle if cc is open and port is clean - iio: imu: inv_icm42600: change invalid data error to -EBUSY - iio: imu: inv_icm42600: Convert to uXX and sXX integer types - iio: imu: inv_icm42600: use = { } instead of memset() - iio: imu: inv_icm42600: switch timestamp type from int64_t __aligned(8) to aligned_s64 - iio: temperature: maxim_thermocouple: use DMA-safe buffer for spi_read() - iio: light: as73211: Ensure buffer holes are zeroed - tls: fix handling of zero-length records on the rx_list - powerpc/boot: Fix build with gcc 15 - mmc: sdhci-pci-gli: GL9763e: Mask the replay timer timeout of AER - compiler: remove __ADDRESSABLE_ASM{_STR,}() again - drm/amd/display: Don't overclock DCE 6 by 15% - usb: dwc3: pci: add support for the Intel Wildcat Lake - usb: dwc3: Ignore late xferNotReady event to prevent halt timeout - USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles - usb: storage: realtek_cr: Use correct byte order for bcs->Residue - USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera - usb: renesas-xhci: Fix External ROM access timeouts - usb: core: hcd: fix accessing unmapped memory in SINGLE_STEP_SET_FEATURE test - comedi: Make insn_rw_emulate_bits() do insn->n samples - usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive - cdx: Fix off-by-one error in cdx_rpmsg_probe() - most: core: Drop device reference after usage in get_channel() - iio: proximity: isl29501: fix buffered read on big-endian systems - iio: pressure: bmp280: Use IS_ERR() in bmp280_common_probe() - fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable() - drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS - cpuidle: governors: menu: Avoid selecting states with too much latency - cpuidle: menu: Remove iowait influence - mmc: sdhci-pci-gli: Add a new function to simplify the code - mmc: sdhci-pci-gli: Use PCI AER definitions, not hard-coded values - mptcp: disable add_addr retransmission when timeout is 0 - mptcp: remove duplicate sk_reset_timer call - use uniform permission checks for all mount propagation changes - arm64: dts: ti: k3-am62-main: Remove eMMC High Speed DDR support - scsi: mpi3mr: Serialize admin queue BAR writes on 32-bit systems - scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers - scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE - PCI: imx6: Add IMX8MM_EP and IMX8MP_EP fixed 256-byte BAR 4 in epc_features - PCI: imx6: Delay link start until configfs 'start' written - PCI: rockchip: Set Target Link Speed to 5.0 GT/s before retraining - PCI: rockchip: Use standard PCIe definitions - drm/amd/display: Fill display clock and vblank time in dce110_fill_display_configs - drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs - drm/amd/display: Fix DP audio DTO1 clock source on DCE 6. - drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3 - ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and EliteBook 830 G6 - mm/debug_vm_pgtable: clear page table entries at destroy_args() - squashfs: fix memory leak in squashfs_fill_super - mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for consistency - memstick: Fix deadlock by moving removing flag earlier - KVM: arm64: Fix kernel BUG() due to bad backport of FPSIMD/SVE/SME fix - sched/fair: Fix frequency selection for non-invariant case - kbuild: userprogs: use correct linker when mixing clang and GNU ld - ata: libata-scsi: Return aborted command when missing sense and result TF - PM: runtime: Take active children into account in pm_runtime_get_if_in_use() - PM: runtime: Simplify pm_runtime_get_if_active() usage - ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig - usb: dwc3: imx8mp: fix device leak at unbind - wifi: mac80211: check basic rates validity in sta_link_apply_parameters - KVM: x86: Take irqfds.lock when adding/deleting IRQ bypass producer - s390/mm: Remove possible false-positive warning in pte_free_defer() - btrfs: send: make fs_path_len() inline and constify its argument - btrfs: send: use fallocate for hole punching with send stream v2 - btrfs: send: avoid path allocation for the current inode when issuing commands - btrfs: send: keep the current inode's path cached - btrfs: send: add and use helper to rename current inode when processing refs - btrfs: send: only use boolean variables at process_recorded_refs() - btrfs: send: factor out common logic when sending xattrs - btrfs: populate otime when logging an inode item - btrfs: constify more pointer parameters - btrfs: fix ssd_spread overallocation - btrfs: open code timespec64 in struct btrfs_inode - xfs: fully decouple XFS_IBULK* flags from XFS_IWALK* flags - btrfs: abort transaction on unexpected eb generation at btrfs_copy_root() - btrfs: always abort transaction on failure to add block group to free space tree - btrfs: move transaction aborts to the error site in add_block_group_free_space() - btrfs: qgroup: fix race between quota disable and quota rescan ioctl - usb: typec: fusb302: cache PD RX state - block: Make REQ_OP_ZONE_FINISH a write operation - block: reject invalid operation in submit_bio_noacct - leds: flash: leds-qcom-flash: Fix registry access after re-bind - leds: flash: leds-qcom-flash: Limit LED current based on thermal condition - selftests/memfd: add test for mapping write-sealed memfd read-only - mm: update memfd seal write check to include F_SEAL_WRITE - mptcp: pm: kernel: flush: do not reset ADD_ADDR limit - mptcp: drop skb if MPTCP skb extension allocation fails - ipv6: sr: Fix MAC comparison to be constant-time - drm/amd/display: Don't overwrite dce60_clk_mgr - drm/amd/display: Add primary plane to commits for correct VRR handling - drm/amdkfd: Destroy KFD debugfs after destroy KFD wq - drm/amdgpu: update mmhub 3.0.1 client id mappings - drm/amdgpu: Avoid extra evict-restore process. - drm/amd: Restore cached power limit during resume - media: venus: venc: Clamp param smaller than 1fps and bigger than 240 - media: venus: vdec: Clamp param smaller than 1fps and bigger than 240. - media: venus: protect against spurious interrupts during probe - media: venus: hfi: explicitly release IRQ during teardown - media: qcom: camss: cleanup media device allocated resource on error path - media: ov2659: Fix memory leaks in ov2659_probe() - media: usbtv: Lock resolution while streaming - media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free() - media: verisilicon: Fix AV1 decoder clock frequency - media: vivid: fix wrong pixel_array control size - media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init() - media: hi556: correct the test pattern configuration - media: gspca: Add bounds checking to firmware parser - parisc: Update comments in make_insert_tlb - parisc: Try to fixup kernel exception in bad_area_nosemaphore path of do_page_fault() - parisc: Rename pte_needs_flush() to pte_needs_cache_flush() in cache.c - parisc: Makefile: explain that 64BIT requires both 32-bit and 64-bit compilers - parisc: Define and use set_pte_at() - parisc: Check region is readable by user in raw_copy_from_user() - soc/tegra: pmc: Ensure power-domains are in a known state - f2fs: fix to avoid out-of-boundary access in dnode page - phy: qcom: phy-qcom-m31: Update IPQ5332 M31 USB phy initialization sequence - vhost/vsock: Avoid allocating arbitrarily-sized SKBs - PCI: endpoint: Fix configfs group removal on driver teardown - PCI: endpoint: Fix configfs group list head handling - mtd: rawnand: renesas: Add missing check after DMA map - mtd: rawnand: fsmc: Add missing check after DMA map - mtd: spinand: propagate spinand_wait() errors from spinand_write_page() - mtd: spi-nor: Fix spi_nor_try_unlock_all() - hwmon: (gsc-hwmon) fix fan pwm setpoint show functions - pwm: mediatek: Fix duty and period setting - pwm: mediatek: Handle hardware enable and clock enable separately - pwm: imx-tpm: Reset counter if CMOD is 0 - wifi: ath11k: fix dest ring-buffer corruption when ring is full - wifi: ath11k: fix source ring-buffer corruption - wifi: ath11k: fix dest ring-buffer corruption - wifi: ath12k: fix dest ring-buffer corruption when ring is full - wifi: ath12k: fix source ring-buffer corruption - wifi: ath12k: fix dest ring-buffer corruption - wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table() - iio: adc: ad_sigma_delta: change to buffer predisable - zynq_fpga: use sgtable-based scatterlist wrappers - scsi: ufs: ufs-pci: Fix default runtime and system PM levels - scsi: ufs: ufs-pci: Fix hibernate state transition for Intel MTL-like host controllers - ata: libata-scsi: Fix ata_to_sense_error() status handling - scsi: mpi3mr: Fix race between config read submit and interrupt completion - dt-bindings: display: sprd,sharkl3-dsi-host: Fix missing clocks constraints - dt-bindings: display: sprd,sharkl3-dpu: Fix missing clocks constraints - arm64: dts: ti: k3-am62-verdin: Enable pull-ups on I2C buses - arm64: dts: ti: k3-am62a7-sk: fix pinmux for main_uart1 - arm64: dts: ti: k3-pinctrl: Enable Schmitt Trigger by default - btrfs: zoned: fix write time activation failure for metadata block group - ext4: fix hole length calculation overflow in non-extent inodes - ext4: don't try to clear the orphan_present feature block device is r/o - ext4: fix reserved gdt blocks handling in fsmap - ext4: fix fsmap end of range reporting with bigalloc - ext4: check fast symlink for ea_inode correctly - tracing: fprobe-event: Sanitize wildcard for fprobe event name - crypto: qat - lower priority for skcipher and aead algorithms - lib/crypto: mips/chacha: Fix clang build and remove unneeded byteswap - vt: defkeymap: Map keycodes above 127 to K_HOLE - vt: keyboard: Don't process Unicode characters in K_OFF mode - bus: mhi: host: Fix endianness of BHI vector table - usb: dwc3: meson-g12a: fix device leaks at unbind - usb: musb: omap2430: fix device leak at unbind - usb: gadget: udc: renesas_usb3: fix device leak at unbind - usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init() - m68k: Fix lost column on framebuffer debug console - platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister() - cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table() - rcu: Fix racy re-initialization of irq_work causing hangs - HID: apple: avoid setting up battery timer for devices without battery - HID: magicmouse: avoid setting up battery timer when not needed - RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages - tools/nolibc: fix spelling of FD_SETBITMASK in FD_* macros - media: uvcvideo: Do not mark valid metadata as invalid - media: venus: Fix OOB read due to missing payload bound check - parisc: Makefile: fix a typo in palo.conf - fbdev: Fix vmalloc out-of-bounds write in fast_imageblit - btrfs: do not allow relocation of partially dropped subvolumes - btrfs: zoned: do not select metadata BG as finish target - btrfs: clear dirty status from extent buffer on error at insert_new_root() - btrfs: zoned: do not remove unwritten non-data block group - btrfs: abort transaction during log replay if walk_log_tree() failed - btrfs: zoned: use filesystem size not disk size for reclaim decision - cdc-acm: fix race between initial clearing halt and open - thunderbolt: Fix copy+paste error in match_service_id() - usb: typec: ucsi: Update power_supply on power role change - misc: rtsx: usb: Ensure mmc child device is active when card is present - iommufd: Report unmapped bytes in the error path of iopt_unmap_iova_range - cifs: reset iface weights when we cannot find a candidate - drm/amdgpu: fix incorrect vm flags to map bo - scsi: lpfc: Remove redundant assignment to avoid memory leak - rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe - pNFS: Handle RPC size limit for layoutcommits - pNFS: Fix disk addr range check in block/scsi layout - pNFS: Fix stripe mapping in block/scsi layout - ASoC: Intel: avs: Fix uninitialized pointer error in probe() - net: phy: smsc: add proper reset flags for LAN8710A - ipmi: Fix strcpy source and destination the same - kconfig: lxdialog: fix 'space' to (de)select options - kconfig: gconf: fix potential memory leak in renderer_edited() - kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed() - ipmi: Use dev_warn_ratelimited() for incorrect message warnings - vfio/mlx5: fix possible overflow in tracking max message size - scsi: aacraid: Stop using PCI_IRQ_AFFINITY - scsi: target: core: Generate correct identifiers for PR OUT transport IDs - scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans - kconfig: nconf: Ensure null termination where strncpy is used - vfio/type1: conditional rescheduling while pinning - kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c - f2fs: check the generic conditions first - exfat: add cluster chain loop check for dir - i2c: Force DLL0945 touchpad i2c freq to 100khz - apparmor: use the condition in AA_BUG_FMT even with debug disabled - dm-table: fix checking for rq stackable devices - dm-mpath: don't print the "loaded" message if registering fails - i3c: master: Initialize ret in i3c_i2c_notifier_call() - i3c: don't fail if GETHDRCAP is unsupported - apparmor: shift ouid when mediating hard links in userns - rtc: ds1307: handle oscillator stop flag (OSF) for ds1341 - i3c: add missing include to internal header - module: Prevent silent truncation of module name in delete_module(2) - md: dm-zoned-target: Initialize return variable r to avoid uninitialized use - soundwire: Move handle_nested_irq outside of sdw_dev_lock - soundwire: amd: serialize amd manager resume sequence during pm_prepare - crypto: octeontx2 - add timeout for load_fvc completion poll - media: uvcvideo: Fix bandwidth issue for Alcor camera - media: usb: hdpvr: disable zero-length read messages - media: tc358743: Increase FIFO trigger level to 374 - media: tc358743: Return an appropriate colorspace from tc358743_set_fmt - media: tc358743: Check I2C succeeded during probe - pinctrl: stm32: Manage irq affinity settings - scsi: mpi3mr: Correctly handle ATA device errors - scsi: mpt3sas: Correctly handle ATA device errors - power: supply: qcom_battmgr: Add lithium-polymer entry - RDMA/core: reduce stack using in nldev_stat_get_doit() - dmaengine: stm32-dma: configure next sg only if there are more than 2 sgs - leds: leds-lp50xx: Handle reg to get correct multi_index - media: v4l2-common: Reduce warnings about missing V4L2_CID_LINK_FREQ control - MIPS: lantiq: falcon: sysctrl: fix request memory check logic - crypto: jitter - fix intermediary handling - watchdog: iTCO_wdt: Report error if timeout configuration fails - MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free} - clk: qcom: ipq5018: keep XO clock always on - hwmon: (emc2305) Set initial PWM minimum value during probe based on thermal state - watchdog: dw_wdt: Fix default timeout - fs/orangefs: use snprintf() instead of sprintf() - phy: rockchip-pcie: Properly disable TEST_WRITE strobe signal - mfd: axp20x: Set explicit ID for AXP313 regulator - clk: tegra: periph: Fix error handling and resolve unsigned compare warning - fbdev: fix potential buffer overflow in do_register_framebuffer() - cifs: Fix calling CIFSFindFirst() for root path without msearch - watchdog: sbsa: Adjust keepalive timeout to avoid MediaTek WS0 race condition - drm/amd/display: Avoid configuring PSR granularity if PSR-SU not supported - drm/amd/display: Only finalize atomic_obj if it was initialized - vhost: fail early when __vhost_add_used() fails - vsock/virtio: Resize receive buffers so that each SKB fits in a 4K page - net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325 - rcu: Fix rcu_read_unlock() deadloop due to IRQ work - drm/amd/display: Avoid trying AUX transactions on disconnected ports - selftests/bpf: Fix a user_ringbuf failure with arm64 64KB page size - bpf: Make reg_not_null() true for CONST_PTR_TO_MAP - uapi: in6: restore visibility of most IPv6 socket options - drm/ttm: Should to return the evict error - drm: renesas: rz-du: mipi_dsi: Add min check for VCLK range - net: ncsi: Fix buffer overflow in fetching version id - ionic: clean dbpage in de-init - wifi: rtlwifi: fix possible skb memory leak in _rtl_pci_init_one_rxdesc() - ptp: Use ratelimite for freerun error message - bpftool: Fix JSON writer resource leak in version command - net: dsa: b53: prevent SWITCH_CTRL access on BCM5325 - net: dsa: b53: prevent DIS_LEARNING access on BCM5325 - net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325 - net: dsa: b53: fix b53_imp_vlan_setup for BCM5325 - gve: Return error for unknown admin queue command - net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs - net: vlan: Make is_vlan_dev() a stub when VLAN is not configured - drm/amd: Allow printing VanGogh OD SCLK levels without setting dpm to manual - dpaa_eth: don't use fixed_phy_change_carrier - wifi: iwlegacy: Check rate_idx range after addition - netmem: fix skb_frag_address_safe with unreadable skbs - powerpc: floppy: Add missing checks after DMA map - wifi: ath12k: Decrement TID on RX peer frag setup error handling - wifi: ath12k: Enable REO queue lookup table feature on QCN9274 hw2.0 - wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`. - wifi: mac80211: update radar_required in channel context after channel switch - drm/amd/display: Fix 'failed to blank crtc!' - wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect - wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd() - wifi: ath12k: Add memset and update default rate value in wmi tx completion - drm/amd/display: Separate set_gsl from set_gsl_source_select - net: fec: allow disable coalescing - net: atlantic: add set_power to fw_ops for atl2 to fix wol - net: thunderbolt: Fix the parameter passing of tb_xdomain_enable_paths()/tb_xdomain_disable_paths() - net: thunderbolt: Enable end-to-end flow control also in transmit - kselftest/arm64: Specify SVE data when testing VL set in sve-ptrace - wifi: mt76: mt7915: mcu: re-init MCU before loading FW patch - wifi: rtw89: Disable deep power saving for USB/SDIO - wifi: rtw89: Fix rtw89_mac_power_switch() for USB - drm/msm: use trylock for debugfs - wifi: mac80211: fix rx link assignment for non-MLO stations - ipv6: mcast: Check inet6_dev->dead under idev->mc_lock in __ipv6_dev_mc_inc(). - (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer - wifi: mac80211: don't complete management TX on SAE commit - sched/fair: Bump sd->max_newidle_lb_cost when newidle balance fails - s390/stp: Remove udelay from stp_sync_clock() - wifi: iwlwifi: mvm: fix scan request validation - um: Re-evaluate thread flags repeatedly - wifi: iwlwifi: mvm: set gtk id also in older FWs - perf/cxlpmu: Remove unintended newline from IRQ name format string - net: phy: micrel: Add ksz9131_resume() - net: thunderx: Fix format-truncation warning in bgx_acpi_match_id() - net: ipv4: fix incorrect MTU in broadcast routes - wifi: cfg80211: Fix interface type validation - net: mctp: Prevent duplicate binds - arm64: Mark kernel as tainted on SAE and SError panic - net/mlx5e: Properly access RCU protected qdisc_sleeping variable - net: ag71xx: Add missing check after DMA map - et131x: Add missing check after DMA map - wifi: rtw89: Lower the timeout in rtw89_fw_read_c2h_reg() for USB - be2net: Use correct byte order and format string for TCP seq and ack_seq - s390/time: Use monotonic clock in get_cycles() - wifi: cfg80211: reject HTC bit for management frames - ktest.pl: Prevent recursion of default variable options - wifi: ath12k: Correct tid cleanup when tid setup fails - net: usb: cdc-ncm: check for filtering capability - xen/netfront: Fix TX response spurious interrupts - Bluetooth: hci_sock: Reset cookie to zero in hci_sock_free_cookie() - powerpc/thp: tracing: Hide hugepage events under CONFIG_PPC_BOOK3S_64 - ASoC: qcom: use drvdata instead of component to keep id - ASoC: codecs: rt5640: Retry DEVICE_ID verification - iio: adc: ad7768-1: Ensure SYNC_IN pulse minimum timing requirement - ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros - ALSA: pcm: Rewrite recalculate_boundary() to avoid costly loop - platform/chrome: cros_ec_typec: Defer probe on missing EC parent - platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches - soc: qcom: mdt_loader: Actually use the e_phoff - imx8m-blk-ctrl: set ISI panic write hurry level - pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop() - usb: core: usb_submit_urb: downgrade type check - usb: typec: intel_pmc_mux: Defer probe if SCU IPC isn't present - ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4 - ASoC: hdac_hdmi: Rate limit logging on connection and disconnection - ALSA: hda: Disable jack polling at shutdown - ALSA: hda: Handle the jack polling always via a work - mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode() - mei: bus: Check for still connected devices in mei_cl_bus_dev_release() - char: misc: Fix improper and inaccurate error code returned by misc_init() - reset: brcmstb: Enable reset drivers for ARCH_BCM2835 - pps: clients: gpio: fix interrupt handling order in remove path - ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path - mmc: sdhci-msm: Ensure SD card power isn't ON when card removed - ACPI: processor: fix acpi_object initialization - PM: sleep: console: Fix the black screen issue - thermal: sysfs: Return ENODATA instead of EAGAIN for reads - PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit() - firmware: tegra: Fix IVC dependency problems - ACPI: PRM: Reduce unnecessary printing to avoid user confusion - selftests: tracing: Use mutex_unlock for testing glob filter - tools/build: Fix s390(x) cross-compilation with clang - gpio: tps65912: check the return value of regmap_update_bits() - iio: adc: ad_sigma_delta: don't overallocate scan buffer - tools/nolibc: define time_t in terms of __kernel_old_time_t - thermal/drivers/qcom-spmi-temp-alarm: Enable stage 2 shutdown when required - ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed - EDAC/synopsys: Clear the ECC counters on init - gpio: wcd934x: check the return value of regmap_update_bits() - remoteproc: imx_rproc: skip clock enable when M-core is managed by the SCU - soc: qcom: rpmh-rsc: Add RSC version 4 support - usb: xhci: Avoid showing errors during surprise removal - usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command - usb: xhci: Avoid showing warnings for dying controller - usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default - selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t - cpufreq: CPPC: Mark driver with NEED_UPDATE_LIMITS flag - platform/x86/amd: pmc: Add Lenovo Yoga 6 13ALC6 to pmc quirk list - usb: xhci: print xhci->xhc_state when queue_command failed - tracefs: Add d_delete to remove negative dentries - securityfs: don't pin dentries twice, once is enough... - fix locking in efi_secret_unlink() - ext2: Handle fiemap on empty files to prevent EINVAL - fs/ntfs3: correctly create symlink for relative path - fs/ntfs3: Add sanity check for file name - better lockdep annotations for simple_recursive_removal() - hfs: fix not erasing deleted b-tree node issue - drbd: add missing kref_get in handle_write_conflicts - udf: Verify partition map count - gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops - nvme-pci: try function level reset on init failure - smb/server: avoid deadlock when linking with ReplaceIfExists - arm64: Handle KCOV __init vs inline mismatches - ptp: prevent possible ABBA deadlock in ptp_clock_freerun() - intel_idle: Allow loading ACPI tables for any family - net: ti: icss-iep: Fix incorrect type for return value in extts_enable() - netfilter: ctnetlink: fix refcount leak on table dump - udp: also consider secpath when evaluating ipsec use for checksumming - KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs - KVM: nVMX: Check vmcs12->guest_ia32_debugctl on nested VM-Enter - KVM: VMX: Extract checking of guest's DEBUGCTL into helper - KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported - KVM: VMX: Handle forced exit due to preemption timer in fastpath - KVM: VMX: Re-enter guest in fastpath for "spurious" preemption timer exits - KVM: x86: Plumb "force_immediate_exit" into kvm_entry() tracepoint - libceph: prevent potential out-of-bounds reads in handle_auth_done() - net: usb: pegasus: fix memory leak in update_eth_regs_async() - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() - !20540 urma: added support for ipoverurma - team: fix check for port enabled in team_queue_override_port_prio_changed() - mm/page_alloc: prevent pcp corruption with SMP=n - !20528 Fix CVE-2025-71083 - KVM: nVMX: Defer SVI update to vmcs01 on EOI when L2 is active w/o VID - KVM: x86: Plumb in the vCPU to kvm_x86_ops.hwapic_isr_update() - KVM: SVM: Set RFLAGS.IF=1 in C code, to get VMRUN out of the STI shadow - smb: client: don't wait for info->send_pending == 0 on error - smb: client: let send_done() cleanup before calling smbd_disconnect_rdma_connection() - ACPI: processor: perflib: Move problematic pr->performance check - ACPI: processor: perflib: Fix initial _PPC limit application - Documentation: ACPI: Fix parent device references - fs: Prevent file descriptor table allocations exceeding INT_MAX - sunvdc: Balance device refcount in vdc_port_mpgroup_check - PCI: Extend isolated function probing to LoongArch - NFSD: detect mismatch of file handle and delegation stateid in OPEN op - net: dpaa: fix device leak when querying time stamp info - net: ti: icss-iep: fix device and OF node leaks at probe - net: mtk_eth_soc: fix device leak at probe - net: enetc: fix device and OF node leak at probe - net: gianfar: fix device leak when querying time stamp info - net: phy: micrel: fix KSZ8081/KSZ8091 cable test - gpio: mlxbf3: use platform_get_irq_optional() - gpio: mlxbf2: use platform_get_irq_optional() - gpio: virtio: Fix config space reading. - ALSA: hda/realtek: Add Framework Laptop 13 (AMD Ryzen AI 300) to quirks - ALSA: hda/realtek: Fix headset mic on HONOR BRB-X - ALSA: usb-audio: Validate UAC3 cluster segment descriptors - rcu: Fix racy re-initialization of irq_work causing hangs - rcu: Fix rcu_read_unlock() deadloop due to IRQ work - drm/tilcdc: Fix removal actions in case of failed probe - drm/tilcdc: request and mapp iomem with devres - urma: fix update topo logic - dmaengine: stm32: dmamux: fix device leak on route allocation - pswiotlb: Adapt to the IOMMU DMA API upgraded by IOMMUFD - null_blk: fix kmemleak by releasing references to fault configfs items - inet: frags: flush pending skbs in fqdir_pre_exit() - inet: frags: add inet_frag_queue_flush() - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() - md/dm-raid: don't clear MD_RECOVERY_FROZEN after setting frozen - md/dm-raid: don't call md_reap_sync_thread() directly - ACPICA: Avoid walking the Namespace if start_node is NULL - arm64: entry: xcall/xint: make asm conditionals compatible with clang IAS - LoongArch: BPF: Sign extend kfunc call arguments - genirq/msi:: Fix kabi break of struct msi_desc - genirq/msi: Store the IOMMU IOVA directly in msi_desc instead of iommu_cookie - NFS: Fix a deadlock involving nfs_release_folio() - Revert "[Huawei] Revert "NFS: fix up nfs_release_folio() to try to release the page"" - urma: added support for ipoverurma - drm/ttm: Avoid NULL pointer deref for evicted BOs - XSched: Update XSched manual - svcrdma: bound check rq_pages index in inline path - ipv6: Fix use-after-free in inet6_addr_del(). - ipv4: ip_gre: make ipgre_header() robust - net: fix memory leak in skb_segment_list for GRO packets - net: sock: fix hardened usercopy panic in sock_recv_errqueue - ipv4: Fix reference count leak when using error routes with nexthop objects - SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf - fbdev: Fix vmalloc out-of-bounds write in fast_imageblit - udp: Deal with race between UDP socket address change and rehash - EDAC/amd64: The width of hash value is 2 bits for Hygon family 18h model 6h processors - x86/tsc: Use topology_max_packages() to get package number - EDAC/amd64: Use unicast instead of broadcast to access the cs_config register - EDAC/amd64: Correct the address translation for hygon family 18h model 4h - KVM: arm64: Mark some header functions as inline - KVM: arm64: Refactor exit handlers - x86/resctrl: Fix memory bandwidth counter width for Hygon CPUs - hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio - !20820 ub/obmm: add sysfs interface for mempool statistics & bugfixes - ub/obmm: fix wrong pxm_numa parameter validation - ub/obmm: Remove unused parameters from obmm_addr_check.c - ub/obmm: Enhance mem_allocator_granu validation - ub/obmm: simplify allocator naming scheme - ub/obmm: fix allow_slow logic and optimize conti_alloc_memory - ub/obmm: add sysfs interface with fine-grained memory statistics - !20804 net: hv_netvsc: reject RSS hash key programming without RX indirection table - !20813 migrate: correct lock ordering for hugetlb file folios - !20812 libceph: make calc_target() set t->paused, not just clear it - !20719 drivers/ub/sentry: some bugfix - !20798 urma: log should not retrieve eid_idx from uctx - !20808 urma: support triple bonding device - urma: log should not retrieve eid_idx from uctx - migrate: correct lock ordering for hugetlb file folios - libceph: make calc_target() set t->paused, not just clear it - !20745 vfio platform VFIO support for hisi05a1 devices - urma: support triple bonding device - net: hv_netvsc: reject RSS hash key programming without RX indirection table - !20789 gic: Add hip09 support for HISILICON_ERRATUM_165010801 - !20726 tracing: Add recursion protection in kernel stack trace recording - !20668 irqchip/gic-v3-its: Avoid truncating memory addresses - !20795 ub: udma: support query and set qos info. - !20791 Migration/urma:optimize performance in live migration. - ub: udma: Support for UE link establishment message. - Migration/urma: optimize performance in live migration. - !20787 ub: cdma: modify the method of assigning values to the structure - !20759 ubcore: hotfix route query for port eid on the same node. - ub: udma: support query and set qos info. - Revert "ub: ubase: Support for RC saved by queue granularity" - ubcore: hotfix route query for port eid on the same node. - !20676 urma: set/get sl - !20765 urma: bugfix of UAF and double free in ubcm - !20778 ub: ubase&unic: Fixes some bugfix in resetting and dfx ability - gic: Add hip09 support for HISILICON_ERRATUM_165010801 - vfio/platform: Add CONFIG_VFIO_HISI05A1 to openeuler_defconfig and turn it on by default - vfio/platform: VFIO support for hisi05a1 devices - ub: cdma: modify the method of assigning values to the structure - urma: set/get sl - ub: ubase: support to query ub dl pkt stats and real-time peak bandwidth - ub: ubase: Support for RC saved by queue granularity - ub: ubase: Traverse mailbox AE events using interrupts and polling. - ub: ubase: Modify ubase ctrlq trace to distinguish between MUE and UE messages - net: unic: The function of dumping himac registers is added. - ub: ubase: Fix MAC is_pfc sync, optimize list ops and code style - ub: ubase: Retain the initial tm qset configuration and restore it - net: unic: Fixed an issue in the bond IP address notification and pause configuration when an exception occurs. - ub: ubase: Add a retransmission function to improve reliability. - net: unic: Increase the readability and reliability of loopback code - net: unic: Synchronize the code modify for ip management and deactivation - net: unic: Increase the readability and reliability of VLAN feature. - net: unic: Added unic DFX log information. - ub: ubase: Add and correct comments for some functions and data structures - net: unic: Notify MAMI when the bond port status changes - ub: ubase: Support for HIMAC reset during ELR reset and Optimize ELR reset - !20768 iommu/ummu-core: Fix separate page table compatibility - !20665 [OLK-6.6] Enhance CMA memory usage reporting for CSV3 - !20764 net: hns3: fix double free issue for tx spare buffer - urma: bugfix of UAF and double free in ubcm - iommu/ummu-core: Fix separate page table compatibility - net: hns3: fix double free issue for tx spare buffer - drivers/ub/sentry: fix memory leak in sentry_msg_helper - drivers/ub/sentry: initialize some variables - drivers/ub/sentry: fix potential buffer overflow in convert_str_to_smh_msg() - drivers/ub/sentry: fix potential null pointer reference in sentry_uvb_comm - drivers/ub/sentry: add input parameter verification for exported symbols - tracing: Add recursion protection in kernel stack trace recording - x86/csv: Enhance CMA memory usage reporting for CSV3 - irqchip/gic-v3-its: Avoid truncating memory addresses - change the package name of 64KB page size kernel to kernel-64k - !20704 kernel support hisi-cca-da - !20180 [virtCCA Live Migration 2]virtcca secure cvm supports live migration - !20905 v2 KVM: arm64: Fix softirq masking in FPSIMD register saving sequence - !20965 iommu/ummu: Optimized TID invalidation and tdev initialization - !20964 iommu/ummu: Support TID and EID Granularity for MPAM - !20970 ub: ubase&unic: Supporting the black box capability of the ubase&unic driver - hisi-cca-da: Start dev by rsi call - hisi-cca-da: Set ripas of the bar region as RIPAS_DEV - hisi-cca-da: Support swiotlb and realm memory use - hisi-cca-da: Add smmu info when dev attach - hisi-cca-da: Transfer realm msix access to rmm - hisi-cca-da: Support pcipc sriov capability - hisi-cca-da: Delay realm memory release to kvm_destroy_realm - hisi-cca-da: Create realm s2 host pgtable and map msi mmio to rmm - hisi-cca-da: Add cca realm s2 pgtable framework - hisi-cca-da: Use bitmap to determine whether the command can be forwarded - hisi-cca-da: Restrict Realm SMMU to stage-2 domain only - hisi-cca-da: Add cmd forward mechanism in realm smmu - hisi-cca-da: Add realm smmu event and gerror irq initialization - hisi-cca-da: Add realm smmu stream table initialization - hisi-cca-da: Add realm smmu cmdq and evtq initialization - hisi-cca-da: Add realm smmu initialization - hisi-cca-da: Add relam iommu support to iommufd - hisi-cca-da: Add realm iommu support for vfio-iommu-type1 - hisi-cca-da: Support dev map and unmap - hisi-cca-da: Support dev validate and dev start - hisi-cca-da: VFIO support ccada - hisi-cca-da: Support dev delegate and dev attach - hisi-cca-da: Support root dev delegate and dev init - hisi-cca-da: Add hisilicon extension smc and ccada cmd - hisi-cca-da: Add hisi ccada feature config - !20751 ARM CCA supports hugepage - !20944 ub: ubmempfd: supports for D2H mapping and demapping - !20888 HiSock Enhancement - ub: ubase&unic: Supporting the black box capability of the ubase&unic driver. - net: unic: Resolve the residual MAC address problem - net: unic: Optimized the code for the cmd structure and FEC function. - ub: ubase: add log for post mailbox timeout - ub: ubus: Remove black box header file to include dir - rme: Remove the secret bit of the vring desc addr - rme: improve hisi-cca data mmap and destroy method - !20943 uvb: fix wd_obtain logic err - !20942 urma: fix bond device id not release - !20892 dcache: Limit the minimal number of bucket to two - rme: isolate page when do delegation to avoid migration - rme: hisi-cca supports different levels for mapping ram - rme: rename ccal to hisi-cca - rme: support set ripas for ccal realm vm - rme: support destroy ram data for ccal realm vm - rme: support populate region for ccal realm vm - rme: support map ram for ccal realm vm - rme: support config ccal realm vm - rme: support ccal RMI calls - rme: realm vm supports wfx handler - !20952 urma: introduce ipourma module - iommu/ummu-core: Simplifies tdev initialization resources - iommu/ummu: Optimized log printing - iommu/ummu: Use passed gfp_mask in map_pages callback - uvb: fix wd_obtain logic err - !20949 ub: udma: support user ctl function. - urma: fix bond device id not release - !20901 drivers/ub/sentry: some bugfix - ub: ubmempfd: supports for D2H mapping and demapping - ub: ubmempfd: supports providing services to the QEMU process through file nodes - [virtCCA Live Migration 2]virtcca secure cvm supports live migration - urma: query priority and enable bit, support ring size configuration - urma: implement debugfs, improve boundary checks and error handling logic - urma: implement data plane interaction and statistics - urma: implement ipourma network device operations - urma: ipourma resource management - urma: ipourma resource management and err code - urma: introduce ipourma main module - iommu/ummu: Optimized the TID invalidation configuration - iommu/ummu: Optimized SVA permission table memory allocation approach - iommu/ummu: Adapt UMMU SVA interface adjustment - iommu/ummu: Support TID and EID Granularity for MPAM - !20848 [OLK-6.6] backport important bugfix for nvme driver from upstream linux-6.6.y - !20847 urma: sl resource query error - !20908 [OLK-6.6][linux-6.6.y sync] Backport 6.6.108-6.6.110 LTS Patches - !20084 Loongarch: Enable CONFIG_CRYPTO_XTS for disk encryption - !20929 PCI: Fix NVMe link speed downgrade to 2.5GT/s during hotplug - drivers/ub/sentry: fix check input parameters - ub: udma: support user ctl function. - ub: udma: support uboe function. - ub: udma: bugfix related to query aux info. - !20935 ub: ubmem_vmmu: supports IOMMU driver for the UB memory MMU in VMs - drivers/ub/sentry: do not use magic numbers - !20876 urma: Kernel-mode specific implementations file for Jetty extension interface - urma: sl resource query error - !20873 sunrpc: fix NULL pointer dereference in rpcb_register_inet6 and rpcb_register_inet4 - !20875 sunrpc: fix race in cache cleanup causing stale nextcheck time - ub: ubmem_vmmu: supports IOMMU driver for the UB memory MMU in VMs - ub: ubmem_vmmu: supports parsing and configuring the hardware node information - ub: ubmem_vmmu: HiSilicon ubmem_vmmu Architecture Implementation - !20806 Fix CVE-2025-71225 - !20896 scsi: qla2xxx: Free sp in error path to fix system crash - !20894 scsi: qla2xxx: Delay module unload while fabric scan in progress - !20893 scsi: qla2xxx: Validate sp before freeing associated memory - !20802 Fix CVE-2026-23110 - urma: Kernel-mode specific implementations file for Jetty extension interface - drivers/ub/sentry: fix memory leak in process_urma_data() - drivers/ub/sentry: initialize some variables - PCI: Fix NVMe link speed downgrade to 2.5GT/s during hotplug - !20770 ub: ubdevshm: supports the memory user to obtain and release shared memory - Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 - mm: consider non-anon swap cache folios in folio_expected_ref_count() - mm: simplify folio_expected_ref_count() - ASoC: qcom: audioreach: fix potential null pointer dereference - gcc-plugins: Remove TODO_verify_il for GCC >= 16 - crypto: sha256 - fix crash at kexec - drm/i915/backlight: Return immediately when scale() finds invalid parameters - minmax.h: remove some #defines that are only expanded once - minmax.h: simplify the variants of clamp() - minmax.h: move all the clamp() definitions after the min/max() ones - minmax.h: use BUILD_BUG_ON_MSG() for the lo < hi test in clamp() - minmax.h: reduce the #define expansion of min(), max() and clamp() - minmax.h: update some comments - minmax.h: add whitespace around operators and after commas - minmax: fix up min3() and max3() too - minmax: improve macro expansion and type checking - minmax: don't use max() in situations that want a C constant expression - minmax: simplify min()/max()/clamp() implementation - minmax: make generic MIN() and MAX() macros available everywhere - drm/ast: Use msleep instead of mdelay for edid read - gpiolib: Extend software-node support to support secondary software-nodes - ARM: bcm: Select ARM_GIC_V3 for ARCH_BRCMSTB - s390/cpum_cf: Fix uninitialized warning after backport of ce971233242b - kmsan: fix out-of-bounds access to shadow memory - afs: Fix potential null pointer dereference in afs_put_server - ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address - i40e: improve VF MAC filters accounting - i40e: add mask to apply valid bits for itr_idx - HID: asus: add support for missing PX series fn keys - drm/gma500: Fix null dereference in hdmi teardown - octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() - net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port - net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() - net: dsa: lantiq_gswip: do also enable or disable cpu port - selftests: fib_nexthops: Fix creation of non-FDB nexthops - net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS - bnxt_en: correct offset handling for IPv6 destination address - vhost: Take a reference on the task in struct vhost_task. - Bluetooth: hci_sync: Fix hci_resume_advertising_sync - ethernet: rvu-af: Remove slash from the driver name - can: peak_usb: fix shift-out-of-bounds issue - can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow - can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow - can: hi311x: populate ndo_change_mtu() to prevent buffer overflow - can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow - bpf: Reject bpf_timer for PREEMPT_RT - can: rcar_can: rcar_can_resume(): fix s2ram with PSCI - wifi: virt_wifi: Fix page fault on connect - cpufreq: Initialize cpufreq-based invariance before subsys - ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients - arm64: dts: imx8mp: Correct thermal sensor index - mm: folio_may_be_lru_cached() unless folio_test_large() - mm/gup: local lru_add_drain() to avoid lru_add_drain_all() - mm/gup: check ref_count instead of lru before migration - mm: add folio_expected_ref_count() for reference count calculation - mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked" - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions - ALSA: usb-audio: Add mute TLV for playback volumes on more devices - ALSA: usb-audio: move mixer_quirks' min_mute into common quirk - ALSA: usb-audio: Add DSD support for Comtrue USB Audio device - i2c: designware: Add quirk for Intel Xe - mmc: sdhci-cadence: add Mobileye eyeQ support - usb: core: Add 0x prefix to quirks debug output - ALSA: usb-audio: Fix build with CONFIG_INPUT=n - ALSA: usb-audio: Convert comma to semicolon - ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 - ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks - ALSA: usb-audio: Simplify NULL comparison in mixer_quirks - ALSA: usb-audio: Avoid multiple assignments in mixer_quirks - ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks - ALSA: usb-audio: Fix block comments in mixer_quirks - firewire: core: fix overlooked update of subsystem ABI version - scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE - !20843 [OLK-6.6][linux-6.6.y sync] Backport 6.6.107-6.6.108 LTS Patches - !20869 ub:hisi-ubus: fix bug of security smatch - !20861 CVE-2026-23163 - ub: ubdevshm: supports the memory user to obtain and release shared memory - ub: ubdevshm: supports granting and revoking shared memory permissions - ub: ubdevshm: supports the registration and deregistration of shared memory segments - ub: ubdevshm: supports the registration and deregistration - KVM: arm64: Fix softirq masking in FPSIMD register saving sequence - !20886 Fix CVE-2026-23205 - !20803 Fix CVE-2026-23112 - !20868 sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure - !20811 smb/server: fix refcount leak in smb2_open() - !20810 smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() - !20809 smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() - sunrpc: fix NULL pointer dereference in rpcb_register_inet6 and rpcb_register_inet4 - sunrpc: fix race in cache cleanup causing stale nextcheck time - scsi: qla2xxx: Free sp in error path to fix system crash - scsi: qla2xxx: Delay module unload while fabric scan in progress - scsi: qla2xxx: Validate sp before freeing associated memory - dcache: Limit the minimal number of bucket to two - !20872 Fix CVE-2026-23220 - !20846 Fix CVE-2026-23193 - !20815 Fix CVE-2026-23216 - !20859 Fix CVE-2026-23179 - !20871 CVE-2026-23096 - !20858 ub: ubase: resolve the cmdq crq overflow problem - bpf: Deprecate hisock unused kfuncs and orig ingress logic - bpf: Add local connect support for hisock - bpf: Add ipv4-mapped ipv6 addr support for hisock - bpf: Add target comm parse to hisock_cmd - bpf: Add multi port parse to hisock_cmd - bpf: Only deploy hisock in server - bpf: Apply BPF_HISOCK_INGRESS to hisock ingress - bpf: Add bpf_handle_ingress/egress_ptype kfunc - bpf: Add bpf_get_skb_ethhdr kfunc - bpf: Add bpf_set_ingress/egress_dev kfunc - bpf: Add bpf_set_ingress_dst kfunc - bpf: Add BPF_HISOCK_INGRESS attach type - cgroup: make cgroup_bpf_prog_attach work when cgroup2 is not mounted - smb: client: fix potential UAF and double free in smb2_open_file() - smb/client: fix memory leak in smb2_open_file() - !20852 ASoC: amd: fix memory leak in acp3x pdm dma ops - ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths - uacce: fix cdev handling in the cleanup path - Revert "uacce: fix for cdev memory leak" - ub:hisi-ubus: fix bug of security smatch - ub:ubus: injected route event - ub:ubus: Black Box Development - !20865 urma: urma support uboe - sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure - urma: urma support uboe - !20857 ub_fwctl driver adds support for querying some functions - ub:ub_fwctl:Add illegal verification for scc - ub:ub_fwctl:Support querying the historical status of port links - drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove - drm/amdkfd: Don't use sw fault filter if retry cam enabled - ub:ub_fwctl:Support querying firmware version numbers - ub: ub_fwctl: Support querying real-time bandwidth statistics - ub:ub_fwctl:Support querying statistical indicators at the ub port and uboe port levels - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() - !20854 [URMA] add ping server for urma_ping - urma: add ping server - ub: ubase: resolve the cmdq crq overflow problem - ub: ubase: Optimized the QoS code naming to improve code readability. - ub: ubase&unic: optimizing code and configuration settings. - net: unic: not support query and configure ip by control plane in UBoE - net: unic: fix the automatically enable uc guid promisc mode. - !20844 urma:kernel header of userctl - urma: Kernel-mode header file for Jetty extension interface - ASoC: amd: fix memory leak in acp3x pdm dma ops - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() - phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again) - ACPICA: Work around bogus -Wstringop-overread warning since GCC 11 - !20835 Fix CVE-2026-23084 - minmax: add a few more MIN_T/MAX_T users - minmax: simplify and clarify min_t()/max_t() implementation - minmax: avoid overly complicated constant expressions in VM code - rtc: pcf2127: fix SPI command byte for PCF2131 backport - xhci: dbc: Fix full DbC transfer ring after several reconnects - xhci: dbc: decouple endpoint allocation from initialization - phy: ti: omap-usb2: fix device leak at unbind - phy: Use device_get_match_data() - drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path - ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message - ASoC: wm8974: Correct PLL rate rounding - ASoC: wm8940: Correct typo in control name - ASoC: wm8940: Correct PLL rate rounding - io_uring: include dying ring in task_work "should cancel" state - io_uring: backport io_should_terminate_tw() - ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx - selftests: mptcp: avoid spurious errors on TCP disconnect - selftests: mptcp: connect: catch IO errors on listen side - rds: ib: Increment i_fastreg_wrs before bailing out - KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active - mmc: mvsdio: Fix dma_unmap_sg() nents value - ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S - ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface - btrfs: tree-checker: fix the incorrect inode ref size check - iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page() - LoongArch: Check the return value when creating kobj - LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled - LoongArch: Update help info of ARCH_STRICT_ALIGN - nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* - octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() - net: liquidio: fix overflow in octeon_init_instr_queue() - bonding: don't set oif to bond dev when getting NS target destination - net/mlx5e: Consider aggregated port speed during rate configuration - i40e: remove redundant memory barrier when cleaning Tx descs - net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure - selftests: mptcp: sockopt: fix error messages - mptcp: tfo: record 'deny join id0' info - mptcp: set remote_deny_join_id0 on SYN recv - dpaa2-switch: fix buffer pool seeding for control traffic - btrfs: fix invalid extref key setup when replaying dentry - pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch - wifi: mac80211: fix incorrect type for ret - wifi: mac80211: increase scan_ies_len for S1G - ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported - !20769 [OLK-6.6][linux-6.6.y sync] Backport 6.6.106-6.6.107 LTS Patches - be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list - !20776 ub:ubfi: Release the chosen node - !20817 CVE-2026-23094 - !20819 dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() - ub:ubus: Add port num check - !20379 [OLK-6.6][sync from OLK-5.10]io_uring: Support forcing sq thread to be idle and woken up by hrtimer - !20830 sched/soft_domain: Increasing NR_MAX_CLUSTER to 32 - sched/soft_domain: Increasing NR_MAX_CLUSTER to 32 - btrfs: fix incorrect readahead expansion length - x86: disable image size check for test builds - drm/i915/power: fix size for for_each_set_bit() in abox iteration - drm/amdgpu: fix a memory leak in fence cleanup when unloading - net: mdiobus: release reset_gpio in mdiobus_unregister_device() - phy: ti-pipe3: fix device leak at unbind - phy: tegra: xusb: fix device and OF node leak at probe - dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate - usb: gadget: midi2: Fix MIDI2 IN EP max packet size - usb: gadget: midi2: Fix missing UMP group attributes initialization - USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels - RISC-V: Remove unnecessary include from compat.h - hrtimer: Rename __hrtimer_hres_active() to hrtimer_hres_active() - hrtimer: Remove unused function - regulator: sy7636a: fix lifecycle of power good gpio - dmaengine: ti: edma: Fix memory allocation size for queue_priority_map - hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr - hsr: use rtnl lock when iterating over ports - net: hsr: Add VLAN CTAG filter support - net: hsr: Add support for MC filtering at the slave device - can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB - can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails - can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed - igb: fix link test skipping when interface is admin down - docs: networking: can: change bcm_msg_head frames member to support flexible array - tunnels: reset the GSO metadata before reusing the skb - net: bridge: Bounce invalid boolopts - net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() - USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions - USB: serial: option: add Telit Cinterion FN990A w/audio compositions - dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks - serial: sc16is7xx: fix bug in flow control levels init - tty: hvc_console: Call hvc_kick in hvc_write unconditionally - Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups" - Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table - Input: iqs7222 - avoid enabling unused interrupts - mm/khugepaged: fix the address passed to notifier on testing young - btrfs: fix corruption reading compressed range when block size is smaller than page size - btrfs: use readahead_expand() on compressed extents - mm/damon/sysfs: fix use-after-free in state_show() - mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing - mtd: nand: raw: atmel: Fix comment in timings preparation - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages - drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time - mm/damon/core: set quota->charged_from to jiffies at first charge window - fuse: prevent overflow in copy_file_range return value - fuse: check if copy_file_range() returns larger than requested size - mtd: rawnand: stm32_fmc2: fix ECC overwrite - mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer - net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups - i2c: i801: Hide Intel Birch Stream SoC TCO WDT - ocfs2: fix recursive semaphore deadlock in fiemap call - mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN - compiler-clang.h: define __SANITIZE_*__ macros only when undefined - EDAC/altera: Delete an inappropriate dma_free_coherent() call - rcu-tasks: Maintain real-time response in rcu_tasks_postscan() - rcu-tasks: Eliminate deadlocks involving do_exit() and RCU tasks - rcu-tasks: Maintain lists to eliminate RCU-tasks/do_exit() deadlocks - s390/cpum_cf: Deny all sampling events by counter PMU - NFSv4/flexfiles: Fix layout merge mirror check. - NFSv4.2: Serialise O_DIRECT i/o and copy range - NFSv4.2: Serialise O_DIRECT i/o and clone range - NFSv4.2: Serialise O_DIRECT i/o and fallocate() - NFS: Serialise O_DIRECT i/o and truncate() - fs/nfs/io: make nfs_start_io_*() killable - ftrace/samples: Fix function size computation - NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server - NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set - media: i2c: imx214: Fix link frequency validation - NFSD: nfsd_unlink() clobbers non-zero status returned from fh_fill_pre_attrs() - nfsd: Fix a regression in nfsd_setattr() - kasan: fix GCC mem-intrinsic prefix with sw tags - kunit: kasan_test: disable fortify string checker on kasan_strings() test - io_uring: fix kabi broken in struct io_ring_ctx - io_uring: Support forcing sq thread to be idle and woken up by hrtimer - dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() - uacce: fix isolate sysfs check condition - Revert "uacce: fix isolate sysfs check condition" - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() - smb/server: fix refcount leak in smb2_open() - smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() - smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() - md: suspend array while updating raid_disks via sysfs - scsi: core: Wake up the error handler when final completions race against each other - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec - ub:ubfi: Release the chosen node - ub:ubus: Delete unused functions - Loongarch: Enable CONFIG_CRYPTO_XTS for disk encryption - Add sw64 support in kernel.spec - !21194 hisi-cca-da: Revert smmu realm enabled condition for arm_smmu_domain_finalise. - !21192 urma: bugfix of ubagg&ubcore&uburma - !21183 platform/x86: classmate-laptop: Add missing NULL pointer checks - urma: bugfix of ubagg&ubcore&uburma - hisi-cca-da: Revert smmu realm enabled condition for arm_smmu_domain_finalise. - platform/x86: classmate-laptop: Add missing NULL pointer checks - !21167 urma: fix kernel codecheck issues. - !21174 urma: change return value for provider err - !21127 urma: copy linked ports when importing bond jetty/seg - !20247 ubcore: query primary eid in ipourma loopback mode. - !21077 Fix hisi cca bugs - ubcore: route query refine and ipo loopback adapt. - hisi-cca-da: Transfer PCIe ECAM access requests to RMM for realm device. - hisi-cca-da: Write NS STE for PF drivers. - hisi-cca-da: Provide IO interfaces - hisi-cca-da: Destroy mmu stage2 pagetable after closing vfio devices - !21045 scsi: hisi_sas: Fix NULL pointer exception when do user_scan() - hisi-cca-da: Automatically unbind PF/VF drivers and prevent probe. - !21165 tools/interference: add ifstool utility for kernel interference statistics - !21166 urma: fix jfce uaf in batch cleanup - !21043 urma: fix tjetty ref in ping server - urma: change return value for provider err - !21128 sched/rt: Skip currently executing CPU in rto_next_cpu() - !21129 procfs: fix missing RCU protection when reading real_parent in do_task_stat() - urma: fix jfce uaf in batch cleanup - !21074 ipmi: Add HiSilicon IPMI Page Soft Offline driver - !21076 [OLK-6.6][linux-6.6.y sync] Backport 6.6.112-6.6.113 LTS Patches - urma: fix kernel codecheck issues. - tools/interference: add ifstool utility for kernel interference statistics - !20291 [Hygon][6.6][Bugfix] Bug fix for EDAC decode address fail issue on Hygon Dhyana processor - !21092 kexec: derive purgatory entry from symbol - !21154 sched: Add SOFT_DOMAIN feature interface for cgroup2 - !21153 fix CVE-2025-39981 - Revert "hisi-cca-da: Delay realm memory release to kvm_destroy_realm" - urma: fix tjetty ref in ping server - rme: Enforce isolation to solve compile error without config CONFIG_HISI_CCA - hisi-cca-da: Improve hisi cca dev validate and delegate - hisi-cca-da: Fix smmu enable rme problem - hisi-cca-da: Fix msi region shared problem - sched: Add SOFT_DOMAIN feature interface for cgroup2 - Bluetooth: MGMT: Fix memory leak in set_ssp_complete - Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete - overflow: Introduce __DEFINE_FLEX for having no initializer - overflow: Fix direct struct member initialization in _DEFINE_FLEX() - overflow: Change DEFINE_FLEX to take __counted_by member - overflow: add DEFINE_FLEX() for on-stack allocs - Bluetooth: MGMT: Fix possible UAFs - Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete() - !21103 Revert "mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()" - !21104 v2 vsock/virtio: cap TX credit to local buffer size - !21070 Fixes CVE-2026-23100 - !21135 RDMA/hns: Support configure and query the CNP DSCP through sysfs - !21088 ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref - RDMA/hns: Support configure and query the CNP DSCP through sysfs - RDMA/hns: Support query FW cap bit - RDMA/hns: Support query HW ID. - !20934 smb/server: fix refcount leak in parse_durable_handle_context() - !21004 regmap: Fix race condition in hwspinlock irqsave routine - !19568 [OLK-6.6]fix txgbe clang compile warning - urma: copy linked ports when importing bond jetty/seg - procfs: fix missing RCU protection when reading real_parent in do_task_stat() - sched/rt: Skip currently executing CPU in rto_next_cpu() - !21073 scsi: qla2xxx: Fix bsg_done() causing double free - !21114 CVE-2024-57979 - !21113 iommu: disable SVA when CONFIG_X86 is set - !20957 dmaengine: xilinx: xdma: Fix regmap max_register - !21087 net: unic: Multiple stability fixes for tx timeout, DFX capability and concurrent activation/reset - pps: Fix a use-after-free - fix kabi - pps: Fix a use-after-free - !21078 of: unittest: Fix memory leak in unittest_data_add() - !21079 *** fix CVE-2026-23208 *** - !21082 ALSA: aloop: Fix racy access at PCM trigger - !21083 bus: fsl-mc: fix use-after-free in driver_override_show() - iommu: disable SVA when CONFIG_X86 is set - vsock/virtio: cap TX credit to local buffer size - Revert "mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()" - !20983 Fix CVE-2026-23139 - !20878 Fix CVE-2026-23230 - kexec: derive purgatory entry from symbol - lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC - PCI/IOV: Fix race between SR-IOV enable/disable and hotplug - Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" - rtc: interface: Alarm race handling should not discard preceding error - perf test stat tests: Fix for virtualized machines - perf test stat: Update test expectations and events - perf test stat: Avoid hybrid assumption when virtualized - writeback: Avoid excessively long inode switching times - writeback: Avoid softlockup when switching many inodes - cramfs: Verify inode mode when loading from disk - fs: Add 'initramfs_options' to set initramfs mount options - minixfs: Verify inode mode when loading from disk - irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume - irqchip/sifive-plic: Make use of __assign_bit() - selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled - s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG - s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL - s390/bpf: Describe the frame using a struct instead of constants - s390/bpf: Centralize frame offset calculations - s390/bpf: Change seen_reg to a mask - ACPI: property: Do not pass NULL handles to acpi_attach_data() - ACPI: property: Add code comments explaining what is going on - ACPI: property: Disregard references in data-only subnode lists - ACPI: battery: Add synchronization between interface updates - ACPI: battery: Check for error code from devm_mutex_init() call - ACPI: battery: initialize mutexes through devm_ APIs - ACPI: battery: allocate driver data through devm_ APIs - arm64: mte: Do not flag the zero page as PG_mte_tagged - ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref - !20790 dm: use bio_clone_blkg_association - ipmi: Add HiSilicon IPMI Page Soft Offline driver - net: unic: Resolve network unavailability caused by concurrent activation and reset - net: unic: Provide the DFX capability for querying MNG table - net: unic: Delete the elr reset process after the tx timeout - bus: fsl-mc: fix use-after-free in driver_override_show() - ALSA: aloop: Fix racy access at PCM trigger - ALSA: usb-audio: Use the right limit for PCM OOB check - ALSA: usb-audio: Prevent excessive number of frames - of: unittest: Fix memory leak in unittest_data_add() - !21034 CVE-2026-23140 - !21016 net: fix segmentation of forwarding fraglist GRO - !21017 mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() - !21018 CVE-2026-23209 - !21019 ipv6: annotate data-race in ndisc_router_discovery() - !20881 ipvlan: Make the addrs_lock be per port - rme: Imporve range delegate - btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() - PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release - PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() - misc: fastrpc: Save actual DMA size in fastrpc_map structure - misc: fastrpc: Add missing dev_err newlines - mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag - mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type - mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value - media: mc: Clear minor number before put device - lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older - ACPICA: Allow to skip Global Lock initialization - ext4: validate ea_ino and size in check_xattrs - ext4: correctly handle queries for metadata mappings - ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() - nfsd: nfserr_jukebox in nlm_fopen should lead to a retry - NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() - mm/damon/vaddr: do not repeat pte_offset_map_lock() until success - mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 - mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations - wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 - wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again - selftests: mptcp: join: validate C-flag + def limit - spi: cadence-quadspi: Flush posted register writes before DAC access - spi: cadence-quadspi: Flush posted register writes before INDAC access - PCI: tegra194: Handle errors in BPMP response - PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() - PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock - PCI: rcar-host: Drop PMSR spinlock - PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit - PCI/AER: Support errors introduced by PCIe r6.0 - PCI/AER: Fix missing uevent on recovery when a reset is requested - PCI/ERR: Fix uevent on failure to recover - PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV - PCI/sysfs: Ensure devices are powered for config reads - PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock - rseq/selftests: Use weak symbol reference, not definition, to link with glibc - rtc: interface: Fix long-standing race when setting alarm - rtc: interface: Ensure alarm irq is enabled when UIE is enabled - memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe - mmc: core: SPI mode remove cmd7 - mtd: rawnand: fsmc: Default to autodetect buswidth - xtensa: simdisk: add input size check in proc_write_simdisk - sparc: fix error handling in scan_one_device() - sparc64: fix hugetlb for sun4u - scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() - sched/deadline: Fix race in push_dl_task() - pwm: berlin: Fix wrong register in suspend/resume - powerpc/pseries/msi: Fix potential underflow and leak issue - powerpc/powernv/pci: Fix underflow and leak issue - power: supply: max77976_charger: fix constant current reporting - pinctrl: samsung: Drop unused S3C24xx driver data - nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk - parisc: don't reference obsolete termio struct for TC* constants - openat2: don't trigger automounts with RESOLVE_NO_XDEV - of: unittest: Fix device reference count leak in of_unittest_pci_node_verify - lib/genalloc: fix device leak in of_gen_pool_get() - KEYS: trusted_tpm1: Compare HMAC values in constant time - iommu/vt-d: PRS isn't usable if PDS isn't supported - iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume - init: handle bootloader identifier in kernel parameters - iio: xilinx-ams: Unmask interrupts after updating alarms - iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK - iio: frequency: adf4350: Fix prescaler usage. - iio: dac: ad5421: use int type to store negative error codes - iio: dac: ad5360: use int type to store negative error codes - fs/ntfs3: Fix a resource leak bug in wnd_extend() - fbdev: Fix logic error in "offb" name match - crypto: rockchip - Fix dma_unmap_sg() nents value - crypto: atmel - Fix dma_unmap_sg() direction - crypto: aspeed - Fix dma_unmap_sg() direction - copy_sighand: Handle architectures where sizeof(unsigned long) < sizeof(u64) - bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() - bus: mhi: ep: Fix chained transfer handling in read path - btrfs: avoid potential out-of-bounds in btrfs_encode_fh() - blk-crypto: fix missing blktrace bio split events - drm/nouveau: fix bad ret code in nouveau_bo_move_prep - drm/rcar-du: dsi: Fix 1/2/3 lane support - media: lirc: Fix error handling in lirc_register() - media: venus: firmware: Use correct reset sequence for IRIS2 - media: pci: ivtv: Add missing check after DMA map - media: mc: Fix MUST_CONNECT handling for pads with no links - media: i2c: mt9v111: fix incorrect type for ret - media: cx18: Add missing check after DMA map - firmware: meson_sm: fix device leak at probe - xen/events: Update virq_to_irq on migration - xen/events: Return -EEXIST for bound VIRQs - xen/manage: Fix suspend error path - xen/events: Cleanup find_virq() return codes - dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required - ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init - arm64: dts: ti: k3-am62a-main: Fix main padcfg length - arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees - arm64: dts: qcom: msm8939: Add missing MDSS reset - arm64: dts: qcom: msm8916: Add missing MDSS reset - ACPI: debug: fix signedness issues in read/write helpers - ACPI: property: Fix buffer properties extraction for subnodes - gpio: wcd934x: mark the GPIO controller as sleeping - tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single - smb: client: fix missing timestamp updates after utime(2) - bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() - drm/amd/display: Properly disable scaling on DCE6 - drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 - drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs - drm/amdgpu: Add additional DCE6 SCL registers - mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes - mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call - tcp: take care of zero tp->window_clamp in tcp_set_rcvlowat() - perf python: split Clang options when invoking Popen - tools build: Align warning options with perf - net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe - drm/vmwgfx: Fix copy-paste typo in validation - net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() - LoongArch: Init acpi_gbl_use_global_lock to false - LoongArch: Remove CONFIG_ACPI_TABLE_UPGRADE in platform_init() - ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size - scsi: mvsas: Fix use-after-free bugs in mvs_work_queue - clk: tegra: do not overallocate memory for bpmp clocks - clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver - clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() - clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() - clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m - perf evsel: Ensure the fallback message is always written to - perf tools: Add fallback for exclude_guest - perf test: Add a test for default perf stat command - perf test: Don't leak workload gopipe in PERF_RECORD_* - perf session: Fix handling when buffer exceeds 2 GiB - perf arm_spe: Correct memory level for remote access - perf arm_spe: Correct setting remote access - rtc: optee: fix memory leak on driver removal - rtc: x1205: Fix Xicor X1205 vendor prefix - perf util: Fix compression checks returning -1 as bool - clk: at91: peripheral: fix return value - libperf event: Ensure tracing data is multiple of 8 sized - perf evsel: Avoid container_of on a NULL leader - asm-generic/io.h: Skip trace helpers if rwmmio events are disabled - iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE - clocksource/drivers/clps711x: Fix resource leaks in error paths - fscontext: do not consume log entries when returning -EMSGSIZE - fs: always return zero on success from replace_fd() - !21067 [OLK-6.6][linux-6.6.y sync] Backport 6.6.111-6.6.112 LTS Patches - scsi: qla2xxx: Fix bsg_done() causing double free - !21065 Fix CVE-2026-23069 - !21062 v4 Support multi-level cgroup - !20987 Fix CVE-2026-23212 - !20982 Fix CVE-2026-23119 - !20979 Fix CVE-2026-23111 - !20974 Fix CVE-2026-23099 - !20973 Fix CVE-2026-23105 - !20972 Fix CVE-2026-23074 - !20884 ksmbd: add chann_lock to protect ksmbd_chann_list xarray - !20947 Fix CVE-2026-23101 - ext4: clear i_state_flags when alloc inode - misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup - Revert "wifi: ath10k: avoid unnecessary wait for service ready message" - fs/ntfs3: fix mount failure for sparse runs in run_unpack() - !20825 efivarfs: fix error propagation in efivar_entry_get() - !20824 io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop - !20950 ub:ubus: protect iterator ue_list and mue_list with ub_bus_sem - mm/rmap: fix two comments related to huge_pmd_unshare() - mm/hugetlb: fix two comments related to huge_pmd_unshare() - mm/hugetlb: fix hugetlb_pmd_shared() - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count - !20728 drivers: Update vendor name of Chengdu NorthLink Technology N5/N6 Series Network Card Drivers - vsock/virtio: fix potential underflow in virtio_transport_get_credit() - !21001 Fix CVE-2026-23229 - usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call - arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode - !20999 Fix CVE-2026-23173 - usb: typec: tipd: Clear interrupts first - bus: fsl-mc: Check return value of platform_get_resource() - remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() - Input: atmel_mxt_ts - allow reset GPIO to sleep - misc: fastrpc: Skip reference for DMA handles - misc: fastrpc: fix possible map leak in fastrpc_put_args - misc: fastrpc: Fix fastrpc_map_lookup operation - nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() - ext4: fix checks for orphan inodes - ksmbd: fix error code overwriting in smb2_get_info_filesystem() - LoongArch: Automatically disable kaslr if boot from kexec_file - mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() - mfd: rz-mtu3: Fix MTU5 NFCR register offset - ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down - ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() - vhost: vringh: Modify the return value check - net/mlx5: fw reset, add reset timeout work - net/mlx5: pagealloc: Fix reclaim race during command interface teardown - net/mlx5: Stop polling for command response if interface goes down - net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable - nfp: fix RSS hash key size when RSS is not supported - mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands - drivers/base/node: fix double free in register_one_node() - hwrng: ks-sa - fix division by zero in ks_sa_rng_init - KEYS: X.509: Fix Basic Constraints CA flag parsing - Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements - Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO - vhost: vringh: Fix copy_to_iter return value check - RDMA/siw: Always report immediate post SQ errors - usb: vhci-hcd: Prevent suspending virtually attached devices - NFSv4.1: fix backchannel max_resp_sz verification check - coresight: trbe: Return NULL pointer for allocation failures - coresight: etm4x: Support atclk - coresight-etm4x: Conditionally access register TRCEXTINSELR - remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice - PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() - vfio/pds: replace bitmap_free with vfree - sparc: fix accurate exception reporting in copy_{from,to}_user for M7 - sparc: fix accurate exception reporting in copy_to_user for Niagara 4 - sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara - sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III - wifi: mac80211: fix Rx packet handling when pubsta information is not available - wifi: ath10k: avoid unnecessary wait for service ready message - Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram - IB/sa: Fix sa_local_svc_timeout_ms read race - RDMA/core: Resolve MAC of next-hop device without ARP support - f2fs: fix zero-sized extent for precache extents - scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() - scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() - scsi: qla2xxx: edif: Fix incorrect sign of error code - ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message - f2fs: fix to truncate first page in error path of f2fs_truncate() - f2fs: fix to update map->m_next_extent correctly in f2fs_map_blocks() - wifi: mt76: fix potential memory leak in mt76_wmac_probe() - RDMA/cm: Rate limit destroy CM ID timeout error message - drivers/base/node: handle error properly in register_one_node() - watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog - ipvs: Use READ_ONCE/WRITE_ONCE for ipvs->enable - iio: consumers: Fix offset handling in iio_convert_raw_to_processed() - iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() - fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist - fs: ntfs3: Fix integer overflow in run_unpack() - drm/msm/dpu: fix incorrect type for ret - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping - ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping - misc: genwqe: Fix incorrect cmd field being reported in error - usb: gadget: configfs: Correctly set use_os_string at bind - usb: phy: twl6030: Fix incorrect type for ret - drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() - tcp: fix __tcp_close() to only send RST when required - PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation - wifi: mwifiex: send world regulatory domain to driver - drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) - drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) - drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) - drm/amd/pm: Adjust si_upload_smc_data register programming (v3) - drm/amd/pm: Fix si_upload_smc_data (v3) - drm/amd/pm: Disable ULV even if unsupported (v3) - drm/amdgpu: Power up UVD 3 for FW validation (v2) - coresight: Only register perf symlink for sinks with alloc_buffer - inet: ping: check sock_net() in ping_get_port() and ping_lookup() - media: st-delta: avoid excessive stack usage - ALSA: lx_core: use int type to store negative error codes - media: rj54n1cb0c: Fix memleak in rj54n1_probe() - scsi: myrs: Fix dma_alloc_coherent() error check - hwrng: nomadik - add ARM_AMBA dependency - crypto: keembay - Add missing check after sg_nents_for_len() - drm/amd/display: Remove redundant semicolons - serial: max310x: Add error checking in probe() - usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls - usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup - phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 - media: zoran: Remove zoran_fh structure - drm/bridge: it6505: select REGMAP_I2C - f2fs: fix condition in __allow_reserved_blocks() - drm/radeon/r600_cs: clean up of dead code in r600_cs - drm/panel: novatek-nt35560: Fix invalid return value - bpf: Enforce expected_attach_type for tailcall compatibility - i2c: designware: Add disabling clocks when probe fails - i2c: designware: Fix clock issue when PM is disabled - i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD - thermal/drivers/qcom/lmh: Add missing IRQ includes - thermal/drivers/qcom: Make LMH select QCOM_SCM - hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems - once: fix race by moving DO_ONCE to separate section - smp: Fix up and expand the smp_call_function_many() kerneldoc - selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported - i3c: master: svc: Recycle unused IBI slot - i3c: master: svc: Use manual response for IBI events - ACPICA: Fix largest possible resource descriptor index - pwm: tiehrpwm: Fix corner case in clock divisor calculation - arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible - arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value - arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names - cpuidle: qcom-spm: fix device and OF node leaks at probe - firmware: firmware: meson-sm: fix compile-test default - arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 - null_blk: Fix the description of the cache_size module argument - pinctrl: renesas: Use int type to store negative error codes - power: supply: cw2015: Fix a alignment coding style issue - PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() - ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property - ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS - ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax - block: use int to store blk_stack_limits() return value - selftests/nolibc: fix EXPECT_NZ macro - regulator: scmi: Use int type to store negative error codes - arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map - ARM: at91: pm: fix MCKx restore routine - pinctrl: meson-gxl: add missing i2c_d pinmux - soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS - leds: flash: leds-qcom-flash: Update torch current clamp setting - ARM: dts: renesas: porter: Fix CAN pin group - libbpf: Fix reuse of DEVMAP - bpf: Remove migrate_disable in kprobe_multi_link_prog_run - bpf/selftests: Fix test_tcpnotify_user - regmap: Remove superfluous check for !config in __regmap_init() - arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 - x86/vdso: Fix output operand size of RDPID - smb: server: fix IRD/ORD negotiation with the client - coresight: trbe: Prevent overflow in PERF_IDX2OFF() - gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote - selftests: arm64: Check fread return value in exec_target - seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast - init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD - filelock: add FL_RECLAIM to show_fl_flags() macro - !21022 KVM: Don't clobber irqfd routing type when deassigning irqfd - !20998 ceph: fix oops due to invalid pointer for kfree() in parse_longname() - !21023 l2tp: avoid one data-race in l2tp_tunnel_del_work() - xsched: fix potential NULL dereference in xsched_quota_timeout_update - xsched: remove the standalone xcu_cfs_cg_deinit() helper - xsched: restructure xcu_cgrp_subsys teardown to align with cpu_cgrp_subsys lifecycle - xsched: simplify root group check by direct comparison with root_xcg - xsched: replace magic number with SCHED_CLASS_MAX_LENGTH for scheduler class string length - xsched/core: immediate cleanup of remaining operators on task exit - xsched: add init_fair_xsched_group() for XCU-specific fair group initialization - xsched: modify xcu_cg_initialize_components helper - xsched: refactor xsched_entity initialization - xsched: change rq_init() parameter from struct xsched_cu to struct xsched_rq - xsched: harden and clarify xcu_move_task() logic - xsched: move throttling-related fields from xsched_group_xcu_priv to xsched_rq_cfs - xsched/quota: add throttled flag to cfs_rq for robust hierarchical enqueue under throttling - xsched/quota: support multi-level cgroup - xsched: remove redundant xcu parameter from dequeue_ctx - xsched: update group shares using xcu_grp_shares_add/sub helpers - xsched: delete unused code - xsched/cfs: propagate group activation/deactivation up the hierarchy - xsched/cfs: move xruntime updates to pick/put paths - xsched: add has_running hook to xsched classes for wake-up eligibility check - !21012 [OLK-6.6][linux-6.6.y sync] Backport 6.6.110-6.6.111 LTS Patches - scsi: hisi_sas: Fix NULL pointer exception when do user_scan() - !21013 CVE-2026-23177 - !21007 bonding: fix use-after-free due to enslave fail after slave array update - !21006 net: Fix CVE-2026-23204 - bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path - bpf, test_run: Subtract size of xdp_frame from allowed metadata size - bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN - bpf: Make variables in bpf_prog_test_run_xdp less confusing - bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K - !21015 libceph: reset sparse-read state in osd_fault() - !21024 ub: udma: bugfix related to print messages. - !20980 Fix CVE-2026-23126 - !20922 Fix CVE-2026-23133 - ub: udma: bugfix related to print messages. - l2tp: avoid one data-race in l2tp_tunnel_del_work() - KVM: Don't clobber irqfd routing type when deassigning irqfd - ipv6: annotate data-race in ndisc_router_discovery() - macvlan: observe an RCU grace period in macvlan_common_newlink() error path - macvlan: fix error recovery in macvlan_common_newlink() - mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() - net: fix segmentation of forwarding fraglist GRO - can: rcar_canfd: Fix CAN-FD mode as default - libceph: reset sparse-read state in osd_fault() - !21008 uvb: fix cis call return value and obtain - mm, shmem: prevent infinite loop on truncate race - mm/shmem, swap: fix race of truncate and swap entry split - net/9p: fix double req put in p9_fd_cancelled - riscv: mm: Do not restrict mmap address based on hint - riscv: mm: Use hint address in mmap if available - driver core/PM: Set power.no_callbacks along with power.no_pm - serial: stm32: allow selecting console when the driver is module - hid: fix I2C read buffer overflow in raw_event() for mcp2221 - ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free - ALSA: usb-audio: Kill timer properly at removal - platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list - can: rcar_canfd: Fix controller mode setting - can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled - btrfs: ref-verify: handle damaged extent root tree - ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue - perf subcmd: avoid crash in exclude_cmds when excludes is empty - platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list - dm-integrity: limit MAX_TAG_SIZE to 255 - ASoC: amd: acp: Adjust pdm gain value - wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 - USB: serial: option: add SIMCom 8230C compositions - media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe - !20931 Fix CVE-2026-23060 - uvb: fix cis call return value and obtain - bonding: fix use-after-free due to enslave fail after slave array update - net/sched: cls_u32: use skb_header_pointer_careful() - net: add skb_header_pointer_careful() helper - regmap: Fix race condition in hwspinlock irqsave routine - crypto: virtio - Add spinlock protection with virtqueue notification - net/mlx5e: TC, delete flows only for existing peers - !20967 net: hns3: modify code of judging if SMMU DMA is enabled - ceph: fix oops due to invalid pointer for kfree() in parse_longname() - !20969 Fix CVE-2026-23125 - !20948 v4 arm64: Add memory poison recovery support for various paths - !20975 CVE-2026-23102 - !20977 v4 support apei_page_offline_policy - bonding: annotate data-races around slave->last_rx - netfilter: nf_conncount: update last_gc only when GC has been performed - bonding: provide a net pointer to __skb_flow_dissect() - netdevsim: fix a race issue related to the operation on bpf_bound_progs list - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() - apei/ghes: Add sysctl interface to control soft-offline page isolation - Revert "mm/memory-failure: support disabling soft offline for HugeTLB pages" - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - arm64/fpsimd: signal: Fix restoration of SVE context - arm64/fpsimd: signal: Consistently read FPSIMD context - arm64/fpsimd: signal: Mandate SVE payload for streaming-mode state - bonding: limit BOND_MODE_8023AD to Ethernet devices - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag - net/sched: Enforce that teql can only be used as root qdisc - sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT - drivers/net: Update vendor name of Chengdu NorthLink Technology N5/N6 Series Network Card Drivers - net: hns3: modify code of judging if SMMU DMA is enabled - dmaengine: xilinx: xdma: Fix regmap max_register - ub:ubus: protect iterator ue_list and mue_list with ub_bus_sem - ub:ubus: Avoid getting empty uent from ubc - ub:hisi-ubus: Use GFP_ATOMIC when alloc memory - arm64: send sig fault for user task when apei_claim_sea fails - arm64: add ras log during do_sea - arm64: move getting valid siaddr to the top of do_sea - arm64: mm: shmem: support poison recovery from shmem_file_read_iter() - arm64: fs: support poison recovery from __kernel_read() - iov_iter: add mc support for copy_page_to_iter - arm64: mm: support recovery from copy_{from/to}_user_page() - iov_iter: get rid of 'copy_mc' flag - leds: led-class: Only Add LED to leds_list when it is fully ready - wifi: ath10k: fix dma_free_coherent() pointer - smb/server: fix refcount leak in parse_durable_handle_context() - ksmbd: add chann_lock to protect ksmbd_chann_list xarray - ipvlan: Make the addrs_lock be per port - smb: client: split cached_fid bitfields to avoid shared-byte RMW races - efivarfs: fix error propagation in efivar_entry_get() - io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop - dm: use bio_clone_blkg_association - RAS/AMD/ATL: fix error nodes per socket on for Hygon Dhyana processor - net: txgbe: fix clang compile warning - !20552 ub: udma: fix some code issues. - !20313 Fix CVE-2025-40220 - !20321 nvme: fix admin request_queue lifetime - !20512 PM / devfreq: hisi: Fix potential UAF in OPP handling - !20544 Fix CVE-2025-71147 - !20548 v4 net: LTS-6.6 backport - !20503 Fix CVE-2025-39713 - !20133 Fix CVE-2025-39721 - !20438 Fix CVE-2025-38659 - !20264 Fix CVE-2025-40277 - !20340 Fix CVE-2025-40271 - !20319 Fix CVE-2025-40237 - !20392 vfs: Don't leak disconnected dentries on umount - !20554 iommu/s390: Implement blocking domain - !20489 [OLK-6.6][linux-6.6.y sync] Backport 6.6.101-6.6.102 LTS Patches - !20513 ACPI: PCC: Fix race condition by removing static qualifier - !20468 drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer - !20483 rcu: Protect ->defer_qs_iw_pending from data race - !20510 drivers/ub/sentry: fix primary eid index value - !20553 ub: cdma: support separated page table feature - ub: udma: fix some code issues. - !20480 iommu/ummu-core: fix error invalidate tid - !20561 iommu/ummu: Add ummu sva independent page table parameter - ub: udma: bugfix related to 2m_hugepage. - ub: udma: support for separate page tables - ub: udma: delete debugfs code. - ub: udma: bugfix related to ctrlq function. - ub: udma: verify get cqe/ae aux info out addr and len. - ub: cdma: support separated page table feature - iommu/ummu: Add ummu sva independent page table parameter - iommu: Adjust PLB refresh timing in 'grant' and 'ungrant' - !20505 Fix CVE-2026-23035 - iommu/s390: Implement blocking domain - drivers/ub/sentry: fix primary eid index value - !20535 libceph: make decode_pool() more resilient against corrupted osdmaps - !20536 mm/page_alloc: change all pageblocks migrate type on coalescing - !20537 mm/secretmem: fix use-after-free race in fault handler - !20538 wifi: avoid kernel-infoleak from struct iw_point - !20539 net: usb: rtl8150: fix memory leak on usb_submit_urb() failure - !20440 PCI/AER: Fix NULL pointer access by aer_info - !20262 Fix CVE-2025-68176 - netfilter: nf_reject: don't leak dst refcount for loopback packets - net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error - page_pool: always add GFP_NOWARN for ATOMIC allocations - virtio-net: fix received length check in big packets - net: bridge: fix use-after-free due to MST port state bypass - vsock: Ignore signal/timeout on connect() if already established - tls: make sure to abort the stream if headers are bogus - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI - xfrm: Duplicate SPI Handling - tls: handle data disappearing from under the TLS ULP - net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing - bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls - Bluetooth: hci_core: Fix use-after-free in vhci_flush() - KEYS: trusted: Fix a memory leak in tpm2_load_cmd - !20237 Fix CVE-2025-68724 - !20459 Fix CVE-2025-71131 - !20525 Fix CVE-2025-68816 - !20529 CVE-2025-68172 - net: usb: rtl8150: fix memory leak on usb_submit_urb() failure - !20370 Revert "Revert "RDMA/hns: Fix mismatch exception rollback"" - wifi: avoid kernel-infoleak from struct iw_point - mm/secretmem: fix use-after-free race in fault handler - mm/page_alloc: change all pageblocks migrate type on coalescing - libceph: make decode_pool() more resilient against corrupted osdmaps - pps: Fix kabi breakage of struct pps_device for last_fetched_ev - sched: Fix kabi breakage of struct task_struct for saved_state - crypto: aspeed - fix double free caused by devm - !20515 Bluetooth: bcsp: receive data only if registered - !20507 Fix CVE-2025-40358 - !20450 ub: ubase&unic: Fix some bug in concurrent process - !20452 iommu/ummu: Fix some bugs and optimize the code implementation - !20451 iommu/ummu: Add the function of creating devices with SVA-separated - !20500 mm: fix the inaccurate memory statistics issue for users - net/mlx5: fw_tracer, Validate format string parameters - Bluetooth: bcsp: receive data only if registered - ACPI: PCC: Fix race condition by removing static qualifier - ACPI: CPPC: Fix missing PCC check for guaranteed_perf - iommu/ummu: Add the function of creating devices with SVA-separated - iommu/ummu-core: fix error invalidate tid - riscv: stacktrace: Disable KASAN checks for non-current tasks - !20497 arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() - !20496 drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies - !20495 iommu/amd: Avoid stack buffer overflow from kernel cmdline - !20494 HID: core: Harden s32ton() against conversion to 0 bits - !20493 iommu: Fix two issues in iommu_copy_struct_from_user() - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv - PM / devfreq: hisi: Fix potential UAF in OPP handling - media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() - !20487 interference: Fix uninitialized ifs_clock compiling issue - MIPS: mm: kmalloc tlb_vpn array to avoid stack overflow - MIPS: mm: Prevent a TLB shutdown on initial uniquification - mm: fix the inaccurate memory statistics issue for users - mm: add config option for atomic mode in mm counter - Revert "mm: fix the inaccurate memory statistics issue for users" - !20444 net/mlx5e: Fix crash on profile change rollback failure - !20442 net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv - arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() - drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies - iommu/amd: Avoid stack buffer overflow from kernel cmdline - HID: core: Harden s32ton() against conversion to 0 bits - iommu: Fix two issues in iommu_copy_struct_from_user() - SUNRPC: call xs_sock_process_cmsg for all cmsg - flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read - !20374 [OLK 6.6]Use Hygon IBRS and IBPB rather than software-based mitigation to mitigate Retbleed and SRSO. - !20227 Rename leapioraid to leapraid and release v2.0 - mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery - MIPS: mm: tlb-r4k: Uniquify TLB entries on init - x86/fpu: Delay instruction pointer fixup until after warning - ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx() - ALSA: intel_hdmi: Fix off-by-one error in __hdmi_lpe_audio_probe() - x86/sev: Evict cache lines during SNP memory validation - net: usbnet: Fix the wrong netif_carrier_on() call - net: usbnet: Avoid potential RCU stall on LINK_CHANGE event - Bluetooth: btusb: Add USB ID 3625:010b for TP-LINK Archer TX10UB Nano - sched,freezer: Remove unnecessary warning in __thaw_task - freezer,sched: Clean saved_state when restoring it during thaw - freezer,sched: Do not restore saved_state of a thawed task - freezer,sched: Use saved_state to reduce some spurious wakeups - sched/core: Remove ifdeffery for saved_state - i2c: stm32f7: unmap DMA mapped buffer - i2c: stm32f7: simplify status messages in case of errors - i2c: stm32f7: perform most of irq job in threaded handler - i2c: stm32f7: use dev_err_probe upon calls of devm_request_irq - i2c: stm32f7: Use devm_clk_get_enabled() - USB: serial: option: add Foxconn T99W709 - smb: server: Fix extension string in ksmbd_extract_shortname() - ksmbd: fix corrupted mtime and ctime in smb2_open - ksmbd: fix Preauh_HashValue race condition - ksmbd: fix null pointer dereference error in generate_encryptionkey - vsock: Do not allow binding to VMADDR_PORT_ANY - selftests/perf_events: Add a mmap() correctness test - smb: client: return an error if rdma_connect does not return within 5 seconds - smb: client: let recv_done() cleanup before notifying the callers. - smb: client: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already - smb: client: make use of common smbdirect_socket - smb: smbdirect: add smbdirect_socket.h - smb: client: Correct typos in multiple comments across various files - smb: client: Use min() macro - smb: server: let recv_done() avoid touching data_transfer after cleanup/move - smb: server: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already - ALSA: hda/ca0132: Fix missing error handling in ca0132_alt_select_out() - irqchip: Build IMX_MU_MSI only on ARM - net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing - sunrpc: fix client side handling of tls alerts - net/sched: taprio: enforce minimum value for picos_per_byte - net: drop UFO packets in udp_rcv_segment() - ipv6: reject malicious packets in ipv6_gso_segment() - net/mlx5: Correctly set gso_segs when LRO is used - netlink: specs: ethtool: fix module EEPROM input/output arguments - net: ipa: add IPA v5.1 and v5.5 to ipa_version_string() - phy: mscc: Fix parsing of unicast frames - netpoll: prevent hanging NAPI when netcons gets enabled - md/md-cluster: handle REMOVE message earlier - NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY - NFS: Fix wakeup of __nfs_lookup_revalidate() in unblock_revalidate() - sched: Add test_and_clear_wake_up_bit() and atomic_dec_and_wake_up() - pNFS/flexfiles: don't attempt pnfs on fatal DS errors - PCI: pnv_php: Fix surprise plug detection and recovery - powerpc/eeh: Export eeh_unfreeze_pe() - PCI: pnv_php: Work around switches with broken presence detection - kconfig: qconf: fix ConfigList::updateListAllforAll() - scsi: sd: Make sd shutdown issue START STOP UNIT appropriately - scsi: ufs: core: Use link recovery when h8 exit fails during runtime resume - scsi: Revert "scsi: iscsi: Fix HW conn removal use after free" - scsi: mpt3sas: Fix a fw_event memory leak - vfio/pci: Separate SR-IOV VF dev_set - vfio/pds: Fix missing detach_ioas op - vfio: Prevent open_count decrement to negative - vfio: Fix unbalanced vfio_df_close call in no-iommu mode - f2fs: fix to calculate dirty data during has_not_enough_free_secs() - f2fs: fix to update upper_p in __get_secs_required() correctly - f2fs: vm_unmap_ram() may be called from an invalid context - f2fs: fix to avoid out-of-boundary access in devs.path - f2fs: doc: fix wrong quota mount option description - f2fs: fix KMSAN uninit-value in extent_info usage - rtc: rv3028: fix incorrect maximum clock rate handling - rtc: pcf8563: fix incorrect maximum clock rate handling - rtc: pcf85063: fix incorrect maximum clock rate handling - rtc: nct3018y: fix incorrect maximum clock rate handling - rtc: hym8563: fix incorrect maximum clock rate handling - rtc: ds1307: fix incorrect maximum clock rate handling - ucount: fix atomic_long_inc_below() argument type - module: Restore the moduleparam prefix length check - apparmor: fix loop detection used in conflicting attachment resolution - apparmor: ensure WB_HISTORY_SIZE value is a power of 2 - bpf: Check netfilter ctx accesses are aligned - bpf: Check flow_dissector ctx accesses are aligned - vhost-scsi: Fix log flooding with target does not exist errors - mtd: rawnand: atmel: set pmecc data setup time - mtd: rawnand: rockchip: Add missing check after DMA map - mtd: rawnand: atmel: Fix dma_mapping_error() address - jfs: fix metapage reference count leak in dbAllocCtl - crypto: qat - fix seq_file position update in adf_ring_next() - crypto: qat - fix DMA direction for compression on GEN2 devices - perf tools: Remove libtraceevent in .gitignore - sh: Do not use hyphen in exported variable name - ASoC: fsl_xcvr: get channel status data when PHY is not exists - dmaengine: nbpfaxi: Add missing check after DMA map - dmaengine: mv_xor: Fix missing check after DMA map and missing unmap - fs/orangefs: Allow 2 more characters in do_c_string() - PCI: endpoint: pci-epf-vntb: Fix the incorrect usage of __iomem attribute - soundwire: stream: restore params when prepare ports fail - crypto: img-hash - Fix dma_unmap_sg() nents value - crypto: keembay - Fix dma_unmap_sg() nents value - hwrng: mtk - handle devm_pm_runtime_enable errors - watchdog: ziirave_wdt: check record length in ziirave_firm_verify() - scsi: isci: Fix dma_unmap_sg() nents value - scsi: mvsas: Fix dma_unmap_sg() nents value - scsi: elx: efct: Fix dma_unmap_sg() nents value - scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value - clk: sunxi-ng: v3s: Fix de clock definition - perf tests bp_account: Fix leaked file descriptor - kernel: trace: preemptirq_delay_test: use offstack cpu mask - crypto: inside-secure - Fix `dma_unmap_sg()` nents value - perf sched: Fix memory leaks in 'perf sched latency' - perf sched: Fix memory leaks for evsel->priv in timehist - perf sched: Free thread->priv using priv_destructor - perf dso: Add missed dso__put to dso__load_kcore - perf tools: Fix use-after-free in help_unknown_cmd() - Fix dma_unmap_sg() nents value - clk: clk-axi-clkgen: fix fpfd_max frequency for zynq - fanotify: sanitize handle_type values when reporting fid - pinctrl: sunxi: Fix memory leak on krealloc failure - PCI: endpoint: pci-epf-vntb: Return -ENOENT if pci_epc_get_next_free_bar() fails - crypto: arm/aes-neonbs - work around gcc-15 warning - power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set - power: supply: cpcap-charger: Fix null check for power_supply_get_by_name - clk: xilinx: vcu: unregister pll_post only if registered correctly - media: v4l2-ctrls: Fix H264 SEPARATE_COLOUR_PLANE check - mtd: fix possible integer overflow in erase_xfer() - crypto: marvell/cesa - Fix engine load inaccuracy - crypto: qat - use unmanaged allocation for dc_data - crypto: sun8i-ce - fix nents passed to dma_unmap_sg() - PCI: rockchip-host: Fix "Unexpected Completion" log message - bpf/preload: Don't select USERMODE_DRIVER - ipv6: annotate data-races around rt->fib6_nsiblings - ipv6: fix possible infinite loop in fib6_info_uses_dev() - vrf: Drop existing dst reference in vrf_ip6_input_dst - selftests: rtnetlink.sh: remove esp4_offload after test - net/mlx5e: Clear Read-Only port buffer size in PBMC before update - netfilter: xt_nfacct: don't assume acct name is null-terminated - can: kvaser_usb: Assign netdev.dev_port based on device channel index - can: kvaser_pciefd: Store device channel index - can: peak_usb: fix USB FD devices potential malfunction - tools/rv: Do not skip idle in trace - Bluetooth: hci_event: Mask data status from LE ext adv reports - kcsan: test: Initialize dummy variable - wifi: mac80211: Write cnt before copying in ieee80211_copy_rnr_beacon() - wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE - wifi: ath12k: fix endianness handling while accessing wmi service bit - wifi: mac80211: Check 802.11 encaps offloading in ieee80211_tx_h_select_key() - wifi: mac80211: Don't call fq_flow_idx() for management frames - wifi: mac80211: Do not schedule stopped TXQs - wifi: plfxlc: Fix error handling in usb driver probe - wifi: mac80211: reject TDLS operations when station is not associated - iommu/amd: Fix geometry.aperture_end for V2 tables - mwl8k: Add missing check after DMA map - wifi: rtl8xxxu: Fix RX skb size for aggregation disabled - tcp: call tcp_measure_rcv_mss() for ooo packets - xen/gntdev: remove struct gntdev_copy_batch from stack - net_sched: act_ctinfo: use atomic64_t for three counters - net/sched: Restrict conditions for adding duplicating netems to qdisc tree - um: rtc: Avoid shadowing err in uml_rtc_start() - arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX - netfilter: nf_tables: adjust lockdep assertions handling - netfilter: nf_tables: Drop dead code from fill_*_info routines - fbcon: Fix outdated registered_fb reference in comment - drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value - m68k: Don't unregister boot console needlessly - drm/msm/dpu: Fill in min_prefill_lines for SC8180X - kselftest/arm64: Fix check for setting new VLs in sve-ptrace - net: dst: annotate data-races around dst->input - tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range - wifi: ath11k: clear initialized flag for deinit-ed srng lists - iwlwifi: Add missing check for alloc_ordered_workqueue - wifi: iwlwifi: Fix memory leak in iwl_mvm_init() - wifi: rtl818x: Kill URBs before clearing tx status queue - wifi: rtw89: avoid NULL dereference when RX problematic packet on unsupported 6 GHz band - caif: reduce stack size, again - bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure - drm/vmwgfx: Fix Host-Backed userspace on Guest-Backed kernel - net: ipv6: ip6mr: Fix in/out netdev to pass to the FORWARD chain - selftests/bpf: fix signedness bug in redir_partial() - bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls - bpf, sockmap: Fix psock incorrectly pointing to sk - drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed - staging: nvec: Fix incorrect null termination of battery manufacturer - interconnect: qcom: sc8180x: specify num_nodes - interconnect: qcom: sc8280xp: specify num_links for qnm_a1noc_cfg - soc: qcom: pmic_glink: fix OF node leak - samples: mei: Fix building on musl libc - cpufreq: Initialize cpufreq-based frequency-invariance later - cpufreq: intel_pstate: Always use HWP_DESIRED_PERF in passive mode - arm64: dts: imx8mn-beacon: Fix HS400 USDHC clock speed - arm64: dts: imx8mm-beacon: Fix HS400 USDHC clock speed - ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface - soc/tegra: cbb: Clear ERR_FORCE register with ERR_STATUS - arm: dts: ti: omap: Fixup pinheader typo - usb: early: xhci-dbc: Fix early_ioremap leak - powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw() - pps: fix poll support - staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() - spi: stm32: Check for cfg availability in stm32_spi_probe - usb: misc: apple-mfi-fastcharge: Make power supply names unique - usb: host: xhci-plat: fix incorrect type for of_match variable in xhci_plat_probe() - ARM: dts: vfxxx: Correctly use two tuples for timer address - arm64: dts: qcom: msm8976: Make blsp_dma controlled-remotely - arm64: dts: qcom: sc7180: Expand IMEM region - arm64: dts: qcom: sdm845: Expand IMEM region - soc: qcom: QMI encoding/decoding for big endian - selftests: Fix errno checking in syscall_user_dispatch test - ASoC: mediatek: use reserved memory or enable buffer pre-allocation - gfs2: No more self recovery - Revert "fs/ntfs3: Replace inode_trylock with inode_lock" - hfs: make splice write available again - hfsplus: make splice write available again - ublk: use vmalloc for ublk_device's __queues - fs_context: fix parameter name in infofc() macro - audit,module: restore audit logging in load failure case - ASoC: amd: yc: add DMI quirk for ASUS M6501RM - ASoC: Intel: fix SND_SOC_SOF dependencies - ASoC: amd: yc: Add DMI entries to support HP 15-fb1xxx - ethernet: intel: fix building with large NR_CPUS - ASoC: amd: yc: Add DMI quirk for HP Laptop 17 cp-2033dx - interference: Fix uninitialized ifs_clock compiling issue - iommu/ummu: optimize log printing - !20455 Fix compilation failure caused by PR#20174 - !20302 CVE-2026-22980 - !20142 CVE-2025-68803 - !20261 ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency - !20435 fix CVE-2026-22998 - !20433 scsi: target: Reset t_task_cdb pointer in error case - !20432 scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" - !20431 block: Use RCU in blk_mq_[un - !20307 tpm: Cap the number of PCR banks - !20062 xfs: Add xfs_dir3_leaf_header_check() in leaf/leafn read - !20157 v2 md: backport from mainline - rcu: Protect ->defer_qs_iw_pending from data race - platform/x86/intel/pmt: fix compilation failure caused by PR#20174 - iommu/ummu: optimize kv cache memory management - iommu/ummu: optimize permission table management - iommu/ummu: remove check for eid_type while del eid - iommu/ummu: optimize the code implementation - drivers/perf: fix ummu-pmu data reading exception - iommu/ummu: IOMMU_DOMAIN_BLOCKED type don not sync tct - drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer - crypto: seqiv - Do not use req->iv after crypto_aead_encrypt - net: unic: Notify mami of the bond ip change. - ub: ubase: Support for UE link by ctrlq message - ub: ubase: send a deactivate req in removing - ub: ubase: Querying TPG/TP contexts in the chip is no longer supported after enabling safe mode. - ub: ubase: Use an independent thread for the ctrlq workqueue. - !20368 ubcore: fix logging and permission for route query. - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id - !20344 ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr - net: unic: Fix the ummu 0xa event that occurs when modifying queues and resetting concurrent scenarios - ub: ubase: Add KABI compatibility - ub: ubase: fixing the issue of cdma ctp_req_vl parameter configuration - ub: ubase: add PMU IDEV interrupt supported abilities. - ub: ubase: Delete the tid mask for eq, jfs, jfr, and jfc context - ub: ubase: Set the completion event interrupt to auto - net: unic: fix poll tx read old skb cause a UAF bug - !20249 Fix CVE-2025-38489 - !20250 Fix CVE-2025-38480 - !20378 Fix CVE-2025-39838 - !20430 Fix CVE-2025-39942 - !20351 Fix CVE-2025-71149 - !20375 Fix CVE-2025-71150 - !20323 Fix CVE-2025-38730 - !20320 Fix CVE-2025-68814 - !20314 Fix CVE-2025-71072 - !20315 Fix CVE-2025-68794 - !20403 bpf: Check skb->transport_header is set in bpf_skb_check_mtu - !20402 bpf: Do not let BPF test infra emit invalid GSO types to stack - !20401 tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() - !20400 netfilter: nft_ct: add seqadj extension for natted connections - !20399 net: xfrm: Fix CVE-2025-40215 - !20398 net/sched: sch_qfq: Fix null-deref in agg_dequeue - !20397 bpf: Reject narrower access to pointer ctx fields - !20396 Bluetooth: eir: Fix possible crashes on eir_create_adv_data - !20394 IB/mlx5: Fix potential deadlock in MR deregistration - !20367 ub: cdma: cdma uaf bugfix - net/mlx5e: Fix crash on profile change rollback failure - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv - PCI/AER: Fix NULL pointer access by aer_info - gfs2: No more self recovery - drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE - crypto: qat - flush misc workqueue during device shutdown - !20174 Backport PMT spec 3.0 support - !20366 [Hygon][6.6][Bugfix]: Resolve FPU state corruption between atomic and non-atomic contexts - !19814 [OLK-6.6] Batch flushing user memory encrytion status change - !20393 [OLK-6.6][linux-6.6.y sync] Backport 6.6.100-6.6.101 LTS Patches - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec - nvmet-tcp: remove boilerplate code - scsi: target: Reset t_task_cdb pointer in error case - scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" - block: Use RCU in blk_mq_[un]quiesce_tagset() instead of set->tag_list_lock - ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size - ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer - smb: server: let recv_done() consistently call put_recvmsg/smb_direct_disconnect_rdma_connection - smb: server: remove separate empty_recvmsg_queue - !20384 ub:ubus: Fix ubus link message and pool device error - !20389 gfs2: Prevent recursive memory reclaim - !20388 *** fix CVE-2025-38062 *** - !20387 KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced - !20386 pinctrl: check the return value of pinmux_ops::get_function_name() - !20385 iommu/amd/pgtbl: Fix possible race while increase page table level - ub:ubus: Not cfg access during surprise down - ub:hisi-ubus: Delete validate_pa err print - PCI: cadence: Check for the existence of cdns_pcie::ops before using it - can: netlink: can_changelink(): allow disabling of automatic restart - Revert "selftests/bpf: Add a cgroup prog bpf_get_ns_current_pid_tgid() test" - drm/sched: Remove optimization that causes hang when killing dependent jobs - ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS - bpf: Check skb->transport_header is set in bpf_skb_check_mtu - bpf: Do not let BPF test infra emit invalid GSO types to stack - tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() - netfilter: nft_ct: add seqadj extension for natted connections - xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added - xfrm: delete x->tunnel as we delete x - x86/hw-vuln:Support hardware-based mitigation for Retbleed and SRSO via Hygon IBRS to avoid performance degradation caused by software-based mitigation. - net/sched: sch_qfq: Fix null-deref in agg_dequeue - bpf: Reject narrower access to pointer ctx fields - Bluetooth: eir: Fix possible crashes on eir_create_adv_data - IB/mlx5: Fix potential deadlock in MR deregistration - ub:ubus: Fix ubus link message and pool device error - ub:hisi-ubus: cq poller maximum handle 64 cqe per time - ub:hisi-ubus:Fix vdm message print error - ub:ubus:Fix ubus interrupt release issue - wifi: mt76: mt7921: prevent decap offload config before STA initialization - mtd: rawnand: qcom: Fix last codeword read in qcom_param_page_type_exec() - iio: hid-sensor-prox: Restore lost scale assignments - iio: hid-sensor-prox: Fix incorrect OFFSET calculation - crypto: powerpc/poly1305 - add depends on BROKEN for now - erofs: address D-cache aliasing - drm/i915/dp: Fix 2.7 Gbps DP_LINK_BW value on g4x - ALSA: hda: Add missing NVIDIA HDA codec IDs - ALSA: hda/tegra: Add Tegra264 support - comedi: comedi_test: Fix possible deletion of uninitialized timers - usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach - usb: typec: tcpm: allow switching to mode accessory to mux properly - usb: typec: tcpm: allow to use sink in accessory mode - drm/amdkfd: Don't call mmput from MMU notifier callback - mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n - selftests: mptcp: connect: also cover checksum - selftests: mptcp: connect: also cover alt modes - resource: fix false warning in __request_region() - gve: Fix stuck TX queue for DQ queue format - e1000e: ignore uninitialized checksum word on tgp - e1000e: disregard NVM checksum on tgp when valid checksum bit is not set - dpaa2-switch: Fix device reference count leak in MAC endpoint handling - dpaa2-eth: Fix device reference count leak in MAC endpoint handling - ALSA: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx - sprintf.h requires stdarg.h - bus: fsl-mc: Fix potential double device reference in fsl_mc_get_endpoint() - i2c: virtio: Avoid hang by using interruptible completion wait - i2c: tegra: Fix reset error handling with ACPI - platform/x86: ideapad-laptop: Fix kbd backlight not remembered among boots - can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode - can: dev: can_restart(): move debug message and stats after successful restart - can: dev: can_restart(): reverse logic to remove need for goto - i40e: When removing VF MAC filters, only check PF-set MAC - i40e: report VF tx_dropped with tx_errors instead of tx_discards - i40e: Add rx_missed_errors for buffer exhaustion - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch - net/mlx5: Fix memory leak in cmd_exec() - staging: vchiq_arm: Make vchiq_shutdown never fail - x86/hyperv: Fix usage of cpu_online_mask to get valid cpu - regmap: fix potential memory leak of regmap_bus - iio: adc: ad7949: use spi_is_bpw_supported() - interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1 node - RDMA/core: Rate limit GID cache warning messages - virtio_ring: Fix error reporting in virtqueue_resize - !20348 [OLK-6.6][linux-6.6.y sync] Backport 6.6.99-6.6.100 LTS Patches - !20346 tracing: Fix crash on synthetic stacktrace field usage - vfs: Don't leak disconnected dentries on umount - !20334 Fix CVE-2025-68780 - gfs2: Prevent recursive memory reclaim - amd/amdkfd: enhance kfd process check in switch partition - drm/amdkfd: allow compute partition mode switch with cgroup exclusions - KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced - pinctrl: check the return value of pinmux_ops::get_function_name() - iommu/amd/pgtbl: Fix possible race while increase page table level - !19966 nvme-fc: use lock accessing port_state and rport state - ASoC: fsl_sai: replace regmap_write with regmap_update_bits - comedi: Fix use of uninitialized data in insn_rw_emulate_bits() - cifs: prevent NULL pointer dereference in UTF16 conversion - ksmbd: Fix refcount leak when invalid session is found on session lookup - ubcore: fix logging and permission for route query. - !20232 driver/coda: VirtCCA supports MSI device DA - Revert "Revert "RDMA/hns: Fix mismatch exception rollback"" - !20197 ub: udma&ubase: fix a bug that caused long reboot time - x86: Resolve FPU state corruption between atomic and non-atomic contexts - ub: cdma: cdma uaf bugfix - ub: cdma: jfs call trace bugfix - !20353 x86/fpu: Clear XSTATE_BV[i - s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again - KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls - nvmem: layouts: u-boot-env: remove crc32 endianness conversion - i2c: omap: fix deprecated of_property_read_bool() use - ASoC: fsl_sai: Force a software reset when starting in consumer mode - regulator: pwm-regulator: Manage boot-on with disabled PWM channels - regulator: pwm-regulator: Calculate the output voltage for disabled PWMs - i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe() - i2c: omap: Fix an error handling path in omap_i2c_probe() - i2c: omap: Add support for setting mux - usb: dwc3: qcom: Don't leave BCR asserted - usb: hub: Don't try to recover devices lost during warm reset. - usb: hub: Fix flushing of delayed work used for post resume purposes - usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm - usb: hub: fix detection of high tier USB3 devices behind suspended hubs - arm64: Filter out SME hwcaps when FEAT_SME isn't implemented - ipv6: make addrconf_wq single threaded - !20354 cpufreq/sched: Explicitly synchronize limits_changed flag handling - sched/deadline: only set free_cpus for online runqueues - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 - cpufreq/sched: Explicitly synchronize limits_changed flag handling - io_uring/poll: correctly handle io_poll_add() return value on update - shmem: fix recovery on rename failures - io_uring: fix filename leak in __io_openat_prep() - Revert "cgroup_freezer: cgroup_freezing: Check if not frozen" - rxrpc: Fix transmission of an abort in response to an abort - rxrpc: Fix recv-recv race of completed call - net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree - net: bridge: Do not offload IGMP/MLD messages - hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf - netfilter: nf_conntrack: fix crash due to removal of uninitialised entry - ipv6: mcast: Delay put pmc->idev in mld_del_delrec() - net/mlx5: Correctly set gso_size when LRO is used - Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID - Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout - Bluetooth: SMP: If an unallowed command is received consider it a failure - Bluetooth: hci_sync: fix connectable extended advertising when using static random address - hwmon: (corsair-cpro) Validate the size of the received input buffer - selftests: net: increase inter-packet timeout in udpgro.sh - wifi: cfg80211: remove scan request n_channels counted_by - nvme: fix misaccounting of nvme-mpath inflight I/O - net: phy: Don't register LEDs for genphy - nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list() - rpl: Fix use-after-free in rpl_do_srh_inline(). - block: fix kobject leak in blk_unregister_queue - net: emaclite: Fix missing pointer increment in aligned_read() - soundwire: amd: fix for clearing command status register - soundwire: amd: fix for handling slave alerts after link is down - comedi: Fix use of uninitialized data in insn_rw_emulate_bits() - comedi: Fix some signed shift left operations - comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large - comedi: das6402: Fix bit shift out of bounds - comedi: das16m1: Fix bit shift out of bounds - comedi: aio_iiro_16: Fix bit shift out of bounds - comedi: pcl812: Fix bit shift out of bounds - iio: adc: stm32-adc: Fix race in installing chained IRQ handler - iio: adc: max1363: Reorder mode_list[] entries - iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] - iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush - soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled - soc: aspeed: lpc-snoop: Cleanup resources in stack-order - s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again - pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov - net: libwx: properly reset Rx ring descriptor - net: libwx: remove duplicate page_pool_put_full_page() - mmc: sdhci_am654: Workaround for Errata i2312 - mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models - mmc: bcm2835: Fix dma_unmap_sg() nents value - memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() - isofs: Verify inode mode when loading from disk - dmaengine: nbpfaxi: Fix memory corruption in probe() - af_packet: fix soft lockup issue caused by tpacket_snd() - af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() - arm64: dts: rockchip: use cs-gpios for spi1 on ringneck - arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on - arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency - net/mlx5: Update the list of the PCI supported devices - phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() - io_uring/poll: fix POLLERR handling - ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS - drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume - tracing/osnoise: Fix crash in timerlat_dump_stack() - spi: Add check for 8-bit transfer with 8 IO mode support - pch_uart: Fix dma_sync_sg_for_device() nents value - thunderbolt: Fix bit masking in tb_dp_port_set_hops() - i2c: stm32: fix the device used for the DMA map - tracing: Fix crash on synthetic stacktrace field usage - usb: musb: fix gadget state on disconnect - USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI - USB: serial: option: add Foxconn T99W640 - USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition - phy: tegra: xusb: Disable periodic tracking on Tegra234 - phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode - phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr - fs/proc: fix uaf in proc_readdir_de() - io_uring/net: commit partial buffers on retry - nvme: fix admin request_queue lifetime - fs/notify: call exportfs_encode_fid with s_umount - iomap: adjust read range correctly for non-block-aligned positions - fuse: fix livelock in synchronous file put from fuseblk workers - tpm: Cap the number of PCR banks - nfsd: provide locking for v4_end_grace - Revert "nfsd: provide locking for v4_end_grace" - config: enable config for PMT discovery driver - platform/x86/intel/pmt/discovery: use valid device pointer in dev_err_probe - platform/x86/intel/pmt: Fix kobject memory leak on init failure - platform/x86/intel/pmt: fix a crashlog NULL pointer access - platform/x86/intel/pmt: fix build dependency for kunit test - platform/x86/intel/pmt/discovery: fix format string warning - platform/x86/intel/pmt/discovery: Fix size_t specifiers for 32-bit - platform/x86/intel/pmt: KUNIT test for PMT Enhanced Discovery API - platform/x86/intel/pmt/telemetry: Add API to retrieve telemetry regions by feature - platform/x86/intel/pmt/discovery: Get telemetry attributes - platform/x86/intel/tpmi: Get OOBMSM CPU mapping from TPMI - platform/x86/intel/vsec: Set OOBMSM to CPU mapping - platform/x86/intel/tpmi: Relocate platform info to intel_vsec.h - docs: Add ABI documentation for intel_pmt feature directories - platform/x86/intel/pmt: Add PMT Discovery driver - sysfs: Fix crash on empty group attributes array - sysfs: Introduce a mechanism to hide static attribute_groups - platform/x86/intel/vsec: Add new Discovery feature - platform/x86/intel/vsec: Skip driverless features - platform/x86/intel/vsec: Skip absent features during initialization - platform/x86/intel/vsec: Add device links to enforce dependencies - platform/x86/intel/vsec: Create wrapper to walk PCI config space - platform/x86/intel/vsec: Add private data for per-device data - MAINTAINERS: Add link to documentation of Intel PMT ABI - platform/x86/intel/pmt: allow user offset for PMT callbacks - driver/coda: VirtCCA supports MSI device DA - ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency - Rename leapioraid to leapraid and release v2.0 - ub: udma: fix a bug that caused long reboot time. - ub: ubase: Accelerate when ctrl node is shutting down - platform/x86/intel/pmt: Use PMT callbacks - platform/x86/intel/vsec: Add PMT read callbacks - platform/x86/intel/vsec.h: Move to include/linux - md: prevent incorrect update of resync/recovery offset - md/raid1: Fix data corruption for degraded array with slow disk - md/raid1: set max_sectors during early return from choose_slow_rdev() - md-cluster: fix no recovery job when adding/re-adding a disk - md-cluster: fix hanging issue while a new disk adding - md/raid5: recheck if reshape has finished with device_lock held - md-cluster: Constify struct md_cluster_operations - md: Remove unneeded semicolon - md/raid5: fix spares errors about rcu usage - dm-raid: Fix WARN_ON_ONCE check for sync_thread in raid_resume - md: pass in max_sectors for pers->sync_request() - md: factor out helpers for different sync_action in md_do_sync() - md: replace last_sync_action with new enum type - md: use new helpers in md_do_sync() - md: don't fail action_store() if sync_thread is not registered - md: remove parameter check_seq for stop_sync_thread() - md: replace sysfs api sync_action with new helpers - md: factor out helper to start reshape from action_store() - md: add new helpers for sync_action - md: add a new enum type sync_action - md: rearrange recovery_flags - md/raid0: don't free conf on raid0_run failure - md: make md_flush_request() more readable - md: change the return value type of md_write_start to void - md: Revert "md: Fix overflow in is_mddev_idle" - md: don't account sync_io if iostats of the disk is disabled - md: Fix overflow in is_mddev_idle - md: add check for sleepers in md_wakeup_thread() - md: add a mddev_is_dm helper - md: add a mddev_add_trace_msg helper - md: add a mddev_trace_remap helper - dm-raid456, md/raid456: fix a deadlock for dm-raid456 while io concurrent with reshape - dm-raid: add a new helper prepare_suspend() in md_personality - dm-raid: really frozen sync_thread during suspend - md: add a new helper reshape_interrupted() - md: export helper md_is_rdwr() - md: export helpers to stop sync_thread - md: don't clear MD_RECOVERY_FROZEN for new dm-raid until resume - md/raid1: factor out helpers to choose the best rdev from read_balance() - md/raid1: factor out the code to manage sequential IO - md/raid1: factor out choose_bb_rdev() from read_balance() - md/raid1: factor out choose_slow_rdev() from read_balance() - md/raid1: factor out read_first_rdev() from read_balance() - md/raid1-10: factor out a new helper raid1_should_read_first() - md/raid1-10: add a helper raid1_check_read_range() - md/raid1: fix choose next idle in read_balance() - md/raid1: record nonrot rdevs while adding/removing rdevs to conf - md/raid1: factor out helpers to add rdev to conf - md: add a new helper rdev_has_badblock() - md: check mddev->pers before calling md_set_readonly() - md: clean up openers check in do_md_stop() and md_set_readonly() - md: sync blockdev before stopping raid or setting readonly - md: factor out a helper to sync mddev - md: return directly before setting did_set_md_closing - md: changed the switch of RAID_VERSION to if - md: merge the check of capabilities into md_ioctl_valid() - md: Don't suspend the array for interrupted reshape - md: Don't register sync_thread for reshape directly - md: Make sure md_do_sync() will set MD_RECOVERY_DONE - md: Don't ignore read-only array in md_check_recovery() - md: Don't ignore suspended array in md_check_recovery() - md: get rdev->mddev with READ_ONCE() - md: remove redundant md_wakeup_thread() - md: remove redundant check of 'mddev->sync_thread' - md: fix a suspicious RCU usage warning - raid: Remove now superfluous sentinel element from ctl_table array - NFSD: NFSv4 file creation neglects setting ACL - nfsd: set security label during create operations - xfs: Add xfs_dir3_leaf_header_check() in leaf/leafn read - nvme-fc: use lock accessing port_state and rport state - x86/mm: Batch flushing user memory encrytion status change - !20588 [OLK-6.6] Revert "x86/csv: Enhance CMA memory usage reporting for CSV3" - Revert "x86/csv: Enhance CMA memory usage reporting for CSV3" - !20576 media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg() - !20575 RDMA/cm: Fix leaking the multicast GID table reference - !20580 RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly - !20551 Fix CVE-2025-68785 - !20478 f2fs: fix to avoid potential deadlock - !20501 [OLK-6.6] backport important bugfix for bnxt driver from upstream linux-6.6.y - !20520 Fix CVE-2026-23038 - !20424 net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup - !20425 mlx5: Fix default values in create CQ - RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly - media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg() - RDMA/cm: Fix leaking the multicast GID table reference - net: openvswitch: fix middle attribute validation in push_nsh() action - net: openvswitch: remove never-working support for setting nsh fields - pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() - bnxt_en: Fix potential data corruption with HW GRO/LRO - f2fs: fix to avoid potential deadlock - mlx5: Fix default values in create CQ - net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup - riscv kernel upgrade to 6.6.0-138.0.0 - Fixed system hang when boot systemd on spacemit k3 - riscv: perf vendor events: fix lrw core PMU event mapping - !20727 v2 bpf: sockmap fixes - !20741 scsi: qla2xxx: Sanitize payload size to prevent member overflow - !20744 fix CVE-2025-38449 - !20763 net: usb: asix: validate PHY address before use - !20762 smc91x: fix broken irq-context in PREEMPT_RT - !20293 [Hygon][6.6][EDAC] The width of hash value is 2 bits for Hygon family 18h model 6h processors - !20290 [Hygon][6.6][Bugfix] Bug fix for EDAC to use unicast instead of broadcast on hygon family 18h model 4h - !20289 [Hygon][6.6][Bugfix] Bug fix for EDAC to correct the address translation on hygon family 18h model 4h - !20245 KVM: arm64: Refactor exit handlers - !20246 KVM: arm64: Mark some header functions as inline - !19005 [Hygon] [OLK-6.6] [Bugfix] Fix memory bandwidth counter width for Hygon QoS - !20292 [Hygon][6.6][TSC Adjust] Backport x86 TSC adjust patch - !20273 [Hygon][6.6][Bugfix] Get correct CPU LLC ID in guest for Hygon processors - !20722 [OLK-6.6][linux-6.6.y sync] Backport 6.6.104-6.6.106 LTS Patches - !20667 fix CVE-2024-50102 - !20736 netfilter: nf_tables: remove redundant chain validation on register store - !20758 ub: ubase: Fixed the alarm issue caused by the initialization of the structure variable definition. - !20721 obmm: reduce log noise for successful export/import/preimport - net: usb: asix: validate PHY address before use - smc91x: fix broken irq-context in PREEMPT_RT - !20731 devlink: rate: Unset parent pointer in devl_rate_nodes_destroy - !20732 libceph: return the handler error from mon_handle_auth_done() - !20743 mm: slub: avoid wake up kswapd in set_track_prepare - ub: ubase: Fixed the alarm issue caused by the initialization of the structure variable definition. - !20750 ub: cdma: adapted to UMMU interface changes - !20713 urma: DFX of log in kernel - urma: optimize log levels for kernel space - ub: cdma: adapted to UMMU interface changes - wifi: ath11k: avoid bit operation on key flags - drm/mediatek: fix potential OF node use-after-free - cpufreq: intel_pstate: Check IDA only before MSR_IA32_PERF_CTL writes - wifi: cfg80211: sme: store capped length in __cfg80211_connect_result() - !20708 ub:hisi-ubus: Add create bus instance ummu bypass - drm: fix kabi for struct drm_framebuffer - drm/framebuffer: Acquire internal references on GEM handles - drm/gem: Acquire references on GEM handles for framebuffers - mm: slub: avoid wake up kswapd in set_track_prepare - scsi: qla2xxx: Sanitize payload size to prevent member overflow - netfilter: nf_tables: remove redundant chain validation on register store - libceph: return the handler error from mon_handle_auth_done() - devlink: rate: Unset parent pointer in devl_rate_nodes_destroy - Documentation/hw-vuln: Add VMSCAPE documentation - dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status() - riscv: use lw when reading int cpu in asm_per_cpu - mm: slub: avoid wake up kswapd in set_track_prepare - tools: gpio: remove the include directory on make clean - tools: gpio: rm .*.cmd on make clean - drm/amd/amdgpu: Fix missing error return on kzalloc failure - drm/amdgpu: Replace DRM_* with dev_* in amdgpu_psp.c - perf bpf-event: Fix use-after-free in synthesis - drm/bridge: ti-sn65dsi86: fix REFCLK setting - spi: spi-fsl-lpspi: Clear status register after disabling the module - spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort - spi: spi-fsl-lpspi: Set correct chip-select polarity bit - spi: spi-fsl-lpspi: Fix transmissions when using CONT - hwmon: mlxreg-fan: Prevent fans from getting stuck at 0 RPM - pcmcia: omap: Add missing check for platform_get_resource - Revert "drm/amdgpu: Avoid extra evict-restore process." - ALSA: hda/realtek: Fix headset mic for TongFang X6[AF]R5xxY - ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model - drm/mediatek: Fix device/node reference count leaks in mtk_drm_get_all_drm_priv - drm/mediatek: Fix using wrong drm private data to bind mediatek-drm - drm/mediatek: Add crtc path enum for all_drm_priv array - vmxnet3: update MTU after device quiesce - net: dsa: microchip: linearize skb for tail-tagging switches - net: dsa: microchip: update tag_ksz masks for KSZ9477 family - dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status() - ALSA: hda/realtek - Add new HP ZBook laptop with micmute led fixup - ALSA: hda/realtek: Add support for HP Agusta using CS35L41 HDA - iio: pressure: mprls0025pa: use aligned_s64 for timestamp - iio: chemical: pms7003: use aligned_s64 for timestamp - iio: imu: inv_mpu6050: align buffer for timestamp - thermal/drivers/mediatek/lvts: Disable low offset IRQ for minimum threshold - nouveau: fix disabling the nonstall irq due to storm code - cpufreq: intel_pstate: Unchecked MSR aceess in legacy mode - net: pcs: rzn1-miic: Correct MODCTRL register offset - platform/x86/amd/pmc: Add TUXEDO IB Pro Gen10 AMD to spurious 8042 quirks list - drm/amdgpu: drop hw access in non-DC audio fini - wifi: mt76: mt7996: Initialize hdr before passing to skb_put_data() - wifi: mwifiex: Initialize the chan_stats array to zero - tcp_bpf: Fix copied value in tcp_bpf_sendmsg - skmsg: Return copied bytes in sk_msg_memcopy_from_iter - tcp_bpf: Add sk_rmem_alloc related logic for tcp_bpf ingress redirection - Revert "bpf, sockmap: Add sk_rmem_alloc check for sockmap" - ALSA: usb-audio: Add mute TLV for playback volumes on some devices - phy: mscc: Stop taking ts_lock for tx_queue and use its own lock - selftest: net: Fix weird setsockopt() in bind_bhash.c. - net: atm: fix memory leak in atm_register_sysfs when device_register fail - ax25: properly unshare skbs in ax25_kiss_rcv() - mctp: return -ENOPROTOOPT for unknown getsockopt options - net/smc: Remove validation of reserved bits in CLC Decline message - ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init() - net: thunder_bgx: decrement cleanup index before use - net: thunder_bgx: add a missing of_node_put - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() - wifi: libertas: cap SSID len in lbs_associate() - wifi: cw1200: cap SSID length in cw1200_do_join() - net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets - wifi: ath11k: fix group data packet drops during rekey - wifi: ath11k: avoid forward declaration of ath11k_mac_start_vdev_delay() - wifi: ath11k: rename ath11k_start_vdev_delay() - wifi: ath11k: Introduce and use ath11k_sta_to_arsta() - net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() - macsec: read MACSEC_SA_ATTR_PN with nla_get_uint - netlink: add variable-length / auto integers - net: macb: Fix tx_ptr_lock locking - icmp: fix icmp_ndo_send address translation for reply direction - mISDN: Fix memory leak in dsp_hwec_enable() - xirc2ps_cs: fix register access when enabling FullDuplex - netfilter: conntrack: helper: Replace -EEXIST by -EBUSY - wifi: cfg80211: fix use-after-free in cmp_bss() - arm64: dts: imx8mp: Fix missing microSD slot vqmmc on Data Modul i.MX8M Plus eDM SBC - arm64: dts: imx8mp: Fix missing microSD slot vqmmc on DH electronics i.MX8M Plus DHCOM - tee: optee: ffa: fix a typo of "optee_ffa_api_is_compatible" - arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro - Bluetooth: hci_sync: Avoid adding default advertising on startup - cpupower: Fix a bug where the -t option of the set subcommand was not working. - drm/amd/display: Don't warn when missing DCE encoder caps - cdc_ncm: Flag Intel OEM version of Fibocom L850-GL as WWAN - LoongArch: Save LBT before FPU in setup_sigcontext() - btrfs: avoid load/store tearing races when checking if an inode was logged - btrfs: fix race between setting last_dir_index_offset and inode logging - btrfs: fix race between logging inode and checking if it was logged before - bpf: Fix oob access in cgroup local storage - !20556 urma: fix update topo logic - !20639 [OLK-6.6][linux-6.6.y sync] Backport 6.6.103-6.6.104 LTS Patches - !20641 [OLK-6.6][linux-6.6.y sync] LoongArch: Add more instruction opcodes and emit_* helpers - !20560 *** fix CVE-2025-38062 *** - !20662 pNFS: Fix a deadlock when returning a delegation during open() - ub:hisi-ubus: Add create bus instance ummu bypass - Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" - Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set" - HID: mcp2221: Handle reads greater than 60 bytes - HID: mcp2221: Don't set bus speed on every transfer - net/mlx5: SF, Fix add port error handling - drm/nouveau/disp: Always accept linear modifier - smb3 client: fix return code mapping of remap_file_range - net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions - dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted - HID: wacom: Add a new Art Pen 2 - HID: logitech: Add ids for G PRO 2 LIGHTSPEED - HID: quirks: add support for Legion Go dual dinput modes - net: stmmac: Set CIC bit only for TX queues with COE - net: stmmac: xgmac: Correct supported speed modes - net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts - net/mlx5e: Set local Xoff after FW update - net/mlx5e: Update and set Xon/Xoff upon port speed set - net/mlx5e: Update and set Xon/Xoff upon MTU set - net/mlx5: Nack sync reset when SFs are present - net/mlx5: Convert SF port_indices xarray to function_ids xarray - net/mlx5: Use devlink port pointer to get the pointer of container SF struct - net/mlx5: Call mlx5_sf_id_erase() once in mlx5_sf_dealloc() - phy: mscc: Fix when PTP clock is register and unregister - net: dlink: fix multicast stats being counted incorrectly - dt-bindings: display/msm: qcom,mdp5: drop lut clock - drm/nouveau: remove unused memory target test - drm/nouveau: remove unused increment in gm200_flcn_pio_imem_wr - Bluetooth: hci_sync: fix set_local_name race condition - Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced - Bluetooth: hci_event: Mark connection as closed during suspend disconnect - Bluetooth: hci_event: Treat UNKNOWN_CONN_ID on disconnect as success - HID: input: report battery status changes immediately - HID: input: rename hidinput_set_battery_charge_status() - powerpc/kvm: Fix ifdef to remove build warning - drm/msm: Defer fd_install in SUBMIT ioctl - vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() - ACPI: EC: Add device to acpi_ec_no_wakeup[] qurik list - erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC - ASoC: codecs: tx-macro: correct tx_macro_component_drv name - smb: client: fix race with concurrent opens in unlink(2) - scsi: core: sysfs: Correct sysfs attributes access rights - of: dynamic: Fix use after free in of_changeset_add_prop_helper() - of: Add a helper to free property struct - mips: lantiq: xway: sysctrl: rename the etop node - mips: dts: lantiq: danube: add missing burst length property - pinctrl: STMFX: add missing HAS_IOMEM dependency - of: dynamic: Fix memleak when of_pci_add_properties() failed - !20684 urma: adjust urma log format - !20355 udp: Deal with race between UDP socket address change and rehash - !20627 Fixes CVE-2025-38627 - !20702 CVE-2025-39948 - !20701 netfilter: ctnetlink: remove refcounting in expectation dumpers - !20700 CVE-2025-38678 - !20703 CVE-2025-38491 - !20690 tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. - obmm: reduce log noise for successful export/import/preimport - mptcp: avoid deadlock on fallback while reinjecting - mptcp: plug races between subflow fail and subflow creation - mptcp: make fallback action and fallback decision atomic - ice: fix Rx page leak on multi-buffer frames - ice: fix incorrect counter for buffer allocation failures - ice: stop storing XDP verdict within ice_rx_buf - ice: gather page_count()'s of each frag right before XDP prog call - ice: Introduce ice_xdp_buff - netfilter: ctnetlink: remove refcounting in expectation dumpers - netfilter: nf_tables: reject duplicate device on updates - netfilter: nf_tables: Introduce functions freeing nft_hook objects - netfilter: nf_tables: Fix percpu address space issues in nf_tables_api.c - err.h: add ERR_PTR_PCPU(), PTR_ERR_PCPU() and IS_ERR_PCPU() macros - tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. - !20498 Fix CVE-2025-71118 - !20608 pmdomain: arm: scmi: Fix genpd leak on provider registration failure - !20679 x86/CPU/AMD: Add RDSEED fix for Zen5 - !20650 fix cve-2025-40300 - !20661 Input: alps - fix use-after-free bugs caused by dev3_register_work - !20664 backport some net bugfix from 6.6 lts - urma: adjust urma log format - !20678 ub: udma: close debug switch load parameters. - ub: udma: close debug switch load parameters. - x86/CPU/AMD: Add RDSEED fix for Zen5 - !20630 net: LTS-6.6 bugfix backport - !20632 net/sched: sch_qfq: do not free existing class in qfq_change_class() - !20631 macvlan: fix possible UAF in macvlan_forward_source() - !20628 Fix CVE-2025-39910 - !20659 v2 Fix CVE-2025-22090 - !20506 XSched: Update XSched manual - !20647 media: imon: make send_packet() more robust - !20646 ksm: use range-walk function to jump over holes in scan_get_next_rmap_item - !20645 fbcon: Set fb_display[i - !20648 parse_longname(): strrchr() expects NUL-terminated string - !20621 urma: modify log level - !20602 urma: fix the jfe uaf issue that occurred during the killall process. - !20567 urma:change log level and pass status 9 - !20640 iio: common: st_sensors: Fix use of uninitialize device structs - !20634 usb: gadget: udc: fix use-after-free in usb_gadget_state_work - !20633 net: dsa: properly keep track of conduit reference - !20635 fix CVE-2025-68231 - !20651 mm/slub: avoid accessing metadata when pointer is invalid in object_err() - !20649 drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb - !20652 mm/vmalloc: fix data race in show_numa_info() - x86: uaccess: don't use runtime-const rewriting in modules - x86: fix off-by-one in access_ok() - x86: fix user address masking non-canonical speculation issue - x86/uaccess: Zero the 8-byte get_range case on failure on 32-bit - x86/uaccess: Improve the 8-byte getuser() case - x86: fix whitespace in runtime-const assembler output - dcache: keep dentry_hashtable or d_hash_shift even when not used - runtime constants: add x86 architecture support - runtime constants: deal with old decrepit linkers - x86/uaccess: Add missing __force to casts in __access_ok() and valid_user_address() - !20345 arm64: entry: xcall/xint: make asm conditionals compatible with clang IAS - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). - libceph: replace BUG_ON with bounds check for map->max_osd - libceph: prevent potential out-of-bounds writes in handle_auth_session_key() - libceph: fix potential use-after-free in have_mon_and_osd_map() - sctp: Hold sock lock while iterating over address list - sctp: Prevent TOCTOU out-of-bounds write - sctp: Hold RCU read lock while iterating over address list - tipc: Fix use-after-free in tipc_mon_reinit_self(). - sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto - sctp: avoid NULL dereference when chunk data buffer is missing - bpf: Explicitly check accesses to bpf_sock_addr - ipvs: Defer ip_vs_ftp unregister during netns cleanup - nexthop: Forbid FDB status change while nexthop is in a group - netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). - net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer - sctp: initialize more fields in sctp_v6_from_sk() - pNFS: Fix a deadlock when returning a delegation during open() - Input: alps - fix use-after-free bugs caused by dev3_register_work - x86/cpu: Get CPU LLC ID from CPUID 0x8000001d in guest for Hygon processors - kernel/fork: only call untrack_pfn_clear() on VMAs duplicated for fork() - mm: (un)track_pfn_copy() fix + doc improvements - x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range() - !20642 mtdchar: fix integer overflow in read/write ioctls - mm/vmalloc: fix data race in show_numa_info() - mm/slub: avoid accessing metadata when pointer is invalid in object_err() - config: enable CONFIG_MITIGATION_VMESCAPE by default on x86 - x86/vmscape: Enable the mitigation - x86/vmscape: Enumerate VMSCAPE bug - x86/vmscape: Add conditional IBPB mitigation - drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb - parse_longname(): strrchr() expects NUL-terminated string - media: imon: make send_packet() more robust - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item - fbcon: Set fb_display[i]->mode to NULL when the mode is released - !20569 CVE-2024-35808 - mtdchar: fix integer overflow in read/write ioctls - !20619 Fix CVE-2026-22991 - !20612 net: hns3: extend HCLGE_FD_AD_COUNTER_NUM to 8 bits - LoongArch: Add more instruction opcodes and emit_* helpers - iio: common: st_sensors: Fix use of uninitialize device structs - !20581 null_blk: fix kmemleak by releasing references to fault configfs items - mm/mempool: fix poisoning order>0 pages with HIGHMEM - mm/page_poison: replace kmap_atomic() with kmap_local_page() - mm/mempool: replace kmap_atomic() with kmap_local_page() - usb: gadget: udc: fix use-after-free in usb_gadget_state_work - net: dsa: properly keep track of conduit reference - net/sched: sch_qfq: do not free existing class in qfq_change_class() - macvlan: fix possible UAF in macvlan_forward_source() - netfilter: nft_objref: validate objref and objrefmap expressions - arp: do not assume dev_hard_header() does not change skb->head - ip6_gre: make ip6gre_header() robust - netfilter: nf_tables: avoid chain re-validation if possible - netfilter: nf_tables: drop unused 3rd argument from validate callback ops - Revert "netfilter: nft_objref: validate objref and objrefmap expressions" - bpf: Fix reference count leak in bpf_prog_test_run_xdp() - net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset - ethtool: Avoid overflowing userspace buffer on stats query - ipvs: fix ipv4 null-ptr-deref in route error path - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() - !20596 mm/page_alloc: prevent pcp corruption with SMP=n - !20598 team: fix check for port enabled in team_queue_override_port_prio_changed() - !18823 hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio - mm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc() - kasan: avoid sleepable page allocation from atomic context - f2fs: compress: fix UAF of f2fs_inode_info in f2fs_free_dic - f2fs: compress: change the first parameter of page_array_{alloc,free} to sbi - !20583 [OLK-6.6][linux-6.6.y sync] Backport 6.6.102-6.6.103 LTS Patches - !20460 fbdev: Fix vmalloc out-of-bounds write in fast_imageblit - urma:fix log level and pass status 9 - urma: modify log level - !20592 CVE-2025-71141 fixup - !20594 CVE-2025-39744 fixup - !20607 powerpc/64s/slb: Fix SLB multihit issue during SLB preload - !20606 mm/huge_memory: fix NULL pointer deference when splitting folio - !20604 Fix CVE-2026-22984 - !20603 Fix CVE-2026-23021 - !20600 Fix CVE-2026-22990 - urma: fix the jfe uaf issue that occurred during the killall process. - !20380 pswiotlb: Adapt to the IOMMU DMA API upgraded by IOMMUFD - libceph: make free_choose_arg_map() resilient to partial allocation - drm/dp: Change AUX DPCD probe address from LANE0_1_STATUS to TRAINING_PATTERN_SET - net: hns3: extend HCLGE_FD_AD_COUNTER_NUM to 8 bits - net: hns3: extend HCLGE_FD_AD_QID to 11 bits - net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue - net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M - Revert "net: hns3: add support for FD counter" - !20587 dmaengine: stm32: dmamux: fix device leak on route allocation - pmdomain: arm: scmi: Fix genpd leak on provider registration failure - powerpc/64s/slb: Fix SLB multihit issue during SLB preload - mm/huge_memory: fix NULL pointer deference when splitting folio - !20562 LoongArch: BPF: Sign extend kfunc call arguments - !20470 ipv4: Fix reference count leak when using error routes with nexthop objects - !20471 net: sock: fix hardened usercopy panic in sock_recv_errqueue - !20472 net: fix memory leak in skb_segment_list for GRO packets - !20473 ipv4: ip_gre: make ipgre_header() robust - !20469 SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf - !20476 ipv6: Fix use-after-free in inet6_addr_del(). - !20477 svcrdma: bound check rq_pages index in inline path - !20578 ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() - !20579 fix CVE-2025-68768 - !20542 Fix NFS deadlock - USB: storage: Remove subclass and protocol overrides from Novatek quirk - cpuidle: governors: menu: Select polling state in some more cases - cpuidle: governors: menu: Rearrange main loop in menu_select() - cpuidle: menu: Update documentation after previous changes - Revert "drm/tegra: dsi: Clear enable register if powered by bootloader" - parisc: Remove spurious if statement from raw_copy_from_user() - ata: libata-scsi: Fix system suspend for a security locked drive - Revert "drm/amdgpu: fix incorrect vm flags to map bo" - mfd: axp20x: Set explicit ID for regulator cell if no IRQ line is present - drm/amd/display: use udelay rather than fsleep - sched/fair: Revert max_newidle_lb_cost bump - net: ipv4: fix regression in local-broadcast routes - tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers - PM: runtime: Do not clear needs_force_resume with enabled runtime PM - usb: typec: ucsi: psy: Set max current to zero when disconnected - io_uring/rw: cast rw->flags assignment to rwf_t - Documentation: ACPI: i2c-muxes: fix I2C device references - s390/hypfs: Enable limited access during lockdown - s390/hypfs: Avoid unnecessary ioctl registration in debugfs - ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation - net/mlx5e: Preserve shared buffer capacity during headroom updates - net/mlx5: Base ECVF devlink port attrs from 0 - Octeontx2-af: Skip overlap check for SPI field - bonding: send LACPDUs periodically in passive mode after receiving partner's LACPDU - bonding: Add independent control state machine - bonding: update LACP activity flag after setting lacp_active - net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate - ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc - gve: prevent ethtool ops after shutdown - phy: mscc: Fix timestamping for vsc8584 - net: ethernet: mtk_ppe: add RCU lock around dev_fill_forward_path - ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add - net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM - ALSA: usb-audio: Fix size validation in convert_chmap_v3() - mlxsw: spectrum: Forward packets with an IPv4 link-local source IP - Bluetooth: hci_conn: do return error from hci_enhanced_setup_sync() - Bluetooth: hci_event: fix MTU for BN == 0 in CIS Established - scsi: qla4xxx: Prevent a potential error pointer dereference - RDMA/bnxt_re: Fix to initialize the PBL array - RDMA/bnxt_re: Fix to remove workload check in SRQ limit path - RDMA/bnxt_re: Fix to do SRQ armena by default - RDMA/erdma: Fix ignored return value of init_kernel_qp - iosys-map: Fix undefined behavior in iosys_map_clear() - cgroup/cpuset: Use static_branch_enable_cpuslocked() on cpusets_insane_config_key - spi: spi-fsl-lpspi: Clamp too high speed_hz - usb: typec: maxim_contaminant: disable low power mode when reading comparator values - usb: typec: maxim_contaminant: re-enable cc toggle if cc is open and port is clean - iio: imu: inv_icm42600: change invalid data error to -EBUSY - iio: imu: inv_icm42600: Convert to uXX and sXX integer types - iio: imu: inv_icm42600: use = { } instead of memset() - iio: imu: inv_icm42600: switch timestamp type from int64_t __aligned(8) to aligned_s64 - iio: temperature: maxim_thermocouple: use DMA-safe buffer for spi_read() - iio: light: as73211: Ensure buffer holes are zeroed - tls: fix handling of zero-length records on the rx_list - powerpc/boot: Fix build with gcc 15 - mmc: sdhci-pci-gli: GL9763e: Mask the replay timer timeout of AER - compiler: remove __ADDRESSABLE_ASM{_STR,}() again - drm/amd/display: Don't overclock DCE 6 by 15% - usb: dwc3: pci: add support for the Intel Wildcat Lake - usb: dwc3: Ignore late xferNotReady event to prevent halt timeout - USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles - usb: storage: realtek_cr: Use correct byte order for bcs->Residue - USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera - usb: renesas-xhci: Fix External ROM access timeouts - usb: core: hcd: fix accessing unmapped memory in SINGLE_STEP_SET_FEATURE test - comedi: Make insn_rw_emulate_bits() do insn->n samples - usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive - cdx: Fix off-by-one error in cdx_rpmsg_probe() - most: core: Drop device reference after usage in get_channel() - iio: proximity: isl29501: fix buffered read on big-endian systems - iio: pressure: bmp280: Use IS_ERR() in bmp280_common_probe() - fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable() - drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS - cpuidle: governors: menu: Avoid selecting states with too much latency - cpuidle: menu: Remove iowait influence - mmc: sdhci-pci-gli: Add a new function to simplify the code - mmc: sdhci-pci-gli: Use PCI AER definitions, not hard-coded values - mptcp: disable add_addr retransmission when timeout is 0 - mptcp: remove duplicate sk_reset_timer call - use uniform permission checks for all mount propagation changes - arm64: dts: ti: k3-am62-main: Remove eMMC High Speed DDR support - scsi: mpi3mr: Serialize admin queue BAR writes on 32-bit systems - scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers - scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE - PCI: imx6: Add IMX8MM_EP and IMX8MP_EP fixed 256-byte BAR 4 in epc_features - PCI: imx6: Delay link start until configfs 'start' written - PCI: rockchip: Set Target Link Speed to 5.0 GT/s before retraining - PCI: rockchip: Use standard PCIe definitions - drm/amd/display: Fill display clock and vblank time in dce110_fill_display_configs - drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs - drm/amd/display: Fix DP audio DTO1 clock source on DCE 6. - drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3 - ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and EliteBook 830 G6 - mm/debug_vm_pgtable: clear page table entries at destroy_args() - squashfs: fix memory leak in squashfs_fill_super - mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for consistency - memstick: Fix deadlock by moving removing flag earlier - KVM: arm64: Fix kernel BUG() due to bad backport of FPSIMD/SVE/SME fix - sched/fair: Fix frequency selection for non-invariant case - kbuild: userprogs: use correct linker when mixing clang and GNU ld - ata: libata-scsi: Return aborted command when missing sense and result TF - PM: runtime: Take active children into account in pm_runtime_get_if_in_use() - PM: runtime: Simplify pm_runtime_get_if_active() usage - ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig - usb: dwc3: imx8mp: fix device leak at unbind - wifi: mac80211: check basic rates validity in sta_link_apply_parameters - KVM: x86: Take irqfds.lock when adding/deleting IRQ bypass producer - s390/mm: Remove possible false-positive warning in pte_free_defer() - btrfs: send: make fs_path_len() inline and constify its argument - btrfs: send: use fallocate for hole punching with send stream v2 - btrfs: send: avoid path allocation for the current inode when issuing commands - btrfs: send: keep the current inode's path cached - btrfs: send: add and use helper to rename current inode when processing refs - btrfs: send: only use boolean variables at process_recorded_refs() - btrfs: send: factor out common logic when sending xattrs - btrfs: populate otime when logging an inode item - btrfs: constify more pointer parameters - btrfs: fix ssd_spread overallocation - btrfs: open code timespec64 in struct btrfs_inode - xfs: fully decouple XFS_IBULK* flags from XFS_IWALK* flags - btrfs: abort transaction on unexpected eb generation at btrfs_copy_root() - btrfs: always abort transaction on failure to add block group to free space tree - btrfs: move transaction aborts to the error site in add_block_group_free_space() - btrfs: qgroup: fix race between quota disable and quota rescan ioctl - usb: typec: fusb302: cache PD RX state - block: Make REQ_OP_ZONE_FINISH a write operation - block: reject invalid operation in submit_bio_noacct - leds: flash: leds-qcom-flash: Fix registry access after re-bind - leds: flash: leds-qcom-flash: Limit LED current based on thermal condition - selftests/memfd: add test for mapping write-sealed memfd read-only - mm: update memfd seal write check to include F_SEAL_WRITE - mptcp: pm: kernel: flush: do not reset ADD_ADDR limit - mptcp: drop skb if MPTCP skb extension allocation fails - ipv6: sr: Fix MAC comparison to be constant-time - drm/amd/display: Don't overwrite dce60_clk_mgr - drm/amd/display: Add primary plane to commits for correct VRR handling - drm/amdkfd: Destroy KFD debugfs after destroy KFD wq - drm/amdgpu: update mmhub 3.0.1 client id mappings - drm/amdgpu: Avoid extra evict-restore process. - drm/amd: Restore cached power limit during resume - media: venus: venc: Clamp param smaller than 1fps and bigger than 240 - media: venus: vdec: Clamp param smaller than 1fps and bigger than 240. - media: venus: protect against spurious interrupts during probe - media: venus: hfi: explicitly release IRQ during teardown - media: qcom: camss: cleanup media device allocated resource on error path - media: ov2659: Fix memory leaks in ov2659_probe() - media: usbtv: Lock resolution while streaming - media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free() - media: verisilicon: Fix AV1 decoder clock frequency - media: vivid: fix wrong pixel_array control size - media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init() - media: hi556: correct the test pattern configuration - media: gspca: Add bounds checking to firmware parser - parisc: Update comments in make_insert_tlb - parisc: Try to fixup kernel exception in bad_area_nosemaphore path of do_page_fault() - parisc: Rename pte_needs_flush() to pte_needs_cache_flush() in cache.c - parisc: Makefile: explain that 64BIT requires both 32-bit and 64-bit compilers - parisc: Define and use set_pte_at() - parisc: Check region is readable by user in raw_copy_from_user() - soc/tegra: pmc: Ensure power-domains are in a known state - f2fs: fix to avoid out-of-boundary access in dnode page - phy: qcom: phy-qcom-m31: Update IPQ5332 M31 USB phy initialization sequence - vhost/vsock: Avoid allocating arbitrarily-sized SKBs - PCI: endpoint: Fix configfs group removal on driver teardown - PCI: endpoint: Fix configfs group list head handling - mtd: rawnand: renesas: Add missing check after DMA map - mtd: rawnand: fsmc: Add missing check after DMA map - mtd: spinand: propagate spinand_wait() errors from spinand_write_page() - mtd: spi-nor: Fix spi_nor_try_unlock_all() - hwmon: (gsc-hwmon) fix fan pwm setpoint show functions - pwm: mediatek: Fix duty and period setting - pwm: mediatek: Handle hardware enable and clock enable separately - pwm: imx-tpm: Reset counter if CMOD is 0 - wifi: ath11k: fix dest ring-buffer corruption when ring is full - wifi: ath11k: fix source ring-buffer corruption - wifi: ath11k: fix dest ring-buffer corruption - wifi: ath12k: fix dest ring-buffer corruption when ring is full - wifi: ath12k: fix source ring-buffer corruption - wifi: ath12k: fix dest ring-buffer corruption - wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table() - iio: adc: ad_sigma_delta: change to buffer predisable - zynq_fpga: use sgtable-based scatterlist wrappers - scsi: ufs: ufs-pci: Fix default runtime and system PM levels - scsi: ufs: ufs-pci: Fix hibernate state transition for Intel MTL-like host controllers - ata: libata-scsi: Fix ata_to_sense_error() status handling - scsi: mpi3mr: Fix race between config read submit and interrupt completion - dt-bindings: display: sprd,sharkl3-dsi-host: Fix missing clocks constraints - dt-bindings: display: sprd,sharkl3-dpu: Fix missing clocks constraints - arm64: dts: ti: k3-am62-verdin: Enable pull-ups on I2C buses - arm64: dts: ti: k3-am62a7-sk: fix pinmux for main_uart1 - arm64: dts: ti: k3-pinctrl: Enable Schmitt Trigger by default - btrfs: zoned: fix write time activation failure for metadata block group - ext4: fix hole length calculation overflow in non-extent inodes - ext4: don't try to clear the orphan_present feature block device is r/o - ext4: fix reserved gdt blocks handling in fsmap - ext4: fix fsmap end of range reporting with bigalloc - ext4: check fast symlink for ea_inode correctly - tracing: fprobe-event: Sanitize wildcard for fprobe event name - crypto: qat - lower priority for skcipher and aead algorithms - lib/crypto: mips/chacha: Fix clang build and remove unneeded byteswap - vt: defkeymap: Map keycodes above 127 to K_HOLE - vt: keyboard: Don't process Unicode characters in K_OFF mode - bus: mhi: host: Fix endianness of BHI vector table - usb: dwc3: meson-g12a: fix device leaks at unbind - usb: musb: omap2430: fix device leak at unbind - usb: gadget: udc: renesas_usb3: fix device leak at unbind - usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init() - m68k: Fix lost column on framebuffer debug console - platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister() - cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table() - rcu: Fix racy re-initialization of irq_work causing hangs - HID: apple: avoid setting up battery timer for devices without battery - HID: magicmouse: avoid setting up battery timer when not needed - RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages - tools/nolibc: fix spelling of FD_SETBITMASK in FD_* macros - media: uvcvideo: Do not mark valid metadata as invalid - media: venus: Fix OOB read due to missing payload bound check - parisc: Makefile: fix a typo in palo.conf - fbdev: Fix vmalloc out-of-bounds write in fast_imageblit - btrfs: do not allow relocation of partially dropped subvolumes - btrfs: zoned: do not select metadata BG as finish target - btrfs: clear dirty status from extent buffer on error at insert_new_root() - btrfs: zoned: do not remove unwritten non-data block group - btrfs: abort transaction during log replay if walk_log_tree() failed - btrfs: zoned: use filesystem size not disk size for reclaim decision - cdc-acm: fix race between initial clearing halt and open - thunderbolt: Fix copy+paste error in match_service_id() - usb: typec: ucsi: Update power_supply on power role change - misc: rtsx: usb: Ensure mmc child device is active when card is present - iommufd: Report unmapped bytes in the error path of iopt_unmap_iova_range - cifs: reset iface weights when we cannot find a candidate - drm/amdgpu: fix incorrect vm flags to map bo - scsi: lpfc: Remove redundant assignment to avoid memory leak - rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe - pNFS: Handle RPC size limit for layoutcommits - pNFS: Fix disk addr range check in block/scsi layout - pNFS: Fix stripe mapping in block/scsi layout - ASoC: Intel: avs: Fix uninitialized pointer error in probe() - net: phy: smsc: add proper reset flags for LAN8710A - ipmi: Fix strcpy source and destination the same - kconfig: lxdialog: fix 'space' to (de)select options - kconfig: gconf: fix potential memory leak in renderer_edited() - kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed() - ipmi: Use dev_warn_ratelimited() for incorrect message warnings - vfio/mlx5: fix possible overflow in tracking max message size - scsi: aacraid: Stop using PCI_IRQ_AFFINITY - scsi: target: core: Generate correct identifiers for PR OUT transport IDs - scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans - kconfig: nconf: Ensure null termination where strncpy is used - vfio/type1: conditional rescheduling while pinning - kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c - f2fs: check the generic conditions first - exfat: add cluster chain loop check for dir - i2c: Force DLL0945 touchpad i2c freq to 100khz - apparmor: use the condition in AA_BUG_FMT even with debug disabled - dm-table: fix checking for rq stackable devices - dm-mpath: don't print the "loaded" message if registering fails - i3c: master: Initialize ret in i3c_i2c_notifier_call() - i3c: don't fail if GETHDRCAP is unsupported - apparmor: shift ouid when mediating hard links in userns - rtc: ds1307: handle oscillator stop flag (OSF) for ds1341 - i3c: add missing include to internal header - module: Prevent silent truncation of module name in delete_module(2) - md: dm-zoned-target: Initialize return variable r to avoid uninitialized use - soundwire: Move handle_nested_irq outside of sdw_dev_lock - soundwire: amd: serialize amd manager resume sequence during pm_prepare - crypto: octeontx2 - add timeout for load_fvc completion poll - media: uvcvideo: Fix bandwidth issue for Alcor camera - media: usb: hdpvr: disable zero-length read messages - media: tc358743: Increase FIFO trigger level to 374 - media: tc358743: Return an appropriate colorspace from tc358743_set_fmt - media: tc358743: Check I2C succeeded during probe - pinctrl: stm32: Manage irq affinity settings - scsi: mpi3mr: Correctly handle ATA device errors - scsi: mpt3sas: Correctly handle ATA device errors - power: supply: qcom_battmgr: Add lithium-polymer entry - RDMA/core: reduce stack using in nldev_stat_get_doit() - dmaengine: stm32-dma: configure next sg only if there are more than 2 sgs - leds: leds-lp50xx: Handle reg to get correct multi_index - media: v4l2-common: Reduce warnings about missing V4L2_CID_LINK_FREQ control - MIPS: lantiq: falcon: sysctrl: fix request memory check logic - crypto: jitter - fix intermediary handling - watchdog: iTCO_wdt: Report error if timeout configuration fails - MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free} - clk: qcom: ipq5018: keep XO clock always on - hwmon: (emc2305) Set initial PWM minimum value during probe based on thermal state - watchdog: dw_wdt: Fix default timeout - fs/orangefs: use snprintf() instead of sprintf() - phy: rockchip-pcie: Properly disable TEST_WRITE strobe signal - mfd: axp20x: Set explicit ID for AXP313 regulator - clk: tegra: periph: Fix error handling and resolve unsigned compare warning - fbdev: fix potential buffer overflow in do_register_framebuffer() - cifs: Fix calling CIFSFindFirst() for root path without msearch - watchdog: sbsa: Adjust keepalive timeout to avoid MediaTek WS0 race condition - drm/amd/display: Avoid configuring PSR granularity if PSR-SU not supported - drm/amd/display: Only finalize atomic_obj if it was initialized - vhost: fail early when __vhost_add_used() fails - vsock/virtio: Resize receive buffers so that each SKB fits in a 4K page - net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325 - rcu: Fix rcu_read_unlock() deadloop due to IRQ work - drm/amd/display: Avoid trying AUX transactions on disconnected ports - selftests/bpf: Fix a user_ringbuf failure with arm64 64KB page size - bpf: Make reg_not_null() true for CONST_PTR_TO_MAP - uapi: in6: restore visibility of most IPv6 socket options - drm/ttm: Should to return the evict error - drm: renesas: rz-du: mipi_dsi: Add min check for VCLK range - net: ncsi: Fix buffer overflow in fetching version id - ionic: clean dbpage in de-init - wifi: rtlwifi: fix possible skb memory leak in _rtl_pci_init_one_rxdesc() - ptp: Use ratelimite for freerun error message - bpftool: Fix JSON writer resource leak in version command - net: dsa: b53: prevent SWITCH_CTRL access on BCM5325 - net: dsa: b53: prevent DIS_LEARNING access on BCM5325 - net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325 - net: dsa: b53: fix b53_imp_vlan_setup for BCM5325 - gve: Return error for unknown admin queue command - net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs - net: vlan: Make is_vlan_dev() a stub when VLAN is not configured - drm/amd: Allow printing VanGogh OD SCLK levels without setting dpm to manual - dpaa_eth: don't use fixed_phy_change_carrier - wifi: iwlegacy: Check rate_idx range after addition - netmem: fix skb_frag_address_safe with unreadable skbs - powerpc: floppy: Add missing checks after DMA map - wifi: ath12k: Decrement TID on RX peer frag setup error handling - wifi: ath12k: Enable REO queue lookup table feature on QCN9274 hw2.0 - wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`. - wifi: mac80211: update radar_required in channel context after channel switch - drm/amd/display: Fix 'failed to blank crtc!' - wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect - wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd() - wifi: ath12k: Add memset and update default rate value in wmi tx completion - drm/amd/display: Separate set_gsl from set_gsl_source_select - net: fec: allow disable coalescing - net: atlantic: add set_power to fw_ops for atl2 to fix wol - net: thunderbolt: Fix the parameter passing of tb_xdomain_enable_paths()/tb_xdomain_disable_paths() - net: thunderbolt: Enable end-to-end flow control also in transmit - kselftest/arm64: Specify SVE data when testing VL set in sve-ptrace - wifi: mt76: mt7915: mcu: re-init MCU before loading FW patch - wifi: rtw89: Disable deep power saving for USB/SDIO - wifi: rtw89: Fix rtw89_mac_power_switch() for USB - drm/msm: use trylock for debugfs - wifi: mac80211: fix rx link assignment for non-MLO stations - ipv6: mcast: Check inet6_dev->dead under idev->mc_lock in __ipv6_dev_mc_inc(). - (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer - wifi: mac80211: don't complete management TX on SAE commit - sched/fair: Bump sd->max_newidle_lb_cost when newidle balance fails - s390/stp: Remove udelay from stp_sync_clock() - wifi: iwlwifi: mvm: fix scan request validation - um: Re-evaluate thread flags repeatedly - wifi: iwlwifi: mvm: set gtk id also in older FWs - perf/cxlpmu: Remove unintended newline from IRQ name format string - net: phy: micrel: Add ksz9131_resume() - net: thunderx: Fix format-truncation warning in bgx_acpi_match_id() - net: ipv4: fix incorrect MTU in broadcast routes - wifi: cfg80211: Fix interface type validation - net: mctp: Prevent duplicate binds - arm64: Mark kernel as tainted on SAE and SError panic - net/mlx5e: Properly access RCU protected qdisc_sleeping variable - net: ag71xx: Add missing check after DMA map - et131x: Add missing check after DMA map - wifi: rtw89: Lower the timeout in rtw89_fw_read_c2h_reg() for USB - be2net: Use correct byte order and format string for TCP seq and ack_seq - s390/time: Use monotonic clock in get_cycles() - wifi: cfg80211: reject HTC bit for management frames - ktest.pl: Prevent recursion of default variable options - wifi: ath12k: Correct tid cleanup when tid setup fails - net: usb: cdc-ncm: check for filtering capability - xen/netfront: Fix TX response spurious interrupts - Bluetooth: hci_sock: Reset cookie to zero in hci_sock_free_cookie() - powerpc/thp: tracing: Hide hugepage events under CONFIG_PPC_BOOK3S_64 - ASoC: qcom: use drvdata instead of component to keep id - ASoC: codecs: rt5640: Retry DEVICE_ID verification - iio: adc: ad7768-1: Ensure SYNC_IN pulse minimum timing requirement - ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros - ALSA: pcm: Rewrite recalculate_boundary() to avoid costly loop - platform/chrome: cros_ec_typec: Defer probe on missing EC parent - platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches - soc: qcom: mdt_loader: Actually use the e_phoff - imx8m-blk-ctrl: set ISI panic write hurry level - pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop() - usb: core: usb_submit_urb: downgrade type check - usb: typec: intel_pmc_mux: Defer probe if SCU IPC isn't present - ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4 - ASoC: hdac_hdmi: Rate limit logging on connection and disconnection - ALSA: hda: Disable jack polling at shutdown - ALSA: hda: Handle the jack polling always via a work - mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode() - mei: bus: Check for still connected devices in mei_cl_bus_dev_release() - char: misc: Fix improper and inaccurate error code returned by misc_init() - reset: brcmstb: Enable reset drivers for ARCH_BCM2835 - pps: clients: gpio: fix interrupt handling order in remove path - ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path - mmc: sdhci-msm: Ensure SD card power isn't ON when card removed - ACPI: processor: fix acpi_object initialization - PM: sleep: console: Fix the black screen issue - thermal: sysfs: Return ENODATA instead of EAGAIN for reads - PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit() - firmware: tegra: Fix IVC dependency problems - ACPI: PRM: Reduce unnecessary printing to avoid user confusion - selftests: tracing: Use mutex_unlock for testing glob filter - tools/build: Fix s390(x) cross-compilation with clang - gpio: tps65912: check the return value of regmap_update_bits() - iio: adc: ad_sigma_delta: don't overallocate scan buffer - tools/nolibc: define time_t in terms of __kernel_old_time_t - thermal/drivers/qcom-spmi-temp-alarm: Enable stage 2 shutdown when required - ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed - EDAC/synopsys: Clear the ECC counters on init - gpio: wcd934x: check the return value of regmap_update_bits() - remoteproc: imx_rproc: skip clock enable when M-core is managed by the SCU - soc: qcom: rpmh-rsc: Add RSC version 4 support - usb: xhci: Avoid showing errors during surprise removal - usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command - usb: xhci: Avoid showing warnings for dying controller - usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default - selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t - cpufreq: CPPC: Mark driver with NEED_UPDATE_LIMITS flag - platform/x86/amd: pmc: Add Lenovo Yoga 6 13ALC6 to pmc quirk list - usb: xhci: print xhci->xhc_state when queue_command failed - tracefs: Add d_delete to remove negative dentries - securityfs: don't pin dentries twice, once is enough... - fix locking in efi_secret_unlink() - ext2: Handle fiemap on empty files to prevent EINVAL - fs/ntfs3: correctly create symlink for relative path - fs/ntfs3: Add sanity check for file name - better lockdep annotations for simple_recursive_removal() - hfs: fix not erasing deleted b-tree node issue - drbd: add missing kref_get in handle_write_conflicts - udf: Verify partition map count - gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops - nvme-pci: try function level reset on init failure - smb/server: avoid deadlock when linking with ReplaceIfExists - arm64: Handle KCOV __init vs inline mismatches - ptp: prevent possible ABBA deadlock in ptp_clock_freerun() - intel_idle: Allow loading ACPI tables for any family - net: ti: icss-iep: Fix incorrect type for return value in extts_enable() - netfilter: ctnetlink: fix refcount leak on table dump - udp: also consider secpath when evaluating ipsec use for checksumming - KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs - KVM: nVMX: Check vmcs12->guest_ia32_debugctl on nested VM-Enter - KVM: VMX: Extract checking of guest's DEBUGCTL into helper - KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported - KVM: VMX: Handle forced exit due to preemption timer in fastpath - KVM: VMX: Re-enter guest in fastpath for "spurious" preemption timer exits - KVM: x86: Plumb "force_immediate_exit" into kvm_entry() tracepoint - libceph: prevent potential out-of-bounds reads in handle_auth_done() - net: usb: pegasus: fix memory leak in update_eth_regs_async() - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() - !20540 urma: added support for ipoverurma - team: fix check for port enabled in team_queue_override_port_prio_changed() - mm/page_alloc: prevent pcp corruption with SMP=n - !20528 Fix CVE-2025-71083 - KVM: nVMX: Defer SVI update to vmcs01 on EOI when L2 is active w/o VID - KVM: x86: Plumb in the vCPU to kvm_x86_ops.hwapic_isr_update() - KVM: SVM: Set RFLAGS.IF=1 in C code, to get VMRUN out of the STI shadow - smb: client: don't wait for info->send_pending == 0 on error - smb: client: let send_done() cleanup before calling smbd_disconnect_rdma_connection() - ACPI: processor: perflib: Move problematic pr->performance check - ACPI: processor: perflib: Fix initial _PPC limit application - Documentation: ACPI: Fix parent device references - fs: Prevent file descriptor table allocations exceeding INT_MAX - sunvdc: Balance device refcount in vdc_port_mpgroup_check - PCI: Extend isolated function probing to LoongArch - NFSD: detect mismatch of file handle and delegation stateid in OPEN op - net: dpaa: fix device leak when querying time stamp info - net: ti: icss-iep: fix device and OF node leaks at probe - net: mtk_eth_soc: fix device leak at probe - net: enetc: fix device and OF node leak at probe - net: gianfar: fix device leak when querying time stamp info - net: phy: micrel: fix KSZ8081/KSZ8091 cable test - gpio: mlxbf3: use platform_get_irq_optional() - gpio: mlxbf2: use platform_get_irq_optional() - gpio: virtio: Fix config space reading. - ALSA: hda/realtek: Add Framework Laptop 13 (AMD Ryzen AI 300) to quirks - ALSA: hda/realtek: Fix headset mic on HONOR BRB-X - ALSA: usb-audio: Validate UAC3 cluster segment descriptors - rcu: Fix racy re-initialization of irq_work causing hangs - rcu: Fix rcu_read_unlock() deadloop due to IRQ work - drm/tilcdc: Fix removal actions in case of failed probe - drm/tilcdc: request and mapp iomem with devres - urma: fix update topo logic - dmaengine: stm32: dmamux: fix device leak on route allocation - pswiotlb: Adapt to the IOMMU DMA API upgraded by IOMMUFD - null_blk: fix kmemleak by releasing references to fault configfs items - inet: frags: flush pending skbs in fqdir_pre_exit() - inet: frags: add inet_frag_queue_flush() - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() - md/dm-raid: don't clear MD_RECOVERY_FROZEN after setting frozen - md/dm-raid: don't call md_reap_sync_thread() directly - ACPICA: Avoid walking the Namespace if start_node is NULL - arm64: entry: xcall/xint: make asm conditionals compatible with clang IAS - LoongArch: BPF: Sign extend kfunc call arguments - genirq/msi:: Fix kabi break of struct msi_desc - genirq/msi: Store the IOMMU IOVA directly in msi_desc instead of iommu_cookie - NFS: Fix a deadlock involving nfs_release_folio() - Revert "[Huawei] Revert "NFS: fix up nfs_release_folio() to try to release the page"" - urma: added support for ipoverurma - drm/ttm: Avoid NULL pointer deref for evicted BOs - XSched: Update XSched manual - svcrdma: bound check rq_pages index in inline path - ipv6: Fix use-after-free in inet6_addr_del(). - ipv4: ip_gre: make ipgre_header() robust - net: fix memory leak in skb_segment_list for GRO packets - net: sock: fix hardened usercopy panic in sock_recv_errqueue - ipv4: Fix reference count leak when using error routes with nexthop objects - SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf - fbdev: Fix vmalloc out-of-bounds write in fast_imageblit - udp: Deal with race between UDP socket address change and rehash - EDAC/amd64: The width of hash value is 2 bits for Hygon family 18h model 6h processors - x86/tsc: Use topology_max_packages() to get package number - EDAC/amd64: Use unicast instead of broadcast to access the cs_config register - EDAC/amd64: Correct the address translation for hygon family 18h model 4h - KVM: arm64: Mark some header functions as inline - KVM: arm64: Refactor exit handlers - x86/resctrl: Fix memory bandwidth counter width for Hygon CPUs - hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio - !20820 ub/obmm: add sysfs interface for mempool statistics & bugfixes - ub/obmm: fix wrong pxm_numa parameter validation - ub/obmm: Remove unused parameters from obmm_addr_check.c - ub/obmm: Enhance mem_allocator_granu validation - ub/obmm: simplify allocator naming scheme - ub/obmm: fix allow_slow logic and optimize conti_alloc_memory - ub/obmm: add sysfs interface with fine-grained memory statistics - !20804 net: hv_netvsc: reject RSS hash key programming without RX indirection table - !20813 migrate: correct lock ordering for hugetlb file folios - !20812 libceph: make calc_target() set t->paused, not just clear it - !20719 drivers/ub/sentry: some bugfix - !20798 urma: log should not retrieve eid_idx from uctx - !20808 urma: support triple bonding device - urma: log should not retrieve eid_idx from uctx - migrate: correct lock ordering for hugetlb file folios - libceph: make calc_target() set t->paused, not just clear it - !20745 vfio platform VFIO support for hisi05a1 devices - urma: support triple bonding device - net: hv_netvsc: reject RSS hash key programming without RX indirection table - !20789 gic: Add hip09 support for HISILICON_ERRATUM_165010801 - !20726 tracing: Add recursion protection in kernel stack trace recording - !20668 irqchip/gic-v3-its: Avoid truncating memory addresses - !20795 ub: udma: support query and set qos info. - !20791 Migration/urma:optimize performance in live migration. - ub: udma: Support for UE link establishment message. - Migration/urma: optimize performance in live migration. - !20787 ub: cdma: modify the method of assigning values to the structure - !20759 ubcore: hotfix route query for port eid on the same node. - ub: udma: support query and set qos info. - Revert "ub: ubase: Support for RC saved by queue granularity" - ubcore: hotfix route query for port eid on the same node. - !20676 urma: set/get sl - !20765 urma: bugfix of UAF and double free in ubcm - !20778 ub: ubase&unic: Fixes some bugfix in resetting and dfx ability - gic: Add hip09 support for HISILICON_ERRATUM_165010801 - vfio/platform: Add CONFIG_VFIO_HISI05A1 to openeuler_defconfig and turn it on by default - vfio/platform: VFIO support for hisi05a1 devices - ub: cdma: modify the method of assigning values to the structure - urma: set/get sl - ub: ubase: support to query ub dl pkt stats and real-time peak bandwidth - ub: ubase: Support for RC saved by queue granularity - ub: ubase: Traverse mailbox AE events using interrupts and polling. - ub: ubase: Modify ubase ctrlq trace to distinguish between MUE and UE messages - net: unic: The function of dumping himac registers is added. - ub: ubase: Fix MAC is_pfc sync, optimize list ops and code style - ub: ubase: Retain the initial tm qset configuration and restore it - net: unic: Fixed an issue in the bond IP address notification and pause configuration when an exception occurs. - ub: ubase: Add a retransmission function to improve reliability. - net: unic: Increase the readability and reliability of loopback code - net: unic: Synchronize the code modify for ip management and deactivation - net: unic: Increase the readability and reliability of VLAN feature. - net: unic: Added unic DFX log information. - ub: ubase: Add and correct comments for some functions and data structures - net: unic: Notify MAMI when the bond port status changes - ub: ubase: Support for HIMAC reset during ELR reset and Optimize ELR reset - !20768 iommu/ummu-core: Fix separate page table compatibility - !20665 [OLK-6.6] Enhance CMA memory usage reporting for CSV3 - !20764 net: hns3: fix double free issue for tx spare buffer - urma: bugfix of UAF and double free in ubcm - iommu/ummu-core: Fix separate page table compatibility - net: hns3: fix double free issue for tx spare buffer - drivers/ub/sentry: fix memory leak in sentry_msg_helper - drivers/ub/sentry: initialize some variables - drivers/ub/sentry: fix potential buffer overflow in convert_str_to_smh_msg() - drivers/ub/sentry: fix potential null pointer reference in sentry_uvb_comm - drivers/ub/sentry: add input parameter verification for exported symbols - tracing: Add recursion protection in kernel stack trace recording - x86/csv: Enhance CMA memory usage reporting for CSV3 - irqchip/gic-v3-its: Avoid truncating memory addresses - change the package name of 64KB page size kernel to kernel-64k - !20704 kernel support hisi-cca-da - !20180 [virtCCA Live Migration 2]virtcca secure cvm supports live migration - !20905 v2 KVM: arm64: Fix softirq masking in FPSIMD register saving sequence - !20965 iommu/ummu: Optimized TID invalidation and tdev initialization - !20964 iommu/ummu: Support TID and EID Granularity for MPAM - !20970 ub: ubase&unic: Supporting the black box capability of the ubase&unic driver - hisi-cca-da: Start dev by rsi call - hisi-cca-da: Set ripas of the bar region as RIPAS_DEV - hisi-cca-da: Support swiotlb and realm memory use - hisi-cca-da: Add smmu info when dev attach - hisi-cca-da: Transfer realm msix access to rmm - hisi-cca-da: Support pcipc sriov capability - hisi-cca-da: Delay realm memory release to kvm_destroy_realm - hisi-cca-da: Create realm s2 host pgtable and map msi mmio to rmm - hisi-cca-da: Add cca realm s2 pgtable framework - hisi-cca-da: Use bitmap to determine whether the command can be forwarded - hisi-cca-da: Restrict Realm SMMU to stage-2 domain only - hisi-cca-da: Add cmd forward mechanism in realm smmu - hisi-cca-da: Add realm smmu event and gerror irq initialization - hisi-cca-da: Add realm smmu stream table initialization - hisi-cca-da: Add realm smmu cmdq and evtq initialization - hisi-cca-da: Add realm smmu initialization - hisi-cca-da: Add relam iommu support to iommufd - hisi-cca-da: Add realm iommu support for vfio-iommu-type1 - hisi-cca-da: Support dev map and unmap - hisi-cca-da: Support dev validate and dev start - hisi-cca-da: VFIO support ccada - hisi-cca-da: Support dev delegate and dev attach - hisi-cca-da: Support root dev delegate and dev init - hisi-cca-da: Add hisilicon extension smc and ccada cmd - hisi-cca-da: Add hisi ccada feature config - !20751 ARM CCA supports hugepage - !20944 ub: ubmempfd: supports for D2H mapping and demapping - !20888 HiSock Enhancement - ub: ubase&unic: Supporting the black box capability of the ubase&unic driver. - net: unic: Resolve the residual MAC address problem - net: unic: Optimized the code for the cmd structure and FEC function. - ub: ubase: add log for post mailbox timeout - ub: ubus: Remove black box header file to include dir - rme: Remove the secret bit of the vring desc addr - rme: improve hisi-cca data mmap and destroy method - !20943 uvb: fix wd_obtain logic err - !20942 urma: fix bond device id not release - !20892 dcache: Limit the minimal number of bucket to two - rme: isolate page when do delegation to avoid migration - rme: hisi-cca supports different levels for mapping ram - rme: rename ccal to hisi-cca - rme: support set ripas for ccal realm vm - rme: support destroy ram data for ccal realm vm - rme: support populate region for ccal realm vm - rme: support map ram for ccal realm vm - rme: support config ccal realm vm - rme: support ccal RMI calls - rme: realm vm supports wfx handler - !20952 urma: introduce ipourma module - iommu/ummu-core: Simplifies tdev initialization resources - iommu/ummu: Optimized log printing - iommu/ummu: Use passed gfp_mask in map_pages callback - uvb: fix wd_obtain logic err - !20949 ub: udma: support user ctl function. - urma: fix bond device id not release - !20901 drivers/ub/sentry: some bugfix - ub: ubmempfd: supports for D2H mapping and demapping - ub: ubmempfd: supports providing services to the QEMU process through file nodes - [virtCCA Live Migration 2]virtcca secure cvm supports live migration - urma: query priority and enable bit, support ring size configuration - urma: implement debugfs, improve boundary checks and error handling logic - urma: implement data plane interaction and statistics - urma: implement ipourma network device operations - urma: ipourma resource management - urma: ipourma resource management and err code - urma: introduce ipourma main module - iommu/ummu: Optimized the TID invalidation configuration - iommu/ummu: Optimized SVA permission table memory allocation approach - iommu/ummu: Adapt UMMU SVA interface adjustment - iommu/ummu: Support TID and EID Granularity for MPAM - !20848 [OLK-6.6] backport important bugfix for nvme driver from upstream linux-6.6.y - !20847 urma: sl resource query error - !20908 [OLK-6.6][linux-6.6.y sync] Backport 6.6.108-6.6.110 LTS Patches - !20084 Loongarch: Enable CONFIG_CRYPTO_XTS for disk encryption - !20929 PCI: Fix NVMe link speed downgrade to 2.5GT/s during hotplug - drivers/ub/sentry: fix check input parameters - ub: udma: support user ctl function. - ub: udma: support uboe function. - ub: udma: bugfix related to query aux info. - !20935 ub: ubmem_vmmu: supports IOMMU driver for the UB memory MMU in VMs - drivers/ub/sentry: do not use magic numbers - !20876 urma: Kernel-mode specific implementations file for Jetty extension interface - urma: sl resource query error - !20873 sunrpc: fix NULL pointer dereference in rpcb_register_inet6 and rpcb_register_inet4 - !20875 sunrpc: fix race in cache cleanup causing stale nextcheck time - ub: ubmem_vmmu: supports IOMMU driver for the UB memory MMU in VMs - ub: ubmem_vmmu: supports parsing and configuring the hardware node information - ub: ubmem_vmmu: HiSilicon ubmem_vmmu Architecture Implementation - !20806 Fix CVE-2025-71225 - !20896 scsi: qla2xxx: Free sp in error path to fix system crash - !20894 scsi: qla2xxx: Delay module unload while fabric scan in progress - !20893 scsi: qla2xxx: Validate sp before freeing associated memory - !20802 Fix CVE-2026-23110 - urma: Kernel-mode specific implementations file for Jetty extension interface - drivers/ub/sentry: fix memory leak in process_urma_data() - drivers/ub/sentry: initialize some variables - PCI: Fix NVMe link speed downgrade to 2.5GT/s during hotplug - !20770 ub: ubdevshm: supports the memory user to obtain and release shared memory - Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 - mm: consider non-anon swap cache folios in folio_expected_ref_count() - mm: simplify folio_expected_ref_count() - ASoC: qcom: audioreach: fix potential null pointer dereference - gcc-plugins: Remove TODO_verify_il for GCC >= 16 - crypto: sha256 - fix crash at kexec - drm/i915/backlight: Return immediately when scale() finds invalid parameters - minmax.h: remove some #defines that are only expanded once - minmax.h: simplify the variants of clamp() - minmax.h: move all the clamp() definitions after the min/max() ones - minmax.h: use BUILD_BUG_ON_MSG() for the lo < hi test in clamp() - minmax.h: reduce the #define expansion of min(), max() and clamp() - minmax.h: update some comments - minmax.h: add whitespace around operators and after commas - minmax: fix up min3() and max3() too - minmax: improve macro expansion and type checking - minmax: don't use max() in situations that want a C constant expression - minmax: simplify min()/max()/clamp() implementation - minmax: make generic MIN() and MAX() macros available everywhere - drm/ast: Use msleep instead of mdelay for edid read - gpiolib: Extend software-node support to support secondary software-nodes - ARM: bcm: Select ARM_GIC_V3 for ARCH_BRCMSTB - s390/cpum_cf: Fix uninitialized warning after backport of ce971233242b - kmsan: fix out-of-bounds access to shadow memory - afs: Fix potential null pointer dereference in afs_put_server - ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address - i40e: improve VF MAC filters accounting - i40e: add mask to apply valid bits for itr_idx - HID: asus: add support for missing PX series fn keys - drm/gma500: Fix null dereference in hdmi teardown - octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() - net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port - net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() - net: dsa: lantiq_gswip: do also enable or disable cpu port - selftests: fib_nexthops: Fix creation of non-FDB nexthops - net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS - bnxt_en: correct offset handling for IPv6 destination address - vhost: Take a reference on the task in struct vhost_task. - Bluetooth: hci_sync: Fix hci_resume_advertising_sync - ethernet: rvu-af: Remove slash from the driver name - can: peak_usb: fix shift-out-of-bounds issue - can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow - can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow - can: hi311x: populate ndo_change_mtu() to prevent buffer overflow - can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow - bpf: Reject bpf_timer for PREEMPT_RT - can: rcar_can: rcar_can_resume(): fix s2ram with PSCI - wifi: virt_wifi: Fix page fault on connect - cpufreq: Initialize cpufreq-based invariance before subsys - ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients - arm64: dts: imx8mp: Correct thermal sensor index - mm: folio_may_be_lru_cached() unless folio_test_large() - mm/gup: local lru_add_drain() to avoid lru_add_drain_all() - mm/gup: check ref_count instead of lru before migration - mm: add folio_expected_ref_count() for reference count calculation - mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked" - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions - ALSA: usb-audio: Add mute TLV for playback volumes on more devices - ALSA: usb-audio: move mixer_quirks' min_mute into common quirk - ALSA: usb-audio: Add DSD support for Comtrue USB Audio device - i2c: designware: Add quirk for Intel Xe - mmc: sdhci-cadence: add Mobileye eyeQ support - usb: core: Add 0x prefix to quirks debug output - ALSA: usb-audio: Fix build with CONFIG_INPUT=n - ALSA: usb-audio: Convert comma to semicolon - ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 - ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks - ALSA: usb-audio: Simplify NULL comparison in mixer_quirks - ALSA: usb-audio: Avoid multiple assignments in mixer_quirks - ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks - ALSA: usb-audio: Fix block comments in mixer_quirks - firewire: core: fix overlooked update of subsystem ABI version - scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE - !20843 [OLK-6.6][linux-6.6.y sync] Backport 6.6.107-6.6.108 LTS Patches - !20869 ub:hisi-ubus: fix bug of security smatch - !20861 CVE-2026-23163 - ub: ubdevshm: supports the memory user to obtain and release shared memory - ub: ubdevshm: supports granting and revoking shared memory permissions - ub: ubdevshm: supports the registration and deregistration of shared memory segments - ub: ubdevshm: supports the registration and deregistration - KVM: arm64: Fix softirq masking in FPSIMD register saving sequence - !20886 Fix CVE-2026-23205 - !20803 Fix CVE-2026-23112 - !20868 sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure - !20811 smb/server: fix refcount leak in smb2_open() - !20810 smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() - !20809 smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() - sunrpc: fix NULL pointer dereference in rpcb_register_inet6 and rpcb_register_inet4 - sunrpc: fix race in cache cleanup causing stale nextcheck time - scsi: qla2xxx: Free sp in error path to fix system crash - scsi: qla2xxx: Delay module unload while fabric scan in progress - scsi: qla2xxx: Validate sp before freeing associated memory - dcache: Limit the minimal number of bucket to two - !20872 Fix CVE-2026-23220 - !20846 Fix CVE-2026-23193 - !20815 Fix CVE-2026-23216 - !20859 Fix CVE-2026-23179 - !20871 CVE-2026-23096 - !20858 ub: ubase: resolve the cmdq crq overflow problem - bpf: Deprecate hisock unused kfuncs and orig ingress logic - bpf: Add local connect support for hisock - bpf: Add ipv4-mapped ipv6 addr support for hisock - bpf: Add target comm parse to hisock_cmd - bpf: Add multi port parse to hisock_cmd - bpf: Only deploy hisock in server - bpf: Apply BPF_HISOCK_INGRESS to hisock ingress - bpf: Add bpf_handle_ingress/egress_ptype kfunc - bpf: Add bpf_get_skb_ethhdr kfunc - bpf: Add bpf_set_ingress/egress_dev kfunc - bpf: Add bpf_set_ingress_dst kfunc - bpf: Add BPF_HISOCK_INGRESS attach type - cgroup: make cgroup_bpf_prog_attach work when cgroup2 is not mounted - smb: client: fix potential UAF and double free in smb2_open_file() - smb/client: fix memory leak in smb2_open_file() - !20852 ASoC: amd: fix memory leak in acp3x pdm dma ops - ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths - uacce: fix cdev handling in the cleanup path - Revert "uacce: fix for cdev memory leak" - ub:hisi-ubus: fix bug of security smatch - ub:ubus: injected route event - ub:ubus: Black Box Development - !20865 urma: urma support uboe - sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure - urma: urma support uboe - !20857 ub_fwctl driver adds support for querying some functions - ub:ub_fwctl:Add illegal verification for scc - ub:ub_fwctl:Support querying the historical status of port links - drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove - drm/amdkfd: Don't use sw fault filter if retry cam enabled - ub:ub_fwctl:Support querying firmware version numbers - ub: ub_fwctl: Support querying real-time bandwidth statistics - ub:ub_fwctl:Support querying statistical indicators at the ub port and uboe port levels - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() - !20854 [URMA] add ping server for urma_ping - urma: add ping server - ub: ubase: resolve the cmdq crq overflow problem - ub: ubase: Optimized the QoS code naming to improve code readability. - ub: ubase&unic: optimizing code and configuration settings. - net: unic: not support query and configure ip by control plane in UBoE - net: unic: fix the automatically enable uc guid promisc mode. - !20844 urma:kernel header of userctl - urma: Kernel-mode header file for Jetty extension interface - ASoC: amd: fix memory leak in acp3x pdm dma ops - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() - phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again) - ACPICA: Work around bogus -Wstringop-overread warning since GCC 11 - !20835 Fix CVE-2026-23084 - minmax: add a few more MIN_T/MAX_T users - minmax: simplify and clarify min_t()/max_t() implementation - minmax: avoid overly complicated constant expressions in VM code - rtc: pcf2127: fix SPI command byte for PCF2131 backport - xhci: dbc: Fix full DbC transfer ring after several reconnects - xhci: dbc: decouple endpoint allocation from initialization - phy: ti: omap-usb2: fix device leak at unbind - phy: Use device_get_match_data() - drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path - ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message - ASoC: wm8974: Correct PLL rate rounding - ASoC: wm8940: Correct typo in control name - ASoC: wm8940: Correct PLL rate rounding - io_uring: include dying ring in task_work "should cancel" state - io_uring: backport io_should_terminate_tw() - ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx - selftests: mptcp: avoid spurious errors on TCP disconnect - selftests: mptcp: connect: catch IO errors on listen side - rds: ib: Increment i_fastreg_wrs before bailing out - KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active - mmc: mvsdio: Fix dma_unmap_sg() nents value - ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S - ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface - btrfs: tree-checker: fix the incorrect inode ref size check - iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page() - LoongArch: Check the return value when creating kobj - LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled - LoongArch: Update help info of ARCH_STRICT_ALIGN - nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* - octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() - net: liquidio: fix overflow in octeon_init_instr_queue() - bonding: don't set oif to bond dev when getting NS target destination - net/mlx5e: Consider aggregated port speed during rate configuration - i40e: remove redundant memory barrier when cleaning Tx descs - net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure - selftests: mptcp: sockopt: fix error messages - mptcp: tfo: record 'deny join id0' info - mptcp: set remote_deny_join_id0 on SYN recv - dpaa2-switch: fix buffer pool seeding for control traffic - btrfs: fix invalid extref key setup when replaying dentry - pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch - wifi: mac80211: fix incorrect type for ret - wifi: mac80211: increase scan_ies_len for S1G - ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported - !20769 [OLK-6.6][linux-6.6.y sync] Backport 6.6.106-6.6.107 LTS Patches - be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list - !20776 ub:ubfi: Release the chosen node - !20817 CVE-2026-23094 - !20819 dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() - ub:ubus: Add port num check - !20379 [OLK-6.6][sync from OLK-5.10]io_uring: Support forcing sq thread to be idle and woken up by hrtimer - !20830 sched/soft_domain: Increasing NR_MAX_CLUSTER to 32 - sched/soft_domain: Increasing NR_MAX_CLUSTER to 32 - btrfs: fix incorrect readahead expansion length - x86: disable image size check for test builds - drm/i915/power: fix size for for_each_set_bit() in abox iteration - drm/amdgpu: fix a memory leak in fence cleanup when unloading - net: mdiobus: release reset_gpio in mdiobus_unregister_device() - phy: ti-pipe3: fix device leak at unbind - phy: tegra: xusb: fix device and OF node leak at probe - dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate - usb: gadget: midi2: Fix MIDI2 IN EP max packet size - usb: gadget: midi2: Fix missing UMP group attributes initialization - USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels - RISC-V: Remove unnecessary include from compat.h - hrtimer: Rename __hrtimer_hres_active() to hrtimer_hres_active() - hrtimer: Remove unused function - regulator: sy7636a: fix lifecycle of power good gpio - dmaengine: ti: edma: Fix memory allocation size for queue_priority_map - hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr - hsr: use rtnl lock when iterating over ports - net: hsr: Add VLAN CTAG filter support - net: hsr: Add support for MC filtering at the slave device - can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB - can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails - can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed - igb: fix link test skipping when interface is admin down - docs: networking: can: change bcm_msg_head frames member to support flexible array - tunnels: reset the GSO metadata before reusing the skb - net: bridge: Bounce invalid boolopts - net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() - USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions - USB: serial: option: add Telit Cinterion FN990A w/audio compositions - dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks - serial: sc16is7xx: fix bug in flow control levels init - tty: hvc_console: Call hvc_kick in hvc_write unconditionally - Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups" - Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table - Input: iqs7222 - avoid enabling unused interrupts - mm/khugepaged: fix the address passed to notifier on testing young - btrfs: fix corruption reading compressed range when block size is smaller than page size - btrfs: use readahead_expand() on compressed extents - mm/damon/sysfs: fix use-after-free in state_show() - mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing - mtd: nand: raw: atmel: Fix comment in timings preparation - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages - drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time - mm/damon/core: set quota->charged_from to jiffies at first charge window - fuse: prevent overflow in copy_file_range return value - fuse: check if copy_file_range() returns larger than requested size - mtd: rawnand: stm32_fmc2: fix ECC overwrite - mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer - net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups - i2c: i801: Hide Intel Birch Stream SoC TCO WDT - ocfs2: fix recursive semaphore deadlock in fiemap call - mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN - compiler-clang.h: define __SANITIZE_*__ macros only when undefined - EDAC/altera: Delete an inappropriate dma_free_coherent() call - rcu-tasks: Maintain real-time response in rcu_tasks_postscan() - rcu-tasks: Eliminate deadlocks involving do_exit() and RCU tasks - rcu-tasks: Maintain lists to eliminate RCU-tasks/do_exit() deadlocks - s390/cpum_cf: Deny all sampling events by counter PMU - NFSv4/flexfiles: Fix layout merge mirror check. - NFSv4.2: Serialise O_DIRECT i/o and copy range - NFSv4.2: Serialise O_DIRECT i/o and clone range - NFSv4.2: Serialise O_DIRECT i/o and fallocate() - NFS: Serialise O_DIRECT i/o and truncate() - fs/nfs/io: make nfs_start_io_*() killable - ftrace/samples: Fix function size computation - NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server - NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set - media: i2c: imx214: Fix link frequency validation - NFSD: nfsd_unlink() clobbers non-zero status returned from fh_fill_pre_attrs() - nfsd: Fix a regression in nfsd_setattr() - kasan: fix GCC mem-intrinsic prefix with sw tags - kunit: kasan_test: disable fortify string checker on kasan_strings() test - io_uring: fix kabi broken in struct io_ring_ctx - io_uring: Support forcing sq thread to be idle and woken up by hrtimer - dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() - uacce: fix isolate sysfs check condition - Revert "uacce: fix isolate sysfs check condition" - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() - smb/server: fix refcount leak in smb2_open() - smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() - smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() - md: suspend array while updating raid_disks via sysfs - scsi: core: Wake up the error handler when final completions race against each other - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec - ub:ubfi: Release the chosen node - ub:ubus: Delete unused functions - Loongarch: Enable CONFIG_CRYPTO_XTS for disk encryption - Add sw64 support in kernel.spec - !21194 hisi-cca-da: Revert smmu realm enabled condition for arm_smmu_domain_finalise. - !21192 urma: bugfix of ubagg&ubcore&uburma - !21183 platform/x86: classmate-laptop: Add missing NULL pointer checks - urma: bugfix of ubagg&ubcore&uburma - hisi-cca-da: Revert smmu realm enabled condition for arm_smmu_domain_finalise. - platform/x86: classmate-laptop: Add missing NULL pointer checks - !21167 urma: fix kernel codecheck issues. - !21174 urma: change return value for provider err - !21127 urma: copy linked ports when importing bond jetty/seg - !20247 ubcore: query primary eid in ipourma loopback mode. - !21077 Fix hisi cca bugs - ubcore: route query refine and ipo loopback adapt. - hisi-cca-da: Transfer PCIe ECAM access requests to RMM for realm device. - hisi-cca-da: Write NS STE for PF drivers. - hisi-cca-da: Provide IO interfaces - hisi-cca-da: Destroy mmu stage2 pagetable after closing vfio devices - !21045 scsi: hisi_sas: Fix NULL pointer exception when do user_scan() - hisi-cca-da: Automatically unbind PF/VF drivers and prevent probe. - !21165 tools/interference: add ifstool utility for kernel interference statistics - !21166 urma: fix jfce uaf in batch cleanup - !21043 urma: fix tjetty ref in ping server - urma: change return value for provider err - !21128 sched/rt: Skip currently executing CPU in rto_next_cpu() - !21129 procfs: fix missing RCU protection when reading real_parent in do_task_stat() - urma: fix jfce uaf in batch cleanup - !21074 ipmi: Add HiSilicon IPMI Page Soft Offline driver - !21076 [OLK-6.6][linux-6.6.y sync] Backport 6.6.112-6.6.113 LTS Patches - urma: fix kernel codecheck issues. - tools/interference: add ifstool utility for kernel interference statistics - !20291 [Hygon][6.6][Bugfix] Bug fix for EDAC decode address fail issue on Hygon Dhyana processor - !21092 kexec: derive purgatory entry from symbol - !21154 sched: Add SOFT_DOMAIN feature interface for cgroup2 - !21153 fix CVE-2025-39981 - Revert "hisi-cca-da: Delay realm memory release to kvm_destroy_realm" - urma: fix tjetty ref in ping server - rme: Enforce isolation to solve compile error without config CONFIG_HISI_CCA - hisi-cca-da: Improve hisi cca dev validate and delegate - hisi-cca-da: Fix smmu enable rme problem - hisi-cca-da: Fix msi region shared problem - sched: Add SOFT_DOMAIN feature interface for cgroup2 - Bluetooth: MGMT: Fix memory leak in set_ssp_complete - Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete - overflow: Introduce __DEFINE_FLEX for having no initializer - overflow: Fix direct struct member initialization in _DEFINE_FLEX() - overflow: Change DEFINE_FLEX to take __counted_by member - overflow: add DEFINE_FLEX() for on-stack allocs - Bluetooth: MGMT: Fix possible UAFs - Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete() - !21103 Revert "mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()" - !21104 v2 vsock/virtio: cap TX credit to local buffer size - !21070 Fixes CVE-2026-23100 - !21135 RDMA/hns: Support configure and query the CNP DSCP through sysfs - !21088 ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref - RDMA/hns: Support configure and query the CNP DSCP through sysfs - RDMA/hns: Support query FW cap bit - RDMA/hns: Support query HW ID. - !20934 smb/server: fix refcount leak in parse_durable_handle_context() - !21004 regmap: Fix race condition in hwspinlock irqsave routine - !19568 [OLK-6.6]fix txgbe clang compile warning - urma: copy linked ports when importing bond jetty/seg - procfs: fix missing RCU protection when reading real_parent in do_task_stat() - sched/rt: Skip currently executing CPU in rto_next_cpu() - !21073 scsi: qla2xxx: Fix bsg_done() causing double free - !21114 CVE-2024-57979 - !21113 iommu: disable SVA when CONFIG_X86 is set - !20957 dmaengine: xilinx: xdma: Fix regmap max_register - !21087 net: unic: Multiple stability fixes for tx timeout, DFX capability and concurrent activation/reset - pps: Fix a use-after-free - fix kabi - pps: Fix a use-after-free - !21078 of: unittest: Fix memory leak in unittest_data_add() - !21079 *** fix CVE-2026-23208 *** - !21082 ALSA: aloop: Fix racy access at PCM trigger - !21083 bus: fsl-mc: fix use-after-free in driver_override_show() - iommu: disable SVA when CONFIG_X86 is set - vsock/virtio: cap TX credit to local buffer size - Revert "mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()" - !20983 Fix CVE-2026-23139 - !20878 Fix CVE-2026-23230 - kexec: derive purgatory entry from symbol - lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC - PCI/IOV: Fix race between SR-IOV enable/disable and hotplug - Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" - rtc: interface: Alarm race handling should not discard preceding error - perf test stat tests: Fix for virtualized machines - perf test stat: Update test expectations and events - perf test stat: Avoid hybrid assumption when virtualized - writeback: Avoid excessively long inode switching times - writeback: Avoid softlockup when switching many inodes - cramfs: Verify inode mode when loading from disk - fs: Add 'initramfs_options' to set initramfs mount options - minixfs: Verify inode mode when loading from disk - irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume - irqchip/sifive-plic: Make use of __assign_bit() - selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled - s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG - s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL - s390/bpf: Describe the frame using a struct instead of constants - s390/bpf: Centralize frame offset calculations - s390/bpf: Change seen_reg to a mask - ACPI: property: Do not pass NULL handles to acpi_attach_data() - ACPI: property: Add code comments explaining what is going on - ACPI: property: Disregard references in data-only subnode lists - ACPI: battery: Add synchronization between interface updates - ACPI: battery: Check for error code from devm_mutex_init() call - ACPI: battery: initialize mutexes through devm_ APIs - ACPI: battery: allocate driver data through devm_ APIs - arm64: mte: Do not flag the zero page as PG_mte_tagged - ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref - !20790 dm: use bio_clone_blkg_association - ipmi: Add HiSilicon IPMI Page Soft Offline driver - net: unic: Resolve network unavailability caused by concurrent activation and reset - net: unic: Provide the DFX capability for querying MNG table - net: unic: Delete the elr reset process after the tx timeout - bus: fsl-mc: fix use-after-free in driver_override_show() - ALSA: aloop: Fix racy access at PCM trigger - ALSA: usb-audio: Use the right limit for PCM OOB check - ALSA: usb-audio: Prevent excessive number of frames - of: unittest: Fix memory leak in unittest_data_add() - !21034 CVE-2026-23140 - !21016 net: fix segmentation of forwarding fraglist GRO - !21017 mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() - !21018 CVE-2026-23209 - !21019 ipv6: annotate data-race in ndisc_router_discovery() - !20881 ipvlan: Make the addrs_lock be per port - rme: Imporve range delegate - btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() - PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release - PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() - misc: fastrpc: Save actual DMA size in fastrpc_map structure - misc: fastrpc: Add missing dev_err newlines - mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag - mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type - mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value - media: mc: Clear minor number before put device - lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older - ACPICA: Allow to skip Global Lock initialization - ext4: validate ea_ino and size in check_xattrs - ext4: correctly handle queries for metadata mappings - ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() - nfsd: nfserr_jukebox in nlm_fopen should lead to a retry - NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() - mm/damon/vaddr: do not repeat pte_offset_map_lock() until success - mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 - mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations - wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 - wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again - selftests: mptcp: join: validate C-flag + def limit - spi: cadence-quadspi: Flush posted register writes before DAC access - spi: cadence-quadspi: Flush posted register writes before INDAC access - PCI: tegra194: Handle errors in BPMP response - PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() - PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock - PCI: rcar-host: Drop PMSR spinlock - PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit - PCI/AER: Support errors introduced by PCIe r6.0 - PCI/AER: Fix missing uevent on recovery when a reset is requested - PCI/ERR: Fix uevent on failure to recover - PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV - PCI/sysfs: Ensure devices are powered for config reads - PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock - rseq/selftests: Use weak symbol reference, not definition, to link with glibc - rtc: interface: Fix long-standing race when setting alarm - rtc: interface: Ensure alarm irq is enabled when UIE is enabled - memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe - mmc: core: SPI mode remove cmd7 - mtd: rawnand: fsmc: Default to autodetect buswidth - xtensa: simdisk: add input size check in proc_write_simdisk - sparc: fix error handling in scan_one_device() - sparc64: fix hugetlb for sun4u - scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() - sched/deadline: Fix race in push_dl_task() - pwm: berlin: Fix wrong register in suspend/resume - powerpc/pseries/msi: Fix potential underflow and leak issue - powerpc/powernv/pci: Fix underflow and leak issue - power: supply: max77976_charger: fix constant current reporting - pinctrl: samsung: Drop unused S3C24xx driver data - nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk - parisc: don't reference obsolete termio struct for TC* constants - openat2: don't trigger automounts with RESOLVE_NO_XDEV - of: unittest: Fix device reference count leak in of_unittest_pci_node_verify - lib/genalloc: fix device leak in of_gen_pool_get() - KEYS: trusted_tpm1: Compare HMAC values in constant time - iommu/vt-d: PRS isn't usable if PDS isn't supported - iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume - init: handle bootloader identifier in kernel parameters - iio: xilinx-ams: Unmask interrupts after updating alarms - iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK - iio: frequency: adf4350: Fix prescaler usage. - iio: dac: ad5421: use int type to store negative error codes - iio: dac: ad5360: use int type to store negative error codes - fs/ntfs3: Fix a resource leak bug in wnd_extend() - fbdev: Fix logic error in "offb" name match - crypto: rockchip - Fix dma_unmap_sg() nents value - crypto: atmel - Fix dma_unmap_sg() direction - crypto: aspeed - Fix dma_unmap_sg() direction - copy_sighand: Handle architectures where sizeof(unsigned long) < sizeof(u64) - bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() - bus: mhi: ep: Fix chained transfer handling in read path - btrfs: avoid potential out-of-bounds in btrfs_encode_fh() - blk-crypto: fix missing blktrace bio split events - drm/nouveau: fix bad ret code in nouveau_bo_move_prep - drm/rcar-du: dsi: Fix 1/2/3 lane support - media: lirc: Fix error handling in lirc_register() - media: venus: firmware: Use correct reset sequence for IRIS2 - media: pci: ivtv: Add missing check after DMA map - media: mc: Fix MUST_CONNECT handling for pads with no links - media: i2c: mt9v111: fix incorrect type for ret - media: cx18: Add missing check after DMA map - firmware: meson_sm: fix device leak at probe - xen/events: Update virq_to_irq on migration - xen/events: Return -EEXIST for bound VIRQs - xen/manage: Fix suspend error path - xen/events: Cleanup find_virq() return codes - dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required - ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init - arm64: dts: ti: k3-am62a-main: Fix main padcfg length - arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees - arm64: dts: qcom: msm8939: Add missing MDSS reset - arm64: dts: qcom: msm8916: Add missing MDSS reset - ACPI: debug: fix signedness issues in read/write helpers - ACPI: property: Fix buffer properties extraction for subnodes - gpio: wcd934x: mark the GPIO controller as sleeping - tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single - smb: client: fix missing timestamp updates after utime(2) - bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() - drm/amd/display: Properly disable scaling on DCE6 - drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 - drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs - drm/amdgpu: Add additional DCE6 SCL registers - mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes - mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call - tcp: take care of zero tp->window_clamp in tcp_set_rcvlowat() - perf python: split Clang options when invoking Popen - tools build: Align warning options with perf - net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe - drm/vmwgfx: Fix copy-paste typo in validation - net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() - LoongArch: Init acpi_gbl_use_global_lock to false - LoongArch: Remove CONFIG_ACPI_TABLE_UPGRADE in platform_init() - ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size - scsi: mvsas: Fix use-after-free bugs in mvs_work_queue - clk: tegra: do not overallocate memory for bpmp clocks - clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver - clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() - clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() - clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m - perf evsel: Ensure the fallback message is always written to - perf tools: Add fallback for exclude_guest - perf test: Add a test for default perf stat command - perf test: Don't leak workload gopipe in PERF_RECORD_* - perf session: Fix handling when buffer exceeds 2 GiB - perf arm_spe: Correct memory level for remote access - perf arm_spe: Correct setting remote access - rtc: optee: fix memory leak on driver removal - rtc: x1205: Fix Xicor X1205 vendor prefix - perf util: Fix compression checks returning -1 as bool - clk: at91: peripheral: fix return value - libperf event: Ensure tracing data is multiple of 8 sized - perf evsel: Avoid container_of on a NULL leader - asm-generic/io.h: Skip trace helpers if rwmmio events are disabled - iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE - clocksource/drivers/clps711x: Fix resource leaks in error paths - fscontext: do not consume log entries when returning -EMSGSIZE - fs: always return zero on success from replace_fd() - !21067 [OLK-6.6][linux-6.6.y sync] Backport 6.6.111-6.6.112 LTS Patches - scsi: qla2xxx: Fix bsg_done() causing double free - !21065 Fix CVE-2026-23069 - !21062 v4 Support multi-level cgroup - !20987 Fix CVE-2026-23212 - !20982 Fix CVE-2026-23119 - !20979 Fix CVE-2026-23111 - !20974 Fix CVE-2026-23099 - !20973 Fix CVE-2026-23105 - !20972 Fix CVE-2026-23074 - !20884 ksmbd: add chann_lock to protect ksmbd_chann_list xarray - !20947 Fix CVE-2026-23101 - ext4: clear i_state_flags when alloc inode - misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup - Revert "wifi: ath10k: avoid unnecessary wait for service ready message" - fs/ntfs3: fix mount failure for sparse runs in run_unpack() - !20825 efivarfs: fix error propagation in efivar_entry_get() - !20824 io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop - !20950 ub:ubus: protect iterator ue_list and mue_list with ub_bus_sem - mm/rmap: fix two comments related to huge_pmd_unshare() - mm/hugetlb: fix two comments related to huge_pmd_unshare() - mm/hugetlb: fix hugetlb_pmd_shared() - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count - !20728 drivers: Update vendor name of Chengdu NorthLink Technology N5/N6 Series Network Card Drivers - vsock/virtio: fix potential underflow in virtio_transport_get_credit() - !21001 Fix CVE-2026-23229 - usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call - arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode - !20999 Fix CVE-2026-23173 - usb: typec: tipd: Clear interrupts first - bus: fsl-mc: Check return value of platform_get_resource() - remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() - Input: atmel_mxt_ts - allow reset GPIO to sleep - misc: fastrpc: Skip reference for DMA handles - misc: fastrpc: fix possible map leak in fastrpc_put_args - misc: fastrpc: Fix fastrpc_map_lookup operation - nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() - ext4: fix checks for orphan inodes - ksmbd: fix error code overwriting in smb2_get_info_filesystem() - LoongArch: Automatically disable kaslr if boot from kexec_file - mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() - mfd: rz-mtu3: Fix MTU5 NFCR register offset - ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down - ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() - vhost: vringh: Modify the return value check - net/mlx5: fw reset, add reset timeout work - net/mlx5: pagealloc: Fix reclaim race during command interface teardown - net/mlx5: Stop polling for command response if interface goes down - net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable - nfp: fix RSS hash key size when RSS is not supported - mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands - drivers/base/node: fix double free in register_one_node() - hwrng: ks-sa - fix division by zero in ks_sa_rng_init - KEYS: X.509: Fix Basic Constraints CA flag parsing - Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements - Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO - vhost: vringh: Fix copy_to_iter return value check - RDMA/siw: Always report immediate post SQ errors - usb: vhci-hcd: Prevent suspending virtually attached devices - NFSv4.1: fix backchannel max_resp_sz verification check - coresight: trbe: Return NULL pointer for allocation failures - coresight: etm4x: Support atclk - coresight-etm4x: Conditionally access register TRCEXTINSELR - remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice - PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() - vfio/pds: replace bitmap_free with vfree - sparc: fix accurate exception reporting in copy_{from,to}_user for M7 - sparc: fix accurate exception reporting in copy_to_user for Niagara 4 - sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara - sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III - wifi: mac80211: fix Rx packet handling when pubsta information is not available - wifi: ath10k: avoid unnecessary wait for service ready message - Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram - IB/sa: Fix sa_local_svc_timeout_ms read race - RDMA/core: Resolve MAC of next-hop device without ARP support - f2fs: fix zero-sized extent for precache extents - scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() - scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() - scsi: qla2xxx: edif: Fix incorrect sign of error code - ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message - f2fs: fix to truncate first page in error path of f2fs_truncate() - f2fs: fix to update map->m_next_extent correctly in f2fs_map_blocks() - wifi: mt76: fix potential memory leak in mt76_wmac_probe() - RDMA/cm: Rate limit destroy CM ID timeout error message - drivers/base/node: handle error properly in register_one_node() - watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog - ipvs: Use READ_ONCE/WRITE_ONCE for ipvs->enable - iio: consumers: Fix offset handling in iio_convert_raw_to_processed() - iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() - fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist - fs: ntfs3: Fix integer overflow in run_unpack() - drm/msm/dpu: fix incorrect type for ret - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping - ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping - misc: genwqe: Fix incorrect cmd field being reported in error - usb: gadget: configfs: Correctly set use_os_string at bind - usb: phy: twl6030: Fix incorrect type for ret - drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() - tcp: fix __tcp_close() to only send RST when required - PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation - wifi: mwifiex: send world regulatory domain to driver - drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) - drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) - drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) - drm/amd/pm: Adjust si_upload_smc_data register programming (v3) - drm/amd/pm: Fix si_upload_smc_data (v3) - drm/amd/pm: Disable ULV even if unsupported (v3) - drm/amdgpu: Power up UVD 3 for FW validation (v2) - coresight: Only register perf symlink for sinks with alloc_buffer - inet: ping: check sock_net() in ping_get_port() and ping_lookup() - media: st-delta: avoid excessive stack usage - ALSA: lx_core: use int type to store negative error codes - media: rj54n1cb0c: Fix memleak in rj54n1_probe() - scsi: myrs: Fix dma_alloc_coherent() error check - hwrng: nomadik - add ARM_AMBA dependency - crypto: keembay - Add missing check after sg_nents_for_len() - drm/amd/display: Remove redundant semicolons - serial: max310x: Add error checking in probe() - usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls - usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup - phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 - media: zoran: Remove zoran_fh structure - drm/bridge: it6505: select REGMAP_I2C - f2fs: fix condition in __allow_reserved_blocks() - drm/radeon/r600_cs: clean up of dead code in r600_cs - drm/panel: novatek-nt35560: Fix invalid return value - bpf: Enforce expected_attach_type for tailcall compatibility - i2c: designware: Add disabling clocks when probe fails - i2c: designware: Fix clock issue when PM is disabled - i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD - thermal/drivers/qcom/lmh: Add missing IRQ includes - thermal/drivers/qcom: Make LMH select QCOM_SCM - hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems - once: fix race by moving DO_ONCE to separate section - smp: Fix up and expand the smp_call_function_many() kerneldoc - selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported - i3c: master: svc: Recycle unused IBI slot - i3c: master: svc: Use manual response for IBI events - ACPICA: Fix largest possible resource descriptor index - pwm: tiehrpwm: Fix corner case in clock divisor calculation - arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible - arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value - arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names - cpuidle: qcom-spm: fix device and OF node leaks at probe - firmware: firmware: meson-sm: fix compile-test default - arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 - null_blk: Fix the description of the cache_size module argument - pinctrl: renesas: Use int type to store negative error codes - power: supply: cw2015: Fix a alignment coding style issue - PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() - ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property - ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS - ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax - block: use int to store blk_stack_limits() return value - selftests/nolibc: fix EXPECT_NZ macro - regulator: scmi: Use int type to store negative error codes - arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map - ARM: at91: pm: fix MCKx restore routine - pinctrl: meson-gxl: add missing i2c_d pinmux - soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS - leds: flash: leds-qcom-flash: Update torch current clamp setting - ARM: dts: renesas: porter: Fix CAN pin group - libbpf: Fix reuse of DEVMAP - bpf: Remove migrate_disable in kprobe_multi_link_prog_run - bpf/selftests: Fix test_tcpnotify_user - regmap: Remove superfluous check for !config in __regmap_init() - arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 - x86/vdso: Fix output operand size of RDPID - smb: server: fix IRD/ORD negotiation with the client - coresight: trbe: Prevent overflow in PERF_IDX2OFF() - gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote - selftests: arm64: Check fread return value in exec_target - seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast - init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD - filelock: add FL_RECLAIM to show_fl_flags() macro - !21022 KVM: Don't clobber irqfd routing type when deassigning irqfd - !20998 ceph: fix oops due to invalid pointer for kfree() in parse_longname() - !21023 l2tp: avoid one data-race in l2tp_tunnel_del_work() - xsched: fix potential NULL dereference in xsched_quota_timeout_update - xsched: remove the standalone xcu_cfs_cg_deinit() helper - xsched: restructure xcu_cgrp_subsys teardown to align with cpu_cgrp_subsys lifecycle - xsched: simplify root group check by direct comparison with root_xcg - xsched: replace magic number with SCHED_CLASS_MAX_LENGTH for scheduler class string length - xsched/core: immediate cleanup of remaining operators on task exit - xsched: add init_fair_xsched_group() for XCU-specific fair group initialization - xsched: modify xcu_cg_initialize_components helper - xsched: refactor xsched_entity initialization - xsched: change rq_init() parameter from struct xsched_cu to struct xsched_rq - xsched: harden and clarify xcu_move_task() logic - xsched: move throttling-related fields from xsched_group_xcu_priv to xsched_rq_cfs - xsched/quota: add throttled flag to cfs_rq for robust hierarchical enqueue under throttling - xsched/quota: support multi-level cgroup - xsched: remove redundant xcu parameter from dequeue_ctx - xsched: update group shares using xcu_grp_shares_add/sub helpers - xsched: delete unused code - xsched/cfs: propagate group activation/deactivation up the hierarchy - xsched/cfs: move xruntime updates to pick/put paths - xsched: add has_running hook to xsched classes for wake-up eligibility check - !21012 [OLK-6.6][linux-6.6.y sync] Backport 6.6.110-6.6.111 LTS Patches - scsi: hisi_sas: Fix NULL pointer exception when do user_scan() - !21013 CVE-2026-23177 - !21007 bonding: fix use-after-free due to enslave fail after slave array update - !21006 net: Fix CVE-2026-23204 - bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path - bpf, test_run: Subtract size of xdp_frame from allowed metadata size - bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN - bpf: Make variables in bpf_prog_test_run_xdp less confusing - bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K - !21015 libceph: reset sparse-read state in osd_fault() - !21024 ub: udma: bugfix related to print messages. - !20980 Fix CVE-2026-23126 - !20922 Fix CVE-2026-23133 - ub: udma: bugfix related to print messages. - l2tp: avoid one data-race in l2tp_tunnel_del_work() - KVM: Don't clobber irqfd routing type when deassigning irqfd - ipv6: annotate data-race in ndisc_router_discovery() - macvlan: observe an RCU grace period in macvlan_common_newlink() error path - macvlan: fix error recovery in macvlan_common_newlink() - mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() - net: fix segmentation of forwarding fraglist GRO - can: rcar_canfd: Fix CAN-FD mode as default - libceph: reset sparse-read state in osd_fault() - !21008 uvb: fix cis call return value and obtain - mm, shmem: prevent infinite loop on truncate race - mm/shmem, swap: fix race of truncate and swap entry split - net/9p: fix double req put in p9_fd_cancelled - riscv: mm: Do not restrict mmap address based on hint - riscv: mm: Use hint address in mmap if available - driver core/PM: Set power.no_callbacks along with power.no_pm - serial: stm32: allow selecting console when the driver is module - hid: fix I2C read buffer overflow in raw_event() for mcp2221 - ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free - ALSA: usb-audio: Kill timer properly at removal - platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list - can: rcar_canfd: Fix controller mode setting - can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled - btrfs: ref-verify: handle damaged extent root tree - ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue - perf subcmd: avoid crash in exclude_cmds when excludes is empty - platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list - dm-integrity: limit MAX_TAG_SIZE to 255 - ASoC: amd: acp: Adjust pdm gain value - wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 - USB: serial: option: add SIMCom 8230C compositions - media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe - !20931 Fix CVE-2026-23060 - uvb: fix cis call return value and obtain - bonding: fix use-after-free due to enslave fail after slave array update - net/sched: cls_u32: use skb_header_pointer_careful() - net: add skb_header_pointer_careful() helper - regmap: Fix race condition in hwspinlock irqsave routine - crypto: virtio - Add spinlock protection with virtqueue notification - net/mlx5e: TC, delete flows only for existing peers - !20967 net: hns3: modify code of judging if SMMU DMA is enabled - ceph: fix oops due to invalid pointer for kfree() in parse_longname() - !20969 Fix CVE-2026-23125 - !20948 v4 arm64: Add memory poison recovery support for various paths - !20975 CVE-2026-23102 - !20977 v4 support apei_page_offline_policy - bonding: annotate data-races around slave->last_rx - netfilter: nf_conncount: update last_gc only when GC has been performed - bonding: provide a net pointer to __skb_flow_dissect() - netdevsim: fix a race issue related to the operation on bpf_bound_progs list - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() - apei/ghes: Add sysctl interface to control soft-offline page isolation - Revert "mm/memory-failure: support disabling soft offline for HugeTLB pages" - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - arm64/fpsimd: signal: Fix restoration of SVE context - arm64/fpsimd: signal: Consistently read FPSIMD context - arm64/fpsimd: signal: Mandate SVE payload for streaming-mode state - bonding: limit BOND_MODE_8023AD to Ethernet devices - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag - net/sched: Enforce that teql can only be used as root qdisc - sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT - drivers/net: Update vendor name of Chengdu NorthLink Technology N5/N6 Series Network Card Drivers - net: hns3: modify code of judging if SMMU DMA is enabled - dmaengine: xilinx: xdma: Fix regmap max_register - ub:ubus: protect iterator ue_list and mue_list with ub_bus_sem - ub:ubus: Avoid getting empty uent from ubc - ub:hisi-ubus: Use GFP_ATOMIC when alloc memory - arm64: send sig fault for user task when apei_claim_sea fails - arm64: add ras log during do_sea - arm64: move getting valid siaddr to the top of do_sea - arm64: mm: shmem: support poison recovery from shmem_file_read_iter() - arm64: fs: support poison recovery from __kernel_read() - iov_iter: add mc support for copy_page_to_iter - arm64: mm: support recovery from copy_{from/to}_user_page() - iov_iter: get rid of 'copy_mc' flag - leds: led-class: Only Add LED to leds_list when it is fully ready - wifi: ath10k: fix dma_free_coherent() pointer - smb/server: fix refcount leak in parse_durable_handle_context() - ksmbd: add chann_lock to protect ksmbd_chann_list xarray - ipvlan: Make the addrs_lock be per port - smb: client: split cached_fid bitfields to avoid shared-byte RMW races - efivarfs: fix error propagation in efivar_entry_get() - io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop - dm: use bio_clone_blkg_association - RAS/AMD/ATL: fix error nodes per socket on for Hygon Dhyana processor - net: txgbe: fix clang compile warning - !20552 ub: udma: fix some code issues. - !20313 Fix CVE-2025-40220 - !20321 nvme: fix admin request_queue lifetime - !20512 PM / devfreq: hisi: Fix potential UAF in OPP handling - !20544 Fix CVE-2025-71147 - !20548 v4 net: LTS-6.6 backport - !20503 Fix CVE-2025-39713 - !20133 Fix CVE-2025-39721 - !20438 Fix CVE-2025-38659 - !20264 Fix CVE-2025-40277 - !20340 Fix CVE-2025-40271 - !20319 Fix CVE-2025-40237 - !20392 vfs: Don't leak disconnected dentries on umount - !20554 iommu/s390: Implement blocking domain - !20489 [OLK-6.6][linux-6.6.y sync] Backport 6.6.101-6.6.102 LTS Patches - !20513 ACPI: PCC: Fix race condition by removing static qualifier - !20468 drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer - !20483 rcu: Protect ->defer_qs_iw_pending from data race - !20510 drivers/ub/sentry: fix primary eid index value - !20553 ub: cdma: support separated page table feature - ub: udma: fix some code issues. - !20480 iommu/ummu-core: fix error invalidate tid - !20561 iommu/ummu: Add ummu sva independent page table parameter - ub: udma: bugfix related to 2m_hugepage. - ub: udma: support for separate page tables - ub: udma: delete debugfs code. - ub: udma: bugfix related to ctrlq function. - ub: udma: verify get cqe/ae aux info out addr and len. - ub: cdma: support separated page table feature - iommu/ummu: Add ummu sva independent page table parameter - iommu: Adjust PLB refresh timing in 'grant' and 'ungrant' - !20505 Fix CVE-2026-23035 - iommu/s390: Implement blocking domain - drivers/ub/sentry: fix primary eid index value - !20535 libceph: make decode_pool() more resilient against corrupted osdmaps - !20536 mm/page_alloc: change all pageblocks migrate type on coalescing - !20537 mm/secretmem: fix use-after-free race in fault handler - !20538 wifi: avoid kernel-infoleak from struct iw_point - !20539 net: usb: rtl8150: fix memory leak on usb_submit_urb() failure - !20440 PCI/AER: Fix NULL pointer access by aer_info - !20262 Fix CVE-2025-68176 - netfilter: nf_reject: don't leak dst refcount for loopback packets - net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error - page_pool: always add GFP_NOWARN for ATOMIC allocations - virtio-net: fix received length check in big packets - net: bridge: fix use-after-free due to MST port state bypass - vsock: Ignore signal/timeout on connect() if already established - tls: make sure to abort the stream if headers are bogus - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI - xfrm: Duplicate SPI Handling - tls: handle data disappearing from under the TLS ULP - net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing - bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls - Bluetooth: hci_core: Fix use-after-free in vhci_flush() - KEYS: trusted: Fix a memory leak in tpm2_load_cmd - !20237 Fix CVE-2025-68724 - !20459 Fix CVE-2025-71131 - !20525 Fix CVE-2025-68816 - !20529 CVE-2025-68172 - net: usb: rtl8150: fix memory leak on usb_submit_urb() failure - !20370 Revert "Revert "RDMA/hns: Fix mismatch exception rollback"" - wifi: avoid kernel-infoleak from struct iw_point - mm/secretmem: fix use-after-free race in fault handler - mm/page_alloc: change all pageblocks migrate type on coalescing - libceph: make decode_pool() more resilient against corrupted osdmaps - pps: Fix kabi breakage of struct pps_device for last_fetched_ev - sched: Fix kabi breakage of struct task_struct for saved_state - crypto: aspeed - fix double free caused by devm - !20515 Bluetooth: bcsp: receive data only if registered - !20507 Fix CVE-2025-40358 - !20450 ub: ubase&unic: Fix some bug in concurrent process - !20452 iommu/ummu: Fix some bugs and optimize the code implementation - !20451 iommu/ummu: Add the function of creating devices with SVA-separated - !20500 mm: fix the inaccurate memory statistics issue for users - net/mlx5: fw_tracer, Validate format string parameters - Bluetooth: bcsp: receive data only if registered - ACPI: PCC: Fix race condition by removing static qualifier - ACPI: CPPC: Fix missing PCC check for guaranteed_perf - iommu/ummu: Add the function of creating devices with SVA-separated - iommu/ummu-core: fix error invalidate tid - riscv: stacktrace: Disable KASAN checks for non-current tasks - !20497 arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() - !20496 drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies - !20495 iommu/amd: Avoid stack buffer overflow from kernel cmdline - !20494 HID: core: Harden s32ton() against conversion to 0 bits - !20493 iommu: Fix two issues in iommu_copy_struct_from_user() - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv - PM / devfreq: hisi: Fix potential UAF in OPP handling - media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() - !20487 interference: Fix uninitialized ifs_clock compiling issue - MIPS: mm: kmalloc tlb_vpn array to avoid stack overflow - MIPS: mm: Prevent a TLB shutdown on initial uniquification - mm: fix the inaccurate memory statistics issue for users - mm: add config option for atomic mode in mm counter - Revert "mm: fix the inaccurate memory statistics issue for users" - !20444 net/mlx5e: Fix crash on profile change rollback failure - !20442 net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv - arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() - drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies - iommu/amd: Avoid stack buffer overflow from kernel cmdline - HID: core: Harden s32ton() against conversion to 0 bits - iommu: Fix two issues in iommu_copy_struct_from_user() - SUNRPC: call xs_sock_process_cmsg for all cmsg - flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read - !20374 [OLK 6.6]Use Hygon IBRS and IBPB rather than software-based mitigation to mitigate Retbleed and SRSO. - !20227 Rename leapioraid to leapraid and release v2.0 - mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery - MIPS: mm: tlb-r4k: Uniquify TLB entries on init - x86/fpu: Delay instruction pointer fixup until after warning - ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx() - ALSA: intel_hdmi: Fix off-by-one error in __hdmi_lpe_audio_probe() - x86/sev: Evict cache lines during SNP memory validation - net: usbnet: Fix the wrong netif_carrier_on() call - net: usbnet: Avoid potential RCU stall on LINK_CHANGE event - Bluetooth: btusb: Add USB ID 3625:010b for TP-LINK Archer TX10UB Nano - sched,freezer: Remove unnecessary warning in __thaw_task - freezer,sched: Clean saved_state when restoring it during thaw - freezer,sched: Do not restore saved_state of a thawed task - freezer,sched: Use saved_state to reduce some spurious wakeups - sched/core: Remove ifdeffery for saved_state - i2c: stm32f7: unmap DMA mapped buffer - i2c: stm32f7: simplify status messages in case of errors - i2c: stm32f7: perform most of irq job in threaded handler - i2c: stm32f7: use dev_err_probe upon calls of devm_request_irq - i2c: stm32f7: Use devm_clk_get_enabled() - USB: serial: option: add Foxconn T99W709 - smb: server: Fix extension string in ksmbd_extract_shortname() - ksmbd: fix corrupted mtime and ctime in smb2_open - ksmbd: fix Preauh_HashValue race condition - ksmbd: fix null pointer dereference error in generate_encryptionkey - vsock: Do not allow binding to VMADDR_PORT_ANY - selftests/perf_events: Add a mmap() correctness test - smb: client: return an error if rdma_connect does not return within 5 seconds - smb: client: let recv_done() cleanup before notifying the callers. - smb: client: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already - smb: client: make use of common smbdirect_socket - smb: smbdirect: add smbdirect_socket.h - smb: client: Correct typos in multiple comments across various files - smb: client: Use min() macro - smb: server: let recv_done() avoid touching data_transfer after cleanup/move - smb: server: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already - ALSA: hda/ca0132: Fix missing error handling in ca0132_alt_select_out() - irqchip: Build IMX_MU_MSI only on ARM - net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing - sunrpc: fix client side handling of tls alerts - net/sched: taprio: enforce minimum value for picos_per_byte - net: drop UFO packets in udp_rcv_segment() - ipv6: reject malicious packets in ipv6_gso_segment() - net/mlx5: Correctly set gso_segs when LRO is used - netlink: specs: ethtool: fix module EEPROM input/output arguments - net: ipa: add IPA v5.1 and v5.5 to ipa_version_string() - phy: mscc: Fix parsing of unicast frames - netpoll: prevent hanging NAPI when netcons gets enabled - md/md-cluster: handle REMOVE message earlier - NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY - NFS: Fix wakeup of __nfs_lookup_revalidate() in unblock_revalidate() - sched: Add test_and_clear_wake_up_bit() and atomic_dec_and_wake_up() - pNFS/flexfiles: don't attempt pnfs on fatal DS errors - PCI: pnv_php: Fix surprise plug detection and recovery - powerpc/eeh: Export eeh_unfreeze_pe() - PCI: pnv_php: Work around switches with broken presence detection - kconfig: qconf: fix ConfigList::updateListAllforAll() - scsi: sd: Make sd shutdown issue START STOP UNIT appropriately - scsi: ufs: core: Use link recovery when h8 exit fails during runtime resume - scsi: Revert "scsi: iscsi: Fix HW conn removal use after free" - scsi: mpt3sas: Fix a fw_event memory leak - vfio/pci: Separate SR-IOV VF dev_set - vfio/pds: Fix missing detach_ioas op - vfio: Prevent open_count decrement to negative - vfio: Fix unbalanced vfio_df_close call in no-iommu mode - f2fs: fix to calculate dirty data during has_not_enough_free_secs() - f2fs: fix to update upper_p in __get_secs_required() correctly - f2fs: vm_unmap_ram() may be called from an invalid context - f2fs: fix to avoid out-of-boundary access in devs.path - f2fs: doc: fix wrong quota mount option description - f2fs: fix KMSAN uninit-value in extent_info usage - rtc: rv3028: fix incorrect maximum clock rate handling - rtc: pcf8563: fix incorrect maximum clock rate handling - rtc: pcf85063: fix incorrect maximum clock rate handling - rtc: nct3018y: fix incorrect maximum clock rate handling - rtc: hym8563: fix incorrect maximum clock rate handling - rtc: ds1307: fix incorrect maximum clock rate handling - ucount: fix atomic_long_inc_below() argument type - module: Restore the moduleparam prefix length check - apparmor: fix loop detection used in conflicting attachment resolution - apparmor: ensure WB_HISTORY_SIZE value is a power of 2 - bpf: Check netfilter ctx accesses are aligned - bpf: Check flow_dissector ctx accesses are aligned - vhost-scsi: Fix log flooding with target does not exist errors - mtd: rawnand: atmel: set pmecc data setup time - mtd: rawnand: rockchip: Add missing check after DMA map - mtd: rawnand: atmel: Fix dma_mapping_error() address - jfs: fix metapage reference count leak in dbAllocCtl - crypto: qat - fix seq_file position update in adf_ring_next() - crypto: qat - fix DMA direction for compression on GEN2 devices - perf tools: Remove libtraceevent in .gitignore - sh: Do not use hyphen in exported variable name - ASoC: fsl_xcvr: get channel status data when PHY is not exists - dmaengine: nbpfaxi: Add missing check after DMA map - dmaengine: mv_xor: Fix missing check after DMA map and missing unmap - fs/orangefs: Allow 2 more characters in do_c_string() - PCI: endpoint: pci-epf-vntb: Fix the incorrect usage of __iomem attribute - soundwire: stream: restore params when prepare ports fail - crypto: img-hash - Fix dma_unmap_sg() nents value - crypto: keembay - Fix dma_unmap_sg() nents value - hwrng: mtk - handle devm_pm_runtime_enable errors - watchdog: ziirave_wdt: check record length in ziirave_firm_verify() - scsi: isci: Fix dma_unmap_sg() nents value - scsi: mvsas: Fix dma_unmap_sg() nents value - scsi: elx: efct: Fix dma_unmap_sg() nents value - scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value - clk: sunxi-ng: v3s: Fix de clock definition - perf tests bp_account: Fix leaked file descriptor - kernel: trace: preemptirq_delay_test: use offstack cpu mask - crypto: inside-secure - Fix `dma_unmap_sg()` nents value - perf sched: Fix memory leaks in 'perf sched latency' - perf sched: Fix memory leaks for evsel->priv in timehist - perf sched: Free thread->priv using priv_destructor - perf dso: Add missed dso__put to dso__load_kcore - perf tools: Fix use-after-free in help_unknown_cmd() - Fix dma_unmap_sg() nents value - clk: clk-axi-clkgen: fix fpfd_max frequency for zynq - fanotify: sanitize handle_type values when reporting fid - pinctrl: sunxi: Fix memory leak on krealloc failure - PCI: endpoint: pci-epf-vntb: Return -ENOENT if pci_epc_get_next_free_bar() fails - crypto: arm/aes-neonbs - work around gcc-15 warning - power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set - power: supply: cpcap-charger: Fix null check for power_supply_get_by_name - clk: xilinx: vcu: unregister pll_post only if registered correctly - media: v4l2-ctrls: Fix H264 SEPARATE_COLOUR_PLANE check - mtd: fix possible integer overflow in erase_xfer() - crypto: marvell/cesa - Fix engine load inaccuracy - crypto: qat - use unmanaged allocation for dc_data - crypto: sun8i-ce - fix nents passed to dma_unmap_sg() - PCI: rockchip-host: Fix "Unexpected Completion" log message - bpf/preload: Don't select USERMODE_DRIVER - ipv6: annotate data-races around rt->fib6_nsiblings - ipv6: fix possible infinite loop in fib6_info_uses_dev() - vrf: Drop existing dst reference in vrf_ip6_input_dst - selftests: rtnetlink.sh: remove esp4_offload after test - net/mlx5e: Clear Read-Only port buffer size in PBMC before update - netfilter: xt_nfacct: don't assume acct name is null-terminated - can: kvaser_usb: Assign netdev.dev_port based on device channel index - can: kvaser_pciefd: Store device channel index - can: peak_usb: fix USB FD devices potential malfunction - tools/rv: Do not skip idle in trace - Bluetooth: hci_event: Mask data status from LE ext adv reports - kcsan: test: Initialize dummy variable - wifi: mac80211: Write cnt before copying in ieee80211_copy_rnr_beacon() - wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE - wifi: ath12k: fix endianness handling while accessing wmi service bit - wifi: mac80211: Check 802.11 encaps offloading in ieee80211_tx_h_select_key() - wifi: mac80211: Don't call fq_flow_idx() for management frames - wifi: mac80211: Do not schedule stopped TXQs - wifi: plfxlc: Fix error handling in usb driver probe - wifi: mac80211: reject TDLS operations when station is not associated - iommu/amd: Fix geometry.aperture_end for V2 tables - mwl8k: Add missing check after DMA map - wifi: rtl8xxxu: Fix RX skb size for aggregation disabled - tcp: call tcp_measure_rcv_mss() for ooo packets - xen/gntdev: remove struct gntdev_copy_batch from stack - net_sched: act_ctinfo: use atomic64_t for three counters - net/sched: Restrict conditions for adding duplicating netems to qdisc tree - um: rtc: Avoid shadowing err in uml_rtc_start() - arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX - netfilter: nf_tables: adjust lockdep assertions handling - netfilter: nf_tables: Drop dead code from fill_*_info routines - fbcon: Fix outdated registered_fb reference in comment - drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value - m68k: Don't unregister boot console needlessly - drm/msm/dpu: Fill in min_prefill_lines for SC8180X - kselftest/arm64: Fix check for setting new VLs in sve-ptrace - net: dst: annotate data-races around dst->input - tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range - wifi: ath11k: clear initialized flag for deinit-ed srng lists - iwlwifi: Add missing check for alloc_ordered_workqueue - wifi: iwlwifi: Fix memory leak in iwl_mvm_init() - wifi: rtl818x: Kill URBs before clearing tx status queue - wifi: rtw89: avoid NULL dereference when RX problematic packet on unsupported 6 GHz band - caif: reduce stack size, again - bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure - drm/vmwgfx: Fix Host-Backed userspace on Guest-Backed kernel - net: ipv6: ip6mr: Fix in/out netdev to pass to the FORWARD chain - selftests/bpf: fix signedness bug in redir_partial() - bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls - bpf, sockmap: Fix psock incorrectly pointing to sk - drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed - staging: nvec: Fix incorrect null termination of battery manufacturer - interconnect: qcom: sc8180x: specify num_nodes - interconnect: qcom: sc8280xp: specify num_links for qnm_a1noc_cfg - soc: qcom: pmic_glink: fix OF node leak - samples: mei: Fix building on musl libc - cpufreq: Initialize cpufreq-based frequency-invariance later - cpufreq: intel_pstate: Always use HWP_DESIRED_PERF in passive mode - arm64: dts: imx8mn-beacon: Fix HS400 USDHC clock speed - arm64: dts: imx8mm-beacon: Fix HS400 USDHC clock speed - ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface - soc/tegra: cbb: Clear ERR_FORCE register with ERR_STATUS - arm: dts: ti: omap: Fixup pinheader typo - usb: early: xhci-dbc: Fix early_ioremap leak - powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw() - pps: fix poll support - staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() - spi: stm32: Check for cfg availability in stm32_spi_probe - usb: misc: apple-mfi-fastcharge: Make power supply names unique - usb: host: xhci-plat: fix incorrect type for of_match variable in xhci_plat_probe() - ARM: dts: vfxxx: Correctly use two tuples for timer address - arm64: dts: qcom: msm8976: Make blsp_dma controlled-remotely - arm64: dts: qcom: sc7180: Expand IMEM region - arm64: dts: qcom: sdm845: Expand IMEM region - soc: qcom: QMI encoding/decoding for big endian - selftests: Fix errno checking in syscall_user_dispatch test - ASoC: mediatek: use reserved memory or enable buffer pre-allocation - gfs2: No more self recovery - Revert "fs/ntfs3: Replace inode_trylock with inode_lock" - hfs: make splice write available again - hfsplus: make splice write available again - ublk: use vmalloc for ublk_device's __queues - fs_context: fix parameter name in infofc() macro - audit,module: restore audit logging in load failure case - ASoC: amd: yc: add DMI quirk for ASUS M6501RM - ASoC: Intel: fix SND_SOC_SOF dependencies - ASoC: amd: yc: Add DMI entries to support HP 15-fb1xxx - ethernet: intel: fix building with large NR_CPUS - ASoC: amd: yc: Add DMI quirk for HP Laptop 17 cp-2033dx - interference: Fix uninitialized ifs_clock compiling issue - iommu/ummu: optimize log printing - !20455 Fix compilation failure caused by PR#20174 - !20302 CVE-2026-22980 - !20142 CVE-2025-68803 - !20261 ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency - !20435 fix CVE-2026-22998 - !20433 scsi: target: Reset t_task_cdb pointer in error case - !20432 scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" - !20431 block: Use RCU in blk_mq_[un - !20307 tpm: Cap the number of PCR banks - !20062 xfs: Add xfs_dir3_leaf_header_check() in leaf/leafn read - !20157 v2 md: backport from mainline - rcu: Protect ->defer_qs_iw_pending from data race - platform/x86/intel/pmt: fix compilation failure caused by PR#20174 - iommu/ummu: optimize kv cache memory management - iommu/ummu: optimize permission table management - iommu/ummu: remove check for eid_type while del eid - iommu/ummu: optimize the code implementation - drivers/perf: fix ummu-pmu data reading exception - iommu/ummu: IOMMU_DOMAIN_BLOCKED type don not sync tct - drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer - crypto: seqiv - Do not use req->iv after crypto_aead_encrypt - net: unic: Notify mami of the bond ip change. - ub: ubase: Support for UE link by ctrlq message - ub: ubase: send a deactivate req in removing - ub: ubase: Querying TPG/TP contexts in the chip is no longer supported after enabling safe mode. - ub: ubase: Use an independent thread for the ctrlq workqueue. - !20368 ubcore: fix logging and permission for route query. - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id - !20344 ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr - net: unic: Fix the ummu 0xa event that occurs when modifying queues and resetting concurrent scenarios - ub: ubase: Add KABI compatibility - ub: ubase: fixing the issue of cdma ctp_req_vl parameter configuration - ub: ubase: add PMU IDEV interrupt supported abilities. - ub: ubase: Delete the tid mask for eq, jfs, jfr, and jfc context - ub: ubase: Set the completion event interrupt to auto - net: unic: fix poll tx read old skb cause a UAF bug - !20249 Fix CVE-2025-38489 - !20250 Fix CVE-2025-38480 - !20378 Fix CVE-2025-39838 - !20430 Fix CVE-2025-39942 - !20351 Fix CVE-2025-71149 - !20375 Fix CVE-2025-71150 - !20323 Fix CVE-2025-38730 - !20320 Fix CVE-2025-68814 - !20314 Fix CVE-2025-71072 - !20315 Fix CVE-2025-68794 - !20403 bpf: Check skb->transport_header is set in bpf_skb_check_mtu - !20402 bpf: Do not let BPF test infra emit invalid GSO types to stack - !20401 tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() - !20400 netfilter: nft_ct: add seqadj extension for natted connections - !20399 net: xfrm: Fix CVE-2025-40215 - !20398 net/sched: sch_qfq: Fix null-deref in agg_dequeue - !20397 bpf: Reject narrower access to pointer ctx fields - !20396 Bluetooth: eir: Fix possible crashes on eir_create_adv_data - !20394 IB/mlx5: Fix potential deadlock in MR deregistration - !20367 ub: cdma: cdma uaf bugfix - net/mlx5e: Fix crash on profile change rollback failure - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv - PCI/AER: Fix NULL pointer access by aer_info - gfs2: No more self recovery - drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE - crypto: qat - flush misc workqueue during device shutdown - !20174 Backport PMT spec 3.0 support - !20366 [Hygon][6.6][Bugfix]: Resolve FPU state corruption between atomic and non-atomic contexts - !19814 [OLK-6.6] Batch flushing user memory encrytion status change - !20393 [OLK-6.6][linux-6.6.y sync] Backport 6.6.100-6.6.101 LTS Patches - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec - nvmet-tcp: remove boilerplate code - scsi: target: Reset t_task_cdb pointer in error case - scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" - block: Use RCU in blk_mq_[un]quiesce_tagset() instead of set->tag_list_lock - ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size - ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer - smb: server: let recv_done() consistently call put_recvmsg/smb_direct_disconnect_rdma_connection - smb: server: remove separate empty_recvmsg_queue - !20384 ub:ubus: Fix ubus link message and pool device error - !20389 gfs2: Prevent recursive memory reclaim - !20388 *** fix CVE-2025-38062 *** - !20387 KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced - !20386 pinctrl: check the return value of pinmux_ops::get_function_name() - !20385 iommu/amd/pgtbl: Fix possible race while increase page table level - ub:ubus: Not cfg access during surprise down - ub:hisi-ubus: Delete validate_pa err print - PCI: cadence: Check for the existence of cdns_pcie::ops before using it - can: netlink: can_changelink(): allow disabling of automatic restart - Revert "selftests/bpf: Add a cgroup prog bpf_get_ns_current_pid_tgid() test" - drm/sched: Remove optimization that causes hang when killing dependent jobs - ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS - bpf: Check skb->transport_header is set in bpf_skb_check_mtu - bpf: Do not let BPF test infra emit invalid GSO types to stack - tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() - netfilter: nft_ct: add seqadj extension for natted connections - xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added - xfrm: delete x->tunnel as we delete x - x86/hw-vuln:Support hardware-based mitigation for Retbleed and SRSO via Hygon IBRS to avoid performance degradation caused by software-based mitigation. - net/sched: sch_qfq: Fix null-deref in agg_dequeue - bpf: Reject narrower access to pointer ctx fields - Bluetooth: eir: Fix possible crashes on eir_create_adv_data - IB/mlx5: Fix potential deadlock in MR deregistration - ub:ubus: Fix ubus link message and pool device error - ub:hisi-ubus: cq poller maximum handle 64 cqe per time - ub:hisi-ubus:Fix vdm message print error - ub:ubus:Fix ubus interrupt release issue - wifi: mt76: mt7921: prevent decap offload config before STA initialization - mtd: rawnand: qcom: Fix last codeword read in qcom_param_page_type_exec() - iio: hid-sensor-prox: Restore lost scale assignments - iio: hid-sensor-prox: Fix incorrect OFFSET calculation - crypto: powerpc/poly1305 - add depends on BROKEN for now - erofs: address D-cache aliasing - drm/i915/dp: Fix 2.7 Gbps DP_LINK_BW value on g4x - ALSA: hda: Add missing NVIDIA HDA codec IDs - ALSA: hda/tegra: Add Tegra264 support - comedi: comedi_test: Fix possible deletion of uninitialized timers - usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach - usb: typec: tcpm: allow switching to mode accessory to mux properly - usb: typec: tcpm: allow to use sink in accessory mode - drm/amdkfd: Don't call mmput from MMU notifier callback - mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n - selftests: mptcp: connect: also cover checksum - selftests: mptcp: connect: also cover alt modes - resource: fix false warning in __request_region() - gve: Fix stuck TX queue for DQ queue format - e1000e: ignore uninitialized checksum word on tgp - e1000e: disregard NVM checksum on tgp when valid checksum bit is not set - dpaa2-switch: Fix device reference count leak in MAC endpoint handling - dpaa2-eth: Fix device reference count leak in MAC endpoint handling - ALSA: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx - sprintf.h requires stdarg.h - bus: fsl-mc: Fix potential double device reference in fsl_mc_get_endpoint() - i2c: virtio: Avoid hang by using interruptible completion wait - i2c: tegra: Fix reset error handling with ACPI - platform/x86: ideapad-laptop: Fix kbd backlight not remembered among boots - can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode - can: dev: can_restart(): move debug message and stats after successful restart - can: dev: can_restart(): reverse logic to remove need for goto - i40e: When removing VF MAC filters, only check PF-set MAC - i40e: report VF tx_dropped with tx_errors instead of tx_discards - i40e: Add rx_missed_errors for buffer exhaustion - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch - net/mlx5: Fix memory leak in cmd_exec() - staging: vchiq_arm: Make vchiq_shutdown never fail - x86/hyperv: Fix usage of cpu_online_mask to get valid cpu - regmap: fix potential memory leak of regmap_bus - iio: adc: ad7949: use spi_is_bpw_supported() - interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1 node - RDMA/core: Rate limit GID cache warning messages - virtio_ring: Fix error reporting in virtqueue_resize - !20348 [OLK-6.6][linux-6.6.y sync] Backport 6.6.99-6.6.100 LTS Patches - !20346 tracing: Fix crash on synthetic stacktrace field usage - vfs: Don't leak disconnected dentries on umount - !20334 Fix CVE-2025-68780 - gfs2: Prevent recursive memory reclaim - amd/amdkfd: enhance kfd process check in switch partition - drm/amdkfd: allow compute partition mode switch with cgroup exclusions - KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced - pinctrl: check the return value of pinmux_ops::get_function_name() - iommu/amd/pgtbl: Fix possible race while increase page table level - !19966 nvme-fc: use lock accessing port_state and rport state - ASoC: fsl_sai: replace regmap_write with regmap_update_bits - comedi: Fix use of uninitialized data in insn_rw_emulate_bits() - cifs: prevent NULL pointer dereference in UTF16 conversion - ksmbd: Fix refcount leak when invalid session is found on session lookup - ubcore: fix logging and permission for route query. - !20232 driver/coda: VirtCCA supports MSI device DA - Revert "Revert "RDMA/hns: Fix mismatch exception rollback"" - !20197 ub: udma&ubase: fix a bug that caused long reboot time - x86: Resolve FPU state corruption between atomic and non-atomic contexts - ub: cdma: cdma uaf bugfix - ub: cdma: jfs call trace bugfix - !20353 x86/fpu: Clear XSTATE_BV[i - s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again - KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls - nvmem: layouts: u-boot-env: remove crc32 endianness conversion - i2c: omap: fix deprecated of_property_read_bool() use - ASoC: fsl_sai: Force a software reset when starting in consumer mode - regulator: pwm-regulator: Manage boot-on with disabled PWM channels - regulator: pwm-regulator: Calculate the output voltage for disabled PWMs - i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe() - i2c: omap: Fix an error handling path in omap_i2c_probe() - i2c: omap: Add support for setting mux - usb: dwc3: qcom: Don't leave BCR asserted - usb: hub: Don't try to recover devices lost during warm reset. - usb: hub: Fix flushing of delayed work used for post resume purposes - usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm - usb: hub: fix detection of high tier USB3 devices behind suspended hubs - arm64: Filter out SME hwcaps when FEAT_SME isn't implemented - ipv6: make addrconf_wq single threaded - !20354 cpufreq/sched: Explicitly synchronize limits_changed flag handling - sched/deadline: only set free_cpus for online runqueues - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 - cpufreq/sched: Explicitly synchronize limits_changed flag handling - io_uring/poll: correctly handle io_poll_add() return value on update - shmem: fix recovery on rename failures - io_uring: fix filename leak in __io_openat_prep() - Revert "cgroup_freezer: cgroup_freezing: Check if not frozen" - rxrpc: Fix transmission of an abort in response to an abort - rxrpc: Fix recv-recv race of completed call - net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree - net: bridge: Do not offload IGMP/MLD messages - hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf - netfilter: nf_conntrack: fix crash due to removal of uninitialised entry - ipv6: mcast: Delay put pmc->idev in mld_del_delrec() - net/mlx5: Correctly set gso_size when LRO is used - Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID - Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout - Bluetooth: SMP: If an unallowed command is received consider it a failure - Bluetooth: hci_sync: fix connectable extended advertising when using static random address - hwmon: (corsair-cpro) Validate the size of the received input buffer - selftests: net: increase inter-packet timeout in udpgro.sh - wifi: cfg80211: remove scan request n_channels counted_by - nvme: fix misaccounting of nvme-mpath inflight I/O - net: phy: Don't register LEDs for genphy - nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list() - rpl: Fix use-after-free in rpl_do_srh_inline(). - block: fix kobject leak in blk_unregister_queue - net: emaclite: Fix missing pointer increment in aligned_read() - soundwire: amd: fix for clearing command status register - soundwire: amd: fix for handling slave alerts after link is down - comedi: Fix use of uninitialized data in insn_rw_emulate_bits() - comedi: Fix some signed shift left operations - comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large - comedi: das6402: Fix bit shift out of bounds - comedi: das16m1: Fix bit shift out of bounds - comedi: aio_iiro_16: Fix bit shift out of bounds - comedi: pcl812: Fix bit shift out of bounds - iio: adc: stm32-adc: Fix race in installing chained IRQ handler - iio: adc: max1363: Reorder mode_list[] entries - iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] - iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush - soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled - soc: aspeed: lpc-snoop: Cleanup resources in stack-order - s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again - pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov - net: libwx: properly reset Rx ring descriptor - net: libwx: remove duplicate page_pool_put_full_page() - mmc: sdhci_am654: Workaround for Errata i2312 - mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models - mmc: bcm2835: Fix dma_unmap_sg() nents value - memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() - isofs: Verify inode mode when loading from disk - dmaengine: nbpfaxi: Fix memory corruption in probe() - af_packet: fix soft lockup issue caused by tpacket_snd() - af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() - arm64: dts: rockchip: use cs-gpios for spi1 on ringneck - arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on - arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency - net/mlx5: Update the list of the PCI supported devices - phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() - io_uring/poll: fix POLLERR handling - ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS - drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume - tracing/osnoise: Fix crash in timerlat_dump_stack() - spi: Add check for 8-bit transfer with 8 IO mode support - pch_uart: Fix dma_sync_sg_for_device() nents value - thunderbolt: Fix bit masking in tb_dp_port_set_hops() - i2c: stm32: fix the device used for the DMA map - tracing: Fix crash on synthetic stacktrace field usage - usb: musb: fix gadget state on disconnect - USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI - USB: serial: option: add Foxconn T99W640 - USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition - phy: tegra: xusb: Disable periodic tracking on Tegra234 - phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode - phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr - fs/proc: fix uaf in proc_readdir_de() - io_uring/net: commit partial buffers on retry - nvme: fix admin request_queue lifetime - fs/notify: call exportfs_encode_fid with s_umount - iomap: adjust read range correctly for non-block-aligned positions - fuse: fix livelock in synchronous file put from fuseblk workers - tpm: Cap the number of PCR banks - nfsd: provide locking for v4_end_grace - Revert "nfsd: provide locking for v4_end_grace" - config: enable config for PMT discovery driver - platform/x86/intel/pmt/discovery: use valid device pointer in dev_err_probe - platform/x86/intel/pmt: Fix kobject memory leak on init failure - platform/x86/intel/pmt: fix a crashlog NULL pointer access - platform/x86/intel/pmt: fix build dependency for kunit test - platform/x86/intel/pmt/discovery: fix format string warning - platform/x86/intel/pmt/discovery: Fix size_t specifiers for 32-bit - platform/x86/intel/pmt: KUNIT test for PMT Enhanced Discovery API - platform/x86/intel/pmt/telemetry: Add API to retrieve telemetry regions by feature - platform/x86/intel/pmt/discovery: Get telemetry attributes - platform/x86/intel/tpmi: Get OOBMSM CPU mapping from TPMI - platform/x86/intel/vsec: Set OOBMSM to CPU mapping - platform/x86/intel/tpmi: Relocate platform info to intel_vsec.h - docs: Add ABI documentation for intel_pmt feature directories - platform/x86/intel/pmt: Add PMT Discovery driver - sysfs: Fix crash on empty group attributes array - sysfs: Introduce a mechanism to hide static attribute_groups - platform/x86/intel/vsec: Add new Discovery feature - platform/x86/intel/vsec: Skip driverless features - platform/x86/intel/vsec: Skip absent features during initialization - platform/x86/intel/vsec: Add device links to enforce dependencies - platform/x86/intel/vsec: Create wrapper to walk PCI config space - platform/x86/intel/vsec: Add private data for per-device data - MAINTAINERS: Add link to documentation of Intel PMT ABI - platform/x86/intel/pmt: allow user offset for PMT callbacks - driver/coda: VirtCCA supports MSI device DA - ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency - Rename leapioraid to leapraid and release v2.0 - ub: udma: fix a bug that caused long reboot time. - ub: ubase: Accelerate when ctrl node is shutting down - platform/x86/intel/pmt: Use PMT callbacks - platform/x86/intel/vsec: Add PMT read callbacks - platform/x86/intel/vsec.h: Move to include/linux - md: prevent incorrect update of resync/recovery offset - md/raid1: Fix data corruption for degraded array with slow disk - md/raid1: set max_sectors during early return from choose_slow_rdev() - md-cluster: fix no recovery job when adding/re-adding a disk - md-cluster: fix hanging issue while a new disk adding - md/raid5: recheck if reshape has finished with device_lock held - md-cluster: Constify struct md_cluster_operations - md: Remove unneeded semicolon - md/raid5: fix spares errors about rcu usage - dm-raid: Fix WARN_ON_ONCE check for sync_thread in raid_resume - md: pass in max_sectors for pers->sync_request() - md: factor out helpers for different sync_action in md_do_sync() - md: replace last_sync_action with new enum type - md: use new helpers in md_do_sync() - md: don't fail action_store() if sync_thread is not registered - md: remove parameter check_seq for stop_sync_thread() - md: replace sysfs api sync_action with new helpers - md: factor out helper to start reshape from action_store() - md: add new helpers for sync_action - md: add a new enum type sync_action - md: rearrange recovery_flags - md/raid0: don't free conf on raid0_run failure - md: make md_flush_request() more readable - md: change the return value type of md_write_start to void - md: Revert "md: Fix overflow in is_mddev_idle" - md: don't account sync_io if iostats of the disk is disabled - md: Fix overflow in is_mddev_idle - md: add check for sleepers in md_wakeup_thread() - md: add a mddev_is_dm helper - md: add a mddev_add_trace_msg helper - md: add a mddev_trace_remap helper - dm-raid456, md/raid456: fix a deadlock for dm-raid456 while io concurrent with reshape - dm-raid: add a new helper prepare_suspend() in md_personality - dm-raid: really frozen sync_thread during suspend - md: add a new helper reshape_interrupted() - md: export helper md_is_rdwr() - md: export helpers to stop sync_thread - md: don't clear MD_RECOVERY_FROZEN for new dm-raid until resume - md/raid1: factor out helpers to choose the best rdev from read_balance() - md/raid1: factor out the code to manage sequential IO - md/raid1: factor out choose_bb_rdev() from read_balance() - md/raid1: factor out choose_slow_rdev() from read_balance() - md/raid1: factor out read_first_rdev() from read_balance() - md/raid1-10: factor out a new helper raid1_should_read_first() - md/raid1-10: add a helper raid1_check_read_range() - md/raid1: fix choose next idle in read_balance() - md/raid1: record nonrot rdevs while adding/removing rdevs to conf - md/raid1: factor out helpers to add rdev to conf - md: add a new helper rdev_has_badblock() - md: check mddev->pers before calling md_set_readonly() - md: clean up openers check in do_md_stop() and md_set_readonly() - md: sync blockdev before stopping raid or setting readonly - md: factor out a helper to sync mddev - md: return directly before setting did_set_md_closing - md: changed the switch of RAID_VERSION to if - md: merge the check of capabilities into md_ioctl_valid() - md: Don't suspend the array for interrupted reshape - md: Don't register sync_thread for reshape directly - md: Make sure md_do_sync() will set MD_RECOVERY_DONE - md: Don't ignore read-only array in md_check_recovery() - md: Don't ignore suspended array in md_check_recovery() - md: get rdev->mddev with READ_ONCE() - md: remove redundant md_wakeup_thread() - md: remove redundant check of 'mddev->sync_thread' - md: fix a suspicious RCU usage warning - raid: Remove now superfluous sentinel element from ctl_table array - NFSD: NFSv4 file creation neglects setting ACL - nfsd: set security label during create operations - xfs: Add xfs_dir3_leaf_header_check() in leaf/leafn read - nvme-fc: use lock accessing port_state and rport state - x86/mm: Batch flushing user memory encrytion status change - !20588 [OLK-6.6] Revert "x86/csv: Enhance CMA memory usage reporting for CSV3" - Revert "x86/csv: Enhance CMA memory usage reporting for CSV3" - !20576 media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg() - !20575 RDMA/cm: Fix leaking the multicast GID table reference - !20580 RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly - !20551 Fix CVE-2025-68785 - !20478 f2fs: fix to avoid potential deadlock - !20501 [OLK-6.6] backport important bugfix for bnxt driver from upstream linux-6.6.y - !20520 Fix CVE-2026-23038 - !20424 net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup - !20425 mlx5: Fix default values in create CQ - RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly - media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg() - RDMA/cm: Fix leaking the multicast GID table reference - net: openvswitch: fix middle attribute validation in push_nsh() action - net: openvswitch: remove never-working support for setting nsh fields - pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() - bnxt_en: Fix potential data corruption with HW GRO/LRO - f2fs: fix to avoid potential deadlock - mlx5: Fix default values in create CQ - net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup - riscv kernel upgrade to 6.6.0-138.0.0 - Fixed system hang when boot systemd on spacemit k3 - riscv: perf vendor events: fix lrw core PMU event mapping - !20727 v2 bpf: sockmap fixes - !20741 scsi: qla2xxx: Sanitize payload size to prevent member overflow - !20744 fix CVE-2025-38449 - !20763 net: usb: asix: validate PHY address before use - !20762 smc91x: fix broken irq-context in PREEMPT_RT - !20293 [Hygon][6.6][EDAC] The width of hash value is 2 bits for Hygon family 18h model 6h processors - !20290 [Hygon][6.6][Bugfix] Bug fix for EDAC to use unicast instead of broadcast on hygon family 18h model 4h - !20289 [Hygon][6.6][Bugfix] Bug fix for EDAC to correct the address translation on hygon family 18h model 4h - !20245 KVM: arm64: Refactor exit handlers - !20246 KVM: arm64: Mark some header functions as inline - !19005 [Hygon] [OLK-6.6] [Bugfix] Fix memory bandwidth counter width for Hygon QoS - !20292 [Hygon][6.6][TSC Adjust] Backport x86 TSC adjust patch - !20273 [Hygon][6.6][Bugfix] Get correct CPU LLC ID in guest for Hygon processors - !20722 [OLK-6.6][linux-6.6.y sync] Backport 6.6.104-6.6.106 LTS Patches - !20667 fix CVE-2024-50102 - !20736 netfilter: nf_tables: remove redundant chain validation on register store - !20758 ub: ubase: Fixed the alarm issue caused by the initialization of the structure variable definition. - !20721 obmm: reduce log noise for successful export/import/preimport - net: usb: asix: validate PHY address before use - smc91x: fix broken irq-context in PREEMPT_RT - !20731 devlink: rate: Unset parent pointer in devl_rate_nodes_destroy - !20732 libceph: return the handler error from mon_handle_auth_done() - !20743 mm: slub: avoid wake up kswapd in set_track_prepare - ub: ubase: Fixed the alarm issue caused by the initialization of the structure variable definition. - !20750 ub: cdma: adapted to UMMU interface changes - !20713 urma: DFX of log in kernel - urma: optimize log levels for kernel space - ub: cdma: adapted to UMMU interface changes - wifi: ath11k: avoid bit operation on key flags - drm/mediatek: fix potential OF node use-after-free - cpufreq: intel_pstate: Check IDA only before MSR_IA32_PERF_CTL writes - wifi: cfg80211: sme: store capped length in __cfg80211_connect_result() - !20708 ub:hisi-ubus: Add create bus instance ummu bypass - drm: fix kabi for struct drm_framebuffer - drm/framebuffer: Acquire internal references on GEM handles - drm/gem: Acquire references on GEM handles for framebuffers - mm: slub: avoid wake up kswapd in set_track_prepare - scsi: qla2xxx: Sanitize payload size to prevent member overflow - netfilter: nf_tables: remove redundant chain validation on register store - libceph: return the handler error from mon_handle_auth_done() - devlink: rate: Unset parent pointer in devl_rate_nodes_destroy - Documentation/hw-vuln: Add VMSCAPE documentation - dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status() - riscv: use lw when reading int cpu in asm_per_cpu - mm: slub: avoid wake up kswapd in set_track_prepare - tools: gpio: remove the include directory on make clean - tools: gpio: rm .*.cmd on make clean - drm/amd/amdgpu: Fix missing error return on kzalloc failure - drm/amdgpu: Replace DRM_* with dev_* in amdgpu_psp.c - perf bpf-event: Fix use-after-free in synthesis - drm/bridge: ti-sn65dsi86: fix REFCLK setting - spi: spi-fsl-lpspi: Clear status register after disabling the module - spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort - spi: spi-fsl-lpspi: Set correct chip-select polarity bit - spi: spi-fsl-lpspi: Fix transmissions when using CONT - hwmon: mlxreg-fan: Prevent fans from getting stuck at 0 RPM - pcmcia: omap: Add missing check for platform_get_resource - Revert "drm/amdgpu: Avoid extra evict-restore process." - ALSA: hda/realtek: Fix headset mic for TongFang X6[AF]R5xxY - ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model - drm/mediatek: Fix device/node reference count leaks in mtk_drm_get_all_drm_priv - drm/mediatek: Fix using wrong drm private data to bind mediatek-drm - drm/mediatek: Add crtc path enum for all_drm_priv array - vmxnet3: update MTU after device quiesce - net: dsa: microchip: linearize skb for tail-tagging switches - net: dsa: microchip: update tag_ksz masks for KSZ9477 family - dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status() - ALSA: hda/realtek - Add new HP ZBook laptop with micmute led fixup - ALSA: hda/realtek: Add support for HP Agusta using CS35L41 HDA - iio: pressure: mprls0025pa: use aligned_s64 for timestamp - iio: chemical: pms7003: use aligned_s64 for timestamp - iio: imu: inv_mpu6050: align buffer for timestamp - thermal/drivers/mediatek/lvts: Disable low offset IRQ for minimum threshold - nouveau: fix disabling the nonstall irq due to storm code - cpufreq: intel_pstate: Unchecked MSR aceess in legacy mode - net: pcs: rzn1-miic: Correct MODCTRL register offset - platform/x86/amd/pmc: Add TUXEDO IB Pro Gen10 AMD to spurious 8042 quirks list - drm/amdgpu: drop hw access in non-DC audio fini - wifi: mt76: mt7996: Initialize hdr before passing to skb_put_data() - wifi: mwifiex: Initialize the chan_stats array to zero - tcp_bpf: Fix copied value in tcp_bpf_sendmsg - skmsg: Return copied bytes in sk_msg_memcopy_from_iter - tcp_bpf: Add sk_rmem_alloc related logic for tcp_bpf ingress redirection - Revert "bpf, sockmap: Add sk_rmem_alloc check for sockmap" - ALSA: usb-audio: Add mute TLV for playback volumes on some devices - phy: mscc: Stop taking ts_lock for tx_queue and use its own lock - selftest: net: Fix weird setsockopt() in bind_bhash.c. - net: atm: fix memory leak in atm_register_sysfs when device_register fail - ax25: properly unshare skbs in ax25_kiss_rcv() - mctp: return -ENOPROTOOPT for unknown getsockopt options - net/smc: Remove validation of reserved bits in CLC Decline message - ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init() - net: thunder_bgx: decrement cleanup index before use - net: thunder_bgx: add a missing of_node_put - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() - wifi: libertas: cap SSID len in lbs_associate() - wifi: cw1200: cap SSID length in cw1200_do_join() - net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets - wifi: ath11k: fix group data packet drops during rekey - wifi: ath11k: avoid forward declaration of ath11k_mac_start_vdev_delay() - wifi: ath11k: rename ath11k_start_vdev_delay() - wifi: ath11k: Introduce and use ath11k_sta_to_arsta() - net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() - macsec: read MACSEC_SA_ATTR_PN with nla_get_uint - netlink: add variable-length / auto integers - net: macb: Fix tx_ptr_lock locking - icmp: fix icmp_ndo_send address translation for reply direction - mISDN: Fix memory leak in dsp_hwec_enable() - xirc2ps_cs: fix register access when enabling FullDuplex - netfilter: conntrack: helper: Replace -EEXIST by -EBUSY - wifi: cfg80211: fix use-after-free in cmp_bss() - arm64: dts: imx8mp: Fix missing microSD slot vqmmc on Data Modul i.MX8M Plus eDM SBC - arm64: dts: imx8mp: Fix missing microSD slot vqmmc on DH electronics i.MX8M Plus DHCOM - tee: optee: ffa: fix a typo of "optee_ffa_api_is_compatible" - arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro - Bluetooth: hci_sync: Avoid adding default advertising on startup - cpupower: Fix a bug where the -t option of the set subcommand was not working. - drm/amd/display: Don't warn when missing DCE encoder caps - cdc_ncm: Flag Intel OEM version of Fibocom L850-GL as WWAN - LoongArch: Save LBT before FPU in setup_sigcontext() - btrfs: avoid load/store tearing races when checking if an inode was logged - btrfs: fix race between setting last_dir_index_offset and inode logging - btrfs: fix race between logging inode and checking if it was logged before - bpf: Fix oob access in cgroup local storage - !20556 urma: fix update topo logic - !20639 [OLK-6.6][linux-6.6.y sync] Backport 6.6.103-6.6.104 LTS Patches - !20641 [OLK-6.6][linux-6.6.y sync] LoongArch: Add more instruction opcodes and emit_* helpers - !20560 *** fix CVE-2025-38062 *** - !20662 pNFS: Fix a deadlock when returning a delegation during open() - ub:hisi-ubus: Add create bus instance ummu bypass - Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" - Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set" - HID: mcp2221: Handle reads greater than 60 bytes - HID: mcp2221: Don't set bus speed on every transfer - net/mlx5: SF, Fix add port error handling - drm/nouveau/disp: Always accept linear modifier - smb3 client: fix return code mapping of remap_file_range - net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions - dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted - HID: wacom: Add a new Art Pen 2 - HID: logitech: Add ids for G PRO 2 LIGHTSPEED - HID: quirks: add support for Legion Go dual dinput modes - net: stmmac: Set CIC bit only for TX queues with COE - net: stmmac: xgmac: Correct supported speed modes - net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts - net/mlx5e: Set local Xoff after FW update - net/mlx5e: Update and set Xon/Xoff upon port speed set - net/mlx5e: Update and set Xon/Xoff upon MTU set - net/mlx5: Nack sync reset when SFs are present - net/mlx5: Convert SF port_indices xarray to function_ids xarray - net/mlx5: Use devlink port pointer to get the pointer of container SF struct - net/mlx5: Call mlx5_sf_id_erase() once in mlx5_sf_dealloc() - phy: mscc: Fix when PTP clock is register and unregister - net: dlink: fix multicast stats being counted incorrectly - dt-bindings: display/msm: qcom,mdp5: drop lut clock - drm/nouveau: remove unused memory target test - drm/nouveau: remove unused increment in gm200_flcn_pio_imem_wr - Bluetooth: hci_sync: fix set_local_name race condition - Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced - Bluetooth: hci_event: Mark connection as closed during suspend disconnect - Bluetooth: hci_event: Treat UNKNOWN_CONN_ID on disconnect as success - HID: input: report battery status changes immediately - HID: input: rename hidinput_set_battery_charge_status() - powerpc/kvm: Fix ifdef to remove build warning - drm/msm: Defer fd_install in SUBMIT ioctl - vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() - ACPI: EC: Add device to acpi_ec_no_wakeup[] qurik list - erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC - ASoC: codecs: tx-macro: correct tx_macro_component_drv name - smb: client: fix race with concurrent opens in unlink(2) - scsi: core: sysfs: Correct sysfs attributes access rights - of: dynamic: Fix use after free in of_changeset_add_prop_helper() - of: Add a helper to free property struct - mips: lantiq: xway: sysctrl: rename the etop node - mips: dts: lantiq: danube: add missing burst length property - pinctrl: STMFX: add missing HAS_IOMEM dependency - of: dynamic: Fix memleak when of_pci_add_properties() failed - !20684 urma: adjust urma log format - !20355 udp: Deal with race between UDP socket address change and rehash - !20627 Fixes CVE-2025-38627 - !20702 CVE-2025-39948 - !20701 netfilter: ctnetlink: remove refcounting in expectation dumpers - !20700 CVE-2025-38678 - !20703 CVE-2025-38491 - !20690 tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. - obmm: reduce log noise for successful export/import/preimport - mptcp: avoid deadlock on fallback while reinjecting - mptcp: plug races between subflow fail and subflow creation - mptcp: make fallback action and fallback decision atomic - ice: fix Rx page leak on multi-buffer frames - ice: fix incorrect counter for buffer allocation failures - ice: stop storing XDP verdict within ice_rx_buf - ice: gather page_count()'s of each frag right before XDP prog call - ice: Introduce ice_xdp_buff - netfilter: ctnetlink: remove refcounting in expectation dumpers - netfilter: nf_tables: reject duplicate device on updates - netfilter: nf_tables: Introduce functions freeing nft_hook objects - netfilter: nf_tables: Fix percpu address space issues in nf_tables_api.c - err.h: add ERR_PTR_PCPU(), PTR_ERR_PCPU() and IS_ERR_PCPU() macros - tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. - !20498 Fix CVE-2025-71118 - !20608 pmdomain: arm: scmi: Fix genpd leak on provider registration failure - !20679 x86/CPU/AMD: Add RDSEED fix for Zen5 - !20650 fix cve-2025-40300 - !20661 Input: alps - fix use-after-free bugs caused by dev3_register_work - !20664 backport some net bugfix from 6.6 lts - urma: adjust urma log format - !20678 ub: udma: close debug switch load parameters. - ub: udma: close debug switch load parameters. - x86/CPU/AMD: Add RDSEED fix for Zen5 - !20630 net: LTS-6.6 bugfix backport - !20632 net/sched: sch_qfq: do not free existing class in qfq_change_class() - !20631 macvlan: fix possible UAF in macvlan_forward_source() - !20628 Fix CVE-2025-39910 - !20659 v2 Fix CVE-2025-22090 - !20506 XSched: Update XSched manual - !20647 media: imon: make send_packet() more robust - !20646 ksm: use range-walk function to jump over holes in scan_get_next_rmap_item - !20645 fbcon: Set fb_display[i - !20648 parse_longname(): strrchr() expects NUL-terminated string - !20621 urma: modify log level - !20602 urma: fix the jfe uaf issue that occurred during the killall process. - !20567 urma:change log level and pass status 9 - !20640 iio: common: st_sensors: Fix use of uninitialize device structs - !20634 usb: gadget: udc: fix use-after-free in usb_gadget_state_work - !20633 net: dsa: properly keep track of conduit reference - !20635 fix CVE-2025-68231 - !20651 mm/slub: avoid accessing metadata when pointer is invalid in object_err() - !20649 drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb - !20652 mm/vmalloc: fix data race in show_numa_info() - x86: uaccess: don't use runtime-const rewriting in modules - x86: fix off-by-one in access_ok() - x86: fix user address masking non-canonical speculation issue - x86/uaccess: Zero the 8-byte get_range case on failure on 32-bit - x86/uaccess: Improve the 8-byte getuser() case - x86: fix whitespace in runtime-const assembler output - dcache: keep dentry_hashtable or d_hash_shift even when not used - runtime constants: add x86 architecture support - runtime constants: deal with old decrepit linkers - x86/uaccess: Add missing __force to casts in __access_ok() and valid_user_address() - !20345 arm64: entry: xcall/xint: make asm conditionals compatible with clang IAS - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). - libceph: replace BUG_ON with bounds check for map->max_osd - libceph: prevent potential out-of-bounds writes in handle_auth_session_key() - libceph: fix potential use-after-free in have_mon_and_osd_map() - sctp: Hold sock lock while iterating over address list - sctp: Prevent TOCTOU out-of-bounds write - sctp: Hold RCU read lock while iterating over address list - tipc: Fix use-after-free in tipc_mon_reinit_self(). - sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto - sctp: avoid NULL dereference when chunk data buffer is missing - bpf: Explicitly check accesses to bpf_sock_addr - ipvs: Defer ip_vs_ftp unregister during netns cleanup - nexthop: Forbid FDB status change while nexthop is in a group - netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). - net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer - sctp: initialize more fields in sctp_v6_from_sk() - pNFS: Fix a deadlock when returning a delegation during open() - Input: alps - fix use-after-free bugs caused by dev3_register_work - x86/cpu: Get CPU LLC ID from CPUID 0x8000001d in guest for Hygon processors - kernel/fork: only call untrack_pfn_clear() on VMAs duplicated for fork() - mm: (un)track_pfn_copy() fix + doc improvements - x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range() - !20642 mtdchar: fix integer overflow in read/write ioctls - mm/vmalloc: fix data race in show_numa_info() - mm/slub: avoid accessing metadata when pointer is invalid in object_err() - config: enable CONFIG_MITIGATION_VMESCAPE by default on x86 - x86/vmscape: Enable the mitigation - x86/vmscape: Enumerate VMSCAPE bug - x86/vmscape: Add conditional IBPB mitigation - drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb - parse_longname(): strrchr() expects NUL-terminated string - media: imon: make send_packet() more robust - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item - fbcon: Set fb_display[i]->mode to NULL when the mode is released - !20569 CVE-2024-35808 - mtdchar: fix integer overflow in read/write ioctls - !20619 Fix CVE-2026-22991 - !20612 net: hns3: extend HCLGE_FD_AD_COUNTER_NUM to 8 bits - LoongArch: Add more instruction opcodes and emit_* helpers - iio: common: st_sensors: Fix use of uninitialize device structs - !20581 null_blk: fix kmemleak by releasing references to fault configfs items - mm/mempool: fix poisoning order>0 pages with HIGHMEM - mm/page_poison: replace kmap_atomic() with kmap_local_page() - mm/mempool: replace kmap_atomic() with kmap_local_page() - usb: gadget: udc: fix use-after-free in usb_gadget_state_work - net: dsa: properly keep track of conduit reference - net/sched: sch_qfq: do not free existing class in qfq_change_class() - macvlan: fix possible UAF in macvlan_forward_source() - netfilter: nft_objref: validate objref and objrefmap expressions - arp: do not assume dev_hard_header() does not change skb->head - ip6_gre: make ip6gre_header() robust - netfilter: nf_tables: avoid chain re-validation if possible - netfilter: nf_tables: drop unused 3rd argument from validate callback ops - Revert "netfilter: nft_objref: validate objref and objrefmap expressions" - bpf: Fix reference count leak in bpf_prog_test_run_xdp() - net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset - ethtool: Avoid overflowing userspace buffer on stats query - ipvs: fix ipv4 null-ptr-deref in route error path - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() - !20596 mm/page_alloc: prevent pcp corruption with SMP=n - !20598 team: fix check for port enabled in team_queue_override_port_prio_changed() - !18823 hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio - mm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc() - kasan: avoid sleepable page allocation from atomic context - f2fs: compress: fix UAF of f2fs_inode_info in f2fs_free_dic - f2fs: compress: change the first parameter of page_array_{alloc,free} to sbi - !20583 [OLK-6.6][linux-6.6.y sync] Backport 6.6.102-6.6.103 LTS Patches - !20460 fbdev: Fix vmalloc out-of-bounds write in fast_imageblit - urma:fix log level and pass status 9 - urma: modify log level - !20592 CVE-2025-71141 fixup - !20594 CVE-2025-39744 fixup - !20607 powerpc/64s/slb: Fix SLB multihit issue during SLB preload - !20606 mm/huge_memory: fix NULL pointer deference when splitting folio - !20604 Fix CVE-2026-22984 - !20603 Fix CVE-2026-23021 - !20600 Fix CVE-2026-22990 - urma: fix the jfe uaf issue that occurred during the killall process. - !20380 pswiotlb: Adapt to the IOMMU DMA API upgraded by IOMMUFD - libceph: make free_choose_arg_map() resilient to partial allocation - drm/dp: Change AUX DPCD probe address from LANE0_1_STATUS to TRAINING_PATTERN_SET - net: hns3: extend HCLGE_FD_AD_COUNTER_NUM to 8 bits - net: hns3: extend HCLGE_FD_AD_QID to 11 bits - net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue - net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M - Revert "net: hns3: add support for FD counter" - !20587 dmaengine: stm32: dmamux: fix device leak on route allocation - pmdomain: arm: scmi: Fix genpd leak on provider registration failure - powerpc/64s/slb: Fix SLB multihit issue during SLB preload - mm/huge_memory: fix NULL pointer deference when splitting folio - !20562 LoongArch: BPF: Sign extend kfunc call arguments - !20470 ipv4: Fix reference count leak when using error routes with nexthop objects - !20471 net: sock: fix hardened usercopy panic in sock_recv_errqueue - !20472 net: fix memory leak in skb_segment_list for GRO packets - !20473 ipv4: ip_gre: make ipgre_header() robust - !20469 SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf - !20476 ipv6: Fix use-after-free in inet6_addr_del(). - !20477 svcrdma: bound check rq_pages index in inline path - !20578 ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() - !20579 fix CVE-2025-68768 - !20542 Fix NFS deadlock - USB: storage: Remove subclass and protocol overrides from Novatek quirk - cpuidle: governors: menu: Select polling state in some more cases - cpuidle: governors: menu: Rearrange main loop in menu_select() - cpuidle: menu: Update documentation after previous changes - Revert "drm/tegra: dsi: Clear enable register if powered by bootloader" - parisc: Remove spurious if statement from raw_copy_from_user() - ata: libata-scsi: Fix system suspend for a security locked drive - Revert "drm/amdgpu: fix incorrect vm flags to map bo" - mfd: axp20x: Set explicit ID for regulator cell if no IRQ line is present - drm/amd/display: use udelay rather than fsleep - sched/fair: Revert max_newidle_lb_cost bump - net: ipv4: fix regression in local-broadcast routes - tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers - PM: runtime: Do not clear needs_force_resume with enabled runtime PM - usb: typec: ucsi: psy: Set max current to zero when disconnected - io_uring/rw: cast rw->flags assignment to rwf_t - Documentation: ACPI: i2c-muxes: fix I2C device references - s390/hypfs: Enable limited access during lockdown - s390/hypfs: Avoid unnecessary ioctl registration in debugfs - ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation - net/mlx5e: Preserve shared buffer capacity during headroom updates - net/mlx5: Base ECVF devlink port attrs from 0 - Octeontx2-af: Skip overlap check for SPI field - bonding: send LACPDUs periodically in passive mode after receiving partner's LACPDU - bonding: Add independent control state machine - bonding: update LACP activity flag after setting lacp_active - net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate - ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc - gve: prevent ethtool ops after shutdown - phy: mscc: Fix timestamping for vsc8584 - net: ethernet: mtk_ppe: add RCU lock around dev_fill_forward_path - ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add - net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM - ALSA: usb-audio: Fix size validation in convert_chmap_v3() - mlxsw: spectrum: Forward packets with an IPv4 link-local source IP - Bluetooth: hci_conn: do return error from hci_enhanced_setup_sync() - Bluetooth: hci_event: fix MTU for BN == 0 in CIS Established - scsi: qla4xxx: Prevent a potential error pointer dereference - RDMA/bnxt_re: Fix to initialize the PBL array - RDMA/bnxt_re: Fix to remove workload check in SRQ limit path - RDMA/bnxt_re: Fix to do SRQ armena by default - RDMA/erdma: Fix ignored return value of init_kernel_qp - iosys-map: Fix undefined behavior in iosys_map_clear() - cgroup/cpuset: Use static_branch_enable_cpuslocked() on cpusets_insane_config_key - spi: spi-fsl-lpspi: Clamp too high speed_hz - usb: typec: maxim_contaminant: disable low power mode when reading comparator values - usb: typec: maxim_contaminant: re-enable cc toggle if cc is open and port is clean - iio: imu: inv_icm42600: change invalid data error to -EBUSY - iio: imu: inv_icm42600: Convert to uXX and sXX integer types - iio: imu: inv_icm42600: use = { } instead of memset() - iio: imu: inv_icm42600: switch timestamp type from int64_t __aligned(8) to aligned_s64 - iio: temperature: maxim_thermocouple: use DMA-safe buffer for spi_read() - iio: light: as73211: Ensure buffer holes are zeroed - tls: fix handling of zero-length records on the rx_list - powerpc/boot: Fix build with gcc 15 - mmc: sdhci-pci-gli: GL9763e: Mask the replay timer timeout of AER - compiler: remove __ADDRESSABLE_ASM{_STR,}() again - drm/amd/display: Don't overclock DCE 6 by 15% - usb: dwc3: pci: add support for the Intel Wildcat Lake - usb: dwc3: Ignore late xferNotReady event to prevent halt timeout - USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles - usb: storage: realtek_cr: Use correct byte order for bcs->Residue - USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera - usb: renesas-xhci: Fix External ROM access timeouts - usb: core: hcd: fix accessing unmapped memory in SINGLE_STEP_SET_FEATURE test - comedi: Make insn_rw_emulate_bits() do insn->n samples - usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive - cdx: Fix off-by-one error in cdx_rpmsg_probe() - most: core: Drop device reference after usage in get_channel() - iio: proximity: isl29501: fix buffered read on big-endian systems - iio: pressure: bmp280: Use IS_ERR() in bmp280_common_probe() - fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable() - drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS - cpuidle: governors: menu: Avoid selecting states with too much latency - cpuidle: menu: Remove iowait influence - mmc: sdhci-pci-gli: Add a new function to simplify the code - mmc: sdhci-pci-gli: Use PCI AER definitions, not hard-coded values - mptcp: disable add_addr retransmission when timeout is 0 - mptcp: remove duplicate sk_reset_timer call - use uniform permission checks for all mount propagation changes - arm64: dts: ti: k3-am62-main: Remove eMMC High Speed DDR support - scsi: mpi3mr: Serialize admin queue BAR writes on 32-bit systems - scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers - scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE - PCI: imx6: Add IMX8MM_EP and IMX8MP_EP fixed 256-byte BAR 4 in epc_features - PCI: imx6: Delay link start until configfs 'start' written - PCI: rockchip: Set Target Link Speed to 5.0 GT/s before retraining - PCI: rockchip: Use standard PCIe definitions - drm/amd/display: Fill display clock and vblank time in dce110_fill_display_configs - drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs - drm/amd/display: Fix DP audio DTO1 clock source on DCE 6. - drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3 - ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and EliteBook 830 G6 - mm/debug_vm_pgtable: clear page table entries at destroy_args() - squashfs: fix memory leak in squashfs_fill_super - mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for consistency - memstick: Fix deadlock by moving removing flag earlier - KVM: arm64: Fix kernel BUG() due to bad backport of FPSIMD/SVE/SME fix - sched/fair: Fix frequency selection for non-invariant case - kbuild: userprogs: use correct linker when mixing clang and GNU ld - ata: libata-scsi: Return aborted command when missing sense and result TF - PM: runtime: Take active children into account in pm_runtime_get_if_in_use() - PM: runtime: Simplify pm_runtime_get_if_active() usage - ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig - usb: dwc3: imx8mp: fix device leak at unbind - wifi: mac80211: check basic rates validity in sta_link_apply_parameters - KVM: x86: Take irqfds.lock when adding/deleting IRQ bypass producer - s390/mm: Remove possible false-positive warning in pte_free_defer() - btrfs: send: make fs_path_len() inline and constify its argument - btrfs: send: use fallocate for hole punching with send stream v2 - btrfs: send: avoid path allocation for the current inode when issuing commands - btrfs: send: keep the current inode's path cached - btrfs: send: add and use helper to rename current inode when processing refs - btrfs: send: only use boolean variables at process_recorded_refs() - btrfs: send: factor out common logic when sending xattrs - btrfs: populate otime when logging an inode item - btrfs: constify more pointer parameters - btrfs: fix ssd_spread overallocation - btrfs: open code timespec64 in struct btrfs_inode - xfs: fully decouple XFS_IBULK* flags from XFS_IWALK* flags - btrfs: abort transaction on unexpected eb generation at btrfs_copy_root() - btrfs: always abort transaction on failure to add block group to free space tree - btrfs: move transaction aborts to the error site in add_block_group_free_space() - btrfs: qgroup: fix race between quota disable and quota rescan ioctl - usb: typec: fusb302: cache PD RX state - block: Make REQ_OP_ZONE_FINISH a write operation - block: reject invalid operation in submit_bio_noacct - leds: flash: leds-qcom-flash: Fix registry access after re-bind - leds: flash: leds-qcom-flash: Limit LED current based on thermal condition - selftests/memfd: add test for mapping write-sealed memfd read-only - mm: update memfd seal write check to include F_SEAL_WRITE - mptcp: pm: kernel: flush: do not reset ADD_ADDR limit - mptcp: drop skb if MPTCP skb extension allocation fails - ipv6: sr: Fix MAC comparison to be constant-time - drm/amd/display: Don't overwrite dce60_clk_mgr - drm/amd/display: Add primary plane to commits for correct VRR handling - drm/amdkfd: Destroy KFD debugfs after destroy KFD wq - drm/amdgpu: update mmhub 3.0.1 client id mappings - drm/amdgpu: Avoid extra evict-restore process. - drm/amd: Restore cached power limit during resume - media: venus: venc: Clamp param smaller than 1fps and bigger than 240 - media: venus: vdec: Clamp param smaller than 1fps and bigger than 240. - media: venus: protect against spurious interrupts during probe - media: venus: hfi: explicitly release IRQ during teardown - media: qcom: camss: cleanup media device allocated resource on error path - media: ov2659: Fix memory leaks in ov2659_probe() - media: usbtv: Lock resolution while streaming - media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free() - media: verisilicon: Fix AV1 decoder clock frequency - media: vivid: fix wrong pixel_array control size - media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init() - media: hi556: correct the test pattern configuration - media: gspca: Add bounds checking to firmware parser - parisc: Update comments in make_insert_tlb - parisc: Try to fixup kernel exception in bad_area_nosemaphore path of do_page_fault() - parisc: Rename pte_needs_flush() to pte_needs_cache_flush() in cache.c - parisc: Makefile: explain that 64BIT requires both 32-bit and 64-bit compilers - parisc: Define and use set_pte_at() - parisc: Check region is readable by user in raw_copy_from_user() - soc/tegra: pmc: Ensure power-domains are in a known state - f2fs: fix to avoid out-of-boundary access in dnode page - phy: qcom: phy-qcom-m31: Update IPQ5332 M31 USB phy initialization sequence - vhost/vsock: Avoid allocating arbitrarily-sized SKBs - PCI: endpoint: Fix configfs group removal on driver teardown - PCI: endpoint: Fix configfs group list head handling - mtd: rawnand: renesas: Add missing check after DMA map - mtd: rawnand: fsmc: Add missing check after DMA map - mtd: spinand: propagate spinand_wait() errors from spinand_write_page() - mtd: spi-nor: Fix spi_nor_try_unlock_all() - hwmon: (gsc-hwmon) fix fan pwm setpoint show functions - pwm: mediatek: Fix duty and period setting - pwm: mediatek: Handle hardware enable and clock enable separately - pwm: imx-tpm: Reset counter if CMOD is 0 - wifi: ath11k: fix dest ring-buffer corruption when ring is full - wifi: ath11k: fix source ring-buffer corruption - wifi: ath11k: fix dest ring-buffer corruption - wifi: ath12k: fix dest ring-buffer corruption when ring is full - wifi: ath12k: fix source ring-buffer corruption - wifi: ath12k: fix dest ring-buffer corruption - wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table() - iio: adc: ad_sigma_delta: change to buffer predisable - zynq_fpga: use sgtable-based scatterlist wrappers - scsi: ufs: ufs-pci: Fix default runtime and system PM levels - scsi: ufs: ufs-pci: Fix hibernate state transition for Intel MTL-like host controllers - ata: libata-scsi: Fix ata_to_sense_error() status handling - scsi: mpi3mr: Fix race between config read submit and interrupt completion - dt-bindings: display: sprd,sharkl3-dsi-host: Fix missing clocks constraints - dt-bindings: display: sprd,sharkl3-dpu: Fix missing clocks constraints - arm64: dts: ti: k3-am62-verdin: Enable pull-ups on I2C buses - arm64: dts: ti: k3-am62a7-sk: fix pinmux for main_uart1 - arm64: dts: ti: k3-pinctrl: Enable Schmitt Trigger by default - btrfs: zoned: fix write time activation failure for metadata block group - ext4: fix hole length calculation overflow in non-extent inodes - ext4: don't try to clear the orphan_present feature block device is r/o - ext4: fix reserved gdt blocks handling in fsmap - ext4: fix fsmap end of range reporting with bigalloc - ext4: check fast symlink for ea_inode correctly - tracing: fprobe-event: Sanitize wildcard for fprobe event name - crypto: qat - lower priority for skcipher and aead algorithms - lib/crypto: mips/chacha: Fix clang build and remove unneeded byteswap - vt: defkeymap: Map keycodes above 127 to K_HOLE - vt: keyboard: Don't process Unicode characters in K_OFF mode - bus: mhi: host: Fix endianness of BHI vector table - usb: dwc3: meson-g12a: fix device leaks at unbind - usb: musb: omap2430: fix device leak at unbind - usb: gadget: udc: renesas_usb3: fix device leak at unbind - usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init() - m68k: Fix lost column on framebuffer debug console - platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister() - cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table() - rcu: Fix racy re-initialization of irq_work causing hangs - HID: apple: avoid setting up battery timer for devices without battery - HID: magicmouse: avoid setting up battery timer when not needed - RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages - tools/nolibc: fix spelling of FD_SETBITMASK in FD_* macros - media: uvcvideo: Do not mark valid metadata as invalid - media: venus: Fix OOB read due to missing payload bound check - parisc: Makefile: fix a typo in palo.conf - fbdev: Fix vmalloc out-of-bounds write in fast_imageblit - btrfs: do not allow relocation of partially dropped subvolumes - btrfs: zoned: do not select metadata BG as finish target - btrfs: clear dirty status from extent buffer on error at insert_new_root() - btrfs: zoned: do not remove unwritten non-data block group - btrfs: abort transaction during log replay if walk_log_tree() failed - btrfs: zoned: use filesystem size not disk size for reclaim decision - cdc-acm: fix race between initial clearing halt and open - thunderbolt: Fix copy+paste error in match_service_id() - usb: typec: ucsi: Update power_supply on power role change - misc: rtsx: usb: Ensure mmc child device is active when card is present - iommufd: Report unmapped bytes in the error path of iopt_unmap_iova_range - cifs: reset iface weights when we cannot find a candidate - drm/amdgpu: fix incorrect vm flags to map bo - scsi: lpfc: Remove redundant assignment to avoid memory leak - rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe - pNFS: Handle RPC size limit for layoutcommits - pNFS: Fix disk addr range check in block/scsi layout - pNFS: Fix stripe mapping in block/scsi layout - ASoC: Intel: avs: Fix uninitialized pointer error in probe() - net: phy: smsc: add proper reset flags for LAN8710A - ipmi: Fix strcpy source and destination the same - kconfig: lxdialog: fix 'space' to (de)select options - kconfig: gconf: fix potential memory leak in renderer_edited() - kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed() - ipmi: Use dev_warn_ratelimited() for incorrect message warnings - vfio/mlx5: fix possible overflow in tracking max message size - scsi: aacraid: Stop using PCI_IRQ_AFFINITY - scsi: target: core: Generate correct identifiers for PR OUT transport IDs - scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans - kconfig: nconf: Ensure null termination where strncpy is used - vfio/type1: conditional rescheduling while pinning - kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c - f2fs: check the generic conditions first - exfat: add cluster chain loop check for dir - i2c: Force DLL0945 touchpad i2c freq to 100khz - apparmor: use the condition in AA_BUG_FMT even with debug disabled - dm-table: fix checking for rq stackable devices - dm-mpath: don't print the "loaded" message if registering fails - i3c: master: Initialize ret in i3c_i2c_notifier_call() - i3c: don't fail if GETHDRCAP is unsupported - apparmor: shift ouid when mediating hard links in userns - rtc: ds1307: handle oscillator stop flag (OSF) for ds1341 - i3c: add missing include to internal header - module: Prevent silent truncation of module name in delete_module(2) - md: dm-zoned-target: Initialize return variable r to avoid uninitialized use - soundwire: Move handle_nested_irq outside of sdw_dev_lock - soundwire: amd: serialize amd manager resume sequence during pm_prepare - crypto: octeontx2 - add timeout for load_fvc completion poll - media: uvcvideo: Fix bandwidth issue for Alcor camera - media: usb: hdpvr: disable zero-length read messages - media: tc358743: Increase FIFO trigger level to 374 - media: tc358743: Return an appropriate colorspace from tc358743_set_fmt - media: tc358743: Check I2C succeeded during probe - pinctrl: stm32: Manage irq affinity settings - scsi: mpi3mr: Correctly handle ATA device errors - scsi: mpt3sas: Correctly handle ATA device errors - power: supply: qcom_battmgr: Add lithium-polymer entry - RDMA/core: reduce stack using in nldev_stat_get_doit() - dmaengine: stm32-dma: configure next sg only if there are more than 2 sgs - leds: leds-lp50xx: Handle reg to get correct multi_index - media: v4l2-common: Reduce warnings about missing V4L2_CID_LINK_FREQ control - MIPS: lantiq: falcon: sysctrl: fix request memory check logic - crypto: jitter - fix intermediary handling - watchdog: iTCO_wdt: Report error if timeout configuration fails - MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free} - clk: qcom: ipq5018: keep XO clock always on - hwmon: (emc2305) Set initial PWM minimum value during probe based on thermal state - watchdog: dw_wdt: Fix default timeout - fs/orangefs: use snprintf() instead of sprintf() - phy: rockchip-pcie: Properly disable TEST_WRITE strobe signal - mfd: axp20x: Set explicit ID for AXP313 regulator - clk: tegra: periph: Fix error handling and resolve unsigned compare warning - fbdev: fix potential buffer overflow in do_register_framebuffer() - cifs: Fix calling CIFSFindFirst() for root path without msearch - watchdog: sbsa: Adjust keepalive timeout to avoid MediaTek WS0 race condition - drm/amd/display: Avoid configuring PSR granularity if PSR-SU not supported - drm/amd/display: Only finalize atomic_obj if it was initialized - vhost: fail early when __vhost_add_used() fails - vsock/virtio: Resize receive buffers so that each SKB fits in a 4K page - net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325 - rcu: Fix rcu_read_unlock() deadloop due to IRQ work - drm/amd/display: Avoid trying AUX transactions on disconnected ports - selftests/bpf: Fix a user_ringbuf failure with arm64 64KB page size - bpf: Make reg_not_null() true for CONST_PTR_TO_MAP - uapi: in6: restore visibility of most IPv6 socket options - drm/ttm: Should to return the evict error - drm: renesas: rz-du: mipi_dsi: Add min check for VCLK range - net: ncsi: Fix buffer overflow in fetching version id - ionic: clean dbpage in de-init - wifi: rtlwifi: fix possible skb memory leak in _rtl_pci_init_one_rxdesc() - ptp: Use ratelimite for freerun error message - bpftool: Fix JSON writer resource leak in version command - net: dsa: b53: prevent SWITCH_CTRL access on BCM5325 - net: dsa: b53: prevent DIS_LEARNING access on BCM5325 - net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325 - net: dsa: b53: fix b53_imp_vlan_setup for BCM5325 - gve: Return error for unknown admin queue command - net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs - net: vlan: Make is_vlan_dev() a stub when VLAN is not configured - drm/amd: Allow printing VanGogh OD SCLK levels without setting dpm to manual - dpaa_eth: don't use fixed_phy_change_carrier - wifi: iwlegacy: Check rate_idx range after addition - netmem: fix skb_frag_address_safe with unreadable skbs - powerpc: floppy: Add missing checks after DMA map - wifi: ath12k: Decrement TID on RX peer frag setup error handling - wifi: ath12k: Enable REO queue lookup table feature on QCN9274 hw2.0 - wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`. - wifi: mac80211: update radar_required in channel context after channel switch - drm/amd/display: Fix 'failed to blank crtc!' - wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect - wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd() - wifi: ath12k: Add memset and update default rate value in wmi tx completion - drm/amd/display: Separate set_gsl from set_gsl_source_select - net: fec: allow disable coalescing - net: atlantic: add set_power to fw_ops for atl2 to fix wol - net: thunderbolt: Fix the parameter passing of tb_xdomain_enable_paths()/tb_xdomain_disable_paths() - net: thunderbolt: Enable end-to-end flow control also in transmit - kselftest/arm64: Specify SVE data when testing VL set in sve-ptrace - wifi: mt76: mt7915: mcu: re-init MCU before loading FW patch - wifi: rtw89: Disable deep power saving for USB/SDIO - wifi: rtw89: Fix rtw89_mac_power_switch() for USB - drm/msm: use trylock for debugfs - wifi: mac80211: fix rx link assignment for non-MLO stations - ipv6: mcast: Check inet6_dev->dead under idev->mc_lock in __ipv6_dev_mc_inc(). - (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer - wifi: mac80211: don't complete management TX on SAE commit - sched/fair: Bump sd->max_newidle_lb_cost when newidle balance fails - s390/stp: Remove udelay from stp_sync_clock() - wifi: iwlwifi: mvm: fix scan request validation - um: Re-evaluate thread flags repeatedly - wifi: iwlwifi: mvm: set gtk id also in older FWs - perf/cxlpmu: Remove unintended newline from IRQ name format string - net: phy: micrel: Add ksz9131_resume() - net: thunderx: Fix format-truncation warning in bgx_acpi_match_id() - net: ipv4: fix incorrect MTU in broadcast routes - wifi: cfg80211: Fix interface type validation - net: mctp: Prevent duplicate binds - arm64: Mark kernel as tainted on SAE and SError panic - net/mlx5e: Properly access RCU protected qdisc_sleeping variable - net: ag71xx: Add missing check after DMA map - et131x: Add missing check after DMA map - wifi: rtw89: Lower the timeout in rtw89_fw_read_c2h_reg() for USB - be2net: Use correct byte order and format string for TCP seq and ack_seq - s390/time: Use monotonic clock in get_cycles() - wifi: cfg80211: reject HTC bit for management frames - ktest.pl: Prevent recursion of default variable options - wifi: ath12k: Correct tid cleanup when tid setup fails - net: usb: cdc-ncm: check for filtering capability - xen/netfront: Fix TX response spurious interrupts - Bluetooth: hci_sock: Reset cookie to zero in hci_sock_free_cookie() - powerpc/thp: tracing: Hide hugepage events under CONFIG_PPC_BOOK3S_64 - ASoC: qcom: use drvdata instead of component to keep id - ASoC: codecs: rt5640: Retry DEVICE_ID verification - iio: adc: ad7768-1: Ensure SYNC_IN pulse minimum timing requirement - ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros - ALSA: pcm: Rewrite recalculate_boundary() to avoid costly loop - platform/chrome: cros_ec_typec: Defer probe on missing EC parent - platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches - soc: qcom: mdt_loader: Actually use the e_phoff - imx8m-blk-ctrl: set ISI panic write hurry level - pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop() - usb: core: usb_submit_urb: downgrade type check - usb: typec: intel_pmc_mux: Defer probe if SCU IPC isn't present - ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4 - ASoC: hdac_hdmi: Rate limit logging on connection and disconnection - ALSA: hda: Disable jack polling at shutdown - ALSA: hda: Handle the jack polling always via a work - mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode() - mei: bus: Check for still connected devices in mei_cl_bus_dev_release() - char: misc: Fix improper and inaccurate error code returned by misc_init() - reset: brcmstb: Enable reset drivers for ARCH_BCM2835 - pps: clients: gpio: fix interrupt handling order in remove path - ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path - mmc: sdhci-msm: Ensure SD card power isn't ON when card removed - ACPI: processor: fix acpi_object initialization - PM: sleep: console: Fix the black screen issue - thermal: sysfs: Return ENODATA instead of EAGAIN for reads - PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit() - firmware: tegra: Fix IVC dependency problems - ACPI: PRM: Reduce unnecessary printing to avoid user confusion - selftests: tracing: Use mutex_unlock for testing glob filter - tools/build: Fix s390(x) cross-compilation with clang - gpio: tps65912: check the return value of regmap_update_bits() - iio: adc: ad_sigma_delta: don't overallocate scan buffer - tools/nolibc: define time_t in terms of __kernel_old_time_t - thermal/drivers/qcom-spmi-temp-alarm: Enable stage 2 shutdown when required - ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed - EDAC/synopsys: Clear the ECC counters on init - gpio: wcd934x: check the return value of regmap_update_bits() - remoteproc: imx_rproc: skip clock enable when M-core is managed by the SCU - soc: qcom: rpmh-rsc: Add RSC version 4 support - usb: xhci: Avoid showing errors during surprise removal - usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command - usb: xhci: Avoid showing warnings for dying controller - usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default - selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t - cpufreq: CPPC: Mark driver with NEED_UPDATE_LIMITS flag - platform/x86/amd: pmc: Add Lenovo Yoga 6 13ALC6 to pmc quirk list - usb: xhci: print xhci->xhc_state when queue_command failed - tracefs: Add d_delete to remove negative dentries - securityfs: don't pin dentries twice, once is enough... - fix locking in efi_secret_unlink() - ext2: Handle fiemap on empty files to prevent EINVAL - fs/ntfs3: correctly create symlink for relative path - fs/ntfs3: Add sanity check for file name - better lockdep annotations for simple_recursive_removal() - hfs: fix not erasing deleted b-tree node issue - drbd: add missing kref_get in handle_write_conflicts - udf: Verify partition map count - gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops - nvme-pci: try function level reset on init failure - smb/server: avoid deadlock when linking with ReplaceIfExists - arm64: Handle KCOV __init vs inline mismatches - ptp: prevent possible ABBA deadlock in ptp_clock_freerun() - intel_idle: Allow loading ACPI tables for any family - net: ti: icss-iep: Fix incorrect type for return value in extts_enable() - netfilter: ctnetlink: fix refcount leak on table dump - udp: also consider secpath when evaluating ipsec use for checksumming - KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs - KVM: nVMX: Check vmcs12->guest_ia32_debugctl on nested VM-Enter - KVM: VMX: Extract checking of guest's DEBUGCTL into helper - KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported - KVM: VMX: Handle forced exit due to preemption timer in fastpath - KVM: VMX: Re-enter guest in fastpath for "spurious" preemption timer exits - KVM: x86: Plumb "force_immediate_exit" into kvm_entry() tracepoint - libceph: prevent potential out-of-bounds reads in handle_auth_done() - net: usb: pegasus: fix memory leak in update_eth_regs_async() - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() - !20540 urma: added support for ipoverurma - team: fix check for port enabled in team_queue_override_port_prio_changed() - mm/page_alloc: prevent pcp corruption with SMP=n - !20528 Fix CVE-2025-71083 - KVM: nVMX: Defer SVI update to vmcs01 on EOI when L2 is active w/o VID - KVM: x86: Plumb in the vCPU to kvm_x86_ops.hwapic_isr_update() - KVM: SVM: Set RFLAGS.IF=1 in C code, to get VMRUN out of the STI shadow - smb: client: don't wait for info->send_pending == 0 on error - smb: client: let send_done() cleanup before calling smbd_disconnect_rdma_connection() - ACPI: processor: perflib: Move problematic pr->performance check - ACPI: processor: perflib: Fix initial _PPC limit application - Documentation: ACPI: Fix parent device references - fs: Prevent file descriptor table allocations exceeding INT_MAX - sunvdc: Balance device refcount in vdc_port_mpgroup_check - PCI: Extend isolated function probing to LoongArch - NFSD: detect mismatch of file handle and delegation stateid in OPEN op - net: dpaa: fix device leak when querying time stamp info - net: ti: icss-iep: fix device and OF node leaks at probe - net: mtk_eth_soc: fix device leak at probe - net: enetc: fix device and OF node leak at probe - net: gianfar: fix device leak when querying time stamp info - net: phy: micrel: fix KSZ8081/KSZ8091 cable test - gpio: mlxbf3: use platform_get_irq_optional() - gpio: mlxbf2: use platform_get_irq_optional() - gpio: virtio: Fix config space reading. - ALSA: hda/realtek: Add Framework Laptop 13 (AMD Ryzen AI 300) to quirks - ALSA: hda/realtek: Fix headset mic on HONOR BRB-X - ALSA: usb-audio: Validate UAC3 cluster segment descriptors - rcu: Fix racy re-initialization of irq_work causing hangs - rcu: Fix rcu_read_unlock() deadloop due to IRQ work - drm/tilcdc: Fix removal actions in case of failed probe - drm/tilcdc: request and mapp iomem with devres - urma: fix update topo logic - dmaengine: stm32: dmamux: fix device leak on route allocation - pswiotlb: Adapt to the IOMMU DMA API upgraded by IOMMUFD - null_blk: fix kmemleak by releasing references to fault configfs items - inet: frags: flush pending skbs in fqdir_pre_exit() - inet: frags: add inet_frag_queue_flush() - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() - md/dm-raid: don't clear MD_RECOVERY_FROZEN after setting frozen - md/dm-raid: don't call md_reap_sync_thread() directly - ACPICA: Avoid walking the Namespace if start_node is NULL - arm64: entry: xcall/xint: make asm conditionals compatible with clang IAS - LoongArch: BPF: Sign extend kfunc call arguments - genirq/msi:: Fix kabi break of struct msi_desc - genirq/msi: Store the IOMMU IOVA directly in msi_desc instead of iommu_cookie - NFS: Fix a deadlock involving nfs_release_folio() - Revert "[Huawei] Revert "NFS: fix up nfs_release_folio() to try to release the page"" - urma: added support for ipoverurma - drm/ttm: Avoid NULL pointer deref for evicted BOs - XSched: Update XSched manual - svcrdma: bound check rq_pages index in inline path - ipv6: Fix use-after-free in inet6_addr_del(). - ipv4: ip_gre: make ipgre_header() robust - net: fix memory leak in skb_segment_list for GRO packets - net: sock: fix hardened usercopy panic in sock_recv_errqueue - ipv4: Fix reference count leak when using error routes with nexthop objects - SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf - fbdev: Fix vmalloc out-of-bounds write in fast_imageblit - udp: Deal with race between UDP socket address change and rehash - EDAC/amd64: The width of hash value is 2 bits for Hygon family 18h model 6h processors - x86/tsc: Use topology_max_packages() to get package number - EDAC/amd64: Use unicast instead of broadcast to access the cs_config register - EDAC/amd64: Correct the address translation for hygon family 18h model 4h - KVM: arm64: Mark some header functions as inline - KVM: arm64: Refactor exit handlers - x86/resctrl: Fix memory bandwidth counter width for Hygon CPUs - hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio - !20820 ub/obmm: add sysfs interface for mempool statistics & bugfixes - ub/obmm: fix wrong pxm_numa parameter validation - ub/obmm: Remove unused parameters from obmm_addr_check.c - ub/obmm: Enhance mem_allocator_granu validation - ub/obmm: simplify allocator naming scheme - ub/obmm: fix allow_slow logic and optimize conti_alloc_memory - ub/obmm: add sysfs interface with fine-grained memory statistics - !20804 net: hv_netvsc: reject RSS hash key programming without RX indirection table - !20813 migrate: correct lock ordering for hugetlb file folios - !20812 libceph: make calc_target() set t->paused, not just clear it - !20719 drivers/ub/sentry: some bugfix - !20798 urma: log should not retrieve eid_idx from uctx - !20808 urma: support triple bonding device - urma: log should not retrieve eid_idx from uctx - migrate: correct lock ordering for hugetlb file folios - libceph: make calc_target() set t->paused, not just clear it - !20745 vfio platform VFIO support for hisi05a1 devices - urma: support triple bonding device - net: hv_netvsc: reject RSS hash key programming without RX indirection table - !20789 gic: Add hip09 support for HISILICON_ERRATUM_165010801 - !20726 tracing: Add recursion protection in kernel stack trace recording - !20668 irqchip/gic-v3-its: Avoid truncating memory addresses - !20795 ub: udma: support query and set qos info. - !20791 Migration/urma:optimize performance in live migration. - ub: udma: Support for UE link establishment message. - Migration/urma: optimize performance in live migration. - !20787 ub: cdma: modify the method of assigning values to the structure - !20759 ubcore: hotfix route query for port eid on the same node. - ub: udma: support query and set qos info. - Revert "ub: ubase: Support for RC saved by queue granularity" - ubcore: hotfix route query for port eid on the same node. - !20676 urma: set/get sl - !20765 urma: bugfix of UAF and double free in ubcm - !20778 ub: ubase&unic: Fixes some bugfix in resetting and dfx ability - gic: Add hip09 support for HISILICON_ERRATUM_165010801 - vfio/platform: Add CONFIG_VFIO_HISI05A1 to openeuler_defconfig and turn it on by default - vfio/platform: VFIO support for hisi05a1 devices - ub: cdma: modify the method of assigning values to the structure - urma: set/get sl - ub: ubase: support to query ub dl pkt stats and real-time peak bandwidth - ub: ubase: Support for RC saved by queue granularity - ub: ubase: Traverse mailbox AE events using interrupts and polling. - ub: ubase: Modify ubase ctrlq trace to distinguish between MUE and UE messages - net: unic: The function of dumping himac registers is added. - ub: ubase: Fix MAC is_pfc sync, optimize list ops and code style - ub: ubase: Retain the initial tm qset configuration and restore it - net: unic: Fixed an issue in the bond IP address notification and pause configuration when an exception occurs. - ub: ubase: Add a retransmission function to improve reliability. - net: unic: Increase the readability and reliability of loopback code - net: unic: Synchronize the code modify for ip management and deactivation - net: unic: Increase the readability and reliability of VLAN feature. - net: unic: Added unic DFX log information. - ub: ubase: Add and correct comments for some functions and data structures - net: unic: Notify MAMI when the bond port status changes - ub: ubase: Support for HIMAC reset during ELR reset and Optimize ELR reset - !20768 iommu/ummu-core: Fix separate page table compatibility - !20665 [OLK-6.6] Enhance CMA memory usage reporting for CSV3 - !20764 net: hns3: fix double free issue for tx spare buffer - urma: bugfix of UAF and double free in ubcm - iommu/ummu-core: Fix separate page table compatibility - net: hns3: fix double free issue for tx spare buffer - drivers/ub/sentry: fix memory leak in sentry_msg_helper - drivers/ub/sentry: initialize some variables - drivers/ub/sentry: fix potential buffer overflow in convert_str_to_smh_msg() - drivers/ub/sentry: fix potential null pointer reference in sentry_uvb_comm - drivers/ub/sentry: add input parameter verification for exported symbols - tracing: Add recursion protection in kernel stack trace recording - x86/csv: Enhance CMA memory usage reporting for CSV3 - irqchip/gic-v3-its: Avoid truncating memory addresses - change the package name of 64KB page size kernel to kernel-64k - !20704 kernel support hisi-cca-da - !20180 [virtCCA Live Migration 2]virtcca secure cvm supports live migration - !20905 v2 KVM: arm64: Fix softirq masking in FPSIMD register saving sequence - !20965 iommu/ummu: Optimized TID invalidation and tdev initialization - !20964 iommu/ummu: Support TID and EID Granularity for MPAM - !20970 ub: ubase&unic: Supporting the black box capability of the ubase&unic driver - hisi-cca-da: Start dev by rsi call - hisi-cca-da: Set ripas of the bar region as RIPAS_DEV - hisi-cca-da: Support swiotlb and realm memory use - hisi-cca-da: Add smmu info when dev attach - hisi-cca-da: Transfer realm msix access to rmm - hisi-cca-da: Support pcipc sriov capability - hisi-cca-da: Delay realm memory release to kvm_destroy_realm - hisi-cca-da: Create realm s2 host pgtable and map msi mmio to rmm - hisi-cca-da: Add cca realm s2 pgtable framework - hisi-cca-da: Use bitmap to determine whether the command can be forwarded - hisi-cca-da: Restrict Realm SMMU to stage-2 domain only - hisi-cca-da: Add cmd forward mechanism in realm smmu - hisi-cca-da: Add realm smmu event and gerror irq initialization - hisi-cca-da: Add realm smmu stream table initialization - hisi-cca-da: Add realm smmu cmdq and evtq initialization - hisi-cca-da: Add realm smmu initialization - hisi-cca-da: Add relam iommu support to iommufd - hisi-cca-da: Add realm iommu support for vfio-iommu-type1 - hisi-cca-da: Support dev map and unmap - hisi-cca-da: Support dev validate and dev start - hisi-cca-da: VFIO support ccada - hisi-cca-da: Support dev delegate and dev attach - hisi-cca-da: Support root dev delegate and dev init - hisi-cca-da: Add hisilicon extension smc and ccada cmd - hisi-cca-da: Add hisi ccada feature config - !20751 ARM CCA supports hugepage - !20944 ub: ubmempfd: supports for D2H mapping and demapping - !20888 HiSock Enhancement - ub: ubase&unic: Supporting the black box capability of the ubase&unic driver. - net: unic: Resolve the residual MAC address problem - net: unic: Optimized the code for the cmd structure and FEC function. - ub: ubase: add log for post mailbox timeout - ub: ubus: Remove black box header file to include dir - rme: Remove the secret bit of the vring desc addr - rme: improve hisi-cca data mmap and destroy method - !20943 uvb: fix wd_obtain logic err - !20942 urma: fix bond device id not release - !20892 dcache: Limit the minimal number of bucket to two - rme: isolate page when do delegation to avoid migration - rme: hisi-cca supports different levels for mapping ram - rme: rename ccal to hisi-cca - rme: support set ripas for ccal realm vm - rme: support destroy ram data for ccal realm vm - rme: support populate region for ccal realm vm - rme: support map ram for ccal realm vm - rme: support config ccal realm vm - rme: support ccal RMI calls - rme: realm vm supports wfx handler - !20952 urma: introduce ipourma module - iommu/ummu-core: Simplifies tdev initialization resources - iommu/ummu: Optimized log printing - iommu/ummu: Use passed gfp_mask in map_pages callback - uvb: fix wd_obtain logic err - !20949 ub: udma: support user ctl function. - urma: fix bond device id not release - !20901 drivers/ub/sentry: some bugfix - ub: ubmempfd: supports for D2H mapping and demapping - ub: ubmempfd: supports providing services to the QEMU process through file nodes - [virtCCA Live Migration 2]virtcca secure cvm supports live migration - urma: query priority and enable bit, support ring size configuration - urma: implement debugfs, improve boundary checks and error handling logic - urma: implement data plane interaction and statistics - urma: implement ipourma network device operations - urma: ipourma resource management - urma: ipourma resource management and err code - urma: introduce ipourma main module - iommu/ummu: Optimized the TID invalidation configuration - iommu/ummu: Optimized SVA permission table memory allocation approach - iommu/ummu: Adapt UMMU SVA interface adjustment - iommu/ummu: Support TID and EID Granularity for MPAM - !20848 [OLK-6.6] backport important bugfix for nvme driver from upstream linux-6.6.y - !20847 urma: sl resource query error - !20908 [OLK-6.6][linux-6.6.y sync] Backport 6.6.108-6.6.110 LTS Patches - !20084 Loongarch: Enable CONFIG_CRYPTO_XTS for disk encryption - !20929 PCI: Fix NVMe link speed downgrade to 2.5GT/s during hotplug - drivers/ub/sentry: fix check input parameters - ub: udma: support user ctl function. - ub: udma: support uboe function. - ub: udma: bugfix related to query aux info. - !20935 ub: ubmem_vmmu: supports IOMMU driver for the UB memory MMU in VMs - drivers/ub/sentry: do not use magic numbers - !20876 urma: Kernel-mode specific implementations file for Jetty extension interface - urma: sl resource query error - !20873 sunrpc: fix NULL pointer dereference in rpcb_register_inet6 and rpcb_register_inet4 - !20875 sunrpc: fix race in cache cleanup causing stale nextcheck time - ub: ubmem_vmmu: supports IOMMU driver for the UB memory MMU in VMs - ub: ubmem_vmmu: supports parsing and configuring the hardware node information - ub: ubmem_vmmu: HiSilicon ubmem_vmmu Architecture Implementation - !20806 Fix CVE-2025-71225 - !20896 scsi: qla2xxx: Free sp in error path to fix system crash - !20894 scsi: qla2xxx: Delay module unload while fabric scan in progress - !20893 scsi: qla2xxx: Validate sp before freeing associated memory - !20802 Fix CVE-2026-23110 - urma: Kernel-mode specific implementations file for Jetty extension interface - drivers/ub/sentry: fix memory leak in process_urma_data() - drivers/ub/sentry: initialize some variables - PCI: Fix NVMe link speed downgrade to 2.5GT/s during hotplug - !20770 ub: ubdevshm: supports the memory user to obtain and release shared memory - Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 - mm: consider non-anon swap cache folios in folio_expected_ref_count() - mm: simplify folio_expected_ref_count() - ASoC: qcom: audioreach: fix potential null pointer dereference - gcc-plugins: Remove TODO_verify_il for GCC >= 16 - crypto: sha256 - fix crash at kexec - drm/i915/backlight: Return immediately when scale() finds invalid parameters - minmax.h: remove some #defines that are only expanded once - minmax.h: simplify the variants of clamp() - minmax.h: move all the clamp() definitions after the min/max() ones - minmax.h: use BUILD_BUG_ON_MSG() for the lo < hi test in clamp() - minmax.h: reduce the #define expansion of min(), max() and clamp() - minmax.h: update some comments - minmax.h: add whitespace around operators and after commas - minmax: fix up min3() and max3() too - minmax: improve macro expansion and type checking - minmax: don't use max() in situations that want a C constant expression - minmax: simplify min()/max()/clamp() implementation - minmax: make generic MIN() and MAX() macros available everywhere - drm/ast: Use msleep instead of mdelay for edid read - gpiolib: Extend software-node support to support secondary software-nodes - ARM: bcm: Select ARM_GIC_V3 for ARCH_BRCMSTB - s390/cpum_cf: Fix uninitialized warning after backport of ce971233242b - kmsan: fix out-of-bounds access to shadow memory - afs: Fix potential null pointer dereference in afs_put_server - ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address - i40e: improve VF MAC filters accounting - i40e: add mask to apply valid bits for itr_idx - HID: asus: add support for missing PX series fn keys - drm/gma500: Fix null dereference in hdmi teardown - octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() - net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port - net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() - net: dsa: lantiq_gswip: do also enable or disable cpu port - selftests: fib_nexthops: Fix creation of non-FDB nexthops - net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS - bnxt_en: correct offset handling for IPv6 destination address - vhost: Take a reference on the task in struct vhost_task. - Bluetooth: hci_sync: Fix hci_resume_advertising_sync - ethernet: rvu-af: Remove slash from the driver name - can: peak_usb: fix shift-out-of-bounds issue - can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow - can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow - can: hi311x: populate ndo_change_mtu() to prevent buffer overflow - can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow - bpf: Reject bpf_timer for PREEMPT_RT - can: rcar_can: rcar_can_resume(): fix s2ram with PSCI - wifi: virt_wifi: Fix page fault on connect - cpufreq: Initialize cpufreq-based invariance before subsys - ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients - arm64: dts: imx8mp: Correct thermal sensor index - mm: folio_may_be_lru_cached() unless folio_test_large() - mm/gup: local lru_add_drain() to avoid lru_add_drain_all() - mm/gup: check ref_count instead of lru before migration - mm: add folio_expected_ref_count() for reference count calculation - mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked" - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions - ALSA: usb-audio: Add mute TLV for playback volumes on more devices - ALSA: usb-audio: move mixer_quirks' min_mute into common quirk - ALSA: usb-audio: Add DSD support for Comtrue USB Audio device - i2c: designware: Add quirk for Intel Xe - mmc: sdhci-cadence: add Mobileye eyeQ support - usb: core: Add 0x prefix to quirks debug output - ALSA: usb-audio: Fix build with CONFIG_INPUT=n - ALSA: usb-audio: Convert comma to semicolon - ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 - ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks - ALSA: usb-audio: Simplify NULL comparison in mixer_quirks - ALSA: usb-audio: Avoid multiple assignments in mixer_quirks - ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks - ALSA: usb-audio: Fix block comments in mixer_quirks - firewire: core: fix overlooked update of subsystem ABI version - scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE - !20843 [OLK-6.6][linux-6.6.y sync] Backport 6.6.107-6.6.108 LTS Patches - !20869 ub:hisi-ubus: fix bug of security smatch - !20861 CVE-2026-23163 - ub: ubdevshm: supports the memory user to obtain and release shared memory - ub: ubdevshm: supports granting and revoking shared memory permissions - ub: ubdevshm: supports the registration and deregistration of shared memory segments - ub: ubdevshm: supports the registration and deregistration - KVM: arm64: Fix softirq masking in FPSIMD register saving sequence - !20886 Fix CVE-2026-23205 - !20803 Fix CVE-2026-23112 - !20868 sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure - !20811 smb/server: fix refcount leak in smb2_open() - !20810 smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() - !20809 smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() - sunrpc: fix NULL pointer dereference in rpcb_register_inet6 and rpcb_register_inet4 - sunrpc: fix race in cache cleanup causing stale nextcheck time - scsi: qla2xxx: Free sp in error path to fix system crash - scsi: qla2xxx: Delay module unload while fabric scan in progress - scsi: qla2xxx: Validate sp before freeing associated memory - dcache: Limit the minimal number of bucket to two - !20872 Fix CVE-2026-23220 - !20846 Fix CVE-2026-23193 - !20815 Fix CVE-2026-23216 - !20859 Fix CVE-2026-23179 - !20871 CVE-2026-23096 - !20858 ub: ubase: resolve the cmdq crq overflow problem - bpf: Deprecate hisock unused kfuncs and orig ingress logic - bpf: Add local connect support for hisock - bpf: Add ipv4-mapped ipv6 addr support for hisock - bpf: Add target comm parse to hisock_cmd - bpf: Add multi port parse to hisock_cmd - bpf: Only deploy hisock in server - bpf: Apply BPF_HISOCK_INGRESS to hisock ingress - bpf: Add bpf_handle_ingress/egress_ptype kfunc - bpf: Add bpf_get_skb_ethhdr kfunc - bpf: Add bpf_set_ingress/egress_dev kfunc - bpf: Add bpf_set_ingress_dst kfunc - bpf: Add BPF_HISOCK_INGRESS attach type - cgroup: make cgroup_bpf_prog_attach work when cgroup2 is not mounted - smb: client: fix potential UAF and double free in smb2_open_file() - smb/client: fix memory leak in smb2_open_file() - !20852 ASoC: amd: fix memory leak in acp3x pdm dma ops - ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths - uacce: fix cdev handling in the cleanup path - Revert "uacce: fix for cdev memory leak" - ub:hisi-ubus: fix bug of security smatch - ub:ubus: injected route event - ub:ubus: Black Box Development - !20865 urma: urma support uboe - sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure - urma: urma support uboe - !20857 ub_fwctl driver adds support for querying some functions - ub:ub_fwctl:Add illegal verification for scc - ub:ub_fwctl:Support querying the historical status of port links - drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove - drm/amdkfd: Don't use sw fault filter if retry cam enabled - ub:ub_fwctl:Support querying firmware version numbers - ub: ub_fwctl: Support querying real-time bandwidth statistics - ub:ub_fwctl:Support querying statistical indicators at the ub port and uboe port levels - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() - !20854 [URMA] add ping server for urma_ping - urma: add ping server - ub: ubase: resolve the cmdq crq overflow problem - ub: ubase: Optimized the QoS code naming to improve code readability. - ub: ubase&unic: optimizing code and configuration settings. - net: unic: not support query and configure ip by control plane in UBoE - net: unic: fix the automatically enable uc guid promisc mode. - !20844 urma:kernel header of userctl - urma: Kernel-mode header file for Jetty extension interface - ASoC: amd: fix memory leak in acp3x pdm dma ops - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() - phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again) - ACPICA: Work around bogus -Wstringop-overread warning since GCC 11 - !20835 Fix CVE-2026-23084 - minmax: add a few more MIN_T/MAX_T users - minmax: simplify and clarify min_t()/max_t() implementation - minmax: avoid overly complicated constant expressions in VM code - rtc: pcf2127: fix SPI command byte for PCF2131 backport - xhci: dbc: Fix full DbC transfer ring after several reconnects - xhci: dbc: decouple endpoint allocation from initialization - phy: ti: omap-usb2: fix device leak at unbind - phy: Use device_get_match_data() - drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path - ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message - ASoC: wm8974: Correct PLL rate rounding - ASoC: wm8940: Correct typo in control name - ASoC: wm8940: Correct PLL rate rounding - io_uring: include dying ring in task_work "should cancel" state - io_uring: backport io_should_terminate_tw() - ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx - selftests: mptcp: avoid spurious errors on TCP disconnect - selftests: mptcp: connect: catch IO errors on listen side - rds: ib: Increment i_fastreg_wrs before bailing out - KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active - mmc: mvsdio: Fix dma_unmap_sg() nents value - ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S - ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface - btrfs: tree-checker: fix the incorrect inode ref size check - iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page() - LoongArch: Check the return value when creating kobj - LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled - LoongArch: Update help info of ARCH_STRICT_ALIGN - nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* - octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() - net: liquidio: fix overflow in octeon_init_instr_queue() - bonding: don't set oif to bond dev when getting NS target destination - net/mlx5e: Consider aggregated port speed during rate configuration - i40e: remove redundant memory barrier when cleaning Tx descs - net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure - selftests: mptcp: sockopt: fix error messages - mptcp: tfo: record 'deny join id0' info - mptcp: set remote_deny_join_id0 on SYN recv - dpaa2-switch: fix buffer pool seeding for control traffic - btrfs: fix invalid extref key setup when replaying dentry - pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch - wifi: mac80211: fix incorrect type for ret - wifi: mac80211: increase scan_ies_len for S1G - ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported - !20769 [OLK-6.6][linux-6.6.y sync] Backport 6.6.106-6.6.107 LTS Patches - be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list - !20776 ub:ubfi: Release the chosen node - !20817 CVE-2026-23094 - !20819 dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() - ub:ubus: Add port num check - !20379 [OLK-6.6][sync from OLK-5.10]io_uring: Support forcing sq thread to be idle and woken up by hrtimer - !20830 sched/soft_domain: Increasing NR_MAX_CLUSTER to 32 - sched/soft_domain: Increasing NR_MAX_CLUSTER to 32 - btrfs: fix incorrect readahead expansion length - x86: disable image size check for test builds - drm/i915/power: fix size for for_each_set_bit() in abox iteration - drm/amdgpu: fix a memory leak in fence cleanup when unloading - net: mdiobus: release reset_gpio in mdiobus_unregister_device() - phy: ti-pipe3: fix device leak at unbind - phy: tegra: xusb: fix device and OF node leak at probe - dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate - usb: gadget: midi2: Fix MIDI2 IN EP max packet size - usb: gadget: midi2: Fix missing UMP group attributes initialization - USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels - RISC-V: Remove unnecessary include from compat.h - hrtimer: Rename __hrtimer_hres_active() to hrtimer_hres_active() - hrtimer: Remove unused function - regulator: sy7636a: fix lifecycle of power good gpio - dmaengine: ti: edma: Fix memory allocation size for queue_priority_map - hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr - hsr: use rtnl lock when iterating over ports - net: hsr: Add VLAN CTAG filter support - net: hsr: Add support for MC filtering at the slave device - can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB - can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails - can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed - igb: fix link test skipping when interface is admin down - docs: networking: can: change bcm_msg_head frames member to support flexible array - tunnels: reset the GSO metadata before reusing the skb - net: bridge: Bounce invalid boolopts - net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() - USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions - USB: serial: option: add Telit Cinterion FN990A w/audio compositions - dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks - serial: sc16is7xx: fix bug in flow control levels init - tty: hvc_console: Call hvc_kick in hvc_write unconditionally - Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups" - Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table - Input: iqs7222 - avoid enabling unused interrupts - mm/khugepaged: fix the address passed to notifier on testing young - btrfs: fix corruption reading compressed range when block size is smaller than page size - btrfs: use readahead_expand() on compressed extents - mm/damon/sysfs: fix use-after-free in state_show() - mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing - mtd: nand: raw: atmel: Fix comment in timings preparation - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages - drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time - mm/damon/core: set quota->charged_from to jiffies at first charge window - fuse: prevent overflow in copy_file_range return value - fuse: check if copy_file_range() returns larger than requested size - mtd: rawnand: stm32_fmc2: fix ECC overwrite - mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer - net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups - i2c: i801: Hide Intel Birch Stream SoC TCO WDT - ocfs2: fix recursive semaphore deadlock in fiemap call - mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN - compiler-clang.h: define __SANITIZE_*__ macros only when undefined - EDAC/altera: Delete an inappropriate dma_free_coherent() call - rcu-tasks: Maintain real-time response in rcu_tasks_postscan() - rcu-tasks: Eliminate deadlocks involving do_exit() and RCU tasks - rcu-tasks: Maintain lists to eliminate RCU-tasks/do_exit() deadlocks - s390/cpum_cf: Deny all sampling events by counter PMU - NFSv4/flexfiles: Fix layout merge mirror check. - NFSv4.2: Serialise O_DIRECT i/o and copy range - NFSv4.2: Serialise O_DIRECT i/o and clone range - NFSv4.2: Serialise O_DIRECT i/o and fallocate() - NFS: Serialise O_DIRECT i/o and truncate() - fs/nfs/io: make nfs_start_io_*() killable - ftrace/samples: Fix function size computation - NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server - NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set - media: i2c: imx214: Fix link frequency validation - NFSD: nfsd_unlink() clobbers non-zero status returned from fh_fill_pre_attrs() - nfsd: Fix a regression in nfsd_setattr() - kasan: fix GCC mem-intrinsic prefix with sw tags - kunit: kasan_test: disable fortify string checker on kasan_strings() test - io_uring: fix kabi broken in struct io_ring_ctx - io_uring: Support forcing sq thread to be idle and woken up by hrtimer - dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() - uacce: fix isolate sysfs check condition - Revert "uacce: fix isolate sysfs check condition" - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() - smb/server: fix refcount leak in smb2_open() - smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() - smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() - md: suspend array while updating raid_disks via sysfs - scsi: core: Wake up the error handler when final completions race against each other - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec - ub:ubfi: Release the chosen node - ub:ubus: Delete unused functions - Loongarch: Enable CONFIG_CRYPTO_XTS for disk encryption - Add sw64 support in kernel.spec - !21194 hisi-cca-da: Revert smmu realm enabled condition for arm_smmu_domain_finalise. - !21192 urma: bugfix of ubagg&ubcore&uburma - !21183 platform/x86: classmate-laptop: Add missing NULL pointer checks - urma: bugfix of ubagg&ubcore&uburma - hisi-cca-da: Revert smmu realm enabled condition for arm_smmu_domain_finalise. - platform/x86: classmate-laptop: Add missing NULL pointer checks - !21167 urma: fix kernel codecheck issues. - !21174 urma: change return value for provider err - !21127 urma: copy linked ports when importing bond jetty/seg - !20247 ubcore: query primary eid in ipourma loopback mode. - !21077 Fix hisi cca bugs - ubcore: route query refine and ipo loopback adapt. - hisi-cca-da: Transfer PCIe ECAM access requests to RMM for realm device. - hisi-cca-da: Write NS STE for PF drivers. - hisi-cca-da: Provide IO interfaces - hisi-cca-da: Destroy mmu stage2 pagetable after closing vfio devices - !21045 scsi: hisi_sas: Fix NULL pointer exception when do user_scan() - hisi-cca-da: Automatically unbind PF/VF drivers and prevent probe. - !21165 tools/interference: add ifstool utility for kernel interference statistics - !21166 urma: fix jfce uaf in batch cleanup - !21043 urma: fix tjetty ref in ping server - urma: change return value for provider err - !21128 sched/rt: Skip currently executing CPU in rto_next_cpu() - !21129 procfs: fix missing RCU protection when reading real_parent in do_task_stat() - urma: fix jfce uaf in batch cleanup - !21074 ipmi: Add HiSilicon IPMI Page Soft Offline driver - !21076 [OLK-6.6][linux-6.6.y sync] Backport 6.6.112-6.6.113 LTS Patches - urma: fix kernel codecheck issues. - tools/interference: add ifstool utility for kernel interference statistics - !20291 [Hygon][6.6][Bugfix] Bug fix for EDAC decode address fail issue on Hygon Dhyana processor - !21092 kexec: derive purgatory entry from symbol - !21154 sched: Add SOFT_DOMAIN feature interface for cgroup2 - !21153 fix CVE-2025-39981 - Revert "hisi-cca-da: Delay realm memory release to kvm_destroy_realm" - urma: fix tjetty ref in ping server - rme: Enforce isolation to solve compile error without config CONFIG_HISI_CCA - hisi-cca-da: Improve hisi cca dev validate and delegate - hisi-cca-da: Fix smmu enable rme problem - hisi-cca-da: Fix msi region shared problem - sched: Add SOFT_DOMAIN feature interface for cgroup2 - Bluetooth: MGMT: Fix memory leak in set_ssp_complete - Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete - overflow: Introduce __DEFINE_FLEX for having no initializer - overflow: Fix direct struct member initialization in _DEFINE_FLEX() - overflow: Change DEFINE_FLEX to take __counted_by member - overflow: add DEFINE_FLEX() for on-stack allocs - Bluetooth: MGMT: Fix possible UAFs - Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete() - !21103 Revert "mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()" - !21104 v2 vsock/virtio: cap TX credit to local buffer size - !21070 Fixes CVE-2026-23100 - !21135 RDMA/hns: Support configure and query the CNP DSCP through sysfs - !21088 ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref - RDMA/hns: Support configure and query the CNP DSCP through sysfs - RDMA/hns: Support query FW cap bit - RDMA/hns: Support query HW ID. - !20934 smb/server: fix refcount leak in parse_durable_handle_context() - !21004 regmap: Fix race condition in hwspinlock irqsave routine - !19568 [OLK-6.6]fix txgbe clang compile warning - urma: copy linked ports when importing bond jetty/seg - procfs: fix missing RCU protection when reading real_parent in do_task_stat() - sched/rt: Skip currently executing CPU in rto_next_cpu() - !21073 scsi: qla2xxx: Fix bsg_done() causing double free - !21114 CVE-2024-57979 - !21113 iommu: disable SVA when CONFIG_X86 is set - !20957 dmaengine: xilinx: xdma: Fix regmap max_register - !21087 net: unic: Multiple stability fixes for tx timeout, DFX capability and concurrent activation/reset - pps: Fix a use-after-free - fix kabi - pps: Fix a use-after-free - !21078 of: unittest: Fix memory leak in unittest_data_add() - !21079 *** fix CVE-2026-23208 *** - !21082 ALSA: aloop: Fix racy access at PCM trigger - !21083 bus: fsl-mc: fix use-after-free in driver_override_show() - iommu: disable SVA when CONFIG_X86 is set - vsock/virtio: cap TX credit to local buffer size - Revert "mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()" - !20983 Fix CVE-2026-23139 - !20878 Fix CVE-2026-23230 - kexec: derive purgatory entry from symbol - lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC - PCI/IOV: Fix race between SR-IOV enable/disable and hotplug - Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" - rtc: interface: Alarm race handling should not discard preceding error - perf test stat tests: Fix for virtualized machines - perf test stat: Update test expectations and events - perf test stat: Avoid hybrid assumption when virtualized - writeback: Avoid excessively long inode switching times - writeback: Avoid softlockup when switching many inodes - cramfs: Verify inode mode when loading from disk - fs: Add 'initramfs_options' to set initramfs mount options - minixfs: Verify inode mode when loading from disk - irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume - irqchip/sifive-plic: Make use of __assign_bit() - selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled - s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG - s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL - s390/bpf: Describe the frame using a struct instead of constants - s390/bpf: Centralize frame offset calculations - s390/bpf: Change seen_reg to a mask - ACPI: property: Do not pass NULL handles to acpi_attach_data() - ACPI: property: Add code comments explaining what is going on - ACPI: property: Disregard references in data-only subnode lists - ACPI: battery: Add synchronization between interface updates - ACPI: battery: Check for error code from devm_mutex_init() call - ACPI: battery: initialize mutexes through devm_ APIs - ACPI: battery: allocate driver data through devm_ APIs - arm64: mte: Do not flag the zero page as PG_mte_tagged - ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref - !20790 dm: use bio_clone_blkg_association - ipmi: Add HiSilicon IPMI Page Soft Offline driver - net: unic: Resolve network unavailability caused by concurrent activation and reset - net: unic: Provide the DFX capability for querying MNG table - net: unic: Delete the elr reset process after the tx timeout - bus: fsl-mc: fix use-after-free in driver_override_show() - ALSA: aloop: Fix racy access at PCM trigger - ALSA: usb-audio: Use the right limit for PCM OOB check - ALSA: usb-audio: Prevent excessive number of frames - of: unittest: Fix memory leak in unittest_data_add() - !21034 CVE-2026-23140 - !21016 net: fix segmentation of forwarding fraglist GRO - !21017 mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() - !21018 CVE-2026-23209 - !21019 ipv6: annotate data-race in ndisc_router_discovery() - !20881 ipvlan: Make the addrs_lock be per port - rme: Imporve range delegate - btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() - PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release - PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() - misc: fastrpc: Save actual DMA size in fastrpc_map structure - misc: fastrpc: Add missing dev_err newlines - mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag - mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type - mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value - media: mc: Clear minor number before put device - lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older - ACPICA: Allow to skip Global Lock initialization - ext4: validate ea_ino and size in check_xattrs - ext4: correctly handle queries for metadata mappings - ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() - nfsd: nfserr_jukebox in nlm_fopen should lead to a retry - NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() - mm/damon/vaddr: do not repeat pte_offset_map_lock() until success - mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 - mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations - wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 - wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again - selftests: mptcp: join: validate C-flag + def limit - spi: cadence-quadspi: Flush posted register writes before DAC access - spi: cadence-quadspi: Flush posted register writes before INDAC access - PCI: tegra194: Handle errors in BPMP response - PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() - PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock - PCI: rcar-host: Drop PMSR spinlock - PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit - PCI/AER: Support errors introduced by PCIe r6.0 - PCI/AER: Fix missing uevent on recovery when a reset is requested - PCI/ERR: Fix uevent on failure to recover - PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV - PCI/sysfs: Ensure devices are powered for config reads - PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock - rseq/selftests: Use weak symbol reference, not definition, to link with glibc - rtc: interface: Fix long-standing race when setting alarm - rtc: interface: Ensure alarm irq is enabled when UIE is enabled - memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe - mmc: core: SPI mode remove cmd7 - mtd: rawnand: fsmc: Default to autodetect buswidth - xtensa: simdisk: add input size check in proc_write_simdisk - sparc: fix error handling in scan_one_device() - sparc64: fix hugetlb for sun4u - scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() - sched/deadline: Fix race in push_dl_task() - pwm: berlin: Fix wrong register in suspend/resume - powerpc/pseries/msi: Fix potential underflow and leak issue - powerpc/powernv/pci: Fix underflow and leak issue - power: supply: max77976_charger: fix constant current reporting - pinctrl: samsung: Drop unused S3C24xx driver data - nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk - parisc: don't reference obsolete termio struct for TC* constants - openat2: don't trigger automounts with RESOLVE_NO_XDEV - of: unittest: Fix device reference count leak in of_unittest_pci_node_verify - lib/genalloc: fix device leak in of_gen_pool_get() - KEYS: trusted_tpm1: Compare HMAC values in constant time - iommu/vt-d: PRS isn't usable if PDS isn't supported - iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume - init: handle bootloader identifier in kernel parameters - iio: xilinx-ams: Unmask interrupts after updating alarms - iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK - iio: frequency: adf4350: Fix prescaler usage. - iio: dac: ad5421: use int type to store negative error codes - iio: dac: ad5360: use int type to store negative error codes - fs/ntfs3: Fix a resource leak bug in wnd_extend() - fbdev: Fix logic error in "offb" name match - crypto: rockchip - Fix dma_unmap_sg() nents value - crypto: atmel - Fix dma_unmap_sg() direction - crypto: aspeed - Fix dma_unmap_sg() direction - copy_sighand: Handle architectures where sizeof(unsigned long) < sizeof(u64) - bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() - bus: mhi: ep: Fix chained transfer handling in read path - btrfs: avoid potential out-of-bounds in btrfs_encode_fh() - blk-crypto: fix missing blktrace bio split events - drm/nouveau: fix bad ret code in nouveau_bo_move_prep - drm/rcar-du: dsi: Fix 1/2/3 lane support - media: lirc: Fix error handling in lirc_register() - media: venus: firmware: Use correct reset sequence for IRIS2 - media: pci: ivtv: Add missing check after DMA map - media: mc: Fix MUST_CONNECT handling for pads with no links - media: i2c: mt9v111: fix incorrect type for ret - media: cx18: Add missing check after DMA map - firmware: meson_sm: fix device leak at probe - xen/events: Update virq_to_irq on migration - xen/events: Return -EEXIST for bound VIRQs - xen/manage: Fix suspend error path - xen/events: Cleanup find_virq() return codes - dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required - ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init - arm64: dts: ti: k3-am62a-main: Fix main padcfg length - arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees - arm64: dts: qcom: msm8939: Add missing MDSS reset - arm64: dts: qcom: msm8916: Add missing MDSS reset - ACPI: debug: fix signedness issues in read/write helpers - ACPI: property: Fix buffer properties extraction for subnodes - gpio: wcd934x: mark the GPIO controller as sleeping - tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single - smb: client: fix missing timestamp updates after utime(2) - bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() - drm/amd/display: Properly disable scaling on DCE6 - drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 - drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs - drm/amdgpu: Add additional DCE6 SCL registers - mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes - mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call - tcp: take care of zero tp->window_clamp in tcp_set_rcvlowat() - perf python: split Clang options when invoking Popen - tools build: Align warning options with perf - net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe - drm/vmwgfx: Fix copy-paste typo in validation - net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() - LoongArch: Init acpi_gbl_use_global_lock to false - LoongArch: Remove CONFIG_ACPI_TABLE_UPGRADE in platform_init() - ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size - scsi: mvsas: Fix use-after-free bugs in mvs_work_queue - clk: tegra: do not overallocate memory for bpmp clocks - clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver - clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() - clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() - clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m - perf evsel: Ensure the fallback message is always written to - perf tools: Add fallback for exclude_guest - perf test: Add a test for default perf stat command - perf test: Don't leak workload gopipe in PERF_RECORD_* - perf session: Fix handling when buffer exceeds 2 GiB - perf arm_spe: Correct memory level for remote access - perf arm_spe: Correct setting remote access - rtc: optee: fix memory leak on driver removal - rtc: x1205: Fix Xicor X1205 vendor prefix - perf util: Fix compression checks returning -1 as bool - clk: at91: peripheral: fix return value - libperf event: Ensure tracing data is multiple of 8 sized - perf evsel: Avoid container_of on a NULL leader - asm-generic/io.h: Skip trace helpers if rwmmio events are disabled - iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE - clocksource/drivers/clps711x: Fix resource leaks in error paths - fscontext: do not consume log entries when returning -EMSGSIZE - fs: always return zero on success from replace_fd() - !21067 [OLK-6.6][linux-6.6.y sync] Backport 6.6.111-6.6.112 LTS Patches - scsi: qla2xxx: Fix bsg_done() causing double free - !21065 Fix CVE-2026-23069 - !21062 v4 Support multi-level cgroup - !20987 Fix CVE-2026-23212 - !20982 Fix CVE-2026-23119 - !20979 Fix CVE-2026-23111 - !20974 Fix CVE-2026-23099 - !20973 Fix CVE-2026-23105 - !20972 Fix CVE-2026-23074 - !20884 ksmbd: add chann_lock to protect ksmbd_chann_list xarray - !20947 Fix CVE-2026-23101 - ext4: clear i_state_flags when alloc inode - misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup - Revert "wifi: ath10k: avoid unnecessary wait for service ready message" - fs/ntfs3: fix mount failure for sparse runs in run_unpack() - !20825 efivarfs: fix error propagation in efivar_entry_get() - !20824 io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop - !20950 ub:ubus: protect iterator ue_list and mue_list with ub_bus_sem - mm/rmap: fix two comments related to huge_pmd_unshare() - mm/hugetlb: fix two comments related to huge_pmd_unshare() - mm/hugetlb: fix hugetlb_pmd_shared() - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count - !20728 drivers: Update vendor name of Chengdu NorthLink Technology N5/N6 Series Network Card Drivers - vsock/virtio: fix potential underflow in virtio_transport_get_credit() - !21001 Fix CVE-2026-23229 - usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call - arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode - !20999 Fix CVE-2026-23173 - usb: typec: tipd: Clear interrupts first - bus: fsl-mc: Check return value of platform_get_resource() - remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() - Input: atmel_mxt_ts - allow reset GPIO to sleep - misc: fastrpc: Skip reference for DMA handles - misc: fastrpc: fix possible map leak in fastrpc_put_args - misc: fastrpc: Fix fastrpc_map_lookup operation - nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() - ext4: fix checks for orphan inodes - ksmbd: fix error code overwriting in smb2_get_info_filesystem() - LoongArch: Automatically disable kaslr if boot from kexec_file - mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() - mfd: rz-mtu3: Fix MTU5 NFCR register offset - ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down - ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() - vhost: vringh: Modify the return value check - net/mlx5: fw reset, add reset timeout work - net/mlx5: pagealloc: Fix reclaim race during command interface teardown - net/mlx5: Stop polling for command response if interface goes down - net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable - nfp: fix RSS hash key size when RSS is not supported - mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands - drivers/base/node: fix double free in register_one_node() - hwrng: ks-sa - fix division by zero in ks_sa_rng_init - KEYS: X.509: Fix Basic Constraints CA flag parsing - Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements - Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO - vhost: vringh: Fix copy_to_iter return value check - RDMA/siw: Always report immediate post SQ errors - usb: vhci-hcd: Prevent suspending virtually attached devices - NFSv4.1: fix backchannel max_resp_sz verification check - coresight: trbe: Return NULL pointer for allocation failures - coresight: etm4x: Support atclk - coresight-etm4x: Conditionally access register TRCEXTINSELR - remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice - PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() - vfio/pds: replace bitmap_free with vfree - sparc: fix accurate exception reporting in copy_{from,to}_user for M7 - sparc: fix accurate exception reporting in copy_to_user for Niagara 4 - sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara - sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III - wifi: mac80211: fix Rx packet handling when pubsta information is not available - wifi: ath10k: avoid unnecessary wait for service ready message - Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram - IB/sa: Fix sa_local_svc_timeout_ms read race - RDMA/core: Resolve MAC of next-hop device without ARP support - f2fs: fix zero-sized extent for precache extents - scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() - scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() - scsi: qla2xxx: edif: Fix incorrect sign of error code - ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message - f2fs: fix to truncate first page in error path of f2fs_truncate() - f2fs: fix to update map->m_next_extent correctly in f2fs_map_blocks() - wifi: mt76: fix potential memory leak in mt76_wmac_probe() - RDMA/cm: Rate limit destroy CM ID timeout error message - drivers/base/node: handle error properly in register_one_node() - watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog - ipvs: Use READ_ONCE/WRITE_ONCE for ipvs->enable - iio: consumers: Fix offset handling in iio_convert_raw_to_processed() - iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() - fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist - fs: ntfs3: Fix integer overflow in run_unpack() - drm/msm/dpu: fix incorrect type for ret - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping - ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping - misc: genwqe: Fix incorrect cmd field being reported in error - usb: gadget: configfs: Correctly set use_os_string at bind - usb: phy: twl6030: Fix incorrect type for ret - drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() - tcp: fix __tcp_close() to only send RST when required - PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation - wifi: mwifiex: send world regulatory domain to driver - drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) - drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) - drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) - drm/amd/pm: Adjust si_upload_smc_data register programming (v3) - drm/amd/pm: Fix si_upload_smc_data (v3) - drm/amd/pm: Disable ULV even if unsupported (v3) - drm/amdgpu: Power up UVD 3 for FW validation (v2) - coresight: Only register perf symlink for sinks with alloc_buffer - inet: ping: check sock_net() in ping_get_port() and ping_lookup() - media: st-delta: avoid excessive stack usage - ALSA: lx_core: use int type to store negative error codes - media: rj54n1cb0c: Fix memleak in rj54n1_probe() - scsi: myrs: Fix dma_alloc_coherent() error check - hwrng: nomadik - add ARM_AMBA dependency - crypto: keembay - Add missing check after sg_nents_for_len() - drm/amd/display: Remove redundant semicolons - serial: max310x: Add error checking in probe() - usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls - usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup - phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 - media: zoran: Remove zoran_fh structure - drm/bridge: it6505: select REGMAP_I2C - f2fs: fix condition in __allow_reserved_blocks() - drm/radeon/r600_cs: clean up of dead code in r600_cs - drm/panel: novatek-nt35560: Fix invalid return value - bpf: Enforce expected_attach_type for tailcall compatibility - i2c: designware: Add disabling clocks when probe fails - i2c: designware: Fix clock issue when PM is disabled - i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD - thermal/drivers/qcom/lmh: Add missing IRQ includes - thermal/drivers/qcom: Make LMH select QCOM_SCM - hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems - once: fix race by moving DO_ONCE to separate section - smp: Fix up and expand the smp_call_function_many() kerneldoc - selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported - i3c: master: svc: Recycle unused IBI slot - i3c: master: svc: Use manual response for IBI events - ACPICA: Fix largest possible resource descriptor index - pwm: tiehrpwm: Fix corner case in clock divisor calculation - arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible - arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value - arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names - cpuidle: qcom-spm: fix device and OF node leaks at probe - firmware: firmware: meson-sm: fix compile-test default - arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 - null_blk: Fix the description of the cache_size module argument - pinctrl: renesas: Use int type to store negative error codes - power: supply: cw2015: Fix a alignment coding style issue - PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() - ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property - ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS - ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax - block: use int to store blk_stack_limits() return value - selftests/nolibc: fix EXPECT_NZ macro - regulator: scmi: Use int type to store negative error codes - arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map - ARM: at91: pm: fix MCKx restore routine - pinctrl: meson-gxl: add missing i2c_d pinmux - soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS - leds: flash: leds-qcom-flash: Update torch current clamp setting - ARM: dts: renesas: porter: Fix CAN pin group - libbpf: Fix reuse of DEVMAP - bpf: Remove migrate_disable in kprobe_multi_link_prog_run - bpf/selftests: Fix test_tcpnotify_user - regmap: Remove superfluous check for !config in __regmap_init() - arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 - x86/vdso: Fix output operand size of RDPID - smb: server: fix IRD/ORD negotiation with the client - coresight: trbe: Prevent overflow in PERF_IDX2OFF() - gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote - selftests: arm64: Check fread return value in exec_target - seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast - init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD - filelock: add FL_RECLAIM to show_fl_flags() macro - !21022 KVM: Don't clobber irqfd routing type when deassigning irqfd - !20998 ceph: fix oops due to invalid pointer for kfree() in parse_longname() - !21023 l2tp: avoid one data-race in l2tp_tunnel_del_work() - xsched: fix potential NULL dereference in xsched_quota_timeout_update - xsched: remove the standalone xcu_cfs_cg_deinit() helper - xsched: restructure xcu_cgrp_subsys teardown to align with cpu_cgrp_subsys lifecycle - xsched: simplify root group check by direct comparison with root_xcg - xsched: replace magic number with SCHED_CLASS_MAX_LENGTH for scheduler class string length - xsched/core: immediate cleanup of remaining operators on task exit - xsched: add init_fair_xsched_group() for XCU-specific fair group initialization - xsched: modify xcu_cg_initialize_components helper - xsched: refactor xsched_entity initialization - xsched: change rq_init() parameter from struct xsched_cu to struct xsched_rq - xsched: harden and clarify xcu_move_task() logic - xsched: move throttling-related fields from xsched_group_xcu_priv to xsched_rq_cfs - xsched/quota: add throttled flag to cfs_rq for robust hierarchical enqueue under throttling - xsched/quota: support multi-level cgroup - xsched: remove redundant xcu parameter from dequeue_ctx - xsched: update group shares using xcu_grp_shares_add/sub helpers - xsched: delete unused code - xsched/cfs: propagate group activation/deactivation up the hierarchy - xsched/cfs: move xruntime updates to pick/put paths - xsched: add has_running hook to xsched classes for wake-up eligibility check - !21012 [OLK-6.6][linux-6.6.y sync] Backport 6.6.110-6.6.111 LTS Patches - scsi: hisi_sas: Fix NULL pointer exception when do user_scan() - !21013 CVE-2026-23177 - !21007 bonding: fix use-after-free due to enslave fail after slave array update - !21006 net: Fix CVE-2026-23204 - bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path - bpf, test_run: Subtract size of xdp_frame from allowed metadata size - bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN - bpf: Make variables in bpf_prog_test_run_xdp less confusing - bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K - !21015 libceph: reset sparse-read state in osd_fault() - !21024 ub: udma: bugfix related to print messages. - !20980 Fix CVE-2026-23126 - !20922 Fix CVE-2026-23133 - ub: udma: bugfix related to print messages. - l2tp: avoid one data-race in l2tp_tunnel_del_work() - KVM: Don't clobber irqfd routing type when deassigning irqfd - ipv6: annotate data-race in ndisc_router_discovery() - macvlan: observe an RCU grace period in macvlan_common_newlink() error path - macvlan: fix error recovery in macvlan_common_newlink() - mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() - net: fix segmentation of forwarding fraglist GRO - can: rcar_canfd: Fix CAN-FD mode as default - libceph: reset sparse-read state in osd_fault() - !21008 uvb: fix cis call return value and obtain - mm, shmem: prevent infinite loop on truncate race - mm/shmem, swap: fix race of truncate and swap entry split - net/9p: fix double req put in p9_fd_cancelled - riscv: mm: Do not restrict mmap address based on hint - riscv: mm: Use hint address in mmap if available - driver core/PM: Set power.no_callbacks along with power.no_pm - serial: stm32: allow selecting console when the driver is module - hid: fix I2C read buffer overflow in raw_event() for mcp2221 - ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free - ALSA: usb-audio: Kill timer properly at removal - platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list - can: rcar_canfd: Fix controller mode setting - can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled - btrfs: ref-verify: handle damaged extent root tree - ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue - perf subcmd: avoid crash in exclude_cmds when excludes is empty - platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list - dm-integrity: limit MAX_TAG_SIZE to 255 - ASoC: amd: acp: Adjust pdm gain value - wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 - USB: serial: option: add SIMCom 8230C compositions - media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe - !20931 Fix CVE-2026-23060 - uvb: fix cis call return value and obtain - bonding: fix use-after-free due to enslave fail after slave array update - net/sched: cls_u32: use skb_header_pointer_careful() - net: add skb_header_pointer_careful() helper - regmap: Fix race condition in hwspinlock irqsave routine - crypto: virtio - Add spinlock protection with virtqueue notification - net/mlx5e: TC, delete flows only for existing peers - !20967 net: hns3: modify code of judging if SMMU DMA is enabled - ceph: fix oops due to invalid pointer for kfree() in parse_longname() - !20969 Fix CVE-2026-23125 - !20948 v4 arm64: Add memory poison recovery support for various paths - !20975 CVE-2026-23102 - !20977 v4 support apei_page_offline_policy - bonding: annotate data-races around slave->last_rx - netfilter: nf_conncount: update last_gc only when GC has been performed - bonding: provide a net pointer to __skb_flow_dissect() - netdevsim: fix a race issue related to the operation on bpf_bound_progs list - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() - apei/ghes: Add sysctl interface to control soft-offline page isolation - Revert "mm/memory-failure: support disabling soft offline for HugeTLB pages" - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - arm64/fpsimd: signal: Fix restoration of SVE context - arm64/fpsimd: signal: Consistently read FPSIMD context - arm64/fpsimd: signal: Mandate SVE payload for streaming-mode state - bonding: limit BOND_MODE_8023AD to Ethernet devices - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag - net/sched: Enforce that teql can only be used as root qdisc - sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT - drivers/net: Update vendor name of Chengdu NorthLink Technology N5/N6 Series Network Card Drivers - net: hns3: modify code of judging if SMMU DMA is enabled - dmaengine: xilinx: xdma: Fix regmap max_register - ub:ubus: protect iterator ue_list and mue_list with ub_bus_sem - ub:ubus: Avoid getting empty uent from ubc - ub:hisi-ubus: Use GFP_ATOMIC when alloc memory - arm64: send sig fault for user task when apei_claim_sea fails - arm64: add ras log during do_sea - arm64: move getting valid siaddr to the top of do_sea - arm64: mm: shmem: support poison recovery from shmem_file_read_iter() - arm64: fs: support poison recovery from __kernel_read() - iov_iter: add mc support for copy_page_to_iter - arm64: mm: support recovery from copy_{from/to}_user_page() - iov_iter: get rid of 'copy_mc' flag - leds: led-class: Only Add LED to leds_list when it is fully ready - wifi: ath10k: fix dma_free_coherent() pointer - smb/server: fix refcount leak in parse_durable_handle_context() - ksmbd: add chann_lock to protect ksmbd_chann_list xarray - ipvlan: Make the addrs_lock be per port - smb: client: split cached_fid bitfields to avoid shared-byte RMW races - efivarfs: fix error propagation in efivar_entry_get() - io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop - dm: use bio_clone_blkg_association - RAS/AMD/ATL: fix error nodes per socket on for Hygon Dhyana processor - net: txgbe: fix clang compile warning - !20552 ub: udma: fix some code issues. - !20313 Fix CVE-2025-40220 - !20321 nvme: fix admin request_queue lifetime - !20512 PM / devfreq: hisi: Fix potential UAF in OPP handling - !20544 Fix CVE-2025-71147 - !20548 v4 net: LTS-6.6 backport - !20503 Fix CVE-2025-39713 - !20133 Fix CVE-2025-39721 - !20438 Fix CVE-2025-38659 - !20264 Fix CVE-2025-40277 - !20340 Fix CVE-2025-40271 - !20319 Fix CVE-2025-40237 - !20392 vfs: Don't leak disconnected dentries on umount - !20554 iommu/s390: Implement blocking domain - !20489 [OLK-6.6][linux-6.6.y sync] Backport 6.6.101-6.6.102 LTS Patches - !20513 ACPI: PCC: Fix race condition by removing static qualifier - !20468 drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer - !20483 rcu: Protect ->defer_qs_iw_pending from data race - !20510 drivers/ub/sentry: fix primary eid index value - !20553 ub: cdma: support separated page table feature - ub: udma: fix some code issues. - !20480 iommu/ummu-core: fix error invalidate tid - !20561 iommu/ummu: Add ummu sva independent page table parameter - ub: udma: bugfix related to 2m_hugepage. - ub: udma: support for separate page tables - ub: udma: delete debugfs code. - ub: udma: bugfix related to ctrlq function. - ub: udma: verify get cqe/ae aux info out addr and len. - ub: cdma: support separated page table feature - iommu/ummu: Add ummu sva independent page table parameter - iommu: Adjust PLB refresh timing in 'grant' and 'ungrant' - !20505 Fix CVE-2026-23035 - iommu/s390: Implement blocking domain - drivers/ub/sentry: fix primary eid index value - !20535 libceph: make decode_pool() more resilient against corrupted osdmaps - !20536 mm/page_alloc: change all pageblocks migrate type on coalescing - !20537 mm/secretmem: fix use-after-free race in fault handler - !20538 wifi: avoid kernel-infoleak from struct iw_point - !20539 net: usb: rtl8150: fix memory leak on usb_submit_urb() failure - !20440 PCI/AER: Fix NULL pointer access by aer_info - !20262 Fix CVE-2025-68176 - netfilter: nf_reject: don't leak dst refcount for loopback packets - net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error - page_pool: always add GFP_NOWARN for ATOMIC allocations - virtio-net: fix received length check in big packets - net: bridge: fix use-after-free due to MST port state bypass - vsock: Ignore signal/timeout on connect() if already established - tls: make sure to abort the stream if headers are bogus - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI - xfrm: Duplicate SPI Handling - tls: handle data disappearing from under the TLS ULP - net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing - bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls - Bluetooth: hci_core: Fix use-after-free in vhci_flush() - KEYS: trusted: Fix a memory leak in tpm2_load_cmd - !20237 Fix CVE-2025-68724 - !20459 Fix CVE-2025-71131 - !20525 Fix CVE-2025-68816 - !20529 CVE-2025-68172 - net: usb: rtl8150: fix memory leak on usb_submit_urb() failure - !20370 Revert "Revert "RDMA/hns: Fix mismatch exception rollback"" - wifi: avoid kernel-infoleak from struct iw_point - mm/secretmem: fix use-after-free race in fault handler - mm/page_alloc: change all pageblocks migrate type on coalescing - libceph: make decode_pool() more resilient against corrupted osdmaps - pps: Fix kabi breakage of struct pps_device for last_fetched_ev - sched: Fix kabi breakage of struct task_struct for saved_state - crypto: aspeed - fix double free caused by devm - !20515 Bluetooth: bcsp: receive data only if registered - !20507 Fix CVE-2025-40358 - !20450 ub: ubase&unic: Fix some bug in concurrent process - !20452 iommu/ummu: Fix some bugs and optimize the code implementation - !20451 iommu/ummu: Add the function of creating devices with SVA-separated - !20500 mm: fix the inaccurate memory statistics issue for users - net/mlx5: fw_tracer, Validate format string parameters - Bluetooth: bcsp: receive data only if registered - ACPI: PCC: Fix race condition by removing static qualifier - ACPI: CPPC: Fix missing PCC check for guaranteed_perf - iommu/ummu: Add the function of creating devices with SVA-separated - iommu/ummu-core: fix error invalidate tid - riscv: stacktrace: Disable KASAN checks for non-current tasks - !20497 arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() - !20496 drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies - !20495 iommu/amd: Avoid stack buffer overflow from kernel cmdline - !20494 HID: core: Harden s32ton() against conversion to 0 bits - !20493 iommu: Fix two issues in iommu_copy_struct_from_user() - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv - PM / devfreq: hisi: Fix potential UAF in OPP handling - media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() - !20487 interference: Fix uninitialized ifs_clock compiling issue - MIPS: mm: kmalloc tlb_vpn array to avoid stack overflow - MIPS: mm: Prevent a TLB shutdown on initial uniquification - mm: fix the inaccurate memory statistics issue for users - mm: add config option for atomic mode in mm counter - Revert "mm: fix the inaccurate memory statistics issue for users" - !20444 net/mlx5e: Fix crash on profile change rollback failure - !20442 net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv - arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() - drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies - iommu/amd: Avoid stack buffer overflow from kernel cmdline - HID: core: Harden s32ton() against conversion to 0 bits - iommu: Fix two issues in iommu_copy_struct_from_user() - SUNRPC: call xs_sock_process_cmsg for all cmsg - flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read - !20374 [OLK 6.6]Use Hygon IBRS and IBPB rather than software-based mitigation to mitigate Retbleed and SRSO. - !20227 Rename leapioraid to leapraid and release v2.0 - mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery - MIPS: mm: tlb-r4k: Uniquify TLB entries on init - x86/fpu: Delay instruction pointer fixup until after warning - ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx() - ALSA: intel_hdmi: Fix off-by-one error in __hdmi_lpe_audio_probe() - x86/sev: Evict cache lines during SNP memory validation - net: usbnet: Fix the wrong netif_carrier_on() call - net: usbnet: Avoid potential RCU stall on LINK_CHANGE event - Bluetooth: btusb: Add USB ID 3625:010b for TP-LINK Archer TX10UB Nano - sched,freezer: Remove unnecessary warning in __thaw_task - freezer,sched: Clean saved_state when restoring it during thaw - freezer,sched: Do not restore saved_state of a thawed task - freezer,sched: Use saved_state to reduce some spurious wakeups - sched/core: Remove ifdeffery for saved_state - i2c: stm32f7: unmap DMA mapped buffer - i2c: stm32f7: simplify status messages in case of errors - i2c: stm32f7: perform most of irq job in threaded handler - i2c: stm32f7: use dev_err_probe upon calls of devm_request_irq - i2c: stm32f7: Use devm_clk_get_enabled() - USB: serial: option: add Foxconn T99W709 - smb: server: Fix extension string in ksmbd_extract_shortname() - ksmbd: fix corrupted mtime and ctime in smb2_open - ksmbd: fix Preauh_HashValue race condition - ksmbd: fix null pointer dereference error in generate_encryptionkey - vsock: Do not allow binding to VMADDR_PORT_ANY - selftests/perf_events: Add a mmap() correctness test - smb: client: return an error if rdma_connect does not return within 5 seconds - smb: client: let recv_done() cleanup before notifying the callers. - smb: client: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already - smb: client: make use of common smbdirect_socket - smb: smbdirect: add smbdirect_socket.h - smb: client: Correct typos in multiple comments across various files - smb: client: Use min() macro - smb: server: let recv_done() avoid touching data_transfer after cleanup/move - smb: server: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already - ALSA: hda/ca0132: Fix missing error handling in ca0132_alt_select_out() - irqchip: Build IMX_MU_MSI only on ARM - net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing - sunrpc: fix client side handling of tls alerts - net/sched: taprio: enforce minimum value for picos_per_byte - net: drop UFO packets in udp_rcv_segment() - ipv6: reject malicious packets in ipv6_gso_segment() - net/mlx5: Correctly set gso_segs when LRO is used - netlink: specs: ethtool: fix module EEPROM input/output arguments - net: ipa: add IPA v5.1 and v5.5 to ipa_version_string() - phy: mscc: Fix parsing of unicast frames - netpoll: prevent hanging NAPI when netcons gets enabled - md/md-cluster: handle REMOVE message earlier - NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY - NFS: Fix wakeup of __nfs_lookup_revalidate() in unblock_revalidate() - sched: Add test_and_clear_wake_up_bit() and atomic_dec_and_wake_up() - pNFS/flexfiles: don't attempt pnfs on fatal DS errors - PCI: pnv_php: Fix surprise plug detection and recovery - powerpc/eeh: Export eeh_unfreeze_pe() - PCI: pnv_php: Work around switches with broken presence detection - kconfig: qconf: fix ConfigList::updateListAllforAll() - scsi: sd: Make sd shutdown issue START STOP UNIT appropriately - scsi: ufs: core: Use link recovery when h8 exit fails during runtime resume - scsi: Revert "scsi: iscsi: Fix HW conn removal use after free" - scsi: mpt3sas: Fix a fw_event memory leak - vfio/pci: Separate SR-IOV VF dev_set - vfio/pds: Fix missing detach_ioas op - vfio: Prevent open_count decrement to negative - vfio: Fix unbalanced vfio_df_close call in no-iommu mode - f2fs: fix to calculate dirty data during has_not_enough_free_secs() - f2fs: fix to update upper_p in __get_secs_required() correctly - f2fs: vm_unmap_ram() may be called from an invalid context - f2fs: fix to avoid out-of-boundary access in devs.path - f2fs: doc: fix wrong quota mount option description - f2fs: fix KMSAN uninit-value in extent_info usage - rtc: rv3028: fix incorrect maximum clock rate handling - rtc: pcf8563: fix incorrect maximum clock rate handling - rtc: pcf85063: fix incorrect maximum clock rate handling - rtc: nct3018y: fix incorrect maximum clock rate handling - rtc: hym8563: fix incorrect maximum clock rate handling - rtc: ds1307: fix incorrect maximum clock rate handling - ucount: fix atomic_long_inc_below() argument type - module: Restore the moduleparam prefix length check - apparmor: fix loop detection used in conflicting attachment resolution - apparmor: ensure WB_HISTORY_SIZE value is a power of 2 - bpf: Check netfilter ctx accesses are aligned - bpf: Check flow_dissector ctx accesses are aligned - vhost-scsi: Fix log flooding with target does not exist errors - mtd: rawnand: atmel: set pmecc data setup time - mtd: rawnand: rockchip: Add missing check after DMA map - mtd: rawnand: atmel: Fix dma_mapping_error() address - jfs: fix metapage reference count leak in dbAllocCtl - crypto: qat - fix seq_file position update in adf_ring_next() - crypto: qat - fix DMA direction for compression on GEN2 devices - perf tools: Remove libtraceevent in .gitignore - sh: Do not use hyphen in exported variable name - ASoC: fsl_xcvr: get channel status data when PHY is not exists - dmaengine: nbpfaxi: Add missing check after DMA map - dmaengine: mv_xor: Fix missing check after DMA map and missing unmap - fs/orangefs: Allow 2 more characters in do_c_string() - PCI: endpoint: pci-epf-vntb: Fix the incorrect usage of __iomem attribute - soundwire: stream: restore params when prepare ports fail - crypto: img-hash - Fix dma_unmap_sg() nents value - crypto: keembay - Fix dma_unmap_sg() nents value - hwrng: mtk - handle devm_pm_runtime_enable errors - watchdog: ziirave_wdt: check record length in ziirave_firm_verify() - scsi: isci: Fix dma_unmap_sg() nents value - scsi: mvsas: Fix dma_unmap_sg() nents value - scsi: elx: efct: Fix dma_unmap_sg() nents value - scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value - clk: sunxi-ng: v3s: Fix de clock definition - perf tests bp_account: Fix leaked file descriptor - kernel: trace: preemptirq_delay_test: use offstack cpu mask - crypto: inside-secure - Fix `dma_unmap_sg()` nents value - perf sched: Fix memory leaks in 'perf sched latency' - perf sched: Fix memory leaks for evsel->priv in timehist - perf sched: Free thread->priv using priv_destructor - perf dso: Add missed dso__put to dso__load_kcore - perf tools: Fix use-after-free in help_unknown_cmd() - Fix dma_unmap_sg() nents value - clk: clk-axi-clkgen: fix fpfd_max frequency for zynq - fanotify: sanitize handle_type values when reporting fid - pinctrl: sunxi: Fix memory leak on krealloc failure - PCI: endpoint: pci-epf-vntb: Return -ENOENT if pci_epc_get_next_free_bar() fails - crypto: arm/aes-neonbs - work around gcc-15 warning - power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set - power: supply: cpcap-charger: Fix null check for power_supply_get_by_name - clk: xilinx: vcu: unregister pll_post only if registered correctly - media: v4l2-ctrls: Fix H264 SEPARATE_COLOUR_PLANE check - mtd: fix possible integer overflow in erase_xfer() - crypto: marvell/cesa - Fix engine load inaccuracy - crypto: qat - use unmanaged allocation for dc_data - crypto: sun8i-ce - fix nents passed to dma_unmap_sg() - PCI: rockchip-host: Fix "Unexpected Completion" log message - bpf/preload: Don't select USERMODE_DRIVER - ipv6: annotate data-races around rt->fib6_nsiblings - ipv6: fix possible infinite loop in fib6_info_uses_dev() - vrf: Drop existing dst reference in vrf_ip6_input_dst - selftests: rtnetlink.sh: remove esp4_offload after test - net/mlx5e: Clear Read-Only port buffer size in PBMC before update - netfilter: xt_nfacct: don't assume acct name is null-terminated - can: kvaser_usb: Assign netdev.dev_port based on device channel index - can: kvaser_pciefd: Store device channel index - can: peak_usb: fix USB FD devices potential malfunction - tools/rv: Do not skip idle in trace - Bluetooth: hci_event: Mask data status from LE ext adv reports - kcsan: test: Initialize dummy variable - wifi: mac80211: Write cnt before copying in ieee80211_copy_rnr_beacon() - wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE - wifi: ath12k: fix endianness handling while accessing wmi service bit - wifi: mac80211: Check 802.11 encaps offloading in ieee80211_tx_h_select_key() - wifi: mac80211: Don't call fq_flow_idx() for management frames - wifi: mac80211: Do not schedule stopped TXQs - wifi: plfxlc: Fix error handling in usb driver probe - wifi: mac80211: reject TDLS operations when station is not associated - iommu/amd: Fix geometry.aperture_end for V2 tables - mwl8k: Add missing check after DMA map - wifi: rtl8xxxu: Fix RX skb size for aggregation disabled - tcp: call tcp_measure_rcv_mss() for ooo packets - xen/gntdev: remove struct gntdev_copy_batch from stack - net_sched: act_ctinfo: use atomic64_t for three counters - net/sched: Restrict conditions for adding duplicating netems to qdisc tree - um: rtc: Avoid shadowing err in uml_rtc_start() - arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX - netfilter: nf_tables: adjust lockdep assertions handling - netfilter: nf_tables: Drop dead code from fill_*_info routines - fbcon: Fix outdated registered_fb reference in comment - drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value - m68k: Don't unregister boot console needlessly - drm/msm/dpu: Fill in min_prefill_lines for SC8180X - kselftest/arm64: Fix check for setting new VLs in sve-ptrace - net: dst: annotate data-races around dst->input - tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range - wifi: ath11k: clear initialized flag for deinit-ed srng lists - iwlwifi: Add missing check for alloc_ordered_workqueue - wifi: iwlwifi: Fix memory leak in iwl_mvm_init() - wifi: rtl818x: Kill URBs before clearing tx status queue - wifi: rtw89: avoid NULL dereference when RX problematic packet on unsupported 6 GHz band - caif: reduce stack size, again - bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure - drm/vmwgfx: Fix Host-Backed userspace on Guest-Backed kernel - net: ipv6: ip6mr: Fix in/out netdev to pass to the FORWARD chain - selftests/bpf: fix signedness bug in redir_partial() - bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls - bpf, sockmap: Fix psock incorrectly pointing to sk - drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed - staging: nvec: Fix incorrect null termination of battery manufacturer - interconnect: qcom: sc8180x: specify num_nodes - interconnect: qcom: sc8280xp: specify num_links for qnm_a1noc_cfg - soc: qcom: pmic_glink: fix OF node leak - samples: mei: Fix building on musl libc - cpufreq: Initialize cpufreq-based frequency-invariance later - cpufreq: intel_pstate: Always use HWP_DESIRED_PERF in passive mode - arm64: dts: imx8mn-beacon: Fix HS400 USDHC clock speed - arm64: dts: imx8mm-beacon: Fix HS400 USDHC clock speed - ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface - soc/tegra: cbb: Clear ERR_FORCE register with ERR_STATUS - arm: dts: ti: omap: Fixup pinheader typo - usb: early: xhci-dbc: Fix early_ioremap leak - powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw() - pps: fix poll support - staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() - spi: stm32: Check for cfg availability in stm32_spi_probe - usb: misc: apple-mfi-fastcharge: Make power supply names unique - usb: host: xhci-plat: fix incorrect type for of_match variable in xhci_plat_probe() - ARM: dts: vfxxx: Correctly use two tuples for timer address - arm64: dts: qcom: msm8976: Make blsp_dma controlled-remotely - arm64: dts: qcom: sc7180: Expand IMEM region - arm64: dts: qcom: sdm845: Expand IMEM region - soc: qcom: QMI encoding/decoding for big endian - selftests: Fix errno checking in syscall_user_dispatch test - ASoC: mediatek: use reserved memory or enable buffer pre-allocation - gfs2: No more self recovery - Revert "fs/ntfs3: Replace inode_trylock with inode_lock" - hfs: make splice write available again - hfsplus: make splice write available again - ublk: use vmalloc for ublk_device's __queues - fs_context: fix parameter name in infofc() macro - audit,module: restore audit logging in load failure case - ASoC: amd: yc: add DMI quirk for ASUS M6501RM - ASoC: Intel: fix SND_SOC_SOF dependencies - ASoC: amd: yc: Add DMI entries to support HP 15-fb1xxx - ethernet: intel: fix building with large NR_CPUS - ASoC: amd: yc: Add DMI quirk for HP Laptop 17 cp-2033dx - interference: Fix uninitialized ifs_clock compiling issue - iommu/ummu: optimize log printing - !20455 Fix compilation failure caused by PR#20174 - !20302 CVE-2026-22980 - !20142 CVE-2025-68803 - !20261 ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency - !20435 fix CVE-2026-22998 - !20433 scsi: target: Reset t_task_cdb pointer in error case - !20432 scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" - !20431 block: Use RCU in blk_mq_[un - !20307 tpm: Cap the number of PCR banks - !20062 xfs: Add xfs_dir3_leaf_header_check() in leaf/leafn read - !20157 v2 md: backport from mainline - rcu: Protect ->defer_qs_iw_pending from data race - platform/x86/intel/pmt: fix compilation failure caused by PR#20174 - iommu/ummu: optimize kv cache memory management - iommu/ummu: optimize permission table management - iommu/ummu: remove check for eid_type while del eid - iommu/ummu: optimize the code implementation - drivers/perf: fix ummu-pmu data reading exception - iommu/ummu: IOMMU_DOMAIN_BLOCKED type don not sync tct - drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer - crypto: seqiv - Do not use req->iv after crypto_aead_encrypt - net: unic: Notify mami of the bond ip change. - ub: ubase: Support for UE link by ctrlq message - ub: ubase: send a deactivate req in removing - ub: ubase: Querying TPG/TP contexts in the chip is no longer supported after enabling safe mode. - ub: ubase: Use an independent thread for the ctrlq workqueue. - !20368 ubcore: fix logging and permission for route query. - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id - !20344 ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr - net: unic: Fix the ummu 0xa event that occurs when modifying queues and resetting concurrent scenarios - ub: ubase: Add KABI compatibility - ub: ubase: fixing the issue of cdma ctp_req_vl parameter configuration - ub: ubase: add PMU IDEV interrupt supported abilities. - ub: ubase: Delete the tid mask for eq, jfs, jfr, and jfc context - ub: ubase: Set the completion event interrupt to auto - net: unic: fix poll tx read old skb cause a UAF bug - !20249 Fix CVE-2025-38489 - !20250 Fix CVE-2025-38480 - !20378 Fix CVE-2025-39838 - !20430 Fix CVE-2025-39942 - !20351 Fix CVE-2025-71149 - !20375 Fix CVE-2025-71150 - !20323 Fix CVE-2025-38730 - !20320 Fix CVE-2025-68814 - !20314 Fix CVE-2025-71072 - !20315 Fix CVE-2025-68794 - !20403 bpf: Check skb->transport_header is set in bpf_skb_check_mtu - !20402 bpf: Do not let BPF test infra emit invalid GSO types to stack - !20401 tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() - !20400 netfilter: nft_ct: add seqadj extension for natted connections - !20399 net: xfrm: Fix CVE-2025-40215 - !20398 net/sched: sch_qfq: Fix null-deref in agg_dequeue - !20397 bpf: Reject narrower access to pointer ctx fields - !20396 Bluetooth: eir: Fix possible crashes on eir_create_adv_data - !20394 IB/mlx5: Fix potential deadlock in MR deregistration - !20367 ub: cdma: cdma uaf bugfix - net/mlx5e: Fix crash on profile change rollback failure - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv - PCI/AER: Fix NULL pointer access by aer_info - gfs2: No more self recovery - drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE - crypto: qat - flush misc workqueue during device shutdown - !20174 Backport PMT spec 3.0 support - !20366 [Hygon][6.6][Bugfix]: Resolve FPU state corruption between atomic and non-atomic contexts - !19814 [OLK-6.6] Batch flushing user memory encrytion status change - !20393 [OLK-6.6][linux-6.6.y sync] Backport 6.6.100-6.6.101 LTS Patches - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec - nvmet-tcp: remove boilerplate code - scsi: target: Reset t_task_cdb pointer in error case - scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" - block: Use RCU in blk_mq_[un]quiesce_tagset() instead of set->tag_list_lock - ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size - ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer - smb: server: let recv_done() consistently call put_recvmsg/smb_direct_disconnect_rdma_connection - smb: server: remove separate empty_recvmsg_queue - !20384 ub:ubus: Fix ubus link message and pool device error - !20389 gfs2: Prevent recursive memory reclaim - !20388 *** fix CVE-2025-38062 *** - !20387 KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced - !20386 pinctrl: check the return value of pinmux_ops::get_function_name() - !20385 iommu/amd/pgtbl: Fix possible race while increase page table level - ub:ubus: Not cfg access during surprise down - ub:hisi-ubus: Delete validate_pa err print - PCI: cadence: Check for the existence of cdns_pcie::ops before using it - can: netlink: can_changelink(): allow disabling of automatic restart - Revert "selftests/bpf: Add a cgroup prog bpf_get_ns_current_pid_tgid() test" - drm/sched: Remove optimization that causes hang when killing dependent jobs - ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS - bpf: Check skb->transport_header is set in bpf_skb_check_mtu - bpf: Do not let BPF test infra emit invalid GSO types to stack - tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() - netfilter: nft_ct: add seqadj extension for natted connections - xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added - xfrm: delete x->tunnel as we delete x - x86/hw-vuln:Support hardware-based mitigation for Retbleed and SRSO via Hygon IBRS to avoid performance degradation caused by software-based mitigation. - net/sched: sch_qfq: Fix null-deref in agg_dequeue - bpf: Reject narrower access to pointer ctx fields - Bluetooth: eir: Fix possible crashes on eir_create_adv_data - IB/mlx5: Fix potential deadlock in MR deregistration - ub:ubus: Fix ubus link message and pool device error - ub:hisi-ubus: cq poller maximum handle 64 cqe per time - ub:hisi-ubus:Fix vdm message print error - ub:ubus:Fix ubus interrupt release issue - wifi: mt76: mt7921: prevent decap offload config before STA initialization - mtd: rawnand: qcom: Fix last codeword read in qcom_param_page_type_exec() - iio: hid-sensor-prox: Restore lost scale assignments - iio: hid-sensor-prox: Fix incorrect OFFSET calculation - crypto: powerpc/poly1305 - add depends on BROKEN for now - erofs: address D-cache aliasing - drm/i915/dp: Fix 2.7 Gbps DP_LINK_BW value on g4x - ALSA: hda: Add missing NVIDIA HDA codec IDs - ALSA: hda/tegra: Add Tegra264 support - comedi: comedi_test: Fix possible deletion of uninitialized timers - usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach - usb: typec: tcpm: allow switching to mode accessory to mux properly - usb: typec: tcpm: allow to use sink in accessory mode - drm/amdkfd: Don't call mmput from MMU notifier callback - mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n - selftests: mptcp: connect: also cover checksum - selftests: mptcp: connect: also cover alt modes - resource: fix false warning in __request_region() - gve: Fix stuck TX queue for DQ queue format - e1000e: ignore uninitialized checksum word on tgp - e1000e: disregard NVM checksum on tgp when valid checksum bit is not set - dpaa2-switch: Fix device reference count leak in MAC endpoint handling - dpaa2-eth: Fix device reference count leak in MAC endpoint handling - ALSA: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx - sprintf.h requires stdarg.h - bus: fsl-mc: Fix potential double device reference in fsl_mc_get_endpoint() - i2c: virtio: Avoid hang by using interruptible completion wait - i2c: tegra: Fix reset error handling with ACPI - platform/x86: ideapad-laptop: Fix kbd backlight not remembered among boots - can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode - can: dev: can_restart(): move debug message and stats after successful restart - can: dev: can_restart(): reverse logic to remove need for goto - i40e: When removing VF MAC filters, only check PF-set MAC - i40e: report VF tx_dropped with tx_errors instead of tx_discards - i40e: Add rx_missed_errors for buffer exhaustion - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch - net/mlx5: Fix memory leak in cmd_exec() - staging: vchiq_arm: Make vchiq_shutdown never fail - x86/hyperv: Fix usage of cpu_online_mask to get valid cpu - regmap: fix potential memory leak of regmap_bus - iio: adc: ad7949: use spi_is_bpw_supported() - interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1 node - RDMA/core: Rate limit GID cache warning messages - virtio_ring: Fix error reporting in virtqueue_resize - !20348 [OLK-6.6][linux-6.6.y sync] Backport 6.6.99-6.6.100 LTS Patches - !20346 tracing: Fix crash on synthetic stacktrace field usage - vfs: Don't leak disconnected dentries on umount - !20334 Fix CVE-2025-68780 - gfs2: Prevent recursive memory reclaim - amd/amdkfd: enhance kfd process check in switch partition - drm/amdkfd: allow compute partition mode switch with cgroup exclusions - KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced - pinctrl: check the return value of pinmux_ops::get_function_name() - iommu/amd/pgtbl: Fix possible race while increase page table level - !19966 nvme-fc: use lock accessing port_state and rport state - ASoC: fsl_sai: replace regmap_write with regmap_update_bits - comedi: Fix use of uninitialized data in insn_rw_emulate_bits() - cifs: prevent NULL pointer dereference in UTF16 conversion - ksmbd: Fix refcount leak when invalid session is found on session lookup - ubcore: fix logging and permission for route query. - !20232 driver/coda: VirtCCA supports MSI device DA - Revert "Revert "RDMA/hns: Fix mismatch exception rollback"" - !20197 ub: udma&ubase: fix a bug that caused long reboot time - x86: Resolve FPU state corruption between atomic and non-atomic contexts - ub: cdma: cdma uaf bugfix - ub: cdma: jfs call trace bugfix - !20353 x86/fpu: Clear XSTATE_BV[i - s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again - KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls - nvmem: layouts: u-boot-env: remove crc32 endianness conversion - i2c: omap: fix deprecated of_property_read_bool() use - ASoC: fsl_sai: Force a software reset when starting in consumer mode - regulator: pwm-regulator: Manage boot-on with disabled PWM channels - regulator: pwm-regulator: Calculate the output voltage for disabled PWMs - i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe() - i2c: omap: Fix an error handling path in omap_i2c_probe() - i2c: omap: Add support for setting mux - usb: dwc3: qcom: Don't leave BCR asserted - usb: hub: Don't try to recover devices lost during warm reset. - usb: hub: Fix flushing of delayed work used for post resume purposes - usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm - usb: hub: fix detection of high tier USB3 devices behind suspended hubs - arm64: Filter out SME hwcaps when FEAT_SME isn't implemented - ipv6: make addrconf_wq single threaded - !20354 cpufreq/sched: Explicitly synchronize limits_changed flag handling - sched/deadline: only set free_cpus for online runqueues - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 - cpufreq/sched: Explicitly synchronize limits_changed flag handling - io_uring/poll: correctly handle io_poll_add() return value on update - shmem: fix recovery on rename failures - io_uring: fix filename leak in __io_openat_prep() - Revert "cgroup_freezer: cgroup_freezing: Check if not frozen" - rxrpc: Fix transmission of an abort in response to an abort - rxrpc: Fix recv-recv race of completed call - net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree - net: bridge: Do not offload IGMP/MLD messages - hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf - netfilter: nf_conntrack: fix crash due to removal of uninitialised entry - ipv6: mcast: Delay put pmc->idev in mld_del_delrec() - net/mlx5: Correctly set gso_size when LRO is used - Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID - Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout - Bluetooth: SMP: If an unallowed command is received consider it a failure - Bluetooth: hci_sync: fix connectable extended advertising when using static random address - hwmon: (corsair-cpro) Validate the size of the received input buffer - selftests: net: increase inter-packet timeout in udpgro.sh - wifi: cfg80211: remove scan request n_channels counted_by - nvme: fix misaccounting of nvme-mpath inflight I/O - net: phy: Don't register LEDs for genphy - nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list() - rpl: Fix use-after-free in rpl_do_srh_inline(). - block: fix kobject leak in blk_unregister_queue - net: emaclite: Fix missing pointer increment in aligned_read() - soundwire: amd: fix for clearing command status register - soundwire: amd: fix for handling slave alerts after link is down - comedi: Fix use of uninitialized data in insn_rw_emulate_bits() - comedi: Fix some signed shift left operations - comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large - comedi: das6402: Fix bit shift out of bounds - comedi: das16m1: Fix bit shift out of bounds - comedi: aio_iiro_16: Fix bit shift out of bounds - comedi: pcl812: Fix bit shift out of bounds - iio: adc: stm32-adc: Fix race in installing chained IRQ handler - iio: adc: max1363: Reorder mode_list[] entries - iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] - iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush - soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled - soc: aspeed: lpc-snoop: Cleanup resources in stack-order - s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again - pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov - net: libwx: properly reset Rx ring descriptor - net: libwx: remove duplicate page_pool_put_full_page() - mmc: sdhci_am654: Workaround for Errata i2312 - mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models - mmc: bcm2835: Fix dma_unmap_sg() nents value - memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() - isofs: Verify inode mode when loading from disk - dmaengine: nbpfaxi: Fix memory corruption in probe() - af_packet: fix soft lockup issue caused by tpacket_snd() - af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() - arm64: dts: rockchip: use cs-gpios for spi1 on ringneck - arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on - arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency - net/mlx5: Update the list of the PCI supported devices - phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() - io_uring/poll: fix POLLERR handling - ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS - drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume - tracing/osnoise: Fix crash in timerlat_dump_stack() - spi: Add check for 8-bit transfer with 8 IO mode support - pch_uart: Fix dma_sync_sg_for_device() nents value - thunderbolt: Fix bit masking in tb_dp_port_set_hops() - i2c: stm32: fix the device used for the DMA map - tracing: Fix crash on synthetic stacktrace field usage - usb: musb: fix gadget state on disconnect - USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI - USB: serial: option: add Foxconn T99W640 - USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition - phy: tegra: xusb: Disable periodic tracking on Tegra234 - phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode - phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr - fs/proc: fix uaf in proc_readdir_de() - io_uring/net: commit partial buffers on retry - nvme: fix admin request_queue lifetime - fs/notify: call exportfs_encode_fid with s_umount - iomap: adjust read range correctly for non-block-aligned positions - fuse: fix livelock in synchronous file put from fuseblk workers - tpm: Cap the number of PCR banks - nfsd: provide locking for v4_end_grace - Revert "nfsd: provide locking for v4_end_grace" - config: enable config for PMT discovery driver - platform/x86/intel/pmt/discovery: use valid device pointer in dev_err_probe - platform/x86/intel/pmt: Fix kobject memory leak on init failure - platform/x86/intel/pmt: fix a crashlog NULL pointer access - platform/x86/intel/pmt: fix build dependency for kunit test - platform/x86/intel/pmt/discovery: fix format string warning - platform/x86/intel/pmt/discovery: Fix size_t specifiers for 32-bit - platform/x86/intel/pmt: KUNIT test for PMT Enhanced Discovery API - platform/x86/intel/pmt/telemetry: Add API to retrieve telemetry regions by feature - platform/x86/intel/pmt/discovery: Get telemetry attributes - platform/x86/intel/tpmi: Get OOBMSM CPU mapping from TPMI - platform/x86/intel/vsec: Set OOBMSM to CPU mapping - platform/x86/intel/tpmi: Relocate platform info to intel_vsec.h - docs: Add ABI documentation for intel_pmt feature directories - platform/x86/intel/pmt: Add PMT Discovery driver - sysfs: Fix crash on empty group attributes array - sysfs: Introduce a mechanism to hide static attribute_groups - platform/x86/intel/vsec: Add new Discovery feature - platform/x86/intel/vsec: Skip driverless features - platform/x86/intel/vsec: Skip absent features during initialization - platform/x86/intel/vsec: Add device links to enforce dependencies - platform/x86/intel/vsec: Create wrapper to walk PCI config space - platform/x86/intel/vsec: Add private data for per-device data - MAINTAINERS: Add link to documentation of Intel PMT ABI - platform/x86/intel/pmt: allow user offset for PMT callbacks - driver/coda: VirtCCA supports MSI device DA - ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency - Rename leapioraid to leapraid and release v2.0 - ub: udma: fix a bug that caused long reboot time. - ub: ubase: Accelerate when ctrl node is shutting down - platform/x86/intel/pmt: Use PMT callbacks - platform/x86/intel/vsec: Add PMT read callbacks - platform/x86/intel/vsec.h: Move to include/linux - md: prevent incorrect update of resync/recovery offset - md/raid1: Fix data corruption for degraded array with slow disk - md/raid1: set max_sectors during early return from choose_slow_rdev() - md-cluster: fix no recovery job when adding/re-adding a disk - md-cluster: fix hanging issue while a new disk adding - md/raid5: recheck if reshape has finished with device_lock held - md-cluster: Constify struct md_cluster_operations - md: Remove unneeded semicolon - md/raid5: fix spares errors about rcu usage - dm-raid: Fix WARN_ON_ONCE check for sync_thread in raid_resume - md: pass in max_sectors for pers->sync_request() - md: factor out helpers for different sync_action in md_do_sync() - md: replace last_sync_action with new enum type - md: use new helpers in md_do_sync() - md: don't fail action_store() if sync_thread is not registered - md: remove parameter check_seq for stop_sync_thread() - md: replace sysfs api sync_action with new helpers - md: factor out helper to start reshape from action_store() - md: add new helpers for sync_action - md: add a new enum type sync_action - md: rearrange recovery_flags - md/raid0: don't free conf on raid0_run failure - md: make md_flush_request() more readable - md: change the return value type of md_write_start to void - md: Revert "md: Fix overflow in is_mddev_idle" - md: don't account sync_io if iostats of the disk is disabled - md: Fix overflow in is_mddev_idle - md: add check for sleepers in md_wakeup_thread() - md: add a mddev_is_dm helper - md: add a mddev_add_trace_msg helper - md: add a mddev_trace_remap helper - dm-raid456, md/raid456: fix a deadlock for dm-raid456 while io concurrent with reshape - dm-raid: add a new helper prepare_suspend() in md_personality - dm-raid: really frozen sync_thread during suspend - md: add a new helper reshape_interrupted() - md: export helper md_is_rdwr() - md: export helpers to stop sync_thread - md: don't clear MD_RECOVERY_FROZEN for new dm-raid until resume - md/raid1: factor out helpers to choose the best rdev from read_balance() - md/raid1: factor out the code to manage sequential IO - md/raid1: factor out choose_bb_rdev() from read_balance() - md/raid1: factor out choose_slow_rdev() from read_balance() - md/raid1: factor out read_first_rdev() from read_balance() - md/raid1-10: factor out a new helper raid1_should_read_first() - md/raid1-10: add a helper raid1_check_read_range() - md/raid1: fix choose next idle in read_balance() - md/raid1: record nonrot rdevs while adding/removing rdevs to conf - md/raid1: factor out helpers to add rdev to conf - md: add a new helper rdev_has_badblock() - md: check mddev->pers before calling md_set_readonly() - md: clean up openers check in do_md_stop() and md_set_readonly() - md: sync blockdev before stopping raid or setting readonly - md: factor out a helper to sync mddev - md: return directly before setting did_set_md_closing - md: changed the switch of RAID_VERSION to if - md: merge the check of capabilities into md_ioctl_valid() - md: Don't suspend the array for interrupted reshape - md: Don't register sync_thread for reshape directly - md: Make sure md_do_sync() will set MD_RECOVERY_DONE - md: Don't ignore read-only array in md_check_recovery() - md: Don't ignore suspended array in md_check_recovery() - md: get rdev->mddev with READ_ONCE() - md: remove redundant md_wakeup_thread() - md: remove redundant check of 'mddev->sync_thread' - md: fix a suspicious RCU usage warning - raid: Remove now superfluous sentinel element from ctl_table array - NFSD: NFSv4 file creation neglects setting ACL - nfsd: set security label during create operations - xfs: Add xfs_dir3_leaf_header_check() in leaf/leafn read - nvme-fc: use lock accessing port_state and rport state - x86/mm: Batch flushing user memory encrytion status change - !20588 [OLK-6.6] Revert "x86/csv: Enhance CMA memory usage reporting for CSV3" - Revert "x86/csv: Enhance CMA memory usage reporting for CSV3" - !20576 media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg() - !20575 RDMA/cm: Fix leaking the multicast GID table reference - !20580 RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly - !20551 Fix CVE-2025-68785 - !20478 f2fs: fix to avoid potential deadlock - !20501 [OLK-6.6] backport important bugfix for bnxt driver from upstream linux-6.6.y - !20520 Fix CVE-2026-23038 - !20424 net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup - !20425 mlx5: Fix default values in create CQ - RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly - media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg() - RDMA/cm: Fix leaking the multicast GID table reference - net: openvswitch: fix middle attribute validation in push_nsh() action - net: openvswitch: remove never-working support for setting nsh fields - pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() - bnxt_en: Fix potential data corruption with HW GRO/LRO - f2fs: fix to avoid potential deadlock - mlx5: Fix default values in create CQ - net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup - riscv kernel upgrade to 6.6.0-138.0.0 - Fixed system hang when boot systemd on spacemit k3 - riscv: perf vendor events: fix lrw core PMU event mapping - !20727 v2 bpf: sockmap fixes - !20741 scsi: qla2xxx: Sanitize payload size to prevent member overflow - !20744 fix CVE-2025-38449 - !20763 net: usb: asix: validate PHY address before use - !20762 smc91x: fix broken irq-context in PREEMPT_RT - !20293 [Hygon][6.6][EDAC] The width of hash value is 2 bits for Hygon family 18h model 6h processors - !20290 [Hygon][6.6][Bugfix] Bug fix for EDAC to use unicast instead of broadcast on hygon family 18h model 4h - !20289 [Hygon][6.6][Bugfix] Bug fix for EDAC to correct the address translation on hygon family 18h model 4h - !20245 KVM: arm64: Refactor exit handlers - !20246 KVM: arm64: Mark some header functions as inline - !19005 [Hygon] [OLK-6.6] [Bugfix] Fix memory bandwidth counter width for Hygon QoS - !20292 [Hygon][6.6][TSC Adjust] Backport x86 TSC adjust patch - !20273 [Hygon][6.6][Bugfix] Get correct CPU LLC ID in guest for Hygon processors - !20722 [OLK-6.6][linux-6.6.y sync] Backport 6.6.104-6.6.106 LTS Patches - !20667 fix CVE-2024-50102 - !20736 netfilter: nf_tables: remove redundant chain validation on register store - !20758 ub: ubase: Fixed the alarm issue caused by the initialization of the structure variable definition. - !20721 obmm: reduce log noise for successful export/import/preimport - net: usb: asix: validate PHY address before use - smc91x: fix broken irq-context in PREEMPT_RT - !20731 devlink: rate: Unset parent pointer in devl_rate_nodes_destroy - !20732 libceph: return the handler error from mon_handle_auth_done() - !20743 mm: slub: avoid wake up kswapd in set_track_prepare - ub: ubase: Fixed the alarm issue caused by the initialization of the structure variable definition. - !20750 ub: cdma: adapted to UMMU interface changes - !20713 urma: DFX of log in kernel - urma: optimize log levels for kernel space - ub: cdma: adapted to UMMU interface changes - wifi: ath11k: avoid bit operation on key flags - drm/mediatek: fix potential OF node use-after-free - cpufreq: intel_pstate: Check IDA only before MSR_IA32_PERF_CTL writes - wifi: cfg80211: sme: store capped length in __cfg80211_connect_result() - !20708 ub:hisi-ubus: Add create bus instance ummu bypass - drm: fix kabi for struct drm_framebuffer - drm/framebuffer: Acquire internal references on GEM handles - drm/gem: Acquire references on GEM handles for framebuffers - mm: slub: avoid wake up kswapd in set_track_prepare - scsi: qla2xxx: Sanitize payload size to prevent member overflow - netfilter: nf_tables: remove redundant chain validation on register store - libceph: return the handler error from mon_handle_auth_done() - devlink: rate: Unset parent pointer in devl_rate_nodes_destroy - Documentation/hw-vuln: Add VMSCAPE documentation - dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status() - riscv: use lw when reading int cpu in asm_per_cpu - mm: slub: avoid wake up kswapd in set_track_prepare - tools: gpio: remove the include directory on make clean - tools: gpio: rm .*.cmd on make clean - drm/amd/amdgpu: Fix missing error return on kzalloc failure - drm/amdgpu: Replace DRM_* with dev_* in amdgpu_psp.c - perf bpf-event: Fix use-after-free in synthesis - drm/bridge: ti-sn65dsi86: fix REFCLK setting - spi: spi-fsl-lpspi: Clear status register after disabling the module - spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort - spi: spi-fsl-lpspi: Set correct chip-select polarity bit - spi: spi-fsl-lpspi: Fix transmissions when using CONT - hwmon: mlxreg-fan: Prevent fans from getting stuck at 0 RPM - pcmcia: omap: Add missing check for platform_get_resource - Revert "drm/amdgpu: Avoid extra evict-restore process." - ALSA: hda/realtek: Fix headset mic for TongFang X6[AF]R5xxY - ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model - drm/mediatek: Fix device/node reference count leaks in mtk_drm_get_all_drm_priv - drm/mediatek: Fix using wrong drm private data to bind mediatek-drm - drm/mediatek: Add crtc path enum for all_drm_priv array - vmxnet3: update MTU after device quiesce - net: dsa: microchip: linearize skb for tail-tagging switches - net: dsa: microchip: update tag_ksz masks for KSZ9477 family - dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status() - ALSA: hda/realtek - Add new HP ZBook laptop with micmute led fixup - ALSA: hda/realtek: Add support for HP Agusta using CS35L41 HDA - iio: pressure: mprls0025pa: use aligned_s64 for timestamp - iio: chemical: pms7003: use aligned_s64 for timestamp - iio: imu: inv_mpu6050: align buffer for timestamp - thermal/drivers/mediatek/lvts: Disable low offset IRQ for minimum threshold - nouveau: fix disabling the nonstall irq due to storm code - cpufreq: intel_pstate: Unchecked MSR aceess in legacy mode - net: pcs: rzn1-miic: Correct MODCTRL register offset - platform/x86/amd/pmc: Add TUXEDO IB Pro Gen10 AMD to spurious 8042 quirks list - drm/amdgpu: drop hw access in non-DC audio fini - wifi: mt76: mt7996: Initialize hdr before passing to skb_put_data() - wifi: mwifiex: Initialize the chan_stats array to zero - tcp_bpf: Fix copied value in tcp_bpf_sendmsg - skmsg: Return copied bytes in sk_msg_memcopy_from_iter - tcp_bpf: Add sk_rmem_alloc related logic for tcp_bpf ingress redirection - Revert "bpf, sockmap: Add sk_rmem_alloc check for sockmap" - ALSA: usb-audio: Add mute TLV for playback volumes on some devices - phy: mscc: Stop taking ts_lock for tx_queue and use its own lock - selftest: net: Fix weird setsockopt() in bind_bhash.c. - net: atm: fix memory leak in atm_register_sysfs when device_register fail - ax25: properly unshare skbs in ax25_kiss_rcv() - mctp: return -ENOPROTOOPT for unknown getsockopt options - net/smc: Remove validation of reserved bits in CLC Decline message - ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init() - net: thunder_bgx: decrement cleanup index before use - net: thunder_bgx: add a missing of_node_put - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() - wifi: libertas: cap SSID len in lbs_associate() - wifi: cw1200: cap SSID length in cw1200_do_join() - net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets - wifi: ath11k: fix group data packet drops during rekey - wifi: ath11k: avoid forward declaration of ath11k_mac_start_vdev_delay() - wifi: ath11k: rename ath11k_start_vdev_delay() - wifi: ath11k: Introduce and use ath11k_sta_to_arsta() - net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() - macsec: read MACSEC_SA_ATTR_PN with nla_get_uint - netlink: add variable-length / auto integers - net: macb: Fix tx_ptr_lock locking - icmp: fix icmp_ndo_send address translation for reply direction - mISDN: Fix memory leak in dsp_hwec_enable() - xirc2ps_cs: fix register access when enabling FullDuplex - netfilter: conntrack: helper: Replace -EEXIST by -EBUSY - wifi: cfg80211: fix use-after-free in cmp_bss() - arm64: dts: imx8mp: Fix missing microSD slot vqmmc on Data Modul i.MX8M Plus eDM SBC - arm64: dts: imx8mp: Fix missing microSD slot vqmmc on DH electronics i.MX8M Plus DHCOM - tee: optee: ffa: fix a typo of "optee_ffa_api_is_compatible" - arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro - Bluetooth: hci_sync: Avoid adding default advertising on startup - cpupower: Fix a bug where the -t option of the set subcommand was not working. - drm/amd/display: Don't warn when missing DCE encoder caps - cdc_ncm: Flag Intel OEM version of Fibocom L850-GL as WWAN - LoongArch: Save LBT before FPU in setup_sigcontext() - btrfs: avoid load/store tearing races when checking if an inode was logged - btrfs: fix race between setting last_dir_index_offset and inode logging - btrfs: fix race between logging inode and checking if it was logged before - bpf: Fix oob access in cgroup local storage - !20556 urma: fix update topo logic - !20639 [OLK-6.6][linux-6.6.y sync] Backport 6.6.103-6.6.104 LTS Patches - !20641 [OLK-6.6][linux-6.6.y sync] LoongArch: Add more instruction opcodes and emit_* helpers - !20560 *** fix CVE-2025-38062 *** - !20662 pNFS: Fix a deadlock when returning a delegation during open() - ub:hisi-ubus: Add create bus instance ummu bypass - Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" - Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set" - HID: mcp2221: Handle reads greater than 60 bytes - HID: mcp2221: Don't set bus speed on every transfer - net/mlx5: SF, Fix add port error handling - drm/nouveau/disp: Always accept linear modifier - smb3 client: fix return code mapping of remap_file_range - net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions - dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted - HID: wacom: Add a new Art Pen 2 - HID: logitech: Add ids for G PRO 2 LIGHTSPEED - HID: quirks: add support for Legion Go dual dinput modes - net: stmmac: Set CIC bit only for TX queues with COE - net: stmmac: xgmac: Correct supported speed modes - net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts - net/mlx5e: Set local Xoff after FW update - net/mlx5e: Update and set Xon/Xoff upon port speed set - net/mlx5e: Update and set Xon/Xoff upon MTU set - net/mlx5: Nack sync reset when SFs are present - net/mlx5: Convert SF port_indices xarray to function_ids xarray - net/mlx5: Use devlink port pointer to get the pointer of container SF struct - net/mlx5: Call mlx5_sf_id_erase() once in mlx5_sf_dealloc() - phy: mscc: Fix when PTP clock is register and unregister - net: dlink: fix multicast stats being counted incorrectly - dt-bindings: display/msm: qcom,mdp5: drop lut clock - drm/nouveau: remove unused memory target test - drm/nouveau: remove unused increment in gm200_flcn_pio_imem_wr - Bluetooth: hci_sync: fix set_local_name race condition - Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced - Bluetooth: hci_event: Mark connection as closed during suspend disconnect - Bluetooth: hci_event: Treat UNKNOWN_CONN_ID on disconnect as success - HID: input: report battery status changes immediately - HID: input: rename hidinput_set_battery_charge_status() - powerpc/kvm: Fix ifdef to remove build warning - drm/msm: Defer fd_install in SUBMIT ioctl - vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() - ACPI: EC: Add device to acpi_ec_no_wakeup[] qurik list - erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC - ASoC: codecs: tx-macro: correct tx_macro_component_drv name - smb: client: fix race with concurrent opens in unlink(2) - scsi: core: sysfs: Correct sysfs attributes access rights - of: dynamic: Fix use after free in of_changeset_add_prop_helper() - of: Add a helper to free property struct - mips: lantiq: xway: sysctrl: rename the etop node - mips: dts: lantiq: danube: add missing burst length property - pinctrl: STMFX: add missing HAS_IOMEM dependency - of: dynamic: Fix memleak when of_pci_add_properties() failed - !20684 urma: adjust urma log format - !20355 udp: Deal with race between UDP socket address change and rehash - !20627 Fixes CVE-2025-38627 - !20702 CVE-2025-39948 - !20701 netfilter: ctnetlink: remove refcounting in expectation dumpers - !20700 CVE-2025-38678 - !20703 CVE-2025-38491 - !20690 tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. - obmm: reduce log noise for successful export/import/preimport - mptcp: avoid deadlock on fallback while reinjecting - mptcp: plug races between subflow fail and subflow creation - mptcp: make fallback action and fallback decision atomic - ice: fix Rx page leak on multi-buffer frames - ice: fix incorrect counter for buffer allocation failures - ice: stop storing XDP verdict within ice_rx_buf - ice: gather page_count()'s of each frag right before XDP prog call - ice: Introduce ice_xdp_buff - netfilter: ctnetlink: remove refcounting in expectation dumpers - netfilter: nf_tables: reject duplicate device on updates - netfilter: nf_tables: Introduce functions freeing nft_hook objects - netfilter: nf_tables: Fix percpu address space issues in nf_tables_api.c - err.h: add ERR_PTR_PCPU(), PTR_ERR_PCPU() and IS_ERR_PCPU() macros - tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. - !20498 Fix CVE-2025-71118 - !20608 pmdomain: arm: scmi: Fix genpd leak on provider registration failure - !20679 x86/CPU/AMD: Add RDSEED fix for Zen5 - !20650 fix cve-2025-40300 - !20661 Input: alps - fix use-after-free bugs caused by dev3_register_work - !20664 backport some net bugfix from 6.6 lts - urma: adjust urma log format - !20678 ub: udma: close debug switch load parameters. - ub: udma: close debug switch load parameters. - x86/CPU/AMD: Add RDSEED fix for Zen5 - !20630 net: LTS-6.6 bugfix backport - !20632 net/sched: sch_qfq: do not free existing class in qfq_change_class() - !20631 macvlan: fix possible UAF in macvlan_forward_source() - !20628 Fix CVE-2025-39910 - !20659 v2 Fix CVE-2025-22090 - !20506 XSched: Update XSched manual - !20647 media: imon: make send_packet() more robust - !20646 ksm: use range-walk function to jump over holes in scan_get_next_rmap_item - !20645 fbcon: Set fb_display[i - !20648 parse_longname(): strrchr() expects NUL-terminated string - !20621 urma: modify log level - !20602 urma: fix the jfe uaf issue that occurred during the killall process. - !20567 urma:change log level and pass status 9 - !20640 iio: common: st_sensors: Fix use of uninitialize device structs - !20634 usb: gadget: udc: fix use-after-free in usb_gadget_state_work - !20633 net: dsa: properly keep track of conduit reference - !20635 fix CVE-2025-68231 - !20651 mm/slub: avoid accessing metadata when pointer is invalid in object_err() - !20649 drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb - !20652 mm/vmalloc: fix data race in show_numa_info() - x86: uaccess: don't use runtime-const rewriting in modules - x86: fix off-by-one in access_ok() - x86: fix user address masking non-canonical speculation issue - x86/uaccess: Zero the 8-byte get_range case on failure on 32-bit - x86/uaccess: Improve the 8-byte getuser() case - x86: fix whitespace in runtime-const assembler output - dcache: keep dentry_hashtable or d_hash_shift even when not used - runtime constants: add x86 architecture support - runtime constants: deal with old decrepit linkers - x86/uaccess: Add missing __force to casts in __access_ok() and valid_user_address() - !20345 arm64: entry: xcall/xint: make asm conditionals compatible with clang IAS - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). - libceph: replace BUG_ON with bounds check for map->max_osd - libceph: prevent potential out-of-bounds writes in handle_auth_session_key() - libceph: fix potential use-after-free in have_mon_and_osd_map() - sctp: Hold sock lock while iterating over address list - sctp: Prevent TOCTOU out-of-bounds write - sctp: Hold RCU read lock while iterating over address list - tipc: Fix use-after-free in tipc_mon_reinit_self(). - sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto - sctp: avoid NULL dereference when chunk data buffer is missing - bpf: Explicitly check accesses to bpf_sock_addr - ipvs: Defer ip_vs_ftp unregister during netns cleanup - nexthop: Forbid FDB status change while nexthop is in a group - netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). - net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer - sctp: initialize more fields in sctp_v6_from_sk() - pNFS: Fix a deadlock when returning a delegation during open() - Input: alps - fix use-after-free bugs caused by dev3_register_work - x86/cpu: Get CPU LLC ID from CPUID 0x8000001d in guest for Hygon processors - kernel/fork: only call untrack_pfn_clear() on VMAs duplicated for fork() - mm: (un)track_pfn_copy() fix + doc improvements - x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range() - !20642 mtdchar: fix integer overflow in read/write ioctls - mm/vmalloc: fix data race in show_numa_info() - mm/slub: avoid accessing metadata when pointer is invalid in object_err() - config: enable CONFIG_MITIGATION_VMESCAPE by default on x86 - x86/vmscape: Enable the mitigation - x86/vmscape: Enumerate VMSCAPE bug - x86/vmscape: Add conditional IBPB mitigation - drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb - parse_longname(): strrchr() expects NUL-terminated string - media: imon: make send_packet() more robust - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item - fbcon: Set fb_display[i]->mode to NULL when the mode is released - !20569 CVE-2024-35808 - mtdchar: fix integer overflow in read/write ioctls - !20619 Fix CVE-2026-22991 - !20612 net: hns3: extend HCLGE_FD_AD_COUNTER_NUM to 8 bits - LoongArch: Add more instruction opcodes and emit_* helpers - iio: common: st_sensors: Fix use of uninitialize device structs - !20581 null_blk: fix kmemleak by releasing references to fault configfs items - mm/mempool: fix poisoning order>0 pages with HIGHMEM - mm/page_poison: replace kmap_atomic() with kmap_local_page() - mm/mempool: replace kmap_atomic() with kmap_local_page() - usb: gadget: udc: fix use-after-free in usb_gadget_state_work - net: dsa: properly keep track of conduit reference - net/sched: sch_qfq: do not free existing class in qfq_change_class() - macvlan: fix possible UAF in macvlan_forward_source() - netfilter: nft_objref: validate objref and objrefmap expressions - arp: do not assume dev_hard_header() does not change skb->head - ip6_gre: make ip6gre_header() robust - netfilter: nf_tables: avoid chain re-validation if possible - netfilter: nf_tables: drop unused 3rd argument from validate callback ops - Revert "netfilter: nft_objref: validate objref and objrefmap expressions" - bpf: Fix reference count leak in bpf_prog_test_run_xdp() - net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset - ethtool: Avoid overflowing userspace buffer on stats query - ipvs: fix ipv4 null-ptr-deref in route error path - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() - !20596 mm/page_alloc: prevent pcp corruption with SMP=n - !20598 team: fix check for port enabled in team_queue_override_port_prio_changed() - !18823 hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio - mm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc() - kasan: avoid sleepable page allocation from atomic context - f2fs: compress: fix UAF of f2fs_inode_info in f2fs_free_dic - f2fs: compress: change the first parameter of page_array_{alloc,free} to sbi - !20583 [OLK-6.6][linux-6.6.y sync] Backport 6.6.102-6.6.103 LTS Patches - !20460 fbdev: Fix vmalloc out-of-bounds write in fast_imageblit - urma:fix log level and pass status 9 - urma: modify log level - !20592 CVE-2025-71141 fixup - !20594 CVE-2025-39744 fixup - !20607 powerpc/64s/slb: Fix SLB multihit issue during SLB preload - !20606 mm/huge_memory: fix NULL pointer deference when splitting folio - !20604 Fix CVE-2026-22984 - !20603 Fix CVE-2026-23021 - !20600 Fix CVE-2026-22990 - urma: fix the jfe uaf issue that occurred during the killall process. - !20380 pswiotlb: Adapt to the IOMMU DMA API upgraded by IOMMUFD - libceph: make free_choose_arg_map() resilient to partial allocation - drm/dp: Change AUX DPCD probe address from LANE0_1_STATUS to TRAINING_PATTERN_SET - net: hns3: extend HCLGE_FD_AD_COUNTER_NUM to 8 bits - net: hns3: extend HCLGE_FD_AD_QID to 11 bits - net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue - net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M - Revert "net: hns3: add support for FD counter" - !20587 dmaengine: stm32: dmamux: fix device leak on route allocation - pmdomain: arm: scmi: Fix genpd leak on provider registration failure - powerpc/64s/slb: Fix SLB multihit issue during SLB preload - mm/huge_memory: fix NULL pointer deference when splitting folio - !20562 LoongArch: BPF: Sign extend kfunc call arguments - !20470 ipv4: Fix reference count leak when using error routes with nexthop objects - !20471 net: sock: fix hardened usercopy panic in sock_recv_errqueue - !20472 net: fix memory leak in skb_segment_list for GRO packets - !20473 ipv4: ip_gre: make ipgre_header() robust - !20469 SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf - !20476 ipv6: Fix use-after-free in inet6_addr_del(). - !20477 svcrdma: bound check rq_pages index in inline path - !20578 ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() - !20579 fix CVE-2025-68768 - !20542 Fix NFS deadlock - USB: storage: Remove subclass and protocol overrides from Novatek quirk - cpuidle: governors: menu: Select polling state in some more cases - cpuidle: governors: menu: Rearrange main loop in menu_select() - cpuidle: menu: Update documentation after previous changes - Revert "drm/tegra: dsi: Clear enable register if powered by bootloader" - parisc: Remove spurious if statement from raw_copy_from_user() - ata: libata-scsi: Fix system suspend for a security locked drive - Revert "drm/amdgpu: fix incorrect vm flags to map bo" - mfd: axp20x: Set explicit ID for regulator cell if no IRQ line is present - drm/amd/display: use udelay rather than fsleep - sched/fair: Revert max_newidle_lb_cost bump - net: ipv4: fix regression in local-broadcast routes - tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers - PM: runtime: Do not clear needs_force_resume with enabled runtime PM - usb: typec: ucsi: psy: Set max current to zero when disconnected - io_uring/rw: cast rw->flags assignment to rwf_t - Documentation: ACPI: i2c-muxes: fix I2C device references - s390/hypfs: Enable limited access during lockdown - s390/hypfs: Avoid unnecessary ioctl registration in debugfs - ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation - net/mlx5e: Preserve shared buffer capacity during headroom updates - net/mlx5: Base ECVF devlink port attrs from 0 - Octeontx2-af: Skip overlap check for SPI field - bonding: send LACPDUs periodically in passive mode after receiving partner's LACPDU - bonding: Add independent control state machine - bonding: update LACP activity flag after setting lacp_active - net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate - ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc - gve: prevent ethtool ops after shutdown - phy: mscc: Fix timestamping for vsc8584 - net: ethernet: mtk_ppe: add RCU lock around dev_fill_forward_path - ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add - net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM - ALSA: usb-audio: Fix size validation in convert_chmap_v3() - mlxsw: spectrum: Forward packets with an IPv4 link-local source IP - Bluetooth: hci_conn: do return error from hci_enhanced_setup_sync() - Bluetooth: hci_event: fix MTU for BN == 0 in CIS Established - scsi: qla4xxx: Prevent a potential error pointer dereference - RDMA/bnxt_re: Fix to initialize the PBL array - RDMA/bnxt_re: Fix to remove workload check in SRQ limit path - RDMA/bnxt_re: Fix to do SRQ armena by default - RDMA/erdma: Fix ignored return value of init_kernel_qp - iosys-map: Fix undefined behavior in iosys_map_clear() - cgroup/cpuset: Use static_branch_enable_cpuslocked() on cpusets_insane_config_key - spi: spi-fsl-lpspi: Clamp too high speed_hz - usb: typec: maxim_contaminant: disable low power mode when reading comparator values - usb: typec: maxim_contaminant: re-enable cc toggle if cc is open and port is clean - iio: imu: inv_icm42600: change invalid data error to -EBUSY - iio: imu: inv_icm42600: Convert to uXX and sXX integer types - iio: imu: inv_icm42600: use = { } instead of memset() - iio: imu: inv_icm42600: switch timestamp type from int64_t __aligned(8) to aligned_s64 - iio: temperature: maxim_thermocouple: use DMA-safe buffer for spi_read() - iio: light: as73211: Ensure buffer holes are zeroed - tls: fix handling of zero-length records on the rx_list - powerpc/boot: Fix build with gcc 15 - mmc: sdhci-pci-gli: GL9763e: Mask the replay timer timeout of AER - compiler: remove __ADDRESSABLE_ASM{_STR,}() again - drm/amd/display: Don't overclock DCE 6 by 15% - usb: dwc3: pci: add support for the Intel Wildcat Lake - usb: dwc3: Ignore late xferNotReady event to prevent halt timeout - USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles - usb: storage: realtek_cr: Use correct byte order for bcs->Residue - USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera - usb: renesas-xhci: Fix External ROM access timeouts - usb: core: hcd: fix accessing unmapped memory in SINGLE_STEP_SET_FEATURE test - comedi: Make insn_rw_emulate_bits() do insn->n samples - usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive - cdx: Fix off-by-one error in cdx_rpmsg_probe() - most: core: Drop device reference after usage in get_channel() - iio: proximity: isl29501: fix buffered read on big-endian systems - iio: pressure: bmp280: Use IS_ERR() in bmp280_common_probe() - fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable() - drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS - cpuidle: governors: menu: Avoid selecting states with too much latency - cpuidle: menu: Remove iowait influence - mmc: sdhci-pci-gli: Add a new function to simplify the code - mmc: sdhci-pci-gli: Use PCI AER definitions, not hard-coded values - mptcp: disable add_addr retransmission when timeout is 0 - mptcp: remove duplicate sk_reset_timer call - use uniform permission checks for all mount propagation changes - arm64: dts: ti: k3-am62-main: Remove eMMC High Speed DDR support - scsi: mpi3mr: Serialize admin queue BAR writes on 32-bit systems - scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers - scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE - PCI: imx6: Add IMX8MM_EP and IMX8MP_EP fixed 256-byte BAR 4 in epc_features - PCI: imx6: Delay link start until configfs 'start' written - PCI: rockchip: Set Target Link Speed to 5.0 GT/s before retraining - PCI: rockchip: Use standard PCIe definitions - drm/amd/display: Fill display clock and vblank time in dce110_fill_display_configs - drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs - drm/amd/display: Fix DP audio DTO1 clock source on DCE 6. - drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3 - ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and EliteBook 830 G6 - mm/debug_vm_pgtable: clear page table entries at destroy_args() - squashfs: fix memory leak in squashfs_fill_super - mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for consistency - memstick: Fix deadlock by moving removing flag earlier - KVM: arm64: Fix kernel BUG() due to bad backport of FPSIMD/SVE/SME fix - sched/fair: Fix frequency selection for non-invariant case - kbuild: userprogs: use correct linker when mixing clang and GNU ld - ata: libata-scsi: Return aborted command when missing sense and result TF - PM: runtime: Take active children into account in pm_runtime_get_if_in_use() - PM: runtime: Simplify pm_runtime_get_if_active() usage - ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig - usb: dwc3: imx8mp: fix device leak at unbind - wifi: mac80211: check basic rates validity in sta_link_apply_parameters - KVM: x86: Take irqfds.lock when adding/deleting IRQ bypass producer - s390/mm: Remove possible false-positive warning in pte_free_defer() - btrfs: send: make fs_path_len() inline and constify its argument - btrfs: send: use fallocate for hole punching with send stream v2 - btrfs: send: avoid path allocation for the current inode when issuing commands - btrfs: send: keep the current inode's path cached - btrfs: send: add and use helper to rename current inode when processing refs - btrfs: send: only use boolean variables at process_recorded_refs() - btrfs: send: factor out common logic when sending xattrs - btrfs: populate otime when logging an inode item - btrfs: constify more pointer parameters - btrfs: fix ssd_spread overallocation - btrfs: open code timespec64 in struct btrfs_inode - xfs: fully decouple XFS_IBULK* flags from XFS_IWALK* flags - btrfs: abort transaction on unexpected eb generation at btrfs_copy_root() - btrfs: always abort transaction on failure to add block group to free space tree - btrfs: move transaction aborts to the error site in add_block_group_free_space() - btrfs: qgroup: fix race between quota disable and quota rescan ioctl - usb: typec: fusb302: cache PD RX state - block: Make REQ_OP_ZONE_FINISH a write operation - block: reject invalid operation in submit_bio_noacct - leds: flash: leds-qcom-flash: Fix registry access after re-bind - leds: flash: leds-qcom-flash: Limit LED current based on thermal condition - selftests/memfd: add test for mapping write-sealed memfd read-only - mm: update memfd seal write check to include F_SEAL_WRITE - mptcp: pm: kernel: flush: do not reset ADD_ADDR limit - mptcp: drop skb if MPTCP skb extension allocation fails - ipv6: sr: Fix MAC comparison to be constant-time - drm/amd/display: Don't overwrite dce60_clk_mgr - drm/amd/display: Add primary plane to commits for correct VRR handling - drm/amdkfd: Destroy KFD debugfs after destroy KFD wq - drm/amdgpu: update mmhub 3.0.1 client id mappings - drm/amdgpu: Avoid extra evict-restore process. - drm/amd: Restore cached power limit during resume - media: venus: venc: Clamp param smaller than 1fps and bigger than 240 - media: venus: vdec: Clamp param smaller than 1fps and bigger than 240. - media: venus: protect against spurious interrupts during probe - media: venus: hfi: explicitly release IRQ during teardown - media: qcom: camss: cleanup media device allocated resource on error path - media: ov2659: Fix memory leaks in ov2659_probe() - media: usbtv: Lock resolution while streaming - media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free() - media: verisilicon: Fix AV1 decoder clock frequency - media: vivid: fix wrong pixel_array control size - media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init() - media: hi556: correct the test pattern configuration - media: gspca: Add bounds checking to firmware parser - parisc: Update comments in make_insert_tlb - parisc: Try to fixup kernel exception in bad_area_nosemaphore path of do_page_fault() - parisc: Rename pte_needs_flush() to pte_needs_cache_flush() in cache.c - parisc: Makefile: explain that 64BIT requires both 32-bit and 64-bit compilers - parisc: Define and use set_pte_at() - parisc: Check region is readable by user in raw_copy_from_user() - soc/tegra: pmc: Ensure power-domains are in a known state - f2fs: fix to avoid out-of-boundary access in dnode page - phy: qcom: phy-qcom-m31: Update IPQ5332 M31 USB phy initialization sequence - vhost/vsock: Avoid allocating arbitrarily-sized SKBs - PCI: endpoint: Fix configfs group removal on driver teardown - PCI: endpoint: Fix configfs group list head handling - mtd: rawnand: renesas: Add missing check after DMA map - mtd: rawnand: fsmc: Add missing check after DMA map - mtd: spinand: propagate spinand_wait() errors from spinand_write_page() - mtd: spi-nor: Fix spi_nor_try_unlock_all() - hwmon: (gsc-hwmon) fix fan pwm setpoint show functions - pwm: mediatek: Fix duty and period setting - pwm: mediatek: Handle hardware enable and clock enable separately - pwm: imx-tpm: Reset counter if CMOD is 0 - wifi: ath11k: fix dest ring-buffer corruption when ring is full - wifi: ath11k: fix source ring-buffer corruption - wifi: ath11k: fix dest ring-buffer corruption - wifi: ath12k: fix dest ring-buffer corruption when ring is full - wifi: ath12k: fix source ring-buffer corruption - wifi: ath12k: fix dest ring-buffer corruption - wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table() - iio: adc: ad_sigma_delta: change to buffer predisable - zynq_fpga: use sgtable-based scatterlist wrappers - scsi: ufs: ufs-pci: Fix default runtime and system PM levels - scsi: ufs: ufs-pci: Fix hibernate state transition for Intel MTL-like host controllers - ata: libata-scsi: Fix ata_to_sense_error() status handling - scsi: mpi3mr: Fix race between config read submit and interrupt completion - dt-bindings: display: sprd,sharkl3-dsi-host: Fix missing clocks constraints - dt-bindings: display: sprd,sharkl3-dpu: Fix missing clocks constraints - arm64: dts: ti: k3-am62-verdin: Enable pull-ups on I2C buses - arm64: dts: ti: k3-am62a7-sk: fix pinmux for main_uart1 - arm64: dts: ti: k3-pinctrl: Enable Schmitt Trigger by default - btrfs: zoned: fix write time activation failure for metadata block group - ext4: fix hole length calculation overflow in non-extent inodes - ext4: don't try to clear the orphan_present feature block device is r/o - ext4: fix reserved gdt blocks handling in fsmap - ext4: fix fsmap end of range reporting with bigalloc - ext4: check fast symlink for ea_inode correctly - tracing: fprobe-event: Sanitize wildcard for fprobe event name - crypto: qat - lower priority for skcipher and aead algorithms - lib/crypto: mips/chacha: Fix clang build and remove unneeded byteswap - vt: defkeymap: Map keycodes above 127 to K_HOLE - vt: keyboard: Don't process Unicode characters in K_OFF mode - bus: mhi: host: Fix endianness of BHI vector table - usb: dwc3: meson-g12a: fix device leaks at unbind - usb: musb: omap2430: fix device leak at unbind - usb: gadget: udc: renesas_usb3: fix device leak at unbind - usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init() - m68k: Fix lost column on framebuffer debug console - platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister() - cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table() - rcu: Fix racy re-initialization of irq_work causing hangs - HID: apple: avoid setting up battery timer for devices without battery - HID: magicmouse: avoid setting up battery timer when not needed - RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages - tools/nolibc: fix spelling of FD_SETBITMASK in FD_* macros - media: uvcvideo: Do not mark valid metadata as invalid - media: venus: Fix OOB read due to missing payload bound check - parisc: Makefile: fix a typo in palo.conf - fbdev: Fix vmalloc out-of-bounds write in fast_imageblit - btrfs: do not allow relocation of partially dropped subvolumes - btrfs: zoned: do not select metadata BG as finish target - btrfs: clear dirty status from extent buffer on error at insert_new_root() - btrfs: zoned: do not remove unwritten non-data block group - btrfs: abort transaction during log replay if walk_log_tree() failed - btrfs: zoned: use filesystem size not disk size for reclaim decision - cdc-acm: fix race between initial clearing halt and open - thunderbolt: Fix copy+paste error in match_service_id() - usb: typec: ucsi: Update power_supply on power role change - misc: rtsx: usb: Ensure mmc child device is active when card is present - iommufd: Report unmapped bytes in the error path of iopt_unmap_iova_range - cifs: reset iface weights when we cannot find a candidate - drm/amdgpu: fix incorrect vm flags to map bo - scsi: lpfc: Remove redundant assignment to avoid memory leak - rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe - pNFS: Handle RPC size limit for layoutcommits - pNFS: Fix disk addr range check in block/scsi layout - pNFS: Fix stripe mapping in block/scsi layout - ASoC: Intel: avs: Fix uninitialized pointer error in probe() - net: phy: smsc: add proper reset flags for LAN8710A - ipmi: Fix strcpy source and destination the same - kconfig: lxdialog: fix 'space' to (de)select options - kconfig: gconf: fix potential memory leak in renderer_edited() - kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed() - ipmi: Use dev_warn_ratelimited() for incorrect message warnings - vfio/mlx5: fix possible overflow in tracking max message size - scsi: aacraid: Stop using PCI_IRQ_AFFINITY - scsi: target: core: Generate correct identifiers for PR OUT transport IDs - scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans - kconfig: nconf: Ensure null termination where strncpy is used - vfio/type1: conditional rescheduling while pinning - kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c - f2fs: check the generic conditions first - exfat: add cluster chain loop check for dir - i2c: Force DLL0945 touchpad i2c freq to 100khz - apparmor: use the condition in AA_BUG_FMT even with debug disabled - dm-table: fix checking for rq stackable devices - dm-mpath: don't print the "loaded" message if registering fails - i3c: master: Initialize ret in i3c_i2c_notifier_call() - i3c: don't fail if GETHDRCAP is unsupported - apparmor: shift ouid when mediating hard links in userns - rtc: ds1307: handle oscillator stop flag (OSF) for ds1341 - i3c: add missing include to internal header - module: Prevent silent truncation of module name in delete_module(2) - md: dm-zoned-target: Initialize return variable r to avoid uninitialized use - soundwire: Move handle_nested_irq outside of sdw_dev_lock - soundwire: amd: serialize amd manager resume sequence during pm_prepare - crypto: octeontx2 - add timeout for load_fvc completion poll - media: uvcvideo: Fix bandwidth issue for Alcor camera - media: usb: hdpvr: disable zero-length read messages - media: tc358743: Increase FIFO trigger level to 374 - media: tc358743: Return an appropriate colorspace from tc358743_set_fmt - media: tc358743: Check I2C succeeded during probe - pinctrl: stm32: Manage irq affinity settings - scsi: mpi3mr: Correctly handle ATA device errors - scsi: mpt3sas: Correctly handle ATA device errors - power: supply: qcom_battmgr: Add lithium-polymer entry - RDMA/core: reduce stack using in nldev_stat_get_doit() - dmaengine: stm32-dma: configure next sg only if there are more than 2 sgs - leds: leds-lp50xx: Handle reg to get correct multi_index - media: v4l2-common: Reduce warnings about missing V4L2_CID_LINK_FREQ control - MIPS: lantiq: falcon: sysctrl: fix request memory check logic - crypto: jitter - fix intermediary handling - watchdog: iTCO_wdt: Report error if timeout configuration fails - MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free} - clk: qcom: ipq5018: keep XO clock always on - hwmon: (emc2305) Set initial PWM minimum value during probe based on thermal state - watchdog: dw_wdt: Fix default timeout - fs/orangefs: use snprintf() instead of sprintf() - phy: rockchip-pcie: Properly disable TEST_WRITE strobe signal - mfd: axp20x: Set explicit ID for AXP313 regulator - clk: tegra: periph: Fix error handling and resolve unsigned compare warning - fbdev: fix potential buffer overflow in do_register_framebuffer() - cifs: Fix calling CIFSFindFirst() for root path without msearch - watchdog: sbsa: Adjust keepalive timeout to avoid MediaTek WS0 race condition - drm/amd/display: Avoid configuring PSR granularity if PSR-SU not supported - drm/amd/display: Only finalize atomic_obj if it was initialized - vhost: fail early when __vhost_add_used() fails - vsock/virtio: Resize receive buffers so that each SKB fits in a 4K page - net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325 - rcu: Fix rcu_read_unlock() deadloop due to IRQ work - drm/amd/display: Avoid trying AUX transactions on disconnected ports - selftests/bpf: Fix a user_ringbuf failure with arm64 64KB page size - bpf: Make reg_not_null() true for CONST_PTR_TO_MAP - uapi: in6: restore visibility of most IPv6 socket options - drm/ttm: Should to return the evict error - drm: renesas: rz-du: mipi_dsi: Add min check for VCLK range - net: ncsi: Fix buffer overflow in fetching version id - ionic: clean dbpage in de-init - wifi: rtlwifi: fix possible skb memory leak in _rtl_pci_init_one_rxdesc() - ptp: Use ratelimite for freerun error message - bpftool: Fix JSON writer resource leak in version command - net: dsa: b53: prevent SWITCH_CTRL access on BCM5325 - net: dsa: b53: prevent DIS_LEARNING access on BCM5325 - net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325 - net: dsa: b53: fix b53_imp_vlan_setup for BCM5325 - gve: Return error for unknown admin queue command - net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs - net: vlan: Make is_vlan_dev() a stub when VLAN is not configured - drm/amd: Allow printing VanGogh OD SCLK levels without setting dpm to manual - dpaa_eth: don't use fixed_phy_change_carrier - wifi: iwlegacy: Check rate_idx range after addition - netmem: fix skb_frag_address_safe with unreadable skbs - powerpc: floppy: Add missing checks after DMA map - wifi: ath12k: Decrement TID on RX peer frag setup error handling - wifi: ath12k: Enable REO queue lookup table feature on QCN9274 hw2.0 - wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`. - wifi: mac80211: update radar_required in channel context after channel switch - drm/amd/display: Fix 'failed to blank crtc!' - wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect - wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd() - wifi: ath12k: Add memset and update default rate value in wmi tx completion - drm/amd/display: Separate set_gsl from set_gsl_source_select - net: fec: allow disable coalescing - net: atlantic: add set_power to fw_ops for atl2 to fix wol - net: thunderbolt: Fix the parameter passing of tb_xdomain_enable_paths()/tb_xdomain_disable_paths() - net: thunderbolt: Enable end-to-end flow control also in transmit - kselftest/arm64: Specify SVE data when testing VL set in sve-ptrace - wifi: mt76: mt7915: mcu: re-init MCU before loading FW patch - wifi: rtw89: Disable deep power saving for USB/SDIO - wifi: rtw89: Fix rtw89_mac_power_switch() for USB - drm/msm: use trylock for debugfs - wifi: mac80211: fix rx link assignment for non-MLO stations - ipv6: mcast: Check inet6_dev->dead under idev->mc_lock in __ipv6_dev_mc_inc(). - (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer - wifi: mac80211: don't complete management TX on SAE commit - sched/fair: Bump sd->max_newidle_lb_cost when newidle balance fails - s390/stp: Remove udelay from stp_sync_clock() - wifi: iwlwifi: mvm: fix scan request validation - um: Re-evaluate thread flags repeatedly - wifi: iwlwifi: mvm: set gtk id also in older FWs - perf/cxlpmu: Remove unintended newline from IRQ name format string - net: phy: micrel: Add ksz9131_resume() - net: thunderx: Fix format-truncation warning in bgx_acpi_match_id() - net: ipv4: fix incorrect MTU in broadcast routes - wifi: cfg80211: Fix interface type validation - net: mctp: Prevent duplicate binds - arm64: Mark kernel as tainted on SAE and SError panic - net/mlx5e: Properly access RCU protected qdisc_sleeping variable - net: ag71xx: Add missing check after DMA map - et131x: Add missing check after DMA map - wifi: rtw89: Lower the timeout in rtw89_fw_read_c2h_reg() for USB - be2net: Use correct byte order and format string for TCP seq and ack_seq - s390/time: Use monotonic clock in get_cycles() - wifi: cfg80211: reject HTC bit for management frames - ktest.pl: Prevent recursion of default variable options - wifi: ath12k: Correct tid cleanup when tid setup fails - net: usb: cdc-ncm: check for filtering capability - xen/netfront: Fix TX response spurious interrupts - Bluetooth: hci_sock: Reset cookie to zero in hci_sock_free_cookie() - powerpc/thp: tracing: Hide hugepage events under CONFIG_PPC_BOOK3S_64 - ASoC: qcom: use drvdata instead of component to keep id - ASoC: codecs: rt5640: Retry DEVICE_ID verification - iio: adc: ad7768-1: Ensure SYNC_IN pulse minimum timing requirement - ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros - ALSA: pcm: Rewrite recalculate_boundary() to avoid costly loop - platform/chrome: cros_ec_typec: Defer probe on missing EC parent - platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches - soc: qcom: mdt_loader: Actually use the e_phoff - imx8m-blk-ctrl: set ISI panic write hurry level - pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop() - usb: core: usb_submit_urb: downgrade type check - usb: typec: intel_pmc_mux: Defer probe if SCU IPC isn't present - ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4 - ASoC: hdac_hdmi: Rate limit logging on connection and disconnection - ALSA: hda: Disable jack polling at shutdown - ALSA: hda: Handle the jack polling always via a work - mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode() - mei: bus: Check for still connected devices in mei_cl_bus_dev_release() - char: misc: Fix improper and inaccurate error code returned by misc_init() - reset: brcmstb: Enable reset drivers for ARCH_BCM2835 - pps: clients: gpio: fix interrupt handling order in remove path - ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path - mmc: sdhci-msm: Ensure SD card power isn't ON when card removed - ACPI: processor: fix acpi_object initialization - PM: sleep: console: Fix the black screen issue - thermal: sysfs: Return ENODATA instead of EAGAIN for reads - PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit() - firmware: tegra: Fix IVC dependency problems - ACPI: PRM: Reduce unnecessary printing to avoid user confusion - selftests: tracing: Use mutex_unlock for testing glob filter - tools/build: Fix s390(x) cross-compilation with clang - gpio: tps65912: check the return value of regmap_update_bits() - iio: adc: ad_sigma_delta: don't overallocate scan buffer - tools/nolibc: define time_t in terms of __kernel_old_time_t - thermal/drivers/qcom-spmi-temp-alarm: Enable stage 2 shutdown when required - ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed - EDAC/synopsys: Clear the ECC counters on init - gpio: wcd934x: check the return value of regmap_update_bits() - remoteproc: imx_rproc: skip clock enable when M-core is managed by the SCU - soc: qcom: rpmh-rsc: Add RSC version 4 support - usb: xhci: Avoid showing errors during surprise removal - usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command - usb: xhci: Avoid showing warnings for dying controller - usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default - selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t - cpufreq: CPPC: Mark driver with NEED_UPDATE_LIMITS flag - platform/x86/amd: pmc: Add Lenovo Yoga 6 13ALC6 to pmc quirk list - usb: xhci: print xhci->xhc_state when queue_command failed - tracefs: Add d_delete to remove negative dentries - securityfs: don't pin dentries twice, once is enough... - fix locking in efi_secret_unlink() - ext2: Handle fiemap on empty files to prevent EINVAL - fs/ntfs3: correctly create symlink for relative path - fs/ntfs3: Add sanity check for file name - better lockdep annotations for simple_recursive_removal() - hfs: fix not erasing deleted b-tree node issue - drbd: add missing kref_get in handle_write_conflicts - udf: Verify partition map count - gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops - nvme-pci: try function level reset on init failure - smb/server: avoid deadlock when linking with ReplaceIfExists - arm64: Handle KCOV __init vs inline mismatches - ptp: prevent possible ABBA deadlock in ptp_clock_freerun() - intel_idle: Allow loading ACPI tables for any family - net: ti: icss-iep: Fix incorrect type for return value in extts_enable() - netfilter: ctnetlink: fix refcount leak on table dump - udp: also consider secpath when evaluating ipsec use for checksumming - KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs - KVM: nVMX: Check vmcs12->guest_ia32_debugctl on nested VM-Enter - KVM: VMX: Extract checking of guest's DEBUGCTL into helper - KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported - KVM: VMX: Handle forced exit due to preemption timer in fastpath - KVM: VMX: Re-enter guest in fastpath for "spurious" preemption timer exits - KVM: x86: Plumb "force_immediate_exit" into kvm_entry() tracepoint - libceph: prevent potential out-of-bounds reads in handle_auth_done() - net: usb: pegasus: fix memory leak in update_eth_regs_async() - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() - !20540 urma: added support for ipoverurma - team: fix check for port enabled in team_queue_override_port_prio_changed() - mm/page_alloc: prevent pcp corruption with SMP=n - !20528 Fix CVE-2025-71083 - KVM: nVMX: Defer SVI update to vmcs01 on EOI when L2 is active w/o VID - KVM: x86: Plumb in the vCPU to kvm_x86_ops.hwapic_isr_update() - KVM: SVM: Set RFLAGS.IF=1 in C code, to get VMRUN out of the STI shadow - smb: client: don't wait for info->send_pending == 0 on error - smb: client: let send_done() cleanup before calling smbd_disconnect_rdma_connection() - ACPI: processor: perflib: Move problematic pr->performance check - ACPI: processor: perflib: Fix initial _PPC limit application - Documentation: ACPI: Fix parent device references - fs: Prevent file descriptor table allocations exceeding INT_MAX - sunvdc: Balance device refcount in vdc_port_mpgroup_check - PCI: Extend isolated function probing to LoongArch - NFSD: detect mismatch of file handle and delegation stateid in OPEN op - net: dpaa: fix device leak when querying time stamp info - net: ti: icss-iep: fix device and OF node leaks at probe - net: mtk_eth_soc: fix device leak at probe - net: enetc: fix device and OF node leak at probe - net: gianfar: fix device leak when querying time stamp info - net: phy: micrel: fix KSZ8081/KSZ8091 cable test - gpio: mlxbf3: use platform_get_irq_optional() - gpio: mlxbf2: use platform_get_irq_optional() - gpio: virtio: Fix config space reading. - ALSA: hda/realtek: Add Framework Laptop 13 (AMD Ryzen AI 300) to quirks - ALSA: hda/realtek: Fix headset mic on HONOR BRB-X - ALSA: usb-audio: Validate UAC3 cluster segment descriptors - rcu: Fix racy re-initialization of irq_work causing hangs - rcu: Fix rcu_read_unlock() deadloop due to IRQ work - drm/tilcdc: Fix removal actions in case of failed probe - drm/tilcdc: request and mapp iomem with devres - urma: fix update topo logic - dmaengine: stm32: dmamux: fix device leak on route allocation - pswiotlb: Adapt to the IOMMU DMA API upgraded by IOMMUFD - null_blk: fix kmemleak by releasing references to fault configfs items - inet: frags: flush pending skbs in fqdir_pre_exit() - inet: frags: add inet_frag_queue_flush() - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() - md/dm-raid: don't clear MD_RECOVERY_FROZEN after setting frozen - md/dm-raid: don't call md_reap_sync_thread() directly - ACPICA: Avoid walking the Namespace if start_node is NULL - arm64: entry: xcall/xint: make asm conditionals compatible with clang IAS - LoongArch: BPF: Sign extend kfunc call arguments - genirq/msi:: Fix kabi break of struct msi_desc - genirq/msi: Store the IOMMU IOVA directly in msi_desc instead of iommu_cookie - NFS: Fix a deadlock involving nfs_release_folio() - Revert "[Huawei] Revert "NFS: fix up nfs_release_folio() to try to release the page"" - urma: added support for ipoverurma - drm/ttm: Avoid NULL pointer deref for evicted BOs - XSched: Update XSched manual - svcrdma: bound check rq_pages index in inline path - ipv6: Fix use-after-free in inet6_addr_del(). - ipv4: ip_gre: make ipgre_header() robust - net: fix memory leak in skb_segment_list for GRO packets - net: sock: fix hardened usercopy panic in sock_recv_errqueue - ipv4: Fix reference count leak when using error routes with nexthop objects - SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf - fbdev: Fix vmalloc out-of-bounds write in fast_imageblit - udp: Deal with race between UDP socket address change and rehash - EDAC/amd64: The width of hash value is 2 bits for Hygon family 18h model 6h processors - x86/tsc: Use topology_max_packages() to get package number - EDAC/amd64: Use unicast instead of broadcast to access the cs_config register - EDAC/amd64: Correct the address translation for hygon family 18h model 4h - KVM: arm64: Mark some header functions as inline - KVM: arm64: Refactor exit handlers - x86/resctrl: Fix memory bandwidth counter width for Hygon CPUs - hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio - !20820 ub/obmm: add sysfs interface for mempool statistics & bugfixes - ub/obmm: fix wrong pxm_numa parameter validation - ub/obmm: Remove unused parameters from obmm_addr_check.c - ub/obmm: Enhance mem_allocator_granu validation - ub/obmm: simplify allocator naming scheme - ub/obmm: fix allow_slow logic and optimize conti_alloc_memory - ub/obmm: add sysfs interface with fine-grained memory statistics - !20804 net: hv_netvsc: reject RSS hash key programming without RX indirection table - !20813 migrate: correct lock ordering for hugetlb file folios - !20812 libceph: make calc_target() set t->paused, not just clear it - !20719 drivers/ub/sentry: some bugfix - !20798 urma: log should not retrieve eid_idx from uctx - !20808 urma: support triple bonding device - urma: log should not retrieve eid_idx from uctx - migrate: correct lock ordering for hugetlb file folios - libceph: make calc_target() set t->paused, not just clear it - !20745 vfio platform VFIO support for hisi05a1 devices - urma: support triple bonding device - net: hv_netvsc: reject RSS hash key programming without RX indirection table - !20789 gic: Add hip09 support for HISILICON_ERRATUM_165010801 - !20726 tracing: Add recursion protection in kernel stack trace recording - !20668 irqchip/gic-v3-its: Avoid truncating memory addresses - !20795 ub: udma: support query and set qos info. - !20791 Migration/urma:optimize performance in live migration. - ub: udma: Support for UE link establishment message. - Migration/urma: optimize performance in live migration. - !20787 ub: cdma: modify the method of assigning values to the structure - !20759 ubcore: hotfix route query for port eid on the same node. - ub: udma: support query and set qos info. - Revert "ub: ubase: Support for RC saved by queue granularity" - ubcore: hotfix route query for port eid on the same node. - !20676 urma: set/get sl - !20765 urma: bugfix of UAF and double free in ubcm - !20778 ub: ubase&unic: Fixes some bugfix in resetting and dfx ability - gic: Add hip09 support for HISILICON_ERRATUM_165010801 - vfio/platform: Add CONFIG_VFIO_HISI05A1 to openeuler_defconfig and turn it on by default - vfio/platform: VFIO support for hisi05a1 devices - ub: cdma: modify the method of assigning values to the structure - urma: set/get sl - ub: ubase: support to query ub dl pkt stats and real-time peak bandwidth - ub: ubase: Support for RC saved by queue granularity - ub: ubase: Traverse mailbox AE events using interrupts and polling. - ub: ubase: Modify ubase ctrlq trace to distinguish between MUE and UE messages - net: unic: The function of dumping himac registers is added. - ub: ubase: Fix MAC is_pfc sync, optimize list ops and code style - ub: ubase: Retain the initial tm qset configuration and restore it - net: unic: Fixed an issue in the bond IP address notification and pause configuration when an exception occurs. - ub: ubase: Add a retransmission function to improve reliability. - net: unic: Increase the readability and reliability of loopback code - net: unic: Synchronize the code modify for ip management and deactivation - net: unic: Increase the readability and reliability of VLAN feature. - net: unic: Added unic DFX log information. - ub: ubase: Add and correct comments for some functions and data structures - net: unic: Notify MAMI when the bond port status changes - ub: ubase: Support for HIMAC reset during ELR reset and Optimize ELR reset - !20768 iommu/ummu-core: Fix separate page table compatibility - !20665 [OLK-6.6] Enhance CMA memory usage reporting for CSV3 - !20764 net: hns3: fix double free issue for tx spare buffer - urma: bugfix of UAF and double free in ubcm - iommu/ummu-core: Fix separate page table compatibility - net: hns3: fix double free issue for tx spare buffer - drivers/ub/sentry: fix memory leak in sentry_msg_helper - drivers/ub/sentry: initialize some variables - drivers/ub/sentry: fix potential buffer overflow in convert_str_to_smh_msg() - drivers/ub/sentry: fix potential null pointer reference in sentry_uvb_comm - drivers/ub/sentry: add input parameter verification for exported symbols - tracing: Add recursion protection in kernel stack trace recording - x86/csv: Enhance CMA memory usage reporting for CSV3 - irqchip/gic-v3-its: Avoid truncating memory addresses - change the package name of 64KB page size kernel to kernel-64k - !20704 kernel support hisi-cca-da - !20180 [virtCCA Live Migration 2]virtcca secure cvm supports live migration - !20905 v2 KVM: arm64: Fix softirq masking in FPSIMD register saving sequence - !20965 iommu/ummu: Optimized TID invalidation and tdev initialization - !20964 iommu/ummu: Support TID and EID Granularity for MPAM - !20970 ub: ubase&unic: Supporting the black box capability of the ubase&unic driver - hisi-cca-da: Start dev by rsi call - hisi-cca-da: Set ripas of the bar region as RIPAS_DEV - hisi-cca-da: Support swiotlb and realm memory use - hisi-cca-da: Add smmu info when dev attach - hisi-cca-da: Transfer realm msix access to rmm - hisi-cca-da: Support pcipc sriov capability - hisi-cca-da: Delay realm memory release to kvm_destroy_realm - hisi-cca-da: Create realm s2 host pgtable and map msi mmio to rmm - hisi-cca-da: Add cca realm s2 pgtable framework - hisi-cca-da: Use bitmap to determine whether the command can be forwarded - hisi-cca-da: Restrict Realm SMMU to stage-2 domain only - hisi-cca-da: Add cmd forward mechanism in realm smmu - hisi-cca-da: Add realm smmu event and gerror irq initialization - hisi-cca-da: Add realm smmu stream table initialization - hisi-cca-da: Add realm smmu cmdq and evtq initialization - hisi-cca-da: Add realm smmu initialization - hisi-cca-da: Add relam iommu support to iommufd - hisi-cca-da: Add realm iommu support for vfio-iommu-type1 - hisi-cca-da: Support dev map and unmap - hisi-cca-da: Support dev validate and dev start - hisi-cca-da: VFIO support ccada - hisi-cca-da: Support dev delegate and dev attach - hisi-cca-da: Support root dev delegate and dev init - hisi-cca-da: Add hisilicon extension smc and ccada cmd - hisi-cca-da: Add hisi ccada feature config - !20751 ARM CCA supports hugepage - !20944 ub: ubmempfd: supports for D2H mapping and demapping - !20888 HiSock Enhancement - ub: ubase&unic: Supporting the black box capability of the ubase&unic driver. - net: unic: Resolve the residual MAC address problem - net: unic: Optimized the code for the cmd structure and FEC function. - ub: ubase: add log for post mailbox timeout - ub: ubus: Remove black box header file to include dir - rme: Remove the secret bit of the vring desc addr - rme: improve hisi-cca data mmap and destroy method - !20943 uvb: fix wd_obtain logic err - !20942 urma: fix bond device id not release - !20892 dcache: Limit the minimal number of bucket to two - rme: isolate page when do delegation to avoid migration - rme: hisi-cca supports different levels for mapping ram - rme: rename ccal to hisi-cca - rme: support set ripas for ccal realm vm - rme: support destroy ram data for ccal realm vm - rme: support populate region for ccal realm vm - rme: support map ram for ccal realm vm - rme: support config ccal realm vm - rme: support ccal RMI calls - rme: realm vm supports wfx handler - !20952 urma: introduce ipourma module - iommu/ummu-core: Simplifies tdev initialization resources - iommu/ummu: Optimized log printing - iommu/ummu: Use passed gfp_mask in map_pages callback - uvb: fix wd_obtain logic err - !20949 ub: udma: support user ctl function. - urma: fix bond device id not release - !20901 drivers/ub/sentry: some bugfix - ub: ubmempfd: supports for D2H mapping and demapping - ub: ubmempfd: supports providing services to the QEMU process through file nodes - [virtCCA Live Migration 2]virtcca secure cvm supports live migration - urma: query priority and enable bit, support ring size configuration - urma: implement debugfs, improve boundary checks and error handling logic - urma: implement data plane interaction and statistics - urma: implement ipourma network device operations - urma: ipourma resource management - urma: ipourma resource management and err code - urma: introduce ipourma main module - iommu/ummu: Optimized the TID invalidation configuration - iommu/ummu: Optimized SVA permission table memory allocation approach - iommu/ummu: Adapt UMMU SVA interface adjustment - iommu/ummu: Support TID and EID Granularity for MPAM - !20848 [OLK-6.6] backport important bugfix for nvme driver from upstream linux-6.6.y - !20847 urma: sl resource query error - !20908 [OLK-6.6][linux-6.6.y sync] Backport 6.6.108-6.6.110 LTS Patches - !20084 Loongarch: Enable CONFIG_CRYPTO_XTS for disk encryption - !20929 PCI: Fix NVMe link speed downgrade to 2.5GT/s during hotplug - drivers/ub/sentry: fix check input parameters - ub: udma: support user ctl function. - ub: udma: support uboe function. - ub: udma: bugfix related to query aux info. - !20935 ub: ubmem_vmmu: supports IOMMU driver for the UB memory MMU in VMs - drivers/ub/sentry: do not use magic numbers - !20876 urma: Kernel-mode specific implementations file for Jetty extension interface - urma: sl resource query error - !20873 sunrpc: fix NULL pointer dereference in rpcb_register_inet6 and rpcb_register_inet4 - !20875 sunrpc: fix race in cache cleanup causing stale nextcheck time - ub: ubmem_vmmu: supports IOMMU driver for the UB memory MMU in VMs - ub: ubmem_vmmu: supports parsing and configuring the hardware node information - ub: ubmem_vmmu: HiSilicon ubmem_vmmu Architecture Implementation - !20806 Fix CVE-2025-71225 - !20896 scsi: qla2xxx: Free sp in error path to fix system crash - !20894 scsi: qla2xxx: Delay module unload while fabric scan in progress - !20893 scsi: qla2xxx: Validate sp before freeing associated memory - !20802 Fix CVE-2026-23110 - urma: Kernel-mode specific implementations file for Jetty extension interface - drivers/ub/sentry: fix memory leak in process_urma_data() - drivers/ub/sentry: initialize some variables - PCI: Fix NVMe link speed downgrade to 2.5GT/s during hotplug - !20770 ub: ubdevshm: supports the memory user to obtain and release shared memory - Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 - mm: consider non-anon swap cache folios in folio_expected_ref_count() - mm: simplify folio_expected_ref_count() - ASoC: qcom: audioreach: fix potential null pointer dereference - gcc-plugins: Remove TODO_verify_il for GCC >= 16 - crypto: sha256 - fix crash at kexec - drm/i915/backlight: Return immediately when scale() finds invalid parameters - minmax.h: remove some #defines that are only expanded once - minmax.h: simplify the variants of clamp() - minmax.h: move all the clamp() definitions after the min/max() ones - minmax.h: use BUILD_BUG_ON_MSG() for the lo < hi test in clamp() - minmax.h: reduce the #define expansion of min(), max() and clamp() - minmax.h: update some comments - minmax.h: add whitespace around operators and after commas - minmax: fix up min3() and max3() too - minmax: improve macro expansion and type checking - minmax: don't use max() in situations that want a C constant expression - minmax: simplify min()/max()/clamp() implementation - minmax: make generic MIN() and MAX() macros available everywhere - drm/ast: Use msleep instead of mdelay for edid read - gpiolib: Extend software-node support to support secondary software-nodes - ARM: bcm: Select ARM_GIC_V3 for ARCH_BRCMSTB - s390/cpum_cf: Fix uninitialized warning after backport of ce971233242b - kmsan: fix out-of-bounds access to shadow memory - afs: Fix potential null pointer dereference in afs_put_server - ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address - i40e: improve VF MAC filters accounting - i40e: add mask to apply valid bits for itr_idx - HID: asus: add support for missing PX series fn keys - drm/gma500: Fix null dereference in hdmi teardown - octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() - net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port - net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() - net: dsa: lantiq_gswip: do also enable or disable cpu port - selftests: fib_nexthops: Fix creation of non-FDB nexthops - net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS - bnxt_en: correct offset handling for IPv6 destination address - vhost: Take a reference on the task in struct vhost_task. - Bluetooth: hci_sync: Fix hci_resume_advertising_sync - ethernet: rvu-af: Remove slash from the driver name - can: peak_usb: fix shift-out-of-bounds issue - can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow - can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow - can: hi311x: populate ndo_change_mtu() to prevent buffer overflow - can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow - bpf: Reject bpf_timer for PREEMPT_RT - can: rcar_can: rcar_can_resume(): fix s2ram with PSCI - wifi: virt_wifi: Fix page fault on connect - cpufreq: Initialize cpufreq-based invariance before subsys - ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients - arm64: dts: imx8mp: Correct thermal sensor index - mm: folio_may_be_lru_cached() unless folio_test_large() - mm/gup: local lru_add_drain() to avoid lru_add_drain_all() - mm/gup: check ref_count instead of lru before migration - mm: add folio_expected_ref_count() for reference count calculation - mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked" - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions - ALSA: usb-audio: Add mute TLV for playback volumes on more devices - ALSA: usb-audio: move mixer_quirks' min_mute into common quirk - ALSA: usb-audio: Add DSD support for Comtrue USB Audio device - i2c: designware: Add quirk for Intel Xe - mmc: sdhci-cadence: add Mobileye eyeQ support - usb: core: Add 0x prefix to quirks debug output - ALSA: usb-audio: Fix build with CONFIG_INPUT=n - ALSA: usb-audio: Convert comma to semicolon - ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 - ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks - ALSA: usb-audio: Simplify NULL comparison in mixer_quirks - ALSA: usb-audio: Avoid multiple assignments in mixer_quirks - ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks - ALSA: usb-audio: Fix block comments in mixer_quirks - firewire: core: fix overlooked update of subsystem ABI version - scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE - !20843 [OLK-6.6][linux-6.6.y sync] Backport 6.6.107-6.6.108 LTS Patches - !20869 ub:hisi-ubus: fix bug of security smatch - !20861 CVE-2026-23163 - ub: ubdevshm: supports the memory user to obtain and release shared memory - ub: ubdevshm: supports granting and revoking shared memory permissions - ub: ubdevshm: supports the registration and deregistration of shared memory segments - ub: ubdevshm: supports the registration and deregistration - KVM: arm64: Fix softirq masking in FPSIMD register saving sequence - !20886 Fix CVE-2026-23205 - !20803 Fix CVE-2026-23112 - !20868 sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure - !20811 smb/server: fix refcount leak in smb2_open() - !20810 smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() - !20809 smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() - sunrpc: fix NULL pointer dereference in rpcb_register_inet6 and rpcb_register_inet4 - sunrpc: fix race in cache cleanup causing stale nextcheck time - scsi: qla2xxx: Free sp in error path to fix system crash - scsi: qla2xxx: Delay module unload while fabric scan in progress - scsi: qla2xxx: Validate sp before freeing associated memory - dcache: Limit the minimal number of bucket to two - !20872 Fix CVE-2026-23220 - !20846 Fix CVE-2026-23193 - !20815 Fix CVE-2026-23216 - !20859 Fix CVE-2026-23179 - !20871 CVE-2026-23096 - !20858 ub: ubase: resolve the cmdq crq overflow problem - bpf: Deprecate hisock unused kfuncs and orig ingress logic - bpf: Add local connect support for hisock - bpf: Add ipv4-mapped ipv6 addr support for hisock - bpf: Add target comm parse to hisock_cmd - bpf: Add multi port parse to hisock_cmd - bpf: Only deploy hisock in server - bpf: Apply BPF_HISOCK_INGRESS to hisock ingress - bpf: Add bpf_handle_ingress/egress_ptype kfunc - bpf: Add bpf_get_skb_ethhdr kfunc - bpf: Add bpf_set_ingress/egress_dev kfunc - bpf: Add bpf_set_ingress_dst kfunc - bpf: Add BPF_HISOCK_INGRESS attach type - cgroup: make cgroup_bpf_prog_attach work when cgroup2 is not mounted - smb: client: fix potential UAF and double free in smb2_open_file() - smb/client: fix memory leak in smb2_open_file() - !20852 ASoC: amd: fix memory leak in acp3x pdm dma ops - ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths - uacce: fix cdev handling in the cleanup path - Revert "uacce: fix for cdev memory leak" - ub:hisi-ubus: fix bug of security smatch - ub:ubus: injected route event - ub:ubus: Black Box Development - !20865 urma: urma support uboe - sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure - urma: urma support uboe - !20857 ub_fwctl driver adds support for querying some functions - ub:ub_fwctl:Add illegal verification for scc - ub:ub_fwctl:Support querying the historical status of port links - drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove - drm/amdkfd: Don't use sw fault filter if retry cam enabled - ub:ub_fwctl:Support querying firmware version numbers - ub: ub_fwctl: Support querying real-time bandwidth statistics - ub:ub_fwctl:Support querying statistical indicators at the ub port and uboe port levels - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() - !20854 [URMA] add ping server for urma_ping - urma: add ping server - ub: ubase: resolve the cmdq crq overflow problem - ub: ubase: Optimized the QoS code naming to improve code readability. - ub: ubase&unic: optimizing code and configuration settings. - net: unic: not support query and configure ip by control plane in UBoE - net: unic: fix the automatically enable uc guid promisc mode. - !20844 urma:kernel header of userctl - urma: Kernel-mode header file for Jetty extension interface - ASoC: amd: fix memory leak in acp3x pdm dma ops - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() - phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again) - ACPICA: Work around bogus -Wstringop-overread warning since GCC 11 - !20835 Fix CVE-2026-23084 - minmax: add a few more MIN_T/MAX_T users - minmax: simplify and clarify min_t()/max_t() implementation - minmax: avoid overly complicated constant expressions in VM code - rtc: pcf2127: fix SPI command byte for PCF2131 backport - xhci: dbc: Fix full DbC transfer ring after several reconnects - xhci: dbc: decouple endpoint allocation from initialization - phy: ti: omap-usb2: fix device leak at unbind - phy: Use device_get_match_data() - drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path - ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message - ASoC: wm8974: Correct PLL rate rounding - ASoC: wm8940: Correct typo in control name - ASoC: wm8940: Correct PLL rate rounding - io_uring: include dying ring in task_work "should cancel" state - io_uring: backport io_should_terminate_tw() - ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx - selftests: mptcp: avoid spurious errors on TCP disconnect - selftests: mptcp: connect: catch IO errors on listen side - rds: ib: Increment i_fastreg_wrs before bailing out - KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active - mmc: mvsdio: Fix dma_unmap_sg() nents value - ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S - ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface - btrfs: tree-checker: fix the incorrect inode ref size check - iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page() - LoongArch: Check the return value when creating kobj - LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled - LoongArch: Update help info of ARCH_STRICT_ALIGN - nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* - octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() - net: liquidio: fix overflow in octeon_init_instr_queue() - bonding: don't set oif to bond dev when getting NS target destination - net/mlx5e: Consider aggregated port speed during rate configuration - i40e: remove redundant memory barrier when cleaning Tx descs - net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure - selftests: mptcp: sockopt: fix error messages - mptcp: tfo: record 'deny join id0' info - mptcp: set remote_deny_join_id0 on SYN recv - dpaa2-switch: fix buffer pool seeding for control traffic - btrfs: fix invalid extref key setup when replaying dentry - pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch - wifi: mac80211: fix incorrect type for ret - wifi: mac80211: increase scan_ies_len for S1G - ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported - !20769 [OLK-6.6][linux-6.6.y sync] Backport 6.6.106-6.6.107 LTS Patches - be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list - !20776 ub:ubfi: Release the chosen node - !20817 CVE-2026-23094 - !20819 dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() - ub:ubus: Add port num check - !20379 [OLK-6.6][sync from OLK-5.10]io_uring: Support forcing sq thread to be idle and woken up by hrtimer - !20830 sched/soft_domain: Increasing NR_MAX_CLUSTER to 32 - sched/soft_domain: Increasing NR_MAX_CLUSTER to 32 - btrfs: fix incorrect readahead expansion length - x86: disable image size check for test builds - drm/i915/power: fix size for for_each_set_bit() in abox iteration - drm/amdgpu: fix a memory leak in fence cleanup when unloading - net: mdiobus: release reset_gpio in mdiobus_unregister_device() - phy: ti-pipe3: fix device leak at unbind - phy: tegra: xusb: fix device and OF node leak at probe - dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate - usb: gadget: midi2: Fix MIDI2 IN EP max packet size - usb: gadget: midi2: Fix missing UMP group attributes initialization - USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels - RISC-V: Remove unnecessary include from compat.h - hrtimer: Rename __hrtimer_hres_active() to hrtimer_hres_active() - hrtimer: Remove unused function - regulator: sy7636a: fix lifecycle of power good gpio - dmaengine: ti: edma: Fix memory allocation size for queue_priority_map - hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr - hsr: use rtnl lock when iterating over ports - net: hsr: Add VLAN CTAG filter support - net: hsr: Add support for MC filtering at the slave device - can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB - can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails - can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed - igb: fix link test skipping when interface is admin down - docs: networking: can: change bcm_msg_head frames member to support flexible array - tunnels: reset the GSO metadata before reusing the skb - net: bridge: Bounce invalid boolopts - net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() - USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions - USB: serial: option: add Telit Cinterion FN990A w/audio compositions - dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks - serial: sc16is7xx: fix bug in flow control levels init - tty: hvc_console: Call hvc_kick in hvc_write unconditionally - Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups" - Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table - Input: iqs7222 - avoid enabling unused interrupts - mm/khugepaged: fix the address passed to notifier on testing young - btrfs: fix corruption reading compressed range when block size is smaller than page size - btrfs: use readahead_expand() on compressed extents - mm/damon/sysfs: fix use-after-free in state_show() - mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing - mtd: nand: raw: atmel: Fix comment in timings preparation - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages - drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time - mm/damon/core: set quota->charged_from to jiffies at first charge window - fuse: prevent overflow in copy_file_range return value - fuse: check if copy_file_range() returns larger than requested size - mtd: rawnand: stm32_fmc2: fix ECC overwrite - mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer - net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups - i2c: i801: Hide Intel Birch Stream SoC TCO WDT - ocfs2: fix recursive semaphore deadlock in fiemap call - mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN - compiler-clang.h: define __SANITIZE_*__ macros only when undefined - EDAC/altera: Delete an inappropriate dma_free_coherent() call - rcu-tasks: Maintain real-time response in rcu_tasks_postscan() - rcu-tasks: Eliminate deadlocks involving do_exit() and RCU tasks - rcu-tasks: Maintain lists to eliminate RCU-tasks/do_exit() deadlocks - s390/cpum_cf: Deny all sampling events by counter PMU - NFSv4/flexfiles: Fix layout merge mirror check. - NFSv4.2: Serialise O_DIRECT i/o and copy range - NFSv4.2: Serialise O_DIRECT i/o and clone range - NFSv4.2: Serialise O_DIRECT i/o and fallocate() - NFS: Serialise O_DIRECT i/o and truncate() - fs/nfs/io: make nfs_start_io_*() killable - ftrace/samples: Fix function size computation - NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server - NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set - media: i2c: imx214: Fix link frequency validation - NFSD: nfsd_unlink() clobbers non-zero status returned from fh_fill_pre_attrs() - nfsd: Fix a regression in nfsd_setattr() - kasan: fix GCC mem-intrinsic prefix with sw tags - kunit: kasan_test: disable fortify string checker on kasan_strings() test - io_uring: fix kabi broken in struct io_ring_ctx - io_uring: Support forcing sq thread to be idle and woken up by hrtimer - dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() - uacce: fix isolate sysfs check condition - Revert "uacce: fix isolate sysfs check condition" - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() - smb/server: fix refcount leak in smb2_open() - smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() - smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() - md: suspend array while updating raid_disks via sysfs - scsi: core: Wake up the error handler when final completions race against each other - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec - ub:ubfi: Release the chosen node - ub:ubus: Delete unused functions - Loongarch: Enable CONFIG_CRYPTO_XTS for disk encryption - Add sw64 support in kernel.spec - !21194 hisi-cca-da: Revert smmu realm enabled condition for arm_smmu_domain_finalise. - !21192 urma: bugfix of ubagg&ubcore&uburma - !21183 platform/x86: classmate-laptop: Add missing NULL pointer checks - urma: bugfix of ubagg&ubcore&uburma - hisi-cca-da: Revert smmu realm enabled condition for arm_smmu_domain_finalise. - platform/x86: classmate-laptop: Add missing NULL pointer checks - !21167 urma: fix kernel codecheck issues. - !21174 urma: change return value for provider err - !21127 urma: copy linked ports when importing bond jetty/seg - !20247 ubcore: query primary eid in ipourma loopback mode. - !21077 Fix hisi cca bugs - ubcore: route query refine and ipo loopback adapt. - hisi-cca-da: Transfer PCIe ECAM access requests to RMM for realm device. - hisi-cca-da: Write NS STE for PF drivers. - hisi-cca-da: Provide IO interfaces - hisi-cca-da: Destroy mmu stage2 pagetable after closing vfio devices - !21045 scsi: hisi_sas: Fix NULL pointer exception when do user_scan() - hisi-cca-da: Automatically unbind PF/VF drivers and prevent probe. - !21165 tools/interference: add ifstool utility for kernel interference statistics - !21166 urma: fix jfce uaf in batch cleanup - !21043 urma: fix tjetty ref in ping server - urma: change return value for provider err - !21128 sched/rt: Skip currently executing CPU in rto_next_cpu() - !21129 procfs: fix missing RCU protection when reading real_parent in do_task_stat() - urma: fix jfce uaf in batch cleanup - !21074 ipmi: Add HiSilicon IPMI Page Soft Offline driver - !21076 [OLK-6.6][linux-6.6.y sync] Backport 6.6.112-6.6.113 LTS Patches - urma: fix kernel codecheck issues. - tools/interference: add ifstool utility for kernel interference statistics - !20291 [Hygon][6.6][Bugfix] Bug fix for EDAC decode address fail issue on Hygon Dhyana processor - !21092 kexec: derive purgatory entry from symbol - !21154 sched: Add SOFT_DOMAIN feature interface for cgroup2 - !21153 fix CVE-2025-39981 - Revert "hisi-cca-da: Delay realm memory release to kvm_destroy_realm" - urma: fix tjetty ref in ping server - rme: Enforce isolation to solve compile error without config CONFIG_HISI_CCA - hisi-cca-da: Improve hisi cca dev validate and delegate - hisi-cca-da: Fix smmu enable rme problem - hisi-cca-da: Fix msi region shared problem - sched: Add SOFT_DOMAIN feature interface for cgroup2 - Bluetooth: MGMT: Fix memory leak in set_ssp_complete - Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete - overflow: Introduce __DEFINE_FLEX for having no initializer - overflow: Fix direct struct member initialization in _DEFINE_FLEX() - overflow: Change DEFINE_FLEX to take __counted_by member - overflow: add DEFINE_FLEX() for on-stack allocs - Bluetooth: MGMT: Fix possible UAFs - Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete() - !21103 Revert "mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()" - !21104 v2 vsock/virtio: cap TX credit to local buffer size - !21070 Fixes CVE-2026-23100 - !21135 RDMA/hns: Support configure and query the CNP DSCP through sysfs - !21088 ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref - RDMA/hns: Support configure and query the CNP DSCP through sysfs - RDMA/hns: Support query FW cap bit - RDMA/hns: Support query HW ID. - !20934 smb/server: fix refcount leak in parse_durable_handle_context() - !21004 regmap: Fix race condition in hwspinlock irqsave routine - !19568 [OLK-6.6]fix txgbe clang compile warning - urma: copy linked ports when importing bond jetty/seg - procfs: fix missing RCU protection when reading real_parent in do_task_stat() - sched/rt: Skip currently executing CPU in rto_next_cpu() - !21073 scsi: qla2xxx: Fix bsg_done() causing double free - !21114 CVE-2024-57979 - !21113 iommu: disable SVA when CONFIG_X86 is set - !20957 dmaengine: xilinx: xdma: Fix regmap max_register - !21087 net: unic: Multiple stability fixes for tx timeout, DFX capability and concurrent activation/reset - pps: Fix a use-after-free - fix kabi - pps: Fix a use-after-free - !21078 of: unittest: Fix memory leak in unittest_data_add() - !21079 *** fix CVE-2026-23208 *** - !21082 ALSA: aloop: Fix racy access at PCM trigger - !21083 bus: fsl-mc: fix use-after-free in driver_override_show() - iommu: disable SVA when CONFIG_X86 is set - vsock/virtio: cap TX credit to local buffer size - Revert "mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()" - !20983 Fix CVE-2026-23139 - !20878 Fix CVE-2026-23230 - kexec: derive purgatory entry from symbol - lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC - PCI/IOV: Fix race between SR-IOV enable/disable and hotplug - Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" - rtc: interface: Alarm race handling should not discard preceding error - perf test stat tests: Fix for virtualized machines - perf test stat: Update test expectations and events - perf test stat: Avoid hybrid assumption when virtualized - writeback: Avoid excessively long inode switching times - writeback: Avoid softlockup when switching many inodes - cramfs: Verify inode mode when loading from disk - fs: Add 'initramfs_options' to set initramfs mount options - minixfs: Verify inode mode when loading from disk - irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume - irqchip/sifive-plic: Make use of __assign_bit() - selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled - s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG - s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL - s390/bpf: Describe the frame using a struct instead of constants - s390/bpf: Centralize frame offset calculations - s390/bpf: Change seen_reg to a mask - ACPI: property: Do not pass NULL handles to acpi_attach_data() - ACPI: property: Add code comments explaining what is going on - ACPI: property: Disregard references in data-only subnode lists - ACPI: battery: Add synchronization between interface updates - ACPI: battery: Check for error code from devm_mutex_init() call - ACPI: battery: initialize mutexes through devm_ APIs - ACPI: battery: allocate driver data through devm_ APIs - arm64: mte: Do not flag the zero page as PG_mte_tagged - ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref - !20790 dm: use bio_clone_blkg_association - ipmi: Add HiSilicon IPMI Page Soft Offline driver - net: unic: Resolve network unavailability caused by concurrent activation and reset - net: unic: Provide the DFX capability for querying MNG table - net: unic: Delete the elr reset process after the tx timeout - bus: fsl-mc: fix use-after-free in driver_override_show() - ALSA: aloop: Fix racy access at PCM trigger - ALSA: usb-audio: Use the right limit for PCM OOB check - ALSA: usb-audio: Prevent excessive number of frames - of: unittest: Fix memory leak in unittest_data_add() - !21034 CVE-2026-23140 - !21016 net: fix segmentation of forwarding fraglist GRO - !21017 mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() - !21018 CVE-2026-23209 - !21019 ipv6: annotate data-race in ndisc_router_discovery() - !20881 ipvlan: Make the addrs_lock be per port - rme: Imporve range delegate - btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() - PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release - PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() - misc: fastrpc: Save actual DMA size in fastrpc_map structure - misc: fastrpc: Add missing dev_err newlines - mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag - mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type - mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value - media: mc: Clear minor number before put device - lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older - ACPICA: Allow to skip Global Lock initialization - ext4: validate ea_ino and size in check_xattrs - ext4: correctly handle queries for metadata mappings - ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() - nfsd: nfserr_jukebox in nlm_fopen should lead to a retry - NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() - mm/damon/vaddr: do not repeat pte_offset_map_lock() until success - mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 - mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations - wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 - wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again - selftests: mptcp: join: validate C-flag + def limit - spi: cadence-quadspi: Flush posted register writes before DAC access - spi: cadence-quadspi: Flush posted register writes before INDAC access - PCI: tegra194: Handle errors in BPMP response - PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() - PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock - PCI: rcar-host: Drop PMSR spinlock - PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit - PCI/AER: Support errors introduced by PCIe r6.0 - PCI/AER: Fix missing uevent on recovery when a reset is requested - PCI/ERR: Fix uevent on failure to recover - PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV - PCI/sysfs: Ensure devices are powered for config reads - PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock - rseq/selftests: Use weak symbol reference, not definition, to link with glibc - rtc: interface: Fix long-standing race when setting alarm - rtc: interface: Ensure alarm irq is enabled when UIE is enabled - memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe - mmc: core: SPI mode remove cmd7 - mtd: rawnand: fsmc: Default to autodetect buswidth - xtensa: simdisk: add input size check in proc_write_simdisk - sparc: fix error handling in scan_one_device() - sparc64: fix hugetlb for sun4u - scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() - sched/deadline: Fix race in push_dl_task() - pwm: berlin: Fix wrong register in suspend/resume - powerpc/pseries/msi: Fix potential underflow and leak issue - powerpc/powernv/pci: Fix underflow and leak issue - power: supply: max77976_charger: fix constant current reporting - pinctrl: samsung: Drop unused S3C24xx driver data - nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk - parisc: don't reference obsolete termio struct for TC* constants - openat2: don't trigger automounts with RESOLVE_NO_XDEV - of: unittest: Fix device reference count leak in of_unittest_pci_node_verify - lib/genalloc: fix device leak in of_gen_pool_get() - KEYS: trusted_tpm1: Compare HMAC values in constant time - iommu/vt-d: PRS isn't usable if PDS isn't supported - iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume - init: handle bootloader identifier in kernel parameters - iio: xilinx-ams: Unmask interrupts after updating alarms - iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK - iio: frequency: adf4350: Fix prescaler usage. - iio: dac: ad5421: use int type to store negative error codes - iio: dac: ad5360: use int type to store negative error codes - fs/ntfs3: Fix a resource leak bug in wnd_extend() - fbdev: Fix logic error in "offb" name match - crypto: rockchip - Fix dma_unmap_sg() nents value - crypto: atmel - Fix dma_unmap_sg() direction - crypto: aspeed - Fix dma_unmap_sg() direction - copy_sighand: Handle architectures where sizeof(unsigned long) < sizeof(u64) - bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() - bus: mhi: ep: Fix chained transfer handling in read path - btrfs: avoid potential out-of-bounds in btrfs_encode_fh() - blk-crypto: fix missing blktrace bio split events - drm/nouveau: fix bad ret code in nouveau_bo_move_prep - drm/rcar-du: dsi: Fix 1/2/3 lane support - media: lirc: Fix error handling in lirc_register() - media: venus: firmware: Use correct reset sequence for IRIS2 - media: pci: ivtv: Add missing check after DMA map - media: mc: Fix MUST_CONNECT handling for pads with no links - media: i2c: mt9v111: fix incorrect type for ret - media: cx18: Add missing check after DMA map - firmware: meson_sm: fix device leak at probe - xen/events: Update virq_to_irq on migration - xen/events: Return -EEXIST for bound VIRQs - xen/manage: Fix suspend error path - xen/events: Cleanup find_virq() return codes - dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required - ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init - arm64: dts: ti: k3-am62a-main: Fix main padcfg length - arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees - arm64: dts: qcom: msm8939: Add missing MDSS reset - arm64: dts: qcom: msm8916: Add missing MDSS reset - ACPI: debug: fix signedness issues in read/write helpers - ACPI: property: Fix buffer properties extraction for subnodes - gpio: wcd934x: mark the GPIO controller as sleeping - tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single - smb: client: fix missing timestamp updates after utime(2) - bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() - drm/amd/display: Properly disable scaling on DCE6 - drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 - drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs - drm/amdgpu: Add additional DCE6 SCL registers - mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes - mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call - tcp: take care of zero tp->window_clamp in tcp_set_rcvlowat() - perf python: split Clang options when invoking Popen - tools build: Align warning options with perf - net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe - drm/vmwgfx: Fix copy-paste typo in validation - net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() - LoongArch: Init acpi_gbl_use_global_lock to false - LoongArch: Remove CONFIG_ACPI_TABLE_UPGRADE in platform_init() - ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size - scsi: mvsas: Fix use-after-free bugs in mvs_work_queue - clk: tegra: do not overallocate memory for bpmp clocks - clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver - clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() - clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() - clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m - perf evsel: Ensure the fallback message is always written to - perf tools: Add fallback for exclude_guest - perf test: Add a test for default perf stat command - perf test: Don't leak workload gopipe in PERF_RECORD_* - perf session: Fix handling when buffer exceeds 2 GiB - perf arm_spe: Correct memory level for remote access - perf arm_spe: Correct setting remote access - rtc: optee: fix memory leak on driver removal - rtc: x1205: Fix Xicor X1205 vendor prefix - perf util: Fix compression checks returning -1 as bool - clk: at91: peripheral: fix return value - libperf event: Ensure tracing data is multiple of 8 sized - perf evsel: Avoid container_of on a NULL leader - asm-generic/io.h: Skip trace helpers if rwmmio events are disabled - iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE - clocksource/drivers/clps711x: Fix resource leaks in error paths - fscontext: do not consume log entries when returning -EMSGSIZE - fs: always return zero on success from replace_fd() - !21067 [OLK-6.6][linux-6.6.y sync] Backport 6.6.111-6.6.112 LTS Patches - scsi: qla2xxx: Fix bsg_done() causing double free - !21065 Fix CVE-2026-23069 - !21062 v4 Support multi-level cgroup - !20987 Fix CVE-2026-23212 - !20982 Fix CVE-2026-23119 - !20979 Fix CVE-2026-23111 - !20974 Fix CVE-2026-23099 - !20973 Fix CVE-2026-23105 - !20972 Fix CVE-2026-23074 - !20884 ksmbd: add chann_lock to protect ksmbd_chann_list xarray - !20947 Fix CVE-2026-23101 - ext4: clear i_state_flags when alloc inode - misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup - Revert "wifi: ath10k: avoid unnecessary wait for service ready message" - fs/ntfs3: fix mount failure for sparse runs in run_unpack() - !20825 efivarfs: fix error propagation in efivar_entry_get() - !20824 io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop - !20950 ub:ubus: protect iterator ue_list and mue_list with ub_bus_sem - mm/rmap: fix two comments related to huge_pmd_unshare() - mm/hugetlb: fix two comments related to huge_pmd_unshare() - mm/hugetlb: fix hugetlb_pmd_shared() - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count - !20728 drivers: Update vendor name of Chengdu NorthLink Technology N5/N6 Series Network Card Drivers - vsock/virtio: fix potential underflow in virtio_transport_get_credit() - !21001 Fix CVE-2026-23229 - usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call - arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode - !20999 Fix CVE-2026-23173 - usb: typec: tipd: Clear interrupts first - bus: fsl-mc: Check return value of platform_get_resource() - remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() - Input: atmel_mxt_ts - allow reset GPIO to sleep - misc: fastrpc: Skip reference for DMA handles - misc: fastrpc: fix possible map leak in fastrpc_put_args - misc: fastrpc: Fix fastrpc_map_lookup operation - nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() - ext4: fix checks for orphan inodes - ksmbd: fix error code overwriting in smb2_get_info_filesystem() - LoongArch: Automatically disable kaslr if boot from kexec_file - mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() - mfd: rz-mtu3: Fix MTU5 NFCR register offset - ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down - ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() - vhost: vringh: Modify the return value check - net/mlx5: fw reset, add reset timeout work - net/mlx5: pagealloc: Fix reclaim race during command interface teardown - net/mlx5: Stop polling for command response if interface goes down - net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable - nfp: fix RSS hash key size when RSS is not supported - mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands - drivers/base/node: fix double free in register_one_node() - hwrng: ks-sa - fix division by zero in ks_sa_rng_init - KEYS: X.509: Fix Basic Constraints CA flag parsing - Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements - Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO - vhost: vringh: Fix copy_to_iter return value check - RDMA/siw: Always report immediate post SQ errors - usb: vhci-hcd: Prevent suspending virtually attached devices - NFSv4.1: fix backchannel max_resp_sz verification check - coresight: trbe: Return NULL pointer for allocation failures - coresight: etm4x: Support atclk - coresight-etm4x: Conditionally access register TRCEXTINSELR - remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice - PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() - vfio/pds: replace bitmap_free with vfree - sparc: fix accurate exception reporting in copy_{from,to}_user for M7 - sparc: fix accurate exception reporting in copy_to_user for Niagara 4 - sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara - sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III - wifi: mac80211: fix Rx packet handling when pubsta information is not available - wifi: ath10k: avoid unnecessary wait for service ready message - Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram - IB/sa: Fix sa_local_svc_timeout_ms read race - RDMA/core: Resolve MAC of next-hop device without ARP support - f2fs: fix zero-sized extent for precache extents - scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() - scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() - scsi: qla2xxx: edif: Fix incorrect sign of error code - ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message - f2fs: fix to truncate first page in error path of f2fs_truncate() - f2fs: fix to update map->m_next_extent correctly in f2fs_map_blocks() - wifi: mt76: fix potential memory leak in mt76_wmac_probe() - RDMA/cm: Rate limit destroy CM ID timeout error message - drivers/base/node: handle error properly in register_one_node() - watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog - ipvs: Use READ_ONCE/WRITE_ONCE for ipvs->enable - iio: consumers: Fix offset handling in iio_convert_raw_to_processed() - iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() - fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist - fs: ntfs3: Fix integer overflow in run_unpack() - drm/msm/dpu: fix incorrect type for ret - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping - ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping - misc: genwqe: Fix incorrect cmd field being reported in error - usb: gadget: configfs: Correctly set use_os_string at bind - usb: phy: twl6030: Fix incorrect type for ret - drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() - tcp: fix __tcp_close() to only send RST when required - PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation - wifi: mwifiex: send world regulatory domain to driver - drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) - drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) - drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) - drm/amd/pm: Adjust si_upload_smc_data register programming (v3) - drm/amd/pm: Fix si_upload_smc_data (v3) - drm/amd/pm: Disable ULV even if unsupported (v3) - drm/amdgpu: Power up UVD 3 for FW validation (v2) - coresight: Only register perf symlink for sinks with alloc_buffer - inet: ping: check sock_net() in ping_get_port() and ping_lookup() - media: st-delta: avoid excessive stack usage - ALSA: lx_core: use int type to store negative error codes - media: rj54n1cb0c: Fix memleak in rj54n1_probe() - scsi: myrs: Fix dma_alloc_coherent() error check - hwrng: nomadik - add ARM_AMBA dependency - crypto: keembay - Add missing check after sg_nents_for_len() - drm/amd/display: Remove redundant semicolons - serial: max310x: Add error checking in probe() - usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls - usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup - phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 - media: zoran: Remove zoran_fh structure - drm/bridge: it6505: select REGMAP_I2C - f2fs: fix condition in __allow_reserved_blocks() - drm/radeon/r600_cs: clean up of dead code in r600_cs - drm/panel: novatek-nt35560: Fix invalid return value - bpf: Enforce expected_attach_type for tailcall compatibility - i2c: designware: Add disabling clocks when probe fails - i2c: designware: Fix clock issue when PM is disabled - i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD - thermal/drivers/qcom/lmh: Add missing IRQ includes - thermal/drivers/qcom: Make LMH select QCOM_SCM - hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems - once: fix race by moving DO_ONCE to separate section - smp: Fix up and expand the smp_call_function_many() kerneldoc - selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported - i3c: master: svc: Recycle unused IBI slot - i3c: master: svc: Use manual response for IBI events - ACPICA: Fix largest possible resource descriptor index - pwm: tiehrpwm: Fix corner case in clock divisor calculation - arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible - arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value - arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names - cpuidle: qcom-spm: fix device and OF node leaks at probe - firmware: firmware: meson-sm: fix compile-test default - arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 - null_blk: Fix the description of the cache_size module argument - pinctrl: renesas: Use int type to store negative error codes - power: supply: cw2015: Fix a alignment coding style issue - PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() - ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property - ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS - ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax - block: use int to store blk_stack_limits() return value - selftests/nolibc: fix EXPECT_NZ macro - regulator: scmi: Use int type to store negative error codes - arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map - ARM: at91: pm: fix MCKx restore routine - pinctrl: meson-gxl: add missing i2c_d pinmux - soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS - leds: flash: leds-qcom-flash: Update torch current clamp setting - ARM: dts: renesas: porter: Fix CAN pin group - libbpf: Fix reuse of DEVMAP - bpf: Remove migrate_disable in kprobe_multi_link_prog_run - bpf/selftests: Fix test_tcpnotify_user - regmap: Remove superfluous check for !config in __regmap_init() - arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 - x86/vdso: Fix output operand size of RDPID - smb: server: fix IRD/ORD negotiation with the client - coresight: trbe: Prevent overflow in PERF_IDX2OFF() - gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote - selftests: arm64: Check fread return value in exec_target - seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast - init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD - filelock: add FL_RECLAIM to show_fl_flags() macro - !21022 KVM: Don't clobber irqfd routing type when deassigning irqfd - !20998 ceph: fix oops due to invalid pointer for kfree() in parse_longname() - !21023 l2tp: avoid one data-race in l2tp_tunnel_del_work() - xsched: fix potential NULL dereference in xsched_quota_timeout_update - xsched: remove the standalone xcu_cfs_cg_deinit() helper - xsched: restructure xcu_cgrp_subsys teardown to align with cpu_cgrp_subsys lifecycle - xsched: simplify root group check by direct comparison with root_xcg - xsched: replace magic number with SCHED_CLASS_MAX_LENGTH for scheduler class string length - xsched/core: immediate cleanup of remaining operators on task exit - xsched: add init_fair_xsched_group() for XCU-specific fair group initialization - xsched: modify xcu_cg_initialize_components helper - xsched: refactor xsched_entity initialization - xsched: change rq_init() parameter from struct xsched_cu to struct xsched_rq - xsched: harden and clarify xcu_move_task() logic - xsched: move throttling-related fields from xsched_group_xcu_priv to xsched_rq_cfs - xsched/quota: add throttled flag to cfs_rq for robust hierarchical enqueue under throttling - xsched/quota: support multi-level cgroup - xsched: remove redundant xcu parameter from dequeue_ctx - xsched: update group shares using xcu_grp_shares_add/sub helpers - xsched: delete unused code - xsched/cfs: propagate group activation/deactivation up the hierarchy - xsched/cfs: move xruntime updates to pick/put paths - xsched: add has_running hook to xsched classes for wake-up eligibility check - !21012 [OLK-6.6][linux-6.6.y sync] Backport 6.6.110-6.6.111 LTS Patches - scsi: hisi_sas: Fix NULL pointer exception when do user_scan() - !21013 CVE-2026-23177 - !21007 bonding: fix use-after-free due to enslave fail after slave array update - !21006 net: Fix CVE-2026-23204 - bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path - bpf, test_run: Subtract size of xdp_frame from allowed metadata size - bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN - bpf: Make variables in bpf_prog_test_run_xdp less confusing - bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K - !21015 libceph: reset sparse-read state in osd_fault() - !21024 ub: udma: bugfix related to print messages. - !20980 Fix CVE-2026-23126 - !20922 Fix CVE-2026-23133 - ub: udma: bugfix related to print messages. - l2tp: avoid one data-race in l2tp_tunnel_del_work() - KVM: Don't clobber irqfd routing type when deassigning irqfd - ipv6: annotate data-race in ndisc_router_discovery() - macvlan: observe an RCU grace period in macvlan_common_newlink() error path - macvlan: fix error recovery in macvlan_common_newlink() - mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() - net: fix segmentation of forwarding fraglist GRO - can: rcar_canfd: Fix CAN-FD mode as default - libceph: reset sparse-read state in osd_fault() - !21008 uvb: fix cis call return value and obtain - mm, shmem: prevent infinite loop on truncate race - mm/shmem, swap: fix race of truncate and swap entry split - net/9p: fix double req put in p9_fd_cancelled - riscv: mm: Do not restrict mmap address based on hint - riscv: mm: Use hint address in mmap if available - driver core/PM: Set power.no_callbacks along with power.no_pm - serial: stm32: allow selecting console when the driver is module - hid: fix I2C read buffer overflow in raw_event() for mcp2221 - ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free - ALSA: usb-audio: Kill timer properly at removal - platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list - can: rcar_canfd: Fix controller mode setting - can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled - btrfs: ref-verify: handle damaged extent root tree - ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue - perf subcmd: avoid crash in exclude_cmds when excludes is empty - platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list - dm-integrity: limit MAX_TAG_SIZE to 255 - ASoC: amd: acp: Adjust pdm gain value - wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 - USB: serial: option: add SIMCom 8230C compositions - media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe - !20931 Fix CVE-2026-23060 - uvb: fix cis call return value and obtain - bonding: fix use-after-free due to enslave fail after slave array update - net/sched: cls_u32: use skb_header_pointer_careful() - net: add skb_header_pointer_careful() helper - regmap: Fix race condition in hwspinlock irqsave routine - crypto: virtio - Add spinlock protection with virtqueue notification - net/mlx5e: TC, delete flows only for existing peers - !20967 net: hns3: modify code of judging if SMMU DMA is enabled - ceph: fix oops due to invalid pointer for kfree() in parse_longname() - !20969 Fix CVE-2026-23125 - !20948 v4 arm64: Add memory poison recovery support for various paths - !20975 CVE-2026-23102 - !20977 v4 support apei_page_offline_policy - bonding: annotate data-races around slave->last_rx - netfilter: nf_conncount: update last_gc only when GC has been performed - bonding: provide a net pointer to __skb_flow_dissect() - netdevsim: fix a race issue related to the operation on bpf_bound_progs list - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() - apei/ghes: Add sysctl interface to control soft-offline page isolation - Revert "mm/memory-failure: support disabling soft offline for HugeTLB pages" - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - arm64/fpsimd: signal: Fix restoration of SVE context - arm64/fpsimd: signal: Consistently read FPSIMD context - arm64/fpsimd: signal: Mandate SVE payload for streaming-mode state - bonding: limit BOND_MODE_8023AD to Ethernet devices - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag - net/sched: Enforce that teql can only be used as root qdisc - sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT - drivers/net: Update vendor name of Chengdu NorthLink Technology N5/N6 Series Network Card Drivers - net: hns3: modify code of judging if SMMU DMA is enabled - dmaengine: xilinx: xdma: Fix regmap max_register - ub:ubus: protect iterator ue_list and mue_list with ub_bus_sem - ub:ubus: Avoid getting empty uent from ubc - ub:hisi-ubus: Use GFP_ATOMIC when alloc memory - arm64: send sig fault for user task when apei_claim_sea fails - arm64: add ras log during do_sea - arm64: move getting valid siaddr to the top of do_sea - arm64: mm: shmem: support poison recovery from shmem_file_read_iter() - arm64: fs: support poison recovery from __kernel_read() - iov_iter: add mc support for copy_page_to_iter - arm64: mm: support recovery from copy_{from/to}_user_page() - iov_iter: get rid of 'copy_mc' flag - leds: led-class: Only Add LED to leds_list when it is fully ready - wifi: ath10k: fix dma_free_coherent() pointer - smb/server: fix refcount leak in parse_durable_handle_context() - ksmbd: add chann_lock to protect ksmbd_chann_list xarray - ipvlan: Make the addrs_lock be per port - smb: client: split cached_fid bitfields to avoid shared-byte RMW races - efivarfs: fix error propagation in efivar_entry_get() - io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop - dm: use bio_clone_blkg_association - RAS/AMD/ATL: fix error nodes per socket on for Hygon Dhyana processor - net: txgbe: fix clang compile warning - !20552 ub: udma: fix some code issues. - !20313 Fix CVE-2025-40220 - !20321 nvme: fix admin request_queue lifetime - !20512 PM / devfreq: hisi: Fix potential UAF in OPP handling - !20544 Fix CVE-2025-71147 - !20548 v4 net: LTS-6.6 backport - !20503 Fix CVE-2025-39713 - !20133 Fix CVE-2025-39721 - !20438 Fix CVE-2025-38659 - !20264 Fix CVE-2025-40277 - !20340 Fix CVE-2025-40271 - !20319 Fix CVE-2025-40237 - !20392 vfs: Don't leak disconnected dentries on umount - !20554 iommu/s390: Implement blocking domain - !20489 [OLK-6.6][linux-6.6.y sync] Backport 6.6.101-6.6.102 LTS Patches - !20513 ACPI: PCC: Fix race condition by removing static qualifier - !20468 drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer - !20483 rcu: Protect ->defer_qs_iw_pending from data race - !20510 drivers/ub/sentry: fix primary eid index value - !20553 ub: cdma: support separated page table feature - ub: udma: fix some code issues. - !20480 iommu/ummu-core: fix error invalidate tid - !20561 iommu/ummu: Add ummu sva independent page table parameter - ub: udma: bugfix related to 2m_hugepage. - ub: udma: support for separate page tables - ub: udma: delete debugfs code. - ub: udma: bugfix related to ctrlq function. - ub: udma: verify get cqe/ae aux info out addr and len. - ub: cdma: support separated page table feature - iommu/ummu: Add ummu sva independent page table parameter - iommu: Adjust PLB refresh timing in 'grant' and 'ungrant' - !20505 Fix CVE-2026-23035 - iommu/s390: Implement blocking domain - drivers/ub/sentry: fix primary eid index value - !20535 libceph: make decode_pool() more resilient against corrupted osdmaps - !20536 mm/page_alloc: change all pageblocks migrate type on coalescing - !20537 mm/secretmem: fix use-after-free race in fault handler - !20538 wifi: avoid kernel-infoleak from struct iw_point - !20539 net: usb: rtl8150: fix memory leak on usb_submit_urb() failure - !20440 PCI/AER: Fix NULL pointer access by aer_info - !20262 Fix CVE-2025-68176 - netfilter: nf_reject: don't leak dst refcount for loopback packets - net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error - page_pool: always add GFP_NOWARN for ATOMIC allocations - virtio-net: fix received length check in big packets - net: bridge: fix use-after-free due to MST port state bypass - vsock: Ignore signal/timeout on connect() if already established - tls: make sure to abort the stream if headers are bogus - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI - xfrm: Duplicate SPI Handling - tls: handle data disappearing from under the TLS ULP - net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing - bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls - Bluetooth: hci_core: Fix use-after-free in vhci_flush() - KEYS: trusted: Fix a memory leak in tpm2_load_cmd - !20237 Fix CVE-2025-68724 - !20459 Fix CVE-2025-71131 - !20525 Fix CVE-2025-68816 - !20529 CVE-2025-68172 - net: usb: rtl8150: fix memory leak on usb_submit_urb() failure - !20370 Revert "Revert "RDMA/hns: Fix mismatch exception rollback"" - wifi: avoid kernel-infoleak from struct iw_point - mm/secretmem: fix use-after-free race in fault handler - mm/page_alloc: change all pageblocks migrate type on coalescing - libceph: make decode_pool() more resilient against corrupted osdmaps - pps: Fix kabi breakage of struct pps_device for last_fetched_ev - sched: Fix kabi breakage of struct task_struct for saved_state - crypto: aspeed - fix double free caused by devm - !20515 Bluetooth: bcsp: receive data only if registered - !20507 Fix CVE-2025-40358 - !20450 ub: ubase&unic: Fix some bug in concurrent process - !20452 iommu/ummu: Fix some bugs and optimize the code implementation - !20451 iommu/ummu: Add the function of creating devices with SVA-separated - !20500 mm: fix the inaccurate memory statistics issue for users - net/mlx5: fw_tracer, Validate format string parameters - Bluetooth: bcsp: receive data only if registered - ACPI: PCC: Fix race condition by removing static qualifier - ACPI: CPPC: Fix missing PCC check for guaranteed_perf - iommu/ummu: Add the function of creating devices with SVA-separated - iommu/ummu-core: fix error invalidate tid - riscv: stacktrace: Disable KASAN checks for non-current tasks - !20497 arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() - !20496 drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies - !20495 iommu/amd: Avoid stack buffer overflow from kernel cmdline - !20494 HID: core: Harden s32ton() against conversion to 0 bits - !20493 iommu: Fix two issues in iommu_copy_struct_from_user() - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv - PM / devfreq: hisi: Fix potential UAF in OPP handling - media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() - !20487 interference: Fix uninitialized ifs_clock compiling issue - MIPS: mm: kmalloc tlb_vpn array to avoid stack overflow - MIPS: mm: Prevent a TLB shutdown on initial uniquification - mm: fix the inaccurate memory statistics issue for users - mm: add config option for atomic mode in mm counter - Revert "mm: fix the inaccurate memory statistics issue for users" - !20444 net/mlx5e: Fix crash on profile change rollback failure - !20442 net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv - arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() - drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies - iommu/amd: Avoid stack buffer overflow from kernel cmdline - HID: core: Harden s32ton() against conversion to 0 bits - iommu: Fix two issues in iommu_copy_struct_from_user() - SUNRPC: call xs_sock_process_cmsg for all cmsg - flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read - !20374 [OLK 6.6]Use Hygon IBRS and IBPB rather than software-based mitigation to mitigate Retbleed and SRSO. - !20227 Rename leapioraid to leapraid and release v2.0 - mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery - MIPS: mm: tlb-r4k: Uniquify TLB entries on init - x86/fpu: Delay instruction pointer fixup until after warning - ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx() - ALSA: intel_hdmi: Fix off-by-one error in __hdmi_lpe_audio_probe() - x86/sev: Evict cache lines during SNP memory validation - net: usbnet: Fix the wrong netif_carrier_on() call - net: usbnet: Avoid potential RCU stall on LINK_CHANGE event - Bluetooth: btusb: Add USB ID 3625:010b for TP-LINK Archer TX10UB Nano - sched,freezer: Remove unnecessary warning in __thaw_task - freezer,sched: Clean saved_state when restoring it during thaw - freezer,sched: Do not restore saved_state of a thawed task - freezer,sched: Use saved_state to reduce some spurious wakeups - sched/core: Remove ifdeffery for saved_state - i2c: stm32f7: unmap DMA mapped buffer - i2c: stm32f7: simplify status messages in case of errors - i2c: stm32f7: perform most of irq job in threaded handler - i2c: stm32f7: use dev_err_probe upon calls of devm_request_irq - i2c: stm32f7: Use devm_clk_get_enabled() - USB: serial: option: add Foxconn T99W709 - smb: server: Fix extension string in ksmbd_extract_shortname() - ksmbd: fix corrupted mtime and ctime in smb2_open - ksmbd: fix Preauh_HashValue race condition - ksmbd: fix null pointer dereference error in generate_encryptionkey - vsock: Do not allow binding to VMADDR_PORT_ANY - selftests/perf_events: Add a mmap() correctness test - smb: client: return an error if rdma_connect does not return within 5 seconds - smb: client: let recv_done() cleanup before notifying the callers. - smb: client: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already - smb: client: make use of common smbdirect_socket - smb: smbdirect: add smbdirect_socket.h - smb: client: Correct typos in multiple comments across various files - smb: client: Use min() macro - smb: server: let recv_done() avoid touching data_transfer after cleanup/move - smb: server: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already - ALSA: hda/ca0132: Fix missing error handling in ca0132_alt_select_out() - irqchip: Build IMX_MU_MSI only on ARM - net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing - sunrpc: fix client side handling of tls alerts - net/sched: taprio: enforce minimum value for picos_per_byte - net: drop UFO packets in udp_rcv_segment() - ipv6: reject malicious packets in ipv6_gso_segment() - net/mlx5: Correctly set gso_segs when LRO is used - netlink: specs: ethtool: fix module EEPROM input/output arguments - net: ipa: add IPA v5.1 and v5.5 to ipa_version_string() - phy: mscc: Fix parsing of unicast frames - netpoll: prevent hanging NAPI when netcons gets enabled - md/md-cluster: handle REMOVE message earlier - NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY - NFS: Fix wakeup of __nfs_lookup_revalidate() in unblock_revalidate() - sched: Add test_and_clear_wake_up_bit() and atomic_dec_and_wake_up() - pNFS/flexfiles: don't attempt pnfs on fatal DS errors - PCI: pnv_php: Fix surprise plug detection and recovery - powerpc/eeh: Export eeh_unfreeze_pe() - PCI: pnv_php: Work around switches with broken presence detection - kconfig: qconf: fix ConfigList::updateListAllforAll() - scsi: sd: Make sd shutdown issue START STOP UNIT appropriately - scsi: ufs: core: Use link recovery when h8 exit fails during runtime resume - scsi: Revert "scsi: iscsi: Fix HW conn removal use after free" - scsi: mpt3sas: Fix a fw_event memory leak - vfio/pci: Separate SR-IOV VF dev_set - vfio/pds: Fix missing detach_ioas op - vfio: Prevent open_count decrement to negative - vfio: Fix unbalanced vfio_df_close call in no-iommu mode - f2fs: fix to calculate dirty data during has_not_enough_free_secs() - f2fs: fix to update upper_p in __get_secs_required() correctly - f2fs: vm_unmap_ram() may be called from an invalid context - f2fs: fix to avoid out-of-boundary access in devs.path - f2fs: doc: fix wrong quota mount option description - f2fs: fix KMSAN uninit-value in extent_info usage - rtc: rv3028: fix incorrect maximum clock rate handling - rtc: pcf8563: fix incorrect maximum clock rate handling - rtc: pcf85063: fix incorrect maximum clock rate handling - rtc: nct3018y: fix incorrect maximum clock rate handling - rtc: hym8563: fix incorrect maximum clock rate handling - rtc: ds1307: fix incorrect maximum clock rate handling - ucount: fix atomic_long_inc_below() argument type - module: Restore the moduleparam prefix length check - apparmor: fix loop detection used in conflicting attachment resolution - apparmor: ensure WB_HISTORY_SIZE value is a power of 2 - bpf: Check netfilter ctx accesses are aligned - bpf: Check flow_dissector ctx accesses are aligned - vhost-scsi: Fix log flooding with target does not exist errors - mtd: rawnand: atmel: set pmecc data setup time - mtd: rawnand: rockchip: Add missing check after DMA map - mtd: rawnand: atmel: Fix dma_mapping_error() address - jfs: fix metapage reference count leak in dbAllocCtl - crypto: qat - fix seq_file position update in adf_ring_next() - crypto: qat - fix DMA direction for compression on GEN2 devices - perf tools: Remove libtraceevent in .gitignore - sh: Do not use hyphen in exported variable name - ASoC: fsl_xcvr: get channel status data when PHY is not exists - dmaengine: nbpfaxi: Add missing check after DMA map - dmaengine: mv_xor: Fix missing check after DMA map and missing unmap - fs/orangefs: Allow 2 more characters in do_c_string() - PCI: endpoint: pci-epf-vntb: Fix the incorrect usage of __iomem attribute - soundwire: stream: restore params when prepare ports fail - crypto: img-hash - Fix dma_unmap_sg() nents value - crypto: keembay - Fix dma_unmap_sg() nents value - hwrng: mtk - handle devm_pm_runtime_enable errors - watchdog: ziirave_wdt: check record length in ziirave_firm_verify() - scsi: isci: Fix dma_unmap_sg() nents value - scsi: mvsas: Fix dma_unmap_sg() nents value - scsi: elx: efct: Fix dma_unmap_sg() nents value - scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value - clk: sunxi-ng: v3s: Fix de clock definition - perf tests bp_account: Fix leaked file descriptor - kernel: trace: preemptirq_delay_test: use offstack cpu mask - crypto: inside-secure - Fix `dma_unmap_sg()` nents value - perf sched: Fix memory leaks in 'perf sched latency' - perf sched: Fix memory leaks for evsel->priv in timehist - perf sched: Free thread->priv using priv_destructor - perf dso: Add missed dso__put to dso__load_kcore - perf tools: Fix use-after-free in help_unknown_cmd() - Fix dma_unmap_sg() nents value - clk: clk-axi-clkgen: fix fpfd_max frequency for zynq - fanotify: sanitize handle_type values when reporting fid - pinctrl: sunxi: Fix memory leak on krealloc failure - PCI: endpoint: pci-epf-vntb: Return -ENOENT if pci_epc_get_next_free_bar() fails - crypto: arm/aes-neonbs - work around gcc-15 warning - power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set - power: supply: cpcap-charger: Fix null check for power_supply_get_by_name - clk: xilinx: vcu: unregister pll_post only if registered correctly - media: v4l2-ctrls: Fix H264 SEPARATE_COLOUR_PLANE check - mtd: fix possible integer overflow in erase_xfer() - crypto: marvell/cesa - Fix engine load inaccuracy - crypto: qat - use unmanaged allocation for dc_data - crypto: sun8i-ce - fix nents passed to dma_unmap_sg() - PCI: rockchip-host: Fix "Unexpected Completion" log message - bpf/preload: Don't select USERMODE_DRIVER - ipv6: annotate data-races around rt->fib6_nsiblings - ipv6: fix possible infinite loop in fib6_info_uses_dev() - vrf: Drop existing dst reference in vrf_ip6_input_dst - selftests: rtnetlink.sh: remove esp4_offload after test - net/mlx5e: Clear Read-Only port buffer size in PBMC before update - netfilter: xt_nfacct: don't assume acct name is null-terminated - can: kvaser_usb: Assign netdev.dev_port based on device channel index - can: kvaser_pciefd: Store device channel index - can: peak_usb: fix USB FD devices potential malfunction - tools/rv: Do not skip idle in trace - Bluetooth: hci_event: Mask data status from LE ext adv reports - kcsan: test: Initialize dummy variable - wifi: mac80211: Write cnt before copying in ieee80211_copy_rnr_beacon() - wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE - wifi: ath12k: fix endianness handling while accessing wmi service bit - wifi: mac80211: Check 802.11 encaps offloading in ieee80211_tx_h_select_key() - wifi: mac80211: Don't call fq_flow_idx() for management frames - wifi: mac80211: Do not schedule stopped TXQs - wifi: plfxlc: Fix error handling in usb driver probe - wifi: mac80211: reject TDLS operations when station is not associated - iommu/amd: Fix geometry.aperture_end for V2 tables - mwl8k: Add missing check after DMA map - wifi: rtl8xxxu: Fix RX skb size for aggregation disabled - tcp: call tcp_measure_rcv_mss() for ooo packets - xen/gntdev: remove struct gntdev_copy_batch from stack - net_sched: act_ctinfo: use atomic64_t for three counters - net/sched: Restrict conditions for adding duplicating netems to qdisc tree - um: rtc: Avoid shadowing err in uml_rtc_start() - arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX - netfilter: nf_tables: adjust lockdep assertions handling - netfilter: nf_tables: Drop dead code from fill_*_info routines - fbcon: Fix outdated registered_fb reference in comment - drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value - m68k: Don't unregister boot console needlessly - drm/msm/dpu: Fill in min_prefill_lines for SC8180X - kselftest/arm64: Fix check for setting new VLs in sve-ptrace - net: dst: annotate data-races around dst->input - tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range - wifi: ath11k: clear initialized flag for deinit-ed srng lists - iwlwifi: Add missing check for alloc_ordered_workqueue - wifi: iwlwifi: Fix memory leak in iwl_mvm_init() - wifi: rtl818x: Kill URBs before clearing tx status queue - wifi: rtw89: avoid NULL dereference when RX problematic packet on unsupported 6 GHz band - caif: reduce stack size, again - bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure - drm/vmwgfx: Fix Host-Backed userspace on Guest-Backed kernel - net: ipv6: ip6mr: Fix in/out netdev to pass to the FORWARD chain - selftests/bpf: fix signedness bug in redir_partial() - bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls - bpf, sockmap: Fix psock incorrectly pointing to sk - drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed - staging: nvec: Fix incorrect null termination of battery manufacturer - interconnect: qcom: sc8180x: specify num_nodes - interconnect: qcom: sc8280xp: specify num_links for qnm_a1noc_cfg - soc: qcom: pmic_glink: fix OF node leak - samples: mei: Fix building on musl libc - cpufreq: Initialize cpufreq-based frequency-invariance later - cpufreq: intel_pstate: Always use HWP_DESIRED_PERF in passive mode - arm64: dts: imx8mn-beacon: Fix HS400 USDHC clock speed - arm64: dts: imx8mm-beacon: Fix HS400 USDHC clock speed - ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface - soc/tegra: cbb: Clear ERR_FORCE register with ERR_STATUS - arm: dts: ti: omap: Fixup pinheader typo - usb: early: xhci-dbc: Fix early_ioremap leak - powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw() - pps: fix poll support - staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() - spi: stm32: Check for cfg availability in stm32_spi_probe - usb: misc: apple-mfi-fastcharge: Make power supply names unique - usb: host: xhci-plat: fix incorrect type for of_match variable in xhci_plat_probe() - ARM: dts: vfxxx: Correctly use two tuples for timer address - arm64: dts: qcom: msm8976: Make blsp_dma controlled-remotely - arm64: dts: qcom: sc7180: Expand IMEM region - arm64: dts: qcom: sdm845: Expand IMEM region - soc: qcom: QMI encoding/decoding for big endian - selftests: Fix errno checking in syscall_user_dispatch test - ASoC: mediatek: use reserved memory or enable buffer pre-allocation - gfs2: No more self recovery - Revert "fs/ntfs3: Replace inode_trylock with inode_lock" - hfs: make splice write available again - hfsplus: make splice write available again - ublk: use vmalloc for ublk_device's __queues - fs_context: fix parameter name in infofc() macro - audit,module: restore audit logging in load failure case - ASoC: amd: yc: add DMI quirk for ASUS M6501RM - ASoC: Intel: fix SND_SOC_SOF dependencies - ASoC: amd: yc: Add DMI entries to support HP 15-fb1xxx - ethernet: intel: fix building with large NR_CPUS - ASoC: amd: yc: Add DMI quirk for HP Laptop 17 cp-2033dx - interference: Fix uninitialized ifs_clock compiling issue - iommu/ummu: optimize log printing - !20455 Fix compilation failure caused by PR#20174 - !20302 CVE-2026-22980 - !20142 CVE-2025-68803 - !20261 ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency - !20435 fix CVE-2026-22998 - !20433 scsi: target: Reset t_task_cdb pointer in error case - !20432 scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" - !20431 block: Use RCU in blk_mq_[un - !20307 tpm: Cap the number of PCR banks - !20062 xfs: Add xfs_dir3_leaf_header_check() in leaf/leafn read - !20157 v2 md: backport from mainline - rcu: Protect ->defer_qs_iw_pending from data race - platform/x86/intel/pmt: fix compilation failure caused by PR#20174 - iommu/ummu: optimize kv cache memory management - iommu/ummu: optimize permission table management - iommu/ummu: remove check for eid_type while del eid - iommu/ummu: optimize the code implementation - drivers/perf: fix ummu-pmu data reading exception - iommu/ummu: IOMMU_DOMAIN_BLOCKED type don not sync tct - drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer - crypto: seqiv - Do not use req->iv after crypto_aead_encrypt - net: unic: Notify mami of the bond ip change. - ub: ubase: Support for UE link by ctrlq message - ub: ubase: send a deactivate req in removing - ub: ubase: Querying TPG/TP contexts in the chip is no longer supported after enabling safe mode. - ub: ubase: Use an independent thread for the ctrlq workqueue. - !20368 ubcore: fix logging and permission for route query. - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id - !20344 ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr - net: unic: Fix the ummu 0xa event that occurs when modifying queues and resetting concurrent scenarios - ub: ubase: Add KABI compatibility - ub: ubase: fixing the issue of cdma ctp_req_vl parameter configuration - ub: ubase: add PMU IDEV interrupt supported abilities. - ub: ubase: Delete the tid mask for eq, jfs, jfr, and jfc context - ub: ubase: Set the completion event interrupt to auto - net: unic: fix poll tx read old skb cause a UAF bug - !20249 Fix CVE-2025-38489 - !20250 Fix CVE-2025-38480 - !20378 Fix CVE-2025-39838 - !20430 Fix CVE-2025-39942 - !20351 Fix CVE-2025-71149 - !20375 Fix CVE-2025-71150 - !20323 Fix CVE-2025-38730 - !20320 Fix CVE-2025-68814 - !20314 Fix CVE-2025-71072 - !20315 Fix CVE-2025-68794 - !20403 bpf: Check skb->transport_header is set in bpf_skb_check_mtu - !20402 bpf: Do not let BPF test infra emit invalid GSO types to stack - !20401 tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() - !20400 netfilter: nft_ct: add seqadj extension for natted connections - !20399 net: xfrm: Fix CVE-2025-40215 - !20398 net/sched: sch_qfq: Fix null-deref in agg_dequeue - !20397 bpf: Reject narrower access to pointer ctx fields - !20396 Bluetooth: eir: Fix possible crashes on eir_create_adv_data - !20394 IB/mlx5: Fix potential deadlock in MR deregistration - !20367 ub: cdma: cdma uaf bugfix - net/mlx5e: Fix crash on profile change rollback failure - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv - PCI/AER: Fix NULL pointer access by aer_info - gfs2: No more self recovery - drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE - crypto: qat - flush misc workqueue during device shutdown - !20174 Backport PMT spec 3.0 support - !20366 [Hygon][6.6][Bugfix]: Resolve FPU state corruption between atomic and non-atomic contexts - !19814 [OLK-6.6] Batch flushing user memory encrytion status change - !20393 [OLK-6.6][linux-6.6.y sync] Backport 6.6.100-6.6.101 LTS Patches - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec - nvmet-tcp: remove boilerplate code - scsi: target: Reset t_task_cdb pointer in error case - scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" - block: Use RCU in blk_mq_[un]quiesce_tagset() instead of set->tag_list_lock - ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size - ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer - smb: server: let recv_done() consistently call put_recvmsg/smb_direct_disconnect_rdma_connection - smb: server: remove separate empty_recvmsg_queue - !20384 ub:ubus: Fix ubus link message and pool device error - !20389 gfs2: Prevent recursive memory reclaim - !20388 *** fix CVE-2025-38062 *** - !20387 KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced - !20386 pinctrl: check the return value of pinmux_ops::get_function_name() - !20385 iommu/amd/pgtbl: Fix possible race while increase page table level - ub:ubus: Not cfg access during surprise down - ub:hisi-ubus: Delete validate_pa err print - PCI: cadence: Check for the existence of cdns_pcie::ops before using it - can: netlink: can_changelink(): allow disabling of automatic restart - Revert "selftests/bpf: Add a cgroup prog bpf_get_ns_current_pid_tgid() test" - drm/sched: Remove optimization that causes hang when killing dependent jobs - ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS - bpf: Check skb->transport_header is set in bpf_skb_check_mtu - bpf: Do not let BPF test infra emit invalid GSO types to stack - tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() - netfilter: nft_ct: add seqadj extension for natted connections - xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added - xfrm: delete x->tunnel as we delete x - x86/hw-vuln:Support hardware-based mitigation for Retbleed and SRSO via Hygon IBRS to avoid performance degradation caused by software-based mitigation. - net/sched: sch_qfq: Fix null-deref in agg_dequeue - bpf: Reject narrower access to pointer ctx fields - Bluetooth: eir: Fix possible crashes on eir_create_adv_data - IB/mlx5: Fix potential deadlock in MR deregistration - ub:ubus: Fix ubus link message and pool device error - ub:hisi-ubus: cq poller maximum handle 64 cqe per time - ub:hisi-ubus:Fix vdm message print error - ub:ubus:Fix ubus interrupt release issue - wifi: mt76: mt7921: prevent decap offload config before STA initialization - mtd: rawnand: qcom: Fix last codeword read in qcom_param_page_type_exec() - iio: hid-sensor-prox: Restore lost scale assignments - iio: hid-sensor-prox: Fix incorrect OFFSET calculation - crypto: powerpc/poly1305 - add depends on BROKEN for now - erofs: address D-cache aliasing - drm/i915/dp: Fix 2.7 Gbps DP_LINK_BW value on g4x - ALSA: hda: Add missing NVIDIA HDA codec IDs - ALSA: hda/tegra: Add Tegra264 support - comedi: comedi_test: Fix possible deletion of uninitialized timers - usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach - usb: typec: tcpm: allow switching to mode accessory to mux properly - usb: typec: tcpm: allow to use sink in accessory mode - drm/amdkfd: Don't call mmput from MMU notifier callback - mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n - selftests: mptcp: connect: also cover checksum - selftests: mptcp: connect: also cover alt modes - resource: fix false warning in __request_region() - gve: Fix stuck TX queue for DQ queue format - e1000e: ignore uninitialized checksum word on tgp - e1000e: disregard NVM checksum on tgp when valid checksum bit is not set - dpaa2-switch: Fix device reference count leak in MAC endpoint handling - dpaa2-eth: Fix device reference count leak in MAC endpoint handling - ALSA: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx - sprintf.h requires stdarg.h - bus: fsl-mc: Fix potential double device reference in fsl_mc_get_endpoint() - i2c: virtio: Avoid hang by using interruptible completion wait - i2c: tegra: Fix reset error handling with ACPI - platform/x86: ideapad-laptop: Fix kbd backlight not remembered among boots - can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode - can: dev: can_restart(): move debug message and stats after successful restart - can: dev: can_restart(): reverse logic to remove need for goto - i40e: When removing VF MAC filters, only check PF-set MAC - i40e: report VF tx_dropped with tx_errors instead of tx_discards - i40e: Add rx_missed_errors for buffer exhaustion - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch - net/mlx5: Fix memory leak in cmd_exec() - staging: vchiq_arm: Make vchiq_shutdown never fail - x86/hyperv: Fix usage of cpu_online_mask to get valid cpu - regmap: fix potential memory leak of regmap_bus - iio: adc: ad7949: use spi_is_bpw_supported() - interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1 node - RDMA/core: Rate limit GID cache warning messages - virtio_ring: Fix error reporting in virtqueue_resize - !20348 [OLK-6.6][linux-6.6.y sync] Backport 6.6.99-6.6.100 LTS Patches - !20346 tracing: Fix crash on synthetic stacktrace field usage - vfs: Don't leak disconnected dentries on umount - !20334 Fix CVE-2025-68780 - gfs2: Prevent recursive memory reclaim - amd/amdkfd: enhance kfd process check in switch partition - drm/amdkfd: allow compute partition mode switch with cgroup exclusions - KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced - pinctrl: check the return value of pinmux_ops::get_function_name() - iommu/amd/pgtbl: Fix possible race while increase page table level - !19966 nvme-fc: use lock accessing port_state and rport state - ASoC: fsl_sai: replace regmap_write with regmap_update_bits - comedi: Fix use of uninitialized data in insn_rw_emulate_bits() - cifs: prevent NULL pointer dereference in UTF16 conversion - ksmbd: Fix refcount leak when invalid session is found on session lookup - ubcore: fix logging and permission for route query. - !20232 driver/coda: VirtCCA supports MSI device DA - Revert "Revert "RDMA/hns: Fix mismatch exception rollback"" - !20197 ub: udma&ubase: fix a bug that caused long reboot time - x86: Resolve FPU state corruption between atomic and non-atomic contexts - ub: cdma: cdma uaf bugfix - ub: cdma: jfs call trace bugfix - !20353 x86/fpu: Clear XSTATE_BV[i - s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again - KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls - nvmem: layouts: u-boot-env: remove crc32 endianness conversion - i2c: omap: fix deprecated of_property_read_bool() use - ASoC: fsl_sai: Force a software reset when starting in consumer mode - regulator: pwm-regulator: Manage boot-on with disabled PWM channels - regulator: pwm-regulator: Calculate the output voltage for disabled PWMs - i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe() - i2c: omap: Fix an error handling path in omap_i2c_probe() - i2c: omap: Add support for setting mux - usb: dwc3: qcom: Don't leave BCR asserted - usb: hub: Don't try to recover devices lost during warm reset. - usb: hub: Fix flushing of delayed work used for post resume purposes - usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm - usb: hub: fix detection of high tier USB3 devices behind suspended hubs - arm64: Filter out SME hwcaps when FEAT_SME isn't implemented - ipv6: make addrconf_wq single threaded - !20354 cpufreq/sched: Explicitly synchronize limits_changed flag handling - sched/deadline: only set free_cpus for online runqueues - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 - cpufreq/sched: Explicitly synchronize limits_changed flag handling - io_uring/poll: correctly handle io_poll_add() return value on update - shmem: fix recovery on rename failures - io_uring: fix filename leak in __io_openat_prep() - Revert "cgroup_freezer: cgroup_freezing: Check if not frozen" - rxrpc: Fix transmission of an abort in response to an abort - rxrpc: Fix recv-recv race of completed call - net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree - net: bridge: Do not offload IGMP/MLD messages - hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf - netfilter: nf_conntrack: fix crash due to removal of uninitialised entry - ipv6: mcast: Delay put pmc->idev in mld_del_delrec() - net/mlx5: Correctly set gso_size when LRO is used - Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID - Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout - Bluetooth: SMP: If an unallowed command is received consider it a failure - Bluetooth: hci_sync: fix connectable extended advertising when using static random address - hwmon: (corsair-cpro) Validate the size of the received input buffer - selftests: net: increase inter-packet timeout in udpgro.sh - wifi: cfg80211: remove scan request n_channels counted_by - nvme: fix misaccounting of nvme-mpath inflight I/O - net: phy: Don't register LEDs for genphy - nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list() - rpl: Fix use-after-free in rpl_do_srh_inline(). - block: fix kobject leak in blk_unregister_queue - net: emaclite: Fix missing pointer increment in aligned_read() - soundwire: amd: fix for clearing command status register - soundwire: amd: fix for handling slave alerts after link is down - comedi: Fix use of uninitialized data in insn_rw_emulate_bits() - comedi: Fix some signed shift left operations - comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large - comedi: das6402: Fix bit shift out of bounds - comedi: das16m1: Fix bit shift out of bounds - comedi: aio_iiro_16: Fix bit shift out of bounds - comedi: pcl812: Fix bit shift out of bounds - iio: adc: stm32-adc: Fix race in installing chained IRQ handler - iio: adc: max1363: Reorder mode_list[] entries - iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] - iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush - soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled - soc: aspeed: lpc-snoop: Cleanup resources in stack-order - s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again - pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov - net: libwx: properly reset Rx ring descriptor - net: libwx: remove duplicate page_pool_put_full_page() - mmc: sdhci_am654: Workaround for Errata i2312 - mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models - mmc: bcm2835: Fix dma_unmap_sg() nents value - memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() - isofs: Verify inode mode when loading from disk - dmaengine: nbpfaxi: Fix memory corruption in probe() - af_packet: fix soft lockup issue caused by tpacket_snd() - af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() - arm64: dts: rockchip: use cs-gpios for spi1 on ringneck - arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on - arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency - net/mlx5: Update the list of the PCI supported devices - phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() - io_uring/poll: fix POLLERR handling - ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS - drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume - tracing/osnoise: Fix crash in timerlat_dump_stack() - spi: Add check for 8-bit transfer with 8 IO mode support - pch_uart: Fix dma_sync_sg_for_device() nents value - thunderbolt: Fix bit masking in tb_dp_port_set_hops() - i2c: stm32: fix the device used for the DMA map - tracing: Fix crash on synthetic stacktrace field usage - usb: musb: fix gadget state on disconnect - USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI - USB: serial: option: add Foxconn T99W640 - USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition - phy: tegra: xusb: Disable periodic tracking on Tegra234 - phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode - phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr - fs/proc: fix uaf in proc_readdir_de() - io_uring/net: commit partial buffers on retry - nvme: fix admin request_queue lifetime - fs/notify: call exportfs_encode_fid with s_umount - iomap: adjust read range correctly for non-block-aligned positions - fuse: fix livelock in synchronous file put from fuseblk workers - tpm: Cap the number of PCR banks - nfsd: provide locking for v4_end_grace - Revert "nfsd: provide locking for v4_end_grace" - config: enable config for PMT discovery driver - platform/x86/intel/pmt/discovery: use valid device pointer in dev_err_probe - platform/x86/intel/pmt: Fix kobject memory leak on init failure - platform/x86/intel/pmt: fix a crashlog NULL pointer access - platform/x86/intel/pmt: fix build dependency for kunit test - platform/x86/intel/pmt/discovery: fix format string warning - platform/x86/intel/pmt/discovery: Fix size_t specifiers for 32-bit - platform/x86/intel/pmt: KUNIT test for PMT Enhanced Discovery API - platform/x86/intel/pmt/telemetry: Add API to retrieve telemetry regions by feature - platform/x86/intel/pmt/discovery: Get telemetry attributes - platform/x86/intel/tpmi: Get OOBMSM CPU mapping from TPMI - platform/x86/intel/vsec: Set OOBMSM to CPU mapping - platform/x86/intel/tpmi: Relocate platform info to intel_vsec.h - docs: Add ABI documentation for intel_pmt feature directories - platform/x86/intel/pmt: Add PMT Discovery driver - sysfs: Fix crash on empty group attributes array - sysfs: Introduce a mechanism to hide static attribute_groups - platform/x86/intel/vsec: Add new Discovery feature - platform/x86/intel/vsec: Skip driverless features - platform/x86/intel/vsec: Skip absent features during initialization - platform/x86/intel/vsec: Add device links to enforce dependencies - platform/x86/intel/vsec: Create wrapper to walk PCI config space - platform/x86/intel/vsec: Add private data for per-device data - MAINTAINERS: Add link to documentation of Intel PMT ABI - platform/x86/intel/pmt: allow user offset for PMT callbacks - driver/coda: VirtCCA supports MSI device DA - ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency - Rename leapioraid to leapraid and release v2.0 - ub: udma: fix a bug that caused long reboot time. - ub: ubase: Accelerate when ctrl node is shutting down - platform/x86/intel/pmt: Use PMT callbacks - platform/x86/intel/vsec: Add PMT read callbacks - platform/x86/intel/vsec.h: Move to include/linux - md: prevent incorrect update of resync/recovery offset - md/raid1: Fix data corruption for degraded array with slow disk - md/raid1: set max_sectors during early return from choose_slow_rdev() - md-cluster: fix no recovery job when adding/re-adding a disk - md-cluster: fix hanging issue while a new disk adding - md/raid5: recheck if reshape has finished with device_lock held - md-cluster: Constify struct md_cluster_operations - md: Remove unneeded semicolon - md/raid5: fix spares errors about rcu usage - dm-raid: Fix WARN_ON_ONCE check for sync_thread in raid_resume - md: pass in max_sectors for pers->sync_request() - md: factor out helpers for different sync_action in md_do_sync() - md: replace last_sync_action with new enum type - md: use new helpers in md_do_sync() - md: don't fail action_store() if sync_thread is not registered - md: remove parameter check_seq for stop_sync_thread() - md: replace sysfs api sync_action with new helpers - md: factor out helper to start reshape from action_store() - md: add new helpers for sync_action - md: add a new enum type sync_action - md: rearrange recovery_flags - md/raid0: don't free conf on raid0_run failure - md: make md_flush_request() more readable - md: change the return value type of md_write_start to void - md: Revert "md: Fix overflow in is_mddev_idle" - md: don't account sync_io if iostats of the disk is disabled - md: Fix overflow in is_mddev_idle - md: add check for sleepers in md_wakeup_thread() - md: add a mddev_is_dm helper - md: add a mddev_add_trace_msg helper - md: add a mddev_trace_remap helper - dm-raid456, md/raid456: fix a deadlock for dm-raid456 while io concurrent with reshape - dm-raid: add a new helper prepare_suspend() in md_personality - dm-raid: really frozen sync_thread during suspend - md: add a new helper reshape_interrupted() - md: export helper md_is_rdwr() - md: export helpers to stop sync_thread - md: don't clear MD_RECOVERY_FROZEN for new dm-raid until resume - md/raid1: factor out helpers to choose the best rdev from read_balance() - md/raid1: factor out the code to manage sequential IO - md/raid1: factor out choose_bb_rdev() from read_balance() - md/raid1: factor out choose_slow_rdev() from read_balance() - md/raid1: factor out read_first_rdev() from read_balance() - md/raid1-10: factor out a new helper raid1_should_read_first() - md/raid1-10: add a helper raid1_check_read_range() - md/raid1: fix choose next idle in read_balance() - md/raid1: record nonrot rdevs while adding/removing rdevs to conf - md/raid1: factor out helpers to add rdev to conf - md: add a new helper rdev_has_badblock() - md: check mddev->pers before calling md_set_readonly() - md: clean up openers check in do_md_stop() and md_set_readonly() - md: sync blockdev before stopping raid or setting readonly - md: factor out a helper to sync mddev - md: return directly before setting did_set_md_closing - md: changed the switch of RAID_VERSION to if - md: merge the check of capabilities into md_ioctl_valid() - md: Don't suspend the array for interrupted reshape - md: Don't register sync_thread for reshape directly - md: Make sure md_do_sync() will set MD_RECOVERY_DONE - md: Don't ignore read-only array in md_check_recovery() - md: Don't ignore suspended array in md_check_recovery() - md: get rdev->mddev with READ_ONCE() - md: remove redundant md_wakeup_thread() - md: remove redundant check of 'mddev->sync_thread' - md: fix a suspicious RCU usage warning - raid: Remove now superfluous sentinel element from ctl_table array - NFSD: NFSv4 file creation neglects setting ACL - nfsd: set security label during create operations - xfs: Add xfs_dir3_leaf_header_check() in leaf/leafn read - nvme-fc: use lock accessing port_state and rport state - x86/mm: Batch flushing user memory encrytion status change - !20588 [OLK-6.6] Revert "x86/csv: Enhance CMA memory usage reporting for CSV3" - Revert "x86/csv: Enhance CMA memory usage reporting for CSV3" - !20576 media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg() - !20575 RDMA/cm: Fix leaking the multicast GID table reference - !20580 RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly - !20551 Fix CVE-2025-68785 - !20478 f2fs: fix to avoid potential deadlock - !20501 [OLK-6.6] backport important bugfix for bnxt driver from upstream linux-6.6.y - !20520 Fix CVE-2026-23038 - !20424 net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup - !20425 mlx5: Fix default values in create CQ - RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly - media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg() - RDMA/cm: Fix leaking the multicast GID table reference - net: openvswitch: fix middle attribute validation in push_nsh() action - net: openvswitch: remove never-working support for setting nsh fields - pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() - bnxt_en: Fix potential data corruption with HW GRO/LRO - f2fs: fix to avoid potential deadlock - mlx5: Fix default values in create CQ - net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup - riscv kernel upgrade to 6.6.0-138.0.0 - Fixed system hang when boot systemd on spacemit k3 - riscv: perf vendor events: fix lrw core PMU event mapping - !20727 v2 bpf: sockmap fixes - !20741 scsi: qla2xxx: Sanitize payload size to prevent member overflow - !20744 fix CVE-2025-38449 - !20763 net: usb: asix: validate PHY address before use - !20762 smc91x: fix broken irq-context in PREEMPT_RT - !20293 [Hygon][6.6][EDAC] The width of hash value is 2 bits for Hygon family 18h model 6h processors - !20290 [Hygon][6.6][Bugfix] Bug fix for EDAC to use unicast instead of broadcast on hygon family 18h model 4h - !20289 [Hygon][6.6][Bugfix] Bug fix for EDAC to correct the address translation on hygon family 18h model 4h - !20245 KVM: arm64: Refactor exit handlers - !20246 KVM: arm64: Mark some header functions as inline - !19005 [Hygon] [OLK-6.6] [Bugfix] Fix memory bandwidth counter width for Hygon QoS - !20292 [Hygon][6.6][TSC Adjust] Backport x86 TSC adjust patch - !20273 [Hygon][6.6][Bugfix] Get correct CPU LLC ID in guest for Hygon processors - !20722 [OLK-6.6][linux-6.6.y sync] Backport 6.6.104-6.6.106 LTS Patches - !20667 fix CVE-2024-50102 - !20736 netfilter: nf_tables: remove redundant chain validation on register store - !20758 ub: ubase: Fixed the alarm issue caused by the initialization of the structure variable definition. - !20721 obmm: reduce log noise for successful export/import/preimport - net: usb: asix: validate PHY address before use - smc91x: fix broken irq-context in PREEMPT_RT - !20731 devlink: rate: Unset parent pointer in devl_rate_nodes_destroy - !20732 libceph: return the handler error from mon_handle_auth_done() - !20743 mm: slub: avoid wake up kswapd in set_track_prepare - ub: ubase: Fixed the alarm issue caused by the initialization of the structure variable definition. - !20750 ub: cdma: adapted to UMMU interface changes - !20713 urma: DFX of log in kernel - urma: optimize log levels for kernel space - ub: cdma: adapted to UMMU interface changes - wifi: ath11k: avoid bit operation on key flags - drm/mediatek: fix potential OF node use-after-free - cpufreq: intel_pstate: Check IDA only before MSR_IA32_PERF_CTL writes - wifi: cfg80211: sme: store capped length in __cfg80211_connect_result() - !20708 ub:hisi-ubus: Add create bus instance ummu bypass - drm: fix kabi for struct drm_framebuffer - drm/framebuffer: Acquire internal references on GEM handles - drm/gem: Acquire references on GEM handles for framebuffers - mm: slub: avoid wake up kswapd in set_track_prepare - scsi: qla2xxx: Sanitize payload size to prevent member overflow - netfilter: nf_tables: remove redundant chain validation on register store - libceph: return the handler error from mon_handle_auth_done() - devlink: rate: Unset parent pointer in devl_rate_nodes_destroy - Documentation/hw-vuln: Add VMSCAPE documentation - dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status() - riscv: use lw when reading int cpu in asm_per_cpu - mm: slub: avoid wake up kswapd in set_track_prepare - tools: gpio: remove the include directory on make clean - tools: gpio: rm .*.cmd on make clean - drm/amd/amdgpu: Fix missing error return on kzalloc failure - drm/amdgpu: Replace DRM_* with dev_* in amdgpu_psp.c - perf bpf-event: Fix use-after-free in synthesis - drm/bridge: ti-sn65dsi86: fix REFCLK setting - spi: spi-fsl-lpspi: Clear status register after disabling the module - spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort - spi: spi-fsl-lpspi: Set correct chip-select polarity bit - spi: spi-fsl-lpspi: Fix transmissions when using CONT - hwmon: mlxreg-fan: Prevent fans from getting stuck at 0 RPM - pcmcia: omap: Add missing check for platform_get_resource - Revert "drm/amdgpu: Avoid extra evict-restore process." - ALSA: hda/realtek: Fix headset mic for TongFang X6[AF]R5xxY - ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model - drm/mediatek: Fix device/node reference count leaks in mtk_drm_get_all_drm_priv - drm/mediatek: Fix using wrong drm private data to bind mediatek-drm - drm/mediatek: Add crtc path enum for all_drm_priv array - vmxnet3: update MTU after device quiesce - net: dsa: microchip: linearize skb for tail-tagging switches - net: dsa: microchip: update tag_ksz masks for KSZ9477 family - dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status() - ALSA: hda/realtek - Add new HP ZBook laptop with micmute led fixup - ALSA: hda/realtek: Add support for HP Agusta using CS35L41 HDA - iio: pressure: mprls0025pa: use aligned_s64 for timestamp - iio: chemical: pms7003: use aligned_s64 for timestamp - iio: imu: inv_mpu6050: align buffer for timestamp - thermal/drivers/mediatek/lvts: Disable low offset IRQ for minimum threshold - nouveau: fix disabling the nonstall irq due to storm code - cpufreq: intel_pstate: Unchecked MSR aceess in legacy mode - net: pcs: rzn1-miic: Correct MODCTRL register offset - platform/x86/amd/pmc: Add TUXEDO IB Pro Gen10 AMD to spurious 8042 quirks list - drm/amdgpu: drop hw access in non-DC audio fini - wifi: mt76: mt7996: Initialize hdr before passing to skb_put_data() - wifi: mwifiex: Initialize the chan_stats array to zero - tcp_bpf: Fix copied value in tcp_bpf_sendmsg - skmsg: Return copied bytes in sk_msg_memcopy_from_iter - tcp_bpf: Add sk_rmem_alloc related logic for tcp_bpf ingress redirection - Revert "bpf, sockmap: Add sk_rmem_alloc check for sockmap" - ALSA: usb-audio: Add mute TLV for playback volumes on some devices - phy: mscc: Stop taking ts_lock for tx_queue and use its own lock - selftest: net: Fix weird setsockopt() in bind_bhash.c. - net: atm: fix memory leak in atm_register_sysfs when device_register fail - ax25: properly unshare skbs in ax25_kiss_rcv() - mctp: return -ENOPROTOOPT for unknown getsockopt options - net/smc: Remove validation of reserved bits in CLC Decline message - ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init() - net: thunder_bgx: decrement cleanup index before use - net: thunder_bgx: add a missing of_node_put - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() - wifi: libertas: cap SSID len in lbs_associate() - wifi: cw1200: cap SSID length in cw1200_do_join() - net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets - wifi: ath11k: fix group data packet drops during rekey - wifi: ath11k: avoid forward declaration of ath11k_mac_start_vdev_delay() - wifi: ath11k: rename ath11k_start_vdev_delay() - wifi: ath11k: Introduce and use ath11k_sta_to_arsta() - net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() - macsec: read MACSEC_SA_ATTR_PN with nla_get_uint - netlink: add variable-length / auto integers - net: macb: Fix tx_ptr_lock locking - icmp: fix icmp_ndo_send address translation for reply direction - mISDN: Fix memory leak in dsp_hwec_enable() - xirc2ps_cs: fix register access when enabling FullDuplex - netfilter: conntrack: helper: Replace -EEXIST by -EBUSY - wifi: cfg80211: fix use-after-free in cmp_bss() - arm64: dts: imx8mp: Fix missing microSD slot vqmmc on Data Modul i.MX8M Plus eDM SBC - arm64: dts: imx8mp: Fix missing microSD slot vqmmc on DH electronics i.MX8M Plus DHCOM - tee: optee: ffa: fix a typo of "optee_ffa_api_is_compatible" - arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro - Bluetooth: hci_sync: Avoid adding default advertising on startup - cpupower: Fix a bug where the -t option of the set subcommand was not working. - drm/amd/display: Don't warn when missing DCE encoder caps - cdc_ncm: Flag Intel OEM version of Fibocom L850-GL as WWAN - LoongArch: Save LBT before FPU in setup_sigcontext() - btrfs: avoid load/store tearing races when checking if an inode was logged - btrfs: fix race between setting last_dir_index_offset and inode logging - btrfs: fix race between logging inode and checking if it was logged before - bpf: Fix oob access in cgroup local storage - !20556 urma: fix update topo logic - !20639 [OLK-6.6][linux-6.6.y sync] Backport 6.6.103-6.6.104 LTS Patches - !20641 [OLK-6.6][linux-6.6.y sync] LoongArch: Add more instruction opcodes and emit_* helpers - !20560 *** fix CVE-2025-38062 *** - !20662 pNFS: Fix a deadlock when returning a delegation during open() - ub:hisi-ubus: Add create bus instance ummu bypass - Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" - Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set" - HID: mcp2221: Handle reads greater than 60 bytes - HID: mcp2221: Don't set bus speed on every transfer - net/mlx5: SF, Fix add port error handling - drm/nouveau/disp: Always accept linear modifier - smb3 client: fix return code mapping of remap_file_range - net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions - dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted - HID: wacom: Add a new Art Pen 2 - HID: logitech: Add ids for G PRO 2 LIGHTSPEED - HID: quirks: add support for Legion Go dual dinput modes - net: stmmac: Set CIC bit only for TX queues with COE - net: stmmac: xgmac: Correct supported speed modes - net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts - net/mlx5e: Set local Xoff after FW update - net/mlx5e: Update and set Xon/Xoff upon port speed set - net/mlx5e: Update and set Xon/Xoff upon MTU set - net/mlx5: Nack sync reset when SFs are present - net/mlx5: Convert SF port_indices xarray to function_ids xarray - net/mlx5: Use devlink port pointer to get the pointer of container SF struct - net/mlx5: Call mlx5_sf_id_erase() once in mlx5_sf_dealloc() - phy: mscc: Fix when PTP clock is register and unregister - net: dlink: fix multicast stats being counted incorrectly - dt-bindings: display/msm: qcom,mdp5: drop lut clock - drm/nouveau: remove unused memory target test - drm/nouveau: remove unused increment in gm200_flcn_pio_imem_wr - Bluetooth: hci_sync: fix set_local_name race condition - Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced - Bluetooth: hci_event: Mark connection as closed during suspend disconnect - Bluetooth: hci_event: Treat UNKNOWN_CONN_ID on disconnect as success - HID: input: report battery status changes immediately - HID: input: rename hidinput_set_battery_charge_status() - powerpc/kvm: Fix ifdef to remove build warning - drm/msm: Defer fd_install in SUBMIT ioctl - vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() - ACPI: EC: Add device to acpi_ec_no_wakeup[] qurik list - erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC - ASoC: codecs: tx-macro: correct tx_macro_component_drv name - smb: client: fix race with concurrent opens in unlink(2) - scsi: core: sysfs: Correct sysfs attributes access rights - of: dynamic: Fix use after free in of_changeset_add_prop_helper() - of: Add a helper to free property struct - mips: lantiq: xway: sysctrl: rename the etop node - mips: dts: lantiq: danube: add missing burst length property - pinctrl: STMFX: add missing HAS_IOMEM dependency - of: dynamic: Fix memleak when of_pci_add_properties() failed - !20684 urma: adjust urma log format - !20355 udp: Deal with race between UDP socket address change and rehash - !20627 Fixes CVE-2025-38627 - !20702 CVE-2025-39948 - !20701 netfilter: ctnetlink: remove refcounting in expectation dumpers - !20700 CVE-2025-38678 - !20703 CVE-2025-38491 - !20690 tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. - obmm: reduce log noise for successful export/import/preimport - mptcp: avoid deadlock on fallback while reinjecting - mptcp: plug races between subflow fail and subflow creation - mptcp: make fallback action and fallback decision atomic - ice: fix Rx page leak on multi-buffer frames - ice: fix incorrect counter for buffer allocation failures - ice: stop storing XDP verdict within ice_rx_buf - ice: gather page_count()'s of each frag right before XDP prog call - ice: Introduce ice_xdp_buff - netfilter: ctnetlink: remove refcounting in expectation dumpers - netfilter: nf_tables: reject duplicate device on updates - netfilter: nf_tables: Introduce functions freeing nft_hook objects - netfilter: nf_tables: Fix percpu address space issues in nf_tables_api.c - err.h: add ERR_PTR_PCPU(), PTR_ERR_PCPU() and IS_ERR_PCPU() macros - tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. - !20498 Fix CVE-2025-71118 - !20608 pmdomain: arm: scmi: Fix genpd leak on provider registration failure - !20679 x86/CPU/AMD: Add RDSEED fix for Zen5 - !20650 fix cve-2025-40300 - !20661 Input: alps - fix use-after-free bugs caused by dev3_register_work - !20664 backport some net bugfix from 6.6 lts - urma: adjust urma log format - !20678 ub: udma: close debug switch load parameters. - ub: udma: close debug switch load parameters. - x86/CPU/AMD: Add RDSEED fix for Zen5 - !20630 net: LTS-6.6 bugfix backport - !20632 net/sched: sch_qfq: do not free existing class in qfq_change_class() - !20631 macvlan: fix possible UAF in macvlan_forward_source() - !20628 Fix CVE-2025-39910 - !20659 v2 Fix CVE-2025-22090 - !20506 XSched: Update XSched manual - !20647 media: imon: make send_packet() more robust - !20646 ksm: use range-walk function to jump over holes in scan_get_next_rmap_item - !20645 fbcon: Set fb_display[i - !20648 parse_longname(): strrchr() expects NUL-terminated string - !20621 urma: modify log level - !20602 urma: fix the jfe uaf issue that occurred during the killall process. - !20567 urma:change log level and pass status 9 - !20640 iio: common: st_sensors: Fix use of uninitialize device structs - !20634 usb: gadget: udc: fix use-after-free in usb_gadget_state_work - !20633 net: dsa: properly keep track of conduit reference - !20635 fix CVE-2025-68231 - !20651 mm/slub: avoid accessing metadata when pointer is invalid in object_err() - !20649 drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb - !20652 mm/vmalloc: fix data race in show_numa_info() - x86: uaccess: don't use runtime-const rewriting in modules - x86: fix off-by-one in access_ok() - x86: fix user address masking non-canonical speculation issue - x86/uaccess: Zero the 8-byte get_range case on failure on 32-bit - x86/uaccess: Improve the 8-byte getuser() case - x86: fix whitespace in runtime-const assembler output - dcache: keep dentry_hashtable or d_hash_shift even when not used - runtime constants: add x86 architecture support - runtime constants: deal with old decrepit linkers - x86/uaccess: Add missing __force to casts in __access_ok() and valid_user_address() - !20345 arm64: entry: xcall/xint: make asm conditionals compatible with clang IAS - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). - libceph: replace BUG_ON with bounds check for map->max_osd - libceph: prevent potential out-of-bounds writes in handle_auth_session_key() - libceph: fix potential use-after-free in have_mon_and_osd_map() - sctp: Hold sock lock while iterating over address list - sctp: Prevent TOCTOU out-of-bounds write - sctp: Hold RCU read lock while iterating over address list - tipc: Fix use-after-free in tipc_mon_reinit_self(). - sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto - sctp: avoid NULL dereference when chunk data buffer is missing - bpf: Explicitly check accesses to bpf_sock_addr - ipvs: Defer ip_vs_ftp unregister during netns cleanup - nexthop: Forbid FDB status change while nexthop is in a group - netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). - net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer - sctp: initialize more fields in sctp_v6_from_sk() - pNFS: Fix a deadlock when returning a delegation during open() - Input: alps - fix use-after-free bugs caused by dev3_register_work - x86/cpu: Get CPU LLC ID from CPUID 0x8000001d in guest for Hygon processors - kernel/fork: only call untrack_pfn_clear() on VMAs duplicated for fork() - mm: (un)track_pfn_copy() fix + doc improvements - x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range() - !20642 mtdchar: fix integer overflow in read/write ioctls - mm/vmalloc: fix data race in show_numa_info() - mm/slub: avoid accessing metadata when pointer is invalid in object_err() - config: enable CONFIG_MITIGATION_VMESCAPE by default on x86 - x86/vmscape: Enable the mitigation - x86/vmscape: Enumerate VMSCAPE bug - x86/vmscape: Add conditional IBPB mitigation - drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb - parse_longname(): strrchr() expects NUL-terminated string - media: imon: make send_packet() more robust - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item - fbcon: Set fb_display[i]->mode to NULL when the mode is released - !20569 CVE-2024-35808 - mtdchar: fix integer overflow in read/write ioctls - !20619 Fix CVE-2026-22991 - !20612 net: hns3: extend HCLGE_FD_AD_COUNTER_NUM to 8 bits - LoongArch: Add more instruction opcodes and emit_* helpers - iio: common: st_sensors: Fix use of uninitialize device structs - !20581 null_blk: fix kmemleak by releasing references to fault configfs items - mm/mempool: fix poisoning order>0 pages with HIGHMEM - mm/page_poison: replace kmap_atomic() with kmap_local_page() - mm/mempool: replace kmap_atomic() with kmap_local_page() - usb: gadget: udc: fix use-after-free in usb_gadget_state_work - net: dsa: properly keep track of conduit reference - net/sched: sch_qfq: do not free existing class in qfq_change_class() - macvlan: fix possible UAF in macvlan_forward_source() - netfilter: nft_objref: validate objref and objrefmap expressions - arp: do not assume dev_hard_header() does not change skb->head - ip6_gre: make ip6gre_header() robust - netfilter: nf_tables: avoid chain re-validation if possible - netfilter: nf_tables: drop unused 3rd argument from validate callback ops - Revert "netfilter: nft_objref: validate objref and objrefmap expressions" - bpf: Fix reference count leak in bpf_prog_test_run_xdp() - net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset - ethtool: Avoid overflowing userspace buffer on stats query - ipvs: fix ipv4 null-ptr-deref in route error path - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() - !20596 mm/page_alloc: prevent pcp corruption with SMP=n - !20598 team: fix check for port enabled in team_queue_override_port_prio_changed() - !18823 hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio - mm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc() - kasan: avoid sleepable page allocation from atomic context - f2fs: compress: fix UAF of f2fs_inode_info in f2fs_free_dic - f2fs: compress: change the first parameter of page_array_{alloc,free} to sbi - !20583 [OLK-6.6][linux-6.6.y sync] Backport 6.6.102-6.6.103 LTS Patches - !20460 fbdev: Fix vmalloc out-of-bounds write in fast_imageblit - urma:fix log level and pass status 9 - urma: modify log level - !20592 CVE-2025-71141 fixup - !20594 CVE-2025-39744 fixup - !20607 powerpc/64s/slb: Fix SLB multihit issue during SLB preload - !20606 mm/huge_memory: fix NULL pointer deference when splitting folio - !20604 Fix CVE-2026-22984 - !20603 Fix CVE-2026-23021 - !20600 Fix CVE-2026-22990 - urma: fix the jfe uaf issue that occurred during the killall process. - !20380 pswiotlb: Adapt to the IOMMU DMA API upgraded by IOMMUFD - libceph: make free_choose_arg_map() resilient to partial allocation - drm/dp: Change AUX DPCD probe address from LANE0_1_STATUS to TRAINING_PATTERN_SET - net: hns3: extend HCLGE_FD_AD_COUNTER_NUM to 8 bits - net: hns3: extend HCLGE_FD_AD_QID to 11 bits - net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue - net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M - Revert "net: hns3: add support for FD counter" - !20587 dmaengine: stm32: dmamux: fix device leak on route allocation - pmdomain: arm: scmi: Fix genpd leak on provider registration failure - powerpc/64s/slb: Fix SLB multihit issue during SLB preload - mm/huge_memory: fix NULL pointer deference when splitting folio - !20562 LoongArch: BPF: Sign extend kfunc call arguments - !20470 ipv4: Fix reference count leak when using error routes with nexthop objects - !20471 net: sock: fix hardened usercopy panic in sock_recv_errqueue - !20472 net: fix memory leak in skb_segment_list for GRO packets - !20473 ipv4: ip_gre: make ipgre_header() robust - !20469 SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf - !20476 ipv6: Fix use-after-free in inet6_addr_del(). - !20477 svcrdma: bound check rq_pages index in inline path - !20578 ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() - !20579 fix CVE-2025-68768 - !20542 Fix NFS deadlock - USB: storage: Remove subclass and protocol overrides from Novatek quirk - cpuidle: governors: menu: Select polling state in some more cases - cpuidle: governors: menu: Rearrange main loop in menu_select() - cpuidle: menu: Update documentation after previous changes - Revert "drm/tegra: dsi: Clear enable register if powered by bootloader" - parisc: Remove spurious if statement from raw_copy_from_user() - ata: libata-scsi: Fix system suspend for a security locked drive - Revert "drm/amdgpu: fix incorrect vm flags to map bo" - mfd: axp20x: Set explicit ID for regulator cell if no IRQ line is present - drm/amd/display: use udelay rather than fsleep - sched/fair: Revert max_newidle_lb_cost bump - net: ipv4: fix regression in local-broadcast routes - tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers - PM: runtime: Do not clear needs_force_resume with enabled runtime PM - usb: typec: ucsi: psy: Set max current to zero when disconnected - io_uring/rw: cast rw->flags assignment to rwf_t - Documentation: ACPI: i2c-muxes: fix I2C device references - s390/hypfs: Enable limited access during lockdown - s390/hypfs: Avoid unnecessary ioctl registration in debugfs - ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation - net/mlx5e: Preserve shared buffer capacity during headroom updates - net/mlx5: Base ECVF devlink port attrs from 0 - Octeontx2-af: Skip overlap check for SPI field - bonding: send LACPDUs periodically in passive mode after receiving partner's LACPDU - bonding: Add independent control state machine - bonding: update LACP activity flag after setting lacp_active - net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate - ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc - gve: prevent ethtool ops after shutdown - phy: mscc: Fix timestamping for vsc8584 - net: ethernet: mtk_ppe: add RCU lock around dev_fill_forward_path - ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add - net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM - ALSA: usb-audio: Fix size validation in convert_chmap_v3() - mlxsw: spectrum: Forward packets with an IPv4 link-local source IP - Bluetooth: hci_conn: do return error from hci_enhanced_setup_sync() - Bluetooth: hci_event: fix MTU for BN == 0 in CIS Established - scsi: qla4xxx: Prevent a potential error pointer dereference - RDMA/bnxt_re: Fix to initialize the PBL array - RDMA/bnxt_re: Fix to remove workload check in SRQ limit path - RDMA/bnxt_re: Fix to do SRQ armena by default - RDMA/erdma: Fix ignored return value of init_kernel_qp - iosys-map: Fix undefined behavior in iosys_map_clear() - cgroup/cpuset: Use static_branch_enable_cpuslocked() on cpusets_insane_config_key - spi: spi-fsl-lpspi: Clamp too high speed_hz - usb: typec: maxim_contaminant: disable low power mode when reading comparator values - usb: typec: maxim_contaminant: re-enable cc toggle if cc is open and port is clean - iio: imu: inv_icm42600: change invalid data error to -EBUSY - iio: imu: inv_icm42600: Convert to uXX and sXX integer types - iio: imu: inv_icm42600: use = { } instead of memset() - iio: imu: inv_icm42600: switch timestamp type from int64_t __aligned(8) to aligned_s64 - iio: temperature: maxim_thermocouple: use DMA-safe buffer for spi_read() - iio: light: as73211: Ensure buffer holes are zeroed - tls: fix handling of zero-length records on the rx_list - powerpc/boot: Fix build with gcc 15 - mmc: sdhci-pci-gli: GL9763e: Mask the replay timer timeout of AER - compiler: remove __ADDRESSABLE_ASM{_STR,}() again - drm/amd/display: Don't overclock DCE 6 by 15% - usb: dwc3: pci: add support for the Intel Wildcat Lake - usb: dwc3: Ignore late xferNotReady event to prevent halt timeout - USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles - usb: storage: realtek_cr: Use correct byte order for bcs->Residue - USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera - usb: renesas-xhci: Fix External ROM access timeouts - usb: core: hcd: fix accessing unmapped memory in SINGLE_STEP_SET_FEATURE test - comedi: Make insn_rw_emulate_bits() do insn->n samples - usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive - cdx: Fix off-by-one error in cdx_rpmsg_probe() - most: core: Drop device reference after usage in get_channel() - iio: proximity: isl29501: fix buffered read on big-endian systems - iio: pressure: bmp280: Use IS_ERR() in bmp280_common_probe() - fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable() - drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS - cpuidle: governors: menu: Avoid selecting states with too much latency - cpuidle: menu: Remove iowait influence - mmc: sdhci-pci-gli: Add a new function to simplify the code - mmc: sdhci-pci-gli: Use PCI AER definitions, not hard-coded values - mptcp: disable add_addr retransmission when timeout is 0 - mptcp: remove duplicate sk_reset_timer call - use uniform permission checks for all mount propagation changes - arm64: dts: ti: k3-am62-main: Remove eMMC High Speed DDR support - scsi: mpi3mr: Serialize admin queue BAR writes on 32-bit systems - scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers - scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE - PCI: imx6: Add IMX8MM_EP and IMX8MP_EP fixed 256-byte BAR 4 in epc_features - PCI: imx6: Delay link start until configfs 'start' written - PCI: rockchip: Set Target Link Speed to 5.0 GT/s before retraining - PCI: rockchip: Use standard PCIe definitions - drm/amd/display: Fill display clock and vblank time in dce110_fill_display_configs - drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs - drm/amd/display: Fix DP audio DTO1 clock source on DCE 6. - drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3 - ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and EliteBook 830 G6 - mm/debug_vm_pgtable: clear page table entries at destroy_args() - squashfs: fix memory leak in squashfs_fill_super - mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for consistency - memstick: Fix deadlock by moving removing flag earlier - KVM: arm64: Fix kernel BUG() due to bad backport of FPSIMD/SVE/SME fix - sched/fair: Fix frequency selection for non-invariant case - kbuild: userprogs: use correct linker when mixing clang and GNU ld - ata: libata-scsi: Return aborted command when missing sense and result TF - PM: runtime: Take active children into account in pm_runtime_get_if_in_use() - PM: runtime: Simplify pm_runtime_get_if_active() usage - ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig - usb: dwc3: imx8mp: fix device leak at unbind - wifi: mac80211: check basic rates validity in sta_link_apply_parameters - KVM: x86: Take irqfds.lock when adding/deleting IRQ bypass producer - s390/mm: Remove possible false-positive warning in pte_free_defer() - btrfs: send: make fs_path_len() inline and constify its argument - btrfs: send: use fallocate for hole punching with send stream v2 - btrfs: send: avoid path allocation for the current inode when issuing commands - btrfs: send: keep the current inode's path cached - btrfs: send: add and use helper to rename current inode when processing refs - btrfs: send: only use boolean variables at process_recorded_refs() - btrfs: send: factor out common logic when sending xattrs - btrfs: populate otime when logging an inode item - btrfs: constify more pointer parameters - btrfs: fix ssd_spread overallocation - btrfs: open code timespec64 in struct btrfs_inode - xfs: fully decouple XFS_IBULK* flags from XFS_IWALK* flags - btrfs: abort transaction on unexpected eb generation at btrfs_copy_root() - btrfs: always abort transaction on failure to add block group to free space tree - btrfs: move transaction aborts to the error site in add_block_group_free_space() - btrfs: qgroup: fix race between quota disable and quota rescan ioctl - usb: typec: fusb302: cache PD RX state - block: Make REQ_OP_ZONE_FINISH a write operation - block: reject invalid operation in submit_bio_noacct - leds: flash: leds-qcom-flash: Fix registry access after re-bind - leds: flash: leds-qcom-flash: Limit LED current based on thermal condition - selftests/memfd: add test for mapping write-sealed memfd read-only - mm: update memfd seal write check to include F_SEAL_WRITE - mptcp: pm: kernel: flush: do not reset ADD_ADDR limit - mptcp: drop skb if MPTCP skb extension allocation fails - ipv6: sr: Fix MAC comparison to be constant-time - drm/amd/display: Don't overwrite dce60_clk_mgr - drm/amd/display: Add primary plane to commits for correct VRR handling - drm/amdkfd: Destroy KFD debugfs after destroy KFD wq - drm/amdgpu: update mmhub 3.0.1 client id mappings - drm/amdgpu: Avoid extra evict-restore process. - drm/amd: Restore cached power limit during resume - media: venus: venc: Clamp param smaller than 1fps and bigger than 240 - media: venus: vdec: Clamp param smaller than 1fps and bigger than 240. - media: venus: protect against spurious interrupts during probe - media: venus: hfi: explicitly release IRQ during teardown - media: qcom: camss: cleanup media device allocated resource on error path - media: ov2659: Fix memory leaks in ov2659_probe() - media: usbtv: Lock resolution while streaming - media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free() - media: verisilicon: Fix AV1 decoder clock frequency - media: vivid: fix wrong pixel_array control size - media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init() - media: hi556: correct the test pattern configuration - media: gspca: Add bounds checking to firmware parser - parisc: Update comments in make_insert_tlb - parisc: Try to fixup kernel exception in bad_area_nosemaphore path of do_page_fault() - parisc: Rename pte_needs_flush() to pte_needs_cache_flush() in cache.c - parisc: Makefile: explain that 64BIT requires both 32-bit and 64-bit compilers - parisc: Define and use set_pte_at() - parisc: Check region is readable by user in raw_copy_from_user() - soc/tegra: pmc: Ensure power-domains are in a known state - f2fs: fix to avoid out-of-boundary access in dnode page - phy: qcom: phy-qcom-m31: Update IPQ5332 M31 USB phy initialization sequence - vhost/vsock: Avoid allocating arbitrarily-sized SKBs - PCI: endpoint: Fix configfs group removal on driver teardown - PCI: endpoint: Fix configfs group list head handling - mtd: rawnand: renesas: Add missing check after DMA map - mtd: rawnand: fsmc: Add missing check after DMA map - mtd: spinand: propagate spinand_wait() errors from spinand_write_page() - mtd: spi-nor: Fix spi_nor_try_unlock_all() - hwmon: (gsc-hwmon) fix fan pwm setpoint show functions - pwm: mediatek: Fix duty and period setting - pwm: mediatek: Handle hardware enable and clock enable separately - pwm: imx-tpm: Reset counter if CMOD is 0 - wifi: ath11k: fix dest ring-buffer corruption when ring is full - wifi: ath11k: fix source ring-buffer corruption - wifi: ath11k: fix dest ring-buffer corruption - wifi: ath12k: fix dest ring-buffer corruption when ring is full - wifi: ath12k: fix source ring-buffer corruption - wifi: ath12k: fix dest ring-buffer corruption - wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table() - iio: adc: ad_sigma_delta: change to buffer predisable - zynq_fpga: use sgtable-based scatterlist wrappers - scsi: ufs: ufs-pci: Fix default runtime and system PM levels - scsi: ufs: ufs-pci: Fix hibernate state transition for Intel MTL-like host controllers - ata: libata-scsi: Fix ata_to_sense_error() status handling - scsi: mpi3mr: Fix race between config read submit and interrupt completion - dt-bindings: display: sprd,sharkl3-dsi-host: Fix missing clocks constraints - dt-bindings: display: sprd,sharkl3-dpu: Fix missing clocks constraints - arm64: dts: ti: k3-am62-verdin: Enable pull-ups on I2C buses - arm64: dts: ti: k3-am62a7-sk: fix pinmux for main_uart1 - arm64: dts: ti: k3-pinctrl: Enable Schmitt Trigger by default - btrfs: zoned: fix write time activation failure for metadata block group - ext4: fix hole length calculation overflow in non-extent inodes - ext4: don't try to clear the orphan_present feature block device is r/o - ext4: fix reserved gdt blocks handling in fsmap - ext4: fix fsmap end of range reporting with bigalloc - ext4: check fast symlink for ea_inode correctly - tracing: fprobe-event: Sanitize wildcard for fprobe event name - crypto: qat - lower priority for skcipher and aead algorithms - lib/crypto: mips/chacha: Fix clang build and remove unneeded byteswap - vt: defkeymap: Map keycodes above 127 to K_HOLE - vt: keyboard: Don't process Unicode characters in K_OFF mode - bus: mhi: host: Fix endianness of BHI vector table - usb: dwc3: meson-g12a: fix device leaks at unbind - usb: musb: omap2430: fix device leak at unbind - usb: gadget: udc: renesas_usb3: fix device leak at unbind - usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init() - m68k: Fix lost column on framebuffer debug console - platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister() - cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table() - rcu: Fix racy re-initialization of irq_work causing hangs - HID: apple: avoid setting up battery timer for devices without battery - HID: magicmouse: avoid setting up battery timer when not needed - RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages - tools/nolibc: fix spelling of FD_SETBITMASK in FD_* macros - media: uvcvideo: Do not mark valid metadata as invalid - media: venus: Fix OOB read due to missing payload bound check - parisc: Makefile: fix a typo in palo.conf - fbdev: Fix vmalloc out-of-bounds write in fast_imageblit - btrfs: do not allow relocation of partially dropped subvolumes - btrfs: zoned: do not select metadata BG as finish target - btrfs: clear dirty status from extent buffer on error at insert_new_root() - btrfs: zoned: do not remove unwritten non-data block group - btrfs: abort transaction during log replay if walk_log_tree() failed - btrfs: zoned: use filesystem size not disk size for reclaim decision - cdc-acm: fix race between initial clearing halt and open - thunderbolt: Fix copy+paste error in match_service_id() - usb: typec: ucsi: Update power_supply on power role change - misc: rtsx: usb: Ensure mmc child device is active when card is present - iommufd: Report unmapped bytes in the error path of iopt_unmap_iova_range - cifs: reset iface weights when we cannot find a candidate - drm/amdgpu: fix incorrect vm flags to map bo - scsi: lpfc: Remove redundant assignment to avoid memory leak - rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe - pNFS: Handle RPC size limit for layoutcommits - pNFS: Fix disk addr range check in block/scsi layout - pNFS: Fix stripe mapping in block/scsi layout - ASoC: Intel: avs: Fix uninitialized pointer error in probe() - net: phy: smsc: add proper reset flags for LAN8710A - ipmi: Fix strcpy source and destination the same - kconfig: lxdialog: fix 'space' to (de)select options - kconfig: gconf: fix potential memory leak in renderer_edited() - kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed() - ipmi: Use dev_warn_ratelimited() for incorrect message warnings - vfio/mlx5: fix possible overflow in tracking max message size - scsi: aacraid: Stop using PCI_IRQ_AFFINITY - scsi: target: core: Generate correct identifiers for PR OUT transport IDs - scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans - kconfig: nconf: Ensure null termination where strncpy is used - vfio/type1: conditional rescheduling while pinning - kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c - f2fs: check the generic conditions first - exfat: add cluster chain loop check for dir - i2c: Force DLL0945 touchpad i2c freq to 100khz - apparmor: use the condition in AA_BUG_FMT even with debug disabled - dm-table: fix checking for rq stackable devices - dm-mpath: don't print the "loaded" message if registering fails - i3c: master: Initialize ret in i3c_i2c_notifier_call() - i3c: don't fail if GETHDRCAP is unsupported - apparmor: shift ouid when mediating hard links in userns - rtc: ds1307: handle oscillator stop flag (OSF) for ds1341 - i3c: add missing include to internal header - module: Prevent silent truncation of module name in delete_module(2) - md: dm-zoned-target: Initialize return variable r to avoid uninitialized use - soundwire: Move handle_nested_irq outside of sdw_dev_lock - soundwire: amd: serialize amd manager resume sequence during pm_prepare - crypto: octeontx2 - add timeout for load_fvc completion poll - media: uvcvideo: Fix bandwidth issue for Alcor camera - media: usb: hdpvr: disable zero-length read messages - media: tc358743: Increase FIFO trigger level to 374 - media: tc358743: Return an appropriate colorspace from tc358743_set_fmt - media: tc358743: Check I2C succeeded during probe - pinctrl: stm32: Manage irq affinity settings - scsi: mpi3mr: Correctly handle ATA device errors - scsi: mpt3sas: Correctly handle ATA device errors - power: supply: qcom_battmgr: Add lithium-polymer entry - RDMA/core: reduce stack using in nldev_stat_get_doit() - dmaengine: stm32-dma: configure next sg only if there are more than 2 sgs - leds: leds-lp50xx: Handle reg to get correct multi_index - media: v4l2-common: Reduce warnings about missing V4L2_CID_LINK_FREQ control - MIPS: lantiq: falcon: sysctrl: fix request memory check logic - crypto: jitter - fix intermediary handling - watchdog: iTCO_wdt: Report error if timeout configuration fails - MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free} - clk: qcom: ipq5018: keep XO clock always on - hwmon: (emc2305) Set initial PWM minimum value during probe based on thermal state - watchdog: dw_wdt: Fix default timeout - fs/orangefs: use snprintf() instead of sprintf() - phy: rockchip-pcie: Properly disable TEST_WRITE strobe signal - mfd: axp20x: Set explicit ID for AXP313 regulator - clk: tegra: periph: Fix error handling and resolve unsigned compare warning - fbdev: fix potential buffer overflow in do_register_framebuffer() - cifs: Fix calling CIFSFindFirst() for root path without msearch - watchdog: sbsa: Adjust keepalive timeout to avoid MediaTek WS0 race condition - drm/amd/display: Avoid configuring PSR granularity if PSR-SU not supported - drm/amd/display: Only finalize atomic_obj if it was initialized - vhost: fail early when __vhost_add_used() fails - vsock/virtio: Resize receive buffers so that each SKB fits in a 4K page - net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325 - rcu: Fix rcu_read_unlock() deadloop due to IRQ work - drm/amd/display: Avoid trying AUX transactions on disconnected ports - selftests/bpf: Fix a user_ringbuf failure with arm64 64KB page size - bpf: Make reg_not_null() true for CONST_PTR_TO_MAP - uapi: in6: restore visibility of most IPv6 socket options - drm/ttm: Should to return the evict error - drm: renesas: rz-du: mipi_dsi: Add min check for VCLK range - net: ncsi: Fix buffer overflow in fetching version id - ionic: clean dbpage in de-init - wifi: rtlwifi: fix possible skb memory leak in _rtl_pci_init_one_rxdesc() - ptp: Use ratelimite for freerun error message - bpftool: Fix JSON writer resource leak in version command - net: dsa: b53: prevent SWITCH_CTRL access on BCM5325 - net: dsa: b53: prevent DIS_LEARNING access on BCM5325 - net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325 - net: dsa: b53: fix b53_imp_vlan_setup for BCM5325 - gve: Return error for unknown admin queue command - net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs - net: vlan: Make is_vlan_dev() a stub when VLAN is not configured - drm/amd: Allow printing VanGogh OD SCLK levels without setting dpm to manual - dpaa_eth: don't use fixed_phy_change_carrier - wifi: iwlegacy: Check rate_idx range after addition - netmem: fix skb_frag_address_safe with unreadable skbs - powerpc: floppy: Add missing checks after DMA map - wifi: ath12k: Decrement TID on RX peer frag setup error handling - wifi: ath12k: Enable REO queue lookup table feature on QCN9274 hw2.0 - wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`. - wifi: mac80211: update radar_required in channel context after channel switch - drm/amd/display: Fix 'failed to blank crtc!' - wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect - wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd() - wifi: ath12k: Add memset and update default rate value in wmi tx completion - drm/amd/display: Separate set_gsl from set_gsl_source_select - net: fec: allow disable coalescing - net: atlantic: add set_power to fw_ops for atl2 to fix wol - net: thunderbolt: Fix the parameter passing of tb_xdomain_enable_paths()/tb_xdomain_disable_paths() - net: thunderbolt: Enable end-to-end flow control also in transmit - kselftest/arm64: Specify SVE data when testing VL set in sve-ptrace - wifi: mt76: mt7915: mcu: re-init MCU before loading FW patch - wifi: rtw89: Disable deep power saving for USB/SDIO - wifi: rtw89: Fix rtw89_mac_power_switch() for USB - drm/msm: use trylock for debugfs - wifi: mac80211: fix rx link assignment for non-MLO stations - ipv6: mcast: Check inet6_dev->dead under idev->mc_lock in __ipv6_dev_mc_inc(). - (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer - wifi: mac80211: don't complete management TX on SAE commit - sched/fair: Bump sd->max_newidle_lb_cost when newidle balance fails - s390/stp: Remove udelay from stp_sync_clock() - wifi: iwlwifi: mvm: fix scan request validation - um: Re-evaluate thread flags repeatedly - wifi: iwlwifi: mvm: set gtk id also in older FWs - perf/cxlpmu: Remove unintended newline from IRQ name format string - net: phy: micrel: Add ksz9131_resume() - net: thunderx: Fix format-truncation warning in bgx_acpi_match_id() - net: ipv4: fix incorrect MTU in broadcast routes - wifi: cfg80211: Fix interface type validation - net: mctp: Prevent duplicate binds - arm64: Mark kernel as tainted on SAE and SError panic - net/mlx5e: Properly access RCU protected qdisc_sleeping variable - net: ag71xx: Add missing check after DMA map - et131x: Add missing check after DMA map - wifi: rtw89: Lower the timeout in rtw89_fw_read_c2h_reg() for USB - be2net: Use correct byte order and format string for TCP seq and ack_seq - s390/time: Use monotonic clock in get_cycles() - wifi: cfg80211: reject HTC bit for management frames - ktest.pl: Prevent recursion of default variable options - wifi: ath12k: Correct tid cleanup when tid setup fails - net: usb: cdc-ncm: check for filtering capability - xen/netfront: Fix TX response spurious interrupts - Bluetooth: hci_sock: Reset cookie to zero in hci_sock_free_cookie() - powerpc/thp: tracing: Hide hugepage events under CONFIG_PPC_BOOK3S_64 - ASoC: qcom: use drvdata instead of component to keep id - ASoC: codecs: rt5640: Retry DEVICE_ID verification - iio: adc: ad7768-1: Ensure SYNC_IN pulse minimum timing requirement - ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros - ALSA: pcm: Rewrite recalculate_boundary() to avoid costly loop - platform/chrome: cros_ec_typec: Defer probe on missing EC parent - platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches - soc: qcom: mdt_loader: Actually use the e_phoff - imx8m-blk-ctrl: set ISI panic write hurry level - pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop() - usb: core: usb_submit_urb: downgrade type check - usb: typec: intel_pmc_mux: Defer probe if SCU IPC isn't present - ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4 - ASoC: hdac_hdmi: Rate limit logging on connection and disconnection - ALSA: hda: Disable jack polling at shutdown - ALSA: hda: Handle the jack polling always via a work - mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode() - mei: bus: Check for still connected devices in mei_cl_bus_dev_release() - char: misc: Fix improper and inaccurate error code returned by misc_init() - reset: brcmstb: Enable reset drivers for ARCH_BCM2835 - pps: clients: gpio: fix interrupt handling order in remove path - ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path - mmc: sdhci-msm: Ensure SD card power isn't ON when card removed - ACPI: processor: fix acpi_object initialization - PM: sleep: console: Fix the black screen issue - thermal: sysfs: Return ENODATA instead of EAGAIN for reads - PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit() - firmware: tegra: Fix IVC dependency problems - ACPI: PRM: Reduce unnecessary printing to avoid user confusion - selftests: tracing: Use mutex_unlock for testing glob filter - tools/build: Fix s390(x) cross-compilation with clang - gpio: tps65912: check the return value of regmap_update_bits() - iio: adc: ad_sigma_delta: don't overallocate scan buffer - tools/nolibc: define time_t in terms of __kernel_old_time_t - thermal/drivers/qcom-spmi-temp-alarm: Enable stage 2 shutdown when required - ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed - EDAC/synopsys: Clear the ECC counters on init - gpio: wcd934x: check the return value of regmap_update_bits() - remoteproc: imx_rproc: skip clock enable when M-core is managed by the SCU - soc: qcom: rpmh-rsc: Add RSC version 4 support - usb: xhci: Avoid showing errors during surprise removal - usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command - usb: xhci: Avoid showing warnings for dying controller - usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default - selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t - cpufreq: CPPC: Mark driver with NEED_UPDATE_LIMITS flag - platform/x86/amd: pmc: Add Lenovo Yoga 6 13ALC6 to pmc quirk list - usb: xhci: print xhci->xhc_state when queue_command failed - tracefs: Add d_delete to remove negative dentries - securityfs: don't pin dentries twice, once is enough... - fix locking in efi_secret_unlink() - ext2: Handle fiemap on empty files to prevent EINVAL - fs/ntfs3: correctly create symlink for relative path - fs/ntfs3: Add sanity check for file name - better lockdep annotations for simple_recursive_removal() - hfs: fix not erasing deleted b-tree node issue - drbd: add missing kref_get in handle_write_conflicts - udf: Verify partition map count - gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops - nvme-pci: try function level reset on init failure - smb/server: avoid deadlock when linking with ReplaceIfExists - arm64: Handle KCOV __init vs inline mismatches - ptp: prevent possible ABBA deadlock in ptp_clock_freerun() - intel_idle: Allow loading ACPI tables for any family - net: ti: icss-iep: Fix incorrect type for return value in extts_enable() - netfilter: ctnetlink: fix refcount leak on table dump - udp: also consider secpath when evaluating ipsec use for checksumming - KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs - KVM: nVMX: Check vmcs12->guest_ia32_debugctl on nested VM-Enter - KVM: VMX: Extract checking of guest's DEBUGCTL into helper - KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported - KVM: VMX: Handle forced exit due to preemption timer in fastpath - KVM: VMX: Re-enter guest in fastpath for "spurious" preemption timer exits - KVM: x86: Plumb "force_immediate_exit" into kvm_entry() tracepoint - libceph: prevent potential out-of-bounds reads in handle_auth_done() - net: usb: pegasus: fix memory leak in update_eth_regs_async() - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() - !20540 urma: added support for ipoverurma - team: fix check for port enabled in team_queue_override_port_prio_changed() - mm/page_alloc: prevent pcp corruption with SMP=n - !20528 Fix CVE-2025-71083 - KVM: nVMX: Defer SVI update to vmcs01 on EOI when L2 is active w/o VID - KVM: x86: Plumb in the vCPU to kvm_x86_ops.hwapic_isr_update() - KVM: SVM: Set RFLAGS.IF=1 in C code, to get VMRUN out of the STI shadow - smb: client: don't wait for info->send_pending == 0 on error - smb: client: let send_done() cleanup before calling smbd_disconnect_rdma_connection() - ACPI: processor: perflib: Move problematic pr->performance check - ACPI: processor: perflib: Fix initial _PPC limit application - Documentation: ACPI: Fix parent device references - fs: Prevent file descriptor table allocations exceeding INT_MAX - sunvdc: Balance device refcount in vdc_port_mpgroup_check - PCI: Extend isolated function probing to LoongArch - NFSD: detect mismatch of file handle and delegation stateid in OPEN op - net: dpaa: fix device leak when querying time stamp info - net: ti: icss-iep: fix device and OF node leaks at probe - net: mtk_eth_soc: fix device leak at probe - net: enetc: fix device and OF node leak at probe - net: gianfar: fix device leak when querying time stamp info - net: phy: micrel: fix KSZ8081/KSZ8091 cable test - gpio: mlxbf3: use platform_get_irq_optional() - gpio: mlxbf2: use platform_get_irq_optional() - gpio: virtio: Fix config space reading. - ALSA: hda/realtek: Add Framework Laptop 13 (AMD Ryzen AI 300) to quirks - ALSA: hda/realtek: Fix headset mic on HONOR BRB-X - ALSA: usb-audio: Validate UAC3 cluster segment descriptors - rcu: Fix racy re-initialization of irq_work causing hangs - rcu: Fix rcu_read_unlock() deadloop due to IRQ work - drm/tilcdc: Fix removal actions in case of failed probe - drm/tilcdc: request and mapp iomem with devres - urma: fix update topo logic - dmaengine: stm32: dmamux: fix device leak on route allocation - pswiotlb: Adapt to the IOMMU DMA API upgraded by IOMMUFD - null_blk: fix kmemleak by releasing references to fault configfs items - inet: frags: flush pending skbs in fqdir_pre_exit() - inet: frags: add inet_frag_queue_flush() - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() - md/dm-raid: don't clear MD_RECOVERY_FROZEN after setting frozen - md/dm-raid: don't call md_reap_sync_thread() directly - ACPICA: Avoid walking the Namespace if start_node is NULL - arm64: entry: xcall/xint: make asm conditionals compatible with clang IAS - LoongArch: BPF: Sign extend kfunc call arguments - genirq/msi:: Fix kabi break of struct msi_desc - genirq/msi: Store the IOMMU IOVA directly in msi_desc instead of iommu_cookie - NFS: Fix a deadlock involving nfs_release_folio() - Revert "[Huawei] Revert "NFS: fix up nfs_release_folio() to try to release the page"" - urma: added support for ipoverurma - drm/ttm: Avoid NULL pointer deref for evicted BOs - XSched: Update XSched manual - svcrdma: bound check rq_pages index in inline path - ipv6: Fix use-after-free in inet6_addr_del(). - ipv4: ip_gre: make ipgre_header() robust - net: fix memory leak in skb_segment_list for GRO packets - net: sock: fix hardened usercopy panic in sock_recv_errqueue - ipv4: Fix reference count leak when using error routes with nexthop objects - SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf - fbdev: Fix vmalloc out-of-bounds write in fast_imageblit - udp: Deal with race between UDP socket address change and rehash - EDAC/amd64: The width of hash value is 2 bits for Hygon family 18h model 6h processors - x86/tsc: Use topology_max_packages() to get package number - EDAC/amd64: Use unicast instead of broadcast to access the cs_config register - EDAC/amd64: Correct the address translation for hygon family 18h model 4h - KVM: arm64: Mark some header functions as inline - KVM: arm64: Refactor exit handlers - x86/resctrl: Fix memory bandwidth counter width for Hygon CPUs - hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio - !20820 ub/obmm: add sysfs interface for mempool statistics & bugfixes - ub/obmm: fix wrong pxm_numa parameter validation - ub/obmm: Remove unused parameters from obmm_addr_check.c - ub/obmm: Enhance mem_allocator_granu validation - ub/obmm: simplify allocator naming scheme - ub/obmm: fix allow_slow logic and optimize conti_alloc_memory - ub/obmm: add sysfs interface with fine-grained memory statistics - !20804 net: hv_netvsc: reject RSS hash key programming without RX indirection table - !20813 migrate: correct lock ordering for hugetlb file folios - !20812 libceph: make calc_target() set t->paused, not just clear it - !20719 drivers/ub/sentry: some bugfix - !20798 urma: log should not retrieve eid_idx from uctx - !20808 urma: support triple bonding device - urma: log should not retrieve eid_idx from uctx - migrate: correct lock ordering for hugetlb file folios - libceph: make calc_target() set t->paused, not just clear it - !20745 vfio platform VFIO support for hisi05a1 devices - urma: support triple bonding device - net: hv_netvsc: reject RSS hash key programming without RX indirection table - !20789 gic: Add hip09 support for HISILICON_ERRATUM_165010801 - !20726 tracing: Add recursion protection in kernel stack trace recording - !20668 irqchip/gic-v3-its: Avoid truncating memory addresses - !20795 ub: udma: support query and set qos info. - !20791 Migration/urma:optimize performance in live migration. - ub: udma: Support for UE link establishment message. - Migration/urma: optimize performance in live migration. - !20787 ub: cdma: modify the method of assigning values to the structure - !20759 ubcore: hotfix route query for port eid on the same node. - ub: udma: support query and set qos info. - Revert "ub: ubase: Support for RC saved by queue granularity" - ubcore: hotfix route query for port eid on the same node. - !20676 urma: set/get sl - !20765 urma: bugfix of UAF and double free in ubcm - !20778 ub: ubase&unic: Fixes some bugfix in resetting and dfx ability - gic: Add hip09 support for HISILICON_ERRATUM_165010801 - vfio/platform: Add CONFIG_VFIO_HISI05A1 to openeuler_defconfig and turn it on by default - vfio/platform: VFIO support for hisi05a1 devices - ub: cdma: modify the method of assigning values to the structure - urma: set/get sl - ub: ubase: support to query ub dl pkt stats and real-time peak bandwidth - ub: ubase: Support for RC saved by queue granularity - ub: ubase: Traverse mailbox AE events using interrupts and polling. - ub: ubase: Modify ubase ctrlq trace to distinguish between MUE and UE messages - net: unic: The function of dumping himac registers is added. - ub: ubase: Fix MAC is_pfc sync, optimize list ops and code style - ub: ubase: Retain the initial tm qset configuration and restore it - net: unic: Fixed an issue in the bond IP address notification and pause configuration when an exception occurs. - ub: ubase: Add a retransmission function to improve reliability. - net: unic: Increase the readability and reliability of loopback code - net: unic: Synchronize the code modify for ip management and deactivation - net: unic: Increase the readability and reliability of VLAN feature. - net: unic: Added unic DFX log information. - ub: ubase: Add and correct comments for some functions and data structures - net: unic: Notify MAMI when the bond port status changes - ub: ubase: Support for HIMAC reset during ELR reset and Optimize ELR reset - !20768 iommu/ummu-core: Fix separate page table compatibility - !20665 [OLK-6.6] Enhance CMA memory usage reporting for CSV3 - !20764 net: hns3: fix double free issue for tx spare buffer - urma: bugfix of UAF and double free in ubcm - iommu/ummu-core: Fix separate page table compatibility - net: hns3: fix double free issue for tx spare buffer - drivers/ub/sentry: fix memory leak in sentry_msg_helper - drivers/ub/sentry: initialize some variables - drivers/ub/sentry: fix potential buffer overflow in convert_str_to_smh_msg() - drivers/ub/sentry: fix potential null pointer reference in sentry_uvb_comm - drivers/ub/sentry: add input parameter verification for exported symbols - tracing: Add recursion protection in kernel stack trace recording - x86/csv: Enhance CMA memory usage reporting for CSV3 - irqchip/gic-v3-its: Avoid truncating memory addresses - change the package name of 64KB page size kernel to kernel-64k - !20704 kernel support hisi-cca-da - !20180 [virtCCA Live Migration 2]virtcca secure cvm supports live migration - !20905 v2 KVM: arm64: Fix softirq masking in FPSIMD register saving sequence - !20965 iommu/ummu: Optimized TID invalidation and tdev initialization - !20964 iommu/ummu: Support TID and EID Granularity for MPAM - !20970 ub: ubase&unic: Supporting the black box capability of the ubase&unic driver - hisi-cca-da: Start dev by rsi call - hisi-cca-da: Set ripas of the bar region as RIPAS_DEV - hisi-cca-da: Support swiotlb and realm memory use - hisi-cca-da: Add smmu info when dev attach - hisi-cca-da: Transfer realm msix access to rmm - hisi-cca-da: Support pcipc sriov capability - hisi-cca-da: Delay realm memory release to kvm_destroy_realm - hisi-cca-da: Create realm s2 host pgtable and map msi mmio to rmm - hisi-cca-da: Add cca realm s2 pgtable framework - hisi-cca-da: Use bitmap to determine whether the command can be forwarded - hisi-cca-da: Restrict Realm SMMU to stage-2 domain only - hisi-cca-da: Add cmd forward mechanism in realm smmu - hisi-cca-da: Add realm smmu event and gerror irq initialization - hisi-cca-da: Add realm smmu stream table initialization - hisi-cca-da: Add realm smmu cmdq and evtq initialization - hisi-cca-da: Add realm smmu initialization - hisi-cca-da: Add relam iommu support to iommufd - hisi-cca-da: Add realm iommu support for vfio-iommu-type1 - hisi-cca-da: Support dev map and unmap - hisi-cca-da: Support dev validate and dev start - hisi-cca-da: VFIO support ccada - hisi-cca-da: Support dev delegate and dev attach - hisi-cca-da: Support root dev delegate and dev init - hisi-cca-da: Add hisilicon extension smc and ccada cmd - hisi-cca-da: Add hisi ccada feature config - !20751 ARM CCA supports hugepage - !20944 ub: ubmempfd: supports for D2H mapping and demapping - !20888 HiSock Enhancement - ub: ubase&unic: Supporting the black box capability of the ubase&unic driver. - net: unic: Resolve the residual MAC address problem - net: unic: Optimized the code for the cmd structure and FEC function. - ub: ubase: add log for post mailbox timeout - ub: ubus: Remove black box header file to include dir - rme: Remove the secret bit of the vring desc addr - rme: improve hisi-cca data mmap and destroy method - !20943 uvb: fix wd_obtain logic err - !20942 urma: fix bond device id not release - !20892 dcache: Limit the minimal number of bucket to two - rme: isolate page when do delegation to avoid migration - rme: hisi-cca supports different levels for mapping ram - rme: rename ccal to hisi-cca - rme: support set ripas for ccal realm vm - rme: support destroy ram data for ccal realm vm - rme: support populate region for ccal realm vm - rme: support map ram for ccal realm vm - rme: support config ccal realm vm - rme: support ccal RMI calls - rme: realm vm supports wfx handler - !20952 urma: introduce ipourma module - iommu/ummu-core: Simplifies tdev initialization resources - iommu/ummu: Optimized log printing - iommu/ummu: Use passed gfp_mask in map_pages callback - uvb: fix wd_obtain logic err - !20949 ub: udma: support user ctl function. - urma: fix bond device id not release - !20901 drivers/ub/sentry: some bugfix - ub: ubmempfd: supports for D2H mapping and demapping - ub: ubmempfd: supports providing services to the QEMU process through file nodes - [virtCCA Live Migration 2]virtcca secure cvm supports live migration - urma: query priority and enable bit, support ring size configuration - urma: implement debugfs, improve boundary checks and error handling logic - urma: implement data plane interaction and statistics - urma: implement ipourma network device operations - urma: ipourma resource management - urma: ipourma resource management and err code - urma: introduce ipourma main module - iommu/ummu: Optimized the TID invalidation configuration - iommu/ummu: Optimized SVA permission table memory allocation approach - iommu/ummu: Adapt UMMU SVA interface adjustment - iommu/ummu: Support TID and EID Granularity for MPAM - !20848 [OLK-6.6] backport important bugfix for nvme driver from upstream linux-6.6.y - !20847 urma: sl resource query error - !20908 [OLK-6.6][linux-6.6.y sync] Backport 6.6.108-6.6.110 LTS Patches - !20084 Loongarch: Enable CONFIG_CRYPTO_XTS for disk encryption - !20929 PCI: Fix NVMe link speed downgrade to 2.5GT/s during hotplug - drivers/ub/sentry: fix check input parameters - ub: udma: support user ctl function. - ub: udma: support uboe function. - ub: udma: bugfix related to query aux info. - !20935 ub: ubmem_vmmu: supports IOMMU driver for the UB memory MMU in VMs - drivers/ub/sentry: do not use magic numbers - !20876 urma: Kernel-mode specific implementations file for Jetty extension interface - urma: sl resource query error - !20873 sunrpc: fix NULL pointer dereference in rpcb_register_inet6 and rpcb_register_inet4 - !20875 sunrpc: fix race in cache cleanup causing stale nextcheck time - ub: ubmem_vmmu: supports IOMMU driver for the UB memory MMU in VMs - ub: ubmem_vmmu: supports parsing and configuring the hardware node information - ub: ubmem_vmmu: HiSilicon ubmem_vmmu Architecture Implementation - !20806 Fix CVE-2025-71225 - !20896 scsi: qla2xxx: Free sp in error path to fix system crash - !20894 scsi: qla2xxx: Delay module unload while fabric scan in progress - !20893 scsi: qla2xxx: Validate sp before freeing associated memory - !20802 Fix CVE-2026-23110 - urma: Kernel-mode specific implementations file for Jetty extension interface - drivers/ub/sentry: fix memory leak in process_urma_data() - drivers/ub/sentry: initialize some variables - PCI: Fix NVMe link speed downgrade to 2.5GT/s during hotplug - !20770 ub: ubdevshm: supports the memory user to obtain and release shared memory - Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 - mm: consider non-anon swap cache folios in folio_expected_ref_count() - mm: simplify folio_expected_ref_count() - ASoC: qcom: audioreach: fix potential null pointer dereference - gcc-plugins: Remove TODO_verify_il for GCC >= 16 - crypto: sha256 - fix crash at kexec - drm/i915/backlight: Return immediately when scale() finds invalid parameters - minmax.h: remove some #defines that are only expanded once - minmax.h: simplify the variants of clamp() - minmax.h: move all the clamp() definitions after the min/max() ones - minmax.h: use BUILD_BUG_ON_MSG() for the lo < hi test in clamp() - minmax.h: reduce the #define expansion of min(), max() and clamp() - minmax.h: update some comments - minmax.h: add whitespace around operators and after commas - minmax: fix up min3() and max3() too - minmax: improve macro expansion and type checking - minmax: don't use max() in situations that want a C constant expression - minmax: simplify min()/max()/clamp() implementation - minmax: make generic MIN() and MAX() macros available everywhere - drm/ast: Use msleep instead of mdelay for edid read - gpiolib: Extend software-node support to support secondary software-nodes - ARM: bcm: Select ARM_GIC_V3 for ARCH_BRCMSTB - s390/cpum_cf: Fix uninitialized warning after backport of ce971233242b - kmsan: fix out-of-bounds access to shadow memory - afs: Fix potential null pointer dereference in afs_put_server - ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address - i40e: improve VF MAC filters accounting - i40e: add mask to apply valid bits for itr_idx - HID: asus: add support for missing PX series fn keys - drm/gma500: Fix null dereference in hdmi teardown - octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() - net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port - net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() - net: dsa: lantiq_gswip: do also enable or disable cpu port - selftests: fib_nexthops: Fix creation of non-FDB nexthops - net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS - bnxt_en: correct offset handling for IPv6 destination address - vhost: Take a reference on the task in struct vhost_task. - Bluetooth: hci_sync: Fix hci_resume_advertising_sync - ethernet: rvu-af: Remove slash from the driver name - can: peak_usb: fix shift-out-of-bounds issue - can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow - can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow - can: hi311x: populate ndo_change_mtu() to prevent buffer overflow - can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow - bpf: Reject bpf_timer for PREEMPT_RT - can: rcar_can: rcar_can_resume(): fix s2ram with PSCI - wifi: virt_wifi: Fix page fault on connect - cpufreq: Initialize cpufreq-based invariance before subsys - ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients - arm64: dts: imx8mp: Correct thermal sensor index - mm: folio_may_be_lru_cached() unless folio_test_large() - mm/gup: local lru_add_drain() to avoid lru_add_drain_all() - mm/gup: check ref_count instead of lru before migration - mm: add folio_expected_ref_count() for reference count calculation - mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked" - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions - ALSA: usb-audio: Add mute TLV for playback volumes on more devices - ALSA: usb-audio: move mixer_quirks' min_mute into common quirk - ALSA: usb-audio: Add DSD support for Comtrue USB Audio device - i2c: designware: Add quirk for Intel Xe - mmc: sdhci-cadence: add Mobileye eyeQ support - usb: core: Add 0x prefix to quirks debug output - ALSA: usb-audio: Fix build with CONFIG_INPUT=n - ALSA: usb-audio: Convert comma to semicolon - ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 - ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks - ALSA: usb-audio: Simplify NULL comparison in mixer_quirks - ALSA: usb-audio: Avoid multiple assignments in mixer_quirks - ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks - ALSA: usb-audio: Fix block comments in mixer_quirks - firewire: core: fix overlooked update of subsystem ABI version - scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE - !20843 [OLK-6.6][linux-6.6.y sync] Backport 6.6.107-6.6.108 LTS Patches - !20869 ub:hisi-ubus: fix bug of security smatch - !20861 CVE-2026-23163 - ub: ubdevshm: supports the memory user to obtain and release shared memory - ub: ubdevshm: supports granting and revoking shared memory permissions - ub: ubdevshm: supports the registration and deregistration of shared memory segments - ub: ubdevshm: supports the registration and deregistration - KVM: arm64: Fix softirq masking in FPSIMD register saving sequence - !20886 Fix CVE-2026-23205 - !20803 Fix CVE-2026-23112 - !20868 sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure - !20811 smb/server: fix refcount leak in smb2_open() - !20810 smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() - !20809 smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() - sunrpc: fix NULL pointer dereference in rpcb_register_inet6 and rpcb_register_inet4 - sunrpc: fix race in cache cleanup causing stale nextcheck time - scsi: qla2xxx: Free sp in error path to fix system crash - scsi: qla2xxx: Delay module unload while fabric scan in progress - scsi: qla2xxx: Validate sp before freeing associated memory - dcache: Limit the minimal number of bucket to two - !20872 Fix CVE-2026-23220 - !20846 Fix CVE-2026-23193 - !20815 Fix CVE-2026-23216 - !20859 Fix CVE-2026-23179 - !20871 CVE-2026-23096 - !20858 ub: ubase: resolve the cmdq crq overflow problem - bpf: Deprecate hisock unused kfuncs and orig ingress logic - bpf: Add local connect support for hisock - bpf: Add ipv4-mapped ipv6 addr support for hisock - bpf: Add target comm parse to hisock_cmd - bpf: Add multi port parse to hisock_cmd - bpf: Only deploy hisock in server - bpf: Apply BPF_HISOCK_INGRESS to hisock ingress - bpf: Add bpf_handle_ingress/egress_ptype kfunc - bpf: Add bpf_get_skb_ethhdr kfunc - bpf: Add bpf_set_ingress/egress_dev kfunc - bpf: Add bpf_set_ingress_dst kfunc - bpf: Add BPF_HISOCK_INGRESS attach type - cgroup: make cgroup_bpf_prog_attach work when cgroup2 is not mounted - smb: client: fix potential UAF and double free in smb2_open_file() - smb/client: fix memory leak in smb2_open_file() - !20852 ASoC: amd: fix memory leak in acp3x pdm dma ops - ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths - uacce: fix cdev handling in the cleanup path - Revert "uacce: fix for cdev memory leak" - ub:hisi-ubus: fix bug of security smatch - ub:ubus: injected route event - ub:ubus: Black Box Development - !20865 urma: urma support uboe - sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure - urma: urma support uboe - !20857 ub_fwctl driver adds support for querying some functions - ub:ub_fwctl:Add illegal verification for scc - ub:ub_fwctl:Support querying the historical status of port links - drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove - drm/amdkfd: Don't use sw fault filter if retry cam enabled - ub:ub_fwctl:Support querying firmware version numbers - ub: ub_fwctl: Support querying real-time bandwidth statistics - ub:ub_fwctl:Support querying statistical indicators at the ub port and uboe port levels - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() - !20854 [URMA] add ping server for urma_ping - urma: add ping server - ub: ubase: resolve the cmdq crq overflow problem - ub: ubase: Optimized the QoS code naming to improve code readability. - ub: ubase&unic: optimizing code and configuration settings. - net: unic: not support query and configure ip by control plane in UBoE - net: unic: fix the automatically enable uc guid promisc mode. - !20844 urma:kernel header of userctl - urma: Kernel-mode header file for Jetty extension interface - ASoC: amd: fix memory leak in acp3x pdm dma ops - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() - phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again) - ACPICA: Work around bogus -Wstringop-overread warning since GCC 11 - !20835 Fix CVE-2026-23084 - minmax: add a few more MIN_T/MAX_T users - minmax: simplify and clarify min_t()/max_t() implementation - minmax: avoid overly complicated constant expressions in VM code - rtc: pcf2127: fix SPI command byte for PCF2131 backport - xhci: dbc: Fix full DbC transfer ring after several reconnects - xhci: dbc: decouple endpoint allocation from initialization - phy: ti: omap-usb2: fix device leak at unbind - phy: Use device_get_match_data() - drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path - ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message - ASoC: wm8974: Correct PLL rate rounding - ASoC: wm8940: Correct typo in control name - ASoC: wm8940: Correct PLL rate rounding - io_uring: include dying ring in task_work "should cancel" state - io_uring: backport io_should_terminate_tw() - ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx - selftests: mptcp: avoid spurious errors on TCP disconnect - selftests: mptcp: connect: catch IO errors on listen side - rds: ib: Increment i_fastreg_wrs before bailing out - KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active - mmc: mvsdio: Fix dma_unmap_sg() nents value - ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S - ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface - btrfs: tree-checker: fix the incorrect inode ref size check - iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page() - LoongArch: Check the return value when creating kobj - LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled - LoongArch: Update help info of ARCH_STRICT_ALIGN - nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* - octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() - net: liquidio: fix overflow in octeon_init_instr_queue() - bonding: don't set oif to bond dev when getting NS target destination - net/mlx5e: Consider aggregated port speed during rate configuration - i40e: remove redundant memory barrier when cleaning Tx descs - net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure - selftests: mptcp: sockopt: fix error messages - mptcp: tfo: record 'deny join id0' info - mptcp: set remote_deny_join_id0 on SYN recv - dpaa2-switch: fix buffer pool seeding for control traffic - btrfs: fix invalid extref key setup when replaying dentry - pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch - wifi: mac80211: fix incorrect type for ret - wifi: mac80211: increase scan_ies_len for S1G - ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported - !20769 [OLK-6.6][linux-6.6.y sync] Backport 6.6.106-6.6.107 LTS Patches - be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list - !20776 ub:ubfi: Release the chosen node - !20817 CVE-2026-23094 - !20819 dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() - ub:ubus: Add port num check - !20379 [OLK-6.6][sync from OLK-5.10]io_uring: Support forcing sq thread to be idle and woken up by hrtimer - !20830 sched/soft_domain: Increasing NR_MAX_CLUSTER to 32 - sched/soft_domain: Increasing NR_MAX_CLUSTER to 32 - btrfs: fix incorrect readahead expansion length - x86: disable image size check for test builds - drm/i915/power: fix size for for_each_set_bit() in abox iteration - drm/amdgpu: fix a memory leak in fence cleanup when unloading - net: mdiobus: release reset_gpio in mdiobus_unregister_device() - phy: ti-pipe3: fix device leak at unbind - phy: tegra: xusb: fix device and OF node leak at probe - dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate - usb: gadget: midi2: Fix MIDI2 IN EP max packet size - usb: gadget: midi2: Fix missing UMP group attributes initialization - USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels - RISC-V: Remove unnecessary include from compat.h - hrtimer: Rename __hrtimer_hres_active() to hrtimer_hres_active() - hrtimer: Remove unused function - regulator: sy7636a: fix lifecycle of power good gpio - dmaengine: ti: edma: Fix memory allocation size for queue_priority_map - hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr - hsr: use rtnl lock when iterating over ports - net: hsr: Add VLAN CTAG filter support - net: hsr: Add support for MC filtering at the slave device - can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB - can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails - can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed - igb: fix link test skipping when interface is admin down - docs: networking: can: change bcm_msg_head frames member to support flexible array - tunnels: reset the GSO metadata before reusing the skb - net: bridge: Bounce invalid boolopts - net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() - USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions - USB: serial: option: add Telit Cinterion FN990A w/audio compositions - dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks - serial: sc16is7xx: fix bug in flow control levels init - tty: hvc_console: Call hvc_kick in hvc_write unconditionally - Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups" - Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table - Input: iqs7222 - avoid enabling unused interrupts - mm/khugepaged: fix the address passed to notifier on testing young - btrfs: fix corruption reading compressed range when block size is smaller than page size - btrfs: use readahead_expand() on compressed extents - mm/damon/sysfs: fix use-after-free in state_show() - mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing - mtd: nand: raw: atmel: Fix comment in timings preparation - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages - drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time - mm/damon/core: set quota->charged_from to jiffies at first charge window - fuse: prevent overflow in copy_file_range return value - fuse: check if copy_file_range() returns larger than requested size - mtd: rawnand: stm32_fmc2: fix ECC overwrite - mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer - net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups - i2c: i801: Hide Intel Birch Stream SoC TCO WDT - ocfs2: fix recursive semaphore deadlock in fiemap call - mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN - compiler-clang.h: define __SANITIZE_*__ macros only when undefined - EDAC/altera: Delete an inappropriate dma_free_coherent() call - rcu-tasks: Maintain real-time response in rcu_tasks_postscan() - rcu-tasks: Eliminate deadlocks involving do_exit() and RCU tasks - rcu-tasks: Maintain lists to eliminate RCU-tasks/do_exit() deadlocks - s390/cpum_cf: Deny all sampling events by counter PMU - NFSv4/flexfiles: Fix layout merge mirror check. - NFSv4.2: Serialise O_DIRECT i/o and copy range - NFSv4.2: Serialise O_DIRECT i/o and clone range - NFSv4.2: Serialise O_DIRECT i/o and fallocate() - NFS: Serialise O_DIRECT i/o and truncate() - fs/nfs/io: make nfs_start_io_*() killable - ftrace/samples: Fix function size computation - NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server - NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set - media: i2c: imx214: Fix link frequency validation - NFSD: nfsd_unlink() clobbers non-zero status returned from fh_fill_pre_attrs() - nfsd: Fix a regression in nfsd_setattr() - kasan: fix GCC mem-intrinsic prefix with sw tags - kunit: kasan_test: disable fortify string checker on kasan_strings() test - io_uring: fix kabi broken in struct io_ring_ctx - io_uring: Support forcing sq thread to be idle and woken up by hrtimer - dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() - uacce: fix isolate sysfs check condition - Revert "uacce: fix isolate sysfs check condition" - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() - smb/server: fix refcount leak in smb2_open() - smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() - smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() - md: suspend array while updating raid_disks via sysfs - scsi: core: Wake up the error handler when final completions race against each other - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec - ub:ubfi: Release the chosen node - ub:ubus: Delete unused functions - Loongarch: Enable CONFIG_CRYPTO_XTS for disk encryption - Add sw64 support in kernel.spec - !21194 hisi-cca-da: Revert smmu realm enabled condition for arm_smmu_domain_finalise. - !21192 urma: bugfix of ubagg&ubcore&uburma - !21183 platform/x86: classmate-laptop: Add missing NULL pointer checks - urma: bugfix of ubagg&ubcore&uburma - hisi-cca-da: Revert smmu realm enabled condition for arm_smmu_domain_finalise. - platform/x86: classmate-laptop: Add missing NULL pointer checks - !21167 urma: fix kernel codecheck issues. - !21174 urma: change return value for provider err - !21127 urma: copy linked ports when importing bond jetty/seg - !20247 ubcore: query primary eid in ipourma loopback mode. - !21077 Fix hisi cca bugs - ubcore: route query refine and ipo loopback adapt. - hisi-cca-da: Transfer PCIe ECAM access requests to RMM for realm device. - hisi-cca-da: Write NS STE for PF drivers. - hisi-cca-da: Provide IO interfaces - hisi-cca-da: Destroy mmu stage2 pagetable after closing vfio devices - !21045 scsi: hisi_sas: Fix NULL pointer exception when do user_scan() - hisi-cca-da: Automatically unbind PF/VF drivers and prevent probe. - !21165 tools/interference: add ifstool utility for kernel interference statistics - !21166 urma: fix jfce uaf in batch cleanup - !21043 urma: fix tjetty ref in ping server - urma: change return value for provider err - !21128 sched/rt: Skip currently executing CPU in rto_next_cpu() - !21129 procfs: fix missing RCU protection when reading real_parent in do_task_stat() - urma: fix jfce uaf in batch cleanup - !21074 ipmi: Add HiSilicon IPMI Page Soft Offline driver - !21076 [OLK-6.6][linux-6.6.y sync] Backport 6.6.112-6.6.113 LTS Patches - urma: fix kernel codecheck issues. - tools/interference: add ifstool utility for kernel interference statistics - !20291 [Hygon][6.6][Bugfix] Bug fix for EDAC decode address fail issue on Hygon Dhyana processor - !21092 kexec: derive purgatory entry from symbol - !21154 sched: Add SOFT_DOMAIN feature interface for cgroup2 - !21153 fix CVE-2025-39981 - Revert "hisi-cca-da: Delay realm memory release to kvm_destroy_realm" - urma: fix tjetty ref in ping server - rme: Enforce isolation to solve compile error without config CONFIG_HISI_CCA - hisi-cca-da: Improve hisi cca dev validate and delegate - hisi-cca-da: Fix smmu enable rme problem - hisi-cca-da: Fix msi region shared problem - sched: Add SOFT_DOMAIN feature interface for cgroup2 - Bluetooth: MGMT: Fix memory leak in set_ssp_complete - Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete - overflow: Introduce __DEFINE_FLEX for having no initializer - overflow: Fix direct struct member initialization in _DEFINE_FLEX() - overflow: Change DEFINE_FLEX to take __counted_by member - overflow: add DEFINE_FLEX() for on-stack allocs - Bluetooth: MGMT: Fix possible UAFs - Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete() - !21103 Revert "mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()" - !21104 v2 vsock/virtio: cap TX credit to local buffer size - !21070 Fixes CVE-2026-23100 - !21135 RDMA/hns: Support configure and query the CNP DSCP through sysfs - !21088 ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref - RDMA/hns: Support configure and query the CNP DSCP through sysfs - RDMA/hns: Support query FW cap bit - RDMA/hns: Support query HW ID. - !20934 smb/server: fix refcount leak in parse_durable_handle_context() - !21004 regmap: Fix race condition in hwspinlock irqsave routine - !19568 [OLK-6.6]fix txgbe clang compile warning - urma: copy linked ports when importing bond jetty/seg - procfs: fix missing RCU protection when reading real_parent in do_task_stat() - sched/rt: Skip currently executing CPU in rto_next_cpu() - !21073 scsi: qla2xxx: Fix bsg_done() causing double free - !21114 CVE-2024-57979 - !21113 iommu: disable SVA when CONFIG_X86 is set - !20957 dmaengine: xilinx: xdma: Fix regmap max_register - !21087 net: unic: Multiple stability fixes for tx timeout, DFX capability and concurrent activation/reset - pps: Fix a use-after-free - fix kabi - pps: Fix a use-after-free - !21078 of: unittest: Fix memory leak in unittest_data_add() - !21079 *** fix CVE-2026-23208 *** - !21082 ALSA: aloop: Fix racy access at PCM trigger - !21083 bus: fsl-mc: fix use-after-free in driver_override_show() - iommu: disable SVA when CONFIG_X86 is set - vsock/virtio: cap TX credit to local buffer size - Revert "mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()" - !20983 Fix CVE-2026-23139 - !20878 Fix CVE-2026-23230 - kexec: derive purgatory entry from symbol - lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC - PCI/IOV: Fix race between SR-IOV enable/disable and hotplug - Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" - rtc: interface: Alarm race handling should not discard preceding error - perf test stat tests: Fix for virtualized machines - perf test stat: Update test expectations and events - perf test stat: Avoid hybrid assumption when virtualized - writeback: Avoid excessively long inode switching times - writeback: Avoid softlockup when switching many inodes - cramfs: Verify inode mode when loading from disk - fs: Add 'initramfs_options' to set initramfs mount options - minixfs: Verify inode mode when loading from disk - irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume - irqchip/sifive-plic: Make use of __assign_bit() - selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled - s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG - s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL - s390/bpf: Describe the frame using a struct instead of constants - s390/bpf: Centralize frame offset calculations - s390/bpf: Change seen_reg to a mask - ACPI: property: Do not pass NULL handles to acpi_attach_data() - ACPI: property: Add code comments explaining what is going on - ACPI: property: Disregard references in data-only subnode lists - ACPI: battery: Add synchronization between interface updates - ACPI: battery: Check for error code from devm_mutex_init() call - ACPI: battery: initialize mutexes through devm_ APIs - ACPI: battery: allocate driver data through devm_ APIs - arm64: mte: Do not flag the zero page as PG_mte_tagged - ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref - !20790 dm: use bio_clone_blkg_association - ipmi: Add HiSilicon IPMI Page Soft Offline driver - net: unic: Resolve network unavailability caused by concurrent activation and reset - net: unic: Provide the DFX capability for querying MNG table - net: unic: Delete the elr reset process after the tx timeout - bus: fsl-mc: fix use-after-free in driver_override_show() - ALSA: aloop: Fix racy access at PCM trigger - ALSA: usb-audio: Use the right limit for PCM OOB check - ALSA: usb-audio: Prevent excessive number of frames - of: unittest: Fix memory leak in unittest_data_add() - !21034 CVE-2026-23140 - !21016 net: fix segmentation of forwarding fraglist GRO - !21017 mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() - !21018 CVE-2026-23209 - !21019 ipv6: annotate data-race in ndisc_router_discovery() - !20881 ipvlan: Make the addrs_lock be per port - rme: Imporve range delegate - btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() - PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release - PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() - misc: fastrpc: Save actual DMA size in fastrpc_map structure - misc: fastrpc: Add missing dev_err newlines - mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag - mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type - mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value - media: mc: Clear minor number before put device - lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older - ACPICA: Allow to skip Global Lock initialization - ext4: validate ea_ino and size in check_xattrs - ext4: correctly handle queries for metadata mappings - ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() - nfsd: nfserr_jukebox in nlm_fopen should lead to a retry - NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() - mm/damon/vaddr: do not repeat pte_offset_map_lock() until success - mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 - mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations - wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 - wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again - selftests: mptcp: join: validate C-flag + def limit - spi: cadence-quadspi: Flush posted register writes before DAC access - spi: cadence-quadspi: Flush posted register writes before INDAC access - PCI: tegra194: Handle errors in BPMP response - PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() - PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock - PCI: rcar-host: Drop PMSR spinlock - PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit - PCI/AER: Support errors introduced by PCIe r6.0 - PCI/AER: Fix missing uevent on recovery when a reset is requested - PCI/ERR: Fix uevent on failure to recover - PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV - PCI/sysfs: Ensure devices are powered for config reads - PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock - rseq/selftests: Use weak symbol reference, not definition, to link with glibc - rtc: interface: Fix long-standing race when setting alarm - rtc: interface: Ensure alarm irq is enabled when UIE is enabled - memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe - mmc: core: SPI mode remove cmd7 - mtd: rawnand: fsmc: Default to autodetect buswidth - xtensa: simdisk: add input size check in proc_write_simdisk - sparc: fix error handling in scan_one_device() - sparc64: fix hugetlb for sun4u - scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() - sched/deadline: Fix race in push_dl_task() - pwm: berlin: Fix wrong register in suspend/resume - powerpc/pseries/msi: Fix potential underflow and leak issue - powerpc/powernv/pci: Fix underflow and leak issue - power: supply: max77976_charger: fix constant current reporting - pinctrl: samsung: Drop unused S3C24xx driver data - nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk - parisc: don't reference obsolete termio struct for TC* constants - openat2: don't trigger automounts with RESOLVE_NO_XDEV - of: unittest: Fix device reference count leak in of_unittest_pci_node_verify - lib/genalloc: fix device leak in of_gen_pool_get() - KEYS: trusted_tpm1: Compare HMAC values in constant time - iommu/vt-d: PRS isn't usable if PDS isn't supported - iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume - init: handle bootloader identifier in kernel parameters - iio: xilinx-ams: Unmask interrupts after updating alarms - iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK - iio: frequency: adf4350: Fix prescaler usage. - iio: dac: ad5421: use int type to store negative error codes - iio: dac: ad5360: use int type to store negative error codes - fs/ntfs3: Fix a resource leak bug in wnd_extend() - fbdev: Fix logic error in "offb" name match - crypto: rockchip - Fix dma_unmap_sg() nents value - crypto: atmel - Fix dma_unmap_sg() direction - crypto: aspeed - Fix dma_unmap_sg() direction - copy_sighand: Handle architectures where sizeof(unsigned long) < sizeof(u64) - bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() - bus: mhi: ep: Fix chained transfer handling in read path - btrfs: avoid potential out-of-bounds in btrfs_encode_fh() - blk-crypto: fix missing blktrace bio split events - drm/nouveau: fix bad ret code in nouveau_bo_move_prep - drm/rcar-du: dsi: Fix 1/2/3 lane support - media: lirc: Fix error handling in lirc_register() - media: venus: firmware: Use correct reset sequence for IRIS2 - media: pci: ivtv: Add missing check after DMA map - media: mc: Fix MUST_CONNECT handling for pads with no links - media: i2c: mt9v111: fix incorrect type for ret - media: cx18: Add missing check after DMA map - firmware: meson_sm: fix device leak at probe - xen/events: Update virq_to_irq on migration - xen/events: Return -EEXIST for bound VIRQs - xen/manage: Fix suspend error path - xen/events: Cleanup find_virq() return codes - dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required - ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init - arm64: dts: ti: k3-am62a-main: Fix main padcfg length - arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees - arm64: dts: qcom: msm8939: Add missing MDSS reset - arm64: dts: qcom: msm8916: Add missing MDSS reset - ACPI: debug: fix signedness issues in read/write helpers - ACPI: property: Fix buffer properties extraction for subnodes - gpio: wcd934x: mark the GPIO controller as sleeping - tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single - smb: client: fix missing timestamp updates after utime(2) - bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() - drm/amd/display: Properly disable scaling on DCE6 - drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 - drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs - drm/amdgpu: Add additional DCE6 SCL registers - mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes - mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call - tcp: take care of zero tp->window_clamp in tcp_set_rcvlowat() - perf python: split Clang options when invoking Popen - tools build: Align warning options with perf - net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe - drm/vmwgfx: Fix copy-paste typo in validation - net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() - LoongArch: Init acpi_gbl_use_global_lock to false - LoongArch: Remove CONFIG_ACPI_TABLE_UPGRADE in platform_init() - ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size - scsi: mvsas: Fix use-after-free bugs in mvs_work_queue - clk: tegra: do not overallocate memory for bpmp clocks - clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver - clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() - clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() - clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m - perf evsel: Ensure the fallback message is always written to - perf tools: Add fallback for exclude_guest - perf test: Add a test for default perf stat command - perf test: Don't leak workload gopipe in PERF_RECORD_* - perf session: Fix handling when buffer exceeds 2 GiB - perf arm_spe: Correct memory level for remote access - perf arm_spe: Correct setting remote access - rtc: optee: fix memory leak on driver removal - rtc: x1205: Fix Xicor X1205 vendor prefix - perf util: Fix compression checks returning -1 as bool - clk: at91: peripheral: fix return value - libperf event: Ensure tracing data is multiple of 8 sized - perf evsel: Avoid container_of on a NULL leader - asm-generic/io.h: Skip trace helpers if rwmmio events are disabled - iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE - clocksource/drivers/clps711x: Fix resource leaks in error paths - fscontext: do not consume log entries when returning -EMSGSIZE - fs: always return zero on success from replace_fd() - !21067 [OLK-6.6][linux-6.6.y sync] Backport 6.6.111-6.6.112 LTS Patches - scsi: qla2xxx: Fix bsg_done() causing double free - !21065 Fix CVE-2026-23069 - !21062 v4 Support multi-level cgroup - !20987 Fix CVE-2026-23212 - !20982 Fix CVE-2026-23119 - !20979 Fix CVE-2026-23111 - !20974 Fix CVE-2026-23099 - !20973 Fix CVE-2026-23105 - !20972 Fix CVE-2026-23074 - !20884 ksmbd: add chann_lock to protect ksmbd_chann_list xarray - !20947 Fix CVE-2026-23101 - ext4: clear i_state_flags when alloc inode - misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup - Revert "wifi: ath10k: avoid unnecessary wait for service ready message" - fs/ntfs3: fix mount failure for sparse runs in run_unpack() - !20825 efivarfs: fix error propagation in efivar_entry_get() - !20824 io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop - !20950 ub:ubus: protect iterator ue_list and mue_list with ub_bus_sem - mm/rmap: fix two comments related to huge_pmd_unshare() - mm/hugetlb: fix two comments related to huge_pmd_unshare() - mm/hugetlb: fix hugetlb_pmd_shared() - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count - !20728 drivers: Update vendor name of Chengdu NorthLink Technology N5/N6 Series Network Card Drivers - vsock/virtio: fix potential underflow in virtio_transport_get_credit() - !21001 Fix CVE-2026-23229 - usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call - arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode - !20999 Fix CVE-2026-23173 - usb: typec: tipd: Clear interrupts first - bus: fsl-mc: Check return value of platform_get_resource() - remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() - Input: atmel_mxt_ts - allow reset GPIO to sleep - misc: fastrpc: Skip reference for DMA handles - misc: fastrpc: fix possible map leak in fastrpc_put_args - misc: fastrpc: Fix fastrpc_map_lookup operation - nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() - ext4: fix checks for orphan inodes - ksmbd: fix error code overwriting in smb2_get_info_filesystem() - LoongArch: Automatically disable kaslr if boot from kexec_file - mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() - mfd: rz-mtu3: Fix MTU5 NFCR register offset - ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down - ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() - vhost: vringh: Modify the return value check - net/mlx5: fw reset, add reset timeout work - net/mlx5: pagealloc: Fix reclaim race during command interface teardown - net/mlx5: Stop polling for command response if interface goes down - net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable - nfp: fix RSS hash key size when RSS is not supported - mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands - drivers/base/node: fix double free in register_one_node() - hwrng: ks-sa - fix division by zero in ks_sa_rng_init - KEYS: X.509: Fix Basic Constraints CA flag parsing - Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements - Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO - vhost: vringh: Fix copy_to_iter return value check - RDMA/siw: Always report immediate post SQ errors - usb: vhci-hcd: Prevent suspending virtually attached devices - NFSv4.1: fix backchannel max_resp_sz verification check - coresight: trbe: Return NULL pointer for allocation failures - coresight: etm4x: Support atclk - coresight-etm4x: Conditionally access register TRCEXTINSELR - remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice - PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() - vfio/pds: replace bitmap_free with vfree - sparc: fix accurate exception reporting in copy_{from,to}_user for M7 - sparc: fix accurate exception reporting in copy_to_user for Niagara 4 - sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara - sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III - wifi: mac80211: fix Rx packet handling when pubsta information is not available - wifi: ath10k: avoid unnecessary wait for service ready message - Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram - IB/sa: Fix sa_local_svc_timeout_ms read race - RDMA/core: Resolve MAC of next-hop device without ARP support - f2fs: fix zero-sized extent for precache extents - scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() - scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() - scsi: qla2xxx: edif: Fix incorrect sign of error code - ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message - f2fs: fix to truncate first page in error path of f2fs_truncate() - f2fs: fix to update map->m_next_extent correctly in f2fs_map_blocks() - wifi: mt76: fix potential memory leak in mt76_wmac_probe() - RDMA/cm: Rate limit destroy CM ID timeout error message - drivers/base/node: handle error properly in register_one_node() - watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog - ipvs: Use READ_ONCE/WRITE_ONCE for ipvs->enable - iio: consumers: Fix offset handling in iio_convert_raw_to_processed() - iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() - fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist - fs: ntfs3: Fix integer overflow in run_unpack() - drm/msm/dpu: fix incorrect type for ret - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping - ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping - misc: genwqe: Fix incorrect cmd field being reported in error - usb: gadget: configfs: Correctly set use_os_string at bind - usb: phy: twl6030: Fix incorrect type for ret - drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() - tcp: fix __tcp_close() to only send RST when required - PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation - wifi: mwifiex: send world regulatory domain to driver - drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) - drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) - drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) - drm/amd/pm: Adjust si_upload_smc_data register programming (v3) - drm/amd/pm: Fix si_upload_smc_data (v3) - drm/amd/pm: Disable ULV even if unsupported (v3) - drm/amdgpu: Power up UVD 3 for FW validation (v2) - coresight: Only register perf symlink for sinks with alloc_buffer - inet: ping: check sock_net() in ping_get_port() and ping_lookup() - media: st-delta: avoid excessive stack usage - ALSA: lx_core: use int type to store negative error codes - media: rj54n1cb0c: Fix memleak in rj54n1_probe() - scsi: myrs: Fix dma_alloc_coherent() error check - hwrng: nomadik - add ARM_AMBA dependency - crypto: keembay - Add missing check after sg_nents_for_len() - drm/amd/display: Remove redundant semicolons - serial: max310x: Add error checking in probe() - usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls - usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup - phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 - media: zoran: Remove zoran_fh structure - drm/bridge: it6505: select REGMAP_I2C - f2fs: fix condition in __allow_reserved_blocks() - drm/radeon/r600_cs: clean up of dead code in r600_cs - drm/panel: novatek-nt35560: Fix invalid return value - bpf: Enforce expected_attach_type for tailcall compatibility - i2c: designware: Add disabling clocks when probe fails - i2c: designware: Fix clock issue when PM is disabled - i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD - thermal/drivers/qcom/lmh: Add missing IRQ includes - thermal/drivers/qcom: Make LMH select QCOM_SCM - hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems - once: fix race by moving DO_ONCE to separate section - smp: Fix up and expand the smp_call_function_many() kerneldoc - selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported - i3c: master: svc: Recycle unused IBI slot - i3c: master: svc: Use manual response for IBI events - ACPICA: Fix largest possible resource descriptor index - pwm: tiehrpwm: Fix corner case in clock divisor calculation - arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible - arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value - arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names - cpuidle: qcom-spm: fix device and OF node leaks at probe - firmware: firmware: meson-sm: fix compile-test default - arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 - null_blk: Fix the description of the cache_size module argument - pinctrl: renesas: Use int type to store negative error codes - power: supply: cw2015: Fix a alignment coding style issue - PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() - ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property - ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS - ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax - block: use int to store blk_stack_limits() return value - selftests/nolibc: fix EXPECT_NZ macro - regulator: scmi: Use int type to store negative error codes - arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map - ARM: at91: pm: fix MCKx restore routine - pinctrl: meson-gxl: add missing i2c_d pinmux - soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS - leds: flash: leds-qcom-flash: Update torch current clamp setting - ARM: dts: renesas: porter: Fix CAN pin group - libbpf: Fix reuse of DEVMAP - bpf: Remove migrate_disable in kprobe_multi_link_prog_run - bpf/selftests: Fix test_tcpnotify_user - regmap: Remove superfluous check for !config in __regmap_init() - arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 - x86/vdso: Fix output operand size of RDPID - smb: server: fix IRD/ORD negotiation with the client - coresight: trbe: Prevent overflow in PERF_IDX2OFF() - gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote - selftests: arm64: Check fread return value in exec_target - seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast - init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD - filelock: add FL_RECLAIM to show_fl_flags() macro - !21022 KVM: Don't clobber irqfd routing type when deassigning irqfd - !20998 ceph: fix oops due to invalid pointer for kfree() in parse_longname() - !21023 l2tp: avoid one data-race in l2tp_tunnel_del_work() - xsched: fix potential NULL dereference in xsched_quota_timeout_update - xsched: remove the standalone xcu_cfs_cg_deinit() helper - xsched: restructure xcu_cgrp_subsys teardown to align with cpu_cgrp_subsys lifecycle - xsched: simplify root group check by direct comparison with root_xcg - xsched: replace magic number with SCHED_CLASS_MAX_LENGTH for scheduler class string length - xsched/core: immediate cleanup of remaining operators on task exit - xsched: add init_fair_xsched_group() for XCU-specific fair group initialization - xsched: modify xcu_cg_initialize_components helper - xsched: refactor xsched_entity initialization - xsched: change rq_init() parameter from struct xsched_cu to struct xsched_rq - xsched: harden and clarify xcu_move_task() logic - xsched: move throttling-related fields from xsched_group_xcu_priv to xsched_rq_cfs - xsched/quota: add throttled flag to cfs_rq for robust hierarchical enqueue under throttling - xsched/quota: support multi-level cgroup - xsched: remove redundant xcu parameter from dequeue_ctx - xsched: update group shares using xcu_grp_shares_add/sub helpers - xsched: delete unused code - xsched/cfs: propagate group activation/deactivation up the hierarchy - xsched/cfs: move xruntime updates to pick/put paths - xsched: add has_running hook to xsched classes for wake-up eligibility check - !21012 [OLK-6.6][linux-6.6.y sync] Backport 6.6.110-6.6.111 LTS Patches - scsi: hisi_sas: Fix NULL pointer exception when do user_scan() - !21013 CVE-2026-23177 - !21007 bonding: fix use-after-free due to enslave fail after slave array update - !21006 net: Fix CVE-2026-23204 - bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path - bpf, test_run: Subtract size of xdp_frame from allowed metadata size - bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN - bpf: Make variables in bpf_prog_test_run_xdp less confusing - bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K - !21015 libceph: reset sparse-read state in osd_fault() - !21024 ub: udma: bugfix related to print messages. - !20980 Fix CVE-2026-23126 - !20922 Fix CVE-2026-23133 - ub: udma: bugfix related to print messages. - l2tp: avoid one data-race in l2tp_tunnel_del_work() - KVM: Don't clobber irqfd routing type when deassigning irqfd - ipv6: annotate data-race in ndisc_router_discovery() - macvlan: observe an RCU grace period in macvlan_common_newlink() error path - macvlan: fix error recovery in macvlan_common_newlink() - mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() - net: fix segmentation of forwarding fraglist GRO - can: rcar_canfd: Fix CAN-FD mode as default - libceph: reset sparse-read state in osd_fault() - !21008 uvb: fix cis call return value and obtain - mm, shmem: prevent infinite loop on truncate race - mm/shmem, swap: fix race of truncate and swap entry split - net/9p: fix double req put in p9_fd_cancelled - riscv: mm: Do not restrict mmap address based on hint - riscv: mm: Use hint address in mmap if available - driver core/PM: Set power.no_callbacks along with power.no_pm - serial: stm32: allow selecting console when the driver is module - hid: fix I2C read buffer overflow in raw_event() for mcp2221 - ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free - ALSA: usb-audio: Kill timer properly at removal - platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list - can: rcar_canfd: Fix controller mode setting - can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled - btrfs: ref-verify: handle damaged extent root tree - ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue - perf subcmd: avoid crash in exclude_cmds when excludes is empty - platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list - dm-integrity: limit MAX_TAG_SIZE to 255 - ASoC: amd: acp: Adjust pdm gain value - wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 - USB: serial: option: add SIMCom 8230C compositions - media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe - !20931 Fix CVE-2026-23060 - uvb: fix cis call return value and obtain - bonding: fix use-after-free due to enslave fail after slave array update - net/sched: cls_u32: use skb_header_pointer_careful() - net: add skb_header_pointer_careful() helper - regmap: Fix race condition in hwspinlock irqsave routine - crypto: virtio - Add spinlock protection with virtqueue notification - net/mlx5e: TC, delete flows only for existing peers - !20967 net: hns3: modify code of judging if SMMU DMA is enabled - ceph: fix oops due to invalid pointer for kfree() in parse_longname() - !20969 Fix CVE-2026-23125 - !20948 v4 arm64: Add memory poison recovery support for various paths - !20975 CVE-2026-23102 - !20977 v4 support apei_page_offline_policy - bonding: annotate data-races around slave->last_rx - netfilter: nf_conncount: update last_gc only when GC has been performed - bonding: provide a net pointer to __skb_flow_dissect() - netdevsim: fix a race issue related to the operation on bpf_bound_progs list - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() - apei/ghes: Add sysctl interface to control soft-offline page isolation - Revert "mm/memory-failure: support disabling soft offline for HugeTLB pages" - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - arm64/fpsimd: signal: Fix restoration of SVE context - arm64/fpsimd: signal: Consistently read FPSIMD context - arm64/fpsimd: signal: Mandate SVE payload for streaming-mode state - bonding: limit BOND_MODE_8023AD to Ethernet devices - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag - net/sched: Enforce that teql can only be used as root qdisc - sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT - drivers/net: Update vendor name of Chengdu NorthLink Technology N5/N6 Series Network Card Drivers - net: hns3: modify code of judging if SMMU DMA is enabled - dmaengine: xilinx: xdma: Fix regmap max_register - ub:ubus: protect iterator ue_list and mue_list with ub_bus_sem - ub:ubus: Avoid getting empty uent from ubc - ub:hisi-ubus: Use GFP_ATOMIC when alloc memory - arm64: send sig fault for user task when apei_claim_sea fails - arm64: add ras log during do_sea - arm64: move getting valid siaddr to the top of do_sea - arm64: mm: shmem: support poison recovery from shmem_file_read_iter() - arm64: fs: support poison recovery from __kernel_read() - iov_iter: add mc support for copy_page_to_iter - arm64: mm: support recovery from copy_{from/to}_user_page() - iov_iter: get rid of 'copy_mc' flag - leds: led-class: Only Add LED to leds_list when it is fully ready - wifi: ath10k: fix dma_free_coherent() pointer - smb/server: fix refcount leak in parse_durable_handle_context() - ksmbd: add chann_lock to protect ksmbd_chann_list xarray - ipvlan: Make the addrs_lock be per port - smb: client: split cached_fid bitfields to avoid shared-byte RMW races - efivarfs: fix error propagation in efivar_entry_get() - io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop - dm: use bio_clone_blkg_association - RAS/AMD/ATL: fix error nodes per socket on for Hygon Dhyana processor - net: txgbe: fix clang compile warning - !20552 ub: udma: fix some code issues. - !20313 Fix CVE-2025-40220 - !20321 nvme: fix admin request_queue lifetime - !20512 PM / devfreq: hisi: Fix potential UAF in OPP handling - !20544 Fix CVE-2025-71147 - !20548 v4 net: LTS-6.6 backport - !20503 Fix CVE-2025-39713 - !20133 Fix CVE-2025-39721 - !20438 Fix CVE-2025-38659 - !20264 Fix CVE-2025-40277 - !20340 Fix CVE-2025-40271 - !20319 Fix CVE-2025-40237 - !20392 vfs: Don't leak disconnected dentries on umount - !20554 iommu/s390: Implement blocking domain - !20489 [OLK-6.6][linux-6.6.y sync] Backport 6.6.101-6.6.102 LTS Patches - !20513 ACPI: PCC: Fix race condition by removing static qualifier - !20468 drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer - !20483 rcu: Protect ->defer_qs_iw_pending from data race - !20510 drivers/ub/sentry: fix primary eid index value - !20553 ub: cdma: support separated page table feature - ub: udma: fix some code issues. - !20480 iommu/ummu-core: fix error invalidate tid - !20561 iommu/ummu: Add ummu sva independent page table parameter - ub: udma: bugfix related to 2m_hugepage. - ub: udma: support for separate page tables - ub: udma: delete debugfs code. - ub: udma: bugfix related to ctrlq function. - ub: udma: verify get cqe/ae aux info out addr and len. - ub: cdma: support separated page table feature - iommu/ummu: Add ummu sva independent page table parameter - iommu: Adjust PLB refresh timing in 'grant' and 'ungrant' - !20505 Fix CVE-2026-23035 - iommu/s390: Implement blocking domain - drivers/ub/sentry: fix primary eid index value - !20535 libceph: make decode_pool() more resilient against corrupted osdmaps - !20536 mm/page_alloc: change all pageblocks migrate type on coalescing - !20537 mm/secretmem: fix use-after-free race in fault handler - !20538 wifi: avoid kernel-infoleak from struct iw_point - !20539 net: usb: rtl8150: fix memory leak on usb_submit_urb() failure - !20440 PCI/AER: Fix NULL pointer access by aer_info - !20262 Fix CVE-2025-68176 - netfilter: nf_reject: don't leak dst refcount for loopback packets - net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error - page_pool: always add GFP_NOWARN for ATOMIC allocations - virtio-net: fix received length check in big packets - net: bridge: fix use-after-free due to MST port state bypass - vsock: Ignore signal/timeout on connect() if already established - tls: make sure to abort the stream if headers are bogus - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI - xfrm: Duplicate SPI Handling - tls: handle data disappearing from under the TLS ULP - net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing - bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls - Bluetooth: hci_core: Fix use-after-free in vhci_flush() - KEYS: trusted: Fix a memory leak in tpm2_load_cmd - !20237 Fix CVE-2025-68724 - !20459 Fix CVE-2025-71131 - !20525 Fix CVE-2025-68816 - !20529 CVE-2025-68172 - net: usb: rtl8150: fix memory leak on usb_submit_urb() failure - !20370 Revert "Revert "RDMA/hns: Fix mismatch exception rollback"" - wifi: avoid kernel-infoleak from struct iw_point - mm/secretmem: fix use-after-free race in fault handler - mm/page_alloc: change all pageblocks migrate type on coalescing - libceph: make decode_pool() more resilient against corrupted osdmaps - pps: Fix kabi breakage of struct pps_device for last_fetched_ev - sched: Fix kabi breakage of struct task_struct for saved_state - crypto: aspeed - fix double free caused by devm - !20515 Bluetooth: bcsp: receive data only if registered - !20507 Fix CVE-2025-40358 - !20450 ub: ubase&unic: Fix some bug in concurrent process - !20452 iommu/ummu: Fix some bugs and optimize the code implementation - !20451 iommu/ummu: Add the function of creating devices with SVA-separated - !20500 mm: fix the inaccurate memory statistics issue for users - net/mlx5: fw_tracer, Validate format string parameters - Bluetooth: bcsp: receive data only if registered - ACPI: PCC: Fix race condition by removing static qualifier - ACPI: CPPC: Fix missing PCC check for guaranteed_perf - iommu/ummu: Add the function of creating devices with SVA-separated - iommu/ummu-core: fix error invalidate tid - riscv: stacktrace: Disable KASAN checks for non-current tasks - !20497 arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() - !20496 drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies - !20495 iommu/amd: Avoid stack buffer overflow from kernel cmdline - !20494 HID: core: Harden s32ton() against conversion to 0 bits - !20493 iommu: Fix two issues in iommu_copy_struct_from_user() - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv - PM / devfreq: hisi: Fix potential UAF in OPP handling - media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() - !20487 interference: Fix uninitialized ifs_clock compiling issue - MIPS: mm: kmalloc tlb_vpn array to avoid stack overflow - MIPS: mm: Prevent a TLB shutdown on initial uniquification - mm: fix the inaccurate memory statistics issue for users - mm: add config option for atomic mode in mm counter - Revert "mm: fix the inaccurate memory statistics issue for users" - !20444 net/mlx5e: Fix crash on profile change rollback failure - !20442 net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv - arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() - drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies - iommu/amd: Avoid stack buffer overflow from kernel cmdline - HID: core: Harden s32ton() against conversion to 0 bits - iommu: Fix two issues in iommu_copy_struct_from_user() - SUNRPC: call xs_sock_process_cmsg for all cmsg - flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read - !20374 [OLK 6.6]Use Hygon IBRS and IBPB rather than software-based mitigation to mitigate Retbleed and SRSO. - !20227 Rename leapioraid to leapraid and release v2.0 - mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery - MIPS: mm: tlb-r4k: Uniquify TLB entries on init - x86/fpu: Delay instruction pointer fixup until after warning - ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx() - ALSA: intel_hdmi: Fix off-by-one error in __hdmi_lpe_audio_probe() - x86/sev: Evict cache lines during SNP memory validation - net: usbnet: Fix the wrong netif_carrier_on() call - net: usbnet: Avoid potential RCU stall on LINK_CHANGE event - Bluetooth: btusb: Add USB ID 3625:010b for TP-LINK Archer TX10UB Nano - sched,freezer: Remove unnecessary warning in __thaw_task - freezer,sched: Clean saved_state when restoring it during thaw - freezer,sched: Do not restore saved_state of a thawed task - freezer,sched: Use saved_state to reduce some spurious wakeups - sched/core: Remove ifdeffery for saved_state - i2c: stm32f7: unmap DMA mapped buffer - i2c: stm32f7: simplify status messages in case of errors - i2c: stm32f7: perform most of irq job in threaded handler - i2c: stm32f7: use dev_err_probe upon calls of devm_request_irq - i2c: stm32f7: Use devm_clk_get_enabled() - USB: serial: option: add Foxconn T99W709 - smb: server: Fix extension string in ksmbd_extract_shortname() - ksmbd: fix corrupted mtime and ctime in smb2_open - ksmbd: fix Preauh_HashValue race condition - ksmbd: fix null pointer dereference error in generate_encryptionkey - vsock: Do not allow binding to VMADDR_PORT_ANY - selftests/perf_events: Add a mmap() correctness test - smb: client: return an error if rdma_connect does not return within 5 seconds - smb: client: let recv_done() cleanup before notifying the callers. - smb: client: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already - smb: client: make use of common smbdirect_socket - smb: smbdirect: add smbdirect_socket.h - smb: client: Correct typos in multiple comments across various files - smb: client: Use min() macro - smb: server: let recv_done() avoid touching data_transfer after cleanup/move - smb: server: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already - ALSA: hda/ca0132: Fix missing error handling in ca0132_alt_select_out() - irqchip: Build IMX_MU_MSI only on ARM - net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing - sunrpc: fix client side handling of tls alerts - net/sched: taprio: enforce minimum value for picos_per_byte - net: drop UFO packets in udp_rcv_segment() - ipv6: reject malicious packets in ipv6_gso_segment() - net/mlx5: Correctly set gso_segs when LRO is used - netlink: specs: ethtool: fix module EEPROM input/output arguments - net: ipa: add IPA v5.1 and v5.5 to ipa_version_string() - phy: mscc: Fix parsing of unicast frames - netpoll: prevent hanging NAPI when netcons gets enabled - md/md-cluster: handle REMOVE message earlier - NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY - NFS: Fix wakeup of __nfs_lookup_revalidate() in unblock_revalidate() - sched: Add test_and_clear_wake_up_bit() and atomic_dec_and_wake_up() - pNFS/flexfiles: don't attempt pnfs on fatal DS errors - PCI: pnv_php: Fix surprise plug detection and recovery - powerpc/eeh: Export eeh_unfreeze_pe() - PCI: pnv_php: Work around switches with broken presence detection - kconfig: qconf: fix ConfigList::updateListAllforAll() - scsi: sd: Make sd shutdown issue START STOP UNIT appropriately - scsi: ufs: core: Use link recovery when h8 exit fails during runtime resume - scsi: Revert "scsi: iscsi: Fix HW conn removal use after free" - scsi: mpt3sas: Fix a fw_event memory leak - vfio/pci: Separate SR-IOV VF dev_set - vfio/pds: Fix missing detach_ioas op - vfio: Prevent open_count decrement to negative - vfio: Fix unbalanced vfio_df_close call in no-iommu mode - f2fs: fix to calculate dirty data during has_not_enough_free_secs() - f2fs: fix to update upper_p in __get_secs_required() correctly - f2fs: vm_unmap_ram() may be called from an invalid context - f2fs: fix to avoid out-of-boundary access in devs.path - f2fs: doc: fix wrong quota mount option description - f2fs: fix KMSAN uninit-value in extent_info usage - rtc: rv3028: fix incorrect maximum clock rate handling - rtc: pcf8563: fix incorrect maximum clock rate handling - rtc: pcf85063: fix incorrect maximum clock rate handling - rtc: nct3018y: fix incorrect maximum clock rate handling - rtc: hym8563: fix incorrect maximum clock rate handling - rtc: ds1307: fix incorrect maximum clock rate handling - ucount: fix atomic_long_inc_below() argument type - module: Restore the moduleparam prefix length check - apparmor: fix loop detection used in conflicting attachment resolution - apparmor: ensure WB_HISTORY_SIZE value is a power of 2 - bpf: Check netfilter ctx accesses are aligned - bpf: Check flow_dissector ctx accesses are aligned - vhost-scsi: Fix log flooding with target does not exist errors - mtd: rawnand: atmel: set pmecc data setup time - mtd: rawnand: rockchip: Add missing check after DMA map - mtd: rawnand: atmel: Fix dma_mapping_error() address - jfs: fix metapage reference count leak in dbAllocCtl - crypto: qat - fix seq_file position update in adf_ring_next() - crypto: qat - fix DMA direction for compression on GEN2 devices - perf tools: Remove libtraceevent in .gitignore - sh: Do not use hyphen in exported variable name - ASoC: fsl_xcvr: get channel status data when PHY is not exists - dmaengine: nbpfaxi: Add missing check after DMA map - dmaengine: mv_xor: Fix missing check after DMA map and missing unmap - fs/orangefs: Allow 2 more characters in do_c_string() - PCI: endpoint: pci-epf-vntb: Fix the incorrect usage of __iomem attribute - soundwire: stream: restore params when prepare ports fail - crypto: img-hash - Fix dma_unmap_sg() nents value - crypto: keembay - Fix dma_unmap_sg() nents value - hwrng: mtk - handle devm_pm_runtime_enable errors - watchdog: ziirave_wdt: check record length in ziirave_firm_verify() - scsi: isci: Fix dma_unmap_sg() nents value - scsi: mvsas: Fix dma_unmap_sg() nents value - scsi: elx: efct: Fix dma_unmap_sg() nents value - scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value - clk: sunxi-ng: v3s: Fix de clock definition - perf tests bp_account: Fix leaked file descriptor - kernel: trace: preemptirq_delay_test: use offstack cpu mask - crypto: inside-secure - Fix `dma_unmap_sg()` nents value - perf sched: Fix memory leaks in 'perf sched latency' - perf sched: Fix memory leaks for evsel->priv in timehist - perf sched: Free thread->priv using priv_destructor - perf dso: Add missed dso__put to dso__load_kcore - perf tools: Fix use-after-free in help_unknown_cmd() - Fix dma_unmap_sg() nents value - clk: clk-axi-clkgen: fix fpfd_max frequency for zynq - fanotify: sanitize handle_type values when reporting fid - pinctrl: sunxi: Fix memory leak on krealloc failure - PCI: endpoint: pci-epf-vntb: Return -ENOENT if pci_epc_get_next_free_bar() fails - crypto: arm/aes-neonbs - work around gcc-15 warning - power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set - power: supply: cpcap-charger: Fix null check for power_supply_get_by_name - clk: xilinx: vcu: unregister pll_post only if registered correctly - media: v4l2-ctrls: Fix H264 SEPARATE_COLOUR_PLANE check - mtd: fix possible integer overflow in erase_xfer() - crypto: marvell/cesa - Fix engine load inaccuracy - crypto: qat - use unmanaged allocation for dc_data - crypto: sun8i-ce - fix nents passed to dma_unmap_sg() - PCI: rockchip-host: Fix "Unexpected Completion" log message - bpf/preload: Don't select USERMODE_DRIVER - ipv6: annotate data-races around rt->fib6_nsiblings - ipv6: fix possible infinite loop in fib6_info_uses_dev() - vrf: Drop existing dst reference in vrf_ip6_input_dst - selftests: rtnetlink.sh: remove esp4_offload after test - net/mlx5e: Clear Read-Only port buffer size in PBMC before update - netfilter: xt_nfacct: don't assume acct name is null-terminated - can: kvaser_usb: Assign netdev.dev_port based on device channel index - can: kvaser_pciefd: Store device channel index - can: peak_usb: fix USB FD devices potential malfunction - tools/rv: Do not skip idle in trace - Bluetooth: hci_event: Mask data status from LE ext adv reports - kcsan: test: Initialize dummy variable - wifi: mac80211: Write cnt before copying in ieee80211_copy_rnr_beacon() - wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE - wifi: ath12k: fix endianness handling while accessing wmi service bit - wifi: mac80211: Check 802.11 encaps offloading in ieee80211_tx_h_select_key() - wifi: mac80211: Don't call fq_flow_idx() for management frames - wifi: mac80211: Do not schedule stopped TXQs - wifi: plfxlc: Fix error handling in usb driver probe - wifi: mac80211: reject TDLS operations when station is not associated - iommu/amd: Fix geometry.aperture_end for V2 tables - mwl8k: Add missing check after DMA map - wifi: rtl8xxxu: Fix RX skb size for aggregation disabled - tcp: call tcp_measure_rcv_mss() for ooo packets - xen/gntdev: remove struct gntdev_copy_batch from stack - net_sched: act_ctinfo: use atomic64_t for three counters - net/sched: Restrict conditions for adding duplicating netems to qdisc tree - um: rtc: Avoid shadowing err in uml_rtc_start() - arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX - netfilter: nf_tables: adjust lockdep assertions handling - netfilter: nf_tables: Drop dead code from fill_*_info routines - fbcon: Fix outdated registered_fb reference in comment - drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value - m68k: Don't unregister boot console needlessly - drm/msm/dpu: Fill in min_prefill_lines for SC8180X - kselftest/arm64: Fix check for setting new VLs in sve-ptrace - net: dst: annotate data-races around dst->input - tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range - wifi: ath11k: clear initialized flag for deinit-ed srng lists - iwlwifi: Add missing check for alloc_ordered_workqueue - wifi: iwlwifi: Fix memory leak in iwl_mvm_init() - wifi: rtl818x: Kill URBs before clearing tx status queue - wifi: rtw89: avoid NULL dereference when RX problematic packet on unsupported 6 GHz band - caif: reduce stack size, again - bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure - drm/vmwgfx: Fix Host-Backed userspace on Guest-Backed kernel - net: ipv6: ip6mr: Fix in/out netdev to pass to the FORWARD chain - selftests/bpf: fix signedness bug in redir_partial() - bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls - bpf, sockmap: Fix psock incorrectly pointing to sk - drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed - staging: nvec: Fix incorrect null termination of battery manufacturer - interconnect: qcom: sc8180x: specify num_nodes - interconnect: qcom: sc8280xp: specify num_links for qnm_a1noc_cfg - soc: qcom: pmic_glink: fix OF node leak - samples: mei: Fix building on musl libc - cpufreq: Initialize cpufreq-based frequency-invariance later - cpufreq: intel_pstate: Always use HWP_DESIRED_PERF in passive mode - arm64: dts: imx8mn-beacon: Fix HS400 USDHC clock speed - arm64: dts: imx8mm-beacon: Fix HS400 USDHC clock speed - ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface - soc/tegra: cbb: Clear ERR_FORCE register with ERR_STATUS - arm: dts: ti: omap: Fixup pinheader typo - usb: early: xhci-dbc: Fix early_ioremap leak - powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw() - pps: fix poll support - staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() - spi: stm32: Check for cfg availability in stm32_spi_probe - usb: misc: apple-mfi-fastcharge: Make power supply names unique - usb: host: xhci-plat: fix incorrect type for of_match variable in xhci_plat_probe() - ARM: dts: vfxxx: Correctly use two tuples for timer address - arm64: dts: qcom: msm8976: Make blsp_dma controlled-remotely - arm64: dts: qcom: sc7180: Expand IMEM region - arm64: dts: qcom: sdm845: Expand IMEM region - soc: qcom: QMI encoding/decoding for big endian - selftests: Fix errno checking in syscall_user_dispatch test - ASoC: mediatek: use reserved memory or enable buffer pre-allocation - gfs2: No more self recovery - Revert "fs/ntfs3: Replace inode_trylock with inode_lock" - hfs: make splice write available again - hfsplus: make splice write available again - ublk: use vmalloc for ublk_device's __queues - fs_context: fix parameter name in infofc() macro - audit,module: restore audit logging in load failure case - ASoC: amd: yc: add DMI quirk for ASUS M6501RM - ASoC: Intel: fix SND_SOC_SOF dependencies - ASoC: amd: yc: Add DMI entries to support HP 15-fb1xxx - ethernet: intel: fix building with large NR_CPUS - ASoC: amd: yc: Add DMI quirk for HP Laptop 17 cp-2033dx - interference: Fix uninitialized ifs_clock compiling issue - iommu/ummu: optimize log printing - !20455 Fix compilation failure caused by PR#20174 - !20302 CVE-2026-22980 - !20142 CVE-2025-68803 - !20261 ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency - !20435 fix CVE-2026-22998 - !20433 scsi: target: Reset t_task_cdb pointer in error case - !20432 scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" - !20431 block: Use RCU in blk_mq_[un - !20307 tpm: Cap the number of PCR banks - !20062 xfs: Add xfs_dir3_leaf_header_check() in leaf/leafn read - !20157 v2 md: backport from mainline - rcu: Protect ->defer_qs_iw_pending from data race - platform/x86/intel/pmt: fix compilation failure caused by PR#20174 - iommu/ummu: optimize kv cache memory management - iommu/ummu: optimize permission table management - iommu/ummu: remove check for eid_type while del eid - iommu/ummu: optimize the code implementation - drivers/perf: fix ummu-pmu data reading exception - iommu/ummu: IOMMU_DOMAIN_BLOCKED type don not sync tct - drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer - crypto: seqiv - Do not use req->iv after crypto_aead_encrypt - net: unic: Notify mami of the bond ip change. - ub: ubase: Support for UE link by ctrlq message - ub: ubase: send a deactivate req in removing - ub: ubase: Querying TPG/TP contexts in the chip is no longer supported after enabling safe mode. - ub: ubase: Use an independent thread for the ctrlq workqueue. - !20368 ubcore: fix logging and permission for route query. - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id - !20344 ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr - net: unic: Fix the ummu 0xa event that occurs when modifying queues and resetting concurrent scenarios - ub: ubase: Add KABI compatibility - ub: ubase: fixing the issue of cdma ctp_req_vl parameter configuration - ub: ubase: add PMU IDEV interrupt supported abilities. - ub: ubase: Delete the tid mask for eq, jfs, jfr, and jfc context - ub: ubase: Set the completion event interrupt to auto - net: unic: fix poll tx read old skb cause a UAF bug - !20249 Fix CVE-2025-38489 - !20250 Fix CVE-2025-38480 - !20378 Fix CVE-2025-39838 - !20430 Fix CVE-2025-39942 - !20351 Fix CVE-2025-71149 - !20375 Fix CVE-2025-71150 - !20323 Fix CVE-2025-38730 - !20320 Fix CVE-2025-68814 - !20314 Fix CVE-2025-71072 - !20315 Fix CVE-2025-68794 - !20403 bpf: Check skb->transport_header is set in bpf_skb_check_mtu - !20402 bpf: Do not let BPF test infra emit invalid GSO types to stack - !20401 tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() - !20400 netfilter: nft_ct: add seqadj extension for natted connections - !20399 net: xfrm: Fix CVE-2025-40215 - !20398 net/sched: sch_qfq: Fix null-deref in agg_dequeue - !20397 bpf: Reject narrower access to pointer ctx fields - !20396 Bluetooth: eir: Fix possible crashes on eir_create_adv_data - !20394 IB/mlx5: Fix potential deadlock in MR deregistration - !20367 ub: cdma: cdma uaf bugfix - net/mlx5e: Fix crash on profile change rollback failure - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv - PCI/AER: Fix NULL pointer access by aer_info - gfs2: No more self recovery - drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE - crypto: qat - flush misc workqueue during device shutdown - !20174 Backport PMT spec 3.0 support - !20366 [Hygon][6.6][Bugfix]: Resolve FPU state corruption between atomic and non-atomic contexts - !19814 [OLK-6.6] Batch flushing user memory encrytion status change - !20393 [OLK-6.6][linux-6.6.y sync] Backport 6.6.100-6.6.101 LTS Patches - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec - nvmet-tcp: remove boilerplate code - scsi: target: Reset t_task_cdb pointer in error case - scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" - block: Use RCU in blk_mq_[un]quiesce_tagset() instead of set->tag_list_lock - ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size - ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer - smb: server: let recv_done() consistently call put_recvmsg/smb_direct_disconnect_rdma_connection - smb: server: remove separate empty_recvmsg_queue - !20384 ub:ubus: Fix ubus link message and pool device error - !20389 gfs2: Prevent recursive memory reclaim - !20388 *** fix CVE-2025-38062 *** - !20387 KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced - !20386 pinctrl: check the return value of pinmux_ops::get_function_name() - !20385 iommu/amd/pgtbl: Fix possible race while increase page table level - ub:ubus: Not cfg access during surprise down - ub:hisi-ubus: Delete validate_pa err print - PCI: cadence: Check for the existence of cdns_pcie::ops before using it - can: netlink: can_changelink(): allow disabling of automatic restart - Revert "selftests/bpf: Add a cgroup prog bpf_get_ns_current_pid_tgid() test" - drm/sched: Remove optimization that causes hang when killing dependent jobs - ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS - bpf: Check skb->transport_header is set in bpf_skb_check_mtu - bpf: Do not let BPF test infra emit invalid GSO types to stack - tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() - netfilter: nft_ct: add seqadj extension for natted connections - xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added - xfrm: delete x->tunnel as we delete x - x86/hw-vuln:Support hardware-based mitigation for Retbleed and SRSO via Hygon IBRS to avoid performance degradation caused by software-based mitigation. - net/sched: sch_qfq: Fix null-deref in agg_dequeue - bpf: Reject narrower access to pointer ctx fields - Bluetooth: eir: Fix possible crashes on eir_create_adv_data - IB/mlx5: Fix potential deadlock in MR deregistration - ub:ubus: Fix ubus link message and pool device error - ub:hisi-ubus: cq poller maximum handle 64 cqe per time - ub:hisi-ubus:Fix vdm message print error - ub:ubus:Fix ubus interrupt release issue - wifi: mt76: mt7921: prevent decap offload config before STA initialization - mtd: rawnand: qcom: Fix last codeword read in qcom_param_page_type_exec() - iio: hid-sensor-prox: Restore lost scale assignments - iio: hid-sensor-prox: Fix incorrect OFFSET calculation - crypto: powerpc/poly1305 - add depends on BROKEN for now - erofs: address D-cache aliasing - drm/i915/dp: Fix 2.7 Gbps DP_LINK_BW value on g4x - ALSA: hda: Add missing NVIDIA HDA codec IDs - ALSA: hda/tegra: Add Tegra264 support - comedi: comedi_test: Fix possible deletion of uninitialized timers - usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach - usb: typec: tcpm: allow switching to mode accessory to mux properly - usb: typec: tcpm: allow to use sink in accessory mode - drm/amdkfd: Don't call mmput from MMU notifier callback - mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n - selftests: mptcp: connect: also cover checksum - selftests: mptcp: connect: also cover alt modes - resource: fix false warning in __request_region() - gve: Fix stuck TX queue for DQ queue format - e1000e: ignore uninitialized checksum word on tgp - e1000e: disregard NVM checksum on tgp when valid checksum bit is not set - dpaa2-switch: Fix device reference count leak in MAC endpoint handling - dpaa2-eth: Fix device reference count leak in MAC endpoint handling - ALSA: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx - sprintf.h requires stdarg.h - bus: fsl-mc: Fix potential double device reference in fsl_mc_get_endpoint() - i2c: virtio: Avoid hang by using interruptible completion wait - i2c: tegra: Fix reset error handling with ACPI - platform/x86: ideapad-laptop: Fix kbd backlight not remembered among boots - can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode - can: dev: can_restart(): move debug message and stats after successful restart - can: dev: can_restart(): reverse logic to remove need for goto - i40e: When removing VF MAC filters, only check PF-set MAC - i40e: report VF tx_dropped with tx_errors instead of tx_discards - i40e: Add rx_missed_errors for buffer exhaustion - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch - net/mlx5: Fix memory leak in cmd_exec() - staging: vchiq_arm: Make vchiq_shutdown never fail - x86/hyperv: Fix usage of cpu_online_mask to get valid cpu - regmap: fix potential memory leak of regmap_bus - iio: adc: ad7949: use spi_is_bpw_supported() - interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1 node - RDMA/core: Rate limit GID cache warning messages - virtio_ring: Fix error reporting in virtqueue_resize - !20348 [OLK-6.6][linux-6.6.y sync] Backport 6.6.99-6.6.100 LTS Patches - !20346 tracing: Fix crash on synthetic stacktrace field usage - vfs: Don't leak disconnected dentries on umount - !20334 Fix CVE-2025-68780 - gfs2: Prevent recursive memory reclaim - amd/amdkfd: enhance kfd process check in switch partition - drm/amdkfd: allow compute partition mode switch with cgroup exclusions - KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced - pinctrl: check the return value of pinmux_ops::get_function_name() - iommu/amd/pgtbl: Fix possible race while increase page table level - !19966 nvme-fc: use lock accessing port_state and rport state - ASoC: fsl_sai: replace regmap_write with regmap_update_bits - comedi: Fix use of uninitialized data in insn_rw_emulate_bits() - cifs: prevent NULL pointer dereference in UTF16 conversion - ksmbd: Fix refcount leak when invalid session is found on session lookup - ubcore: fix logging and permission for route query. - !20232 driver/coda: VirtCCA supports MSI device DA - Revert "Revert "RDMA/hns: Fix mismatch exception rollback"" - !20197 ub: udma&ubase: fix a bug that caused long reboot time - x86: Resolve FPU state corruption between atomic and non-atomic contexts - ub: cdma: cdma uaf bugfix - ub: cdma: jfs call trace bugfix - !20353 x86/fpu: Clear XSTATE_BV[i - s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again - KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls - nvmem: layouts: u-boot-env: remove crc32 endianness conversion - i2c: omap: fix deprecated of_property_read_bool() use - ASoC: fsl_sai: Force a software reset when starting in consumer mode - regulator: pwm-regulator: Manage boot-on with disabled PWM channels - regulator: pwm-regulator: Calculate the output voltage for disabled PWMs - i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe() - i2c: omap: Fix an error handling path in omap_i2c_probe() - i2c: omap: Add support for setting mux - usb: dwc3: qcom: Don't leave BCR asserted - usb: hub: Don't try to recover devices lost during warm reset. - usb: hub: Fix flushing of delayed work used for post resume purposes - usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm - usb: hub: fix detection of high tier USB3 devices behind suspended hubs - arm64: Filter out SME hwcaps when FEAT_SME isn't implemented - ipv6: make addrconf_wq single threaded - !20354 cpufreq/sched: Explicitly synchronize limits_changed flag handling - sched/deadline: only set free_cpus for online runqueues - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 - cpufreq/sched: Explicitly synchronize limits_changed flag handling - io_uring/poll: correctly handle io_poll_add() return value on update - shmem: fix recovery on rename failures - io_uring: fix filename leak in __io_openat_prep() - Revert "cgroup_freezer: cgroup_freezing: Check if not frozen" - rxrpc: Fix transmission of an abort in response to an abort - rxrpc: Fix recv-recv race of completed call - net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree - net: bridge: Do not offload IGMP/MLD messages - hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf - netfilter: nf_conntrack: fix crash due to removal of uninitialised entry - ipv6: mcast: Delay put pmc->idev in mld_del_delrec() - net/mlx5: Correctly set gso_size when LRO is used - Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID - Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout - Bluetooth: SMP: If an unallowed command is received consider it a failure - Bluetooth: hci_sync: fix connectable extended advertising when using static random address - hwmon: (corsair-cpro) Validate the size of the received input buffer - selftests: net: increase inter-packet timeout in udpgro.sh - wifi: cfg80211: remove scan request n_channels counted_by - nvme: fix misaccounting of nvme-mpath inflight I/O - net: phy: Don't register LEDs for genphy - nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list() - rpl: Fix use-after-free in rpl_do_srh_inline(). - block: fix kobject leak in blk_unregister_queue - net: emaclite: Fix missing pointer increment in aligned_read() - soundwire: amd: fix for clearing command status register - soundwire: amd: fix for handling slave alerts after link is down - comedi: Fix use of uninitialized data in insn_rw_emulate_bits() - comedi: Fix some signed shift left operations - comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large - comedi: das6402: Fix bit shift out of bounds - comedi: das16m1: Fix bit shift out of bounds - comedi: aio_iiro_16: Fix bit shift out of bounds - comedi: pcl812: Fix bit shift out of bounds - iio: adc: stm32-adc: Fix race in installing chained IRQ handler - iio: adc: max1363: Reorder mode_list[] entries - iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] - iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush - soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled - soc: aspeed: lpc-snoop: Cleanup resources in stack-order - s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again - pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov - net: libwx: properly reset Rx ring descriptor - net: libwx: remove duplicate page_pool_put_full_page() - mmc: sdhci_am654: Workaround for Errata i2312 - mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models - mmc: bcm2835: Fix dma_unmap_sg() nents value - memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() - isofs: Verify inode mode when loading from disk - dmaengine: nbpfaxi: Fix memory corruption in probe() - af_packet: fix soft lockup issue caused by tpacket_snd() - af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() - arm64: dts: rockchip: use cs-gpios for spi1 on ringneck - arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on - arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency - net/mlx5: Update the list of the PCI supported devices - phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() - io_uring/poll: fix POLLERR handling - ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS - drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume - tracing/osnoise: Fix crash in timerlat_dump_stack() - spi: Add check for 8-bit transfer with 8 IO mode support - pch_uart: Fix dma_sync_sg_for_device() nents value - thunderbolt: Fix bit masking in tb_dp_port_set_hops() - i2c: stm32: fix the device used for the DMA map - tracing: Fix crash on synthetic stacktrace field usage - usb: musb: fix gadget state on disconnect - USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI - USB: serial: option: add Foxconn T99W640 - USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition - phy: tegra: xusb: Disable periodic tracking on Tegra234 - phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode - phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr - fs/proc: fix uaf in proc_readdir_de() - io_uring/net: commit partial buffers on retry - nvme: fix admin request_queue lifetime - fs/notify: call exportfs_encode_fid with s_umount - iomap: adjust read range correctly for non-block-aligned positions - fuse: fix livelock in synchronous file put from fuseblk workers - tpm: Cap the number of PCR banks - nfsd: provide locking for v4_end_grace - Revert "nfsd: provide locking for v4_end_grace" - config: enable config for PMT discovery driver - platform/x86/intel/pmt/discovery: use valid device pointer in dev_err_probe - platform/x86/intel/pmt: Fix kobject memory leak on init failure - platform/x86/intel/pmt: fix a crashlog NULL pointer access - platform/x86/intel/pmt: fix build dependency for kunit test - platform/x86/intel/pmt/discovery: fix format string warning - platform/x86/intel/pmt/discovery: Fix size_t specifiers for 32-bit - platform/x86/intel/pmt: KUNIT test for PMT Enhanced Discovery API - platform/x86/intel/pmt/telemetry: Add API to retrieve telemetry regions by feature - platform/x86/intel/pmt/discovery: Get telemetry attributes - platform/x86/intel/tpmi: Get OOBMSM CPU mapping from TPMI - platform/x86/intel/vsec: Set OOBMSM to CPU mapping - platform/x86/intel/tpmi: Relocate platform info to intel_vsec.h - docs: Add ABI documentation for intel_pmt feature directories - platform/x86/intel/pmt: Add PMT Discovery driver - sysfs: Fix crash on empty group attributes array - sysfs: Introduce a mechanism to hide static attribute_groups - platform/x86/intel/vsec: Add new Discovery feature - platform/x86/intel/vsec: Skip driverless features - platform/x86/intel/vsec: Skip absent features during initialization - platform/x86/intel/vsec: Add device links to enforce dependencies - platform/x86/intel/vsec: Create wrapper to walk PCI config space - platform/x86/intel/vsec: Add private data for per-device data - MAINTAINERS: Add link to documentation of Intel PMT ABI - platform/x86/intel/pmt: allow user offset for PMT callbacks - driver/coda: VirtCCA supports MSI device DA - ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency - Rename leapioraid to leapraid and release v2.0 - ub: udma: fix a bug that caused long reboot time. - ub: ubase: Accelerate when ctrl node is shutting down - platform/x86/intel/pmt: Use PMT callbacks - platform/x86/intel/vsec: Add PMT read callbacks - platform/x86/intel/vsec.h: Move to include/linux - md: prevent incorrect update of resync/recovery offset - md/raid1: Fix data corruption for degraded array with slow disk - md/raid1: set max_sectors during early return from choose_slow_rdev() - md-cluster: fix no recovery job when adding/re-adding a disk - md-cluster: fix hanging issue while a new disk adding - md/raid5: recheck if reshape has finished with device_lock held - md-cluster: Constify struct md_cluster_operations - md: Remove unneeded semicolon - md/raid5: fix spares errors about rcu usage - dm-raid: Fix WARN_ON_ONCE check for sync_thread in raid_resume - md: pass in max_sectors for pers->sync_request() - md: factor out helpers for different sync_action in md_do_sync() - md: replace last_sync_action with new enum type - md: use new helpers in md_do_sync() - md: don't fail action_store() if sync_thread is not registered - md: remove parameter check_seq for stop_sync_thread() - md: replace sysfs api sync_action with new helpers - md: factor out helper to start reshape from action_store() - md: add new helpers for sync_action - md: add a new enum type sync_action - md: rearrange recovery_flags - md/raid0: don't free conf on raid0_run failure - md: make md_flush_request() more readable - md: change the return value type of md_write_start to void - md: Revert "md: Fix overflow in is_mddev_idle" - md: don't account sync_io if iostats of the disk is disabled - md: Fix overflow in is_mddev_idle - md: add check for sleepers in md_wakeup_thread() - md: add a mddev_is_dm helper - md: add a mddev_add_trace_msg helper - md: add a mddev_trace_remap helper - dm-raid456, md/raid456: fix a deadlock for dm-raid456 while io concurrent with reshape - dm-raid: add a new helper prepare_suspend() in md_personality - dm-raid: really frozen sync_thread during suspend - md: add a new helper reshape_interrupted() - md: export helper md_is_rdwr() - md: export helpers to stop sync_thread - md: don't clear MD_RECOVERY_FROZEN for new dm-raid until resume - md/raid1: factor out helpers to choose the best rdev from read_balance() - md/raid1: factor out the code to manage sequential IO - md/raid1: factor out choose_bb_rdev() from read_balance() - md/raid1: factor out choose_slow_rdev() from read_balance() - md/raid1: factor out read_first_rdev() from read_balance() - md/raid1-10: factor out a new helper raid1_should_read_first() - md/raid1-10: add a helper raid1_check_read_range() - md/raid1: fix choose next idle in read_balance() - md/raid1: record nonrot rdevs while adding/removing rdevs to conf - md/raid1: factor out helpers to add rdev to conf - md: add a new helper rdev_has_badblock() - md: check mddev->pers before calling md_set_readonly() - md: clean up openers check in do_md_stop() and md_set_readonly() - md: sync blockdev before stopping raid or setting readonly - md: factor out a helper to sync mddev - md: return directly before setting did_set_md_closing - md: changed the switch of RAID_VERSION to if - md: merge the check of capabilities into md_ioctl_valid() - md: Don't suspend the array for interrupted reshape - md: Don't register sync_thread for reshape directly - md: Make sure md_do_sync() will set MD_RECOVERY_DONE - md: Don't ignore read-only array in md_check_recovery() - md: Don't ignore suspended array in md_check_recovery() - md: get rdev->mddev with READ_ONCE() - md: remove redundant md_wakeup_thread() - md: remove redundant check of 'mddev->sync_thread' - md: fix a suspicious RCU usage warning - raid: Remove now superfluous sentinel element from ctl_table array - NFSD: NFSv4 file creation neglects setting ACL - nfsd: set security label during create operations - xfs: Add xfs_dir3_leaf_header_check() in leaf/leafn read - nvme-fc: use lock accessing port_state and rport state - x86/mm: Batch flushing user memory encrytion status change - !20588 [OLK-6.6] Revert "x86/csv: Enhance CMA memory usage reporting for CSV3" - Revert "x86/csv: Enhance CMA memory usage reporting for CSV3" - !20576 media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg() - !20575 RDMA/cm: Fix leaking the multicast GID table reference - !20580 RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly - !20551 Fix CVE-2025-68785 - !20478 f2fs: fix to avoid potential deadlock - !20501 [OLK-6.6] backport important bugfix for bnxt driver from upstream linux-6.6.y - !20520 Fix CVE-2026-23038 - !20424 net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup - !20425 mlx5: Fix default values in create CQ - RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly - media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg() - RDMA/cm: Fix leaking the multicast GID table reference - net: openvswitch: fix middle attribute validation in push_nsh() action - net: openvswitch: remove never-working support for setting nsh fields - pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() - bnxt_en: Fix potential data corruption with HW GRO/LRO - f2fs: fix to avoid potential deadlock - mlx5: Fix default values in create CQ - net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup - riscv kernel upgrade to 6.6.0-138.0.0 - Fixed system hang when boot systemd on spacemit k3 - riscv: perf vendor events: fix lrw core PMU event mapping - !20727 v2 bpf: sockmap fixes - !20741 scsi: qla2xxx: Sanitize payload size to prevent member overflow - !20744 fix CVE-2025-38449 - !20763 net: usb: asix: validate PHY address before use - !20762 smc91x: fix broken irq-context in PREEMPT_RT - !20293 [Hygon][6.6][EDAC] The width of hash value is 2 bits for Hygon family 18h model 6h processors - !20290 [Hygon][6.6][Bugfix] Bug fix for EDAC to use unicast instead of broadcast on hygon family 18h model 4h - !20289 [Hygon][6.6][Bugfix] Bug fix for EDAC to correct the address translation on hygon family 18h model 4h - !20245 KVM: arm64: Refactor exit handlers - !20246 KVM: arm64: Mark some header functions as inline - !19005 [Hygon] [OLK-6.6] [Bugfix] Fix memory bandwidth counter width for Hygon QoS - !20292 [Hygon][6.6][TSC Adjust] Backport x86 TSC adjust patch - !20273 [Hygon][6.6][Bugfix] Get correct CPU LLC ID in guest for Hygon processors - !20722 [OLK-6.6][linux-6.6.y sync] Backport 6.6.104-6.6.106 LTS Patches - !20667 fix CVE-2024-50102 - !20736 netfilter: nf_tables: remove redundant chain validation on register store - !20758 ub: ubase: Fixed the alarm issue caused by the initialization of the structure variable definition. - !20721 obmm: reduce log noise for successful export/import/preimport - net: usb: asix: validate PHY address before use - smc91x: fix broken irq-context in PREEMPT_RT - !20731 devlink: rate: Unset parent pointer in devl_rate_nodes_destroy - !20732 libceph: return the handler error from mon_handle_auth_done() - !20743 mm: slub: avoid wake up kswapd in set_track_prepare - ub: ubase: Fixed the alarm issue caused by the initialization of the structure variable definition. - !20750 ub: cdma: adapted to UMMU interface changes - !20713 urma: DFX of log in kernel - urma: optimize log levels for kernel space - ub: cdma: adapted to UMMU interface changes - wifi: ath11k: avoid bit operation on key flags - drm/mediatek: fix potential OF node use-after-free - cpufreq: intel_pstate: Check IDA only before MSR_IA32_PERF_CTL writes - wifi: cfg80211: sme: store capped length in __cfg80211_connect_result() - !20708 ub:hisi-ubus: Add create bus instance ummu bypass - drm: fix kabi for struct drm_framebuffer - drm/framebuffer: Acquire internal references on GEM handles - drm/gem: Acquire references on GEM handles for framebuffers - mm: slub: avoid wake up kswapd in set_track_prepare - scsi: qla2xxx: Sanitize payload size to prevent member overflow - netfilter: nf_tables: remove redundant chain validation on register store - libceph: return the handler error from mon_handle_auth_done() - devlink: rate: Unset parent pointer in devl_rate_nodes_destroy - Documentation/hw-vuln: Add VMSCAPE documentation - dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status() - riscv: use lw when reading int cpu in asm_per_cpu - mm: slub: avoid wake up kswapd in set_track_prepare - tools: gpio: remove the include directory on make clean - tools: gpio: rm .*.cmd on make clean - drm/amd/amdgpu: Fix missing error return on kzalloc failure - drm/amdgpu: Replace DRM_* with dev_* in amdgpu_psp.c - perf bpf-event: Fix use-after-free in synthesis - drm/bridge: ti-sn65dsi86: fix REFCLK setting - spi: spi-fsl-lpspi: Clear status register after disabling the module - spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort - spi: spi-fsl-lpspi: Set correct chip-select polarity bit - spi: spi-fsl-lpspi: Fix transmissions when using CONT - hwmon: mlxreg-fan: Prevent fans from getting stuck at 0 RPM - pcmcia: omap: Add missing check for platform_get_resource - Revert "drm/amdgpu: Avoid extra evict-restore process." - ALSA: hda/realtek: Fix headset mic for TongFang X6[AF]R5xxY - ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model - drm/mediatek: Fix device/node reference count leaks in mtk_drm_get_all_drm_priv - drm/mediatek: Fix using wrong drm private data to bind mediatek-drm - drm/mediatek: Add crtc path enum for all_drm_priv array - vmxnet3: update MTU after device quiesce - net: dsa: microchip: linearize skb for tail-tagging switches - net: dsa: microchip: update tag_ksz masks for KSZ9477 family - dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status() - ALSA: hda/realtek - Add new HP ZBook laptop with micmute led fixup - ALSA: hda/realtek: Add support for HP Agusta using CS35L41 HDA - iio: pressure: mprls0025pa: use aligned_s64 for timestamp - iio: chemical: pms7003: use aligned_s64 for timestamp - iio: imu: inv_mpu6050: align buffer for timestamp - thermal/drivers/mediatek/lvts: Disable low offset IRQ for minimum threshold - nouveau: fix disabling the nonstall irq due to storm code - cpufreq: intel_pstate: Unchecked MSR aceess in legacy mode - net: pcs: rzn1-miic: Correct MODCTRL register offset - platform/x86/amd/pmc: Add TUXEDO IB Pro Gen10 AMD to spurious 8042 quirks list - drm/amdgpu: drop hw access in non-DC audio fini - wifi: mt76: mt7996: Initialize hdr before passing to skb_put_data() - wifi: mwifiex: Initialize the chan_stats array to zero - tcp_bpf: Fix copied value in tcp_bpf_sendmsg - skmsg: Return copied bytes in sk_msg_memcopy_from_iter - tcp_bpf: Add sk_rmem_alloc related logic for tcp_bpf ingress redirection - Revert "bpf, sockmap: Add sk_rmem_alloc check for sockmap" - ALSA: usb-audio: Add mute TLV for playback volumes on some devices - phy: mscc: Stop taking ts_lock for tx_queue and use its own lock - selftest: net: Fix weird setsockopt() in bind_bhash.c. - net: atm: fix memory leak in atm_register_sysfs when device_register fail - ax25: properly unshare skbs in ax25_kiss_rcv() - mctp: return -ENOPROTOOPT for unknown getsockopt options - net/smc: Remove validation of reserved bits in CLC Decline message - ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init() - net: thunder_bgx: decrement cleanup index before use - net: thunder_bgx: add a missing of_node_put - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() - wifi: libertas: cap SSID len in lbs_associate() - wifi: cw1200: cap SSID length in cw1200_do_join() - net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets - wifi: ath11k: fix group data packet drops during rekey - wifi: ath11k: avoid forward declaration of ath11k_mac_start_vdev_delay() - wifi: ath11k: rename ath11k_start_vdev_delay() - wifi: ath11k: Introduce and use ath11k_sta_to_arsta() - net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() - macsec: read MACSEC_SA_ATTR_PN with nla_get_uint - netlink: add variable-length / auto integers - net: macb: Fix tx_ptr_lock locking - icmp: fix icmp_ndo_send address translation for reply direction - mISDN: Fix memory leak in dsp_hwec_enable() - xirc2ps_cs: fix register access when enabling FullDuplex - netfilter: conntrack: helper: Replace -EEXIST by -EBUSY - wifi: cfg80211: fix use-after-free in cmp_bss() - arm64: dts: imx8mp: Fix missing microSD slot vqmmc on Data Modul i.MX8M Plus eDM SBC - arm64: dts: imx8mp: Fix missing microSD slot vqmmc on DH electronics i.MX8M Plus DHCOM - tee: optee: ffa: fix a typo of "optee_ffa_api_is_compatible" - arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro - Bluetooth: hci_sync: Avoid adding default advertising on startup - cpupower: Fix a bug where the -t option of the set subcommand was not working. - drm/amd/display: Don't warn when missing DCE encoder caps - cdc_ncm: Flag Intel OEM version of Fibocom L850-GL as WWAN - LoongArch: Save LBT before FPU in setup_sigcontext() - btrfs: avoid load/store tearing races when checking if an inode was logged - btrfs: fix race between setting last_dir_index_offset and inode logging - btrfs: fix race between logging inode and checking if it was logged before - bpf: Fix oob access in cgroup local storage - !20556 urma: fix update topo logic - !20639 [OLK-6.6][linux-6.6.y sync] Backport 6.6.103-6.6.104 LTS Patches - !20641 [OLK-6.6][linux-6.6.y sync] LoongArch: Add more instruction opcodes and emit_* helpers - !20560 *** fix CVE-2025-38062 *** - !20662 pNFS: Fix a deadlock when returning a delegation during open() - ub:hisi-ubus: Add create bus instance ummu bypass - Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" - Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set" - HID: mcp2221: Handle reads greater than 60 bytes - HID: mcp2221: Don't set bus speed on every transfer - net/mlx5: SF, Fix add port error handling - drm/nouveau/disp: Always accept linear modifier - smb3 client: fix return code mapping of remap_file_range - net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions - dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted - HID: wacom: Add a new Art Pen 2 - HID: logitech: Add ids for G PRO 2 LIGHTSPEED - HID: quirks: add support for Legion Go dual dinput modes - net: stmmac: Set CIC bit only for TX queues with COE - net: stmmac: xgmac: Correct supported speed modes - net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts - net/mlx5e: Set local Xoff after FW update - net/mlx5e: Update and set Xon/Xoff upon port speed set - net/mlx5e: Update and set Xon/Xoff upon MTU set - net/mlx5: Nack sync reset when SFs are present - net/mlx5: Convert SF port_indices xarray to function_ids xarray - net/mlx5: Use devlink port pointer to get the pointer of container SF struct - net/mlx5: Call mlx5_sf_id_erase() once in mlx5_sf_dealloc() - phy: mscc: Fix when PTP clock is register and unregister - net: dlink: fix multicast stats being counted incorrectly - dt-bindings: display/msm: qcom,mdp5: drop lut clock - drm/nouveau: remove unused memory target test - drm/nouveau: remove unused increment in gm200_flcn_pio_imem_wr - Bluetooth: hci_sync: fix set_local_name race condition - Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced - Bluetooth: hci_event: Mark connection as closed during suspend disconnect - Bluetooth: hci_event: Treat UNKNOWN_CONN_ID on disconnect as success - HID: input: report battery status changes immediately - HID: input: rename hidinput_set_battery_charge_status() - powerpc/kvm: Fix ifdef to remove build warning - drm/msm: Defer fd_install in SUBMIT ioctl - vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() - ACPI: EC: Add device to acpi_ec_no_wakeup[] qurik list - erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC - ASoC: codecs: tx-macro: correct tx_macro_component_drv name - smb: client: fix race with concurrent opens in unlink(2) - scsi: core: sysfs: Correct sysfs attributes access rights - of: dynamic: Fix use after free in of_changeset_add_prop_helper() - of: Add a helper to free property struct - mips: lantiq: xway: sysctrl: rename the etop node - mips: dts: lantiq: danube: add missing burst length property - pinctrl: STMFX: add missing HAS_IOMEM dependency - of: dynamic: Fix memleak when of_pci_add_properties() failed - !20684 urma: adjust urma log format - !20355 udp: Deal with race between UDP socket address change and rehash - !20627 Fixes CVE-2025-38627 - !20702 CVE-2025-39948 - !20701 netfilter: ctnetlink: remove refcounting in expectation dumpers - !20700 CVE-2025-38678 - !20703 CVE-2025-38491 - !20690 tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. - obmm: reduce log noise for successful export/import/preimport - mptcp: avoid deadlock on fallback while reinjecting - mptcp: plug races between subflow fail and subflow creation - mptcp: make fallback action and fallback decision atomic - ice: fix Rx page leak on multi-buffer frames - ice: fix incorrect counter for buffer allocation failures - ice: stop storing XDP verdict within ice_rx_buf - ice: gather page_count()'s of each frag right before XDP prog call - ice: Introduce ice_xdp_buff - netfilter: ctnetlink: remove refcounting in expectation dumpers - netfilter: nf_tables: reject duplicate device on updates - netfilter: nf_tables: Introduce functions freeing nft_hook objects - netfilter: nf_tables: Fix percpu address space issues in nf_tables_api.c - err.h: add ERR_PTR_PCPU(), PTR_ERR_PCPU() and IS_ERR_PCPU() macros - tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. - !20498 Fix CVE-2025-71118 - !20608 pmdomain: arm: scmi: Fix genpd leak on provider registration failure - !20679 x86/CPU/AMD: Add RDSEED fix for Zen5 - !20650 fix cve-2025-40300 - !20661 Input: alps - fix use-after-free bugs caused by dev3_register_work - !20664 backport some net bugfix from 6.6 lts - urma: adjust urma log format - !20678 ub: udma: close debug switch load parameters. - ub: udma: close debug switch load parameters. - x86/CPU/AMD: Add RDSEED fix for Zen5 - !20630 net: LTS-6.6 bugfix backport - !20632 net/sched: sch_qfq: do not free existing class in qfq_change_class() - !20631 macvlan: fix possible UAF in macvlan_forward_source() - !20628 Fix CVE-2025-39910 - !20659 v2 Fix CVE-2025-22090 - !20506 XSched: Update XSched manual - !20647 media: imon: make send_packet() more robust - !20646 ksm: use range-walk function to jump over holes in scan_get_next_rmap_item - !20645 fbcon: Set fb_display[i - !20648 parse_longname(): strrchr() expects NUL-terminated string - !20621 urma: modify log level - !20602 urma: fix the jfe uaf issue that occurred during the killall process. - !20567 urma:change log level and pass status 9 - !20640 iio: common: st_sensors: Fix use of uninitialize device structs - !20634 usb: gadget: udc: fix use-after-free in usb_gadget_state_work - !20633 net: dsa: properly keep track of conduit reference - !20635 fix CVE-2025-68231 - !20651 mm/slub: avoid accessing metadata when pointer is invalid in object_err() - !20649 drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb - !20652 mm/vmalloc: fix data race in show_numa_info() - x86: uaccess: don't use runtime-const rewriting in modules - x86: fix off-by-one in access_ok() - x86: fix user address masking non-canonical speculation issue - x86/uaccess: Zero the 8-byte get_range case on failure on 32-bit - x86/uaccess: Improve the 8-byte getuser() case - x86: fix whitespace in runtime-const assembler output - dcache: keep dentry_hashtable or d_hash_shift even when not used - runtime constants: add x86 architecture support - runtime constants: deal with old decrepit linkers - x86/uaccess: Add missing __force to casts in __access_ok() and valid_user_address() - !20345 arm64: entry: xcall/xint: make asm conditionals compatible with clang IAS - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). - libceph: replace BUG_ON with bounds check for map->max_osd - libceph: prevent potential out-of-bounds writes in handle_auth_session_key() - libceph: fix potential use-after-free in have_mon_and_osd_map() - sctp: Hold sock lock while iterating over address list - sctp: Prevent TOCTOU out-of-bounds write - sctp: Hold RCU read lock while iterating over address list - tipc: Fix use-after-free in tipc_mon_reinit_self(). - sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto - sctp: avoid NULL dereference when chunk data buffer is missing - bpf: Explicitly check accesses to bpf_sock_addr - ipvs: Defer ip_vs_ftp unregister during netns cleanup - nexthop: Forbid FDB status change while nexthop is in a group - netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). - net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer - sctp: initialize more fields in sctp_v6_from_sk() - pNFS: Fix a deadlock when returning a delegation during open() - Input: alps - fix use-after-free bugs caused by dev3_register_work - x86/cpu: Get CPU LLC ID from CPUID 0x8000001d in guest for Hygon processors - kernel/fork: only call untrack_pfn_clear() on VMAs duplicated for fork() - mm: (un)track_pfn_copy() fix + doc improvements - x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range() - !20642 mtdchar: fix integer overflow in read/write ioctls - mm/vmalloc: fix data race in show_numa_info() - mm/slub: avoid accessing metadata when pointer is invalid in object_err() - config: enable CONFIG_MITIGATION_VMESCAPE by default on x86 - x86/vmscape: Enable the mitigation - x86/vmscape: Enumerate VMSCAPE bug - x86/vmscape: Add conditional IBPB mitigation - drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb - parse_longname(): strrchr() expects NUL-terminated string - media: imon: make send_packet() more robust - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item - fbcon: Set fb_display[i]->mode to NULL when the mode is released - !20569 CVE-2024-35808 - mtdchar: fix integer overflow in read/write ioctls - !20619 Fix CVE-2026-22991 - !20612 net: hns3: extend HCLGE_FD_AD_COUNTER_NUM to 8 bits - LoongArch: Add more instruction opcodes and emit_* helpers - iio: common: st_sensors: Fix use of uninitialize device structs - !20581 null_blk: fix kmemleak by releasing references to fault configfs items - mm/mempool: fix poisoning order>0 pages with HIGHMEM - mm/page_poison: replace kmap_atomic() with kmap_local_page() - mm/mempool: replace kmap_atomic() with kmap_local_page() - usb: gadget: udc: fix use-after-free in usb_gadget_state_work - net: dsa: properly keep track of conduit reference - net/sched: sch_qfq: do not free existing class in qfq_change_class() - macvlan: fix possible UAF in macvlan_forward_source() - netfilter: nft_objref: validate objref and objrefmap expressions - arp: do not assume dev_hard_header() does not change skb->head - ip6_gre: make ip6gre_header() robust - netfilter: nf_tables: avoid chain re-validation if possible - netfilter: nf_tables: drop unused 3rd argument from validate callback ops - Revert "netfilter: nft_objref: validate objref and objrefmap expressions" - bpf: Fix reference count leak in bpf_prog_test_run_xdp() - net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset - ethtool: Avoid overflowing userspace buffer on stats query - ipvs: fix ipv4 null-ptr-deref in route error path - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() - !20596 mm/page_alloc: prevent pcp corruption with SMP=n - !20598 team: fix check for port enabled in team_queue_override_port_prio_changed() - !18823 hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio - mm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc() - kasan: avoid sleepable page allocation from atomic context - f2fs: compress: fix UAF of f2fs_inode_info in f2fs_free_dic - f2fs: compress: change the first parameter of page_array_{alloc,free} to sbi - !20583 [OLK-6.6][linux-6.6.y sync] Backport 6.6.102-6.6.103 LTS Patches - !20460 fbdev: Fix vmalloc out-of-bounds write in fast_imageblit - urma:fix log level and pass status 9 - urma: modify log level - !20592 CVE-2025-71141 fixup - !20594 CVE-2025-39744 fixup - !20607 powerpc/64s/slb: Fix SLB multihit issue during SLB preload - !20606 mm/huge_memory: fix NULL pointer deference when splitting folio - !20604 Fix CVE-2026-22984 - !20603 Fix CVE-2026-23021 - !20600 Fix CVE-2026-22990 - urma: fix the jfe uaf issue that occurred during the killall process. - !20380 pswiotlb: Adapt to the IOMMU DMA API upgraded by IOMMUFD - libceph: make free_choose_arg_map() resilient to partial allocation - drm/dp: Change AUX DPCD probe address from LANE0_1_STATUS to TRAINING_PATTERN_SET - net: hns3: extend HCLGE_FD_AD_COUNTER_NUM to 8 bits - net: hns3: extend HCLGE_FD_AD_QID to 11 bits - net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue - net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M - Revert "net: hns3: add support for FD counter" - !20587 dmaengine: stm32: dmamux: fix device leak on route allocation - pmdomain: arm: scmi: Fix genpd leak on provider registration failure - powerpc/64s/slb: Fix SLB multihit issue during SLB preload - mm/huge_memory: fix NULL pointer deference when splitting folio - !20562 LoongArch: BPF: Sign extend kfunc call arguments - !20470 ipv4: Fix reference count leak when using error routes with nexthop objects - !20471 net: sock: fix hardened usercopy panic in sock_recv_errqueue - !20472 net: fix memory leak in skb_segment_list for GRO packets - !20473 ipv4: ip_gre: make ipgre_header() robust - !20469 SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf - !20476 ipv6: Fix use-after-free in inet6_addr_del(). - !20477 svcrdma: bound check rq_pages index in inline path - !20578 ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() - !20579 fix CVE-2025-68768 - !20542 Fix NFS deadlock - USB: storage: Remove subclass and protocol overrides from Novatek quirk - cpuidle: governors: menu: Select polling state in some more cases - cpuidle: governors: menu: Rearrange main loop in menu_select() - cpuidle: menu: Update documentation after previous changes - Revert "drm/tegra: dsi: Clear enable register if powered by bootloader" - parisc: Remove spurious if statement from raw_copy_from_user() - ata: libata-scsi: Fix system suspend for a security locked drive - Revert "drm/amdgpu: fix incorrect vm flags to map bo" - mfd: axp20x: Set explicit ID for regulator cell if no IRQ line is present - drm/amd/display: use udelay rather than fsleep - sched/fair: Revert max_newidle_lb_cost bump - net: ipv4: fix regression in local-broadcast routes - tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers - PM: runtime: Do not clear needs_force_resume with enabled runtime PM - usb: typec: ucsi: psy: Set max current to zero when disconnected - io_uring/rw: cast rw->flags assignment to rwf_t - Documentation: ACPI: i2c-muxes: fix I2C device references - s390/hypfs: Enable limited access during lockdown - s390/hypfs: Avoid unnecessary ioctl registration in debugfs - ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation - net/mlx5e: Preserve shared buffer capacity during headroom updates - net/mlx5: Base ECVF devlink port attrs from 0 - Octeontx2-af: Skip overlap check for SPI field - bonding: send LACPDUs periodically in passive mode after receiving partner's LACPDU - bonding: Add independent control state machine - bonding: update LACP activity flag after setting lacp_active - net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate - ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc - gve: prevent ethtool ops after shutdown - phy: mscc: Fix timestamping for vsc8584 - net: ethernet: mtk_ppe: add RCU lock around dev_fill_forward_path - ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add - net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM - ALSA: usb-audio: Fix size validation in convert_chmap_v3() - mlxsw: spectrum: Forward packets with an IPv4 link-local source IP - Bluetooth: hci_conn: do return error from hci_enhanced_setup_sync() - Bluetooth: hci_event: fix MTU for BN == 0 in CIS Established - scsi: qla4xxx: Prevent a potential error pointer dereference - RDMA/bnxt_re: Fix to initialize the PBL array - RDMA/bnxt_re: Fix to remove workload check in SRQ limit path - RDMA/bnxt_re: Fix to do SRQ armena by default - RDMA/erdma: Fix ignored return value of init_kernel_qp - iosys-map: Fix undefined behavior in iosys_map_clear() - cgroup/cpuset: Use static_branch_enable_cpuslocked() on cpusets_insane_config_key - spi: spi-fsl-lpspi: Clamp too high speed_hz - usb: typec: maxim_contaminant: disable low power mode when reading comparator values - usb: typec: maxim_contaminant: re-enable cc toggle if cc is open and port is clean - iio: imu: inv_icm42600: change invalid data error to -EBUSY - iio: imu: inv_icm42600: Convert to uXX and sXX integer types - iio: imu: inv_icm42600: use = { } instead of memset() - iio: imu: inv_icm42600: switch timestamp type from int64_t __aligned(8) to aligned_s64 - iio: temperature: maxim_thermocouple: use DMA-safe buffer for spi_read() - iio: light: as73211: Ensure buffer holes are zeroed - tls: fix handling of zero-length records on the rx_list - powerpc/boot: Fix build with gcc 15 - mmc: sdhci-pci-gli: GL9763e: Mask the replay timer timeout of AER - compiler: remove __ADDRESSABLE_ASM{_STR,}() again - drm/amd/display: Don't overclock DCE 6 by 15% - usb: dwc3: pci: add support for the Intel Wildcat Lake - usb: dwc3: Ignore late xferNotReady event to prevent halt timeout - USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles - usb: storage: realtek_cr: Use correct byte order for bcs->Residue - USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera - usb: renesas-xhci: Fix External ROM access timeouts - usb: core: hcd: fix accessing unmapped memory in SINGLE_STEP_SET_FEATURE test - comedi: Make insn_rw_emulate_bits() do insn->n samples - usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive - cdx: Fix off-by-one error in cdx_rpmsg_probe() - most: core: Drop device reference after usage in get_channel() - iio: proximity: isl29501: fix buffered read on big-endian systems - iio: pressure: bmp280: Use IS_ERR() in bmp280_common_probe() - fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable() - drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS - cpuidle: governors: menu: Avoid selecting states with too much latency - cpuidle: menu: Remove iowait influence - mmc: sdhci-pci-gli: Add a new function to simplify the code - mmc: sdhci-pci-gli: Use PCI AER definitions, not hard-coded values - mptcp: disable add_addr retransmission when timeout is 0 - mptcp: remove duplicate sk_reset_timer call - use uniform permission checks for all mount propagation changes - arm64: dts: ti: k3-am62-main: Remove eMMC High Speed DDR support - scsi: mpi3mr: Serialize admin queue BAR writes on 32-bit systems - scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers - scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE - PCI: imx6: Add IMX8MM_EP and IMX8MP_EP fixed 256-byte BAR 4 in epc_features - PCI: imx6: Delay link start until configfs 'start' written - PCI: rockchip: Set Target Link Speed to 5.0 GT/s before retraining - PCI: rockchip: Use standard PCIe definitions - drm/amd/display: Fill display clock and vblank time in dce110_fill_display_configs - drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs - drm/amd/display: Fix DP audio DTO1 clock source on DCE 6. - drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3 - ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and EliteBook 830 G6 - mm/debug_vm_pgtable: clear page table entries at destroy_args() - squashfs: fix memory leak in squashfs_fill_super - mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for consistency - memstick: Fix deadlock by moving removing flag earlier - KVM: arm64: Fix kernel BUG() due to bad backport of FPSIMD/SVE/SME fix - sched/fair: Fix frequency selection for non-invariant case - kbuild: userprogs: use correct linker when mixing clang and GNU ld - ata: libata-scsi: Return aborted command when missing sense and result TF - PM: runtime: Take active children into account in pm_runtime_get_if_in_use() - PM: runtime: Simplify pm_runtime_get_if_active() usage - ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig - usb: dwc3: imx8mp: fix device leak at unbind - wifi: mac80211: check basic rates validity in sta_link_apply_parameters - KVM: x86: Take irqfds.lock when adding/deleting IRQ bypass producer - s390/mm: Remove possible false-positive warning in pte_free_defer() - btrfs: send: make fs_path_len() inline and constify its argument - btrfs: send: use fallocate for hole punching with send stream v2 - btrfs: send: avoid path allocation for the current inode when issuing commands - btrfs: send: keep the current inode's path cached - btrfs: send: add and use helper to rename current inode when processing refs - btrfs: send: only use boolean variables at process_recorded_refs() - btrfs: send: factor out common logic when sending xattrs - btrfs: populate otime when logging an inode item - btrfs: constify more pointer parameters - btrfs: fix ssd_spread overallocation - btrfs: open code timespec64 in struct btrfs_inode - xfs: fully decouple XFS_IBULK* flags from XFS_IWALK* flags - btrfs: abort transaction on unexpected eb generation at btrfs_copy_root() - btrfs: always abort transaction on failure to add block group to free space tree - btrfs: move transaction aborts to the error site in add_block_group_free_space() - btrfs: qgroup: fix race between quota disable and quota rescan ioctl - usb: typec: fusb302: cache PD RX state - block: Make REQ_OP_ZONE_FINISH a write operation - block: reject invalid operation in submit_bio_noacct - leds: flash: leds-qcom-flash: Fix registry access after re-bind - leds: flash: leds-qcom-flash: Limit LED current based on thermal condition - selftests/memfd: add test for mapping write-sealed memfd read-only - mm: update memfd seal write check to include F_SEAL_WRITE - mptcp: pm: kernel: flush: do not reset ADD_ADDR limit - mptcp: drop skb if MPTCP skb extension allocation fails - ipv6: sr: Fix MAC comparison to be constant-time - drm/amd/display: Don't overwrite dce60_clk_mgr - drm/amd/display: Add primary plane to commits for correct VRR handling - drm/amdkfd: Destroy KFD debugfs after destroy KFD wq - drm/amdgpu: update mmhub 3.0.1 client id mappings - drm/amdgpu: Avoid extra evict-restore process. - drm/amd: Restore cached power limit during resume - media: venus: venc: Clamp param smaller than 1fps and bigger than 240 - media: venus: vdec: Clamp param smaller than 1fps and bigger than 240. - media: venus: protect against spurious interrupts during probe - media: venus: hfi: explicitly release IRQ during teardown - media: qcom: camss: cleanup media device allocated resource on error path - media: ov2659: Fix memory leaks in ov2659_probe() - media: usbtv: Lock resolution while streaming - media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free() - media: verisilicon: Fix AV1 decoder clock frequency - media: vivid: fix wrong pixel_array control size - media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init() - media: hi556: correct the test pattern configuration - media: gspca: Add bounds checking to firmware parser - parisc: Update comments in make_insert_tlb - parisc: Try to fixup kernel exception in bad_area_nosemaphore path of do_page_fault() - parisc: Rename pte_needs_flush() to pte_needs_cache_flush() in cache.c - parisc: Makefile: explain that 64BIT requires both 32-bit and 64-bit compilers - parisc: Define and use set_pte_at() - parisc: Check region is readable by user in raw_copy_from_user() - soc/tegra: pmc: Ensure power-domains are in a known state - f2fs: fix to avoid out-of-boundary access in dnode page - phy: qcom: phy-qcom-m31: Update IPQ5332 M31 USB phy initialization sequence - vhost/vsock: Avoid allocating arbitrarily-sized SKBs - PCI: endpoint: Fix configfs group removal on driver teardown - PCI: endpoint: Fix configfs group list head handling - mtd: rawnand: renesas: Add missing check after DMA map - mtd: rawnand: fsmc: Add missing check after DMA map - mtd: spinand: propagate spinand_wait() errors from spinand_write_page() - mtd: spi-nor: Fix spi_nor_try_unlock_all() - hwmon: (gsc-hwmon) fix fan pwm setpoint show functions - pwm: mediatek: Fix duty and period setting - pwm: mediatek: Handle hardware enable and clock enable separately - pwm: imx-tpm: Reset counter if CMOD is 0 - wifi: ath11k: fix dest ring-buffer corruption when ring is full - wifi: ath11k: fix source ring-buffer corruption - wifi: ath11k: fix dest ring-buffer corruption - wifi: ath12k: fix dest ring-buffer corruption when ring is full - wifi: ath12k: fix source ring-buffer corruption - wifi: ath12k: fix dest ring-buffer corruption - wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table() - iio: adc: ad_sigma_delta: change to buffer predisable - zynq_fpga: use sgtable-based scatterlist wrappers - scsi: ufs: ufs-pci: Fix default runtime and system PM levels - scsi: ufs: ufs-pci: Fix hibernate state transition for Intel MTL-like host controllers - ata: libata-scsi: Fix ata_to_sense_error() status handling - scsi: mpi3mr: Fix race between config read submit and interrupt completion - dt-bindings: display: sprd,sharkl3-dsi-host: Fix missing clocks constraints - dt-bindings: display: sprd,sharkl3-dpu: Fix missing clocks constraints - arm64: dts: ti: k3-am62-verdin: Enable pull-ups on I2C buses - arm64: dts: ti: k3-am62a7-sk: fix pinmux for main_uart1 - arm64: dts: ti: k3-pinctrl: Enable Schmitt Trigger by default - btrfs: zoned: fix write time activation failure for metadata block group - ext4: fix hole length calculation overflow in non-extent inodes - ext4: don't try to clear the orphan_present feature block device is r/o - ext4: fix reserved gdt blocks handling in fsmap - ext4: fix fsmap end of range reporting with bigalloc - ext4: check fast symlink for ea_inode correctly - tracing: fprobe-event: Sanitize wildcard for fprobe event name - crypto: qat - lower priority for skcipher and aead algorithms - lib/crypto: mips/chacha: Fix clang build and remove unneeded byteswap - vt: defkeymap: Map keycodes above 127 to K_HOLE - vt: keyboard: Don't process Unicode characters in K_OFF mode - bus: mhi: host: Fix endianness of BHI vector table - usb: dwc3: meson-g12a: fix device leaks at unbind - usb: musb: omap2430: fix device leak at unbind - usb: gadget: udc: renesas_usb3: fix device leak at unbind - usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init() - m68k: Fix lost column on framebuffer debug console - platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister() - cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table() - rcu: Fix racy re-initialization of irq_work causing hangs - HID: apple: avoid setting up battery timer for devices without battery - HID: magicmouse: avoid setting up battery timer when not needed - RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages - tools/nolibc: fix spelling of FD_SETBITMASK in FD_* macros - media: uvcvideo: Do not mark valid metadata as invalid - media: venus: Fix OOB read due to missing payload bound check - parisc: Makefile: fix a typo in palo.conf - fbdev: Fix vmalloc out-of-bounds write in fast_imageblit - btrfs: do not allow relocation of partially dropped subvolumes - btrfs: zoned: do not select metadata BG as finish target - btrfs: clear dirty status from extent buffer on error at insert_new_root() - btrfs: zoned: do not remove unwritten non-data block group - btrfs: abort transaction during log replay if walk_log_tree() failed - btrfs: zoned: use filesystem size not disk size for reclaim decision - cdc-acm: fix race between initial clearing halt and open - thunderbolt: Fix copy+paste error in match_service_id() - usb: typec: ucsi: Update power_supply on power role change - misc: rtsx: usb: Ensure mmc child device is active when card is present - iommufd: Report unmapped bytes in the error path of iopt_unmap_iova_range - cifs: reset iface weights when we cannot find a candidate - drm/amdgpu: fix incorrect vm flags to map bo - scsi: lpfc: Remove redundant assignment to avoid memory leak - rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe - pNFS: Handle RPC size limit for layoutcommits - pNFS: Fix disk addr range check in block/scsi layout - pNFS: Fix stripe mapping in block/scsi layout - ASoC: Intel: avs: Fix uninitialized pointer error in probe() - net: phy: smsc: add proper reset flags for LAN8710A - ipmi: Fix strcpy source and destination the same - kconfig: lxdialog: fix 'space' to (de)select options - kconfig: gconf: fix potential memory leak in renderer_edited() - kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed() - ipmi: Use dev_warn_ratelimited() for incorrect message warnings - vfio/mlx5: fix possible overflow in tracking max message size - scsi: aacraid: Stop using PCI_IRQ_AFFINITY - scsi: target: core: Generate correct identifiers for PR OUT transport IDs - scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans - kconfig: nconf: Ensure null termination where strncpy is used - vfio/type1: conditional rescheduling while pinning - kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c - f2fs: check the generic conditions first - exfat: add cluster chain loop check for dir - i2c: Force DLL0945 touchpad i2c freq to 100khz - apparmor: use the condition in AA_BUG_FMT even with debug disabled - dm-table: fix checking for rq stackable devices - dm-mpath: don't print the "loaded" message if registering fails - i3c: master: Initialize ret in i3c_i2c_notifier_call() - i3c: don't fail if GETHDRCAP is unsupported - apparmor: shift ouid when mediating hard links in userns - rtc: ds1307: handle oscillator stop flag (OSF) for ds1341 - i3c: add missing include to internal header - module: Prevent silent truncation of module name in delete_module(2) - md: dm-zoned-target: Initialize return variable r to avoid uninitialized use - soundwire: Move handle_nested_irq outside of sdw_dev_lock - soundwire: amd: serialize amd manager resume sequence during pm_prepare - crypto: octeontx2 - add timeout for load_fvc completion poll - media: uvcvideo: Fix bandwidth issue for Alcor camera - media: usb: hdpvr: disable zero-length read messages - media: tc358743: Increase FIFO trigger level to 374 - media: tc358743: Return an appropriate colorspace from tc358743_set_fmt - media: tc358743: Check I2C succeeded during probe - pinctrl: stm32: Manage irq affinity settings - scsi: mpi3mr: Correctly handle ATA device errors - scsi: mpt3sas: Correctly handle ATA device errors - power: supply: qcom_battmgr: Add lithium-polymer entry - RDMA/core: reduce stack using in nldev_stat_get_doit() - dmaengine: stm32-dma: configure next sg only if there are more than 2 sgs - leds: leds-lp50xx: Handle reg to get correct multi_index - media: v4l2-common: Reduce warnings about missing V4L2_CID_LINK_FREQ control - MIPS: lantiq: falcon: sysctrl: fix request memory check logic - crypto: jitter - fix intermediary handling - watchdog: iTCO_wdt: Report error if timeout configuration fails - MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free} - clk: qcom: ipq5018: keep XO clock always on - hwmon: (emc2305) Set initial PWM minimum value during probe based on thermal state - watchdog: dw_wdt: Fix default timeout - fs/orangefs: use snprintf() instead of sprintf() - phy: rockchip-pcie: Properly disable TEST_WRITE strobe signal - mfd: axp20x: Set explicit ID for AXP313 regulator - clk: tegra: periph: Fix error handling and resolve unsigned compare warning - fbdev: fix potential buffer overflow in do_register_framebuffer() - cifs: Fix calling CIFSFindFirst() for root path without msearch - watchdog: sbsa: Adjust keepalive timeout to avoid MediaTek WS0 race condition - drm/amd/display: Avoid configuring PSR granularity if PSR-SU not supported - drm/amd/display: Only finalize atomic_obj if it was initialized - vhost: fail early when __vhost_add_used() fails - vsock/virtio: Resize receive buffers so that each SKB fits in a 4K page - net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325 - rcu: Fix rcu_read_unlock() deadloop due to IRQ work - drm/amd/display: Avoid trying AUX transactions on disconnected ports - selftests/bpf: Fix a user_ringbuf failure with arm64 64KB page size - bpf: Make reg_not_null() true for CONST_PTR_TO_MAP - uapi: in6: restore visibility of most IPv6 socket options - drm/ttm: Should to return the evict error - drm: renesas: rz-du: mipi_dsi: Add min check for VCLK range - net: ncsi: Fix buffer overflow in fetching version id - ionic: clean dbpage in de-init - wifi: rtlwifi: fix possible skb memory leak in _rtl_pci_init_one_rxdesc() - ptp: Use ratelimite for freerun error message - bpftool: Fix JSON writer resource leak in version command - net: dsa: b53: prevent SWITCH_CTRL access on BCM5325 - net: dsa: b53: prevent DIS_LEARNING access on BCM5325 - net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325 - net: dsa: b53: fix b53_imp_vlan_setup for BCM5325 - gve: Return error for unknown admin queue command - net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs - net: vlan: Make is_vlan_dev() a stub when VLAN is not configured - drm/amd: Allow printing VanGogh OD SCLK levels without setting dpm to manual - dpaa_eth: don't use fixed_phy_change_carrier - wifi: iwlegacy: Check rate_idx range after addition - netmem: fix skb_frag_address_safe with unreadable skbs - powerpc: floppy: Add missing checks after DMA map - wifi: ath12k: Decrement TID on RX peer frag setup error handling - wifi: ath12k: Enable REO queue lookup table feature on QCN9274 hw2.0 - wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`. - wifi: mac80211: update radar_required in channel context after channel switch - drm/amd/display: Fix 'failed to blank crtc!' - wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect - wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd() - wifi: ath12k: Add memset and update default rate value in wmi tx completion - drm/amd/display: Separate set_gsl from set_gsl_source_select - net: fec: allow disable coalescing - net: atlantic: add set_power to fw_ops for atl2 to fix wol - net: thunderbolt: Fix the parameter passing of tb_xdomain_enable_paths()/tb_xdomain_disable_paths() - net: thunderbolt: Enable end-to-end flow control also in transmit - kselftest/arm64: Specify SVE data when testing VL set in sve-ptrace - wifi: mt76: mt7915: mcu: re-init MCU before loading FW patch - wifi: rtw89: Disable deep power saving for USB/SDIO - wifi: rtw89: Fix rtw89_mac_power_switch() for USB - drm/msm: use trylock for debugfs - wifi: mac80211: fix rx link assignment for non-MLO stations - ipv6: mcast: Check inet6_dev->dead under idev->mc_lock in __ipv6_dev_mc_inc(). - (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer - wifi: mac80211: don't complete management TX on SAE commit - sched/fair: Bump sd->max_newidle_lb_cost when newidle balance fails - s390/stp: Remove udelay from stp_sync_clock() - wifi: iwlwifi: mvm: fix scan request validation - um: Re-evaluate thread flags repeatedly - wifi: iwlwifi: mvm: set gtk id also in older FWs - perf/cxlpmu: Remove unintended newline from IRQ name format string - net: phy: micrel: Add ksz9131_resume() - net: thunderx: Fix format-truncation warning in bgx_acpi_match_id() - net: ipv4: fix incorrect MTU in broadcast routes - wifi: cfg80211: Fix interface type validation - net: mctp: Prevent duplicate binds - arm64: Mark kernel as tainted on SAE and SError panic - net/mlx5e: Properly access RCU protected qdisc_sleeping variable - net: ag71xx: Add missing check after DMA map - et131x: Add missing check after DMA map - wifi: rtw89: Lower the timeout in rtw89_fw_read_c2h_reg() for USB - be2net: Use correct byte order and format string for TCP seq and ack_seq - s390/time: Use monotonic clock in get_cycles() - wifi: cfg80211: reject HTC bit for management frames - ktest.pl: Prevent recursion of default variable options - wifi: ath12k: Correct tid cleanup when tid setup fails - net: usb: cdc-ncm: check for filtering capability - xen/netfront: Fix TX response spurious interrupts - Bluetooth: hci_sock: Reset cookie to zero in hci_sock_free_cookie() - powerpc/thp: tracing: Hide hugepage events under CONFIG_PPC_BOOK3S_64 - ASoC: qcom: use drvdata instead of component to keep id - ASoC: codecs: rt5640: Retry DEVICE_ID verification - iio: adc: ad7768-1: Ensure SYNC_IN pulse minimum timing requirement - ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros - ALSA: pcm: Rewrite recalculate_boundary() to avoid costly loop - platform/chrome: cros_ec_typec: Defer probe on missing EC parent - platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches - soc: qcom: mdt_loader: Actually use the e_phoff - imx8m-blk-ctrl: set ISI panic write hurry level - pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop() - usb: core: usb_submit_urb: downgrade type check - usb: typec: intel_pmc_mux: Defer probe if SCU IPC isn't present - ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4 - ASoC: hdac_hdmi: Rate limit logging on connection and disconnection - ALSA: hda: Disable jack polling at shutdown - ALSA: hda: Handle the jack polling always via a work - mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode() - mei: bus: Check for still connected devices in mei_cl_bus_dev_release() - char: misc: Fix improper and inaccurate error code returned by misc_init() - reset: brcmstb: Enable reset drivers for ARCH_BCM2835 - pps: clients: gpio: fix interrupt handling order in remove path - ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path - mmc: sdhci-msm: Ensure SD card power isn't ON when card removed - ACPI: processor: fix acpi_object initialization - PM: sleep: console: Fix the black screen issue - thermal: sysfs: Return ENODATA instead of EAGAIN for reads - PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit() - firmware: tegra: Fix IVC dependency problems - ACPI: PRM: Reduce unnecessary printing to avoid user confusion - selftests: tracing: Use mutex_unlock for testing glob filter - tools/build: Fix s390(x) cross-compilation with clang - gpio: tps65912: check the return value of regmap_update_bits() - iio: adc: ad_sigma_delta: don't overallocate scan buffer - tools/nolibc: define time_t in terms of __kernel_old_time_t - thermal/drivers/qcom-spmi-temp-alarm: Enable stage 2 shutdown when required - ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed - EDAC/synopsys: Clear the ECC counters on init - gpio: wcd934x: check the return value of regmap_update_bits() - remoteproc: imx_rproc: skip clock enable when M-core is managed by the SCU - soc: qcom: rpmh-rsc: Add RSC version 4 support - usb: xhci: Avoid showing errors during surprise removal - usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command - usb: xhci: Avoid showing warnings for dying controller - usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default - selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t - cpufreq: CPPC: Mark driver with NEED_UPDATE_LIMITS flag - platform/x86/amd: pmc: Add Lenovo Yoga 6 13ALC6 to pmc quirk list - usb: xhci: print xhci->xhc_state when queue_command failed - tracefs: Add d_delete to remove negative dentries - securityfs: don't pin dentries twice, once is enough... - fix locking in efi_secret_unlink() - ext2: Handle fiemap on empty files to prevent EINVAL - fs/ntfs3: correctly create symlink for relative path - fs/ntfs3: Add sanity check for file name - better lockdep annotations for simple_recursive_removal() - hfs: fix not erasing deleted b-tree node issue - drbd: add missing kref_get in handle_write_conflicts - udf: Verify partition map count - gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops - nvme-pci: try function level reset on init failure - smb/server: avoid deadlock when linking with ReplaceIfExists - arm64: Handle KCOV __init vs inline mismatches - ptp: prevent possible ABBA deadlock in ptp_clock_freerun() - intel_idle: Allow loading ACPI tables for any family - net: ti: icss-iep: Fix incorrect type for return value in extts_enable() - netfilter: ctnetlink: fix refcount leak on table dump - udp: also consider secpath when evaluating ipsec use for checksumming - KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs - KVM: nVMX: Check vmcs12->guest_ia32_debugctl on nested VM-Enter - KVM: VMX: Extract checking of guest's DEBUGCTL into helper - KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported - KVM: VMX: Handle forced exit due to preemption timer in fastpath - KVM: VMX: Re-enter guest in fastpath for "spurious" preemption timer exits - KVM: x86: Plumb "force_immediate_exit" into kvm_entry() tracepoint - libceph: prevent potential out-of-bounds reads in handle_auth_done() - net: usb: pegasus: fix memory leak in update_eth_regs_async() - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() - !20540 urma: added support for ipoverurma - team: fix check for port enabled in team_queue_override_port_prio_changed() - mm/page_alloc: prevent pcp corruption with SMP=n - !20528 Fix CVE-2025-71083 - KVM: nVMX: Defer SVI update to vmcs01 on EOI when L2 is active w/o VID - KVM: x86: Plumb in the vCPU to kvm_x86_ops.hwapic_isr_update() - KVM: SVM: Set RFLAGS.IF=1 in C code, to get VMRUN out of the STI shadow - smb: client: don't wait for info->send_pending == 0 on error - smb: client: let send_done() cleanup before calling smbd_disconnect_rdma_connection() - ACPI: processor: perflib: Move problematic pr->performance check - ACPI: processor: perflib: Fix initial _PPC limit application - Documentation: ACPI: Fix parent device references - fs: Prevent file descriptor table allocations exceeding INT_MAX - sunvdc: Balance device refcount in vdc_port_mpgroup_check - PCI: Extend isolated function probing to LoongArch - NFSD: detect mismatch of file handle and delegation stateid in OPEN op - net: dpaa: fix device leak when querying time stamp info - net: ti: icss-iep: fix device and OF node leaks at probe - net: mtk_eth_soc: fix device leak at probe - net: enetc: fix device and OF node leak at probe - net: gianfar: fix device leak when querying time stamp info - net: phy: micrel: fix KSZ8081/KSZ8091 cable test - gpio: mlxbf3: use platform_get_irq_optional() - gpio: mlxbf2: use platform_get_irq_optional() - gpio: virtio: Fix config space reading. - ALSA: hda/realtek: Add Framework Laptop 13 (AMD Ryzen AI 300) to quirks - ALSA: hda/realtek: Fix headset mic on HONOR BRB-X - ALSA: usb-audio: Validate UAC3 cluster segment descriptors - rcu: Fix racy re-initialization of irq_work causing hangs - rcu: Fix rcu_read_unlock() deadloop due to IRQ work - drm/tilcdc: Fix removal actions in case of failed probe - drm/tilcdc: request and mapp iomem with devres - urma: fix update topo logic - dmaengine: stm32: dmamux: fix device leak on route allocation - pswiotlb: Adapt to the IOMMU DMA API upgraded by IOMMUFD - null_blk: fix kmemleak by releasing references to fault configfs items - inet: frags: flush pending skbs in fqdir_pre_exit() - inet: frags: add inet_frag_queue_flush() - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() - md/dm-raid: don't clear MD_RECOVERY_FROZEN after setting frozen - md/dm-raid: don't call md_reap_sync_thread() directly - ACPICA: Avoid walking the Namespace if start_node is NULL - arm64: entry: xcall/xint: make asm conditionals compatible with clang IAS - LoongArch: BPF: Sign extend kfunc call arguments - genirq/msi:: Fix kabi break of struct msi_desc - genirq/msi: Store the IOMMU IOVA directly in msi_desc instead of iommu_cookie - NFS: Fix a deadlock involving nfs_release_folio() - Revert "[Huawei] Revert "NFS: fix up nfs_release_folio() to try to release the page"" - urma: added support for ipoverurma - drm/ttm: Avoid NULL pointer deref for evicted BOs - XSched: Update XSched manual - svcrdma: bound check rq_pages index in inline path - ipv6: Fix use-after-free in inet6_addr_del(). - ipv4: ip_gre: make ipgre_header() robust - net: fix memory leak in skb_segment_list for GRO packets - net: sock: fix hardened usercopy panic in sock_recv_errqueue - ipv4: Fix reference count leak when using error routes with nexthop objects - SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf - fbdev: Fix vmalloc out-of-bounds write in fast_imageblit - udp: Deal with race between UDP socket address change and rehash - EDAC/amd64: The width of hash value is 2 bits for Hygon family 18h model 6h processors - x86/tsc: Use topology_max_packages() to get package number - EDAC/amd64: Use unicast instead of broadcast to access the cs_config register - EDAC/amd64: Correct the address translation for hygon family 18h model 4h - KVM: arm64: Mark some header functions as inline - KVM: arm64: Refactor exit handlers - x86/resctrl: Fix memory bandwidth counter width for Hygon CPUs - hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio - !20820 ub/obmm: add sysfs interface for mempool statistics & bugfixes - ub/obmm: fix wrong pxm_numa parameter validation - ub/obmm: Remove unused parameters from obmm_addr_check.c - ub/obmm: Enhance mem_allocator_granu validation - ub/obmm: simplify allocator naming scheme - ub/obmm: fix allow_slow logic and optimize conti_alloc_memory - ub/obmm: add sysfs interface with fine-grained memory statistics - !20804 net: hv_netvsc: reject RSS hash key programming without RX indirection table - !20813 migrate: correct lock ordering for hugetlb file folios - !20812 libceph: make calc_target() set t->paused, not just clear it - !20719 drivers/ub/sentry: some bugfix - !20798 urma: log should not retrieve eid_idx from uctx - !20808 urma: support triple bonding device - urma: log should not retrieve eid_idx from uctx - migrate: correct lock ordering for hugetlb file folios - libceph: make calc_target() set t->paused, not just clear it - !20745 vfio platform VFIO support for hisi05a1 devices - urma: support triple bonding device - net: hv_netvsc: reject RSS hash key programming without RX indirection table - !20789 gic: Add hip09 support for HISILICON_ERRATUM_165010801 - !20726 tracing: Add recursion protection in kernel stack trace recording - !20668 irqchip/gic-v3-its: Avoid truncating memory addresses - !20795 ub: udma: support query and set qos info. - !20791 Migration/urma:optimize performance in live migration. - ub: udma: Support for UE link establishment message. - Migration/urma: optimize performance in live migration. - !20787 ub: cdma: modify the method of assigning values to the structure - !20759 ubcore: hotfix route query for port eid on the same node. - ub: udma: support query and set qos info. - Revert "ub: ubase: Support for RC saved by queue granularity" - ubcore: hotfix route query for port eid on the same node. - !20676 urma: set/get sl - !20765 urma: bugfix of UAF and double free in ubcm - !20778 ub: ubase&unic: Fixes some bugfix in resetting and dfx ability - gic: Add hip09 support for HISILICON_ERRATUM_165010801 - vfio/platform: Add CONFIG_VFIO_HISI05A1 to openeuler_defconfig and turn it on by default - vfio/platform: VFIO support for hisi05a1 devices - ub: cdma: modify the method of assigning values to the structure - urma: set/get sl - ub: ubase: support to query ub dl pkt stats and real-time peak bandwidth - ub: ubase: Support for RC saved by queue granularity - ub: ubase: Traverse mailbox AE events using interrupts and polling. - ub: ubase: Modify ubase ctrlq trace to distinguish between MUE and UE messages - net: unic: The function of dumping himac registers is added. - ub: ubase: Fix MAC is_pfc sync, optimize list ops and code style - ub: ubase: Retain the initial tm qset configuration and restore it - net: unic: Fixed an issue in the bond IP address notification and pause configuration when an exception occurs. - ub: ubase: Add a retransmission function to improve reliability. - net: unic: Increase the readability and reliability of loopback code - net: unic: Synchronize the code modify for ip management and deactivation - net: unic: Increase the readability and reliability of VLAN feature. - net: unic: Added unic DFX log information. - ub: ubase: Add and correct comments for some functions and data structures - net: unic: Notify MAMI when the bond port status changes - ub: ubase: Support for HIMAC reset during ELR reset and Optimize ELR reset - !20768 iommu/ummu-core: Fix separate page table compatibility - !20665 [OLK-6.6] Enhance CMA memory usage reporting for CSV3 - !20764 net: hns3: fix double free issue for tx spare buffer - urma: bugfix of UAF and double free in ubcm - iommu/ummu-core: Fix separate page table compatibility - net: hns3: fix double free issue for tx spare buffer - drivers/ub/sentry: fix memory leak in sentry_msg_helper - drivers/ub/sentry: initialize some variables - drivers/ub/sentry: fix potential buffer overflow in convert_str_to_smh_msg() - drivers/ub/sentry: fix potential null pointer reference in sentry_uvb_comm - drivers/ub/sentry: add input parameter verification for exported symbols - tracing: Add recursion protection in kernel stack trace recording - x86/csv: Enhance CMA memory usage reporting for CSV3 - irqchip/gic-v3-its: Avoid truncating memory addresses - change the package name of 64KB page size kernel to kernel-64k - !20704 kernel support hisi-cca-da - !20180 [virtCCA Live Migration 2]virtcca secure cvm supports live migration - !20905 v2 KVM: arm64: Fix softirq masking in FPSIMD register saving sequence - !20965 iommu/ummu: Optimized TID invalidation and tdev initialization - !20964 iommu/ummu: Support TID and EID Granularity for MPAM - !20970 ub: ubase&unic: Supporting the black box capability of the ubase&unic driver - hisi-cca-da: Start dev by rsi call - hisi-cca-da: Set ripas of the bar region as RIPAS_DEV - hisi-cca-da: Support swiotlb and realm memory use - hisi-cca-da: Add smmu info when dev attach - hisi-cca-da: Transfer realm msix access to rmm - hisi-cca-da: Support pcipc sriov capability - hisi-cca-da: Delay realm memory release to kvm_destroy_realm - hisi-cca-da: Create realm s2 host pgtable and map msi mmio to rmm - hisi-cca-da: Add cca realm s2 pgtable framework - hisi-cca-da: Use bitmap to determine whether the command can be forwarded - hisi-cca-da: Restrict Realm SMMU to stage-2 domain only - hisi-cca-da: Add cmd forward mechanism in realm smmu - hisi-cca-da: Add realm smmu event and gerror irq initialization - hisi-cca-da: Add realm smmu stream table initialization - hisi-cca-da: Add realm smmu cmdq and evtq initialization - hisi-cca-da: Add realm smmu initialization - hisi-cca-da: Add relam iommu support to iommufd - hisi-cca-da: Add realm iommu support for vfio-iommu-type1 - hisi-cca-da: Support dev map and unmap - hisi-cca-da: Support dev validate and dev start - hisi-cca-da: VFIO support ccada - hisi-cca-da: Support dev delegate and dev attach - hisi-cca-da: Support root dev delegate and dev init - hisi-cca-da: Add hisilicon extension smc and ccada cmd - hisi-cca-da: Add hisi ccada feature config - !20751 ARM CCA supports hugepage - !20944 ub: ubmempfd: supports for D2H mapping and demapping - !20888 HiSock Enhancement - ub: ubase&unic: Supporting the black box capability of the ubase&unic driver. - net: unic: Resolve the residual MAC address problem - net: unic: Optimized the code for the cmd structure and FEC function. - ub: ubase: add log for post mailbox timeout - ub: ubus: Remove black box header file to include dir - rme: Remove the secret bit of the vring desc addr - rme: improve hisi-cca data mmap and destroy method - !20943 uvb: fix wd_obtain logic err - !20942 urma: fix bond device id not release - !20892 dcache: Limit the minimal number of bucket to two - rme: isolate page when do delegation to avoid migration - rme: hisi-cca supports different levels for mapping ram - rme: rename ccal to hisi-cca - rme: support set ripas for ccal realm vm - rme: support destroy ram data for ccal realm vm - rme: support populate region for ccal realm vm - rme: support map ram for ccal realm vm - rme: support config ccal realm vm - rme: support ccal RMI calls - rme: realm vm supports wfx handler - !20952 urma: introduce ipourma module - iommu/ummu-core: Simplifies tdev initialization resources - iommu/ummu: Optimized log printing - iommu/ummu: Use passed gfp_mask in map_pages callback - uvb: fix wd_obtain logic err - !20949 ub: udma: support user ctl function. - urma: fix bond device id not release - !20901 drivers/ub/sentry: some bugfix - ub: ubmempfd: supports for D2H mapping and demapping - ub: ubmempfd: supports providing services to the QEMU process through file nodes - [virtCCA Live Migration 2]virtcca secure cvm supports live migration - urma: query priority and enable bit, support ring size configuration - urma: implement debugfs, improve boundary checks and error handling logic - urma: implement data plane interaction and statistics - urma: implement ipourma network device operations - urma: ipourma resource management - urma: ipourma resource management and err code - urma: introduce ipourma main module - iommu/ummu: Optimized the TID invalidation configuration - iommu/ummu: Optimized SVA permission table memory allocation approach - iommu/ummu: Adapt UMMU SVA interface adjustment - iommu/ummu: Support TID and EID Granularity for MPAM - !20848 [OLK-6.6] backport important bugfix for nvme driver from upstream linux-6.6.y - !20847 urma: sl resource query error - !20908 [OLK-6.6][linux-6.6.y sync] Backport 6.6.108-6.6.110 LTS Patches - !20084 Loongarch: Enable CONFIG_CRYPTO_XTS for disk encryption - !20929 PCI: Fix NVMe link speed downgrade to 2.5GT/s during hotplug - drivers/ub/sentry: fix check input parameters - ub: udma: support user ctl function. - ub: udma: support uboe function. - ub: udma: bugfix related to query aux info. - !20935 ub: ubmem_vmmu: supports IOMMU driver for the UB memory MMU in VMs - drivers/ub/sentry: do not use magic numbers - !20876 urma: Kernel-mode specific implementations file for Jetty extension interface - urma: sl resource query error - !20873 sunrpc: fix NULL pointer dereference in rpcb_register_inet6 and rpcb_register_inet4 - !20875 sunrpc: fix race in cache cleanup causing stale nextcheck time - ub: ubmem_vmmu: supports IOMMU driver for the UB memory MMU in VMs - ub: ubmem_vmmu: supports parsing and configuring the hardware node information - ub: ubmem_vmmu: HiSilicon ubmem_vmmu Architecture Implementation - !20806 Fix CVE-2025-71225 - !20896 scsi: qla2xxx: Free sp in error path to fix system crash - !20894 scsi: qla2xxx: Delay module unload while fabric scan in progress - !20893 scsi: qla2xxx: Validate sp before freeing associated memory - !20802 Fix CVE-2026-23110 - urma: Kernel-mode specific implementations file for Jetty extension interface - drivers/ub/sentry: fix memory leak in process_urma_data() - drivers/ub/sentry: initialize some variables - PCI: Fix NVMe link speed downgrade to 2.5GT/s during hotplug - !20770 ub: ubdevshm: supports the memory user to obtain and release shared memory - Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 - mm: consider non-anon swap cache folios in folio_expected_ref_count() - mm: simplify folio_expected_ref_count() - ASoC: qcom: audioreach: fix potential null pointer dereference - gcc-plugins: Remove TODO_verify_il for GCC >= 16 - crypto: sha256 - fix crash at kexec - drm/i915/backlight: Return immediately when scale() finds invalid parameters - minmax.h: remove some #defines that are only expanded once - minmax.h: simplify the variants of clamp() - minmax.h: move all the clamp() definitions after the min/max() ones - minmax.h: use BUILD_BUG_ON_MSG() for the lo < hi test in clamp() - minmax.h: reduce the #define expansion of min(), max() and clamp() - minmax.h: update some comments - minmax.h: add whitespace around operators and after commas - minmax: fix up min3() and max3() too - minmax: improve macro expansion and type checking - minmax: don't use max() in situations that want a C constant expression - minmax: simplify min()/max()/clamp() implementation - minmax: make generic MIN() and MAX() macros available everywhere - drm/ast: Use msleep instead of mdelay for edid read - gpiolib: Extend software-node support to support secondary software-nodes - ARM: bcm: Select ARM_GIC_V3 for ARCH_BRCMSTB - s390/cpum_cf: Fix uninitialized warning after backport of ce971233242b - kmsan: fix out-of-bounds access to shadow memory - afs: Fix potential null pointer dereference in afs_put_server - ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address - i40e: improve VF MAC filters accounting - i40e: add mask to apply valid bits for itr_idx - HID: asus: add support for missing PX series fn keys - drm/gma500: Fix null dereference in hdmi teardown - octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() - net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port - net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() - net: dsa: lantiq_gswip: do also enable or disable cpu port - selftests: fib_nexthops: Fix creation of non-FDB nexthops - net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS - bnxt_en: correct offset handling for IPv6 destination address - vhost: Take a reference on the task in struct vhost_task. - Bluetooth: hci_sync: Fix hci_resume_advertising_sync - ethernet: rvu-af: Remove slash from the driver name - can: peak_usb: fix shift-out-of-bounds issue - can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow - can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow - can: hi311x: populate ndo_change_mtu() to prevent buffer overflow - can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow - bpf: Reject bpf_timer for PREEMPT_RT - can: rcar_can: rcar_can_resume(): fix s2ram with PSCI - wifi: virt_wifi: Fix page fault on connect - cpufreq: Initialize cpufreq-based invariance before subsys - ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients - arm64: dts: imx8mp: Correct thermal sensor index - mm: folio_may_be_lru_cached() unless folio_test_large() - mm/gup: local lru_add_drain() to avoid lru_add_drain_all() - mm/gup: check ref_count instead of lru before migration - mm: add folio_expected_ref_count() for reference count calculation - mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked" - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions - ALSA: usb-audio: Add mute TLV for playback volumes on more devices - ALSA: usb-audio: move mixer_quirks' min_mute into common quirk - ALSA: usb-audio: Add DSD support for Comtrue USB Audio device - i2c: designware: Add quirk for Intel Xe - mmc: sdhci-cadence: add Mobileye eyeQ support - usb: core: Add 0x prefix to quirks debug output - ALSA: usb-audio: Fix build with CONFIG_INPUT=n - ALSA: usb-audio: Convert comma to semicolon - ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 - ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks - ALSA: usb-audio: Simplify NULL comparison in mixer_quirks - ALSA: usb-audio: Avoid multiple assignments in mixer_quirks - ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks - ALSA: usb-audio: Fix block comments in mixer_quirks - firewire: core: fix overlooked update of subsystem ABI version - scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE - !20843 [OLK-6.6][linux-6.6.y sync] Backport 6.6.107-6.6.108 LTS Patches - !20869 ub:hisi-ubus: fix bug of security smatch - !20861 CVE-2026-23163 - ub: ubdevshm: supports the memory user to obtain and release shared memory - ub: ubdevshm: supports granting and revoking shared memory permissions - ub: ubdevshm: supports the registration and deregistration of shared memory segments - ub: ubdevshm: supports the registration and deregistration - KVM: arm64: Fix softirq masking in FPSIMD register saving sequence - !20886 Fix CVE-2026-23205 - !20803 Fix CVE-2026-23112 - !20868 sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure - !20811 smb/server: fix refcount leak in smb2_open() - !20810 smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() - !20809 smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() - sunrpc: fix NULL pointer dereference in rpcb_register_inet6 and rpcb_register_inet4 - sunrpc: fix race in cache cleanup causing stale nextcheck time - scsi: qla2xxx: Free sp in error path to fix system crash - scsi: qla2xxx: Delay module unload while fabric scan in progress - scsi: qla2xxx: Validate sp before freeing associated memory - dcache: Limit the minimal number of bucket to two - !20872 Fix CVE-2026-23220 - !20846 Fix CVE-2026-23193 - !20815 Fix CVE-2026-23216 - !20859 Fix CVE-2026-23179 - !20871 CVE-2026-23096 - !20858 ub: ubase: resolve the cmdq crq overflow problem - bpf: Deprecate hisock unused kfuncs and orig ingress logic - bpf: Add local connect support for hisock - bpf: Add ipv4-mapped ipv6 addr support for hisock - bpf: Add target comm parse to hisock_cmd - bpf: Add multi port parse to hisock_cmd - bpf: Only deploy hisock in server - bpf: Apply BPF_HISOCK_INGRESS to hisock ingress - bpf: Add bpf_handle_ingress/egress_ptype kfunc - bpf: Add bpf_get_skb_ethhdr kfunc - bpf: Add bpf_set_ingress/egress_dev kfunc - bpf: Add bpf_set_ingress_dst kfunc - bpf: Add BPF_HISOCK_INGRESS attach type - cgroup: make cgroup_bpf_prog_attach work when cgroup2 is not mounted - smb: client: fix potential UAF and double free in smb2_open_file() - smb/client: fix memory leak in smb2_open_file() - !20852 ASoC: amd: fix memory leak in acp3x pdm dma ops - ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths - uacce: fix cdev handling in the cleanup path - Revert "uacce: fix for cdev memory leak" - ub:hisi-ubus: fix bug of security smatch - ub:ubus: injected route event - ub:ubus: Black Box Development - !20865 urma: urma support uboe - sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure - urma: urma support uboe - !20857 ub_fwctl driver adds support for querying some functions - ub:ub_fwctl:Add illegal verification for scc - ub:ub_fwctl:Support querying the historical status of port links - drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove - drm/amdkfd: Don't use sw fault filter if retry cam enabled - ub:ub_fwctl:Support querying firmware version numbers - ub: ub_fwctl: Support querying real-time bandwidth statistics - ub:ub_fwctl:Support querying statistical indicators at the ub port and uboe port levels - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() - !20854 [URMA] add ping server for urma_ping - urma: add ping server - ub: ubase: resolve the cmdq crq overflow problem - ub: ubase: Optimized the QoS code naming to improve code readability. - ub: ubase&unic: optimizing code and configuration settings. - net: unic: not support query and configure ip by control plane in UBoE - net: unic: fix the automatically enable uc guid promisc mode. - !20844 urma:kernel header of userctl - urma: Kernel-mode header file for Jetty extension interface - ASoC: amd: fix memory leak in acp3x pdm dma ops - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() - phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again) - ACPICA: Work around bogus -Wstringop-overread warning since GCC 11 - !20835 Fix CVE-2026-23084 - minmax: add a few more MIN_T/MAX_T users - minmax: simplify and clarify min_t()/max_t() implementation - minmax: avoid overly complicated constant expressions in VM code - rtc: pcf2127: fix SPI command byte for PCF2131 backport - xhci: dbc: Fix full DbC transfer ring after several reconnects - xhci: dbc: decouple endpoint allocation from initialization - phy: ti: omap-usb2: fix device leak at unbind - phy: Use device_get_match_data() - drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path - ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message - ASoC: wm8974: Correct PLL rate rounding - ASoC: wm8940: Correct typo in control name - ASoC: wm8940: Correct PLL rate rounding - io_uring: include dying ring in task_work "should cancel" state - io_uring: backport io_should_terminate_tw() - ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx - selftests: mptcp: avoid spurious errors on TCP disconnect - selftests: mptcp: connect: catch IO errors on listen side - rds: ib: Increment i_fastreg_wrs before bailing out - KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active - mmc: mvsdio: Fix dma_unmap_sg() nents value - ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S - ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface - btrfs: tree-checker: fix the incorrect inode ref size check - iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page() - LoongArch: Check the return value when creating kobj - LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled - LoongArch: Update help info of ARCH_STRICT_ALIGN - nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* - octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() - net: liquidio: fix overflow in octeon_init_instr_queue() - bonding: don't set oif to bond dev when getting NS target destination - net/mlx5e: Consider aggregated port speed during rate configuration - i40e: remove redundant memory barrier when cleaning Tx descs - net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure - selftests: mptcp: sockopt: fix error messages - mptcp: tfo: record 'deny join id0' info - mptcp: set remote_deny_join_id0 on SYN recv - dpaa2-switch: fix buffer pool seeding for control traffic - btrfs: fix invalid extref key setup when replaying dentry - pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch - wifi: mac80211: fix incorrect type for ret - wifi: mac80211: increase scan_ies_len for S1G - ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported - !20769 [OLK-6.6][linux-6.6.y sync] Backport 6.6.106-6.6.107 LTS Patches - be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list - !20776 ub:ubfi: Release the chosen node - !20817 CVE-2026-23094 - !20819 dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() - ub:ubus: Add port num check - !20379 [OLK-6.6][sync from OLK-5.10]io_uring: Support forcing sq thread to be idle and woken up by hrtimer - !20830 sched/soft_domain: Increasing NR_MAX_CLUSTER to 32 - sched/soft_domain: Increasing NR_MAX_CLUSTER to 32 - btrfs: fix incorrect readahead expansion length - x86: disable image size check for test builds - drm/i915/power: fix size for for_each_set_bit() in abox iteration - drm/amdgpu: fix a memory leak in fence cleanup when unloading - net: mdiobus: release reset_gpio in mdiobus_unregister_device() - phy: ti-pipe3: fix device leak at unbind - phy: tegra: xusb: fix device and OF node leak at probe - dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate - usb: gadget: midi2: Fix MIDI2 IN EP max packet size - usb: gadget: midi2: Fix missing UMP group attributes initialization - USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels - RISC-V: Remove unnecessary include from compat.h - hrtimer: Rename __hrtimer_hres_active() to hrtimer_hres_active() - hrtimer: Remove unused function - regulator: sy7636a: fix lifecycle of power good gpio - dmaengine: ti: edma: Fix memory allocation size for queue_priority_map - hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr - hsr: use rtnl lock when iterating over ports - net: hsr: Add VLAN CTAG filter support - net: hsr: Add support for MC filtering at the slave device - can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB - can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails - can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed - igb: fix link test skipping when interface is admin down - docs: networking: can: change bcm_msg_head frames member to support flexible array - tunnels: reset the GSO metadata before reusing the skb - net: bridge: Bounce invalid boolopts - net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() - USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions - USB: serial: option: add Telit Cinterion FN990A w/audio compositions - dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks - serial: sc16is7xx: fix bug in flow control levels init - tty: hvc_console: Call hvc_kick in hvc_write unconditionally - Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups" - Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table - Input: iqs7222 - avoid enabling unused interrupts - mm/khugepaged: fix the address passed to notifier on testing young - btrfs: fix corruption reading compressed range when block size is smaller than page size - btrfs: use readahead_expand() on compressed extents - mm/damon/sysfs: fix use-after-free in state_show() - mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing - mtd: nand: raw: atmel: Fix comment in timings preparation - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages - drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time - mm/damon/core: set quota->charged_from to jiffies at first charge window - fuse: prevent overflow in copy_file_range return value - fuse: check if copy_file_range() returns larger than requested size - mtd: rawnand: stm32_fmc2: fix ECC overwrite - mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer - net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups - i2c: i801: Hide Intel Birch Stream SoC TCO WDT - ocfs2: fix recursive semaphore deadlock in fiemap call - mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN - compiler-clang.h: define __SANITIZE_*__ macros only when undefined - EDAC/altera: Delete an inappropriate dma_free_coherent() call - rcu-tasks: Maintain real-time response in rcu_tasks_postscan() - rcu-tasks: Eliminate deadlocks involving do_exit() and RCU tasks - rcu-tasks: Maintain lists to eliminate RCU-tasks/do_exit() deadlocks - s390/cpum_cf: Deny all sampling events by counter PMU - NFSv4/flexfiles: Fix layout merge mirror check. - NFSv4.2: Serialise O_DIRECT i/o and copy range - NFSv4.2: Serialise O_DIRECT i/o and clone range - NFSv4.2: Serialise O_DIRECT i/o and fallocate() - NFS: Serialise O_DIRECT i/o and truncate() - fs/nfs/io: make nfs_start_io_*() killable - ftrace/samples: Fix function size computation - NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server - NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set - media: i2c: imx214: Fix link frequency validation - NFSD: nfsd_unlink() clobbers non-zero status returned from fh_fill_pre_attrs() - nfsd: Fix a regression in nfsd_setattr() - kasan: fix GCC mem-intrinsic prefix with sw tags - kunit: kasan_test: disable fortify string checker on kasan_strings() test - io_uring: fix kabi broken in struct io_ring_ctx - io_uring: Support forcing sq thread to be idle and woken up by hrtimer - dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() - uacce: fix isolate sysfs check condition - Revert "uacce: fix isolate sysfs check condition" - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() - smb/server: fix refcount leak in smb2_open() - smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() - smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() - md: suspend array while updating raid_disks via sysfs - scsi: core: Wake up the error handler when final completions race against each other - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec - ub:ubfi: Release the chosen node - ub:ubus: Delete unused functions - Loongarch: Enable CONFIG_CRYPTO_XTS for disk encryption - Add sw64 support in kernel.spec - !21194 hisi-cca-da: Revert smmu realm enabled condition for arm_smmu_domain_finalise. - !21192 urma: bugfix of ubagg&ubcore&uburma - !21183 platform/x86: classmate-laptop: Add missing NULL pointer checks - urma: bugfix of ubagg&ubcore&uburma - hisi-cca-da: Revert smmu realm enabled condition for arm_smmu_domain_finalise. - platform/x86: classmate-laptop: Add missing NULL pointer checks - !21167 urma: fix kernel codecheck issues. - !21174 urma: change return value for provider err - !21127 urma: copy linked ports when importing bond jetty/seg - !20247 ubcore: query primary eid in ipourma loopback mode. - !21077 Fix hisi cca bugs - ubcore: route query refine and ipo loopback adapt. - hisi-cca-da: Transfer PCIe ECAM access requests to RMM for realm device. - hisi-cca-da: Write NS STE for PF drivers. - hisi-cca-da: Provide IO interfaces - hisi-cca-da: Destroy mmu stage2 pagetable after closing vfio devices - !21045 scsi: hisi_sas: Fix NULL pointer exception when do user_scan() - hisi-cca-da: Automatically unbind PF/VF drivers and prevent probe. - !21165 tools/interference: add ifstool utility for kernel interference statistics - !21166 urma: fix jfce uaf in batch cleanup - !21043 urma: fix tjetty ref in ping server - urma: change return value for provider err - !21128 sched/rt: Skip currently executing CPU in rto_next_cpu() - !21129 procfs: fix missing RCU protection when reading real_parent in do_task_stat() - urma: fix jfce uaf in batch cleanup - !21074 ipmi: Add HiSilicon IPMI Page Soft Offline driver - !21076 [OLK-6.6][linux-6.6.y sync] Backport 6.6.112-6.6.113 LTS Patches - urma: fix kernel codecheck issues. - tools/interference: add ifstool utility for kernel interference statistics - !20291 [Hygon][6.6][Bugfix] Bug fix for EDAC decode address fail issue on Hygon Dhyana processor - !21092 kexec: derive purgatory entry from symbol - !21154 sched: Add SOFT_DOMAIN feature interface for cgroup2 - !21153 fix CVE-2025-39981 - Revert "hisi-cca-da: Delay realm memory release to kvm_destroy_realm" - urma: fix tjetty ref in ping server - rme: Enforce isolation to solve compile error without config CONFIG_HISI_CCA - hisi-cca-da: Improve hisi cca dev validate and delegate - hisi-cca-da: Fix smmu enable rme problem - hisi-cca-da: Fix msi region shared problem - sched: Add SOFT_DOMAIN feature interface for cgroup2 - Bluetooth: MGMT: Fix memory leak in set_ssp_complete - Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete - overflow: Introduce __DEFINE_FLEX for having no initializer - overflow: Fix direct struct member initialization in _DEFINE_FLEX() - overflow: Change DEFINE_FLEX to take __counted_by member - overflow: add DEFINE_FLEX() for on-stack allocs - Bluetooth: MGMT: Fix possible UAFs - Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete() - !21103 Revert "mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()" - !21104 v2 vsock/virtio: cap TX credit to local buffer size - !21070 Fixes CVE-2026-23100 - !21135 RDMA/hns: Support configure and query the CNP DSCP through sysfs - !21088 ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref - RDMA/hns: Support configure and query the CNP DSCP through sysfs - RDMA/hns: Support query FW cap bit - RDMA/hns: Support query HW ID. - !20934 smb/server: fix refcount leak in parse_durable_handle_context() - !21004 regmap: Fix race condition in hwspinlock irqsave routine - !19568 [OLK-6.6]fix txgbe clang compile warning - urma: copy linked ports when importing bond jetty/seg - procfs: fix missing RCU protection when reading real_parent in do_task_stat() - sched/rt: Skip currently executing CPU in rto_next_cpu() - !21073 scsi: qla2xxx: Fix bsg_done() causing double free - !21114 CVE-2024-57979 - !21113 iommu: disable SVA when CONFIG_X86 is set - !20957 dmaengine: xilinx: xdma: Fix regmap max_register - !21087 net: unic: Multiple stability fixes for tx timeout, DFX capability and concurrent activation/reset - pps: Fix a use-after-free - fix kabi - pps: Fix a use-after-free - !21078 of: unittest: Fix memory leak in unittest_data_add() - !21079 *** fix CVE-2026-23208 *** - !21082 ALSA: aloop: Fix racy access at PCM trigger - !21083 bus: fsl-mc: fix use-after-free in driver_override_show() - iommu: disable SVA when CONFIG_X86 is set - vsock/virtio: cap TX credit to local buffer size - Revert "mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()" - !20983 Fix CVE-2026-23139 - !20878 Fix CVE-2026-23230 - kexec: derive purgatory entry from symbol - lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC - PCI/IOV: Fix race between SR-IOV enable/disable and hotplug - Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" - rtc: interface: Alarm race handling should not discard preceding error - perf test stat tests: Fix for virtualized machines - perf test stat: Update test expectations and events - perf test stat: Avoid hybrid assumption when virtualized - writeback: Avoid excessively long inode switching times - writeback: Avoid softlockup when switching many inodes - cramfs: Verify inode mode when loading from disk - fs: Add 'initramfs_options' to set initramfs mount options - minixfs: Verify inode mode when loading from disk - irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume - irqchip/sifive-plic: Make use of __assign_bit() - selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled - s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG - s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL - s390/bpf: Describe the frame using a struct instead of constants - s390/bpf: Centralize frame offset calculations - s390/bpf: Change seen_reg to a mask - ACPI: property: Do not pass NULL handles to acpi_attach_data() - ACPI: property: Add code comments explaining what is going on - ACPI: property: Disregard references in data-only subnode lists - ACPI: battery: Add synchronization between interface updates - ACPI: battery: Check for error code from devm_mutex_init() call - ACPI: battery: initialize mutexes through devm_ APIs - ACPI: battery: allocate driver data through devm_ APIs - arm64: mte: Do not flag the zero page as PG_mte_tagged - ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref - !20790 dm: use bio_clone_blkg_association - ipmi: Add HiSilicon IPMI Page Soft Offline driver - net: unic: Resolve network unavailability caused by concurrent activation and reset - net: unic: Provide the DFX capability for querying MNG table - net: unic: Delete the elr reset process after the tx timeout - bus: fsl-mc: fix use-after-free in driver_override_show() - ALSA: aloop: Fix racy access at PCM trigger - ALSA: usb-audio: Use the right limit for PCM OOB check - ALSA: usb-audio: Prevent excessive number of frames - of: unittest: Fix memory leak in unittest_data_add() - !21034 CVE-2026-23140 - !21016 net: fix segmentation of forwarding fraglist GRO - !21017 mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() - !21018 CVE-2026-23209 - !21019 ipv6: annotate data-race in ndisc_router_discovery() - !20881 ipvlan: Make the addrs_lock be per port - rme: Imporve range delegate - btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() - PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release - PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() - misc: fastrpc: Save actual DMA size in fastrpc_map structure - misc: fastrpc: Add missing dev_err newlines - mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag - mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type - mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value - media: mc: Clear minor number before put device - lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older - ACPICA: Allow to skip Global Lock initialization - ext4: validate ea_ino and size in check_xattrs - ext4: correctly handle queries for metadata mappings - ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() - nfsd: nfserr_jukebox in nlm_fopen should lead to a retry - NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() - mm/damon/vaddr: do not repeat pte_offset_map_lock() until success - mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 - mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations - wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 - wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again - selftests: mptcp: join: validate C-flag + def limit - spi: cadence-quadspi: Flush posted register writes before DAC access - spi: cadence-quadspi: Flush posted register writes before INDAC access - PCI: tegra194: Handle errors in BPMP response - PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() - PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock - PCI: rcar-host: Drop PMSR spinlock - PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit - PCI/AER: Support errors introduced by PCIe r6.0 - PCI/AER: Fix missing uevent on recovery when a reset is requested - PCI/ERR: Fix uevent on failure to recover - PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV - PCI/sysfs: Ensure devices are powered for config reads - PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock - rseq/selftests: Use weak symbol reference, not definition, to link with glibc - rtc: interface: Fix long-standing race when setting alarm - rtc: interface: Ensure alarm irq is enabled when UIE is enabled - memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe - mmc: core: SPI mode remove cmd7 - mtd: rawnand: fsmc: Default to autodetect buswidth - xtensa: simdisk: add input size check in proc_write_simdisk - sparc: fix error handling in scan_one_device() - sparc64: fix hugetlb for sun4u - scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() - sched/deadline: Fix race in push_dl_task() - pwm: berlin: Fix wrong register in suspend/resume - powerpc/pseries/msi: Fix potential underflow and leak issue - powerpc/powernv/pci: Fix underflow and leak issue - power: supply: max77976_charger: fix constant current reporting - pinctrl: samsung: Drop unused S3C24xx driver data - nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk - parisc: don't reference obsolete termio struct for TC* constants - openat2: don't trigger automounts with RESOLVE_NO_XDEV - of: unittest: Fix device reference count leak in of_unittest_pci_node_verify - lib/genalloc: fix device leak in of_gen_pool_get() - KEYS: trusted_tpm1: Compare HMAC values in constant time - iommu/vt-d: PRS isn't usable if PDS isn't supported - iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume - init: handle bootloader identifier in kernel parameters - iio: xilinx-ams: Unmask interrupts after updating alarms - iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK - iio: frequency: adf4350: Fix prescaler usage. - iio: dac: ad5421: use int type to store negative error codes - iio: dac: ad5360: use int type to store negative error codes - fs/ntfs3: Fix a resource leak bug in wnd_extend() - fbdev: Fix logic error in "offb" name match - crypto: rockchip - Fix dma_unmap_sg() nents value - crypto: atmel - Fix dma_unmap_sg() direction - crypto: aspeed - Fix dma_unmap_sg() direction - copy_sighand: Handle architectures where sizeof(unsigned long) < sizeof(u64) - bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() - bus: mhi: ep: Fix chained transfer handling in read path - btrfs: avoid potential out-of-bounds in btrfs_encode_fh() - blk-crypto: fix missing blktrace bio split events - drm/nouveau: fix bad ret code in nouveau_bo_move_prep - drm/rcar-du: dsi: Fix 1/2/3 lane support - media: lirc: Fix error handling in lirc_register() - media: venus: firmware: Use correct reset sequence for IRIS2 - media: pci: ivtv: Add missing check after DMA map - media: mc: Fix MUST_CONNECT handling for pads with no links - media: i2c: mt9v111: fix incorrect type for ret - media: cx18: Add missing check after DMA map - firmware: meson_sm: fix device leak at probe - xen/events: Update virq_to_irq on migration - xen/events: Return -EEXIST for bound VIRQs - xen/manage: Fix suspend error path - xen/events: Cleanup find_virq() return codes - dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required - ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init - arm64: dts: ti: k3-am62a-main: Fix main padcfg length - arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees - arm64: dts: qcom: msm8939: Add missing MDSS reset - arm64: dts: qcom: msm8916: Add missing MDSS reset - ACPI: debug: fix signedness issues in read/write helpers - ACPI: property: Fix buffer properties extraction for subnodes - gpio: wcd934x: mark the GPIO controller as sleeping - tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single - smb: client: fix missing timestamp updates after utime(2) - bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() - drm/amd/display: Properly disable scaling on DCE6 - drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 - drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs - drm/amdgpu: Add additional DCE6 SCL registers - mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes - mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call - tcp: take care of zero tp->window_clamp in tcp_set_rcvlowat() - perf python: split Clang options when invoking Popen - tools build: Align warning options with perf - net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe - drm/vmwgfx: Fix copy-paste typo in validation - net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() - LoongArch: Init acpi_gbl_use_global_lock to false - LoongArch: Remove CONFIG_ACPI_TABLE_UPGRADE in platform_init() - ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size - scsi: mvsas: Fix use-after-free bugs in mvs_work_queue - clk: tegra: do not overallocate memory for bpmp clocks - clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver - clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() - clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() - clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m - perf evsel: Ensure the fallback message is always written to - perf tools: Add fallback for exclude_guest - perf test: Add a test for default perf stat command - perf test: Don't leak workload gopipe in PERF_RECORD_* - perf session: Fix handling when buffer exceeds 2 GiB - perf arm_spe: Correct memory level for remote access - perf arm_spe: Correct setting remote access - rtc: optee: fix memory leak on driver removal - rtc: x1205: Fix Xicor X1205 vendor prefix - perf util: Fix compression checks returning -1 as bool - clk: at91: peripheral: fix return value - libperf event: Ensure tracing data is multiple of 8 sized - perf evsel: Avoid container_of on a NULL leader - asm-generic/io.h: Skip trace helpers if rwmmio events are disabled - iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE - clocksource/drivers/clps711x: Fix resource leaks in error paths - fscontext: do not consume log entries when returning -EMSGSIZE - fs: always return zero on success from replace_fd() - !21067 [OLK-6.6][linux-6.6.y sync] Backport 6.6.111-6.6.112 LTS Patches - scsi: qla2xxx: Fix bsg_done() causing double free - !21065 Fix CVE-2026-23069 - !21062 v4 Support multi-level cgroup - !20987 Fix CVE-2026-23212 - !20982 Fix CVE-2026-23119 - !20979 Fix CVE-2026-23111 - !20974 Fix CVE-2026-23099 - !20973 Fix CVE-2026-23105 - !20972 Fix CVE-2026-23074 - !20884 ksmbd: add chann_lock to protect ksmbd_chann_list xarray - !20947 Fix CVE-2026-23101 - ext4: clear i_state_flags when alloc inode - misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup - Revert "wifi: ath10k: avoid unnecessary wait for service ready message" - fs/ntfs3: fix mount failure for sparse runs in run_unpack() - !20825 efivarfs: fix error propagation in efivar_entry_get() - !20824 io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop - !20950 ub:ubus: protect iterator ue_list and mue_list with ub_bus_sem - mm/rmap: fix two comments related to huge_pmd_unshare() - mm/hugetlb: fix two comments related to huge_pmd_unshare() - mm/hugetlb: fix hugetlb_pmd_shared() - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count - !20728 drivers: Update vendor name of Chengdu NorthLink Technology N5/N6 Series Network Card Drivers - vsock/virtio: fix potential underflow in virtio_transport_get_credit() - !21001 Fix CVE-2026-23229 - usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call - arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode - !20999 Fix CVE-2026-23173 - usb: typec: tipd: Clear interrupts first - bus: fsl-mc: Check return value of platform_get_resource() - remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() - Input: atmel_mxt_ts - allow reset GPIO to sleep - misc: fastrpc: Skip reference for DMA handles - misc: fastrpc: fix possible map leak in fastrpc_put_args - misc: fastrpc: Fix fastrpc_map_lookup operation - nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() - ext4: fix checks for orphan inodes - ksmbd: fix error code overwriting in smb2_get_info_filesystem() - LoongArch: Automatically disable kaslr if boot from kexec_file - mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() - mfd: rz-mtu3: Fix MTU5 NFCR register offset - ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down - ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() - vhost: vringh: Modify the return value check - net/mlx5: fw reset, add reset timeout work - net/mlx5: pagealloc: Fix reclaim race during command interface teardown - net/mlx5: Stop polling for command response if interface goes down - net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable - nfp: fix RSS hash key size when RSS is not supported - mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands - drivers/base/node: fix double free in register_one_node() - hwrng: ks-sa - fix division by zero in ks_sa_rng_init - KEYS: X.509: Fix Basic Constraints CA flag parsing - Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements - Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO - vhost: vringh: Fix copy_to_iter return value check - RDMA/siw: Always report immediate post SQ errors - usb: vhci-hcd: Prevent suspending virtually attached devices - NFSv4.1: fix backchannel max_resp_sz verification check - coresight: trbe: Return NULL pointer for allocation failures - coresight: etm4x: Support atclk - coresight-etm4x: Conditionally access register TRCEXTINSELR - remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice - PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() - vfio/pds: replace bitmap_free with vfree - sparc: fix accurate exception reporting in copy_{from,to}_user for M7 - sparc: fix accurate exception reporting in copy_to_user for Niagara 4 - sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara - sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III - wifi: mac80211: fix Rx packet handling when pubsta information is not available - wifi: ath10k: avoid unnecessary wait for service ready message - Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram - IB/sa: Fix sa_local_svc_timeout_ms read race - RDMA/core: Resolve MAC of next-hop device without ARP support - f2fs: fix zero-sized extent for precache extents - scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() - scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() - scsi: qla2xxx: edif: Fix incorrect sign of error code - ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message - f2fs: fix to truncate first page in error path of f2fs_truncate() - f2fs: fix to update map->m_next_extent correctly in f2fs_map_blocks() - wifi: mt76: fix potential memory leak in mt76_wmac_probe() - RDMA/cm: Rate limit destroy CM ID timeout error message - drivers/base/node: handle error properly in register_one_node() - watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog - ipvs: Use READ_ONCE/WRITE_ONCE for ipvs->enable - iio: consumers: Fix offset handling in iio_convert_raw_to_processed() - iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() - fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist - fs: ntfs3: Fix integer overflow in run_unpack() - drm/msm/dpu: fix incorrect type for ret - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping - ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping - misc: genwqe: Fix incorrect cmd field being reported in error - usb: gadget: configfs: Correctly set use_os_string at bind - usb: phy: twl6030: Fix incorrect type for ret - drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() - tcp: fix __tcp_close() to only send RST when required - PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation - wifi: mwifiex: send world regulatory domain to driver - drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) - drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) - drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) - drm/amd/pm: Adjust si_upload_smc_data register programming (v3) - drm/amd/pm: Fix si_upload_smc_data (v3) - drm/amd/pm: Disable ULV even if unsupported (v3) - drm/amdgpu: Power up UVD 3 for FW validation (v2) - coresight: Only register perf symlink for sinks with alloc_buffer - inet: ping: check sock_net() in ping_get_port() and ping_lookup() - media: st-delta: avoid excessive stack usage - ALSA: lx_core: use int type to store negative error codes - media: rj54n1cb0c: Fix memleak in rj54n1_probe() - scsi: myrs: Fix dma_alloc_coherent() error check - hwrng: nomadik - add ARM_AMBA dependency - crypto: keembay - Add missing check after sg_nents_for_len() - drm/amd/display: Remove redundant semicolons - serial: max310x: Add error checking in probe() - usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls - usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup - phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 - media: zoran: Remove zoran_fh structure - drm/bridge: it6505: select REGMAP_I2C - f2fs: fix condition in __allow_reserved_blocks() - drm/radeon/r600_cs: clean up of dead code in r600_cs - drm/panel: novatek-nt35560: Fix invalid return value - bpf: Enforce expected_attach_type for tailcall compatibility - i2c: designware: Add disabling clocks when probe fails - i2c: designware: Fix clock issue when PM is disabled - i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD - thermal/drivers/qcom/lmh: Add missing IRQ includes - thermal/drivers/qcom: Make LMH select QCOM_SCM - hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems - once: fix race by moving DO_ONCE to separate section - smp: Fix up and expand the smp_call_function_many() kerneldoc - selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported - i3c: master: svc: Recycle unused IBI slot - i3c: master: svc: Use manual response for IBI events - ACPICA: Fix largest possible resource descriptor index - pwm: tiehrpwm: Fix corner case in clock divisor calculation - arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible - arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value - arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names - cpuidle: qcom-spm: fix device and OF node leaks at probe - firmware: firmware: meson-sm: fix compile-test default - arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 - null_blk: Fix the description of the cache_size module argument - pinctrl: renesas: Use int type to store negative error codes - power: supply: cw2015: Fix a alignment coding style issue - PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() - ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property - ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS - ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax - block: use int to store blk_stack_limits() return value - selftests/nolibc: fix EXPECT_NZ macro - regulator: scmi: Use int type to store negative error codes - arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map - ARM: at91: pm: fix MCKx restore routine - pinctrl: meson-gxl: add missing i2c_d pinmux - soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS - leds: flash: leds-qcom-flash: Update torch current clamp setting - ARM: dts: renesas: porter: Fix CAN pin group - libbpf: Fix reuse of DEVMAP - bpf: Remove migrate_disable in kprobe_multi_link_prog_run - bpf/selftests: Fix test_tcpnotify_user - regmap: Remove superfluous check for !config in __regmap_init() - arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 - x86/vdso: Fix output operand size of RDPID - smb: server: fix IRD/ORD negotiation with the client - coresight: trbe: Prevent overflow in PERF_IDX2OFF() - gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote - selftests: arm64: Check fread return value in exec_target - seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast - init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD - filelock: add FL_RECLAIM to show_fl_flags() macro - !21022 KVM: Don't clobber irqfd routing type when deassigning irqfd - !20998 ceph: fix oops due to invalid pointer for kfree() in parse_longname() - !21023 l2tp: avoid one data-race in l2tp_tunnel_del_work() - xsched: fix potential NULL dereference in xsched_quota_timeout_update - xsched: remove the standalone xcu_cfs_cg_deinit() helper - xsched: restructure xcu_cgrp_subsys teardown to align with cpu_cgrp_subsys lifecycle - xsched: simplify root group check by direct comparison with root_xcg - xsched: replace magic number with SCHED_CLASS_MAX_LENGTH for scheduler class string length - xsched/core: immediate cleanup of remaining operators on task exit - xsched: add init_fair_xsched_group() for XCU-specific fair group initialization - xsched: modify xcu_cg_initialize_components helper - xsched: refactor xsched_entity initialization - xsched: change rq_init() parameter from struct xsched_cu to struct xsched_rq - xsched: harden and clarify xcu_move_task() logic - xsched: move throttling-related fields from xsched_group_xcu_priv to xsched_rq_cfs - xsched/quota: add throttled flag to cfs_rq for robust hierarchical enqueue under throttling - xsched/quota: support multi-level cgroup - xsched: remove redundant xcu parameter from dequeue_ctx - xsched: update group shares using xcu_grp_shares_add/sub helpers - xsched: delete unused code - xsched/cfs: propagate group activation/deactivation up the hierarchy - xsched/cfs: move xruntime updates to pick/put paths - xsched: add has_running hook to xsched classes for wake-up eligibility check - !21012 [OLK-6.6][linux-6.6.y sync] Backport 6.6.110-6.6.111 LTS Patches - scsi: hisi_sas: Fix NULL pointer exception when do user_scan() - !21013 CVE-2026-23177 - !21007 bonding: fix use-after-free due to enslave fail after slave array update - !21006 net: Fix CVE-2026-23204 - bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path - bpf, test_run: Subtract size of xdp_frame from allowed metadata size - bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN - bpf: Make variables in bpf_prog_test_run_xdp less confusing - bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K - !21015 libceph: reset sparse-read state in osd_fault() - !21024 ub: udma: bugfix related to print messages. - !20980 Fix CVE-2026-23126 - !20922 Fix CVE-2026-23133 - ub: udma: bugfix related to print messages. - l2tp: avoid one data-race in l2tp_tunnel_del_work() - KVM: Don't clobber irqfd routing type when deassigning irqfd - ipv6: annotate data-race in ndisc_router_discovery() - macvlan: observe an RCU grace period in macvlan_common_newlink() error path - macvlan: fix error recovery in macvlan_common_newlink() - mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() - net: fix segmentation of forwarding fraglist GRO - can: rcar_canfd: Fix CAN-FD mode as default - libceph: reset sparse-read state in osd_fault() - !21008 uvb: fix cis call return value and obtain - mm, shmem: prevent infinite loop on truncate race - mm/shmem, swap: fix race of truncate and swap entry split - net/9p: fix double req put in p9_fd_cancelled - riscv: mm: Do not restrict mmap address based on hint - riscv: mm: Use hint address in mmap if available - driver core/PM: Set power.no_callbacks along with power.no_pm - serial: stm32: allow selecting console when the driver is module - hid: fix I2C read buffer overflow in raw_event() for mcp2221 - ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free - ALSA: usb-audio: Kill timer properly at removal - platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list - can: rcar_canfd: Fix controller mode setting - can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled - btrfs: ref-verify: handle damaged extent root tree - ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue - perf subcmd: avoid crash in exclude_cmds when excludes is empty - platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list - dm-integrity: limit MAX_TAG_SIZE to 255 - ASoC: amd: acp: Adjust pdm gain value - wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 - USB: serial: option: add SIMCom 8230C compositions - media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe - !20931 Fix CVE-2026-23060 - uvb: fix cis call return value and obtain - bonding: fix use-after-free due to enslave fail after slave array update - net/sched: cls_u32: use skb_header_pointer_careful() - net: add skb_header_pointer_careful() helper - regmap: Fix race condition in hwspinlock irqsave routine - crypto: virtio - Add spinlock protection with virtqueue notification - net/mlx5e: TC, delete flows only for existing peers - !20967 net: hns3: modify code of judging if SMMU DMA is enabled - ceph: fix oops due to invalid pointer for kfree() in parse_longname() - !20969 Fix CVE-2026-23125 - !20948 v4 arm64: Add memory poison recovery support for various paths - !20975 CVE-2026-23102 - !20977 v4 support apei_page_offline_policy - bonding: annotate data-races around slave->last_rx - netfilter: nf_conncount: update last_gc only when GC has been performed - bonding: provide a net pointer to __skb_flow_dissect() - netdevsim: fix a race issue related to the operation on bpf_bound_progs list - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() - apei/ghes: Add sysctl interface to control soft-offline page isolation - Revert "mm/memory-failure: support disabling soft offline for HugeTLB pages" - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - arm64/fpsimd: signal: Fix restoration of SVE context - arm64/fpsimd: signal: Consistently read FPSIMD context - arm64/fpsimd: signal: Mandate SVE payload for streaming-mode state - bonding: limit BOND_MODE_8023AD to Ethernet devices - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag - net/sched: Enforce that teql can only be used as root qdisc - sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT - drivers/net: Update vendor name of Chengdu NorthLink Technology N5/N6 Series Network Card Drivers - net: hns3: modify code of judging if SMMU DMA is enabled - dmaengine: xilinx: xdma: Fix regmap max_register - ub:ubus: protect iterator ue_list and mue_list with ub_bus_sem - ub:ubus: Avoid getting empty uent from ubc - ub:hisi-ubus: Use GFP_ATOMIC when alloc memory - arm64: send sig fault for user task when apei_claim_sea fails - arm64: add ras log during do_sea - arm64: move getting valid siaddr to the top of do_sea - arm64: mm: shmem: support poison recovery from shmem_file_read_iter() - arm64: fs: support poison recovery from __kernel_read() - iov_iter: add mc support for copy_page_to_iter - arm64: mm: support recovery from copy_{from/to}_user_page() - iov_iter: get rid of 'copy_mc' flag - leds: led-class: Only Add LED to leds_list when it is fully ready - wifi: ath10k: fix dma_free_coherent() pointer - smb/server: fix refcount leak in parse_durable_handle_context() - ksmbd: add chann_lock to protect ksmbd_chann_list xarray - ipvlan: Make the addrs_lock be per port - smb: client: split cached_fid bitfields to avoid shared-byte RMW races - efivarfs: fix error propagation in efivar_entry_get() - io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop - dm: use bio_clone_blkg_association - RAS/AMD/ATL: fix error nodes per socket on for Hygon Dhyana processor - net: txgbe: fix clang compile warning - !20552 ub: udma: fix some code issues. - !20313 Fix CVE-2025-40220 - !20321 nvme: fix admin request_queue lifetime - !20512 PM / devfreq: hisi: Fix potential UAF in OPP handling - !20544 Fix CVE-2025-71147 - !20548 v4 net: LTS-6.6 backport - !20503 Fix CVE-2025-39713 - !20133 Fix CVE-2025-39721 - !20438 Fix CVE-2025-38659 - !20264 Fix CVE-2025-40277 - !20340 Fix CVE-2025-40271 - !20319 Fix CVE-2025-40237 - !20392 vfs: Don't leak disconnected dentries on umount - !20554 iommu/s390: Implement blocking domain - !20489 [OLK-6.6][linux-6.6.y sync] Backport 6.6.101-6.6.102 LTS Patches - !20513 ACPI: PCC: Fix race condition by removing static qualifier - !20468 drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer - !20483 rcu: Protect ->defer_qs_iw_pending from data race - !20510 drivers/ub/sentry: fix primary eid index value - !20553 ub: cdma: support separated page table feature - ub: udma: fix some code issues. - !20480 iommu/ummu-core: fix error invalidate tid - !20561 iommu/ummu: Add ummu sva independent page table parameter - ub: udma: bugfix related to 2m_hugepage. - ub: udma: support for separate page tables - ub: udma: delete debugfs code. - ub: udma: bugfix related to ctrlq function. - ub: udma: verify get cqe/ae aux info out addr and len. - ub: cdma: support separated page table feature - iommu/ummu: Add ummu sva independent page table parameter - iommu: Adjust PLB refresh timing in 'grant' and 'ungrant' - !20505 Fix CVE-2026-23035 - iommu/s390: Implement blocking domain - drivers/ub/sentry: fix primary eid index value - !20535 libceph: make decode_pool() more resilient against corrupted osdmaps - !20536 mm/page_alloc: change all pageblocks migrate type on coalescing - !20537 mm/secretmem: fix use-after-free race in fault handler - !20538 wifi: avoid kernel-infoleak from struct iw_point - !20539 net: usb: rtl8150: fix memory leak on usb_submit_urb() failure - !20440 PCI/AER: Fix NULL pointer access by aer_info - !20262 Fix CVE-2025-68176 - netfilter: nf_reject: don't leak dst refcount for loopback packets - net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error - page_pool: always add GFP_NOWARN for ATOMIC allocations - virtio-net: fix received length check in big packets - net: bridge: fix use-after-free due to MST port state bypass - vsock: Ignore signal/timeout on connect() if already established - tls: make sure to abort the stream if headers are bogus - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI - xfrm: Duplicate SPI Handling - tls: handle data disappearing from under the TLS ULP - net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing - bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls - Bluetooth: hci_core: Fix use-after-free in vhci_flush() - KEYS: trusted: Fix a memory leak in tpm2_load_cmd - !20237 Fix CVE-2025-68724 - !20459 Fix CVE-2025-71131 - !20525 Fix CVE-2025-68816 - !20529 CVE-2025-68172 - net: usb: rtl8150: fix memory leak on usb_submit_urb() failure - !20370 Revert "Revert "RDMA/hns: Fix mismatch exception rollback"" - wifi: avoid kernel-infoleak from struct iw_point - mm/secretmem: fix use-after-free race in fault handler - mm/page_alloc: change all pageblocks migrate type on coalescing - libceph: make decode_pool() more resilient against corrupted osdmaps - pps: Fix kabi breakage of struct pps_device for last_fetched_ev - sched: Fix kabi breakage of struct task_struct for saved_state - crypto: aspeed - fix double free caused by devm - !20515 Bluetooth: bcsp: receive data only if registered - !20507 Fix CVE-2025-40358 - !20450 ub: ubase&unic: Fix some bug in concurrent process - !20452 iommu/ummu: Fix some bugs and optimize the code implementation - !20451 iommu/ummu: Add the function of creating devices with SVA-separated - !20500 mm: fix the inaccurate memory statistics issue for users - net/mlx5: fw_tracer, Validate format string parameters - Bluetooth: bcsp: receive data only if registered - ACPI: PCC: Fix race condition by removing static qualifier - ACPI: CPPC: Fix missing PCC check for guaranteed_perf - iommu/ummu: Add the function of creating devices with SVA-separated - iommu/ummu-core: fix error invalidate tid - riscv: stacktrace: Disable KASAN checks for non-current tasks - !20497 arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() - !20496 drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies - !20495 iommu/amd: Avoid stack buffer overflow from kernel cmdline - !20494 HID: core: Harden s32ton() against conversion to 0 bits - !20493 iommu: Fix two issues in iommu_copy_struct_from_user() - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv - PM / devfreq: hisi: Fix potential UAF in OPP handling - media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() - !20487 interference: Fix uninitialized ifs_clock compiling issue - MIPS: mm: kmalloc tlb_vpn array to avoid stack overflow - MIPS: mm: Prevent a TLB shutdown on initial uniquification - mm: fix the inaccurate memory statistics issue for users - mm: add config option for atomic mode in mm counter - Revert "mm: fix the inaccurate memory statistics issue for users" - !20444 net/mlx5e: Fix crash on profile change rollback failure - !20442 net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv - arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() - drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies - iommu/amd: Avoid stack buffer overflow from kernel cmdline - HID: core: Harden s32ton() against conversion to 0 bits - iommu: Fix two issues in iommu_copy_struct_from_user() - SUNRPC: call xs_sock_process_cmsg for all cmsg - flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read - !20374 [OLK 6.6]Use Hygon IBRS and IBPB rather than software-based mitigation to mitigate Retbleed and SRSO. - !20227 Rename leapioraid to leapraid and release v2.0 - mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery - MIPS: mm: tlb-r4k: Uniquify TLB entries on init - x86/fpu: Delay instruction pointer fixup until after warning - ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx() - ALSA: intel_hdmi: Fix off-by-one error in __hdmi_lpe_audio_probe() - x86/sev: Evict cache lines during SNP memory validation - net: usbnet: Fix the wrong netif_carrier_on() call - net: usbnet: Avoid potential RCU stall on LINK_CHANGE event - Bluetooth: btusb: Add USB ID 3625:010b for TP-LINK Archer TX10UB Nano - sched,freezer: Remove unnecessary warning in __thaw_task - freezer,sched: Clean saved_state when restoring it during thaw - freezer,sched: Do not restore saved_state of a thawed task - freezer,sched: Use saved_state to reduce some spurious wakeups - sched/core: Remove ifdeffery for saved_state - i2c: stm32f7: unmap DMA mapped buffer - i2c: stm32f7: simplify status messages in case of errors - i2c: stm32f7: perform most of irq job in threaded handler - i2c: stm32f7: use dev_err_probe upon calls of devm_request_irq - i2c: stm32f7: Use devm_clk_get_enabled() - USB: serial: option: add Foxconn T99W709 - smb: server: Fix extension string in ksmbd_extract_shortname() - ksmbd: fix corrupted mtime and ctime in smb2_open - ksmbd: fix Preauh_HashValue race condition - ksmbd: fix null pointer dereference error in generate_encryptionkey - vsock: Do not allow binding to VMADDR_PORT_ANY - selftests/perf_events: Add a mmap() correctness test - smb: client: return an error if rdma_connect does not return within 5 seconds - smb: client: let recv_done() cleanup before notifying the callers. - smb: client: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already - smb: client: make use of common smbdirect_socket - smb: smbdirect: add smbdirect_socket.h - smb: client: Correct typos in multiple comments across various files - smb: client: Use min() macro - smb: server: let recv_done() avoid touching data_transfer after cleanup/move - smb: server: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already - ALSA: hda/ca0132: Fix missing error handling in ca0132_alt_select_out() - irqchip: Build IMX_MU_MSI only on ARM - net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing - sunrpc: fix client side handling of tls alerts - net/sched: taprio: enforce minimum value for picos_per_byte - net: drop UFO packets in udp_rcv_segment() - ipv6: reject malicious packets in ipv6_gso_segment() - net/mlx5: Correctly set gso_segs when LRO is used - netlink: specs: ethtool: fix module EEPROM input/output arguments - net: ipa: add IPA v5.1 and v5.5 to ipa_version_string() - phy: mscc: Fix parsing of unicast frames - netpoll: prevent hanging NAPI when netcons gets enabled - md/md-cluster: handle REMOVE message earlier - NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY - NFS: Fix wakeup of __nfs_lookup_revalidate() in unblock_revalidate() - sched: Add test_and_clear_wake_up_bit() and atomic_dec_and_wake_up() - pNFS/flexfiles: don't attempt pnfs on fatal DS errors - PCI: pnv_php: Fix surprise plug detection and recovery - powerpc/eeh: Export eeh_unfreeze_pe() - PCI: pnv_php: Work around switches with broken presence detection - kconfig: qconf: fix ConfigList::updateListAllforAll() - scsi: sd: Make sd shutdown issue START STOP UNIT appropriately - scsi: ufs: core: Use link recovery when h8 exit fails during runtime resume - scsi: Revert "scsi: iscsi: Fix HW conn removal use after free" - scsi: mpt3sas: Fix a fw_event memory leak - vfio/pci: Separate SR-IOV VF dev_set - vfio/pds: Fix missing detach_ioas op - vfio: Prevent open_count decrement to negative - vfio: Fix unbalanced vfio_df_close call in no-iommu mode - f2fs: fix to calculate dirty data during has_not_enough_free_secs() - f2fs: fix to update upper_p in __get_secs_required() correctly - f2fs: vm_unmap_ram() may be called from an invalid context - f2fs: fix to avoid out-of-boundary access in devs.path - f2fs: doc: fix wrong quota mount option description - f2fs: fix KMSAN uninit-value in extent_info usage - rtc: rv3028: fix incorrect maximum clock rate handling - rtc: pcf8563: fix incorrect maximum clock rate handling - rtc: pcf85063: fix incorrect maximum clock rate handling - rtc: nct3018y: fix incorrect maximum clock rate handling - rtc: hym8563: fix incorrect maximum clock rate handling - rtc: ds1307: fix incorrect maximum clock rate handling - ucount: fix atomic_long_inc_below() argument type - module: Restore the moduleparam prefix length check - apparmor: fix loop detection used in conflicting attachment resolution - apparmor: ensure WB_HISTORY_SIZE value is a power of 2 - bpf: Check netfilter ctx accesses are aligned - bpf: Check flow_dissector ctx accesses are aligned - vhost-scsi: Fix log flooding with target does not exist errors - mtd: rawnand: atmel: set pmecc data setup time - mtd: rawnand: rockchip: Add missing check after DMA map - mtd: rawnand: atmel: Fix dma_mapping_error() address - jfs: fix metapage reference count leak in dbAllocCtl - crypto: qat - fix seq_file position update in adf_ring_next() - crypto: qat - fix DMA direction for compression on GEN2 devices - perf tools: Remove libtraceevent in .gitignore - sh: Do not use hyphen in exported variable name - ASoC: fsl_xcvr: get channel status data when PHY is not exists - dmaengine: nbpfaxi: Add missing check after DMA map - dmaengine: mv_xor: Fix missing check after DMA map and missing unmap - fs/orangefs: Allow 2 more characters in do_c_string() - PCI: endpoint: pci-epf-vntb: Fix the incorrect usage of __iomem attribute - soundwire: stream: restore params when prepare ports fail - crypto: img-hash - Fix dma_unmap_sg() nents value - crypto: keembay - Fix dma_unmap_sg() nents value - hwrng: mtk - handle devm_pm_runtime_enable errors - watchdog: ziirave_wdt: check record length in ziirave_firm_verify() - scsi: isci: Fix dma_unmap_sg() nents value - scsi: mvsas: Fix dma_unmap_sg() nents value - scsi: elx: efct: Fix dma_unmap_sg() nents value - scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value - clk: sunxi-ng: v3s: Fix de clock definition - perf tests bp_account: Fix leaked file descriptor - kernel: trace: preemptirq_delay_test: use offstack cpu mask - crypto: inside-secure - Fix `dma_unmap_sg()` nents value - perf sched: Fix memory leaks in 'perf sched latency' - perf sched: Fix memory leaks for evsel->priv in timehist - perf sched: Free thread->priv using priv_destructor - perf dso: Add missed dso__put to dso__load_kcore - perf tools: Fix use-after-free in help_unknown_cmd() - Fix dma_unmap_sg() nents value - clk: clk-axi-clkgen: fix fpfd_max frequency for zynq - fanotify: sanitize handle_type values when reporting fid - pinctrl: sunxi: Fix memory leak on krealloc failure - PCI: endpoint: pci-epf-vntb: Return -ENOENT if pci_epc_get_next_free_bar() fails - crypto: arm/aes-neonbs - work around gcc-15 warning - power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set - power: supply: cpcap-charger: Fix null check for power_supply_get_by_name - clk: xilinx: vcu: unregister pll_post only if registered correctly - media: v4l2-ctrls: Fix H264 SEPARATE_COLOUR_PLANE check - mtd: fix possible integer overflow in erase_xfer() - crypto: marvell/cesa - Fix engine load inaccuracy - crypto: qat - use unmanaged allocation for dc_data - crypto: sun8i-ce - fix nents passed to dma_unmap_sg() - PCI: rockchip-host: Fix "Unexpected Completion" log message - bpf/preload: Don't select USERMODE_DRIVER - ipv6: annotate data-races around rt->fib6_nsiblings - ipv6: fix possible infinite loop in fib6_info_uses_dev() - vrf: Drop existing dst reference in vrf_ip6_input_dst - selftests: rtnetlink.sh: remove esp4_offload after test - net/mlx5e: Clear Read-Only port buffer size in PBMC before update - netfilter: xt_nfacct: don't assume acct name is null-terminated - can: kvaser_usb: Assign netdev.dev_port based on device channel index - can: kvaser_pciefd: Store device channel index - can: peak_usb: fix USB FD devices potential malfunction - tools/rv: Do not skip idle in trace - Bluetooth: hci_event: Mask data status from LE ext adv reports - kcsan: test: Initialize dummy variable - wifi: mac80211: Write cnt before copying in ieee80211_copy_rnr_beacon() - wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE - wifi: ath12k: fix endianness handling while accessing wmi service bit - wifi: mac80211: Check 802.11 encaps offloading in ieee80211_tx_h_select_key() - wifi: mac80211: Don't call fq_flow_idx() for management frames - wifi: mac80211: Do not schedule stopped TXQs - wifi: plfxlc: Fix error handling in usb driver probe - wifi: mac80211: reject TDLS operations when station is not associated - iommu/amd: Fix geometry.aperture_end for V2 tables - mwl8k: Add missing check after DMA map - wifi: rtl8xxxu: Fix RX skb size for aggregation disabled - tcp: call tcp_measure_rcv_mss() for ooo packets - xen/gntdev: remove struct gntdev_copy_batch from stack - net_sched: act_ctinfo: use atomic64_t for three counters - net/sched: Restrict conditions for adding duplicating netems to qdisc tree - um: rtc: Avoid shadowing err in uml_rtc_start() - arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX - netfilter: nf_tables: adjust lockdep assertions handling - netfilter: nf_tables: Drop dead code from fill_*_info routines - fbcon: Fix outdated registered_fb reference in comment - drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value - m68k: Don't unregister boot console needlessly - drm/msm/dpu: Fill in min_prefill_lines for SC8180X - kselftest/arm64: Fix check for setting new VLs in sve-ptrace - net: dst: annotate data-races around dst->input - tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range - wifi: ath11k: clear initialized flag for deinit-ed srng lists - iwlwifi: Add missing check for alloc_ordered_workqueue - wifi: iwlwifi: Fix memory leak in iwl_mvm_init() - wifi: rtl818x: Kill URBs before clearing tx status queue - wifi: rtw89: avoid NULL dereference when RX problematic packet on unsupported 6 GHz band - caif: reduce stack size, again - bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure - drm/vmwgfx: Fix Host-Backed userspace on Guest-Backed kernel - net: ipv6: ip6mr: Fix in/out netdev to pass to the FORWARD chain - selftests/bpf: fix signedness bug in redir_partial() - bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls - bpf, sockmap: Fix psock incorrectly pointing to sk - drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed - staging: nvec: Fix incorrect null termination of battery manufacturer - interconnect: qcom: sc8180x: specify num_nodes - interconnect: qcom: sc8280xp: specify num_links for qnm_a1noc_cfg - soc: qcom: pmic_glink: fix OF node leak - samples: mei: Fix building on musl libc - cpufreq: Initialize cpufreq-based frequency-invariance later - cpufreq: intel_pstate: Always use HWP_DESIRED_PERF in passive mode - arm64: dts: imx8mn-beacon: Fix HS400 USDHC clock speed - arm64: dts: imx8mm-beacon: Fix HS400 USDHC clock speed - ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface - soc/tegra: cbb: Clear ERR_FORCE register with ERR_STATUS - arm: dts: ti: omap: Fixup pinheader typo - usb: early: xhci-dbc: Fix early_ioremap leak - powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw() - pps: fix poll support - staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() - spi: stm32: Check for cfg availability in stm32_spi_probe - usb: misc: apple-mfi-fastcharge: Make power supply names unique - usb: host: xhci-plat: fix incorrect type for of_match variable in xhci_plat_probe() - ARM: dts: vfxxx: Correctly use two tuples for timer address - arm64: dts: qcom: msm8976: Make blsp_dma controlled-remotely - arm64: dts: qcom: sc7180: Expand IMEM region - arm64: dts: qcom: sdm845: Expand IMEM region - soc: qcom: QMI encoding/decoding for big endian - selftests: Fix errno checking in syscall_user_dispatch test - ASoC: mediatek: use reserved memory or enable buffer pre-allocation - gfs2: No more self recovery - Revert "fs/ntfs3: Replace inode_trylock with inode_lock" - hfs: make splice write available again - hfsplus: make splice write available again - ublk: use vmalloc for ublk_device's __queues - fs_context: fix parameter name in infofc() macro - audit,module: restore audit logging in load failure case - ASoC: amd: yc: add DMI quirk for ASUS M6501RM - ASoC: Intel: fix SND_SOC_SOF dependencies - ASoC: amd: yc: Add DMI entries to support HP 15-fb1xxx - ethernet: intel: fix building with large NR_CPUS - ASoC: amd: yc: Add DMI quirk for HP Laptop 17 cp-2033dx - interference: Fix uninitialized ifs_clock compiling issue - iommu/ummu: optimize log printing - !20455 Fix compilation failure caused by PR#20174 - !20302 CVE-2026-22980 - !20142 CVE-2025-68803 - !20261 ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency - !20435 fix CVE-2026-22998 - !20433 scsi: target: Reset t_task_cdb pointer in error case - !20432 scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" - !20431 block: Use RCU in blk_mq_[un - !20307 tpm: Cap the number of PCR banks - !20062 xfs: Add xfs_dir3_leaf_header_check() in leaf/leafn read - !20157 v2 md: backport from mainline - rcu: Protect ->defer_qs_iw_pending from data race - platform/x86/intel/pmt: fix compilation failure caused by PR#20174 - iommu/ummu: optimize kv cache memory management - iommu/ummu: optimize permission table management - iommu/ummu: remove check for eid_type while del eid - iommu/ummu: optimize the code implementation - drivers/perf: fix ummu-pmu data reading exception - iommu/ummu: IOMMU_DOMAIN_BLOCKED type don not sync tct - drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer - crypto: seqiv - Do not use req->iv after crypto_aead_encrypt - net: unic: Notify mami of the bond ip change. - ub: ubase: Support for UE link by ctrlq message - ub: ubase: send a deactivate req in removing - ub: ubase: Querying TPG/TP contexts in the chip is no longer supported after enabling safe mode. - ub: ubase: Use an independent thread for the ctrlq workqueue. - !20368 ubcore: fix logging and permission for route query. - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id - !20344 ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr - net: unic: Fix the ummu 0xa event that occurs when modifying queues and resetting concurrent scenarios - ub: ubase: Add KABI compatibility - ub: ubase: fixing the issue of cdma ctp_req_vl parameter configuration - ub: ubase: add PMU IDEV interrupt supported abilities. - ub: ubase: Delete the tid mask for eq, jfs, jfr, and jfc context - ub: ubase: Set the completion event interrupt to auto - net: unic: fix poll tx read old skb cause a UAF bug - !20249 Fix CVE-2025-38489 - !20250 Fix CVE-2025-38480 - !20378 Fix CVE-2025-39838 - !20430 Fix CVE-2025-39942 - !20351 Fix CVE-2025-71149 - !20375 Fix CVE-2025-71150 - !20323 Fix CVE-2025-38730 - !20320 Fix CVE-2025-68814 - !20314 Fix CVE-2025-71072 - !20315 Fix CVE-2025-68794 - !20403 bpf: Check skb->transport_header is set in bpf_skb_check_mtu - !20402 bpf: Do not let BPF test infra emit invalid GSO types to stack - !20401 tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() - !20400 netfilter: nft_ct: add seqadj extension for natted connections - !20399 net: xfrm: Fix CVE-2025-40215 - !20398 net/sched: sch_qfq: Fix null-deref in agg_dequeue - !20397 bpf: Reject narrower access to pointer ctx fields - !20396 Bluetooth: eir: Fix possible crashes on eir_create_adv_data - !20394 IB/mlx5: Fix potential deadlock in MR deregistration - !20367 ub: cdma: cdma uaf bugfix - net/mlx5e: Fix crash on profile change rollback failure - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv - PCI/AER: Fix NULL pointer access by aer_info - gfs2: No more self recovery - drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE - crypto: qat - flush misc workqueue during device shutdown - !20174 Backport PMT spec 3.0 support - !20366 [Hygon][6.6][Bugfix]: Resolve FPU state corruption between atomic and non-atomic contexts - !19814 [OLK-6.6] Batch flushing user memory encrytion status change - !20393 [OLK-6.6][linux-6.6.y sync] Backport 6.6.100-6.6.101 LTS Patches - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec - nvmet-tcp: remove boilerplate code - scsi: target: Reset t_task_cdb pointer in error case - scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" - block: Use RCU in blk_mq_[un]quiesce_tagset() instead of set->tag_list_lock - ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size - ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer - smb: server: let recv_done() consistently call put_recvmsg/smb_direct_disconnect_rdma_connection - smb: server: remove separate empty_recvmsg_queue - !20384 ub:ubus: Fix ubus link message and pool device error - !20389 gfs2: Prevent recursive memory reclaim - !20388 *** fix CVE-2025-38062 *** - !20387 KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced - !20386 pinctrl: check the return value of pinmux_ops::get_function_name() - !20385 iommu/amd/pgtbl: Fix possible race while increase page table level - ub:ubus: Not cfg access during surprise down - ub:hisi-ubus: Delete validate_pa err print - PCI: cadence: Check for the existence of cdns_pcie::ops before using it - can: netlink: can_changelink(): allow disabling of automatic restart - Revert "selftests/bpf: Add a cgroup prog bpf_get_ns_current_pid_tgid() test" - drm/sched: Remove optimization that causes hang when killing dependent jobs - ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS - bpf: Check skb->transport_header is set in bpf_skb_check_mtu - bpf: Do not let BPF test infra emit invalid GSO types to stack - tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() - netfilter: nft_ct: add seqadj extension for natted connections - xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added - xfrm: delete x->tunnel as we delete x - x86/hw-vuln:Support hardware-based mitigation for Retbleed and SRSO via Hygon IBRS to avoid performance degradation caused by software-based mitigation. - net/sched: sch_qfq: Fix null-deref in agg_dequeue - bpf: Reject narrower access to pointer ctx fields - Bluetooth: eir: Fix possible crashes on eir_create_adv_data - IB/mlx5: Fix potential deadlock in MR deregistration - ub:ubus: Fix ubus link message and pool device error - ub:hisi-ubus: cq poller maximum handle 64 cqe per time - ub:hisi-ubus:Fix vdm message print error - ub:ubus:Fix ubus interrupt release issue - wifi: mt76: mt7921: prevent decap offload config before STA initialization - mtd: rawnand: qcom: Fix last codeword read in qcom_param_page_type_exec() - iio: hid-sensor-prox: Restore lost scale assignments - iio: hid-sensor-prox: Fix incorrect OFFSET calculation - crypto: powerpc/poly1305 - add depends on BROKEN for now - erofs: address D-cache aliasing - drm/i915/dp: Fix 2.7 Gbps DP_LINK_BW value on g4x - ALSA: hda: Add missing NVIDIA HDA codec IDs - ALSA: hda/tegra: Add Tegra264 support - comedi: comedi_test: Fix possible deletion of uninitialized timers - usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach - usb: typec: tcpm: allow switching to mode accessory to mux properly - usb: typec: tcpm: allow to use sink in accessory mode - drm/amdkfd: Don't call mmput from MMU notifier callback - mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n - selftests: mptcp: connect: also cover checksum - selftests: mptcp: connect: also cover alt modes - resource: fix false warning in __request_region() - gve: Fix stuck TX queue for DQ queue format - e1000e: ignore uninitialized checksum word on tgp - e1000e: disregard NVM checksum on tgp when valid checksum bit is not set - dpaa2-switch: Fix device reference count leak in MAC endpoint handling - dpaa2-eth: Fix device reference count leak in MAC endpoint handling - ALSA: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx - sprintf.h requires stdarg.h - bus: fsl-mc: Fix potential double device reference in fsl_mc_get_endpoint() - i2c: virtio: Avoid hang by using interruptible completion wait - i2c: tegra: Fix reset error handling with ACPI - platform/x86: ideapad-laptop: Fix kbd backlight not remembered among boots - can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode - can: dev: can_restart(): move debug message and stats after successful restart - can: dev: can_restart(): reverse logic to remove need for goto - i40e: When removing VF MAC filters, only check PF-set MAC - i40e: report VF tx_dropped with tx_errors instead of tx_discards - i40e: Add rx_missed_errors for buffer exhaustion - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch - net/mlx5: Fix memory leak in cmd_exec() - staging: vchiq_arm: Make vchiq_shutdown never fail - x86/hyperv: Fix usage of cpu_online_mask to get valid cpu - regmap: fix potential memory leak of regmap_bus - iio: adc: ad7949: use spi_is_bpw_supported() - interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1 node - RDMA/core: Rate limit GID cache warning messages - virtio_ring: Fix error reporting in virtqueue_resize - !20348 [OLK-6.6][linux-6.6.y sync] Backport 6.6.99-6.6.100 LTS Patches - !20346 tracing: Fix crash on synthetic stacktrace field usage - vfs: Don't leak disconnected dentries on umount - !20334 Fix CVE-2025-68780 - gfs2: Prevent recursive memory reclaim - amd/amdkfd: enhance kfd process check in switch partition - drm/amdkfd: allow compute partition mode switch with cgroup exclusions - KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced - pinctrl: check the return value of pinmux_ops::get_function_name() - iommu/amd/pgtbl: Fix possible race while increase page table level - !19966 nvme-fc: use lock accessing port_state and rport state - ASoC: fsl_sai: replace regmap_write with regmap_update_bits - comedi: Fix use of uninitialized data in insn_rw_emulate_bits() - cifs: prevent NULL pointer dereference in UTF16 conversion - ksmbd: Fix refcount leak when invalid session is found on session lookup - ubcore: fix logging and permission for route query. - !20232 driver/coda: VirtCCA supports MSI device DA - Revert "Revert "RDMA/hns: Fix mismatch exception rollback"" - !20197 ub: udma&ubase: fix a bug that caused long reboot time - x86: Resolve FPU state corruption between atomic and non-atomic contexts - ub: cdma: cdma uaf bugfix - ub: cdma: jfs call trace bugfix - !20353 x86/fpu: Clear XSTATE_BV[i - s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again - KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls - nvmem: layouts: u-boot-env: remove crc32 endianness conversion - i2c: omap: fix deprecated of_property_read_bool() use - ASoC: fsl_sai: Force a software reset when starting in consumer mode - regulator: pwm-regulator: Manage boot-on with disabled PWM channels - regulator: pwm-regulator: Calculate the output voltage for disabled PWMs - i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe() - i2c: omap: Fix an error handling path in omap_i2c_probe() - i2c: omap: Add support for setting mux - usb: dwc3: qcom: Don't leave BCR asserted - usb: hub: Don't try to recover devices lost during warm reset. - usb: hub: Fix flushing of delayed work used for post resume purposes - usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm - usb: hub: fix detection of high tier USB3 devices behind suspended hubs - arm64: Filter out SME hwcaps when FEAT_SME isn't implemented - ipv6: make addrconf_wq single threaded - !20354 cpufreq/sched: Explicitly synchronize limits_changed flag handling - sched/deadline: only set free_cpus for online runqueues - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 - cpufreq/sched: Explicitly synchronize limits_changed flag handling - io_uring/poll: correctly handle io_poll_add() return value on update - shmem: fix recovery on rename failures - io_uring: fix filename leak in __io_openat_prep() - Revert "cgroup_freezer: cgroup_freezing: Check if not frozen" - rxrpc: Fix transmission of an abort in response to an abort - rxrpc: Fix recv-recv race of completed call - net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree - net: bridge: Do not offload IGMP/MLD messages - hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf - netfilter: nf_conntrack: fix crash due to removal of uninitialised entry - ipv6: mcast: Delay put pmc->idev in mld_del_delrec() - net/mlx5: Correctly set gso_size when LRO is used - Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID - Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout - Bluetooth: SMP: If an unallowed command is received consider it a failure - Bluetooth: hci_sync: fix connectable extended advertising when using static random address - hwmon: (corsair-cpro) Validate the size of the received input buffer - selftests: net: increase inter-packet timeout in udpgro.sh - wifi: cfg80211: remove scan request n_channels counted_by - nvme: fix misaccounting of nvme-mpath inflight I/O - net: phy: Don't register LEDs for genphy - nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list() - rpl: Fix use-after-free in rpl_do_srh_inline(). - block: fix kobject leak in blk_unregister_queue - net: emaclite: Fix missing pointer increment in aligned_read() - soundwire: amd: fix for clearing command status register - soundwire: amd: fix for handling slave alerts after link is down - comedi: Fix use of uninitialized data in insn_rw_emulate_bits() - comedi: Fix some signed shift left operations - comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large - comedi: das6402: Fix bit shift out of bounds - comedi: das16m1: Fix bit shift out of bounds - comedi: aio_iiro_16: Fix bit shift out of bounds - comedi: pcl812: Fix bit shift out of bounds - iio: adc: stm32-adc: Fix race in installing chained IRQ handler - iio: adc: max1363: Reorder mode_list[] entries - iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] - iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush - soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled - soc: aspeed: lpc-snoop: Cleanup resources in stack-order - s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again - pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov - net: libwx: properly reset Rx ring descriptor - net: libwx: remove duplicate page_pool_put_full_page() - mmc: sdhci_am654: Workaround for Errata i2312 - mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models - mmc: bcm2835: Fix dma_unmap_sg() nents value - memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() - isofs: Verify inode mode when loading from disk - dmaengine: nbpfaxi: Fix memory corruption in probe() - af_packet: fix soft lockup issue caused by tpacket_snd() - af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() - arm64: dts: rockchip: use cs-gpios for spi1 on ringneck - arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on - arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency - net/mlx5: Update the list of the PCI supported devices - phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() - io_uring/poll: fix POLLERR handling - ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS - drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume - tracing/osnoise: Fix crash in timerlat_dump_stack() - spi: Add check for 8-bit transfer with 8 IO mode support - pch_uart: Fix dma_sync_sg_for_device() nents value - thunderbolt: Fix bit masking in tb_dp_port_set_hops() - i2c: stm32: fix the device used for the DMA map - tracing: Fix crash on synthetic stacktrace field usage - usb: musb: fix gadget state on disconnect - USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI - USB: serial: option: add Foxconn T99W640 - USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition - phy: tegra: xusb: Disable periodic tracking on Tegra234 - phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode - phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr - fs/proc: fix uaf in proc_readdir_de() - io_uring/net: commit partial buffers on retry - nvme: fix admin request_queue lifetime - fs/notify: call exportfs_encode_fid with s_umount - iomap: adjust read range correctly for non-block-aligned positions - fuse: fix livelock in synchronous file put from fuseblk workers - tpm: Cap the number of PCR banks - nfsd: provide locking for v4_end_grace - Revert "nfsd: provide locking for v4_end_grace" - config: enable config for PMT discovery driver - platform/x86/intel/pmt/discovery: use valid device pointer in dev_err_probe - platform/x86/intel/pmt: Fix kobject memory leak on init failure - platform/x86/intel/pmt: fix a crashlog NULL pointer access - platform/x86/intel/pmt: fix build dependency for kunit test - platform/x86/intel/pmt/discovery: fix format string warning - platform/x86/intel/pmt/discovery: Fix size_t specifiers for 32-bit - platform/x86/intel/pmt: KUNIT test for PMT Enhanced Discovery API - platform/x86/intel/pmt/telemetry: Add API to retrieve telemetry regions by feature - platform/x86/intel/pmt/discovery: Get telemetry attributes - platform/x86/intel/tpmi: Get OOBMSM CPU mapping from TPMI - platform/x86/intel/vsec: Set OOBMSM to CPU mapping - platform/x86/intel/tpmi: Relocate platform info to intel_vsec.h - docs: Add ABI documentation for intel_pmt feature directories - platform/x86/intel/pmt: Add PMT Discovery driver - sysfs: Fix crash on empty group attributes array - sysfs: Introduce a mechanism to hide static attribute_groups - platform/x86/intel/vsec: Add new Discovery feature - platform/x86/intel/vsec: Skip driverless features - platform/x86/intel/vsec: Skip absent features during initialization - platform/x86/intel/vsec: Add device links to enforce dependencies - platform/x86/intel/vsec: Create wrapper to walk PCI config space - platform/x86/intel/vsec: Add private data for per-device data - MAINTAINERS: Add link to documentation of Intel PMT ABI - platform/x86/intel/pmt: allow user offset for PMT callbacks - driver/coda: VirtCCA supports MSI device DA - ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency - Rename leapioraid to leapraid and release v2.0 - ub: udma: fix a bug that caused long reboot time. - ub: ubase: Accelerate when ctrl node is shutting down - platform/x86/intel/pmt: Use PMT callbacks - platform/x86/intel/vsec: Add PMT read callbacks - platform/x86/intel/vsec.h: Move to include/linux - md: prevent incorrect update of resync/recovery offset - md/raid1: Fix data corruption for degraded array with slow disk - md/raid1: set max_sectors during early return from choose_slow_rdev() - md-cluster: fix no recovery job when adding/re-adding a disk - md-cluster: fix hanging issue while a new disk adding - md/raid5: recheck if reshape has finished with device_lock held - md-cluster: Constify struct md_cluster_operations - md: Remove unneeded semicolon - md/raid5: fix spares errors about rcu usage - dm-raid: Fix WARN_ON_ONCE check for sync_thread in raid_resume - md: pass in max_sectors for pers->sync_request() - md: factor out helpers for different sync_action in md_do_sync() - md: replace last_sync_action with new enum type - md: use new helpers in md_do_sync() - md: don't fail action_store() if sync_thread is not registered - md: remove parameter check_seq for stop_sync_thread() - md: replace sysfs api sync_action with new helpers - md: factor out helper to start reshape from action_store() - md: add new helpers for sync_action - md: add a new enum type sync_action - md: rearrange recovery_flags - md/raid0: don't free conf on raid0_run failure - md: make md_flush_request() more readable - md: change the return value type of md_write_start to void - md: Revert "md: Fix overflow in is_mddev_idle" - md: don't account sync_io if iostats of the disk is disabled - md: Fix overflow in is_mddev_idle - md: add check for sleepers in md_wakeup_thread() - md: add a mddev_is_dm helper - md: add a mddev_add_trace_msg helper - md: add a mddev_trace_remap helper - dm-raid456, md/raid456: fix a deadlock for dm-raid456 while io concurrent with reshape - dm-raid: add a new helper prepare_suspend() in md_personality - dm-raid: really frozen sync_thread during suspend - md: add a new helper reshape_interrupted() - md: export helper md_is_rdwr() - md: export helpers to stop sync_thread - md: don't clear MD_RECOVERY_FROZEN for new dm-raid until resume - md/raid1: factor out helpers to choose the best rdev from read_balance() - md/raid1: factor out the code to manage sequential IO - md/raid1: factor out choose_bb_rdev() from read_balance() - md/raid1: factor out choose_slow_rdev() from read_balance() - md/raid1: factor out read_first_rdev() from read_balance() - md/raid1-10: factor out a new helper raid1_should_read_first() - md/raid1-10: add a helper raid1_check_read_range() - md/raid1: fix choose next idle in read_balance() - md/raid1: record nonrot rdevs while adding/removing rdevs to conf - md/raid1: factor out helpers to add rdev to conf - md: add a new helper rdev_has_badblock() - md: check mddev->pers before calling md_set_readonly() - md: clean up openers check in do_md_stop() and md_set_readonly() - md: sync blockdev before stopping raid or setting readonly - md: factor out a helper to sync mddev - md: return directly before setting did_set_md_closing - md: changed the switch of RAID_VERSION to if - md: merge the check of capabilities into md_ioctl_valid() - md: Don't suspend the array for interrupted reshape - md: Don't register sync_thread for reshape directly - md: Make sure md_do_sync() will set MD_RECOVERY_DONE - md: Don't ignore read-only array in md_check_recovery() - md: Don't ignore suspended array in md_check_recovery() - md: get rdev->mddev with READ_ONCE() - md: remove redundant md_wakeup_thread() - md: remove redundant check of 'mddev->sync_thread' - md: fix a suspicious RCU usage warning - raid: Remove now superfluous sentinel element from ctl_table array - NFSD: NFSv4 file creation neglects setting ACL - nfsd: set security label during create operations - xfs: Add xfs_dir3_leaf_header_check() in leaf/leafn read - nvme-fc: use lock accessing port_state and rport state - x86/mm: Batch flushing user memory encrytion status change - !20588 [OLK-6.6] Revert "x86/csv: Enhance CMA memory usage reporting for CSV3" - Revert "x86/csv: Enhance CMA memory usage reporting for CSV3" - !20576 media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg() - !20575 RDMA/cm: Fix leaking the multicast GID table reference - !20580 RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly - !20551 Fix CVE-2025-68785 - !20478 f2fs: fix to avoid potential deadlock - !20501 [OLK-6.6] backport important bugfix for bnxt driver from upstream linux-6.6.y - !20520 Fix CVE-2026-23038 - !20424 net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup - !20425 mlx5: Fix default values in create CQ - RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly - media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg() - RDMA/cm: Fix leaking the multicast GID table reference - net: openvswitch: fix middle attribute validation in push_nsh() action - net: openvswitch: remove never-working support for setting nsh fields - pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() - bnxt_en: Fix potential data corruption with HW GRO/LRO - f2fs: fix to avoid potential deadlock - mlx5: Fix default values in create CQ - net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup - riscv kernel upgrade to 6.6.0-138.0.0 - Fixed system hang when boot systemd on spacemit k3 - riscv: perf vendor events: fix lrw core PMU event mapping - !20727 v2 bpf: sockmap fixes - !20741 scsi: qla2xxx: Sanitize payload size to prevent member overflow - !20744 fix CVE-2025-38449 - !20763 net: usb: asix: validate PHY address before use - !20762 smc91x: fix broken irq-context in PREEMPT_RT - !20293 [Hygon][6.6][EDAC] The width of hash value is 2 bits for Hygon family 18h model 6h processors - !20290 [Hygon][6.6][Bugfix] Bug fix for EDAC to use unicast instead of broadcast on hygon family 18h model 4h - !20289 [Hygon][6.6][Bugfix] Bug fix for EDAC to correct the address translation on hygon family 18h model 4h - !20245 KVM: arm64: Refactor exit handlers - !20246 KVM: arm64: Mark some header functions as inline - !19005 [Hygon] [OLK-6.6] [Bugfix] Fix memory bandwidth counter width for Hygon QoS - !20292 [Hygon][6.6][TSC Adjust] Backport x86 TSC adjust patch - !20273 [Hygon][6.6][Bugfix] Get correct CPU LLC ID in guest for Hygon processors - !20722 [OLK-6.6][linux-6.6.y sync] Backport 6.6.104-6.6.106 LTS Patches - !20667 fix CVE-2024-50102 - !20736 netfilter: nf_tables: remove redundant chain validation on register store - !20758 ub: ubase: Fixed the alarm issue caused by the initialization of the structure variable definition. - !20721 obmm: reduce log noise for successful export/import/preimport - net: usb: asix: validate PHY address before use - smc91x: fix broken irq-context in PREEMPT_RT - !20731 devlink: rate: Unset parent pointer in devl_rate_nodes_destroy - !20732 libceph: return the handler error from mon_handle_auth_done() - !20743 mm: slub: avoid wake up kswapd in set_track_prepare - ub: ubase: Fixed the alarm issue caused by the initialization of the structure variable definition. - !20750 ub: cdma: adapted to UMMU interface changes - !20713 urma: DFX of log in kernel - urma: optimize log levels for kernel space - ub: cdma: adapted to UMMU interface changes - wifi: ath11k: avoid bit operation on key flags - drm/mediatek: fix potential OF node use-after-free - cpufreq: intel_pstate: Check IDA only before MSR_IA32_PERF_CTL writes - wifi: cfg80211: sme: store capped length in __cfg80211_connect_result() - !20708 ub:hisi-ubus: Add create bus instance ummu bypass - drm: fix kabi for struct drm_framebuffer - drm/framebuffer: Acquire internal references on GEM handles - drm/gem: Acquire references on GEM handles for framebuffers - mm: slub: avoid wake up kswapd in set_track_prepare - scsi: qla2xxx: Sanitize payload size to prevent member overflow - netfilter: nf_tables: remove redundant chain validation on register store - libceph: return the handler error from mon_handle_auth_done() - devlink: rate: Unset parent pointer in devl_rate_nodes_destroy - Documentation/hw-vuln: Add VMSCAPE documentation - dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status() - riscv: use lw when reading int cpu in asm_per_cpu - mm: slub: avoid wake up kswapd in set_track_prepare - tools: gpio: remove the include directory on make clean - tools: gpio: rm .*.cmd on make clean - drm/amd/amdgpu: Fix missing error return on kzalloc failure - drm/amdgpu: Replace DRM_* with dev_* in amdgpu_psp.c - perf bpf-event: Fix use-after-free in synthesis - drm/bridge: ti-sn65dsi86: fix REFCLK setting - spi: spi-fsl-lpspi: Clear status register after disabling the module - spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort - spi: spi-fsl-lpspi: Set correct chip-select polarity bit - spi: spi-fsl-lpspi: Fix transmissions when using CONT - hwmon: mlxreg-fan: Prevent fans from getting stuck at 0 RPM - pcmcia: omap: Add missing check for platform_get_resource - Revert "drm/amdgpu: Avoid extra evict-restore process." - ALSA: hda/realtek: Fix headset mic for TongFang X6[AF]R5xxY - ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model - drm/mediatek: Fix device/node reference count leaks in mtk_drm_get_all_drm_priv - drm/mediatek: Fix using wrong drm private data to bind mediatek-drm - drm/mediatek: Add crtc path enum for all_drm_priv array - vmxnet3: update MTU after device quiesce - net: dsa: microchip: linearize skb for tail-tagging switches - net: dsa: microchip: update tag_ksz masks for KSZ9477 family - dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status() - ALSA: hda/realtek - Add new HP ZBook laptop with micmute led fixup - ALSA: hda/realtek: Add support for HP Agusta using CS35L41 HDA - iio: pressure: mprls0025pa: use aligned_s64 for timestamp - iio: chemical: pms7003: use aligned_s64 for timestamp - iio: imu: inv_mpu6050: align buffer for timestamp - thermal/drivers/mediatek/lvts: Disable low offset IRQ for minimum threshold - nouveau: fix disabling the nonstall irq due to storm code - cpufreq: intel_pstate: Unchecked MSR aceess in legacy mode - net: pcs: rzn1-miic: Correct MODCTRL register offset - platform/x86/amd/pmc: Add TUXEDO IB Pro Gen10 AMD to spurious 8042 quirks list - drm/amdgpu: drop hw access in non-DC audio fini - wifi: mt76: mt7996: Initialize hdr before passing to skb_put_data() - wifi: mwifiex: Initialize the chan_stats array to zero - tcp_bpf: Fix copied value in tcp_bpf_sendmsg - skmsg: Return copied bytes in sk_msg_memcopy_from_iter - tcp_bpf: Add sk_rmem_alloc related logic for tcp_bpf ingress redirection - Revert "bpf, sockmap: Add sk_rmem_alloc check for sockmap" - ALSA: usb-audio: Add mute TLV for playback volumes on some devices - phy: mscc: Stop taking ts_lock for tx_queue and use its own lock - selftest: net: Fix weird setsockopt() in bind_bhash.c. - net: atm: fix memory leak in atm_register_sysfs when device_register fail - ax25: properly unshare skbs in ax25_kiss_rcv() - mctp: return -ENOPROTOOPT for unknown getsockopt options - net/smc: Remove validation of reserved bits in CLC Decline message - ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init() - net: thunder_bgx: decrement cleanup index before use - net: thunder_bgx: add a missing of_node_put - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() - wifi: libertas: cap SSID len in lbs_associate() - wifi: cw1200: cap SSID length in cw1200_do_join() - net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets - wifi: ath11k: fix group data packet drops during rekey - wifi: ath11k: avoid forward declaration of ath11k_mac_start_vdev_delay() - wifi: ath11k: rename ath11k_start_vdev_delay() - wifi: ath11k: Introduce and use ath11k_sta_to_arsta() - net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() - macsec: read MACSEC_SA_ATTR_PN with nla_get_uint - netlink: add variable-length / auto integers - net: macb: Fix tx_ptr_lock locking - icmp: fix icmp_ndo_send address translation for reply direction - mISDN: Fix memory leak in dsp_hwec_enable() - xirc2ps_cs: fix register access when enabling FullDuplex - netfilter: conntrack: helper: Replace -EEXIST by -EBUSY - wifi: cfg80211: fix use-after-free in cmp_bss() - arm64: dts: imx8mp: Fix missing microSD slot vqmmc on Data Modul i.MX8M Plus eDM SBC - arm64: dts: imx8mp: Fix missing microSD slot vqmmc on DH electronics i.MX8M Plus DHCOM - tee: optee: ffa: fix a typo of "optee_ffa_api_is_compatible" - arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro - Bluetooth: hci_sync: Avoid adding default advertising on startup - cpupower: Fix a bug where the -t option of the set subcommand was not working. - drm/amd/display: Don't warn when missing DCE encoder caps - cdc_ncm: Flag Intel OEM version of Fibocom L850-GL as WWAN - LoongArch: Save LBT before FPU in setup_sigcontext() - btrfs: avoid load/store tearing races when checking if an inode was logged - btrfs: fix race between setting last_dir_index_offset and inode logging - btrfs: fix race between logging inode and checking if it was logged before - bpf: Fix oob access in cgroup local storage - !20556 urma: fix update topo logic - !20639 [OLK-6.6][linux-6.6.y sync] Backport 6.6.103-6.6.104 LTS Patches - !20641 [OLK-6.6][linux-6.6.y sync] LoongArch: Add more instruction opcodes and emit_* helpers - !20560 *** fix CVE-2025-38062 *** - !20662 pNFS: Fix a deadlock when returning a delegation during open() - ub:hisi-ubus: Add create bus instance ummu bypass - Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" - Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set" - HID: mcp2221: Handle reads greater than 60 bytes - HID: mcp2221: Don't set bus speed on every transfer - net/mlx5: SF, Fix add port error handling - drm/nouveau/disp: Always accept linear modifier - smb3 client: fix return code mapping of remap_file_range - net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions - dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted - HID: wacom: Add a new Art Pen 2 - HID: logitech: Add ids for G PRO 2 LIGHTSPEED - HID: quirks: add support for Legion Go dual dinput modes - net: stmmac: Set CIC bit only for TX queues with COE - net: stmmac: xgmac: Correct supported speed modes - net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts - net/mlx5e: Set local Xoff after FW update - net/mlx5e: Update and set Xon/Xoff upon port speed set - net/mlx5e: Update and set Xon/Xoff upon MTU set - net/mlx5: Nack sync reset when SFs are present - net/mlx5: Convert SF port_indices xarray to function_ids xarray - net/mlx5: Use devlink port pointer to get the pointer of container SF struct - net/mlx5: Call mlx5_sf_id_erase() once in mlx5_sf_dealloc() - phy: mscc: Fix when PTP clock is register and unregister - net: dlink: fix multicast stats being counted incorrectly - dt-bindings: display/msm: qcom,mdp5: drop lut clock - drm/nouveau: remove unused memory target test - drm/nouveau: remove unused increment in gm200_flcn_pio_imem_wr - Bluetooth: hci_sync: fix set_local_name race condition - Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced - Bluetooth: hci_event: Mark connection as closed during suspend disconnect - Bluetooth: hci_event: Treat UNKNOWN_CONN_ID on disconnect as success - HID: input: report battery status changes immediately - HID: input: rename hidinput_set_battery_charge_status() - powerpc/kvm: Fix ifdef to remove build warning - drm/msm: Defer fd_install in SUBMIT ioctl - vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() - ACPI: EC: Add device to acpi_ec_no_wakeup[] qurik list - erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC - ASoC: codecs: tx-macro: correct tx_macro_component_drv name - smb: client: fix race with concurrent opens in unlink(2) - scsi: core: sysfs: Correct sysfs attributes access rights - of: dynamic: Fix use after free in of_changeset_add_prop_helper() - of: Add a helper to free property struct - mips: lantiq: xway: sysctrl: rename the etop node - mips: dts: lantiq: danube: add missing burst length property - pinctrl: STMFX: add missing HAS_IOMEM dependency - of: dynamic: Fix memleak when of_pci_add_properties() failed - !20684 urma: adjust urma log format - !20355 udp: Deal with race between UDP socket address change and rehash - !20627 Fixes CVE-2025-38627 - !20702 CVE-2025-39948 - !20701 netfilter: ctnetlink: remove refcounting in expectation dumpers - !20700 CVE-2025-38678 - !20703 CVE-2025-38491 - !20690 tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. - obmm: reduce log noise for successful export/import/preimport - mptcp: avoid deadlock on fallback while reinjecting - mptcp: plug races between subflow fail and subflow creation - mptcp: make fallback action and fallback decision atomic - ice: fix Rx page leak on multi-buffer frames - ice: fix incorrect counter for buffer allocation failures - ice: stop storing XDP verdict within ice_rx_buf - ice: gather page_count()'s of each frag right before XDP prog call - ice: Introduce ice_xdp_buff - netfilter: ctnetlink: remove refcounting in expectation dumpers - netfilter: nf_tables: reject duplicate device on updates - netfilter: nf_tables: Introduce functions freeing nft_hook objects - netfilter: nf_tables: Fix percpu address space issues in nf_tables_api.c - err.h: add ERR_PTR_PCPU(), PTR_ERR_PCPU() and IS_ERR_PCPU() macros - tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. - !20498 Fix CVE-2025-71118 - !20608 pmdomain: arm: scmi: Fix genpd leak on provider registration failure - !20679 x86/CPU/AMD: Add RDSEED fix for Zen5 - !20650 fix cve-2025-40300 - !20661 Input: alps - fix use-after-free bugs caused by dev3_register_work - !20664 backport some net bugfix from 6.6 lts - urma: adjust urma log format - !20678 ub: udma: close debug switch load parameters. - ub: udma: close debug switch load parameters. - x86/CPU/AMD: Add RDSEED fix for Zen5 - !20630 net: LTS-6.6 bugfix backport - !20632 net/sched: sch_qfq: do not free existing class in qfq_change_class() - !20631 macvlan: fix possible UAF in macvlan_forward_source() - !20628 Fix CVE-2025-39910 - !20659 v2 Fix CVE-2025-22090 - !20506 XSched: Update XSched manual - !20647 media: imon: make send_packet() more robust - !20646 ksm: use range-walk function to jump over holes in scan_get_next_rmap_item - !20645 fbcon: Set fb_display[i - !20648 parse_longname(): strrchr() expects NUL-terminated string - !20621 urma: modify log level - !20602 urma: fix the jfe uaf issue that occurred during the killall process. - !20567 urma:change log level and pass status 9 - !20640 iio: common: st_sensors: Fix use of uninitialize device structs - !20634 usb: gadget: udc: fix use-after-free in usb_gadget_state_work - !20633 net: dsa: properly keep track of conduit reference - !20635 fix CVE-2025-68231 - !20651 mm/slub: avoid accessing metadata when pointer is invalid in object_err() - !20649 drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb - !20652 mm/vmalloc: fix data race in show_numa_info() - x86: uaccess: don't use runtime-const rewriting in modules - x86: fix off-by-one in access_ok() - x86: fix user address masking non-canonical speculation issue - x86/uaccess: Zero the 8-byte get_range case on failure on 32-bit - x86/uaccess: Improve the 8-byte getuser() case - x86: fix whitespace in runtime-const assembler output - dcache: keep dentry_hashtable or d_hash_shift even when not used - runtime constants: add x86 architecture support - runtime constants: deal with old decrepit linkers - x86/uaccess: Add missing __force to casts in __access_ok() and valid_user_address() - !20345 arm64: entry: xcall/xint: make asm conditionals compatible with clang IAS - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). - libceph: replace BUG_ON with bounds check for map->max_osd - libceph: prevent potential out-of-bounds writes in handle_auth_session_key() - libceph: fix potential use-after-free in have_mon_and_osd_map() - sctp: Hold sock lock while iterating over address list - sctp: Prevent TOCTOU out-of-bounds write - sctp: Hold RCU read lock while iterating over address list - tipc: Fix use-after-free in tipc_mon_reinit_self(). - sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto - sctp: avoid NULL dereference when chunk data buffer is missing - bpf: Explicitly check accesses to bpf_sock_addr - ipvs: Defer ip_vs_ftp unregister during netns cleanup - nexthop: Forbid FDB status change while nexthop is in a group - netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). - net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer - sctp: initialize more fields in sctp_v6_from_sk() - pNFS: Fix a deadlock when returning a delegation during open() - Input: alps - fix use-after-free bugs caused by dev3_register_work - x86/cpu: Get CPU LLC ID from CPUID 0x8000001d in guest for Hygon processors - kernel/fork: only call untrack_pfn_clear() on VMAs duplicated for fork() - mm: (un)track_pfn_copy() fix + doc improvements - x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range() - !20642 mtdchar: fix integer overflow in read/write ioctls - mm/vmalloc: fix data race in show_numa_info() - mm/slub: avoid accessing metadata when pointer is invalid in object_err() - config: enable CONFIG_MITIGATION_VMESCAPE by default on x86 - x86/vmscape: Enable the mitigation - x86/vmscape: Enumerate VMSCAPE bug - x86/vmscape: Add conditional IBPB mitigation - drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb - parse_longname(): strrchr() expects NUL-terminated string - media: imon: make send_packet() more robust - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item - fbcon: Set fb_display[i]->mode to NULL when the mode is released - !20569 CVE-2024-35808 - mtdchar: fix integer overflow in read/write ioctls - !20619 Fix CVE-2026-22991 - !20612 net: hns3: extend HCLGE_FD_AD_COUNTER_NUM to 8 bits - LoongArch: Add more instruction opcodes and emit_* helpers - iio: common: st_sensors: Fix use of uninitialize device structs - !20581 null_blk: fix kmemleak by releasing references to fault configfs items - mm/mempool: fix poisoning order>0 pages with HIGHMEM - mm/page_poison: replace kmap_atomic() with kmap_local_page() - mm/mempool: replace kmap_atomic() with kmap_local_page() - usb: gadget: udc: fix use-after-free in usb_gadget_state_work - net: dsa: properly keep track of conduit reference - net/sched: sch_qfq: do not free existing class in qfq_change_class() - macvlan: fix possible UAF in macvlan_forward_source() - netfilter: nft_objref: validate objref and objrefmap expressions - arp: do not assume dev_hard_header() does not change skb->head - ip6_gre: make ip6gre_header() robust - netfilter: nf_tables: avoid chain re-validation if possible - netfilter: nf_tables: drop unused 3rd argument from validate callback ops - Revert "netfilter: nft_objref: validate objref and objrefmap expressions" - bpf: Fix reference count leak in bpf_prog_test_run_xdp() - net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset - ethtool: Avoid overflowing userspace buffer on stats query - ipvs: fix ipv4 null-ptr-deref in route error path - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() - !20596 mm/page_alloc: prevent pcp corruption with SMP=n - !20598 team: fix check for port enabled in team_queue_override_port_prio_changed() - !18823 hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio - mm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc() - kasan: avoid sleepable page allocation from atomic context - f2fs: compress: fix UAF of f2fs_inode_info in f2fs_free_dic - f2fs: compress: change the first parameter of page_array_{alloc,free} to sbi - !20583 [OLK-6.6][linux-6.6.y sync] Backport 6.6.102-6.6.103 LTS Patches - !20460 fbdev: Fix vmalloc out-of-bounds write in fast_imageblit - urma:fix log level and pass status 9 - urma: modify log level - !20592 CVE-2025-71141 fixup - !20594 CVE-2025-39744 fixup - !20607 powerpc/64s/slb: Fix SLB multihit issue during SLB preload - !20606 mm/huge_memory: fix NULL pointer deference when splitting folio - !20604 Fix CVE-2026-22984 - !20603 Fix CVE-2026-23021 - !20600 Fix CVE-2026-22990 - urma: fix the jfe uaf issue that occurred during the killall process. - !20380 pswiotlb: Adapt to the IOMMU DMA API upgraded by IOMMUFD - libceph: make free_choose_arg_map() resilient to partial allocation - drm/dp: Change AUX DPCD probe address from LANE0_1_STATUS to TRAINING_PATTERN_SET - net: hns3: extend HCLGE_FD_AD_COUNTER_NUM to 8 bits - net: hns3: extend HCLGE_FD_AD_QID to 11 bits - net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue - net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M - Revert "net: hns3: add support for FD counter" - !20587 dmaengine: stm32: dmamux: fix device leak on route allocation - pmdomain: arm: scmi: Fix genpd leak on provider registration failure - powerpc/64s/slb: Fix SLB multihit issue during SLB preload - mm/huge_memory: fix NULL pointer deference when splitting folio - !20562 LoongArch: BPF: Sign extend kfunc call arguments - !20470 ipv4: Fix reference count leak when using error routes with nexthop objects - !20471 net: sock: fix hardened usercopy panic in sock_recv_errqueue - !20472 net: fix memory leak in skb_segment_list for GRO packets - !20473 ipv4: ip_gre: make ipgre_header() robust - !20469 SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf - !20476 ipv6: Fix use-after-free in inet6_addr_del(). - !20477 svcrdma: bound check rq_pages index in inline path - !20578 ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() - !20579 fix CVE-2025-68768 - !20542 Fix NFS deadlock - USB: storage: Remove subclass and protocol overrides from Novatek quirk - cpuidle: governors: menu: Select polling state in some more cases - cpuidle: governors: menu: Rearrange main loop in menu_select() - cpuidle: menu: Update documentation after previous changes - Revert "drm/tegra: dsi: Clear enable register if powered by bootloader" - parisc: Remove spurious if statement from raw_copy_from_user() - ata: libata-scsi: Fix system suspend for a security locked drive - Revert "drm/amdgpu: fix incorrect vm flags to map bo" - mfd: axp20x: Set explicit ID for regulator cell if no IRQ line is present - drm/amd/display: use udelay rather than fsleep - sched/fair: Revert max_newidle_lb_cost bump - net: ipv4: fix regression in local-broadcast routes - tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers - PM: runtime: Do not clear needs_force_resume with enabled runtime PM - usb: typec: ucsi: psy: Set max current to zero when disconnected - io_uring/rw: cast rw->flags assignment to rwf_t - Documentation: ACPI: i2c-muxes: fix I2C device references - s390/hypfs: Enable limited access during lockdown - s390/hypfs: Avoid unnecessary ioctl registration in debugfs - ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation - net/mlx5e: Preserve shared buffer capacity during headroom updates - net/mlx5: Base ECVF devlink port attrs from 0 - Octeontx2-af: Skip overlap check for SPI field - bonding: send LACPDUs periodically in passive mode after receiving partner's LACPDU - bonding: Add independent control state machine - bonding: update LACP activity flag after setting lacp_active - net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate - ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc - gve: prevent ethtool ops after shutdown - phy: mscc: Fix timestamping for vsc8584 - net: ethernet: mtk_ppe: add RCU lock around dev_fill_forward_path - ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add - net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM - ALSA: usb-audio: Fix size validation in convert_chmap_v3() - mlxsw: spectrum: Forward packets with an IPv4 link-local source IP - Bluetooth: hci_conn: do return error from hci_enhanced_setup_sync() - Bluetooth: hci_event: fix MTU for BN == 0 in CIS Established - scsi: qla4xxx: Prevent a potential error pointer dereference - RDMA/bnxt_re: Fix to initialize the PBL array - RDMA/bnxt_re: Fix to remove workload check in SRQ limit path - RDMA/bnxt_re: Fix to do SRQ armena by default - RDMA/erdma: Fix ignored return value of init_kernel_qp - iosys-map: Fix undefined behavior in iosys_map_clear() - cgroup/cpuset: Use static_branch_enable_cpuslocked() on cpusets_insane_config_key - spi: spi-fsl-lpspi: Clamp too high speed_hz - usb: typec: maxim_contaminant: disable low power mode when reading comparator values - usb: typec: maxim_contaminant: re-enable cc toggle if cc is open and port is clean - iio: imu: inv_icm42600: change invalid data error to -EBUSY - iio: imu: inv_icm42600: Convert to uXX and sXX integer types - iio: imu: inv_icm42600: use = { } instead of memset() - iio: imu: inv_icm42600: switch timestamp type from int64_t __aligned(8) to aligned_s64 - iio: temperature: maxim_thermocouple: use DMA-safe buffer for spi_read() - iio: light: as73211: Ensure buffer holes are zeroed - tls: fix handling of zero-length records on the rx_list - powerpc/boot: Fix build with gcc 15 - mmc: sdhci-pci-gli: GL9763e: Mask the replay timer timeout of AER - compiler: remove __ADDRESSABLE_ASM{_STR,}() again - drm/amd/display: Don't overclock DCE 6 by 15% - usb: dwc3: pci: add support for the Intel Wildcat Lake - usb: dwc3: Ignore late xferNotReady event to prevent halt timeout - USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles - usb: storage: realtek_cr: Use correct byte order for bcs->Residue - USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera - usb: renesas-xhci: Fix External ROM access timeouts - usb: core: hcd: fix accessing unmapped memory in SINGLE_STEP_SET_FEATURE test - comedi: Make insn_rw_emulate_bits() do insn->n samples - usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive - cdx: Fix off-by-one error in cdx_rpmsg_probe() - most: core: Drop device reference after usage in get_channel() - iio: proximity: isl29501: fix buffered read on big-endian systems - iio: pressure: bmp280: Use IS_ERR() in bmp280_common_probe() - fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable() - drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS - cpuidle: governors: menu: Avoid selecting states with too much latency - cpuidle: menu: Remove iowait influence - mmc: sdhci-pci-gli: Add a new function to simplify the code - mmc: sdhci-pci-gli: Use PCI AER definitions, not hard-coded values - mptcp: disable add_addr retransmission when timeout is 0 - mptcp: remove duplicate sk_reset_timer call - use uniform permission checks for all mount propagation changes - arm64: dts: ti: k3-am62-main: Remove eMMC High Speed DDR support - scsi: mpi3mr: Serialize admin queue BAR writes on 32-bit systems - scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers - scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE - PCI: imx6: Add IMX8MM_EP and IMX8MP_EP fixed 256-byte BAR 4 in epc_features - PCI: imx6: Delay link start until configfs 'start' written - PCI: rockchip: Set Target Link Speed to 5.0 GT/s before retraining - PCI: rockchip: Use standard PCIe definitions - drm/amd/display: Fill display clock and vblank time in dce110_fill_display_configs - drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs - drm/amd/display: Fix DP audio DTO1 clock source on DCE 6. - drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3 - ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and EliteBook 830 G6 - mm/debug_vm_pgtable: clear page table entries at destroy_args() - squashfs: fix memory leak in squashfs_fill_super - mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for consistency - memstick: Fix deadlock by moving removing flag earlier - KVM: arm64: Fix kernel BUG() due to bad backport of FPSIMD/SVE/SME fix - sched/fair: Fix frequency selection for non-invariant case - kbuild: userprogs: use correct linker when mixing clang and GNU ld - ata: libata-scsi: Return aborted command when missing sense and result TF - PM: runtime: Take active children into account in pm_runtime_get_if_in_use() - PM: runtime: Simplify pm_runtime_get_if_active() usage - ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig - usb: dwc3: imx8mp: fix device leak at unbind - wifi: mac80211: check basic rates validity in sta_link_apply_parameters - KVM: x86: Take irqfds.lock when adding/deleting IRQ bypass producer - s390/mm: Remove possible false-positive warning in pte_free_defer() - btrfs: send: make fs_path_len() inline and constify its argument - btrfs: send: use fallocate for hole punching with send stream v2 - btrfs: send: avoid path allocation for the current inode when issuing commands - btrfs: send: keep the current inode's path cached - btrfs: send: add and use helper to rename current inode when processing refs - btrfs: send: only use boolean variables at process_recorded_refs() - btrfs: send: factor out common logic when sending xattrs - btrfs: populate otime when logging an inode item - btrfs: constify more pointer parameters - btrfs: fix ssd_spread overallocation - btrfs: open code timespec64 in struct btrfs_inode - xfs: fully decouple XFS_IBULK* flags from XFS_IWALK* flags - btrfs: abort transaction on unexpected eb generation at btrfs_copy_root() - btrfs: always abort transaction on failure to add block group to free space tree - btrfs: move transaction aborts to the error site in add_block_group_free_space() - btrfs: qgroup: fix race between quota disable and quota rescan ioctl - usb: typec: fusb302: cache PD RX state - block: Make REQ_OP_ZONE_FINISH a write operation - block: reject invalid operation in submit_bio_noacct - leds: flash: leds-qcom-flash: Fix registry access after re-bind - leds: flash: leds-qcom-flash: Limit LED current based on thermal condition - selftests/memfd: add test for mapping write-sealed memfd read-only - mm: update memfd seal write check to include F_SEAL_WRITE - mptcp: pm: kernel: flush: do not reset ADD_ADDR limit - mptcp: drop skb if MPTCP skb extension allocation fails - ipv6: sr: Fix MAC comparison to be constant-time - drm/amd/display: Don't overwrite dce60_clk_mgr - drm/amd/display: Add primary plane to commits for correct VRR handling - drm/amdkfd: Destroy KFD debugfs after destroy KFD wq - drm/amdgpu: update mmhub 3.0.1 client id mappings - drm/amdgpu: Avoid extra evict-restore process. - drm/amd: Restore cached power limit during resume - media: venus: venc: Clamp param smaller than 1fps and bigger than 240 - media: venus: vdec: Clamp param smaller than 1fps and bigger than 240. - media: venus: protect against spurious interrupts during probe - media: venus: hfi: explicitly release IRQ during teardown - media: qcom: camss: cleanup media device allocated resource on error path - media: ov2659: Fix memory leaks in ov2659_probe() - media: usbtv: Lock resolution while streaming - media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free() - media: verisilicon: Fix AV1 decoder clock frequency - media: vivid: fix wrong pixel_array control size - media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init() - media: hi556: correct the test pattern configuration - media: gspca: Add bounds checking to firmware parser - parisc: Update comments in make_insert_tlb - parisc: Try to fixup kernel exception in bad_area_nosemaphore path of do_page_fault() - parisc: Rename pte_needs_flush() to pte_needs_cache_flush() in cache.c - parisc: Makefile: explain that 64BIT requires both 32-bit and 64-bit compilers - parisc: Define and use set_pte_at() - parisc: Check region is readable by user in raw_copy_from_user() - soc/tegra: pmc: Ensure power-domains are in a known state - f2fs: fix to avoid out-of-boundary access in dnode page - phy: qcom: phy-qcom-m31: Update IPQ5332 M31 USB phy initialization sequence - vhost/vsock: Avoid allocating arbitrarily-sized SKBs - PCI: endpoint: Fix configfs group removal on driver teardown - PCI: endpoint: Fix configfs group list head handling - mtd: rawnand: renesas: Add missing check after DMA map - mtd: rawnand: fsmc: Add missing check after DMA map - mtd: spinand: propagate spinand_wait() errors from spinand_write_page() - mtd: spi-nor: Fix spi_nor_try_unlock_all() - hwmon: (gsc-hwmon) fix fan pwm setpoint show functions - pwm: mediatek: Fix duty and period setting - pwm: mediatek: Handle hardware enable and clock enable separately - pwm: imx-tpm: Reset counter if CMOD is 0 - wifi: ath11k: fix dest ring-buffer corruption when ring is full - wifi: ath11k: fix source ring-buffer corruption - wifi: ath11k: fix dest ring-buffer corruption - wifi: ath12k: fix dest ring-buffer corruption when ring is full - wifi: ath12k: fix source ring-buffer corruption - wifi: ath12k: fix dest ring-buffer corruption - wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table() - iio: adc: ad_sigma_delta: change to buffer predisable - zynq_fpga: use sgtable-based scatterlist wrappers - scsi: ufs: ufs-pci: Fix default runtime and system PM levels - scsi: ufs: ufs-pci: Fix hibernate state transition for Intel MTL-like host controllers - ata: libata-scsi: Fix ata_to_sense_error() status handling - scsi: mpi3mr: Fix race between config read submit and interrupt completion - dt-bindings: display: sprd,sharkl3-dsi-host: Fix missing clocks constraints - dt-bindings: display: sprd,sharkl3-dpu: Fix missing clocks constraints - arm64: dts: ti: k3-am62-verdin: Enable pull-ups on I2C buses - arm64: dts: ti: k3-am62a7-sk: fix pinmux for main_uart1 - arm64: dts: ti: k3-pinctrl: Enable Schmitt Trigger by default - btrfs: zoned: fix write time activation failure for metadata block group - ext4: fix hole length calculation overflow in non-extent inodes - ext4: don't try to clear the orphan_present feature block device is r/o - ext4: fix reserved gdt blocks handling in fsmap - ext4: fix fsmap end of range reporting with bigalloc - ext4: check fast symlink for ea_inode correctly - tracing: fprobe-event: Sanitize wildcard for fprobe event name - crypto: qat - lower priority for skcipher and aead algorithms - lib/crypto: mips/chacha: Fix clang build and remove unneeded byteswap - vt: defkeymap: Map keycodes above 127 to K_HOLE - vt: keyboard: Don't process Unicode characters in K_OFF mode - bus: mhi: host: Fix endianness of BHI vector table - usb: dwc3: meson-g12a: fix device leaks at unbind - usb: musb: omap2430: fix device leak at unbind - usb: gadget: udc: renesas_usb3: fix device leak at unbind - usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init() - m68k: Fix lost column on framebuffer debug console - platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister() - cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table() - rcu: Fix racy re-initialization of irq_work causing hangs - HID: apple: avoid setting up battery timer for devices without battery - HID: magicmouse: avoid setting up battery timer when not needed - RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages - tools/nolibc: fix spelling of FD_SETBITMASK in FD_* macros - media: uvcvideo: Do not mark valid metadata as invalid - media: venus: Fix OOB read due to missing payload bound check - parisc: Makefile: fix a typo in palo.conf - fbdev: Fix vmalloc out-of-bounds write in fast_imageblit - btrfs: do not allow relocation of partially dropped subvolumes - btrfs: zoned: do not select metadata BG as finish target - btrfs: clear dirty status from extent buffer on error at insert_new_root() - btrfs: zoned: do not remove unwritten non-data block group - btrfs: abort transaction during log replay if walk_log_tree() failed - btrfs: zoned: use filesystem size not disk size for reclaim decision - cdc-acm: fix race between initial clearing halt and open - thunderbolt: Fix copy+paste error in match_service_id() - usb: typec: ucsi: Update power_supply on power role change - misc: rtsx: usb: Ensure mmc child device is active when card is present - iommufd: Report unmapped bytes in the error path of iopt_unmap_iova_range - cifs: reset iface weights when we cannot find a candidate - drm/amdgpu: fix incorrect vm flags to map bo - scsi: lpfc: Remove redundant assignment to avoid memory leak - rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe - pNFS: Handle RPC size limit for layoutcommits - pNFS: Fix disk addr range check in block/scsi layout - pNFS: Fix stripe mapping in block/scsi layout - ASoC: Intel: avs: Fix uninitialized pointer error in probe() - net: phy: smsc: add proper reset flags for LAN8710A - ipmi: Fix strcpy source and destination the same - kconfig: lxdialog: fix 'space' to (de)select options - kconfig: gconf: fix potential memory leak in renderer_edited() - kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed() - ipmi: Use dev_warn_ratelimited() for incorrect message warnings - vfio/mlx5: fix possible overflow in tracking max message size - scsi: aacraid: Stop using PCI_IRQ_AFFINITY - scsi: target: core: Generate correct identifiers for PR OUT transport IDs - scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans - kconfig: nconf: Ensure null termination where strncpy is used - vfio/type1: conditional rescheduling while pinning - kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c - f2fs: check the generic conditions first - exfat: add cluster chain loop check for dir - i2c: Force DLL0945 touchpad i2c freq to 100khz - apparmor: use the condition in AA_BUG_FMT even with debug disabled - dm-table: fix checking for rq stackable devices - dm-mpath: don't print the "loaded" message if registering fails - i3c: master: Initialize ret in i3c_i2c_notifier_call() - i3c: don't fail if GETHDRCAP is unsupported - apparmor: shift ouid when mediating hard links in userns - rtc: ds1307: handle oscillator stop flag (OSF) for ds1341 - i3c: add missing include to internal header - module: Prevent silent truncation of module name in delete_module(2) - md: dm-zoned-target: Initialize return variable r to avoid uninitialized use - soundwire: Move handle_nested_irq outside of sdw_dev_lock - soundwire: amd: serialize amd manager resume sequence during pm_prepare - crypto: octeontx2 - add timeout for load_fvc completion poll - media: uvcvideo: Fix bandwidth issue for Alcor camera - media: usb: hdpvr: disable zero-length read messages - media: tc358743: Increase FIFO trigger level to 374 - media: tc358743: Return an appropriate colorspace from tc358743_set_fmt - media: tc358743: Check I2C succeeded during probe - pinctrl: stm32: Manage irq affinity settings - scsi: mpi3mr: Correctly handle ATA device errors - scsi: mpt3sas: Correctly handle ATA device errors - power: supply: qcom_battmgr: Add lithium-polymer entry - RDMA/core: reduce stack using in nldev_stat_get_doit() - dmaengine: stm32-dma: configure next sg only if there are more than 2 sgs - leds: leds-lp50xx: Handle reg to get correct multi_index - media: v4l2-common: Reduce warnings about missing V4L2_CID_LINK_FREQ control - MIPS: lantiq: falcon: sysctrl: fix request memory check logic - crypto: jitter - fix intermediary handling - watchdog: iTCO_wdt: Report error if timeout configuration fails - MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free} - clk: qcom: ipq5018: keep XO clock always on - hwmon: (emc2305) Set initial PWM minimum value during probe based on thermal state - watchdog: dw_wdt: Fix default timeout - fs/orangefs: use snprintf() instead of sprintf() - phy: rockchip-pcie: Properly disable TEST_WRITE strobe signal - mfd: axp20x: Set explicit ID for AXP313 regulator - clk: tegra: periph: Fix error handling and resolve unsigned compare warning - fbdev: fix potential buffer overflow in do_register_framebuffer() - cifs: Fix calling CIFSFindFirst() for root path without msearch - watchdog: sbsa: Adjust keepalive timeout to avoid MediaTek WS0 race condition - drm/amd/display: Avoid configuring PSR granularity if PSR-SU not supported - drm/amd/display: Only finalize atomic_obj if it was initialized - vhost: fail early when __vhost_add_used() fails - vsock/virtio: Resize receive buffers so that each SKB fits in a 4K page - net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325 - rcu: Fix rcu_read_unlock() deadloop due to IRQ work - drm/amd/display: Avoid trying AUX transactions on disconnected ports - selftests/bpf: Fix a user_ringbuf failure with arm64 64KB page size - bpf: Make reg_not_null() true for CONST_PTR_TO_MAP - uapi: in6: restore visibility of most IPv6 socket options - drm/ttm: Should to return the evict error - drm: renesas: rz-du: mipi_dsi: Add min check for VCLK range - net: ncsi: Fix buffer overflow in fetching version id - ionic: clean dbpage in de-init - wifi: rtlwifi: fix possible skb memory leak in _rtl_pci_init_one_rxdesc() - ptp: Use ratelimite for freerun error message - bpftool: Fix JSON writer resource leak in version command - net: dsa: b53: prevent SWITCH_CTRL access on BCM5325 - net: dsa: b53: prevent DIS_LEARNING access on BCM5325 - net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325 - net: dsa: b53: fix b53_imp_vlan_setup for BCM5325 - gve: Return error for unknown admin queue command - net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs - net: vlan: Make is_vlan_dev() a stub when VLAN is not configured - drm/amd: Allow printing VanGogh OD SCLK levels without setting dpm to manual - dpaa_eth: don't use fixed_phy_change_carrier - wifi: iwlegacy: Check rate_idx range after addition - netmem: fix skb_frag_address_safe with unreadable skbs - powerpc: floppy: Add missing checks after DMA map - wifi: ath12k: Decrement TID on RX peer frag setup error handling - wifi: ath12k: Enable REO queue lookup table feature on QCN9274 hw2.0 - wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`. - wifi: mac80211: update radar_required in channel context after channel switch - drm/amd/display: Fix 'failed to blank crtc!' - wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect - wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd() - wifi: ath12k: Add memset and update default rate value in wmi tx completion - drm/amd/display: Separate set_gsl from set_gsl_source_select - net: fec: allow disable coalescing - net: atlantic: add set_power to fw_ops for atl2 to fix wol - net: thunderbolt: Fix the parameter passing of tb_xdomain_enable_paths()/tb_xdomain_disable_paths() - net: thunderbolt: Enable end-to-end flow control also in transmit - kselftest/arm64: Specify SVE data when testing VL set in sve-ptrace - wifi: mt76: mt7915: mcu: re-init MCU before loading FW patch - wifi: rtw89: Disable deep power saving for USB/SDIO - wifi: rtw89: Fix rtw89_mac_power_switch() for USB - drm/msm: use trylock for debugfs - wifi: mac80211: fix rx link assignment for non-MLO stations - ipv6: mcast: Check inet6_dev->dead under idev->mc_lock in __ipv6_dev_mc_inc(). - (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer - wifi: mac80211: don't complete management TX on SAE commit - sched/fair: Bump sd->max_newidle_lb_cost when newidle balance fails - s390/stp: Remove udelay from stp_sync_clock() - wifi: iwlwifi: mvm: fix scan request validation - um: Re-evaluate thread flags repeatedly - wifi: iwlwifi: mvm: set gtk id also in older FWs - perf/cxlpmu: Remove unintended newline from IRQ name format string - net: phy: micrel: Add ksz9131_resume() - net: thunderx: Fix format-truncation warning in bgx_acpi_match_id() - net: ipv4: fix incorrect MTU in broadcast routes - wifi: cfg80211: Fix interface type validation - net: mctp: Prevent duplicate binds - arm64: Mark kernel as tainted on SAE and SError panic - net/mlx5e: Properly access RCU protected qdisc_sleeping variable - net: ag71xx: Add missing check after DMA map - et131x: Add missing check after DMA map - wifi: rtw89: Lower the timeout in rtw89_fw_read_c2h_reg() for USB - be2net: Use correct byte order and format string for TCP seq and ack_seq - s390/time: Use monotonic clock in get_cycles() - wifi: cfg80211: reject HTC bit for management frames - ktest.pl: Prevent recursion of default variable options - wifi: ath12k: Correct tid cleanup when tid setup fails - net: usb: cdc-ncm: check for filtering capability - xen/netfront: Fix TX response spurious interrupts - Bluetooth: hci_sock: Reset cookie to zero in hci_sock_free_cookie() - powerpc/thp: tracing: Hide hugepage events under CONFIG_PPC_BOOK3S_64 - ASoC: qcom: use drvdata instead of component to keep id - ASoC: codecs: rt5640: Retry DEVICE_ID verification - iio: adc: ad7768-1: Ensure SYNC_IN pulse minimum timing requirement - ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros - ALSA: pcm: Rewrite recalculate_boundary() to avoid costly loop - platform/chrome: cros_ec_typec: Defer probe on missing EC parent - platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches - soc: qcom: mdt_loader: Actually use the e_phoff - imx8m-blk-ctrl: set ISI panic write hurry level - pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop() - usb: core: usb_submit_urb: downgrade type check - usb: typec: intel_pmc_mux: Defer probe if SCU IPC isn't present - ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4 - ASoC: hdac_hdmi: Rate limit logging on connection and disconnection - ALSA: hda: Disable jack polling at shutdown - ALSA: hda: Handle the jack polling always via a work - mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode() - mei: bus: Check for still connected devices in mei_cl_bus_dev_release() - char: misc: Fix improper and inaccurate error code returned by misc_init() - reset: brcmstb: Enable reset drivers for ARCH_BCM2835 - pps: clients: gpio: fix interrupt handling order in remove path - ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path - mmc: sdhci-msm: Ensure SD card power isn't ON when card removed - ACPI: processor: fix acpi_object initialization - PM: sleep: console: Fix the black screen issue - thermal: sysfs: Return ENODATA instead of EAGAIN for reads - PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit() - firmware: tegra: Fix IVC dependency problems - ACPI: PRM: Reduce unnecessary printing to avoid user confusion - selftests: tracing: Use mutex_unlock for testing glob filter - tools/build: Fix s390(x) cross-compilation with clang - gpio: tps65912: check the return value of regmap_update_bits() - iio: adc: ad_sigma_delta: don't overallocate scan buffer - tools/nolibc: define time_t in terms of __kernel_old_time_t - thermal/drivers/qcom-spmi-temp-alarm: Enable stage 2 shutdown when required - ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed - EDAC/synopsys: Clear the ECC counters on init - gpio: wcd934x: check the return value of regmap_update_bits() - remoteproc: imx_rproc: skip clock enable when M-core is managed by the SCU - soc: qcom: rpmh-rsc: Add RSC version 4 support - usb: xhci: Avoid showing errors during surprise removal - usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command - usb: xhci: Avoid showing warnings for dying controller - usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default - selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t - cpufreq: CPPC: Mark driver with NEED_UPDATE_LIMITS flag - platform/x86/amd: pmc: Add Lenovo Yoga 6 13ALC6 to pmc quirk list - usb: xhci: print xhci->xhc_state when queue_command failed - tracefs: Add d_delete to remove negative dentries - securityfs: don't pin dentries twice, once is enough... - fix locking in efi_secret_unlink() - ext2: Handle fiemap on empty files to prevent EINVAL - fs/ntfs3: correctly create symlink for relative path - fs/ntfs3: Add sanity check for file name - better lockdep annotations for simple_recursive_removal() - hfs: fix not erasing deleted b-tree node issue - drbd: add missing kref_get in handle_write_conflicts - udf: Verify partition map count - gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops - nvme-pci: try function level reset on init failure - smb/server: avoid deadlock when linking with ReplaceIfExists - arm64: Handle KCOV __init vs inline mismatches - ptp: prevent possible ABBA deadlock in ptp_clock_freerun() - intel_idle: Allow loading ACPI tables for any family - net: ti: icss-iep: Fix incorrect type for return value in extts_enable() - netfilter: ctnetlink: fix refcount leak on table dump - udp: also consider secpath when evaluating ipsec use for checksumming - KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs - KVM: nVMX: Check vmcs12->guest_ia32_debugctl on nested VM-Enter - KVM: VMX: Extract checking of guest's DEBUGCTL into helper - KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported - KVM: VMX: Handle forced exit due to preemption timer in fastpath - KVM: VMX: Re-enter guest in fastpath for "spurious" preemption timer exits - KVM: x86: Plumb "force_immediate_exit" into kvm_entry() tracepoint - libceph: prevent potential out-of-bounds reads in handle_auth_done() - net: usb: pegasus: fix memory leak in update_eth_regs_async() - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() - !20540 urma: added support for ipoverurma - team: fix check for port enabled in team_queue_override_port_prio_changed() - mm/page_alloc: prevent pcp corruption with SMP=n - !20528 Fix CVE-2025-71083 - KVM: nVMX: Defer SVI update to vmcs01 on EOI when L2 is active w/o VID - KVM: x86: Plumb in the vCPU to kvm_x86_ops.hwapic_isr_update() - KVM: SVM: Set RFLAGS.IF=1 in C code, to get VMRUN out of the STI shadow - smb: client: don't wait for info->send_pending == 0 on error - smb: client: let send_done() cleanup before calling smbd_disconnect_rdma_connection() - ACPI: processor: perflib: Move problematic pr->performance check - ACPI: processor: perflib: Fix initial _PPC limit application - Documentation: ACPI: Fix parent device references - fs: Prevent file descriptor table allocations exceeding INT_MAX - sunvdc: Balance device refcount in vdc_port_mpgroup_check - PCI: Extend isolated function probing to LoongArch - NFSD: detect mismatch of file handle and delegation stateid in OPEN op - net: dpaa: fix device leak when querying time stamp info - net: ti: icss-iep: fix device and OF node leaks at probe - net: mtk_eth_soc: fix device leak at probe - net: enetc: fix device and OF node leak at probe - net: gianfar: fix device leak when querying time stamp info - net: phy: micrel: fix KSZ8081/KSZ8091 cable test - gpio: mlxbf3: use platform_get_irq_optional() - gpio: mlxbf2: use platform_get_irq_optional() - gpio: virtio: Fix config space reading. - ALSA: hda/realtek: Add Framework Laptop 13 (AMD Ryzen AI 300) to quirks - ALSA: hda/realtek: Fix headset mic on HONOR BRB-X - ALSA: usb-audio: Validate UAC3 cluster segment descriptors - rcu: Fix racy re-initialization of irq_work causing hangs - rcu: Fix rcu_read_unlock() deadloop due to IRQ work - drm/tilcdc: Fix removal actions in case of failed probe - drm/tilcdc: request and mapp iomem with devres - urma: fix update topo logic - dmaengine: stm32: dmamux: fix device leak on route allocation - pswiotlb: Adapt to the IOMMU DMA API upgraded by IOMMUFD - null_blk: fix kmemleak by releasing references to fault configfs items - inet: frags: flush pending skbs in fqdir_pre_exit() - inet: frags: add inet_frag_queue_flush() - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() - md/dm-raid: don't clear MD_RECOVERY_FROZEN after setting frozen - md/dm-raid: don't call md_reap_sync_thread() directly - ACPICA: Avoid walking the Namespace if start_node is NULL - arm64: entry: xcall/xint: make asm conditionals compatible with clang IAS - LoongArch: BPF: Sign extend kfunc call arguments - genirq/msi:: Fix kabi break of struct msi_desc - genirq/msi: Store the IOMMU IOVA directly in msi_desc instead of iommu_cookie - NFS: Fix a deadlock involving nfs_release_folio() - Revert "[Huawei] Revert "NFS: fix up nfs_release_folio() to try to release the page"" - urma: added support for ipoverurma - drm/ttm: Avoid NULL pointer deref for evicted BOs - XSched: Update XSched manual - svcrdma: bound check rq_pages index in inline path - ipv6: Fix use-after-free in inet6_addr_del(). - ipv4: ip_gre: make ipgre_header() robust - net: fix memory leak in skb_segment_list for GRO packets - net: sock: fix hardened usercopy panic in sock_recv_errqueue - ipv4: Fix reference count leak when using error routes with nexthop objects - SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf - fbdev: Fix vmalloc out-of-bounds write in fast_imageblit - udp: Deal with race between UDP socket address change and rehash - EDAC/amd64: The width of hash value is 2 bits for Hygon family 18h model 6h processors - x86/tsc: Use topology_max_packages() to get package number - EDAC/amd64: Use unicast instead of broadcast to access the cs_config register - EDAC/amd64: Correct the address translation for hygon family 18h model 4h - KVM: arm64: Mark some header functions as inline - KVM: arm64: Refactor exit handlers - x86/resctrl: Fix memory bandwidth counter width for Hygon CPUs - hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio - !20820 ub/obmm: add sysfs interface for mempool statistics & bugfixes - ub/obmm: fix wrong pxm_numa parameter validation - ub/obmm: Remove unused parameters from obmm_addr_check.c - ub/obmm: Enhance mem_allocator_granu validation - ub/obmm: simplify allocator naming scheme - ub/obmm: fix allow_slow logic and optimize conti_alloc_memory - ub/obmm: add sysfs interface with fine-grained memory statistics - !20804 net: hv_netvsc: reject RSS hash key programming without RX indirection table - !20813 migrate: correct lock ordering for hugetlb file folios - !20812 libceph: make calc_target() set t->paused, not just clear it - !20719 drivers/ub/sentry: some bugfix - !20798 urma: log should not retrieve eid_idx from uctx - !20808 urma: support triple bonding device - urma: log should not retrieve eid_idx from uctx - migrate: correct lock ordering for hugetlb file folios - libceph: make calc_target() set t->paused, not just clear it - !20745 vfio platform VFIO support for hisi05a1 devices - urma: support triple bonding device - net: hv_netvsc: reject RSS hash key programming without RX indirection table - !20789 gic: Add hip09 support for HISILICON_ERRATUM_165010801 - !20726 tracing: Add recursion protection in kernel stack trace recording - !20668 irqchip/gic-v3-its: Avoid truncating memory addresses - !20795 ub: udma: support query and set qos info. - !20791 Migration/urma:optimize performance in live migration. - ub: udma: Support for UE link establishment message. - Migration/urma: optimize performance in live migration. - !20787 ub: cdma: modify the method of assigning values to the structure - !20759 ubcore: hotfix route query for port eid on the same node. - ub: udma: support query and set qos info. - Revert "ub: ubase: Support for RC saved by queue granularity" - ubcore: hotfix route query for port eid on the same node. - !20676 urma: set/get sl - !20765 urma: bugfix of UAF and double free in ubcm - !20778 ub: ubase&unic: Fixes some bugfix in resetting and dfx ability - gic: Add hip09 support for HISILICON_ERRATUM_165010801 - vfio/platform: Add CONFIG_VFIO_HISI05A1 to openeuler_defconfig and turn it on by default - vfio/platform: VFIO support for hisi05a1 devices - ub: cdma: modify the method of assigning values to the structure - urma: set/get sl - ub: ubase: support to query ub dl pkt stats and real-time peak bandwidth - ub: ubase: Support for RC saved by queue granularity - ub: ubase: Traverse mailbox AE events using interrupts and polling. - ub: ubase: Modify ubase ctrlq trace to distinguish between MUE and UE messages - net: unic: The function of dumping himac registers is added. - ub: ubase: Fix MAC is_pfc sync, optimize list ops and code style - ub: ubase: Retain the initial tm qset configuration and restore it - net: unic: Fixed an issue in the bond IP address notification and pause configuration when an exception occurs. - ub: ubase: Add a retransmission function to improve reliability. - net: unic: Increase the readability and reliability of loopback code - net: unic: Synchronize the code modify for ip management and deactivation - net: unic: Increase the readability and reliability of VLAN feature. - net: unic: Added unic DFX log information. - ub: ubase: Add and correct comments for some functions and data structures - net: unic: Notify MAMI when the bond port status changes - ub: ubase: Support for HIMAC reset during ELR reset and Optimize ELR reset - !20768 iommu/ummu-core: Fix separate page table compatibility - !20665 [OLK-6.6] Enhance CMA memory usage reporting for CSV3 - !20764 net: hns3: fix double free issue for tx spare buffer - urma: bugfix of UAF and double free in ubcm - iommu/ummu-core: Fix separate page table compatibility - net: hns3: fix double free issue for tx spare buffer - drivers/ub/sentry: fix memory leak in sentry_msg_helper - drivers/ub/sentry: initialize some variables - drivers/ub/sentry: fix potential buffer overflow in convert_str_to_smh_msg() - drivers/ub/sentry: fix potential null pointer reference in sentry_uvb_comm - drivers/ub/sentry: add input parameter verification for exported symbols - tracing: Add recursion protection in kernel stack trace recording - x86/csv: Enhance CMA memory usage reporting for CSV3 - irqchip/gic-v3-its: Avoid truncating memory addresses - change the package name of 64KB page size kernel to kernel-64k - !20704 kernel support hisi-cca-da - !20180 [virtCCA Live Migration 2]virtcca secure cvm supports live migration - !20905 v2 KVM: arm64: Fix softirq masking in FPSIMD register saving sequence - !20965 iommu/ummu: Optimized TID invalidation and tdev initialization - !20964 iommu/ummu: Support TID and EID Granularity for MPAM - !20970 ub: ubase&unic: Supporting the black box capability of the ubase&unic driver - hisi-cca-da: Start dev by rsi call - hisi-cca-da: Set ripas of the bar region as RIPAS_DEV - hisi-cca-da: Support swiotlb and realm memory use - hisi-cca-da: Add smmu info when dev attach - hisi-cca-da: Transfer realm msix access to rmm - hisi-cca-da: Support pcipc sriov capability - hisi-cca-da: Delay realm memory release to kvm_destroy_realm - hisi-cca-da: Create realm s2 host pgtable and map msi mmio to rmm - hisi-cca-da: Add cca realm s2 pgtable framework - hisi-cca-da: Use bitmap to determine whether the command can be forwarded - hisi-cca-da: Restrict Realm SMMU to stage-2 domain only - hisi-cca-da: Add cmd forward mechanism in realm smmu - hisi-cca-da: Add realm smmu event and gerror irq initialization - hisi-cca-da: Add realm smmu stream table initialization - hisi-cca-da: Add realm smmu cmdq and evtq initialization - hisi-cca-da: Add realm smmu initialization - hisi-cca-da: Add relam iommu support to iommufd - hisi-cca-da: Add realm iommu support for vfio-iommu-type1 - hisi-cca-da: Support dev map and unmap - hisi-cca-da: Support dev validate and dev start - hisi-cca-da: VFIO support ccada - hisi-cca-da: Support dev delegate and dev attach - hisi-cca-da: Support root dev delegate and dev init - hisi-cca-da: Add hisilicon extension smc and ccada cmd - hisi-cca-da: Add hisi ccada feature config - !20751 ARM CCA supports hugepage - !20944 ub: ubmempfd: supports for D2H mapping and demapping - !20888 HiSock Enhancement - ub: ubase&unic: Supporting the black box capability of the ubase&unic driver. - net: unic: Resolve the residual MAC address problem - net: unic: Optimized the code for the cmd structure and FEC function. - ub: ubase: add log for post mailbox timeout - ub: ubus: Remove black box header file to include dir - rme: Remove the secret bit of the vring desc addr - rme: improve hisi-cca data mmap and destroy method - !20943 uvb: fix wd_obtain logic err - !20942 urma: fix bond device id not release - !20892 dcache: Limit the minimal number of bucket to two - rme: isolate page when do delegation to avoid migration - rme: hisi-cca supports different levels for mapping ram - rme: rename ccal to hisi-cca - rme: support set ripas for ccal realm vm - rme: support destroy ram data for ccal realm vm - rme: support populate region for ccal realm vm - rme: support map ram for ccal realm vm - rme: support config ccal realm vm - rme: support ccal RMI calls - rme: realm vm supports wfx handler - !20952 urma: introduce ipourma module - iommu/ummu-core: Simplifies tdev initialization resources - iommu/ummu: Optimized log printing - iommu/ummu: Use passed gfp_mask in map_pages callback - uvb: fix wd_obtain logic err - !20949 ub: udma: support user ctl function. - urma: fix bond device id not release - !20901 drivers/ub/sentry: some bugfix - ub: ubmempfd: supports for D2H mapping and demapping - ub: ubmempfd: supports providing services to the QEMU process through file nodes - [virtCCA Live Migration 2]virtcca secure cvm supports live migration - urma: query priority and enable bit, support ring size configuration - urma: implement debugfs, improve boundary checks and error handling logic - urma: implement data plane interaction and statistics - urma: implement ipourma network device operations - urma: ipourma resource management - urma: ipourma resource management and err code - urma: introduce ipourma main module - iommu/ummu: Optimized the TID invalidation configuration - iommu/ummu: Optimized SVA permission table memory allocation approach - iommu/ummu: Adapt UMMU SVA interface adjustment - iommu/ummu: Support TID and EID Granularity for MPAM - !20848 [OLK-6.6] backport important bugfix for nvme driver from upstream linux-6.6.y - !20847 urma: sl resource query error - !20908 [OLK-6.6][linux-6.6.y sync] Backport 6.6.108-6.6.110 LTS Patches - !20084 Loongarch: Enable CONFIG_CRYPTO_XTS for disk encryption - !20929 PCI: Fix NVMe link speed downgrade to 2.5GT/s during hotplug - drivers/ub/sentry: fix check input parameters - ub: udma: support user ctl function. - ub: udma: support uboe function. - ub: udma: bugfix related to query aux info. - !20935 ub: ubmem_vmmu: supports IOMMU driver for the UB memory MMU in VMs - drivers/ub/sentry: do not use magic numbers - !20876 urma: Kernel-mode specific implementations file for Jetty extension interface - urma: sl resource query error - !20873 sunrpc: fix NULL pointer dereference in rpcb_register_inet6 and rpcb_register_inet4 - !20875 sunrpc: fix race in cache cleanup causing stale nextcheck time - ub: ubmem_vmmu: supports IOMMU driver for the UB memory MMU in VMs - ub: ubmem_vmmu: supports parsing and configuring the hardware node information - ub: ubmem_vmmu: HiSilicon ubmem_vmmu Architecture Implementation - !20806 Fix CVE-2025-71225 - !20896 scsi: qla2xxx: Free sp in error path to fix system crash - !20894 scsi: qla2xxx: Delay module unload while fabric scan in progress - !20893 scsi: qla2xxx: Validate sp before freeing associated memory - !20802 Fix CVE-2026-23110 - urma: Kernel-mode specific implementations file for Jetty extension interface - drivers/ub/sentry: fix memory leak in process_urma_data() - drivers/ub/sentry: initialize some variables - PCI: Fix NVMe link speed downgrade to 2.5GT/s during hotplug - !20770 ub: ubdevshm: supports the memory user to obtain and release shared memory - Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 - mm: consider non-anon swap cache folios in folio_expected_ref_count() - mm: simplify folio_expected_ref_count() - ASoC: qcom: audioreach: fix potential null pointer dereference - gcc-plugins: Remove TODO_verify_il for GCC >= 16 - crypto: sha256 - fix crash at kexec - drm/i915/backlight: Return immediately when scale() finds invalid parameters - minmax.h: remove some #defines that are only expanded once - minmax.h: simplify the variants of clamp() - minmax.h: move all the clamp() definitions after the min/max() ones - minmax.h: use BUILD_BUG_ON_MSG() for the lo < hi test in clamp() - minmax.h: reduce the #define expansion of min(), max() and clamp() - minmax.h: update some comments - minmax.h: add whitespace around operators and after commas - minmax: fix up min3() and max3() too - minmax: improve macro expansion and type checking - minmax: don't use max() in situations that want a C constant expression - minmax: simplify min()/max()/clamp() implementation - minmax: make generic MIN() and MAX() macros available everywhere - drm/ast: Use msleep instead of mdelay for edid read - gpiolib: Extend software-node support to support secondary software-nodes - ARM: bcm: Select ARM_GIC_V3 for ARCH_BRCMSTB - s390/cpum_cf: Fix uninitialized warning after backport of ce971233242b - kmsan: fix out-of-bounds access to shadow memory - afs: Fix potential null pointer dereference in afs_put_server - ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address - i40e: improve VF MAC filters accounting - i40e: add mask to apply valid bits for itr_idx - HID: asus: add support for missing PX series fn keys - drm/gma500: Fix null dereference in hdmi teardown - octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() - net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port - net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() - net: dsa: lantiq_gswip: do also enable or disable cpu port - selftests: fib_nexthops: Fix creation of non-FDB nexthops - net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS - bnxt_en: correct offset handling for IPv6 destination address - vhost: Take a reference on the task in struct vhost_task. - Bluetooth: hci_sync: Fix hci_resume_advertising_sync - ethernet: rvu-af: Remove slash from the driver name - can: peak_usb: fix shift-out-of-bounds issue - can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow - can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow - can: hi311x: populate ndo_change_mtu() to prevent buffer overflow - can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow - bpf: Reject bpf_timer for PREEMPT_RT - can: rcar_can: rcar_can_resume(): fix s2ram with PSCI - wifi: virt_wifi: Fix page fault on connect - cpufreq: Initialize cpufreq-based invariance before subsys - ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients - arm64: dts: imx8mp: Correct thermal sensor index - mm: folio_may_be_lru_cached() unless folio_test_large() - mm/gup: local lru_add_drain() to avoid lru_add_drain_all() - mm/gup: check ref_count instead of lru before migration - mm: add folio_expected_ref_count() for reference count calculation - mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked" - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions - ALSA: usb-audio: Add mute TLV for playback volumes on more devices - ALSA: usb-audio: move mixer_quirks' min_mute into common quirk - ALSA: usb-audio: Add DSD support for Comtrue USB Audio device - i2c: designware: Add quirk for Intel Xe - mmc: sdhci-cadence: add Mobileye eyeQ support - usb: core: Add 0x prefix to quirks debug output - ALSA: usb-audio: Fix build with CONFIG_INPUT=n - ALSA: usb-audio: Convert comma to semicolon - ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 - ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks - ALSA: usb-audio: Simplify NULL comparison in mixer_quirks - ALSA: usb-audio: Avoid multiple assignments in mixer_quirks - ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks - ALSA: usb-audio: Fix block comments in mixer_quirks - firewire: core: fix overlooked update of subsystem ABI version - scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE - !20843 [OLK-6.6][linux-6.6.y sync] Backport 6.6.107-6.6.108 LTS Patches - !20869 ub:hisi-ubus: fix bug of security smatch - !20861 CVE-2026-23163 - ub: ubdevshm: supports the memory user to obtain and release shared memory - ub: ubdevshm: supports granting and revoking shared memory permissions - ub: ubdevshm: supports the registration and deregistration of shared memory segments - ub: ubdevshm: supports the registration and deregistration - KVM: arm64: Fix softirq masking in FPSIMD register saving sequence - !20886 Fix CVE-2026-23205 - !20803 Fix CVE-2026-23112 - !20868 sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure - !20811 smb/server: fix refcount leak in smb2_open() - !20810 smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() - !20809 smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() - sunrpc: fix NULL pointer dereference in rpcb_register_inet6 and rpcb_register_inet4 - sunrpc: fix race in cache cleanup causing stale nextcheck time - scsi: qla2xxx: Free sp in error path to fix system crash - scsi: qla2xxx: Delay module unload while fabric scan in progress - scsi: qla2xxx: Validate sp before freeing associated memory - dcache: Limit the minimal number of bucket to two - !20872 Fix CVE-2026-23220 - !20846 Fix CVE-2026-23193 - !20815 Fix CVE-2026-23216 - !20859 Fix CVE-2026-23179 - !20871 CVE-2026-23096 - !20858 ub: ubase: resolve the cmdq crq overflow problem - bpf: Deprecate hisock unused kfuncs and orig ingress logic - bpf: Add local connect support for hisock - bpf: Add ipv4-mapped ipv6 addr support for hisock - bpf: Add target comm parse to hisock_cmd - bpf: Add multi port parse to hisock_cmd - bpf: Only deploy hisock in server - bpf: Apply BPF_HISOCK_INGRESS to hisock ingress - bpf: Add bpf_handle_ingress/egress_ptype kfunc - bpf: Add bpf_get_skb_ethhdr kfunc - bpf: Add bpf_set_ingress/egress_dev kfunc - bpf: Add bpf_set_ingress_dst kfunc - bpf: Add BPF_HISOCK_INGRESS attach type - cgroup: make cgroup_bpf_prog_attach work when cgroup2 is not mounted - smb: client: fix potential UAF and double free in smb2_open_file() - smb/client: fix memory leak in smb2_open_file() - !20852 ASoC: amd: fix memory leak in acp3x pdm dma ops - ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths - uacce: fix cdev handling in the cleanup path - Revert "uacce: fix for cdev memory leak" - ub:hisi-ubus: fix bug of security smatch - ub:ubus: injected route event - ub:ubus: Black Box Development - !20865 urma: urma support uboe - sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure - urma: urma support uboe - !20857 ub_fwctl driver adds support for querying some functions - ub:ub_fwctl:Add illegal verification for scc - ub:ub_fwctl:Support querying the historical status of port links - drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove - drm/amdkfd: Don't use sw fault filter if retry cam enabled - ub:ub_fwctl:Support querying firmware version numbers - ub: ub_fwctl: Support querying real-time bandwidth statistics - ub:ub_fwctl:Support querying statistical indicators at the ub port and uboe port levels - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() - !20854 [URMA] add ping server for urma_ping - urma: add ping server - ub: ubase: resolve the cmdq crq overflow problem - ub: ubase: Optimized the QoS code naming to improve code readability. - ub: ubase&unic: optimizing code and configuration settings. - net: unic: not support query and configure ip by control plane in UBoE - net: unic: fix the automatically enable uc guid promisc mode. - !20844 urma:kernel header of userctl - urma: Kernel-mode header file for Jetty extension interface - ASoC: amd: fix memory leak in acp3x pdm dma ops - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() - phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again) - ACPICA: Work around bogus -Wstringop-overread warning since GCC 11 - !20835 Fix CVE-2026-23084 - minmax: add a few more MIN_T/MAX_T users - minmax: simplify and clarify min_t()/max_t() implementation - minmax: avoid overly complicated constant expressions in VM code - rtc: pcf2127: fix SPI command byte for PCF2131 backport - xhci: dbc: Fix full DbC transfer ring after several reconnects - xhci: dbc: decouple endpoint allocation from initialization - phy: ti: omap-usb2: fix device leak at unbind - phy: Use device_get_match_data() - drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path - ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message - ASoC: wm8974: Correct PLL rate rounding - ASoC: wm8940: Correct typo in control name - ASoC: wm8940: Correct PLL rate rounding - io_uring: include dying ring in task_work "should cancel" state - io_uring: backport io_should_terminate_tw() - ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx - selftests: mptcp: avoid spurious errors on TCP disconnect - selftests: mptcp: connect: catch IO errors on listen side - rds: ib: Increment i_fastreg_wrs before bailing out - KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active - mmc: mvsdio: Fix dma_unmap_sg() nents value - ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S - ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface - btrfs: tree-checker: fix the incorrect inode ref size check - iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page() - LoongArch: Check the return value when creating kobj - LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled - LoongArch: Update help info of ARCH_STRICT_ALIGN - nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* - octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() - net: liquidio: fix overflow in octeon_init_instr_queue() - bonding: don't set oif to bond dev when getting NS target destination - net/mlx5e: Consider aggregated port speed during rate configuration - i40e: remove redundant memory barrier when cleaning Tx descs - net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure - selftests: mptcp: sockopt: fix error messages - mptcp: tfo: record 'deny join id0' info - mptcp: set remote_deny_join_id0 on SYN recv - dpaa2-switch: fix buffer pool seeding for control traffic - btrfs: fix invalid extref key setup when replaying dentry - pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch - wifi: mac80211: fix incorrect type for ret - wifi: mac80211: increase scan_ies_len for S1G - ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported - !20769 [OLK-6.6][linux-6.6.y sync] Backport 6.6.106-6.6.107 LTS Patches - be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list - !20776 ub:ubfi: Release the chosen node - !20817 CVE-2026-23094 - !20819 dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() - ub:ubus: Add port num check - !20379 [OLK-6.6][sync from OLK-5.10]io_uring: Support forcing sq thread to be idle and woken up by hrtimer - !20830 sched/soft_domain: Increasing NR_MAX_CLUSTER to 32 - sched/soft_domain: Increasing NR_MAX_CLUSTER to 32 - btrfs: fix incorrect readahead expansion length - x86: disable image size check for test builds - drm/i915/power: fix size for for_each_set_bit() in abox iteration - drm/amdgpu: fix a memory leak in fence cleanup when unloading - net: mdiobus: release reset_gpio in mdiobus_unregister_device() - phy: ti-pipe3: fix device leak at unbind - phy: tegra: xusb: fix device and OF node leak at probe - dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate - usb: gadget: midi2: Fix MIDI2 IN EP max packet size - usb: gadget: midi2: Fix missing UMP group attributes initialization - USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels - RISC-V: Remove unnecessary include from compat.h - hrtimer: Rename __hrtimer_hres_active() to hrtimer_hres_active() - hrtimer: Remove unused function - regulator: sy7636a: fix lifecycle of power good gpio - dmaengine: ti: edma: Fix memory allocation size for queue_priority_map - hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr - hsr: use rtnl lock when iterating over ports - net: hsr: Add VLAN CTAG filter support - net: hsr: Add support for MC filtering at the slave device - can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB - can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails - can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed - igb: fix link test skipping when interface is admin down - docs: networking: can: change bcm_msg_head frames member to support flexible array - tunnels: reset the GSO metadata before reusing the skb - net: bridge: Bounce invalid boolopts - net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() - USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions - USB: serial: option: add Telit Cinterion FN990A w/audio compositions - dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks - serial: sc16is7xx: fix bug in flow control levels init - tty: hvc_console: Call hvc_kick in hvc_write unconditionally - Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups" - Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table - Input: iqs7222 - avoid enabling unused interrupts - mm/khugepaged: fix the address passed to notifier on testing young - btrfs: fix corruption reading compressed range when block size is smaller than page size - btrfs: use readahead_expand() on compressed extents - mm/damon/sysfs: fix use-after-free in state_show() - mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing - mtd: nand: raw: atmel: Fix comment in timings preparation - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages - drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time - mm/damon/core: set quota->charged_from to jiffies at first charge window - fuse: prevent overflow in copy_file_range return value - fuse: check if copy_file_range() returns larger than requested size - mtd: rawnand: stm32_fmc2: fix ECC overwrite - mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer - net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups - i2c: i801: Hide Intel Birch Stream SoC TCO WDT - ocfs2: fix recursive semaphore deadlock in fiemap call - mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN - compiler-clang.h: define __SANITIZE_*__ macros only when undefined - EDAC/altera: Delete an inappropriate dma_free_coherent() call - rcu-tasks: Maintain real-time response in rcu_tasks_postscan() - rcu-tasks: Eliminate deadlocks involving do_exit() and RCU tasks - rcu-tasks: Maintain lists to eliminate RCU-tasks/do_exit() deadlocks - s390/cpum_cf: Deny all sampling events by counter PMU - NFSv4/flexfiles: Fix layout merge mirror check. - NFSv4.2: Serialise O_DIRECT i/o and copy range - NFSv4.2: Serialise O_DIRECT i/o and clone range - NFSv4.2: Serialise O_DIRECT i/o and fallocate() - NFS: Serialise O_DIRECT i/o and truncate() - fs/nfs/io: make nfs_start_io_*() killable - ftrace/samples: Fix function size computation - NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server - NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set - media: i2c: imx214: Fix link frequency validation - NFSD: nfsd_unlink() clobbers non-zero status returned from fh_fill_pre_attrs() - nfsd: Fix a regression in nfsd_setattr() - kasan: fix GCC mem-intrinsic prefix with sw tags - kunit: kasan_test: disable fortify string checker on kasan_strings() test - io_uring: fix kabi broken in struct io_ring_ctx - io_uring: Support forcing sq thread to be idle and woken up by hrtimer - dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() - uacce: fix isolate sysfs check condition - Revert "uacce: fix isolate sysfs check condition" - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() - smb/server: fix refcount leak in smb2_open() - smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() - smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() - md: suspend array while updating raid_disks via sysfs - scsi: core: Wake up the error handler when final completions race against each other - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec - ub:ubfi: Release the chosen node - ub:ubus: Delete unused functions - Loongarch: Enable CONFIG_CRYPTO_XTS for disk encryption - Add sw64 support in kernel.spec - !21194 hisi-cca-da: Revert smmu realm enabled condition for arm_smmu_domain_finalise. - !21192 urma: bugfix of ubagg&ubcore&uburma - !21183 platform/x86: classmate-laptop: Add missing NULL pointer checks - urma: bugfix of ubagg&ubcore&uburma - hisi-cca-da: Revert smmu realm enabled condition for arm_smmu_domain_finalise. - platform/x86: classmate-laptop: Add missing NULL pointer checks - !21167 urma: fix kernel codecheck issues. - !21174 urma: change return value for provider err - !21127 urma: copy linked ports when importing bond jetty/seg - !20247 ubcore: query primary eid in ipourma loopback mode. - !21077 Fix hisi cca bugs - ubcore: route query refine and ipo loopback adapt. - hisi-cca-da: Transfer PCIe ECAM access requests to RMM for realm device. - hisi-cca-da: Write NS STE for PF drivers. - hisi-cca-da: Provide IO interfaces - hisi-cca-da: Destroy mmu stage2 pagetable after closing vfio devices - !21045 scsi: hisi_sas: Fix NULL pointer exception when do user_scan() - hisi-cca-da: Automatically unbind PF/VF drivers and prevent probe. - !21165 tools/interference: add ifstool utility for kernel interference statistics - !21166 urma: fix jfce uaf in batch cleanup - !21043 urma: fix tjetty ref in ping server - urma: change return value for provider err - !21128 sched/rt: Skip currently executing CPU in rto_next_cpu() - !21129 procfs: fix missing RCU protection when reading real_parent in do_task_stat() - urma: fix jfce uaf in batch cleanup - !21074 ipmi: Add HiSilicon IPMI Page Soft Offline driver - !21076 [OLK-6.6][linux-6.6.y sync] Backport 6.6.112-6.6.113 LTS Patches - urma: fix kernel codecheck issues. - tools/interference: add ifstool utility for kernel interference statistics - !20291 [Hygon][6.6][Bugfix] Bug fix for EDAC decode address fail issue on Hygon Dhyana processor - !21092 kexec: derive purgatory entry from symbol - !21154 sched: Add SOFT_DOMAIN feature interface for cgroup2 - !21153 fix CVE-2025-39981 - Revert "hisi-cca-da: Delay realm memory release to kvm_destroy_realm" - urma: fix tjetty ref in ping server - rme: Enforce isolation to solve compile error without config CONFIG_HISI_CCA - hisi-cca-da: Improve hisi cca dev validate and delegate - hisi-cca-da: Fix smmu enable rme problem - hisi-cca-da: Fix msi region shared problem - sched: Add SOFT_DOMAIN feature interface for cgroup2 - Bluetooth: MGMT: Fix memory leak in set_ssp_complete - Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete - overflow: Introduce __DEFINE_FLEX for having no initializer - overflow: Fix direct struct member initialization in _DEFINE_FLEX() - overflow: Change DEFINE_FLEX to take __counted_by member - overflow: add DEFINE_FLEX() for on-stack allocs - Bluetooth: MGMT: Fix possible UAFs - Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete() - !21103 Revert "mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()" - !21104 v2 vsock/virtio: cap TX credit to local buffer size - !21070 Fixes CVE-2026-23100 - !21135 RDMA/hns: Support configure and query the CNP DSCP through sysfs - !21088 ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref - RDMA/hns: Support configure and query the CNP DSCP through sysfs - RDMA/hns: Support query FW cap bit - RDMA/hns: Support query HW ID. - !20934 smb/server: fix refcount leak in parse_durable_handle_context() - !21004 regmap: Fix race condition in hwspinlock irqsave routine - !19568 [OLK-6.6]fix txgbe clang compile warning - urma: copy linked ports when importing bond jetty/seg - procfs: fix missing RCU protection when reading real_parent in do_task_stat() - sched/rt: Skip currently executing CPU in rto_next_cpu() - !21073 scsi: qla2xxx: Fix bsg_done() causing double free - !21114 CVE-2024-57979 - !21113 iommu: disable SVA when CONFIG_X86 is set - !20957 dmaengine: xilinx: xdma: Fix regmap max_register - !21087 net: unic: Multiple stability fixes for tx timeout, DFX capability and concurrent activation/reset - pps: Fix a use-after-free - fix kabi - pps: Fix a use-after-free - !21078 of: unittest: Fix memory leak in unittest_data_add() - !21079 *** fix CVE-2026-23208 *** - !21082 ALSA: aloop: Fix racy access at PCM trigger - !21083 bus: fsl-mc: fix use-after-free in driver_override_show() - iommu: disable SVA when CONFIG_X86 is set - vsock/virtio: cap TX credit to local buffer size - Revert "mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()" - !20983 Fix CVE-2026-23139 - !20878 Fix CVE-2026-23230 - kexec: derive purgatory entry from symbol - lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC - PCI/IOV: Fix race between SR-IOV enable/disable and hotplug - Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" - rtc: interface: Alarm race handling should not discard preceding error - perf test stat tests: Fix for virtualized machines - perf test stat: Update test expectations and events - perf test stat: Avoid hybrid assumption when virtualized - writeback: Avoid excessively long inode switching times - writeback: Avoid softlockup when switching many inodes - cramfs: Verify inode mode when loading from disk - fs: Add 'initramfs_options' to set initramfs mount options - minixfs: Verify inode mode when loading from disk - irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume - irqchip/sifive-plic: Make use of __assign_bit() - selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled - s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG - s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL - s390/bpf: Describe the frame using a struct instead of constants - s390/bpf: Centralize frame offset calculations - s390/bpf: Change seen_reg to a mask - ACPI: property: Do not pass NULL handles to acpi_attach_data() - ACPI: property: Add code comments explaining what is going on - ACPI: property: Disregard references in data-only subnode lists - ACPI: battery: Add synchronization between interface updates - ACPI: battery: Check for error code from devm_mutex_init() call - ACPI: battery: initialize mutexes through devm_ APIs - ACPI: battery: allocate driver data through devm_ APIs - arm64: mte: Do not flag the zero page as PG_mte_tagged - ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref - !20790 dm: use bio_clone_blkg_association - ipmi: Add HiSilicon IPMI Page Soft Offline driver - net: unic: Resolve network unavailability caused by concurrent activation and reset - net: unic: Provide the DFX capability for querying MNG table - net: unic: Delete the elr reset process after the tx timeout - bus: fsl-mc: fix use-after-free in driver_override_show() - ALSA: aloop: Fix racy access at PCM trigger - ALSA: usb-audio: Use the right limit for PCM OOB check - ALSA: usb-audio: Prevent excessive number of frames - of: unittest: Fix memory leak in unittest_data_add() - !21034 CVE-2026-23140 - !21016 net: fix segmentation of forwarding fraglist GRO - !21017 mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() - !21018 CVE-2026-23209 - !21019 ipv6: annotate data-race in ndisc_router_discovery() - !20881 ipvlan: Make the addrs_lock be per port - rme: Imporve range delegate - btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() - PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release - PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() - misc: fastrpc: Save actual DMA size in fastrpc_map structure - misc: fastrpc: Add missing dev_err newlines - mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag - mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type - mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value - media: mc: Clear minor number before put device - lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older - ACPICA: Allow to skip Global Lock initialization - ext4: validate ea_ino and size in check_xattrs - ext4: correctly handle queries for metadata mappings - ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() - nfsd: nfserr_jukebox in nlm_fopen should lead to a retry - NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() - mm/damon/vaddr: do not repeat pte_offset_map_lock() until success - mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 - mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations - wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 - wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again - selftests: mptcp: join: validate C-flag + def limit - spi: cadence-quadspi: Flush posted register writes before DAC access - spi: cadence-quadspi: Flush posted register writes before INDAC access - PCI: tegra194: Handle errors in BPMP response - PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() - PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock - PCI: rcar-host: Drop PMSR spinlock - PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit - PCI/AER: Support errors introduced by PCIe r6.0 - PCI/AER: Fix missing uevent on recovery when a reset is requested - PCI/ERR: Fix uevent on failure to recover - PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV - PCI/sysfs: Ensure devices are powered for config reads - PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock - rseq/selftests: Use weak symbol reference, not definition, to link with glibc - rtc: interface: Fix long-standing race when setting alarm - rtc: interface: Ensure alarm irq is enabled when UIE is enabled - memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe - mmc: core: SPI mode remove cmd7 - mtd: rawnand: fsmc: Default to autodetect buswidth - xtensa: simdisk: add input size check in proc_write_simdisk - sparc: fix error handling in scan_one_device() - sparc64: fix hugetlb for sun4u - scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() - sched/deadline: Fix race in push_dl_task() - pwm: berlin: Fix wrong register in suspend/resume - powerpc/pseries/msi: Fix potential underflow and leak issue - powerpc/powernv/pci: Fix underflow and leak issue - power: supply: max77976_charger: fix constant current reporting - pinctrl: samsung: Drop unused S3C24xx driver data - nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk - parisc: don't reference obsolete termio struct for TC* constants - openat2: don't trigger automounts with RESOLVE_NO_XDEV - of: unittest: Fix device reference count leak in of_unittest_pci_node_verify - lib/genalloc: fix device leak in of_gen_pool_get() - KEYS: trusted_tpm1: Compare HMAC values in constant time - iommu/vt-d: PRS isn't usable if PDS isn't supported - iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume - init: handle bootloader identifier in kernel parameters - iio: xilinx-ams: Unmask interrupts after updating alarms - iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK - iio: frequency: adf4350: Fix prescaler usage. - iio: dac: ad5421: use int type to store negative error codes - iio: dac: ad5360: use int type to store negative error codes - fs/ntfs3: Fix a resource leak bug in wnd_extend() - fbdev: Fix logic error in "offb" name match - crypto: rockchip - Fix dma_unmap_sg() nents value - crypto: atmel - Fix dma_unmap_sg() direction - crypto: aspeed - Fix dma_unmap_sg() direction - copy_sighand: Handle architectures where sizeof(unsigned long) < sizeof(u64) - bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() - bus: mhi: ep: Fix chained transfer handling in read path - btrfs: avoid potential out-of-bounds in btrfs_encode_fh() - blk-crypto: fix missing blktrace bio split events - drm/nouveau: fix bad ret code in nouveau_bo_move_prep - drm/rcar-du: dsi: Fix 1/2/3 lane support - media: lirc: Fix error handling in lirc_register() - media: venus: firmware: Use correct reset sequence for IRIS2 - media: pci: ivtv: Add missing check after DMA map - media: mc: Fix MUST_CONNECT handling for pads with no links - media: i2c: mt9v111: fix incorrect type for ret - media: cx18: Add missing check after DMA map - firmware: meson_sm: fix device leak at probe - xen/events: Update virq_to_irq on migration - xen/events: Return -EEXIST for bound VIRQs - xen/manage: Fix suspend error path - xen/events: Cleanup find_virq() return codes - dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required - ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init - arm64: dts: ti: k3-am62a-main: Fix main padcfg length - arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees - arm64: dts: qcom: msm8939: Add missing MDSS reset - arm64: dts: qcom: msm8916: Add missing MDSS reset - ACPI: debug: fix signedness issues in read/write helpers - ACPI: property: Fix buffer properties extraction for subnodes - gpio: wcd934x: mark the GPIO controller as sleeping - tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single - smb: client: fix missing timestamp updates after utime(2) - bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() - drm/amd/display: Properly disable scaling on DCE6 - drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 - drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs - drm/amdgpu: Add additional DCE6 SCL registers - mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes - mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call - tcp: take care of zero tp->window_clamp in tcp_set_rcvlowat() - perf python: split Clang options when invoking Popen - tools build: Align warning options with perf - net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe - drm/vmwgfx: Fix copy-paste typo in validation - net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() - LoongArch: Init acpi_gbl_use_global_lock to false - LoongArch: Remove CONFIG_ACPI_TABLE_UPGRADE in platform_init() - ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size - scsi: mvsas: Fix use-after-free bugs in mvs_work_queue - clk: tegra: do not overallocate memory for bpmp clocks - clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver - clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() - clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() - clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m - perf evsel: Ensure the fallback message is always written to - perf tools: Add fallback for exclude_guest - perf test: Add a test for default perf stat command - perf test: Don't leak workload gopipe in PERF_RECORD_* - perf session: Fix handling when buffer exceeds 2 GiB - perf arm_spe: Correct memory level for remote access - perf arm_spe: Correct setting remote access - rtc: optee: fix memory leak on driver removal - rtc: x1205: Fix Xicor X1205 vendor prefix - perf util: Fix compression checks returning -1 as bool - clk: at91: peripheral: fix return value - libperf event: Ensure tracing data is multiple of 8 sized - perf evsel: Avoid container_of on a NULL leader - asm-generic/io.h: Skip trace helpers if rwmmio events are disabled - iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE - clocksource/drivers/clps711x: Fix resource leaks in error paths - fscontext: do not consume log entries when returning -EMSGSIZE - fs: always return zero on success from replace_fd() - !21067 [OLK-6.6][linux-6.6.y sync] Backport 6.6.111-6.6.112 LTS Patches - scsi: qla2xxx: Fix bsg_done() causing double free - !21065 Fix CVE-2026-23069 - !21062 v4 Support multi-level cgroup - !20987 Fix CVE-2026-23212 - !20982 Fix CVE-2026-23119 - !20979 Fix CVE-2026-23111 - !20974 Fix CVE-2026-23099 - !20973 Fix CVE-2026-23105 - !20972 Fix CVE-2026-23074 - !20884 ksmbd: add chann_lock to protect ksmbd_chann_list xarray - !20947 Fix CVE-2026-23101 - ext4: clear i_state_flags when alloc inode - misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup - Revert "wifi: ath10k: avoid unnecessary wait for service ready message" - fs/ntfs3: fix mount failure for sparse runs in run_unpack() - !20825 efivarfs: fix error propagation in efivar_entry_get() - !20824 io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop - !20950 ub:ubus: protect iterator ue_list and mue_list with ub_bus_sem - mm/rmap: fix two comments related to huge_pmd_unshare() - mm/hugetlb: fix two comments related to huge_pmd_unshare() - mm/hugetlb: fix hugetlb_pmd_shared() - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count - !20728 drivers: Update vendor name of Chengdu NorthLink Technology N5/N6 Series Network Card Drivers - vsock/virtio: fix potential underflow in virtio_transport_get_credit() - !21001 Fix CVE-2026-23229 - usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call - arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode - !20999 Fix CVE-2026-23173 - usb: typec: tipd: Clear interrupts first - bus: fsl-mc: Check return value of platform_get_resource() - remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() - Input: atmel_mxt_ts - allow reset GPIO to sleep - misc: fastrpc: Skip reference for DMA handles - misc: fastrpc: fix possible map leak in fastrpc_put_args - misc: fastrpc: Fix fastrpc_map_lookup operation - nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() - ext4: fix checks for orphan inodes - ksmbd: fix error code overwriting in smb2_get_info_filesystem() - LoongArch: Automatically disable kaslr if boot from kexec_file - mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() - mfd: rz-mtu3: Fix MTU5 NFCR register offset - ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down - ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() - vhost: vringh: Modify the return value check - net/mlx5: fw reset, add reset timeout work - net/mlx5: pagealloc: Fix reclaim race during command interface teardown - net/mlx5: Stop polling for command response if interface goes down - net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable - nfp: fix RSS hash key size when RSS is not supported - mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands - drivers/base/node: fix double free in register_one_node() - hwrng: ks-sa - fix division by zero in ks_sa_rng_init - KEYS: X.509: Fix Basic Constraints CA flag parsing - Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements - Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO - vhost: vringh: Fix copy_to_iter return value check - RDMA/siw: Always report immediate post SQ errors - usb: vhci-hcd: Prevent suspending virtually attached devices - NFSv4.1: fix backchannel max_resp_sz verification check - coresight: trbe: Return NULL pointer for allocation failures - coresight: etm4x: Support atclk - coresight-etm4x: Conditionally access register TRCEXTINSELR - remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice - PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() - vfio/pds: replace bitmap_free with vfree - sparc: fix accurate exception reporting in copy_{from,to}_user for M7 - sparc: fix accurate exception reporting in copy_to_user for Niagara 4 - sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara - sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III - wifi: mac80211: fix Rx packet handling when pubsta information is not available - wifi: ath10k: avoid unnecessary wait for service ready message - Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram - IB/sa: Fix sa_local_svc_timeout_ms read race - RDMA/core: Resolve MAC of next-hop device without ARP support - f2fs: fix zero-sized extent for precache extents - scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() - scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() - scsi: qla2xxx: edif: Fix incorrect sign of error code - ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message - f2fs: fix to truncate first page in error path of f2fs_truncate() - f2fs: fix to update map->m_next_extent correctly in f2fs_map_blocks() - wifi: mt76: fix potential memory leak in mt76_wmac_probe() - RDMA/cm: Rate limit destroy CM ID timeout error message - drivers/base/node: handle error properly in register_one_node() - watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog - ipvs: Use READ_ONCE/WRITE_ONCE for ipvs->enable - iio: consumers: Fix offset handling in iio_convert_raw_to_processed() - iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() - fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist - fs: ntfs3: Fix integer overflow in run_unpack() - drm/msm/dpu: fix incorrect type for ret - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping - ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping - misc: genwqe: Fix incorrect cmd field being reported in error - usb: gadget: configfs: Correctly set use_os_string at bind - usb: phy: twl6030: Fix incorrect type for ret - drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() - tcp: fix __tcp_close() to only send RST when required - PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation - wifi: mwifiex: send world regulatory domain to driver - drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) - drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) - drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) - drm/amd/pm: Adjust si_upload_smc_data register programming (v3) - drm/amd/pm: Fix si_upload_smc_data (v3) - drm/amd/pm: Disable ULV even if unsupported (v3) - drm/amdgpu: Power up UVD 3 for FW validation (v2) - coresight: Only register perf symlink for sinks with alloc_buffer - inet: ping: check sock_net() in ping_get_port() and ping_lookup() - media: st-delta: avoid excessive stack usage - ALSA: lx_core: use int type to store negative error codes - media: rj54n1cb0c: Fix memleak in rj54n1_probe() - scsi: myrs: Fix dma_alloc_coherent() error check - hwrng: nomadik - add ARM_AMBA dependency - crypto: keembay - Add missing check after sg_nents_for_len() - drm/amd/display: Remove redundant semicolons - serial: max310x: Add error checking in probe() - usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls - usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup - phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 - media: zoran: Remove zoran_fh structure - drm/bridge: it6505: select REGMAP_I2C - f2fs: fix condition in __allow_reserved_blocks() - drm/radeon/r600_cs: clean up of dead code in r600_cs - drm/panel: novatek-nt35560: Fix invalid return value - bpf: Enforce expected_attach_type for tailcall compatibility - i2c: designware: Add disabling clocks when probe fails - i2c: designware: Fix clock issue when PM is disabled - i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD - thermal/drivers/qcom/lmh: Add missing IRQ includes - thermal/drivers/qcom: Make LMH select QCOM_SCM - hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems - once: fix race by moving DO_ONCE to separate section - smp: Fix up and expand the smp_call_function_many() kerneldoc - selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported - i3c: master: svc: Recycle unused IBI slot - i3c: master: svc: Use manual response for IBI events - ACPICA: Fix largest possible resource descriptor index - pwm: tiehrpwm: Fix corner case in clock divisor calculation - arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible - arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value - arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names - cpuidle: qcom-spm: fix device and OF node leaks at probe - firmware: firmware: meson-sm: fix compile-test default - arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 - null_blk: Fix the description of the cache_size module argument - pinctrl: renesas: Use int type to store negative error codes - power: supply: cw2015: Fix a alignment coding style issue - PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() - ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property - ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS - ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax - block: use int to store blk_stack_limits() return value - selftests/nolibc: fix EXPECT_NZ macro - regulator: scmi: Use int type to store negative error codes - arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map - ARM: at91: pm: fix MCKx restore routine - pinctrl: meson-gxl: add missing i2c_d pinmux - soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS - leds: flash: leds-qcom-flash: Update torch current clamp setting - ARM: dts: renesas: porter: Fix CAN pin group - libbpf: Fix reuse of DEVMAP - bpf: Remove migrate_disable in kprobe_multi_link_prog_run - bpf/selftests: Fix test_tcpnotify_user - regmap: Remove superfluous check for !config in __regmap_init() - arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 - x86/vdso: Fix output operand size of RDPID - smb: server: fix IRD/ORD negotiation with the client - coresight: trbe: Prevent overflow in PERF_IDX2OFF() - gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote - selftests: arm64: Check fread return value in exec_target - seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast - init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD - filelock: add FL_RECLAIM to show_fl_flags() macro - !21022 KVM: Don't clobber irqfd routing type when deassigning irqfd - !20998 ceph: fix oops due to invalid pointer for kfree() in parse_longname() - !21023 l2tp: avoid one data-race in l2tp_tunnel_del_work() - xsched: fix potential NULL dereference in xsched_quota_timeout_update - xsched: remove the standalone xcu_cfs_cg_deinit() helper - xsched: restructure xcu_cgrp_subsys teardown to align with cpu_cgrp_subsys lifecycle - xsched: simplify root group check by direct comparison with root_xcg - xsched: replace magic number with SCHED_CLASS_MAX_LENGTH for scheduler class string length - xsched/core: immediate cleanup of remaining operators on task exit - xsched: add init_fair_xsched_group() for XCU-specific fair group initialization - xsched: modify xcu_cg_initialize_components helper - xsched: refactor xsched_entity initialization - xsched: change rq_init() parameter from struct xsched_cu to struct xsched_rq - xsched: harden and clarify xcu_move_task() logic - xsched: move throttling-related fields from xsched_group_xcu_priv to xsched_rq_cfs - xsched/quota: add throttled flag to cfs_rq for robust hierarchical enqueue under throttling - xsched/quota: support multi-level cgroup - xsched: remove redundant xcu parameter from dequeue_ctx - xsched: update group shares using xcu_grp_shares_add/sub helpers - xsched: delete unused code - xsched/cfs: propagate group activation/deactivation up the hierarchy - xsched/cfs: move xruntime updates to pick/put paths - xsched: add has_running hook to xsched classes for wake-up eligibility check - !21012 [OLK-6.6][linux-6.6.y sync] Backport 6.6.110-6.6.111 LTS Patches - scsi: hisi_sas: Fix NULL pointer exception when do user_scan() - !21013 CVE-2026-23177 - !21007 bonding: fix use-after-free due to enslave fail after slave array update - !21006 net: Fix CVE-2026-23204 - bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path - bpf, test_run: Subtract size of xdp_frame from allowed metadata size - bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN - bpf: Make variables in bpf_prog_test_run_xdp less confusing - bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K - !21015 libceph: reset sparse-read state in osd_fault() - !21024 ub: udma: bugfix related to print messages. - !20980 Fix CVE-2026-23126 - !20922 Fix CVE-2026-23133 - ub: udma: bugfix related to print messages. - l2tp: avoid one data-race in l2tp_tunnel_del_work() - KVM: Don't clobber irqfd routing type when deassigning irqfd - ipv6: annotate data-race in ndisc_router_discovery() - macvlan: observe an RCU grace period in macvlan_common_newlink() error path - macvlan: fix error recovery in macvlan_common_newlink() - mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() - net: fix segmentation of forwarding fraglist GRO - can: rcar_canfd: Fix CAN-FD mode as default - libceph: reset sparse-read state in osd_fault() - !21008 uvb: fix cis call return value and obtain - mm, shmem: prevent infinite loop on truncate race - mm/shmem, swap: fix race of truncate and swap entry split - net/9p: fix double req put in p9_fd_cancelled - riscv: mm: Do not restrict mmap address based on hint - riscv: mm: Use hint address in mmap if available - driver core/PM: Set power.no_callbacks along with power.no_pm - serial: stm32: allow selecting console when the driver is module - hid: fix I2C read buffer overflow in raw_event() for mcp2221 - ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free - ALSA: usb-audio: Kill timer properly at removal - platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list - can: rcar_canfd: Fix controller mode setting - can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled - btrfs: ref-verify: handle damaged extent root tree - ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue - perf subcmd: avoid crash in exclude_cmds when excludes is empty - platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list - dm-integrity: limit MAX_TAG_SIZE to 255 - ASoC: amd: acp: Adjust pdm gain value - wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 - USB: serial: option: add SIMCom 8230C compositions - media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe - !20931 Fix CVE-2026-23060 - uvb: fix cis call return value and obtain - bonding: fix use-after-free due to enslave fail after slave array update - net/sched: cls_u32: use skb_header_pointer_careful() - net: add skb_header_pointer_careful() helper - regmap: Fix race condition in hwspinlock irqsave routine - crypto: virtio - Add spinlock protection with virtqueue notification - net/mlx5e: TC, delete flows only for existing peers - !20967 net: hns3: modify code of judging if SMMU DMA is enabled - ceph: fix oops due to invalid pointer for kfree() in parse_longname() - !20969 Fix CVE-2026-23125 - !20948 v4 arm64: Add memory poison recovery support for various paths - !20975 CVE-2026-23102 - !20977 v4 support apei_page_offline_policy - bonding: annotate data-races around slave->last_rx - netfilter: nf_conncount: update last_gc only when GC has been performed - bonding: provide a net pointer to __skb_flow_dissect() - netdevsim: fix a race issue related to the operation on bpf_bound_progs list - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() - apei/ghes: Add sysctl interface to control soft-offline page isolation - Revert "mm/memory-failure: support disabling soft offline for HugeTLB pages" - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - arm64/fpsimd: signal: Fix restoration of SVE context - arm64/fpsimd: signal: Consistently read FPSIMD context - arm64/fpsimd: signal: Mandate SVE payload for streaming-mode state - bonding: limit BOND_MODE_8023AD to Ethernet devices - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag - net/sched: Enforce that teql can only be used as root qdisc - sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT - drivers/net: Update vendor name of Chengdu NorthLink Technology N5/N6 Series Network Card Drivers - net: hns3: modify code of judging if SMMU DMA is enabled - dmaengine: xilinx: xdma: Fix regmap max_register - ub:ubus: protect iterator ue_list and mue_list with ub_bus_sem - ub:ubus: Avoid getting empty uent from ubc - ub:hisi-ubus: Use GFP_ATOMIC when alloc memory - arm64: send sig fault for user task when apei_claim_sea fails - arm64: add ras log during do_sea - arm64: move getting valid siaddr to the top of do_sea - arm64: mm: shmem: support poison recovery from shmem_file_read_iter() - arm64: fs: support poison recovery from __kernel_read() - iov_iter: add mc support for copy_page_to_iter - arm64: mm: support recovery from copy_{from/to}_user_page() - iov_iter: get rid of 'copy_mc' flag - leds: led-class: Only Add LED to leds_list when it is fully ready - wifi: ath10k: fix dma_free_coherent() pointer - smb/server: fix refcount leak in parse_durable_handle_context() - ksmbd: add chann_lock to protect ksmbd_chann_list xarray - ipvlan: Make the addrs_lock be per port - smb: client: split cached_fid bitfields to avoid shared-byte RMW races - efivarfs: fix error propagation in efivar_entry_get() - io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop - dm: use bio_clone_blkg_association - RAS/AMD/ATL: fix error nodes per socket on for Hygon Dhyana processor - net: txgbe: fix clang compile warning - !20552 ub: udma: fix some code issues. - !20313 Fix CVE-2025-40220 - !20321 nvme: fix admin request_queue lifetime - !20512 PM / devfreq: hisi: Fix potential UAF in OPP handling - !20544 Fix CVE-2025-71147 - !20548 v4 net: LTS-6.6 backport - !20503 Fix CVE-2025-39713 - !20133 Fix CVE-2025-39721 - !20438 Fix CVE-2025-38659 - !20264 Fix CVE-2025-40277 - !20340 Fix CVE-2025-40271 - !20319 Fix CVE-2025-40237 - !20392 vfs: Don't leak disconnected dentries on umount - !20554 iommu/s390: Implement blocking domain - !20489 [OLK-6.6][linux-6.6.y sync] Backport 6.6.101-6.6.102 LTS Patches - !20513 ACPI: PCC: Fix race condition by removing static qualifier - !20468 drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer - !20483 rcu: Protect ->defer_qs_iw_pending from data race - !20510 drivers/ub/sentry: fix primary eid index value - !20553 ub: cdma: support separated page table feature - ub: udma: fix some code issues. - !20480 iommu/ummu-core: fix error invalidate tid - !20561 iommu/ummu: Add ummu sva independent page table parameter - ub: udma: bugfix related to 2m_hugepage. - ub: udma: support for separate page tables - ub: udma: delete debugfs code. - ub: udma: bugfix related to ctrlq function. - ub: udma: verify get cqe/ae aux info out addr and len. - ub: cdma: support separated page table feature - iommu/ummu: Add ummu sva independent page table parameter - iommu: Adjust PLB refresh timing in 'grant' and 'ungrant' - !20505 Fix CVE-2026-23035 - iommu/s390: Implement blocking domain - drivers/ub/sentry: fix primary eid index value - !20535 libceph: make decode_pool() more resilient against corrupted osdmaps - !20536 mm/page_alloc: change all pageblocks migrate type on coalescing - !20537 mm/secretmem: fix use-after-free race in fault handler - !20538 wifi: avoid kernel-infoleak from struct iw_point - !20539 net: usb: rtl8150: fix memory leak on usb_submit_urb() failure - !20440 PCI/AER: Fix NULL pointer access by aer_info - !20262 Fix CVE-2025-68176 - netfilter: nf_reject: don't leak dst refcount for loopback packets - net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error - page_pool: always add GFP_NOWARN for ATOMIC allocations - virtio-net: fix received length check in big packets - net: bridge: fix use-after-free due to MST port state bypass - vsock: Ignore signal/timeout on connect() if already established - tls: make sure to abort the stream if headers are bogus - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI - xfrm: Duplicate SPI Handling - tls: handle data disappearing from under the TLS ULP - net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing - bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls - Bluetooth: hci_core: Fix use-after-free in vhci_flush() - KEYS: trusted: Fix a memory leak in tpm2_load_cmd - !20237 Fix CVE-2025-68724 - !20459 Fix CVE-2025-71131 - !20525 Fix CVE-2025-68816 - !20529 CVE-2025-68172 - net: usb: rtl8150: fix memory leak on usb_submit_urb() failure - !20370 Revert "Revert "RDMA/hns: Fix mismatch exception rollback"" - wifi: avoid kernel-infoleak from struct iw_point - mm/secretmem: fix use-after-free race in fault handler - mm/page_alloc: change all pageblocks migrate type on coalescing - libceph: make decode_pool() more resilient against corrupted osdmaps - pps: Fix kabi breakage of struct pps_device for last_fetched_ev - sched: Fix kabi breakage of struct task_struct for saved_state - crypto: aspeed - fix double free caused by devm - !20515 Bluetooth: bcsp: receive data only if registered - !20507 Fix CVE-2025-40358 - !20450 ub: ubase&unic: Fix some bug in concurrent process - !20452 iommu/ummu: Fix some bugs and optimize the code implementation - !20451 iommu/ummu: Add the function of creating devices with SVA-separated - !20500 mm: fix the inaccurate memory statistics issue for users - net/mlx5: fw_tracer, Validate format string parameters - Bluetooth: bcsp: receive data only if registered - ACPI: PCC: Fix race condition by removing static qualifier - ACPI: CPPC: Fix missing PCC check for guaranteed_perf - iommu/ummu: Add the function of creating devices with SVA-separated - iommu/ummu-core: fix error invalidate tid - riscv: stacktrace: Disable KASAN checks for non-current tasks - !20497 arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() - !20496 drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies - !20495 iommu/amd: Avoid stack buffer overflow from kernel cmdline - !20494 HID: core: Harden s32ton() against conversion to 0 bits - !20493 iommu: Fix two issues in iommu_copy_struct_from_user() - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv - PM / devfreq: hisi: Fix potential UAF in OPP handling - media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() - !20487 interference: Fix uninitialized ifs_clock compiling issue - MIPS: mm: kmalloc tlb_vpn array to avoid stack overflow - MIPS: mm: Prevent a TLB shutdown on initial uniquification - mm: fix the inaccurate memory statistics issue for users - mm: add config option for atomic mode in mm counter - Revert "mm: fix the inaccurate memory statistics issue for users" - !20444 net/mlx5e: Fix crash on profile change rollback failure - !20442 net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv - arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() - drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies - iommu/amd: Avoid stack buffer overflow from kernel cmdline - HID: core: Harden s32ton() against conversion to 0 bits - iommu: Fix two issues in iommu_copy_struct_from_user() - SUNRPC: call xs_sock_process_cmsg for all cmsg - flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read - !20374 [OLK 6.6]Use Hygon IBRS and IBPB rather than software-based mitigation to mitigate Retbleed and SRSO. - !20227 Rename leapioraid to leapraid and release v2.0 - mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery - MIPS: mm: tlb-r4k: Uniquify TLB entries on init - x86/fpu: Delay instruction pointer fixup until after warning - ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx() - ALSA: intel_hdmi: Fix off-by-one error in __hdmi_lpe_audio_probe() - x86/sev: Evict cache lines during SNP memory validation - net: usbnet: Fix the wrong netif_carrier_on() call - net: usbnet: Avoid potential RCU stall on LINK_CHANGE event - Bluetooth: btusb: Add USB ID 3625:010b for TP-LINK Archer TX10UB Nano - sched,freezer: Remove unnecessary warning in __thaw_task - freezer,sched: Clean saved_state when restoring it during thaw - freezer,sched: Do not restore saved_state of a thawed task - freezer,sched: Use saved_state to reduce some spurious wakeups - sched/core: Remove ifdeffery for saved_state - i2c: stm32f7: unmap DMA mapped buffer - i2c: stm32f7: simplify status messages in case of errors - i2c: stm32f7: perform most of irq job in threaded handler - i2c: stm32f7: use dev_err_probe upon calls of devm_request_irq - i2c: stm32f7: Use devm_clk_get_enabled() - USB: serial: option: add Foxconn T99W709 - smb: server: Fix extension string in ksmbd_extract_shortname() - ksmbd: fix corrupted mtime and ctime in smb2_open - ksmbd: fix Preauh_HashValue race condition - ksmbd: fix null pointer dereference error in generate_encryptionkey - vsock: Do not allow binding to VMADDR_PORT_ANY - selftests/perf_events: Add a mmap() correctness test - smb: client: return an error if rdma_connect does not return within 5 seconds - smb: client: let recv_done() cleanup before notifying the callers. - smb: client: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already - smb: client: make use of common smbdirect_socket - smb: smbdirect: add smbdirect_socket.h - smb: client: Correct typos in multiple comments across various files - smb: client: Use min() macro - smb: server: let recv_done() avoid touching data_transfer after cleanup/move - smb: server: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already - ALSA: hda/ca0132: Fix missing error handling in ca0132_alt_select_out() - irqchip: Build IMX_MU_MSI only on ARM - net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing - sunrpc: fix client side handling of tls alerts - net/sched: taprio: enforce minimum value for picos_per_byte - net: drop UFO packets in udp_rcv_segment() - ipv6: reject malicious packets in ipv6_gso_segment() - net/mlx5: Correctly set gso_segs when LRO is used - netlink: specs: ethtool: fix module EEPROM input/output arguments - net: ipa: add IPA v5.1 and v5.5 to ipa_version_string() - phy: mscc: Fix parsing of unicast frames - netpoll: prevent hanging NAPI when netcons gets enabled - md/md-cluster: handle REMOVE message earlier - NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY - NFS: Fix wakeup of __nfs_lookup_revalidate() in unblock_revalidate() - sched: Add test_and_clear_wake_up_bit() and atomic_dec_and_wake_up() - pNFS/flexfiles: don't attempt pnfs on fatal DS errors - PCI: pnv_php: Fix surprise plug detection and recovery - powerpc/eeh: Export eeh_unfreeze_pe() - PCI: pnv_php: Work around switches with broken presence detection - kconfig: qconf: fix ConfigList::updateListAllforAll() - scsi: sd: Make sd shutdown issue START STOP UNIT appropriately - scsi: ufs: core: Use link recovery when h8 exit fails during runtime resume - scsi: Revert "scsi: iscsi: Fix HW conn removal use after free" - scsi: mpt3sas: Fix a fw_event memory leak - vfio/pci: Separate SR-IOV VF dev_set - vfio/pds: Fix missing detach_ioas op - vfio: Prevent open_count decrement to negative - vfio: Fix unbalanced vfio_df_close call in no-iommu mode - f2fs: fix to calculate dirty data during has_not_enough_free_secs() - f2fs: fix to update upper_p in __get_secs_required() correctly - f2fs: vm_unmap_ram() may be called from an invalid context - f2fs: fix to avoid out-of-boundary access in devs.path - f2fs: doc: fix wrong quota mount option description - f2fs: fix KMSAN uninit-value in extent_info usage - rtc: rv3028: fix incorrect maximum clock rate handling - rtc: pcf8563: fix incorrect maximum clock rate handling - rtc: pcf85063: fix incorrect maximum clock rate handling - rtc: nct3018y: fix incorrect maximum clock rate handling - rtc: hym8563: fix incorrect maximum clock rate handling - rtc: ds1307: fix incorrect maximum clock rate handling - ucount: fix atomic_long_inc_below() argument type - module: Restore the moduleparam prefix length check - apparmor: fix loop detection used in conflicting attachment resolution - apparmor: ensure WB_HISTORY_SIZE value is a power of 2 - bpf: Check netfilter ctx accesses are aligned - bpf: Check flow_dissector ctx accesses are aligned - vhost-scsi: Fix log flooding with target does not exist errors - mtd: rawnand: atmel: set pmecc data setup time - mtd: rawnand: rockchip: Add missing check after DMA map - mtd: rawnand: atmel: Fix dma_mapping_error() address - jfs: fix metapage reference count leak in dbAllocCtl - crypto: qat - fix seq_file position update in adf_ring_next() - crypto: qat - fix DMA direction for compression on GEN2 devices - perf tools: Remove libtraceevent in .gitignore - sh: Do not use hyphen in exported variable name - ASoC: fsl_xcvr: get channel status data when PHY is not exists - dmaengine: nbpfaxi: Add missing check after DMA map - dmaengine: mv_xor: Fix missing check after DMA map and missing unmap - fs/orangefs: Allow 2 more characters in do_c_string() - PCI: endpoint: pci-epf-vntb: Fix the incorrect usage of __iomem attribute - soundwire: stream: restore params when prepare ports fail - crypto: img-hash - Fix dma_unmap_sg() nents value - crypto: keembay - Fix dma_unmap_sg() nents value - hwrng: mtk - handle devm_pm_runtime_enable errors - watchdog: ziirave_wdt: check record length in ziirave_firm_verify() - scsi: isci: Fix dma_unmap_sg() nents value - scsi: mvsas: Fix dma_unmap_sg() nents value - scsi: elx: efct: Fix dma_unmap_sg() nents value - scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value - clk: sunxi-ng: v3s: Fix de clock definition - perf tests bp_account: Fix leaked file descriptor - kernel: trace: preemptirq_delay_test: use offstack cpu mask - crypto: inside-secure - Fix `dma_unmap_sg()` nents value - perf sched: Fix memory leaks in 'perf sched latency' - perf sched: Fix memory leaks for evsel->priv in timehist - perf sched: Free thread->priv using priv_destructor - perf dso: Add missed dso__put to dso__load_kcore - perf tools: Fix use-after-free in help_unknown_cmd() - Fix dma_unmap_sg() nents value - clk: clk-axi-clkgen: fix fpfd_max frequency for zynq - fanotify: sanitize handle_type values when reporting fid - pinctrl: sunxi: Fix memory leak on krealloc failure - PCI: endpoint: pci-epf-vntb: Return -ENOENT if pci_epc_get_next_free_bar() fails - crypto: arm/aes-neonbs - work around gcc-15 warning - power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set - power: supply: cpcap-charger: Fix null check for power_supply_get_by_name - clk: xilinx: vcu: unregister pll_post only if registered correctly - media: v4l2-ctrls: Fix H264 SEPARATE_COLOUR_PLANE check - mtd: fix possible integer overflow in erase_xfer() - crypto: marvell/cesa - Fix engine load inaccuracy - crypto: qat - use unmanaged allocation for dc_data - crypto: sun8i-ce - fix nents passed to dma_unmap_sg() - PCI: rockchip-host: Fix "Unexpected Completion" log message - bpf/preload: Don't select USERMODE_DRIVER - ipv6: annotate data-races around rt->fib6_nsiblings - ipv6: fix possible infinite loop in fib6_info_uses_dev() - vrf: Drop existing dst reference in vrf_ip6_input_dst - selftests: rtnetlink.sh: remove esp4_offload after test - net/mlx5e: Clear Read-Only port buffer size in PBMC before update - netfilter: xt_nfacct: don't assume acct name is null-terminated - can: kvaser_usb: Assign netdev.dev_port based on device channel index - can: kvaser_pciefd: Store device channel index - can: peak_usb: fix USB FD devices potential malfunction - tools/rv: Do not skip idle in trace - Bluetooth: hci_event: Mask data status from LE ext adv reports - kcsan: test: Initialize dummy variable - wifi: mac80211: Write cnt before copying in ieee80211_copy_rnr_beacon() - wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE - wifi: ath12k: fix endianness handling while accessing wmi service bit - wifi: mac80211: Check 802.11 encaps offloading in ieee80211_tx_h_select_key() - wifi: mac80211: Don't call fq_flow_idx() for management frames - wifi: mac80211: Do not schedule stopped TXQs - wifi: plfxlc: Fix error handling in usb driver probe - wifi: mac80211: reject TDLS operations when station is not associated - iommu/amd: Fix geometry.aperture_end for V2 tables - mwl8k: Add missing check after DMA map - wifi: rtl8xxxu: Fix RX skb size for aggregation disabled - tcp: call tcp_measure_rcv_mss() for ooo packets - xen/gntdev: remove struct gntdev_copy_batch from stack - net_sched: act_ctinfo: use atomic64_t for three counters - net/sched: Restrict conditions for adding duplicating netems to qdisc tree - um: rtc: Avoid shadowing err in uml_rtc_start() - arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX - netfilter: nf_tables: adjust lockdep assertions handling - netfilter: nf_tables: Drop dead code from fill_*_info routines - fbcon: Fix outdated registered_fb reference in comment - drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value - m68k: Don't unregister boot console needlessly - drm/msm/dpu: Fill in min_prefill_lines for SC8180X - kselftest/arm64: Fix check for setting new VLs in sve-ptrace - net: dst: annotate data-races around dst->input - tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range - wifi: ath11k: clear initialized flag for deinit-ed srng lists - iwlwifi: Add missing check for alloc_ordered_workqueue - wifi: iwlwifi: Fix memory leak in iwl_mvm_init() - wifi: rtl818x: Kill URBs before clearing tx status queue - wifi: rtw89: avoid NULL dereference when RX problematic packet on unsupported 6 GHz band - caif: reduce stack size, again - bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure - drm/vmwgfx: Fix Host-Backed userspace on Guest-Backed kernel - net: ipv6: ip6mr: Fix in/out netdev to pass to the FORWARD chain - selftests/bpf: fix signedness bug in redir_partial() - bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls - bpf, sockmap: Fix psock incorrectly pointing to sk - drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed - staging: nvec: Fix incorrect null termination of battery manufacturer - interconnect: qcom: sc8180x: specify num_nodes - interconnect: qcom: sc8280xp: specify num_links for qnm_a1noc_cfg - soc: qcom: pmic_glink: fix OF node leak - samples: mei: Fix building on musl libc - cpufreq: Initialize cpufreq-based frequency-invariance later - cpufreq: intel_pstate: Always use HWP_DESIRED_PERF in passive mode - arm64: dts: imx8mn-beacon: Fix HS400 USDHC clock speed - arm64: dts: imx8mm-beacon: Fix HS400 USDHC clock speed - ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface - soc/tegra: cbb: Clear ERR_FORCE register with ERR_STATUS - arm: dts: ti: omap: Fixup pinheader typo - usb: early: xhci-dbc: Fix early_ioremap leak - powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw() - pps: fix poll support - staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() - spi: stm32: Check for cfg availability in stm32_spi_probe - usb: misc: apple-mfi-fastcharge: Make power supply names unique - usb: host: xhci-plat: fix incorrect type for of_match variable in xhci_plat_probe() - ARM: dts: vfxxx: Correctly use two tuples for timer address - arm64: dts: qcom: msm8976: Make blsp_dma controlled-remotely - arm64: dts: qcom: sc7180: Expand IMEM region - arm64: dts: qcom: sdm845: Expand IMEM region - soc: qcom: QMI encoding/decoding for big endian - selftests: Fix errno checking in syscall_user_dispatch test - ASoC: mediatek: use reserved memory or enable buffer pre-allocation - gfs2: No more self recovery - Revert "fs/ntfs3: Replace inode_trylock with inode_lock" - hfs: make splice write available again - hfsplus: make splice write available again - ublk: use vmalloc for ublk_device's __queues - fs_context: fix parameter name in infofc() macro - audit,module: restore audit logging in load failure case - ASoC: amd: yc: add DMI quirk for ASUS M6501RM - ASoC: Intel: fix SND_SOC_SOF dependencies - ASoC: amd: yc: Add DMI entries to support HP 15-fb1xxx - ethernet: intel: fix building with large NR_CPUS - ASoC: amd: yc: Add DMI quirk for HP Laptop 17 cp-2033dx - interference: Fix uninitialized ifs_clock compiling issue - iommu/ummu: optimize log printing - !20455 Fix compilation failure caused by PR#20174 - !20302 CVE-2026-22980 - !20142 CVE-2025-68803 - !20261 ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency - !20435 fix CVE-2026-22998 - !20433 scsi: target: Reset t_task_cdb pointer in error case - !20432 scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" - !20431 block: Use RCU in blk_mq_[un - !20307 tpm: Cap the number of PCR banks - !20062 xfs: Add xfs_dir3_leaf_header_check() in leaf/leafn read - !20157 v2 md: backport from mainline - rcu: Protect ->defer_qs_iw_pending from data race - platform/x86/intel/pmt: fix compilation failure caused by PR#20174 - iommu/ummu: optimize kv cache memory management - iommu/ummu: optimize permission table management - iommu/ummu: remove check for eid_type while del eid - iommu/ummu: optimize the code implementation - drivers/perf: fix ummu-pmu data reading exception - iommu/ummu: IOMMU_DOMAIN_BLOCKED type don not sync tct - drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer - crypto: seqiv - Do not use req->iv after crypto_aead_encrypt - net: unic: Notify mami of the bond ip change. - ub: ubase: Support for UE link by ctrlq message - ub: ubase: send a deactivate req in removing - ub: ubase: Querying TPG/TP contexts in the chip is no longer supported after enabling safe mode. - ub: ubase: Use an independent thread for the ctrlq workqueue. - !20368 ubcore: fix logging and permission for route query. - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id - !20344 ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr - net: unic: Fix the ummu 0xa event that occurs when modifying queues and resetting concurrent scenarios - ub: ubase: Add KABI compatibility - ub: ubase: fixing the issue of cdma ctp_req_vl parameter configuration - ub: ubase: add PMU IDEV interrupt supported abilities. - ub: ubase: Delete the tid mask for eq, jfs, jfr, and jfc context - ub: ubase: Set the completion event interrupt to auto - net: unic: fix poll tx read old skb cause a UAF bug - !20249 Fix CVE-2025-38489 - !20250 Fix CVE-2025-38480 - !20378 Fix CVE-2025-39838 - !20430 Fix CVE-2025-39942 - !20351 Fix CVE-2025-71149 - !20375 Fix CVE-2025-71150 - !20323 Fix CVE-2025-38730 - !20320 Fix CVE-2025-68814 - !20314 Fix CVE-2025-71072 - !20315 Fix CVE-2025-68794 - !20403 bpf: Check skb->transport_header is set in bpf_skb_check_mtu - !20402 bpf: Do not let BPF test infra emit invalid GSO types to stack - !20401 tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() - !20400 netfilter: nft_ct: add seqadj extension for natted connections - !20399 net: xfrm: Fix CVE-2025-40215 - !20398 net/sched: sch_qfq: Fix null-deref in agg_dequeue - !20397 bpf: Reject narrower access to pointer ctx fields - !20396 Bluetooth: eir: Fix possible crashes on eir_create_adv_data - !20394 IB/mlx5: Fix potential deadlock in MR deregistration - !20367 ub: cdma: cdma uaf bugfix - net/mlx5e: Fix crash on profile change rollback failure - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv - PCI/AER: Fix NULL pointer access by aer_info - gfs2: No more self recovery - drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE - crypto: qat - flush misc workqueue during device shutdown - !20174 Backport PMT spec 3.0 support - !20366 [Hygon][6.6][Bugfix]: Resolve FPU state corruption between atomic and non-atomic contexts - !19814 [OLK-6.6] Batch flushing user memory encrytion status change - !20393 [OLK-6.6][linux-6.6.y sync] Backport 6.6.100-6.6.101 LTS Patches - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec - nvmet-tcp: remove boilerplate code - scsi: target: Reset t_task_cdb pointer in error case - scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" - block: Use RCU in blk_mq_[un]quiesce_tagset() instead of set->tag_list_lock - ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size - ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer - smb: server: let recv_done() consistently call put_recvmsg/smb_direct_disconnect_rdma_connection - smb: server: remove separate empty_recvmsg_queue - !20384 ub:ubus: Fix ubus link message and pool device error - !20389 gfs2: Prevent recursive memory reclaim - !20388 *** fix CVE-2025-38062 *** - !20387 KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced - !20386 pinctrl: check the return value of pinmux_ops::get_function_name() - !20385 iommu/amd/pgtbl: Fix possible race while increase page table level - ub:ubus: Not cfg access during surprise down - ub:hisi-ubus: Delete validate_pa err print - PCI: cadence: Check for the existence of cdns_pcie::ops before using it - can: netlink: can_changelink(): allow disabling of automatic restart - Revert "selftests/bpf: Add a cgroup prog bpf_get_ns_current_pid_tgid() test" - drm/sched: Remove optimization that causes hang when killing dependent jobs - ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS - bpf: Check skb->transport_header is set in bpf_skb_check_mtu - bpf: Do not let BPF test infra emit invalid GSO types to stack - tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() - netfilter: nft_ct: add seqadj extension for natted connections - xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added - xfrm: delete x->tunnel as we delete x - x86/hw-vuln:Support hardware-based mitigation for Retbleed and SRSO via Hygon IBRS to avoid performance degradation caused by software-based mitigation. - net/sched: sch_qfq: Fix null-deref in agg_dequeue - bpf: Reject narrower access to pointer ctx fields - Bluetooth: eir: Fix possible crashes on eir_create_adv_data - IB/mlx5: Fix potential deadlock in MR deregistration - ub:ubus: Fix ubus link message and pool device error - ub:hisi-ubus: cq poller maximum handle 64 cqe per time - ub:hisi-ubus:Fix vdm message print error - ub:ubus:Fix ubus interrupt release issue - wifi: mt76: mt7921: prevent decap offload config before STA initialization - mtd: rawnand: qcom: Fix last codeword read in qcom_param_page_type_exec() - iio: hid-sensor-prox: Restore lost scale assignments - iio: hid-sensor-prox: Fix incorrect OFFSET calculation - crypto: powerpc/poly1305 - add depends on BROKEN for now - erofs: address D-cache aliasing - drm/i915/dp: Fix 2.7 Gbps DP_LINK_BW value on g4x - ALSA: hda: Add missing NVIDIA HDA codec IDs - ALSA: hda/tegra: Add Tegra264 support - comedi: comedi_test: Fix possible deletion of uninitialized timers - usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach - usb: typec: tcpm: allow switching to mode accessory to mux properly - usb: typec: tcpm: allow to use sink in accessory mode - drm/amdkfd: Don't call mmput from MMU notifier callback - mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n - selftests: mptcp: connect: also cover checksum - selftests: mptcp: connect: also cover alt modes - resource: fix false warning in __request_region() - gve: Fix stuck TX queue for DQ queue format - e1000e: ignore uninitialized checksum word on tgp - e1000e: disregard NVM checksum on tgp when valid checksum bit is not set - dpaa2-switch: Fix device reference count leak in MAC endpoint handling - dpaa2-eth: Fix device reference count leak in MAC endpoint handling - ALSA: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx - sprintf.h requires stdarg.h - bus: fsl-mc: Fix potential double device reference in fsl_mc_get_endpoint() - i2c: virtio: Avoid hang by using interruptible completion wait - i2c: tegra: Fix reset error handling with ACPI - platform/x86: ideapad-laptop: Fix kbd backlight not remembered among boots - can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode - can: dev: can_restart(): move debug message and stats after successful restart - can: dev: can_restart(): reverse logic to remove need for goto - i40e: When removing VF MAC filters, only check PF-set MAC - i40e: report VF tx_dropped with tx_errors instead of tx_discards - i40e: Add rx_missed_errors for buffer exhaustion - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch - net/mlx5: Fix memory leak in cmd_exec() - staging: vchiq_arm: Make vchiq_shutdown never fail - x86/hyperv: Fix usage of cpu_online_mask to get valid cpu - regmap: fix potential memory leak of regmap_bus - iio: adc: ad7949: use spi_is_bpw_supported() - interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1 node - RDMA/core: Rate limit GID cache warning messages - virtio_ring: Fix error reporting in virtqueue_resize - !20348 [OLK-6.6][linux-6.6.y sync] Backport 6.6.99-6.6.100 LTS Patches - !20346 tracing: Fix crash on synthetic stacktrace field usage - vfs: Don't leak disconnected dentries on umount - !20334 Fix CVE-2025-68780 - gfs2: Prevent recursive memory reclaim - amd/amdkfd: enhance kfd process check in switch partition - drm/amdkfd: allow compute partition mode switch with cgroup exclusions - KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced - pinctrl: check the return value of pinmux_ops::get_function_name() - iommu/amd/pgtbl: Fix possible race while increase page table level - !19966 nvme-fc: use lock accessing port_state and rport state - ASoC: fsl_sai: replace regmap_write with regmap_update_bits - comedi: Fix use of uninitialized data in insn_rw_emulate_bits() - cifs: prevent NULL pointer dereference in UTF16 conversion - ksmbd: Fix refcount leak when invalid session is found on session lookup - ubcore: fix logging and permission for route query. - !20232 driver/coda: VirtCCA supports MSI device DA - Revert "Revert "RDMA/hns: Fix mismatch exception rollback"" - !20197 ub: udma&ubase: fix a bug that caused long reboot time - x86: Resolve FPU state corruption between atomic and non-atomic contexts - ub: cdma: cdma uaf bugfix - ub: cdma: jfs call trace bugfix - !20353 x86/fpu: Clear XSTATE_BV[i - s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again - KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls - nvmem: layouts: u-boot-env: remove crc32 endianness conversion - i2c: omap: fix deprecated of_property_read_bool() use - ASoC: fsl_sai: Force a software reset when starting in consumer mode - regulator: pwm-regulator: Manage boot-on with disabled PWM channels - regulator: pwm-regulator: Calculate the output voltage for disabled PWMs - i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe() - i2c: omap: Fix an error handling path in omap_i2c_probe() - i2c: omap: Add support for setting mux - usb: dwc3: qcom: Don't leave BCR asserted - usb: hub: Don't try to recover devices lost during warm reset. - usb: hub: Fix flushing of delayed work used for post resume purposes - usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm - usb: hub: fix detection of high tier USB3 devices behind suspended hubs - arm64: Filter out SME hwcaps when FEAT_SME isn't implemented - ipv6: make addrconf_wq single threaded - !20354 cpufreq/sched: Explicitly synchronize limits_changed flag handling - sched/deadline: only set free_cpus for online runqueues - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 - cpufreq/sched: Explicitly synchronize limits_changed flag handling - io_uring/poll: correctly handle io_poll_add() return value on update - shmem: fix recovery on rename failures - io_uring: fix filename leak in __io_openat_prep() - Revert "cgroup_freezer: cgroup_freezing: Check if not frozen" - rxrpc: Fix transmission of an abort in response to an abort - rxrpc: Fix recv-recv race of completed call - net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree - net: bridge: Do not offload IGMP/MLD messages - hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf - netfilter: nf_conntrack: fix crash due to removal of uninitialised entry - ipv6: mcast: Delay put pmc->idev in mld_del_delrec() - net/mlx5: Correctly set gso_size when LRO is used - Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID - Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout - Bluetooth: SMP: If an unallowed command is received consider it a failure - Bluetooth: hci_sync: fix connectable extended advertising when using static random address - hwmon: (corsair-cpro) Validate the size of the received input buffer - selftests: net: increase inter-packet timeout in udpgro.sh - wifi: cfg80211: remove scan request n_channels counted_by - nvme: fix misaccounting of nvme-mpath inflight I/O - net: phy: Don't register LEDs for genphy - nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list() - rpl: Fix use-after-free in rpl_do_srh_inline(). - block: fix kobject leak in blk_unregister_queue - net: emaclite: Fix missing pointer increment in aligned_read() - soundwire: amd: fix for clearing command status register - soundwire: amd: fix for handling slave alerts after link is down - comedi: Fix use of uninitialized data in insn_rw_emulate_bits() - comedi: Fix some signed shift left operations - comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large - comedi: das6402: Fix bit shift out of bounds - comedi: das16m1: Fix bit shift out of bounds - comedi: aio_iiro_16: Fix bit shift out of bounds - comedi: pcl812: Fix bit shift out of bounds - iio: adc: stm32-adc: Fix race in installing chained IRQ handler - iio: adc: max1363: Reorder mode_list[] entries - iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] - iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush - soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled - soc: aspeed: lpc-snoop: Cleanup resources in stack-order - s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again - pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov - net: libwx: properly reset Rx ring descriptor - net: libwx: remove duplicate page_pool_put_full_page() - mmc: sdhci_am654: Workaround for Errata i2312 - mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models - mmc: bcm2835: Fix dma_unmap_sg() nents value - memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() - isofs: Verify inode mode when loading from disk - dmaengine: nbpfaxi: Fix memory corruption in probe() - af_packet: fix soft lockup issue caused by tpacket_snd() - af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() - arm64: dts: rockchip: use cs-gpios for spi1 on ringneck - arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on - arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency - net/mlx5: Update the list of the PCI supported devices - phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() - io_uring/poll: fix POLLERR handling - ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS - drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume - tracing/osnoise: Fix crash in timerlat_dump_stack() - spi: Add check for 8-bit transfer with 8 IO mode support - pch_uart: Fix dma_sync_sg_for_device() nents value - thunderbolt: Fix bit masking in tb_dp_port_set_hops() - i2c: stm32: fix the device used for the DMA map - tracing: Fix crash on synthetic stacktrace field usage - usb: musb: fix gadget state on disconnect - USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI - USB: serial: option: add Foxconn T99W640 - USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition - phy: tegra: xusb: Disable periodic tracking on Tegra234 - phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode - phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr - fs/proc: fix uaf in proc_readdir_de() - io_uring/net: commit partial buffers on retry - nvme: fix admin request_queue lifetime - fs/notify: call exportfs_encode_fid with s_umount - iomap: adjust read range correctly for non-block-aligned positions - fuse: fix livelock in synchronous file put from fuseblk workers - tpm: Cap the number of PCR banks - nfsd: provide locking for v4_end_grace - Revert "nfsd: provide locking for v4_end_grace" - config: enable config for PMT discovery driver - platform/x86/intel/pmt/discovery: use valid device pointer in dev_err_probe - platform/x86/intel/pmt: Fix kobject memory leak on init failure - platform/x86/intel/pmt: fix a crashlog NULL pointer access - platform/x86/intel/pmt: fix build dependency for kunit test - platform/x86/intel/pmt/discovery: fix format string warning - platform/x86/intel/pmt/discovery: Fix size_t specifiers for 32-bit - platform/x86/intel/pmt: KUNIT test for PMT Enhanced Discovery API - platform/x86/intel/pmt/telemetry: Add API to retrieve telemetry regions by feature - platform/x86/intel/pmt/discovery: Get telemetry attributes - platform/x86/intel/tpmi: Get OOBMSM CPU mapping from TPMI - platform/x86/intel/vsec: Set OOBMSM to CPU mapping - platform/x86/intel/tpmi: Relocate platform info to intel_vsec.h - docs: Add ABI documentation for intel_pmt feature directories - platform/x86/intel/pmt: Add PMT Discovery driver - sysfs: Fix crash on empty group attributes array - sysfs: Introduce a mechanism to hide static attribute_groups - platform/x86/intel/vsec: Add new Discovery feature - platform/x86/intel/vsec: Skip driverless features - platform/x86/intel/vsec: Skip absent features during initialization - platform/x86/intel/vsec: Add device links to enforce dependencies - platform/x86/intel/vsec: Create wrapper to walk PCI config space - platform/x86/intel/vsec: Add private data for per-device data - MAINTAINERS: Add link to documentation of Intel PMT ABI - platform/x86/intel/pmt: allow user offset for PMT callbacks - driver/coda: VirtCCA supports MSI device DA - ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency - Rename leapioraid to leapraid and release v2.0 - ub: udma: fix a bug that caused long reboot time. - ub: ubase: Accelerate when ctrl node is shutting down - platform/x86/intel/pmt: Use PMT callbacks - platform/x86/intel/vsec: Add PMT read callbacks - platform/x86/intel/vsec.h: Move to include/linux - md: prevent incorrect update of resync/recovery offset - md/raid1: Fix data corruption for degraded array with slow disk - md/raid1: set max_sectors during early return from choose_slow_rdev() - md-cluster: fix no recovery job when adding/re-adding a disk - md-cluster: fix hanging issue while a new disk adding - md/raid5: recheck if reshape has finished with device_lock held - md-cluster: Constify struct md_cluster_operations - md: Remove unneeded semicolon - md/raid5: fix spares errors about rcu usage - dm-raid: Fix WARN_ON_ONCE check for sync_thread in raid_resume - md: pass in max_sectors for pers->sync_request() - md: factor out helpers for different sync_action in md_do_sync() - md: replace last_sync_action with new enum type - md: use new helpers in md_do_sync() - md: don't fail action_store() if sync_thread is not registered - md: remove parameter check_seq for stop_sync_thread() - md: replace sysfs api sync_action with new helpers - md: factor out helper to start reshape from action_store() - md: add new helpers for sync_action - md: add a new enum type sync_action - md: rearrange recovery_flags - md/raid0: don't free conf on raid0_run failure - md: make md_flush_request() more readable - md: change the return value type of md_write_start to void - md: Revert "md: Fix overflow in is_mddev_idle" - md: don't account sync_io if iostats of the disk is disabled - md: Fix overflow in is_mddev_idle - md: add check for sleepers in md_wakeup_thread() - md: add a mddev_is_dm helper - md: add a mddev_add_trace_msg helper - md: add a mddev_trace_remap helper - dm-raid456, md/raid456: fix a deadlock for dm-raid456 while io concurrent with reshape - dm-raid: add a new helper prepare_suspend() in md_personality - dm-raid: really frozen sync_thread during suspend - md: add a new helper reshape_interrupted() - md: export helper md_is_rdwr() - md: export helpers to stop sync_thread - md: don't clear MD_RECOVERY_FROZEN for new dm-raid until resume - md/raid1: factor out helpers to choose the best rdev from read_balance() - md/raid1: factor out the code to manage sequential IO - md/raid1: factor out choose_bb_rdev() from read_balance() - md/raid1: factor out choose_slow_rdev() from read_balance() - md/raid1: factor out read_first_rdev() from read_balance() - md/raid1-10: factor out a new helper raid1_should_read_first() - md/raid1-10: add a helper raid1_check_read_range() - md/raid1: fix choose next idle in read_balance() - md/raid1: record nonrot rdevs while adding/removing rdevs to conf - md/raid1: factor out helpers to add rdev to conf - md: add a new helper rdev_has_badblock() - md: check mddev->pers before calling md_set_readonly() - md: clean up openers check in do_md_stop() and md_set_readonly() - md: sync blockdev before stopping raid or setting readonly - md: factor out a helper to sync mddev - md: return directly before setting did_set_md_closing - md: changed the switch of RAID_VERSION to if - md: merge the check of capabilities into md_ioctl_valid() - md: Don't suspend the array for interrupted reshape - md: Don't register sync_thread for reshape directly - md: Make sure md_do_sync() will set MD_RECOVERY_DONE - md: Don't ignore read-only array in md_check_recovery() - md: Don't ignore suspended array in md_check_recovery() - md: get rdev->mddev with READ_ONCE() - md: remove redundant md_wakeup_thread() - md: remove redundant check of 'mddev->sync_thread' - md: fix a suspicious RCU usage warning - raid: Remove now superfluous sentinel element from ctl_table array - NFSD: NFSv4 file creation neglects setting ACL - nfsd: set security label during create operations - xfs: Add xfs_dir3_leaf_header_check() in leaf/leafn read - nvme-fc: use lock accessing port_state and rport state - x86/mm: Batch flushing user memory encrytion status change - !20588 [OLK-6.6] Revert "x86/csv: Enhance CMA memory usage reporting for CSV3" - Revert "x86/csv: Enhance CMA memory usage reporting for CSV3" - !20576 media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg() - !20575 RDMA/cm: Fix leaking the multicast GID table reference - !20580 RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly - !20551 Fix CVE-2025-68785 - !20478 f2fs: fix to avoid potential deadlock - !20501 [OLK-6.6] backport important bugfix for bnxt driver from upstream linux-6.6.y - !20520 Fix CVE-2026-23038 - !20424 net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup - !20425 mlx5: Fix default values in create CQ - RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly - media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg() - RDMA/cm: Fix leaking the multicast GID table reference - net: openvswitch: fix middle attribute validation in push_nsh() action - net: openvswitch: remove never-working support for setting nsh fields - pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() - bnxt_en: Fix potential data corruption with HW GRO/LRO - f2fs: fix to avoid potential deadlock - mlx5: Fix default values in create CQ - net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup - riscv kernel upgrade to 6.6.0-138.0.0 - Fixed system hang when boot systemd on spacemit k3 - riscv: perf vendor events: fix lrw core PMU event mapping - !20727 v2 bpf: sockmap fixes - !20741 scsi: qla2xxx: Sanitize payload size to prevent member overflow - !20744 fix CVE-2025-38449 - !20763 net: usb: asix: validate PHY address before use - !20762 smc91x: fix broken irq-context in PREEMPT_RT - !20293 [Hygon][6.6][EDAC] The width of hash value is 2 bits for Hygon family 18h model 6h processors - !20290 [Hygon][6.6][Bugfix] Bug fix for EDAC to use unicast instead of broadcast on hygon family 18h model 4h - !20289 [Hygon][6.6][Bugfix] Bug fix for EDAC to correct the address translation on hygon family 18h model 4h - !20245 KVM: arm64: Refactor exit handlers - !20246 KVM: arm64: Mark some header functions as inline - !19005 [Hygon] [OLK-6.6] [Bugfix] Fix memory bandwidth counter width for Hygon QoS - !20292 [Hygon][6.6][TSC Adjust] Backport x86 TSC adjust patch - !20273 [Hygon][6.6][Bugfix] Get correct CPU LLC ID in guest for Hygon processors - !20722 [OLK-6.6][linux-6.6.y sync] Backport 6.6.104-6.6.106 LTS Patches - !20667 fix CVE-2024-50102 - !20736 netfilter: nf_tables: remove redundant chain validation on register store - !20758 ub: ubase: Fixed the alarm issue caused by the initialization of the structure variable definition. - !20721 obmm: reduce log noise for successful export/import/preimport - net: usb: asix: validate PHY address before use - smc91x: fix broken irq-context in PREEMPT_RT - !20731 devlink: rate: Unset parent pointer in devl_rate_nodes_destroy - !20732 libceph: return the handler error from mon_handle_auth_done() - !20743 mm: slub: avoid wake up kswapd in set_track_prepare - ub: ubase: Fixed the alarm issue caused by the initialization of the structure variable definition. - !20750 ub: cdma: adapted to UMMU interface changes - !20713 urma: DFX of log in kernel - urma: optimize log levels for kernel space - ub: cdma: adapted to UMMU interface changes - wifi: ath11k: avoid bit operation on key flags - drm/mediatek: fix potential OF node use-after-free - cpufreq: intel_pstate: Check IDA only before MSR_IA32_PERF_CTL writes - wifi: cfg80211: sme: store capped length in __cfg80211_connect_result() - !20708 ub:hisi-ubus: Add create bus instance ummu bypass - drm: fix kabi for struct drm_framebuffer - drm/framebuffer: Acquire internal references on GEM handles - drm/gem: Acquire references on GEM handles for framebuffers - mm: slub: avoid wake up kswapd in set_track_prepare - scsi: qla2xxx: Sanitize payload size to prevent member overflow - netfilter: nf_tables: remove redundant chain validation on register store - libceph: return the handler error from mon_handle_auth_done() - devlink: rate: Unset parent pointer in devl_rate_nodes_destroy - Documentation/hw-vuln: Add VMSCAPE documentation - dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status() - riscv: use lw when reading int cpu in asm_per_cpu - mm: slub: avoid wake up kswapd in set_track_prepare - tools: gpio: remove the include directory on make clean - tools: gpio: rm .*.cmd on make clean - drm/amd/amdgpu: Fix missing error return on kzalloc failure - drm/amdgpu: Replace DRM_* with dev_* in amdgpu_psp.c - perf bpf-event: Fix use-after-free in synthesis - drm/bridge: ti-sn65dsi86: fix REFCLK setting - spi: spi-fsl-lpspi: Clear status register after disabling the module - spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort - spi: spi-fsl-lpspi: Set correct chip-select polarity bit - spi: spi-fsl-lpspi: Fix transmissions when using CONT - hwmon: mlxreg-fan: Prevent fans from getting stuck at 0 RPM - pcmcia: omap: Add missing check for platform_get_resource - Revert "drm/amdgpu: Avoid extra evict-restore process." - ALSA: hda/realtek: Fix headset mic for TongFang X6[AF]R5xxY - ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model - drm/mediatek: Fix device/node reference count leaks in mtk_drm_get_all_drm_priv - drm/mediatek: Fix using wrong drm private data to bind mediatek-drm - drm/mediatek: Add crtc path enum for all_drm_priv array - vmxnet3: update MTU after device quiesce - net: dsa: microchip: linearize skb for tail-tagging switches - net: dsa: microchip: update tag_ksz masks for KSZ9477 family - dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status() - ALSA: hda/realtek - Add new HP ZBook laptop with micmute led fixup - ALSA: hda/realtek: Add support for HP Agusta using CS35L41 HDA - iio: pressure: mprls0025pa: use aligned_s64 for timestamp - iio: chemical: pms7003: use aligned_s64 for timestamp - iio: imu: inv_mpu6050: align buffer for timestamp - thermal/drivers/mediatek/lvts: Disable low offset IRQ for minimum threshold - nouveau: fix disabling the nonstall irq due to storm code - cpufreq: intel_pstate: Unchecked MSR aceess in legacy mode - net: pcs: rzn1-miic: Correct MODCTRL register offset - platform/x86/amd/pmc: Add TUXEDO IB Pro Gen10 AMD to spurious 8042 quirks list - drm/amdgpu: drop hw access in non-DC audio fini - wifi: mt76: mt7996: Initialize hdr before passing to skb_put_data() - wifi: mwifiex: Initialize the chan_stats array to zero - tcp_bpf: Fix copied value in tcp_bpf_sendmsg - skmsg: Return copied bytes in sk_msg_memcopy_from_iter - tcp_bpf: Add sk_rmem_alloc related logic for tcp_bpf ingress redirection - Revert "bpf, sockmap: Add sk_rmem_alloc check for sockmap" - ALSA: usb-audio: Add mute TLV for playback volumes on some devices - phy: mscc: Stop taking ts_lock for tx_queue and use its own lock - selftest: net: Fix weird setsockopt() in bind_bhash.c. - net: atm: fix memory leak in atm_register_sysfs when device_register fail - ax25: properly unshare skbs in ax25_kiss_rcv() - mctp: return -ENOPROTOOPT for unknown getsockopt options - net/smc: Remove validation of reserved bits in CLC Decline message - ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init() - net: thunder_bgx: decrement cleanup index before use - net: thunder_bgx: add a missing of_node_put - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() - wifi: libertas: cap SSID len in lbs_associate() - wifi: cw1200: cap SSID length in cw1200_do_join() - net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets - wifi: ath11k: fix group data packet drops during rekey - wifi: ath11k: avoid forward declaration of ath11k_mac_start_vdev_delay() - wifi: ath11k: rename ath11k_start_vdev_delay() - wifi: ath11k: Introduce and use ath11k_sta_to_arsta() - net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() - macsec: read MACSEC_SA_ATTR_PN with nla_get_uint - netlink: add variable-length / auto integers - net: macb: Fix tx_ptr_lock locking - icmp: fix icmp_ndo_send address translation for reply direction - mISDN: Fix memory leak in dsp_hwec_enable() - xirc2ps_cs: fix register access when enabling FullDuplex - netfilter: conntrack: helper: Replace -EEXIST by -EBUSY - wifi: cfg80211: fix use-after-free in cmp_bss() - arm64: dts: imx8mp: Fix missing microSD slot vqmmc on Data Modul i.MX8M Plus eDM SBC - arm64: dts: imx8mp: Fix missing microSD slot vqmmc on DH electronics i.MX8M Plus DHCOM - tee: optee: ffa: fix a typo of "optee_ffa_api_is_compatible" - arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro - Bluetooth: hci_sync: Avoid adding default advertising on startup - cpupower: Fix a bug where the -t option of the set subcommand was not working. - drm/amd/display: Don't warn when missing DCE encoder caps - cdc_ncm: Flag Intel OEM version of Fibocom L850-GL as WWAN - LoongArch: Save LBT before FPU in setup_sigcontext() - btrfs: avoid load/store tearing races when checking if an inode was logged - btrfs: fix race between setting last_dir_index_offset and inode logging - btrfs: fix race between logging inode and checking if it was logged before - bpf: Fix oob access in cgroup local storage - !20556 urma: fix update topo logic - !20639 [OLK-6.6][linux-6.6.y sync] Backport 6.6.103-6.6.104 LTS Patches - !20641 [OLK-6.6][linux-6.6.y sync] LoongArch: Add more instruction opcodes and emit_* helpers - !20560 *** fix CVE-2025-38062 *** - !20662 pNFS: Fix a deadlock when returning a delegation during open() - ub:hisi-ubus: Add create bus instance ummu bypass - Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" - Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set" - HID: mcp2221: Handle reads greater than 60 bytes - HID: mcp2221: Don't set bus speed on every transfer - net/mlx5: SF, Fix add port error handling - drm/nouveau/disp: Always accept linear modifier - smb3 client: fix return code mapping of remap_file_range - net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions - dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted - HID: wacom: Add a new Art Pen 2 - HID: logitech: Add ids for G PRO 2 LIGHTSPEED - HID: quirks: add support for Legion Go dual dinput modes - net: stmmac: Set CIC bit only for TX queues with COE - net: stmmac: xgmac: Correct supported speed modes - net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts - net/mlx5e: Set local Xoff after FW update - net/mlx5e: Update and set Xon/Xoff upon port speed set - net/mlx5e: Update and set Xon/Xoff upon MTU set - net/mlx5: Nack sync reset when SFs are present - net/mlx5: Convert SF port_indices xarray to function_ids xarray - net/mlx5: Use devlink port pointer to get the pointer of container SF struct - net/mlx5: Call mlx5_sf_id_erase() once in mlx5_sf_dealloc() - phy: mscc: Fix when PTP clock is register and unregister - net: dlink: fix multicast stats being counted incorrectly - dt-bindings: display/msm: qcom,mdp5: drop lut clock - drm/nouveau: remove unused memory target test - drm/nouveau: remove unused increment in gm200_flcn_pio_imem_wr - Bluetooth: hci_sync: fix set_local_name race condition - Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced - Bluetooth: hci_event: Mark connection as closed during suspend disconnect - Bluetooth: hci_event: Treat UNKNOWN_CONN_ID on disconnect as success - HID: input: report battery status changes immediately - HID: input: rename hidinput_set_battery_charge_status() - powerpc/kvm: Fix ifdef to remove build warning - drm/msm: Defer fd_install in SUBMIT ioctl - vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() - ACPI: EC: Add device to acpi_ec_no_wakeup[] qurik list - erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC - ASoC: codecs: tx-macro: correct tx_macro_component_drv name - smb: client: fix race with concurrent opens in unlink(2) - scsi: core: sysfs: Correct sysfs attributes access rights - of: dynamic: Fix use after free in of_changeset_add_prop_helper() - of: Add a helper to free property struct - mips: lantiq: xway: sysctrl: rename the etop node - mips: dts: lantiq: danube: add missing burst length property - pinctrl: STMFX: add missing HAS_IOMEM dependency - of: dynamic: Fix memleak when of_pci_add_properties() failed - !20684 urma: adjust urma log format - !20355 udp: Deal with race between UDP socket address change and rehash - !20627 Fixes CVE-2025-38627 - !20702 CVE-2025-39948 - !20701 netfilter: ctnetlink: remove refcounting in expectation dumpers - !20700 CVE-2025-38678 - !20703 CVE-2025-38491 - !20690 tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. - obmm: reduce log noise for successful export/import/preimport - mptcp: avoid deadlock on fallback while reinjecting - mptcp: plug races between subflow fail and subflow creation - mptcp: make fallback action and fallback decision atomic - ice: fix Rx page leak on multi-buffer frames - ice: fix incorrect counter for buffer allocation failures - ice: stop storing XDP verdict within ice_rx_buf - ice: gather page_count()'s of each frag right before XDP prog call - ice: Introduce ice_xdp_buff - netfilter: ctnetlink: remove refcounting in expectation dumpers - netfilter: nf_tables: reject duplicate device on updates - netfilter: nf_tables: Introduce functions freeing nft_hook objects - netfilter: nf_tables: Fix percpu address space issues in nf_tables_api.c - err.h: add ERR_PTR_PCPU(), PTR_ERR_PCPU() and IS_ERR_PCPU() macros - tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. - !20498 Fix CVE-2025-71118 - !20608 pmdomain: arm: scmi: Fix genpd leak on provider registration failure - !20679 x86/CPU/AMD: Add RDSEED fix for Zen5 - !20650 fix cve-2025-40300 - !20661 Input: alps - fix use-after-free bugs caused by dev3_register_work - !20664 backport some net bugfix from 6.6 lts - urma: adjust urma log format - !20678 ub: udma: close debug switch load parameters. - ub: udma: close debug switch load parameters. - x86/CPU/AMD: Add RDSEED fix for Zen5 - !20630 net: LTS-6.6 bugfix backport - !20632 net/sched: sch_qfq: do not free existing class in qfq_change_class() - !20631 macvlan: fix possible UAF in macvlan_forward_source() - !20628 Fix CVE-2025-39910 - !20659 v2 Fix CVE-2025-22090 - !20506 XSched: Update XSched manual - !20647 media: imon: make send_packet() more robust - !20646 ksm: use range-walk function to jump over holes in scan_get_next_rmap_item - !20645 fbcon: Set fb_display[i - !20648 parse_longname(): strrchr() expects NUL-terminated string - !20621 urma: modify log level - !20602 urma: fix the jfe uaf issue that occurred during the killall process. - !20567 urma:change log level and pass status 9 - !20640 iio: common: st_sensors: Fix use of uninitialize device structs - !20634 usb: gadget: udc: fix use-after-free in usb_gadget_state_work - !20633 net: dsa: properly keep track of conduit reference - !20635 fix CVE-2025-68231 - !20651 mm/slub: avoid accessing metadata when pointer is invalid in object_err() - !20649 drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb - !20652 mm/vmalloc: fix data race in show_numa_info() - x86: uaccess: don't use runtime-const rewriting in modules - x86: fix off-by-one in access_ok() - x86: fix user address masking non-canonical speculation issue - x86/uaccess: Zero the 8-byte get_range case on failure on 32-bit - x86/uaccess: Improve the 8-byte getuser() case - x86: fix whitespace in runtime-const assembler output - dcache: keep dentry_hashtable or d_hash_shift even when not used - runtime constants: add x86 architecture support - runtime constants: deal with old decrepit linkers - x86/uaccess: Add missing __force to casts in __access_ok() and valid_user_address() - !20345 arm64: entry: xcall/xint: make asm conditionals compatible with clang IAS - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). - libceph: replace BUG_ON with bounds check for map->max_osd - libceph: prevent potential out-of-bounds writes in handle_auth_session_key() - libceph: fix potential use-after-free in have_mon_and_osd_map() - sctp: Hold sock lock while iterating over address list - sctp: Prevent TOCTOU out-of-bounds write - sctp: Hold RCU read lock while iterating over address list - tipc: Fix use-after-free in tipc_mon_reinit_self(). - sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto - sctp: avoid NULL dereference when chunk data buffer is missing - bpf: Explicitly check accesses to bpf_sock_addr - ipvs: Defer ip_vs_ftp unregister during netns cleanup - nexthop: Forbid FDB status change while nexthop is in a group - netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). - net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer - sctp: initialize more fields in sctp_v6_from_sk() - pNFS: Fix a deadlock when returning a delegation during open() - Input: alps - fix use-after-free bugs caused by dev3_register_work - x86/cpu: Get CPU LLC ID from CPUID 0x8000001d in guest for Hygon processors - kernel/fork: only call untrack_pfn_clear() on VMAs duplicated for fork() - mm: (un)track_pfn_copy() fix + doc improvements - x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range() - !20642 mtdchar: fix integer overflow in read/write ioctls - mm/vmalloc: fix data race in show_numa_info() - mm/slub: avoid accessing metadata when pointer is invalid in object_err() - config: enable CONFIG_MITIGATION_VMESCAPE by default on x86 - x86/vmscape: Enable the mitigation - x86/vmscape: Enumerate VMSCAPE bug - x86/vmscape: Add conditional IBPB mitigation - drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb - parse_longname(): strrchr() expects NUL-terminated string - media: imon: make send_packet() more robust - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item - fbcon: Set fb_display[i]->mode to NULL when the mode is released - !20569 CVE-2024-35808 - mtdchar: fix integer overflow in read/write ioctls - !20619 Fix CVE-2026-22991 - !20612 net: hns3: extend HCLGE_FD_AD_COUNTER_NUM to 8 bits - LoongArch: Add more instruction opcodes and emit_* helpers - iio: common: st_sensors: Fix use of uninitialize device structs - !20581 null_blk: fix kmemleak by releasing references to fault configfs items - mm/mempool: fix poisoning order>0 pages with HIGHMEM - mm/page_poison: replace kmap_atomic() with kmap_local_page() - mm/mempool: replace kmap_atomic() with kmap_local_page() - usb: gadget: udc: fix use-after-free in usb_gadget_state_work - net: dsa: properly keep track of conduit reference - net/sched: sch_qfq: do not free existing class in qfq_change_class() - macvlan: fix possible UAF in macvlan_forward_source() - netfilter: nft_objref: validate objref and objrefmap expressions - arp: do not assume dev_hard_header() does not change skb->head - ip6_gre: make ip6gre_header() robust - netfilter: nf_tables: avoid chain re-validation if possible - netfilter: nf_tables: drop unused 3rd argument from validate callback ops - Revert "netfilter: nft_objref: validate objref and objrefmap expressions" - bpf: Fix reference count leak in bpf_prog_test_run_xdp() - net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset - ethtool: Avoid overflowing userspace buffer on stats query - ipvs: fix ipv4 null-ptr-deref in route error path - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() - !20596 mm/page_alloc: prevent pcp corruption with SMP=n - !20598 team: fix check for port enabled in team_queue_override_port_prio_changed() - !18823 hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio - mm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc() - kasan: avoid sleepable page allocation from atomic context - f2fs: compress: fix UAF of f2fs_inode_info in f2fs_free_dic - f2fs: compress: change the first parameter of page_array_{alloc,free} to sbi - !20583 [OLK-6.6][linux-6.6.y sync] Backport 6.6.102-6.6.103 LTS Patches - !20460 fbdev: Fix vmalloc out-of-bounds write in fast_imageblit - urma:fix log level and pass status 9 - urma: modify log level - !20592 CVE-2025-71141 fixup - !20594 CVE-2025-39744 fixup - !20607 powerpc/64s/slb: Fix SLB multihit issue during SLB preload - !20606 mm/huge_memory: fix NULL pointer deference when splitting folio - !20604 Fix CVE-2026-22984 - !20603 Fix CVE-2026-23021 - !20600 Fix CVE-2026-22990 - urma: fix the jfe uaf issue that occurred during the killall process. - !20380 pswiotlb: Adapt to the IOMMU DMA API upgraded by IOMMUFD - libceph: make free_choose_arg_map() resilient to partial allocation - drm/dp: Change AUX DPCD probe address from LANE0_1_STATUS to TRAINING_PATTERN_SET - net: hns3: extend HCLGE_FD_AD_COUNTER_NUM to 8 bits - net: hns3: extend HCLGE_FD_AD_QID to 11 bits - net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue - net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M - Revert "net: hns3: add support for FD counter" - !20587 dmaengine: stm32: dmamux: fix device leak on route allocation - pmdomain: arm: scmi: Fix genpd leak on provider registration failure - powerpc/64s/slb: Fix SLB multihit issue during SLB preload - mm/huge_memory: fix NULL pointer deference when splitting folio - !20562 LoongArch: BPF: Sign extend kfunc call arguments - !20470 ipv4: Fix reference count leak when using error routes with nexthop objects - !20471 net: sock: fix hardened usercopy panic in sock_recv_errqueue - !20472 net: fix memory leak in skb_segment_list for GRO packets - !20473 ipv4: ip_gre: make ipgre_header() robust - !20469 SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf - !20476 ipv6: Fix use-after-free in inet6_addr_del(). - !20477 svcrdma: bound check rq_pages index in inline path - !20578 ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() - !20579 fix CVE-2025-68768 - !20542 Fix NFS deadlock - USB: storage: Remove subclass and protocol overrides from Novatek quirk - cpuidle: governors: menu: Select polling state in some more cases - cpuidle: governors: menu: Rearrange main loop in menu_select() - cpuidle: menu: Update documentation after previous changes - Revert "drm/tegra: dsi: Clear enable register if powered by bootloader" - parisc: Remove spurious if statement from raw_copy_from_user() - ata: libata-scsi: Fix system suspend for a security locked drive - Revert "drm/amdgpu: fix incorrect vm flags to map bo" - mfd: axp20x: Set explicit ID for regulator cell if no IRQ line is present - drm/amd/display: use udelay rather than fsleep - sched/fair: Revert max_newidle_lb_cost bump - net: ipv4: fix regression in local-broadcast routes - tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers - PM: runtime: Do not clear needs_force_resume with enabled runtime PM - usb: typec: ucsi: psy: Set max current to zero when disconnected - io_uring/rw: cast rw->flags assignment to rwf_t - Documentation: ACPI: i2c-muxes: fix I2C device references - s390/hypfs: Enable limited access during lockdown - s390/hypfs: Avoid unnecessary ioctl registration in debugfs - ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation - net/mlx5e: Preserve shared buffer capacity during headroom updates - net/mlx5: Base ECVF devlink port attrs from 0 - Octeontx2-af: Skip overlap check for SPI field - bonding: send LACPDUs periodically in passive mode after receiving partner's LACPDU - bonding: Add independent control state machine - bonding: update LACP activity flag after setting lacp_active - net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate - ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc - gve: prevent ethtool ops after shutdown - phy: mscc: Fix timestamping for vsc8584 - net: ethernet: mtk_ppe: add RCU lock around dev_fill_forward_path - ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add - net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM - ALSA: usb-audio: Fix size validation in convert_chmap_v3() - mlxsw: spectrum: Forward packets with an IPv4 link-local source IP - Bluetooth: hci_conn: do return error from hci_enhanced_setup_sync() - Bluetooth: hci_event: fix MTU for BN == 0 in CIS Established - scsi: qla4xxx: Prevent a potential error pointer dereference - RDMA/bnxt_re: Fix to initialize the PBL array - RDMA/bnxt_re: Fix to remove workload check in SRQ limit path - RDMA/bnxt_re: Fix to do SRQ armena by default - RDMA/erdma: Fix ignored return value of init_kernel_qp - iosys-map: Fix undefined behavior in iosys_map_clear() - cgroup/cpuset: Use static_branch_enable_cpuslocked() on cpusets_insane_config_key - spi: spi-fsl-lpspi: Clamp too high speed_hz - usb: typec: maxim_contaminant: disable low power mode when reading comparator values - usb: typec: maxim_contaminant: re-enable cc toggle if cc is open and port is clean - iio: imu: inv_icm42600: change invalid data error to -EBUSY - iio: imu: inv_icm42600: Convert to uXX and sXX integer types - iio: imu: inv_icm42600: use = { } instead of memset() - iio: imu: inv_icm42600: switch timestamp type from int64_t __aligned(8) to aligned_s64 - iio: temperature: maxim_thermocouple: use DMA-safe buffer for spi_read() - iio: light: as73211: Ensure buffer holes are zeroed - tls: fix handling of zero-length records on the rx_list - powerpc/boot: Fix build with gcc 15 - mmc: sdhci-pci-gli: GL9763e: Mask the replay timer timeout of AER - compiler: remove __ADDRESSABLE_ASM{_STR,}() again - drm/amd/display: Don't overclock DCE 6 by 15% - usb: dwc3: pci: add support for the Intel Wildcat Lake - usb: dwc3: Ignore late xferNotReady event to prevent halt timeout - USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles - usb: storage: realtek_cr: Use correct byte order for bcs->Residue - USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera - usb: renesas-xhci: Fix External ROM access timeouts - usb: core: hcd: fix accessing unmapped memory in SINGLE_STEP_SET_FEATURE test - comedi: Make insn_rw_emulate_bits() do insn->n samples - usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive - cdx: Fix off-by-one error in cdx_rpmsg_probe() - most: core: Drop device reference after usage in get_channel() - iio: proximity: isl29501: fix buffered read on big-endian systems - iio: pressure: bmp280: Use IS_ERR() in bmp280_common_probe() - fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable() - drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS - cpuidle: governors: menu: Avoid selecting states with too much latency - cpuidle: menu: Remove iowait influence - mmc: sdhci-pci-gli: Add a new function to simplify the code - mmc: sdhci-pci-gli: Use PCI AER definitions, not hard-coded values - mptcp: disable add_addr retransmission when timeout is 0 - mptcp: remove duplicate sk_reset_timer call - use uniform permission checks for all mount propagation changes - arm64: dts: ti: k3-am62-main: Remove eMMC High Speed DDR support - scsi: mpi3mr: Serialize admin queue BAR writes on 32-bit systems - scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers - scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE - PCI: imx6: Add IMX8MM_EP and IMX8MP_EP fixed 256-byte BAR 4 in epc_features - PCI: imx6: Delay link start until configfs 'start' written - PCI: rockchip: Set Target Link Speed to 5.0 GT/s before retraining - PCI: rockchip: Use standard PCIe definitions - drm/amd/display: Fill display clock and vblank time in dce110_fill_display_configs - drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs - drm/amd/display: Fix DP audio DTO1 clock source on DCE 6. - drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3 - ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and EliteBook 830 G6 - mm/debug_vm_pgtable: clear page table entries at destroy_args() - squashfs: fix memory leak in squashfs_fill_super - mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for consistency - memstick: Fix deadlock by moving removing flag earlier - KVM: arm64: Fix kernel BUG() due to bad backport of FPSIMD/SVE/SME fix - sched/fair: Fix frequency selection for non-invariant case - kbuild: userprogs: use correct linker when mixing clang and GNU ld - ata: libata-scsi: Return aborted command when missing sense and result TF - PM: runtime: Take active children into account in pm_runtime_get_if_in_use() - PM: runtime: Simplify pm_runtime_get_if_active() usage - ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig - usb: dwc3: imx8mp: fix device leak at unbind - wifi: mac80211: check basic rates validity in sta_link_apply_parameters - KVM: x86: Take irqfds.lock when adding/deleting IRQ bypass producer - s390/mm: Remove possible false-positive warning in pte_free_defer() - btrfs: send: make fs_path_len() inline and constify its argument - btrfs: send: use fallocate for hole punching with send stream v2 - btrfs: send: avoid path allocation for the current inode when issuing commands - btrfs: send: keep the current inode's path cached - btrfs: send: add and use helper to rename current inode when processing refs - btrfs: send: only use boolean variables at process_recorded_refs() - btrfs: send: factor out common logic when sending xattrs - btrfs: populate otime when logging an inode item - btrfs: constify more pointer parameters - btrfs: fix ssd_spread overallocation - btrfs: open code timespec64 in struct btrfs_inode - xfs: fully decouple XFS_IBULK* flags from XFS_IWALK* flags - btrfs: abort transaction on unexpected eb generation at btrfs_copy_root() - btrfs: always abort transaction on failure to add block group to free space tree - btrfs: move transaction aborts to the error site in add_block_group_free_space() - btrfs: qgroup: fix race between quota disable and quota rescan ioctl - usb: typec: fusb302: cache PD RX state - block: Make REQ_OP_ZONE_FINISH a write operation - block: reject invalid operation in submit_bio_noacct - leds: flash: leds-qcom-flash: Fix registry access after re-bind - leds: flash: leds-qcom-flash: Limit LED current based on thermal condition - selftests/memfd: add test for mapping write-sealed memfd read-only - mm: update memfd seal write check to include F_SEAL_WRITE - mptcp: pm: kernel: flush: do not reset ADD_ADDR limit - mptcp: drop skb if MPTCP skb extension allocation fails - ipv6: sr: Fix MAC comparison to be constant-time - drm/amd/display: Don't overwrite dce60_clk_mgr - drm/amd/display: Add primary plane to commits for correct VRR handling - drm/amdkfd: Destroy KFD debugfs after destroy KFD wq - drm/amdgpu: update mmhub 3.0.1 client id mappings - drm/amdgpu: Avoid extra evict-restore process. - drm/amd: Restore cached power limit during resume - media: venus: venc: Clamp param smaller than 1fps and bigger than 240 - media: venus: vdec: Clamp param smaller than 1fps and bigger than 240. - media: venus: protect against spurious interrupts during probe - media: venus: hfi: explicitly release IRQ during teardown - media: qcom: camss: cleanup media device allocated resource on error path - media: ov2659: Fix memory leaks in ov2659_probe() - media: usbtv: Lock resolution while streaming - media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free() - media: verisilicon: Fix AV1 decoder clock frequency - media: vivid: fix wrong pixel_array control size - media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init() - media: hi556: correct the test pattern configuration - media: gspca: Add bounds checking to firmware parser - parisc: Update comments in make_insert_tlb - parisc: Try to fixup kernel exception in bad_area_nosemaphore path of do_page_fault() - parisc: Rename pte_needs_flush() to pte_needs_cache_flush() in cache.c - parisc: Makefile: explain that 64BIT requires both 32-bit and 64-bit compilers - parisc: Define and use set_pte_at() - parisc: Check region is readable by user in raw_copy_from_user() - soc/tegra: pmc: Ensure power-domains are in a known state - f2fs: fix to avoid out-of-boundary access in dnode page - phy: qcom: phy-qcom-m31: Update IPQ5332 M31 USB phy initialization sequence - vhost/vsock: Avoid allocating arbitrarily-sized SKBs - PCI: endpoint: Fix configfs group removal on driver teardown - PCI: endpoint: Fix configfs group list head handling - mtd: rawnand: renesas: Add missing check after DMA map - mtd: rawnand: fsmc: Add missing check after DMA map - mtd: spinand: propagate spinand_wait() errors from spinand_write_page() - mtd: spi-nor: Fix spi_nor_try_unlock_all() - hwmon: (gsc-hwmon) fix fan pwm setpoint show functions - pwm: mediatek: Fix duty and period setting - pwm: mediatek: Handle hardware enable and clock enable separately - pwm: imx-tpm: Reset counter if CMOD is 0 - wifi: ath11k: fix dest ring-buffer corruption when ring is full - wifi: ath11k: fix source ring-buffer corruption - wifi: ath11k: fix dest ring-buffer corruption - wifi: ath12k: fix dest ring-buffer corruption when ring is full - wifi: ath12k: fix source ring-buffer corruption - wifi: ath12k: fix dest ring-buffer corruption - wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table() - iio: adc: ad_sigma_delta: change to buffer predisable - zynq_fpga: use sgtable-based scatterlist wrappers - scsi: ufs: ufs-pci: Fix default runtime and system PM levels - scsi: ufs: ufs-pci: Fix hibernate state transition for Intel MTL-like host controllers - ata: libata-scsi: Fix ata_to_sense_error() status handling - scsi: mpi3mr: Fix race between config read submit and interrupt completion - dt-bindings: display: sprd,sharkl3-dsi-host: Fix missing clocks constraints - dt-bindings: display: sprd,sharkl3-dpu: Fix missing clocks constraints - arm64: dts: ti: k3-am62-verdin: Enable pull-ups on I2C buses - arm64: dts: ti: k3-am62a7-sk: fix pinmux for main_uart1 - arm64: dts: ti: k3-pinctrl: Enable Schmitt Trigger by default - btrfs: zoned: fix write time activation failure for metadata block group - ext4: fix hole length calculation overflow in non-extent inodes - ext4: don't try to clear the orphan_present feature block device is r/o - ext4: fix reserved gdt blocks handling in fsmap - ext4: fix fsmap end of range reporting with bigalloc - ext4: check fast symlink for ea_inode correctly - tracing: fprobe-event: Sanitize wildcard for fprobe event name - crypto: qat - lower priority for skcipher and aead algorithms - lib/crypto: mips/chacha: Fix clang build and remove unneeded byteswap - vt: defkeymap: Map keycodes above 127 to K_HOLE - vt: keyboard: Don't process Unicode characters in K_OFF mode - bus: mhi: host: Fix endianness of BHI vector table - usb: dwc3: meson-g12a: fix device leaks at unbind - usb: musb: omap2430: fix device leak at unbind - usb: gadget: udc: renesas_usb3: fix device leak at unbind - usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init() - m68k: Fix lost column on framebuffer debug console - platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister() - cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table() - rcu: Fix racy re-initialization of irq_work causing hangs - HID: apple: avoid setting up battery timer for devices without battery - HID: magicmouse: avoid setting up battery timer when not needed - RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages - tools/nolibc: fix spelling of FD_SETBITMASK in FD_* macros - media: uvcvideo: Do not mark valid metadata as invalid - media: venus: Fix OOB read due to missing payload bound check - parisc: Makefile: fix a typo in palo.conf - fbdev: Fix vmalloc out-of-bounds write in fast_imageblit - btrfs: do not allow relocation of partially dropped subvolumes - btrfs: zoned: do not select metadata BG as finish target - btrfs: clear dirty status from extent buffer on error at insert_new_root() - btrfs: zoned: do not remove unwritten non-data block group - btrfs: abort transaction during log replay if walk_log_tree() failed - btrfs: zoned: use filesystem size not disk size for reclaim decision - cdc-acm: fix race between initial clearing halt and open - thunderbolt: Fix copy+paste error in match_service_id() - usb: typec: ucsi: Update power_supply on power role change - misc: rtsx: usb: Ensure mmc child device is active when card is present - iommufd: Report unmapped bytes in the error path of iopt_unmap_iova_range - cifs: reset iface weights when we cannot find a candidate - drm/amdgpu: fix incorrect vm flags to map bo - scsi: lpfc: Remove redundant assignment to avoid memory leak - rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe - pNFS: Handle RPC size limit for layoutcommits - pNFS: Fix disk addr range check in block/scsi layout - pNFS: Fix stripe mapping in block/scsi layout - ASoC: Intel: avs: Fix uninitialized pointer error in probe() - net: phy: smsc: add proper reset flags for LAN8710A - ipmi: Fix strcpy source and destination the same - kconfig: lxdialog: fix 'space' to (de)select options - kconfig: gconf: fix potential memory leak in renderer_edited() - kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed() - ipmi: Use dev_warn_ratelimited() for incorrect message warnings - vfio/mlx5: fix possible overflow in tracking max message size - scsi: aacraid: Stop using PCI_IRQ_AFFINITY - scsi: target: core: Generate correct identifiers for PR OUT transport IDs - scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans - kconfig: nconf: Ensure null termination where strncpy is used - vfio/type1: conditional rescheduling while pinning - kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c - f2fs: check the generic conditions first - exfat: add cluster chain loop check for dir - i2c: Force DLL0945 touchpad i2c freq to 100khz - apparmor: use the condition in AA_BUG_FMT even with debug disabled - dm-table: fix checking for rq stackable devices - dm-mpath: don't print the "loaded" message if registering fails - i3c: master: Initialize ret in i3c_i2c_notifier_call() - i3c: don't fail if GETHDRCAP is unsupported - apparmor: shift ouid when mediating hard links in userns - rtc: ds1307: handle oscillator stop flag (OSF) for ds1341 - i3c: add missing include to internal header - module: Prevent silent truncation of module name in delete_module(2) - md: dm-zoned-target: Initialize return variable r to avoid uninitialized use - soundwire: Move handle_nested_irq outside of sdw_dev_lock - soundwire: amd: serialize amd manager resume sequence during pm_prepare - crypto: octeontx2 - add timeout for load_fvc completion poll - media: uvcvideo: Fix bandwidth issue for Alcor camera - media: usb: hdpvr: disable zero-length read messages - media: tc358743: Increase FIFO trigger level to 374 - media: tc358743: Return an appropriate colorspace from tc358743_set_fmt - media: tc358743: Check I2C succeeded during probe - pinctrl: stm32: Manage irq affinity settings - scsi: mpi3mr: Correctly handle ATA device errors - scsi: mpt3sas: Correctly handle ATA device errors - power: supply: qcom_battmgr: Add lithium-polymer entry - RDMA/core: reduce stack using in nldev_stat_get_doit() - dmaengine: stm32-dma: configure next sg only if there are more than 2 sgs - leds: leds-lp50xx: Handle reg to get correct multi_index - media: v4l2-common: Reduce warnings about missing V4L2_CID_LINK_FREQ control - MIPS: lantiq: falcon: sysctrl: fix request memory check logic - crypto: jitter - fix intermediary handling - watchdog: iTCO_wdt: Report error if timeout configuration fails - MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free} - clk: qcom: ipq5018: keep XO clock always on - hwmon: (emc2305) Set initial PWM minimum value during probe based on thermal state - watchdog: dw_wdt: Fix default timeout - fs/orangefs: use snprintf() instead of sprintf() - phy: rockchip-pcie: Properly disable TEST_WRITE strobe signal - mfd: axp20x: Set explicit ID for AXP313 regulator - clk: tegra: periph: Fix error handling and resolve unsigned compare warning - fbdev: fix potential buffer overflow in do_register_framebuffer() - cifs: Fix calling CIFSFindFirst() for root path without msearch - watchdog: sbsa: Adjust keepalive timeout to avoid MediaTek WS0 race condition - drm/amd/display: Avoid configuring PSR granularity if PSR-SU not supported - drm/amd/display: Only finalize atomic_obj if it was initialized - vhost: fail early when __vhost_add_used() fails - vsock/virtio: Resize receive buffers so that each SKB fits in a 4K page - net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325 - rcu: Fix rcu_read_unlock() deadloop due to IRQ work - drm/amd/display: Avoid trying AUX transactions on disconnected ports - selftests/bpf: Fix a user_ringbuf failure with arm64 64KB page size - bpf: Make reg_not_null() true for CONST_PTR_TO_MAP - uapi: in6: restore visibility of most IPv6 socket options - drm/ttm: Should to return the evict error - drm: renesas: rz-du: mipi_dsi: Add min check for VCLK range - net: ncsi: Fix buffer overflow in fetching version id - ionic: clean dbpage in de-init - wifi: rtlwifi: fix possible skb memory leak in _rtl_pci_init_one_rxdesc() - ptp: Use ratelimite for freerun error message - bpftool: Fix JSON writer resource leak in version command - net: dsa: b53: prevent SWITCH_CTRL access on BCM5325 - net: dsa: b53: prevent DIS_LEARNING access on BCM5325 - net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325 - net: dsa: b53: fix b53_imp_vlan_setup for BCM5325 - gve: Return error for unknown admin queue command - net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs - net: vlan: Make is_vlan_dev() a stub when VLAN is not configured - drm/amd: Allow printing VanGogh OD SCLK levels without setting dpm to manual - dpaa_eth: don't use fixed_phy_change_carrier - wifi: iwlegacy: Check rate_idx range after addition - netmem: fix skb_frag_address_safe with unreadable skbs - powerpc: floppy: Add missing checks after DMA map - wifi: ath12k: Decrement TID on RX peer frag setup error handling - wifi: ath12k: Enable REO queue lookup table feature on QCN9274 hw2.0 - wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`. - wifi: mac80211: update radar_required in channel context after channel switch - drm/amd/display: Fix 'failed to blank crtc!' - wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect - wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd() - wifi: ath12k: Add memset and update default rate value in wmi tx completion - drm/amd/display: Separate set_gsl from set_gsl_source_select - net: fec: allow disable coalescing - net: atlantic: add set_power to fw_ops for atl2 to fix wol - net: thunderbolt: Fix the parameter passing of tb_xdomain_enable_paths()/tb_xdomain_disable_paths() - net: thunderbolt: Enable end-to-end flow control also in transmit - kselftest/arm64: Specify SVE data when testing VL set in sve-ptrace - wifi: mt76: mt7915: mcu: re-init MCU before loading FW patch - wifi: rtw89: Disable deep power saving for USB/SDIO - wifi: rtw89: Fix rtw89_mac_power_switch() for USB - drm/msm: use trylock for debugfs - wifi: mac80211: fix rx link assignment for non-MLO stations - ipv6: mcast: Check inet6_dev->dead under idev->mc_lock in __ipv6_dev_mc_inc(). - (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer - wifi: mac80211: don't complete management TX on SAE commit - sched/fair: Bump sd->max_newidle_lb_cost when newidle balance fails - s390/stp: Remove udelay from stp_sync_clock() - wifi: iwlwifi: mvm: fix scan request validation - um: Re-evaluate thread flags repeatedly - wifi: iwlwifi: mvm: set gtk id also in older FWs - perf/cxlpmu: Remove unintended newline from IRQ name format string - net: phy: micrel: Add ksz9131_resume() - net: thunderx: Fix format-truncation warning in bgx_acpi_match_id() - net: ipv4: fix incorrect MTU in broadcast routes - wifi: cfg80211: Fix interface type validation - net: mctp: Prevent duplicate binds - arm64: Mark kernel as tainted on SAE and SError panic - net/mlx5e: Properly access RCU protected qdisc_sleeping variable - net: ag71xx: Add missing check after DMA map - et131x: Add missing check after DMA map - wifi: rtw89: Lower the timeout in rtw89_fw_read_c2h_reg() for USB - be2net: Use correct byte order and format string for TCP seq and ack_seq - s390/time: Use monotonic clock in get_cycles() - wifi: cfg80211: reject HTC bit for management frames - ktest.pl: Prevent recursion of default variable options - wifi: ath12k: Correct tid cleanup when tid setup fails - net: usb: cdc-ncm: check for filtering capability - xen/netfront: Fix TX response spurious interrupts - Bluetooth: hci_sock: Reset cookie to zero in hci_sock_free_cookie() - powerpc/thp: tracing: Hide hugepage events under CONFIG_PPC_BOOK3S_64 - ASoC: qcom: use drvdata instead of component to keep id - ASoC: codecs: rt5640: Retry DEVICE_ID verification - iio: adc: ad7768-1: Ensure SYNC_IN pulse minimum timing requirement - ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros - ALSA: pcm: Rewrite recalculate_boundary() to avoid costly loop - platform/chrome: cros_ec_typec: Defer probe on missing EC parent - platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches - soc: qcom: mdt_loader: Actually use the e_phoff - imx8m-blk-ctrl: set ISI panic write hurry level - pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop() - usb: core: usb_submit_urb: downgrade type check - usb: typec: intel_pmc_mux: Defer probe if SCU IPC isn't present - ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4 - ASoC: hdac_hdmi: Rate limit logging on connection and disconnection - ALSA: hda: Disable jack polling at shutdown - ALSA: hda: Handle the jack polling always via a work - mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode() - mei: bus: Check for still connected devices in mei_cl_bus_dev_release() - char: misc: Fix improper and inaccurate error code returned by misc_init() - reset: brcmstb: Enable reset drivers for ARCH_BCM2835 - pps: clients: gpio: fix interrupt handling order in remove path - ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path - mmc: sdhci-msm: Ensure SD card power isn't ON when card removed - ACPI: processor: fix acpi_object initialization - PM: sleep: console: Fix the black screen issue - thermal: sysfs: Return ENODATA instead of EAGAIN for reads - PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit() - firmware: tegra: Fix IVC dependency problems - ACPI: PRM: Reduce unnecessary printing to avoid user confusion - selftests: tracing: Use mutex_unlock for testing glob filter - tools/build: Fix s390(x) cross-compilation with clang - gpio: tps65912: check the return value of regmap_update_bits() - iio: adc: ad_sigma_delta: don't overallocate scan buffer - tools/nolibc: define time_t in terms of __kernel_old_time_t - thermal/drivers/qcom-spmi-temp-alarm: Enable stage 2 shutdown when required - ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed - EDAC/synopsys: Clear the ECC counters on init - gpio: wcd934x: check the return value of regmap_update_bits() - remoteproc: imx_rproc: skip clock enable when M-core is managed by the SCU - soc: qcom: rpmh-rsc: Add RSC version 4 support - usb: xhci: Avoid showing errors during surprise removal - usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command - usb: xhci: Avoid showing warnings for dying controller - usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default - selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t - cpufreq: CPPC: Mark driver with NEED_UPDATE_LIMITS flag - platform/x86/amd: pmc: Add Lenovo Yoga 6 13ALC6 to pmc quirk list - usb: xhci: print xhci->xhc_state when queue_command failed - tracefs: Add d_delete to remove negative dentries - securityfs: don't pin dentries twice, once is enough... - fix locking in efi_secret_unlink() - ext2: Handle fiemap on empty files to prevent EINVAL - fs/ntfs3: correctly create symlink for relative path - fs/ntfs3: Add sanity check for file name - better lockdep annotations for simple_recursive_removal() - hfs: fix not erasing deleted b-tree node issue - drbd: add missing kref_get in handle_write_conflicts - udf: Verify partition map count - gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops - nvme-pci: try function level reset on init failure - smb/server: avoid deadlock when linking with ReplaceIfExists - arm64: Handle KCOV __init vs inline mismatches - ptp: prevent possible ABBA deadlock in ptp_clock_freerun() - intel_idle: Allow loading ACPI tables for any family - net: ti: icss-iep: Fix incorrect type for return value in extts_enable() - netfilter: ctnetlink: fix refcount leak on table dump - udp: also consider secpath when evaluating ipsec use for checksumming - KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs - KVM: nVMX: Check vmcs12->guest_ia32_debugctl on nested VM-Enter - KVM: VMX: Extract checking of guest's DEBUGCTL into helper - KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported - KVM: VMX: Handle forced exit due to preemption timer in fastpath - KVM: VMX: Re-enter guest in fastpath for "spurious" preemption timer exits - KVM: x86: Plumb "force_immediate_exit" into kvm_entry() tracepoint - libceph: prevent potential out-of-bounds reads in handle_auth_done() - net: usb: pegasus: fix memory leak in update_eth_regs_async() - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() - !20540 urma: added support for ipoverurma - team: fix check for port enabled in team_queue_override_port_prio_changed() - mm/page_alloc: prevent pcp corruption with SMP=n - !20528 Fix CVE-2025-71083 - KVM: nVMX: Defer SVI update to vmcs01 on EOI when L2 is active w/o VID - KVM: x86: Plumb in the vCPU to kvm_x86_ops.hwapic_isr_update() - KVM: SVM: Set RFLAGS.IF=1 in C code, to get VMRUN out of the STI shadow - smb: client: don't wait for info->send_pending == 0 on error - smb: client: let send_done() cleanup before calling smbd_disconnect_rdma_connection() - ACPI: processor: perflib: Move problematic pr->performance check - ACPI: processor: perflib: Fix initial _PPC limit application - Documentation: ACPI: Fix parent device references - fs: Prevent file descriptor table allocations exceeding INT_MAX - sunvdc: Balance device refcount in vdc_port_mpgroup_check - PCI: Extend isolated function probing to LoongArch - NFSD: detect mismatch of file handle and delegation stateid in OPEN op - net: dpaa: fix device leak when querying time stamp info - net: ti: icss-iep: fix device and OF node leaks at probe - net: mtk_eth_soc: fix device leak at probe - net: enetc: fix device and OF node leak at probe - net: gianfar: fix device leak when querying time stamp info - net: phy: micrel: fix KSZ8081/KSZ8091 cable test - gpio: mlxbf3: use platform_get_irq_optional() - gpio: mlxbf2: use platform_get_irq_optional() - gpio: virtio: Fix config space reading. - ALSA: hda/realtek: Add Framework Laptop 13 (AMD Ryzen AI 300) to quirks - ALSA: hda/realtek: Fix headset mic on HONOR BRB-X - ALSA: usb-audio: Validate UAC3 cluster segment descriptors - rcu: Fix racy re-initialization of irq_work causing hangs - rcu: Fix rcu_read_unlock() deadloop due to IRQ work - drm/tilcdc: Fix removal actions in case of failed probe - drm/tilcdc: request and mapp iomem with devres - urma: fix update topo logic - dmaengine: stm32: dmamux: fix device leak on route allocation - pswiotlb: Adapt to the IOMMU DMA API upgraded by IOMMUFD - null_blk: fix kmemleak by releasing references to fault configfs items - inet: frags: flush pending skbs in fqdir_pre_exit() - inet: frags: add inet_frag_queue_flush() - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() - md/dm-raid: don't clear MD_RECOVERY_FROZEN after setting frozen - md/dm-raid: don't call md_reap_sync_thread() directly - ACPICA: Avoid walking the Namespace if start_node is NULL - arm64: entry: xcall/xint: make asm conditionals compatible with clang IAS - LoongArch: BPF: Sign extend kfunc call arguments - genirq/msi:: Fix kabi break of struct msi_desc - genirq/msi: Store the IOMMU IOVA directly in msi_desc instead of iommu_cookie - NFS: Fix a deadlock involving nfs_release_folio() - Revert "[Huawei] Revert "NFS: fix up nfs_release_folio() to try to release the page"" - urma: added support for ipoverurma - drm/ttm: Avoid NULL pointer deref for evicted BOs - XSched: Update XSched manual - svcrdma: bound check rq_pages index in inline path - ipv6: Fix use-after-free in inet6_addr_del(). - ipv4: ip_gre: make ipgre_header() robust - net: fix memory leak in skb_segment_list for GRO packets - net: sock: fix hardened usercopy panic in sock_recv_errqueue - ipv4: Fix reference count leak when using error routes with nexthop objects - SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf - fbdev: Fix vmalloc out-of-bounds write in fast_imageblit - udp: Deal with race between UDP socket address change and rehash - EDAC/amd64: The width of hash value is 2 bits for Hygon family 18h model 6h processors - x86/tsc: Use topology_max_packages() to get package number - EDAC/amd64: Use unicast instead of broadcast to access the cs_config register - EDAC/amd64: Correct the address translation for hygon family 18h model 4h - KVM: arm64: Mark some header functions as inline - KVM: arm64: Refactor exit handlers - x86/resctrl: Fix memory bandwidth counter width for Hygon CPUs - hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio - !20820 ub/obmm: add sysfs interface for mempool statistics & bugfixes - ub/obmm: fix wrong pxm_numa parameter validation - ub/obmm: Remove unused parameters from obmm_addr_check.c - ub/obmm: Enhance mem_allocator_granu validation - ub/obmm: simplify allocator naming scheme - ub/obmm: fix allow_slow logic and optimize conti_alloc_memory - ub/obmm: add sysfs interface with fine-grained memory statistics - !20804 net: hv_netvsc: reject RSS hash key programming without RX indirection table - !20813 migrate: correct lock ordering for hugetlb file folios - !20812 libceph: make calc_target() set t->paused, not just clear it - !20719 drivers/ub/sentry: some bugfix - !20798 urma: log should not retrieve eid_idx from uctx - !20808 urma: support triple bonding device - urma: log should not retrieve eid_idx from uctx - migrate: correct lock ordering for hugetlb file folios - libceph: make calc_target() set t->paused, not just clear it - !20745 vfio platform VFIO support for hisi05a1 devices - urma: support triple bonding device - net: hv_netvsc: reject RSS hash key programming without RX indirection table - !20789 gic: Add hip09 support for HISILICON_ERRATUM_165010801 - !20726 tracing: Add recursion protection in kernel stack trace recording - !20668 irqchip/gic-v3-its: Avoid truncating memory addresses - !20795 ub: udma: support query and set qos info. - !20791 Migration/urma:optimize performance in live migration. - ub: udma: Support for UE link establishment message. - Migration/urma: optimize performance in live migration. - !20787 ub: cdma: modify the method of assigning values to the structure - !20759 ubcore: hotfix route query for port eid on the same node. - ub: udma: support query and set qos info. - Revert "ub: ubase: Support for RC saved by queue granularity" - ubcore: hotfix route query for port eid on the same node. - !20676 urma: set/get sl - !20765 urma: bugfix of UAF and double free in ubcm - !20778 ub: ubase&unic: Fixes some bugfix in resetting and dfx ability - gic: Add hip09 support for HISILICON_ERRATUM_165010801 - vfio/platform: Add CONFIG_VFIO_HISI05A1 to openeuler_defconfig and turn it on by default - vfio/platform: VFIO support for hisi05a1 devices - ub: cdma: modify the method of assigning values to the structure - urma: set/get sl - ub: ubase: support to query ub dl pkt stats and real-time peak bandwidth - ub: ubase: Support for RC saved by queue granularity - ub: ubase: Traverse mailbox AE events using interrupts and polling. - ub: ubase: Modify ubase ctrlq trace to distinguish between MUE and UE messages - net: unic: The function of dumping himac registers is added. - ub: ubase: Fix MAC is_pfc sync, optimize list ops and code style - ub: ubase: Retain the initial tm qset configuration and restore it - net: unic: Fixed an issue in the bond IP address notification and pause configuration when an exception occurs. - ub: ubase: Add a retransmission function to improve reliability. - net: unic: Increase the readability and reliability of loopback code - net: unic: Synchronize the code modify for ip management and deactivation - net: unic: Increase the readability and reliability of VLAN feature. - net: unic: Added unic DFX log information. - ub: ubase: Add and correct comments for some functions and data structures - net: unic: Notify MAMI when the bond port status changes - ub: ubase: Support for HIMAC reset during ELR reset and Optimize ELR reset - !20768 iommu/ummu-core: Fix separate page table compatibility - !20665 [OLK-6.6] Enhance CMA memory usage reporting for CSV3 - !20764 net: hns3: fix double free issue for tx spare buffer - urma: bugfix of UAF and double free in ubcm - iommu/ummu-core: Fix separate page table compatibility - net: hns3: fix double free issue for tx spare buffer - drivers/ub/sentry: fix memory leak in sentry_msg_helper - drivers/ub/sentry: initialize some variables - drivers/ub/sentry: fix potential buffer overflow in convert_str_to_smh_msg() - drivers/ub/sentry: fix potential null pointer reference in sentry_uvb_comm - drivers/ub/sentry: add input parameter verification for exported symbols - tracing: Add recursion protection in kernel stack trace recording - x86/csv: Enhance CMA memory usage reporting for CSV3 - irqchip/gic-v3-its: Avoid truncating memory addresses - change the package name of 64KB page size kernel to kernel-64k - !20704 kernel support hisi-cca-da - !20180 [virtCCA Live Migration 2]virtcca secure cvm supports live migration - !20905 v2 KVM: arm64: Fix softirq masking in FPSIMD register saving sequence - !20965 iommu/ummu: Optimized TID invalidation and tdev initialization - !20964 iommu/ummu: Support TID and EID Granularity for MPAM - !20970 ub: ubase&unic: Supporting the black box capability of the ubase&unic driver - hisi-cca-da: Start dev by rsi call - hisi-cca-da: Set ripas of the bar region as RIPAS_DEV - hisi-cca-da: Support swiotlb and realm memory use - hisi-cca-da: Add smmu info when dev attach - hisi-cca-da: Transfer realm msix access to rmm - hisi-cca-da: Support pcipc sriov capability - hisi-cca-da: Delay realm memory release to kvm_destroy_realm - hisi-cca-da: Create realm s2 host pgtable and map msi mmio to rmm - hisi-cca-da: Add cca realm s2 pgtable framework - hisi-cca-da: Use bitmap to determine whether the command can be forwarded - hisi-cca-da: Restrict Realm SMMU to stage-2 domain only - hisi-cca-da: Add cmd forward mechanism in realm smmu - hisi-cca-da: Add realm smmu event and gerror irq initialization - hisi-cca-da: Add realm smmu stream table initialization - hisi-cca-da: Add realm smmu cmdq and evtq initialization - hisi-cca-da: Add realm smmu initialization - hisi-cca-da: Add relam iommu support to iommufd - hisi-cca-da: Add realm iommu support for vfio-iommu-type1 - hisi-cca-da: Support dev map and unmap - hisi-cca-da: Support dev validate and dev start - hisi-cca-da: VFIO support ccada - hisi-cca-da: Support dev delegate and dev attach - hisi-cca-da: Support root dev delegate and dev init - hisi-cca-da: Add hisilicon extension smc and ccada cmd - hisi-cca-da: Add hisi ccada feature config - !20751 ARM CCA supports hugepage - !20944 ub: ubmempfd: supports for D2H mapping and demapping - !20888 HiSock Enhancement - ub: ubase&unic: Supporting the black box capability of the ubase&unic driver. - net: unic: Resolve the residual MAC address problem - net: unic: Optimized the code for the cmd structure and FEC function. - ub: ubase: add log for post mailbox timeout - ub: ubus: Remove black box header file to include dir - rme: Remove the secret bit of the vring desc addr - rme: improve hisi-cca data mmap and destroy method - !20943 uvb: fix wd_obtain logic err - !20942 urma: fix bond device id not release - !20892 dcache: Limit the minimal number of bucket to two - rme: isolate page when do delegation to avoid migration - rme: hisi-cca supports different levels for mapping ram - rme: rename ccal to hisi-cca - rme: support set ripas for ccal realm vm - rme: support destroy ram data for ccal realm vm - rme: support populate region for ccal realm vm - rme: support map ram for ccal realm vm - rme: support config ccal realm vm - rme: support ccal RMI calls - rme: realm vm supports wfx handler - !20952 urma: introduce ipourma module - iommu/ummu-core: Simplifies tdev initialization resources - iommu/ummu: Optimized log printing - iommu/ummu: Use passed gfp_mask in map_pages callback - uvb: fix wd_obtain logic err - !20949 ub: udma: support user ctl function. - urma: fix bond device id not release - !20901 drivers/ub/sentry: some bugfix - ub: ubmempfd: supports for D2H mapping and demapping - ub: ubmempfd: supports providing services to the QEMU process through file nodes - [virtCCA Live Migration 2]virtcca secure cvm supports live migration - urma: query priority and enable bit, support ring size configuration - urma: implement debugfs, improve boundary checks and error handling logic - urma: implement data plane interaction and statistics - urma: implement ipourma network device operations - urma: ipourma resource management - urma: ipourma resource management and err code - urma: introduce ipourma main module - iommu/ummu: Optimized the TID invalidation configuration - iommu/ummu: Optimized SVA permission table memory allocation approach - iommu/ummu: Adapt UMMU SVA interface adjustment - iommu/ummu: Support TID and EID Granularity for MPAM - !20848 [OLK-6.6] backport important bugfix for nvme driver from upstream linux-6.6.y - !20847 urma: sl resource query error - !20908 [OLK-6.6][linux-6.6.y sync] Backport 6.6.108-6.6.110 LTS Patches - !20084 Loongarch: Enable CONFIG_CRYPTO_XTS for disk encryption - !20929 PCI: Fix NVMe link speed downgrade to 2.5GT/s during hotplug - drivers/ub/sentry: fix check input parameters - ub: udma: support user ctl function. - ub: udma: support uboe function. - ub: udma: bugfix related to query aux info. - !20935 ub: ubmem_vmmu: supports IOMMU driver for the UB memory MMU in VMs - drivers/ub/sentry: do not use magic numbers - !20876 urma: Kernel-mode specific implementations file for Jetty extension interface - urma: sl resource query error - !20873 sunrpc: fix NULL pointer dereference in rpcb_register_inet6 and rpcb_register_inet4 - !20875 sunrpc: fix race in cache cleanup causing stale nextcheck time - ub: ubmem_vmmu: supports IOMMU driver for the UB memory MMU in VMs - ub: ubmem_vmmu: supports parsing and configuring the hardware node information - ub: ubmem_vmmu: HiSilicon ubmem_vmmu Architecture Implementation - !20806 Fix CVE-2025-71225 - !20896 scsi: qla2xxx: Free sp in error path to fix system crash - !20894 scsi: qla2xxx: Delay module unload while fabric scan in progress - !20893 scsi: qla2xxx: Validate sp before freeing associated memory - !20802 Fix CVE-2026-23110 - urma: Kernel-mode specific implementations file for Jetty extension interface - drivers/ub/sentry: fix memory leak in process_urma_data() - drivers/ub/sentry: initialize some variables - PCI: Fix NVMe link speed downgrade to 2.5GT/s during hotplug - !20770 ub: ubdevshm: supports the memory user to obtain and release shared memory - Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 - mm: consider non-anon swap cache folios in folio_expected_ref_count() - mm: simplify folio_expected_ref_count() - ASoC: qcom: audioreach: fix potential null pointer dereference - gcc-plugins: Remove TODO_verify_il for GCC >= 16 - crypto: sha256 - fix crash at kexec - drm/i915/backlight: Return immediately when scale() finds invalid parameters - minmax.h: remove some #defines that are only expanded once - minmax.h: simplify the variants of clamp() - minmax.h: move all the clamp() definitions after the min/max() ones - minmax.h: use BUILD_BUG_ON_MSG() for the lo < hi test in clamp() - minmax.h: reduce the #define expansion of min(), max() and clamp() - minmax.h: update some comments - minmax.h: add whitespace around operators and after commas - minmax: fix up min3() and max3() too - minmax: improve macro expansion and type checking - minmax: don't use max() in situations that want a C constant expression - minmax: simplify min()/max()/clamp() implementation - minmax: make generic MIN() and MAX() macros available everywhere - drm/ast: Use msleep instead of mdelay for edid read - gpiolib: Extend software-node support to support secondary software-nodes - ARM: bcm: Select ARM_GIC_V3 for ARCH_BRCMSTB - s390/cpum_cf: Fix uninitialized warning after backport of ce971233242b - kmsan: fix out-of-bounds access to shadow memory - afs: Fix potential null pointer dereference in afs_put_server - ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address - i40e: improve VF MAC filters accounting - i40e: add mask to apply valid bits for itr_idx - HID: asus: add support for missing PX series fn keys - drm/gma500: Fix null dereference in hdmi teardown - octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() - net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port - net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() - net: dsa: lantiq_gswip: do also enable or disable cpu port - selftests: fib_nexthops: Fix creation of non-FDB nexthops - net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS - bnxt_en: correct offset handling for IPv6 destination address - vhost: Take a reference on the task in struct vhost_task. - Bluetooth: hci_sync: Fix hci_resume_advertising_sync - ethernet: rvu-af: Remove slash from the driver name - can: peak_usb: fix shift-out-of-bounds issue - can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow - can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow - can: hi311x: populate ndo_change_mtu() to prevent buffer overflow - can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow - bpf: Reject bpf_timer for PREEMPT_RT - can: rcar_can: rcar_can_resume(): fix s2ram with PSCI - wifi: virt_wifi: Fix page fault on connect - cpufreq: Initialize cpufreq-based invariance before subsys - ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients - arm64: dts: imx8mp: Correct thermal sensor index - mm: folio_may_be_lru_cached() unless folio_test_large() - mm/gup: local lru_add_drain() to avoid lru_add_drain_all() - mm/gup: check ref_count instead of lru before migration - mm: add folio_expected_ref_count() for reference count calculation - mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked" - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions - ALSA: usb-audio: Add mute TLV for playback volumes on more devices - ALSA: usb-audio: move mixer_quirks' min_mute into common quirk - ALSA: usb-audio: Add DSD support for Comtrue USB Audio device - i2c: designware: Add quirk for Intel Xe - mmc: sdhci-cadence: add Mobileye eyeQ support - usb: core: Add 0x prefix to quirks debug output - ALSA: usb-audio: Fix build with CONFIG_INPUT=n - ALSA: usb-audio: Convert comma to semicolon - ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 - ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks - ALSA: usb-audio: Simplify NULL comparison in mixer_quirks - ALSA: usb-audio: Avoid multiple assignments in mixer_quirks - ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks - ALSA: usb-audio: Fix block comments in mixer_quirks - firewire: core: fix overlooked update of subsystem ABI version - scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE - !20843 [OLK-6.6][linux-6.6.y sync] Backport 6.6.107-6.6.108 LTS Patches - !20869 ub:hisi-ubus: fix bug of security smatch - !20861 CVE-2026-23163 - ub: ubdevshm: supports the memory user to obtain and release shared memory - ub: ubdevshm: supports granting and revoking shared memory permissions - ub: ubdevshm: supports the registration and deregistration of shared memory segments - ub: ubdevshm: supports the registration and deregistration - KVM: arm64: Fix softirq masking in FPSIMD register saving sequence - !20886 Fix CVE-2026-23205 - !20803 Fix CVE-2026-23112 - !20868 sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure - !20811 smb/server: fix refcount leak in smb2_open() - !20810 smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() - !20809 smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() - sunrpc: fix NULL pointer dereference in rpcb_register_inet6 and rpcb_register_inet4 - sunrpc: fix race in cache cleanup causing stale nextcheck time - scsi: qla2xxx: Free sp in error path to fix system crash - scsi: qla2xxx: Delay module unload while fabric scan in progress - scsi: qla2xxx: Validate sp before freeing associated memory - dcache: Limit the minimal number of bucket to two - !20872 Fix CVE-2026-23220 - !20846 Fix CVE-2026-23193 - !20815 Fix CVE-2026-23216 - !20859 Fix CVE-2026-23179 - !20871 CVE-2026-23096 - !20858 ub: ubase: resolve the cmdq crq overflow problem - bpf: Deprecate hisock unused kfuncs and orig ingress logic - bpf: Add local connect support for hisock - bpf: Add ipv4-mapped ipv6 addr support for hisock - bpf: Add target comm parse to hisock_cmd - bpf: Add multi port parse to hisock_cmd - bpf: Only deploy hisock in server - bpf: Apply BPF_HISOCK_INGRESS to hisock ingress - bpf: Add bpf_handle_ingress/egress_ptype kfunc - bpf: Add bpf_get_skb_ethhdr kfunc - bpf: Add bpf_set_ingress/egress_dev kfunc - bpf: Add bpf_set_ingress_dst kfunc - bpf: Add BPF_HISOCK_INGRESS attach type - cgroup: make cgroup_bpf_prog_attach work when cgroup2 is not mounted - smb: client: fix potential UAF and double free in smb2_open_file() - smb/client: fix memory leak in smb2_open_file() - !20852 ASoC: amd: fix memory leak in acp3x pdm dma ops - ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths - uacce: fix cdev handling in the cleanup path - Revert "uacce: fix for cdev memory leak" - ub:hisi-ubus: fix bug of security smatch - ub:ubus: injected route event - ub:ubus: Black Box Development - !20865 urma: urma support uboe - sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure - urma: urma support uboe - !20857 ub_fwctl driver adds support for querying some functions - ub:ub_fwctl:Add illegal verification for scc - ub:ub_fwctl:Support querying the historical status of port links - drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove - drm/amdkfd: Don't use sw fault filter if retry cam enabled - ub:ub_fwctl:Support querying firmware version numbers - ub: ub_fwctl: Support querying real-time bandwidth statistics - ub:ub_fwctl:Support querying statistical indicators at the ub port and uboe port levels - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() - !20854 [URMA] add ping server for urma_ping - urma: add ping server - ub: ubase: resolve the cmdq crq overflow problem - ub: ubase: Optimized the QoS code naming to improve code readability. - ub: ubase&unic: optimizing code and configuration settings. - net: unic: not support query and configure ip by control plane in UBoE - net: unic: fix the automatically enable uc guid promisc mode. - !20844 urma:kernel header of userctl - urma: Kernel-mode header file for Jetty extension interface - ASoC: amd: fix memory leak in acp3x pdm dma ops - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() - phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again) - ACPICA: Work around bogus -Wstringop-overread warning since GCC 11 - !20835 Fix CVE-2026-23084 - minmax: add a few more MIN_T/MAX_T users - minmax: simplify and clarify min_t()/max_t() implementation - minmax: avoid overly complicated constant expressions in VM code - rtc: pcf2127: fix SPI command byte for PCF2131 backport - xhci: dbc: Fix full DbC transfer ring after several reconnects - xhci: dbc: decouple endpoint allocation from initialization - phy: ti: omap-usb2: fix device leak at unbind - phy: Use device_get_match_data() - drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path - ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message - ASoC: wm8974: Correct PLL rate rounding - ASoC: wm8940: Correct typo in control name - ASoC: wm8940: Correct PLL rate rounding - io_uring: include dying ring in task_work "should cancel" state - io_uring: backport io_should_terminate_tw() - ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx - selftests: mptcp: avoid spurious errors on TCP disconnect - selftests: mptcp: connect: catch IO errors on listen side - rds: ib: Increment i_fastreg_wrs before bailing out - KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active - mmc: mvsdio: Fix dma_unmap_sg() nents value - ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S - ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface - btrfs: tree-checker: fix the incorrect inode ref size check - iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page() - LoongArch: Check the return value when creating kobj - LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled - LoongArch: Update help info of ARCH_STRICT_ALIGN - nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* - octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() - net: liquidio: fix overflow in octeon_init_instr_queue() - bonding: don't set oif to bond dev when getting NS target destination - net/mlx5e: Consider aggregated port speed during rate configuration - i40e: remove redundant memory barrier when cleaning Tx descs - net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure - selftests: mptcp: sockopt: fix error messages - mptcp: tfo: record 'deny join id0' info - mptcp: set remote_deny_join_id0 on SYN recv - dpaa2-switch: fix buffer pool seeding for control traffic - btrfs: fix invalid extref key setup when replaying dentry - pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch - wifi: mac80211: fix incorrect type for ret - wifi: mac80211: increase scan_ies_len for S1G - ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported - !20769 [OLK-6.6][linux-6.6.y sync] Backport 6.6.106-6.6.107 LTS Patches - be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list - !20776 ub:ubfi: Release the chosen node - !20817 CVE-2026-23094 - !20819 dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() - ub:ubus: Add port num check - !20379 [OLK-6.6][sync from OLK-5.10]io_uring: Support forcing sq thread to be idle and woken up by hrtimer - !20830 sched/soft_domain: Increasing NR_MAX_CLUSTER to 32 - sched/soft_domain: Increasing NR_MAX_CLUSTER to 32 - btrfs: fix incorrect readahead expansion length - x86: disable image size check for test builds - drm/i915/power: fix size for for_each_set_bit() in abox iteration - drm/amdgpu: fix a memory leak in fence cleanup when unloading - net: mdiobus: release reset_gpio in mdiobus_unregister_device() - phy: ti-pipe3: fix device leak at unbind - phy: tegra: xusb: fix device and OF node leak at probe - dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate - usb: gadget: midi2: Fix MIDI2 IN EP max packet size - usb: gadget: midi2: Fix missing UMP group attributes initialization - USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels - RISC-V: Remove unnecessary include from compat.h - hrtimer: Rename __hrtimer_hres_active() to hrtimer_hres_active() - hrtimer: Remove unused function - regulator: sy7636a: fix lifecycle of power good gpio - dmaengine: ti: edma: Fix memory allocation size for queue_priority_map - hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr - hsr: use rtnl lock when iterating over ports - net: hsr: Add VLAN CTAG filter support - net: hsr: Add support for MC filtering at the slave device - can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB - can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails - can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed - igb: fix link test skipping when interface is admin down - docs: networking: can: change bcm_msg_head frames member to support flexible array - tunnels: reset the GSO metadata before reusing the skb - net: bridge: Bounce invalid boolopts - net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() - USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions - USB: serial: option: add Telit Cinterion FN990A w/audio compositions - dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks - serial: sc16is7xx: fix bug in flow control levels init - tty: hvc_console: Call hvc_kick in hvc_write unconditionally - Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups" - Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table - Input: iqs7222 - avoid enabling unused interrupts - mm/khugepaged: fix the address passed to notifier on testing young - btrfs: fix corruption reading compressed range when block size is smaller than page size - btrfs: use readahead_expand() on compressed extents - mm/damon/sysfs: fix use-after-free in state_show() - mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing - mtd: nand: raw: atmel: Fix comment in timings preparation - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages - drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time - mm/damon/core: set quota->charged_from to jiffies at first charge window - fuse: prevent overflow in copy_file_range return value - fuse: check if copy_file_range() returns larger than requested size - mtd: rawnand: stm32_fmc2: fix ECC overwrite - mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer - net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups - i2c: i801: Hide Intel Birch Stream SoC TCO WDT - ocfs2: fix recursive semaphore deadlock in fiemap call - mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN - compiler-clang.h: define __SANITIZE_*__ macros only when undefined - EDAC/altera: Delete an inappropriate dma_free_coherent() call - rcu-tasks: Maintain real-time response in rcu_tasks_postscan() - rcu-tasks: Eliminate deadlocks involving do_exit() and RCU tasks - rcu-tasks: Maintain lists to eliminate RCU-tasks/do_exit() deadlocks - s390/cpum_cf: Deny all sampling events by counter PMU - NFSv4/flexfiles: Fix layout merge mirror check. - NFSv4.2: Serialise O_DIRECT i/o and copy range - NFSv4.2: Serialise O_DIRECT i/o and clone range - NFSv4.2: Serialise O_DIRECT i/o and fallocate() - NFS: Serialise O_DIRECT i/o and truncate() - fs/nfs/io: make nfs_start_io_*() killable - ftrace/samples: Fix function size computation - NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server - NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set - media: i2c: imx214: Fix link frequency validation - NFSD: nfsd_unlink() clobbers non-zero status returned from fh_fill_pre_attrs() - nfsd: Fix a regression in nfsd_setattr() - kasan: fix GCC mem-intrinsic prefix with sw tags - kunit: kasan_test: disable fortify string checker on kasan_strings() test - io_uring: fix kabi broken in struct io_ring_ctx - io_uring: Support forcing sq thread to be idle and woken up by hrtimer - dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() - uacce: fix isolate sysfs check condition - Revert "uacce: fix isolate sysfs check condition" - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() - smb/server: fix refcount leak in smb2_open() - smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() - smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() - md: suspend array while updating raid_disks via sysfs - scsi: core: Wake up the error handler when final completions race against each other - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec - ub:ubfi: Release the chosen node - ub:ubus: Delete unused functions - Loongarch: Enable CONFIG_CRYPTO_XTS for disk encryption - Add sw64 support in kernel.spec - !21194 hisi-cca-da: Revert smmu realm enabled condition for arm_smmu_domain_finalise. - !21192 urma: bugfix of ubagg&ubcore&uburma - !21183 platform/x86: classmate-laptop: Add missing NULL pointer checks - urma: bugfix of ubagg&ubcore&uburma - hisi-cca-da: Revert smmu realm enabled condition for arm_smmu_domain_finalise. - platform/x86: classmate-laptop: Add missing NULL pointer checks - !21167 urma: fix kernel codecheck issues. - !21174 urma: change return value for provider err - !21127 urma: copy linked ports when importing bond jetty/seg - !20247 ubcore: query primary eid in ipourma loopback mode. - !21077 Fix hisi cca bugs - ubcore: route query refine and ipo loopback adapt. - hisi-cca-da: Transfer PCIe ECAM access requests to RMM for realm device. - hisi-cca-da: Write NS STE for PF drivers. - hisi-cca-da: Provide IO interfaces - hisi-cca-da: Destroy mmu stage2 pagetable after closing vfio devices - !21045 scsi: hisi_sas: Fix NULL pointer exception when do user_scan() - hisi-cca-da: Automatically unbind PF/VF drivers and prevent probe. - !21165 tools/interference: add ifstool utility for kernel interference statistics - !21166 urma: fix jfce uaf in batch cleanup - !21043 urma: fix tjetty ref in ping server - urma: change return value for provider err - !21128 sched/rt: Skip currently executing CPU in rto_next_cpu() - !21129 procfs: fix missing RCU protection when reading real_parent in do_task_stat() - urma: fix jfce uaf in batch cleanup - !21074 ipmi: Add HiSilicon IPMI Page Soft Offline driver - !21076 [OLK-6.6][linux-6.6.y sync] Backport 6.6.112-6.6.113 LTS Patches - urma: fix kernel codecheck issues. - tools/interference: add ifstool utility for kernel interference statistics - !20291 [Hygon][6.6][Bugfix] Bug fix for EDAC decode address fail issue on Hygon Dhyana processor - !21092 kexec: derive purgatory entry from symbol - !21154 sched: Add SOFT_DOMAIN feature interface for cgroup2 - !21153 fix CVE-2025-39981 - Revert "hisi-cca-da: Delay realm memory release to kvm_destroy_realm" - urma: fix tjetty ref in ping server - rme: Enforce isolation to solve compile error without config CONFIG_HISI_CCA - hisi-cca-da: Improve hisi cca dev validate and delegate - hisi-cca-da: Fix smmu enable rme problem - hisi-cca-da: Fix msi region shared problem - sched: Add SOFT_DOMAIN feature interface for cgroup2 - Bluetooth: MGMT: Fix memory leak in set_ssp_complete - Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete - overflow: Introduce __DEFINE_FLEX for having no initializer - overflow: Fix direct struct member initialization in _DEFINE_FLEX() - overflow: Change DEFINE_FLEX to take __counted_by member - overflow: add DEFINE_FLEX() for on-stack allocs - Bluetooth: MGMT: Fix possible UAFs - Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete() - !21103 Revert "mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()" - !21104 v2 vsock/virtio: cap TX credit to local buffer size - !21070 Fixes CVE-2026-23100 - !21135 RDMA/hns: Support configure and query the CNP DSCP through sysfs - !21088 ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref - RDMA/hns: Support configure and query the CNP DSCP through sysfs - RDMA/hns: Support query FW cap bit - RDMA/hns: Support query HW ID. - !20934 smb/server: fix refcount leak in parse_durable_handle_context() - !21004 regmap: Fix race condition in hwspinlock irqsave routine - !19568 [OLK-6.6]fix txgbe clang compile warning - urma: copy linked ports when importing bond jetty/seg - procfs: fix missing RCU protection when reading real_parent in do_task_stat() - sched/rt: Skip currently executing CPU in rto_next_cpu() - !21073 scsi: qla2xxx: Fix bsg_done() causing double free - !21114 CVE-2024-57979 - !21113 iommu: disable SVA when CONFIG_X86 is set - !20957 dmaengine: xilinx: xdma: Fix regmap max_register - !21087 net: unic: Multiple stability fixes for tx timeout, DFX capability and concurrent activation/reset - pps: Fix a use-after-free - fix kabi - pps: Fix a use-after-free - !21078 of: unittest: Fix memory leak in unittest_data_add() - !21079 *** fix CVE-2026-23208 *** - !21082 ALSA: aloop: Fix racy access at PCM trigger - !21083 bus: fsl-mc: fix use-after-free in driver_override_show() - iommu: disable SVA when CONFIG_X86 is set - vsock/virtio: cap TX credit to local buffer size - Revert "mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()" - !20983 Fix CVE-2026-23139 - !20878 Fix CVE-2026-23230 - kexec: derive purgatory entry from symbol - lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC - PCI/IOV: Fix race between SR-IOV enable/disable and hotplug - Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" - rtc: interface: Alarm race handling should not discard preceding error - perf test stat tests: Fix for virtualized machines - perf test stat: Update test expectations and events - perf test stat: Avoid hybrid assumption when virtualized - writeback: Avoid excessively long inode switching times - writeback: Avoid softlockup when switching many inodes - cramfs: Verify inode mode when loading from disk - fs: Add 'initramfs_options' to set initramfs mount options - minixfs: Verify inode mode when loading from disk - irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume - irqchip/sifive-plic: Make use of __assign_bit() - selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled - s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG - s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL - s390/bpf: Describe the frame using a struct instead of constants - s390/bpf: Centralize frame offset calculations - s390/bpf: Change seen_reg to a mask - ACPI: property: Do not pass NULL handles to acpi_attach_data() - ACPI: property: Add code comments explaining what is going on - ACPI: property: Disregard references in data-only subnode lists - ACPI: battery: Add synchronization between interface updates - ACPI: battery: Check for error code from devm_mutex_init() call - ACPI: battery: initialize mutexes through devm_ APIs - ACPI: battery: allocate driver data through devm_ APIs - arm64: mte: Do not flag the zero page as PG_mte_tagged - ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref - !20790 dm: use bio_clone_blkg_association - ipmi: Add HiSilicon IPMI Page Soft Offline driver - net: unic: Resolve network unavailability caused by concurrent activation and reset - net: unic: Provide the DFX capability for querying MNG table - net: unic: Delete the elr reset process after the tx timeout - bus: fsl-mc: fix use-after-free in driver_override_show() - ALSA: aloop: Fix racy access at PCM trigger - ALSA: usb-audio: Use the right limit for PCM OOB check - ALSA: usb-audio: Prevent excessive number of frames - of: unittest: Fix memory leak in unittest_data_add() - !21034 CVE-2026-23140 - !21016 net: fix segmentation of forwarding fraglist GRO - !21017 mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() - !21018 CVE-2026-23209 - !21019 ipv6: annotate data-race in ndisc_router_discovery() - !20881 ipvlan: Make the addrs_lock be per port - rme: Imporve range delegate - btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() - PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release - PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() - misc: fastrpc: Save actual DMA size in fastrpc_map structure - misc: fastrpc: Add missing dev_err newlines - mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag - mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type - mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value - media: mc: Clear minor number before put device - lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older - ACPICA: Allow to skip Global Lock initialization - ext4: validate ea_ino and size in check_xattrs - ext4: correctly handle queries for metadata mappings - ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() - nfsd: nfserr_jukebox in nlm_fopen should lead to a retry - NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() - mm/damon/vaddr: do not repeat pte_offset_map_lock() until success - mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 - mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations - wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 - wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again - selftests: mptcp: join: validate C-flag + def limit - spi: cadence-quadspi: Flush posted register writes before DAC access - spi: cadence-quadspi: Flush posted register writes before INDAC access - PCI: tegra194: Handle errors in BPMP response - PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() - PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock - PCI: rcar-host: Drop PMSR spinlock - PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit - PCI/AER: Support errors introduced by PCIe r6.0 - PCI/AER: Fix missing uevent on recovery when a reset is requested - PCI/ERR: Fix uevent on failure to recover - PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV - PCI/sysfs: Ensure devices are powered for config reads - PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock - rseq/selftests: Use weak symbol reference, not definition, to link with glibc - rtc: interface: Fix long-standing race when setting alarm - rtc: interface: Ensure alarm irq is enabled when UIE is enabled - memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe - mmc: core: SPI mode remove cmd7 - mtd: rawnand: fsmc: Default to autodetect buswidth - xtensa: simdisk: add input size check in proc_write_simdisk - sparc: fix error handling in scan_one_device() - sparc64: fix hugetlb for sun4u - scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() - sched/deadline: Fix race in push_dl_task() - pwm: berlin: Fix wrong register in suspend/resume - powerpc/pseries/msi: Fix potential underflow and leak issue - powerpc/powernv/pci: Fix underflow and leak issue - power: supply: max77976_charger: fix constant current reporting - pinctrl: samsung: Drop unused S3C24xx driver data - nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk - parisc: don't reference obsolete termio struct for TC* constants - openat2: don't trigger automounts with RESOLVE_NO_XDEV - of: unittest: Fix device reference count leak in of_unittest_pci_node_verify - lib/genalloc: fix device leak in of_gen_pool_get() - KEYS: trusted_tpm1: Compare HMAC values in constant time - iommu/vt-d: PRS isn't usable if PDS isn't supported - iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume - init: handle bootloader identifier in kernel parameters - iio: xilinx-ams: Unmask interrupts after updating alarms - iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK - iio: frequency: adf4350: Fix prescaler usage. - iio: dac: ad5421: use int type to store negative error codes - iio: dac: ad5360: use int type to store negative error codes - fs/ntfs3: Fix a resource leak bug in wnd_extend() - fbdev: Fix logic error in "offb" name match - crypto: rockchip - Fix dma_unmap_sg() nents value - crypto: atmel - Fix dma_unmap_sg() direction - crypto: aspeed - Fix dma_unmap_sg() direction - copy_sighand: Handle architectures where sizeof(unsigned long) < sizeof(u64) - bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() - bus: mhi: ep: Fix chained transfer handling in read path - btrfs: avoid potential out-of-bounds in btrfs_encode_fh() - blk-crypto: fix missing blktrace bio split events - drm/nouveau: fix bad ret code in nouveau_bo_move_prep - drm/rcar-du: dsi: Fix 1/2/3 lane support - media: lirc: Fix error handling in lirc_register() - media: venus: firmware: Use correct reset sequence for IRIS2 - media: pci: ivtv: Add missing check after DMA map - media: mc: Fix MUST_CONNECT handling for pads with no links - media: i2c: mt9v111: fix incorrect type for ret - media: cx18: Add missing check after DMA map - firmware: meson_sm: fix device leak at probe - xen/events: Update virq_to_irq on migration - xen/events: Return -EEXIST for bound VIRQs - xen/manage: Fix suspend error path - xen/events: Cleanup find_virq() return codes - dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required - ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init - arm64: dts: ti: k3-am62a-main: Fix main padcfg length - arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees - arm64: dts: qcom: msm8939: Add missing MDSS reset - arm64: dts: qcom: msm8916: Add missing MDSS reset - ACPI: debug: fix signedness issues in read/write helpers - ACPI: property: Fix buffer properties extraction for subnodes - gpio: wcd934x: mark the GPIO controller as sleeping - tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single - smb: client: fix missing timestamp updates after utime(2) - bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() - drm/amd/display: Properly disable scaling on DCE6 - drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 - drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs - drm/amdgpu: Add additional DCE6 SCL registers - mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes - mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call - tcp: take care of zero tp->window_clamp in tcp_set_rcvlowat() - perf python: split Clang options when invoking Popen - tools build: Align warning options with perf - net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe - drm/vmwgfx: Fix copy-paste typo in validation - net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() - LoongArch: Init acpi_gbl_use_global_lock to false - LoongArch: Remove CONFIG_ACPI_TABLE_UPGRADE in platform_init() - ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size - scsi: mvsas: Fix use-after-free bugs in mvs_work_queue - clk: tegra: do not overallocate memory for bpmp clocks - clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver - clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() - clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() - clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m - perf evsel: Ensure the fallback message is always written to - perf tools: Add fallback for exclude_guest - perf test: Add a test for default perf stat command - perf test: Don't leak workload gopipe in PERF_RECORD_* - perf session: Fix handling when buffer exceeds 2 GiB - perf arm_spe: Correct memory level for remote access - perf arm_spe: Correct setting remote access - rtc: optee: fix memory leak on driver removal - rtc: x1205: Fix Xicor X1205 vendor prefix - perf util: Fix compression checks returning -1 as bool - clk: at91: peripheral: fix return value - libperf event: Ensure tracing data is multiple of 8 sized - perf evsel: Avoid container_of on a NULL leader - asm-generic/io.h: Skip trace helpers if rwmmio events are disabled - iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE - clocksource/drivers/clps711x: Fix resource leaks in error paths - fscontext: do not consume log entries when returning -EMSGSIZE - fs: always return zero on success from replace_fd() - !21067 [OLK-6.6][linux-6.6.y sync] Backport 6.6.111-6.6.112 LTS Patches - scsi: qla2xxx: Fix bsg_done() causing double free - !21065 Fix CVE-2026-23069 - !21062 v4 Support multi-level cgroup - !20987 Fix CVE-2026-23212 - !20982 Fix CVE-2026-23119 - !20979 Fix CVE-2026-23111 - !20974 Fix CVE-2026-23099 - !20973 Fix CVE-2026-23105 - !20972 Fix CVE-2026-23074 - !20884 ksmbd: add chann_lock to protect ksmbd_chann_list xarray - !20947 Fix CVE-2026-23101 - ext4: clear i_state_flags when alloc inode - misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup - Revert "wifi: ath10k: avoid unnecessary wait for service ready message" - fs/ntfs3: fix mount failure for sparse runs in run_unpack() - !20825 efivarfs: fix error propagation in efivar_entry_get() - !20824 io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop - !20950 ub:ubus: protect iterator ue_list and mue_list with ub_bus_sem - mm/rmap: fix two comments related to huge_pmd_unshare() - mm/hugetlb: fix two comments related to huge_pmd_unshare() - mm/hugetlb: fix hugetlb_pmd_shared() - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count - !20728 drivers: Update vendor name of Chengdu NorthLink Technology N5/N6 Series Network Card Drivers - vsock/virtio: fix potential underflow in virtio_transport_get_credit() - !21001 Fix CVE-2026-23229 - usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call - arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode - !20999 Fix CVE-2026-23173 - usb: typec: tipd: Clear interrupts first - bus: fsl-mc: Check return value of platform_get_resource() - remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() - Input: atmel_mxt_ts - allow reset GPIO to sleep - misc: fastrpc: Skip reference for DMA handles - misc: fastrpc: fix possible map leak in fastrpc_put_args - misc: fastrpc: Fix fastrpc_map_lookup operation - nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() - ext4: fix checks for orphan inodes - ksmbd: fix error code overwriting in smb2_get_info_filesystem() - LoongArch: Automatically disable kaslr if boot from kexec_file - mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() - mfd: rz-mtu3: Fix MTU5 NFCR register offset - ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down - ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() - vhost: vringh: Modify the return value check - net/mlx5: fw reset, add reset timeout work - net/mlx5: pagealloc: Fix reclaim race during command interface teardown - net/mlx5: Stop polling for command response if interface goes down - net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable - nfp: fix RSS hash key size when RSS is not supported - mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands - drivers/base/node: fix double free in register_one_node() - hwrng: ks-sa - fix division by zero in ks_sa_rng_init - KEYS: X.509: Fix Basic Constraints CA flag parsing - Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements - Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO - vhost: vringh: Fix copy_to_iter return value check - RDMA/siw: Always report immediate post SQ errors - usb: vhci-hcd: Prevent suspending virtually attached devices - NFSv4.1: fix backchannel max_resp_sz verification check - coresight: trbe: Return NULL pointer for allocation failures - coresight: etm4x: Support atclk - coresight-etm4x: Conditionally access register TRCEXTINSELR - remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice - PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() - vfio/pds: replace bitmap_free with vfree - sparc: fix accurate exception reporting in copy_{from,to}_user for M7 - sparc: fix accurate exception reporting in copy_to_user for Niagara 4 - sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara - sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III - wifi: mac80211: fix Rx packet handling when pubsta information is not available - wifi: ath10k: avoid unnecessary wait for service ready message - Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram - IB/sa: Fix sa_local_svc_timeout_ms read race - RDMA/core: Resolve MAC of next-hop device without ARP support - f2fs: fix zero-sized extent for precache extents - scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() - scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() - scsi: qla2xxx: edif: Fix incorrect sign of error code - ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message - f2fs: fix to truncate first page in error path of f2fs_truncate() - f2fs: fix to update map->m_next_extent correctly in f2fs_map_blocks() - wifi: mt76: fix potential memory leak in mt76_wmac_probe() - RDMA/cm: Rate limit destroy CM ID timeout error message - drivers/base/node: handle error properly in register_one_node() - watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog - ipvs: Use READ_ONCE/WRITE_ONCE for ipvs->enable - iio: consumers: Fix offset handling in iio_convert_raw_to_processed() - iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() - fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist - fs: ntfs3: Fix integer overflow in run_unpack() - drm/msm/dpu: fix incorrect type for ret - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping - ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping - misc: genwqe: Fix incorrect cmd field being reported in error - usb: gadget: configfs: Correctly set use_os_string at bind - usb: phy: twl6030: Fix incorrect type for ret - drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() - tcp: fix __tcp_close() to only send RST when required - PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation - wifi: mwifiex: send world regulatory domain to driver - drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) - drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) - drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) - drm/amd/pm: Adjust si_upload_smc_data register programming (v3) - drm/amd/pm: Fix si_upload_smc_data (v3) - drm/amd/pm: Disable ULV even if unsupported (v3) - drm/amdgpu: Power up UVD 3 for FW validation (v2) - coresight: Only register perf symlink for sinks with alloc_buffer - inet: ping: check sock_net() in ping_get_port() and ping_lookup() - media: st-delta: avoid excessive stack usage - ALSA: lx_core: use int type to store negative error codes - media: rj54n1cb0c: Fix memleak in rj54n1_probe() - scsi: myrs: Fix dma_alloc_coherent() error check - hwrng: nomadik - add ARM_AMBA dependency - crypto: keembay - Add missing check after sg_nents_for_len() - drm/amd/display: Remove redundant semicolons - serial: max310x: Add error checking in probe() - usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls - usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup - phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 - media: zoran: Remove zoran_fh structure - drm/bridge: it6505: select REGMAP_I2C - f2fs: fix condition in __allow_reserved_blocks() - drm/radeon/r600_cs: clean up of dead code in r600_cs - drm/panel: novatek-nt35560: Fix invalid return value - bpf: Enforce expected_attach_type for tailcall compatibility - i2c: designware: Add disabling clocks when probe fails - i2c: designware: Fix clock issue when PM is disabled - i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD - thermal/drivers/qcom/lmh: Add missing IRQ includes - thermal/drivers/qcom: Make LMH select QCOM_SCM - hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems - once: fix race by moving DO_ONCE to separate section - smp: Fix up and expand the smp_call_function_many() kerneldoc - selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported - i3c: master: svc: Recycle unused IBI slot - i3c: master: svc: Use manual response for IBI events - ACPICA: Fix largest possible resource descriptor index - pwm: tiehrpwm: Fix corner case in clock divisor calculation - arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible - arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value - arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names - cpuidle: qcom-spm: fix device and OF node leaks at probe - firmware: firmware: meson-sm: fix compile-test default - arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 - null_blk: Fix the description of the cache_size module argument - pinctrl: renesas: Use int type to store negative error codes - power: supply: cw2015: Fix a alignment coding style issue - PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() - ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property - ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS - ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax - block: use int to store blk_stack_limits() return value - selftests/nolibc: fix EXPECT_NZ macro - regulator: scmi: Use int type to store negative error codes - arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map - ARM: at91: pm: fix MCKx restore routine - pinctrl: meson-gxl: add missing i2c_d pinmux - soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS - leds: flash: leds-qcom-flash: Update torch current clamp setting - ARM: dts: renesas: porter: Fix CAN pin group - libbpf: Fix reuse of DEVMAP - bpf: Remove migrate_disable in kprobe_multi_link_prog_run - bpf/selftests: Fix test_tcpnotify_user - regmap: Remove superfluous check for !config in __regmap_init() - arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 - x86/vdso: Fix output operand size of RDPID - smb: server: fix IRD/ORD negotiation with the client - coresight: trbe: Prevent overflow in PERF_IDX2OFF() - gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote - selftests: arm64: Check fread return value in exec_target - seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast - init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD - filelock: add FL_RECLAIM to show_fl_flags() macro - !21022 KVM: Don't clobber irqfd routing type when deassigning irqfd - !20998 ceph: fix oops due to invalid pointer for kfree() in parse_longname() - !21023 l2tp: avoid one data-race in l2tp_tunnel_del_work() - xsched: fix potential NULL dereference in xsched_quota_timeout_update - xsched: remove the standalone xcu_cfs_cg_deinit() helper - xsched: restructure xcu_cgrp_subsys teardown to align with cpu_cgrp_subsys lifecycle - xsched: simplify root group check by direct comparison with root_xcg - xsched: replace magic number with SCHED_CLASS_MAX_LENGTH for scheduler class string length - xsched/core: immediate cleanup of remaining operators on task exit - xsched: add init_fair_xsched_group() for XCU-specific fair group initialization - xsched: modify xcu_cg_initialize_components helper - xsched: refactor xsched_entity initialization - xsched: change rq_init() parameter from struct xsched_cu to struct xsched_rq - xsched: harden and clarify xcu_move_task() logic - xsched: move throttling-related fields from xsched_group_xcu_priv to xsched_rq_cfs - xsched/quota: add throttled flag to cfs_rq for robust hierarchical enqueue under throttling - xsched/quota: support multi-level cgroup - xsched: remove redundant xcu parameter from dequeue_ctx - xsched: update group shares using xcu_grp_shares_add/sub helpers - xsched: delete unused code - xsched/cfs: propagate group activation/deactivation up the hierarchy - xsched/cfs: move xruntime updates to pick/put paths - xsched: add has_running hook to xsched classes for wake-up eligibility check - !21012 [OLK-6.6][linux-6.6.y sync] Backport 6.6.110-6.6.111 LTS Patches - scsi: hisi_sas: Fix NULL pointer exception when do user_scan() - !21013 CVE-2026-23177 - !21007 bonding: fix use-after-free due to enslave fail after slave array update - !21006 net: Fix CVE-2026-23204 - bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path - bpf, test_run: Subtract size of xdp_frame from allowed metadata size - bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN - bpf: Make variables in bpf_prog_test_run_xdp less confusing - bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K - !21015 libceph: reset sparse-read state in osd_fault() - !21024 ub: udma: bugfix related to print messages. - !20980 Fix CVE-2026-23126 - !20922 Fix CVE-2026-23133 - ub: udma: bugfix related to print messages. - l2tp: avoid one data-race in l2tp_tunnel_del_work() - KVM: Don't clobber irqfd routing type when deassigning irqfd - ipv6: annotate data-race in ndisc_router_discovery() - macvlan: observe an RCU grace period in macvlan_common_newlink() error path - macvlan: fix error recovery in macvlan_common_newlink() - mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() - net: fix segmentation of forwarding fraglist GRO - can: rcar_canfd: Fix CAN-FD mode as default - libceph: reset sparse-read state in osd_fault() - !21008 uvb: fix cis call return value and obtain - mm, shmem: prevent infinite loop on truncate race - mm/shmem, swap: fix race of truncate and swap entry split - net/9p: fix double req put in p9_fd_cancelled - riscv: mm: Do not restrict mmap address based on hint - riscv: mm: Use hint address in mmap if available - driver core/PM: Set power.no_callbacks along with power.no_pm - serial: stm32: allow selecting console when the driver is module - hid: fix I2C read buffer overflow in raw_event() for mcp2221 - ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free - ALSA: usb-audio: Kill timer properly at removal - platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list - can: rcar_canfd: Fix controller mode setting - can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled - btrfs: ref-verify: handle damaged extent root tree - ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue - perf subcmd: avoid crash in exclude_cmds when excludes is empty - platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list - dm-integrity: limit MAX_TAG_SIZE to 255 - ASoC: amd: acp: Adjust pdm gain value - wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 - USB: serial: option: add SIMCom 8230C compositions - media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe - !20931 Fix CVE-2026-23060 - uvb: fix cis call return value and obtain - bonding: fix use-after-free due to enslave fail after slave array update - net/sched: cls_u32: use skb_header_pointer_careful() - net: add skb_header_pointer_careful() helper - regmap: Fix race condition in hwspinlock irqsave routine - crypto: virtio - Add spinlock protection with virtqueue notification - net/mlx5e: TC, delete flows only for existing peers - !20967 net: hns3: modify code of judging if SMMU DMA is enabled - ceph: fix oops due to invalid pointer for kfree() in parse_longname() - !20969 Fix CVE-2026-23125 - !20948 v4 arm64: Add memory poison recovery support for various paths - !20975 CVE-2026-23102 - !20977 v4 support apei_page_offline_policy - bonding: annotate data-races around slave->last_rx - netfilter: nf_conncount: update last_gc only when GC has been performed - bonding: provide a net pointer to __skb_flow_dissect() - netdevsim: fix a race issue related to the operation on bpf_bound_progs list - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() - apei/ghes: Add sysctl interface to control soft-offline page isolation - Revert "mm/memory-failure: support disabling soft offline for HugeTLB pages" - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - arm64/fpsimd: signal: Fix restoration of SVE context - arm64/fpsimd: signal: Consistently read FPSIMD context - arm64/fpsimd: signal: Mandate SVE payload for streaming-mode state - bonding: limit BOND_MODE_8023AD to Ethernet devices - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag - net/sched: Enforce that teql can only be used as root qdisc - sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT - drivers/net: Update vendor name of Chengdu NorthLink Technology N5/N6 Series Network Card Drivers - net: hns3: modify code of judging if SMMU DMA is enabled - dmaengine: xilinx: xdma: Fix regmap max_register - ub:ubus: protect iterator ue_list and mue_list with ub_bus_sem - ub:ubus: Avoid getting empty uent from ubc - ub:hisi-ubus: Use GFP_ATOMIC when alloc memory - arm64: send sig fault for user task when apei_claim_sea fails - arm64: add ras log during do_sea - arm64: move getting valid siaddr to the top of do_sea - arm64: mm: shmem: support poison recovery from shmem_file_read_iter() - arm64: fs: support poison recovery from __kernel_read() - iov_iter: add mc support for copy_page_to_iter - arm64: mm: support recovery from copy_{from/to}_user_page() - iov_iter: get rid of 'copy_mc' flag - leds: led-class: Only Add LED to leds_list when it is fully ready - wifi: ath10k: fix dma_free_coherent() pointer - smb/server: fix refcount leak in parse_durable_handle_context() - ksmbd: add chann_lock to protect ksmbd_chann_list xarray - ipvlan: Make the addrs_lock be per port - smb: client: split cached_fid bitfields to avoid shared-byte RMW races - efivarfs: fix error propagation in efivar_entry_get() - io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop - dm: use bio_clone_blkg_association - RAS/AMD/ATL: fix error nodes per socket on for Hygon Dhyana processor - net: txgbe: fix clang compile warning - !20552 ub: udma: fix some code issues. - !20313 Fix CVE-2025-40220 - !20321 nvme: fix admin request_queue lifetime - !20512 PM / devfreq: hisi: Fix potential UAF in OPP handling - !20544 Fix CVE-2025-71147 - !20548 v4 net: LTS-6.6 backport - !20503 Fix CVE-2025-39713 - !20133 Fix CVE-2025-39721 - !20438 Fix CVE-2025-38659 - !20264 Fix CVE-2025-40277 - !20340 Fix CVE-2025-40271 - !20319 Fix CVE-2025-40237 - !20392 vfs: Don't leak disconnected dentries on umount - !20554 iommu/s390: Implement blocking domain - !20489 [OLK-6.6][linux-6.6.y sync] Backport 6.6.101-6.6.102 LTS Patches - !20513 ACPI: PCC: Fix race condition by removing static qualifier - !20468 drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer - !20483 rcu: Protect ->defer_qs_iw_pending from data race - !20510 drivers/ub/sentry: fix primary eid index value - !20553 ub: cdma: support separated page table feature - ub: udma: fix some code issues. - !20480 iommu/ummu-core: fix error invalidate tid - !20561 iommu/ummu: Add ummu sva independent page table parameter - ub: udma: bugfix related to 2m_hugepage. - ub: udma: support for separate page tables - ub: udma: delete debugfs code. - ub: udma: bugfix related to ctrlq function. - ub: udma: verify get cqe/ae aux info out addr and len. - ub: cdma: support separated page table feature - iommu/ummu: Add ummu sva independent page table parameter - iommu: Adjust PLB refresh timing in 'grant' and 'ungrant' - !20505 Fix CVE-2026-23035 - iommu/s390: Implement blocking domain - drivers/ub/sentry: fix primary eid index value - !20535 libceph: make decode_pool() more resilient against corrupted osdmaps - !20536 mm/page_alloc: change all pageblocks migrate type on coalescing - !20537 mm/secretmem: fix use-after-free race in fault handler - !20538 wifi: avoid kernel-infoleak from struct iw_point - !20539 net: usb: rtl8150: fix memory leak on usb_submit_urb() failure - !20440 PCI/AER: Fix NULL pointer access by aer_info - !20262 Fix CVE-2025-68176 - netfilter: nf_reject: don't leak dst refcount for loopback packets - net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error - page_pool: always add GFP_NOWARN for ATOMIC allocations - virtio-net: fix received length check in big packets - net: bridge: fix use-after-free due to MST port state bypass - vsock: Ignore signal/timeout on connect() if already established - tls: make sure to abort the stream if headers are bogus - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI - xfrm: Duplicate SPI Handling - tls: handle data disappearing from under the TLS ULP - net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing - bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls - Bluetooth: hci_core: Fix use-after-free in vhci_flush() - KEYS: trusted: Fix a memory leak in tpm2_load_cmd - !20237 Fix CVE-2025-68724 - !20459 Fix CVE-2025-71131 - !20525 Fix CVE-2025-68816 - !20529 CVE-2025-68172 - net: usb: rtl8150: fix memory leak on usb_submit_urb() failure - !20370 Revert "Revert "RDMA/hns: Fix mismatch exception rollback"" - wifi: avoid kernel-infoleak from struct iw_point - mm/secretmem: fix use-after-free race in fault handler - mm/page_alloc: change all pageblocks migrate type on coalescing - libceph: make decode_pool() more resilient against corrupted osdmaps - pps: Fix kabi breakage of struct pps_device for last_fetched_ev - sched: Fix kabi breakage of struct task_struct for saved_state - crypto: aspeed - fix double free caused by devm - !20515 Bluetooth: bcsp: receive data only if registered - !20507 Fix CVE-2025-40358 - !20450 ub: ubase&unic: Fix some bug in concurrent process - !20452 iommu/ummu: Fix some bugs and optimize the code implementation - !20451 iommu/ummu: Add the function of creating devices with SVA-separated - !20500 mm: fix the inaccurate memory statistics issue for users - net/mlx5: fw_tracer, Validate format string parameters - Bluetooth: bcsp: receive data only if registered - ACPI: PCC: Fix race condition by removing static qualifier - ACPI: CPPC: Fix missing PCC check for guaranteed_perf - iommu/ummu: Add the function of creating devices with SVA-separated - iommu/ummu-core: fix error invalidate tid - riscv: stacktrace: Disable KASAN checks for non-current tasks - !20497 arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() - !20496 drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies - !20495 iommu/amd: Avoid stack buffer overflow from kernel cmdline - !20494 HID: core: Harden s32ton() against conversion to 0 bits - !20493 iommu: Fix two issues in iommu_copy_struct_from_user() - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv - PM / devfreq: hisi: Fix potential UAF in OPP handling - media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() - !20487 interference: Fix uninitialized ifs_clock compiling issue - MIPS: mm: kmalloc tlb_vpn array to avoid stack overflow - MIPS: mm: Prevent a TLB shutdown on initial uniquification - mm: fix the inaccurate memory statistics issue for users - mm: add config option for atomic mode in mm counter - Revert "mm: fix the inaccurate memory statistics issue for users" - !20444 net/mlx5e: Fix crash on profile change rollback failure - !20442 net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv - arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() - drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies - iommu/amd: Avoid stack buffer overflow from kernel cmdline - HID: core: Harden s32ton() against conversion to 0 bits - iommu: Fix two issues in iommu_copy_struct_from_user() - SUNRPC: call xs_sock_process_cmsg for all cmsg - flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read - !20374 [OLK 6.6]Use Hygon IBRS and IBPB rather than software-based mitigation to mitigate Retbleed and SRSO. - !20227 Rename leapioraid to leapraid and release v2.0 - mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery - MIPS: mm: tlb-r4k: Uniquify TLB entries on init - x86/fpu: Delay instruction pointer fixup until after warning - ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx() - ALSA: intel_hdmi: Fix off-by-one error in __hdmi_lpe_audio_probe() - x86/sev: Evict cache lines during SNP memory validation - net: usbnet: Fix the wrong netif_carrier_on() call - net: usbnet: Avoid potential RCU stall on LINK_CHANGE event - Bluetooth: btusb: Add USB ID 3625:010b for TP-LINK Archer TX10UB Nano - sched,freezer: Remove unnecessary warning in __thaw_task - freezer,sched: Clean saved_state when restoring it during thaw - freezer,sched: Do not restore saved_state of a thawed task - freezer,sched: Use saved_state to reduce some spurious wakeups - sched/core: Remove ifdeffery for saved_state - i2c: stm32f7: unmap DMA mapped buffer - i2c: stm32f7: simplify status messages in case of errors - i2c: stm32f7: perform most of irq job in threaded handler - i2c: stm32f7: use dev_err_probe upon calls of devm_request_irq - i2c: stm32f7: Use devm_clk_get_enabled() - USB: serial: option: add Foxconn T99W709 - smb: server: Fix extension string in ksmbd_extract_shortname() - ksmbd: fix corrupted mtime and ctime in smb2_open - ksmbd: fix Preauh_HashValue race condition - ksmbd: fix null pointer dereference error in generate_encryptionkey - vsock: Do not allow binding to VMADDR_PORT_ANY - selftests/perf_events: Add a mmap() correctness test - smb: client: return an error if rdma_connect does not return within 5 seconds - smb: client: let recv_done() cleanup before notifying the callers. - smb: client: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already - smb: client: make use of common smbdirect_socket - smb: smbdirect: add smbdirect_socket.h - smb: client: Correct typos in multiple comments across various files - smb: client: Use min() macro - smb: server: let recv_done() avoid touching data_transfer after cleanup/move - smb: server: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already - ALSA: hda/ca0132: Fix missing error handling in ca0132_alt_select_out() - irqchip: Build IMX_MU_MSI only on ARM - net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing - sunrpc: fix client side handling of tls alerts - net/sched: taprio: enforce minimum value for picos_per_byte - net: drop UFO packets in udp_rcv_segment() - ipv6: reject malicious packets in ipv6_gso_segment() - net/mlx5: Correctly set gso_segs when LRO is used - netlink: specs: ethtool: fix module EEPROM input/output arguments - net: ipa: add IPA v5.1 and v5.5 to ipa_version_string() - phy: mscc: Fix parsing of unicast frames - netpoll: prevent hanging NAPI when netcons gets enabled - md/md-cluster: handle REMOVE message earlier - NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY - NFS: Fix wakeup of __nfs_lookup_revalidate() in unblock_revalidate() - sched: Add test_and_clear_wake_up_bit() and atomic_dec_and_wake_up() - pNFS/flexfiles: don't attempt pnfs on fatal DS errors - PCI: pnv_php: Fix surprise plug detection and recovery - powerpc/eeh: Export eeh_unfreeze_pe() - PCI: pnv_php: Work around switches with broken presence detection - kconfig: qconf: fix ConfigList::updateListAllforAll() - scsi: sd: Make sd shutdown issue START STOP UNIT appropriately - scsi: ufs: core: Use link recovery when h8 exit fails during runtime resume - scsi: Revert "scsi: iscsi: Fix HW conn removal use after free" - scsi: mpt3sas: Fix a fw_event memory leak - vfio/pci: Separate SR-IOV VF dev_set - vfio/pds: Fix missing detach_ioas op - vfio: Prevent open_count decrement to negative - vfio: Fix unbalanced vfio_df_close call in no-iommu mode - f2fs: fix to calculate dirty data during has_not_enough_free_secs() - f2fs: fix to update upper_p in __get_secs_required() correctly - f2fs: vm_unmap_ram() may be called from an invalid context - f2fs: fix to avoid out-of-boundary access in devs.path - f2fs: doc: fix wrong quota mount option description - f2fs: fix KMSAN uninit-value in extent_info usage - rtc: rv3028: fix incorrect maximum clock rate handling - rtc: pcf8563: fix incorrect maximum clock rate handling - rtc: pcf85063: fix incorrect maximum clock rate handling - rtc: nct3018y: fix incorrect maximum clock rate handling - rtc: hym8563: fix incorrect maximum clock rate handling - rtc: ds1307: fix incorrect maximum clock rate handling - ucount: fix atomic_long_inc_below() argument type - module: Restore the moduleparam prefix length check - apparmor: fix loop detection used in conflicting attachment resolution - apparmor: ensure WB_HISTORY_SIZE value is a power of 2 - bpf: Check netfilter ctx accesses are aligned - bpf: Check flow_dissector ctx accesses are aligned - vhost-scsi: Fix log flooding with target does not exist errors - mtd: rawnand: atmel: set pmecc data setup time - mtd: rawnand: rockchip: Add missing check after DMA map - mtd: rawnand: atmel: Fix dma_mapping_error() address - jfs: fix metapage reference count leak in dbAllocCtl - crypto: qat - fix seq_file position update in adf_ring_next() - crypto: qat - fix DMA direction for compression on GEN2 devices - perf tools: Remove libtraceevent in .gitignore - sh: Do not use hyphen in exported variable name - ASoC: fsl_xcvr: get channel status data when PHY is not exists - dmaengine: nbpfaxi: Add missing check after DMA map - dmaengine: mv_xor: Fix missing check after DMA map and missing unmap - fs/orangefs: Allow 2 more characters in do_c_string() - PCI: endpoint: pci-epf-vntb: Fix the incorrect usage of __iomem attribute - soundwire: stream: restore params when prepare ports fail - crypto: img-hash - Fix dma_unmap_sg() nents value - crypto: keembay - Fix dma_unmap_sg() nents value - hwrng: mtk - handle devm_pm_runtime_enable errors - watchdog: ziirave_wdt: check record length in ziirave_firm_verify() - scsi: isci: Fix dma_unmap_sg() nents value - scsi: mvsas: Fix dma_unmap_sg() nents value - scsi: elx: efct: Fix dma_unmap_sg() nents value - scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value - clk: sunxi-ng: v3s: Fix de clock definition - perf tests bp_account: Fix leaked file descriptor - kernel: trace: preemptirq_delay_test: use offstack cpu mask - crypto: inside-secure - Fix `dma_unmap_sg()` nents value - perf sched: Fix memory leaks in 'perf sched latency' - perf sched: Fix memory leaks for evsel->priv in timehist - perf sched: Free thread->priv using priv_destructor - perf dso: Add missed dso__put to dso__load_kcore - perf tools: Fix use-after-free in help_unknown_cmd() - Fix dma_unmap_sg() nents value - clk: clk-axi-clkgen: fix fpfd_max frequency for zynq - fanotify: sanitize handle_type values when reporting fid - pinctrl: sunxi: Fix memory leak on krealloc failure - PCI: endpoint: pci-epf-vntb: Return -ENOENT if pci_epc_get_next_free_bar() fails - crypto: arm/aes-neonbs - work around gcc-15 warning - power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set - power: supply: cpcap-charger: Fix null check for power_supply_get_by_name - clk: xilinx: vcu: unregister pll_post only if registered correctly - media: v4l2-ctrls: Fix H264 SEPARATE_COLOUR_PLANE check - mtd: fix possible integer overflow in erase_xfer() - crypto: marvell/cesa - Fix engine load inaccuracy - crypto: qat - use unmanaged allocation for dc_data - crypto: sun8i-ce - fix nents passed to dma_unmap_sg() - PCI: rockchip-host: Fix "Unexpected Completion" log message - bpf/preload: Don't select USERMODE_DRIVER - ipv6: annotate data-races around rt->fib6_nsiblings - ipv6: fix possible infinite loop in fib6_info_uses_dev() - vrf: Drop existing dst reference in vrf_ip6_input_dst - selftests: rtnetlink.sh: remove esp4_offload after test - net/mlx5e: Clear Read-Only port buffer size in PBMC before update - netfilter: xt_nfacct: don't assume acct name is null-terminated - can: kvaser_usb: Assign netdev.dev_port based on device channel index - can: kvaser_pciefd: Store device channel index - can: peak_usb: fix USB FD devices potential malfunction - tools/rv: Do not skip idle in trace - Bluetooth: hci_event: Mask data status from LE ext adv reports - kcsan: test: Initialize dummy variable - wifi: mac80211: Write cnt before copying in ieee80211_copy_rnr_beacon() - wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE - wifi: ath12k: fix endianness handling while accessing wmi service bit - wifi: mac80211: Check 802.11 encaps offloading in ieee80211_tx_h_select_key() - wifi: mac80211: Don't call fq_flow_idx() for management frames - wifi: mac80211: Do not schedule stopped TXQs - wifi: plfxlc: Fix error handling in usb driver probe - wifi: mac80211: reject TDLS operations when station is not associated - iommu/amd: Fix geometry.aperture_end for V2 tables - mwl8k: Add missing check after DMA map - wifi: rtl8xxxu: Fix RX skb size for aggregation disabled - tcp: call tcp_measure_rcv_mss() for ooo packets - xen/gntdev: remove struct gntdev_copy_batch from stack - net_sched: act_ctinfo: use atomic64_t for three counters - net/sched: Restrict conditions for adding duplicating netems to qdisc tree - um: rtc: Avoid shadowing err in uml_rtc_start() - arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX - netfilter: nf_tables: adjust lockdep assertions handling - netfilter: nf_tables: Drop dead code from fill_*_info routines - fbcon: Fix outdated registered_fb reference in comment - drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value - m68k: Don't unregister boot console needlessly - drm/msm/dpu: Fill in min_prefill_lines for SC8180X - kselftest/arm64: Fix check for setting new VLs in sve-ptrace - net: dst: annotate data-races around dst->input - tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range - wifi: ath11k: clear initialized flag for deinit-ed srng lists - iwlwifi: Add missing check for alloc_ordered_workqueue - wifi: iwlwifi: Fix memory leak in iwl_mvm_init() - wifi: rtl818x: Kill URBs before clearing tx status queue - wifi: rtw89: avoid NULL dereference when RX problematic packet on unsupported 6 GHz band - caif: reduce stack size, again - bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure - drm/vmwgfx: Fix Host-Backed userspace on Guest-Backed kernel - net: ipv6: ip6mr: Fix in/out netdev to pass to the FORWARD chain - selftests/bpf: fix signedness bug in redir_partial() - bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls - bpf, sockmap: Fix psock incorrectly pointing to sk - drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed - staging: nvec: Fix incorrect null termination of battery manufacturer - interconnect: qcom: sc8180x: specify num_nodes - interconnect: qcom: sc8280xp: specify num_links for qnm_a1noc_cfg - soc: qcom: pmic_glink: fix OF node leak - samples: mei: Fix building on musl libc - cpufreq: Initialize cpufreq-based frequency-invariance later - cpufreq: intel_pstate: Always use HWP_DESIRED_PERF in passive mode - arm64: dts: imx8mn-beacon: Fix HS400 USDHC clock speed - arm64: dts: imx8mm-beacon: Fix HS400 USDHC clock speed - ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface - soc/tegra: cbb: Clear ERR_FORCE register with ERR_STATUS - arm: dts: ti: omap: Fixup pinheader typo - usb: early: xhci-dbc: Fix early_ioremap leak - powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw() - pps: fix poll support - staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() - spi: stm32: Check for cfg availability in stm32_spi_probe - usb: misc: apple-mfi-fastcharge: Make power supply names unique - usb: host: xhci-plat: fix incorrect type for of_match variable in xhci_plat_probe() - ARM: dts: vfxxx: Correctly use two tuples for timer address - arm64: dts: qcom: msm8976: Make blsp_dma controlled-remotely - arm64: dts: qcom: sc7180: Expand IMEM region - arm64: dts: qcom: sdm845: Expand IMEM region - soc: qcom: QMI encoding/decoding for big endian - selftests: Fix errno checking in syscall_user_dispatch test - ASoC: mediatek: use reserved memory or enable buffer pre-allocation - gfs2: No more self recovery - Revert "fs/ntfs3: Replace inode_trylock with inode_lock" - hfs: make splice write available again - hfsplus: make splice write available again - ublk: use vmalloc for ublk_device's __queues - fs_context: fix parameter name in infofc() macro - audit,module: restore audit logging in load failure case - ASoC: amd: yc: add DMI quirk for ASUS M6501RM - ASoC: Intel: fix SND_SOC_SOF dependencies - ASoC: amd: yc: Add DMI entries to support HP 15-fb1xxx - ethernet: intel: fix building with large NR_CPUS - ASoC: amd: yc: Add DMI quirk for HP Laptop 17 cp-2033dx - interference: Fix uninitialized ifs_clock compiling issue - iommu/ummu: optimize log printing - !20455 Fix compilation failure caused by PR#20174 - !20302 CVE-2026-22980 - !20142 CVE-2025-68803 - !20261 ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency - !20435 fix CVE-2026-22998 - !20433 scsi: target: Reset t_task_cdb pointer in error case - !20432 scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" - !20431 block: Use RCU in blk_mq_[un - !20307 tpm: Cap the number of PCR banks - !20062 xfs: Add xfs_dir3_leaf_header_check() in leaf/leafn read - !20157 v2 md: backport from mainline - rcu: Protect ->defer_qs_iw_pending from data race - platform/x86/intel/pmt: fix compilation failure caused by PR#20174 - iommu/ummu: optimize kv cache memory management - iommu/ummu: optimize permission table management - iommu/ummu: remove check for eid_type while del eid - iommu/ummu: optimize the code implementation - drivers/perf: fix ummu-pmu data reading exception - iommu/ummu: IOMMU_DOMAIN_BLOCKED type don not sync tct - drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer - crypto: seqiv - Do not use req->iv after crypto_aead_encrypt - net: unic: Notify mami of the bond ip change. - ub: ubase: Support for UE link by ctrlq message - ub: ubase: send a deactivate req in removing - ub: ubase: Querying TPG/TP contexts in the chip is no longer supported after enabling safe mode. - ub: ubase: Use an independent thread for the ctrlq workqueue. - !20368 ubcore: fix logging and permission for route query. - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id - !20344 ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr - net: unic: Fix the ummu 0xa event that occurs when modifying queues and resetting concurrent scenarios - ub: ubase: Add KABI compatibility - ub: ubase: fixing the issue of cdma ctp_req_vl parameter configuration - ub: ubase: add PMU IDEV interrupt supported abilities. - ub: ubase: Delete the tid mask for eq, jfs, jfr, and jfc context - ub: ubase: Set the completion event interrupt to auto - net: unic: fix poll tx read old skb cause a UAF bug - !20249 Fix CVE-2025-38489 - !20250 Fix CVE-2025-38480 - !20378 Fix CVE-2025-39838 - !20430 Fix CVE-2025-39942 - !20351 Fix CVE-2025-71149 - !20375 Fix CVE-2025-71150 - !20323 Fix CVE-2025-38730 - !20320 Fix CVE-2025-68814 - !20314 Fix CVE-2025-71072 - !20315 Fix CVE-2025-68794 - !20403 bpf: Check skb->transport_header is set in bpf_skb_check_mtu - !20402 bpf: Do not let BPF test infra emit invalid GSO types to stack - !20401 tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() - !20400 netfilter: nft_ct: add seqadj extension for natted connections - !20399 net: xfrm: Fix CVE-2025-40215 - !20398 net/sched: sch_qfq: Fix null-deref in agg_dequeue - !20397 bpf: Reject narrower access to pointer ctx fields - !20396 Bluetooth: eir: Fix possible crashes on eir_create_adv_data - !20394 IB/mlx5: Fix potential deadlock in MR deregistration - !20367 ub: cdma: cdma uaf bugfix - net/mlx5e: Fix crash on profile change rollback failure - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv - PCI/AER: Fix NULL pointer access by aer_info - gfs2: No more self recovery - drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE - crypto: qat - flush misc workqueue during device shutdown - !20174 Backport PMT spec 3.0 support - !20366 [Hygon][6.6][Bugfix]: Resolve FPU state corruption between atomic and non-atomic contexts - !19814 [OLK-6.6] Batch flushing user memory encrytion status change - !20393 [OLK-6.6][linux-6.6.y sync] Backport 6.6.100-6.6.101 LTS Patches - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec - nvmet-tcp: remove boilerplate code - scsi: target: Reset t_task_cdb pointer in error case - scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" - block: Use RCU in blk_mq_[un]quiesce_tagset() instead of set->tag_list_lock - ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size - ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer - smb: server: let recv_done() consistently call put_recvmsg/smb_direct_disconnect_rdma_connection - smb: server: remove separate empty_recvmsg_queue - !20384 ub:ubus: Fix ubus link message and pool device error - !20389 gfs2: Prevent recursive memory reclaim - !20388 *** fix CVE-2025-38062 *** - !20387 KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced - !20386 pinctrl: check the return value of pinmux_ops::get_function_name() - !20385 iommu/amd/pgtbl: Fix possible race while increase page table level - ub:ubus: Not cfg access during surprise down - ub:hisi-ubus: Delete validate_pa err print - PCI: cadence: Check for the existence of cdns_pcie::ops before using it - can: netlink: can_changelink(): allow disabling of automatic restart - Revert "selftests/bpf: Add a cgroup prog bpf_get_ns_current_pid_tgid() test" - drm/sched: Remove optimization that causes hang when killing dependent jobs - ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS - bpf: Check skb->transport_header is set in bpf_skb_check_mtu - bpf: Do not let BPF test infra emit invalid GSO types to stack - tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() - netfilter: nft_ct: add seqadj extension for natted connections - xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added - xfrm: delete x->tunnel as we delete x - x86/hw-vuln:Support hardware-based mitigation for Retbleed and SRSO via Hygon IBRS to avoid performance degradation caused by software-based mitigation. - net/sched: sch_qfq: Fix null-deref in agg_dequeue - bpf: Reject narrower access to pointer ctx fields - Bluetooth: eir: Fix possible crashes on eir_create_adv_data - IB/mlx5: Fix potential deadlock in MR deregistration - ub:ubus: Fix ubus link message and pool device error - ub:hisi-ubus: cq poller maximum handle 64 cqe per time - ub:hisi-ubus:Fix vdm message print error - ub:ubus:Fix ubus interrupt release issue - wifi: mt76: mt7921: prevent decap offload config before STA initialization - mtd: rawnand: qcom: Fix last codeword read in qcom_param_page_type_exec() - iio: hid-sensor-prox: Restore lost scale assignments - iio: hid-sensor-prox: Fix incorrect OFFSET calculation - crypto: powerpc/poly1305 - add depends on BROKEN for now - erofs: address D-cache aliasing - drm/i915/dp: Fix 2.7 Gbps DP_LINK_BW value on g4x - ALSA: hda: Add missing NVIDIA HDA codec IDs - ALSA: hda/tegra: Add Tegra264 support - comedi: comedi_test: Fix possible deletion of uninitialized timers - usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach - usb: typec: tcpm: allow switching to mode accessory to mux properly - usb: typec: tcpm: allow to use sink in accessory mode - drm/amdkfd: Don't call mmput from MMU notifier callback - mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n - selftests: mptcp: connect: also cover checksum - selftests: mptcp: connect: also cover alt modes - resource: fix false warning in __request_region() - gve: Fix stuck TX queue for DQ queue format - e1000e: ignore uninitialized checksum word on tgp - e1000e: disregard NVM checksum on tgp when valid checksum bit is not set - dpaa2-switch: Fix device reference count leak in MAC endpoint handling - dpaa2-eth: Fix device reference count leak in MAC endpoint handling - ALSA: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx - sprintf.h requires stdarg.h - bus: fsl-mc: Fix potential double device reference in fsl_mc_get_endpoint() - i2c: virtio: Avoid hang by using interruptible completion wait - i2c: tegra: Fix reset error handling with ACPI - platform/x86: ideapad-laptop: Fix kbd backlight not remembered among boots - can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode - can: dev: can_restart(): move debug message and stats after successful restart - can: dev: can_restart(): reverse logic to remove need for goto - i40e: When removing VF MAC filters, only check PF-set MAC - i40e: report VF tx_dropped with tx_errors instead of tx_discards - i40e: Add rx_missed_errors for buffer exhaustion - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch - net/mlx5: Fix memory leak in cmd_exec() - staging: vchiq_arm: Make vchiq_shutdown never fail - x86/hyperv: Fix usage of cpu_online_mask to get valid cpu - regmap: fix potential memory leak of regmap_bus - iio: adc: ad7949: use spi_is_bpw_supported() - interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1 node - RDMA/core: Rate limit GID cache warning messages - virtio_ring: Fix error reporting in virtqueue_resize - !20348 [OLK-6.6][linux-6.6.y sync] Backport 6.6.99-6.6.100 LTS Patches - !20346 tracing: Fix crash on synthetic stacktrace field usage - vfs: Don't leak disconnected dentries on umount - !20334 Fix CVE-2025-68780 - gfs2: Prevent recursive memory reclaim - amd/amdkfd: enhance kfd process check in switch partition - drm/amdkfd: allow compute partition mode switch with cgroup exclusions - KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced - pinctrl: check the return value of pinmux_ops::get_function_name() - iommu/amd/pgtbl: Fix possible race while increase page table level - !19966 nvme-fc: use lock accessing port_state and rport state - ASoC: fsl_sai: replace regmap_write with regmap_update_bits - comedi: Fix use of uninitialized data in insn_rw_emulate_bits() - cifs: prevent NULL pointer dereference in UTF16 conversion - ksmbd: Fix refcount leak when invalid session is found on session lookup - ubcore: fix logging and permission for route query. - !20232 driver/coda: VirtCCA supports MSI device DA - Revert "Revert "RDMA/hns: Fix mismatch exception rollback"" - !20197 ub: udma&ubase: fix a bug that caused long reboot time - x86: Resolve FPU state corruption between atomic and non-atomic contexts - ub: cdma: cdma uaf bugfix - ub: cdma: jfs call trace bugfix - !20353 x86/fpu: Clear XSTATE_BV[i - s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again - KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls - nvmem: layouts: u-boot-env: remove crc32 endianness conversion - i2c: omap: fix deprecated of_property_read_bool() use - ASoC: fsl_sai: Force a software reset when starting in consumer mode - regulator: pwm-regulator: Manage boot-on with disabled PWM channels - regulator: pwm-regulator: Calculate the output voltage for disabled PWMs - i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe() - i2c: omap: Fix an error handling path in omap_i2c_probe() - i2c: omap: Add support for setting mux - usb: dwc3: qcom: Don't leave BCR asserted - usb: hub: Don't try to recover devices lost during warm reset. - usb: hub: Fix flushing of delayed work used for post resume purposes - usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm - usb: hub: fix detection of high tier USB3 devices behind suspended hubs - arm64: Filter out SME hwcaps when FEAT_SME isn't implemented - ipv6: make addrconf_wq single threaded - !20354 cpufreq/sched: Explicitly synchronize limits_changed flag handling - sched/deadline: only set free_cpus for online runqueues - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 - cpufreq/sched: Explicitly synchronize limits_changed flag handling - io_uring/poll: correctly handle io_poll_add() return value on update - shmem: fix recovery on rename failures - io_uring: fix filename leak in __io_openat_prep() - Revert "cgroup_freezer: cgroup_freezing: Check if not frozen" - rxrpc: Fix transmission of an abort in response to an abort - rxrpc: Fix recv-recv race of completed call - net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree - net: bridge: Do not offload IGMP/MLD messages - hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf - netfilter: nf_conntrack: fix crash due to removal of uninitialised entry - ipv6: mcast: Delay put pmc->idev in mld_del_delrec() - net/mlx5: Correctly set gso_size when LRO is used - Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID - Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout - Bluetooth: SMP: If an unallowed command is received consider it a failure - Bluetooth: hci_sync: fix connectable extended advertising when using static random address - hwmon: (corsair-cpro) Validate the size of the received input buffer - selftests: net: increase inter-packet timeout in udpgro.sh - wifi: cfg80211: remove scan request n_channels counted_by - nvme: fix misaccounting of nvme-mpath inflight I/O - net: phy: Don't register LEDs for genphy - nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list() - rpl: Fix use-after-free in rpl_do_srh_inline(). - block: fix kobject leak in blk_unregister_queue - net: emaclite: Fix missing pointer increment in aligned_read() - soundwire: amd: fix for clearing command status register - soundwire: amd: fix for handling slave alerts after link is down - comedi: Fix use of uninitialized data in insn_rw_emulate_bits() - comedi: Fix some signed shift left operations - comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large - comedi: das6402: Fix bit shift out of bounds - comedi: das16m1: Fix bit shift out of bounds - comedi: aio_iiro_16: Fix bit shift out of bounds - comedi: pcl812: Fix bit shift out of bounds - iio: adc: stm32-adc: Fix race in installing chained IRQ handler - iio: adc: max1363: Reorder mode_list[] entries - iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] - iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush - soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled - soc: aspeed: lpc-snoop: Cleanup resources in stack-order - s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again - pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov - net: libwx: properly reset Rx ring descriptor - net: libwx: remove duplicate page_pool_put_full_page() - mmc: sdhci_am654: Workaround for Errata i2312 - mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models - mmc: bcm2835: Fix dma_unmap_sg() nents value - memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() - isofs: Verify inode mode when loading from disk - dmaengine: nbpfaxi: Fix memory corruption in probe() - af_packet: fix soft lockup issue caused by tpacket_snd() - af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() - arm64: dts: rockchip: use cs-gpios for spi1 on ringneck - arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on - arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency - net/mlx5: Update the list of the PCI supported devices - phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() - io_uring/poll: fix POLLERR handling - ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS - drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume - tracing/osnoise: Fix crash in timerlat_dump_stack() - spi: Add check for 8-bit transfer with 8 IO mode support - pch_uart: Fix dma_sync_sg_for_device() nents value - thunderbolt: Fix bit masking in tb_dp_port_set_hops() - i2c: stm32: fix the device used for the DMA map - tracing: Fix crash on synthetic stacktrace field usage - usb: musb: fix gadget state on disconnect - USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI - USB: serial: option: add Foxconn T99W640 - USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition - phy: tegra: xusb: Disable periodic tracking on Tegra234 - phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode - phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr - fs/proc: fix uaf in proc_readdir_de() - io_uring/net: commit partial buffers on retry - nvme: fix admin request_queue lifetime - fs/notify: call exportfs_encode_fid with s_umount - iomap: adjust read range correctly for non-block-aligned positions - fuse: fix livelock in synchronous file put from fuseblk workers - tpm: Cap the number of PCR banks - nfsd: provide locking for v4_end_grace - Revert "nfsd: provide locking for v4_end_grace" - config: enable config for PMT discovery driver - platform/x86/intel/pmt/discovery: use valid device pointer in dev_err_probe - platform/x86/intel/pmt: Fix kobject memory leak on init failure - platform/x86/intel/pmt: fix a crashlog NULL pointer access - platform/x86/intel/pmt: fix build dependency for kunit test - platform/x86/intel/pmt/discovery: fix format string warning - platform/x86/intel/pmt/discovery: Fix size_t specifiers for 32-bit - platform/x86/intel/pmt: KUNIT test for PMT Enhanced Discovery API - platform/x86/intel/pmt/telemetry: Add API to retrieve telemetry regions by feature - platform/x86/intel/pmt/discovery: Get telemetry attributes - platform/x86/intel/tpmi: Get OOBMSM CPU mapping from TPMI - platform/x86/intel/vsec: Set OOBMSM to CPU mapping - platform/x86/intel/tpmi: Relocate platform info to intel_vsec.h - docs: Add ABI documentation for intel_pmt feature directories - platform/x86/intel/pmt: Add PMT Discovery driver - sysfs: Fix crash on empty group attributes array - sysfs: Introduce a mechanism to hide static attribute_groups - platform/x86/intel/vsec: Add new Discovery feature - platform/x86/intel/vsec: Skip driverless features - platform/x86/intel/vsec: Skip absent features during initialization - platform/x86/intel/vsec: Add device links to enforce dependencies - platform/x86/intel/vsec: Create wrapper to walk PCI config space - platform/x86/intel/vsec: Add private data for per-device data - MAINTAINERS: Add link to documentation of Intel PMT ABI - platform/x86/intel/pmt: allow user offset for PMT callbacks - driver/coda: VirtCCA supports MSI device DA - ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency - Rename leapioraid to leapraid and release v2.0 - ub: udma: fix a bug that caused long reboot time. - ub: ubase: Accelerate when ctrl node is shutting down - platform/x86/intel/pmt: Use PMT callbacks - platform/x86/intel/vsec: Add PMT read callbacks - platform/x86/intel/vsec.h: Move to include/linux - md: prevent incorrect update of resync/recovery offset - md/raid1: Fix data corruption for degraded array with slow disk - md/raid1: set max_sectors during early return from choose_slow_rdev() - md-cluster: fix no recovery job when adding/re-adding a disk - md-cluster: fix hanging issue while a new disk adding - md/raid5: recheck if reshape has finished with device_lock held - md-cluster: Constify struct md_cluster_operations - md: Remove unneeded semicolon - md/raid5: fix spares errors about rcu usage - dm-raid: Fix WARN_ON_ONCE check for sync_thread in raid_resume - md: pass in max_sectors for pers->sync_request() - md: factor out helpers for different sync_action in md_do_sync() - md: replace last_sync_action with new enum type - md: use new helpers in md_do_sync() - md: don't fail action_store() if sync_thread is not registered - md: remove parameter check_seq for stop_sync_thread() - md: replace sysfs api sync_action with new helpers - md: factor out helper to start reshape from action_store() - md: add new helpers for sync_action - md: add a new enum type sync_action - md: rearrange recovery_flags - md/raid0: don't free conf on raid0_run failure - md: make md_flush_request() more readable - md: change the return value type of md_write_start to void - md: Revert "md: Fix overflow in is_mddev_idle" - md: don't account sync_io if iostats of the disk is disabled - md: Fix overflow in is_mddev_idle - md: add check for sleepers in md_wakeup_thread() - md: add a mddev_is_dm helper - md: add a mddev_add_trace_msg helper - md: add a mddev_trace_remap helper - dm-raid456, md/raid456: fix a deadlock for dm-raid456 while io concurrent with reshape - dm-raid: add a new helper prepare_suspend() in md_personality - dm-raid: really frozen sync_thread during suspend - md: add a new helper reshape_interrupted() - md: export helper md_is_rdwr() - md: export helpers to stop sync_thread - md: don't clear MD_RECOVERY_FROZEN for new dm-raid until resume - md/raid1: factor out helpers to choose the best rdev from read_balance() - md/raid1: factor out the code to manage sequential IO - md/raid1: factor out choose_bb_rdev() from read_balance() - md/raid1: factor out choose_slow_rdev() from read_balance() - md/raid1: factor out read_first_rdev() from read_balance() - md/raid1-10: factor out a new helper raid1_should_read_first() - md/raid1-10: add a helper raid1_check_read_range() - md/raid1: fix choose next idle in read_balance() - md/raid1: record nonrot rdevs while adding/removing rdevs to conf - md/raid1: factor out helpers to add rdev to conf - md: add a new helper rdev_has_badblock() - md: check mddev->pers before calling md_set_readonly() - md: clean up openers check in do_md_stop() and md_set_readonly() - md: sync blockdev before stopping raid or setting readonly - md: factor out a helper to sync mddev - md: return directly before setting did_set_md_closing - md: changed the switch of RAID_VERSION to if - md: merge the check of capabilities into md_ioctl_valid() - md: Don't suspend the array for interrupted reshape - md: Don't register sync_thread for reshape directly - md: Make sure md_do_sync() will set MD_RECOVERY_DONE - md: Don't ignore read-only array in md_check_recovery() - md: Don't ignore suspended array in md_check_recovery() - md: get rdev->mddev with READ_ONCE() - md: remove redundant md_wakeup_thread() - md: remove redundant check of 'mddev->sync_thread' - md: fix a suspicious RCU usage warning - raid: Remove now superfluous sentinel element from ctl_table array - NFSD: NFSv4 file creation neglects setting ACL - nfsd: set security label during create operations - xfs: Add xfs_dir3_leaf_header_check() in leaf/leafn read - nvme-fc: use lock accessing port_state and rport state - x86/mm: Batch flushing user memory encrytion status change - !20588 [OLK-6.6] Revert "x86/csv: Enhance CMA memory usage reporting for CSV3" - Revert "x86/csv: Enhance CMA memory usage reporting for CSV3" - !20576 media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg() - !20575 RDMA/cm: Fix leaking the multicast GID table reference - !20580 RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly - !20551 Fix CVE-2025-68785 - !20478 f2fs: fix to avoid potential deadlock - !20501 [OLK-6.6] backport important bugfix for bnxt driver from upstream linux-6.6.y - !20520 Fix CVE-2026-23038 - !20424 net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup - !20425 mlx5: Fix default values in create CQ - RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly - media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg() - RDMA/cm: Fix leaking the multicast GID table reference - net: openvswitch: fix middle attribute validation in push_nsh() action - net: openvswitch: remove never-working support for setting nsh fields - pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() - bnxt_en: Fix potential data corruption with HW GRO/LRO - f2fs: fix to avoid potential deadlock - mlx5: Fix default values in create CQ - net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup - riscv kernel upgrade to 6.6.0-138.0.0 - Fixed system hang when boot systemd on spacemit k3 - riscv: perf vendor events: fix lrw core PMU event mapping - !20727 v2 bpf: sockmap fixes - !20741 scsi: qla2xxx: Sanitize payload size to prevent member overflow - !20744 fix CVE-2025-38449 - !20763 net: usb: asix: validate PHY address before use - !20762 smc91x: fix broken irq-context in PREEMPT_RT - !20293 [Hygon][6.6][EDAC] The width of hash value is 2 bits for Hygon family 18h model 6h processors - !20290 [Hygon][6.6][Bugfix] Bug fix for EDAC to use unicast instead of broadcast on hygon family 18h model 4h - !20289 [Hygon][6.6][Bugfix] Bug fix for EDAC to correct the address translation on hygon family 18h model 4h - !20245 KVM: arm64: Refactor exit handlers - !20246 KVM: arm64: Mark some header functions as inline - !19005 [Hygon] [OLK-6.6] [Bugfix] Fix memory bandwidth counter width for Hygon QoS - !20292 [Hygon][6.6][TSC Adjust] Backport x86 TSC adjust patch - !20273 [Hygon][6.6][Bugfix] Get correct CPU LLC ID in guest for Hygon processors - !20722 [OLK-6.6][linux-6.6.y sync] Backport 6.6.104-6.6.106 LTS Patches - !20667 fix CVE-2024-50102 - !20736 netfilter: nf_tables: remove redundant chain validation on register store - !20758 ub: ubase: Fixed the alarm issue caused by the initialization of the structure variable definition. - !20721 obmm: reduce log noise for successful export/import/preimport - net: usb: asix: validate PHY address before use - smc91x: fix broken irq-context in PREEMPT_RT - !20731 devlink: rate: Unset parent pointer in devl_rate_nodes_destroy - !20732 libceph: return the handler error from mon_handle_auth_done() - !20743 mm: slub: avoid wake up kswapd in set_track_prepare - ub: ubase: Fixed the alarm issue caused by the initialization of the structure variable definition. - !20750 ub: cdma: adapted to UMMU interface changes - !20713 urma: DFX of log in kernel - urma: optimize log levels for kernel space - ub: cdma: adapted to UMMU interface changes - wifi: ath11k: avoid bit operation on key flags - drm/mediatek: fix potential OF node use-after-free - cpufreq: intel_pstate: Check IDA only before MSR_IA32_PERF_CTL writes - wifi: cfg80211: sme: store capped length in __cfg80211_connect_result() - !20708 ub:hisi-ubus: Add create bus instance ummu bypass - drm: fix kabi for struct drm_framebuffer - drm/framebuffer: Acquire internal references on GEM handles - drm/gem: Acquire references on GEM handles for framebuffers - mm: slub: avoid wake up kswapd in set_track_prepare - scsi: qla2xxx: Sanitize payload size to prevent member overflow - netfilter: nf_tables: remove redundant chain validation on register store - libceph: return the handler error from mon_handle_auth_done() - devlink: rate: Unset parent pointer in devl_rate_nodes_destroy - Documentation/hw-vuln: Add VMSCAPE documentation - dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status() - riscv: use lw when reading int cpu in asm_per_cpu - mm: slub: avoid wake up kswapd in set_track_prepare - tools: gpio: remove the include directory on make clean - tools: gpio: rm .*.cmd on make clean - drm/amd/amdgpu: Fix missing error return on kzalloc failure - drm/amdgpu: Replace DRM_* with dev_* in amdgpu_psp.c - perf bpf-event: Fix use-after-free in synthesis - drm/bridge: ti-sn65dsi86: fix REFCLK setting - spi: spi-fsl-lpspi: Clear status register after disabling the module - spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort - spi: spi-fsl-lpspi: Set correct chip-select polarity bit - spi: spi-fsl-lpspi: Fix transmissions when using CONT - hwmon: mlxreg-fan: Prevent fans from getting stuck at 0 RPM - pcmcia: omap: Add missing check for platform_get_resource - Revert "drm/amdgpu: Avoid extra evict-restore process." - ALSA: hda/realtek: Fix headset mic for TongFang X6[AF]R5xxY - ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model - drm/mediatek: Fix device/node reference count leaks in mtk_drm_get_all_drm_priv - drm/mediatek: Fix using wrong drm private data to bind mediatek-drm - drm/mediatek: Add crtc path enum for all_drm_priv array - vmxnet3: update MTU after device quiesce - net: dsa: microchip: linearize skb for tail-tagging switches - net: dsa: microchip: update tag_ksz masks for KSZ9477 family - dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status() - ALSA: hda/realtek - Add new HP ZBook laptop with micmute led fixup - ALSA: hda/realtek: Add support for HP Agusta using CS35L41 HDA - iio: pressure: mprls0025pa: use aligned_s64 for timestamp - iio: chemical: pms7003: use aligned_s64 for timestamp - iio: imu: inv_mpu6050: align buffer for timestamp - thermal/drivers/mediatek/lvts: Disable low offset IRQ for minimum threshold - nouveau: fix disabling the nonstall irq due to storm code - cpufreq: intel_pstate: Unchecked MSR aceess in legacy mode - net: pcs: rzn1-miic: Correct MODCTRL register offset - platform/x86/amd/pmc: Add TUXEDO IB Pro Gen10 AMD to spurious 8042 quirks list - drm/amdgpu: drop hw access in non-DC audio fini - wifi: mt76: mt7996: Initialize hdr before passing to skb_put_data() - wifi: mwifiex: Initialize the chan_stats array to zero - tcp_bpf: Fix copied value in tcp_bpf_sendmsg - skmsg: Return copied bytes in sk_msg_memcopy_from_iter - tcp_bpf: Add sk_rmem_alloc related logic for tcp_bpf ingress redirection - Revert "bpf, sockmap: Add sk_rmem_alloc check for sockmap" - ALSA: usb-audio: Add mute TLV for playback volumes on some devices - phy: mscc: Stop taking ts_lock for tx_queue and use its own lock - selftest: net: Fix weird setsockopt() in bind_bhash.c. - net: atm: fix memory leak in atm_register_sysfs when device_register fail - ax25: properly unshare skbs in ax25_kiss_rcv() - mctp: return -ENOPROTOOPT for unknown getsockopt options - net/smc: Remove validation of reserved bits in CLC Decline message - ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init() - net: thunder_bgx: decrement cleanup index before use - net: thunder_bgx: add a missing of_node_put - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() - wifi: libertas: cap SSID len in lbs_associate() - wifi: cw1200: cap SSID length in cw1200_do_join() - net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets - wifi: ath11k: fix group data packet drops during rekey - wifi: ath11k: avoid forward declaration of ath11k_mac_start_vdev_delay() - wifi: ath11k: rename ath11k_start_vdev_delay() - wifi: ath11k: Introduce and use ath11k_sta_to_arsta() - net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() - macsec: read MACSEC_SA_ATTR_PN with nla_get_uint - netlink: add variable-length / auto integers - net: macb: Fix tx_ptr_lock locking - icmp: fix icmp_ndo_send address translation for reply direction - mISDN: Fix memory leak in dsp_hwec_enable() - xirc2ps_cs: fix register access when enabling FullDuplex - netfilter: conntrack: helper: Replace -EEXIST by -EBUSY - wifi: cfg80211: fix use-after-free in cmp_bss() - arm64: dts: imx8mp: Fix missing microSD slot vqmmc on Data Modul i.MX8M Plus eDM SBC - arm64: dts: imx8mp: Fix missing microSD slot vqmmc on DH electronics i.MX8M Plus DHCOM - tee: optee: ffa: fix a typo of "optee_ffa_api_is_compatible" - arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro - Bluetooth: hci_sync: Avoid adding default advertising on startup - cpupower: Fix a bug where the -t option of the set subcommand was not working. - drm/amd/display: Don't warn when missing DCE encoder caps - cdc_ncm: Flag Intel OEM version of Fibocom L850-GL as WWAN - LoongArch: Save LBT before FPU in setup_sigcontext() - btrfs: avoid load/store tearing races when checking if an inode was logged - btrfs: fix race between setting last_dir_index_offset and inode logging - btrfs: fix race between logging inode and checking if it was logged before - bpf: Fix oob access in cgroup local storage - !20556 urma: fix update topo logic - !20639 [OLK-6.6][linux-6.6.y sync] Backport 6.6.103-6.6.104 LTS Patches - !20641 [OLK-6.6][linux-6.6.y sync] LoongArch: Add more instruction opcodes and emit_* helpers - !20560 *** fix CVE-2025-38062 *** - !20662 pNFS: Fix a deadlock when returning a delegation during open() - ub:hisi-ubus: Add create bus instance ummu bypass - Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" - Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set" - HID: mcp2221: Handle reads greater than 60 bytes - HID: mcp2221: Don't set bus speed on every transfer - net/mlx5: SF, Fix add port error handling - drm/nouveau/disp: Always accept linear modifier - smb3 client: fix return code mapping of remap_file_range - net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions - dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted - HID: wacom: Add a new Art Pen 2 - HID: logitech: Add ids for G PRO 2 LIGHTSPEED - HID: quirks: add support for Legion Go dual dinput modes - net: stmmac: Set CIC bit only for TX queues with COE - net: stmmac: xgmac: Correct supported speed modes - net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts - net/mlx5e: Set local Xoff after FW update - net/mlx5e: Update and set Xon/Xoff upon port speed set - net/mlx5e: Update and set Xon/Xoff upon MTU set - net/mlx5: Nack sync reset when SFs are present - net/mlx5: Convert SF port_indices xarray to function_ids xarray - net/mlx5: Use devlink port pointer to get the pointer of container SF struct - net/mlx5: Call mlx5_sf_id_erase() once in mlx5_sf_dealloc() - phy: mscc: Fix when PTP clock is register and unregister - net: dlink: fix multicast stats being counted incorrectly - dt-bindings: display/msm: qcom,mdp5: drop lut clock - drm/nouveau: remove unused memory target test - drm/nouveau: remove unused increment in gm200_flcn_pio_imem_wr - Bluetooth: hci_sync: fix set_local_name race condition - Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced - Bluetooth: hci_event: Mark connection as closed during suspend disconnect - Bluetooth: hci_event: Treat UNKNOWN_CONN_ID on disconnect as success - HID: input: report battery status changes immediately - HID: input: rename hidinput_set_battery_charge_status() - powerpc/kvm: Fix ifdef to remove build warning - drm/msm: Defer fd_install in SUBMIT ioctl - vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() - ACPI: EC: Add device to acpi_ec_no_wakeup[] qurik list - erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC - ASoC: codecs: tx-macro: correct tx_macro_component_drv name - smb: client: fix race with concurrent opens in unlink(2) - scsi: core: sysfs: Correct sysfs attributes access rights - of: dynamic: Fix use after free in of_changeset_add_prop_helper() - of: Add a helper to free property struct - mips: lantiq: xway: sysctrl: rename the etop node - mips: dts: lantiq: danube: add missing burst length property - pinctrl: STMFX: add missing HAS_IOMEM dependency - of: dynamic: Fix memleak when of_pci_add_properties() failed - !20684 urma: adjust urma log format - !20355 udp: Deal with race between UDP socket address change and rehash - !20627 Fixes CVE-2025-38627 - !20702 CVE-2025-39948 - !20701 netfilter: ctnetlink: remove refcounting in expectation dumpers - !20700 CVE-2025-38678 - !20703 CVE-2025-38491 - !20690 tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. - obmm: reduce log noise for successful export/import/preimport - mptcp: avoid deadlock on fallback while reinjecting - mptcp: plug races between subflow fail and subflow creation - mptcp: make fallback action and fallback decision atomic - ice: fix Rx page leak on multi-buffer frames - ice: fix incorrect counter for buffer allocation failures - ice: stop storing XDP verdict within ice_rx_buf - ice: gather page_count()'s of each frag right before XDP prog call - ice: Introduce ice_xdp_buff - netfilter: ctnetlink: remove refcounting in expectation dumpers - netfilter: nf_tables: reject duplicate device on updates - netfilter: nf_tables: Introduce functions freeing nft_hook objects - netfilter: nf_tables: Fix percpu address space issues in nf_tables_api.c - err.h: add ERR_PTR_PCPU(), PTR_ERR_PCPU() and IS_ERR_PCPU() macros - tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. - !20498 Fix CVE-2025-71118 - !20608 pmdomain: arm: scmi: Fix genpd leak on provider registration failure - !20679 x86/CPU/AMD: Add RDSEED fix for Zen5 - !20650 fix cve-2025-40300 - !20661 Input: alps - fix use-after-free bugs caused by dev3_register_work - !20664 backport some net bugfix from 6.6 lts - urma: adjust urma log format - !20678 ub: udma: close debug switch load parameters. - ub: udma: close debug switch load parameters. - x86/CPU/AMD: Add RDSEED fix for Zen5 - !20630 net: LTS-6.6 bugfix backport - !20632 net/sched: sch_qfq: do not free existing class in qfq_change_class() - !20631 macvlan: fix possible UAF in macvlan_forward_source() - !20628 Fix CVE-2025-39910 - !20659 v2 Fix CVE-2025-22090 - !20506 XSched: Update XSched manual - !20647 media: imon: make send_packet() more robust - !20646 ksm: use range-walk function to jump over holes in scan_get_next_rmap_item - !20645 fbcon: Set fb_display[i - !20648 parse_longname(): strrchr() expects NUL-terminated string - !20621 urma: modify log level - !20602 urma: fix the jfe uaf issue that occurred during the killall process. - !20567 urma:change log level and pass status 9 - !20640 iio: common: st_sensors: Fix use of uninitialize device structs - !20634 usb: gadget: udc: fix use-after-free in usb_gadget_state_work - !20633 net: dsa: properly keep track of conduit reference - !20635 fix CVE-2025-68231 - !20651 mm/slub: avoid accessing metadata when pointer is invalid in object_err() - !20649 drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb - !20652 mm/vmalloc: fix data race in show_numa_info() - x86: uaccess: don't use runtime-const rewriting in modules - x86: fix off-by-one in access_ok() - x86: fix user address masking non-canonical speculation issue - x86/uaccess: Zero the 8-byte get_range case on failure on 32-bit - x86/uaccess: Improve the 8-byte getuser() case - x86: fix whitespace in runtime-const assembler output - dcache: keep dentry_hashtable or d_hash_shift even when not used - runtime constants: add x86 architecture support - runtime constants: deal with old decrepit linkers - x86/uaccess: Add missing __force to casts in __access_ok() and valid_user_address() - !20345 arm64: entry: xcall/xint: make asm conditionals compatible with clang IAS - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). - libceph: replace BUG_ON with bounds check for map->max_osd - libceph: prevent potential out-of-bounds writes in handle_auth_session_key() - libceph: fix potential use-after-free in have_mon_and_osd_map() - sctp: Hold sock lock while iterating over address list - sctp: Prevent TOCTOU out-of-bounds write - sctp: Hold RCU read lock while iterating over address list - tipc: Fix use-after-free in tipc_mon_reinit_self(). - sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto - sctp: avoid NULL dereference when chunk data buffer is missing - bpf: Explicitly check accesses to bpf_sock_addr - ipvs: Defer ip_vs_ftp unregister during netns cleanup - nexthop: Forbid FDB status change while nexthop is in a group - netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). - net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer - sctp: initialize more fields in sctp_v6_from_sk() - pNFS: Fix a deadlock when returning a delegation during open() - Input: alps - fix use-after-free bugs caused by dev3_register_work - x86/cpu: Get CPU LLC ID from CPUID 0x8000001d in guest for Hygon processors - kernel/fork: only call untrack_pfn_clear() on VMAs duplicated for fork() - mm: (un)track_pfn_copy() fix + doc improvements - x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range() - !20642 mtdchar: fix integer overflow in read/write ioctls - mm/vmalloc: fix data race in show_numa_info() - mm/slub: avoid accessing metadata when pointer is invalid in object_err() - config: enable CONFIG_MITIGATION_VMESCAPE by default on x86 - x86/vmscape: Enable the mitigation - x86/vmscape: Enumerate VMSCAPE bug - x86/vmscape: Add conditional IBPB mitigation - drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb - parse_longname(): strrchr() expects NUL-terminated string - media: imon: make send_packet() more robust - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item - fbcon: Set fb_display[i]->mode to NULL when the mode is released - !20569 CVE-2024-35808 - mtdchar: fix integer overflow in read/write ioctls - !20619 Fix CVE-2026-22991 - !20612 net: hns3: extend HCLGE_FD_AD_COUNTER_NUM to 8 bits - LoongArch: Add more instruction opcodes and emit_* helpers - iio: common: st_sensors: Fix use of uninitialize device structs - !20581 null_blk: fix kmemleak by releasing references to fault configfs items - mm/mempool: fix poisoning order>0 pages with HIGHMEM - mm/page_poison: replace kmap_atomic() with kmap_local_page() - mm/mempool: replace kmap_atomic() with kmap_local_page() - usb: gadget: udc: fix use-after-free in usb_gadget_state_work - net: dsa: properly keep track of conduit reference - net/sched: sch_qfq: do not free existing class in qfq_change_class() - macvlan: fix possible UAF in macvlan_forward_source() - netfilter: nft_objref: validate objref and objrefmap expressions - arp: do not assume dev_hard_header() does not change skb->head - ip6_gre: make ip6gre_header() robust - netfilter: nf_tables: avoid chain re-validation if possible - netfilter: nf_tables: drop unused 3rd argument from validate callback ops - Revert "netfilter: nft_objref: validate objref and objrefmap expressions" - bpf: Fix reference count leak in bpf_prog_test_run_xdp() - net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset - ethtool: Avoid overflowing userspace buffer on stats query - ipvs: fix ipv4 null-ptr-deref in route error path - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() - !20596 mm/page_alloc: prevent pcp corruption with SMP=n - !20598 team: fix check for port enabled in team_queue_override_port_prio_changed() - !18823 hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio - mm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc() - kasan: avoid sleepable page allocation from atomic context - f2fs: compress: fix UAF of f2fs_inode_info in f2fs_free_dic - f2fs: compress: change the first parameter of page_array_{alloc,free} to sbi - !20583 [OLK-6.6][linux-6.6.y sync] Backport 6.6.102-6.6.103 LTS Patches - !20460 fbdev: Fix vmalloc out-of-bounds write in fast_imageblit - urma:fix log level and pass status 9 - urma: modify log level - !20592 CVE-2025-71141 fixup - !20594 CVE-2025-39744 fixup - !20607 powerpc/64s/slb: Fix SLB multihit issue during SLB preload - !20606 mm/huge_memory: fix NULL pointer deference when splitting folio - !20604 Fix CVE-2026-22984 - !20603 Fix CVE-2026-23021 - !20600 Fix CVE-2026-22990 - urma: fix the jfe uaf issue that occurred during the killall process. - !20380 pswiotlb: Adapt to the IOMMU DMA API upgraded by IOMMUFD - libceph: make free_choose_arg_map() resilient to partial allocation - drm/dp: Change AUX DPCD probe address from LANE0_1_STATUS to TRAINING_PATTERN_SET - net: hns3: extend HCLGE_FD_AD_COUNTER_NUM to 8 bits - net: hns3: extend HCLGE_FD_AD_QID to 11 bits - net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue - net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M - Revert "net: hns3: add support for FD counter" - !20587 dmaengine: stm32: dmamux: fix device leak on route allocation - pmdomain: arm: scmi: Fix genpd leak on provider registration failure - powerpc/64s/slb: Fix SLB multihit issue during SLB preload - mm/huge_memory: fix NULL pointer deference when splitting folio - !20562 LoongArch: BPF: Sign extend kfunc call arguments - !20470 ipv4: Fix reference count leak when using error routes with nexthop objects - !20471 net: sock: fix hardened usercopy panic in sock_recv_errqueue - !20472 net: fix memory leak in skb_segment_list for GRO packets - !20473 ipv4: ip_gre: make ipgre_header() robust - !20469 SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf - !20476 ipv6: Fix use-after-free in inet6_addr_del(). - !20477 svcrdma: bound check rq_pages index in inline path - !20578 ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() - !20579 fix CVE-2025-68768 - !20542 Fix NFS deadlock - USB: storage: Remove subclass and protocol overrides from Novatek quirk - cpuidle: governors: menu: Select polling state in some more cases - cpuidle: governors: menu: Rearrange main loop in menu_select() - cpuidle: menu: Update documentation after previous changes - Revert "drm/tegra: dsi: Clear enable register if powered by bootloader" - parisc: Remove spurious if statement from raw_copy_from_user() - ata: libata-scsi: Fix system suspend for a security locked drive - Revert "drm/amdgpu: fix incorrect vm flags to map bo" - mfd: axp20x: Set explicit ID for regulator cell if no IRQ line is present - drm/amd/display: use udelay rather than fsleep - sched/fair: Revert max_newidle_lb_cost bump - net: ipv4: fix regression in local-broadcast routes - tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers - PM: runtime: Do not clear needs_force_resume with enabled runtime PM - usb: typec: ucsi: psy: Set max current to zero when disconnected - io_uring/rw: cast rw->flags assignment to rwf_t - Documentation: ACPI: i2c-muxes: fix I2C device references - s390/hypfs: Enable limited access during lockdown - s390/hypfs: Avoid unnecessary ioctl registration in debugfs - ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation - net/mlx5e: Preserve shared buffer capacity during headroom updates - net/mlx5: Base ECVF devlink port attrs from 0 - Octeontx2-af: Skip overlap check for SPI field - bonding: send LACPDUs periodically in passive mode after receiving partner's LACPDU - bonding: Add independent control state machine - bonding: update LACP activity flag after setting lacp_active - net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate - ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc - gve: prevent ethtool ops after shutdown - phy: mscc: Fix timestamping for vsc8584 - net: ethernet: mtk_ppe: add RCU lock around dev_fill_forward_path - ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add - net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM - ALSA: usb-audio: Fix size validation in convert_chmap_v3() - mlxsw: spectrum: Forward packets with an IPv4 link-local source IP - Bluetooth: hci_conn: do return error from hci_enhanced_setup_sync() - Bluetooth: hci_event: fix MTU for BN == 0 in CIS Established - scsi: qla4xxx: Prevent a potential error pointer dereference - RDMA/bnxt_re: Fix to initialize the PBL array - RDMA/bnxt_re: Fix to remove workload check in SRQ limit path - RDMA/bnxt_re: Fix to do SRQ armena by default - RDMA/erdma: Fix ignored return value of init_kernel_qp - iosys-map: Fix undefined behavior in iosys_map_clear() - cgroup/cpuset: Use static_branch_enable_cpuslocked() on cpusets_insane_config_key - spi: spi-fsl-lpspi: Clamp too high speed_hz - usb: typec: maxim_contaminant: disable low power mode when reading comparator values - usb: typec: maxim_contaminant: re-enable cc toggle if cc is open and port is clean - iio: imu: inv_icm42600: change invalid data error to -EBUSY - iio: imu: inv_icm42600: Convert to uXX and sXX integer types - iio: imu: inv_icm42600: use = { } instead of memset() - iio: imu: inv_icm42600: switch timestamp type from int64_t __aligned(8) to aligned_s64 - iio: temperature: maxim_thermocouple: use DMA-safe buffer for spi_read() - iio: light: as73211: Ensure buffer holes are zeroed - tls: fix handling of zero-length records on the rx_list - powerpc/boot: Fix build with gcc 15 - mmc: sdhci-pci-gli: GL9763e: Mask the replay timer timeout of AER - compiler: remove __ADDRESSABLE_ASM{_STR,}() again - drm/amd/display: Don't overclock DCE 6 by 15% - usb: dwc3: pci: add support for the Intel Wildcat Lake - usb: dwc3: Ignore late xferNotReady event to prevent halt timeout - USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles - usb: storage: realtek_cr: Use correct byte order for bcs->Residue - USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera - usb: renesas-xhci: Fix External ROM access timeouts - usb: core: hcd: fix accessing unmapped memory in SINGLE_STEP_SET_FEATURE test - comedi: Make insn_rw_emulate_bits() do insn->n samples - usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive - cdx: Fix off-by-one error in cdx_rpmsg_probe() - most: core: Drop device reference after usage in get_channel() - iio: proximity: isl29501: fix buffered read on big-endian systems - iio: pressure: bmp280: Use IS_ERR() in bmp280_common_probe() - fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable() - drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS - cpuidle: governors: menu: Avoid selecting states with too much latency - cpuidle: menu: Remove iowait influence - mmc: sdhci-pci-gli: Add a new function to simplify the code - mmc: sdhci-pci-gli: Use PCI AER definitions, not hard-coded values - mptcp: disable add_addr retransmission when timeout is 0 - mptcp: remove duplicate sk_reset_timer call - use uniform permission checks for all mount propagation changes - arm64: dts: ti: k3-am62-main: Remove eMMC High Speed DDR support - scsi: mpi3mr: Serialize admin queue BAR writes on 32-bit systems - scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers - scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE - PCI: imx6: Add IMX8MM_EP and IMX8MP_EP fixed 256-byte BAR 4 in epc_features - PCI: imx6: Delay link start until configfs 'start' written - PCI: rockchip: Set Target Link Speed to 5.0 GT/s before retraining - PCI: rockchip: Use standard PCIe definitions - drm/amd/display: Fill display clock and vblank time in dce110_fill_display_configs - drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs - drm/amd/display: Fix DP audio DTO1 clock source on DCE 6. - drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3 - ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and EliteBook 830 G6 - mm/debug_vm_pgtable: clear page table entries at destroy_args() - squashfs: fix memory leak in squashfs_fill_super - mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for consistency - memstick: Fix deadlock by moving removing flag earlier - KVM: arm64: Fix kernel BUG() due to bad backport of FPSIMD/SVE/SME fix - sched/fair: Fix frequency selection for non-invariant case - kbuild: userprogs: use correct linker when mixing clang and GNU ld - ata: libata-scsi: Return aborted command when missing sense and result TF - PM: runtime: Take active children into account in pm_runtime_get_if_in_use() - PM: runtime: Simplify pm_runtime_get_if_active() usage - ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig - usb: dwc3: imx8mp: fix device leak at unbind - wifi: mac80211: check basic rates validity in sta_link_apply_parameters - KVM: x86: Take irqfds.lock when adding/deleting IRQ bypass producer - s390/mm: Remove possible false-positive warning in pte_free_defer() - btrfs: send: make fs_path_len() inline and constify its argument - btrfs: send: use fallocate for hole punching with send stream v2 - btrfs: send: avoid path allocation for the current inode when issuing commands - btrfs: send: keep the current inode's path cached - btrfs: send: add and use helper to rename current inode when processing refs - btrfs: send: only use boolean variables at process_recorded_refs() - btrfs: send: factor out common logic when sending xattrs - btrfs: populate otime when logging an inode item - btrfs: constify more pointer parameters - btrfs: fix ssd_spread overallocation - btrfs: open code timespec64 in struct btrfs_inode - xfs: fully decouple XFS_IBULK* flags from XFS_IWALK* flags - btrfs: abort transaction on unexpected eb generation at btrfs_copy_root() - btrfs: always abort transaction on failure to add block group to free space tree - btrfs: move transaction aborts to the error site in add_block_group_free_space() - btrfs: qgroup: fix race between quota disable and quota rescan ioctl - usb: typec: fusb302: cache PD RX state - block: Make REQ_OP_ZONE_FINISH a write operation - block: reject invalid operation in submit_bio_noacct - leds: flash: leds-qcom-flash: Fix registry access after re-bind - leds: flash: leds-qcom-flash: Limit LED current based on thermal condition - selftests/memfd: add test for mapping write-sealed memfd read-only - mm: update memfd seal write check to include F_SEAL_WRITE - mptcp: pm: kernel: flush: do not reset ADD_ADDR limit - mptcp: drop skb if MPTCP skb extension allocation fails - ipv6: sr: Fix MAC comparison to be constant-time - drm/amd/display: Don't overwrite dce60_clk_mgr - drm/amd/display: Add primary plane to commits for correct VRR handling - drm/amdkfd: Destroy KFD debugfs after destroy KFD wq - drm/amdgpu: update mmhub 3.0.1 client id mappings - drm/amdgpu: Avoid extra evict-restore process. - drm/amd: Restore cached power limit during resume - media: venus: venc: Clamp param smaller than 1fps and bigger than 240 - media: venus: vdec: Clamp param smaller than 1fps and bigger than 240. - media: venus: protect against spurious interrupts during probe - media: venus: hfi: explicitly release IRQ during teardown - media: qcom: camss: cleanup media device allocated resource on error path - media: ov2659: Fix memory leaks in ov2659_probe() - media: usbtv: Lock resolution while streaming - media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free() - media: verisilicon: Fix AV1 decoder clock frequency - media: vivid: fix wrong pixel_array control size - media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init() - media: hi556: correct the test pattern configuration - media: gspca: Add bounds checking to firmware parser - parisc: Update comments in make_insert_tlb - parisc: Try to fixup kernel exception in bad_area_nosemaphore path of do_page_fault() - parisc: Rename pte_needs_flush() to pte_needs_cache_flush() in cache.c - parisc: Makefile: explain that 64BIT requires both 32-bit and 64-bit compilers - parisc: Define and use set_pte_at() - parisc: Check region is readable by user in raw_copy_from_user() - soc/tegra: pmc: Ensure power-domains are in a known state - f2fs: fix to avoid out-of-boundary access in dnode page - phy: qcom: phy-qcom-m31: Update IPQ5332 M31 USB phy initialization sequence - vhost/vsock: Avoid allocating arbitrarily-sized SKBs - PCI: endpoint: Fix configfs group removal on driver teardown - PCI: endpoint: Fix configfs group list head handling - mtd: rawnand: renesas: Add missing check after DMA map - mtd: rawnand: fsmc: Add missing check after DMA map - mtd: spinand: propagate spinand_wait() errors from spinand_write_page() - mtd: spi-nor: Fix spi_nor_try_unlock_all() - hwmon: (gsc-hwmon) fix fan pwm setpoint show functions - pwm: mediatek: Fix duty and period setting - pwm: mediatek: Handle hardware enable and clock enable separately - pwm: imx-tpm: Reset counter if CMOD is 0 - wifi: ath11k: fix dest ring-buffer corruption when ring is full - wifi: ath11k: fix source ring-buffer corruption - wifi: ath11k: fix dest ring-buffer corruption - wifi: ath12k: fix dest ring-buffer corruption when ring is full - wifi: ath12k: fix source ring-buffer corruption - wifi: ath12k: fix dest ring-buffer corruption - wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table() - iio: adc: ad_sigma_delta: change to buffer predisable - zynq_fpga: use sgtable-based scatterlist wrappers - scsi: ufs: ufs-pci: Fix default runtime and system PM levels - scsi: ufs: ufs-pci: Fix hibernate state transition for Intel MTL-like host controllers - ata: libata-scsi: Fix ata_to_sense_error() status handling - scsi: mpi3mr: Fix race between config read submit and interrupt completion - dt-bindings: display: sprd,sharkl3-dsi-host: Fix missing clocks constraints - dt-bindings: display: sprd,sharkl3-dpu: Fix missing clocks constraints - arm64: dts: ti: k3-am62-verdin: Enable pull-ups on I2C buses - arm64: dts: ti: k3-am62a7-sk: fix pinmux for main_uart1 - arm64: dts: ti: k3-pinctrl: Enable Schmitt Trigger by default - btrfs: zoned: fix write time activation failure for metadata block group - ext4: fix hole length calculation overflow in non-extent inodes - ext4: don't try to clear the orphan_present feature block device is r/o - ext4: fix reserved gdt blocks handling in fsmap - ext4: fix fsmap end of range reporting with bigalloc - ext4: check fast symlink for ea_inode correctly - tracing: fprobe-event: Sanitize wildcard for fprobe event name - crypto: qat - lower priority for skcipher and aead algorithms - lib/crypto: mips/chacha: Fix clang build and remove unneeded byteswap - vt: defkeymap: Map keycodes above 127 to K_HOLE - vt: keyboard: Don't process Unicode characters in K_OFF mode - bus: mhi: host: Fix endianness of BHI vector table - usb: dwc3: meson-g12a: fix device leaks at unbind - usb: musb: omap2430: fix device leak at unbind - usb: gadget: udc: renesas_usb3: fix device leak at unbind - usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init() - m68k: Fix lost column on framebuffer debug console - platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister() - cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table() - rcu: Fix racy re-initialization of irq_work causing hangs - HID: apple: avoid setting up battery timer for devices without battery - HID: magicmouse: avoid setting up battery timer when not needed - RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages - tools/nolibc: fix spelling of FD_SETBITMASK in FD_* macros - media: uvcvideo: Do not mark valid metadata as invalid - media: venus: Fix OOB read due to missing payload bound check - parisc: Makefile: fix a typo in palo.conf - fbdev: Fix vmalloc out-of-bounds write in fast_imageblit - btrfs: do not allow relocation of partially dropped subvolumes - btrfs: zoned: do not select metadata BG as finish target - btrfs: clear dirty status from extent buffer on error at insert_new_root() - btrfs: zoned: do not remove unwritten non-data block group - btrfs: abort transaction during log replay if walk_log_tree() failed - btrfs: zoned: use filesystem size not disk size for reclaim decision - cdc-acm: fix race between initial clearing halt and open - thunderbolt: Fix copy+paste error in match_service_id() - usb: typec: ucsi: Update power_supply on power role change - misc: rtsx: usb: Ensure mmc child device is active when card is present - iommufd: Report unmapped bytes in the error path of iopt_unmap_iova_range - cifs: reset iface weights when we cannot find a candidate - drm/amdgpu: fix incorrect vm flags to map bo - scsi: lpfc: Remove redundant assignment to avoid memory leak - rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe - pNFS: Handle RPC size limit for layoutcommits - pNFS: Fix disk addr range check in block/scsi layout - pNFS: Fix stripe mapping in block/scsi layout - ASoC: Intel: avs: Fix uninitialized pointer error in probe() - net: phy: smsc: add proper reset flags for LAN8710A - ipmi: Fix strcpy source and destination the same - kconfig: lxdialog: fix 'space' to (de)select options - kconfig: gconf: fix potential memory leak in renderer_edited() - kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed() - ipmi: Use dev_warn_ratelimited() for incorrect message warnings - vfio/mlx5: fix possible overflow in tracking max message size - scsi: aacraid: Stop using PCI_IRQ_AFFINITY - scsi: target: core: Generate correct identifiers for PR OUT transport IDs - scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans - kconfig: nconf: Ensure null termination where strncpy is used - vfio/type1: conditional rescheduling while pinning - kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c - f2fs: check the generic conditions first - exfat: add cluster chain loop check for dir - i2c: Force DLL0945 touchpad i2c freq to 100khz - apparmor: use the condition in AA_BUG_FMT even with debug disabled - dm-table: fix checking for rq stackable devices - dm-mpath: don't print the "loaded" message if registering fails - i3c: master: Initialize ret in i3c_i2c_notifier_call() - i3c: don't fail if GETHDRCAP is unsupported - apparmor: shift ouid when mediating hard links in userns - rtc: ds1307: handle oscillator stop flag (OSF) for ds1341 - i3c: add missing include to internal header - module: Prevent silent truncation of module name in delete_module(2) - md: dm-zoned-target: Initialize return variable r to avoid uninitialized use - soundwire: Move handle_nested_irq outside of sdw_dev_lock - soundwire: amd: serialize amd manager resume sequence during pm_prepare - crypto: octeontx2 - add timeout for load_fvc completion poll - media: uvcvideo: Fix bandwidth issue for Alcor camera - media: usb: hdpvr: disable zero-length read messages - media: tc358743: Increase FIFO trigger level to 374 - media: tc358743: Return an appropriate colorspace from tc358743_set_fmt - media: tc358743: Check I2C succeeded during probe - pinctrl: stm32: Manage irq affinity settings - scsi: mpi3mr: Correctly handle ATA device errors - scsi: mpt3sas: Correctly handle ATA device errors - power: supply: qcom_battmgr: Add lithium-polymer entry - RDMA/core: reduce stack using in nldev_stat_get_doit() - dmaengine: stm32-dma: configure next sg only if there are more than 2 sgs - leds: leds-lp50xx: Handle reg to get correct multi_index - media: v4l2-common: Reduce warnings about missing V4L2_CID_LINK_FREQ control - MIPS: lantiq: falcon: sysctrl: fix request memory check logic - crypto: jitter - fix intermediary handling - watchdog: iTCO_wdt: Report error if timeout configuration fails - MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free} - clk: qcom: ipq5018: keep XO clock always on - hwmon: (emc2305) Set initial PWM minimum value during probe based on thermal state - watchdog: dw_wdt: Fix default timeout - fs/orangefs: use snprintf() instead of sprintf() - phy: rockchip-pcie: Properly disable TEST_WRITE strobe signal - mfd: axp20x: Set explicit ID for AXP313 regulator - clk: tegra: periph: Fix error handling and resolve unsigned compare warning - fbdev: fix potential buffer overflow in do_register_framebuffer() - cifs: Fix calling CIFSFindFirst() for root path without msearch - watchdog: sbsa: Adjust keepalive timeout to avoid MediaTek WS0 race condition - drm/amd/display: Avoid configuring PSR granularity if PSR-SU not supported - drm/amd/display: Only finalize atomic_obj if it was initialized - vhost: fail early when __vhost_add_used() fails - vsock/virtio: Resize receive buffers so that each SKB fits in a 4K page - net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325 - rcu: Fix rcu_read_unlock() deadloop due to IRQ work - drm/amd/display: Avoid trying AUX transactions on disconnected ports - selftests/bpf: Fix a user_ringbuf failure with arm64 64KB page size - bpf: Make reg_not_null() true for CONST_PTR_TO_MAP - uapi: in6: restore visibility of most IPv6 socket options - drm/ttm: Should to return the evict error - drm: renesas: rz-du: mipi_dsi: Add min check for VCLK range - net: ncsi: Fix buffer overflow in fetching version id - ionic: clean dbpage in de-init - wifi: rtlwifi: fix possible skb memory leak in _rtl_pci_init_one_rxdesc() - ptp: Use ratelimite for freerun error message - bpftool: Fix JSON writer resource leak in version command - net: dsa: b53: prevent SWITCH_CTRL access on BCM5325 - net: dsa: b53: prevent DIS_LEARNING access on BCM5325 - net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325 - net: dsa: b53: fix b53_imp_vlan_setup for BCM5325 - gve: Return error for unknown admin queue command - net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs - net: vlan: Make is_vlan_dev() a stub when VLAN is not configured - drm/amd: Allow printing VanGogh OD SCLK levels without setting dpm to manual - dpaa_eth: don't use fixed_phy_change_carrier - wifi: iwlegacy: Check rate_idx range after addition - netmem: fix skb_frag_address_safe with unreadable skbs - powerpc: floppy: Add missing checks after DMA map - wifi: ath12k: Decrement TID on RX peer frag setup error handling - wifi: ath12k: Enable REO queue lookup table feature on QCN9274 hw2.0 - wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`. - wifi: mac80211: update radar_required in channel context after channel switch - drm/amd/display: Fix 'failed to blank crtc!' - wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect - wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd() - wifi: ath12k: Add memset and update default rate value in wmi tx completion - drm/amd/display: Separate set_gsl from set_gsl_source_select - net: fec: allow disable coalescing - net: atlantic: add set_power to fw_ops for atl2 to fix wol - net: thunderbolt: Fix the parameter passing of tb_xdomain_enable_paths()/tb_xdomain_disable_paths() - net: thunderbolt: Enable end-to-end flow control also in transmit - kselftest/arm64: Specify SVE data when testing VL set in sve-ptrace - wifi: mt76: mt7915: mcu: re-init MCU before loading FW patch - wifi: rtw89: Disable deep power saving for USB/SDIO - wifi: rtw89: Fix rtw89_mac_power_switch() for USB - drm/msm: use trylock for debugfs - wifi: mac80211: fix rx link assignment for non-MLO stations - ipv6: mcast: Check inet6_dev->dead under idev->mc_lock in __ipv6_dev_mc_inc(). - (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer - wifi: mac80211: don't complete management TX on SAE commit - sched/fair: Bump sd->max_newidle_lb_cost when newidle balance fails - s390/stp: Remove udelay from stp_sync_clock() - wifi: iwlwifi: mvm: fix scan request validation - um: Re-evaluate thread flags repeatedly - wifi: iwlwifi: mvm: set gtk id also in older FWs - perf/cxlpmu: Remove unintended newline from IRQ name format string - net: phy: micrel: Add ksz9131_resume() - net: thunderx: Fix format-truncation warning in bgx_acpi_match_id() - net: ipv4: fix incorrect MTU in broadcast routes - wifi: cfg80211: Fix interface type validation - net: mctp: Prevent duplicate binds - arm64: Mark kernel as tainted on SAE and SError panic - net/mlx5e: Properly access RCU protected qdisc_sleeping variable - net: ag71xx: Add missing check after DMA map - et131x: Add missing check after DMA map - wifi: rtw89: Lower the timeout in rtw89_fw_read_c2h_reg() for USB - be2net: Use correct byte order and format string for TCP seq and ack_seq - s390/time: Use monotonic clock in get_cycles() - wifi: cfg80211: reject HTC bit for management frames - ktest.pl: Prevent recursion of default variable options - wifi: ath12k: Correct tid cleanup when tid setup fails - net: usb: cdc-ncm: check for filtering capability - xen/netfront: Fix TX response spurious interrupts - Bluetooth: hci_sock: Reset cookie to zero in hci_sock_free_cookie() - powerpc/thp: tracing: Hide hugepage events under CONFIG_PPC_BOOK3S_64 - ASoC: qcom: use drvdata instead of component to keep id - ASoC: codecs: rt5640: Retry DEVICE_ID verification - iio: adc: ad7768-1: Ensure SYNC_IN pulse minimum timing requirement - ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros - ALSA: pcm: Rewrite recalculate_boundary() to avoid costly loop - platform/chrome: cros_ec_typec: Defer probe on missing EC parent - platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches - soc: qcom: mdt_loader: Actually use the e_phoff - imx8m-blk-ctrl: set ISI panic write hurry level - pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop() - usb: core: usb_submit_urb: downgrade type check - usb: typec: intel_pmc_mux: Defer probe if SCU IPC isn't present - ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4 - ASoC: hdac_hdmi: Rate limit logging on connection and disconnection - ALSA: hda: Disable jack polling at shutdown - ALSA: hda: Handle the jack polling always via a work - mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode() - mei: bus: Check for still connected devices in mei_cl_bus_dev_release() - char: misc: Fix improper and inaccurate error code returned by misc_init() - reset: brcmstb: Enable reset drivers for ARCH_BCM2835 - pps: clients: gpio: fix interrupt handling order in remove path - ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path - mmc: sdhci-msm: Ensure SD card power isn't ON when card removed - ACPI: processor: fix acpi_object initialization - PM: sleep: console: Fix the black screen issue - thermal: sysfs: Return ENODATA instead of EAGAIN for reads - PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit() - firmware: tegra: Fix IVC dependency problems - ACPI: PRM: Reduce unnecessary printing to avoid user confusion - selftests: tracing: Use mutex_unlock for testing glob filter - tools/build: Fix s390(x) cross-compilation with clang - gpio: tps65912: check the return value of regmap_update_bits() - iio: adc: ad_sigma_delta: don't overallocate scan buffer - tools/nolibc: define time_t in terms of __kernel_old_time_t - thermal/drivers/qcom-spmi-temp-alarm: Enable stage 2 shutdown when required - ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed - EDAC/synopsys: Clear the ECC counters on init - gpio: wcd934x: check the return value of regmap_update_bits() - remoteproc: imx_rproc: skip clock enable when M-core is managed by the SCU - soc: qcom: rpmh-rsc: Add RSC version 4 support - usb: xhci: Avoid showing errors during surprise removal - usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command - usb: xhci: Avoid showing warnings for dying controller - usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default - selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t - cpufreq: CPPC: Mark driver with NEED_UPDATE_LIMITS flag - platform/x86/amd: pmc: Add Lenovo Yoga 6 13ALC6 to pmc quirk list - usb: xhci: print xhci->xhc_state when queue_command failed - tracefs: Add d_delete to remove negative dentries - securityfs: don't pin dentries twice, once is enough... - fix locking in efi_secret_unlink() - ext2: Handle fiemap on empty files to prevent EINVAL - fs/ntfs3: correctly create symlink for relative path - fs/ntfs3: Add sanity check for file name - better lockdep annotations for simple_recursive_removal() - hfs: fix not erasing deleted b-tree node issue - drbd: add missing kref_get in handle_write_conflicts - udf: Verify partition map count - gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops - nvme-pci: try function level reset on init failure - smb/server: avoid deadlock when linking with ReplaceIfExists - arm64: Handle KCOV __init vs inline mismatches - ptp: prevent possible ABBA deadlock in ptp_clock_freerun() - intel_idle: Allow loading ACPI tables for any family - net: ti: icss-iep: Fix incorrect type for return value in extts_enable() - netfilter: ctnetlink: fix refcount leak on table dump - udp: also consider secpath when evaluating ipsec use for checksumming - KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs - KVM: nVMX: Check vmcs12->guest_ia32_debugctl on nested VM-Enter - KVM: VMX: Extract checking of guest's DEBUGCTL into helper - KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported - KVM: VMX: Handle forced exit due to preemption timer in fastpath - KVM: VMX: Re-enter guest in fastpath for "spurious" preemption timer exits - KVM: x86: Plumb "force_immediate_exit" into kvm_entry() tracepoint - libceph: prevent potential out-of-bounds reads in handle_auth_done() - net: usb: pegasus: fix memory leak in update_eth_regs_async() - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() - !20540 urma: added support for ipoverurma - team: fix check for port enabled in team_queue_override_port_prio_changed() - mm/page_alloc: prevent pcp corruption with SMP=n - !20528 Fix CVE-2025-71083 - KVM: nVMX: Defer SVI update to vmcs01 on EOI when L2 is active w/o VID - KVM: x86: Plumb in the vCPU to kvm_x86_ops.hwapic_isr_update() - KVM: SVM: Set RFLAGS.IF=1 in C code, to get VMRUN out of the STI shadow - smb: client: don't wait for info->send_pending == 0 on error - smb: client: let send_done() cleanup before calling smbd_disconnect_rdma_connection() - ACPI: processor: perflib: Move problematic pr->performance check - ACPI: processor: perflib: Fix initial _PPC limit application - Documentation: ACPI: Fix parent device references - fs: Prevent file descriptor table allocations exceeding INT_MAX - sunvdc: Balance device refcount in vdc_port_mpgroup_check - PCI: Extend isolated function probing to LoongArch - NFSD: detect mismatch of file handle and delegation stateid in OPEN op - net: dpaa: fix device leak when querying time stamp info - net: ti: icss-iep: fix device and OF node leaks at probe - net: mtk_eth_soc: fix device leak at probe - net: enetc: fix device and OF node leak at probe - net: gianfar: fix device leak when querying time stamp info - net: phy: micrel: fix KSZ8081/KSZ8091 cable test - gpio: mlxbf3: use platform_get_irq_optional() - gpio: mlxbf2: use platform_get_irq_optional() - gpio: virtio: Fix config space reading. - ALSA: hda/realtek: Add Framework Laptop 13 (AMD Ryzen AI 300) to quirks - ALSA: hda/realtek: Fix headset mic on HONOR BRB-X - ALSA: usb-audio: Validate UAC3 cluster segment descriptors - rcu: Fix racy re-initialization of irq_work causing hangs - rcu: Fix rcu_read_unlock() deadloop due to IRQ work - drm/tilcdc: Fix removal actions in case of failed probe - drm/tilcdc: request and mapp iomem with devres - urma: fix update topo logic - dmaengine: stm32: dmamux: fix device leak on route allocation - pswiotlb: Adapt to the IOMMU DMA API upgraded by IOMMUFD - null_blk: fix kmemleak by releasing references to fault configfs items - inet: frags: flush pending skbs in fqdir_pre_exit() - inet: frags: add inet_frag_queue_flush() - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() - md/dm-raid: don't clear MD_RECOVERY_FROZEN after setting frozen - md/dm-raid: don't call md_reap_sync_thread() directly - ACPICA: Avoid walking the Namespace if start_node is NULL - arm64: entry: xcall/xint: make asm conditionals compatible with clang IAS - LoongArch: BPF: Sign extend kfunc call arguments - genirq/msi:: Fix kabi break of struct msi_desc - genirq/msi: Store the IOMMU IOVA directly in msi_desc instead of iommu_cookie - NFS: Fix a deadlock involving nfs_release_folio() - Revert "[Huawei] Revert "NFS: fix up nfs_release_folio() to try to release the page"" - urma: added support for ipoverurma - drm/ttm: Avoid NULL pointer deref for evicted BOs - XSched: Update XSched manual - svcrdma: bound check rq_pages index in inline path - ipv6: Fix use-after-free in inet6_addr_del(). - ipv4: ip_gre: make ipgre_header() robust - net: fix memory leak in skb_segment_list for GRO packets - net: sock: fix hardened usercopy panic in sock_recv_errqueue - ipv4: Fix reference count leak when using error routes with nexthop objects - SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf - fbdev: Fix vmalloc out-of-bounds write in fast_imageblit - udp: Deal with race between UDP socket address change and rehash - EDAC/amd64: The width of hash value is 2 bits for Hygon family 18h model 6h processors - x86/tsc: Use topology_max_packages() to get package number - EDAC/amd64: Use unicast instead of broadcast to access the cs_config register - EDAC/amd64: Correct the address translation for hygon family 18h model 4h - KVM: arm64: Mark some header functions as inline - KVM: arm64: Refactor exit handlers - x86/resctrl: Fix memory bandwidth counter width for Hygon CPUs - hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio - !20820 ub/obmm: add sysfs interface for mempool statistics & bugfixes - ub/obmm: fix wrong pxm_numa parameter validation - ub/obmm: Remove unused parameters from obmm_addr_check.c - ub/obmm: Enhance mem_allocator_granu validation - ub/obmm: simplify allocator naming scheme - ub/obmm: fix allow_slow logic and optimize conti_alloc_memory - ub/obmm: add sysfs interface with fine-grained memory statistics - !20804 net: hv_netvsc: reject RSS hash key programming without RX indirection table - !20813 migrate: correct lock ordering for hugetlb file folios - !20812 libceph: make calc_target() set t->paused, not just clear it - !20719 drivers/ub/sentry: some bugfix - !20798 urma: log should not retrieve eid_idx from uctx - !20808 urma: support triple bonding device - urma: log should not retrieve eid_idx from uctx - migrate: correct lock ordering for hugetlb file folios - libceph: make calc_target() set t->paused, not just clear it - !20745 vfio platform VFIO support for hisi05a1 devices - urma: support triple bonding device - net: hv_netvsc: reject RSS hash key programming without RX indirection table - !20789 gic: Add hip09 support for HISILICON_ERRATUM_165010801 - !20726 tracing: Add recursion protection in kernel stack trace recording - !20668 irqchip/gic-v3-its: Avoid truncating memory addresses - !20795 ub: udma: support query and set qos info. - !20791 Migration/urma:optimize performance in live migration. - ub: udma: Support for UE link establishment message. - Migration/urma: optimize performance in live migration. - !20787 ub: cdma: modify the method of assigning values to the structure - !20759 ubcore: hotfix route query for port eid on the same node. - ub: udma: support query and set qos info. - Revert "ub: ubase: Support for RC saved by queue granularity" - ubcore: hotfix route query for port eid on the same node. - !20676 urma: set/get sl - !20765 urma: bugfix of UAF and double free in ubcm - !20778 ub: ubase&unic: Fixes some bugfix in resetting and dfx ability - gic: Add hip09 support for HISILICON_ERRATUM_165010801 - vfio/platform: Add CONFIG_VFIO_HISI05A1 to openeuler_defconfig and turn it on by default - vfio/platform: VFIO support for hisi05a1 devices - ub: cdma: modify the method of assigning values to the structure - urma: set/get sl - ub: ubase: support to query ub dl pkt stats and real-time peak bandwidth - ub: ubase: Support for RC saved by queue granularity - ub: ubase: Traverse mailbox AE events using interrupts and polling. - ub: ubase: Modify ubase ctrlq trace to distinguish between MUE and UE messages - net: unic: The function of dumping himac registers is added. - ub: ubase: Fix MAC is_pfc sync, optimize list ops and code style - ub: ubase: Retain the initial tm qset configuration and restore it - net: unic: Fixed an issue in the bond IP address notification and pause configuration when an exception occurs. - ub: ubase: Add a retransmission function to improve reliability. - net: unic: Increase the readability and reliability of loopback code - net: unic: Synchronize the code modify for ip management and deactivation - net: unic: Increase the readability and reliability of VLAN feature. - net: unic: Added unic DFX log information. - ub: ubase: Add and correct comments for some functions and data structures - net: unic: Notify MAMI when the bond port status changes - ub: ubase: Support for HIMAC reset during ELR reset and Optimize ELR reset - !20768 iommu/ummu-core: Fix separate page table compatibility - !20665 [OLK-6.6] Enhance CMA memory usage reporting for CSV3 - !20764 net: hns3: fix double free issue for tx spare buffer - urma: bugfix of UAF and double free in ubcm - iommu/ummu-core: Fix separate page table compatibility - net: hns3: fix double free issue for tx spare buffer - drivers/ub/sentry: fix memory leak in sentry_msg_helper - drivers/ub/sentry: initialize some variables - drivers/ub/sentry: fix potential buffer overflow in convert_str_to_smh_msg() - drivers/ub/sentry: fix potential null pointer reference in sentry_uvb_comm - drivers/ub/sentry: add input parameter verification for exported symbols - tracing: Add recursion protection in kernel stack trace recording - x86/csv: Enhance CMA memory usage reporting for CSV3 - irqchip/gic-v3-its: Avoid truncating memory addresses - change the package name of 64KB page size kernel to kernel-64k - !20704 kernel support hisi-cca-da - !20180 [virtCCA Live Migration 2]virtcca secure cvm supports live migration - !20905 v2 KVM: arm64: Fix softirq masking in FPSIMD register saving sequence - !20965 iommu/ummu: Optimized TID invalidation and tdev initialization - !20964 iommu/ummu: Support TID and EID Granularity for MPAM - !20970 ub: ubase&unic: Supporting the black box capability of the ubase&unic driver - hisi-cca-da: Start dev by rsi call - hisi-cca-da: Set ripas of the bar region as RIPAS_DEV - hisi-cca-da: Support swiotlb and realm memory use - hisi-cca-da: Add smmu info when dev attach - hisi-cca-da: Transfer realm msix access to rmm - hisi-cca-da: Support pcipc sriov capability - hisi-cca-da: Delay realm memory release to kvm_destroy_realm - hisi-cca-da: Create realm s2 host pgtable and map msi mmio to rmm - hisi-cca-da: Add cca realm s2 pgtable framework - hisi-cca-da: Use bitmap to determine whether the command can be forwarded - hisi-cca-da: Restrict Realm SMMU to stage-2 domain only - hisi-cca-da: Add cmd forward mechanism in realm smmu - hisi-cca-da: Add realm smmu event and gerror irq initialization - hisi-cca-da: Add realm smmu stream table initialization - hisi-cca-da: Add realm smmu cmdq and evtq initialization - hisi-cca-da: Add realm smmu initialization - hisi-cca-da: Add relam iommu support to iommufd - hisi-cca-da: Add realm iommu support for vfio-iommu-type1 - hisi-cca-da: Support dev map and unmap - hisi-cca-da: Support dev validate and dev start - hisi-cca-da: VFIO support ccada - hisi-cca-da: Support dev delegate and dev attach - hisi-cca-da: Support root dev delegate and dev init - hisi-cca-da: Add hisilicon extension smc and ccada cmd - hisi-cca-da: Add hisi ccada feature config - !20751 ARM CCA supports hugepage - !20944 ub: ubmempfd: supports for D2H mapping and demapping - !20888 HiSock Enhancement - ub: ubase&unic: Supporting the black box capability of the ubase&unic driver. - net: unic: Resolve the residual MAC address problem - net: unic: Optimized the code for the cmd structure and FEC function. - ub: ubase: add log for post mailbox timeout - ub: ubus: Remove black box header file to include dir - rme: Remove the secret bit of the vring desc addr - rme: improve hisi-cca data mmap and destroy method - !20943 uvb: fix wd_obtain logic err - !20942 urma: fix bond device id not release - !20892 dcache: Limit the minimal number of bucket to two - rme: isolate page when do delegation to avoid migration - rme: hisi-cca supports different levels for mapping ram - rme: rename ccal to hisi-cca - rme: support set ripas for ccal realm vm - rme: support destroy ram data for ccal realm vm - rme: support populate region for ccal realm vm - rme: support map ram for ccal realm vm - rme: support config ccal realm vm - rme: support ccal RMI calls - rme: realm vm supports wfx handler - !20952 urma: introduce ipourma module - iommu/ummu-core: Simplifies tdev initialization resources - iommu/ummu: Optimized log printing - iommu/ummu: Use passed gfp_mask in map_pages callback - uvb: fix wd_obtain logic err - !20949 ub: udma: support user ctl function. - urma: fix bond device id not release - !20901 drivers/ub/sentry: some bugfix - ub: ubmempfd: supports for D2H mapping and demapping - ub: ubmempfd: supports providing services to the QEMU process through file nodes - [virtCCA Live Migration 2]virtcca secure cvm supports live migration - urma: query priority and enable bit, support ring size configuration - urma: implement debugfs, improve boundary checks and error handling logic - urma: implement data plane interaction and statistics - urma: implement ipourma network device operations - urma: ipourma resource management - urma: ipourma resource management and err code - urma: introduce ipourma main module - iommu/ummu: Optimized the TID invalidation configuration - iommu/ummu: Optimized SVA permission table memory allocation approach - iommu/ummu: Adapt UMMU SVA interface adjustment - iommu/ummu: Support TID and EID Granularity for MPAM - !20848 [OLK-6.6] backport important bugfix for nvme driver from upstream linux-6.6.y - !20847 urma: sl resource query error - !20908 [OLK-6.6][linux-6.6.y sync] Backport 6.6.108-6.6.110 LTS Patches - !20084 Loongarch: Enable CONFIG_CRYPTO_XTS for disk encryption - !20929 PCI: Fix NVMe link speed downgrade to 2.5GT/s during hotplug - drivers/ub/sentry: fix check input parameters - ub: udma: support user ctl function. - ub: udma: support uboe function. - ub: udma: bugfix related to query aux info. - !20935 ub: ubmem_vmmu: supports IOMMU driver for the UB memory MMU in VMs - drivers/ub/sentry: do not use magic numbers - !20876 urma: Kernel-mode specific implementations file for Jetty extension interface - urma: sl resource query error - !20873 sunrpc: fix NULL pointer dereference in rpcb_register_inet6 and rpcb_register_inet4 - !20875 sunrpc: fix race in cache cleanup causing stale nextcheck time - ub: ubmem_vmmu: supports IOMMU driver for the UB memory MMU in VMs - ub: ubmem_vmmu: supports parsing and configuring the hardware node information - ub: ubmem_vmmu: HiSilicon ubmem_vmmu Architecture Implementation - !20806 Fix CVE-2025-71225 - !20896 scsi: qla2xxx: Free sp in error path to fix system crash - !20894 scsi: qla2xxx: Delay module unload while fabric scan in progress - !20893 scsi: qla2xxx: Validate sp before freeing associated memory - !20802 Fix CVE-2026-23110 - urma: Kernel-mode specific implementations file for Jetty extension interface - drivers/ub/sentry: fix memory leak in process_urma_data() - drivers/ub/sentry: initialize some variables - PCI: Fix NVMe link speed downgrade to 2.5GT/s during hotplug - !20770 ub: ubdevshm: supports the memory user to obtain and release shared memory - Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 - mm: consider non-anon swap cache folios in folio_expected_ref_count() - mm: simplify folio_expected_ref_count() - ASoC: qcom: audioreach: fix potential null pointer dereference - gcc-plugins: Remove TODO_verify_il for GCC >= 16 - crypto: sha256 - fix crash at kexec - drm/i915/backlight: Return immediately when scale() finds invalid parameters - minmax.h: remove some #defines that are only expanded once - minmax.h: simplify the variants of clamp() - minmax.h: move all the clamp() definitions after the min/max() ones - minmax.h: use BUILD_BUG_ON_MSG() for the lo < hi test in clamp() - minmax.h: reduce the #define expansion of min(), max() and clamp() - minmax.h: update some comments - minmax.h: add whitespace around operators and after commas - minmax: fix up min3() and max3() too - minmax: improve macro expansion and type checking - minmax: don't use max() in situations that want a C constant expression - minmax: simplify min()/max()/clamp() implementation - minmax: make generic MIN() and MAX() macros available everywhere - drm/ast: Use msleep instead of mdelay for edid read - gpiolib: Extend software-node support to support secondary software-nodes - ARM: bcm: Select ARM_GIC_V3 for ARCH_BRCMSTB - s390/cpum_cf: Fix uninitialized warning after backport of ce971233242b - kmsan: fix out-of-bounds access to shadow memory - afs: Fix potential null pointer dereference in afs_put_server - ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address - i40e: improve VF MAC filters accounting - i40e: add mask to apply valid bits for itr_idx - HID: asus: add support for missing PX series fn keys - drm/gma500: Fix null dereference in hdmi teardown - octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() - net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port - net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() - net: dsa: lantiq_gswip: do also enable or disable cpu port - selftests: fib_nexthops: Fix creation of non-FDB nexthops - net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS - bnxt_en: correct offset handling for IPv6 destination address - vhost: Take a reference on the task in struct vhost_task. - Bluetooth: hci_sync: Fix hci_resume_advertising_sync - ethernet: rvu-af: Remove slash from the driver name - can: peak_usb: fix shift-out-of-bounds issue - can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow - can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow - can: hi311x: populate ndo_change_mtu() to prevent buffer overflow - can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow - bpf: Reject bpf_timer for PREEMPT_RT - can: rcar_can: rcar_can_resume(): fix s2ram with PSCI - wifi: virt_wifi: Fix page fault on connect - cpufreq: Initialize cpufreq-based invariance before subsys - ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients - arm64: dts: imx8mp: Correct thermal sensor index - mm: folio_may_be_lru_cached() unless folio_test_large() - mm/gup: local lru_add_drain() to avoid lru_add_drain_all() - mm/gup: check ref_count instead of lru before migration - mm: add folio_expected_ref_count() for reference count calculation - mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked" - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions - ALSA: usb-audio: Add mute TLV for playback volumes on more devices - ALSA: usb-audio: move mixer_quirks' min_mute into common quirk - ALSA: usb-audio: Add DSD support for Comtrue USB Audio device - i2c: designware: Add quirk for Intel Xe - mmc: sdhci-cadence: add Mobileye eyeQ support - usb: core: Add 0x prefix to quirks debug output - ALSA: usb-audio: Fix build with CONFIG_INPUT=n - ALSA: usb-audio: Convert comma to semicolon - ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 - ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks - ALSA: usb-audio: Simplify NULL comparison in mixer_quirks - ALSA: usb-audio: Avoid multiple assignments in mixer_quirks - ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks - ALSA: usb-audio: Fix block comments in mixer_quirks - firewire: core: fix overlooked update of subsystem ABI version - scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE - !20843 [OLK-6.6][linux-6.6.y sync] Backport 6.6.107-6.6.108 LTS Patches - !20869 ub:hisi-ubus: fix bug of security smatch - !20861 CVE-2026-23163 - ub: ubdevshm: supports the memory user to obtain and release shared memory - ub: ubdevshm: supports granting and revoking shared memory permissions - ub: ubdevshm: supports the registration and deregistration of shared memory segments - ub: ubdevshm: supports the registration and deregistration - KVM: arm64: Fix softirq masking in FPSIMD register saving sequence - !20886 Fix CVE-2026-23205 - !20803 Fix CVE-2026-23112 - !20868 sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure - !20811 smb/server: fix refcount leak in smb2_open() - !20810 smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() - !20809 smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() - sunrpc: fix NULL pointer dereference in rpcb_register_inet6 and rpcb_register_inet4 - sunrpc: fix race in cache cleanup causing stale nextcheck time - scsi: qla2xxx: Free sp in error path to fix system crash - scsi: qla2xxx: Delay module unload while fabric scan in progress - scsi: qla2xxx: Validate sp before freeing associated memory - dcache: Limit the minimal number of bucket to two - !20872 Fix CVE-2026-23220 - !20846 Fix CVE-2026-23193 - !20815 Fix CVE-2026-23216 - !20859 Fix CVE-2026-23179 - !20871 CVE-2026-23096 - !20858 ub: ubase: resolve the cmdq crq overflow problem - bpf: Deprecate hisock unused kfuncs and orig ingress logic - bpf: Add local connect support for hisock - bpf: Add ipv4-mapped ipv6 addr support for hisock - bpf: Add target comm parse to hisock_cmd - bpf: Add multi port parse to hisock_cmd - bpf: Only deploy hisock in server - bpf: Apply BPF_HISOCK_INGRESS to hisock ingress - bpf: Add bpf_handle_ingress/egress_ptype kfunc - bpf: Add bpf_get_skb_ethhdr kfunc - bpf: Add bpf_set_ingress/egress_dev kfunc - bpf: Add bpf_set_ingress_dst kfunc - bpf: Add BPF_HISOCK_INGRESS attach type - cgroup: make cgroup_bpf_prog_attach work when cgroup2 is not mounted - smb: client: fix potential UAF and double free in smb2_open_file() - smb/client: fix memory leak in smb2_open_file() - !20852 ASoC: amd: fix memory leak in acp3x pdm dma ops - ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths - uacce: fix cdev handling in the cleanup path - Revert "uacce: fix for cdev memory leak" - ub:hisi-ubus: fix bug of security smatch - ub:ubus: injected route event - ub:ubus: Black Box Development - !20865 urma: urma support uboe - sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure - urma: urma support uboe - !20857 ub_fwctl driver adds support for querying some functions - ub:ub_fwctl:Add illegal verification for scc - ub:ub_fwctl:Support querying the historical status of port links - drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove - drm/amdkfd: Don't use sw fault filter if retry cam enabled - ub:ub_fwctl:Support querying firmware version numbers - ub: ub_fwctl: Support querying real-time bandwidth statistics - ub:ub_fwctl:Support querying statistical indicators at the ub port and uboe port levels - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() - !20854 [URMA] add ping server for urma_ping - urma: add ping server - ub: ubase: resolve the cmdq crq overflow problem - ub: ubase: Optimized the QoS code naming to improve code readability. - ub: ubase&unic: optimizing code and configuration settings. - net: unic: not support query and configure ip by control plane in UBoE - net: unic: fix the automatically enable uc guid promisc mode. - !20844 urma:kernel header of userctl - urma: Kernel-mode header file for Jetty extension interface - ASoC: amd: fix memory leak in acp3x pdm dma ops - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() - phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again) - ACPICA: Work around bogus -Wstringop-overread warning since GCC 11 - !20835 Fix CVE-2026-23084 - minmax: add a few more MIN_T/MAX_T users - minmax: simplify and clarify min_t()/max_t() implementation - minmax: avoid overly complicated constant expressions in VM code - rtc: pcf2127: fix SPI command byte for PCF2131 backport - xhci: dbc: Fix full DbC transfer ring after several reconnects - xhci: dbc: decouple endpoint allocation from initialization - phy: ti: omap-usb2: fix device leak at unbind - phy: Use device_get_match_data() - drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path - ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message - ASoC: wm8974: Correct PLL rate rounding - ASoC: wm8940: Correct typo in control name - ASoC: wm8940: Correct PLL rate rounding - io_uring: include dying ring in task_work "should cancel" state - io_uring: backport io_should_terminate_tw() - ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx - selftests: mptcp: avoid spurious errors on TCP disconnect - selftests: mptcp: connect: catch IO errors on listen side - rds: ib: Increment i_fastreg_wrs before bailing out - KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active - mmc: mvsdio: Fix dma_unmap_sg() nents value - ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S - ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface - btrfs: tree-checker: fix the incorrect inode ref size check - iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page() - LoongArch: Check the return value when creating kobj - LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled - LoongArch: Update help info of ARCH_STRICT_ALIGN - nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* - octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() - net: liquidio: fix overflow in octeon_init_instr_queue() - bonding: don't set oif to bond dev when getting NS target destination - net/mlx5e: Consider aggregated port speed during rate configuration - i40e: remove redundant memory barrier when cleaning Tx descs - net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure - selftests: mptcp: sockopt: fix error messages - mptcp: tfo: record 'deny join id0' info - mptcp: set remote_deny_join_id0 on SYN recv - dpaa2-switch: fix buffer pool seeding for control traffic - btrfs: fix invalid extref key setup when replaying dentry - pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch - wifi: mac80211: fix incorrect type for ret - wifi: mac80211: increase scan_ies_len for S1G - ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported - !20769 [OLK-6.6][linux-6.6.y sync] Backport 6.6.106-6.6.107 LTS Patches - be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list - !20776 ub:ubfi: Release the chosen node - !20817 CVE-2026-23094 - !20819 dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() - ub:ubus: Add port num check - !20379 [OLK-6.6][sync from OLK-5.10]io_uring: Support forcing sq thread to be idle and woken up by hrtimer - !20830 sched/soft_domain: Increasing NR_MAX_CLUSTER to 32 - sched/soft_domain: Increasing NR_MAX_CLUSTER to 32 - btrfs: fix incorrect readahead expansion length - x86: disable image size check for test builds - drm/i915/power: fix size for for_each_set_bit() in abox iteration - drm/amdgpu: fix a memory leak in fence cleanup when unloading - net: mdiobus: release reset_gpio in mdiobus_unregister_device() - phy: ti-pipe3: fix device leak at unbind - phy: tegra: xusb: fix device and OF node leak at probe - dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate - usb: gadget: midi2: Fix MIDI2 IN EP max packet size - usb: gadget: midi2: Fix missing UMP group attributes initialization - USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels - RISC-V: Remove unnecessary include from compat.h - hrtimer: Rename __hrtimer_hres_active() to hrtimer_hres_active() - hrtimer: Remove unused function - regulator: sy7636a: fix lifecycle of power good gpio - dmaengine: ti: edma: Fix memory allocation size for queue_priority_map - hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr - hsr: use rtnl lock when iterating over ports - net: hsr: Add VLAN CTAG filter support - net: hsr: Add support for MC filtering at the slave device - can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB - can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails - can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed - igb: fix link test skipping when interface is admin down - docs: networking: can: change bcm_msg_head frames member to support flexible array - tunnels: reset the GSO metadata before reusing the skb - net: bridge: Bounce invalid boolopts - net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() - USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions - USB: serial: option: add Telit Cinterion FN990A w/audio compositions - dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks - serial: sc16is7xx: fix bug in flow control levels init - tty: hvc_console: Call hvc_kick in hvc_write unconditionally - Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups" - Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table - Input: iqs7222 - avoid enabling unused interrupts - mm/khugepaged: fix the address passed to notifier on testing young - btrfs: fix corruption reading compressed range when block size is smaller than page size - btrfs: use readahead_expand() on compressed extents - mm/damon/sysfs: fix use-after-free in state_show() - mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing - mtd: nand: raw: atmel: Fix comment in timings preparation - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages - drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time - mm/damon/core: set quota->charged_from to jiffies at first charge window - fuse: prevent overflow in copy_file_range return value - fuse: check if copy_file_range() returns larger than requested size - mtd: rawnand: stm32_fmc2: fix ECC overwrite - mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer - net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups - i2c: i801: Hide Intel Birch Stream SoC TCO WDT - ocfs2: fix recursive semaphore deadlock in fiemap call - mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN - compiler-clang.h: define __SANITIZE_*__ macros only when undefined - EDAC/altera: Delete an inappropriate dma_free_coherent() call - rcu-tasks: Maintain real-time response in rcu_tasks_postscan() - rcu-tasks: Eliminate deadlocks involving do_exit() and RCU tasks - rcu-tasks: Maintain lists to eliminate RCU-tasks/do_exit() deadlocks - s390/cpum_cf: Deny all sampling events by counter PMU - NFSv4/flexfiles: Fix layout merge mirror check. - NFSv4.2: Serialise O_DIRECT i/o and copy range - NFSv4.2: Serialise O_DIRECT i/o and clone range - NFSv4.2: Serialise O_DIRECT i/o and fallocate() - NFS: Serialise O_DIRECT i/o and truncate() - fs/nfs/io: make nfs_start_io_*() killable - ftrace/samples: Fix function size computation - NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server - NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set - media: i2c: imx214: Fix link frequency validation - NFSD: nfsd_unlink() clobbers non-zero status returned from fh_fill_pre_attrs() - nfsd: Fix a regression in nfsd_setattr() - kasan: fix GCC mem-intrinsic prefix with sw tags - kunit: kasan_test: disable fortify string checker on kasan_strings() test - io_uring: fix kabi broken in struct io_ring_ctx - io_uring: Support forcing sq thread to be idle and woken up by hrtimer - dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() - uacce: fix isolate sysfs check condition - Revert "uacce: fix isolate sysfs check condition" - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() - smb/server: fix refcount leak in smb2_open() - smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() - smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() - md: suspend array while updating raid_disks via sysfs - scsi: core: Wake up the error handler when final completions race against each other - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec - ub:ubfi: Release the chosen node - ub:ubus: Delete unused functions - Loongarch: Enable CONFIG_CRYPTO_XTS for disk encryption - Add sw64 support in kernel.spec - !21194 hisi-cca-da: Revert smmu realm enabled condition for arm_smmu_domain_finalise. - !21192 urma: bugfix of ubagg&ubcore&uburma - !21183 platform/x86: classmate-laptop: Add missing NULL pointer checks - urma: bugfix of ubagg&ubcore&uburma - hisi-cca-da: Revert smmu realm enabled condition for arm_smmu_domain_finalise. - platform/x86: classmate-laptop: Add missing NULL pointer checks - !21167 urma: fix kernel codecheck issues. - !21174 urma: change return value for provider err - !21127 urma: copy linked ports when importing bond jetty/seg - !20247 ubcore: query primary eid in ipourma loopback mode. - !21077 Fix hisi cca bugs - ubcore: route query refine and ipo loopback adapt. - hisi-cca-da: Transfer PCIe ECAM access requests to RMM for realm device. - hisi-cca-da: Write NS STE for PF drivers. - hisi-cca-da: Provide IO interfaces - hisi-cca-da: Destroy mmu stage2 pagetable after closing vfio devices - !21045 scsi: hisi_sas: Fix NULL pointer exception when do user_scan() - hisi-cca-da: Automatically unbind PF/VF drivers and prevent probe. - !21165 tools/interference: add ifstool utility for kernel interference statistics - !21166 urma: fix jfce uaf in batch cleanup - !21043 urma: fix tjetty ref in ping server - urma: change return value for provider err - !21128 sched/rt: Skip currently executing CPU in rto_next_cpu() - !21129 procfs: fix missing RCU protection when reading real_parent in do_task_stat() - urma: fix jfce uaf in batch cleanup - !21074 ipmi: Add HiSilicon IPMI Page Soft Offline driver - !21076 [OLK-6.6][linux-6.6.y sync] Backport 6.6.112-6.6.113 LTS Patches - urma: fix kernel codecheck issues. - tools/interference: add ifstool utility for kernel interference statistics - !20291 [Hygon][6.6][Bugfix] Bug fix for EDAC decode address fail issue on Hygon Dhyana processor - !21092 kexec: derive purgatory entry from symbol - !21154 sched: Add SOFT_DOMAIN feature interface for cgroup2 - !21153 fix CVE-2025-39981 - Revert "hisi-cca-da: Delay realm memory release to kvm_destroy_realm" - urma: fix tjetty ref in ping server - rme: Enforce isolation to solve compile error without config CONFIG_HISI_CCA - hisi-cca-da: Improve hisi cca dev validate and delegate - hisi-cca-da: Fix smmu enable rme problem - hisi-cca-da: Fix msi region shared problem - sched: Add SOFT_DOMAIN feature interface for cgroup2 - Bluetooth: MGMT: Fix memory leak in set_ssp_complete - Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete - overflow: Introduce __DEFINE_FLEX for having no initializer - overflow: Fix direct struct member initialization in _DEFINE_FLEX() - overflow: Change DEFINE_FLEX to take __counted_by member - overflow: add DEFINE_FLEX() for on-stack allocs - Bluetooth: MGMT: Fix possible UAFs - Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete() - !21103 Revert "mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()" - !21104 v2 vsock/virtio: cap TX credit to local buffer size - !21070 Fixes CVE-2026-23100 - !21135 RDMA/hns: Support configure and query the CNP DSCP through sysfs - !21088 ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref - RDMA/hns: Support configure and query the CNP DSCP through sysfs - RDMA/hns: Support query FW cap bit - RDMA/hns: Support query HW ID. - !20934 smb/server: fix refcount leak in parse_durable_handle_context() - !21004 regmap: Fix race condition in hwspinlock irqsave routine - !19568 [OLK-6.6]fix txgbe clang compile warning - urma: copy linked ports when importing bond jetty/seg - procfs: fix missing RCU protection when reading real_parent in do_task_stat() - sched/rt: Skip currently executing CPU in rto_next_cpu() - !21073 scsi: qla2xxx: Fix bsg_done() causing double free - !21114 CVE-2024-57979 - !21113 iommu: disable SVA when CONFIG_X86 is set - !20957 dmaengine: xilinx: xdma: Fix regmap max_register - !21087 net: unic: Multiple stability fixes for tx timeout, DFX capability and concurrent activation/reset - pps: Fix a use-after-free - fix kabi - pps: Fix a use-after-free - !21078 of: unittest: Fix memory leak in unittest_data_add() - !21079 *** fix CVE-2026-23208 *** - !21082 ALSA: aloop: Fix racy access at PCM trigger - !21083 bus: fsl-mc: fix use-after-free in driver_override_show() - iommu: disable SVA when CONFIG_X86 is set - vsock/virtio: cap TX credit to local buffer size - Revert "mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()" - !20983 Fix CVE-2026-23139 - !20878 Fix CVE-2026-23230 - kexec: derive purgatory entry from symbol - lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC - PCI/IOV: Fix race between SR-IOV enable/disable and hotplug - Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" - rtc: interface: Alarm race handling should not discard preceding error - perf test stat tests: Fix for virtualized machines - perf test stat: Update test expectations and events - perf test stat: Avoid hybrid assumption when virtualized - writeback: Avoid excessively long inode switching times - writeback: Avoid softlockup when switching many inodes - cramfs: Verify inode mode when loading from disk - fs: Add 'initramfs_options' to set initramfs mount options - minixfs: Verify inode mode when loading from disk - irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume - irqchip/sifive-plic: Make use of __assign_bit() - selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled - s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG - s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL - s390/bpf: Describe the frame using a struct instead of constants - s390/bpf: Centralize frame offset calculations - s390/bpf: Change seen_reg to a mask - ACPI: property: Do not pass NULL handles to acpi_attach_data() - ACPI: property: Add code comments explaining what is going on - ACPI: property: Disregard references in data-only subnode lists - ACPI: battery: Add synchronization between interface updates - ACPI: battery: Check for error code from devm_mutex_init() call - ACPI: battery: initialize mutexes through devm_ APIs - ACPI: battery: allocate driver data through devm_ APIs - arm64: mte: Do not flag the zero page as PG_mte_tagged - ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref - !20790 dm: use bio_clone_blkg_association - ipmi: Add HiSilicon IPMI Page Soft Offline driver - net: unic: Resolve network unavailability caused by concurrent activation and reset - net: unic: Provide the DFX capability for querying MNG table - net: unic: Delete the elr reset process after the tx timeout - bus: fsl-mc: fix use-after-free in driver_override_show() - ALSA: aloop: Fix racy access at PCM trigger - ALSA: usb-audio: Use the right limit for PCM OOB check - ALSA: usb-audio: Prevent excessive number of frames - of: unittest: Fix memory leak in unittest_data_add() - !21034 CVE-2026-23140 - !21016 net: fix segmentation of forwarding fraglist GRO - !21017 mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() - !21018 CVE-2026-23209 - !21019 ipv6: annotate data-race in ndisc_router_discovery() - !20881 ipvlan: Make the addrs_lock be per port - rme: Imporve range delegate - btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() - PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release - PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() - misc: fastrpc: Save actual DMA size in fastrpc_map structure - misc: fastrpc: Add missing dev_err newlines - mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag - mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type - mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value - media: mc: Clear minor number before put device - lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older - ACPICA: Allow to skip Global Lock initialization - ext4: validate ea_ino and size in check_xattrs - ext4: correctly handle queries for metadata mappings - ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() - nfsd: nfserr_jukebox in nlm_fopen should lead to a retry - NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() - mm/damon/vaddr: do not repeat pte_offset_map_lock() until success - mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 - mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations - wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 - wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again - selftests: mptcp: join: validate C-flag + def limit - spi: cadence-quadspi: Flush posted register writes before DAC access - spi: cadence-quadspi: Flush posted register writes before INDAC access - PCI: tegra194: Handle errors in BPMP response - PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() - PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock - PCI: rcar-host: Drop PMSR spinlock - PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit - PCI/AER: Support errors introduced by PCIe r6.0 - PCI/AER: Fix missing uevent on recovery when a reset is requested - PCI/ERR: Fix uevent on failure to recover - PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV - PCI/sysfs: Ensure devices are powered for config reads - PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock - rseq/selftests: Use weak symbol reference, not definition, to link with glibc - rtc: interface: Fix long-standing race when setting alarm - rtc: interface: Ensure alarm irq is enabled when UIE is enabled - memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe - mmc: core: SPI mode remove cmd7 - mtd: rawnand: fsmc: Default to autodetect buswidth - xtensa: simdisk: add input size check in proc_write_simdisk - sparc: fix error handling in scan_one_device() - sparc64: fix hugetlb for sun4u - scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() - sched/deadline: Fix race in push_dl_task() - pwm: berlin: Fix wrong register in suspend/resume - powerpc/pseries/msi: Fix potential underflow and leak issue - powerpc/powernv/pci: Fix underflow and leak issue - power: supply: max77976_charger: fix constant current reporting - pinctrl: samsung: Drop unused S3C24xx driver data - nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk - parisc: don't reference obsolete termio struct for TC* constants - openat2: don't trigger automounts with RESOLVE_NO_XDEV - of: unittest: Fix device reference count leak in of_unittest_pci_node_verify - lib/genalloc: fix device leak in of_gen_pool_get() - KEYS: trusted_tpm1: Compare HMAC values in constant time - iommu/vt-d: PRS isn't usable if PDS isn't supported - iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume - init: handle bootloader identifier in kernel parameters - iio: xilinx-ams: Unmask interrupts after updating alarms - iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK - iio: frequency: adf4350: Fix prescaler usage. - iio: dac: ad5421: use int type to store negative error codes - iio: dac: ad5360: use int type to store negative error codes - fs/ntfs3: Fix a resource leak bug in wnd_extend() - fbdev: Fix logic error in "offb" name match - crypto: rockchip - Fix dma_unmap_sg() nents value - crypto: atmel - Fix dma_unmap_sg() direction - crypto: aspeed - Fix dma_unmap_sg() direction - copy_sighand: Handle architectures where sizeof(unsigned long) < sizeof(u64) - bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() - bus: mhi: ep: Fix chained transfer handling in read path - btrfs: avoid potential out-of-bounds in btrfs_encode_fh() - blk-crypto: fix missing blktrace bio split events - drm/nouveau: fix bad ret code in nouveau_bo_move_prep - drm/rcar-du: dsi: Fix 1/2/3 lane support - media: lirc: Fix error handling in lirc_register() - media: venus: firmware: Use correct reset sequence for IRIS2 - media: pci: ivtv: Add missing check after DMA map - media: mc: Fix MUST_CONNECT handling for pads with no links - media: i2c: mt9v111: fix incorrect type for ret - media: cx18: Add missing check after DMA map - firmware: meson_sm: fix device leak at probe - xen/events: Update virq_to_irq on migration - xen/events: Return -EEXIST for bound VIRQs - xen/manage: Fix suspend error path - xen/events: Cleanup find_virq() return codes - dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required - ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init - arm64: dts: ti: k3-am62a-main: Fix main padcfg length - arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees - arm64: dts: qcom: msm8939: Add missing MDSS reset - arm64: dts: qcom: msm8916: Add missing MDSS reset - ACPI: debug: fix signedness issues in read/write helpers - ACPI: property: Fix buffer properties extraction for subnodes - gpio: wcd934x: mark the GPIO controller as sleeping - tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single - smb: client: fix missing timestamp updates after utime(2) - bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() - drm/amd/display: Properly disable scaling on DCE6 - drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 - drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs - drm/amdgpu: Add additional DCE6 SCL registers - mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes - mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call - tcp: take care of zero tp->window_clamp in tcp_set_rcvlowat() - perf python: split Clang options when invoking Popen - tools build: Align warning options with perf - net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe - drm/vmwgfx: Fix copy-paste typo in validation - net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() - LoongArch: Init acpi_gbl_use_global_lock to false - LoongArch: Remove CONFIG_ACPI_TABLE_UPGRADE in platform_init() - ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size - scsi: mvsas: Fix use-after-free bugs in mvs_work_queue - clk: tegra: do not overallocate memory for bpmp clocks - clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver - clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() - clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() - clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m - perf evsel: Ensure the fallback message is always written to - perf tools: Add fallback for exclude_guest - perf test: Add a test for default perf stat command - perf test: Don't leak workload gopipe in PERF_RECORD_* - perf session: Fix handling when buffer exceeds 2 GiB - perf arm_spe: Correct memory level for remote access - perf arm_spe: Correct setting remote access - rtc: optee: fix memory leak on driver removal - rtc: x1205: Fix Xicor X1205 vendor prefix - perf util: Fix compression checks returning -1 as bool - clk: at91: peripheral: fix return value - libperf event: Ensure tracing data is multiple of 8 sized - perf evsel: Avoid container_of on a NULL leader - asm-generic/io.h: Skip trace helpers if rwmmio events are disabled - iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE - clocksource/drivers/clps711x: Fix resource leaks in error paths - fscontext: do not consume log entries when returning -EMSGSIZE - fs: always return zero on success from replace_fd() - !21067 [OLK-6.6][linux-6.6.y sync] Backport 6.6.111-6.6.112 LTS Patches - scsi: qla2xxx: Fix bsg_done() causing double free - !21065 Fix CVE-2026-23069 - !21062 v4 Support multi-level cgroup - !20987 Fix CVE-2026-23212 - !20982 Fix CVE-2026-23119 - !20979 Fix CVE-2026-23111 - !20974 Fix CVE-2026-23099 - !20973 Fix CVE-2026-23105 - !20972 Fix CVE-2026-23074 - !20884 ksmbd: add chann_lock to protect ksmbd_chann_list xarray - !20947 Fix CVE-2026-23101 - ext4: clear i_state_flags when alloc inode - misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup - Revert "wifi: ath10k: avoid unnecessary wait for service ready message" - fs/ntfs3: fix mount failure for sparse runs in run_unpack() - !20825 efivarfs: fix error propagation in efivar_entry_get() - !20824 io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop - !20950 ub:ubus: protect iterator ue_list and mue_list with ub_bus_sem - mm/rmap: fix two comments related to huge_pmd_unshare() - mm/hugetlb: fix two comments related to huge_pmd_unshare() - mm/hugetlb: fix hugetlb_pmd_shared() - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count - !20728 drivers: Update vendor name of Chengdu NorthLink Technology N5/N6 Series Network Card Drivers - vsock/virtio: fix potential underflow in virtio_transport_get_credit() - !21001 Fix CVE-2026-23229 - usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call - arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode - !20999 Fix CVE-2026-23173 - usb: typec: tipd: Clear interrupts first - bus: fsl-mc: Check return value of platform_get_resource() - remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() - Input: atmel_mxt_ts - allow reset GPIO to sleep - misc: fastrpc: Skip reference for DMA handles - misc: fastrpc: fix possible map leak in fastrpc_put_args - misc: fastrpc: Fix fastrpc_map_lookup operation - nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() - ext4: fix checks for orphan inodes - ksmbd: fix error code overwriting in smb2_get_info_filesystem() - LoongArch: Automatically disable kaslr if boot from kexec_file - mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() - mfd: rz-mtu3: Fix MTU5 NFCR register offset - ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down - ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() - vhost: vringh: Modify the return value check - net/mlx5: fw reset, add reset timeout work - net/mlx5: pagealloc: Fix reclaim race during command interface teardown - net/mlx5: Stop polling for command response if interface goes down - net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable - nfp: fix RSS hash key size when RSS is not supported - mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands - drivers/base/node: fix double free in register_one_node() - hwrng: ks-sa - fix division by zero in ks_sa_rng_init - KEYS: X.509: Fix Basic Constraints CA flag parsing - Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements - Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO - vhost: vringh: Fix copy_to_iter return value check - RDMA/siw: Always report immediate post SQ errors - usb: vhci-hcd: Prevent suspending virtually attached devices - NFSv4.1: fix backchannel max_resp_sz verification check - coresight: trbe: Return NULL pointer for allocation failures - coresight: etm4x: Support atclk - coresight-etm4x: Conditionally access register TRCEXTINSELR - remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice - PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() - vfio/pds: replace bitmap_free with vfree - sparc: fix accurate exception reporting in copy_{from,to}_user for M7 - sparc: fix accurate exception reporting in copy_to_user for Niagara 4 - sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara - sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III - wifi: mac80211: fix Rx packet handling when pubsta information is not available - wifi: ath10k: avoid unnecessary wait for service ready message - Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram - IB/sa: Fix sa_local_svc_timeout_ms read race - RDMA/core: Resolve MAC of next-hop device without ARP support - f2fs: fix zero-sized extent for precache extents - scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() - scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() - scsi: qla2xxx: edif: Fix incorrect sign of error code - ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message - f2fs: fix to truncate first page in error path of f2fs_truncate() - f2fs: fix to update map->m_next_extent correctly in f2fs_map_blocks() - wifi: mt76: fix potential memory leak in mt76_wmac_probe() - RDMA/cm: Rate limit destroy CM ID timeout error message - drivers/base/node: handle error properly in register_one_node() - watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog - ipvs: Use READ_ONCE/WRITE_ONCE for ipvs->enable - iio: consumers: Fix offset handling in iio_convert_raw_to_processed() - iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() - fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist - fs: ntfs3: Fix integer overflow in run_unpack() - drm/msm/dpu: fix incorrect type for ret - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping - ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping - misc: genwqe: Fix incorrect cmd field being reported in error - usb: gadget: configfs: Correctly set use_os_string at bind - usb: phy: twl6030: Fix incorrect type for ret - drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() - tcp: fix __tcp_close() to only send RST when required - PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation - wifi: mwifiex: send world regulatory domain to driver - drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) - drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) - drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) - drm/amd/pm: Adjust si_upload_smc_data register programming (v3) - drm/amd/pm: Fix si_upload_smc_data (v3) - drm/amd/pm: Disable ULV even if unsupported (v3) - drm/amdgpu: Power up UVD 3 for FW validation (v2) - coresight: Only register perf symlink for sinks with alloc_buffer - inet: ping: check sock_net() in ping_get_port() and ping_lookup() - media: st-delta: avoid excessive stack usage - ALSA: lx_core: use int type to store negative error codes - media: rj54n1cb0c: Fix memleak in rj54n1_probe() - scsi: myrs: Fix dma_alloc_coherent() error check - hwrng: nomadik - add ARM_AMBA dependency - crypto: keembay - Add missing check after sg_nents_for_len() - drm/amd/display: Remove redundant semicolons - serial: max310x: Add error checking in probe() - usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls - usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup - phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 - media: zoran: Remove zoran_fh structure - drm/bridge: it6505: select REGMAP_I2C - f2fs: fix condition in __allow_reserved_blocks() - drm/radeon/r600_cs: clean up of dead code in r600_cs - drm/panel: novatek-nt35560: Fix invalid return value - bpf: Enforce expected_attach_type for tailcall compatibility - i2c: designware: Add disabling clocks when probe fails - i2c: designware: Fix clock issue when PM is disabled - i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD - thermal/drivers/qcom/lmh: Add missing IRQ includes - thermal/drivers/qcom: Make LMH select QCOM_SCM - hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems - once: fix race by moving DO_ONCE to separate section - smp: Fix up and expand the smp_call_function_many() kerneldoc - selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported - i3c: master: svc: Recycle unused IBI slot - i3c: master: svc: Use manual response for IBI events - ACPICA: Fix largest possible resource descriptor index - pwm: tiehrpwm: Fix corner case in clock divisor calculation - arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible - arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value - arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names - cpuidle: qcom-spm: fix device and OF node leaks at probe - firmware: firmware: meson-sm: fix compile-test default - arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 - null_blk: Fix the description of the cache_size module argument - pinctrl: renesas: Use int type to store negative error codes - power: supply: cw2015: Fix a alignment coding style issue - PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() - ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property - ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS - ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax - block: use int to store blk_stack_limits() return value - selftests/nolibc: fix EXPECT_NZ macro - regulator: scmi: Use int type to store negative error codes - arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map - ARM: at91: pm: fix MCKx restore routine - pinctrl: meson-gxl: add missing i2c_d pinmux - soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS - leds: flash: leds-qcom-flash: Update torch current clamp setting - ARM: dts: renesas: porter: Fix CAN pin group - libbpf: Fix reuse of DEVMAP - bpf: Remove migrate_disable in kprobe_multi_link_prog_run - bpf/selftests: Fix test_tcpnotify_user - regmap: Remove superfluous check for !config in __regmap_init() - arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 - x86/vdso: Fix output operand size of RDPID - smb: server: fix IRD/ORD negotiation with the client - coresight: trbe: Prevent overflow in PERF_IDX2OFF() - gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote - selftests: arm64: Check fread return value in exec_target - seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast - init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD - filelock: add FL_RECLAIM to show_fl_flags() macro - !21022 KVM: Don't clobber irqfd routing type when deassigning irqfd - !20998 ceph: fix oops due to invalid pointer for kfree() in parse_longname() - !21023 l2tp: avoid one data-race in l2tp_tunnel_del_work() - xsched: fix potential NULL dereference in xsched_quota_timeout_update - xsched: remove the standalone xcu_cfs_cg_deinit() helper - xsched: restructure xcu_cgrp_subsys teardown to align with cpu_cgrp_subsys lifecycle - xsched: simplify root group check by direct comparison with root_xcg - xsched: replace magic number with SCHED_CLASS_MAX_LENGTH for scheduler class string length - xsched/core: immediate cleanup of remaining operators on task exit - xsched: add init_fair_xsched_group() for XCU-specific fair group initialization - xsched: modify xcu_cg_initialize_components helper - xsched: refactor xsched_entity initialization - xsched: change rq_init() parameter from struct xsched_cu to struct xsched_rq - xsched: harden and clarify xcu_move_task() logic - xsched: move throttling-related fields from xsched_group_xcu_priv to xsched_rq_cfs - xsched/quota: add throttled flag to cfs_rq for robust hierarchical enqueue under throttling - xsched/quota: support multi-level cgroup - xsched: remove redundant xcu parameter from dequeue_ctx - xsched: update group shares using xcu_grp_shares_add/sub helpers - xsched: delete unused code - xsched/cfs: propagate group activation/deactivation up the hierarchy - xsched/cfs: move xruntime updates to pick/put paths - xsched: add has_running hook to xsched classes for wake-up eligibility check - !21012 [OLK-6.6][linux-6.6.y sync] Backport 6.6.110-6.6.111 LTS Patches - scsi: hisi_sas: Fix NULL pointer exception when do user_scan() - !21013 CVE-2026-23177 - !21007 bonding: fix use-after-free due to enslave fail after slave array update - !21006 net: Fix CVE-2026-23204 - bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path - bpf, test_run: Subtract size of xdp_frame from allowed metadata size - bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN - bpf: Make variables in bpf_prog_test_run_xdp less confusing - bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K - !21015 libceph: reset sparse-read state in osd_fault() - !21024 ub: udma: bugfix related to print messages. - !20980 Fix CVE-2026-23126 - !20922 Fix CVE-2026-23133 - ub: udma: bugfix related to print messages. - l2tp: avoid one data-race in l2tp_tunnel_del_work() - KVM: Don't clobber irqfd routing type when deassigning irqfd - ipv6: annotate data-race in ndisc_router_discovery() - macvlan: observe an RCU grace period in macvlan_common_newlink() error path - macvlan: fix error recovery in macvlan_common_newlink() - mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() - net: fix segmentation of forwarding fraglist GRO - can: rcar_canfd: Fix CAN-FD mode as default - libceph: reset sparse-read state in osd_fault() - !21008 uvb: fix cis call return value and obtain - mm, shmem: prevent infinite loop on truncate race - mm/shmem, swap: fix race of truncate and swap entry split - net/9p: fix double req put in p9_fd_cancelled - riscv: mm: Do not restrict mmap address based on hint - riscv: mm: Use hint address in mmap if available - driver core/PM: Set power.no_callbacks along with power.no_pm - serial: stm32: allow selecting console when the driver is module - hid: fix I2C read buffer overflow in raw_event() for mcp2221 - ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free - ALSA: usb-audio: Kill timer properly at removal - platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list - can: rcar_canfd: Fix controller mode setting - can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled - btrfs: ref-verify: handle damaged extent root tree - ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue - perf subcmd: avoid crash in exclude_cmds when excludes is empty - platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list - dm-integrity: limit MAX_TAG_SIZE to 255 - ASoC: amd: acp: Adjust pdm gain value - wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 - USB: serial: option: add SIMCom 8230C compositions - media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe - !20931 Fix CVE-2026-23060 - uvb: fix cis call return value and obtain - bonding: fix use-after-free due to enslave fail after slave array update - net/sched: cls_u32: use skb_header_pointer_careful() - net: add skb_header_pointer_careful() helper - regmap: Fix race condition in hwspinlock irqsave routine - crypto: virtio - Add spinlock protection with virtqueue notification - net/mlx5e: TC, delete flows only for existing peers - !20967 net: hns3: modify code of judging if SMMU DMA is enabled - ceph: fix oops due to invalid pointer for kfree() in parse_longname() - !20969 Fix CVE-2026-23125 - !20948 v4 arm64: Add memory poison recovery support for various paths - !20975 CVE-2026-23102 - !20977 v4 support apei_page_offline_policy - bonding: annotate data-races around slave->last_rx - netfilter: nf_conncount: update last_gc only when GC has been performed - bonding: provide a net pointer to __skb_flow_dissect() - netdevsim: fix a race issue related to the operation on bpf_bound_progs list - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() - apei/ghes: Add sysctl interface to control soft-offline page isolation - Revert "mm/memory-failure: support disabling soft offline for HugeTLB pages" - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - arm64/fpsimd: signal: Fix restoration of SVE context - arm64/fpsimd: signal: Consistently read FPSIMD context - arm64/fpsimd: signal: Mandate SVE payload for streaming-mode state - bonding: limit BOND_MODE_8023AD to Ethernet devices - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag - net/sched: Enforce that teql can only be used as root qdisc - sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT - drivers/net: Update vendor name of Chengdu NorthLink Technology N5/N6 Series Network Card Drivers - net: hns3: modify code of judging if SMMU DMA is enabled - dmaengine: xilinx: xdma: Fix regmap max_register - ub:ubus: protect iterator ue_list and mue_list with ub_bus_sem - ub:ubus: Avoid getting empty uent from ubc - ub:hisi-ubus: Use GFP_ATOMIC when alloc memory - arm64: send sig fault for user task when apei_claim_sea fails - arm64: add ras log during do_sea - arm64: move getting valid siaddr to the top of do_sea - arm64: mm: shmem: support poison recovery from shmem_file_read_iter() - arm64: fs: support poison recovery from __kernel_read() - iov_iter: add mc support for copy_page_to_iter - arm64: mm: support recovery from copy_{from/to}_user_page() - iov_iter: get rid of 'copy_mc' flag - leds: led-class: Only Add LED to leds_list when it is fully ready - wifi: ath10k: fix dma_free_coherent() pointer - smb/server: fix refcount leak in parse_durable_handle_context() - ksmbd: add chann_lock to protect ksmbd_chann_list xarray - ipvlan: Make the addrs_lock be per port - smb: client: split cached_fid bitfields to avoid shared-byte RMW races - efivarfs: fix error propagation in efivar_entry_get() - io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop - dm: use bio_clone_blkg_association - RAS/AMD/ATL: fix error nodes per socket on for Hygon Dhyana processor - net: txgbe: fix clang compile warning - !20552 ub: udma: fix some code issues. - !20313 Fix CVE-2025-40220 - !20321 nvme: fix admin request_queue lifetime - !20512 PM / devfreq: hisi: Fix potential UAF in OPP handling - !20544 Fix CVE-2025-71147 - !20548 v4 net: LTS-6.6 backport - !20503 Fix CVE-2025-39713 - !20133 Fix CVE-2025-39721 - !20438 Fix CVE-2025-38659 - !20264 Fix CVE-2025-40277 - !20340 Fix CVE-2025-40271 - !20319 Fix CVE-2025-40237 - !20392 vfs: Don't leak disconnected dentries on umount - !20554 iommu/s390: Implement blocking domain - !20489 [OLK-6.6][linux-6.6.y sync] Backport 6.6.101-6.6.102 LTS Patches - !20513 ACPI: PCC: Fix race condition by removing static qualifier - !20468 drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer - !20483 rcu: Protect ->defer_qs_iw_pending from data race - !20510 drivers/ub/sentry: fix primary eid index value - !20553 ub: cdma: support separated page table feature - ub: udma: fix some code issues. - !20480 iommu/ummu-core: fix error invalidate tid - !20561 iommu/ummu: Add ummu sva independent page table parameter - ub: udma: bugfix related to 2m_hugepage. - ub: udma: support for separate page tables - ub: udma: delete debugfs code. - ub: udma: bugfix related to ctrlq function. - ub: udma: verify get cqe/ae aux info out addr and len. - ub: cdma: support separated page table feature - iommu/ummu: Add ummu sva independent page table parameter - iommu: Adjust PLB refresh timing in 'grant' and 'ungrant' - !20505 Fix CVE-2026-23035 - iommu/s390: Implement blocking domain - drivers/ub/sentry: fix primary eid index value - !20535 libceph: make decode_pool() more resilient against corrupted osdmaps - !20536 mm/page_alloc: change all pageblocks migrate type on coalescing - !20537 mm/secretmem: fix use-after-free race in fault handler - !20538 wifi: avoid kernel-infoleak from struct iw_point - !20539 net: usb: rtl8150: fix memory leak on usb_submit_urb() failure - !20440 PCI/AER: Fix NULL pointer access by aer_info - !20262 Fix CVE-2025-68176 - netfilter: nf_reject: don't leak dst refcount for loopback packets - net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error - page_pool: always add GFP_NOWARN for ATOMIC allocations - virtio-net: fix received length check in big packets - net: bridge: fix use-after-free due to MST port state bypass - vsock: Ignore signal/timeout on connect() if already established - tls: make sure to abort the stream if headers are bogus - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI - xfrm: Duplicate SPI Handling - tls: handle data disappearing from under the TLS ULP - net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing - bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls - Bluetooth: hci_core: Fix use-after-free in vhci_flush() - KEYS: trusted: Fix a memory leak in tpm2_load_cmd - !20237 Fix CVE-2025-68724 - !20459 Fix CVE-2025-71131 - !20525 Fix CVE-2025-68816 - !20529 CVE-2025-68172 - net: usb: rtl8150: fix memory leak on usb_submit_urb() failure - !20370 Revert "Revert "RDMA/hns: Fix mismatch exception rollback"" - wifi: avoid kernel-infoleak from struct iw_point - mm/secretmem: fix use-after-free race in fault handler - mm/page_alloc: change all pageblocks migrate type on coalescing - libceph: make decode_pool() more resilient against corrupted osdmaps - pps: Fix kabi breakage of struct pps_device for last_fetched_ev - sched: Fix kabi breakage of struct task_struct for saved_state - crypto: aspeed - fix double free caused by devm - !20515 Bluetooth: bcsp: receive data only if registered - !20507 Fix CVE-2025-40358 - !20450 ub: ubase&unic: Fix some bug in concurrent process - !20452 iommu/ummu: Fix some bugs and optimize the code implementation - !20451 iommu/ummu: Add the function of creating devices with SVA-separated - !20500 mm: fix the inaccurate memory statistics issue for users - net/mlx5: fw_tracer, Validate format string parameters - Bluetooth: bcsp: receive data only if registered - ACPI: PCC: Fix race condition by removing static qualifier - ACPI: CPPC: Fix missing PCC check for guaranteed_perf - iommu/ummu: Add the function of creating devices with SVA-separated - iommu/ummu-core: fix error invalidate tid - riscv: stacktrace: Disable KASAN checks for non-current tasks - !20497 arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() - !20496 drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies - !20495 iommu/amd: Avoid stack buffer overflow from kernel cmdline - !20494 HID: core: Harden s32ton() against conversion to 0 bits - !20493 iommu: Fix two issues in iommu_copy_struct_from_user() - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv - PM / devfreq: hisi: Fix potential UAF in OPP handling - media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() - !20487 interference: Fix uninitialized ifs_clock compiling issue - MIPS: mm: kmalloc tlb_vpn array to avoid stack overflow - MIPS: mm: Prevent a TLB shutdown on initial uniquification - mm: fix the inaccurate memory statistics issue for users - mm: add config option for atomic mode in mm counter - Revert "mm: fix the inaccurate memory statistics issue for users" - !20444 net/mlx5e: Fix crash on profile change rollback failure - !20442 net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv - arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() - drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies - iommu/amd: Avoid stack buffer overflow from kernel cmdline - HID: core: Harden s32ton() against conversion to 0 bits - iommu: Fix two issues in iommu_copy_struct_from_user() - SUNRPC: call xs_sock_process_cmsg for all cmsg - flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read - !20374 [OLK 6.6]Use Hygon IBRS and IBPB rather than software-based mitigation to mitigate Retbleed and SRSO. - !20227 Rename leapioraid to leapraid and release v2.0 - mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery - MIPS: mm: tlb-r4k: Uniquify TLB entries on init - x86/fpu: Delay instruction pointer fixup until after warning - ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx() - ALSA: intel_hdmi: Fix off-by-one error in __hdmi_lpe_audio_probe() - x86/sev: Evict cache lines during SNP memory validation - net: usbnet: Fix the wrong netif_carrier_on() call - net: usbnet: Avoid potential RCU stall on LINK_CHANGE event - Bluetooth: btusb: Add USB ID 3625:010b for TP-LINK Archer TX10UB Nano - sched,freezer: Remove unnecessary warning in __thaw_task - freezer,sched: Clean saved_state when restoring it during thaw - freezer,sched: Do not restore saved_state of a thawed task - freezer,sched: Use saved_state to reduce some spurious wakeups - sched/core: Remove ifdeffery for saved_state - i2c: stm32f7: unmap DMA mapped buffer - i2c: stm32f7: simplify status messages in case of errors - i2c: stm32f7: perform most of irq job in threaded handler - i2c: stm32f7: use dev_err_probe upon calls of devm_request_irq - i2c: stm32f7: Use devm_clk_get_enabled() - USB: serial: option: add Foxconn T99W709 - smb: server: Fix extension string in ksmbd_extract_shortname() - ksmbd: fix corrupted mtime and ctime in smb2_open - ksmbd: fix Preauh_HashValue race condition - ksmbd: fix null pointer dereference error in generate_encryptionkey - vsock: Do not allow binding to VMADDR_PORT_ANY - selftests/perf_events: Add a mmap() correctness test - smb: client: return an error if rdma_connect does not return within 5 seconds - smb: client: let recv_done() cleanup before notifying the callers. - smb: client: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already - smb: client: make use of common smbdirect_socket - smb: smbdirect: add smbdirect_socket.h - smb: client: Correct typos in multiple comments across various files - smb: client: Use min() macro - smb: server: let recv_done() avoid touching data_transfer after cleanup/move - smb: server: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already - ALSA: hda/ca0132: Fix missing error handling in ca0132_alt_select_out() - irqchip: Build IMX_MU_MSI only on ARM - net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing - sunrpc: fix client side handling of tls alerts - net/sched: taprio: enforce minimum value for picos_per_byte - net: drop UFO packets in udp_rcv_segment() - ipv6: reject malicious packets in ipv6_gso_segment() - net/mlx5: Correctly set gso_segs when LRO is used - netlink: specs: ethtool: fix module EEPROM input/output arguments - net: ipa: add IPA v5.1 and v5.5 to ipa_version_string() - phy: mscc: Fix parsing of unicast frames - netpoll: prevent hanging NAPI when netcons gets enabled - md/md-cluster: handle REMOVE message earlier - NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY - NFS: Fix wakeup of __nfs_lookup_revalidate() in unblock_revalidate() - sched: Add test_and_clear_wake_up_bit() and atomic_dec_and_wake_up() - pNFS/flexfiles: don't attempt pnfs on fatal DS errors - PCI: pnv_php: Fix surprise plug detection and recovery - powerpc/eeh: Export eeh_unfreeze_pe() - PCI: pnv_php: Work around switches with broken presence detection - kconfig: qconf: fix ConfigList::updateListAllforAll() - scsi: sd: Make sd shutdown issue START STOP UNIT appropriately - scsi: ufs: core: Use link recovery when h8 exit fails during runtime resume - scsi: Revert "scsi: iscsi: Fix HW conn removal use after free" - scsi: mpt3sas: Fix a fw_event memory leak - vfio/pci: Separate SR-IOV VF dev_set - vfio/pds: Fix missing detach_ioas op - vfio: Prevent open_count decrement to negative - vfio: Fix unbalanced vfio_df_close call in no-iommu mode - f2fs: fix to calculate dirty data during has_not_enough_free_secs() - f2fs: fix to update upper_p in __get_secs_required() correctly - f2fs: vm_unmap_ram() may be called from an invalid context - f2fs: fix to avoid out-of-boundary access in devs.path - f2fs: doc: fix wrong quota mount option description - f2fs: fix KMSAN uninit-value in extent_info usage - rtc: rv3028: fix incorrect maximum clock rate handling - rtc: pcf8563: fix incorrect maximum clock rate handling - rtc: pcf85063: fix incorrect maximum clock rate handling - rtc: nct3018y: fix incorrect maximum clock rate handling - rtc: hym8563: fix incorrect maximum clock rate handling - rtc: ds1307: fix incorrect maximum clock rate handling - ucount: fix atomic_long_inc_below() argument type - module: Restore the moduleparam prefix length check - apparmor: fix loop detection used in conflicting attachment resolution - apparmor: ensure WB_HISTORY_SIZE value is a power of 2 - bpf: Check netfilter ctx accesses are aligned - bpf: Check flow_dissector ctx accesses are aligned - vhost-scsi: Fix log flooding with target does not exist errors - mtd: rawnand: atmel: set pmecc data setup time - mtd: rawnand: rockchip: Add missing check after DMA map - mtd: rawnand: atmel: Fix dma_mapping_error() address - jfs: fix metapage reference count leak in dbAllocCtl - crypto: qat - fix seq_file position update in adf_ring_next() - crypto: qat - fix DMA direction for compression on GEN2 devices - perf tools: Remove libtraceevent in .gitignore - sh: Do not use hyphen in exported variable name - ASoC: fsl_xcvr: get channel status data when PHY is not exists - dmaengine: nbpfaxi: Add missing check after DMA map - dmaengine: mv_xor: Fix missing check after DMA map and missing unmap - fs/orangefs: Allow 2 more characters in do_c_string() - PCI: endpoint: pci-epf-vntb: Fix the incorrect usage of __iomem attribute - soundwire: stream: restore params when prepare ports fail - crypto: img-hash - Fix dma_unmap_sg() nents value - crypto: keembay - Fix dma_unmap_sg() nents value - hwrng: mtk - handle devm_pm_runtime_enable errors - watchdog: ziirave_wdt: check record length in ziirave_firm_verify() - scsi: isci: Fix dma_unmap_sg() nents value - scsi: mvsas: Fix dma_unmap_sg() nents value - scsi: elx: efct: Fix dma_unmap_sg() nents value - scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value - clk: sunxi-ng: v3s: Fix de clock definition - perf tests bp_account: Fix leaked file descriptor - kernel: trace: preemptirq_delay_test: use offstack cpu mask - crypto: inside-secure - Fix `dma_unmap_sg()` nents value - perf sched: Fix memory leaks in 'perf sched latency' - perf sched: Fix memory leaks for evsel->priv in timehist - perf sched: Free thread->priv using priv_destructor - perf dso: Add missed dso__put to dso__load_kcore - perf tools: Fix use-after-free in help_unknown_cmd() - Fix dma_unmap_sg() nents value - clk: clk-axi-clkgen: fix fpfd_max frequency for zynq - fanotify: sanitize handle_type values when reporting fid - pinctrl: sunxi: Fix memory leak on krealloc failure - PCI: endpoint: pci-epf-vntb: Return -ENOENT if pci_epc_get_next_free_bar() fails - crypto: arm/aes-neonbs - work around gcc-15 warning - power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set - power: supply: cpcap-charger: Fix null check for power_supply_get_by_name - clk: xilinx: vcu: unregister pll_post only if registered correctly - media: v4l2-ctrls: Fix H264 SEPARATE_COLOUR_PLANE check - mtd: fix possible integer overflow in erase_xfer() - crypto: marvell/cesa - Fix engine load inaccuracy - crypto: qat - use unmanaged allocation for dc_data - crypto: sun8i-ce - fix nents passed to dma_unmap_sg() - PCI: rockchip-host: Fix "Unexpected Completion" log message - bpf/preload: Don't select USERMODE_DRIVER - ipv6: annotate data-races around rt->fib6_nsiblings - ipv6: fix possible infinite loop in fib6_info_uses_dev() - vrf: Drop existing dst reference in vrf_ip6_input_dst - selftests: rtnetlink.sh: remove esp4_offload after test - net/mlx5e: Clear Read-Only port buffer size in PBMC before update - netfilter: xt_nfacct: don't assume acct name is null-terminated - can: kvaser_usb: Assign netdev.dev_port based on device channel index - can: kvaser_pciefd: Store device channel index - can: peak_usb: fix USB FD devices potential malfunction - tools/rv: Do not skip idle in trace - Bluetooth: hci_event: Mask data status from LE ext adv reports - kcsan: test: Initialize dummy variable - wifi: mac80211: Write cnt before copying in ieee80211_copy_rnr_beacon() - wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE - wifi: ath12k: fix endianness handling while accessing wmi service bit - wifi: mac80211: Check 802.11 encaps offloading in ieee80211_tx_h_select_key() - wifi: mac80211: Don't call fq_flow_idx() for management frames - wifi: mac80211: Do not schedule stopped TXQs - wifi: plfxlc: Fix error handling in usb driver probe - wifi: mac80211: reject TDLS operations when station is not associated - iommu/amd: Fix geometry.aperture_end for V2 tables - mwl8k: Add missing check after DMA map - wifi: rtl8xxxu: Fix RX skb size for aggregation disabled - tcp: call tcp_measure_rcv_mss() for ooo packets - xen/gntdev: remove struct gntdev_copy_batch from stack - net_sched: act_ctinfo: use atomic64_t for three counters - net/sched: Restrict conditions for adding duplicating netems to qdisc tree - um: rtc: Avoid shadowing err in uml_rtc_start() - arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX - netfilter: nf_tables: adjust lockdep assertions handling - netfilter: nf_tables: Drop dead code from fill_*_info routines - fbcon: Fix outdated registered_fb reference in comment - drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value - m68k: Don't unregister boot console needlessly - drm/msm/dpu: Fill in min_prefill_lines for SC8180X - kselftest/arm64: Fix check for setting new VLs in sve-ptrace - net: dst: annotate data-races around dst->input - tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range - wifi: ath11k: clear initialized flag for deinit-ed srng lists - iwlwifi: Add missing check for alloc_ordered_workqueue - wifi: iwlwifi: Fix memory leak in iwl_mvm_init() - wifi: rtl818x: Kill URBs before clearing tx status queue - wifi: rtw89: avoid NULL dereference when RX problematic packet on unsupported 6 GHz band - caif: reduce stack size, again - bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure - drm/vmwgfx: Fix Host-Backed userspace on Guest-Backed kernel - net: ipv6: ip6mr: Fix in/out netdev to pass to the FORWARD chain - selftests/bpf: fix signedness bug in redir_partial() - bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls - bpf, sockmap: Fix psock incorrectly pointing to sk - drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed - staging: nvec: Fix incorrect null termination of battery manufacturer - interconnect: qcom: sc8180x: specify num_nodes - interconnect: qcom: sc8280xp: specify num_links for qnm_a1noc_cfg - soc: qcom: pmic_glink: fix OF node leak - samples: mei: Fix building on musl libc - cpufreq: Initialize cpufreq-based frequency-invariance later - cpufreq: intel_pstate: Always use HWP_DESIRED_PERF in passive mode - arm64: dts: imx8mn-beacon: Fix HS400 USDHC clock speed - arm64: dts: imx8mm-beacon: Fix HS400 USDHC clock speed - ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface - soc/tegra: cbb: Clear ERR_FORCE register with ERR_STATUS - arm: dts: ti: omap: Fixup pinheader typo - usb: early: xhci-dbc: Fix early_ioremap leak - powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw() - pps: fix poll support - staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() - spi: stm32: Check for cfg availability in stm32_spi_probe - usb: misc: apple-mfi-fastcharge: Make power supply names unique - usb: host: xhci-plat: fix incorrect type for of_match variable in xhci_plat_probe() - ARM: dts: vfxxx: Correctly use two tuples for timer address - arm64: dts: qcom: msm8976: Make blsp_dma controlled-remotely - arm64: dts: qcom: sc7180: Expand IMEM region - arm64: dts: qcom: sdm845: Expand IMEM region - soc: qcom: QMI encoding/decoding for big endian - selftests: Fix errno checking in syscall_user_dispatch test - ASoC: mediatek: use reserved memory or enable buffer pre-allocation - gfs2: No more self recovery - Revert "fs/ntfs3: Replace inode_trylock with inode_lock" - hfs: make splice write available again - hfsplus: make splice write available again - ublk: use vmalloc for ublk_device's __queues - fs_context: fix parameter name in infofc() macro - audit,module: restore audit logging in load failure case - ASoC: amd: yc: add DMI quirk for ASUS M6501RM - ASoC: Intel: fix SND_SOC_SOF dependencies - ASoC: amd: yc: Add DMI entries to support HP 15-fb1xxx - ethernet: intel: fix building with large NR_CPUS - ASoC: amd: yc: Add DMI quirk for HP Laptop 17 cp-2033dx - interference: Fix uninitialized ifs_clock compiling issue - iommu/ummu: optimize log printing - !20455 Fix compilation failure caused by PR#20174 - !20302 CVE-2026-22980 - !20142 CVE-2025-68803 - !20261 ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency - !20435 fix CVE-2026-22998 - !20433 scsi: target: Reset t_task_cdb pointer in error case - !20432 scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" - !20431 block: Use RCU in blk_mq_[un - !20307 tpm: Cap the number of PCR banks - !20062 xfs: Add xfs_dir3_leaf_header_check() in leaf/leafn read - !20157 v2 md: backport from mainline - rcu: Protect ->defer_qs_iw_pending from data race - platform/x86/intel/pmt: fix compilation failure caused by PR#20174 - iommu/ummu: optimize kv cache memory management - iommu/ummu: optimize permission table management - iommu/ummu: remove check for eid_type while del eid - iommu/ummu: optimize the code implementation - drivers/perf: fix ummu-pmu data reading exception - iommu/ummu: IOMMU_DOMAIN_BLOCKED type don not sync tct - drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer - crypto: seqiv - Do not use req->iv after crypto_aead_encrypt - net: unic: Notify mami of the bond ip change. - ub: ubase: Support for UE link by ctrlq message - ub: ubase: send a deactivate req in removing - ub: ubase: Querying TPG/TP contexts in the chip is no longer supported after enabling safe mode. - ub: ubase: Use an independent thread for the ctrlq workqueue. - !20368 ubcore: fix logging and permission for route query. - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id - !20344 ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr - net: unic: Fix the ummu 0xa event that occurs when modifying queues and resetting concurrent scenarios - ub: ubase: Add KABI compatibility - ub: ubase: fixing the issue of cdma ctp_req_vl parameter configuration - ub: ubase: add PMU IDEV interrupt supported abilities. - ub: ubase: Delete the tid mask for eq, jfs, jfr, and jfc context - ub: ubase: Set the completion event interrupt to auto - net: unic: fix poll tx read old skb cause a UAF bug - !20249 Fix CVE-2025-38489 - !20250 Fix CVE-2025-38480 - !20378 Fix CVE-2025-39838 - !20430 Fix CVE-2025-39942 - !20351 Fix CVE-2025-71149 - !20375 Fix CVE-2025-71150 - !20323 Fix CVE-2025-38730 - !20320 Fix CVE-2025-68814 - !20314 Fix CVE-2025-71072 - !20315 Fix CVE-2025-68794 - !20403 bpf: Check skb->transport_header is set in bpf_skb_check_mtu - !20402 bpf: Do not let BPF test infra emit invalid GSO types to stack - !20401 tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() - !20400 netfilter: nft_ct: add seqadj extension for natted connections - !20399 net: xfrm: Fix CVE-2025-40215 - !20398 net/sched: sch_qfq: Fix null-deref in agg_dequeue - !20397 bpf: Reject narrower access to pointer ctx fields - !20396 Bluetooth: eir: Fix possible crashes on eir_create_adv_data - !20394 IB/mlx5: Fix potential deadlock in MR deregistration - !20367 ub: cdma: cdma uaf bugfix - net/mlx5e: Fix crash on profile change rollback failure - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv - PCI/AER: Fix NULL pointer access by aer_info - gfs2: No more self recovery - drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE - crypto: qat - flush misc workqueue during device shutdown - !20174 Backport PMT spec 3.0 support - !20366 [Hygon][6.6][Bugfix]: Resolve FPU state corruption between atomic and non-atomic contexts - !19814 [OLK-6.6] Batch flushing user memory encrytion status change - !20393 [OLK-6.6][linux-6.6.y sync] Backport 6.6.100-6.6.101 LTS Patches - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec - nvmet-tcp: remove boilerplate code - scsi: target: Reset t_task_cdb pointer in error case - scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" - block: Use RCU in blk_mq_[un]quiesce_tagset() instead of set->tag_list_lock - ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size - ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer - smb: server: let recv_done() consistently call put_recvmsg/smb_direct_disconnect_rdma_connection - smb: server: remove separate empty_recvmsg_queue - !20384 ub:ubus: Fix ubus link message and pool device error - !20389 gfs2: Prevent recursive memory reclaim - !20388 *** fix CVE-2025-38062 *** - !20387 KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced - !20386 pinctrl: check the return value of pinmux_ops::get_function_name() - !20385 iommu/amd/pgtbl: Fix possible race while increase page table level - ub:ubus: Not cfg access during surprise down - ub:hisi-ubus: Delete validate_pa err print - PCI: cadence: Check for the existence of cdns_pcie::ops before using it - can: netlink: can_changelink(): allow disabling of automatic restart - Revert "selftests/bpf: Add a cgroup prog bpf_get_ns_current_pid_tgid() test" - drm/sched: Remove optimization that causes hang when killing dependent jobs - ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS - bpf: Check skb->transport_header is set in bpf_skb_check_mtu - bpf: Do not let BPF test infra emit invalid GSO types to stack - tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() - netfilter: nft_ct: add seqadj extension for natted connections - xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added - xfrm: delete x->tunnel as we delete x - x86/hw-vuln:Support hardware-based mitigation for Retbleed and SRSO via Hygon IBRS to avoid performance degradation caused by software-based mitigation. - net/sched: sch_qfq: Fix null-deref in agg_dequeue - bpf: Reject narrower access to pointer ctx fields - Bluetooth: eir: Fix possible crashes on eir_create_adv_data - IB/mlx5: Fix potential deadlock in MR deregistration - ub:ubus: Fix ubus link message and pool device error - ub:hisi-ubus: cq poller maximum handle 64 cqe per time - ub:hisi-ubus:Fix vdm message print error - ub:ubus:Fix ubus interrupt release issue - wifi: mt76: mt7921: prevent decap offload config before STA initialization - mtd: rawnand: qcom: Fix last codeword read in qcom_param_page_type_exec() - iio: hid-sensor-prox: Restore lost scale assignments - iio: hid-sensor-prox: Fix incorrect OFFSET calculation - crypto: powerpc/poly1305 - add depends on BROKEN for now - erofs: address D-cache aliasing - drm/i915/dp: Fix 2.7 Gbps DP_LINK_BW value on g4x - ALSA: hda: Add missing NVIDIA HDA codec IDs - ALSA: hda/tegra: Add Tegra264 support - comedi: comedi_test: Fix possible deletion of uninitialized timers - usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach - usb: typec: tcpm: allow switching to mode accessory to mux properly - usb: typec: tcpm: allow to use sink in accessory mode - drm/amdkfd: Don't call mmput from MMU notifier callback - mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n - selftests: mptcp: connect: also cover checksum - selftests: mptcp: connect: also cover alt modes - resource: fix false warning in __request_region() - gve: Fix stuck TX queue for DQ queue format - e1000e: ignore uninitialized checksum word on tgp - e1000e: disregard NVM checksum on tgp when valid checksum bit is not set - dpaa2-switch: Fix device reference count leak in MAC endpoint handling - dpaa2-eth: Fix device reference count leak in MAC endpoint handling - ALSA: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx - sprintf.h requires stdarg.h - bus: fsl-mc: Fix potential double device reference in fsl_mc_get_endpoint() - i2c: virtio: Avoid hang by using interruptible completion wait - i2c: tegra: Fix reset error handling with ACPI - platform/x86: ideapad-laptop: Fix kbd backlight not remembered among boots - can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode - can: dev: can_restart(): move debug message and stats after successful restart - can: dev: can_restart(): reverse logic to remove need for goto - i40e: When removing VF MAC filters, only check PF-set MAC - i40e: report VF tx_dropped with tx_errors instead of tx_discards - i40e: Add rx_missed_errors for buffer exhaustion - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch - net/mlx5: Fix memory leak in cmd_exec() - staging: vchiq_arm: Make vchiq_shutdown never fail - x86/hyperv: Fix usage of cpu_online_mask to get valid cpu - regmap: fix potential memory leak of regmap_bus - iio: adc: ad7949: use spi_is_bpw_supported() - interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1 node - RDMA/core: Rate limit GID cache warning messages - virtio_ring: Fix error reporting in virtqueue_resize - !20348 [OLK-6.6][linux-6.6.y sync] Backport 6.6.99-6.6.100 LTS Patches - !20346 tracing: Fix crash on synthetic stacktrace field usage - vfs: Don't leak disconnected dentries on umount - !20334 Fix CVE-2025-68780 - gfs2: Prevent recursive memory reclaim - amd/amdkfd: enhance kfd process check in switch partition - drm/amdkfd: allow compute partition mode switch with cgroup exclusions - KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced - pinctrl: check the return value of pinmux_ops::get_function_name() - iommu/amd/pgtbl: Fix possible race while increase page table level - !19966 nvme-fc: use lock accessing port_state and rport state - ASoC: fsl_sai: replace regmap_write with regmap_update_bits - comedi: Fix use of uninitialized data in insn_rw_emulate_bits() - cifs: prevent NULL pointer dereference in UTF16 conversion - ksmbd: Fix refcount leak when invalid session is found on session lookup - ubcore: fix logging and permission for route query. - !20232 driver/coda: VirtCCA supports MSI device DA - Revert "Revert "RDMA/hns: Fix mismatch exception rollback"" - !20197 ub: udma&ubase: fix a bug that caused long reboot time - x86: Resolve FPU state corruption between atomic and non-atomic contexts - ub: cdma: cdma uaf bugfix - ub: cdma: jfs call trace bugfix - !20353 x86/fpu: Clear XSTATE_BV[i - s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again - KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls - nvmem: layouts: u-boot-env: remove crc32 endianness conversion - i2c: omap: fix deprecated of_property_read_bool() use - ASoC: fsl_sai: Force a software reset when starting in consumer mode - regulator: pwm-regulator: Manage boot-on with disabled PWM channels - regulator: pwm-regulator: Calculate the output voltage for disabled PWMs - i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe() - i2c: omap: Fix an error handling path in omap_i2c_probe() - i2c: omap: Add support for setting mux - usb: dwc3: qcom: Don't leave BCR asserted - usb: hub: Don't try to recover devices lost during warm reset. - usb: hub: Fix flushing of delayed work used for post resume purposes - usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm - usb: hub: fix detection of high tier USB3 devices behind suspended hubs - arm64: Filter out SME hwcaps when FEAT_SME isn't implemented - ipv6: make addrconf_wq single threaded - !20354 cpufreq/sched: Explicitly synchronize limits_changed flag handling - sched/deadline: only set free_cpus for online runqueues - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 - cpufreq/sched: Explicitly synchronize limits_changed flag handling - io_uring/poll: correctly handle io_poll_add() return value on update - shmem: fix recovery on rename failures - io_uring: fix filename leak in __io_openat_prep() - Revert "cgroup_freezer: cgroup_freezing: Check if not frozen" - rxrpc: Fix transmission of an abort in response to an abort - rxrpc: Fix recv-recv race of completed call - net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree - net: bridge: Do not offload IGMP/MLD messages - hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf - netfilter: nf_conntrack: fix crash due to removal of uninitialised entry - ipv6: mcast: Delay put pmc->idev in mld_del_delrec() - net/mlx5: Correctly set gso_size when LRO is used - Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID - Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout - Bluetooth: SMP: If an unallowed command is received consider it a failure - Bluetooth: hci_sync: fix connectable extended advertising when using static random address - hwmon: (corsair-cpro) Validate the size of the received input buffer - selftests: net: increase inter-packet timeout in udpgro.sh - wifi: cfg80211: remove scan request n_channels counted_by - nvme: fix misaccounting of nvme-mpath inflight I/O - net: phy: Don't register LEDs for genphy - nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list() - rpl: Fix use-after-free in rpl_do_srh_inline(). - block: fix kobject leak in blk_unregister_queue - net: emaclite: Fix missing pointer increment in aligned_read() - soundwire: amd: fix for clearing command status register - soundwire: amd: fix for handling slave alerts after link is down - comedi: Fix use of uninitialized data in insn_rw_emulate_bits() - comedi: Fix some signed shift left operations - comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large - comedi: das6402: Fix bit shift out of bounds - comedi: das16m1: Fix bit shift out of bounds - comedi: aio_iiro_16: Fix bit shift out of bounds - comedi: pcl812: Fix bit shift out of bounds - iio: adc: stm32-adc: Fix race in installing chained IRQ handler - iio: adc: max1363: Reorder mode_list[] entries - iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] - iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush - soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled - soc: aspeed: lpc-snoop: Cleanup resources in stack-order - s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again - pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov - net: libwx: properly reset Rx ring descriptor - net: libwx: remove duplicate page_pool_put_full_page() - mmc: sdhci_am654: Workaround for Errata i2312 - mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models - mmc: bcm2835: Fix dma_unmap_sg() nents value - memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() - isofs: Verify inode mode when loading from disk - dmaengine: nbpfaxi: Fix memory corruption in probe() - af_packet: fix soft lockup issue caused by tpacket_snd() - af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() - arm64: dts: rockchip: use cs-gpios for spi1 on ringneck - arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on - arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency - net/mlx5: Update the list of the PCI supported devices - phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() - io_uring/poll: fix POLLERR handling - ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS - drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume - tracing/osnoise: Fix crash in timerlat_dump_stack() - spi: Add check for 8-bit transfer with 8 IO mode support - pch_uart: Fix dma_sync_sg_for_device() nents value - thunderbolt: Fix bit masking in tb_dp_port_set_hops() - i2c: stm32: fix the device used for the DMA map - tracing: Fix crash on synthetic stacktrace field usage - usb: musb: fix gadget state on disconnect - USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI - USB: serial: option: add Foxconn T99W640 - USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition - phy: tegra: xusb: Disable periodic tracking on Tegra234 - phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode - phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr - fs/proc: fix uaf in proc_readdir_de() - io_uring/net: commit partial buffers on retry - nvme: fix admin request_queue lifetime - fs/notify: call exportfs_encode_fid with s_umount - iomap: adjust read range correctly for non-block-aligned positions - fuse: fix livelock in synchronous file put from fuseblk workers - tpm: Cap the number of PCR banks - nfsd: provide locking for v4_end_grace - Revert "nfsd: provide locking for v4_end_grace" - config: enable config for PMT discovery driver - platform/x86/intel/pmt/discovery: use valid device pointer in dev_err_probe - platform/x86/intel/pmt: Fix kobject memory leak on init failure - platform/x86/intel/pmt: fix a crashlog NULL pointer access - platform/x86/intel/pmt: fix build dependency for kunit test - platform/x86/intel/pmt/discovery: fix format string warning - platform/x86/intel/pmt/discovery: Fix size_t specifiers for 32-bit - platform/x86/intel/pmt: KUNIT test for PMT Enhanced Discovery API - platform/x86/intel/pmt/telemetry: Add API to retrieve telemetry regions by feature - platform/x86/intel/pmt/discovery: Get telemetry attributes - platform/x86/intel/tpmi: Get OOBMSM CPU mapping from TPMI - platform/x86/intel/vsec: Set OOBMSM to CPU mapping - platform/x86/intel/tpmi: Relocate platform info to intel_vsec.h - docs: Add ABI documentation for intel_pmt feature directories - platform/x86/intel/pmt: Add PMT Discovery driver - sysfs: Fix crash on empty group attributes array - sysfs: Introduce a mechanism to hide static attribute_groups - platform/x86/intel/vsec: Add new Discovery feature - platform/x86/intel/vsec: Skip driverless features - platform/x86/intel/vsec: Skip absent features during initialization - platform/x86/intel/vsec: Add device links to enforce dependencies - platform/x86/intel/vsec: Create wrapper to walk PCI config space - platform/x86/intel/vsec: Add private data for per-device data - MAINTAINERS: Add link to documentation of Intel PMT ABI - platform/x86/intel/pmt: allow user offset for PMT callbacks - driver/coda: VirtCCA supports MSI device DA - ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency - Rename leapioraid to leapraid and release v2.0 - ub: udma: fix a bug that caused long reboot time. - ub: ubase: Accelerate when ctrl node is shutting down - platform/x86/intel/pmt: Use PMT callbacks - platform/x86/intel/vsec: Add PMT read callbacks - platform/x86/intel/vsec.h: Move to include/linux - md: prevent incorrect update of resync/recovery offset - md/raid1: Fix data corruption for degraded array with slow disk - md/raid1: set max_sectors during early return from choose_slow_rdev() - md-cluster: fix no recovery job when adding/re-adding a disk - md-cluster: fix hanging issue while a new disk adding - md/raid5: recheck if reshape has finished with device_lock held - md-cluster: Constify struct md_cluster_operations - md: Remove unneeded semicolon - md/raid5: fix spares errors about rcu usage - dm-raid: Fix WARN_ON_ONCE check for sync_thread in raid_resume - md: pass in max_sectors for pers->sync_request() - md: factor out helpers for different sync_action in md_do_sync() - md: replace last_sync_action with new enum type - md: use new helpers in md_do_sync() - md: don't fail action_store() if sync_thread is not registered - md: remove parameter check_seq for stop_sync_thread() - md: replace sysfs api sync_action with new helpers - md: factor out helper to start reshape from action_store() - md: add new helpers for sync_action - md: add a new enum type sync_action - md: rearrange recovery_flags - md/raid0: don't free conf on raid0_run failure - md: make md_flush_request() more readable - md: change the return value type of md_write_start to void - md: Revert "md: Fix overflow in is_mddev_idle" - md: don't account sync_io if iostats of the disk is disabled - md: Fix overflow in is_mddev_idle - md: add check for sleepers in md_wakeup_thread() - md: add a mddev_is_dm helper - md: add a mddev_add_trace_msg helper - md: add a mddev_trace_remap helper - dm-raid456, md/raid456: fix a deadlock for dm-raid456 while io concurrent with reshape - dm-raid: add a new helper prepare_suspend() in md_personality - dm-raid: really frozen sync_thread during suspend - md: add a new helper reshape_interrupted() - md: export helper md_is_rdwr() - md: export helpers to stop sync_thread - md: don't clear MD_RECOVERY_FROZEN for new dm-raid until resume - md/raid1: factor out helpers to choose the best rdev from read_balance() - md/raid1: factor out the code to manage sequential IO - md/raid1: factor out choose_bb_rdev() from read_balance() - md/raid1: factor out choose_slow_rdev() from read_balance() - md/raid1: factor out read_first_rdev() from read_balance() - md/raid1-10: factor out a new helper raid1_should_read_first() - md/raid1-10: add a helper raid1_check_read_range() - md/raid1: fix choose next idle in read_balance() - md/raid1: record nonrot rdevs while adding/removing rdevs to conf - md/raid1: factor out helpers to add rdev to conf - md: add a new helper rdev_has_badblock() - md: check mddev->pers before calling md_set_readonly() - md: clean up openers check in do_md_stop() and md_set_readonly() - md: sync blockdev before stopping raid or setting readonly - md: factor out a helper to sync mddev - md: return directly before setting did_set_md_closing - md: changed the switch of RAID_VERSION to if - md: merge the check of capabilities into md_ioctl_valid() - md: Don't suspend the array for interrupted reshape - md: Don't register sync_thread for reshape directly - md: Make sure md_do_sync() will set MD_RECOVERY_DONE - md: Don't ignore read-only array in md_check_recovery() - md: Don't ignore suspended array in md_check_recovery() - md: get rdev->mddev with READ_ONCE() - md: remove redundant md_wakeup_thread() - md: remove redundant check of 'mddev->sync_thread' - md: fix a suspicious RCU usage warning - raid: Remove now superfluous sentinel element from ctl_table array - NFSD: NFSv4 file creation neglects setting ACL - nfsd: set security label during create operations - xfs: Add xfs_dir3_leaf_header_check() in leaf/leafn read - nvme-fc: use lock accessing port_state and rport state - x86/mm: Batch flushing user memory encrytion status change - !20588 [OLK-6.6] Revert "x86/csv: Enhance CMA memory usage reporting for CSV3" - Revert "x86/csv: Enhance CMA memory usage reporting for CSV3" - !20576 media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg() - !20575 RDMA/cm: Fix leaking the multicast GID table reference - !20580 RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly - !20551 Fix CVE-2025-68785 - !20478 f2fs: fix to avoid potential deadlock - !20501 [OLK-6.6] backport important bugfix for bnxt driver from upstream linux-6.6.y - !20520 Fix CVE-2026-23038 - !20424 net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup - !20425 mlx5: Fix default values in create CQ - RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly - media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg() - RDMA/cm: Fix leaking the multicast GID table reference - net: openvswitch: fix middle attribute validation in push_nsh() action - net: openvswitch: remove never-working support for setting nsh fields - pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() - bnxt_en: Fix potential data corruption with HW GRO/LRO - f2fs: fix to avoid potential deadlock - mlx5: Fix default values in create CQ - net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup - riscv kernel upgrade to 6.6.0-138.0.0 - Fixed system hang when boot systemd on spacemit k3 - riscv: perf vendor events: fix lrw core PMU event mapping - !20727 v2 bpf: sockmap fixes - !20741 scsi: qla2xxx: Sanitize payload size to prevent member overflow - !20744 fix CVE-2025-38449 - !20763 net: usb: asix: validate PHY address before use - !20762 smc91x: fix broken irq-context in PREEMPT_RT - !20293 [Hygon][6.6][EDAC] The width of hash value is 2 bits for Hygon family 18h model 6h processors - !20290 [Hygon][6.6][Bugfix] Bug fix for EDAC to use unicast instead of broadcast on hygon family 18h model 4h - !20289 [Hygon][6.6][Bugfix] Bug fix for EDAC to correct the address translation on hygon family 18h model 4h - !20245 KVM: arm64: Refactor exit handlers - !20246 KVM: arm64: Mark some header functions as inline - !19005 [Hygon] [OLK-6.6] [Bugfix] Fix memory bandwidth counter width for Hygon QoS - !20292 [Hygon][6.6][TSC Adjust] Backport x86 TSC adjust patch - !20273 [Hygon][6.6][Bugfix] Get correct CPU LLC ID in guest for Hygon processors - !20722 [OLK-6.6][linux-6.6.y sync] Backport 6.6.104-6.6.106 LTS Patches - !20667 fix CVE-2024-50102 - !20736 netfilter: nf_tables: remove redundant chain validation on register store - !20758 ub: ubase: Fixed the alarm issue caused by the initialization of the structure variable definition. - !20721 obmm: reduce log noise for successful export/import/preimport - net: usb: asix: validate PHY address before use - smc91x: fix broken irq-context in PREEMPT_RT - !20731 devlink: rate: Unset parent pointer in devl_rate_nodes_destroy - !20732 libceph: return the handler error from mon_handle_auth_done() - !20743 mm: slub: avoid wake up kswapd in set_track_prepare - ub: ubase: Fixed the alarm issue caused by the initialization of the structure variable definition. - !20750 ub: cdma: adapted to UMMU interface changes - !20713 urma: DFX of log in kernel - urma: optimize log levels for kernel space - ub: cdma: adapted to UMMU interface changes - wifi: ath11k: avoid bit operation on key flags - drm/mediatek: fix potential OF node use-after-free - cpufreq: intel_pstate: Check IDA only before MSR_IA32_PERF_CTL writes - wifi: cfg80211: sme: store capped length in __cfg80211_connect_result() - !20708 ub:hisi-ubus: Add create bus instance ummu bypass - drm: fix kabi for struct drm_framebuffer - drm/framebuffer: Acquire internal references on GEM handles - drm/gem: Acquire references on GEM handles for framebuffers - mm: slub: avoid wake up kswapd in set_track_prepare - scsi: qla2xxx: Sanitize payload size to prevent member overflow - netfilter: nf_tables: remove redundant chain validation on register store - libceph: return the handler error from mon_handle_auth_done() - devlink: rate: Unset parent pointer in devl_rate_nodes_destroy - Documentation/hw-vuln: Add VMSCAPE documentation - dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status() - riscv: use lw when reading int cpu in asm_per_cpu - mm: slub: avoid wake up kswapd in set_track_prepare - tools: gpio: remove the include directory on make clean - tools: gpio: rm .*.cmd on make clean - drm/amd/amdgpu: Fix missing error return on kzalloc failure - drm/amdgpu: Replace DRM_* with dev_* in amdgpu_psp.c - perf bpf-event: Fix use-after-free in synthesis - drm/bridge: ti-sn65dsi86: fix REFCLK setting - spi: spi-fsl-lpspi: Clear status register after disabling the module - spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort - spi: spi-fsl-lpspi: Set correct chip-select polarity bit - spi: spi-fsl-lpspi: Fix transmissions when using CONT - hwmon: mlxreg-fan: Prevent fans from getting stuck at 0 RPM - pcmcia: omap: Add missing check for platform_get_resource - Revert "drm/amdgpu: Avoid extra evict-restore process." - ALSA: hda/realtek: Fix headset mic for TongFang X6[AF]R5xxY - ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model - drm/mediatek: Fix device/node reference count leaks in mtk_drm_get_all_drm_priv - drm/mediatek: Fix using wrong drm private data to bind mediatek-drm - drm/mediatek: Add crtc path enum for all_drm_priv array - vmxnet3: update MTU after device quiesce - net: dsa: microchip: linearize skb for tail-tagging switches - net: dsa: microchip: update tag_ksz masks for KSZ9477 family - dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status() - ALSA: hda/realtek - Add new HP ZBook laptop with micmute led fixup - ALSA: hda/realtek: Add support for HP Agusta using CS35L41 HDA - iio: pressure: mprls0025pa: use aligned_s64 for timestamp - iio: chemical: pms7003: use aligned_s64 for timestamp - iio: imu: inv_mpu6050: align buffer for timestamp - thermal/drivers/mediatek/lvts: Disable low offset IRQ for minimum threshold - nouveau: fix disabling the nonstall irq due to storm code - cpufreq: intel_pstate: Unchecked MSR aceess in legacy mode - net: pcs: rzn1-miic: Correct MODCTRL register offset - platform/x86/amd/pmc: Add TUXEDO IB Pro Gen10 AMD to spurious 8042 quirks list - drm/amdgpu: drop hw access in non-DC audio fini - wifi: mt76: mt7996: Initialize hdr before passing to skb_put_data() - wifi: mwifiex: Initialize the chan_stats array to zero - tcp_bpf: Fix copied value in tcp_bpf_sendmsg - skmsg: Return copied bytes in sk_msg_memcopy_from_iter - tcp_bpf: Add sk_rmem_alloc related logic for tcp_bpf ingress redirection - Revert "bpf, sockmap: Add sk_rmem_alloc check for sockmap" - ALSA: usb-audio: Add mute TLV for playback volumes on some devices - phy: mscc: Stop taking ts_lock for tx_queue and use its own lock - selftest: net: Fix weird setsockopt() in bind_bhash.c. - net: atm: fix memory leak in atm_register_sysfs when device_register fail - ax25: properly unshare skbs in ax25_kiss_rcv() - mctp: return -ENOPROTOOPT for unknown getsockopt options - net/smc: Remove validation of reserved bits in CLC Decline message - ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init() - net: thunder_bgx: decrement cleanup index before use - net: thunder_bgx: add a missing of_node_put - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() - wifi: libertas: cap SSID len in lbs_associate() - wifi: cw1200: cap SSID length in cw1200_do_join() - net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets - wifi: ath11k: fix group data packet drops during rekey - wifi: ath11k: avoid forward declaration of ath11k_mac_start_vdev_delay() - wifi: ath11k: rename ath11k_start_vdev_delay() - wifi: ath11k: Introduce and use ath11k_sta_to_arsta() - net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() - macsec: read MACSEC_SA_ATTR_PN with nla_get_uint - netlink: add variable-length / auto integers - net: macb: Fix tx_ptr_lock locking - icmp: fix icmp_ndo_send address translation for reply direction - mISDN: Fix memory leak in dsp_hwec_enable() - xirc2ps_cs: fix register access when enabling FullDuplex - netfilter: conntrack: helper: Replace -EEXIST by -EBUSY - wifi: cfg80211: fix use-after-free in cmp_bss() - arm64: dts: imx8mp: Fix missing microSD slot vqmmc on Data Modul i.MX8M Plus eDM SBC - arm64: dts: imx8mp: Fix missing microSD slot vqmmc on DH electronics i.MX8M Plus DHCOM - tee: optee: ffa: fix a typo of "optee_ffa_api_is_compatible" - arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro - Bluetooth: hci_sync: Avoid adding default advertising on startup - cpupower: Fix a bug where the -t option of the set subcommand was not working. - drm/amd/display: Don't warn when missing DCE encoder caps - cdc_ncm: Flag Intel OEM version of Fibocom L850-GL as WWAN - LoongArch: Save LBT before FPU in setup_sigcontext() - btrfs: avoid load/store tearing races when checking if an inode was logged - btrfs: fix race between setting last_dir_index_offset and inode logging - btrfs: fix race between logging inode and checking if it was logged before - bpf: Fix oob access in cgroup local storage - !20556 urma: fix update topo logic - !20639 [OLK-6.6][linux-6.6.y sync] Backport 6.6.103-6.6.104 LTS Patches - !20641 [OLK-6.6][linux-6.6.y sync] LoongArch: Add more instruction opcodes and emit_* helpers - !20560 *** fix CVE-2025-38062 *** - !20662 pNFS: Fix a deadlock when returning a delegation during open() - ub:hisi-ubus: Add create bus instance ummu bypass - Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" - Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set" - HID: mcp2221: Handle reads greater than 60 bytes - HID: mcp2221: Don't set bus speed on every transfer - net/mlx5: SF, Fix add port error handling - drm/nouveau/disp: Always accept linear modifier - smb3 client: fix return code mapping of remap_file_range - net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions - dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted - HID: wacom: Add a new Art Pen 2 - HID: logitech: Add ids for G PRO 2 LIGHTSPEED - HID: quirks: add support for Legion Go dual dinput modes - net: stmmac: Set CIC bit only for TX queues with COE - net: stmmac: xgmac: Correct supported speed modes - net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts - net/mlx5e: Set local Xoff after FW update - net/mlx5e: Update and set Xon/Xoff upon port speed set - net/mlx5e: Update and set Xon/Xoff upon MTU set - net/mlx5: Nack sync reset when SFs are present - net/mlx5: Convert SF port_indices xarray to function_ids xarray - net/mlx5: Use devlink port pointer to get the pointer of container SF struct - net/mlx5: Call mlx5_sf_id_erase() once in mlx5_sf_dealloc() - phy: mscc: Fix when PTP clock is register and unregister - net: dlink: fix multicast stats being counted incorrectly - dt-bindings: display/msm: qcom,mdp5: drop lut clock - drm/nouveau: remove unused memory target test - drm/nouveau: remove unused increment in gm200_flcn_pio_imem_wr - Bluetooth: hci_sync: fix set_local_name race condition - Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced - Bluetooth: hci_event: Mark connection as closed during suspend disconnect - Bluetooth: hci_event: Treat UNKNOWN_CONN_ID on disconnect as success - HID: input: report battery status changes immediately - HID: input: rename hidinput_set_battery_charge_status() - powerpc/kvm: Fix ifdef to remove build warning - drm/msm: Defer fd_install in SUBMIT ioctl - vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() - ACPI: EC: Add device to acpi_ec_no_wakeup[] qurik list - erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC - ASoC: codecs: tx-macro: correct tx_macro_component_drv name - smb: client: fix race with concurrent opens in unlink(2) - scsi: core: sysfs: Correct sysfs attributes access rights - of: dynamic: Fix use after free in of_changeset_add_prop_helper() - of: Add a helper to free property struct - mips: lantiq: xway: sysctrl: rename the etop node - mips: dts: lantiq: danube: add missing burst length property - pinctrl: STMFX: add missing HAS_IOMEM dependency - of: dynamic: Fix memleak when of_pci_add_properties() failed - !20684 urma: adjust urma log format - !20355 udp: Deal with race between UDP socket address change and rehash - !20627 Fixes CVE-2025-38627 - !20702 CVE-2025-39948 - !20701 netfilter: ctnetlink: remove refcounting in expectation dumpers - !20700 CVE-2025-38678 - !20703 CVE-2025-38491 - !20690 tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. - obmm: reduce log noise for successful export/import/preimport - mptcp: avoid deadlock on fallback while reinjecting - mptcp: plug races between subflow fail and subflow creation - mptcp: make fallback action and fallback decision atomic - ice: fix Rx page leak on multi-buffer frames - ice: fix incorrect counter for buffer allocation failures - ice: stop storing XDP verdict within ice_rx_buf - ice: gather page_count()'s of each frag right before XDP prog call - ice: Introduce ice_xdp_buff - netfilter: ctnetlink: remove refcounting in expectation dumpers - netfilter: nf_tables: reject duplicate device on updates - netfilter: nf_tables: Introduce functions freeing nft_hook objects - netfilter: nf_tables: Fix percpu address space issues in nf_tables_api.c - err.h: add ERR_PTR_PCPU(), PTR_ERR_PCPU() and IS_ERR_PCPU() macros - tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. - !20498 Fix CVE-2025-71118 - !20608 pmdomain: arm: scmi: Fix genpd leak on provider registration failure - !20679 x86/CPU/AMD: Add RDSEED fix for Zen5 - !20650 fix cve-2025-40300 - !20661 Input: alps - fix use-after-free bugs caused by dev3_register_work - !20664 backport some net bugfix from 6.6 lts - urma: adjust urma log format - !20678 ub: udma: close debug switch load parameters. - ub: udma: close debug switch load parameters. - x86/CPU/AMD: Add RDSEED fix for Zen5 - !20630 net: LTS-6.6 bugfix backport - !20632 net/sched: sch_qfq: do not free existing class in qfq_change_class() - !20631 macvlan: fix possible UAF in macvlan_forward_source() - !20628 Fix CVE-2025-39910 - !20659 v2 Fix CVE-2025-22090 - !20506 XSched: Update XSched manual - !20647 media: imon: make send_packet() more robust - !20646 ksm: use range-walk function to jump over holes in scan_get_next_rmap_item - !20645 fbcon: Set fb_display[i - !20648 parse_longname(): strrchr() expects NUL-terminated string - !20621 urma: modify log level - !20602 urma: fix the jfe uaf issue that occurred during the killall process. - !20567 urma:change log level and pass status 9 - !20640 iio: common: st_sensors: Fix use of uninitialize device structs - !20634 usb: gadget: udc: fix use-after-free in usb_gadget_state_work - !20633 net: dsa: properly keep track of conduit reference - !20635 fix CVE-2025-68231 - !20651 mm/slub: avoid accessing metadata when pointer is invalid in object_err() - !20649 drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb - !20652 mm/vmalloc: fix data race in show_numa_info() - x86: uaccess: don't use runtime-const rewriting in modules - x86: fix off-by-one in access_ok() - x86: fix user address masking non-canonical speculation issue - x86/uaccess: Zero the 8-byte get_range case on failure on 32-bit - x86/uaccess: Improve the 8-byte getuser() case - x86: fix whitespace in runtime-const assembler output - dcache: keep dentry_hashtable or d_hash_shift even when not used - runtime constants: add x86 architecture support - runtime constants: deal with old decrepit linkers - x86/uaccess: Add missing __force to casts in __access_ok() and valid_user_address() - !20345 arm64: entry: xcall/xint: make asm conditionals compatible with clang IAS - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). - libceph: replace BUG_ON with bounds check for map->max_osd - libceph: prevent potential out-of-bounds writes in handle_auth_session_key() - libceph: fix potential use-after-free in have_mon_and_osd_map() - sctp: Hold sock lock while iterating over address list - sctp: Prevent TOCTOU out-of-bounds write - sctp: Hold RCU read lock while iterating over address list - tipc: Fix use-after-free in tipc_mon_reinit_self(). - sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto - sctp: avoid NULL dereference when chunk data buffer is missing - bpf: Explicitly check accesses to bpf_sock_addr - ipvs: Defer ip_vs_ftp unregister during netns cleanup - nexthop: Forbid FDB status change while nexthop is in a group - netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). - net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer - sctp: initialize more fields in sctp_v6_from_sk() - pNFS: Fix a deadlock when returning a delegation during open() - Input: alps - fix use-after-free bugs caused by dev3_register_work - x86/cpu: Get CPU LLC ID from CPUID 0x8000001d in guest for Hygon processors - kernel/fork: only call untrack_pfn_clear() on VMAs duplicated for fork() - mm: (un)track_pfn_copy() fix + doc improvements - x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range() - !20642 mtdchar: fix integer overflow in read/write ioctls - mm/vmalloc: fix data race in show_numa_info() - mm/slub: avoid accessing metadata when pointer is invalid in object_err() - config: enable CONFIG_MITIGATION_VMESCAPE by default on x86 - x86/vmscape: Enable the mitigation - x86/vmscape: Enumerate VMSCAPE bug - x86/vmscape: Add conditional IBPB mitigation - drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb - parse_longname(): strrchr() expects NUL-terminated string - media: imon: make send_packet() more robust - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item - fbcon: Set fb_display[i]->mode to NULL when the mode is released - !20569 CVE-2024-35808 - mtdchar: fix integer overflow in read/write ioctls - !20619 Fix CVE-2026-22991 - !20612 net: hns3: extend HCLGE_FD_AD_COUNTER_NUM to 8 bits - LoongArch: Add more instruction opcodes and emit_* helpers - iio: common: st_sensors: Fix use of uninitialize device structs - !20581 null_blk: fix kmemleak by releasing references to fault configfs items - mm/mempool: fix poisoning order>0 pages with HIGHMEM - mm/page_poison: replace kmap_atomic() with kmap_local_page() - mm/mempool: replace kmap_atomic() with kmap_local_page() - usb: gadget: udc: fix use-after-free in usb_gadget_state_work - net: dsa: properly keep track of conduit reference - net/sched: sch_qfq: do not free existing class in qfq_change_class() - macvlan: fix possible UAF in macvlan_forward_source() - netfilter: nft_objref: validate objref and objrefmap expressions - arp: do not assume dev_hard_header() does not change skb->head - ip6_gre: make ip6gre_header() robust - netfilter: nf_tables: avoid chain re-validation if possible - netfilter: nf_tables: drop unused 3rd argument from validate callback ops - Revert "netfilter: nft_objref: validate objref and objrefmap expressions" - bpf: Fix reference count leak in bpf_prog_test_run_xdp() - net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset - ethtool: Avoid overflowing userspace buffer on stats query - ipvs: fix ipv4 null-ptr-deref in route error path - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() - !20596 mm/page_alloc: prevent pcp corruption with SMP=n - !20598 team: fix check for port enabled in team_queue_override_port_prio_changed() - !18823 hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio - mm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc() - kasan: avoid sleepable page allocation from atomic context - f2fs: compress: fix UAF of f2fs_inode_info in f2fs_free_dic - f2fs: compress: change the first parameter of page_array_{alloc,free} to sbi - !20583 [OLK-6.6][linux-6.6.y sync] Backport 6.6.102-6.6.103 LTS Patches - !20460 fbdev: Fix vmalloc out-of-bounds write in fast_imageblit - urma:fix log level and pass status 9 - urma: modify log level - !20592 CVE-2025-71141 fixup - !20594 CVE-2025-39744 fixup - !20607 powerpc/64s/slb: Fix SLB multihit issue during SLB preload - !20606 mm/huge_memory: fix NULL pointer deference when splitting folio - !20604 Fix CVE-2026-22984 - !20603 Fix CVE-2026-23021 - !20600 Fix CVE-2026-22990 - urma: fix the jfe uaf issue that occurred during the killall process. - !20380 pswiotlb: Adapt to the IOMMU DMA API upgraded by IOMMUFD - libceph: make free_choose_arg_map() resilient to partial allocation - drm/dp: Change AUX DPCD probe address from LANE0_1_STATUS to TRAINING_PATTERN_SET - net: hns3: extend HCLGE_FD_AD_COUNTER_NUM to 8 bits - net: hns3: extend HCLGE_FD_AD_QID to 11 bits - net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue - net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M - Revert "net: hns3: add support for FD counter" - !20587 dmaengine: stm32: dmamux: fix device leak on route allocation - pmdomain: arm: scmi: Fix genpd leak on provider registration failure - powerpc/64s/slb: Fix SLB multihit issue during SLB preload - mm/huge_memory: fix NULL pointer deference when splitting folio - !20562 LoongArch: BPF: Sign extend kfunc call arguments - !20470 ipv4: Fix reference count leak when using error routes with nexthop objects - !20471 net: sock: fix hardened usercopy panic in sock_recv_errqueue - !20472 net: fix memory leak in skb_segment_list for GRO packets - !20473 ipv4: ip_gre: make ipgre_header() robust - !20469 SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf - !20476 ipv6: Fix use-after-free in inet6_addr_del(). - !20477 svcrdma: bound check rq_pages index in inline path - !20578 ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() - !20579 fix CVE-2025-68768 - !20542 Fix NFS deadlock - USB: storage: Remove subclass and protocol overrides from Novatek quirk - cpuidle: governors: menu: Select polling state in some more cases - cpuidle: governors: menu: Rearrange main loop in menu_select() - cpuidle: menu: Update documentation after previous changes - Revert "drm/tegra: dsi: Clear enable register if powered by bootloader" - parisc: Remove spurious if statement from raw_copy_from_user() - ata: libata-scsi: Fix system suspend for a security locked drive - Revert "drm/amdgpu: fix incorrect vm flags to map bo" - mfd: axp20x: Set explicit ID for regulator cell if no IRQ line is present - drm/amd/display: use udelay rather than fsleep - sched/fair: Revert max_newidle_lb_cost bump - net: ipv4: fix regression in local-broadcast routes - tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers - PM: runtime: Do not clear needs_force_resume with enabled runtime PM - usb: typec: ucsi: psy: Set max current to zero when disconnected - io_uring/rw: cast rw->flags assignment to rwf_t - Documentation: ACPI: i2c-muxes: fix I2C device references - s390/hypfs: Enable limited access during lockdown - s390/hypfs: Avoid unnecessary ioctl registration in debugfs - ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation - net/mlx5e: Preserve shared buffer capacity during headroom updates - net/mlx5: Base ECVF devlink port attrs from 0 - Octeontx2-af: Skip overlap check for SPI field - bonding: send LACPDUs periodically in passive mode after receiving partner's LACPDU - bonding: Add independent control state machine - bonding: update LACP activity flag after setting lacp_active - net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate - ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc - gve: prevent ethtool ops after shutdown - phy: mscc: Fix timestamping for vsc8584 - net: ethernet: mtk_ppe: add RCU lock around dev_fill_forward_path - ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add - net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM - ALSA: usb-audio: Fix size validation in convert_chmap_v3() - mlxsw: spectrum: Forward packets with an IPv4 link-local source IP - Bluetooth: hci_conn: do return error from hci_enhanced_setup_sync() - Bluetooth: hci_event: fix MTU for BN == 0 in CIS Established - scsi: qla4xxx: Prevent a potential error pointer dereference - RDMA/bnxt_re: Fix to initialize the PBL array - RDMA/bnxt_re: Fix to remove workload check in SRQ limit path - RDMA/bnxt_re: Fix to do SRQ armena by default - RDMA/erdma: Fix ignored return value of init_kernel_qp - iosys-map: Fix undefined behavior in iosys_map_clear() - cgroup/cpuset: Use static_branch_enable_cpuslocked() on cpusets_insane_config_key - spi: spi-fsl-lpspi: Clamp too high speed_hz - usb: typec: maxim_contaminant: disable low power mode when reading comparator values - usb: typec: maxim_contaminant: re-enable cc toggle if cc is open and port is clean - iio: imu: inv_icm42600: change invalid data error to -EBUSY - iio: imu: inv_icm42600: Convert to uXX and sXX integer types - iio: imu: inv_icm42600: use = { } instead of memset() - iio: imu: inv_icm42600: switch timestamp type from int64_t __aligned(8) to aligned_s64 - iio: temperature: maxim_thermocouple: use DMA-safe buffer for spi_read() - iio: light: as73211: Ensure buffer holes are zeroed - tls: fix handling of zero-length records on the rx_list - powerpc/boot: Fix build with gcc 15 - mmc: sdhci-pci-gli: GL9763e: Mask the replay timer timeout of AER - compiler: remove __ADDRESSABLE_ASM{_STR,}() again - drm/amd/display: Don't overclock DCE 6 by 15% - usb: dwc3: pci: add support for the Intel Wildcat Lake - usb: dwc3: Ignore late xferNotReady event to prevent halt timeout - USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles - usb: storage: realtek_cr: Use correct byte order for bcs->Residue - USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera - usb: renesas-xhci: Fix External ROM access timeouts - usb: core: hcd: fix accessing unmapped memory in SINGLE_STEP_SET_FEATURE test - comedi: Make insn_rw_emulate_bits() do insn->n samples - usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive - cdx: Fix off-by-one error in cdx_rpmsg_probe() - most: core: Drop device reference after usage in get_channel() - iio: proximity: isl29501: fix buffered read on big-endian systems - iio: pressure: bmp280: Use IS_ERR() in bmp280_common_probe() - fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable() - drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS - cpuidle: governors: menu: Avoid selecting states with too much latency - cpuidle: menu: Remove iowait influence - mmc: sdhci-pci-gli: Add a new function to simplify the code - mmc: sdhci-pci-gli: Use PCI AER definitions, not hard-coded values - mptcp: disable add_addr retransmission when timeout is 0 - mptcp: remove duplicate sk_reset_timer call - use uniform permission checks for all mount propagation changes - arm64: dts: ti: k3-am62-main: Remove eMMC High Speed DDR support - scsi: mpi3mr: Serialize admin queue BAR writes on 32-bit systems - scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers - scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE - PCI: imx6: Add IMX8MM_EP and IMX8MP_EP fixed 256-byte BAR 4 in epc_features - PCI: imx6: Delay link start until configfs 'start' written - PCI: rockchip: Set Target Link Speed to 5.0 GT/s before retraining - PCI: rockchip: Use standard PCIe definitions - drm/amd/display: Fill display clock and vblank time in dce110_fill_display_configs - drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs - drm/amd/display: Fix DP audio DTO1 clock source on DCE 6. - drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3 - ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and EliteBook 830 G6 - mm/debug_vm_pgtable: clear page table entries at destroy_args() - squashfs: fix memory leak in squashfs_fill_super - mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for consistency - memstick: Fix deadlock by moving removing flag earlier - KVM: arm64: Fix kernel BUG() due to bad backport of FPSIMD/SVE/SME fix - sched/fair: Fix frequency selection for non-invariant case - kbuild: userprogs: use correct linker when mixing clang and GNU ld - ata: libata-scsi: Return aborted command when missing sense and result TF - PM: runtime: Take active children into account in pm_runtime_get_if_in_use() - PM: runtime: Simplify pm_runtime_get_if_active() usage - ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig - usb: dwc3: imx8mp: fix device leak at unbind - wifi: mac80211: check basic rates validity in sta_link_apply_parameters - KVM: x86: Take irqfds.lock when adding/deleting IRQ bypass producer - s390/mm: Remove possible false-positive warning in pte_free_defer() - btrfs: send: make fs_path_len() inline and constify its argument - btrfs: send: use fallocate for hole punching with send stream v2 - btrfs: send: avoid path allocation for the current inode when issuing commands - btrfs: send: keep the current inode's path cached - btrfs: send: add and use helper to rename current inode when processing refs - btrfs: send: only use boolean variables at process_recorded_refs() - btrfs: send: factor out common logic when sending xattrs - btrfs: populate otime when logging an inode item - btrfs: constify more pointer parameters - btrfs: fix ssd_spread overallocation - btrfs: open code timespec64 in struct btrfs_inode - xfs: fully decouple XFS_IBULK* flags from XFS_IWALK* flags - btrfs: abort transaction on unexpected eb generation at btrfs_copy_root() - btrfs: always abort transaction on failure to add block group to free space tree - btrfs: move transaction aborts to the error site in add_block_group_free_space() - btrfs: qgroup: fix race between quota disable and quota rescan ioctl - usb: typec: fusb302: cache PD RX state - block: Make REQ_OP_ZONE_FINISH a write operation - block: reject invalid operation in submit_bio_noacct - leds: flash: leds-qcom-flash: Fix registry access after re-bind - leds: flash: leds-qcom-flash: Limit LED current based on thermal condition - selftests/memfd: add test for mapping write-sealed memfd read-only - mm: update memfd seal write check to include F_SEAL_WRITE - mptcp: pm: kernel: flush: do not reset ADD_ADDR limit - mptcp: drop skb if MPTCP skb extension allocation fails - ipv6: sr: Fix MAC comparison to be constant-time - drm/amd/display: Don't overwrite dce60_clk_mgr - drm/amd/display: Add primary plane to commits for correct VRR handling - drm/amdkfd: Destroy KFD debugfs after destroy KFD wq - drm/amdgpu: update mmhub 3.0.1 client id mappings - drm/amdgpu: Avoid extra evict-restore process. - drm/amd: Restore cached power limit during resume - media: venus: venc: Clamp param smaller than 1fps and bigger than 240 - media: venus: vdec: Clamp param smaller than 1fps and bigger than 240. - media: venus: protect against spurious interrupts during probe - media: venus: hfi: explicitly release IRQ during teardown - media: qcom: camss: cleanup media device allocated resource on error path - media: ov2659: Fix memory leaks in ov2659_probe() - media: usbtv: Lock resolution while streaming - media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free() - media: verisilicon: Fix AV1 decoder clock frequency - media: vivid: fix wrong pixel_array control size - media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init() - media: hi556: correct the test pattern configuration - media: gspca: Add bounds checking to firmware parser - parisc: Update comments in make_insert_tlb - parisc: Try to fixup kernel exception in bad_area_nosemaphore path of do_page_fault() - parisc: Rename pte_needs_flush() to pte_needs_cache_flush() in cache.c - parisc: Makefile: explain that 64BIT requires both 32-bit and 64-bit compilers - parisc: Define and use set_pte_at() - parisc: Check region is readable by user in raw_copy_from_user() - soc/tegra: pmc: Ensure power-domains are in a known state - f2fs: fix to avoid out-of-boundary access in dnode page - phy: qcom: phy-qcom-m31: Update IPQ5332 M31 USB phy initialization sequence - vhost/vsock: Avoid allocating arbitrarily-sized SKBs - PCI: endpoint: Fix configfs group removal on driver teardown - PCI: endpoint: Fix configfs group list head handling - mtd: rawnand: renesas: Add missing check after DMA map - mtd: rawnand: fsmc: Add missing check after DMA map - mtd: spinand: propagate spinand_wait() errors from spinand_write_page() - mtd: spi-nor: Fix spi_nor_try_unlock_all() - hwmon: (gsc-hwmon) fix fan pwm setpoint show functions - pwm: mediatek: Fix duty and period setting - pwm: mediatek: Handle hardware enable and clock enable separately - pwm: imx-tpm: Reset counter if CMOD is 0 - wifi: ath11k: fix dest ring-buffer corruption when ring is full - wifi: ath11k: fix source ring-buffer corruption - wifi: ath11k: fix dest ring-buffer corruption - wifi: ath12k: fix dest ring-buffer corruption when ring is full - wifi: ath12k: fix source ring-buffer corruption - wifi: ath12k: fix dest ring-buffer corruption - wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table() - iio: adc: ad_sigma_delta: change to buffer predisable - zynq_fpga: use sgtable-based scatterlist wrappers - scsi: ufs: ufs-pci: Fix default runtime and system PM levels - scsi: ufs: ufs-pci: Fix hibernate state transition for Intel MTL-like host controllers - ata: libata-scsi: Fix ata_to_sense_error() status handling - scsi: mpi3mr: Fix race between config read submit and interrupt completion - dt-bindings: display: sprd,sharkl3-dsi-host: Fix missing clocks constraints - dt-bindings: display: sprd,sharkl3-dpu: Fix missing clocks constraints - arm64: dts: ti: k3-am62-verdin: Enable pull-ups on I2C buses - arm64: dts: ti: k3-am62a7-sk: fix pinmux for main_uart1 - arm64: dts: ti: k3-pinctrl: Enable Schmitt Trigger by default - btrfs: zoned: fix write time activation failure for metadata block group - ext4: fix hole length calculation overflow in non-extent inodes - ext4: don't try to clear the orphan_present feature block device is r/o - ext4: fix reserved gdt blocks handling in fsmap - ext4: fix fsmap end of range reporting with bigalloc - ext4: check fast symlink for ea_inode correctly - tracing: fprobe-event: Sanitize wildcard for fprobe event name - crypto: qat - lower priority for skcipher and aead algorithms - lib/crypto: mips/chacha: Fix clang build and remove unneeded byteswap - vt: defkeymap: Map keycodes above 127 to K_HOLE - vt: keyboard: Don't process Unicode characters in K_OFF mode - bus: mhi: host: Fix endianness of BHI vector table - usb: dwc3: meson-g12a: fix device leaks at unbind - usb: musb: omap2430: fix device leak at unbind - usb: gadget: udc: renesas_usb3: fix device leak at unbind - usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init() - m68k: Fix lost column on framebuffer debug console - platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister() - cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table() - rcu: Fix racy re-initialization of irq_work causing hangs - HID: apple: avoid setting up battery timer for devices without battery - HID: magicmouse: avoid setting up battery timer when not needed - RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages - tools/nolibc: fix spelling of FD_SETBITMASK in FD_* macros - media: uvcvideo: Do not mark valid metadata as invalid - media: venus: Fix OOB read due to missing payload bound check - parisc: Makefile: fix a typo in palo.conf - fbdev: Fix vmalloc out-of-bounds write in fast_imageblit - btrfs: do not allow relocation of partially dropped subvolumes - btrfs: zoned: do not select metadata BG as finish target - btrfs: clear dirty status from extent buffer on error at insert_new_root() - btrfs: zoned: do not remove unwritten non-data block group - btrfs: abort transaction during log replay if walk_log_tree() failed - btrfs: zoned: use filesystem size not disk size for reclaim decision - cdc-acm: fix race between initial clearing halt and open - thunderbolt: Fix copy+paste error in match_service_id() - usb: typec: ucsi: Update power_supply on power role change - misc: rtsx: usb: Ensure mmc child device is active when card is present - iommufd: Report unmapped bytes in the error path of iopt_unmap_iova_range - cifs: reset iface weights when we cannot find a candidate - drm/amdgpu: fix incorrect vm flags to map bo - scsi: lpfc: Remove redundant assignment to avoid memory leak - rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe - pNFS: Handle RPC size limit for layoutcommits - pNFS: Fix disk addr range check in block/scsi layout - pNFS: Fix stripe mapping in block/scsi layout - ASoC: Intel: avs: Fix uninitialized pointer error in probe() - net: phy: smsc: add proper reset flags for LAN8710A - ipmi: Fix strcpy source and destination the same - kconfig: lxdialog: fix 'space' to (de)select options - kconfig: gconf: fix potential memory leak in renderer_edited() - kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed() - ipmi: Use dev_warn_ratelimited() for incorrect message warnings - vfio/mlx5: fix possible overflow in tracking max message size - scsi: aacraid: Stop using PCI_IRQ_AFFINITY - scsi: target: core: Generate correct identifiers for PR OUT transport IDs - scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans - kconfig: nconf: Ensure null termination where strncpy is used - vfio/type1: conditional rescheduling while pinning - kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c - f2fs: check the generic conditions first - exfat: add cluster chain loop check for dir - i2c: Force DLL0945 touchpad i2c freq to 100khz - apparmor: use the condition in AA_BUG_FMT even with debug disabled - dm-table: fix checking for rq stackable devices - dm-mpath: don't print the "loaded" message if registering fails - i3c: master: Initialize ret in i3c_i2c_notifier_call() - i3c: don't fail if GETHDRCAP is unsupported - apparmor: shift ouid when mediating hard links in userns - rtc: ds1307: handle oscillator stop flag (OSF) for ds1341 - i3c: add missing include to internal header - module: Prevent silent truncation of module name in delete_module(2) - md: dm-zoned-target: Initialize return variable r to avoid uninitialized use - soundwire: Move handle_nested_irq outside of sdw_dev_lock - soundwire: amd: serialize amd manager resume sequence during pm_prepare - crypto: octeontx2 - add timeout for load_fvc completion poll - media: uvcvideo: Fix bandwidth issue for Alcor camera - media: usb: hdpvr: disable zero-length read messages - media: tc358743: Increase FIFO trigger level to 374 - media: tc358743: Return an appropriate colorspace from tc358743_set_fmt - media: tc358743: Check I2C succeeded during probe - pinctrl: stm32: Manage irq affinity settings - scsi: mpi3mr: Correctly handle ATA device errors - scsi: mpt3sas: Correctly handle ATA device errors - power: supply: qcom_battmgr: Add lithium-polymer entry - RDMA/core: reduce stack using in nldev_stat_get_doit() - dmaengine: stm32-dma: configure next sg only if there are more than 2 sgs - leds: leds-lp50xx: Handle reg to get correct multi_index - media: v4l2-common: Reduce warnings about missing V4L2_CID_LINK_FREQ control - MIPS: lantiq: falcon: sysctrl: fix request memory check logic - crypto: jitter - fix intermediary handling - watchdog: iTCO_wdt: Report error if timeout configuration fails - MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free} - clk: qcom: ipq5018: keep XO clock always on - hwmon: (emc2305) Set initial PWM minimum value during probe based on thermal state - watchdog: dw_wdt: Fix default timeout - fs/orangefs: use snprintf() instead of sprintf() - phy: rockchip-pcie: Properly disable TEST_WRITE strobe signal - mfd: axp20x: Set explicit ID for AXP313 regulator - clk: tegra: periph: Fix error handling and resolve unsigned compare warning - fbdev: fix potential buffer overflow in do_register_framebuffer() - cifs: Fix calling CIFSFindFirst() for root path without msearch - watchdog: sbsa: Adjust keepalive timeout to avoid MediaTek WS0 race condition - drm/amd/display: Avoid configuring PSR granularity if PSR-SU not supported - drm/amd/display: Only finalize atomic_obj if it was initialized - vhost: fail early when __vhost_add_used() fails - vsock/virtio: Resize receive buffers so that each SKB fits in a 4K page - net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325 - rcu: Fix rcu_read_unlock() deadloop due to IRQ work - drm/amd/display: Avoid trying AUX transactions on disconnected ports - selftests/bpf: Fix a user_ringbuf failure with arm64 64KB page size - bpf: Make reg_not_null() true for CONST_PTR_TO_MAP - uapi: in6: restore visibility of most IPv6 socket options - drm/ttm: Should to return the evict error - drm: renesas: rz-du: mipi_dsi: Add min check for VCLK range - net: ncsi: Fix buffer overflow in fetching version id - ionic: clean dbpage in de-init - wifi: rtlwifi: fix possible skb memory leak in _rtl_pci_init_one_rxdesc() - ptp: Use ratelimite for freerun error message - bpftool: Fix JSON writer resource leak in version command - net: dsa: b53: prevent SWITCH_CTRL access on BCM5325 - net: dsa: b53: prevent DIS_LEARNING access on BCM5325 - net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325 - net: dsa: b53: fix b53_imp_vlan_setup for BCM5325 - gve: Return error for unknown admin queue command - net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs - net: vlan: Make is_vlan_dev() a stub when VLAN is not configured - drm/amd: Allow printing VanGogh OD SCLK levels without setting dpm to manual - dpaa_eth: don't use fixed_phy_change_carrier - wifi: iwlegacy: Check rate_idx range after addition - netmem: fix skb_frag_address_safe with unreadable skbs - powerpc: floppy: Add missing checks after DMA map - wifi: ath12k: Decrement TID on RX peer frag setup error handling - wifi: ath12k: Enable REO queue lookup table feature on QCN9274 hw2.0 - wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`. - wifi: mac80211: update radar_required in channel context after channel switch - drm/amd/display: Fix 'failed to blank crtc!' - wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect - wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd() - wifi: ath12k: Add memset and update default rate value in wmi tx completion - drm/amd/display: Separate set_gsl from set_gsl_source_select - net: fec: allow disable coalescing - net: atlantic: add set_power to fw_ops for atl2 to fix wol - net: thunderbolt: Fix the parameter passing of tb_xdomain_enable_paths()/tb_xdomain_disable_paths() - net: thunderbolt: Enable end-to-end flow control also in transmit - kselftest/arm64: Specify SVE data when testing VL set in sve-ptrace - wifi: mt76: mt7915: mcu: re-init MCU before loading FW patch - wifi: rtw89: Disable deep power saving for USB/SDIO - wifi: rtw89: Fix rtw89_mac_power_switch() for USB - drm/msm: use trylock for debugfs - wifi: mac80211: fix rx link assignment for non-MLO stations - ipv6: mcast: Check inet6_dev->dead under idev->mc_lock in __ipv6_dev_mc_inc(). - (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer - wifi: mac80211: don't complete management TX on SAE commit - sched/fair: Bump sd->max_newidle_lb_cost when newidle balance fails - s390/stp: Remove udelay from stp_sync_clock() - wifi: iwlwifi: mvm: fix scan request validation - um: Re-evaluate thread flags repeatedly - wifi: iwlwifi: mvm: set gtk id also in older FWs - perf/cxlpmu: Remove unintended newline from IRQ name format string - net: phy: micrel: Add ksz9131_resume() - net: thunderx: Fix format-truncation warning in bgx_acpi_match_id() - net: ipv4: fix incorrect MTU in broadcast routes - wifi: cfg80211: Fix interface type validation - net: mctp: Prevent duplicate binds - arm64: Mark kernel as tainted on SAE and SError panic - net/mlx5e: Properly access RCU protected qdisc_sleeping variable - net: ag71xx: Add missing check after DMA map - et131x: Add missing check after DMA map - wifi: rtw89: Lower the timeout in rtw89_fw_read_c2h_reg() for USB - be2net: Use correct byte order and format string for TCP seq and ack_seq - s390/time: Use monotonic clock in get_cycles() - wifi: cfg80211: reject HTC bit for management frames - ktest.pl: Prevent recursion of default variable options - wifi: ath12k: Correct tid cleanup when tid setup fails - net: usb: cdc-ncm: check for filtering capability - xen/netfront: Fix TX response spurious interrupts - Bluetooth: hci_sock: Reset cookie to zero in hci_sock_free_cookie() - powerpc/thp: tracing: Hide hugepage events under CONFIG_PPC_BOOK3S_64 - ASoC: qcom: use drvdata instead of component to keep id - ASoC: codecs: rt5640: Retry DEVICE_ID verification - iio: adc: ad7768-1: Ensure SYNC_IN pulse minimum timing requirement - ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros - ALSA: pcm: Rewrite recalculate_boundary() to avoid costly loop - platform/chrome: cros_ec_typec: Defer probe on missing EC parent - platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches - soc: qcom: mdt_loader: Actually use the e_phoff - imx8m-blk-ctrl: set ISI panic write hurry level - pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop() - usb: core: usb_submit_urb: downgrade type check - usb: typec: intel_pmc_mux: Defer probe if SCU IPC isn't present - ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4 - ASoC: hdac_hdmi: Rate limit logging on connection and disconnection - ALSA: hda: Disable jack polling at shutdown - ALSA: hda: Handle the jack polling always via a work - mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode() - mei: bus: Check for still connected devices in mei_cl_bus_dev_release() - char: misc: Fix improper and inaccurate error code returned by misc_init() - reset: brcmstb: Enable reset drivers for ARCH_BCM2835 - pps: clients: gpio: fix interrupt handling order in remove path - ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path - mmc: sdhci-msm: Ensure SD card power isn't ON when card removed - ACPI: processor: fix acpi_object initialization - PM: sleep: console: Fix the black screen issue - thermal: sysfs: Return ENODATA instead of EAGAIN for reads - PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit() - firmware: tegra: Fix IVC dependency problems - ACPI: PRM: Reduce unnecessary printing to avoid user confusion - selftests: tracing: Use mutex_unlock for testing glob filter - tools/build: Fix s390(x) cross-compilation with clang - gpio: tps65912: check the return value of regmap_update_bits() - iio: adc: ad_sigma_delta: don't overallocate scan buffer - tools/nolibc: define time_t in terms of __kernel_old_time_t - thermal/drivers/qcom-spmi-temp-alarm: Enable stage 2 shutdown when required - ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed - EDAC/synopsys: Clear the ECC counters on init - gpio: wcd934x: check the return value of regmap_update_bits() - remoteproc: imx_rproc: skip clock enable when M-core is managed by the SCU - soc: qcom: rpmh-rsc: Add RSC version 4 support - usb: xhci: Avoid showing errors during surprise removal - usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command - usb: xhci: Avoid showing warnings for dying controller - usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default - selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t - cpufreq: CPPC: Mark driver with NEED_UPDATE_LIMITS flag - platform/x86/amd: pmc: Add Lenovo Yoga 6 13ALC6 to pmc quirk list - usb: xhci: print xhci->xhc_state when queue_command failed - tracefs: Add d_delete to remove negative dentries - securityfs: don't pin dentries twice, once is enough... - fix locking in efi_secret_unlink() - ext2: Handle fiemap on empty files to prevent EINVAL - fs/ntfs3: correctly create symlink for relative path - fs/ntfs3: Add sanity check for file name - better lockdep annotations for simple_recursive_removal() - hfs: fix not erasing deleted b-tree node issue - drbd: add missing kref_get in handle_write_conflicts - udf: Verify partition map count - gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops - nvme-pci: try function level reset on init failure - smb/server: avoid deadlock when linking with ReplaceIfExists - arm64: Handle KCOV __init vs inline mismatches - ptp: prevent possible ABBA deadlock in ptp_clock_freerun() - intel_idle: Allow loading ACPI tables for any family - net: ti: icss-iep: Fix incorrect type for return value in extts_enable() - netfilter: ctnetlink: fix refcount leak on table dump - udp: also consider secpath when evaluating ipsec use for checksumming - KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs - KVM: nVMX: Check vmcs12->guest_ia32_debugctl on nested VM-Enter - KVM: VMX: Extract checking of guest's DEBUGCTL into helper - KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported - KVM: VMX: Handle forced exit due to preemption timer in fastpath - KVM: VMX: Re-enter guest in fastpath for "spurious" preemption timer exits - KVM: x86: Plumb "force_immediate_exit" into kvm_entry() tracepoint - libceph: prevent potential out-of-bounds reads in handle_auth_done() - net: usb: pegasus: fix memory leak in update_eth_regs_async() - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() - !20540 urma: added support for ipoverurma - team: fix check for port enabled in team_queue_override_port_prio_changed() - mm/page_alloc: prevent pcp corruption with SMP=n - !20528 Fix CVE-2025-71083 - KVM: nVMX: Defer SVI update to vmcs01 on EOI when L2 is active w/o VID - KVM: x86: Plumb in the vCPU to kvm_x86_ops.hwapic_isr_update() - KVM: SVM: Set RFLAGS.IF=1 in C code, to get VMRUN out of the STI shadow - smb: client: don't wait for info->send_pending == 0 on error - smb: client: let send_done() cleanup before calling smbd_disconnect_rdma_connection() - ACPI: processor: perflib: Move problematic pr->performance check - ACPI: processor: perflib: Fix initial _PPC limit application - Documentation: ACPI: Fix parent device references - fs: Prevent file descriptor table allocations exceeding INT_MAX - sunvdc: Balance device refcount in vdc_port_mpgroup_check - PCI: Extend isolated function probing to LoongArch - NFSD: detect mismatch of file handle and delegation stateid in OPEN op - net: dpaa: fix device leak when querying time stamp info - net: ti: icss-iep: fix device and OF node leaks at probe - net: mtk_eth_soc: fix device leak at probe - net: enetc: fix device and OF node leak at probe - net: gianfar: fix device leak when querying time stamp info - net: phy: micrel: fix KSZ8081/KSZ8091 cable test - gpio: mlxbf3: use platform_get_irq_optional() - gpio: mlxbf2: use platform_get_irq_optional() - gpio: virtio: Fix config space reading. - ALSA: hda/realtek: Add Framework Laptop 13 (AMD Ryzen AI 300) to quirks - ALSA: hda/realtek: Fix headset mic on HONOR BRB-X - ALSA: usb-audio: Validate UAC3 cluster segment descriptors - rcu: Fix racy re-initialization of irq_work causing hangs - rcu: Fix rcu_read_unlock() deadloop due to IRQ work - drm/tilcdc: Fix removal actions in case of failed probe - drm/tilcdc: request and mapp iomem with devres - urma: fix update topo logic - dmaengine: stm32: dmamux: fix device leak on route allocation - pswiotlb: Adapt to the IOMMU DMA API upgraded by IOMMUFD - null_blk: fix kmemleak by releasing references to fault configfs items - inet: frags: flush pending skbs in fqdir_pre_exit() - inet: frags: add inet_frag_queue_flush() - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() - md/dm-raid: don't clear MD_RECOVERY_FROZEN after setting frozen - md/dm-raid: don't call md_reap_sync_thread() directly - ACPICA: Avoid walking the Namespace if start_node is NULL - arm64: entry: xcall/xint: make asm conditionals compatible with clang IAS - LoongArch: BPF: Sign extend kfunc call arguments - genirq/msi:: Fix kabi break of struct msi_desc - genirq/msi: Store the IOMMU IOVA directly in msi_desc instead of iommu_cookie - NFS: Fix a deadlock involving nfs_release_folio() - Revert "[Huawei] Revert "NFS: fix up nfs_release_folio() to try to release the page"" - urma: added support for ipoverurma - drm/ttm: Avoid NULL pointer deref for evicted BOs - XSched: Update XSched manual - svcrdma: bound check rq_pages index in inline path - ipv6: Fix use-after-free in inet6_addr_del(). - ipv4: ip_gre: make ipgre_header() robust - net: fix memory leak in skb_segment_list for GRO packets - net: sock: fix hardened usercopy panic in sock_recv_errqueue - ipv4: Fix reference count leak when using error routes with nexthop objects - SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf - fbdev: Fix vmalloc out-of-bounds write in fast_imageblit - udp: Deal with race between UDP socket address change and rehash - EDAC/amd64: The width of hash value is 2 bits for Hygon family 18h model 6h processors - x86/tsc: Use topology_max_packages() to get package number - EDAC/amd64: Use unicast instead of broadcast to access the cs_config register - EDAC/amd64: Correct the address translation for hygon family 18h model 4h - KVM: arm64: Mark some header functions as inline - KVM: arm64: Refactor exit handlers - x86/resctrl: Fix memory bandwidth counter width for Hygon CPUs - hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio - !20820 ub/obmm: add sysfs interface for mempool statistics & bugfixes - ub/obmm: fix wrong pxm_numa parameter validation - ub/obmm: Remove unused parameters from obmm_addr_check.c - ub/obmm: Enhance mem_allocator_granu validation - ub/obmm: simplify allocator naming scheme - ub/obmm: fix allow_slow logic and optimize conti_alloc_memory - ub/obmm: add sysfs interface with fine-grained memory statistics - !20804 net: hv_netvsc: reject RSS hash key programming without RX indirection table - !20813 migrate: correct lock ordering for hugetlb file folios - !20812 libceph: make calc_target() set t->paused, not just clear it - !20719 drivers/ub/sentry: some bugfix - !20798 urma: log should not retrieve eid_idx from uctx - !20808 urma: support triple bonding device - urma: log should not retrieve eid_idx from uctx - migrate: correct lock ordering for hugetlb file folios - libceph: make calc_target() set t->paused, not just clear it - !20745 vfio platform VFIO support for hisi05a1 devices - urma: support triple bonding device - net: hv_netvsc: reject RSS hash key programming without RX indirection table - !20789 gic: Add hip09 support for HISILICON_ERRATUM_165010801 - !20726 tracing: Add recursion protection in kernel stack trace recording - !20668 irqchip/gic-v3-its: Avoid truncating memory addresses - !20795 ub: udma: support query and set qos info. - !20791 Migration/urma:optimize performance in live migration. - ub: udma: Support for UE link establishment message. - Migration/urma: optimize performance in live migration. - !20787 ub: cdma: modify the method of assigning values to the structure - !20759 ubcore: hotfix route query for port eid on the same node. - ub: udma: support query and set qos info. - Revert "ub: ubase: Support for RC saved by queue granularity" - ubcore: hotfix route query for port eid on the same node. - !20676 urma: set/get sl - !20765 urma: bugfix of UAF and double free in ubcm - !20778 ub: ubase&unic: Fixes some bugfix in resetting and dfx ability - gic: Add hip09 support for HISILICON_ERRATUM_165010801 - vfio/platform: Add CONFIG_VFIO_HISI05A1 to openeuler_defconfig and turn it on by default - vfio/platform: VFIO support for hisi05a1 devices - ub: cdma: modify the method of assigning values to the structure - urma: set/get sl - ub: ubase: support to query ub dl pkt stats and real-time peak bandwidth - ub: ubase: Support for RC saved by queue granularity - ub: ubase: Traverse mailbox AE events using interrupts and polling. - ub: ubase: Modify ubase ctrlq trace to distinguish between MUE and UE messages - net: unic: The function of dumping himac registers is added. - ub: ubase: Fix MAC is_pfc sync, optimize list ops and code style - ub: ubase: Retain the initial tm qset configuration and restore it - net: unic: Fixed an issue in the bond IP address notification and pause configuration when an exception occurs. - ub: ubase: Add a retransmission function to improve reliability. - net: unic: Increase the readability and reliability of loopback code - net: unic: Synchronize the code modify for ip management and deactivation - net: unic: Increase the readability and reliability of VLAN feature. - net: unic: Added unic DFX log information. - ub: ubase: Add and correct comments for some functions and data structures - net: unic: Notify MAMI when the bond port status changes - ub: ubase: Support for HIMAC reset during ELR reset and Optimize ELR reset - !20768 iommu/ummu-core: Fix separate page table compatibility - !20665 [OLK-6.6] Enhance CMA memory usage reporting for CSV3 - !20764 net: hns3: fix double free issue for tx spare buffer - urma: bugfix of UAF and double free in ubcm - iommu/ummu-core: Fix separate page table compatibility - net: hns3: fix double free issue for tx spare buffer - drivers/ub/sentry: fix memory leak in sentry_msg_helper - drivers/ub/sentry: initialize some variables - drivers/ub/sentry: fix potential buffer overflow in convert_str_to_smh_msg() - drivers/ub/sentry: fix potential null pointer reference in sentry_uvb_comm - drivers/ub/sentry: add input parameter verification for exported symbols - tracing: Add recursion protection in kernel stack trace recording - x86/csv: Enhance CMA memory usage reporting for CSV3 - irqchip/gic-v3-its: Avoid truncating memory addresses - change the package name of 64KB page size kernel to kernel-64k - !20704 kernel support hisi-cca-da - !20180 [virtCCA Live Migration 2]virtcca secure cvm supports live migration - !20905 v2 KVM: arm64: Fix softirq masking in FPSIMD register saving sequence - !20965 iommu/ummu: Optimized TID invalidation and tdev initialization - !20964 iommu/ummu: Support TID and EID Granularity for MPAM - !20970 ub: ubase&unic: Supporting the black box capability of the ubase&unic driver - hisi-cca-da: Start dev by rsi call - hisi-cca-da: Set ripas of the bar region as RIPAS_DEV - hisi-cca-da: Support swiotlb and realm memory use - hisi-cca-da: Add smmu info when dev attach - hisi-cca-da: Transfer realm msix access to rmm - hisi-cca-da: Support pcipc sriov capability - hisi-cca-da: Delay realm memory release to kvm_destroy_realm - hisi-cca-da: Create realm s2 host pgtable and map msi mmio to rmm - hisi-cca-da: Add cca realm s2 pgtable framework - hisi-cca-da: Use bitmap to determine whether the command can be forwarded - hisi-cca-da: Restrict Realm SMMU to stage-2 domain only - hisi-cca-da: Add cmd forward mechanism in realm smmu - hisi-cca-da: Add realm smmu event and gerror irq initialization - hisi-cca-da: Add realm smmu stream table initialization - hisi-cca-da: Add realm smmu cmdq and evtq initialization - hisi-cca-da: Add realm smmu initialization - hisi-cca-da: Add relam iommu support to iommufd - hisi-cca-da: Add realm iommu support for vfio-iommu-type1 - hisi-cca-da: Support dev map and unmap - hisi-cca-da: Support dev validate and dev start - hisi-cca-da: VFIO support ccada - hisi-cca-da: Support dev delegate and dev attach - hisi-cca-da: Support root dev delegate and dev init - hisi-cca-da: Add hisilicon extension smc and ccada cmd - hisi-cca-da: Add hisi ccada feature config - !20751 ARM CCA supports hugepage - !20944 ub: ubmempfd: supports for D2H mapping and demapping - !20888 HiSock Enhancement - ub: ubase&unic: Supporting the black box capability of the ubase&unic driver. - net: unic: Resolve the residual MAC address problem - net: unic: Optimized the code for the cmd structure and FEC function. - ub: ubase: add log for post mailbox timeout - ub: ubus: Remove black box header file to include dir - rme: Remove the secret bit of the vring desc addr - rme: improve hisi-cca data mmap and destroy method - !20943 uvb: fix wd_obtain logic err - !20942 urma: fix bond device id not release - !20892 dcache: Limit the minimal number of bucket to two - rme: isolate page when do delegation to avoid migration - rme: hisi-cca supports different levels for mapping ram - rme: rename ccal to hisi-cca - rme: support set ripas for ccal realm vm - rme: support destroy ram data for ccal realm vm - rme: support populate region for ccal realm vm - rme: support map ram for ccal realm vm - rme: support config ccal realm vm - rme: support ccal RMI calls - rme: realm vm supports wfx handler - !20952 urma: introduce ipourma module - iommu/ummu-core: Simplifies tdev initialization resources - iommu/ummu: Optimized log printing - iommu/ummu: Use passed gfp_mask in map_pages callback - uvb: fix wd_obtain logic err - !20949 ub: udma: support user ctl function. - urma: fix bond device id not release - !20901 drivers/ub/sentry: some bugfix - ub: ubmempfd: supports for D2H mapping and demapping - ub: ubmempfd: supports providing services to the QEMU process through file nodes - [virtCCA Live Migration 2]virtcca secure cvm supports live migration - urma: query priority and enable bit, support ring size configuration - urma: implement debugfs, improve boundary checks and error handling logic - urma: implement data plane interaction and statistics - urma: implement ipourma network device operations - urma: ipourma resource management - urma: ipourma resource management and err code - urma: introduce ipourma main module - iommu/ummu: Optimized the TID invalidation configuration - iommu/ummu: Optimized SVA permission table memory allocation approach - iommu/ummu: Adapt UMMU SVA interface adjustment - iommu/ummu: Support TID and EID Granularity for MPAM - !20848 [OLK-6.6] backport important bugfix for nvme driver from upstream linux-6.6.y - !20847 urma: sl resource query error - !20908 [OLK-6.6][linux-6.6.y sync] Backport 6.6.108-6.6.110 LTS Patches - !20084 Loongarch: Enable CONFIG_CRYPTO_XTS for disk encryption - !20929 PCI: Fix NVMe link speed downgrade to 2.5GT/s during hotplug - drivers/ub/sentry: fix check input parameters - ub: udma: support user ctl function. - ub: udma: support uboe function. - ub: udma: bugfix related to query aux info. - !20935 ub: ubmem_vmmu: supports IOMMU driver for the UB memory MMU in VMs - drivers/ub/sentry: do not use magic numbers - !20876 urma: Kernel-mode specific implementations file for Jetty extension interface - urma: sl resource query error - !20873 sunrpc: fix NULL pointer dereference in rpcb_register_inet6 and rpcb_register_inet4 - !20875 sunrpc: fix race in cache cleanup causing stale nextcheck time - ub: ubmem_vmmu: supports IOMMU driver for the UB memory MMU in VMs - ub: ubmem_vmmu: supports parsing and configuring the hardware node information - ub: ubmem_vmmu: HiSilicon ubmem_vmmu Architecture Implementation - !20806 Fix CVE-2025-71225 - !20896 scsi: qla2xxx: Free sp in error path to fix system crash - !20894 scsi: qla2xxx: Delay module unload while fabric scan in progress - !20893 scsi: qla2xxx: Validate sp before freeing associated memory - !20802 Fix CVE-2026-23110 - urma: Kernel-mode specific implementations file for Jetty extension interface - drivers/ub/sentry: fix memory leak in process_urma_data() - drivers/ub/sentry: initialize some variables - PCI: Fix NVMe link speed downgrade to 2.5GT/s during hotplug - !20770 ub: ubdevshm: supports the memory user to obtain and release shared memory - Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 - mm: consider non-anon swap cache folios in folio_expected_ref_count() - mm: simplify folio_expected_ref_count() - ASoC: qcom: audioreach: fix potential null pointer dereference - gcc-plugins: Remove TODO_verify_il for GCC >= 16 - crypto: sha256 - fix crash at kexec - drm/i915/backlight: Return immediately when scale() finds invalid parameters - minmax.h: remove some #defines that are only expanded once - minmax.h: simplify the variants of clamp() - minmax.h: move all the clamp() definitions after the min/max() ones - minmax.h: use BUILD_BUG_ON_MSG() for the lo < hi test in clamp() - minmax.h: reduce the #define expansion of min(), max() and clamp() - minmax.h: update some comments - minmax.h: add whitespace around operators and after commas - minmax: fix up min3() and max3() too - minmax: improve macro expansion and type checking - minmax: don't use max() in situations that want a C constant expression - minmax: simplify min()/max()/clamp() implementation - minmax: make generic MIN() and MAX() macros available everywhere - drm/ast: Use msleep instead of mdelay for edid read - gpiolib: Extend software-node support to support secondary software-nodes - ARM: bcm: Select ARM_GIC_V3 for ARCH_BRCMSTB - s390/cpum_cf: Fix uninitialized warning after backport of ce971233242b - kmsan: fix out-of-bounds access to shadow memory - afs: Fix potential null pointer dereference in afs_put_server - ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address - i40e: improve VF MAC filters accounting - i40e: add mask to apply valid bits for itr_idx - HID: asus: add support for missing PX series fn keys - drm/gma500: Fix null dereference in hdmi teardown - octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() - net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port - net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() - net: dsa: lantiq_gswip: do also enable or disable cpu port - selftests: fib_nexthops: Fix creation of non-FDB nexthops - net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS - bnxt_en: correct offset handling for IPv6 destination address - vhost: Take a reference on the task in struct vhost_task. - Bluetooth: hci_sync: Fix hci_resume_advertising_sync - ethernet: rvu-af: Remove slash from the driver name - can: peak_usb: fix shift-out-of-bounds issue - can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow - can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow - can: hi311x: populate ndo_change_mtu() to prevent buffer overflow - can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow - bpf: Reject bpf_timer for PREEMPT_RT - can: rcar_can: rcar_can_resume(): fix s2ram with PSCI - wifi: virt_wifi: Fix page fault on connect - cpufreq: Initialize cpufreq-based invariance before subsys - ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients - arm64: dts: imx8mp: Correct thermal sensor index - mm: folio_may_be_lru_cached() unless folio_test_large() - mm/gup: local lru_add_drain() to avoid lru_add_drain_all() - mm/gup: check ref_count instead of lru before migration - mm: add folio_expected_ref_count() for reference count calculation - mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked" - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions - ALSA: usb-audio: Add mute TLV for playback volumes on more devices - ALSA: usb-audio: move mixer_quirks' min_mute into common quirk - ALSA: usb-audio: Add DSD support for Comtrue USB Audio device - i2c: designware: Add quirk for Intel Xe - mmc: sdhci-cadence: add Mobileye eyeQ support - usb: core: Add 0x prefix to quirks debug output - ALSA: usb-audio: Fix build with CONFIG_INPUT=n - ALSA: usb-audio: Convert comma to semicolon - ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 - ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks - ALSA: usb-audio: Simplify NULL comparison in mixer_quirks - ALSA: usb-audio: Avoid multiple assignments in mixer_quirks - ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks - ALSA: usb-audio: Fix block comments in mixer_quirks - firewire: core: fix overlooked update of subsystem ABI version - scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE - !20843 [OLK-6.6][linux-6.6.y sync] Backport 6.6.107-6.6.108 LTS Patches - !20869 ub:hisi-ubus: fix bug of security smatch - !20861 CVE-2026-23163 - ub: ubdevshm: supports the memory user to obtain and release shared memory - ub: ubdevshm: supports granting and revoking shared memory permissions - ub: ubdevshm: supports the registration and deregistration of shared memory segments - ub: ubdevshm: supports the registration and deregistration - KVM: arm64: Fix softirq masking in FPSIMD register saving sequence - !20886 Fix CVE-2026-23205 - !20803 Fix CVE-2026-23112 - !20868 sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure - !20811 smb/server: fix refcount leak in smb2_open() - !20810 smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() - !20809 smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() - sunrpc: fix NULL pointer dereference in rpcb_register_inet6 and rpcb_register_inet4 - sunrpc: fix race in cache cleanup causing stale nextcheck time - scsi: qla2xxx: Free sp in error path to fix system crash - scsi: qla2xxx: Delay module unload while fabric scan in progress - scsi: qla2xxx: Validate sp before freeing associated memory - dcache: Limit the minimal number of bucket to two - !20872 Fix CVE-2026-23220 - !20846 Fix CVE-2026-23193 - !20815 Fix CVE-2026-23216 - !20859 Fix CVE-2026-23179 - !20871 CVE-2026-23096 - !20858 ub: ubase: resolve the cmdq crq overflow problem - bpf: Deprecate hisock unused kfuncs and orig ingress logic - bpf: Add local connect support for hisock - bpf: Add ipv4-mapped ipv6 addr support for hisock - bpf: Add target comm parse to hisock_cmd - bpf: Add multi port parse to hisock_cmd - bpf: Only deploy hisock in server - bpf: Apply BPF_HISOCK_INGRESS to hisock ingress - bpf: Add bpf_handle_ingress/egress_ptype kfunc - bpf: Add bpf_get_skb_ethhdr kfunc - bpf: Add bpf_set_ingress/egress_dev kfunc - bpf: Add bpf_set_ingress_dst kfunc - bpf: Add BPF_HISOCK_INGRESS attach type - cgroup: make cgroup_bpf_prog_attach work when cgroup2 is not mounted - smb: client: fix potential UAF and double free in smb2_open_file() - smb/client: fix memory leak in smb2_open_file() - !20852 ASoC: amd: fix memory leak in acp3x pdm dma ops - ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths - uacce: fix cdev handling in the cleanup path - Revert "uacce: fix for cdev memory leak" - ub:hisi-ubus: fix bug of security smatch - ub:ubus: injected route event - ub:ubus: Black Box Development - !20865 urma: urma support uboe - sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure - urma: urma support uboe - !20857 ub_fwctl driver adds support for querying some functions - ub:ub_fwctl:Add illegal verification for scc - ub:ub_fwctl:Support querying the historical status of port links - drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove - drm/amdkfd: Don't use sw fault filter if retry cam enabled - ub:ub_fwctl:Support querying firmware version numbers - ub: ub_fwctl: Support querying real-time bandwidth statistics - ub:ub_fwctl:Support querying statistical indicators at the ub port and uboe port levels - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() - !20854 [URMA] add ping server for urma_ping - urma: add ping server - ub: ubase: resolve the cmdq crq overflow problem - ub: ubase: Optimized the QoS code naming to improve code readability. - ub: ubase&unic: optimizing code and configuration settings. - net: unic: not support query and configure ip by control plane in UBoE - net: unic: fix the automatically enable uc guid promisc mode. - !20844 urma:kernel header of userctl - urma: Kernel-mode header file for Jetty extension interface - ASoC: amd: fix memory leak in acp3x pdm dma ops - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() - phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again) - ACPICA: Work around bogus -Wstringop-overread warning since GCC 11 - !20835 Fix CVE-2026-23084 - minmax: add a few more MIN_T/MAX_T users - minmax: simplify and clarify min_t()/max_t() implementation - minmax: avoid overly complicated constant expressions in VM code - rtc: pcf2127: fix SPI command byte for PCF2131 backport - xhci: dbc: Fix full DbC transfer ring after several reconnects - xhci: dbc: decouple endpoint allocation from initialization - phy: ti: omap-usb2: fix device leak at unbind - phy: Use device_get_match_data() - drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path - ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message - ASoC: wm8974: Correct PLL rate rounding - ASoC: wm8940: Correct typo in control name - ASoC: wm8940: Correct PLL rate rounding - io_uring: include dying ring in task_work "should cancel" state - io_uring: backport io_should_terminate_tw() - ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx - selftests: mptcp: avoid spurious errors on TCP disconnect - selftests: mptcp: connect: catch IO errors on listen side - rds: ib: Increment i_fastreg_wrs before bailing out - KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active - mmc: mvsdio: Fix dma_unmap_sg() nents value - ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S - ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface - btrfs: tree-checker: fix the incorrect inode ref size check - iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page() - LoongArch: Check the return value when creating kobj - LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled - LoongArch: Update help info of ARCH_STRICT_ALIGN - nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* - octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() - net: liquidio: fix overflow in octeon_init_instr_queue() - bonding: don't set oif to bond dev when getting NS target destination - net/mlx5e: Consider aggregated port speed during rate configuration - i40e: remove redundant memory barrier when cleaning Tx descs - net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure - selftests: mptcp: sockopt: fix error messages - mptcp: tfo: record 'deny join id0' info - mptcp: set remote_deny_join_id0 on SYN recv - dpaa2-switch: fix buffer pool seeding for control traffic - btrfs: fix invalid extref key setup when replaying dentry - pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch - wifi: mac80211: fix incorrect type for ret - wifi: mac80211: increase scan_ies_len for S1G - ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported - !20769 [OLK-6.6][linux-6.6.y sync] Backport 6.6.106-6.6.107 LTS Patches - be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list - !20776 ub:ubfi: Release the chosen node - !20817 CVE-2026-23094 - !20819 dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() - ub:ubus: Add port num check - !20379 [OLK-6.6][sync from OLK-5.10]io_uring: Support forcing sq thread to be idle and woken up by hrtimer - !20830 sched/soft_domain: Increasing NR_MAX_CLUSTER to 32 - sched/soft_domain: Increasing NR_MAX_CLUSTER to 32 - btrfs: fix incorrect readahead expansion length - x86: disable image size check for test builds - drm/i915/power: fix size for for_each_set_bit() in abox iteration - drm/amdgpu: fix a memory leak in fence cleanup when unloading - net: mdiobus: release reset_gpio in mdiobus_unregister_device() - phy: ti-pipe3: fix device leak at unbind - phy: tegra: xusb: fix device and OF node leak at probe - dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate - usb: gadget: midi2: Fix MIDI2 IN EP max packet size - usb: gadget: midi2: Fix missing UMP group attributes initialization - USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels - RISC-V: Remove unnecessary include from compat.h - hrtimer: Rename __hrtimer_hres_active() to hrtimer_hres_active() - hrtimer: Remove unused function - regulator: sy7636a: fix lifecycle of power good gpio - dmaengine: ti: edma: Fix memory allocation size for queue_priority_map - hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr - hsr: use rtnl lock when iterating over ports - net: hsr: Add VLAN CTAG filter support - net: hsr: Add support for MC filtering at the slave device - can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB - can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails - can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed - igb: fix link test skipping when interface is admin down - docs: networking: can: change bcm_msg_head frames member to support flexible array - tunnels: reset the GSO metadata before reusing the skb - net: bridge: Bounce invalid boolopts - net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() - USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions - USB: serial: option: add Telit Cinterion FN990A w/audio compositions - dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks - serial: sc16is7xx: fix bug in flow control levels init - tty: hvc_console: Call hvc_kick in hvc_write unconditionally - Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups" - Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table - Input: iqs7222 - avoid enabling unused interrupts - mm/khugepaged: fix the address passed to notifier on testing young - btrfs: fix corruption reading compressed range when block size is smaller than page size - btrfs: use readahead_expand() on compressed extents - mm/damon/sysfs: fix use-after-free in state_show() - mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing - mtd: nand: raw: atmel: Fix comment in timings preparation - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages - drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time - mm/damon/core: set quota->charged_from to jiffies at first charge window - fuse: prevent overflow in copy_file_range return value - fuse: check if copy_file_range() returns larger than requested size - mtd: rawnand: stm32_fmc2: fix ECC overwrite - mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer - net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups - i2c: i801: Hide Intel Birch Stream SoC TCO WDT - ocfs2: fix recursive semaphore deadlock in fiemap call - mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN - compiler-clang.h: define __SANITIZE_*__ macros only when undefined - EDAC/altera: Delete an inappropriate dma_free_coherent() call - rcu-tasks: Maintain real-time response in rcu_tasks_postscan() - rcu-tasks: Eliminate deadlocks involving do_exit() and RCU tasks - rcu-tasks: Maintain lists to eliminate RCU-tasks/do_exit() deadlocks - s390/cpum_cf: Deny all sampling events by counter PMU - NFSv4/flexfiles: Fix layout merge mirror check. - NFSv4.2: Serialise O_DIRECT i/o and copy range - NFSv4.2: Serialise O_DIRECT i/o and clone range - NFSv4.2: Serialise O_DIRECT i/o and fallocate() - NFS: Serialise O_DIRECT i/o and truncate() - fs/nfs/io: make nfs_start_io_*() killable - ftrace/samples: Fix function size computation - NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server - NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set - media: i2c: imx214: Fix link frequency validation - NFSD: nfsd_unlink() clobbers non-zero status returned from fh_fill_pre_attrs() - nfsd: Fix a regression in nfsd_setattr() - kasan: fix GCC mem-intrinsic prefix with sw tags - kunit: kasan_test: disable fortify string checker on kasan_strings() test - io_uring: fix kabi broken in struct io_ring_ctx - io_uring: Support forcing sq thread to be idle and woken up by hrtimer - dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() - uacce: fix isolate sysfs check condition - Revert "uacce: fix isolate sysfs check condition" - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() - smb/server: fix refcount leak in smb2_open() - smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() - smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() - md: suspend array while updating raid_disks via sysfs - scsi: core: Wake up the error handler when final completions race against each other - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec - ub:ubfi: Release the chosen node - ub:ubus: Delete unused functions - Loongarch: Enable CONFIG_CRYPTO_XTS for disk encryption - Add sw64 support in kernel.spec - !21194 hisi-cca-da: Revert smmu realm enabled condition for arm_smmu_domain_finalise. - !21192 urma: bugfix of ubagg&ubcore&uburma - !21183 platform/x86: classmate-laptop: Add missing NULL pointer checks - urma: bugfix of ubagg&ubcore&uburma - hisi-cca-da: Revert smmu realm enabled condition for arm_smmu_domain_finalise. - platform/x86: classmate-laptop: Add missing NULL pointer checks - !21167 urma: fix kernel codecheck issues. - !21174 urma: change return value for provider err - !21127 urma: copy linked ports when importing bond jetty/seg - !20247 ubcore: query primary eid in ipourma loopback mode. - !21077 Fix hisi cca bugs - ubcore: route query refine and ipo loopback adapt. - hisi-cca-da: Transfer PCIe ECAM access requests to RMM for realm device. - hisi-cca-da: Write NS STE for PF drivers. - hisi-cca-da: Provide IO interfaces - hisi-cca-da: Destroy mmu stage2 pagetable after closing vfio devices - !21045 scsi: hisi_sas: Fix NULL pointer exception when do user_scan() - hisi-cca-da: Automatically unbind PF/VF drivers and prevent probe. - !21165 tools/interference: add ifstool utility for kernel interference statistics - !21166 urma: fix jfce uaf in batch cleanup - !21043 urma: fix tjetty ref in ping server - urma: change return value for provider err - !21128 sched/rt: Skip currently executing CPU in rto_next_cpu() - !21129 procfs: fix missing RCU protection when reading real_parent in do_task_stat() - urma: fix jfce uaf in batch cleanup - !21074 ipmi: Add HiSilicon IPMI Page Soft Offline driver - !21076 [OLK-6.6][linux-6.6.y sync] Backport 6.6.112-6.6.113 LTS Patches - urma: fix kernel codecheck issues. - tools/interference: add ifstool utility for kernel interference statistics - !20291 [Hygon][6.6][Bugfix] Bug fix for EDAC decode address fail issue on Hygon Dhyana processor - !21092 kexec: derive purgatory entry from symbol - !21154 sched: Add SOFT_DOMAIN feature interface for cgroup2 - !21153 fix CVE-2025-39981 - Revert "hisi-cca-da: Delay realm memory release to kvm_destroy_realm" - urma: fix tjetty ref in ping server - rme: Enforce isolation to solve compile error without config CONFIG_HISI_CCA - hisi-cca-da: Improve hisi cca dev validate and delegate - hisi-cca-da: Fix smmu enable rme problem - hisi-cca-da: Fix msi region shared problem - sched: Add SOFT_DOMAIN feature interface for cgroup2 - Bluetooth: MGMT: Fix memory leak in set_ssp_complete - Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete - overflow: Introduce __DEFINE_FLEX for having no initializer - overflow: Fix direct struct member initialization in _DEFINE_FLEX() - overflow: Change DEFINE_FLEX to take __counted_by member - overflow: add DEFINE_FLEX() for on-stack allocs - Bluetooth: MGMT: Fix possible UAFs - Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete() - !21103 Revert "mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()" - !21104 v2 vsock/virtio: cap TX credit to local buffer size - !21070 Fixes CVE-2026-23100 - !21135 RDMA/hns: Support configure and query the CNP DSCP through sysfs - !21088 ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref - RDMA/hns: Support configure and query the CNP DSCP through sysfs - RDMA/hns: Support query FW cap bit - RDMA/hns: Support query HW ID. - !20934 smb/server: fix refcount leak in parse_durable_handle_context() - !21004 regmap: Fix race condition in hwspinlock irqsave routine - !19568 [OLK-6.6]fix txgbe clang compile warning - urma: copy linked ports when importing bond jetty/seg - procfs: fix missing RCU protection when reading real_parent in do_task_stat() - sched/rt: Skip currently executing CPU in rto_next_cpu() - !21073 scsi: qla2xxx: Fix bsg_done() causing double free - !21114 CVE-2024-57979 - !21113 iommu: disable SVA when CONFIG_X86 is set - !20957 dmaengine: xilinx: xdma: Fix regmap max_register - !21087 net: unic: Multiple stability fixes for tx timeout, DFX capability and concurrent activation/reset - pps: Fix a use-after-free - fix kabi - pps: Fix a use-after-free - !21078 of: unittest: Fix memory leak in unittest_data_add() - !21079 *** fix CVE-2026-23208 *** - !21082 ALSA: aloop: Fix racy access at PCM trigger - !21083 bus: fsl-mc: fix use-after-free in driver_override_show() - iommu: disable SVA when CONFIG_X86 is set - vsock/virtio: cap TX credit to local buffer size - Revert "mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()" - !20983 Fix CVE-2026-23139 - !20878 Fix CVE-2026-23230 - kexec: derive purgatory entry from symbol - lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC - PCI/IOV: Fix race between SR-IOV enable/disable and hotplug - Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" - rtc: interface: Alarm race handling should not discard preceding error - perf test stat tests: Fix for virtualized machines - perf test stat: Update test expectations and events - perf test stat: Avoid hybrid assumption when virtualized - writeback: Avoid excessively long inode switching times - writeback: Avoid softlockup when switching many inodes - cramfs: Verify inode mode when loading from disk - fs: Add 'initramfs_options' to set initramfs mount options - minixfs: Verify inode mode when loading from disk - irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume - irqchip/sifive-plic: Make use of __assign_bit() - selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled - s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG - s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL - s390/bpf: Describe the frame using a struct instead of constants - s390/bpf: Centralize frame offset calculations - s390/bpf: Change seen_reg to a mask - ACPI: property: Do not pass NULL handles to acpi_attach_data() - ACPI: property: Add code comments explaining what is going on - ACPI: property: Disregard references in data-only subnode lists - ACPI: battery: Add synchronization between interface updates - ACPI: battery: Check for error code from devm_mutex_init() call - ACPI: battery: initialize mutexes through devm_ APIs - ACPI: battery: allocate driver data through devm_ APIs - arm64: mte: Do not flag the zero page as PG_mte_tagged - ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref - !20790 dm: use bio_clone_blkg_association - ipmi: Add HiSilicon IPMI Page Soft Offline driver - net: unic: Resolve network unavailability caused by concurrent activation and reset - net: unic: Provide the DFX capability for querying MNG table - net: unic: Delete the elr reset process after the tx timeout - bus: fsl-mc: fix use-after-free in driver_override_show() - ALSA: aloop: Fix racy access at PCM trigger - ALSA: usb-audio: Use the right limit for PCM OOB check - ALSA: usb-audio: Prevent excessive number of frames - of: unittest: Fix memory leak in unittest_data_add() - !21034 CVE-2026-23140 - !21016 net: fix segmentation of forwarding fraglist GRO - !21017 mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() - !21018 CVE-2026-23209 - !21019 ipv6: annotate data-race in ndisc_router_discovery() - !20881 ipvlan: Make the addrs_lock be per port - rme: Imporve range delegate - btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() - PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release - PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() - misc: fastrpc: Save actual DMA size in fastrpc_map structure - misc: fastrpc: Add missing dev_err newlines - mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag - mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type - mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value - media: mc: Clear minor number before put device - lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older - ACPICA: Allow to skip Global Lock initialization - ext4: validate ea_ino and size in check_xattrs - ext4: correctly handle queries for metadata mappings - ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() - nfsd: nfserr_jukebox in nlm_fopen should lead to a retry - NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() - mm/damon/vaddr: do not repeat pte_offset_map_lock() until success - mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 - mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations - wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 - wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again - selftests: mptcp: join: validate C-flag + def limit - spi: cadence-quadspi: Flush posted register writes before DAC access - spi: cadence-quadspi: Flush posted register writes before INDAC access - PCI: tegra194: Handle errors in BPMP response - PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() - PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock - PCI: rcar-host: Drop PMSR spinlock - PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit - PCI/AER: Support errors introduced by PCIe r6.0 - PCI/AER: Fix missing uevent on recovery when a reset is requested - PCI/ERR: Fix uevent on failure to recover - PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV - PCI/sysfs: Ensure devices are powered for config reads - PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock - rseq/selftests: Use weak symbol reference, not definition, to link with glibc - rtc: interface: Fix long-standing race when setting alarm - rtc: interface: Ensure alarm irq is enabled when UIE is enabled - memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe - mmc: core: SPI mode remove cmd7 - mtd: rawnand: fsmc: Default to autodetect buswidth - xtensa: simdisk: add input size check in proc_write_simdisk - sparc: fix error handling in scan_one_device() - sparc64: fix hugetlb for sun4u - scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() - sched/deadline: Fix race in push_dl_task() - pwm: berlin: Fix wrong register in suspend/resume - powerpc/pseries/msi: Fix potential underflow and leak issue - powerpc/powernv/pci: Fix underflow and leak issue - power: supply: max77976_charger: fix constant current reporting - pinctrl: samsung: Drop unused S3C24xx driver data - nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk - parisc: don't reference obsolete termio struct for TC* constants - openat2: don't trigger automounts with RESOLVE_NO_XDEV - of: unittest: Fix device reference count leak in of_unittest_pci_node_verify - lib/genalloc: fix device leak in of_gen_pool_get() - KEYS: trusted_tpm1: Compare HMAC values in constant time - iommu/vt-d: PRS isn't usable if PDS isn't supported - iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume - init: handle bootloader identifier in kernel parameters - iio: xilinx-ams: Unmask interrupts after updating alarms - iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK - iio: frequency: adf4350: Fix prescaler usage. - iio: dac: ad5421: use int type to store negative error codes - iio: dac: ad5360: use int type to store negative error codes - fs/ntfs3: Fix a resource leak bug in wnd_extend() - fbdev: Fix logic error in "offb" name match - crypto: rockchip - Fix dma_unmap_sg() nents value - crypto: atmel - Fix dma_unmap_sg() direction - crypto: aspeed - Fix dma_unmap_sg() direction - copy_sighand: Handle architectures where sizeof(unsigned long) < sizeof(u64) - bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() - bus: mhi: ep: Fix chained transfer handling in read path - btrfs: avoid potential out-of-bounds in btrfs_encode_fh() - blk-crypto: fix missing blktrace bio split events - drm/nouveau: fix bad ret code in nouveau_bo_move_prep - drm/rcar-du: dsi: Fix 1/2/3 lane support - media: lirc: Fix error handling in lirc_register() - media: venus: firmware: Use correct reset sequence for IRIS2 - media: pci: ivtv: Add missing check after DMA map - media: mc: Fix MUST_CONNECT handling for pads with no links - media: i2c: mt9v111: fix incorrect type for ret - media: cx18: Add missing check after DMA map - firmware: meson_sm: fix device leak at probe - xen/events: Update virq_to_irq on migration - xen/events: Return -EEXIST for bound VIRQs - xen/manage: Fix suspend error path - xen/events: Cleanup find_virq() return codes - dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required - ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init - arm64: dts: ti: k3-am62a-main: Fix main padcfg length - arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees - arm64: dts: qcom: msm8939: Add missing MDSS reset - arm64: dts: qcom: msm8916: Add missing MDSS reset - ACPI: debug: fix signedness issues in read/write helpers - ACPI: property: Fix buffer properties extraction for subnodes - gpio: wcd934x: mark the GPIO controller as sleeping - tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single - smb: client: fix missing timestamp updates after utime(2) - bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() - drm/amd/display: Properly disable scaling on DCE6 - drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 - drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs - drm/amdgpu: Add additional DCE6 SCL registers - mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes - mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call - tcp: take care of zero tp->window_clamp in tcp_set_rcvlowat() - perf python: split Clang options when invoking Popen - tools build: Align warning options with perf - net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe - drm/vmwgfx: Fix copy-paste typo in validation - net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() - LoongArch: Init acpi_gbl_use_global_lock to false - LoongArch: Remove CONFIG_ACPI_TABLE_UPGRADE in platform_init() - ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size - scsi: mvsas: Fix use-after-free bugs in mvs_work_queue - clk: tegra: do not overallocate memory for bpmp clocks - clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver - clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() - clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() - clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m - perf evsel: Ensure the fallback message is always written to - perf tools: Add fallback for exclude_guest - perf test: Add a test for default perf stat command - perf test: Don't leak workload gopipe in PERF_RECORD_* - perf session: Fix handling when buffer exceeds 2 GiB - perf arm_spe: Correct memory level for remote access - perf arm_spe: Correct setting remote access - rtc: optee: fix memory leak on driver removal - rtc: x1205: Fix Xicor X1205 vendor prefix - perf util: Fix compression checks returning -1 as bool - clk: at91: peripheral: fix return value - libperf event: Ensure tracing data is multiple of 8 sized - perf evsel: Avoid container_of on a NULL leader - asm-generic/io.h: Skip trace helpers if rwmmio events are disabled - iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE - clocksource/drivers/clps711x: Fix resource leaks in error paths - fscontext: do not consume log entries when returning -EMSGSIZE - fs: always return zero on success from replace_fd() - !21067 [OLK-6.6][linux-6.6.y sync] Backport 6.6.111-6.6.112 LTS Patches - scsi: qla2xxx: Fix bsg_done() causing double free - !21065 Fix CVE-2026-23069 - !21062 v4 Support multi-level cgroup - !20987 Fix CVE-2026-23212 - !20982 Fix CVE-2026-23119 - !20979 Fix CVE-2026-23111 - !20974 Fix CVE-2026-23099 - !20973 Fix CVE-2026-23105 - !20972 Fix CVE-2026-23074 - !20884 ksmbd: add chann_lock to protect ksmbd_chann_list xarray - !20947 Fix CVE-2026-23101 - ext4: clear i_state_flags when alloc inode - misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup - Revert "wifi: ath10k: avoid unnecessary wait for service ready message" - fs/ntfs3: fix mount failure for sparse runs in run_unpack() - !20825 efivarfs: fix error propagation in efivar_entry_get() - !20824 io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop - !20950 ub:ubus: protect iterator ue_list and mue_list with ub_bus_sem - mm/rmap: fix two comments related to huge_pmd_unshare() - mm/hugetlb: fix two comments related to huge_pmd_unshare() - mm/hugetlb: fix hugetlb_pmd_shared() - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count - !20728 drivers: Update vendor name of Chengdu NorthLink Technology N5/N6 Series Network Card Drivers - vsock/virtio: fix potential underflow in virtio_transport_get_credit() - !21001 Fix CVE-2026-23229 - usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call - arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode - !20999 Fix CVE-2026-23173 - usb: typec: tipd: Clear interrupts first - bus: fsl-mc: Check return value of platform_get_resource() - remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() - Input: atmel_mxt_ts - allow reset GPIO to sleep - misc: fastrpc: Skip reference for DMA handles - misc: fastrpc: fix possible map leak in fastrpc_put_args - misc: fastrpc: Fix fastrpc_map_lookup operation - nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() - ext4: fix checks for orphan inodes - ksmbd: fix error code overwriting in smb2_get_info_filesystem() - LoongArch: Automatically disable kaslr if boot from kexec_file - mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() - mfd: rz-mtu3: Fix MTU5 NFCR register offset - ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down - ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() - vhost: vringh: Modify the return value check - net/mlx5: fw reset, add reset timeout work - net/mlx5: pagealloc: Fix reclaim race during command interface teardown - net/mlx5: Stop polling for command response if interface goes down - net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable - nfp: fix RSS hash key size when RSS is not supported - mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands - drivers/base/node: fix double free in register_one_node() - hwrng: ks-sa - fix division by zero in ks_sa_rng_init - KEYS: X.509: Fix Basic Constraints CA flag parsing - Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements - Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO - vhost: vringh: Fix copy_to_iter return value check - RDMA/siw: Always report immediate post SQ errors - usb: vhci-hcd: Prevent suspending virtually attached devices - NFSv4.1: fix backchannel max_resp_sz verification check - coresight: trbe: Return NULL pointer for allocation failures - coresight: etm4x: Support atclk - coresight-etm4x: Conditionally access register TRCEXTINSELR - remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice - PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() - vfio/pds: replace bitmap_free with vfree - sparc: fix accurate exception reporting in copy_{from,to}_user for M7 - sparc: fix accurate exception reporting in copy_to_user for Niagara 4 - sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara - sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III - wifi: mac80211: fix Rx packet handling when pubsta information is not available - wifi: ath10k: avoid unnecessary wait for service ready message - Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram - IB/sa: Fix sa_local_svc_timeout_ms read race - RDMA/core: Resolve MAC of next-hop device without ARP support - f2fs: fix zero-sized extent for precache extents - scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() - scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() - scsi: qla2xxx: edif: Fix incorrect sign of error code - ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message - f2fs: fix to truncate first page in error path of f2fs_truncate() - f2fs: fix to update map->m_next_extent correctly in f2fs_map_blocks() - wifi: mt76: fix potential memory leak in mt76_wmac_probe() - RDMA/cm: Rate limit destroy CM ID timeout error message - drivers/base/node: handle error properly in register_one_node() - watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog - ipvs: Use READ_ONCE/WRITE_ONCE for ipvs->enable - iio: consumers: Fix offset handling in iio_convert_raw_to_processed() - iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() - fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist - fs: ntfs3: Fix integer overflow in run_unpack() - drm/msm/dpu: fix incorrect type for ret - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping - ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping - misc: genwqe: Fix incorrect cmd field being reported in error - usb: gadget: configfs: Correctly set use_os_string at bind - usb: phy: twl6030: Fix incorrect type for ret - drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() - tcp: fix __tcp_close() to only send RST when required - PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation - wifi: mwifiex: send world regulatory domain to driver - drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) - drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) - drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) - drm/amd/pm: Adjust si_upload_smc_data register programming (v3) - drm/amd/pm: Fix si_upload_smc_data (v3) - drm/amd/pm: Disable ULV even if unsupported (v3) - drm/amdgpu: Power up UVD 3 for FW validation (v2) - coresight: Only register perf symlink for sinks with alloc_buffer - inet: ping: check sock_net() in ping_get_port() and ping_lookup() - media: st-delta: avoid excessive stack usage - ALSA: lx_core: use int type to store negative error codes - media: rj54n1cb0c: Fix memleak in rj54n1_probe() - scsi: myrs: Fix dma_alloc_coherent() error check - hwrng: nomadik - add ARM_AMBA dependency - crypto: keembay - Add missing check after sg_nents_for_len() - drm/amd/display: Remove redundant semicolons - serial: max310x: Add error checking in probe() - usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls - usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup - phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 - media: zoran: Remove zoran_fh structure - drm/bridge: it6505: select REGMAP_I2C - f2fs: fix condition in __allow_reserved_blocks() - drm/radeon/r600_cs: clean up of dead code in r600_cs - drm/panel: novatek-nt35560: Fix invalid return value - bpf: Enforce expected_attach_type for tailcall compatibility - i2c: designware: Add disabling clocks when probe fails - i2c: designware: Fix clock issue when PM is disabled - i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD - thermal/drivers/qcom/lmh: Add missing IRQ includes - thermal/drivers/qcom: Make LMH select QCOM_SCM - hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems - once: fix race by moving DO_ONCE to separate section - smp: Fix up and expand the smp_call_function_many() kerneldoc - selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported - i3c: master: svc: Recycle unused IBI slot - i3c: master: svc: Use manual response for IBI events - ACPICA: Fix largest possible resource descriptor index - pwm: tiehrpwm: Fix corner case in clock divisor calculation - arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible - arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value - arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names - cpuidle: qcom-spm: fix device and OF node leaks at probe - firmware: firmware: meson-sm: fix compile-test default - arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 - null_blk: Fix the description of the cache_size module argument - pinctrl: renesas: Use int type to store negative error codes - power: supply: cw2015: Fix a alignment coding style issue - PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() - ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property - ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS - ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax - block: use int to store blk_stack_limits() return value - selftests/nolibc: fix EXPECT_NZ macro - regulator: scmi: Use int type to store negative error codes - arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map - ARM: at91: pm: fix MCKx restore routine - pinctrl: meson-gxl: add missing i2c_d pinmux - soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS - leds: flash: leds-qcom-flash: Update torch current clamp setting - ARM: dts: renesas: porter: Fix CAN pin group - libbpf: Fix reuse of DEVMAP - bpf: Remove migrate_disable in kprobe_multi_link_prog_run - bpf/selftests: Fix test_tcpnotify_user - regmap: Remove superfluous check for !config in __regmap_init() - arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 - x86/vdso: Fix output operand size of RDPID - smb: server: fix IRD/ORD negotiation with the client - coresight: trbe: Prevent overflow in PERF_IDX2OFF() - gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote - selftests: arm64: Check fread return value in exec_target - seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast - init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD - filelock: add FL_RECLAIM to show_fl_flags() macro - !21022 KVM: Don't clobber irqfd routing type when deassigning irqfd - !20998 ceph: fix oops due to invalid pointer for kfree() in parse_longname() - !21023 l2tp: avoid one data-race in l2tp_tunnel_del_work() - xsched: fix potential NULL dereference in xsched_quota_timeout_update - xsched: remove the standalone xcu_cfs_cg_deinit() helper - xsched: restructure xcu_cgrp_subsys teardown to align with cpu_cgrp_subsys lifecycle - xsched: simplify root group check by direct comparison with root_xcg - xsched: replace magic number with SCHED_CLASS_MAX_LENGTH for scheduler class string length - xsched/core: immediate cleanup of remaining operators on task exit - xsched: add init_fair_xsched_group() for XCU-specific fair group initialization - xsched: modify xcu_cg_initialize_components helper - xsched: refactor xsched_entity initialization - xsched: change rq_init() parameter from struct xsched_cu to struct xsched_rq - xsched: harden and clarify xcu_move_task() logic - xsched: move throttling-related fields from xsched_group_xcu_priv to xsched_rq_cfs - xsched/quota: add throttled flag to cfs_rq for robust hierarchical enqueue under throttling - xsched/quota: support multi-level cgroup - xsched: remove redundant xcu parameter from dequeue_ctx - xsched: update group shares using xcu_grp_shares_add/sub helpers - xsched: delete unused code - xsched/cfs: propagate group activation/deactivation up the hierarchy - xsched/cfs: move xruntime updates to pick/put paths - xsched: add has_running hook to xsched classes for wake-up eligibility check - !21012 [OLK-6.6][linux-6.6.y sync] Backport 6.6.110-6.6.111 LTS Patches - scsi: hisi_sas: Fix NULL pointer exception when do user_scan() - !21013 CVE-2026-23177 - !21007 bonding: fix use-after-free due to enslave fail after slave array update - !21006 net: Fix CVE-2026-23204 - bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path - bpf, test_run: Subtract size of xdp_frame from allowed metadata size - bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN - bpf: Make variables in bpf_prog_test_run_xdp less confusing - bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K - !21015 libceph: reset sparse-read state in osd_fault() - !21024 ub: udma: bugfix related to print messages. - !20980 Fix CVE-2026-23126 - !20922 Fix CVE-2026-23133 - ub: udma: bugfix related to print messages. - l2tp: avoid one data-race in l2tp_tunnel_del_work() - KVM: Don't clobber irqfd routing type when deassigning irqfd - ipv6: annotate data-race in ndisc_router_discovery() - macvlan: observe an RCU grace period in macvlan_common_newlink() error path - macvlan: fix error recovery in macvlan_common_newlink() - mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() - net: fix segmentation of forwarding fraglist GRO - can: rcar_canfd: Fix CAN-FD mode as default - libceph: reset sparse-read state in osd_fault() - !21008 uvb: fix cis call return value and obtain - mm, shmem: prevent infinite loop on truncate race - mm/shmem, swap: fix race of truncate and swap entry split - net/9p: fix double req put in p9_fd_cancelled - riscv: mm: Do not restrict mmap address based on hint - riscv: mm: Use hint address in mmap if available - driver core/PM: Set power.no_callbacks along with power.no_pm - serial: stm32: allow selecting console when the driver is module - hid: fix I2C read buffer overflow in raw_event() for mcp2221 - ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free - ALSA: usb-audio: Kill timer properly at removal - platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list - can: rcar_canfd: Fix controller mode setting - can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled - btrfs: ref-verify: handle damaged extent root tree - ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue - perf subcmd: avoid crash in exclude_cmds when excludes is empty - platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list - dm-integrity: limit MAX_TAG_SIZE to 255 - ASoC: amd: acp: Adjust pdm gain value - wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 - USB: serial: option: add SIMCom 8230C compositions - media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe - !20931 Fix CVE-2026-23060 - uvb: fix cis call return value and obtain - bonding: fix use-after-free due to enslave fail after slave array update - net/sched: cls_u32: use skb_header_pointer_careful() - net: add skb_header_pointer_careful() helper - regmap: Fix race condition in hwspinlock irqsave routine - crypto: virtio - Add spinlock protection with virtqueue notification - net/mlx5e: TC, delete flows only for existing peers - !20967 net: hns3: modify code of judging if SMMU DMA is enabled - ceph: fix oops due to invalid pointer for kfree() in parse_longname() - !20969 Fix CVE-2026-23125 - !20948 v4 arm64: Add memory poison recovery support for various paths - !20975 CVE-2026-23102 - !20977 v4 support apei_page_offline_policy - bonding: annotate data-races around slave->last_rx - netfilter: nf_conncount: update last_gc only when GC has been performed - bonding: provide a net pointer to __skb_flow_dissect() - netdevsim: fix a race issue related to the operation on bpf_bound_progs list - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() - apei/ghes: Add sysctl interface to control soft-offline page isolation - Revert "mm/memory-failure: support disabling soft offline for HugeTLB pages" - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - arm64/fpsimd: signal: Fix restoration of SVE context - arm64/fpsimd: signal: Consistently read FPSIMD context - arm64/fpsimd: signal: Mandate SVE payload for streaming-mode state - bonding: limit BOND_MODE_8023AD to Ethernet devices - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag - net/sched: Enforce that teql can only be used as root qdisc - sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT - drivers/net: Update vendor name of Chengdu NorthLink Technology N5/N6 Series Network Card Drivers - net: hns3: modify code of judging if SMMU DMA is enabled - dmaengine: xilinx: xdma: Fix regmap max_register - ub:ubus: protect iterator ue_list and mue_list with ub_bus_sem - ub:ubus: Avoid getting empty uent from ubc - ub:hisi-ubus: Use GFP_ATOMIC when alloc memory - arm64: send sig fault for user task when apei_claim_sea fails - arm64: add ras log during do_sea - arm64: move getting valid siaddr to the top of do_sea - arm64: mm: shmem: support poison recovery from shmem_file_read_iter() - arm64: fs: support poison recovery from __kernel_read() - iov_iter: add mc support for copy_page_to_iter - arm64: mm: support recovery from copy_{from/to}_user_page() - iov_iter: get rid of 'copy_mc' flag - leds: led-class: Only Add LED to leds_list when it is fully ready - wifi: ath10k: fix dma_free_coherent() pointer - smb/server: fix refcount leak in parse_durable_handle_context() - ksmbd: add chann_lock to protect ksmbd_chann_list xarray - ipvlan: Make the addrs_lock be per port - smb: client: split cached_fid bitfields to avoid shared-byte RMW races - efivarfs: fix error propagation in efivar_entry_get() - io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop - dm: use bio_clone_blkg_association - RAS/AMD/ATL: fix error nodes per socket on for Hygon Dhyana processor - net: txgbe: fix clang compile warning - !20552 ub: udma: fix some code issues. - !20313 Fix CVE-2025-40220 - !20321 nvme: fix admin request_queue lifetime - !20512 PM / devfreq: hisi: Fix potential UAF in OPP handling - !20544 Fix CVE-2025-71147 - !20548 v4 net: LTS-6.6 backport - !20503 Fix CVE-2025-39713 - !20133 Fix CVE-2025-39721 - !20438 Fix CVE-2025-38659 - !20264 Fix CVE-2025-40277 - !20340 Fix CVE-2025-40271 - !20319 Fix CVE-2025-40237 - !20392 vfs: Don't leak disconnected dentries on umount - !20554 iommu/s390: Implement blocking domain - !20489 [OLK-6.6][linux-6.6.y sync] Backport 6.6.101-6.6.102 LTS Patches - !20513 ACPI: PCC: Fix race condition by removing static qualifier - !20468 drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer - !20483 rcu: Protect ->defer_qs_iw_pending from data race - !20510 drivers/ub/sentry: fix primary eid index value - !20553 ub: cdma: support separated page table feature - ub: udma: fix some code issues. - !20480 iommu/ummu-core: fix error invalidate tid - !20561 iommu/ummu: Add ummu sva independent page table parameter - ub: udma: bugfix related to 2m_hugepage. - ub: udma: support for separate page tables - ub: udma: delete debugfs code. - ub: udma: bugfix related to ctrlq function. - ub: udma: verify get cqe/ae aux info out addr and len. - ub: cdma: support separated page table feature - iommu/ummu: Add ummu sva independent page table parameter - iommu: Adjust PLB refresh timing in 'grant' and 'ungrant' - !20505 Fix CVE-2026-23035 - iommu/s390: Implement blocking domain - drivers/ub/sentry: fix primary eid index value - !20535 libceph: make decode_pool() more resilient against corrupted osdmaps - !20536 mm/page_alloc: change all pageblocks migrate type on coalescing - !20537 mm/secretmem: fix use-after-free race in fault handler - !20538 wifi: avoid kernel-infoleak from struct iw_point - !20539 net: usb: rtl8150: fix memory leak on usb_submit_urb() failure - !20440 PCI/AER: Fix NULL pointer access by aer_info - !20262 Fix CVE-2025-68176 - netfilter: nf_reject: don't leak dst refcount for loopback packets - net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error - page_pool: always add GFP_NOWARN for ATOMIC allocations - virtio-net: fix received length check in big packets - net: bridge: fix use-after-free due to MST port state bypass - vsock: Ignore signal/timeout on connect() if already established - tls: make sure to abort the stream if headers are bogus - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI - xfrm: Duplicate SPI Handling - tls: handle data disappearing from under the TLS ULP - net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing - bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls - Bluetooth: hci_core: Fix use-after-free in vhci_flush() - KEYS: trusted: Fix a memory leak in tpm2_load_cmd - !20237 Fix CVE-2025-68724 - !20459 Fix CVE-2025-71131 - !20525 Fix CVE-2025-68816 - !20529 CVE-2025-68172 - net: usb: rtl8150: fix memory leak on usb_submit_urb() failure - !20370 Revert "Revert "RDMA/hns: Fix mismatch exception rollback"" - wifi: avoid kernel-infoleak from struct iw_point - mm/secretmem: fix use-after-free race in fault handler - mm/page_alloc: change all pageblocks migrate type on coalescing - libceph: make decode_pool() more resilient against corrupted osdmaps - pps: Fix kabi breakage of struct pps_device for last_fetched_ev - sched: Fix kabi breakage of struct task_struct for saved_state - crypto: aspeed - fix double free caused by devm - !20515 Bluetooth: bcsp: receive data only if registered - !20507 Fix CVE-2025-40358 - !20450 ub: ubase&unic: Fix some bug in concurrent process - !20452 iommu/ummu: Fix some bugs and optimize the code implementation - !20451 iommu/ummu: Add the function of creating devices with SVA-separated - !20500 mm: fix the inaccurate memory statistics issue for users - net/mlx5: fw_tracer, Validate format string parameters - Bluetooth: bcsp: receive data only if registered - ACPI: PCC: Fix race condition by removing static qualifier - ACPI: CPPC: Fix missing PCC check for guaranteed_perf - iommu/ummu: Add the function of creating devices with SVA-separated - iommu/ummu-core: fix error invalidate tid - riscv: stacktrace: Disable KASAN checks for non-current tasks - !20497 arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() - !20496 drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies - !20495 iommu/amd: Avoid stack buffer overflow from kernel cmdline - !20494 HID: core: Harden s32ton() against conversion to 0 bits - !20493 iommu: Fix two issues in iommu_copy_struct_from_user() - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv - PM / devfreq: hisi: Fix potential UAF in OPP handling - media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() - !20487 interference: Fix uninitialized ifs_clock compiling issue - MIPS: mm: kmalloc tlb_vpn array to avoid stack overflow - MIPS: mm: Prevent a TLB shutdown on initial uniquification - mm: fix the inaccurate memory statistics issue for users - mm: add config option for atomic mode in mm counter - Revert "mm: fix the inaccurate memory statistics issue for users" - !20444 net/mlx5e: Fix crash on profile change rollback failure - !20442 net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv - arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() - drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies - iommu/amd: Avoid stack buffer overflow from kernel cmdline - HID: core: Harden s32ton() against conversion to 0 bits - iommu: Fix two issues in iommu_copy_struct_from_user() - SUNRPC: call xs_sock_process_cmsg for all cmsg - flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read - !20374 [OLK 6.6]Use Hygon IBRS and IBPB rather than software-based mitigation to mitigate Retbleed and SRSO. - !20227 Rename leapioraid to leapraid and release v2.0 - mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery - MIPS: mm: tlb-r4k: Uniquify TLB entries on init - x86/fpu: Delay instruction pointer fixup until after warning - ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx() - ALSA: intel_hdmi: Fix off-by-one error in __hdmi_lpe_audio_probe() - x86/sev: Evict cache lines during SNP memory validation - net: usbnet: Fix the wrong netif_carrier_on() call - net: usbnet: Avoid potential RCU stall on LINK_CHANGE event - Bluetooth: btusb: Add USB ID 3625:010b for TP-LINK Archer TX10UB Nano - sched,freezer: Remove unnecessary warning in __thaw_task - freezer,sched: Clean saved_state when restoring it during thaw - freezer,sched: Do not restore saved_state of a thawed task - freezer,sched: Use saved_state to reduce some spurious wakeups - sched/core: Remove ifdeffery for saved_state - i2c: stm32f7: unmap DMA mapped buffer - i2c: stm32f7: simplify status messages in case of errors - i2c: stm32f7: perform most of irq job in threaded handler - i2c: stm32f7: use dev_err_probe upon calls of devm_request_irq - i2c: stm32f7: Use devm_clk_get_enabled() - USB: serial: option: add Foxconn T99W709 - smb: server: Fix extension string in ksmbd_extract_shortname() - ksmbd: fix corrupted mtime and ctime in smb2_open - ksmbd: fix Preauh_HashValue race condition - ksmbd: fix null pointer dereference error in generate_encryptionkey - vsock: Do not allow binding to VMADDR_PORT_ANY - selftests/perf_events: Add a mmap() correctness test - smb: client: return an error if rdma_connect does not return within 5 seconds - smb: client: let recv_done() cleanup before notifying the callers. - smb: client: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already - smb: client: make use of common smbdirect_socket - smb: smbdirect: add smbdirect_socket.h - smb: client: Correct typos in multiple comments across various files - smb: client: Use min() macro - smb: server: let recv_done() avoid touching data_transfer after cleanup/move - smb: server: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already - ALSA: hda/ca0132: Fix missing error handling in ca0132_alt_select_out() - irqchip: Build IMX_MU_MSI only on ARM - net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing - sunrpc: fix client side handling of tls alerts - net/sched: taprio: enforce minimum value for picos_per_byte - net: drop UFO packets in udp_rcv_segment() - ipv6: reject malicious packets in ipv6_gso_segment() - net/mlx5: Correctly set gso_segs when LRO is used - netlink: specs: ethtool: fix module EEPROM input/output arguments - net: ipa: add IPA v5.1 and v5.5 to ipa_version_string() - phy: mscc: Fix parsing of unicast frames - netpoll: prevent hanging NAPI when netcons gets enabled - md/md-cluster: handle REMOVE message earlier - NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY - NFS: Fix wakeup of __nfs_lookup_revalidate() in unblock_revalidate() - sched: Add test_and_clear_wake_up_bit() and atomic_dec_and_wake_up() - pNFS/flexfiles: don't attempt pnfs on fatal DS errors - PCI: pnv_php: Fix surprise plug detection and recovery - powerpc/eeh: Export eeh_unfreeze_pe() - PCI: pnv_php: Work around switches with broken presence detection - kconfig: qconf: fix ConfigList::updateListAllforAll() - scsi: sd: Make sd shutdown issue START STOP UNIT appropriately - scsi: ufs: core: Use link recovery when h8 exit fails during runtime resume - scsi: Revert "scsi: iscsi: Fix HW conn removal use after free" - scsi: mpt3sas: Fix a fw_event memory leak - vfio/pci: Separate SR-IOV VF dev_set - vfio/pds: Fix missing detach_ioas op - vfio: Prevent open_count decrement to negative - vfio: Fix unbalanced vfio_df_close call in no-iommu mode - f2fs: fix to calculate dirty data during has_not_enough_free_secs() - f2fs: fix to update upper_p in __get_secs_required() correctly - f2fs: vm_unmap_ram() may be called from an invalid context - f2fs: fix to avoid out-of-boundary access in devs.path - f2fs: doc: fix wrong quota mount option description - f2fs: fix KMSAN uninit-value in extent_info usage - rtc: rv3028: fix incorrect maximum clock rate handling - rtc: pcf8563: fix incorrect maximum clock rate handling - rtc: pcf85063: fix incorrect maximum clock rate handling - rtc: nct3018y: fix incorrect maximum clock rate handling - rtc: hym8563: fix incorrect maximum clock rate handling - rtc: ds1307: fix incorrect maximum clock rate handling - ucount: fix atomic_long_inc_below() argument type - module: Restore the moduleparam prefix length check - apparmor: fix loop detection used in conflicting attachment resolution - apparmor: ensure WB_HISTORY_SIZE value is a power of 2 - bpf: Check netfilter ctx accesses are aligned - bpf: Check flow_dissector ctx accesses are aligned - vhost-scsi: Fix log flooding with target does not exist errors - mtd: rawnand: atmel: set pmecc data setup time - mtd: rawnand: rockchip: Add missing check after DMA map - mtd: rawnand: atmel: Fix dma_mapping_error() address - jfs: fix metapage reference count leak in dbAllocCtl - crypto: qat - fix seq_file position update in adf_ring_next() - crypto: qat - fix DMA direction for compression on GEN2 devices - perf tools: Remove libtraceevent in .gitignore - sh: Do not use hyphen in exported variable name - ASoC: fsl_xcvr: get channel status data when PHY is not exists - dmaengine: nbpfaxi: Add missing check after DMA map - dmaengine: mv_xor: Fix missing check after DMA map and missing unmap - fs/orangefs: Allow 2 more characters in do_c_string() - PCI: endpoint: pci-epf-vntb: Fix the incorrect usage of __iomem attribute - soundwire: stream: restore params when prepare ports fail - crypto: img-hash - Fix dma_unmap_sg() nents value - crypto: keembay - Fix dma_unmap_sg() nents value - hwrng: mtk - handle devm_pm_runtime_enable errors - watchdog: ziirave_wdt: check record length in ziirave_firm_verify() - scsi: isci: Fix dma_unmap_sg() nents value - scsi: mvsas: Fix dma_unmap_sg() nents value - scsi: elx: efct: Fix dma_unmap_sg() nents value - scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value - clk: sunxi-ng: v3s: Fix de clock definition - perf tests bp_account: Fix leaked file descriptor - kernel: trace: preemptirq_delay_test: use offstack cpu mask - crypto: inside-secure - Fix `dma_unmap_sg()` nents value - perf sched: Fix memory leaks in 'perf sched latency' - perf sched: Fix memory leaks for evsel->priv in timehist - perf sched: Free thread->priv using priv_destructor - perf dso: Add missed dso__put to dso__load_kcore - perf tools: Fix use-after-free in help_unknown_cmd() - Fix dma_unmap_sg() nents value - clk: clk-axi-clkgen: fix fpfd_max frequency for zynq - fanotify: sanitize handle_type values when reporting fid - pinctrl: sunxi: Fix memory leak on krealloc failure - PCI: endpoint: pci-epf-vntb: Return -ENOENT if pci_epc_get_next_free_bar() fails - crypto: arm/aes-neonbs - work around gcc-15 warning - power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set - power: supply: cpcap-charger: Fix null check for power_supply_get_by_name - clk: xilinx: vcu: unregister pll_post only if registered correctly - media: v4l2-ctrls: Fix H264 SEPARATE_COLOUR_PLANE check - mtd: fix possible integer overflow in erase_xfer() - crypto: marvell/cesa - Fix engine load inaccuracy - crypto: qat - use unmanaged allocation for dc_data - crypto: sun8i-ce - fix nents passed to dma_unmap_sg() - PCI: rockchip-host: Fix "Unexpected Completion" log message - bpf/preload: Don't select USERMODE_DRIVER - ipv6: annotate data-races around rt->fib6_nsiblings - ipv6: fix possible infinite loop in fib6_info_uses_dev() - vrf: Drop existing dst reference in vrf_ip6_input_dst - selftests: rtnetlink.sh: remove esp4_offload after test - net/mlx5e: Clear Read-Only port buffer size in PBMC before update - netfilter: xt_nfacct: don't assume acct name is null-terminated - can: kvaser_usb: Assign netdev.dev_port based on device channel index - can: kvaser_pciefd: Store device channel index - can: peak_usb: fix USB FD devices potential malfunction - tools/rv: Do not skip idle in trace - Bluetooth: hci_event: Mask data status from LE ext adv reports - kcsan: test: Initialize dummy variable - wifi: mac80211: Write cnt before copying in ieee80211_copy_rnr_beacon() - wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE - wifi: ath12k: fix endianness handling while accessing wmi service bit - wifi: mac80211: Check 802.11 encaps offloading in ieee80211_tx_h_select_key() - wifi: mac80211: Don't call fq_flow_idx() for management frames - wifi: mac80211: Do not schedule stopped TXQs - wifi: plfxlc: Fix error handling in usb driver probe - wifi: mac80211: reject TDLS operations when station is not associated - iommu/amd: Fix geometry.aperture_end for V2 tables - mwl8k: Add missing check after DMA map - wifi: rtl8xxxu: Fix RX skb size for aggregation disabled - tcp: call tcp_measure_rcv_mss() for ooo packets - xen/gntdev: remove struct gntdev_copy_batch from stack - net_sched: act_ctinfo: use atomic64_t for three counters - net/sched: Restrict conditions for adding duplicating netems to qdisc tree - um: rtc: Avoid shadowing err in uml_rtc_start() - arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX - netfilter: nf_tables: adjust lockdep assertions handling - netfilter: nf_tables: Drop dead code from fill_*_info routines - fbcon: Fix outdated registered_fb reference in comment - drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value - m68k: Don't unregister boot console needlessly - drm/msm/dpu: Fill in min_prefill_lines for SC8180X - kselftest/arm64: Fix check for setting new VLs in sve-ptrace - net: dst: annotate data-races around dst->input - tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range - wifi: ath11k: clear initialized flag for deinit-ed srng lists - iwlwifi: Add missing check for alloc_ordered_workqueue - wifi: iwlwifi: Fix memory leak in iwl_mvm_init() - wifi: rtl818x: Kill URBs before clearing tx status queue - wifi: rtw89: avoid NULL dereference when RX problematic packet on unsupported 6 GHz band - caif: reduce stack size, again - bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure - drm/vmwgfx: Fix Host-Backed userspace on Guest-Backed kernel - net: ipv6: ip6mr: Fix in/out netdev to pass to the FORWARD chain - selftests/bpf: fix signedness bug in redir_partial() - bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls - bpf, sockmap: Fix psock incorrectly pointing to sk - drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed - staging: nvec: Fix incorrect null termination of battery manufacturer - interconnect: qcom: sc8180x: specify num_nodes - interconnect: qcom: sc8280xp: specify num_links for qnm_a1noc_cfg - soc: qcom: pmic_glink: fix OF node leak - samples: mei: Fix building on musl libc - cpufreq: Initialize cpufreq-based frequency-invariance later - cpufreq: intel_pstate: Always use HWP_DESIRED_PERF in passive mode - arm64: dts: imx8mn-beacon: Fix HS400 USDHC clock speed - arm64: dts: imx8mm-beacon: Fix HS400 USDHC clock speed - ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface - soc/tegra: cbb: Clear ERR_FORCE register with ERR_STATUS - arm: dts: ti: omap: Fixup pinheader typo - usb: early: xhci-dbc: Fix early_ioremap leak - powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw() - pps: fix poll support - staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() - spi: stm32: Check for cfg availability in stm32_spi_probe - usb: misc: apple-mfi-fastcharge: Make power supply names unique - usb: host: xhci-plat: fix incorrect type for of_match variable in xhci_plat_probe() - ARM: dts: vfxxx: Correctly use two tuples for timer address - arm64: dts: qcom: msm8976: Make blsp_dma controlled-remotely - arm64: dts: qcom: sc7180: Expand IMEM region - arm64: dts: qcom: sdm845: Expand IMEM region - soc: qcom: QMI encoding/decoding for big endian - selftests: Fix errno checking in syscall_user_dispatch test - ASoC: mediatek: use reserved memory or enable buffer pre-allocation - gfs2: No more self recovery - Revert "fs/ntfs3: Replace inode_trylock with inode_lock" - hfs: make splice write available again - hfsplus: make splice write available again - ublk: use vmalloc for ublk_device's __queues - fs_context: fix parameter name in infofc() macro - audit,module: restore audit logging in load failure case - ASoC: amd: yc: add DMI quirk for ASUS M6501RM - ASoC: Intel: fix SND_SOC_SOF dependencies - ASoC: amd: yc: Add DMI entries to support HP 15-fb1xxx - ethernet: intel: fix building with large NR_CPUS - ASoC: amd: yc: Add DMI quirk for HP Laptop 17 cp-2033dx - interference: Fix uninitialized ifs_clock compiling issue - iommu/ummu: optimize log printing - !20455 Fix compilation failure caused by PR#20174 - !20302 CVE-2026-22980 - !20142 CVE-2025-68803 - !20261 ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency - !20435 fix CVE-2026-22998 - !20433 scsi: target: Reset t_task_cdb pointer in error case - !20432 scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" - !20431 block: Use RCU in blk_mq_[un - !20307 tpm: Cap the number of PCR banks - !20062 xfs: Add xfs_dir3_leaf_header_check() in leaf/leafn read - !20157 v2 md: backport from mainline - rcu: Protect ->defer_qs_iw_pending from data race - platform/x86/intel/pmt: fix compilation failure caused by PR#20174 - iommu/ummu: optimize kv cache memory management - iommu/ummu: optimize permission table management - iommu/ummu: remove check for eid_type while del eid - iommu/ummu: optimize the code implementation - drivers/perf: fix ummu-pmu data reading exception - iommu/ummu: IOMMU_DOMAIN_BLOCKED type don not sync tct - drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer - crypto: seqiv - Do not use req->iv after crypto_aead_encrypt - net: unic: Notify mami of the bond ip change. - ub: ubase: Support for UE link by ctrlq message - ub: ubase: send a deactivate req in removing - ub: ubase: Querying TPG/TP contexts in the chip is no longer supported after enabling safe mode. - ub: ubase: Use an independent thread for the ctrlq workqueue. - !20368 ubcore: fix logging and permission for route query. - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id - !20344 ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr - net: unic: Fix the ummu 0xa event that occurs when modifying queues and resetting concurrent scenarios - ub: ubase: Add KABI compatibility - ub: ubase: fixing the issue of cdma ctp_req_vl parameter configuration - ub: ubase: add PMU IDEV interrupt supported abilities. - ub: ubase: Delete the tid mask for eq, jfs, jfr, and jfc context - ub: ubase: Set the completion event interrupt to auto - net: unic: fix poll tx read old skb cause a UAF bug - !20249 Fix CVE-2025-38489 - !20250 Fix CVE-2025-38480 - !20378 Fix CVE-2025-39838 - !20430 Fix CVE-2025-39942 - !20351 Fix CVE-2025-71149 - !20375 Fix CVE-2025-71150 - !20323 Fix CVE-2025-38730 - !20320 Fix CVE-2025-68814 - !20314 Fix CVE-2025-71072 - !20315 Fix CVE-2025-68794 - !20403 bpf: Check skb->transport_header is set in bpf_skb_check_mtu - !20402 bpf: Do not let BPF test infra emit invalid GSO types to stack - !20401 tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() - !20400 netfilter: nft_ct: add seqadj extension for natted connections - !20399 net: xfrm: Fix CVE-2025-40215 - !20398 net/sched: sch_qfq: Fix null-deref in agg_dequeue - !20397 bpf: Reject narrower access to pointer ctx fields - !20396 Bluetooth: eir: Fix possible crashes on eir_create_adv_data - !20394 IB/mlx5: Fix potential deadlock in MR deregistration - !20367 ub: cdma: cdma uaf bugfix - net/mlx5e: Fix crash on profile change rollback failure - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv - PCI/AER: Fix NULL pointer access by aer_info - gfs2: No more self recovery - drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE - crypto: qat - flush misc workqueue during device shutdown - !20174 Backport PMT spec 3.0 support - !20366 [Hygon][6.6][Bugfix]: Resolve FPU state corruption between atomic and non-atomic contexts - !19814 [OLK-6.6] Batch flushing user memory encrytion status change - !20393 [OLK-6.6][linux-6.6.y sync] Backport 6.6.100-6.6.101 LTS Patches - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec - nvmet-tcp: remove boilerplate code - scsi: target: Reset t_task_cdb pointer in error case - scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" - block: Use RCU in blk_mq_[un]quiesce_tagset() instead of set->tag_list_lock - ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size - ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer - smb: server: let recv_done() consistently call put_recvmsg/smb_direct_disconnect_rdma_connection - smb: server: remove separate empty_recvmsg_queue - !20384 ub:ubus: Fix ubus link message and pool device error - !20389 gfs2: Prevent recursive memory reclaim - !20388 *** fix CVE-2025-38062 *** - !20387 KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced - !20386 pinctrl: check the return value of pinmux_ops::get_function_name() - !20385 iommu/amd/pgtbl: Fix possible race while increase page table level - ub:ubus: Not cfg access during surprise down - ub:hisi-ubus: Delete validate_pa err print - PCI: cadence: Check for the existence of cdns_pcie::ops before using it - can: netlink: can_changelink(): allow disabling of automatic restart - Revert "selftests/bpf: Add a cgroup prog bpf_get_ns_current_pid_tgid() test" - drm/sched: Remove optimization that causes hang when killing dependent jobs - ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS - bpf: Check skb->transport_header is set in bpf_skb_check_mtu - bpf: Do not let BPF test infra emit invalid GSO types to stack - tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() - netfilter: nft_ct: add seqadj extension for natted connections - xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added - xfrm: delete x->tunnel as we delete x - x86/hw-vuln:Support hardware-based mitigation for Retbleed and SRSO via Hygon IBRS to avoid performance degradation caused by software-based mitigation. - net/sched: sch_qfq: Fix null-deref in agg_dequeue - bpf: Reject narrower access to pointer ctx fields - Bluetooth: eir: Fix possible crashes on eir_create_adv_data - IB/mlx5: Fix potential deadlock in MR deregistration - ub:ubus: Fix ubus link message and pool device error - ub:hisi-ubus: cq poller maximum handle 64 cqe per time - ub:hisi-ubus:Fix vdm message print error - ub:ubus:Fix ubus interrupt release issue - wifi: mt76: mt7921: prevent decap offload config before STA initialization - mtd: rawnand: qcom: Fix last codeword read in qcom_param_page_type_exec() - iio: hid-sensor-prox: Restore lost scale assignments - iio: hid-sensor-prox: Fix incorrect OFFSET calculation - crypto: powerpc/poly1305 - add depends on BROKEN for now - erofs: address D-cache aliasing - drm/i915/dp: Fix 2.7 Gbps DP_LINK_BW value on g4x - ALSA: hda: Add missing NVIDIA HDA codec IDs - ALSA: hda/tegra: Add Tegra264 support - comedi: comedi_test: Fix possible deletion of uninitialized timers - usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach - usb: typec: tcpm: allow switching to mode accessory to mux properly - usb: typec: tcpm: allow to use sink in accessory mode - drm/amdkfd: Don't call mmput from MMU notifier callback - mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n - selftests: mptcp: connect: also cover checksum - selftests: mptcp: connect: also cover alt modes - resource: fix false warning in __request_region() - gve: Fix stuck TX queue for DQ queue format - e1000e: ignore uninitialized checksum word on tgp - e1000e: disregard NVM checksum on tgp when valid checksum bit is not set - dpaa2-switch: Fix device reference count leak in MAC endpoint handling - dpaa2-eth: Fix device reference count leak in MAC endpoint handling - ALSA: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx - sprintf.h requires stdarg.h - bus: fsl-mc: Fix potential double device reference in fsl_mc_get_endpoint() - i2c: virtio: Avoid hang by using interruptible completion wait - i2c: tegra: Fix reset error handling with ACPI - platform/x86: ideapad-laptop: Fix kbd backlight not remembered among boots - can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode - can: dev: can_restart(): move debug message and stats after successful restart - can: dev: can_restart(): reverse logic to remove need for goto - i40e: When removing VF MAC filters, only check PF-set MAC - i40e: report VF tx_dropped with tx_errors instead of tx_discards - i40e: Add rx_missed_errors for buffer exhaustion - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch - net/mlx5: Fix memory leak in cmd_exec() - staging: vchiq_arm: Make vchiq_shutdown never fail - x86/hyperv: Fix usage of cpu_online_mask to get valid cpu - regmap: fix potential memory leak of regmap_bus - iio: adc: ad7949: use spi_is_bpw_supported() - interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1 node - RDMA/core: Rate limit GID cache warning messages - virtio_ring: Fix error reporting in virtqueue_resize - !20348 [OLK-6.6][linux-6.6.y sync] Backport 6.6.99-6.6.100 LTS Patches - !20346 tracing: Fix crash on synthetic stacktrace field usage - vfs: Don't leak disconnected dentries on umount - !20334 Fix CVE-2025-68780 - gfs2: Prevent recursive memory reclaim - amd/amdkfd: enhance kfd process check in switch partition - drm/amdkfd: allow compute partition mode switch with cgroup exclusions - KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced - pinctrl: check the return value of pinmux_ops::get_function_name() - iommu/amd/pgtbl: Fix possible race while increase page table level - !19966 nvme-fc: use lock accessing port_state and rport state - ASoC: fsl_sai: replace regmap_write with regmap_update_bits - comedi: Fix use of uninitialized data in insn_rw_emulate_bits() - cifs: prevent NULL pointer dereference in UTF16 conversion - ksmbd: Fix refcount leak when invalid session is found on session lookup - ubcore: fix logging and permission for route query. - !20232 driver/coda: VirtCCA supports MSI device DA - Revert "Revert "RDMA/hns: Fix mismatch exception rollback"" - !20197 ub: udma&ubase: fix a bug that caused long reboot time - x86: Resolve FPU state corruption between atomic and non-atomic contexts - ub: cdma: cdma uaf bugfix - ub: cdma: jfs call trace bugfix - !20353 x86/fpu: Clear XSTATE_BV[i - s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again - KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls - nvmem: layouts: u-boot-env: remove crc32 endianness conversion - i2c: omap: fix deprecated of_property_read_bool() use - ASoC: fsl_sai: Force a software reset when starting in consumer mode - regulator: pwm-regulator: Manage boot-on with disabled PWM channels - regulator: pwm-regulator: Calculate the output voltage for disabled PWMs - i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe() - i2c: omap: Fix an error handling path in omap_i2c_probe() - i2c: omap: Add support for setting mux - usb: dwc3: qcom: Don't leave BCR asserted - usb: hub: Don't try to recover devices lost during warm reset. - usb: hub: Fix flushing of delayed work used for post resume purposes - usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm - usb: hub: fix detection of high tier USB3 devices behind suspended hubs - arm64: Filter out SME hwcaps when FEAT_SME isn't implemented - ipv6: make addrconf_wq single threaded - !20354 cpufreq/sched: Explicitly synchronize limits_changed flag handling - sched/deadline: only set free_cpus for online runqueues - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 - cpufreq/sched: Explicitly synchronize limits_changed flag handling - io_uring/poll: correctly handle io_poll_add() return value on update - shmem: fix recovery on rename failures - io_uring: fix filename leak in __io_openat_prep() - Revert "cgroup_freezer: cgroup_freezing: Check if not frozen" - rxrpc: Fix transmission of an abort in response to an abort - rxrpc: Fix recv-recv race of completed call - net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree - net: bridge: Do not offload IGMP/MLD messages - hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf - netfilter: nf_conntrack: fix crash due to removal of uninitialised entry - ipv6: mcast: Delay put pmc->idev in mld_del_delrec() - net/mlx5: Correctly set gso_size when LRO is used - Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID - Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout - Bluetooth: SMP: If an unallowed command is received consider it a failure - Bluetooth: hci_sync: fix connectable extended advertising when using static random address - hwmon: (corsair-cpro) Validate the size of the received input buffer - selftests: net: increase inter-packet timeout in udpgro.sh - wifi: cfg80211: remove scan request n_channels counted_by - nvme: fix misaccounting of nvme-mpath inflight I/O - net: phy: Don't register LEDs for genphy - nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list() - rpl: Fix use-after-free in rpl_do_srh_inline(). - block: fix kobject leak in blk_unregister_queue - net: emaclite: Fix missing pointer increment in aligned_read() - soundwire: amd: fix for clearing command status register - soundwire: amd: fix for handling slave alerts after link is down - comedi: Fix use of uninitialized data in insn_rw_emulate_bits() - comedi: Fix some signed shift left operations - comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large - comedi: das6402: Fix bit shift out of bounds - comedi: das16m1: Fix bit shift out of bounds - comedi: aio_iiro_16: Fix bit shift out of bounds - comedi: pcl812: Fix bit shift out of bounds - iio: adc: stm32-adc: Fix race in installing chained IRQ handler - iio: adc: max1363: Reorder mode_list[] entries - iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] - iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush - soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled - soc: aspeed: lpc-snoop: Cleanup resources in stack-order - s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again - pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov - net: libwx: properly reset Rx ring descriptor - net: libwx: remove duplicate page_pool_put_full_page() - mmc: sdhci_am654: Workaround for Errata i2312 - mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models - mmc: bcm2835: Fix dma_unmap_sg() nents value - memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() - isofs: Verify inode mode when loading from disk - dmaengine: nbpfaxi: Fix memory corruption in probe() - af_packet: fix soft lockup issue caused by tpacket_snd() - af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() - arm64: dts: rockchip: use cs-gpios for spi1 on ringneck - arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on - arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency - net/mlx5: Update the list of the PCI supported devices - phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() - io_uring/poll: fix POLLERR handling - ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS - drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume - tracing/osnoise: Fix crash in timerlat_dump_stack() - spi: Add check for 8-bit transfer with 8 IO mode support - pch_uart: Fix dma_sync_sg_for_device() nents value - thunderbolt: Fix bit masking in tb_dp_port_set_hops() - i2c: stm32: fix the device used for the DMA map - tracing: Fix crash on synthetic stacktrace field usage - usb: musb: fix gadget state on disconnect - USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI - USB: serial: option: add Foxconn T99W640 - USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition - phy: tegra: xusb: Disable periodic tracking on Tegra234 - phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode - phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr - fs/proc: fix uaf in proc_readdir_de() - io_uring/net: commit partial buffers on retry - nvme: fix admin request_queue lifetime - fs/notify: call exportfs_encode_fid with s_umount - iomap: adjust read range correctly for non-block-aligned positions - fuse: fix livelock in synchronous file put from fuseblk workers - tpm: Cap the number of PCR banks - nfsd: provide locking for v4_end_grace - Revert "nfsd: provide locking for v4_end_grace" - config: enable config for PMT discovery driver - platform/x86/intel/pmt/discovery: use valid device pointer in dev_err_probe - platform/x86/intel/pmt: Fix kobject memory leak on init failure - platform/x86/intel/pmt: fix a crashlog NULL pointer access - platform/x86/intel/pmt: fix build dependency for kunit test - platform/x86/intel/pmt/discovery: fix format string warning - platform/x86/intel/pmt/discovery: Fix size_t specifiers for 32-bit - platform/x86/intel/pmt: KUNIT test for PMT Enhanced Discovery API - platform/x86/intel/pmt/telemetry: Add API to retrieve telemetry regions by feature - platform/x86/intel/pmt/discovery: Get telemetry attributes - platform/x86/intel/tpmi: Get OOBMSM CPU mapping from TPMI - platform/x86/intel/vsec: Set OOBMSM to CPU mapping - platform/x86/intel/tpmi: Relocate platform info to intel_vsec.h - docs: Add ABI documentation for intel_pmt feature directories - platform/x86/intel/pmt: Add PMT Discovery driver - sysfs: Fix crash on empty group attributes array - sysfs: Introduce a mechanism to hide static attribute_groups - platform/x86/intel/vsec: Add new Discovery feature - platform/x86/intel/vsec: Skip driverless features - platform/x86/intel/vsec: Skip absent features during initialization - platform/x86/intel/vsec: Add device links to enforce dependencies - platform/x86/intel/vsec: Create wrapper to walk PCI config space - platform/x86/intel/vsec: Add private data for per-device data - MAINTAINERS: Add link to documentation of Intel PMT ABI - platform/x86/intel/pmt: allow user offset for PMT callbacks - driver/coda: VirtCCA supports MSI device DA - ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency - Rename leapioraid to leapraid and release v2.0 - ub: udma: fix a bug that caused long reboot time. - ub: ubase: Accelerate when ctrl node is shutting down - platform/x86/intel/pmt: Use PMT callbacks - platform/x86/intel/vsec: Add PMT read callbacks - platform/x86/intel/vsec.h: Move to include/linux - md: prevent incorrect update of resync/recovery offset - md/raid1: Fix data corruption for degraded array with slow disk - md/raid1: set max_sectors during early return from choose_slow_rdev() - md-cluster: fix no recovery job when adding/re-adding a disk - md-cluster: fix hanging issue while a new disk adding - md/raid5: recheck if reshape has finished with device_lock held - md-cluster: Constify struct md_cluster_operations - md: Remove unneeded semicolon - md/raid5: fix spares errors about rcu usage - dm-raid: Fix WARN_ON_ONCE check for sync_thread in raid_resume - md: pass in max_sectors for pers->sync_request() - md: factor out helpers for different sync_action in md_do_sync() - md: replace last_sync_action with new enum type - md: use new helpers in md_do_sync() - md: don't fail action_store() if sync_thread is not registered - md: remove parameter check_seq for stop_sync_thread() - md: replace sysfs api sync_action with new helpers - md: factor out helper to start reshape from action_store() - md: add new helpers for sync_action - md: add a new enum type sync_action - md: rearrange recovery_flags - md/raid0: don't free conf on raid0_run failure - md: make md_flush_request() more readable - md: change the return value type of md_write_start to void - md: Revert "md: Fix overflow in is_mddev_idle" - md: don't account sync_io if iostats of the disk is disabled - md: Fix overflow in is_mddev_idle - md: add check for sleepers in md_wakeup_thread() - md: add a mddev_is_dm helper - md: add a mddev_add_trace_msg helper - md: add a mddev_trace_remap helper - dm-raid456, md/raid456: fix a deadlock for dm-raid456 while io concurrent with reshape - dm-raid: add a new helper prepare_suspend() in md_personality - dm-raid: really frozen sync_thread during suspend - md: add a new helper reshape_interrupted() - md: export helper md_is_rdwr() - md: export helpers to stop sync_thread - md: don't clear MD_RECOVERY_FROZEN for new dm-raid until resume - md/raid1: factor out helpers to choose the best rdev from read_balance() - md/raid1: factor out the code to manage sequential IO - md/raid1: factor out choose_bb_rdev() from read_balance() - md/raid1: factor out choose_slow_rdev() from read_balance() - md/raid1: factor out read_first_rdev() from read_balance() - md/raid1-10: factor out a new helper raid1_should_read_first() - md/raid1-10: add a helper raid1_check_read_range() - md/raid1: fix choose next idle in read_balance() - md/raid1: record nonrot rdevs while adding/removing rdevs to conf - md/raid1: factor out helpers to add rdev to conf - md: add a new helper rdev_has_badblock() - md: check mddev->pers before calling md_set_readonly() - md: clean up openers check in do_md_stop() and md_set_readonly() - md: sync blockdev before stopping raid or setting readonly - md: factor out a helper to sync mddev - md: return directly before setting did_set_md_closing - md: changed the switch of RAID_VERSION to if - md: merge the check of capabilities into md_ioctl_valid() - md: Don't suspend the array for interrupted reshape - md: Don't register sync_thread for reshape directly - md: Make sure md_do_sync() will set MD_RECOVERY_DONE - md: Don't ignore read-only array in md_check_recovery() - md: Don't ignore suspended array in md_check_recovery() - md: get rdev->mddev with READ_ONCE() - md: remove redundant md_wakeup_thread() - md: remove redundant check of 'mddev->sync_thread' - md: fix a suspicious RCU usage warning - raid: Remove now superfluous sentinel element from ctl_table array - NFSD: NFSv4 file creation neglects setting ACL - nfsd: set security label during create operations - xfs: Add xfs_dir3_leaf_header_check() in leaf/leafn read - nvme-fc: use lock accessing port_state and rport state - x86/mm: Batch flushing user memory encrytion status change - !20588 [OLK-6.6] Revert "x86/csv: Enhance CMA memory usage reporting for CSV3" - Revert "x86/csv: Enhance CMA memory usage reporting for CSV3" - !20576 media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg() - !20575 RDMA/cm: Fix leaking the multicast GID table reference - !20580 RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly - !20551 Fix CVE-2025-68785 - !20478 f2fs: fix to avoid potential deadlock - !20501 [OLK-6.6] backport important bugfix for bnxt driver from upstream linux-6.6.y - !20520 Fix CVE-2026-23038 - !20424 net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup - !20425 mlx5: Fix default values in create CQ - RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly - media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg() - RDMA/cm: Fix leaking the multicast GID table reference - net: openvswitch: fix middle attribute validation in push_nsh() action - net: openvswitch: remove never-working support for setting nsh fields - pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() - bnxt_en: Fix potential data corruption with HW GRO/LRO - f2fs: fix to avoid potential deadlock - mlx5: Fix default values in create CQ - net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup - riscv kernel upgrade to 6.6.0-138.0.0 - Fixed system hang when boot systemd on spacemit k3 - riscv: perf vendor events: fix lrw core PMU event mapping - !20727 v2 bpf: sockmap fixes - !20741 scsi: qla2xxx: Sanitize payload size to prevent member overflow - !20744 fix CVE-2025-38449 - !20763 net: usb: asix: validate PHY address before use - !20762 smc91x: fix broken irq-context in PREEMPT_RT - !20293 [Hygon][6.6][EDAC] The width of hash value is 2 bits for Hygon family 18h model 6h processors - !20290 [Hygon][6.6][Bugfix] Bug fix for EDAC to use unicast instead of broadcast on hygon family 18h model 4h - !20289 [Hygon][6.6][Bugfix] Bug fix for EDAC to correct the address translation on hygon family 18h model 4h - !20245 KVM: arm64: Refactor exit handlers - !20246 KVM: arm64: Mark some header functions as inline - !19005 [Hygon] [OLK-6.6] [Bugfix] Fix memory bandwidth counter width for Hygon QoS - !20292 [Hygon][6.6][TSC Adjust] Backport x86 TSC adjust patch - !20273 [Hygon][6.6][Bugfix] Get correct CPU LLC ID in guest for Hygon processors - !20722 [OLK-6.6][linux-6.6.y sync] Backport 6.6.104-6.6.106 LTS Patches - !20667 fix CVE-2024-50102 - !20736 netfilter: nf_tables: remove redundant chain validation on register store - !20758 ub: ubase: Fixed the alarm issue caused by the initialization of the structure variable definition. - !20721 obmm: reduce log noise for successful export/import/preimport - net: usb: asix: validate PHY address before use - smc91x: fix broken irq-context in PREEMPT_RT - !20731 devlink: rate: Unset parent pointer in devl_rate_nodes_destroy - !20732 libceph: return the handler error from mon_handle_auth_done() - !20743 mm: slub: avoid wake up kswapd in set_track_prepare - ub: ubase: Fixed the alarm issue caused by the initialization of the structure variable definition. - !20750 ub: cdma: adapted to UMMU interface changes - !20713 urma: DFX of log in kernel - urma: optimize log levels for kernel space - ub: cdma: adapted to UMMU interface changes - wifi: ath11k: avoid bit operation on key flags - drm/mediatek: fix potential OF node use-after-free - cpufreq: intel_pstate: Check IDA only before MSR_IA32_PERF_CTL writes - wifi: cfg80211: sme: store capped length in __cfg80211_connect_result() - !20708 ub:hisi-ubus: Add create bus instance ummu bypass - drm: fix kabi for struct drm_framebuffer - drm/framebuffer: Acquire internal references on GEM handles - drm/gem: Acquire references on GEM handles for framebuffers - mm: slub: avoid wake up kswapd in set_track_prepare - scsi: qla2xxx: Sanitize payload size to prevent member overflow - netfilter: nf_tables: remove redundant chain validation on register store - libceph: return the handler error from mon_handle_auth_done() - devlink: rate: Unset parent pointer in devl_rate_nodes_destroy - Documentation/hw-vuln: Add VMSCAPE documentation - dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status() - riscv: use lw when reading int cpu in asm_per_cpu - mm: slub: avoid wake up kswapd in set_track_prepare - tools: gpio: remove the include directory on make clean - tools: gpio: rm .*.cmd on make clean - drm/amd/amdgpu: Fix missing error return on kzalloc failure - drm/amdgpu: Replace DRM_* with dev_* in amdgpu_psp.c - perf bpf-event: Fix use-after-free in synthesis - drm/bridge: ti-sn65dsi86: fix REFCLK setting - spi: spi-fsl-lpspi: Clear status register after disabling the module - spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort - spi: spi-fsl-lpspi: Set correct chip-select polarity bit - spi: spi-fsl-lpspi: Fix transmissions when using CONT - hwmon: mlxreg-fan: Prevent fans from getting stuck at 0 RPM - pcmcia: omap: Add missing check for platform_get_resource - Revert "drm/amdgpu: Avoid extra evict-restore process." - ALSA: hda/realtek: Fix headset mic for TongFang X6[AF]R5xxY - ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model - drm/mediatek: Fix device/node reference count leaks in mtk_drm_get_all_drm_priv - drm/mediatek: Fix using wrong drm private data to bind mediatek-drm - drm/mediatek: Add crtc path enum for all_drm_priv array - vmxnet3: update MTU after device quiesce - net: dsa: microchip: linearize skb for tail-tagging switches - net: dsa: microchip: update tag_ksz masks for KSZ9477 family - dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status() - ALSA: hda/realtek - Add new HP ZBook laptop with micmute led fixup - ALSA: hda/realtek: Add support for HP Agusta using CS35L41 HDA - iio: pressure: mprls0025pa: use aligned_s64 for timestamp - iio: chemical: pms7003: use aligned_s64 for timestamp - iio: imu: inv_mpu6050: align buffer for timestamp - thermal/drivers/mediatek/lvts: Disable low offset IRQ for minimum threshold - nouveau: fix disabling the nonstall irq due to storm code - cpufreq: intel_pstate: Unchecked MSR aceess in legacy mode - net: pcs: rzn1-miic: Correct MODCTRL register offset - platform/x86/amd/pmc: Add TUXEDO IB Pro Gen10 AMD to spurious 8042 quirks list - drm/amdgpu: drop hw access in non-DC audio fini - wifi: mt76: mt7996: Initialize hdr before passing to skb_put_data() - wifi: mwifiex: Initialize the chan_stats array to zero - tcp_bpf: Fix copied value in tcp_bpf_sendmsg - skmsg: Return copied bytes in sk_msg_memcopy_from_iter - tcp_bpf: Add sk_rmem_alloc related logic for tcp_bpf ingress redirection - Revert "bpf, sockmap: Add sk_rmem_alloc check for sockmap" - ALSA: usb-audio: Add mute TLV for playback volumes on some devices - phy: mscc: Stop taking ts_lock for tx_queue and use its own lock - selftest: net: Fix weird setsockopt() in bind_bhash.c. - net: atm: fix memory leak in atm_register_sysfs when device_register fail - ax25: properly unshare skbs in ax25_kiss_rcv() - mctp: return -ENOPROTOOPT for unknown getsockopt options - net/smc: Remove validation of reserved bits in CLC Decline message - ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init() - net: thunder_bgx: decrement cleanup index before use - net: thunder_bgx: add a missing of_node_put - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() - wifi: libertas: cap SSID len in lbs_associate() - wifi: cw1200: cap SSID length in cw1200_do_join() - net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets - wifi: ath11k: fix group data packet drops during rekey - wifi: ath11k: avoid forward declaration of ath11k_mac_start_vdev_delay() - wifi: ath11k: rename ath11k_start_vdev_delay() - wifi: ath11k: Introduce and use ath11k_sta_to_arsta() - net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() - macsec: read MACSEC_SA_ATTR_PN with nla_get_uint - netlink: add variable-length / auto integers - net: macb: Fix tx_ptr_lock locking - icmp: fix icmp_ndo_send address translation for reply direction - mISDN: Fix memory leak in dsp_hwec_enable() - xirc2ps_cs: fix register access when enabling FullDuplex - netfilter: conntrack: helper: Replace -EEXIST by -EBUSY - wifi: cfg80211: fix use-after-free in cmp_bss() - arm64: dts: imx8mp: Fix missing microSD slot vqmmc on Data Modul i.MX8M Plus eDM SBC - arm64: dts: imx8mp: Fix missing microSD slot vqmmc on DH electronics i.MX8M Plus DHCOM - tee: optee: ffa: fix a typo of "optee_ffa_api_is_compatible" - arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro - Bluetooth: hci_sync: Avoid adding default advertising on startup - cpupower: Fix a bug where the -t option of the set subcommand was not working. - drm/amd/display: Don't warn when missing DCE encoder caps - cdc_ncm: Flag Intel OEM version of Fibocom L850-GL as WWAN - LoongArch: Save LBT before FPU in setup_sigcontext() - btrfs: avoid load/store tearing races when checking if an inode was logged - btrfs: fix race between setting last_dir_index_offset and inode logging - btrfs: fix race between logging inode and checking if it was logged before - bpf: Fix oob access in cgroup local storage - !20556 urma: fix update topo logic - !20639 [OLK-6.6][linux-6.6.y sync] Backport 6.6.103-6.6.104 LTS Patches - !20641 [OLK-6.6][linux-6.6.y sync] LoongArch: Add more instruction opcodes and emit_* helpers - !20560 *** fix CVE-2025-38062 *** - !20662 pNFS: Fix a deadlock when returning a delegation during open() - ub:hisi-ubus: Add create bus instance ummu bypass - Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" - Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set" - HID: mcp2221: Handle reads greater than 60 bytes - HID: mcp2221: Don't set bus speed on every transfer - net/mlx5: SF, Fix add port error handling - drm/nouveau/disp: Always accept linear modifier - smb3 client: fix return code mapping of remap_file_range - net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions - dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted - HID: wacom: Add a new Art Pen 2 - HID: logitech: Add ids for G PRO 2 LIGHTSPEED - HID: quirks: add support for Legion Go dual dinput modes - net: stmmac: Set CIC bit only for TX queues with COE - net: stmmac: xgmac: Correct supported speed modes - net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts - net/mlx5e: Set local Xoff after FW update - net/mlx5e: Update and set Xon/Xoff upon port speed set - net/mlx5e: Update and set Xon/Xoff upon MTU set - net/mlx5: Nack sync reset when SFs are present - net/mlx5: Convert SF port_indices xarray to function_ids xarray - net/mlx5: Use devlink port pointer to get the pointer of container SF struct - net/mlx5: Call mlx5_sf_id_erase() once in mlx5_sf_dealloc() - phy: mscc: Fix when PTP clock is register and unregister - net: dlink: fix multicast stats being counted incorrectly - dt-bindings: display/msm: qcom,mdp5: drop lut clock - drm/nouveau: remove unused memory target test - drm/nouveau: remove unused increment in gm200_flcn_pio_imem_wr - Bluetooth: hci_sync: fix set_local_name race condition - Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced - Bluetooth: hci_event: Mark connection as closed during suspend disconnect - Bluetooth: hci_event: Treat UNKNOWN_CONN_ID on disconnect as success - HID: input: report battery status changes immediately - HID: input: rename hidinput_set_battery_charge_status() - powerpc/kvm: Fix ifdef to remove build warning - drm/msm: Defer fd_install in SUBMIT ioctl - vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() - ACPI: EC: Add device to acpi_ec_no_wakeup[] qurik list - erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC - ASoC: codecs: tx-macro: correct tx_macro_component_drv name - smb: client: fix race with concurrent opens in unlink(2) - scsi: core: sysfs: Correct sysfs attributes access rights - of: dynamic: Fix use after free in of_changeset_add_prop_helper() - of: Add a helper to free property struct - mips: lantiq: xway: sysctrl: rename the etop node - mips: dts: lantiq: danube: add missing burst length property - pinctrl: STMFX: add missing HAS_IOMEM dependency - of: dynamic: Fix memleak when of_pci_add_properties() failed - !20684 urma: adjust urma log format - !20355 udp: Deal with race between UDP socket address change and rehash - !20627 Fixes CVE-2025-38627 - !20702 CVE-2025-39948 - !20701 netfilter: ctnetlink: remove refcounting in expectation dumpers - !20700 CVE-2025-38678 - !20703 CVE-2025-38491 - !20690 tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. - obmm: reduce log noise for successful export/import/preimport - mptcp: avoid deadlock on fallback while reinjecting - mptcp: plug races between subflow fail and subflow creation - mptcp: make fallback action and fallback decision atomic - ice: fix Rx page leak on multi-buffer frames - ice: fix incorrect counter for buffer allocation failures - ice: stop storing XDP verdict within ice_rx_buf - ice: gather page_count()'s of each frag right before XDP prog call - ice: Introduce ice_xdp_buff - netfilter: ctnetlink: remove refcounting in expectation dumpers - netfilter: nf_tables: reject duplicate device on updates - netfilter: nf_tables: Introduce functions freeing nft_hook objects - netfilter: nf_tables: Fix percpu address space issues in nf_tables_api.c - err.h: add ERR_PTR_PCPU(), PTR_ERR_PCPU() and IS_ERR_PCPU() macros - tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. - !20498 Fix CVE-2025-71118 - !20608 pmdomain: arm: scmi: Fix genpd leak on provider registration failure - !20679 x86/CPU/AMD: Add RDSEED fix for Zen5 - !20650 fix cve-2025-40300 - !20661 Input: alps - fix use-after-free bugs caused by dev3_register_work - !20664 backport some net bugfix from 6.6 lts - urma: adjust urma log format - !20678 ub: udma: close debug switch load parameters. - ub: udma: close debug switch load parameters. - x86/CPU/AMD: Add RDSEED fix for Zen5 - !20630 net: LTS-6.6 bugfix backport - !20632 net/sched: sch_qfq: do not free existing class in qfq_change_class() - !20631 macvlan: fix possible UAF in macvlan_forward_source() - !20628 Fix CVE-2025-39910 - !20659 v2 Fix CVE-2025-22090 - !20506 XSched: Update XSched manual - !20647 media: imon: make send_packet() more robust - !20646 ksm: use range-walk function to jump over holes in scan_get_next_rmap_item - !20645 fbcon: Set fb_display[i - !20648 parse_longname(): strrchr() expects NUL-terminated string - !20621 urma: modify log level - !20602 urma: fix the jfe uaf issue that occurred during the killall process. - !20567 urma:change log level and pass status 9 - !20640 iio: common: st_sensors: Fix use of uninitialize device structs - !20634 usb: gadget: udc: fix use-after-free in usb_gadget_state_work - !20633 net: dsa: properly keep track of conduit reference - !20635 fix CVE-2025-68231 - !20651 mm/slub: avoid accessing metadata when pointer is invalid in object_err() - !20649 drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb - !20652 mm/vmalloc: fix data race in show_numa_info() - x86: uaccess: don't use runtime-const rewriting in modules - x86: fix off-by-one in access_ok() - x86: fix user address masking non-canonical speculation issue - x86/uaccess: Zero the 8-byte get_range case on failure on 32-bit - x86/uaccess: Improve the 8-byte getuser() case - x86: fix whitespace in runtime-const assembler output - dcache: keep dentry_hashtable or d_hash_shift even when not used - runtime constants: add x86 architecture support - runtime constants: deal with old decrepit linkers - x86/uaccess: Add missing __force to casts in __access_ok() and valid_user_address() - !20345 arm64: entry: xcall/xint: make asm conditionals compatible with clang IAS - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). - libceph: replace BUG_ON with bounds check for map->max_osd - libceph: prevent potential out-of-bounds writes in handle_auth_session_key() - libceph: fix potential use-after-free in have_mon_and_osd_map() - sctp: Hold sock lock while iterating over address list - sctp: Prevent TOCTOU out-of-bounds write - sctp: Hold RCU read lock while iterating over address list - tipc: Fix use-after-free in tipc_mon_reinit_self(). - sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto - sctp: avoid NULL dereference when chunk data buffer is missing - bpf: Explicitly check accesses to bpf_sock_addr - ipvs: Defer ip_vs_ftp unregister during netns cleanup - nexthop: Forbid FDB status change while nexthop is in a group - netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). - net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer - sctp: initialize more fields in sctp_v6_from_sk() - pNFS: Fix a deadlock when returning a delegation during open() - Input: alps - fix use-after-free bugs caused by dev3_register_work - x86/cpu: Get CPU LLC ID from CPUID 0x8000001d in guest for Hygon processors - kernel/fork: only call untrack_pfn_clear() on VMAs duplicated for fork() - mm: (un)track_pfn_copy() fix + doc improvements - x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range() - !20642 mtdchar: fix integer overflow in read/write ioctls - mm/vmalloc: fix data race in show_numa_info() - mm/slub: avoid accessing metadata when pointer is invalid in object_err() - config: enable CONFIG_MITIGATION_VMESCAPE by default on x86 - x86/vmscape: Enable the mitigation - x86/vmscape: Enumerate VMSCAPE bug - x86/vmscape: Add conditional IBPB mitigation - drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb - parse_longname(): strrchr() expects NUL-terminated string - media: imon: make send_packet() more robust - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item - fbcon: Set fb_display[i]->mode to NULL when the mode is released - !20569 CVE-2024-35808 - mtdchar: fix integer overflow in read/write ioctls - !20619 Fix CVE-2026-22991 - !20612 net: hns3: extend HCLGE_FD_AD_COUNTER_NUM to 8 bits - LoongArch: Add more instruction opcodes and emit_* helpers - iio: common: st_sensors: Fix use of uninitialize device structs - !20581 null_blk: fix kmemleak by releasing references to fault configfs items - mm/mempool: fix poisoning order>0 pages with HIGHMEM - mm/page_poison: replace kmap_atomic() with kmap_local_page() - mm/mempool: replace kmap_atomic() with kmap_local_page() - usb: gadget: udc: fix use-after-free in usb_gadget_state_work - net: dsa: properly keep track of conduit reference - net/sched: sch_qfq: do not free existing class in qfq_change_class() - macvlan: fix possible UAF in macvlan_forward_source() - netfilter: nft_objref: validate objref and objrefmap expressions - arp: do not assume dev_hard_header() does not change skb->head - ip6_gre: make ip6gre_header() robust - netfilter: nf_tables: avoid chain re-validation if possible - netfilter: nf_tables: drop unused 3rd argument from validate callback ops - Revert "netfilter: nft_objref: validate objref and objrefmap expressions" - bpf: Fix reference count leak in bpf_prog_test_run_xdp() - net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset - ethtool: Avoid overflowing userspace buffer on stats query - ipvs: fix ipv4 null-ptr-deref in route error path - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() - !20596 mm/page_alloc: prevent pcp corruption with SMP=n - !20598 team: fix check for port enabled in team_queue_override_port_prio_changed() - !18823 hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio - mm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc() - kasan: avoid sleepable page allocation from atomic context - f2fs: compress: fix UAF of f2fs_inode_info in f2fs_free_dic - f2fs: compress: change the first parameter of page_array_{alloc,free} to sbi - !20583 [OLK-6.6][linux-6.6.y sync] Backport 6.6.102-6.6.103 LTS Patches - !20460 fbdev: Fix vmalloc out-of-bounds write in fast_imageblit - urma:fix log level and pass status 9 - urma: modify log level - !20592 CVE-2025-71141 fixup - !20594 CVE-2025-39744 fixup - !20607 powerpc/64s/slb: Fix SLB multihit issue during SLB preload - !20606 mm/huge_memory: fix NULL pointer deference when splitting folio - !20604 Fix CVE-2026-22984 - !20603 Fix CVE-2026-23021 - !20600 Fix CVE-2026-22990 - urma: fix the jfe uaf issue that occurred during the killall process. - !20380 pswiotlb: Adapt to the IOMMU DMA API upgraded by IOMMUFD - libceph: make free_choose_arg_map() resilient to partial allocation - drm/dp: Change AUX DPCD probe address from LANE0_1_STATUS to TRAINING_PATTERN_SET - net: hns3: extend HCLGE_FD_AD_COUNTER_NUM to 8 bits - net: hns3: extend HCLGE_FD_AD_QID to 11 bits - net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue - net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M - Revert "net: hns3: add support for FD counter" - !20587 dmaengine: stm32: dmamux: fix device leak on route allocation - pmdomain: arm: scmi: Fix genpd leak on provider registration failure - powerpc/64s/slb: Fix SLB multihit issue during SLB preload - mm/huge_memory: fix NULL pointer deference when splitting folio - !20562 LoongArch: BPF: Sign extend kfunc call arguments - !20470 ipv4: Fix reference count leak when using error routes with nexthop objects - !20471 net: sock: fix hardened usercopy panic in sock_recv_errqueue - !20472 net: fix memory leak in skb_segment_list for GRO packets - !20473 ipv4: ip_gre: make ipgre_header() robust - !20469 SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf - !20476 ipv6: Fix use-after-free in inet6_addr_del(). - !20477 svcrdma: bound check rq_pages index in inline path - !20578 ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() - !20579 fix CVE-2025-68768 - !20542 Fix NFS deadlock - USB: storage: Remove subclass and protocol overrides from Novatek quirk - cpuidle: governors: menu: Select polling state in some more cases - cpuidle: governors: menu: Rearrange main loop in menu_select() - cpuidle: menu: Update documentation after previous changes - Revert "drm/tegra: dsi: Clear enable register if powered by bootloader" - parisc: Remove spurious if statement from raw_copy_from_user() - ata: libata-scsi: Fix system suspend for a security locked drive - Revert "drm/amdgpu: fix incorrect vm flags to map bo" - mfd: axp20x: Set explicit ID for regulator cell if no IRQ line is present - drm/amd/display: use udelay rather than fsleep - sched/fair: Revert max_newidle_lb_cost bump - net: ipv4: fix regression in local-broadcast routes - tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers - PM: runtime: Do not clear needs_force_resume with enabled runtime PM - usb: typec: ucsi: psy: Set max current to zero when disconnected - io_uring/rw: cast rw->flags assignment to rwf_t - Documentation: ACPI: i2c-muxes: fix I2C device references - s390/hypfs: Enable limited access during lockdown - s390/hypfs: Avoid unnecessary ioctl registration in debugfs - ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation - net/mlx5e: Preserve shared buffer capacity during headroom updates - net/mlx5: Base ECVF devlink port attrs from 0 - Octeontx2-af: Skip overlap check for SPI field - bonding: send LACPDUs periodically in passive mode after receiving partner's LACPDU - bonding: Add independent control state machine - bonding: update LACP activity flag after setting lacp_active - net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate - ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc - gve: prevent ethtool ops after shutdown - phy: mscc: Fix timestamping for vsc8584 - net: ethernet: mtk_ppe: add RCU lock around dev_fill_forward_path - ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add - net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM - ALSA: usb-audio: Fix size validation in convert_chmap_v3() - mlxsw: spectrum: Forward packets with an IPv4 link-local source IP - Bluetooth: hci_conn: do return error from hci_enhanced_setup_sync() - Bluetooth: hci_event: fix MTU for BN == 0 in CIS Established - scsi: qla4xxx: Prevent a potential error pointer dereference - RDMA/bnxt_re: Fix to initialize the PBL array - RDMA/bnxt_re: Fix to remove workload check in SRQ limit path - RDMA/bnxt_re: Fix to do SRQ armena by default - RDMA/erdma: Fix ignored return value of init_kernel_qp - iosys-map: Fix undefined behavior in iosys_map_clear() - cgroup/cpuset: Use static_branch_enable_cpuslocked() on cpusets_insane_config_key - spi: spi-fsl-lpspi: Clamp too high speed_hz - usb: typec: maxim_contaminant: disable low power mode when reading comparator values - usb: typec: maxim_contaminant: re-enable cc toggle if cc is open and port is clean - iio: imu: inv_icm42600: change invalid data error to -EBUSY - iio: imu: inv_icm42600: Convert to uXX and sXX integer types - iio: imu: inv_icm42600: use = { } instead of memset() - iio: imu: inv_icm42600: switch timestamp type from int64_t __aligned(8) to aligned_s64 - iio: temperature: maxim_thermocouple: use DMA-safe buffer for spi_read() - iio: light: as73211: Ensure buffer holes are zeroed - tls: fix handling of zero-length records on the rx_list - powerpc/boot: Fix build with gcc 15 - mmc: sdhci-pci-gli: GL9763e: Mask the replay timer timeout of AER - compiler: remove __ADDRESSABLE_ASM{_STR,}() again - drm/amd/display: Don't overclock DCE 6 by 15% - usb: dwc3: pci: add support for the Intel Wildcat Lake - usb: dwc3: Ignore late xferNotReady event to prevent halt timeout - USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles - usb: storage: realtek_cr: Use correct byte order for bcs->Residue - USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera - usb: renesas-xhci: Fix External ROM access timeouts - usb: core: hcd: fix accessing unmapped memory in SINGLE_STEP_SET_FEATURE test - comedi: Make insn_rw_emulate_bits() do insn->n samples - usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive - cdx: Fix off-by-one error in cdx_rpmsg_probe() - most: core: Drop device reference after usage in get_channel() - iio: proximity: isl29501: fix buffered read on big-endian systems - iio: pressure: bmp280: Use IS_ERR() in bmp280_common_probe() - fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable() - drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS - cpuidle: governors: menu: Avoid selecting states with too much latency - cpuidle: menu: Remove iowait influence - mmc: sdhci-pci-gli: Add a new function to simplify the code - mmc: sdhci-pci-gli: Use PCI AER definitions, not hard-coded values - mptcp: disable add_addr retransmission when timeout is 0 - mptcp: remove duplicate sk_reset_timer call - use uniform permission checks for all mount propagation changes - arm64: dts: ti: k3-am62-main: Remove eMMC High Speed DDR support - scsi: mpi3mr: Serialize admin queue BAR writes on 32-bit systems - scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers - scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE - PCI: imx6: Add IMX8MM_EP and IMX8MP_EP fixed 256-byte BAR 4 in epc_features - PCI: imx6: Delay link start until configfs 'start' written - PCI: rockchip: Set Target Link Speed to 5.0 GT/s before retraining - PCI: rockchip: Use standard PCIe definitions - drm/amd/display: Fill display clock and vblank time in dce110_fill_display_configs - drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs - drm/amd/display: Fix DP audio DTO1 clock source on DCE 6. - drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3 - ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and EliteBook 830 G6 - mm/debug_vm_pgtable: clear page table entries at destroy_args() - squashfs: fix memory leak in squashfs_fill_super - mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for consistency - memstick: Fix deadlock by moving removing flag earlier - KVM: arm64: Fix kernel BUG() due to bad backport of FPSIMD/SVE/SME fix - sched/fair: Fix frequency selection for non-invariant case - kbuild: userprogs: use correct linker when mixing clang and GNU ld - ata: libata-scsi: Return aborted command when missing sense and result TF - PM: runtime: Take active children into account in pm_runtime_get_if_in_use() - PM: runtime: Simplify pm_runtime_get_if_active() usage - ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig - usb: dwc3: imx8mp: fix device leak at unbind - wifi: mac80211: check basic rates validity in sta_link_apply_parameters - KVM: x86: Take irqfds.lock when adding/deleting IRQ bypass producer - s390/mm: Remove possible false-positive warning in pte_free_defer() - btrfs: send: make fs_path_len() inline and constify its argument - btrfs: send: use fallocate for hole punching with send stream v2 - btrfs: send: avoid path allocation for the current inode when issuing commands - btrfs: send: keep the current inode's path cached - btrfs: send: add and use helper to rename current inode when processing refs - btrfs: send: only use boolean variables at process_recorded_refs() - btrfs: send: factor out common logic when sending xattrs - btrfs: populate otime when logging an inode item - btrfs: constify more pointer parameters - btrfs: fix ssd_spread overallocation - btrfs: open code timespec64 in struct btrfs_inode - xfs: fully decouple XFS_IBULK* flags from XFS_IWALK* flags - btrfs: abort transaction on unexpected eb generation at btrfs_copy_root() - btrfs: always abort transaction on failure to add block group to free space tree - btrfs: move transaction aborts to the error site in add_block_group_free_space() - btrfs: qgroup: fix race between quota disable and quota rescan ioctl - usb: typec: fusb302: cache PD RX state - block: Make REQ_OP_ZONE_FINISH a write operation - block: reject invalid operation in submit_bio_noacct - leds: flash: leds-qcom-flash: Fix registry access after re-bind - leds: flash: leds-qcom-flash: Limit LED current based on thermal condition - selftests/memfd: add test for mapping write-sealed memfd read-only - mm: update memfd seal write check to include F_SEAL_WRITE - mptcp: pm: kernel: flush: do not reset ADD_ADDR limit - mptcp: drop skb if MPTCP skb extension allocation fails - ipv6: sr: Fix MAC comparison to be constant-time - drm/amd/display: Don't overwrite dce60_clk_mgr - drm/amd/display: Add primary plane to commits for correct VRR handling - drm/amdkfd: Destroy KFD debugfs after destroy KFD wq - drm/amdgpu: update mmhub 3.0.1 client id mappings - drm/amdgpu: Avoid extra evict-restore process. - drm/amd: Restore cached power limit during resume - media: venus: venc: Clamp param smaller than 1fps and bigger than 240 - media: venus: vdec: Clamp param smaller than 1fps and bigger than 240. - media: venus: protect against spurious interrupts during probe - media: venus: hfi: explicitly release IRQ during teardown - media: qcom: camss: cleanup media device allocated resource on error path - media: ov2659: Fix memory leaks in ov2659_probe() - media: usbtv: Lock resolution while streaming - media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free() - media: verisilicon: Fix AV1 decoder clock frequency - media: vivid: fix wrong pixel_array control size - media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init() - media: hi556: correct the test pattern configuration - media: gspca: Add bounds checking to firmware parser - parisc: Update comments in make_insert_tlb - parisc: Try to fixup kernel exception in bad_area_nosemaphore path of do_page_fault() - parisc: Rename pte_needs_flush() to pte_needs_cache_flush() in cache.c - parisc: Makefile: explain that 64BIT requires both 32-bit and 64-bit compilers - parisc: Define and use set_pte_at() - parisc: Check region is readable by user in raw_copy_from_user() - soc/tegra: pmc: Ensure power-domains are in a known state - f2fs: fix to avoid out-of-boundary access in dnode page - phy: qcom: phy-qcom-m31: Update IPQ5332 M31 USB phy initialization sequence - vhost/vsock: Avoid allocating arbitrarily-sized SKBs - PCI: endpoint: Fix configfs group removal on driver teardown - PCI: endpoint: Fix configfs group list head handling - mtd: rawnand: renesas: Add missing check after DMA map - mtd: rawnand: fsmc: Add missing check after DMA map - mtd: spinand: propagate spinand_wait() errors from spinand_write_page() - mtd: spi-nor: Fix spi_nor_try_unlock_all() - hwmon: (gsc-hwmon) fix fan pwm setpoint show functions - pwm: mediatek: Fix duty and period setting - pwm: mediatek: Handle hardware enable and clock enable separately - pwm: imx-tpm: Reset counter if CMOD is 0 - wifi: ath11k: fix dest ring-buffer corruption when ring is full - wifi: ath11k: fix source ring-buffer corruption - wifi: ath11k: fix dest ring-buffer corruption - wifi: ath12k: fix dest ring-buffer corruption when ring is full - wifi: ath12k: fix source ring-buffer corruption - wifi: ath12k: fix dest ring-buffer corruption - wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table() - iio: adc: ad_sigma_delta: change to buffer predisable - zynq_fpga: use sgtable-based scatterlist wrappers - scsi: ufs: ufs-pci: Fix default runtime and system PM levels - scsi: ufs: ufs-pci: Fix hibernate state transition for Intel MTL-like host controllers - ata: libata-scsi: Fix ata_to_sense_error() status handling - scsi: mpi3mr: Fix race between config read submit and interrupt completion - dt-bindings: display: sprd,sharkl3-dsi-host: Fix missing clocks constraints - dt-bindings: display: sprd,sharkl3-dpu: Fix missing clocks constraints - arm64: dts: ti: k3-am62-verdin: Enable pull-ups on I2C buses - arm64: dts: ti: k3-am62a7-sk: fix pinmux for main_uart1 - arm64: dts: ti: k3-pinctrl: Enable Schmitt Trigger by default - btrfs: zoned: fix write time activation failure for metadata block group - ext4: fix hole length calculation overflow in non-extent inodes - ext4: don't try to clear the orphan_present feature block device is r/o - ext4: fix reserved gdt blocks handling in fsmap - ext4: fix fsmap end of range reporting with bigalloc - ext4: check fast symlink for ea_inode correctly - tracing: fprobe-event: Sanitize wildcard for fprobe event name - crypto: qat - lower priority for skcipher and aead algorithms - lib/crypto: mips/chacha: Fix clang build and remove unneeded byteswap - vt: defkeymap: Map keycodes above 127 to K_HOLE - vt: keyboard: Don't process Unicode characters in K_OFF mode - bus: mhi: host: Fix endianness of BHI vector table - usb: dwc3: meson-g12a: fix device leaks at unbind - usb: musb: omap2430: fix device leak at unbind - usb: gadget: udc: renesas_usb3: fix device leak at unbind - usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init() - m68k: Fix lost column on framebuffer debug console - platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister() - cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table() - rcu: Fix racy re-initialization of irq_work causing hangs - HID: apple: avoid setting up battery timer for devices without battery - HID: magicmouse: avoid setting up battery timer when not needed - RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages - tools/nolibc: fix spelling of FD_SETBITMASK in FD_* macros - media: uvcvideo: Do not mark valid metadata as invalid - media: venus: Fix OOB read due to missing payload bound check - parisc: Makefile: fix a typo in palo.conf - fbdev: Fix vmalloc out-of-bounds write in fast_imageblit - btrfs: do not allow relocation of partially dropped subvolumes - btrfs: zoned: do not select metadata BG as finish target - btrfs: clear dirty status from extent buffer on error at insert_new_root() - btrfs: zoned: do not remove unwritten non-data block group - btrfs: abort transaction during log replay if walk_log_tree() failed - btrfs: zoned: use filesystem size not disk size for reclaim decision - cdc-acm: fix race between initial clearing halt and open - thunderbolt: Fix copy+paste error in match_service_id() - usb: typec: ucsi: Update power_supply on power role change - misc: rtsx: usb: Ensure mmc child device is active when card is present - iommufd: Report unmapped bytes in the error path of iopt_unmap_iova_range - cifs: reset iface weights when we cannot find a candidate - drm/amdgpu: fix incorrect vm flags to map bo - scsi: lpfc: Remove redundant assignment to avoid memory leak - rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe - pNFS: Handle RPC size limit for layoutcommits - pNFS: Fix disk addr range check in block/scsi layout - pNFS: Fix stripe mapping in block/scsi layout - ASoC: Intel: avs: Fix uninitialized pointer error in probe() - net: phy: smsc: add proper reset flags for LAN8710A - ipmi: Fix strcpy source and destination the same - kconfig: lxdialog: fix 'space' to (de)select options - kconfig: gconf: fix potential memory leak in renderer_edited() - kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed() - ipmi: Use dev_warn_ratelimited() for incorrect message warnings - vfio/mlx5: fix possible overflow in tracking max message size - scsi: aacraid: Stop using PCI_IRQ_AFFINITY - scsi: target: core: Generate correct identifiers for PR OUT transport IDs - scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans - kconfig: nconf: Ensure null termination where strncpy is used - vfio/type1: conditional rescheduling while pinning - kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c - f2fs: check the generic conditions first - exfat: add cluster chain loop check for dir - i2c: Force DLL0945 touchpad i2c freq to 100khz - apparmor: use the condition in AA_BUG_FMT even with debug disabled - dm-table: fix checking for rq stackable devices - dm-mpath: don't print the "loaded" message if registering fails - i3c: master: Initialize ret in i3c_i2c_notifier_call() - i3c: don't fail if GETHDRCAP is unsupported - apparmor: shift ouid when mediating hard links in userns - rtc: ds1307: handle oscillator stop flag (OSF) for ds1341 - i3c: add missing include to internal header - module: Prevent silent truncation of module name in delete_module(2) - md: dm-zoned-target: Initialize return variable r to avoid uninitialized use - soundwire: Move handle_nested_irq outside of sdw_dev_lock - soundwire: amd: serialize amd manager resume sequence during pm_prepare - crypto: octeontx2 - add timeout for load_fvc completion poll - media: uvcvideo: Fix bandwidth issue for Alcor camera - media: usb: hdpvr: disable zero-length read messages - media: tc358743: Increase FIFO trigger level to 374 - media: tc358743: Return an appropriate colorspace from tc358743_set_fmt - media: tc358743: Check I2C succeeded during probe - pinctrl: stm32: Manage irq affinity settings - scsi: mpi3mr: Correctly handle ATA device errors - scsi: mpt3sas: Correctly handle ATA device errors - power: supply: qcom_battmgr: Add lithium-polymer entry - RDMA/core: reduce stack using in nldev_stat_get_doit() - dmaengine: stm32-dma: configure next sg only if there are more than 2 sgs - leds: leds-lp50xx: Handle reg to get correct multi_index - media: v4l2-common: Reduce warnings about missing V4L2_CID_LINK_FREQ control - MIPS: lantiq: falcon: sysctrl: fix request memory check logic - crypto: jitter - fix intermediary handling - watchdog: iTCO_wdt: Report error if timeout configuration fails - MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free} - clk: qcom: ipq5018: keep XO clock always on - hwmon: (emc2305) Set initial PWM minimum value during probe based on thermal state - watchdog: dw_wdt: Fix default timeout - fs/orangefs: use snprintf() instead of sprintf() - phy: rockchip-pcie: Properly disable TEST_WRITE strobe signal - mfd: axp20x: Set explicit ID for AXP313 regulator - clk: tegra: periph: Fix error handling and resolve unsigned compare warning - fbdev: fix potential buffer overflow in do_register_framebuffer() - cifs: Fix calling CIFSFindFirst() for root path without msearch - watchdog: sbsa: Adjust keepalive timeout to avoid MediaTek WS0 race condition - drm/amd/display: Avoid configuring PSR granularity if PSR-SU not supported - drm/amd/display: Only finalize atomic_obj if it was initialized - vhost: fail early when __vhost_add_used() fails - vsock/virtio: Resize receive buffers so that each SKB fits in a 4K page - net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325 - rcu: Fix rcu_read_unlock() deadloop due to IRQ work - drm/amd/display: Avoid trying AUX transactions on disconnected ports - selftests/bpf: Fix a user_ringbuf failure with arm64 64KB page size - bpf: Make reg_not_null() true for CONST_PTR_TO_MAP - uapi: in6: restore visibility of most IPv6 socket options - drm/ttm: Should to return the evict error - drm: renesas: rz-du: mipi_dsi: Add min check for VCLK range - net: ncsi: Fix buffer overflow in fetching version id - ionic: clean dbpage in de-init - wifi: rtlwifi: fix possible skb memory leak in _rtl_pci_init_one_rxdesc() - ptp: Use ratelimite for freerun error message - bpftool: Fix JSON writer resource leak in version command - net: dsa: b53: prevent SWITCH_CTRL access on BCM5325 - net: dsa: b53: prevent DIS_LEARNING access on BCM5325 - net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325 - net: dsa: b53: fix b53_imp_vlan_setup for BCM5325 - gve: Return error for unknown admin queue command - net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs - net: vlan: Make is_vlan_dev() a stub when VLAN is not configured - drm/amd: Allow printing VanGogh OD SCLK levels without setting dpm to manual - dpaa_eth: don't use fixed_phy_change_carrier - wifi: iwlegacy: Check rate_idx range after addition - netmem: fix skb_frag_address_safe with unreadable skbs - powerpc: floppy: Add missing checks after DMA map - wifi: ath12k: Decrement TID on RX peer frag setup error handling - wifi: ath12k: Enable REO queue lookup table feature on QCN9274 hw2.0 - wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`. - wifi: mac80211: update radar_required in channel context after channel switch - drm/amd/display: Fix 'failed to blank crtc!' - wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect - wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd() - wifi: ath12k: Add memset and update default rate value in wmi tx completion - drm/amd/display: Separate set_gsl from set_gsl_source_select - net: fec: allow disable coalescing - net: atlantic: add set_power to fw_ops for atl2 to fix wol - net: thunderbolt: Fix the parameter passing of tb_xdomain_enable_paths()/tb_xdomain_disable_paths() - net: thunderbolt: Enable end-to-end flow control also in transmit - kselftest/arm64: Specify SVE data when testing VL set in sve-ptrace - wifi: mt76: mt7915: mcu: re-init MCU before loading FW patch - wifi: rtw89: Disable deep power saving for USB/SDIO - wifi: rtw89: Fix rtw89_mac_power_switch() for USB - drm/msm: use trylock for debugfs - wifi: mac80211: fix rx link assignment for non-MLO stations - ipv6: mcast: Check inet6_dev->dead under idev->mc_lock in __ipv6_dev_mc_inc(). - (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer - wifi: mac80211: don't complete management TX on SAE commit - sched/fair: Bump sd->max_newidle_lb_cost when newidle balance fails - s390/stp: Remove udelay from stp_sync_clock() - wifi: iwlwifi: mvm: fix scan request validation - um: Re-evaluate thread flags repeatedly - wifi: iwlwifi: mvm: set gtk id also in older FWs - perf/cxlpmu: Remove unintended newline from IRQ name format string - net: phy: micrel: Add ksz9131_resume() - net: thunderx: Fix format-truncation warning in bgx_acpi_match_id() - net: ipv4: fix incorrect MTU in broadcast routes - wifi: cfg80211: Fix interface type validation - net: mctp: Prevent duplicate binds - arm64: Mark kernel as tainted on SAE and SError panic - net/mlx5e: Properly access RCU protected qdisc_sleeping variable - net: ag71xx: Add missing check after DMA map - et131x: Add missing check after DMA map - wifi: rtw89: Lower the timeout in rtw89_fw_read_c2h_reg() for USB - be2net: Use correct byte order and format string for TCP seq and ack_seq - s390/time: Use monotonic clock in get_cycles() - wifi: cfg80211: reject HTC bit for management frames - ktest.pl: Prevent recursion of default variable options - wifi: ath12k: Correct tid cleanup when tid setup fails - net: usb: cdc-ncm: check for filtering capability - xen/netfront: Fix TX response spurious interrupts - Bluetooth: hci_sock: Reset cookie to zero in hci_sock_free_cookie() - powerpc/thp: tracing: Hide hugepage events under CONFIG_PPC_BOOK3S_64 - ASoC: qcom: use drvdata instead of component to keep id - ASoC: codecs: rt5640: Retry DEVICE_ID verification - iio: adc: ad7768-1: Ensure SYNC_IN pulse minimum timing requirement - ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros - ALSA: pcm: Rewrite recalculate_boundary() to avoid costly loop - platform/chrome: cros_ec_typec: Defer probe on missing EC parent - platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches - soc: qcom: mdt_loader: Actually use the e_phoff - imx8m-blk-ctrl: set ISI panic write hurry level - pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop() - usb: core: usb_submit_urb: downgrade type check - usb: typec: intel_pmc_mux: Defer probe if SCU IPC isn't present - ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4 - ASoC: hdac_hdmi: Rate limit logging on connection and disconnection - ALSA: hda: Disable jack polling at shutdown - ALSA: hda: Handle the jack polling always via a work - mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode() - mei: bus: Check for still connected devices in mei_cl_bus_dev_release() - char: misc: Fix improper and inaccurate error code returned by misc_init() - reset: brcmstb: Enable reset drivers for ARCH_BCM2835 - pps: clients: gpio: fix interrupt handling order in remove path - ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path - mmc: sdhci-msm: Ensure SD card power isn't ON when card removed - ACPI: processor: fix acpi_object initialization - PM: sleep: console: Fix the black screen issue - thermal: sysfs: Return ENODATA instead of EAGAIN for reads - PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit() - firmware: tegra: Fix IVC dependency problems - ACPI: PRM: Reduce unnecessary printing to avoid user confusion - selftests: tracing: Use mutex_unlock for testing glob filter - tools/build: Fix s390(x) cross-compilation with clang - gpio: tps65912: check the return value of regmap_update_bits() - iio: adc: ad_sigma_delta: don't overallocate scan buffer - tools/nolibc: define time_t in terms of __kernel_old_time_t - thermal/drivers/qcom-spmi-temp-alarm: Enable stage 2 shutdown when required - ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed - EDAC/synopsys: Clear the ECC counters on init - gpio: wcd934x: check the return value of regmap_update_bits() - remoteproc: imx_rproc: skip clock enable when M-core is managed by the SCU - soc: qcom: rpmh-rsc: Add RSC version 4 support - usb: xhci: Avoid showing errors during surprise removal - usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command - usb: xhci: Avoid showing warnings for dying controller - usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default - selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t - cpufreq: CPPC: Mark driver with NEED_UPDATE_LIMITS flag - platform/x86/amd: pmc: Add Lenovo Yoga 6 13ALC6 to pmc quirk list - usb: xhci: print xhci->xhc_state when queue_command failed - tracefs: Add d_delete to remove negative dentries - securityfs: don't pin dentries twice, once is enough... - fix locking in efi_secret_unlink() - ext2: Handle fiemap on empty files to prevent EINVAL - fs/ntfs3: correctly create symlink for relative path - fs/ntfs3: Add sanity check for file name - better lockdep annotations for simple_recursive_removal() - hfs: fix not erasing deleted b-tree node issue - drbd: add missing kref_get in handle_write_conflicts - udf: Verify partition map count - gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops - nvme-pci: try function level reset on init failure - smb/server: avoid deadlock when linking with ReplaceIfExists - arm64: Handle KCOV __init vs inline mismatches - ptp: prevent possible ABBA deadlock in ptp_clock_freerun() - intel_idle: Allow loading ACPI tables for any family - net: ti: icss-iep: Fix incorrect type for return value in extts_enable() - netfilter: ctnetlink: fix refcount leak on table dump - udp: also consider secpath when evaluating ipsec use for checksumming - KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs - KVM: nVMX: Check vmcs12->guest_ia32_debugctl on nested VM-Enter - KVM: VMX: Extract checking of guest's DEBUGCTL into helper - KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported - KVM: VMX: Handle forced exit due to preemption timer in fastpath - KVM: VMX: Re-enter guest in fastpath for "spurious" preemption timer exits - KVM: x86: Plumb "force_immediate_exit" into kvm_entry() tracepoint - libceph: prevent potential out-of-bounds reads in handle_auth_done() - net: usb: pegasus: fix memory leak in update_eth_regs_async() - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() - !20540 urma: added support for ipoverurma - team: fix check for port enabled in team_queue_override_port_prio_changed() - mm/page_alloc: prevent pcp corruption with SMP=n - !20528 Fix CVE-2025-71083 - KVM: nVMX: Defer SVI update to vmcs01 on EOI when L2 is active w/o VID - KVM: x86: Plumb in the vCPU to kvm_x86_ops.hwapic_isr_update() - KVM: SVM: Set RFLAGS.IF=1 in C code, to get VMRUN out of the STI shadow - smb: client: don't wait for info->send_pending == 0 on error - smb: client: let send_done() cleanup before calling smbd_disconnect_rdma_connection() - ACPI: processor: perflib: Move problematic pr->performance check - ACPI: processor: perflib: Fix initial _PPC limit application - Documentation: ACPI: Fix parent device references - fs: Prevent file descriptor table allocations exceeding INT_MAX - sunvdc: Balance device refcount in vdc_port_mpgroup_check - PCI: Extend isolated function probing to LoongArch - NFSD: detect mismatch of file handle and delegation stateid in OPEN op - net: dpaa: fix device leak when querying time stamp info - net: ti: icss-iep: fix device and OF node leaks at probe - net: mtk_eth_soc: fix device leak at probe - net: enetc: fix device and OF node leak at probe - net: gianfar: fix device leak when querying time stamp info - net: phy: micrel: fix KSZ8081/KSZ8091 cable test - gpio: mlxbf3: use platform_get_irq_optional() - gpio: mlxbf2: use platform_get_irq_optional() - gpio: virtio: Fix config space reading. - ALSA: hda/realtek: Add Framework Laptop 13 (AMD Ryzen AI 300) to quirks - ALSA: hda/realtek: Fix headset mic on HONOR BRB-X - ALSA: usb-audio: Validate UAC3 cluster segment descriptors - rcu: Fix racy re-initialization of irq_work causing hangs - rcu: Fix rcu_read_unlock() deadloop due to IRQ work - drm/tilcdc: Fix removal actions in case of failed probe - drm/tilcdc: request and mapp iomem with devres - urma: fix update topo logic - dmaengine: stm32: dmamux: fix device leak on route allocation - pswiotlb: Adapt to the IOMMU DMA API upgraded by IOMMUFD - null_blk: fix kmemleak by releasing references to fault configfs items - inet: frags: flush pending skbs in fqdir_pre_exit() - inet: frags: add inet_frag_queue_flush() - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() - md/dm-raid: don't clear MD_RECOVERY_FROZEN after setting frozen - md/dm-raid: don't call md_reap_sync_thread() directly - ACPICA: Avoid walking the Namespace if start_node is NULL - arm64: entry: xcall/xint: make asm conditionals compatible with clang IAS - LoongArch: BPF: Sign extend kfunc call arguments - genirq/msi:: Fix kabi break of struct msi_desc - genirq/msi: Store the IOMMU IOVA directly in msi_desc instead of iommu_cookie - NFS: Fix a deadlock involving nfs_release_folio() - Revert "[Huawei] Revert "NFS: fix up nfs_release_folio() to try to release the page"" - urma: added support for ipoverurma - drm/ttm: Avoid NULL pointer deref for evicted BOs - XSched: Update XSched manual - svcrdma: bound check rq_pages index in inline path - ipv6: Fix use-after-free in inet6_addr_del(). - ipv4: ip_gre: make ipgre_header() robust - net: fix memory leak in skb_segment_list for GRO packets - net: sock: fix hardened usercopy panic in sock_recv_errqueue - ipv4: Fix reference count leak when using error routes with nexthop objects - SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf - fbdev: Fix vmalloc out-of-bounds write in fast_imageblit - udp: Deal with race between UDP socket address change and rehash - EDAC/amd64: The width of hash value is 2 bits for Hygon family 18h model 6h processors - x86/tsc: Use topology_max_packages() to get package number - EDAC/amd64: Use unicast instead of broadcast to access the cs_config register - EDAC/amd64: Correct the address translation for hygon family 18h model 4h - KVM: arm64: Mark some header functions as inline - KVM: arm64: Refactor exit handlers - x86/resctrl: Fix memory bandwidth counter width for Hygon CPUs - hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio - !20820 ub/obmm: add sysfs interface for mempool statistics & bugfixes - ub/obmm: fix wrong pxm_numa parameter validation - ub/obmm: Remove unused parameters from obmm_addr_check.c - ub/obmm: Enhance mem_allocator_granu validation - ub/obmm: simplify allocator naming scheme - ub/obmm: fix allow_slow logic and optimize conti_alloc_memory - ub/obmm: add sysfs interface with fine-grained memory statistics - !20804 net: hv_netvsc: reject RSS hash key programming without RX indirection table - !20813 migrate: correct lock ordering for hugetlb file folios - !20812 libceph: make calc_target() set t->paused, not just clear it - !20719 drivers/ub/sentry: some bugfix - !20798 urma: log should not retrieve eid_idx from uctx - !20808 urma: support triple bonding device - urma: log should not retrieve eid_idx from uctx - migrate: correct lock ordering for hugetlb file folios - libceph: make calc_target() set t->paused, not just clear it - !20745 vfio platform VFIO support for hisi05a1 devices - urma: support triple bonding device - net: hv_netvsc: reject RSS hash key programming without RX indirection table - !20789 gic: Add hip09 support for HISILICON_ERRATUM_165010801 - !20726 tracing: Add recursion protection in kernel stack trace recording - !20668 irqchip/gic-v3-its: Avoid truncating memory addresses - !20795 ub: udma: support query and set qos info. - !20791 Migration/urma:optimize performance in live migration. - ub: udma: Support for UE link establishment message. - Migration/urma: optimize performance in live migration. - !20787 ub: cdma: modify the method of assigning values to the structure - !20759 ubcore: hotfix route query for port eid on the same node. - ub: udma: support query and set qos info. - Revert "ub: ubase: Support for RC saved by queue granularity" - ubcore: hotfix route query for port eid on the same node. - !20676 urma: set/get sl - !20765 urma: bugfix of UAF and double free in ubcm - !20778 ub: ubase&unic: Fixes some bugfix in resetting and dfx ability - gic: Add hip09 support for HISILICON_ERRATUM_165010801 - vfio/platform: Add CONFIG_VFIO_HISI05A1 to openeuler_defconfig and turn it on by default - vfio/platform: VFIO support for hisi05a1 devices - ub: cdma: modify the method of assigning values to the structure - urma: set/get sl - ub: ubase: support to query ub dl pkt stats and real-time peak bandwidth - ub: ubase: Support for RC saved by queue granularity - ub: ubase: Traverse mailbox AE events using interrupts and polling. - ub: ubase: Modify ubase ctrlq trace to distinguish between MUE and UE messages - net: unic: The function of dumping himac registers is added. - ub: ubase: Fix MAC is_pfc sync, optimize list ops and code style - ub: ubase: Retain the initial tm qset configuration and restore it - net: unic: Fixed an issue in the bond IP address notification and pause configuration when an exception occurs. - ub: ubase: Add a retransmission function to improve reliability. - net: unic: Increase the readability and reliability of loopback code - net: unic: Synchronize the code modify for ip management and deactivation - net: unic: Increase the readability and reliability of VLAN feature. - net: unic: Added unic DFX log information. - ub: ubase: Add and correct comments for some functions and data structures - net: unic: Notify MAMI when the bond port status changes - ub: ubase: Support for HIMAC reset during ELR reset and Optimize ELR reset - !20768 iommu/ummu-core: Fix separate page table compatibility - !20665 [OLK-6.6] Enhance CMA memory usage reporting for CSV3 - !20764 net: hns3: fix double free issue for tx spare buffer - urma: bugfix of UAF and double free in ubcm - iommu/ummu-core: Fix separate page table compatibility - net: hns3: fix double free issue for tx spare buffer - drivers/ub/sentry: fix memory leak in sentry_msg_helper - drivers/ub/sentry: initialize some variables - drivers/ub/sentry: fix potential buffer overflow in convert_str_to_smh_msg() - drivers/ub/sentry: fix potential null pointer reference in sentry_uvb_comm - drivers/ub/sentry: add input parameter verification for exported symbols - tracing: Add recursion protection in kernel stack trace recording - x86/csv: Enhance CMA memory usage reporting for CSV3 - irqchip/gic-v3-its: Avoid truncating memory addresses - change the package name of 64KB page size kernel to kernel-64k - !20704 kernel support hisi-cca-da - !20180 [virtCCA Live Migration 2]virtcca secure cvm supports live migration - !20905 v2 KVM: arm64: Fix softirq masking in FPSIMD register saving sequence - !20965 iommu/ummu: Optimized TID invalidation and tdev initialization - !20964 iommu/ummu: Support TID and EID Granularity for MPAM - !20970 ub: ubase&unic: Supporting the black box capability of the ubase&unic driver - hisi-cca-da: Start dev by rsi call - hisi-cca-da: Set ripas of the bar region as RIPAS_DEV - hisi-cca-da: Support swiotlb and realm memory use - hisi-cca-da: Add smmu info when dev attach - hisi-cca-da: Transfer realm msix access to rmm - hisi-cca-da: Support pcipc sriov capability - hisi-cca-da: Delay realm memory release to kvm_destroy_realm - hisi-cca-da: Create realm s2 host pgtable and map msi mmio to rmm - hisi-cca-da: Add cca realm s2 pgtable framework - hisi-cca-da: Use bitmap to determine whether the command can be forwarded - hisi-cca-da: Restrict Realm SMMU to stage-2 domain only - hisi-cca-da: Add cmd forward mechanism in realm smmu - hisi-cca-da: Add realm smmu event and gerror irq initialization - hisi-cca-da: Add realm smmu stream table initialization - hisi-cca-da: Add realm smmu cmdq and evtq initialization - hisi-cca-da: Add realm smmu initialization - hisi-cca-da: Add relam iommu support to iommufd - hisi-cca-da: Add realm iommu support for vfio-iommu-type1 - hisi-cca-da: Support dev map and unmap - hisi-cca-da: Support dev validate and dev start - hisi-cca-da: VFIO support ccada - hisi-cca-da: Support dev delegate and dev attach - hisi-cca-da: Support root dev delegate and dev init - hisi-cca-da: Add hisilicon extension smc and ccada cmd - hisi-cca-da: Add hisi ccada feature config - !20751 ARM CCA supports hugepage - !20944 ub: ubmempfd: supports for D2H mapping and demapping - !20888 HiSock Enhancement - ub: ubase&unic: Supporting the black box capability of the ubase&unic driver. - net: unic: Resolve the residual MAC address problem - net: unic: Optimized the code for the cmd structure and FEC function. - ub: ubase: add log for post mailbox timeout - ub: ubus: Remove black box header file to include dir - rme: Remove the secret bit of the vring desc addr - rme: improve hisi-cca data mmap and destroy method - !20943 uvb: fix wd_obtain logic err - !20942 urma: fix bond device id not release - !20892 dcache: Limit the minimal number of bucket to two - rme: isolate page when do delegation to avoid migration - rme: hisi-cca supports different levels for mapping ram - rme: rename ccal to hisi-cca - rme: support set ripas for ccal realm vm - rme: support destroy ram data for ccal realm vm - rme: support populate region for ccal realm vm - rme: support map ram for ccal realm vm - rme: support config ccal realm vm - rme: support ccal RMI calls - rme: realm vm supports wfx handler - !20952 urma: introduce ipourma module - iommu/ummu-core: Simplifies tdev initialization resources - iommu/ummu: Optimized log printing - iommu/ummu: Use passed gfp_mask in map_pages callback - uvb: fix wd_obtain logic err - !20949 ub: udma: support user ctl function. - urma: fix bond device id not release - !20901 drivers/ub/sentry: some bugfix - ub: ubmempfd: supports for D2H mapping and demapping - ub: ubmempfd: supports providing services to the QEMU process through file nodes - [virtCCA Live Migration 2]virtcca secure cvm supports live migration - urma: query priority and enable bit, support ring size configuration - urma: implement debugfs, improve boundary checks and error handling logic - urma: implement data plane interaction and statistics - urma: implement ipourma network device operations - urma: ipourma resource management - urma: ipourma resource management and err code - urma: introduce ipourma main module - iommu/ummu: Optimized the TID invalidation configuration - iommu/ummu: Optimized SVA permission table memory allocation approach - iommu/ummu: Adapt UMMU SVA interface adjustment - iommu/ummu: Support TID and EID Granularity for MPAM - !20848 [OLK-6.6] backport important bugfix for nvme driver from upstream linux-6.6.y - !20847 urma: sl resource query error - !20908 [OLK-6.6][linux-6.6.y sync] Backport 6.6.108-6.6.110 LTS Patches - !20084 Loongarch: Enable CONFIG_CRYPTO_XTS for disk encryption - !20929 PCI: Fix NVMe link speed downgrade to 2.5GT/s during hotplug - drivers/ub/sentry: fix check input parameters - ub: udma: support user ctl function. - ub: udma: support uboe function. - ub: udma: bugfix related to query aux info. - !20935 ub: ubmem_vmmu: supports IOMMU driver for the UB memory MMU in VMs - drivers/ub/sentry: do not use magic numbers - !20876 urma: Kernel-mode specific implementations file for Jetty extension interface - urma: sl resource query error - !20873 sunrpc: fix NULL pointer dereference in rpcb_register_inet6 and rpcb_register_inet4 - !20875 sunrpc: fix race in cache cleanup causing stale nextcheck time - ub: ubmem_vmmu: supports IOMMU driver for the UB memory MMU in VMs - ub: ubmem_vmmu: supports parsing and configuring the hardware node information - ub: ubmem_vmmu: HiSilicon ubmem_vmmu Architecture Implementation - !20806 Fix CVE-2025-71225 - !20896 scsi: qla2xxx: Free sp in error path to fix system crash - !20894 scsi: qla2xxx: Delay module unload while fabric scan in progress - !20893 scsi: qla2xxx: Validate sp before freeing associated memory - !20802 Fix CVE-2026-23110 - urma: Kernel-mode specific implementations file for Jetty extension interface - drivers/ub/sentry: fix memory leak in process_urma_data() - drivers/ub/sentry: initialize some variables - PCI: Fix NVMe link speed downgrade to 2.5GT/s during hotplug - !20770 ub: ubdevshm: supports the memory user to obtain and release shared memory - Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 - mm: consider non-anon swap cache folios in folio_expected_ref_count() - mm: simplify folio_expected_ref_count() - ASoC: qcom: audioreach: fix potential null pointer dereference - gcc-plugins: Remove TODO_verify_il for GCC >= 16 - crypto: sha256 - fix crash at kexec - drm/i915/backlight: Return immediately when scale() finds invalid parameters - minmax.h: remove some #defines that are only expanded once - minmax.h: simplify the variants of clamp() - minmax.h: move all the clamp() definitions after the min/max() ones - minmax.h: use BUILD_BUG_ON_MSG() for the lo < hi test in clamp() - minmax.h: reduce the #define expansion of min(), max() and clamp() - minmax.h: update some comments - minmax.h: add whitespace around operators and after commas - minmax: fix up min3() and max3() too - minmax: improve macro expansion and type checking - minmax: don't use max() in situations that want a C constant expression - minmax: simplify min()/max()/clamp() implementation - minmax: make generic MIN() and MAX() macros available everywhere - drm/ast: Use msleep instead of mdelay for edid read - gpiolib: Extend software-node support to support secondary software-nodes - ARM: bcm: Select ARM_GIC_V3 for ARCH_BRCMSTB - s390/cpum_cf: Fix uninitialized warning after backport of ce971233242b - kmsan: fix out-of-bounds access to shadow memory - afs: Fix potential null pointer dereference in afs_put_server - ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address - i40e: improve VF MAC filters accounting - i40e: add mask to apply valid bits for itr_idx - HID: asus: add support for missing PX series fn keys - drm/gma500: Fix null dereference in hdmi teardown - octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() - net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port - net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() - net: dsa: lantiq_gswip: do also enable or disable cpu port - selftests: fib_nexthops: Fix creation of non-FDB nexthops - net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS - bnxt_en: correct offset handling for IPv6 destination address - vhost: Take a reference on the task in struct vhost_task. - Bluetooth: hci_sync: Fix hci_resume_advertising_sync - ethernet: rvu-af: Remove slash from the driver name - can: peak_usb: fix shift-out-of-bounds issue - can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow - can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow - can: hi311x: populate ndo_change_mtu() to prevent buffer overflow - can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow - bpf: Reject bpf_timer for PREEMPT_RT - can: rcar_can: rcar_can_resume(): fix s2ram with PSCI - wifi: virt_wifi: Fix page fault on connect - cpufreq: Initialize cpufreq-based invariance before subsys - ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients - arm64: dts: imx8mp: Correct thermal sensor index - mm: folio_may_be_lru_cached() unless folio_test_large() - mm/gup: local lru_add_drain() to avoid lru_add_drain_all() - mm/gup: check ref_count instead of lru before migration - mm: add folio_expected_ref_count() for reference count calculation - mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked" - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions - ALSA: usb-audio: Add mute TLV for playback volumes on more devices - ALSA: usb-audio: move mixer_quirks' min_mute into common quirk - ALSA: usb-audio: Add DSD support for Comtrue USB Audio device - i2c: designware: Add quirk for Intel Xe - mmc: sdhci-cadence: add Mobileye eyeQ support - usb: core: Add 0x prefix to quirks debug output - ALSA: usb-audio: Fix build with CONFIG_INPUT=n - ALSA: usb-audio: Convert comma to semicolon - ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 - ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks - ALSA: usb-audio: Simplify NULL comparison in mixer_quirks - ALSA: usb-audio: Avoid multiple assignments in mixer_quirks - ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks - ALSA: usb-audio: Fix block comments in mixer_quirks - firewire: core: fix overlooked update of subsystem ABI version - scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE - !20843 [OLK-6.6][linux-6.6.y sync] Backport 6.6.107-6.6.108 LTS Patches - !20869 ub:hisi-ubus: fix bug of security smatch - !20861 CVE-2026-23163 - ub: ubdevshm: supports the memory user to obtain and release shared memory - ub: ubdevshm: supports granting and revoking shared memory permissions - ub: ubdevshm: supports the registration and deregistration of shared memory segments - ub: ubdevshm: supports the registration and deregistration - KVM: arm64: Fix softirq masking in FPSIMD register saving sequence - !20886 Fix CVE-2026-23205 - !20803 Fix CVE-2026-23112 - !20868 sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure - !20811 smb/server: fix refcount leak in smb2_open() - !20810 smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() - !20809 smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() - sunrpc: fix NULL pointer dereference in rpcb_register_inet6 and rpcb_register_inet4 - sunrpc: fix race in cache cleanup causing stale nextcheck time - scsi: qla2xxx: Free sp in error path to fix system crash - scsi: qla2xxx: Delay module unload while fabric scan in progress - scsi: qla2xxx: Validate sp before freeing associated memory - dcache: Limit the minimal number of bucket to two - !20872 Fix CVE-2026-23220 - !20846 Fix CVE-2026-23193 - !20815 Fix CVE-2026-23216 - !20859 Fix CVE-2026-23179 - !20871 CVE-2026-23096 - !20858 ub: ubase: resolve the cmdq crq overflow problem - bpf: Deprecate hisock unused kfuncs and orig ingress logic - bpf: Add local connect support for hisock - bpf: Add ipv4-mapped ipv6 addr support for hisock - bpf: Add target comm parse to hisock_cmd - bpf: Add multi port parse to hisock_cmd - bpf: Only deploy hisock in server - bpf: Apply BPF_HISOCK_INGRESS to hisock ingress - bpf: Add bpf_handle_ingress/egress_ptype kfunc - bpf: Add bpf_get_skb_ethhdr kfunc - bpf: Add bpf_set_ingress/egress_dev kfunc - bpf: Add bpf_set_ingress_dst kfunc - bpf: Add BPF_HISOCK_INGRESS attach type - cgroup: make cgroup_bpf_prog_attach work when cgroup2 is not mounted - smb: client: fix potential UAF and double free in smb2_open_file() - smb/client: fix memory leak in smb2_open_file() - !20852 ASoC: amd: fix memory leak in acp3x pdm dma ops - ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths - uacce: fix cdev handling in the cleanup path - Revert "uacce: fix for cdev memory leak" - ub:hisi-ubus: fix bug of security smatch - ub:ubus: injected route event - ub:ubus: Black Box Development - !20865 urma: urma support uboe - sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure - urma: urma support uboe - !20857 ub_fwctl driver adds support for querying some functions - ub:ub_fwctl:Add illegal verification for scc - ub:ub_fwctl:Support querying the historical status of port links - drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove - drm/amdkfd: Don't use sw fault filter if retry cam enabled - ub:ub_fwctl:Support querying firmware version numbers - ub: ub_fwctl: Support querying real-time bandwidth statistics - ub:ub_fwctl:Support querying statistical indicators at the ub port and uboe port levels - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() - !20854 [URMA] add ping server for urma_ping - urma: add ping server - ub: ubase: resolve the cmdq crq overflow problem - ub: ubase: Optimized the QoS code naming to improve code readability. - ub: ubase&unic: optimizing code and configuration settings. - net: unic: not support query and configure ip by control plane in UBoE - net: unic: fix the automatically enable uc guid promisc mode. - !20844 urma:kernel header of userctl - urma: Kernel-mode header file for Jetty extension interface - ASoC: amd: fix memory leak in acp3x pdm dma ops - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() - phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again) - ACPICA: Work around bogus -Wstringop-overread warning since GCC 11 - !20835 Fix CVE-2026-23084 - minmax: add a few more MIN_T/MAX_T users - minmax: simplify and clarify min_t()/max_t() implementation - minmax: avoid overly complicated constant expressions in VM code - rtc: pcf2127: fix SPI command byte for PCF2131 backport - xhci: dbc: Fix full DbC transfer ring after several reconnects - xhci: dbc: decouple endpoint allocation from initialization - phy: ti: omap-usb2: fix device leak at unbind - phy: Use device_get_match_data() - drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path - ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message - ASoC: wm8974: Correct PLL rate rounding - ASoC: wm8940: Correct typo in control name - ASoC: wm8940: Correct PLL rate rounding - io_uring: include dying ring in task_work "should cancel" state - io_uring: backport io_should_terminate_tw() - ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx - selftests: mptcp: avoid spurious errors on TCP disconnect - selftests: mptcp: connect: catch IO errors on listen side - rds: ib: Increment i_fastreg_wrs before bailing out - KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active - mmc: mvsdio: Fix dma_unmap_sg() nents value - ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S - ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface - btrfs: tree-checker: fix the incorrect inode ref size check - iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page() - LoongArch: Check the return value when creating kobj - LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled - LoongArch: Update help info of ARCH_STRICT_ALIGN - nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* - octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() - net: liquidio: fix overflow in octeon_init_instr_queue() - bonding: don't set oif to bond dev when getting NS target destination - net/mlx5e: Consider aggregated port speed during rate configuration - i40e: remove redundant memory barrier when cleaning Tx descs - net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure - selftests: mptcp: sockopt: fix error messages - mptcp: tfo: record 'deny join id0' info - mptcp: set remote_deny_join_id0 on SYN recv - dpaa2-switch: fix buffer pool seeding for control traffic - btrfs: fix invalid extref key setup when replaying dentry - pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch - wifi: mac80211: fix incorrect type for ret - wifi: mac80211: increase scan_ies_len for S1G - ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported - !20769 [OLK-6.6][linux-6.6.y sync] Backport 6.6.106-6.6.107 LTS Patches - be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list - !20776 ub:ubfi: Release the chosen node - !20817 CVE-2026-23094 - !20819 dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() - ub:ubus: Add port num check - !20379 [OLK-6.6][sync from OLK-5.10]io_uring: Support forcing sq thread to be idle and woken up by hrtimer - !20830 sched/soft_domain: Increasing NR_MAX_CLUSTER to 32 - sched/soft_domain: Increasing NR_MAX_CLUSTER to 32 - btrfs: fix incorrect readahead expansion length - x86: disable image size check for test builds - drm/i915/power: fix size for for_each_set_bit() in abox iteration - drm/amdgpu: fix a memory leak in fence cleanup when unloading - net: mdiobus: release reset_gpio in mdiobus_unregister_device() - phy: ti-pipe3: fix device leak at unbind - phy: tegra: xusb: fix device and OF node leak at probe - dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate - usb: gadget: midi2: Fix MIDI2 IN EP max packet size - usb: gadget: midi2: Fix missing UMP group attributes initialization - USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels - RISC-V: Remove unnecessary include from compat.h - hrtimer: Rename __hrtimer_hres_active() to hrtimer_hres_active() - hrtimer: Remove unused function - regulator: sy7636a: fix lifecycle of power good gpio - dmaengine: ti: edma: Fix memory allocation size for queue_priority_map - hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr - hsr: use rtnl lock when iterating over ports - net: hsr: Add VLAN CTAG filter support - net: hsr: Add support for MC filtering at the slave device - can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB - can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails - can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed - igb: fix link test skipping when interface is admin down - docs: networking: can: change bcm_msg_head frames member to support flexible array - tunnels: reset the GSO metadata before reusing the skb - net: bridge: Bounce invalid boolopts - net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() - USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions - USB: serial: option: add Telit Cinterion FN990A w/audio compositions - dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks - serial: sc16is7xx: fix bug in flow control levels init - tty: hvc_console: Call hvc_kick in hvc_write unconditionally - Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups" - Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table - Input: iqs7222 - avoid enabling unused interrupts - mm/khugepaged: fix the address passed to notifier on testing young - btrfs: fix corruption reading compressed range when block size is smaller than page size - btrfs: use readahead_expand() on compressed extents - mm/damon/sysfs: fix use-after-free in state_show() - mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing - mtd: nand: raw: atmel: Fix comment in timings preparation - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages - drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time - mm/damon/core: set quota->charged_from to jiffies at first charge window - fuse: prevent overflow in copy_file_range return value - fuse: check if copy_file_range() returns larger than requested size - mtd: rawnand: stm32_fmc2: fix ECC overwrite - mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer - net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups - i2c: i801: Hide Intel Birch Stream SoC TCO WDT - ocfs2: fix recursive semaphore deadlock in fiemap call - mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN - compiler-clang.h: define __SANITIZE_*__ macros only when undefined - EDAC/altera: Delete an inappropriate dma_free_coherent() call - rcu-tasks: Maintain real-time response in rcu_tasks_postscan() - rcu-tasks: Eliminate deadlocks involving do_exit() and RCU tasks - rcu-tasks: Maintain lists to eliminate RCU-tasks/do_exit() deadlocks - s390/cpum_cf: Deny all sampling events by counter PMU - NFSv4/flexfiles: Fix layout merge mirror check. - NFSv4.2: Serialise O_DIRECT i/o and copy range - NFSv4.2: Serialise O_DIRECT i/o and clone range - NFSv4.2: Serialise O_DIRECT i/o and fallocate() - NFS: Serialise O_DIRECT i/o and truncate() - fs/nfs/io: make nfs_start_io_*() killable - ftrace/samples: Fix function size computation - NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server - NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set - media: i2c: imx214: Fix link frequency validation - NFSD: nfsd_unlink() clobbers non-zero status returned from fh_fill_pre_attrs() - nfsd: Fix a regression in nfsd_setattr() - kasan: fix GCC mem-intrinsic prefix with sw tags - kunit: kasan_test: disable fortify string checker on kasan_strings() test - io_uring: fix kabi broken in struct io_ring_ctx - io_uring: Support forcing sq thread to be idle and woken up by hrtimer - dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() - uacce: fix isolate sysfs check condition - Revert "uacce: fix isolate sysfs check condition" - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() - smb/server: fix refcount leak in smb2_open() - smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() - smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() - md: suspend array while updating raid_disks via sysfs - scsi: core: Wake up the error handler when final completions race against each other - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec - ub:ubfi: Release the chosen node - ub:ubus: Delete unused functions - Loongarch: Enable CONFIG_CRYPTO_XTS for disk encryption - Add sw64 support in kernel.spec - !21194 hisi-cca-da: Revert smmu realm enabled condition for arm_smmu_domain_finalise. - !21192 urma: bugfix of ubagg&ubcore&uburma - !21183 platform/x86: classmate-laptop: Add missing NULL pointer checks - urma: bugfix of ubagg&ubcore&uburma - hisi-cca-da: Revert smmu realm enabled condition for arm_smmu_domain_finalise. - platform/x86: classmate-laptop: Add missing NULL pointer checks - !21167 urma: fix kernel codecheck issues. - !21174 urma: change return value for provider err - !21127 urma: copy linked ports when importing bond jetty/seg - !20247 ubcore: query primary eid in ipourma loopback mode. - !21077 Fix hisi cca bugs - ubcore: route query refine and ipo loopback adapt. - hisi-cca-da: Transfer PCIe ECAM access requests to RMM for realm device. - hisi-cca-da: Write NS STE for PF drivers. - hisi-cca-da: Provide IO interfaces - hisi-cca-da: Destroy mmu stage2 pagetable after closing vfio devices - !21045 scsi: hisi_sas: Fix NULL pointer exception when do user_scan() - hisi-cca-da: Automatically unbind PF/VF drivers and prevent probe. - !21165 tools/interference: add ifstool utility for kernel interference statistics - !21166 urma: fix jfce uaf in batch cleanup - !21043 urma: fix tjetty ref in ping server - urma: change return value for provider err - !21128 sched/rt: Skip currently executing CPU in rto_next_cpu() - !21129 procfs: fix missing RCU protection when reading real_parent in do_task_stat() - urma: fix jfce uaf in batch cleanup - !21074 ipmi: Add HiSilicon IPMI Page Soft Offline driver - !21076 [OLK-6.6][linux-6.6.y sync] Backport 6.6.112-6.6.113 LTS Patches - urma: fix kernel codecheck issues. - tools/interference: add ifstool utility for kernel interference statistics - !20291 [Hygon][6.6][Bugfix] Bug fix for EDAC decode address fail issue on Hygon Dhyana processor - !21092 kexec: derive purgatory entry from symbol - !21154 sched: Add SOFT_DOMAIN feature interface for cgroup2 - !21153 fix CVE-2025-39981 - Revert "hisi-cca-da: Delay realm memory release to kvm_destroy_realm" - urma: fix tjetty ref in ping server - rme: Enforce isolation to solve compile error without config CONFIG_HISI_CCA - hisi-cca-da: Improve hisi cca dev validate and delegate - hisi-cca-da: Fix smmu enable rme problem - hisi-cca-da: Fix msi region shared problem - sched: Add SOFT_DOMAIN feature interface for cgroup2 - Bluetooth: MGMT: Fix memory leak in set_ssp_complete - Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete - overflow: Introduce __DEFINE_FLEX for having no initializer - overflow: Fix direct struct member initialization in _DEFINE_FLEX() - overflow: Change DEFINE_FLEX to take __counted_by member - overflow: add DEFINE_FLEX() for on-stack allocs - Bluetooth: MGMT: Fix possible UAFs - Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete() - !21103 Revert "mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()" - !21104 v2 vsock/virtio: cap TX credit to local buffer size - !21070 Fixes CVE-2026-23100 - !21135 RDMA/hns: Support configure and query the CNP DSCP through sysfs - !21088 ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref - RDMA/hns: Support configure and query the CNP DSCP through sysfs - RDMA/hns: Support query FW cap bit - RDMA/hns: Support query HW ID. - !20934 smb/server: fix refcount leak in parse_durable_handle_context() - !21004 regmap: Fix race condition in hwspinlock irqsave routine - !19568 [OLK-6.6]fix txgbe clang compile warning - urma: copy linked ports when importing bond jetty/seg - procfs: fix missing RCU protection when reading real_parent in do_task_stat() - sched/rt: Skip currently executing CPU in rto_next_cpu() - !21073 scsi: qla2xxx: Fix bsg_done() causing double free - !21114 CVE-2024-57979 - !21113 iommu: disable SVA when CONFIG_X86 is set - !20957 dmaengine: xilinx: xdma: Fix regmap max_register - !21087 net: unic: Multiple stability fixes for tx timeout, DFX capability and concurrent activation/reset - pps: Fix a use-after-free - fix kabi - pps: Fix a use-after-free - !21078 of: unittest: Fix memory leak in unittest_data_add() - !21079 *** fix CVE-2026-23208 *** - !21082 ALSA: aloop: Fix racy access at PCM trigger - !21083 bus: fsl-mc: fix use-after-free in driver_override_show() - iommu: disable SVA when CONFIG_X86 is set - vsock/virtio: cap TX credit to local buffer size - Revert "mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()" - !20983 Fix CVE-2026-23139 - !20878 Fix CVE-2026-23230 - kexec: derive purgatory entry from symbol - lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC - PCI/IOV: Fix race between SR-IOV enable/disable and hotplug - Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" - rtc: interface: Alarm race handling should not discard preceding error - perf test stat tests: Fix for virtualized machines - perf test stat: Update test expectations and events - perf test stat: Avoid hybrid assumption when virtualized - writeback: Avoid excessively long inode switching times - writeback: Avoid softlockup when switching many inodes - cramfs: Verify inode mode when loading from disk - fs: Add 'initramfs_options' to set initramfs mount options - minixfs: Verify inode mode when loading from disk - irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume - irqchip/sifive-plic: Make use of __assign_bit() - selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled - s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG - s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL - s390/bpf: Describe the frame using a struct instead of constants - s390/bpf: Centralize frame offset calculations - s390/bpf: Change seen_reg to a mask - ACPI: property: Do not pass NULL handles to acpi_attach_data() - ACPI: property: Add code comments explaining what is going on - ACPI: property: Disregard references in data-only subnode lists - ACPI: battery: Add synchronization between interface updates - ACPI: battery: Check for error code from devm_mutex_init() call - ACPI: battery: initialize mutexes through devm_ APIs - ACPI: battery: allocate driver data through devm_ APIs - arm64: mte: Do not flag the zero page as PG_mte_tagged - ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref - !20790 dm: use bio_clone_blkg_association - ipmi: Add HiSilicon IPMI Page Soft Offline driver - net: unic: Resolve network unavailability caused by concurrent activation and reset - net: unic: Provide the DFX capability for querying MNG table - net: unic: Delete the elr reset process after the tx timeout - bus: fsl-mc: fix use-after-free in driver_override_show() - ALSA: aloop: Fix racy access at PCM trigger - ALSA: usb-audio: Use the right limit for PCM OOB check - ALSA: usb-audio: Prevent excessive number of frames - of: unittest: Fix memory leak in unittest_data_add() - !21034 CVE-2026-23140 - !21016 net: fix segmentation of forwarding fraglist GRO - !21017 mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() - !21018 CVE-2026-23209 - !21019 ipv6: annotate data-race in ndisc_router_discovery() - !20881 ipvlan: Make the addrs_lock be per port - rme: Imporve range delegate - btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() - PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release - PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() - misc: fastrpc: Save actual DMA size in fastrpc_map structure - misc: fastrpc: Add missing dev_err newlines - mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag - mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type - mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value - media: mc: Clear minor number before put device - lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older - ACPICA: Allow to skip Global Lock initialization - ext4: validate ea_ino and size in check_xattrs - ext4: correctly handle queries for metadata mappings - ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() - nfsd: nfserr_jukebox in nlm_fopen should lead to a retry - NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() - mm/damon/vaddr: do not repeat pte_offset_map_lock() until success - mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 - mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations - wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 - wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again - selftests: mptcp: join: validate C-flag + def limit - spi: cadence-quadspi: Flush posted register writes before DAC access - spi: cadence-quadspi: Flush posted register writes before INDAC access - PCI: tegra194: Handle errors in BPMP response - PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() - PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock - PCI: rcar-host: Drop PMSR spinlock - PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit - PCI/AER: Support errors introduced by PCIe r6.0 - PCI/AER: Fix missing uevent on recovery when a reset is requested - PCI/ERR: Fix uevent on failure to recover - PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV - PCI/sysfs: Ensure devices are powered for config reads - PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock - rseq/selftests: Use weak symbol reference, not definition, to link with glibc - rtc: interface: Fix long-standing race when setting alarm - rtc: interface: Ensure alarm irq is enabled when UIE is enabled - memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe - mmc: core: SPI mode remove cmd7 - mtd: rawnand: fsmc: Default to autodetect buswidth - xtensa: simdisk: add input size check in proc_write_simdisk - sparc: fix error handling in scan_one_device() - sparc64: fix hugetlb for sun4u - scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() - sched/deadline: Fix race in push_dl_task() - pwm: berlin: Fix wrong register in suspend/resume - powerpc/pseries/msi: Fix potential underflow and leak issue - powerpc/powernv/pci: Fix underflow and leak issue - power: supply: max77976_charger: fix constant current reporting - pinctrl: samsung: Drop unused S3C24xx driver data - nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk - parisc: don't reference obsolete termio struct for TC* constants - openat2: don't trigger automounts with RESOLVE_NO_XDEV - of: unittest: Fix device reference count leak in of_unittest_pci_node_verify - lib/genalloc: fix device leak in of_gen_pool_get() - KEYS: trusted_tpm1: Compare HMAC values in constant time - iommu/vt-d: PRS isn't usable if PDS isn't supported - iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume - init: handle bootloader identifier in kernel parameters - iio: xilinx-ams: Unmask interrupts after updating alarms - iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK - iio: frequency: adf4350: Fix prescaler usage. - iio: dac: ad5421: use int type to store negative error codes - iio: dac: ad5360: use int type to store negative error codes - fs/ntfs3: Fix a resource leak bug in wnd_extend() - fbdev: Fix logic error in "offb" name match - crypto: rockchip - Fix dma_unmap_sg() nents value - crypto: atmel - Fix dma_unmap_sg() direction - crypto: aspeed - Fix dma_unmap_sg() direction - copy_sighand: Handle architectures where sizeof(unsigned long) < sizeof(u64) - bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() - bus: mhi: ep: Fix chained transfer handling in read path - btrfs: avoid potential out-of-bounds in btrfs_encode_fh() - blk-crypto: fix missing blktrace bio split events - drm/nouveau: fix bad ret code in nouveau_bo_move_prep - drm/rcar-du: dsi: Fix 1/2/3 lane support - media: lirc: Fix error handling in lirc_register() - media: venus: firmware: Use correct reset sequence for IRIS2 - media: pci: ivtv: Add missing check after DMA map - media: mc: Fix MUST_CONNECT handling for pads with no links - media: i2c: mt9v111: fix incorrect type for ret - media: cx18: Add missing check after DMA map - firmware: meson_sm: fix device leak at probe - xen/events: Update virq_to_irq on migration - xen/events: Return -EEXIST for bound VIRQs - xen/manage: Fix suspend error path - xen/events: Cleanup find_virq() return codes - dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required - ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init - arm64: dts: ti: k3-am62a-main: Fix main padcfg length - arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees - arm64: dts: qcom: msm8939: Add missing MDSS reset - arm64: dts: qcom: msm8916: Add missing MDSS reset - ACPI: debug: fix signedness issues in read/write helpers - ACPI: property: Fix buffer properties extraction for subnodes - gpio: wcd934x: mark the GPIO controller as sleeping - tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single - smb: client: fix missing timestamp updates after utime(2) - bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() - drm/amd/display: Properly disable scaling on DCE6 - drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 - drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs - drm/amdgpu: Add additional DCE6 SCL registers - mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes - mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call - tcp: take care of zero tp->window_clamp in tcp_set_rcvlowat() - perf python: split Clang options when invoking Popen - tools build: Align warning options with perf - net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe - drm/vmwgfx: Fix copy-paste typo in validation - net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() - LoongArch: Init acpi_gbl_use_global_lock to false - LoongArch: Remove CONFIG_ACPI_TABLE_UPGRADE in platform_init() - ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size - scsi: mvsas: Fix use-after-free bugs in mvs_work_queue - clk: tegra: do not overallocate memory for bpmp clocks - clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver - clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() - clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() - clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m - perf evsel: Ensure the fallback message is always written to - perf tools: Add fallback for exclude_guest - perf test: Add a test for default perf stat command - perf test: Don't leak workload gopipe in PERF_RECORD_* - perf session: Fix handling when buffer exceeds 2 GiB - perf arm_spe: Correct memory level for remote access - perf arm_spe: Correct setting remote access - rtc: optee: fix memory leak on driver removal - rtc: x1205: Fix Xicor X1205 vendor prefix - perf util: Fix compression checks returning -1 as bool - clk: at91: peripheral: fix return value - libperf event: Ensure tracing data is multiple of 8 sized - perf evsel: Avoid container_of on a NULL leader - asm-generic/io.h: Skip trace helpers if rwmmio events are disabled - iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE - clocksource/drivers/clps711x: Fix resource leaks in error paths - fscontext: do not consume log entries when returning -EMSGSIZE - fs: always return zero on success from replace_fd() - !21067 [OLK-6.6][linux-6.6.y sync] Backport 6.6.111-6.6.112 LTS Patches - scsi: qla2xxx: Fix bsg_done() causing double free - !21065 Fix CVE-2026-23069 - !21062 v4 Support multi-level cgroup - !20987 Fix CVE-2026-23212 - !20982 Fix CVE-2026-23119 - !20979 Fix CVE-2026-23111 - !20974 Fix CVE-2026-23099 - !20973 Fix CVE-2026-23105 - !20972 Fix CVE-2026-23074 - !20884 ksmbd: add chann_lock to protect ksmbd_chann_list xarray - !20947 Fix CVE-2026-23101 - ext4: clear i_state_flags when alloc inode - misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup - Revert "wifi: ath10k: avoid unnecessary wait for service ready message" - fs/ntfs3: fix mount failure for sparse runs in run_unpack() - !20825 efivarfs: fix error propagation in efivar_entry_get() - !20824 io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop - !20950 ub:ubus: protect iterator ue_list and mue_list with ub_bus_sem - mm/rmap: fix two comments related to huge_pmd_unshare() - mm/hugetlb: fix two comments related to huge_pmd_unshare() - mm/hugetlb: fix hugetlb_pmd_shared() - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count - !20728 drivers: Update vendor name of Chengdu NorthLink Technology N5/N6 Series Network Card Drivers - vsock/virtio: fix potential underflow in virtio_transport_get_credit() - !21001 Fix CVE-2026-23229 - usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call - arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode - !20999 Fix CVE-2026-23173 - usb: typec: tipd: Clear interrupts first - bus: fsl-mc: Check return value of platform_get_resource() - remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() - Input: atmel_mxt_ts - allow reset GPIO to sleep - misc: fastrpc: Skip reference for DMA handles - misc: fastrpc: fix possible map leak in fastrpc_put_args - misc: fastrpc: Fix fastrpc_map_lookup operation - nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() - ext4: fix checks for orphan inodes - ksmbd: fix error code overwriting in smb2_get_info_filesystem() - LoongArch: Automatically disable kaslr if boot from kexec_file - mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() - mfd: rz-mtu3: Fix MTU5 NFCR register offset - ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down - ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() - vhost: vringh: Modify the return value check - net/mlx5: fw reset, add reset timeout work - net/mlx5: pagealloc: Fix reclaim race during command interface teardown - net/mlx5: Stop polling for command response if interface goes down - net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable - nfp: fix RSS hash key size when RSS is not supported - mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands - drivers/base/node: fix double free in register_one_node() - hwrng: ks-sa - fix division by zero in ks_sa_rng_init - KEYS: X.509: Fix Basic Constraints CA flag parsing - Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements - Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO - vhost: vringh: Fix copy_to_iter return value check - RDMA/siw: Always report immediate post SQ errors - usb: vhci-hcd: Prevent suspending virtually attached devices - NFSv4.1: fix backchannel max_resp_sz verification check - coresight: trbe: Return NULL pointer for allocation failures - coresight: etm4x: Support atclk - coresight-etm4x: Conditionally access register TRCEXTINSELR - remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice - PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() - vfio/pds: replace bitmap_free with vfree - sparc: fix accurate exception reporting in copy_{from,to}_user for M7 - sparc: fix accurate exception reporting in copy_to_user for Niagara 4 - sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara - sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III - wifi: mac80211: fix Rx packet handling when pubsta information is not available - wifi: ath10k: avoid unnecessary wait for service ready message - Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram - IB/sa: Fix sa_local_svc_timeout_ms read race - RDMA/core: Resolve MAC of next-hop device without ARP support - f2fs: fix zero-sized extent for precache extents - scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() - scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() - scsi: qla2xxx: edif: Fix incorrect sign of error code - ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message - f2fs: fix to truncate first page in error path of f2fs_truncate() - f2fs: fix to update map->m_next_extent correctly in f2fs_map_blocks() - wifi: mt76: fix potential memory leak in mt76_wmac_probe() - RDMA/cm: Rate limit destroy CM ID timeout error message - drivers/base/node: handle error properly in register_one_node() - watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog - ipvs: Use READ_ONCE/WRITE_ONCE for ipvs->enable - iio: consumers: Fix offset handling in iio_convert_raw_to_processed() - iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() - fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist - fs: ntfs3: Fix integer overflow in run_unpack() - drm/msm/dpu: fix incorrect type for ret - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping - ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping - misc: genwqe: Fix incorrect cmd field being reported in error - usb: gadget: configfs: Correctly set use_os_string at bind - usb: phy: twl6030: Fix incorrect type for ret - drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() - tcp: fix __tcp_close() to only send RST when required - PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation - wifi: mwifiex: send world regulatory domain to driver - drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) - drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) - drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) - drm/amd/pm: Adjust si_upload_smc_data register programming (v3) - drm/amd/pm: Fix si_upload_smc_data (v3) - drm/amd/pm: Disable ULV even if unsupported (v3) - drm/amdgpu: Power up UVD 3 for FW validation (v2) - coresight: Only register perf symlink for sinks with alloc_buffer - inet: ping: check sock_net() in ping_get_port() and ping_lookup() - media: st-delta: avoid excessive stack usage - ALSA: lx_core: use int type to store negative error codes - media: rj54n1cb0c: Fix memleak in rj54n1_probe() - scsi: myrs: Fix dma_alloc_coherent() error check - hwrng: nomadik - add ARM_AMBA dependency - crypto: keembay - Add missing check after sg_nents_for_len() - drm/amd/display: Remove redundant semicolons - serial: max310x: Add error checking in probe() - usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls - usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup - phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 - media: zoran: Remove zoran_fh structure - drm/bridge: it6505: select REGMAP_I2C - f2fs: fix condition in __allow_reserved_blocks() - drm/radeon/r600_cs: clean up of dead code in r600_cs - drm/panel: novatek-nt35560: Fix invalid return value - bpf: Enforce expected_attach_type for tailcall compatibility - i2c: designware: Add disabling clocks when probe fails - i2c: designware: Fix clock issue when PM is disabled - i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD - thermal/drivers/qcom/lmh: Add missing IRQ includes - thermal/drivers/qcom: Make LMH select QCOM_SCM - hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems - once: fix race by moving DO_ONCE to separate section - smp: Fix up and expand the smp_call_function_many() kerneldoc - selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported - i3c: master: svc: Recycle unused IBI slot - i3c: master: svc: Use manual response for IBI events - ACPICA: Fix largest possible resource descriptor index - pwm: tiehrpwm: Fix corner case in clock divisor calculation - arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible - arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value - arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names - cpuidle: qcom-spm: fix device and OF node leaks at probe - firmware: firmware: meson-sm: fix compile-test default - arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 - null_blk: Fix the description of the cache_size module argument - pinctrl: renesas: Use int type to store negative error codes - power: supply: cw2015: Fix a alignment coding style issue - PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() - ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property - ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS - ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax - block: use int to store blk_stack_limits() return value - selftests/nolibc: fix EXPECT_NZ macro - regulator: scmi: Use int type to store negative error codes - arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map - ARM: at91: pm: fix MCKx restore routine - pinctrl: meson-gxl: add missing i2c_d pinmux - soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS - leds: flash: leds-qcom-flash: Update torch current clamp setting - ARM: dts: renesas: porter: Fix CAN pin group - libbpf: Fix reuse of DEVMAP - bpf: Remove migrate_disable in kprobe_multi_link_prog_run - bpf/selftests: Fix test_tcpnotify_user - regmap: Remove superfluous check for !config in __regmap_init() - arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 - x86/vdso: Fix output operand size of RDPID - smb: server: fix IRD/ORD negotiation with the client - coresight: trbe: Prevent overflow in PERF_IDX2OFF() - gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote - selftests: arm64: Check fread return value in exec_target - seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast - init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD - filelock: add FL_RECLAIM to show_fl_flags() macro - !21022 KVM: Don't clobber irqfd routing type when deassigning irqfd - !20998 ceph: fix oops due to invalid pointer for kfree() in parse_longname() - !21023 l2tp: avoid one data-race in l2tp_tunnel_del_work() - xsched: fix potential NULL dereference in xsched_quota_timeout_update - xsched: remove the standalone xcu_cfs_cg_deinit() helper - xsched: restructure xcu_cgrp_subsys teardown to align with cpu_cgrp_subsys lifecycle - xsched: simplify root group check by direct comparison with root_xcg - xsched: replace magic number with SCHED_CLASS_MAX_LENGTH for scheduler class string length - xsched/core: immediate cleanup of remaining operators on task exit - xsched: add init_fair_xsched_group() for XCU-specific fair group initialization - xsched: modify xcu_cg_initialize_components helper - xsched: refactor xsched_entity initialization - xsched: change rq_init() parameter from struct xsched_cu to struct xsched_rq - xsched: harden and clarify xcu_move_task() logic - xsched: move throttling-related fields from xsched_group_xcu_priv to xsched_rq_cfs - xsched/quota: add throttled flag to cfs_rq for robust hierarchical enqueue under throttling - xsched/quota: support multi-level cgroup - xsched: remove redundant xcu parameter from dequeue_ctx - xsched: update group shares using xcu_grp_shares_add/sub helpers - xsched: delete unused code - xsched/cfs: propagate group activation/deactivation up the hierarchy - xsched/cfs: move xruntime updates to pick/put paths - xsched: add has_running hook to xsched classes for wake-up eligibility check - !21012 [OLK-6.6][linux-6.6.y sync] Backport 6.6.110-6.6.111 LTS Patches - scsi: hisi_sas: Fix NULL pointer exception when do user_scan() - !21013 CVE-2026-23177 - !21007 bonding: fix use-after-free due to enslave fail after slave array update - !21006 net: Fix CVE-2026-23204 - bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path - bpf, test_run: Subtract size of xdp_frame from allowed metadata size - bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN - bpf: Make variables in bpf_prog_test_run_xdp less confusing - bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K - !21015 libceph: reset sparse-read state in osd_fault() - !21024 ub: udma: bugfix related to print messages. - !20980 Fix CVE-2026-23126 - !20922 Fix CVE-2026-23133 - ub: udma: bugfix related to print messages. - l2tp: avoid one data-race in l2tp_tunnel_del_work() - KVM: Don't clobber irqfd routing type when deassigning irqfd - ipv6: annotate data-race in ndisc_router_discovery() - macvlan: observe an RCU grace period in macvlan_common_newlink() error path - macvlan: fix error recovery in macvlan_common_newlink() - mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() - net: fix segmentation of forwarding fraglist GRO - can: rcar_canfd: Fix CAN-FD mode as default - libceph: reset sparse-read state in osd_fault() - !21008 uvb: fix cis call return value and obtain - mm, shmem: prevent infinite loop on truncate race - mm/shmem, swap: fix race of truncate and swap entry split - net/9p: fix double req put in p9_fd_cancelled - riscv: mm: Do not restrict mmap address based on hint - riscv: mm: Use hint address in mmap if available - driver core/PM: Set power.no_callbacks along with power.no_pm - serial: stm32: allow selecting console when the driver is module - hid: fix I2C read buffer overflow in raw_event() for mcp2221 - ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free - ALSA: usb-audio: Kill timer properly at removal - platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list - can: rcar_canfd: Fix controller mode setting - can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled - btrfs: ref-verify: handle damaged extent root tree - ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue - perf subcmd: avoid crash in exclude_cmds when excludes is empty - platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list - dm-integrity: limit MAX_TAG_SIZE to 255 - ASoC: amd: acp: Adjust pdm gain value - wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 - USB: serial: option: add SIMCom 8230C compositions - media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe - !20931 Fix CVE-2026-23060 - uvb: fix cis call return value and obtain - bonding: fix use-after-free due to enslave fail after slave array update - net/sched: cls_u32: use skb_header_pointer_careful() - net: add skb_header_pointer_careful() helper - regmap: Fix race condition in hwspinlock irqsave routine - crypto: virtio - Add spinlock protection with virtqueue notification - net/mlx5e: TC, delete flows only for existing peers - !20967 net: hns3: modify code of judging if SMMU DMA is enabled - ceph: fix oops due to invalid pointer for kfree() in parse_longname() - !20969 Fix CVE-2026-23125 - !20948 v4 arm64: Add memory poison recovery support for various paths - !20975 CVE-2026-23102 - !20977 v4 support apei_page_offline_policy - bonding: annotate data-races around slave->last_rx - netfilter: nf_conncount: update last_gc only when GC has been performed - bonding: provide a net pointer to __skb_flow_dissect() - netdevsim: fix a race issue related to the operation on bpf_bound_progs list - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() - apei/ghes: Add sysctl interface to control soft-offline page isolation - Revert "mm/memory-failure: support disabling soft offline for HugeTLB pages" - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - arm64/fpsimd: signal: Fix restoration of SVE context - arm64/fpsimd: signal: Consistently read FPSIMD context - arm64/fpsimd: signal: Mandate SVE payload for streaming-mode state - bonding: limit BOND_MODE_8023AD to Ethernet devices - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag - net/sched: Enforce that teql can only be used as root qdisc - sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT - drivers/net: Update vendor name of Chengdu NorthLink Technology N5/N6 Series Network Card Drivers - net: hns3: modify code of judging if SMMU DMA is enabled - dmaengine: xilinx: xdma: Fix regmap max_register - ub:ubus: protect iterator ue_list and mue_list with ub_bus_sem - ub:ubus: Avoid getting empty uent from ubc - ub:hisi-ubus: Use GFP_ATOMIC when alloc memory - arm64: send sig fault for user task when apei_claim_sea fails - arm64: add ras log during do_sea - arm64: move getting valid siaddr to the top of do_sea - arm64: mm: shmem: support poison recovery from shmem_file_read_iter() - arm64: fs: support poison recovery from __kernel_read() - iov_iter: add mc support for copy_page_to_iter - arm64: mm: support recovery from copy_{from/to}_user_page() - iov_iter: get rid of 'copy_mc' flag - leds: led-class: Only Add LED to leds_list when it is fully ready - wifi: ath10k: fix dma_free_coherent() pointer - smb/server: fix refcount leak in parse_durable_handle_context() - ksmbd: add chann_lock to protect ksmbd_chann_list xarray - ipvlan: Make the addrs_lock be per port - smb: client: split cached_fid bitfields to avoid shared-byte RMW races - efivarfs: fix error propagation in efivar_entry_get() - io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop - dm: use bio_clone_blkg_association - RAS/AMD/ATL: fix error nodes per socket on for Hygon Dhyana processor - net: txgbe: fix clang compile warning - !20552 ub: udma: fix some code issues. - !20313 Fix CVE-2025-40220 - !20321 nvme: fix admin request_queue lifetime - !20512 PM / devfreq: hisi: Fix potential UAF in OPP handling - !20544 Fix CVE-2025-71147 - !20548 v4 net: LTS-6.6 backport - !20503 Fix CVE-2025-39713 - !20133 Fix CVE-2025-39721 - !20438 Fix CVE-2025-38659 - !20264 Fix CVE-2025-40277 - !20340 Fix CVE-2025-40271 - !20319 Fix CVE-2025-40237 - !20392 vfs: Don't leak disconnected dentries on umount - !20554 iommu/s390: Implement blocking domain - !20489 [OLK-6.6][linux-6.6.y sync] Backport 6.6.101-6.6.102 LTS Patches - !20513 ACPI: PCC: Fix race condition by removing static qualifier - !20468 drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer - !20483 rcu: Protect ->defer_qs_iw_pending from data race - !20510 drivers/ub/sentry: fix primary eid index value - !20553 ub: cdma: support separated page table feature - ub: udma: fix some code issues. - !20480 iommu/ummu-core: fix error invalidate tid - !20561 iommu/ummu: Add ummu sva independent page table parameter - ub: udma: bugfix related to 2m_hugepage. - ub: udma: support for separate page tables - ub: udma: delete debugfs code. - ub: udma: bugfix related to ctrlq function. - ub: udma: verify get cqe/ae aux info out addr and len. - ub: cdma: support separated page table feature - iommu/ummu: Add ummu sva independent page table parameter - iommu: Adjust PLB refresh timing in 'grant' and 'ungrant' - !20505 Fix CVE-2026-23035 - iommu/s390: Implement blocking domain - drivers/ub/sentry: fix primary eid index value - !20535 libceph: make decode_pool() more resilient against corrupted osdmaps - !20536 mm/page_alloc: change all pageblocks migrate type on coalescing - !20537 mm/secretmem: fix use-after-free race in fault handler - !20538 wifi: avoid kernel-infoleak from struct iw_point - !20539 net: usb: rtl8150: fix memory leak on usb_submit_urb() failure - !20440 PCI/AER: Fix NULL pointer access by aer_info - !20262 Fix CVE-2025-68176 - netfilter: nf_reject: don't leak dst refcount for loopback packets - net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error - page_pool: always add GFP_NOWARN for ATOMIC allocations - virtio-net: fix received length check in big packets - net: bridge: fix use-after-free due to MST port state bypass - vsock: Ignore signal/timeout on connect() if already established - tls: make sure to abort the stream if headers are bogus - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI - xfrm: Duplicate SPI Handling - tls: handle data disappearing from under the TLS ULP - net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing - bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls - Bluetooth: hci_core: Fix use-after-free in vhci_flush() - KEYS: trusted: Fix a memory leak in tpm2_load_cmd - !20237 Fix CVE-2025-68724 - !20459 Fix CVE-2025-71131 - !20525 Fix CVE-2025-68816 - !20529 CVE-2025-68172 - net: usb: rtl8150: fix memory leak on usb_submit_urb() failure - !20370 Revert "Revert "RDMA/hns: Fix mismatch exception rollback"" - wifi: avoid kernel-infoleak from struct iw_point - mm/secretmem: fix use-after-free race in fault handler - mm/page_alloc: change all pageblocks migrate type on coalescing - libceph: make decode_pool() more resilient against corrupted osdmaps - pps: Fix kabi breakage of struct pps_device for last_fetched_ev - sched: Fix kabi breakage of struct task_struct for saved_state - crypto: aspeed - fix double free caused by devm - !20515 Bluetooth: bcsp: receive data only if registered - !20507 Fix CVE-2025-40358 - !20450 ub: ubase&unic: Fix some bug in concurrent process - !20452 iommu/ummu: Fix some bugs and optimize the code implementation - !20451 iommu/ummu: Add the function of creating devices with SVA-separated - !20500 mm: fix the inaccurate memory statistics issue for users - net/mlx5: fw_tracer, Validate format string parameters - Bluetooth: bcsp: receive data only if registered - ACPI: PCC: Fix race condition by removing static qualifier - ACPI: CPPC: Fix missing PCC check for guaranteed_perf - iommu/ummu: Add the function of creating devices with SVA-separated - iommu/ummu-core: fix error invalidate tid - riscv: stacktrace: Disable KASAN checks for non-current tasks - !20497 arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() - !20496 drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies - !20495 iommu/amd: Avoid stack buffer overflow from kernel cmdline - !20494 HID: core: Harden s32ton() against conversion to 0 bits - !20493 iommu: Fix two issues in iommu_copy_struct_from_user() - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv - PM / devfreq: hisi: Fix potential UAF in OPP handling - media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() - !20487 interference: Fix uninitialized ifs_clock compiling issue - MIPS: mm: kmalloc tlb_vpn array to avoid stack overflow - MIPS: mm: Prevent a TLB shutdown on initial uniquification - mm: fix the inaccurate memory statistics issue for users - mm: add config option for atomic mode in mm counter - Revert "mm: fix the inaccurate memory statistics issue for users" - !20444 net/mlx5e: Fix crash on profile change rollback failure - !20442 net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv - arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() - drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies - iommu/amd: Avoid stack buffer overflow from kernel cmdline - HID: core: Harden s32ton() against conversion to 0 bits - iommu: Fix two issues in iommu_copy_struct_from_user() - SUNRPC: call xs_sock_process_cmsg for all cmsg - flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read - !20374 [OLK 6.6]Use Hygon IBRS and IBPB rather than software-based mitigation to mitigate Retbleed and SRSO. - !20227 Rename leapioraid to leapraid and release v2.0 - mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery - MIPS: mm: tlb-r4k: Uniquify TLB entries on init - x86/fpu: Delay instruction pointer fixup until after warning - ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx() - ALSA: intel_hdmi: Fix off-by-one error in __hdmi_lpe_audio_probe() - x86/sev: Evict cache lines during SNP memory validation - net: usbnet: Fix the wrong netif_carrier_on() call - net: usbnet: Avoid potential RCU stall on LINK_CHANGE event - Bluetooth: btusb: Add USB ID 3625:010b for TP-LINK Archer TX10UB Nano - sched,freezer: Remove unnecessary warning in __thaw_task - freezer,sched: Clean saved_state when restoring it during thaw - freezer,sched: Do not restore saved_state of a thawed task - freezer,sched: Use saved_state to reduce some spurious wakeups - sched/core: Remove ifdeffery for saved_state - i2c: stm32f7: unmap DMA mapped buffer - i2c: stm32f7: simplify status messages in case of errors - i2c: stm32f7: perform most of irq job in threaded handler - i2c: stm32f7: use dev_err_probe upon calls of devm_request_irq - i2c: stm32f7: Use devm_clk_get_enabled() - USB: serial: option: add Foxconn T99W709 - smb: server: Fix extension string in ksmbd_extract_shortname() - ksmbd: fix corrupted mtime and ctime in smb2_open - ksmbd: fix Preauh_HashValue race condition - ksmbd: fix null pointer dereference error in generate_encryptionkey - vsock: Do not allow binding to VMADDR_PORT_ANY - selftests/perf_events: Add a mmap() correctness test - smb: client: return an error if rdma_connect does not return within 5 seconds - smb: client: let recv_done() cleanup before notifying the callers. - smb: client: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already - smb: client: make use of common smbdirect_socket - smb: smbdirect: add smbdirect_socket.h - smb: client: Correct typos in multiple comments across various files - smb: client: Use min() macro - smb: server: let recv_done() avoid touching data_transfer after cleanup/move - smb: server: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already - ALSA: hda/ca0132: Fix missing error handling in ca0132_alt_select_out() - irqchip: Build IMX_MU_MSI only on ARM - net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing - sunrpc: fix client side handling of tls alerts - net/sched: taprio: enforce minimum value for picos_per_byte - net: drop UFO packets in udp_rcv_segment() - ipv6: reject malicious packets in ipv6_gso_segment() - net/mlx5: Correctly set gso_segs when LRO is used - netlink: specs: ethtool: fix module EEPROM input/output arguments - net: ipa: add IPA v5.1 and v5.5 to ipa_version_string() - phy: mscc: Fix parsing of unicast frames - netpoll: prevent hanging NAPI when netcons gets enabled - md/md-cluster: handle REMOVE message earlier - NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY - NFS: Fix wakeup of __nfs_lookup_revalidate() in unblock_revalidate() - sched: Add test_and_clear_wake_up_bit() and atomic_dec_and_wake_up() - pNFS/flexfiles: don't attempt pnfs on fatal DS errors - PCI: pnv_php: Fix surprise plug detection and recovery - powerpc/eeh: Export eeh_unfreeze_pe() - PCI: pnv_php: Work around switches with broken presence detection - kconfig: qconf: fix ConfigList::updateListAllforAll() - scsi: sd: Make sd shutdown issue START STOP UNIT appropriately - scsi: ufs: core: Use link recovery when h8 exit fails during runtime resume - scsi: Revert "scsi: iscsi: Fix HW conn removal use after free" - scsi: mpt3sas: Fix a fw_event memory leak - vfio/pci: Separate SR-IOV VF dev_set - vfio/pds: Fix missing detach_ioas op - vfio: Prevent open_count decrement to negative - vfio: Fix unbalanced vfio_df_close call in no-iommu mode - f2fs: fix to calculate dirty data during has_not_enough_free_secs() - f2fs: fix to update upper_p in __get_secs_required() correctly - f2fs: vm_unmap_ram() may be called from an invalid context - f2fs: fix to avoid out-of-boundary access in devs.path - f2fs: doc: fix wrong quota mount option description - f2fs: fix KMSAN uninit-value in extent_info usage - rtc: rv3028: fix incorrect maximum clock rate handling - rtc: pcf8563: fix incorrect maximum clock rate handling - rtc: pcf85063: fix incorrect maximum clock rate handling - rtc: nct3018y: fix incorrect maximum clock rate handling - rtc: hym8563: fix incorrect maximum clock rate handling - rtc: ds1307: fix incorrect maximum clock rate handling - ucount: fix atomic_long_inc_below() argument type - module: Restore the moduleparam prefix length check - apparmor: fix loop detection used in conflicting attachment resolution - apparmor: ensure WB_HISTORY_SIZE value is a power of 2 - bpf: Check netfilter ctx accesses are aligned - bpf: Check flow_dissector ctx accesses are aligned - vhost-scsi: Fix log flooding with target does not exist errors - mtd: rawnand: atmel: set pmecc data setup time - mtd: rawnand: rockchip: Add missing check after DMA map - mtd: rawnand: atmel: Fix dma_mapping_error() address - jfs: fix metapage reference count leak in dbAllocCtl - crypto: qat - fix seq_file position update in adf_ring_next() - crypto: qat - fix DMA direction for compression on GEN2 devices - perf tools: Remove libtraceevent in .gitignore - sh: Do not use hyphen in exported variable name - ASoC: fsl_xcvr: get channel status data when PHY is not exists - dmaengine: nbpfaxi: Add missing check after DMA map - dmaengine: mv_xor: Fix missing check after DMA map and missing unmap - fs/orangefs: Allow 2 more characters in do_c_string() - PCI: endpoint: pci-epf-vntb: Fix the incorrect usage of __iomem attribute - soundwire: stream: restore params when prepare ports fail - crypto: img-hash - Fix dma_unmap_sg() nents value - crypto: keembay - Fix dma_unmap_sg() nents value - hwrng: mtk - handle devm_pm_runtime_enable errors - watchdog: ziirave_wdt: check record length in ziirave_firm_verify() - scsi: isci: Fix dma_unmap_sg() nents value - scsi: mvsas: Fix dma_unmap_sg() nents value - scsi: elx: efct: Fix dma_unmap_sg() nents value - scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value - clk: sunxi-ng: v3s: Fix de clock definition - perf tests bp_account: Fix leaked file descriptor - kernel: trace: preemptirq_delay_test: use offstack cpu mask - crypto: inside-secure - Fix `dma_unmap_sg()` nents value - perf sched: Fix memory leaks in 'perf sched latency' - perf sched: Fix memory leaks for evsel->priv in timehist - perf sched: Free thread->priv using priv_destructor - perf dso: Add missed dso__put to dso__load_kcore - perf tools: Fix use-after-free in help_unknown_cmd() - Fix dma_unmap_sg() nents value - clk: clk-axi-clkgen: fix fpfd_max frequency for zynq - fanotify: sanitize handle_type values when reporting fid - pinctrl: sunxi: Fix memory leak on krealloc failure - PCI: endpoint: pci-epf-vntb: Return -ENOENT if pci_epc_get_next_free_bar() fails - crypto: arm/aes-neonbs - work around gcc-15 warning - power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set - power: supply: cpcap-charger: Fix null check for power_supply_get_by_name - clk: xilinx: vcu: unregister pll_post only if registered correctly - media: v4l2-ctrls: Fix H264 SEPARATE_COLOUR_PLANE check - mtd: fix possible integer overflow in erase_xfer() - crypto: marvell/cesa - Fix engine load inaccuracy - crypto: qat - use unmanaged allocation for dc_data - crypto: sun8i-ce - fix nents passed to dma_unmap_sg() - PCI: rockchip-host: Fix "Unexpected Completion" log message - bpf/preload: Don't select USERMODE_DRIVER - ipv6: annotate data-races around rt->fib6_nsiblings - ipv6: fix possible infinite loop in fib6_info_uses_dev() - vrf: Drop existing dst reference in vrf_ip6_input_dst - selftests: rtnetlink.sh: remove esp4_offload after test - net/mlx5e: Clear Read-Only port buffer size in PBMC before update - netfilter: xt_nfacct: don't assume acct name is null-terminated - can: kvaser_usb: Assign netdev.dev_port based on device channel index - can: kvaser_pciefd: Store device channel index - can: peak_usb: fix USB FD devices potential malfunction - tools/rv: Do not skip idle in trace - Bluetooth: hci_event: Mask data status from LE ext adv reports - kcsan: test: Initialize dummy variable - wifi: mac80211: Write cnt before copying in ieee80211_copy_rnr_beacon() - wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE - wifi: ath12k: fix endianness handling while accessing wmi service bit - wifi: mac80211: Check 802.11 encaps offloading in ieee80211_tx_h_select_key() - wifi: mac80211: Don't call fq_flow_idx() for management frames - wifi: mac80211: Do not schedule stopped TXQs - wifi: plfxlc: Fix error handling in usb driver probe - wifi: mac80211: reject TDLS operations when station is not associated - iommu/amd: Fix geometry.aperture_end for V2 tables - mwl8k: Add missing check after DMA map - wifi: rtl8xxxu: Fix RX skb size for aggregation disabled - tcp: call tcp_measure_rcv_mss() for ooo packets - xen/gntdev: remove struct gntdev_copy_batch from stack - net_sched: act_ctinfo: use atomic64_t for three counters - net/sched: Restrict conditions for adding duplicating netems to qdisc tree - um: rtc: Avoid shadowing err in uml_rtc_start() - arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX - netfilter: nf_tables: adjust lockdep assertions handling - netfilter: nf_tables: Drop dead code from fill_*_info routines - fbcon: Fix outdated registered_fb reference in comment - drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value - m68k: Don't unregister boot console needlessly - drm/msm/dpu: Fill in min_prefill_lines for SC8180X - kselftest/arm64: Fix check for setting new VLs in sve-ptrace - net: dst: annotate data-races around dst->input - tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range - wifi: ath11k: clear initialized flag for deinit-ed srng lists - iwlwifi: Add missing check for alloc_ordered_workqueue - wifi: iwlwifi: Fix memory leak in iwl_mvm_init() - wifi: rtl818x: Kill URBs before clearing tx status queue - wifi: rtw89: avoid NULL dereference when RX problematic packet on unsupported 6 GHz band - caif: reduce stack size, again - bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure - drm/vmwgfx: Fix Host-Backed userspace on Guest-Backed kernel - net: ipv6: ip6mr: Fix in/out netdev to pass to the FORWARD chain - selftests/bpf: fix signedness bug in redir_partial() - bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls - bpf, sockmap: Fix psock incorrectly pointing to sk - drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed - staging: nvec: Fix incorrect null termination of battery manufacturer - interconnect: qcom: sc8180x: specify num_nodes - interconnect: qcom: sc8280xp: specify num_links for qnm_a1noc_cfg - soc: qcom: pmic_glink: fix OF node leak - samples: mei: Fix building on musl libc - cpufreq: Initialize cpufreq-based frequency-invariance later - cpufreq: intel_pstate: Always use HWP_DESIRED_PERF in passive mode - arm64: dts: imx8mn-beacon: Fix HS400 USDHC clock speed - arm64: dts: imx8mm-beacon: Fix HS400 USDHC clock speed - ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface - soc/tegra: cbb: Clear ERR_FORCE register with ERR_STATUS - arm: dts: ti: omap: Fixup pinheader typo - usb: early: xhci-dbc: Fix early_ioremap leak - powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw() - pps: fix poll support - staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() - spi: stm32: Check for cfg availability in stm32_spi_probe - usb: misc: apple-mfi-fastcharge: Make power supply names unique - usb: host: xhci-plat: fix incorrect type for of_match variable in xhci_plat_probe() - ARM: dts: vfxxx: Correctly use two tuples for timer address - arm64: dts: qcom: msm8976: Make blsp_dma controlled-remotely - arm64: dts: qcom: sc7180: Expand IMEM region - arm64: dts: qcom: sdm845: Expand IMEM region - soc: qcom: QMI encoding/decoding for big endian - selftests: Fix errno checking in syscall_user_dispatch test - ASoC: mediatek: use reserved memory or enable buffer pre-allocation - gfs2: No more self recovery - Revert "fs/ntfs3: Replace inode_trylock with inode_lock" - hfs: make splice write available again - hfsplus: make splice write available again - ublk: use vmalloc for ublk_device's __queues - fs_context: fix parameter name in infofc() macro - audit,module: restore audit logging in load failure case - ASoC: amd: yc: add DMI quirk for ASUS M6501RM - ASoC: Intel: fix SND_SOC_SOF dependencies - ASoC: amd: yc: Add DMI entries to support HP 15-fb1xxx - ethernet: intel: fix building with large NR_CPUS - ASoC: amd: yc: Add DMI quirk for HP Laptop 17 cp-2033dx - interference: Fix uninitialized ifs_clock compiling issue - iommu/ummu: optimize log printing - !20455 Fix compilation failure caused by PR#20174 - !20302 CVE-2026-22980 - !20142 CVE-2025-68803 - !20261 ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency - !20435 fix CVE-2026-22998 - !20433 scsi: target: Reset t_task_cdb pointer in error case - !20432 scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" - !20431 block: Use RCU in blk_mq_[un - !20307 tpm: Cap the number of PCR banks - !20062 xfs: Add xfs_dir3_leaf_header_check() in leaf/leafn read - !20157 v2 md: backport from mainline - rcu: Protect ->defer_qs_iw_pending from data race - platform/x86/intel/pmt: fix compilation failure caused by PR#20174 - iommu/ummu: optimize kv cache memory management - iommu/ummu: optimize permission table management - iommu/ummu: remove check for eid_type while del eid - iommu/ummu: optimize the code implementation - drivers/perf: fix ummu-pmu data reading exception - iommu/ummu: IOMMU_DOMAIN_BLOCKED type don not sync tct - drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer - crypto: seqiv - Do not use req->iv after crypto_aead_encrypt - net: unic: Notify mami of the bond ip change. - ub: ubase: Support for UE link by ctrlq message - ub: ubase: send a deactivate req in removing - ub: ubase: Querying TPG/TP contexts in the chip is no longer supported after enabling safe mode. - ub: ubase: Use an independent thread for the ctrlq workqueue. - !20368 ubcore: fix logging and permission for route query. - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id - !20344 ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr - net: unic: Fix the ummu 0xa event that occurs when modifying queues and resetting concurrent scenarios - ub: ubase: Add KABI compatibility - ub: ubase: fixing the issue of cdma ctp_req_vl parameter configuration - ub: ubase: add PMU IDEV interrupt supported abilities. - ub: ubase: Delete the tid mask for eq, jfs, jfr, and jfc context - ub: ubase: Set the completion event interrupt to auto - net: unic: fix poll tx read old skb cause a UAF bug - !20249 Fix CVE-2025-38489 - !20250 Fix CVE-2025-38480 - !20378 Fix CVE-2025-39838 - !20430 Fix CVE-2025-39942 - !20351 Fix CVE-2025-71149 - !20375 Fix CVE-2025-71150 - !20323 Fix CVE-2025-38730 - !20320 Fix CVE-2025-68814 - !20314 Fix CVE-2025-71072 - !20315 Fix CVE-2025-68794 - !20403 bpf: Check skb->transport_header is set in bpf_skb_check_mtu - !20402 bpf: Do not let BPF test infra emit invalid GSO types to stack - !20401 tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() - !20400 netfilter: nft_ct: add seqadj extension for natted connections - !20399 net: xfrm: Fix CVE-2025-40215 - !20398 net/sched: sch_qfq: Fix null-deref in agg_dequeue - !20397 bpf: Reject narrower access to pointer ctx fields - !20396 Bluetooth: eir: Fix possible crashes on eir_create_adv_data - !20394 IB/mlx5: Fix potential deadlock in MR deregistration - !20367 ub: cdma: cdma uaf bugfix - net/mlx5e: Fix crash on profile change rollback failure - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv - PCI/AER: Fix NULL pointer access by aer_info - gfs2: No more self recovery - drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE - crypto: qat - flush misc workqueue during device shutdown - !20174 Backport PMT spec 3.0 support - !20366 [Hygon][6.6][Bugfix]: Resolve FPU state corruption between atomic and non-atomic contexts - !19814 [OLK-6.6] Batch flushing user memory encrytion status change - !20393 [OLK-6.6][linux-6.6.y sync] Backport 6.6.100-6.6.101 LTS Patches - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec - nvmet-tcp: remove boilerplate code - scsi: target: Reset t_task_cdb pointer in error case - scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" - block: Use RCU in blk_mq_[un]quiesce_tagset() instead of set->tag_list_lock - ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size - ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer - smb: server: let recv_done() consistently call put_recvmsg/smb_direct_disconnect_rdma_connection - smb: server: remove separate empty_recvmsg_queue - !20384 ub:ubus: Fix ubus link message and pool device error - !20389 gfs2: Prevent recursive memory reclaim - !20388 *** fix CVE-2025-38062 *** - !20387 KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced - !20386 pinctrl: check the return value of pinmux_ops::get_function_name() - !20385 iommu/amd/pgtbl: Fix possible race while increase page table level - ub:ubus: Not cfg access during surprise down - ub:hisi-ubus: Delete validate_pa err print - PCI: cadence: Check for the existence of cdns_pcie::ops before using it - can: netlink: can_changelink(): allow disabling of automatic restart - Revert "selftests/bpf: Add a cgroup prog bpf_get_ns_current_pid_tgid() test" - drm/sched: Remove optimization that causes hang when killing dependent jobs - ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS - bpf: Check skb->transport_header is set in bpf_skb_check_mtu - bpf: Do not let BPF test infra emit invalid GSO types to stack - tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() - netfilter: nft_ct: add seqadj extension for natted connections - xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added - xfrm: delete x->tunnel as we delete x - x86/hw-vuln:Support hardware-based mitigation for Retbleed and SRSO via Hygon IBRS to avoid performance degradation caused by software-based mitigation. - net/sched: sch_qfq: Fix null-deref in agg_dequeue - bpf: Reject narrower access to pointer ctx fields - Bluetooth: eir: Fix possible crashes on eir_create_adv_data - IB/mlx5: Fix potential deadlock in MR deregistration - ub:ubus: Fix ubus link message and pool device error - ub:hisi-ubus: cq poller maximum handle 64 cqe per time - ub:hisi-ubus:Fix vdm message print error - ub:ubus:Fix ubus interrupt release issue - wifi: mt76: mt7921: prevent decap offload config before STA initialization - mtd: rawnand: qcom: Fix last codeword read in qcom_param_page_type_exec() - iio: hid-sensor-prox: Restore lost scale assignments - iio: hid-sensor-prox: Fix incorrect OFFSET calculation - crypto: powerpc/poly1305 - add depends on BROKEN for now - erofs: address D-cache aliasing - drm/i915/dp: Fix 2.7 Gbps DP_LINK_BW value on g4x - ALSA: hda: Add missing NVIDIA HDA codec IDs - ALSA: hda/tegra: Add Tegra264 support - comedi: comedi_test: Fix possible deletion of uninitialized timers - usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach - usb: typec: tcpm: allow switching to mode accessory to mux properly - usb: typec: tcpm: allow to use sink in accessory mode - drm/amdkfd: Don't call mmput from MMU notifier callback - mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n - selftests: mptcp: connect: also cover checksum - selftests: mptcp: connect: also cover alt modes - resource: fix false warning in __request_region() - gve: Fix stuck TX queue for DQ queue format - e1000e: ignore uninitialized checksum word on tgp - e1000e: disregard NVM checksum on tgp when valid checksum bit is not set - dpaa2-switch: Fix device reference count leak in MAC endpoint handling - dpaa2-eth: Fix device reference count leak in MAC endpoint handling - ALSA: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx - sprintf.h requires stdarg.h - bus: fsl-mc: Fix potential double device reference in fsl_mc_get_endpoint() - i2c: virtio: Avoid hang by using interruptible completion wait - i2c: tegra: Fix reset error handling with ACPI - platform/x86: ideapad-laptop: Fix kbd backlight not remembered among boots - can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode - can: dev: can_restart(): move debug message and stats after successful restart - can: dev: can_restart(): reverse logic to remove need for goto - i40e: When removing VF MAC filters, only check PF-set MAC - i40e: report VF tx_dropped with tx_errors instead of tx_discards - i40e: Add rx_missed_errors for buffer exhaustion - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch - net/mlx5: Fix memory leak in cmd_exec() - staging: vchiq_arm: Make vchiq_shutdown never fail - x86/hyperv: Fix usage of cpu_online_mask to get valid cpu - regmap: fix potential memory leak of regmap_bus - iio: adc: ad7949: use spi_is_bpw_supported() - interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1 node - RDMA/core: Rate limit GID cache warning messages - virtio_ring: Fix error reporting in virtqueue_resize - !20348 [OLK-6.6][linux-6.6.y sync] Backport 6.6.99-6.6.100 LTS Patches - !20346 tracing: Fix crash on synthetic stacktrace field usage - vfs: Don't leak disconnected dentries on umount - !20334 Fix CVE-2025-68780 - gfs2: Prevent recursive memory reclaim - amd/amdkfd: enhance kfd process check in switch partition - drm/amdkfd: allow compute partition mode switch with cgroup exclusions - KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced - pinctrl: check the return value of pinmux_ops::get_function_name() - iommu/amd/pgtbl: Fix possible race while increase page table level - !19966 nvme-fc: use lock accessing port_state and rport state - ASoC: fsl_sai: replace regmap_write with regmap_update_bits - comedi: Fix use of uninitialized data in insn_rw_emulate_bits() - cifs: prevent NULL pointer dereference in UTF16 conversion - ksmbd: Fix refcount leak when invalid session is found on session lookup - ubcore: fix logging and permission for route query. - !20232 driver/coda: VirtCCA supports MSI device DA - Revert "Revert "RDMA/hns: Fix mismatch exception rollback"" - !20197 ub: udma&ubase: fix a bug that caused long reboot time - x86: Resolve FPU state corruption between atomic and non-atomic contexts - ub: cdma: cdma uaf bugfix - ub: cdma: jfs call trace bugfix - !20353 x86/fpu: Clear XSTATE_BV[i - s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again - KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls - nvmem: layouts: u-boot-env: remove crc32 endianness conversion - i2c: omap: fix deprecated of_property_read_bool() use - ASoC: fsl_sai: Force a software reset when starting in consumer mode - regulator: pwm-regulator: Manage boot-on with disabled PWM channels - regulator: pwm-regulator: Calculate the output voltage for disabled PWMs - i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe() - i2c: omap: Fix an error handling path in omap_i2c_probe() - i2c: omap: Add support for setting mux - usb: dwc3: qcom: Don't leave BCR asserted - usb: hub: Don't try to recover devices lost during warm reset. - usb: hub: Fix flushing of delayed work used for post resume purposes - usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm - usb: hub: fix detection of high tier USB3 devices behind suspended hubs - arm64: Filter out SME hwcaps when FEAT_SME isn't implemented - ipv6: make addrconf_wq single threaded - !20354 cpufreq/sched: Explicitly synchronize limits_changed flag handling - sched/deadline: only set free_cpus for online runqueues - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 - cpufreq/sched: Explicitly synchronize limits_changed flag handling - io_uring/poll: correctly handle io_poll_add() return value on update - shmem: fix recovery on rename failures - io_uring: fix filename leak in __io_openat_prep() - Revert "cgroup_freezer: cgroup_freezing: Check if not frozen" - rxrpc: Fix transmission of an abort in response to an abort - rxrpc: Fix recv-recv race of completed call - net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree - net: bridge: Do not offload IGMP/MLD messages - hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf - netfilter: nf_conntrack: fix crash due to removal of uninitialised entry - ipv6: mcast: Delay put pmc->idev in mld_del_delrec() - net/mlx5: Correctly set gso_size when LRO is used - Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID - Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout - Bluetooth: SMP: If an unallowed command is received consider it a failure - Bluetooth: hci_sync: fix connectable extended advertising when using static random address - hwmon: (corsair-cpro) Validate the size of the received input buffer - selftests: net: increase inter-packet timeout in udpgro.sh - wifi: cfg80211: remove scan request n_channels counted_by - nvme: fix misaccounting of nvme-mpath inflight I/O - net: phy: Don't register LEDs for genphy - nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list() - rpl: Fix use-after-free in rpl_do_srh_inline(). - block: fix kobject leak in blk_unregister_queue - net: emaclite: Fix missing pointer increment in aligned_read() - soundwire: amd: fix for clearing command status register - soundwire: amd: fix for handling slave alerts after link is down - comedi: Fix use of uninitialized data in insn_rw_emulate_bits() - comedi: Fix some signed shift left operations - comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large - comedi: das6402: Fix bit shift out of bounds - comedi: das16m1: Fix bit shift out of bounds - comedi: aio_iiro_16: Fix bit shift out of bounds - comedi: pcl812: Fix bit shift out of bounds - iio: adc: stm32-adc: Fix race in installing chained IRQ handler - iio: adc: max1363: Reorder mode_list[] entries - iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] - iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush - soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled - soc: aspeed: lpc-snoop: Cleanup resources in stack-order - s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again - pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov - net: libwx: properly reset Rx ring descriptor - net: libwx: remove duplicate page_pool_put_full_page() - mmc: sdhci_am654: Workaround for Errata i2312 - mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models - mmc: bcm2835: Fix dma_unmap_sg() nents value - memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() - isofs: Verify inode mode when loading from disk - dmaengine: nbpfaxi: Fix memory corruption in probe() - af_packet: fix soft lockup issue caused by tpacket_snd() - af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() - arm64: dts: rockchip: use cs-gpios for spi1 on ringneck - arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on - arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency - net/mlx5: Update the list of the PCI supported devices - phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() - io_uring/poll: fix POLLERR handling - ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS - drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume - tracing/osnoise: Fix crash in timerlat_dump_stack() - spi: Add check for 8-bit transfer with 8 IO mode support - pch_uart: Fix dma_sync_sg_for_device() nents value - thunderbolt: Fix bit masking in tb_dp_port_set_hops() - i2c: stm32: fix the device used for the DMA map - tracing: Fix crash on synthetic stacktrace field usage - usb: musb: fix gadget state on disconnect - USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI - USB: serial: option: add Foxconn T99W640 - USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition - phy: tegra: xusb: Disable periodic tracking on Tegra234 - phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode - phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr - fs/proc: fix uaf in proc_readdir_de() - io_uring/net: commit partial buffers on retry - nvme: fix admin request_queue lifetime - fs/notify: call exportfs_encode_fid with s_umount - iomap: adjust read range correctly for non-block-aligned positions - fuse: fix livelock in synchronous file put from fuseblk workers - tpm: Cap the number of PCR banks - nfsd: provide locking for v4_end_grace - Revert "nfsd: provide locking for v4_end_grace" - config: enable config for PMT discovery driver - platform/x86/intel/pmt/discovery: use valid device pointer in dev_err_probe - platform/x86/intel/pmt: Fix kobject memory leak on init failure - platform/x86/intel/pmt: fix a crashlog NULL pointer access - platform/x86/intel/pmt: fix build dependency for kunit test - platform/x86/intel/pmt/discovery: fix format string warning - platform/x86/intel/pmt/discovery: Fix size_t specifiers for 32-bit - platform/x86/intel/pmt: KUNIT test for PMT Enhanced Discovery API - platform/x86/intel/pmt/telemetry: Add API to retrieve telemetry regions by feature - platform/x86/intel/pmt/discovery: Get telemetry attributes - platform/x86/intel/tpmi: Get OOBMSM CPU mapping from TPMI - platform/x86/intel/vsec: Set OOBMSM to CPU mapping - platform/x86/intel/tpmi: Relocate platform info to intel_vsec.h - docs: Add ABI documentation for intel_pmt feature directories - platform/x86/intel/pmt: Add PMT Discovery driver - sysfs: Fix crash on empty group attributes array - sysfs: Introduce a mechanism to hide static attribute_groups - platform/x86/intel/vsec: Add new Discovery feature - platform/x86/intel/vsec: Skip driverless features - platform/x86/intel/vsec: Skip absent features during initialization - platform/x86/intel/vsec: Add device links to enforce dependencies - platform/x86/intel/vsec: Create wrapper to walk PCI config space - platform/x86/intel/vsec: Add private data for per-device data - MAINTAINERS: Add link to documentation of Intel PMT ABI - platform/x86/intel/pmt: allow user offset for PMT callbacks - driver/coda: VirtCCA supports MSI device DA - ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency - Rename leapioraid to leapraid and release v2.0 - ub: udma: fix a bug that caused long reboot time. - ub: ubase: Accelerate when ctrl node is shutting down - platform/x86/intel/pmt: Use PMT callbacks - platform/x86/intel/vsec: Add PMT read callbacks - platform/x86/intel/vsec.h: Move to include/linux - md: prevent incorrect update of resync/recovery offset - md/raid1: Fix data corruption for degraded array with slow disk - md/raid1: set max_sectors during early return from choose_slow_rdev() - md-cluster: fix no recovery job when adding/re-adding a disk - md-cluster: fix hanging issue while a new disk adding - md/raid5: recheck if reshape has finished with device_lock held - md-cluster: Constify struct md_cluster_operations - md: Remove unneeded semicolon - md/raid5: fix spares errors about rcu usage - dm-raid: Fix WARN_ON_ONCE check for sync_thread in raid_resume - md: pass in max_sectors for pers->sync_request() - md: factor out helpers for different sync_action in md_do_sync() - md: replace last_sync_action with new enum type - md: use new helpers in md_do_sync() - md: don't fail action_store() if sync_thread is not registered - md: remove parameter check_seq for stop_sync_thread() - md: replace sysfs api sync_action with new helpers - md: factor out helper to start reshape from action_store() - md: add new helpers for sync_action - md: add a new enum type sync_action - md: rearrange recovery_flags - md/raid0: don't free conf on raid0_run failure - md: make md_flush_request() more readable - md: change the return value type of md_write_start to void - md: Revert "md: Fix overflow in is_mddev_idle" - md: don't account sync_io if iostats of the disk is disabled - md: Fix overflow in is_mddev_idle - md: add check for sleepers in md_wakeup_thread() - md: add a mddev_is_dm helper - md: add a mddev_add_trace_msg helper - md: add a mddev_trace_remap helper - dm-raid456, md/raid456: fix a deadlock for dm-raid456 while io concurrent with reshape - dm-raid: add a new helper prepare_suspend() in md_personality - dm-raid: really frozen sync_thread during suspend - md: add a new helper reshape_interrupted() - md: export helper md_is_rdwr() - md: export helpers to stop sync_thread - md: don't clear MD_RECOVERY_FROZEN for new dm-raid until resume - md/raid1: factor out helpers to choose the best rdev from read_balance() - md/raid1: factor out the code to manage sequential IO - md/raid1: factor out choose_bb_rdev() from read_balance() - md/raid1: factor out choose_slow_rdev() from read_balance() - md/raid1: factor out read_first_rdev() from read_balance() - md/raid1-10: factor out a new helper raid1_should_read_first() - md/raid1-10: add a helper raid1_check_read_range() - md/raid1: fix choose next idle in read_balance() - md/raid1: record nonrot rdevs while adding/removing rdevs to conf - md/raid1: factor out helpers to add rdev to conf - md: add a new helper rdev_has_badblock() - md: check mddev->pers before calling md_set_readonly() - md: clean up openers check in do_md_stop() and md_set_readonly() - md: sync blockdev before stopping raid or setting readonly - md: factor out a helper to sync mddev - md: return directly before setting did_set_md_closing - md: changed the switch of RAID_VERSION to if - md: merge the check of capabilities into md_ioctl_valid() - md: Don't suspend the array for interrupted reshape - md: Don't register sync_thread for reshape directly - md: Make sure md_do_sync() will set MD_RECOVERY_DONE - md: Don't ignore read-only array in md_check_recovery() - md: Don't ignore suspended array in md_check_recovery() - md: get rdev->mddev with READ_ONCE() - md: remove redundant md_wakeup_thread() - md: remove redundant check of 'mddev->sync_thread' - md: fix a suspicious RCU usage warning - raid: Remove now superfluous sentinel element from ctl_table array - NFSD: NFSv4 file creation neglects setting ACL - nfsd: set security label during create operations - xfs: Add xfs_dir3_leaf_header_check() in leaf/leafn read - nvme-fc: use lock accessing port_state and rport state - x86/mm: Batch flushing user memory encrytion status change - !20588 [OLK-6.6] Revert "x86/csv: Enhance CMA memory usage reporting for CSV3" - Revert "x86/csv: Enhance CMA memory usage reporting for CSV3" - !20576 media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg() - !20575 RDMA/cm: Fix leaking the multicast GID table reference - !20580 RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly - !20551 Fix CVE-2025-68785 - !20478 f2fs: fix to avoid potential deadlock - !20501 [OLK-6.6] backport important bugfix for bnxt driver from upstream linux-6.6.y - !20520 Fix CVE-2026-23038 - !20424 net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup - !20425 mlx5: Fix default values in create CQ - RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly - media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg() - RDMA/cm: Fix leaking the multicast GID table reference - net: openvswitch: fix middle attribute validation in push_nsh() action - net: openvswitch: remove never-working support for setting nsh fields - pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() - bnxt_en: Fix potential data corruption with HW GRO/LRO - f2fs: fix to avoid potential deadlock - mlx5: Fix default values in create CQ - net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup - riscv kernel upgrade to 6.6.0-138.0.0 - Fixed system hang when boot systemd on spacemit k3 - riscv: perf vendor events: fix lrw core PMU event mapping - !20727 v2 bpf: sockmap fixes - !20741 scsi: qla2xxx: Sanitize payload size to prevent member overflow - !20744 fix CVE-2025-38449 - !20763 net: usb: asix: validate PHY address before use - !20762 smc91x: fix broken irq-context in PREEMPT_RT - !20293 [Hygon][6.6][EDAC] The width of hash value is 2 bits for Hygon family 18h model 6h processors - !20290 [Hygon][6.6][Bugfix] Bug fix for EDAC to use unicast instead of broadcast on hygon family 18h model 4h - !20289 [Hygon][6.6][Bugfix] Bug fix for EDAC to correct the address translation on hygon family 18h model 4h - !20245 KVM: arm64: Refactor exit handlers - !20246 KVM: arm64: Mark some header functions as inline - !19005 [Hygon] [OLK-6.6] [Bugfix] Fix memory bandwidth counter width for Hygon QoS - !20292 [Hygon][6.6][TSC Adjust] Backport x86 TSC adjust patch - !20273 [Hygon][6.6][Bugfix] Get correct CPU LLC ID in guest for Hygon processors - !20722 [OLK-6.6][linux-6.6.y sync] Backport 6.6.104-6.6.106 LTS Patches - !20667 fix CVE-2024-50102 - !20736 netfilter: nf_tables: remove redundant chain validation on register store - !20758 ub: ubase: Fixed the alarm issue caused by the initialization of the structure variable definition. - !20721 obmm: reduce log noise for successful export/import/preimport - net: usb: asix: validate PHY address before use - smc91x: fix broken irq-context in PREEMPT_RT - !20731 devlink: rate: Unset parent pointer in devl_rate_nodes_destroy - !20732 libceph: return the handler error from mon_handle_auth_done() - !20743 mm: slub: avoid wake up kswapd in set_track_prepare - ub: ubase: Fixed the alarm issue caused by the initialization of the structure variable definition. - !20750 ub: cdma: adapted to UMMU interface changes - !20713 urma: DFX of log in kernel - urma: optimize log levels for kernel space - ub: cdma: adapted to UMMU interface changes - wifi: ath11k: avoid bit operation on key flags - drm/mediatek: fix potential OF node use-after-free - cpufreq: intel_pstate: Check IDA only before MSR_IA32_PERF_CTL writes - wifi: cfg80211: sme: store capped length in __cfg80211_connect_result() - !20708 ub:hisi-ubus: Add create bus instance ummu bypass - drm: fix kabi for struct drm_framebuffer - drm/framebuffer: Acquire internal references on GEM handles - drm/gem: Acquire references on GEM handles for framebuffers - mm: slub: avoid wake up kswapd in set_track_prepare - scsi: qla2xxx: Sanitize payload size to prevent member overflow - netfilter: nf_tables: remove redundant chain validation on register store - libceph: return the handler error from mon_handle_auth_done() - devlink: rate: Unset parent pointer in devl_rate_nodes_destroy - Documentation/hw-vuln: Add VMSCAPE documentation - dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status() - riscv: use lw when reading int cpu in asm_per_cpu - mm: slub: avoid wake up kswapd in set_track_prepare - tools: gpio: remove the include directory on make clean - tools: gpio: rm .*.cmd on make clean - drm/amd/amdgpu: Fix missing error return on kzalloc failure - drm/amdgpu: Replace DRM_* with dev_* in amdgpu_psp.c - perf bpf-event: Fix use-after-free in synthesis - drm/bridge: ti-sn65dsi86: fix REFCLK setting - spi: spi-fsl-lpspi: Clear status register after disabling the module - spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort - spi: spi-fsl-lpspi: Set correct chip-select polarity bit - spi: spi-fsl-lpspi: Fix transmissions when using CONT - hwmon: mlxreg-fan: Prevent fans from getting stuck at 0 RPM - pcmcia: omap: Add missing check for platform_get_resource - Revert "drm/amdgpu: Avoid extra evict-restore process." - ALSA: hda/realtek: Fix headset mic for TongFang X6[AF]R5xxY - ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model - drm/mediatek: Fix device/node reference count leaks in mtk_drm_get_all_drm_priv - drm/mediatek: Fix using wrong drm private data to bind mediatek-drm - drm/mediatek: Add crtc path enum for all_drm_priv array - vmxnet3: update MTU after device quiesce - net: dsa: microchip: linearize skb for tail-tagging switches - net: dsa: microchip: update tag_ksz masks for KSZ9477 family - dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status() - ALSA: hda/realtek - Add new HP ZBook laptop with micmute led fixup - ALSA: hda/realtek: Add support for HP Agusta using CS35L41 HDA - iio: pressure: mprls0025pa: use aligned_s64 for timestamp - iio: chemical: pms7003: use aligned_s64 for timestamp - iio: imu: inv_mpu6050: align buffer for timestamp - thermal/drivers/mediatek/lvts: Disable low offset IRQ for minimum threshold - nouveau: fix disabling the nonstall irq due to storm code - cpufreq: intel_pstate: Unchecked MSR aceess in legacy mode - net: pcs: rzn1-miic: Correct MODCTRL register offset - platform/x86/amd/pmc: Add TUXEDO IB Pro Gen10 AMD to spurious 8042 quirks list - drm/amdgpu: drop hw access in non-DC audio fini - wifi: mt76: mt7996: Initialize hdr before passing to skb_put_data() - wifi: mwifiex: Initialize the chan_stats array to zero - tcp_bpf: Fix copied value in tcp_bpf_sendmsg - skmsg: Return copied bytes in sk_msg_memcopy_from_iter - tcp_bpf: Add sk_rmem_alloc related logic for tcp_bpf ingress redirection - Revert "bpf, sockmap: Add sk_rmem_alloc check for sockmap" - ALSA: usb-audio: Add mute TLV for playback volumes on some devices - phy: mscc: Stop taking ts_lock for tx_queue and use its own lock - selftest: net: Fix weird setsockopt() in bind_bhash.c. - net: atm: fix memory leak in atm_register_sysfs when device_register fail - ax25: properly unshare skbs in ax25_kiss_rcv() - mctp: return -ENOPROTOOPT for unknown getsockopt options - net/smc: Remove validation of reserved bits in CLC Decline message - ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init() - net: thunder_bgx: decrement cleanup index before use - net: thunder_bgx: add a missing of_node_put - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() - wifi: libertas: cap SSID len in lbs_associate() - wifi: cw1200: cap SSID length in cw1200_do_join() - net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets - wifi: ath11k: fix group data packet drops during rekey - wifi: ath11k: avoid forward declaration of ath11k_mac_start_vdev_delay() - wifi: ath11k: rename ath11k_start_vdev_delay() - wifi: ath11k: Introduce and use ath11k_sta_to_arsta() - net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() - macsec: read MACSEC_SA_ATTR_PN with nla_get_uint - netlink: add variable-length / auto integers - net: macb: Fix tx_ptr_lock locking - icmp: fix icmp_ndo_send address translation for reply direction - mISDN: Fix memory leak in dsp_hwec_enable() - xirc2ps_cs: fix register access when enabling FullDuplex - netfilter: conntrack: helper: Replace -EEXIST by -EBUSY - wifi: cfg80211: fix use-after-free in cmp_bss() - arm64: dts: imx8mp: Fix missing microSD slot vqmmc on Data Modul i.MX8M Plus eDM SBC - arm64: dts: imx8mp: Fix missing microSD slot vqmmc on DH electronics i.MX8M Plus DHCOM - tee: optee: ffa: fix a typo of "optee_ffa_api_is_compatible" - arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro - Bluetooth: hci_sync: Avoid adding default advertising on startup - cpupower: Fix a bug where the -t option of the set subcommand was not working. - drm/amd/display: Don't warn when missing DCE encoder caps - cdc_ncm: Flag Intel OEM version of Fibocom L850-GL as WWAN - LoongArch: Save LBT before FPU in setup_sigcontext() - btrfs: avoid load/store tearing races when checking if an inode was logged - btrfs: fix race between setting last_dir_index_offset and inode logging - btrfs: fix race between logging inode and checking if it was logged before - bpf: Fix oob access in cgroup local storage - !20556 urma: fix update topo logic - !20639 [OLK-6.6][linux-6.6.y sync] Backport 6.6.103-6.6.104 LTS Patches - !20641 [OLK-6.6][linux-6.6.y sync] LoongArch: Add more instruction opcodes and emit_* helpers - !20560 *** fix CVE-2025-38062 *** - !20662 pNFS: Fix a deadlock when returning a delegation during open() - ub:hisi-ubus: Add create bus instance ummu bypass - Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" - Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set" - HID: mcp2221: Handle reads greater than 60 bytes - HID: mcp2221: Don't set bus speed on every transfer - net/mlx5: SF, Fix add port error handling - drm/nouveau/disp: Always accept linear modifier - smb3 client: fix return code mapping of remap_file_range - net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions - dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted - HID: wacom: Add a new Art Pen 2 - HID: logitech: Add ids for G PRO 2 LIGHTSPEED - HID: quirks: add support for Legion Go dual dinput modes - net: stmmac: Set CIC bit only for TX queues with COE - net: stmmac: xgmac: Correct supported speed modes - net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts - net/mlx5e: Set local Xoff after FW update - net/mlx5e: Update and set Xon/Xoff upon port speed set - net/mlx5e: Update and set Xon/Xoff upon MTU set - net/mlx5: Nack sync reset when SFs are present - net/mlx5: Convert SF port_indices xarray to function_ids xarray - net/mlx5: Use devlink port pointer to get the pointer of container SF struct - net/mlx5: Call mlx5_sf_id_erase() once in mlx5_sf_dealloc() - phy: mscc: Fix when PTP clock is register and unregister - net: dlink: fix multicast stats being counted incorrectly - dt-bindings: display/msm: qcom,mdp5: drop lut clock - drm/nouveau: remove unused memory target test - drm/nouveau: remove unused increment in gm200_flcn_pio_imem_wr - Bluetooth: hci_sync: fix set_local_name race condition - Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced - Bluetooth: hci_event: Mark connection as closed during suspend disconnect - Bluetooth: hci_event: Treat UNKNOWN_CONN_ID on disconnect as success - HID: input: report battery status changes immediately - HID: input: rename hidinput_set_battery_charge_status() - powerpc/kvm: Fix ifdef to remove build warning - drm/msm: Defer fd_install in SUBMIT ioctl - vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() - ACPI: EC: Add device to acpi_ec_no_wakeup[] qurik list - erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC - ASoC: codecs: tx-macro: correct tx_macro_component_drv name - smb: client: fix race with concurrent opens in unlink(2) - scsi: core: sysfs: Correct sysfs attributes access rights - of: dynamic: Fix use after free in of_changeset_add_prop_helper() - of: Add a helper to free property struct - mips: lantiq: xway: sysctrl: rename the etop node - mips: dts: lantiq: danube: add missing burst length property - pinctrl: STMFX: add missing HAS_IOMEM dependency - of: dynamic: Fix memleak when of_pci_add_properties() failed - !20684 urma: adjust urma log format - !20355 udp: Deal with race between UDP socket address change and rehash - !20627 Fixes CVE-2025-38627 - !20702 CVE-2025-39948 - !20701 netfilter: ctnetlink: remove refcounting in expectation dumpers - !20700 CVE-2025-38678 - !20703 CVE-2025-38491 - !20690 tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. - obmm: reduce log noise for successful export/import/preimport - mptcp: avoid deadlock on fallback while reinjecting - mptcp: plug races between subflow fail and subflow creation - mptcp: make fallback action and fallback decision atomic - ice: fix Rx page leak on multi-buffer frames - ice: fix incorrect counter for buffer allocation failures - ice: stop storing XDP verdict within ice_rx_buf - ice: gather page_count()'s of each frag right before XDP prog call - ice: Introduce ice_xdp_buff - netfilter: ctnetlink: remove refcounting in expectation dumpers - netfilter: nf_tables: reject duplicate device on updates - netfilter: nf_tables: Introduce functions freeing nft_hook objects - netfilter: nf_tables: Fix percpu address space issues in nf_tables_api.c - err.h: add ERR_PTR_PCPU(), PTR_ERR_PCPU() and IS_ERR_PCPU() macros - tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. - !20498 Fix CVE-2025-71118 - !20608 pmdomain: arm: scmi: Fix genpd leak on provider registration failure - !20679 x86/CPU/AMD: Add RDSEED fix for Zen5 - !20650 fix cve-2025-40300 - !20661 Input: alps - fix use-after-free bugs caused by dev3_register_work - !20664 backport some net bugfix from 6.6 lts - urma: adjust urma log format - !20678 ub: udma: close debug switch load parameters. - ub: udma: close debug switch load parameters. - x86/CPU/AMD: Add RDSEED fix for Zen5 - !20630 net: LTS-6.6 bugfix backport - !20632 net/sched: sch_qfq: do not free existing class in qfq_change_class() - !20631 macvlan: fix possible UAF in macvlan_forward_source() - !20628 Fix CVE-2025-39910 - !20659 v2 Fix CVE-2025-22090 - !20506 XSched: Update XSched manual - !20647 media: imon: make send_packet() more robust - !20646 ksm: use range-walk function to jump over holes in scan_get_next_rmap_item - !20645 fbcon: Set fb_display[i - !20648 parse_longname(): strrchr() expects NUL-terminated string - !20621 urma: modify log level - !20602 urma: fix the jfe uaf issue that occurred during the killall process. - !20567 urma:change log level and pass status 9 - !20640 iio: common: st_sensors: Fix use of uninitialize device structs - !20634 usb: gadget: udc: fix use-after-free in usb_gadget_state_work - !20633 net: dsa: properly keep track of conduit reference - !20635 fix CVE-2025-68231 - !20651 mm/slub: avoid accessing metadata when pointer is invalid in object_err() - !20649 drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb - !20652 mm/vmalloc: fix data race in show_numa_info() - x86: uaccess: don't use runtime-const rewriting in modules - x86: fix off-by-one in access_ok() - x86: fix user address masking non-canonical speculation issue - x86/uaccess: Zero the 8-byte get_range case on failure on 32-bit - x86/uaccess: Improve the 8-byte getuser() case - x86: fix whitespace in runtime-const assembler output - dcache: keep dentry_hashtable or d_hash_shift even when not used - runtime constants: add x86 architecture support - runtime constants: deal with old decrepit linkers - x86/uaccess: Add missing __force to casts in __access_ok() and valid_user_address() - !20345 arm64: entry: xcall/xint: make asm conditionals compatible with clang IAS - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). - libceph: replace BUG_ON with bounds check for map->max_osd - libceph: prevent potential out-of-bounds writes in handle_auth_session_key() - libceph: fix potential use-after-free in have_mon_and_osd_map() - sctp: Hold sock lock while iterating over address list - sctp: Prevent TOCTOU out-of-bounds write - sctp: Hold RCU read lock while iterating over address list - tipc: Fix use-after-free in tipc_mon_reinit_self(). - sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto - sctp: avoid NULL dereference when chunk data buffer is missing - bpf: Explicitly check accesses to bpf_sock_addr - ipvs: Defer ip_vs_ftp unregister during netns cleanup - nexthop: Forbid FDB status change while nexthop is in a group - netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). - net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer - sctp: initialize more fields in sctp_v6_from_sk() - pNFS: Fix a deadlock when returning a delegation during open() - Input: alps - fix use-after-free bugs caused by dev3_register_work - x86/cpu: Get CPU LLC ID from CPUID 0x8000001d in guest for Hygon processors - kernel/fork: only call untrack_pfn_clear() on VMAs duplicated for fork() - mm: (un)track_pfn_copy() fix + doc improvements - x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range() - !20642 mtdchar: fix integer overflow in read/write ioctls - mm/vmalloc: fix data race in show_numa_info() - mm/slub: avoid accessing metadata when pointer is invalid in object_err() - config: enable CONFIG_MITIGATION_VMESCAPE by default on x86 - x86/vmscape: Enable the mitigation - x86/vmscape: Enumerate VMSCAPE bug - x86/vmscape: Add conditional IBPB mitigation - drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb - parse_longname(): strrchr() expects NUL-terminated string - media: imon: make send_packet() more robust - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item - fbcon: Set fb_display[i]->mode to NULL when the mode is released - !20569 CVE-2024-35808 - mtdchar: fix integer overflow in read/write ioctls - !20619 Fix CVE-2026-22991 - !20612 net: hns3: extend HCLGE_FD_AD_COUNTER_NUM to 8 bits - LoongArch: Add more instruction opcodes and emit_* helpers - iio: common: st_sensors: Fix use of uninitialize device structs - !20581 null_blk: fix kmemleak by releasing references to fault configfs items - mm/mempool: fix poisoning order>0 pages with HIGHMEM - mm/page_poison: replace kmap_atomic() with kmap_local_page() - mm/mempool: replace kmap_atomic() with kmap_local_page() - usb: gadget: udc: fix use-after-free in usb_gadget_state_work - net: dsa: properly keep track of conduit reference - net/sched: sch_qfq: do not free existing class in qfq_change_class() - macvlan: fix possible UAF in macvlan_forward_source() - netfilter: nft_objref: validate objref and objrefmap expressions - arp: do not assume dev_hard_header() does not change skb->head - ip6_gre: make ip6gre_header() robust - netfilter: nf_tables: avoid chain re-validation if possible - netfilter: nf_tables: drop unused 3rd argument from validate callback ops - Revert "netfilter: nft_objref: validate objref and objrefmap expressions" - bpf: Fix reference count leak in bpf_prog_test_run_xdp() - net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset - ethtool: Avoid overflowing userspace buffer on stats query - ipvs: fix ipv4 null-ptr-deref in route error path - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() - !20596 mm/page_alloc: prevent pcp corruption with SMP=n - !20598 team: fix check for port enabled in team_queue_override_port_prio_changed() - !18823 hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio - mm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc() - kasan: avoid sleepable page allocation from atomic context - f2fs: compress: fix UAF of f2fs_inode_info in f2fs_free_dic - f2fs: compress: change the first parameter of page_array_{alloc,free} to sbi - !20583 [OLK-6.6][linux-6.6.y sync] Backport 6.6.102-6.6.103 LTS Patches - !20460 fbdev: Fix vmalloc out-of-bounds write in fast_imageblit - urma:fix log level and pass status 9 - urma: modify log level - !20592 CVE-2025-71141 fixup - !20594 CVE-2025-39744 fixup - !20607 powerpc/64s/slb: Fix SLB multihit issue during SLB preload - !20606 mm/huge_memory: fix NULL pointer deference when splitting folio - !20604 Fix CVE-2026-22984 - !20603 Fix CVE-2026-23021 - !20600 Fix CVE-2026-22990 - urma: fix the jfe uaf issue that occurred during the killall process. - !20380 pswiotlb: Adapt to the IOMMU DMA API upgraded by IOMMUFD - libceph: make free_choose_arg_map() resilient to partial allocation - drm/dp: Change AUX DPCD probe address from LANE0_1_STATUS to TRAINING_PATTERN_SET - net: hns3: extend HCLGE_FD_AD_COUNTER_NUM to 8 bits - net: hns3: extend HCLGE_FD_AD_QID to 11 bits - net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue - net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M - Revert "net: hns3: add support for FD counter" - !20587 dmaengine: stm32: dmamux: fix device leak on route allocation - pmdomain: arm: scmi: Fix genpd leak on provider registration failure - powerpc/64s/slb: Fix SLB multihit issue during SLB preload - mm/huge_memory: fix NULL pointer deference when splitting folio - !20562 LoongArch: BPF: Sign extend kfunc call arguments - !20470 ipv4: Fix reference count leak when using error routes with nexthop objects - !20471 net: sock: fix hardened usercopy panic in sock_recv_errqueue - !20472 net: fix memory leak in skb_segment_list for GRO packets - !20473 ipv4: ip_gre: make ipgre_header() robust - !20469 SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf - !20476 ipv6: Fix use-after-free in inet6_addr_del(). - !20477 svcrdma: bound check rq_pages index in inline path - !20578 ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() - !20579 fix CVE-2025-68768 - !20542 Fix NFS deadlock - USB: storage: Remove subclass and protocol overrides from Novatek quirk - cpuidle: governors: menu: Select polling state in some more cases - cpuidle: governors: menu: Rearrange main loop in menu_select() - cpuidle: menu: Update documentation after previous changes - Revert "drm/tegra: dsi: Clear enable register if powered by bootloader" - parisc: Remove spurious if statement from raw_copy_from_user() - ata: libata-scsi: Fix system suspend for a security locked drive - Revert "drm/amdgpu: fix incorrect vm flags to map bo" - mfd: axp20x: Set explicit ID for regulator cell if no IRQ line is present - drm/amd/display: use udelay rather than fsleep - sched/fair: Revert max_newidle_lb_cost bump - net: ipv4: fix regression in local-broadcast routes - tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers - PM: runtime: Do not clear needs_force_resume with enabled runtime PM - usb: typec: ucsi: psy: Set max current to zero when disconnected - io_uring/rw: cast rw->flags assignment to rwf_t - Documentation: ACPI: i2c-muxes: fix I2C device references - s390/hypfs: Enable limited access during lockdown - s390/hypfs: Avoid unnecessary ioctl registration in debugfs - ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation - net/mlx5e: Preserve shared buffer capacity during headroom updates - net/mlx5: Base ECVF devlink port attrs from 0 - Octeontx2-af: Skip overlap check for SPI field - bonding: send LACPDUs periodically in passive mode after receiving partner's LACPDU - bonding: Add independent control state machine - bonding: update LACP activity flag after setting lacp_active - net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate - ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc - gve: prevent ethtool ops after shutdown - phy: mscc: Fix timestamping for vsc8584 - net: ethernet: mtk_ppe: add RCU lock around dev_fill_forward_path - ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add - net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM - ALSA: usb-audio: Fix size validation in convert_chmap_v3() - mlxsw: spectrum: Forward packets with an IPv4 link-local source IP - Bluetooth: hci_conn: do return error from hci_enhanced_setup_sync() - Bluetooth: hci_event: fix MTU for BN == 0 in CIS Established - scsi: qla4xxx: Prevent a potential error pointer dereference - RDMA/bnxt_re: Fix to initialize the PBL array - RDMA/bnxt_re: Fix to remove workload check in SRQ limit path - RDMA/bnxt_re: Fix to do SRQ armena by default - RDMA/erdma: Fix ignored return value of init_kernel_qp - iosys-map: Fix undefined behavior in iosys_map_clear() - cgroup/cpuset: Use static_branch_enable_cpuslocked() on cpusets_insane_config_key - spi: spi-fsl-lpspi: Clamp too high speed_hz - usb: typec: maxim_contaminant: disable low power mode when reading comparator values - usb: typec: maxim_contaminant: re-enable cc toggle if cc is open and port is clean - iio: imu: inv_icm42600: change invalid data error to -EBUSY - iio: imu: inv_icm42600: Convert to uXX and sXX integer types - iio: imu: inv_icm42600: use = { } instead of memset() - iio: imu: inv_icm42600: switch timestamp type from int64_t __aligned(8) to aligned_s64 - iio: temperature: maxim_thermocouple: use DMA-safe buffer for spi_read() - iio: light: as73211: Ensure buffer holes are zeroed - tls: fix handling of zero-length records on the rx_list - powerpc/boot: Fix build with gcc 15 - mmc: sdhci-pci-gli: GL9763e: Mask the replay timer timeout of AER - compiler: remove __ADDRESSABLE_ASM{_STR,}() again - drm/amd/display: Don't overclock DCE 6 by 15% - usb: dwc3: pci: add support for the Intel Wildcat Lake - usb: dwc3: Ignore late xferNotReady event to prevent halt timeout - USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles - usb: storage: realtek_cr: Use correct byte order for bcs->Residue - USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera - usb: renesas-xhci: Fix External ROM access timeouts - usb: core: hcd: fix accessing unmapped memory in SINGLE_STEP_SET_FEATURE test - comedi: Make insn_rw_emulate_bits() do insn->n samples - usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive - cdx: Fix off-by-one error in cdx_rpmsg_probe() - most: core: Drop device reference after usage in get_channel() - iio: proximity: isl29501: fix buffered read on big-endian systems - iio: pressure: bmp280: Use IS_ERR() in bmp280_common_probe() - fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable() - drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS - cpuidle: governors: menu: Avoid selecting states with too much latency - cpuidle: menu: Remove iowait influence - mmc: sdhci-pci-gli: Add a new function to simplify the code - mmc: sdhci-pci-gli: Use PCI AER definitions, not hard-coded values - mptcp: disable add_addr retransmission when timeout is 0 - mptcp: remove duplicate sk_reset_timer call - use uniform permission checks for all mount propagation changes - arm64: dts: ti: k3-am62-main: Remove eMMC High Speed DDR support - scsi: mpi3mr: Serialize admin queue BAR writes on 32-bit systems - scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers - scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE - PCI: imx6: Add IMX8MM_EP and IMX8MP_EP fixed 256-byte BAR 4 in epc_features - PCI: imx6: Delay link start until configfs 'start' written - PCI: rockchip: Set Target Link Speed to 5.0 GT/s before retraining - PCI: rockchip: Use standard PCIe definitions - drm/amd/display: Fill display clock and vblank time in dce110_fill_display_configs - drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs - drm/amd/display: Fix DP audio DTO1 clock source on DCE 6. - drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3 - ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and EliteBook 830 G6 - mm/debug_vm_pgtable: clear page table entries at destroy_args() - squashfs: fix memory leak in squashfs_fill_super - mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for consistency - memstick: Fix deadlock by moving removing flag earlier - KVM: arm64: Fix kernel BUG() due to bad backport of FPSIMD/SVE/SME fix - sched/fair: Fix frequency selection for non-invariant case - kbuild: userprogs: use correct linker when mixing clang and GNU ld - ata: libata-scsi: Return aborted command when missing sense and result TF - PM: runtime: Take active children into account in pm_runtime_get_if_in_use() - PM: runtime: Simplify pm_runtime_get_if_active() usage - ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig - usb: dwc3: imx8mp: fix device leak at unbind - wifi: mac80211: check basic rates validity in sta_link_apply_parameters - KVM: x86: Take irqfds.lock when adding/deleting IRQ bypass producer - s390/mm: Remove possible false-positive warning in pte_free_defer() - btrfs: send: make fs_path_len() inline and constify its argument - btrfs: send: use fallocate for hole punching with send stream v2 - btrfs: send: avoid path allocation for the current inode when issuing commands - btrfs: send: keep the current inode's path cached - btrfs: send: add and use helper to rename current inode when processing refs - btrfs: send: only use boolean variables at process_recorded_refs() - btrfs: send: factor out common logic when sending xattrs - btrfs: populate otime when logging an inode item - btrfs: constify more pointer parameters - btrfs: fix ssd_spread overallocation - btrfs: open code timespec64 in struct btrfs_inode - xfs: fully decouple XFS_IBULK* flags from XFS_IWALK* flags - btrfs: abort transaction on unexpected eb generation at btrfs_copy_root() - btrfs: always abort transaction on failure to add block group to free space tree - btrfs: move transaction aborts to the error site in add_block_group_free_space() - btrfs: qgroup: fix race between quota disable and quota rescan ioctl - usb: typec: fusb302: cache PD RX state - block: Make REQ_OP_ZONE_FINISH a write operation - block: reject invalid operation in submit_bio_noacct - leds: flash: leds-qcom-flash: Fix registry access after re-bind - leds: flash: leds-qcom-flash: Limit LED current based on thermal condition - selftests/memfd: add test for mapping write-sealed memfd read-only - mm: update memfd seal write check to include F_SEAL_WRITE - mptcp: pm: kernel: flush: do not reset ADD_ADDR limit - mptcp: drop skb if MPTCP skb extension allocation fails - ipv6: sr: Fix MAC comparison to be constant-time - drm/amd/display: Don't overwrite dce60_clk_mgr - drm/amd/display: Add primary plane to commits for correct VRR handling - drm/amdkfd: Destroy KFD debugfs after destroy KFD wq - drm/amdgpu: update mmhub 3.0.1 client id mappings - drm/amdgpu: Avoid extra evict-restore process. - drm/amd: Restore cached power limit during resume - media: venus: venc: Clamp param smaller than 1fps and bigger than 240 - media: venus: vdec: Clamp param smaller than 1fps and bigger than 240. - media: venus: protect against spurious interrupts during probe - media: venus: hfi: explicitly release IRQ during teardown - media: qcom: camss: cleanup media device allocated resource on error path - media: ov2659: Fix memory leaks in ov2659_probe() - media: usbtv: Lock resolution while streaming - media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free() - media: verisilicon: Fix AV1 decoder clock frequency - media: vivid: fix wrong pixel_array control size - media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init() - media: hi556: correct the test pattern configuration - media: gspca: Add bounds checking to firmware parser - parisc: Update comments in make_insert_tlb - parisc: Try to fixup kernel exception in bad_area_nosemaphore path of do_page_fault() - parisc: Rename pte_needs_flush() to pte_needs_cache_flush() in cache.c - parisc: Makefile: explain that 64BIT requires both 32-bit and 64-bit compilers - parisc: Define and use set_pte_at() - parisc: Check region is readable by user in raw_copy_from_user() - soc/tegra: pmc: Ensure power-domains are in a known state - f2fs: fix to avoid out-of-boundary access in dnode page - phy: qcom: phy-qcom-m31: Update IPQ5332 M31 USB phy initialization sequence - vhost/vsock: Avoid allocating arbitrarily-sized SKBs - PCI: endpoint: Fix configfs group removal on driver teardown - PCI: endpoint: Fix configfs group list head handling - mtd: rawnand: renesas: Add missing check after DMA map - mtd: rawnand: fsmc: Add missing check after DMA map - mtd: spinand: propagate spinand_wait() errors from spinand_write_page() - mtd: spi-nor: Fix spi_nor_try_unlock_all() - hwmon: (gsc-hwmon) fix fan pwm setpoint show functions - pwm: mediatek: Fix duty and period setting - pwm: mediatek: Handle hardware enable and clock enable separately - pwm: imx-tpm: Reset counter if CMOD is 0 - wifi: ath11k: fix dest ring-buffer corruption when ring is full - wifi: ath11k: fix source ring-buffer corruption - wifi: ath11k: fix dest ring-buffer corruption - wifi: ath12k: fix dest ring-buffer corruption when ring is full - wifi: ath12k: fix source ring-buffer corruption - wifi: ath12k: fix dest ring-buffer corruption - wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table() - iio: adc: ad_sigma_delta: change to buffer predisable - zynq_fpga: use sgtable-based scatterlist wrappers - scsi: ufs: ufs-pci: Fix default runtime and system PM levels - scsi: ufs: ufs-pci: Fix hibernate state transition for Intel MTL-like host controllers - ata: libata-scsi: Fix ata_to_sense_error() status handling - scsi: mpi3mr: Fix race between config read submit and interrupt completion - dt-bindings: display: sprd,sharkl3-dsi-host: Fix missing clocks constraints - dt-bindings: display: sprd,sharkl3-dpu: Fix missing clocks constraints - arm64: dts: ti: k3-am62-verdin: Enable pull-ups on I2C buses - arm64: dts: ti: k3-am62a7-sk: fix pinmux for main_uart1 - arm64: dts: ti: k3-pinctrl: Enable Schmitt Trigger by default - btrfs: zoned: fix write time activation failure for metadata block group - ext4: fix hole length calculation overflow in non-extent inodes - ext4: don't try to clear the orphan_present feature block device is r/o - ext4: fix reserved gdt blocks handling in fsmap - ext4: fix fsmap end of range reporting with bigalloc - ext4: check fast symlink for ea_inode correctly - tracing: fprobe-event: Sanitize wildcard for fprobe event name - crypto: qat - lower priority for skcipher and aead algorithms - lib/crypto: mips/chacha: Fix clang build and remove unneeded byteswap - vt: defkeymap: Map keycodes above 127 to K_HOLE - vt: keyboard: Don't process Unicode characters in K_OFF mode - bus: mhi: host: Fix endianness of BHI vector table - usb: dwc3: meson-g12a: fix device leaks at unbind - usb: musb: omap2430: fix device leak at unbind - usb: gadget: udc: renesas_usb3: fix device leak at unbind - usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init() - m68k: Fix lost column on framebuffer debug console - platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister() - cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table() - rcu: Fix racy re-initialization of irq_work causing hangs - HID: apple: avoid setting up battery timer for devices without battery - HID: magicmouse: avoid setting up battery timer when not needed - RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages - tools/nolibc: fix spelling of FD_SETBITMASK in FD_* macros - media: uvcvideo: Do not mark valid metadata as invalid - media: venus: Fix OOB read due to missing payload bound check - parisc: Makefile: fix a typo in palo.conf - fbdev: Fix vmalloc out-of-bounds write in fast_imageblit - btrfs: do not allow relocation of partially dropped subvolumes - btrfs: zoned: do not select metadata BG as finish target - btrfs: clear dirty status from extent buffer on error at insert_new_root() - btrfs: zoned: do not remove unwritten non-data block group - btrfs: abort transaction during log replay if walk_log_tree() failed - btrfs: zoned: use filesystem size not disk size for reclaim decision - cdc-acm: fix race between initial clearing halt and open - thunderbolt: Fix copy+paste error in match_service_id() - usb: typec: ucsi: Update power_supply on power role change - misc: rtsx: usb: Ensure mmc child device is active when card is present - iommufd: Report unmapped bytes in the error path of iopt_unmap_iova_range - cifs: reset iface weights when we cannot find a candidate - drm/amdgpu: fix incorrect vm flags to map bo - scsi: lpfc: Remove redundant assignment to avoid memory leak - rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe - pNFS: Handle RPC size limit for layoutcommits - pNFS: Fix disk addr range check in block/scsi layout - pNFS: Fix stripe mapping in block/scsi layout - ASoC: Intel: avs: Fix uninitialized pointer error in probe() - net: phy: smsc: add proper reset flags for LAN8710A - ipmi: Fix strcpy source and destination the same - kconfig: lxdialog: fix 'space' to (de)select options - kconfig: gconf: fix potential memory leak in renderer_edited() - kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed() - ipmi: Use dev_warn_ratelimited() for incorrect message warnings - vfio/mlx5: fix possible overflow in tracking max message size - scsi: aacraid: Stop using PCI_IRQ_AFFINITY - scsi: target: core: Generate correct identifiers for PR OUT transport IDs - scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans - kconfig: nconf: Ensure null termination where strncpy is used - vfio/type1: conditional rescheduling while pinning - kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c - f2fs: check the generic conditions first - exfat: add cluster chain loop check for dir - i2c: Force DLL0945 touchpad i2c freq to 100khz - apparmor: use the condition in AA_BUG_FMT even with debug disabled - dm-table: fix checking for rq stackable devices - dm-mpath: don't print the "loaded" message if registering fails - i3c: master: Initialize ret in i3c_i2c_notifier_call() - i3c: don't fail if GETHDRCAP is unsupported - apparmor: shift ouid when mediating hard links in userns - rtc: ds1307: handle oscillator stop flag (OSF) for ds1341 - i3c: add missing include to internal header - module: Prevent silent truncation of module name in delete_module(2) - md: dm-zoned-target: Initialize return variable r to avoid uninitialized use - soundwire: Move handle_nested_irq outside of sdw_dev_lock - soundwire: amd: serialize amd manager resume sequence during pm_prepare - crypto: octeontx2 - add timeout for load_fvc completion poll - media: uvcvideo: Fix bandwidth issue for Alcor camera - media: usb: hdpvr: disable zero-length read messages - media: tc358743: Increase FIFO trigger level to 374 - media: tc358743: Return an appropriate colorspace from tc358743_set_fmt - media: tc358743: Check I2C succeeded during probe - pinctrl: stm32: Manage irq affinity settings - scsi: mpi3mr: Correctly handle ATA device errors - scsi: mpt3sas: Correctly handle ATA device errors - power: supply: qcom_battmgr: Add lithium-polymer entry - RDMA/core: reduce stack using in nldev_stat_get_doit() - dmaengine: stm32-dma: configure next sg only if there are more than 2 sgs - leds: leds-lp50xx: Handle reg to get correct multi_index - media: v4l2-common: Reduce warnings about missing V4L2_CID_LINK_FREQ control - MIPS: lantiq: falcon: sysctrl: fix request memory check logic - crypto: jitter - fix intermediary handling - watchdog: iTCO_wdt: Report error if timeout configuration fails - MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free} - clk: qcom: ipq5018: keep XO clock always on - hwmon: (emc2305) Set initial PWM minimum value during probe based on thermal state - watchdog: dw_wdt: Fix default timeout - fs/orangefs: use snprintf() instead of sprintf() - phy: rockchip-pcie: Properly disable TEST_WRITE strobe signal - mfd: axp20x: Set explicit ID for AXP313 regulator - clk: tegra: periph: Fix error handling and resolve unsigned compare warning - fbdev: fix potential buffer overflow in do_register_framebuffer() - cifs: Fix calling CIFSFindFirst() for root path without msearch - watchdog: sbsa: Adjust keepalive timeout to avoid MediaTek WS0 race condition - drm/amd/display: Avoid configuring PSR granularity if PSR-SU not supported - drm/amd/display: Only finalize atomic_obj if it was initialized - vhost: fail early when __vhost_add_used() fails - vsock/virtio: Resize receive buffers so that each SKB fits in a 4K page - net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325 - rcu: Fix rcu_read_unlock() deadloop due to IRQ work - drm/amd/display: Avoid trying AUX transactions on disconnected ports - selftests/bpf: Fix a user_ringbuf failure with arm64 64KB page size - bpf: Make reg_not_null() true for CONST_PTR_TO_MAP - uapi: in6: restore visibility of most IPv6 socket options - drm/ttm: Should to return the evict error - drm: renesas: rz-du: mipi_dsi: Add min check for VCLK range - net: ncsi: Fix buffer overflow in fetching version id - ionic: clean dbpage in de-init - wifi: rtlwifi: fix possible skb memory leak in _rtl_pci_init_one_rxdesc() - ptp: Use ratelimite for freerun error message - bpftool: Fix JSON writer resource leak in version command - net: dsa: b53: prevent SWITCH_CTRL access on BCM5325 - net: dsa: b53: prevent DIS_LEARNING access on BCM5325 - net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325 - net: dsa: b53: fix b53_imp_vlan_setup for BCM5325 - gve: Return error for unknown admin queue command - net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs - net: vlan: Make is_vlan_dev() a stub when VLAN is not configured - drm/amd: Allow printing VanGogh OD SCLK levels without setting dpm to manual - dpaa_eth: don't use fixed_phy_change_carrier - wifi: iwlegacy: Check rate_idx range after addition - netmem: fix skb_frag_address_safe with unreadable skbs - powerpc: floppy: Add missing checks after DMA map - wifi: ath12k: Decrement TID on RX peer frag setup error handling - wifi: ath12k: Enable REO queue lookup table feature on QCN9274 hw2.0 - wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`. - wifi: mac80211: update radar_required in channel context after channel switch - drm/amd/display: Fix 'failed to blank crtc!' - wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect - wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd() - wifi: ath12k: Add memset and update default rate value in wmi tx completion - drm/amd/display: Separate set_gsl from set_gsl_source_select - net: fec: allow disable coalescing - net: atlantic: add set_power to fw_ops for atl2 to fix wol - net: thunderbolt: Fix the parameter passing of tb_xdomain_enable_paths()/tb_xdomain_disable_paths() - net: thunderbolt: Enable end-to-end flow control also in transmit - kselftest/arm64: Specify SVE data when testing VL set in sve-ptrace - wifi: mt76: mt7915: mcu: re-init MCU before loading FW patch - wifi: rtw89: Disable deep power saving for USB/SDIO - wifi: rtw89: Fix rtw89_mac_power_switch() for USB - drm/msm: use trylock for debugfs - wifi: mac80211: fix rx link assignment for non-MLO stations - ipv6: mcast: Check inet6_dev->dead under idev->mc_lock in __ipv6_dev_mc_inc(). - (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer - wifi: mac80211: don't complete management TX on SAE commit - sched/fair: Bump sd->max_newidle_lb_cost when newidle balance fails - s390/stp: Remove udelay from stp_sync_clock() - wifi: iwlwifi: mvm: fix scan request validation - um: Re-evaluate thread flags repeatedly - wifi: iwlwifi: mvm: set gtk id also in older FWs - perf/cxlpmu: Remove unintended newline from IRQ name format string - net: phy: micrel: Add ksz9131_resume() - net: thunderx: Fix format-truncation warning in bgx_acpi_match_id() - net: ipv4: fix incorrect MTU in broadcast routes - wifi: cfg80211: Fix interface type validation - net: mctp: Prevent duplicate binds - arm64: Mark kernel as tainted on SAE and SError panic - net/mlx5e: Properly access RCU protected qdisc_sleeping variable - net: ag71xx: Add missing check after DMA map - et131x: Add missing check after DMA map - wifi: rtw89: Lower the timeout in rtw89_fw_read_c2h_reg() for USB - be2net: Use correct byte order and format string for TCP seq and ack_seq - s390/time: Use monotonic clock in get_cycles() - wifi: cfg80211: reject HTC bit for management frames - ktest.pl: Prevent recursion of default variable options - wifi: ath12k: Correct tid cleanup when tid setup fails - net: usb: cdc-ncm: check for filtering capability - xen/netfront: Fix TX response spurious interrupts - Bluetooth: hci_sock: Reset cookie to zero in hci_sock_free_cookie() - powerpc/thp: tracing: Hide hugepage events under CONFIG_PPC_BOOK3S_64 - ASoC: qcom: use drvdata instead of component to keep id - ASoC: codecs: rt5640: Retry DEVICE_ID verification - iio: adc: ad7768-1: Ensure SYNC_IN pulse minimum timing requirement - ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros - ALSA: pcm: Rewrite recalculate_boundary() to avoid costly loop - platform/chrome: cros_ec_typec: Defer probe on missing EC parent - platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches - soc: qcom: mdt_loader: Actually use the e_phoff - imx8m-blk-ctrl: set ISI panic write hurry level - pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop() - usb: core: usb_submit_urb: downgrade type check - usb: typec: intel_pmc_mux: Defer probe if SCU IPC isn't present - ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4 - ASoC: hdac_hdmi: Rate limit logging on connection and disconnection - ALSA: hda: Disable jack polling at shutdown - ALSA: hda: Handle the jack polling always via a work - mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode() - mei: bus: Check for still connected devices in mei_cl_bus_dev_release() - char: misc: Fix improper and inaccurate error code returned by misc_init() - reset: brcmstb: Enable reset drivers for ARCH_BCM2835 - pps: clients: gpio: fix interrupt handling order in remove path - ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path - mmc: sdhci-msm: Ensure SD card power isn't ON when card removed - ACPI: processor: fix acpi_object initialization - PM: sleep: console: Fix the black screen issue - thermal: sysfs: Return ENODATA instead of EAGAIN for reads - PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit() - firmware: tegra: Fix IVC dependency problems - ACPI: PRM: Reduce unnecessary printing to avoid user confusion - selftests: tracing: Use mutex_unlock for testing glob filter - tools/build: Fix s390(x) cross-compilation with clang - gpio: tps65912: check the return value of regmap_update_bits() - iio: adc: ad_sigma_delta: don't overallocate scan buffer - tools/nolibc: define time_t in terms of __kernel_old_time_t - thermal/drivers/qcom-spmi-temp-alarm: Enable stage 2 shutdown when required - ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed - EDAC/synopsys: Clear the ECC counters on init - gpio: wcd934x: check the return value of regmap_update_bits() - remoteproc: imx_rproc: skip clock enable when M-core is managed by the SCU - soc: qcom: rpmh-rsc: Add RSC version 4 support - usb: xhci: Avoid showing errors during surprise removal - usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command - usb: xhci: Avoid showing warnings for dying controller - usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default - selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t - cpufreq: CPPC: Mark driver with NEED_UPDATE_LIMITS flag - platform/x86/amd: pmc: Add Lenovo Yoga 6 13ALC6 to pmc quirk list - usb: xhci: print xhci->xhc_state when queue_command failed - tracefs: Add d_delete to remove negative dentries - securityfs: don't pin dentries twice, once is enough... - fix locking in efi_secret_unlink() - ext2: Handle fiemap on empty files to prevent EINVAL - fs/ntfs3: correctly create symlink for relative path - fs/ntfs3: Add sanity check for file name - better lockdep annotations for simple_recursive_removal() - hfs: fix not erasing deleted b-tree node issue - drbd: add missing kref_get in handle_write_conflicts - udf: Verify partition map count - gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops - nvme-pci: try function level reset on init failure - smb/server: avoid deadlock when linking with ReplaceIfExists - arm64: Handle KCOV __init vs inline mismatches - ptp: prevent possible ABBA deadlock in ptp_clock_freerun() - intel_idle: Allow loading ACPI tables for any family - net: ti: icss-iep: Fix incorrect type for return value in extts_enable() - netfilter: ctnetlink: fix refcount leak on table dump - udp: also consider secpath when evaluating ipsec use for checksumming - KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs - KVM: nVMX: Check vmcs12->guest_ia32_debugctl on nested VM-Enter - KVM: VMX: Extract checking of guest's DEBUGCTL into helper - KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported - KVM: VMX: Handle forced exit due to preemption timer in fastpath - KVM: VMX: Re-enter guest in fastpath for "spurious" preemption timer exits - KVM: x86: Plumb "force_immediate_exit" into kvm_entry() tracepoint - libceph: prevent potential out-of-bounds reads in handle_auth_done() - net: usb: pegasus: fix memory leak in update_eth_regs_async() - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() - !20540 urma: added support for ipoverurma - team: fix check for port enabled in team_queue_override_port_prio_changed() - mm/page_alloc: prevent pcp corruption with SMP=n - !20528 Fix CVE-2025-71083 - KVM: nVMX: Defer SVI update to vmcs01 on EOI when L2 is active w/o VID - KVM: x86: Plumb in the vCPU to kvm_x86_ops.hwapic_isr_update() - KVM: SVM: Set RFLAGS.IF=1 in C code, to get VMRUN out of the STI shadow - smb: client: don't wait for info->send_pending == 0 on error - smb: client: let send_done() cleanup before calling smbd_disconnect_rdma_connection() - ACPI: processor: perflib: Move problematic pr->performance check - ACPI: processor: perflib: Fix initial _PPC limit application - Documentation: ACPI: Fix parent device references - fs: Prevent file descriptor table allocations exceeding INT_MAX - sunvdc: Balance device refcount in vdc_port_mpgroup_check - PCI: Extend isolated function probing to LoongArch - NFSD: detect mismatch of file handle and delegation stateid in OPEN op - net: dpaa: fix device leak when querying time stamp info - net: ti: icss-iep: fix device and OF node leaks at probe - net: mtk_eth_soc: fix device leak at probe - net: enetc: fix device and OF node leak at probe - net: gianfar: fix device leak when querying time stamp info - net: phy: micrel: fix KSZ8081/KSZ8091 cable test - gpio: mlxbf3: use platform_get_irq_optional() - gpio: mlxbf2: use platform_get_irq_optional() - gpio: virtio: Fix config space reading. - ALSA: hda/realtek: Add Framework Laptop 13 (AMD Ryzen AI 300) to quirks - ALSA: hda/realtek: Fix headset mic on HONOR BRB-X - ALSA: usb-audio: Validate UAC3 cluster segment descriptors - rcu: Fix racy re-initialization of irq_work causing hangs - rcu: Fix rcu_read_unlock() deadloop due to IRQ work - drm/tilcdc: Fix removal actions in case of failed probe - drm/tilcdc: request and mapp iomem with devres - urma: fix update topo logic - dmaengine: stm32: dmamux: fix device leak on route allocation - pswiotlb: Adapt to the IOMMU DMA API upgraded by IOMMUFD - null_blk: fix kmemleak by releasing references to fault configfs items - inet: frags: flush pending skbs in fqdir_pre_exit() - inet: frags: add inet_frag_queue_flush() - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() - md/dm-raid: don't clear MD_RECOVERY_FROZEN after setting frozen - md/dm-raid: don't call md_reap_sync_thread() directly - ACPICA: Avoid walking the Namespace if start_node is NULL - arm64: entry: xcall/xint: make asm conditionals compatible with clang IAS - LoongArch: BPF: Sign extend kfunc call arguments - genirq/msi:: Fix kabi break of struct msi_desc - genirq/msi: Store the IOMMU IOVA directly in msi_desc instead of iommu_cookie - NFS: Fix a deadlock involving nfs_release_folio() - Revert "[Huawei] Revert "NFS: fix up nfs_release_folio() to try to release the page"" - urma: added support for ipoverurma - drm/ttm: Avoid NULL pointer deref for evicted BOs - XSched: Update XSched manual - svcrdma: bound check rq_pages index in inline path - ipv6: Fix use-after-free in inet6_addr_del(). - ipv4: ip_gre: make ipgre_header() robust - net: fix memory leak in skb_segment_list for GRO packets - net: sock: fix hardened usercopy panic in sock_recv_errqueue - ipv4: Fix reference count leak when using error routes with nexthop objects - SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf - fbdev: Fix vmalloc out-of-bounds write in fast_imageblit - udp: Deal with race between UDP socket address change and rehash - EDAC/amd64: The width of hash value is 2 bits for Hygon family 18h model 6h processors - x86/tsc: Use topology_max_packages() to get package number - EDAC/amd64: Use unicast instead of broadcast to access the cs_config register - EDAC/amd64: Correct the address translation for hygon family 18h model 4h - KVM: arm64: Mark some header functions as inline - KVM: arm64: Refactor exit handlers - x86/resctrl: Fix memory bandwidth counter width for Hygon CPUs - hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio - !20820 ub/obmm: add sysfs interface for mempool statistics & bugfixes - ub/obmm: fix wrong pxm_numa parameter validation - ub/obmm: Remove unused parameters from obmm_addr_check.c - ub/obmm: Enhance mem_allocator_granu validation - ub/obmm: simplify allocator naming scheme - ub/obmm: fix allow_slow logic and optimize conti_alloc_memory - ub/obmm: add sysfs interface with fine-grained memory statistics - !20804 net: hv_netvsc: reject RSS hash key programming without RX indirection table - !20813 migrate: correct lock ordering for hugetlb file folios - !20812 libceph: make calc_target() set t->paused, not just clear it - !20719 drivers/ub/sentry: some bugfix - !20798 urma: log should not retrieve eid_idx from uctx - !20808 urma: support triple bonding device - urma: log should not retrieve eid_idx from uctx - migrate: correct lock ordering for hugetlb file folios - libceph: make calc_target() set t->paused, not just clear it - !20745 vfio platform VFIO support for hisi05a1 devices - urma: support triple bonding device - net: hv_netvsc: reject RSS hash key programming without RX indirection table - !20789 gic: Add hip09 support for HISILICON_ERRATUM_165010801 - !20726 tracing: Add recursion protection in kernel stack trace recording - !20668 irqchip/gic-v3-its: Avoid truncating memory addresses - !20795 ub: udma: support query and set qos info. - !20791 Migration/urma:optimize performance in live migration. - ub: udma: Support for UE link establishment message. - Migration/urma: optimize performance in live migration. - !20787 ub: cdma: modify the method of assigning values to the structure - !20759 ubcore: hotfix route query for port eid on the same node. - ub: udma: support query and set qos info. - Revert "ub: ubase: Support for RC saved by queue granularity" - ubcore: hotfix route query for port eid on the same node. - !20676 urma: set/get sl - !20765 urma: bugfix of UAF and double free in ubcm - !20778 ub: ubase&unic: Fixes some bugfix in resetting and dfx ability - gic: Add hip09 support for HISILICON_ERRATUM_165010801 - vfio/platform: Add CONFIG_VFIO_HISI05A1 to openeuler_defconfig and turn it on by default - vfio/platform: VFIO support for hisi05a1 devices - ub: cdma: modify the method of assigning values to the structure - urma: set/get sl - ub: ubase: support to query ub dl pkt stats and real-time peak bandwidth - ub: ubase: Support for RC saved by queue granularity - ub: ubase: Traverse mailbox AE events using interrupts and polling. - ub: ubase: Modify ubase ctrlq trace to distinguish between MUE and UE messages - net: unic: The function of dumping himac registers is added. - ub: ubase: Fix MAC is_pfc sync, optimize list ops and code style - ub: ubase: Retain the initial tm qset configuration and restore it - net: unic: Fixed an issue in the bond IP address notification and pause configuration when an exception occurs. - ub: ubase: Add a retransmission function to improve reliability. - net: unic: Increase the readability and reliability of loopback code - net: unic: Synchronize the code modify for ip management and deactivation - net: unic: Increase the readability and reliability of VLAN feature. - net: unic: Added unic DFX log information. - ub: ubase: Add and correct comments for some functions and data structures - net: unic: Notify MAMI when the bond port status changes - ub: ubase: Support for HIMAC reset during ELR reset and Optimize ELR reset - !20768 iommu/ummu-core: Fix separate page table compatibility - !20665 [OLK-6.6] Enhance CMA memory usage reporting for CSV3 - !20764 net: hns3: fix double free issue for tx spare buffer - urma: bugfix of UAF and double free in ubcm - iommu/ummu-core: Fix separate page table compatibility - net: hns3: fix double free issue for tx spare buffer - drivers/ub/sentry: fix memory leak in sentry_msg_helper - drivers/ub/sentry: initialize some variables - drivers/ub/sentry: fix potential buffer overflow in convert_str_to_smh_msg() - drivers/ub/sentry: fix potential null pointer reference in sentry_uvb_comm - drivers/ub/sentry: add input parameter verification for exported symbols - tracing: Add recursion protection in kernel stack trace recording - x86/csv: Enhance CMA memory usage reporting for CSV3 - irqchip/gic-v3-its: Avoid truncating memory addresses - change the package name of 64KB page size kernel to kernel-64k - !20704 kernel support hisi-cca-da - !20180 [virtCCA Live Migration 2]virtcca secure cvm supports live migration - !20905 v2 KVM: arm64: Fix softirq masking in FPSIMD register saving sequence - !20965 iommu/ummu: Optimized TID invalidation and tdev initialization - !20964 iommu/ummu: Support TID and EID Granularity for MPAM - !20970 ub: ubase&unic: Supporting the black box capability of the ubase&unic driver - hisi-cca-da: Start dev by rsi call - hisi-cca-da: Set ripas of the bar region as RIPAS_DEV - hisi-cca-da: Support swiotlb and realm memory use - hisi-cca-da: Add smmu info when dev attach - hisi-cca-da: Transfer realm msix access to rmm - hisi-cca-da: Support pcipc sriov capability - hisi-cca-da: Delay realm memory release to kvm_destroy_realm - hisi-cca-da: Create realm s2 host pgtable and map msi mmio to rmm - hisi-cca-da: Add cca realm s2 pgtable framework - hisi-cca-da: Use bitmap to determine whether the command can be forwarded - hisi-cca-da: Restrict Realm SMMU to stage-2 domain only - hisi-cca-da: Add cmd forward mechanism in realm smmu - hisi-cca-da: Add realm smmu event and gerror irq initialization - hisi-cca-da: Add realm smmu stream table initialization - hisi-cca-da: Add realm smmu cmdq and evtq initialization - hisi-cca-da: Add realm smmu initialization - hisi-cca-da: Add relam iommu support to iommufd - hisi-cca-da: Add realm iommu support for vfio-iommu-type1 - hisi-cca-da: Support dev map and unmap - hisi-cca-da: Support dev validate and dev start - hisi-cca-da: VFIO support ccada - hisi-cca-da: Support dev delegate and dev attach - hisi-cca-da: Support root dev delegate and dev init - hisi-cca-da: Add hisilicon extension smc and ccada cmd - hisi-cca-da: Add hisi ccada feature config - !20751 ARM CCA supports hugepage - !20944 ub: ubmempfd: supports for D2H mapping and demapping - !20888 HiSock Enhancement - ub: ubase&unic: Supporting the black box capability of the ubase&unic driver. - net: unic: Resolve the residual MAC address problem - net: unic: Optimized the code for the cmd structure and FEC function. - ub: ubase: add log for post mailbox timeout - ub: ubus: Remove black box header file to include dir - rme: Remove the secret bit of the vring desc addr - rme: improve hisi-cca data mmap and destroy method - !20943 uvb: fix wd_obtain logic err - !20942 urma: fix bond device id not release - !20892 dcache: Limit the minimal number of bucket to two - rme: isolate page when do delegation to avoid migration - rme: hisi-cca supports different levels for mapping ram - rme: rename ccal to hisi-cca - rme: support set ripas for ccal realm vm - rme: support destroy ram data for ccal realm vm - rme: support populate region for ccal realm vm - rme: support map ram for ccal realm vm - rme: support config ccal realm vm - rme: support ccal RMI calls - rme: realm vm supports wfx handler - !20952 urma: introduce ipourma module - iommu/ummu-core: Simplifies tdev initialization resources - iommu/ummu: Optimized log printing - iommu/ummu: Use passed gfp_mask in map_pages callback - uvb: fix wd_obtain logic err - !20949 ub: udma: support user ctl function. - urma: fix bond device id not release - !20901 drivers/ub/sentry: some bugfix - ub: ubmempfd: supports for D2H mapping and demapping - ub: ubmempfd: supports providing services to the QEMU process through file nodes - [virtCCA Live Migration 2]virtcca secure cvm supports live migration - urma: query priority and enable bit, support ring size configuration - urma: implement debugfs, improve boundary checks and error handling logic - urma: implement data plane interaction and statistics - urma: implement ipourma network device operations - urma: ipourma resource management - urma: ipourma resource management and err code - urma: introduce ipourma main module - iommu/ummu: Optimized the TID invalidation configuration - iommu/ummu: Optimized SVA permission table memory allocation approach - iommu/ummu: Adapt UMMU SVA interface adjustment - iommu/ummu: Support TID and EID Granularity for MPAM - !20848 [OLK-6.6] backport important bugfix for nvme driver from upstream linux-6.6.y - !20847 urma: sl resource query error - !20908 [OLK-6.6][linux-6.6.y sync] Backport 6.6.108-6.6.110 LTS Patches - !20084 Loongarch: Enable CONFIG_CRYPTO_XTS for disk encryption - !20929 PCI: Fix NVMe link speed downgrade to 2.5GT/s during hotplug - drivers/ub/sentry: fix check input parameters - ub: udma: support user ctl function. - ub: udma: support uboe function. - ub: udma: bugfix related to query aux info. - !20935 ub: ubmem_vmmu: supports IOMMU driver for the UB memory MMU in VMs - drivers/ub/sentry: do not use magic numbers - !20876 urma: Kernel-mode specific implementations file for Jetty extension interface - urma: sl resource query error - !20873 sunrpc: fix NULL pointer dereference in rpcb_register_inet6 and rpcb_register_inet4 - !20875 sunrpc: fix race in cache cleanup causing stale nextcheck time - ub: ubmem_vmmu: supports IOMMU driver for the UB memory MMU in VMs - ub: ubmem_vmmu: supports parsing and configuring the hardware node information - ub: ubmem_vmmu: HiSilicon ubmem_vmmu Architecture Implementation - !20806 Fix CVE-2025-71225 - !20896 scsi: qla2xxx: Free sp in error path to fix system crash - !20894 scsi: qla2xxx: Delay module unload while fabric scan in progress - !20893 scsi: qla2xxx: Validate sp before freeing associated memory - !20802 Fix CVE-2026-23110 - urma: Kernel-mode specific implementations file for Jetty extension interface - drivers/ub/sentry: fix memory leak in process_urma_data() - drivers/ub/sentry: initialize some variables - PCI: Fix NVMe link speed downgrade to 2.5GT/s during hotplug - !20770 ub: ubdevshm: supports the memory user to obtain and release shared memory - Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 - mm: consider non-anon swap cache folios in folio_expected_ref_count() - mm: simplify folio_expected_ref_count() - ASoC: qcom: audioreach: fix potential null pointer dereference - gcc-plugins: Remove TODO_verify_il for GCC >= 16 - crypto: sha256 - fix crash at kexec - drm/i915/backlight: Return immediately when scale() finds invalid parameters - minmax.h: remove some #defines that are only expanded once - minmax.h: simplify the variants of clamp() - minmax.h: move all the clamp() definitions after the min/max() ones - minmax.h: use BUILD_BUG_ON_MSG() for the lo < hi test in clamp() - minmax.h: reduce the #define expansion of min(), max() and clamp() - minmax.h: update some comments - minmax.h: add whitespace around operators and after commas - minmax: fix up min3() and max3() too - minmax: improve macro expansion and type checking - minmax: don't use max() in situations that want a C constant expression - minmax: simplify min()/max()/clamp() implementation - minmax: make generic MIN() and MAX() macros available everywhere - drm/ast: Use msleep instead of mdelay for edid read - gpiolib: Extend software-node support to support secondary software-nodes - ARM: bcm: Select ARM_GIC_V3 for ARCH_BRCMSTB - s390/cpum_cf: Fix uninitialized warning after backport of ce971233242b - kmsan: fix out-of-bounds access to shadow memory - afs: Fix potential null pointer dereference in afs_put_server - ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address - i40e: improve VF MAC filters accounting - i40e: add mask to apply valid bits for itr_idx - HID: asus: add support for missing PX series fn keys - drm/gma500: Fix null dereference in hdmi teardown - octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() - net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port - net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() - net: dsa: lantiq_gswip: do also enable or disable cpu port - selftests: fib_nexthops: Fix creation of non-FDB nexthops - net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS - bnxt_en: correct offset handling for IPv6 destination address - vhost: Take a reference on the task in struct vhost_task. - Bluetooth: hci_sync: Fix hci_resume_advertising_sync - ethernet: rvu-af: Remove slash from the driver name - can: peak_usb: fix shift-out-of-bounds issue - can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow - can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow - can: hi311x: populate ndo_change_mtu() to prevent buffer overflow - can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow - bpf: Reject bpf_timer for PREEMPT_RT - can: rcar_can: rcar_can_resume(): fix s2ram with PSCI - wifi: virt_wifi: Fix page fault on connect - cpufreq: Initialize cpufreq-based invariance before subsys - ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients - arm64: dts: imx8mp: Correct thermal sensor index - mm: folio_may_be_lru_cached() unless folio_test_large() - mm/gup: local lru_add_drain() to avoid lru_add_drain_all() - mm/gup: check ref_count instead of lru before migration - mm: add folio_expected_ref_count() for reference count calculation - mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked" - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions - ALSA: usb-audio: Add mute TLV for playback volumes on more devices - ALSA: usb-audio: move mixer_quirks' min_mute into common quirk - ALSA: usb-audio: Add DSD support for Comtrue USB Audio device - i2c: designware: Add quirk for Intel Xe - mmc: sdhci-cadence: add Mobileye eyeQ support - usb: core: Add 0x prefix to quirks debug output - ALSA: usb-audio: Fix build with CONFIG_INPUT=n - ALSA: usb-audio: Convert comma to semicolon - ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 - ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks - ALSA: usb-audio: Simplify NULL comparison in mixer_quirks - ALSA: usb-audio: Avoid multiple assignments in mixer_quirks - ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks - ALSA: usb-audio: Fix block comments in mixer_quirks - firewire: core: fix overlooked update of subsystem ABI version - scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE - !20843 [OLK-6.6][linux-6.6.y sync] Backport 6.6.107-6.6.108 LTS Patches - !20869 ub:hisi-ubus: fix bug of security smatch - !20861 CVE-2026-23163 - ub: ubdevshm: supports the memory user to obtain and release shared memory - ub: ubdevshm: supports granting and revoking shared memory permissions - ub: ubdevshm: supports the registration and deregistration of shared memory segments - ub: ubdevshm: supports the registration and deregistration - KVM: arm64: Fix softirq masking in FPSIMD register saving sequence - !20886 Fix CVE-2026-23205 - !20803 Fix CVE-2026-23112 - !20868 sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure - !20811 smb/server: fix refcount leak in smb2_open() - !20810 smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() - !20809 smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() - sunrpc: fix NULL pointer dereference in rpcb_register_inet6 and rpcb_register_inet4 - sunrpc: fix race in cache cleanup causing stale nextcheck time - scsi: qla2xxx: Free sp in error path to fix system crash - scsi: qla2xxx: Delay module unload while fabric scan in progress - scsi: qla2xxx: Validate sp before freeing associated memory - dcache: Limit the minimal number of bucket to two - !20872 Fix CVE-2026-23220 - !20846 Fix CVE-2026-23193 - !20815 Fix CVE-2026-23216 - !20859 Fix CVE-2026-23179 - !20871 CVE-2026-23096 - !20858 ub: ubase: resolve the cmdq crq overflow problem - bpf: Deprecate hisock unused kfuncs and orig ingress logic - bpf: Add local connect support for hisock - bpf: Add ipv4-mapped ipv6 addr support for hisock - bpf: Add target comm parse to hisock_cmd - bpf: Add multi port parse to hisock_cmd - bpf: Only deploy hisock in server - bpf: Apply BPF_HISOCK_INGRESS to hisock ingress - bpf: Add bpf_handle_ingress/egress_ptype kfunc - bpf: Add bpf_get_skb_ethhdr kfunc - bpf: Add bpf_set_ingress/egress_dev kfunc - bpf: Add bpf_set_ingress_dst kfunc - bpf: Add BPF_HISOCK_INGRESS attach type - cgroup: make cgroup_bpf_prog_attach work when cgroup2 is not mounted - smb: client: fix potential UAF and double free in smb2_open_file() - smb/client: fix memory leak in smb2_open_file() - !20852 ASoC: amd: fix memory leak in acp3x pdm dma ops - ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths - uacce: fix cdev handling in the cleanup path - Revert "uacce: fix for cdev memory leak" - ub:hisi-ubus: fix bug of security smatch - ub:ubus: injected route event - ub:ubus: Black Box Development - !20865 urma: urma support uboe - sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure - urma: urma support uboe - !20857 ub_fwctl driver adds support for querying some functions - ub:ub_fwctl:Add illegal verification for scc - ub:ub_fwctl:Support querying the historical status of port links - drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove - drm/amdkfd: Don't use sw fault filter if retry cam enabled - ub:ub_fwctl:Support querying firmware version numbers - ub: ub_fwctl: Support querying real-time bandwidth statistics - ub:ub_fwctl:Support querying statistical indicators at the ub port and uboe port levels - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() - !20854 [URMA] add ping server for urma_ping - urma: add ping server - ub: ubase: resolve the cmdq crq overflow problem - ub: ubase: Optimized the QoS code naming to improve code readability. - ub: ubase&unic: optimizing code and configuration settings. - net: unic: not support query and configure ip by control plane in UBoE - net: unic: fix the automatically enable uc guid promisc mode. - !20844 urma:kernel header of userctl - urma: Kernel-mode header file for Jetty extension interface - ASoC: amd: fix memory leak in acp3x pdm dma ops - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() - phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again) - ACPICA: Work around bogus -Wstringop-overread warning since GCC 11 - !20835 Fix CVE-2026-23084 - minmax: add a few more MIN_T/MAX_T users - minmax: simplify and clarify min_t()/max_t() implementation - minmax: avoid overly complicated constant expressions in VM code - rtc: pcf2127: fix SPI command byte for PCF2131 backport - xhci: dbc: Fix full DbC transfer ring after several reconnects - xhci: dbc: decouple endpoint allocation from initialization - phy: ti: omap-usb2: fix device leak at unbind - phy: Use device_get_match_data() - drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path - ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message - ASoC: wm8974: Correct PLL rate rounding - ASoC: wm8940: Correct typo in control name - ASoC: wm8940: Correct PLL rate rounding - io_uring: include dying ring in task_work "should cancel" state - io_uring: backport io_should_terminate_tw() - ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx - selftests: mptcp: avoid spurious errors on TCP disconnect - selftests: mptcp: connect: catch IO errors on listen side - rds: ib: Increment i_fastreg_wrs before bailing out - KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active - mmc: mvsdio: Fix dma_unmap_sg() nents value - ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S - ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface - btrfs: tree-checker: fix the incorrect inode ref size check - iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page() - LoongArch: Check the return value when creating kobj - LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled - LoongArch: Update help info of ARCH_STRICT_ALIGN - nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* - octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() - net: liquidio: fix overflow in octeon_init_instr_queue() - bonding: don't set oif to bond dev when getting NS target destination - net/mlx5e: Consider aggregated port speed during rate configuration - i40e: remove redundant memory barrier when cleaning Tx descs - net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure - selftests: mptcp: sockopt: fix error messages - mptcp: tfo: record 'deny join id0' info - mptcp: set remote_deny_join_id0 on SYN recv - dpaa2-switch: fix buffer pool seeding for control traffic - btrfs: fix invalid extref key setup when replaying dentry - pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch - wifi: mac80211: fix incorrect type for ret - wifi: mac80211: increase scan_ies_len for S1G - ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported - !20769 [OLK-6.6][linux-6.6.y sync] Backport 6.6.106-6.6.107 LTS Patches - be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list - !20776 ub:ubfi: Release the chosen node - !20817 CVE-2026-23094 - !20819 dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() - ub:ubus: Add port num check - !20379 [OLK-6.6][sync from OLK-5.10]io_uring: Support forcing sq thread to be idle and woken up by hrtimer - !20830 sched/soft_domain: Increasing NR_MAX_CLUSTER to 32 - sched/soft_domain: Increasing NR_MAX_CLUSTER to 32 - btrfs: fix incorrect readahead expansion length - x86: disable image size check for test builds - drm/i915/power: fix size for for_each_set_bit() in abox iteration - drm/amdgpu: fix a memory leak in fence cleanup when unloading - net: mdiobus: release reset_gpio in mdiobus_unregister_device() - phy: ti-pipe3: fix device leak at unbind - phy: tegra: xusb: fix device and OF node leak at probe - dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate - usb: gadget: midi2: Fix MIDI2 IN EP max packet size - usb: gadget: midi2: Fix missing UMP group attributes initialization - USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels - RISC-V: Remove unnecessary include from compat.h - hrtimer: Rename __hrtimer_hres_active() to hrtimer_hres_active() - hrtimer: Remove unused function - regulator: sy7636a: fix lifecycle of power good gpio - dmaengine: ti: edma: Fix memory allocation size for queue_priority_map - hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr - hsr: use rtnl lock when iterating over ports - net: hsr: Add VLAN CTAG filter support - net: hsr: Add support for MC filtering at the slave device - can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB - can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails - can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed - igb: fix link test skipping when interface is admin down - docs: networking: can: change bcm_msg_head frames member to support flexible array - tunnels: reset the GSO metadata before reusing the skb - net: bridge: Bounce invalid boolopts - net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() - USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions - USB: serial: option: add Telit Cinterion FN990A w/audio compositions - dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks - serial: sc16is7xx: fix bug in flow control levels init - tty: hvc_console: Call hvc_kick in hvc_write unconditionally - Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups" - Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table - Input: iqs7222 - avoid enabling unused interrupts - mm/khugepaged: fix the address passed to notifier on testing young - btrfs: fix corruption reading compressed range when block size is smaller than page size - btrfs: use readahead_expand() on compressed extents - mm/damon/sysfs: fix use-after-free in state_show() - mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing - mtd: nand: raw: atmel: Fix comment in timings preparation - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages - drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time - mm/damon/core: set quota->charged_from to jiffies at first charge window - fuse: prevent overflow in copy_file_range return value - fuse: check if copy_file_range() returns larger than requested size - mtd: rawnand: stm32_fmc2: fix ECC overwrite - mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer - net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups - i2c: i801: Hide Intel Birch Stream SoC TCO WDT - ocfs2: fix recursive semaphore deadlock in fiemap call - mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN - compiler-clang.h: define __SANITIZE_*__ macros only when undefined - EDAC/altera: Delete an inappropriate dma_free_coherent() call - rcu-tasks: Maintain real-time response in rcu_tasks_postscan() - rcu-tasks: Eliminate deadlocks involving do_exit() and RCU tasks - rcu-tasks: Maintain lists to eliminate RCU-tasks/do_exit() deadlocks - s390/cpum_cf: Deny all sampling events by counter PMU - NFSv4/flexfiles: Fix layout merge mirror check. - NFSv4.2: Serialise O_DIRECT i/o and copy range - NFSv4.2: Serialise O_DIRECT i/o and clone range - NFSv4.2: Serialise O_DIRECT i/o and fallocate() - NFS: Serialise O_DIRECT i/o and truncate() - fs/nfs/io: make nfs_start_io_*() killable - ftrace/samples: Fix function size computation - NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server - NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set - media: i2c: imx214: Fix link frequency validation - NFSD: nfsd_unlink() clobbers non-zero status returned from fh_fill_pre_attrs() - nfsd: Fix a regression in nfsd_setattr() - kasan: fix GCC mem-intrinsic prefix with sw tags - kunit: kasan_test: disable fortify string checker on kasan_strings() test - io_uring: fix kabi broken in struct io_ring_ctx - io_uring: Support forcing sq thread to be idle and woken up by hrtimer - dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() - uacce: fix isolate sysfs check condition - Revert "uacce: fix isolate sysfs check condition" - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() - smb/server: fix refcount leak in smb2_open() - smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() - smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() - md: suspend array while updating raid_disks via sysfs - scsi: core: Wake up the error handler when final completions race against each other - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec - ub:ubfi: Release the chosen node - ub:ubus: Delete unused functions - Loongarch: Enable CONFIG_CRYPTO_XTS for disk encryption - Add sw64 support in kernel.spec - !21194 hisi-cca-da: Revert smmu realm enabled condition for arm_smmu_domain_finalise. - !21192 urma: bugfix of ubagg&ubcore&uburma - !21183 platform/x86: classmate-laptop: Add missing NULL pointer checks - urma: bugfix of ubagg&ubcore&uburma - hisi-cca-da: Revert smmu realm enabled condition for arm_smmu_domain_finalise. - platform/x86: classmate-laptop: Add missing NULL pointer checks - !21167 urma: fix kernel codecheck issues. - !21174 urma: change return value for provider err - !21127 urma: copy linked ports when importing bond jetty/seg - !20247 ubcore: query primary eid in ipourma loopback mode. - !21077 Fix hisi cca bugs - ubcore: route query refine and ipo loopback adapt. - hisi-cca-da: Transfer PCIe ECAM access requests to RMM for realm device. - hisi-cca-da: Write NS STE for PF drivers. - hisi-cca-da: Provide IO interfaces - hisi-cca-da: Destroy mmu stage2 pagetable after closing vfio devices - !21045 scsi: hisi_sas: Fix NULL pointer exception when do user_scan() - hisi-cca-da: Automatically unbind PF/VF drivers and prevent probe. - !21165 tools/interference: add ifstool utility for kernel interference statistics - !21166 urma: fix jfce uaf in batch cleanup - !21043 urma: fix tjetty ref in ping server - urma: change return value for provider err - !21128 sched/rt: Skip currently executing CPU in rto_next_cpu() - !21129 procfs: fix missing RCU protection when reading real_parent in do_task_stat() - urma: fix jfce uaf in batch cleanup - !21074 ipmi: Add HiSilicon IPMI Page Soft Offline driver - !21076 [OLK-6.6][linux-6.6.y sync] Backport 6.6.112-6.6.113 LTS Patches - urma: fix kernel codecheck issues. - tools/interference: add ifstool utility for kernel interference statistics - !20291 [Hygon][6.6][Bugfix] Bug fix for EDAC decode address fail issue on Hygon Dhyana processor - !21092 kexec: derive purgatory entry from symbol - !21154 sched: Add SOFT_DOMAIN feature interface for cgroup2 - !21153 fix CVE-2025-39981 - Revert "hisi-cca-da: Delay realm memory release to kvm_destroy_realm" - urma: fix tjetty ref in ping server - rme: Enforce isolation to solve compile error without config CONFIG_HISI_CCA - hisi-cca-da: Improve hisi cca dev validate and delegate - hisi-cca-da: Fix smmu enable rme problem - hisi-cca-da: Fix msi region shared problem - sched: Add SOFT_DOMAIN feature interface for cgroup2 - Bluetooth: MGMT: Fix memory leak in set_ssp_complete - Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete - overflow: Introduce __DEFINE_FLEX for having no initializer - overflow: Fix direct struct member initialization in _DEFINE_FLEX() - overflow: Change DEFINE_FLEX to take __counted_by member - overflow: add DEFINE_FLEX() for on-stack allocs - Bluetooth: MGMT: Fix possible UAFs - Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete() - !21103 Revert "mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()" - !21104 v2 vsock/virtio: cap TX credit to local buffer size - !21070 Fixes CVE-2026-23100 - !21135 RDMA/hns: Support configure and query the CNP DSCP through sysfs - !21088 ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref - RDMA/hns: Support configure and query the CNP DSCP through sysfs - RDMA/hns: Support query FW cap bit - RDMA/hns: Support query HW ID. - !20934 smb/server: fix refcount leak in parse_durable_handle_context() - !21004 regmap: Fix race condition in hwspinlock irqsave routine - !19568 [OLK-6.6]fix txgbe clang compile warning - urma: copy linked ports when importing bond jetty/seg - procfs: fix missing RCU protection when reading real_parent in do_task_stat() - sched/rt: Skip currently executing CPU in rto_next_cpu() - !21073 scsi: qla2xxx: Fix bsg_done() causing double free - !21114 CVE-2024-57979 - !21113 iommu: disable SVA when CONFIG_X86 is set - !20957 dmaengine: xilinx: xdma: Fix regmap max_register - !21087 net: unic: Multiple stability fixes for tx timeout, DFX capability and concurrent activation/reset - pps: Fix a use-after-free - fix kabi - pps: Fix a use-after-free - !21078 of: unittest: Fix memory leak in unittest_data_add() - !21079 *** fix CVE-2026-23208 *** - !21082 ALSA: aloop: Fix racy access at PCM trigger - !21083 bus: fsl-mc: fix use-after-free in driver_override_show() - iommu: disable SVA when CONFIG_X86 is set - vsock/virtio: cap TX credit to local buffer size - Revert "mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()" - !20983 Fix CVE-2026-23139 - !20878 Fix CVE-2026-23230 - kexec: derive purgatory entry from symbol - lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC - PCI/IOV: Fix race between SR-IOV enable/disable and hotplug - Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" - rtc: interface: Alarm race handling should not discard preceding error - perf test stat tests: Fix for virtualized machines - perf test stat: Update test expectations and events - perf test stat: Avoid hybrid assumption when virtualized - writeback: Avoid excessively long inode switching times - writeback: Avoid softlockup when switching many inodes - cramfs: Verify inode mode when loading from disk - fs: Add 'initramfs_options' to set initramfs mount options - minixfs: Verify inode mode when loading from disk - irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume - irqchip/sifive-plic: Make use of __assign_bit() - selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled - s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG - s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL - s390/bpf: Describe the frame using a struct instead of constants - s390/bpf: Centralize frame offset calculations - s390/bpf: Change seen_reg to a mask - ACPI: property: Do not pass NULL handles to acpi_attach_data() - ACPI: property: Add code comments explaining what is going on - ACPI: property: Disregard references in data-only subnode lists - ACPI: battery: Add synchronization between interface updates - ACPI: battery: Check for error code from devm_mutex_init() call - ACPI: battery: initialize mutexes through devm_ APIs - ACPI: battery: allocate driver data through devm_ APIs - arm64: mte: Do not flag the zero page as PG_mte_tagged - ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref - !20790 dm: use bio_clone_blkg_association - ipmi: Add HiSilicon IPMI Page Soft Offline driver - net: unic: Resolve network unavailability caused by concurrent activation and reset - net: unic: Provide the DFX capability for querying MNG table - net: unic: Delete the elr reset process after the tx timeout - bus: fsl-mc: fix use-after-free in driver_override_show() - ALSA: aloop: Fix racy access at PCM trigger - ALSA: usb-audio: Use the right limit for PCM OOB check - ALSA: usb-audio: Prevent excessive number of frames - of: unittest: Fix memory leak in unittest_data_add() - !21034 CVE-2026-23140 - !21016 net: fix segmentation of forwarding fraglist GRO - !21017 mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() - !21018 CVE-2026-23209 - !21019 ipv6: annotate data-race in ndisc_router_discovery() - !20881 ipvlan: Make the addrs_lock be per port - rme: Imporve range delegate - btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() - PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release - PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() - misc: fastrpc: Save actual DMA size in fastrpc_map structure - misc: fastrpc: Add missing dev_err newlines - mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag - mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type - mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value - media: mc: Clear minor number before put device - lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older - ACPICA: Allow to skip Global Lock initialization - ext4: validate ea_ino and size in check_xattrs - ext4: correctly handle queries for metadata mappings - ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() - nfsd: nfserr_jukebox in nlm_fopen should lead to a retry - NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() - mm/damon/vaddr: do not repeat pte_offset_map_lock() until success - mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 - mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations - wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 - wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again - selftests: mptcp: join: validate C-flag + def limit - spi: cadence-quadspi: Flush posted register writes before DAC access - spi: cadence-quadspi: Flush posted register writes before INDAC access - PCI: tegra194: Handle errors in BPMP response - PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() - PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock - PCI: rcar-host: Drop PMSR spinlock - PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit - PCI/AER: Support errors introduced by PCIe r6.0 - PCI/AER: Fix missing uevent on recovery when a reset is requested - PCI/ERR: Fix uevent on failure to recover - PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV - PCI/sysfs: Ensure devices are powered for config reads - PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock - rseq/selftests: Use weak symbol reference, not definition, to link with glibc - rtc: interface: Fix long-standing race when setting alarm - rtc: interface: Ensure alarm irq is enabled when UIE is enabled - memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe - mmc: core: SPI mode remove cmd7 - mtd: rawnand: fsmc: Default to autodetect buswidth - xtensa: simdisk: add input size check in proc_write_simdisk - sparc: fix error handling in scan_one_device() - sparc64: fix hugetlb for sun4u - scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() - sched/deadline: Fix race in push_dl_task() - pwm: berlin: Fix wrong register in suspend/resume - powerpc/pseries/msi: Fix potential underflow and leak issue - powerpc/powernv/pci: Fix underflow and leak issue - power: supply: max77976_charger: fix constant current reporting - pinctrl: samsung: Drop unused S3C24xx driver data - nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk - parisc: don't reference obsolete termio struct for TC* constants - openat2: don't trigger automounts with RESOLVE_NO_XDEV - of: unittest: Fix device reference count leak in of_unittest_pci_node_verify - lib/genalloc: fix device leak in of_gen_pool_get() - KEYS: trusted_tpm1: Compare HMAC values in constant time - iommu/vt-d: PRS isn't usable if PDS isn't supported - iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume - init: handle bootloader identifier in kernel parameters - iio: xilinx-ams: Unmask interrupts after updating alarms - iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK - iio: frequency: adf4350: Fix prescaler usage. - iio: dac: ad5421: use int type to store negative error codes - iio: dac: ad5360: use int type to store negative error codes - fs/ntfs3: Fix a resource leak bug in wnd_extend() - fbdev: Fix logic error in "offb" name match - crypto: rockchip - Fix dma_unmap_sg() nents value - crypto: atmel - Fix dma_unmap_sg() direction - crypto: aspeed - Fix dma_unmap_sg() direction - copy_sighand: Handle architectures where sizeof(unsigned long) < sizeof(u64) - bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() - bus: mhi: ep: Fix chained transfer handling in read path - btrfs: avoid potential out-of-bounds in btrfs_encode_fh() - blk-crypto: fix missing blktrace bio split events - drm/nouveau: fix bad ret code in nouveau_bo_move_prep - drm/rcar-du: dsi: Fix 1/2/3 lane support - media: lirc: Fix error handling in lirc_register() - media: venus: firmware: Use correct reset sequence for IRIS2 - media: pci: ivtv: Add missing check after DMA map - media: mc: Fix MUST_CONNECT handling for pads with no links - media: i2c: mt9v111: fix incorrect type for ret - media: cx18: Add missing check after DMA map - firmware: meson_sm: fix device leak at probe - xen/events: Update virq_to_irq on migration - xen/events: Return -EEXIST for bound VIRQs - xen/manage: Fix suspend error path - xen/events: Cleanup find_virq() return codes - dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required - ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init - arm64: dts: ti: k3-am62a-main: Fix main padcfg length - arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees - arm64: dts: qcom: msm8939: Add missing MDSS reset - arm64: dts: qcom: msm8916: Add missing MDSS reset - ACPI: debug: fix signedness issues in read/write helpers - ACPI: property: Fix buffer properties extraction for subnodes - gpio: wcd934x: mark the GPIO controller as sleeping - tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single - smb: client: fix missing timestamp updates after utime(2) - bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() - drm/amd/display: Properly disable scaling on DCE6 - drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 - drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs - drm/amdgpu: Add additional DCE6 SCL registers - mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes - mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call - tcp: take care of zero tp->window_clamp in tcp_set_rcvlowat() - perf python: split Clang options when invoking Popen - tools build: Align warning options with perf - net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe - drm/vmwgfx: Fix copy-paste typo in validation - net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() - LoongArch: Init acpi_gbl_use_global_lock to false - LoongArch: Remove CONFIG_ACPI_TABLE_UPGRADE in platform_init() - ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size - scsi: mvsas: Fix use-after-free bugs in mvs_work_queue - clk: tegra: do not overallocate memory for bpmp clocks - clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver - clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() - clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() - clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m - perf evsel: Ensure the fallback message is always written to - perf tools: Add fallback for exclude_guest - perf test: Add a test for default perf stat command - perf test: Don't leak workload gopipe in PERF_RECORD_* - perf session: Fix handling when buffer exceeds 2 GiB - perf arm_spe: Correct memory level for remote access - perf arm_spe: Correct setting remote access - rtc: optee: fix memory leak on driver removal - rtc: x1205: Fix Xicor X1205 vendor prefix - perf util: Fix compression checks returning -1 as bool - clk: at91: peripheral: fix return value - libperf event: Ensure tracing data is multiple of 8 sized - perf evsel: Avoid container_of on a NULL leader - asm-generic/io.h: Skip trace helpers if rwmmio events are disabled - iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE - clocksource/drivers/clps711x: Fix resource leaks in error paths - fscontext: do not consume log entries when returning -EMSGSIZE - fs: always return zero on success from replace_fd() - !21067 [OLK-6.6][linux-6.6.y sync] Backport 6.6.111-6.6.112 LTS Patches - scsi: qla2xxx: Fix bsg_done() causing double free - !21065 Fix CVE-2026-23069 - !21062 v4 Support multi-level cgroup - !20987 Fix CVE-2026-23212 - !20982 Fix CVE-2026-23119 - !20979 Fix CVE-2026-23111 - !20974 Fix CVE-2026-23099 - !20973 Fix CVE-2026-23105 - !20972 Fix CVE-2026-23074 - !20884 ksmbd: add chann_lock to protect ksmbd_chann_list xarray - !20947 Fix CVE-2026-23101 - ext4: clear i_state_flags when alloc inode - misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup - Revert "wifi: ath10k: avoid unnecessary wait for service ready message" - fs/ntfs3: fix mount failure for sparse runs in run_unpack() - !20825 efivarfs: fix error propagation in efivar_entry_get() - !20824 io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop - !20950 ub:ubus: protect iterator ue_list and mue_list with ub_bus_sem - mm/rmap: fix two comments related to huge_pmd_unshare() - mm/hugetlb: fix two comments related to huge_pmd_unshare() - mm/hugetlb: fix hugetlb_pmd_shared() - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count - !20728 drivers: Update vendor name of Chengdu NorthLink Technology N5/N6 Series Network Card Drivers - vsock/virtio: fix potential underflow in virtio_transport_get_credit() - !21001 Fix CVE-2026-23229 - usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call - arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode - !20999 Fix CVE-2026-23173 - usb: typec: tipd: Clear interrupts first - bus: fsl-mc: Check return value of platform_get_resource() - remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() - Input: atmel_mxt_ts - allow reset GPIO to sleep - misc: fastrpc: Skip reference for DMA handles - misc: fastrpc: fix possible map leak in fastrpc_put_args - misc: fastrpc: Fix fastrpc_map_lookup operation - nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() - ext4: fix checks for orphan inodes - ksmbd: fix error code overwriting in smb2_get_info_filesystem() - LoongArch: Automatically disable kaslr if boot from kexec_file - mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() - mfd: rz-mtu3: Fix MTU5 NFCR register offset - ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down - ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() - vhost: vringh: Modify the return value check - net/mlx5: fw reset, add reset timeout work - net/mlx5: pagealloc: Fix reclaim race during command interface teardown - net/mlx5: Stop polling for command response if interface goes down - net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable - nfp: fix RSS hash key size when RSS is not supported - mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands - drivers/base/node: fix double free in register_one_node() - hwrng: ks-sa - fix division by zero in ks_sa_rng_init - KEYS: X.509: Fix Basic Constraints CA flag parsing - Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements - Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO - vhost: vringh: Fix copy_to_iter return value check - RDMA/siw: Always report immediate post SQ errors - usb: vhci-hcd: Prevent suspending virtually attached devices - NFSv4.1: fix backchannel max_resp_sz verification check - coresight: trbe: Return NULL pointer for allocation failures - coresight: etm4x: Support atclk - coresight-etm4x: Conditionally access register TRCEXTINSELR - remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice - PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() - vfio/pds: replace bitmap_free with vfree - sparc: fix accurate exception reporting in copy_{from,to}_user for M7 - sparc: fix accurate exception reporting in copy_to_user for Niagara 4 - sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara - sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III - wifi: mac80211: fix Rx packet handling when pubsta information is not available - wifi: ath10k: avoid unnecessary wait for service ready message - Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram - IB/sa: Fix sa_local_svc_timeout_ms read race - RDMA/core: Resolve MAC of next-hop device without ARP support - f2fs: fix zero-sized extent for precache extents - scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() - scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() - scsi: qla2xxx: edif: Fix incorrect sign of error code - ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message - f2fs: fix to truncate first page in error path of f2fs_truncate() - f2fs: fix to update map->m_next_extent correctly in f2fs_map_blocks() - wifi: mt76: fix potential memory leak in mt76_wmac_probe() - RDMA/cm: Rate limit destroy CM ID timeout error message - drivers/base/node: handle error properly in register_one_node() - watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog - ipvs: Use READ_ONCE/WRITE_ONCE for ipvs->enable - iio: consumers: Fix offset handling in iio_convert_raw_to_processed() - iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() - fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist - fs: ntfs3: Fix integer overflow in run_unpack() - drm/msm/dpu: fix incorrect type for ret - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping - ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping - misc: genwqe: Fix incorrect cmd field being reported in error - usb: gadget: configfs: Correctly set use_os_string at bind - usb: phy: twl6030: Fix incorrect type for ret - drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() - tcp: fix __tcp_close() to only send RST when required - PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation - wifi: mwifiex: send world regulatory domain to driver - drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) - drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) - drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) - drm/amd/pm: Adjust si_upload_smc_data register programming (v3) - drm/amd/pm: Fix si_upload_smc_data (v3) - drm/amd/pm: Disable ULV even if unsupported (v3) - drm/amdgpu: Power up UVD 3 for FW validation (v2) - coresight: Only register perf symlink for sinks with alloc_buffer - inet: ping: check sock_net() in ping_get_port() and ping_lookup() - media: st-delta: avoid excessive stack usage - ALSA: lx_core: use int type to store negative error codes - media: rj54n1cb0c: Fix memleak in rj54n1_probe() - scsi: myrs: Fix dma_alloc_coherent() error check - hwrng: nomadik - add ARM_AMBA dependency - crypto: keembay - Add missing check after sg_nents_for_len() - drm/amd/display: Remove redundant semicolons - serial: max310x: Add error checking in probe() - usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls - usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup - phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 - media: zoran: Remove zoran_fh structure - drm/bridge: it6505: select REGMAP_I2C - f2fs: fix condition in __allow_reserved_blocks() - drm/radeon/r600_cs: clean up of dead code in r600_cs - drm/panel: novatek-nt35560: Fix invalid return value - bpf: Enforce expected_attach_type for tailcall compatibility - i2c: designware: Add disabling clocks when probe fails - i2c: designware: Fix clock issue when PM is disabled - i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD - thermal/drivers/qcom/lmh: Add missing IRQ includes - thermal/drivers/qcom: Make LMH select QCOM_SCM - hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems - once: fix race by moving DO_ONCE to separate section - smp: Fix up and expand the smp_call_function_many() kerneldoc - selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported - i3c: master: svc: Recycle unused IBI slot - i3c: master: svc: Use manual response for IBI events - ACPICA: Fix largest possible resource descriptor index - pwm: tiehrpwm: Fix corner case in clock divisor calculation - arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible - arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value - arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names - cpuidle: qcom-spm: fix device and OF node leaks at probe - firmware: firmware: meson-sm: fix compile-test default - arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 - null_blk: Fix the description of the cache_size module argument - pinctrl: renesas: Use int type to store negative error codes - power: supply: cw2015: Fix a alignment coding style issue - PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() - ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property - ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS - ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax - block: use int to store blk_stack_limits() return value - selftests/nolibc: fix EXPECT_NZ macro - regulator: scmi: Use int type to store negative error codes - arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map - ARM: at91: pm: fix MCKx restore routine - pinctrl: meson-gxl: add missing i2c_d pinmux - soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS - leds: flash: leds-qcom-flash: Update torch current clamp setting - ARM: dts: renesas: porter: Fix CAN pin group - libbpf: Fix reuse of DEVMAP - bpf: Remove migrate_disable in kprobe_multi_link_prog_run - bpf/selftests: Fix test_tcpnotify_user - regmap: Remove superfluous check for !config in __regmap_init() - arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 - x86/vdso: Fix output operand size of RDPID - smb: server: fix IRD/ORD negotiation with the client - coresight: trbe: Prevent overflow in PERF_IDX2OFF() - gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote - selftests: arm64: Check fread return value in exec_target - seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast - init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD - filelock: add FL_RECLAIM to show_fl_flags() macro - !21022 KVM: Don't clobber irqfd routing type when deassigning irqfd - !20998 ceph: fix oops due to invalid pointer for kfree() in parse_longname() - !21023 l2tp: avoid one data-race in l2tp_tunnel_del_work() - xsched: fix potential NULL dereference in xsched_quota_timeout_update - xsched: remove the standalone xcu_cfs_cg_deinit() helper - xsched: restructure xcu_cgrp_subsys teardown to align with cpu_cgrp_subsys lifecycle - xsched: simplify root group check by direct comparison with root_xcg - xsched: replace magic number with SCHED_CLASS_MAX_LENGTH for scheduler class string length - xsched/core: immediate cleanup of remaining operators on task exit - xsched: add init_fair_xsched_group() for XCU-specific fair group initialization - xsched: modify xcu_cg_initialize_components helper - xsched: refactor xsched_entity initialization - xsched: change rq_init() parameter from struct xsched_cu to struct xsched_rq - xsched: harden and clarify xcu_move_task() logic - xsched: move throttling-related fields from xsched_group_xcu_priv to xsched_rq_cfs - xsched/quota: add throttled flag to cfs_rq for robust hierarchical enqueue under throttling - xsched/quota: support multi-level cgroup - xsched: remove redundant xcu parameter from dequeue_ctx - xsched: update group shares using xcu_grp_shares_add/sub helpers - xsched: delete unused code - xsched/cfs: propagate group activation/deactivation up the hierarchy - xsched/cfs: move xruntime updates to pick/put paths - xsched: add has_running hook to xsched classes for wake-up eligibility check - !21012 [OLK-6.6][linux-6.6.y sync] Backport 6.6.110-6.6.111 LTS Patches - scsi: hisi_sas: Fix NULL pointer exception when do user_scan() - !21013 CVE-2026-23177 - !21007 bonding: fix use-after-free due to enslave fail after slave array update - !21006 net: Fix CVE-2026-23204 - bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path - bpf, test_run: Subtract size of xdp_frame from allowed metadata size - bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN - bpf: Make variables in bpf_prog_test_run_xdp less confusing - bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K - !21015 libceph: reset sparse-read state in osd_fault() - !21024 ub: udma: bugfix related to print messages. - !20980 Fix CVE-2026-23126 - !20922 Fix CVE-2026-23133 - ub: udma: bugfix related to print messages. - l2tp: avoid one data-race in l2tp_tunnel_del_work() - KVM: Don't clobber irqfd routing type when deassigning irqfd - ipv6: annotate data-race in ndisc_router_discovery() - macvlan: observe an RCU grace period in macvlan_common_newlink() error path - macvlan: fix error recovery in macvlan_common_newlink() - mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() - net: fix segmentation of forwarding fraglist GRO - can: rcar_canfd: Fix CAN-FD mode as default - libceph: reset sparse-read state in osd_fault() - !21008 uvb: fix cis call return value and obtain - mm, shmem: prevent infinite loop on truncate race - mm/shmem, swap: fix race of truncate and swap entry split - net/9p: fix double req put in p9_fd_cancelled - riscv: mm: Do not restrict mmap address based on hint - riscv: mm: Use hint address in mmap if available - driver core/PM: Set power.no_callbacks along with power.no_pm - serial: stm32: allow selecting console when the driver is module - hid: fix I2C read buffer overflow in raw_event() for mcp2221 - ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free - ALSA: usb-audio: Kill timer properly at removal - platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list - can: rcar_canfd: Fix controller mode setting - can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled - btrfs: ref-verify: handle damaged extent root tree - ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue - perf subcmd: avoid crash in exclude_cmds when excludes is empty - platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list - dm-integrity: limit MAX_TAG_SIZE to 255 - ASoC: amd: acp: Adjust pdm gain value - wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 - USB: serial: option: add SIMCom 8230C compositions - media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe - !20931 Fix CVE-2026-23060 - uvb: fix cis call return value and obtain - bonding: fix use-after-free due to enslave fail after slave array update - net/sched: cls_u32: use skb_header_pointer_careful() - net: add skb_header_pointer_careful() helper - regmap: Fix race condition in hwspinlock irqsave routine - crypto: virtio - Add spinlock protection with virtqueue notification - net/mlx5e: TC, delete flows only for existing peers - !20967 net: hns3: modify code of judging if SMMU DMA is enabled - ceph: fix oops due to invalid pointer for kfree() in parse_longname() - !20969 Fix CVE-2026-23125 - !20948 v4 arm64: Add memory poison recovery support for various paths - !20975 CVE-2026-23102 - !20977 v4 support apei_page_offline_policy - bonding: annotate data-races around slave->last_rx - netfilter: nf_conncount: update last_gc only when GC has been performed - bonding: provide a net pointer to __skb_flow_dissect() - netdevsim: fix a race issue related to the operation on bpf_bound_progs list - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() - apei/ghes: Add sysctl interface to control soft-offline page isolation - Revert "mm/memory-failure: support disabling soft offline for HugeTLB pages" - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - arm64/fpsimd: signal: Fix restoration of SVE context - arm64/fpsimd: signal: Consistently read FPSIMD context - arm64/fpsimd: signal: Mandate SVE payload for streaming-mode state - bonding: limit BOND_MODE_8023AD to Ethernet devices - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag - net/sched: Enforce that teql can only be used as root qdisc - sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT - drivers/net: Update vendor name of Chengdu NorthLink Technology N5/N6 Series Network Card Drivers - net: hns3: modify code of judging if SMMU DMA is enabled - dmaengine: xilinx: xdma: Fix regmap max_register - ub:ubus: protect iterator ue_list and mue_list with ub_bus_sem - ub:ubus: Avoid getting empty uent from ubc - ub:hisi-ubus: Use GFP_ATOMIC when alloc memory - arm64: send sig fault for user task when apei_claim_sea fails - arm64: add ras log during do_sea - arm64: move getting valid siaddr to the top of do_sea - arm64: mm: shmem: support poison recovery from shmem_file_read_iter() - arm64: fs: support poison recovery from __kernel_read() - iov_iter: add mc support for copy_page_to_iter - arm64: mm: support recovery from copy_{from/to}_user_page() - iov_iter: get rid of 'copy_mc' flag - leds: led-class: Only Add LED to leds_list when it is fully ready - wifi: ath10k: fix dma_free_coherent() pointer - smb/server: fix refcount leak in parse_durable_handle_context() - ksmbd: add chann_lock to protect ksmbd_chann_list xarray - ipvlan: Make the addrs_lock be per port - smb: client: split cached_fid bitfields to avoid shared-byte RMW races - efivarfs: fix error propagation in efivar_entry_get() - io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop - dm: use bio_clone_blkg_association - RAS/AMD/ATL: fix error nodes per socket on for Hygon Dhyana processor - net: txgbe: fix clang compile warning - !20552 ub: udma: fix some code issues. - !20313 Fix CVE-2025-40220 - !20321 nvme: fix admin request_queue lifetime - !20512 PM / devfreq: hisi: Fix potential UAF in OPP handling - !20544 Fix CVE-2025-71147 - !20548 v4 net: LTS-6.6 backport - !20503 Fix CVE-2025-39713 - !20133 Fix CVE-2025-39721 - !20438 Fix CVE-2025-38659 - !20264 Fix CVE-2025-40277 - !20340 Fix CVE-2025-40271 - !20319 Fix CVE-2025-40237 - !20392 vfs: Don't leak disconnected dentries on umount - !20554 iommu/s390: Implement blocking domain - !20489 [OLK-6.6][linux-6.6.y sync] Backport 6.6.101-6.6.102 LTS Patches - !20513 ACPI: PCC: Fix race condition by removing static qualifier - !20468 drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer - !20483 rcu: Protect ->defer_qs_iw_pending from data race - !20510 drivers/ub/sentry: fix primary eid index value - !20553 ub: cdma: support separated page table feature - ub: udma: fix some code issues. - !20480 iommu/ummu-core: fix error invalidate tid - !20561 iommu/ummu: Add ummu sva independent page table parameter - ub: udma: bugfix related to 2m_hugepage. - ub: udma: support for separate page tables - ub: udma: delete debugfs code. - ub: udma: bugfix related to ctrlq function. - ub: udma: verify get cqe/ae aux info out addr and len. - ub: cdma: support separated page table feature - iommu/ummu: Add ummu sva independent page table parameter - iommu: Adjust PLB refresh timing in 'grant' and 'ungrant' - !20505 Fix CVE-2026-23035 - iommu/s390: Implement blocking domain - drivers/ub/sentry: fix primary eid index value - !20535 libceph: make decode_pool() more resilient against corrupted osdmaps - !20536 mm/page_alloc: change all pageblocks migrate type on coalescing - !20537 mm/secretmem: fix use-after-free race in fault handler - !20538 wifi: avoid kernel-infoleak from struct iw_point - !20539 net: usb: rtl8150: fix memory leak on usb_submit_urb() failure - !20440 PCI/AER: Fix NULL pointer access by aer_info - !20262 Fix CVE-2025-68176 - netfilter: nf_reject: don't leak dst refcount for loopback packets - net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error - page_pool: always add GFP_NOWARN for ATOMIC allocations - virtio-net: fix received length check in big packets - net: bridge: fix use-after-free due to MST port state bypass - vsock: Ignore signal/timeout on connect() if already established - tls: make sure to abort the stream if headers are bogus - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI - xfrm: Duplicate SPI Handling - tls: handle data disappearing from under the TLS ULP - net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing - bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls - Bluetooth: hci_core: Fix use-after-free in vhci_flush() - KEYS: trusted: Fix a memory leak in tpm2_load_cmd - !20237 Fix CVE-2025-68724 - !20459 Fix CVE-2025-71131 - !20525 Fix CVE-2025-68816 - !20529 CVE-2025-68172 - net: usb: rtl8150: fix memory leak on usb_submit_urb() failure - !20370 Revert "Revert "RDMA/hns: Fix mismatch exception rollback"" - wifi: avoid kernel-infoleak from struct iw_point - mm/secretmem: fix use-after-free race in fault handler - mm/page_alloc: change all pageblocks migrate type on coalescing - libceph: make decode_pool() more resilient against corrupted osdmaps - pps: Fix kabi breakage of struct pps_device for last_fetched_ev - sched: Fix kabi breakage of struct task_struct for saved_state - crypto: aspeed - fix double free caused by devm - !20515 Bluetooth: bcsp: receive data only if registered - !20507 Fix CVE-2025-40358 - !20450 ub: ubase&unic: Fix some bug in concurrent process - !20452 iommu/ummu: Fix some bugs and optimize the code implementation - !20451 iommu/ummu: Add the function of creating devices with SVA-separated - !20500 mm: fix the inaccurate memory statistics issue for users - net/mlx5: fw_tracer, Validate format string parameters - Bluetooth: bcsp: receive data only if registered - ACPI: PCC: Fix race condition by removing static qualifier - ACPI: CPPC: Fix missing PCC check for guaranteed_perf - iommu/ummu: Add the function of creating devices with SVA-separated - iommu/ummu-core: fix error invalidate tid - riscv: stacktrace: Disable KASAN checks for non-current tasks - !20497 arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() - !20496 drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies - !20495 iommu/amd: Avoid stack buffer overflow from kernel cmdline - !20494 HID: core: Harden s32ton() against conversion to 0 bits - !20493 iommu: Fix two issues in iommu_copy_struct_from_user() - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv - PM / devfreq: hisi: Fix potential UAF in OPP handling - media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() - !20487 interference: Fix uninitialized ifs_clock compiling issue - MIPS: mm: kmalloc tlb_vpn array to avoid stack overflow - MIPS: mm: Prevent a TLB shutdown on initial uniquification - mm: fix the inaccurate memory statistics issue for users - mm: add config option for atomic mode in mm counter - Revert "mm: fix the inaccurate memory statistics issue for users" - !20444 net/mlx5e: Fix crash on profile change rollback failure - !20442 net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv - arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() - drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies - iommu/amd: Avoid stack buffer overflow from kernel cmdline - HID: core: Harden s32ton() against conversion to 0 bits - iommu: Fix two issues in iommu_copy_struct_from_user() - SUNRPC: call xs_sock_process_cmsg for all cmsg - flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read - !20374 [OLK 6.6]Use Hygon IBRS and IBPB rather than software-based mitigation to mitigate Retbleed and SRSO. - !20227 Rename leapioraid to leapraid and release v2.0 - mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery - MIPS: mm: tlb-r4k: Uniquify TLB entries on init - x86/fpu: Delay instruction pointer fixup until after warning - ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx() - ALSA: intel_hdmi: Fix off-by-one error in __hdmi_lpe_audio_probe() - x86/sev: Evict cache lines during SNP memory validation - net: usbnet: Fix the wrong netif_carrier_on() call - net: usbnet: Avoid potential RCU stall on LINK_CHANGE event - Bluetooth: btusb: Add USB ID 3625:010b for TP-LINK Archer TX10UB Nano - sched,freezer: Remove unnecessary warning in __thaw_task - freezer,sched: Clean saved_state when restoring it during thaw - freezer,sched: Do not restore saved_state of a thawed task - freezer,sched: Use saved_state to reduce some spurious wakeups - sched/core: Remove ifdeffery for saved_state - i2c: stm32f7: unmap DMA mapped buffer - i2c: stm32f7: simplify status messages in case of errors - i2c: stm32f7: perform most of irq job in threaded handler - i2c: stm32f7: use dev_err_probe upon calls of devm_request_irq - i2c: stm32f7: Use devm_clk_get_enabled() - USB: serial: option: add Foxconn T99W709 - smb: server: Fix extension string in ksmbd_extract_shortname() - ksmbd: fix corrupted mtime and ctime in smb2_open - ksmbd: fix Preauh_HashValue race condition - ksmbd: fix null pointer dereference error in generate_encryptionkey - vsock: Do not allow binding to VMADDR_PORT_ANY - selftests/perf_events: Add a mmap() correctness test - smb: client: return an error if rdma_connect does not return within 5 seconds - smb: client: let recv_done() cleanup before notifying the callers. - smb: client: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already - smb: client: make use of common smbdirect_socket - smb: smbdirect: add smbdirect_socket.h - smb: client: Correct typos in multiple comments across various files - smb: client: Use min() macro - smb: server: let recv_done() avoid touching data_transfer after cleanup/move - smb: server: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already - ALSA: hda/ca0132: Fix missing error handling in ca0132_alt_select_out() - irqchip: Build IMX_MU_MSI only on ARM - net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing - sunrpc: fix client side handling of tls alerts - net/sched: taprio: enforce minimum value for picos_per_byte - net: drop UFO packets in udp_rcv_segment() - ipv6: reject malicious packets in ipv6_gso_segment() - net/mlx5: Correctly set gso_segs when LRO is used - netlink: specs: ethtool: fix module EEPROM input/output arguments - net: ipa: add IPA v5.1 and v5.5 to ipa_version_string() - phy: mscc: Fix parsing of unicast frames - netpoll: prevent hanging NAPI when netcons gets enabled - md/md-cluster: handle REMOVE message earlier - NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY - NFS: Fix wakeup of __nfs_lookup_revalidate() in unblock_revalidate() - sched: Add test_and_clear_wake_up_bit() and atomic_dec_and_wake_up() - pNFS/flexfiles: don't attempt pnfs on fatal DS errors - PCI: pnv_php: Fix surprise plug detection and recovery - powerpc/eeh: Export eeh_unfreeze_pe() - PCI: pnv_php: Work around switches with broken presence detection - kconfig: qconf: fix ConfigList::updateListAllforAll() - scsi: sd: Make sd shutdown issue START STOP UNIT appropriately - scsi: ufs: core: Use link recovery when h8 exit fails during runtime resume - scsi: Revert "scsi: iscsi: Fix HW conn removal use after free" - scsi: mpt3sas: Fix a fw_event memory leak - vfio/pci: Separate SR-IOV VF dev_set - vfio/pds: Fix missing detach_ioas op - vfio: Prevent open_count decrement to negative - vfio: Fix unbalanced vfio_df_close call in no-iommu mode - f2fs: fix to calculate dirty data during has_not_enough_free_secs() - f2fs: fix to update upper_p in __get_secs_required() correctly - f2fs: vm_unmap_ram() may be called from an invalid context - f2fs: fix to avoid out-of-boundary access in devs.path - f2fs: doc: fix wrong quota mount option description - f2fs: fix KMSAN uninit-value in extent_info usage - rtc: rv3028: fix incorrect maximum clock rate handling - rtc: pcf8563: fix incorrect maximum clock rate handling - rtc: pcf85063: fix incorrect maximum clock rate handling - rtc: nct3018y: fix incorrect maximum clock rate handling - rtc: hym8563: fix incorrect maximum clock rate handling - rtc: ds1307: fix incorrect maximum clock rate handling - ucount: fix atomic_long_inc_below() argument type - module: Restore the moduleparam prefix length check - apparmor: fix loop detection used in conflicting attachment resolution - apparmor: ensure WB_HISTORY_SIZE value is a power of 2 - bpf: Check netfilter ctx accesses are aligned - bpf: Check flow_dissector ctx accesses are aligned - vhost-scsi: Fix log flooding with target does not exist errors - mtd: rawnand: atmel: set pmecc data setup time - mtd: rawnand: rockchip: Add missing check after DMA map - mtd: rawnand: atmel: Fix dma_mapping_error() address - jfs: fix metapage reference count leak in dbAllocCtl - crypto: qat - fix seq_file position update in adf_ring_next() - crypto: qat - fix DMA direction for compression on GEN2 devices - perf tools: Remove libtraceevent in .gitignore - sh: Do not use hyphen in exported variable name - ASoC: fsl_xcvr: get channel status data when PHY is not exists - dmaengine: nbpfaxi: Add missing check after DMA map - dmaengine: mv_xor: Fix missing check after DMA map and missing unmap - fs/orangefs: Allow 2 more characters in do_c_string() - PCI: endpoint: pci-epf-vntb: Fix the incorrect usage of __iomem attribute - soundwire: stream: restore params when prepare ports fail - crypto: img-hash - Fix dma_unmap_sg() nents value - crypto: keembay - Fix dma_unmap_sg() nents value - hwrng: mtk - handle devm_pm_runtime_enable errors - watchdog: ziirave_wdt: check record length in ziirave_firm_verify() - scsi: isci: Fix dma_unmap_sg() nents value - scsi: mvsas: Fix dma_unmap_sg() nents value - scsi: elx: efct: Fix dma_unmap_sg() nents value - scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value - clk: sunxi-ng: v3s: Fix de clock definition - perf tests bp_account: Fix leaked file descriptor - kernel: trace: preemptirq_delay_test: use offstack cpu mask - crypto: inside-secure - Fix `dma_unmap_sg()` nents value - perf sched: Fix memory leaks in 'perf sched latency' - perf sched: Fix memory leaks for evsel->priv in timehist - perf sched: Free thread->priv using priv_destructor - perf dso: Add missed dso__put to dso__load_kcore - perf tools: Fix use-after-free in help_unknown_cmd() - Fix dma_unmap_sg() nents value - clk: clk-axi-clkgen: fix fpfd_max frequency for zynq - fanotify: sanitize handle_type values when reporting fid - pinctrl: sunxi: Fix memory leak on krealloc failure - PCI: endpoint: pci-epf-vntb: Return -ENOENT if pci_epc_get_next_free_bar() fails - crypto: arm/aes-neonbs - work around gcc-15 warning - power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set - power: supply: cpcap-charger: Fix null check for power_supply_get_by_name - clk: xilinx: vcu: unregister pll_post only if registered correctly - media: v4l2-ctrls: Fix H264 SEPARATE_COLOUR_PLANE check - mtd: fix possible integer overflow in erase_xfer() - crypto: marvell/cesa - Fix engine load inaccuracy - crypto: qat - use unmanaged allocation for dc_data - crypto: sun8i-ce - fix nents passed to dma_unmap_sg() - PCI: rockchip-host: Fix "Unexpected Completion" log message - bpf/preload: Don't select USERMODE_DRIVER - ipv6: annotate data-races around rt->fib6_nsiblings - ipv6: fix possible infinite loop in fib6_info_uses_dev() - vrf: Drop existing dst reference in vrf_ip6_input_dst - selftests: rtnetlink.sh: remove esp4_offload after test - net/mlx5e: Clear Read-Only port buffer size in PBMC before update - netfilter: xt_nfacct: don't assume acct name is null-terminated - can: kvaser_usb: Assign netdev.dev_port based on device channel index - can: kvaser_pciefd: Store device channel index - can: peak_usb: fix USB FD devices potential malfunction - tools/rv: Do not skip idle in trace - Bluetooth: hci_event: Mask data status from LE ext adv reports - kcsan: test: Initialize dummy variable - wifi: mac80211: Write cnt before copying in ieee80211_copy_rnr_beacon() - wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE - wifi: ath12k: fix endianness handling while accessing wmi service bit - wifi: mac80211: Check 802.11 encaps offloading in ieee80211_tx_h_select_key() - wifi: mac80211: Don't call fq_flow_idx() for management frames - wifi: mac80211: Do not schedule stopped TXQs - wifi: plfxlc: Fix error handling in usb driver probe - wifi: mac80211: reject TDLS operations when station is not associated - iommu/amd: Fix geometry.aperture_end for V2 tables - mwl8k: Add missing check after DMA map - wifi: rtl8xxxu: Fix RX skb size for aggregation disabled - tcp: call tcp_measure_rcv_mss() for ooo packets - xen/gntdev: remove struct gntdev_copy_batch from stack - net_sched: act_ctinfo: use atomic64_t for three counters - net/sched: Restrict conditions for adding duplicating netems to qdisc tree - um: rtc: Avoid shadowing err in uml_rtc_start() - arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX - netfilter: nf_tables: adjust lockdep assertions handling - netfilter: nf_tables: Drop dead code from fill_*_info routines - fbcon: Fix outdated registered_fb reference in comment - drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value - m68k: Don't unregister boot console needlessly - drm/msm/dpu: Fill in min_prefill_lines for SC8180X - kselftest/arm64: Fix check for setting new VLs in sve-ptrace - net: dst: annotate data-races around dst->input - tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range - wifi: ath11k: clear initialized flag for deinit-ed srng lists - iwlwifi: Add missing check for alloc_ordered_workqueue - wifi: iwlwifi: Fix memory leak in iwl_mvm_init() - wifi: rtl818x: Kill URBs before clearing tx status queue - wifi: rtw89: avoid NULL dereference when RX problematic packet on unsupported 6 GHz band - caif: reduce stack size, again - bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure - drm/vmwgfx: Fix Host-Backed userspace on Guest-Backed kernel - net: ipv6: ip6mr: Fix in/out netdev to pass to the FORWARD chain - selftests/bpf: fix signedness bug in redir_partial() - bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls - bpf, sockmap: Fix psock incorrectly pointing to sk - drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed - staging: nvec: Fix incorrect null termination of battery manufacturer - interconnect: qcom: sc8180x: specify num_nodes - interconnect: qcom: sc8280xp: specify num_links for qnm_a1noc_cfg - soc: qcom: pmic_glink: fix OF node leak - samples: mei: Fix building on musl libc - cpufreq: Initialize cpufreq-based frequency-invariance later - cpufreq: intel_pstate: Always use HWP_DESIRED_PERF in passive mode - arm64: dts: imx8mn-beacon: Fix HS400 USDHC clock speed - arm64: dts: imx8mm-beacon: Fix HS400 USDHC clock speed - ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface - soc/tegra: cbb: Clear ERR_FORCE register with ERR_STATUS - arm: dts: ti: omap: Fixup pinheader typo - usb: early: xhci-dbc: Fix early_ioremap leak - powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw() - pps: fix poll support - staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() - spi: stm32: Check for cfg availability in stm32_spi_probe - usb: misc: apple-mfi-fastcharge: Make power supply names unique - usb: host: xhci-plat: fix incorrect type for of_match variable in xhci_plat_probe() - ARM: dts: vfxxx: Correctly use two tuples for timer address - arm64: dts: qcom: msm8976: Make blsp_dma controlled-remotely - arm64: dts: qcom: sc7180: Expand IMEM region - arm64: dts: qcom: sdm845: Expand IMEM region - soc: qcom: QMI encoding/decoding for big endian - selftests: Fix errno checking in syscall_user_dispatch test - ASoC: mediatek: use reserved memory or enable buffer pre-allocation - gfs2: No more self recovery - Revert "fs/ntfs3: Replace inode_trylock with inode_lock" - hfs: make splice write available again - hfsplus: make splice write available again - ublk: use vmalloc for ublk_device's __queues - fs_context: fix parameter name in infofc() macro - audit,module: restore audit logging in load failure case - ASoC: amd: yc: add DMI quirk for ASUS M6501RM - ASoC: Intel: fix SND_SOC_SOF dependencies - ASoC: amd: yc: Add DMI entries to support HP 15-fb1xxx - ethernet: intel: fix building with large NR_CPUS - ASoC: amd: yc: Add DMI quirk for HP Laptop 17 cp-2033dx - interference: Fix uninitialized ifs_clock compiling issue - iommu/ummu: optimize log printing - !20455 Fix compilation failure caused by PR#20174 - !20302 CVE-2026-22980 - !20142 CVE-2025-68803 - !20261 ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency - !20435 fix CVE-2026-22998 - !20433 scsi: target: Reset t_task_cdb pointer in error case - !20432 scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" - !20431 block: Use RCU in blk_mq_[un - !20307 tpm: Cap the number of PCR banks - !20062 xfs: Add xfs_dir3_leaf_header_check() in leaf/leafn read - !20157 v2 md: backport from mainline - rcu: Protect ->defer_qs_iw_pending from data race - platform/x86/intel/pmt: fix compilation failure caused by PR#20174 - iommu/ummu: optimize kv cache memory management - iommu/ummu: optimize permission table management - iommu/ummu: remove check for eid_type while del eid - iommu/ummu: optimize the code implementation - drivers/perf: fix ummu-pmu data reading exception - iommu/ummu: IOMMU_DOMAIN_BLOCKED type don not sync tct - drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer - crypto: seqiv - Do not use req->iv after crypto_aead_encrypt - net: unic: Notify mami of the bond ip change. - ub: ubase: Support for UE link by ctrlq message - ub: ubase: send a deactivate req in removing - ub: ubase: Querying TPG/TP contexts in the chip is no longer supported after enabling safe mode. - ub: ubase: Use an independent thread for the ctrlq workqueue. - !20368 ubcore: fix logging and permission for route query. - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id - !20344 ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr - net: unic: Fix the ummu 0xa event that occurs when modifying queues and resetting concurrent scenarios - ub: ubase: Add KABI compatibility - ub: ubase: fixing the issue of cdma ctp_req_vl parameter configuration - ub: ubase: add PMU IDEV interrupt supported abilities. - ub: ubase: Delete the tid mask for eq, jfs, jfr, and jfc context - ub: ubase: Set the completion event interrupt to auto - net: unic: fix poll tx read old skb cause a UAF bug - !20249 Fix CVE-2025-38489 - !20250 Fix CVE-2025-38480 - !20378 Fix CVE-2025-39838 - !20430 Fix CVE-2025-39942 - !20351 Fix CVE-2025-71149 - !20375 Fix CVE-2025-71150 - !20323 Fix CVE-2025-38730 - !20320 Fix CVE-2025-68814 - !20314 Fix CVE-2025-71072 - !20315 Fix CVE-2025-68794 - !20403 bpf: Check skb->transport_header is set in bpf_skb_check_mtu - !20402 bpf: Do not let BPF test infra emit invalid GSO types to stack - !20401 tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() - !20400 netfilter: nft_ct: add seqadj extension for natted connections - !20399 net: xfrm: Fix CVE-2025-40215 - !20398 net/sched: sch_qfq: Fix null-deref in agg_dequeue - !20397 bpf: Reject narrower access to pointer ctx fields - !20396 Bluetooth: eir: Fix possible crashes on eir_create_adv_data - !20394 IB/mlx5: Fix potential deadlock in MR deregistration - !20367 ub: cdma: cdma uaf bugfix - net/mlx5e: Fix crash on profile change rollback failure - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv - PCI/AER: Fix NULL pointer access by aer_info - gfs2: No more self recovery - drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE - crypto: qat - flush misc workqueue during device shutdown - !20174 Backport PMT spec 3.0 support - !20366 [Hygon][6.6][Bugfix]: Resolve FPU state corruption between atomic and non-atomic contexts - !19814 [OLK-6.6] Batch flushing user memory encrytion status change - !20393 [OLK-6.6][linux-6.6.y sync] Backport 6.6.100-6.6.101 LTS Patches - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec - nvmet-tcp: remove boilerplate code - scsi: target: Reset t_task_cdb pointer in error case - scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" - block: Use RCU in blk_mq_[un]quiesce_tagset() instead of set->tag_list_lock - ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size - ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer - smb: server: let recv_done() consistently call put_recvmsg/smb_direct_disconnect_rdma_connection - smb: server: remove separate empty_recvmsg_queue - !20384 ub:ubus: Fix ubus link message and pool device error - !20389 gfs2: Prevent recursive memory reclaim - !20388 *** fix CVE-2025-38062 *** - !20387 KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced - !20386 pinctrl: check the return value of pinmux_ops::get_function_name() - !20385 iommu/amd/pgtbl: Fix possible race while increase page table level - ub:ubus: Not cfg access during surprise down - ub:hisi-ubus: Delete validate_pa err print - PCI: cadence: Check for the existence of cdns_pcie::ops before using it - can: netlink: can_changelink(): allow disabling of automatic restart - Revert "selftests/bpf: Add a cgroup prog bpf_get_ns_current_pid_tgid() test" - drm/sched: Remove optimization that causes hang when killing dependent jobs - ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS - bpf: Check skb->transport_header is set in bpf_skb_check_mtu - bpf: Do not let BPF test infra emit invalid GSO types to stack - tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() - netfilter: nft_ct: add seqadj extension for natted connections - xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added - xfrm: delete x->tunnel as we delete x - x86/hw-vuln:Support hardware-based mitigation for Retbleed and SRSO via Hygon IBRS to avoid performance degradation caused by software-based mitigation. - net/sched: sch_qfq: Fix null-deref in agg_dequeue - bpf: Reject narrower access to pointer ctx fields - Bluetooth: eir: Fix possible crashes on eir_create_adv_data - IB/mlx5: Fix potential deadlock in MR deregistration - ub:ubus: Fix ubus link message and pool device error - ub:hisi-ubus: cq poller maximum handle 64 cqe per time - ub:hisi-ubus:Fix vdm message print error - ub:ubus:Fix ubus interrupt release issue - wifi: mt76: mt7921: prevent decap offload config before STA initialization - mtd: rawnand: qcom: Fix last codeword read in qcom_param_page_type_exec() - iio: hid-sensor-prox: Restore lost scale assignments - iio: hid-sensor-prox: Fix incorrect OFFSET calculation - crypto: powerpc/poly1305 - add depends on BROKEN for now - erofs: address D-cache aliasing - drm/i915/dp: Fix 2.7 Gbps DP_LINK_BW value on g4x - ALSA: hda: Add missing NVIDIA HDA codec IDs - ALSA: hda/tegra: Add Tegra264 support - comedi: comedi_test: Fix possible deletion of uninitialized timers - usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach - usb: typec: tcpm: allow switching to mode accessory to mux properly - usb: typec: tcpm: allow to use sink in accessory mode - drm/amdkfd: Don't call mmput from MMU notifier callback - mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n - selftests: mptcp: connect: also cover checksum - selftests: mptcp: connect: also cover alt modes - resource: fix false warning in __request_region() - gve: Fix stuck TX queue for DQ queue format - e1000e: ignore uninitialized checksum word on tgp - e1000e: disregard NVM checksum on tgp when valid checksum bit is not set - dpaa2-switch: Fix device reference count leak in MAC endpoint handling - dpaa2-eth: Fix device reference count leak in MAC endpoint handling - ALSA: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx - sprintf.h requires stdarg.h - bus: fsl-mc: Fix potential double device reference in fsl_mc_get_endpoint() - i2c: virtio: Avoid hang by using interruptible completion wait - i2c: tegra: Fix reset error handling with ACPI - platform/x86: ideapad-laptop: Fix kbd backlight not remembered among boots - can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode - can: dev: can_restart(): move debug message and stats after successful restart - can: dev: can_restart(): reverse logic to remove need for goto - i40e: When removing VF MAC filters, only check PF-set MAC - i40e: report VF tx_dropped with tx_errors instead of tx_discards - i40e: Add rx_missed_errors for buffer exhaustion - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch - net/mlx5: Fix memory leak in cmd_exec() - staging: vchiq_arm: Make vchiq_shutdown never fail - x86/hyperv: Fix usage of cpu_online_mask to get valid cpu - regmap: fix potential memory leak of regmap_bus - iio: adc: ad7949: use spi_is_bpw_supported() - interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1 node - RDMA/core: Rate limit GID cache warning messages - virtio_ring: Fix error reporting in virtqueue_resize - !20348 [OLK-6.6][linux-6.6.y sync] Backport 6.6.99-6.6.100 LTS Patches - !20346 tracing: Fix crash on synthetic stacktrace field usage - vfs: Don't leak disconnected dentries on umount - !20334 Fix CVE-2025-68780 - gfs2: Prevent recursive memory reclaim - amd/amdkfd: enhance kfd process check in switch partition - drm/amdkfd: allow compute partition mode switch with cgroup exclusions - KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced - pinctrl: check the return value of pinmux_ops::get_function_name() - iommu/amd/pgtbl: Fix possible race while increase page table level - !19966 nvme-fc: use lock accessing port_state and rport state - ASoC: fsl_sai: replace regmap_write with regmap_update_bits - comedi: Fix use of uninitialized data in insn_rw_emulate_bits() - cifs: prevent NULL pointer dereference in UTF16 conversion - ksmbd: Fix refcount leak when invalid session is found on session lookup - ubcore: fix logging and permission for route query. - !20232 driver/coda: VirtCCA supports MSI device DA - Revert "Revert "RDMA/hns: Fix mismatch exception rollback"" - !20197 ub: udma&ubase: fix a bug that caused long reboot time - x86: Resolve FPU state corruption between atomic and non-atomic contexts - ub: cdma: cdma uaf bugfix - ub: cdma: jfs call trace bugfix - !20353 x86/fpu: Clear XSTATE_BV[i - s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again - KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls - nvmem: layouts: u-boot-env: remove crc32 endianness conversion - i2c: omap: fix deprecated of_property_read_bool() use - ASoC: fsl_sai: Force a software reset when starting in consumer mode - regulator: pwm-regulator: Manage boot-on with disabled PWM channels - regulator: pwm-regulator: Calculate the output voltage for disabled PWMs - i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe() - i2c: omap: Fix an error handling path in omap_i2c_probe() - i2c: omap: Add support for setting mux - usb: dwc3: qcom: Don't leave BCR asserted - usb: hub: Don't try to recover devices lost during warm reset. - usb: hub: Fix flushing of delayed work used for post resume purposes - usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm - usb: hub: fix detection of high tier USB3 devices behind suspended hubs - arm64: Filter out SME hwcaps when FEAT_SME isn't implemented - ipv6: make addrconf_wq single threaded - !20354 cpufreq/sched: Explicitly synchronize limits_changed flag handling - sched/deadline: only set free_cpus for online runqueues - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 - cpufreq/sched: Explicitly synchronize limits_changed flag handling - io_uring/poll: correctly handle io_poll_add() return value on update - shmem: fix recovery on rename failures - io_uring: fix filename leak in __io_openat_prep() - Revert "cgroup_freezer: cgroup_freezing: Check if not frozen" - rxrpc: Fix transmission of an abort in response to an abort - rxrpc: Fix recv-recv race of completed call - net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree - net: bridge: Do not offload IGMP/MLD messages - hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf - netfilter: nf_conntrack: fix crash due to removal of uninitialised entry - ipv6: mcast: Delay put pmc->idev in mld_del_delrec() - net/mlx5: Correctly set gso_size when LRO is used - Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID - Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout - Bluetooth: SMP: If an unallowed command is received consider it a failure - Bluetooth: hci_sync: fix connectable extended advertising when using static random address - hwmon: (corsair-cpro) Validate the size of the received input buffer - selftests: net: increase inter-packet timeout in udpgro.sh - wifi: cfg80211: remove scan request n_channels counted_by - nvme: fix misaccounting of nvme-mpath inflight I/O - net: phy: Don't register LEDs for genphy - nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list() - rpl: Fix use-after-free in rpl_do_srh_inline(). - block: fix kobject leak in blk_unregister_queue - net: emaclite: Fix missing pointer increment in aligned_read() - soundwire: amd: fix for clearing command status register - soundwire: amd: fix for handling slave alerts after link is down - comedi: Fix use of uninitialized data in insn_rw_emulate_bits() - comedi: Fix some signed shift left operations - comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large - comedi: das6402: Fix bit shift out of bounds - comedi: das16m1: Fix bit shift out of bounds - comedi: aio_iiro_16: Fix bit shift out of bounds - comedi: pcl812: Fix bit shift out of bounds - iio: adc: stm32-adc: Fix race in installing chained IRQ handler - iio: adc: max1363: Reorder mode_list[] entries - iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] - iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush - soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled - soc: aspeed: lpc-snoop: Cleanup resources in stack-order - s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again - pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov - net: libwx: properly reset Rx ring descriptor - net: libwx: remove duplicate page_pool_put_full_page() - mmc: sdhci_am654: Workaround for Errata i2312 - mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models - mmc: bcm2835: Fix dma_unmap_sg() nents value - memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() - isofs: Verify inode mode when loading from disk - dmaengine: nbpfaxi: Fix memory corruption in probe() - af_packet: fix soft lockup issue caused by tpacket_snd() - af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() - arm64: dts: rockchip: use cs-gpios for spi1 on ringneck - arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on - arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency - net/mlx5: Update the list of the PCI supported devices - phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() - io_uring/poll: fix POLLERR handling - ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS - drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume - tracing/osnoise: Fix crash in timerlat_dump_stack() - spi: Add check for 8-bit transfer with 8 IO mode support - pch_uart: Fix dma_sync_sg_for_device() nents value - thunderbolt: Fix bit masking in tb_dp_port_set_hops() - i2c: stm32: fix the device used for the DMA map - tracing: Fix crash on synthetic stacktrace field usage - usb: musb: fix gadget state on disconnect - USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI - USB: serial: option: add Foxconn T99W640 - USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition - phy: tegra: xusb: Disable periodic tracking on Tegra234 - phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode - phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr - fs/proc: fix uaf in proc_readdir_de() - io_uring/net: commit partial buffers on retry - nvme: fix admin request_queue lifetime - fs/notify: call exportfs_encode_fid with s_umount - iomap: adjust read range correctly for non-block-aligned positions - fuse: fix livelock in synchronous file put from fuseblk workers - tpm: Cap the number of PCR banks - nfsd: provide locking for v4_end_grace - Revert "nfsd: provide locking for v4_end_grace" - config: enable config for PMT discovery driver - platform/x86/intel/pmt/discovery: use valid device pointer in dev_err_probe - platform/x86/intel/pmt: Fix kobject memory leak on init failure - platform/x86/intel/pmt: fix a crashlog NULL pointer access - platform/x86/intel/pmt: fix build dependency for kunit test - platform/x86/intel/pmt/discovery: fix format string warning - platform/x86/intel/pmt/discovery: Fix size_t specifiers for 32-bit - platform/x86/intel/pmt: KUNIT test for PMT Enhanced Discovery API - platform/x86/intel/pmt/telemetry: Add API to retrieve telemetry regions by feature - platform/x86/intel/pmt/discovery: Get telemetry attributes - platform/x86/intel/tpmi: Get OOBMSM CPU mapping from TPMI - platform/x86/intel/vsec: Set OOBMSM to CPU mapping - platform/x86/intel/tpmi: Relocate platform info to intel_vsec.h - docs: Add ABI documentation for intel_pmt feature directories - platform/x86/intel/pmt: Add PMT Discovery driver - sysfs: Fix crash on empty group attributes array - sysfs: Introduce a mechanism to hide static attribute_groups - platform/x86/intel/vsec: Add new Discovery feature - platform/x86/intel/vsec: Skip driverless features - platform/x86/intel/vsec: Skip absent features during initialization - platform/x86/intel/vsec: Add device links to enforce dependencies - platform/x86/intel/vsec: Create wrapper to walk PCI config space - platform/x86/intel/vsec: Add private data for per-device data - MAINTAINERS: Add link to documentation of Intel PMT ABI - platform/x86/intel/pmt: allow user offset for PMT callbacks - driver/coda: VirtCCA supports MSI device DA - ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency - Rename leapioraid to leapraid and release v2.0 - ub: udma: fix a bug that caused long reboot time. - ub: ubase: Accelerate when ctrl node is shutting down - platform/x86/intel/pmt: Use PMT callbacks - platform/x86/intel/vsec: Add PMT read callbacks - platform/x86/intel/vsec.h: Move to include/linux - md: prevent incorrect update of resync/recovery offset - md/raid1: Fix data corruption for degraded array with slow disk - md/raid1: set max_sectors during early return from choose_slow_rdev() - md-cluster: fix no recovery job when adding/re-adding a disk - md-cluster: fix hanging issue while a new disk adding - md/raid5: recheck if reshape has finished with device_lock held - md-cluster: Constify struct md_cluster_operations - md: Remove unneeded semicolon - md/raid5: fix spares errors about rcu usage - dm-raid: Fix WARN_ON_ONCE check for sync_thread in raid_resume - md: pass in max_sectors for pers->sync_request() - md: factor out helpers for different sync_action in md_do_sync() - md: replace last_sync_action with new enum type - md: use new helpers in md_do_sync() - md: don't fail action_store() if sync_thread is not registered - md: remove parameter check_seq for stop_sync_thread() - md: replace sysfs api sync_action with new helpers - md: factor out helper to start reshape from action_store() - md: add new helpers for sync_action - md: add a new enum type sync_action - md: rearrange recovery_flags - md/raid0: don't free conf on raid0_run failure - md: make md_flush_request() more readable - md: change the return value type of md_write_start to void - md: Revert "md: Fix overflow in is_mddev_idle" - md: don't account sync_io if iostats of the disk is disabled - md: Fix overflow in is_mddev_idle - md: add check for sleepers in md_wakeup_thread() - md: add a mddev_is_dm helper - md: add a mddev_add_trace_msg helper - md: add a mddev_trace_remap helper - dm-raid456, md/raid456: fix a deadlock for dm-raid456 while io concurrent with reshape - dm-raid: add a new helper prepare_suspend() in md_personality - dm-raid: really frozen sync_thread during suspend - md: add a new helper reshape_interrupted() - md: export helper md_is_rdwr() - md: export helpers to stop sync_thread - md: don't clear MD_RECOVERY_FROZEN for new dm-raid until resume - md/raid1: factor out helpers to choose the best rdev from read_balance() - md/raid1: factor out the code to manage sequential IO - md/raid1: factor out choose_bb_rdev() from read_balance() - md/raid1: factor out choose_slow_rdev() from read_balance() - md/raid1: factor out read_first_rdev() from read_balance() - md/raid1-10: factor out a new helper raid1_should_read_first() - md/raid1-10: add a helper raid1_check_read_range() - md/raid1: fix choose next idle in read_balance() - md/raid1: record nonrot rdevs while adding/removing rdevs to conf - md/raid1: factor out helpers to add rdev to conf - md: add a new helper rdev_has_badblock() - md: check mddev->pers before calling md_set_readonly() - md: clean up openers check in do_md_stop() and md_set_readonly() - md: sync blockdev before stopping raid or setting readonly - md: factor out a helper to sync mddev - md: return directly before setting did_set_md_closing - md: changed the switch of RAID_VERSION to if - md: merge the check of capabilities into md_ioctl_valid() - md: Don't suspend the array for interrupted reshape - md: Don't register sync_thread for reshape directly - md: Make sure md_do_sync() will set MD_RECOVERY_DONE - md: Don't ignore read-only array in md_check_recovery() - md: Don't ignore suspended array in md_check_recovery() - md: get rdev->mddev with READ_ONCE() - md: remove redundant md_wakeup_thread() - md: remove redundant check of 'mddev->sync_thread' - md: fix a suspicious RCU usage warning - raid: Remove now superfluous sentinel element from ctl_table array - NFSD: NFSv4 file creation neglects setting ACL - nfsd: set security label during create operations - xfs: Add xfs_dir3_leaf_header_check() in leaf/leafn read - nvme-fc: use lock accessing port_state and rport state - x86/mm: Batch flushing user memory encrytion status change - !20588 [OLK-6.6] Revert "x86/csv: Enhance CMA memory usage reporting for CSV3" - Revert "x86/csv: Enhance CMA memory usage reporting for CSV3" - !20576 media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg() - !20575 RDMA/cm: Fix leaking the multicast GID table reference - !20580 RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly - !20551 Fix CVE-2025-68785 - !20478 f2fs: fix to avoid potential deadlock - !20501 [OLK-6.6] backport important bugfix for bnxt driver from upstream linux-6.6.y - !20520 Fix CVE-2026-23038 - !20424 net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup - !20425 mlx5: Fix default values in create CQ - RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly - media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg() - RDMA/cm: Fix leaking the multicast GID table reference - net: openvswitch: fix middle attribute validation in push_nsh() action - net: openvswitch: remove never-working support for setting nsh fields - pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() - bnxt_en: Fix potential data corruption with HW GRO/LRO - f2fs: fix to avoid potential deadlock - mlx5: Fix default values in create CQ - net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup - riscv kernel upgrade to 6.6.0-138.0.0 - Fixed system hang when boot systemd on spacemit k3 - riscv: perf vendor events: fix lrw core PMU event mapping - !20727 v2 bpf: sockmap fixes - !20741 scsi: qla2xxx: Sanitize payload size to prevent member overflow - !20744 fix CVE-2025-38449 - !20763 net: usb: asix: validate PHY address before use - !20762 smc91x: fix broken irq-context in PREEMPT_RT - !20293 [Hygon][6.6][EDAC] The width of hash value is 2 bits for Hygon family 18h model 6h processors - !20290 [Hygon][6.6][Bugfix] Bug fix for EDAC to use unicast instead of broadcast on hygon family 18h model 4h - !20289 [Hygon][6.6][Bugfix] Bug fix for EDAC to correct the address translation on hygon family 18h model 4h - !20245 KVM: arm64: Refactor exit handlers - !20246 KVM: arm64: Mark some header functions as inline - !19005 [Hygon] [OLK-6.6] [Bugfix] Fix memory bandwidth counter width for Hygon QoS - !20292 [Hygon][6.6][TSC Adjust] Backport x86 TSC adjust patch - !20273 [Hygon][6.6][Bugfix] Get correct CPU LLC ID in guest for Hygon processors - !20722 [OLK-6.6][linux-6.6.y sync] Backport 6.6.104-6.6.106 LTS Patches - !20667 fix CVE-2024-50102 - !20736 netfilter: nf_tables: remove redundant chain validation on register store - !20758 ub: ubase: Fixed the alarm issue caused by the initialization of the structure variable definition. - !20721 obmm: reduce log noise for successful export/import/preimport - net: usb: asix: validate PHY address before use - smc91x: fix broken irq-context in PREEMPT_RT - !20731 devlink: rate: Unset parent pointer in devl_rate_nodes_destroy - !20732 libceph: return the handler error from mon_handle_auth_done() - !20743 mm: slub: avoid wake up kswapd in set_track_prepare - ub: ubase: Fixed the alarm issue caused by the initialization of the structure variable definition. - !20750 ub: cdma: adapted to UMMU interface changes - !20713 urma: DFX of log in kernel - urma: optimize log levels for kernel space - ub: cdma: adapted to UMMU interface changes - wifi: ath11k: avoid bit operation on key flags - drm/mediatek: fix potential OF node use-after-free - cpufreq: intel_pstate: Check IDA only before MSR_IA32_PERF_CTL writes - wifi: cfg80211: sme: store capped length in __cfg80211_connect_result() - !20708 ub:hisi-ubus: Add create bus instance ummu bypass - drm: fix kabi for struct drm_framebuffer - drm/framebuffer: Acquire internal references on GEM handles - drm/gem: Acquire references on GEM handles for framebuffers - mm: slub: avoid wake up kswapd in set_track_prepare - scsi: qla2xxx: Sanitize payload size to prevent member overflow - netfilter: nf_tables: remove redundant chain validation on register store - libceph: return the handler error from mon_handle_auth_done() - devlink: rate: Unset parent pointer in devl_rate_nodes_destroy - Documentation/hw-vuln: Add VMSCAPE documentation - dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status() - riscv: use lw when reading int cpu in asm_per_cpu - mm: slub: avoid wake up kswapd in set_track_prepare - tools: gpio: remove the include directory on make clean - tools: gpio: rm .*.cmd on make clean - drm/amd/amdgpu: Fix missing error return on kzalloc failure - drm/amdgpu: Replace DRM_* with dev_* in amdgpu_psp.c - perf bpf-event: Fix use-after-free in synthesis - drm/bridge: ti-sn65dsi86: fix REFCLK setting - spi: spi-fsl-lpspi: Clear status register after disabling the module - spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort - spi: spi-fsl-lpspi: Set correct chip-select polarity bit - spi: spi-fsl-lpspi: Fix transmissions when using CONT - hwmon: mlxreg-fan: Prevent fans from getting stuck at 0 RPM - pcmcia: omap: Add missing check for platform_get_resource - Revert "drm/amdgpu: Avoid extra evict-restore process." - ALSA: hda/realtek: Fix headset mic for TongFang X6[AF]R5xxY - ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model - drm/mediatek: Fix device/node reference count leaks in mtk_drm_get_all_drm_priv - drm/mediatek: Fix using wrong drm private data to bind mediatek-drm - drm/mediatek: Add crtc path enum for all_drm_priv array - vmxnet3: update MTU after device quiesce - net: dsa: microchip: linearize skb for tail-tagging switches - net: dsa: microchip: update tag_ksz masks for KSZ9477 family - dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status() - ALSA: hda/realtek - Add new HP ZBook laptop with micmute led fixup - ALSA: hda/realtek: Add support for HP Agusta using CS35L41 HDA - iio: pressure: mprls0025pa: use aligned_s64 for timestamp - iio: chemical: pms7003: use aligned_s64 for timestamp - iio: imu: inv_mpu6050: align buffer for timestamp - thermal/drivers/mediatek/lvts: Disable low offset IRQ for minimum threshold - nouveau: fix disabling the nonstall irq due to storm code - cpufreq: intel_pstate: Unchecked MSR aceess in legacy mode - net: pcs: rzn1-miic: Correct MODCTRL register offset - platform/x86/amd/pmc: Add TUXEDO IB Pro Gen10 AMD to spurious 8042 quirks list - drm/amdgpu: drop hw access in non-DC audio fini - wifi: mt76: mt7996: Initialize hdr before passing to skb_put_data() - wifi: mwifiex: Initialize the chan_stats array to zero - tcp_bpf: Fix copied value in tcp_bpf_sendmsg - skmsg: Return copied bytes in sk_msg_memcopy_from_iter - tcp_bpf: Add sk_rmem_alloc related logic for tcp_bpf ingress redirection - Revert "bpf, sockmap: Add sk_rmem_alloc check for sockmap" - ALSA: usb-audio: Add mute TLV for playback volumes on some devices - phy: mscc: Stop taking ts_lock for tx_queue and use its own lock - selftest: net: Fix weird setsockopt() in bind_bhash.c. - net: atm: fix memory leak in atm_register_sysfs when device_register fail - ax25: properly unshare skbs in ax25_kiss_rcv() - mctp: return -ENOPROTOOPT for unknown getsockopt options - net/smc: Remove validation of reserved bits in CLC Decline message - ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init() - net: thunder_bgx: decrement cleanup index before use - net: thunder_bgx: add a missing of_node_put - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() - wifi: libertas: cap SSID len in lbs_associate() - wifi: cw1200: cap SSID length in cw1200_do_join() - net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets - wifi: ath11k: fix group data packet drops during rekey - wifi: ath11k: avoid forward declaration of ath11k_mac_start_vdev_delay() - wifi: ath11k: rename ath11k_start_vdev_delay() - wifi: ath11k: Introduce and use ath11k_sta_to_arsta() - net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() - macsec: read MACSEC_SA_ATTR_PN with nla_get_uint - netlink: add variable-length / auto integers - net: macb: Fix tx_ptr_lock locking - icmp: fix icmp_ndo_send address translation for reply direction - mISDN: Fix memory leak in dsp_hwec_enable() - xirc2ps_cs: fix register access when enabling FullDuplex - netfilter: conntrack: helper: Replace -EEXIST by -EBUSY - wifi: cfg80211: fix use-after-free in cmp_bss() - arm64: dts: imx8mp: Fix missing microSD slot vqmmc on Data Modul i.MX8M Plus eDM SBC - arm64: dts: imx8mp: Fix missing microSD slot vqmmc on DH electronics i.MX8M Plus DHCOM - tee: optee: ffa: fix a typo of "optee_ffa_api_is_compatible" - arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro - Bluetooth: hci_sync: Avoid adding default advertising on startup - cpupower: Fix a bug where the -t option of the set subcommand was not working. - drm/amd/display: Don't warn when missing DCE encoder caps - cdc_ncm: Flag Intel OEM version of Fibocom L850-GL as WWAN - LoongArch: Save LBT before FPU in setup_sigcontext() - btrfs: avoid load/store tearing races when checking if an inode was logged - btrfs: fix race between setting last_dir_index_offset and inode logging - btrfs: fix race between logging inode and checking if it was logged before - bpf: Fix oob access in cgroup local storage - !20556 urma: fix update topo logic - !20639 [OLK-6.6][linux-6.6.y sync] Backport 6.6.103-6.6.104 LTS Patches - !20641 [OLK-6.6][linux-6.6.y sync] LoongArch: Add more instruction opcodes and emit_* helpers - !20560 *** fix CVE-2025-38062 *** - !20662 pNFS: Fix a deadlock when returning a delegation during open() - ub:hisi-ubus: Add create bus instance ummu bypass - Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" - Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set" - HID: mcp2221: Handle reads greater than 60 bytes - HID: mcp2221: Don't set bus speed on every transfer - net/mlx5: SF, Fix add port error handling - drm/nouveau/disp: Always accept linear modifier - smb3 client: fix return code mapping of remap_file_range - net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions - dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted - HID: wacom: Add a new Art Pen 2 - HID: logitech: Add ids for G PRO 2 LIGHTSPEED - HID: quirks: add support for Legion Go dual dinput modes - net: stmmac: Set CIC bit only for TX queues with COE - net: stmmac: xgmac: Correct supported speed modes - net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts - net/mlx5e: Set local Xoff after FW update - net/mlx5e: Update and set Xon/Xoff upon port speed set - net/mlx5e: Update and set Xon/Xoff upon MTU set - net/mlx5: Nack sync reset when SFs are present - net/mlx5: Convert SF port_indices xarray to function_ids xarray - net/mlx5: Use devlink port pointer to get the pointer of container SF struct - net/mlx5: Call mlx5_sf_id_erase() once in mlx5_sf_dealloc() - phy: mscc: Fix when PTP clock is register and unregister - net: dlink: fix multicast stats being counted incorrectly - dt-bindings: display/msm: qcom,mdp5: drop lut clock - drm/nouveau: remove unused memory target test - drm/nouveau: remove unused increment in gm200_flcn_pio_imem_wr - Bluetooth: hci_sync: fix set_local_name race condition - Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced - Bluetooth: hci_event: Mark connection as closed during suspend disconnect - Bluetooth: hci_event: Treat UNKNOWN_CONN_ID on disconnect as success - HID: input: report battery status changes immediately - HID: input: rename hidinput_set_battery_charge_status() - powerpc/kvm: Fix ifdef to remove build warning - drm/msm: Defer fd_install in SUBMIT ioctl - vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() - ACPI: EC: Add device to acpi_ec_no_wakeup[] qurik list - erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC - ASoC: codecs: tx-macro: correct tx_macro_component_drv name - smb: client: fix race with concurrent opens in unlink(2) - scsi: core: sysfs: Correct sysfs attributes access rights - of: dynamic: Fix use after free in of_changeset_add_prop_helper() - of: Add a helper to free property struct - mips: lantiq: xway: sysctrl: rename the etop node - mips: dts: lantiq: danube: add missing burst length property - pinctrl: STMFX: add missing HAS_IOMEM dependency - of: dynamic: Fix memleak when of_pci_add_properties() failed - !20684 urma: adjust urma log format - !20355 udp: Deal with race between UDP socket address change and rehash - !20627 Fixes CVE-2025-38627 - !20702 CVE-2025-39948 - !20701 netfilter: ctnetlink: remove refcounting in expectation dumpers - !20700 CVE-2025-38678 - !20703 CVE-2025-38491 - !20690 tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. - obmm: reduce log noise for successful export/import/preimport - mptcp: avoid deadlock on fallback while reinjecting - mptcp: plug races between subflow fail and subflow creation - mptcp: make fallback action and fallback decision atomic - ice: fix Rx page leak on multi-buffer frames - ice: fix incorrect counter for buffer allocation failures - ice: stop storing XDP verdict within ice_rx_buf - ice: gather page_count()'s of each frag right before XDP prog call - ice: Introduce ice_xdp_buff - netfilter: ctnetlink: remove refcounting in expectation dumpers - netfilter: nf_tables: reject duplicate device on updates - netfilter: nf_tables: Introduce functions freeing nft_hook objects - netfilter: nf_tables: Fix percpu address space issues in nf_tables_api.c - err.h: add ERR_PTR_PCPU(), PTR_ERR_PCPU() and IS_ERR_PCPU() macros - tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. - !20498 Fix CVE-2025-71118 - !20608 pmdomain: arm: scmi: Fix genpd leak on provider registration failure - !20679 x86/CPU/AMD: Add RDSEED fix for Zen5 - !20650 fix cve-2025-40300 - !20661 Input: alps - fix use-after-free bugs caused by dev3_register_work - !20664 backport some net bugfix from 6.6 lts - urma: adjust urma log format - !20678 ub: udma: close debug switch load parameters. - ub: udma: close debug switch load parameters. - x86/CPU/AMD: Add RDSEED fix for Zen5 - !20630 net: LTS-6.6 bugfix backport - !20632 net/sched: sch_qfq: do not free existing class in qfq_change_class() - !20631 macvlan: fix possible UAF in macvlan_forward_source() - !20628 Fix CVE-2025-39910 - !20659 v2 Fix CVE-2025-22090 - !20506 XSched: Update XSched manual - !20647 media: imon: make send_packet() more robust - !20646 ksm: use range-walk function to jump over holes in scan_get_next_rmap_item - !20645 fbcon: Set fb_display[i - !20648 parse_longname(): strrchr() expects NUL-terminated string - !20621 urma: modify log level - !20602 urma: fix the jfe uaf issue that occurred during the killall process. - !20567 urma:change log level and pass status 9 - !20640 iio: common: st_sensors: Fix use of uninitialize device structs - !20634 usb: gadget: udc: fix use-after-free in usb_gadget_state_work - !20633 net: dsa: properly keep track of conduit reference - !20635 fix CVE-2025-68231 - !20651 mm/slub: avoid accessing metadata when pointer is invalid in object_err() - !20649 drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb - !20652 mm/vmalloc: fix data race in show_numa_info() - x86: uaccess: don't use runtime-const rewriting in modules - x86: fix off-by-one in access_ok() - x86: fix user address masking non-canonical speculation issue - x86/uaccess: Zero the 8-byte get_range case on failure on 32-bit - x86/uaccess: Improve the 8-byte getuser() case - x86: fix whitespace in runtime-const assembler output - dcache: keep dentry_hashtable or d_hash_shift even when not used - runtime constants: add x86 architecture support - runtime constants: deal with old decrepit linkers - x86/uaccess: Add missing __force to casts in __access_ok() and valid_user_address() - !20345 arm64: entry: xcall/xint: make asm conditionals compatible with clang IAS - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). - libceph: replace BUG_ON with bounds check for map->max_osd - libceph: prevent potential out-of-bounds writes in handle_auth_session_key() - libceph: fix potential use-after-free in have_mon_and_osd_map() - sctp: Hold sock lock while iterating over address list - sctp: Prevent TOCTOU out-of-bounds write - sctp: Hold RCU read lock while iterating over address list - tipc: Fix use-after-free in tipc_mon_reinit_self(). - sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto - sctp: avoid NULL dereference when chunk data buffer is missing - bpf: Explicitly check accesses to bpf_sock_addr - ipvs: Defer ip_vs_ftp unregister during netns cleanup - nexthop: Forbid FDB status change while nexthop is in a group - netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). - net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer - sctp: initialize more fields in sctp_v6_from_sk() - pNFS: Fix a deadlock when returning a delegation during open() - Input: alps - fix use-after-free bugs caused by dev3_register_work - x86/cpu: Get CPU LLC ID from CPUID 0x8000001d in guest for Hygon processors - kernel/fork: only call untrack_pfn_clear() on VMAs duplicated for fork() - mm: (un)track_pfn_copy() fix + doc improvements - x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range() - !20642 mtdchar: fix integer overflow in read/write ioctls - mm/vmalloc: fix data race in show_numa_info() - mm/slub: avoid accessing metadata when pointer is invalid in object_err() - config: enable CONFIG_MITIGATION_VMESCAPE by default on x86 - x86/vmscape: Enable the mitigation - x86/vmscape: Enumerate VMSCAPE bug - x86/vmscape: Add conditional IBPB mitigation - drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb - parse_longname(): strrchr() expects NUL-terminated string - media: imon: make send_packet() more robust - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item - fbcon: Set fb_display[i]->mode to NULL when the mode is released - !20569 CVE-2024-35808 - mtdchar: fix integer overflow in read/write ioctls - !20619 Fix CVE-2026-22991 - !20612 net: hns3: extend HCLGE_FD_AD_COUNTER_NUM to 8 bits - LoongArch: Add more instruction opcodes and emit_* helpers - iio: common: st_sensors: Fix use of uninitialize device structs - !20581 null_blk: fix kmemleak by releasing references to fault configfs items - mm/mempool: fix poisoning order>0 pages with HIGHMEM - mm/page_poison: replace kmap_atomic() with kmap_local_page() - mm/mempool: replace kmap_atomic() with kmap_local_page() - usb: gadget: udc: fix use-after-free in usb_gadget_state_work - net: dsa: properly keep track of conduit reference - net/sched: sch_qfq: do not free existing class in qfq_change_class() - macvlan: fix possible UAF in macvlan_forward_source() - netfilter: nft_objref: validate objref and objrefmap expressions - arp: do not assume dev_hard_header() does not change skb->head - ip6_gre: make ip6gre_header() robust - netfilter: nf_tables: avoid chain re-validation if possible - netfilter: nf_tables: drop unused 3rd argument from validate callback ops - Revert "netfilter: nft_objref: validate objref and objrefmap expressions" - bpf: Fix reference count leak in bpf_prog_test_run_xdp() - net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset - ethtool: Avoid overflowing userspace buffer on stats query - ipvs: fix ipv4 null-ptr-deref in route error path - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() - !20596 mm/page_alloc: prevent pcp corruption with SMP=n - !20598 team: fix check for port enabled in team_queue_override_port_prio_changed() - !18823 hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio - mm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc() - kasan: avoid sleepable page allocation from atomic context - f2fs: compress: fix UAF of f2fs_inode_info in f2fs_free_dic - f2fs: compress: change the first parameter of page_array_{alloc,free} to sbi - !20583 [OLK-6.6][linux-6.6.y sync] Backport 6.6.102-6.6.103 LTS Patches - !20460 fbdev: Fix vmalloc out-of-bounds write in fast_imageblit - urma:fix log level and pass status 9 - urma: modify log level - !20592 CVE-2025-71141 fixup - !20594 CVE-2025-39744 fixup - !20607 powerpc/64s/slb: Fix SLB multihit issue during SLB preload - !20606 mm/huge_memory: fix NULL pointer deference when splitting folio - !20604 Fix CVE-2026-22984 - !20603 Fix CVE-2026-23021 - !20600 Fix CVE-2026-22990 - urma: fix the jfe uaf issue that occurred during the killall process. - !20380 pswiotlb: Adapt to the IOMMU DMA API upgraded by IOMMUFD - libceph: make free_choose_arg_map() resilient to partial allocation - drm/dp: Change AUX DPCD probe address from LANE0_1_STATUS to TRAINING_PATTERN_SET - net: hns3: extend HCLGE_FD_AD_COUNTER_NUM to 8 bits - net: hns3: extend HCLGE_FD_AD_QID to 11 bits - net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue - net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M - Revert "net: hns3: add support for FD counter" - !20587 dmaengine: stm32: dmamux: fix device leak on route allocation - pmdomain: arm: scmi: Fix genpd leak on provider registration failure - powerpc/64s/slb: Fix SLB multihit issue during SLB preload - mm/huge_memory: fix NULL pointer deference when splitting folio - !20562 LoongArch: BPF: Sign extend kfunc call arguments - !20470 ipv4: Fix reference count leak when using error routes with nexthop objects - !20471 net: sock: fix hardened usercopy panic in sock_recv_errqueue - !20472 net: fix memory leak in skb_segment_list for GRO packets - !20473 ipv4: ip_gre: make ipgre_header() robust - !20469 SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf - !20476 ipv6: Fix use-after-free in inet6_addr_del(). - !20477 svcrdma: bound check rq_pages index in inline path - !20578 ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() - !20579 fix CVE-2025-68768 - !20542 Fix NFS deadlock - USB: storage: Remove subclass and protocol overrides from Novatek quirk - cpuidle: governors: menu: Select polling state in some more cases - cpuidle: governors: menu: Rearrange main loop in menu_select() - cpuidle: menu: Update documentation after previous changes - Revert "drm/tegra: dsi: Clear enable register if powered by bootloader" - parisc: Remove spurious if statement from raw_copy_from_user() - ata: libata-scsi: Fix system suspend for a security locked drive - Revert "drm/amdgpu: fix incorrect vm flags to map bo" - mfd: axp20x: Set explicit ID for regulator cell if no IRQ line is present - drm/amd/display: use udelay rather than fsleep - sched/fair: Revert max_newidle_lb_cost bump - net: ipv4: fix regression in local-broadcast routes - tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers - PM: runtime: Do not clear needs_force_resume with enabled runtime PM - usb: typec: ucsi: psy: Set max current to zero when disconnected - io_uring/rw: cast rw->flags assignment to rwf_t - Documentation: ACPI: i2c-muxes: fix I2C device references - s390/hypfs: Enable limited access during lockdown - s390/hypfs: Avoid unnecessary ioctl registration in debugfs - ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation - net/mlx5e: Preserve shared buffer capacity during headroom updates - net/mlx5: Base ECVF devlink port attrs from 0 - Octeontx2-af: Skip overlap check for SPI field - bonding: send LACPDUs periodically in passive mode after receiving partner's LACPDU - bonding: Add independent control state machine - bonding: update LACP activity flag after setting lacp_active - net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate - ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc - gve: prevent ethtool ops after shutdown - phy: mscc: Fix timestamping for vsc8584 - net: ethernet: mtk_ppe: add RCU lock around dev_fill_forward_path - ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add - net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM - ALSA: usb-audio: Fix size validation in convert_chmap_v3() - mlxsw: spectrum: Forward packets with an IPv4 link-local source IP - Bluetooth: hci_conn: do return error from hci_enhanced_setup_sync() - Bluetooth: hci_event: fix MTU for BN == 0 in CIS Established - scsi: qla4xxx: Prevent a potential error pointer dereference - RDMA/bnxt_re: Fix to initialize the PBL array - RDMA/bnxt_re: Fix to remove workload check in SRQ limit path - RDMA/bnxt_re: Fix to do SRQ armena by default - RDMA/erdma: Fix ignored return value of init_kernel_qp - iosys-map: Fix undefined behavior in iosys_map_clear() - cgroup/cpuset: Use static_branch_enable_cpuslocked() on cpusets_insane_config_key - spi: spi-fsl-lpspi: Clamp too high speed_hz - usb: typec: maxim_contaminant: disable low power mode when reading comparator values - usb: typec: maxim_contaminant: re-enable cc toggle if cc is open and port is clean - iio: imu: inv_icm42600: change invalid data error to -EBUSY - iio: imu: inv_icm42600: Convert to uXX and sXX integer types - iio: imu: inv_icm42600: use = { } instead of memset() - iio: imu: inv_icm42600: switch timestamp type from int64_t __aligned(8) to aligned_s64 - iio: temperature: maxim_thermocouple: use DMA-safe buffer for spi_read() - iio: light: as73211: Ensure buffer holes are zeroed - tls: fix handling of zero-length records on the rx_list - powerpc/boot: Fix build with gcc 15 - mmc: sdhci-pci-gli: GL9763e: Mask the replay timer timeout of AER - compiler: remove __ADDRESSABLE_ASM{_STR,}() again - drm/amd/display: Don't overclock DCE 6 by 15% - usb: dwc3: pci: add support for the Intel Wildcat Lake - usb: dwc3: Ignore late xferNotReady event to prevent halt timeout - USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles - usb: storage: realtek_cr: Use correct byte order for bcs->Residue - USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera - usb: renesas-xhci: Fix External ROM access timeouts - usb: core: hcd: fix accessing unmapped memory in SINGLE_STEP_SET_FEATURE test - comedi: Make insn_rw_emulate_bits() do insn->n samples - usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive - cdx: Fix off-by-one error in cdx_rpmsg_probe() - most: core: Drop device reference after usage in get_channel() - iio: proximity: isl29501: fix buffered read on big-endian systems - iio: pressure: bmp280: Use IS_ERR() in bmp280_common_probe() - fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable() - drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS - cpuidle: governors: menu: Avoid selecting states with too much latency - cpuidle: menu: Remove iowait influence - mmc: sdhci-pci-gli: Add a new function to simplify the code - mmc: sdhci-pci-gli: Use PCI AER definitions, not hard-coded values - mptcp: disable add_addr retransmission when timeout is 0 - mptcp: remove duplicate sk_reset_timer call - use uniform permission checks for all mount propagation changes - arm64: dts: ti: k3-am62-main: Remove eMMC High Speed DDR support - scsi: mpi3mr: Serialize admin queue BAR writes on 32-bit systems - scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers - scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE - PCI: imx6: Add IMX8MM_EP and IMX8MP_EP fixed 256-byte BAR 4 in epc_features - PCI: imx6: Delay link start until configfs 'start' written - PCI: rockchip: Set Target Link Speed to 5.0 GT/s before retraining - PCI: rockchip: Use standard PCIe definitions - drm/amd/display: Fill display clock and vblank time in dce110_fill_display_configs - drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs - drm/amd/display: Fix DP audio DTO1 clock source on DCE 6. - drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3 - ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and EliteBook 830 G6 - mm/debug_vm_pgtable: clear page table entries at destroy_args() - squashfs: fix memory leak in squashfs_fill_super - mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for consistency - memstick: Fix deadlock by moving removing flag earlier - KVM: arm64: Fix kernel BUG() due to bad backport of FPSIMD/SVE/SME fix - sched/fair: Fix frequency selection for non-invariant case - kbuild: userprogs: use correct linker when mixing clang and GNU ld - ata: libata-scsi: Return aborted command when missing sense and result TF - PM: runtime: Take active children into account in pm_runtime_get_if_in_use() - PM: runtime: Simplify pm_runtime_get_if_active() usage - ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig - usb: dwc3: imx8mp: fix device leak at unbind - wifi: mac80211: check basic rates validity in sta_link_apply_parameters - KVM: x86: Take irqfds.lock when adding/deleting IRQ bypass producer - s390/mm: Remove possible false-positive warning in pte_free_defer() - btrfs: send: make fs_path_len() inline and constify its argument - btrfs: send: use fallocate for hole punching with send stream v2 - btrfs: send: avoid path allocation for the current inode when issuing commands - btrfs: send: keep the current inode's path cached - btrfs: send: add and use helper to rename current inode when processing refs - btrfs: send: only use boolean variables at process_recorded_refs() - btrfs: send: factor out common logic when sending xattrs - btrfs: populate otime when logging an inode item - btrfs: constify more pointer parameters - btrfs: fix ssd_spread overallocation - btrfs: open code timespec64 in struct btrfs_inode - xfs: fully decouple XFS_IBULK* flags from XFS_IWALK* flags - btrfs: abort transaction on unexpected eb generation at btrfs_copy_root() - btrfs: always abort transaction on failure to add block group to free space tree - btrfs: move transaction aborts to the error site in add_block_group_free_space() - btrfs: qgroup: fix race between quota disable and quota rescan ioctl - usb: typec: fusb302: cache PD RX state - block: Make REQ_OP_ZONE_FINISH a write operation - block: reject invalid operation in submit_bio_noacct - leds: flash: leds-qcom-flash: Fix registry access after re-bind - leds: flash: leds-qcom-flash: Limit LED current based on thermal condition - selftests/memfd: add test for mapping write-sealed memfd read-only - mm: update memfd seal write check to include F_SEAL_WRITE - mptcp: pm: kernel: flush: do not reset ADD_ADDR limit - mptcp: drop skb if MPTCP skb extension allocation fails - ipv6: sr: Fix MAC comparison to be constant-time - drm/amd/display: Don't overwrite dce60_clk_mgr - drm/amd/display: Add primary plane to commits for correct VRR handling - drm/amdkfd: Destroy KFD debugfs after destroy KFD wq - drm/amdgpu: update mmhub 3.0.1 client id mappings - drm/amdgpu: Avoid extra evict-restore process. - drm/amd: Restore cached power limit during resume - media: venus: venc: Clamp param smaller than 1fps and bigger than 240 - media: venus: vdec: Clamp param smaller than 1fps and bigger than 240. - media: venus: protect against spurious interrupts during probe - media: venus: hfi: explicitly release IRQ during teardown - media: qcom: camss: cleanup media device allocated resource on error path - media: ov2659: Fix memory leaks in ov2659_probe() - media: usbtv: Lock resolution while streaming - media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free() - media: verisilicon: Fix AV1 decoder clock frequency - media: vivid: fix wrong pixel_array control size - media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init() - media: hi556: correct the test pattern configuration - media: gspca: Add bounds checking to firmware parser - parisc: Update comments in make_insert_tlb - parisc: Try to fixup kernel exception in bad_area_nosemaphore path of do_page_fault() - parisc: Rename pte_needs_flush() to pte_needs_cache_flush() in cache.c - parisc: Makefile: explain that 64BIT requires both 32-bit and 64-bit compilers - parisc: Define and use set_pte_at() - parisc: Check region is readable by user in raw_copy_from_user() - soc/tegra: pmc: Ensure power-domains are in a known state - f2fs: fix to avoid out-of-boundary access in dnode page - phy: qcom: phy-qcom-m31: Update IPQ5332 M31 USB phy initialization sequence - vhost/vsock: Avoid allocating arbitrarily-sized SKBs - PCI: endpoint: Fix configfs group removal on driver teardown - PCI: endpoint: Fix configfs group list head handling - mtd: rawnand: renesas: Add missing check after DMA map - mtd: rawnand: fsmc: Add missing check after DMA map - mtd: spinand: propagate spinand_wait() errors from spinand_write_page() - mtd: spi-nor: Fix spi_nor_try_unlock_all() - hwmon: (gsc-hwmon) fix fan pwm setpoint show functions - pwm: mediatek: Fix duty and period setting - pwm: mediatek: Handle hardware enable and clock enable separately - pwm: imx-tpm: Reset counter if CMOD is 0 - wifi: ath11k: fix dest ring-buffer corruption when ring is full - wifi: ath11k: fix source ring-buffer corruption - wifi: ath11k: fix dest ring-buffer corruption - wifi: ath12k: fix dest ring-buffer corruption when ring is full - wifi: ath12k: fix source ring-buffer corruption - wifi: ath12k: fix dest ring-buffer corruption - wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table() - iio: adc: ad_sigma_delta: change to buffer predisable - zynq_fpga: use sgtable-based scatterlist wrappers - scsi: ufs: ufs-pci: Fix default runtime and system PM levels - scsi: ufs: ufs-pci: Fix hibernate state transition for Intel MTL-like host controllers - ata: libata-scsi: Fix ata_to_sense_error() status handling - scsi: mpi3mr: Fix race between config read submit and interrupt completion - dt-bindings: display: sprd,sharkl3-dsi-host: Fix missing clocks constraints - dt-bindings: display: sprd,sharkl3-dpu: Fix missing clocks constraints - arm64: dts: ti: k3-am62-verdin: Enable pull-ups on I2C buses - arm64: dts: ti: k3-am62a7-sk: fix pinmux for main_uart1 - arm64: dts: ti: k3-pinctrl: Enable Schmitt Trigger by default - btrfs: zoned: fix write time activation failure for metadata block group - ext4: fix hole length calculation overflow in non-extent inodes - ext4: don't try to clear the orphan_present feature block device is r/o - ext4: fix reserved gdt blocks handling in fsmap - ext4: fix fsmap end of range reporting with bigalloc - ext4: check fast symlink for ea_inode correctly - tracing: fprobe-event: Sanitize wildcard for fprobe event name - crypto: qat - lower priority for skcipher and aead algorithms - lib/crypto: mips/chacha: Fix clang build and remove unneeded byteswap - vt: defkeymap: Map keycodes above 127 to K_HOLE - vt: keyboard: Don't process Unicode characters in K_OFF mode - bus: mhi: host: Fix endianness of BHI vector table - usb: dwc3: meson-g12a: fix device leaks at unbind - usb: musb: omap2430: fix device leak at unbind - usb: gadget: udc: renesas_usb3: fix device leak at unbind - usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init() - m68k: Fix lost column on framebuffer debug console - platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister() - cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table() - rcu: Fix racy re-initialization of irq_work causing hangs - HID: apple: avoid setting up battery timer for devices without battery - HID: magicmouse: avoid setting up battery timer when not needed - RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages - tools/nolibc: fix spelling of FD_SETBITMASK in FD_* macros - media: uvcvideo: Do not mark valid metadata as invalid - media: venus: Fix OOB read due to missing payload bound check - parisc: Makefile: fix a typo in palo.conf - fbdev: Fix vmalloc out-of-bounds write in fast_imageblit - btrfs: do not allow relocation of partially dropped subvolumes - btrfs: zoned: do not select metadata BG as finish target - btrfs: clear dirty status from extent buffer on error at insert_new_root() - btrfs: zoned: do not remove unwritten non-data block group - btrfs: abort transaction during log replay if walk_log_tree() failed - btrfs: zoned: use filesystem size not disk size for reclaim decision - cdc-acm: fix race between initial clearing halt and open - thunderbolt: Fix copy+paste error in match_service_id() - usb: typec: ucsi: Update power_supply on power role change - misc: rtsx: usb: Ensure mmc child device is active when card is present - iommufd: Report unmapped bytes in the error path of iopt_unmap_iova_range - cifs: reset iface weights when we cannot find a candidate - drm/amdgpu: fix incorrect vm flags to map bo - scsi: lpfc: Remove redundant assignment to avoid memory leak - rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe - pNFS: Handle RPC size limit for layoutcommits - pNFS: Fix disk addr range check in block/scsi layout - pNFS: Fix stripe mapping in block/scsi layout - ASoC: Intel: avs: Fix uninitialized pointer error in probe() - net: phy: smsc: add proper reset flags for LAN8710A - ipmi: Fix strcpy source and destination the same - kconfig: lxdialog: fix 'space' to (de)select options - kconfig: gconf: fix potential memory leak in renderer_edited() - kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed() - ipmi: Use dev_warn_ratelimited() for incorrect message warnings - vfio/mlx5: fix possible overflow in tracking max message size - scsi: aacraid: Stop using PCI_IRQ_AFFINITY - scsi: target: core: Generate correct identifiers for PR OUT transport IDs - scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans - kconfig: nconf: Ensure null termination where strncpy is used - vfio/type1: conditional rescheduling while pinning - kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c - f2fs: check the generic conditions first - exfat: add cluster chain loop check for dir - i2c: Force DLL0945 touchpad i2c freq to 100khz - apparmor: use the condition in AA_BUG_FMT even with debug disabled - dm-table: fix checking for rq stackable devices - dm-mpath: don't print the "loaded" message if registering fails - i3c: master: Initialize ret in i3c_i2c_notifier_call() - i3c: don't fail if GETHDRCAP is unsupported - apparmor: shift ouid when mediating hard links in userns - rtc: ds1307: handle oscillator stop flag (OSF) for ds1341 - i3c: add missing include to internal header - module: Prevent silent truncation of module name in delete_module(2) - md: dm-zoned-target: Initialize return variable r to avoid uninitialized use - soundwire: Move handle_nested_irq outside of sdw_dev_lock - soundwire: amd: serialize amd manager resume sequence during pm_prepare - crypto: octeontx2 - add timeout for load_fvc completion poll - media: uvcvideo: Fix bandwidth issue for Alcor camera - media: usb: hdpvr: disable zero-length read messages - media: tc358743: Increase FIFO trigger level to 374 - media: tc358743: Return an appropriate colorspace from tc358743_set_fmt - media: tc358743: Check I2C succeeded during probe - pinctrl: stm32: Manage irq affinity settings - scsi: mpi3mr: Correctly handle ATA device errors - scsi: mpt3sas: Correctly handle ATA device errors - power: supply: qcom_battmgr: Add lithium-polymer entry - RDMA/core: reduce stack using in nldev_stat_get_doit() - dmaengine: stm32-dma: configure next sg only if there are more than 2 sgs - leds: leds-lp50xx: Handle reg to get correct multi_index - media: v4l2-common: Reduce warnings about missing V4L2_CID_LINK_FREQ control - MIPS: lantiq: falcon: sysctrl: fix request memory check logic - crypto: jitter - fix intermediary handling - watchdog: iTCO_wdt: Report error if timeout configuration fails - MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free} - clk: qcom: ipq5018: keep XO clock always on - hwmon: (emc2305) Set initial PWM minimum value during probe based on thermal state - watchdog: dw_wdt: Fix default timeout - fs/orangefs: use snprintf() instead of sprintf() - phy: rockchip-pcie: Properly disable TEST_WRITE strobe signal - mfd: axp20x: Set explicit ID for AXP313 regulator - clk: tegra: periph: Fix error handling and resolve unsigned compare warning - fbdev: fix potential buffer overflow in do_register_framebuffer() - cifs: Fix calling CIFSFindFirst() for root path without msearch - watchdog: sbsa: Adjust keepalive timeout to avoid MediaTek WS0 race condition - drm/amd/display: Avoid configuring PSR granularity if PSR-SU not supported - drm/amd/display: Only finalize atomic_obj if it was initialized - vhost: fail early when __vhost_add_used() fails - vsock/virtio: Resize receive buffers so that each SKB fits in a 4K page - net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325 - rcu: Fix rcu_read_unlock() deadloop due to IRQ work - drm/amd/display: Avoid trying AUX transactions on disconnected ports - selftests/bpf: Fix a user_ringbuf failure with arm64 64KB page size - bpf: Make reg_not_null() true for CONST_PTR_TO_MAP - uapi: in6: restore visibility of most IPv6 socket options - drm/ttm: Should to return the evict error - drm: renesas: rz-du: mipi_dsi: Add min check for VCLK range - net: ncsi: Fix buffer overflow in fetching version id - ionic: clean dbpage in de-init - wifi: rtlwifi: fix possible skb memory leak in _rtl_pci_init_one_rxdesc() - ptp: Use ratelimite for freerun error message - bpftool: Fix JSON writer resource leak in version command - net: dsa: b53: prevent SWITCH_CTRL access on BCM5325 - net: dsa: b53: prevent DIS_LEARNING access on BCM5325 - net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325 - net: dsa: b53: fix b53_imp_vlan_setup for BCM5325 - gve: Return error for unknown admin queue command - net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs - net: vlan: Make is_vlan_dev() a stub when VLAN is not configured - drm/amd: Allow printing VanGogh OD SCLK levels without setting dpm to manual - dpaa_eth: don't use fixed_phy_change_carrier - wifi: iwlegacy: Check rate_idx range after addition - netmem: fix skb_frag_address_safe with unreadable skbs - powerpc: floppy: Add missing checks after DMA map - wifi: ath12k: Decrement TID on RX peer frag setup error handling - wifi: ath12k: Enable REO queue lookup table feature on QCN9274 hw2.0 - wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`. - wifi: mac80211: update radar_required in channel context after channel switch - drm/amd/display: Fix 'failed to blank crtc!' - wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect - wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd() - wifi: ath12k: Add memset and update default rate value in wmi tx completion - drm/amd/display: Separate set_gsl from set_gsl_source_select - net: fec: allow disable coalescing - net: atlantic: add set_power to fw_ops for atl2 to fix wol - net: thunderbolt: Fix the parameter passing of tb_xdomain_enable_paths()/tb_xdomain_disable_paths() - net: thunderbolt: Enable end-to-end flow control also in transmit - kselftest/arm64: Specify SVE data when testing VL set in sve-ptrace - wifi: mt76: mt7915: mcu: re-init MCU before loading FW patch - wifi: rtw89: Disable deep power saving for USB/SDIO - wifi: rtw89: Fix rtw89_mac_power_switch() for USB - drm/msm: use trylock for debugfs - wifi: mac80211: fix rx link assignment for non-MLO stations - ipv6: mcast: Check inet6_dev->dead under idev->mc_lock in __ipv6_dev_mc_inc(). - (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer - wifi: mac80211: don't complete management TX on SAE commit - sched/fair: Bump sd->max_newidle_lb_cost when newidle balance fails - s390/stp: Remove udelay from stp_sync_clock() - wifi: iwlwifi: mvm: fix scan request validation - um: Re-evaluate thread flags repeatedly - wifi: iwlwifi: mvm: set gtk id also in older FWs - perf/cxlpmu: Remove unintended newline from IRQ name format string - net: phy: micrel: Add ksz9131_resume() - net: thunderx: Fix format-truncation warning in bgx_acpi_match_id() - net: ipv4: fix incorrect MTU in broadcast routes - wifi: cfg80211: Fix interface type validation - net: mctp: Prevent duplicate binds - arm64: Mark kernel as tainted on SAE and SError panic - net/mlx5e: Properly access RCU protected qdisc_sleeping variable - net: ag71xx: Add missing check after DMA map - et131x: Add missing check after DMA map - wifi: rtw89: Lower the timeout in rtw89_fw_read_c2h_reg() for USB - be2net: Use correct byte order and format string for TCP seq and ack_seq - s390/time: Use monotonic clock in get_cycles() - wifi: cfg80211: reject HTC bit for management frames - ktest.pl: Prevent recursion of default variable options - wifi: ath12k: Correct tid cleanup when tid setup fails - net: usb: cdc-ncm: check for filtering capability - xen/netfront: Fix TX response spurious interrupts - Bluetooth: hci_sock: Reset cookie to zero in hci_sock_free_cookie() - powerpc/thp: tracing: Hide hugepage events under CONFIG_PPC_BOOK3S_64 - ASoC: qcom: use drvdata instead of component to keep id - ASoC: codecs: rt5640: Retry DEVICE_ID verification - iio: adc: ad7768-1: Ensure SYNC_IN pulse minimum timing requirement - ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros - ALSA: pcm: Rewrite recalculate_boundary() to avoid costly loop - platform/chrome: cros_ec_typec: Defer probe on missing EC parent - platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches - soc: qcom: mdt_loader: Actually use the e_phoff - imx8m-blk-ctrl: set ISI panic write hurry level - pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop() - usb: core: usb_submit_urb: downgrade type check - usb: typec: intel_pmc_mux: Defer probe if SCU IPC isn't present - ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4 - ASoC: hdac_hdmi: Rate limit logging on connection and disconnection - ALSA: hda: Disable jack polling at shutdown - ALSA: hda: Handle the jack polling always via a work - mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode() - mei: bus: Check for still connected devices in mei_cl_bus_dev_release() - char: misc: Fix improper and inaccurate error code returned by misc_init() - reset: brcmstb: Enable reset drivers for ARCH_BCM2835 - pps: clients: gpio: fix interrupt handling order in remove path - ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path - mmc: sdhci-msm: Ensure SD card power isn't ON when card removed - ACPI: processor: fix acpi_object initialization - PM: sleep: console: Fix the black screen issue - thermal: sysfs: Return ENODATA instead of EAGAIN for reads - PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit() - firmware: tegra: Fix IVC dependency problems - ACPI: PRM: Reduce unnecessary printing to avoid user confusion - selftests: tracing: Use mutex_unlock for testing glob filter - tools/build: Fix s390(x) cross-compilation with clang - gpio: tps65912: check the return value of regmap_update_bits() - iio: adc: ad_sigma_delta: don't overallocate scan buffer - tools/nolibc: define time_t in terms of __kernel_old_time_t - thermal/drivers/qcom-spmi-temp-alarm: Enable stage 2 shutdown when required - ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed - EDAC/synopsys: Clear the ECC counters on init - gpio: wcd934x: check the return value of regmap_update_bits() - remoteproc: imx_rproc: skip clock enable when M-core is managed by the SCU - soc: qcom: rpmh-rsc: Add RSC version 4 support - usb: xhci: Avoid showing errors during surprise removal - usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command - usb: xhci: Avoid showing warnings for dying controller - usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default - selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t - cpufreq: CPPC: Mark driver with NEED_UPDATE_LIMITS flag - platform/x86/amd: pmc: Add Lenovo Yoga 6 13ALC6 to pmc quirk list - usb: xhci: print xhci->xhc_state when queue_command failed - tracefs: Add d_delete to remove negative dentries - securityfs: don't pin dentries twice, once is enough... - fix locking in efi_secret_unlink() - ext2: Handle fiemap on empty files to prevent EINVAL - fs/ntfs3: correctly create symlink for relative path - fs/ntfs3: Add sanity check for file name - better lockdep annotations for simple_recursive_removal() - hfs: fix not erasing deleted b-tree node issue - drbd: add missing kref_get in handle_write_conflicts - udf: Verify partition map count - gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops - nvme-pci: try function level reset on init failure - smb/server: avoid deadlock when linking with ReplaceIfExists - arm64: Handle KCOV __init vs inline mismatches - ptp: prevent possible ABBA deadlock in ptp_clock_freerun() - intel_idle: Allow loading ACPI tables for any family - net: ti: icss-iep: Fix incorrect type for return value in extts_enable() - netfilter: ctnetlink: fix refcount leak on table dump - udp: also consider secpath when evaluating ipsec use for checksumming - KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs - KVM: nVMX: Check vmcs12->guest_ia32_debugctl on nested VM-Enter - KVM: VMX: Extract checking of guest's DEBUGCTL into helper - KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported - KVM: VMX: Handle forced exit due to preemption timer in fastpath - KVM: VMX: Re-enter guest in fastpath for "spurious" preemption timer exits - KVM: x86: Plumb "force_immediate_exit" into kvm_entry() tracepoint - libceph: prevent potential out-of-bounds reads in handle_auth_done() - net: usb: pegasus: fix memory leak in update_eth_regs_async() - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() - !20540 urma: added support for ipoverurma - team: fix check for port enabled in team_queue_override_port_prio_changed() - mm/page_alloc: prevent pcp corruption with SMP=n - !20528 Fix CVE-2025-71083 - KVM: nVMX: Defer SVI update to vmcs01 on EOI when L2 is active w/o VID - KVM: x86: Plumb in the vCPU to kvm_x86_ops.hwapic_isr_update() - KVM: SVM: Set RFLAGS.IF=1 in C code, to get VMRUN out of the STI shadow - smb: client: don't wait for info->send_pending == 0 on error - smb: client: let send_done() cleanup before calling smbd_disconnect_rdma_connection() - ACPI: processor: perflib: Move problematic pr->performance check - ACPI: processor: perflib: Fix initial _PPC limit application - Documentation: ACPI: Fix parent device references - fs: Prevent file descriptor table allocations exceeding INT_MAX - sunvdc: Balance device refcount in vdc_port_mpgroup_check - PCI: Extend isolated function probing to LoongArch - NFSD: detect mismatch of file handle and delegation stateid in OPEN op - net: dpaa: fix device leak when querying time stamp info - net: ti: icss-iep: fix device and OF node leaks at probe - net: mtk_eth_soc: fix device leak at probe - net: enetc: fix device and OF node leak at probe - net: gianfar: fix device leak when querying time stamp info - net: phy: micrel: fix KSZ8081/KSZ8091 cable test - gpio: mlxbf3: use platform_get_irq_optional() - gpio: mlxbf2: use platform_get_irq_optional() - gpio: virtio: Fix config space reading. - ALSA: hda/realtek: Add Framework Laptop 13 (AMD Ryzen AI 300) to quirks - ALSA: hda/realtek: Fix headset mic on HONOR BRB-X - ALSA: usb-audio: Validate UAC3 cluster segment descriptors - rcu: Fix racy re-initialization of irq_work causing hangs - rcu: Fix rcu_read_unlock() deadloop due to IRQ work - drm/tilcdc: Fix removal actions in case of failed probe - drm/tilcdc: request and mapp iomem with devres - urma: fix update topo logic - dmaengine: stm32: dmamux: fix device leak on route allocation - pswiotlb: Adapt to the IOMMU DMA API upgraded by IOMMUFD - null_blk: fix kmemleak by releasing references to fault configfs items - inet: frags: flush pending skbs in fqdir_pre_exit() - inet: frags: add inet_frag_queue_flush() - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() - md/dm-raid: don't clear MD_RECOVERY_FROZEN after setting frozen - md/dm-raid: don't call md_reap_sync_thread() directly - ACPICA: Avoid walking the Namespace if start_node is NULL - arm64: entry: xcall/xint: make asm conditionals compatible with clang IAS - LoongArch: BPF: Sign extend kfunc call arguments - genirq/msi:: Fix kabi break of struct msi_desc - genirq/msi: Store the IOMMU IOVA directly in msi_desc instead of iommu_cookie - NFS: Fix a deadlock involving nfs_release_folio() - Revert "[Huawei] Revert "NFS: fix up nfs_release_folio() to try to release the page"" - urma: added support for ipoverurma - drm/ttm: Avoid NULL pointer deref for evicted BOs - XSched: Update XSched manual - svcrdma: bound check rq_pages index in inline path - ipv6: Fix use-after-free in inet6_addr_del(). - ipv4: ip_gre: make ipgre_header() robust - net: fix memory leak in skb_segment_list for GRO packets - net: sock: fix hardened usercopy panic in sock_recv_errqueue - ipv4: Fix reference count leak when using error routes with nexthop objects - SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf - fbdev: Fix vmalloc out-of-bounds write in fast_imageblit - udp: Deal with race between UDP socket address change and rehash - EDAC/amd64: The width of hash value is 2 bits for Hygon family 18h model 6h processors - x86/tsc: Use topology_max_packages() to get package number - EDAC/amd64: Use unicast instead of broadcast to access the cs_config register - EDAC/amd64: Correct the address translation for hygon family 18h model 4h - KVM: arm64: Mark some header functions as inline - KVM: arm64: Refactor exit handlers - x86/resctrl: Fix memory bandwidth counter width for Hygon CPUs - hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio - !20820 ub/obmm: add sysfs interface for mempool statistics & bugfixes - ub/obmm: fix wrong pxm_numa parameter validation - ub/obmm: Remove unused parameters from obmm_addr_check.c - ub/obmm: Enhance mem_allocator_granu validation - ub/obmm: simplify allocator naming scheme - ub/obmm: fix allow_slow logic and optimize conti_alloc_memory - ub/obmm: add sysfs interface with fine-grained memory statistics - !20804 net: hv_netvsc: reject RSS hash key programming without RX indirection table - !20813 migrate: correct lock ordering for hugetlb file folios - !20812 libceph: make calc_target() set t->paused, not just clear it - !20719 drivers/ub/sentry: some bugfix - !20798 urma: log should not retrieve eid_idx from uctx - !20808 urma: support triple bonding device - urma: log should not retrieve eid_idx from uctx - migrate: correct lock ordering for hugetlb file folios - libceph: make calc_target() set t->paused, not just clear it - !20745 vfio platform VFIO support for hisi05a1 devices - urma: support triple bonding device - net: hv_netvsc: reject RSS hash key programming without RX indirection table - !20789 gic: Add hip09 support for HISILICON_ERRATUM_165010801 - !20726 tracing: Add recursion protection in kernel stack trace recording - !20668 irqchip/gic-v3-its: Avoid truncating memory addresses - !20795 ub: udma: support query and set qos info. - !20791 Migration/urma:optimize performance in live migration. - ub: udma: Support for UE link establishment message. - Migration/urma: optimize performance in live migration. - !20787 ub: cdma: modify the method of assigning values to the structure - !20759 ubcore: hotfix route query for port eid on the same node. - ub: udma: support query and set qos info. - Revert "ub: ubase: Support for RC saved by queue granularity" - ubcore: hotfix route query for port eid on the same node. - !20676 urma: set/get sl - !20765 urma: bugfix of UAF and double free in ubcm - !20778 ub: ubase&unic: Fixes some bugfix in resetting and dfx ability - gic: Add hip09 support for HISILICON_ERRATUM_165010801 - vfio/platform: Add CONFIG_VFIO_HISI05A1 to openeuler_defconfig and turn it on by default - vfio/platform: VFIO support for hisi05a1 devices - ub: cdma: modify the method of assigning values to the structure - urma: set/get sl - ub: ubase: support to query ub dl pkt stats and real-time peak bandwidth - ub: ubase: Support for RC saved by queue granularity - ub: ubase: Traverse mailbox AE events using interrupts and polling. - ub: ubase: Modify ubase ctrlq trace to distinguish between MUE and UE messages - net: unic: The function of dumping himac registers is added. - ub: ubase: Fix MAC is_pfc sync, optimize list ops and code style - ub: ubase: Retain the initial tm qset configuration and restore it - net: unic: Fixed an issue in the bond IP address notification and pause configuration when an exception occurs. - ub: ubase: Add a retransmission function to improve reliability. - net: unic: Increase the readability and reliability of loopback code - net: unic: Synchronize the code modify for ip management and deactivation - net: unic: Increase the readability and reliability of VLAN feature. - net: unic: Added unic DFX log information. - ub: ubase: Add and correct comments for some functions and data structures - net: unic: Notify MAMI when the bond port status changes - ub: ubase: Support for HIMAC reset during ELR reset and Optimize ELR reset - !20768 iommu/ummu-core: Fix separate page table compatibility - !20665 [OLK-6.6] Enhance CMA memory usage reporting for CSV3 - !20764 net: hns3: fix double free issue for tx spare buffer - urma: bugfix of UAF and double free in ubcm - iommu/ummu-core: Fix separate page table compatibility - net: hns3: fix double free issue for tx spare buffer - drivers/ub/sentry: fix memory leak in sentry_msg_helper - drivers/ub/sentry: initialize some variables - drivers/ub/sentry: fix potential buffer overflow in convert_str_to_smh_msg() - drivers/ub/sentry: fix potential null pointer reference in sentry_uvb_comm - drivers/ub/sentry: add input parameter verification for exported symbols - tracing: Add recursion protection in kernel stack trace recording - x86/csv: Enhance CMA memory usage reporting for CSV3 - irqchip/gic-v3-its: Avoid truncating memory addresses - change the package name of 64KB page size kernel to kernel-64k - !20704 kernel support hisi-cca-da - !20180 [virtCCA Live Migration 2]virtcca secure cvm supports live migration - !20905 v2 KVM: arm64: Fix softirq masking in FPSIMD register saving sequence - !20965 iommu/ummu: Optimized TID invalidation and tdev initialization - !20964 iommu/ummu: Support TID and EID Granularity for MPAM - !20970 ub: ubase&unic: Supporting the black box capability of the ubase&unic driver - hisi-cca-da: Start dev by rsi call - hisi-cca-da: Set ripas of the bar region as RIPAS_DEV - hisi-cca-da: Support swiotlb and realm memory use - hisi-cca-da: Add smmu info when dev attach - hisi-cca-da: Transfer realm msix access to rmm - hisi-cca-da: Support pcipc sriov capability - hisi-cca-da: Delay realm memory release to kvm_destroy_realm - hisi-cca-da: Create realm s2 host pgtable and map msi mmio to rmm - hisi-cca-da: Add cca realm s2 pgtable framework - hisi-cca-da: Use bitmap to determine whether the command can be forwarded - hisi-cca-da: Restrict Realm SMMU to stage-2 domain only - hisi-cca-da: Add cmd forward mechanism in realm smmu - hisi-cca-da: Add realm smmu event and gerror irq initialization - hisi-cca-da: Add realm smmu stream table initialization - hisi-cca-da: Add realm smmu cmdq and evtq initialization - hisi-cca-da: Add realm smmu initialization - hisi-cca-da: Add relam iommu support to iommufd - hisi-cca-da: Add realm iommu support for vfio-iommu-type1 - hisi-cca-da: Support dev map and unmap - hisi-cca-da: Support dev validate and dev start - hisi-cca-da: VFIO support ccada - hisi-cca-da: Support dev delegate and dev attach - hisi-cca-da: Support root dev delegate and dev init - hisi-cca-da: Add hisilicon extension smc and ccada cmd - hisi-cca-da: Add hisi ccada feature config - !20751 ARM CCA supports hugepage - !20944 ub: ubmempfd: supports for D2H mapping and demapping - !20888 HiSock Enhancement - ub: ubase&unic: Supporting the black box capability of the ubase&unic driver. - net: unic: Resolve the residual MAC address problem - net: unic: Optimized the code for the cmd structure and FEC function. - ub: ubase: add log for post mailbox timeout - ub: ubus: Remove black box header file to include dir - rme: Remove the secret bit of the vring desc addr - rme: improve hisi-cca data mmap and destroy method - !20943 uvb: fix wd_obtain logic err - !20942 urma: fix bond device id not release - !20892 dcache: Limit the minimal number of bucket to two - rme: isolate page when do delegation to avoid migration - rme: hisi-cca supports different levels for mapping ram - rme: rename ccal to hisi-cca - rme: support set ripas for ccal realm vm - rme: support destroy ram data for ccal realm vm - rme: support populate region for ccal realm vm - rme: support map ram for ccal realm vm - rme: support config ccal realm vm - rme: support ccal RMI calls - rme: realm vm supports wfx handler - !20952 urma: introduce ipourma module - iommu/ummu-core: Simplifies tdev initialization resources - iommu/ummu: Optimized log printing - iommu/ummu: Use passed gfp_mask in map_pages callback - uvb: fix wd_obtain logic err - !20949 ub: udma: support user ctl function. - urma: fix bond device id not release - !20901 drivers/ub/sentry: some bugfix - ub: ubmempfd: supports for D2H mapping and demapping - ub: ubmempfd: supports providing services to the QEMU process through file nodes - [virtCCA Live Migration 2]virtcca secure cvm supports live migration - urma: query priority and enable bit, support ring size configuration - urma: implement debugfs, improve boundary checks and error handling logic - urma: implement data plane interaction and statistics - urma: implement ipourma network device operations - urma: ipourma resource management - urma: ipourma resource management and err code - urma: introduce ipourma main module - iommu/ummu: Optimized the TID invalidation configuration - iommu/ummu: Optimized SVA permission table memory allocation approach - iommu/ummu: Adapt UMMU SVA interface adjustment - iommu/ummu: Support TID and EID Granularity for MPAM - !20848 [OLK-6.6] backport important bugfix for nvme driver from upstream linux-6.6.y - !20847 urma: sl resource query error - !20908 [OLK-6.6][linux-6.6.y sync] Backport 6.6.108-6.6.110 LTS Patches - !20084 Loongarch: Enable CONFIG_CRYPTO_XTS for disk encryption - !20929 PCI: Fix NVMe link speed downgrade to 2.5GT/s during hotplug - drivers/ub/sentry: fix check input parameters - ub: udma: support user ctl function. - ub: udma: support uboe function. - ub: udma: bugfix related to query aux info. - !20935 ub: ubmem_vmmu: supports IOMMU driver for the UB memory MMU in VMs - drivers/ub/sentry: do not use magic numbers - !20876 urma: Kernel-mode specific implementations file for Jetty extension interface - urma: sl resource query error - !20873 sunrpc: fix NULL pointer dereference in rpcb_register_inet6 and rpcb_register_inet4 - !20875 sunrpc: fix race in cache cleanup causing stale nextcheck time - ub: ubmem_vmmu: supports IOMMU driver for the UB memory MMU in VMs - ub: ubmem_vmmu: supports parsing and configuring the hardware node information - ub: ubmem_vmmu: HiSilicon ubmem_vmmu Architecture Implementation - !20806 Fix CVE-2025-71225 - !20896 scsi: qla2xxx: Free sp in error path to fix system crash - !20894 scsi: qla2xxx: Delay module unload while fabric scan in progress - !20893 scsi: qla2xxx: Validate sp before freeing associated memory - !20802 Fix CVE-2026-23110 - urma: Kernel-mode specific implementations file for Jetty extension interface - drivers/ub/sentry: fix memory leak in process_urma_data() - drivers/ub/sentry: initialize some variables - PCI: Fix NVMe link speed downgrade to 2.5GT/s during hotplug - !20770 ub: ubdevshm: supports the memory user to obtain and release shared memory - Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 - mm: consider non-anon swap cache folios in folio_expected_ref_count() - mm: simplify folio_expected_ref_count() - ASoC: qcom: audioreach: fix potential null pointer dereference - gcc-plugins: Remove TODO_verify_il for GCC >= 16 - crypto: sha256 - fix crash at kexec - drm/i915/backlight: Return immediately when scale() finds invalid parameters - minmax.h: remove some #defines that are only expanded once - minmax.h: simplify the variants of clamp() - minmax.h: move all the clamp() definitions after the min/max() ones - minmax.h: use BUILD_BUG_ON_MSG() for the lo < hi test in clamp() - minmax.h: reduce the #define expansion of min(), max() and clamp() - minmax.h: update some comments - minmax.h: add whitespace around operators and after commas - minmax: fix up min3() and max3() too - minmax: improve macro expansion and type checking - minmax: don't use max() in situations that want a C constant expression - minmax: simplify min()/max()/clamp() implementation - minmax: make generic MIN() and MAX() macros available everywhere - drm/ast: Use msleep instead of mdelay for edid read - gpiolib: Extend software-node support to support secondary software-nodes - ARM: bcm: Select ARM_GIC_V3 for ARCH_BRCMSTB - s390/cpum_cf: Fix uninitialized warning after backport of ce971233242b - kmsan: fix out-of-bounds access to shadow memory - afs: Fix potential null pointer dereference in afs_put_server - ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address - i40e: improve VF MAC filters accounting - i40e: add mask to apply valid bits for itr_idx - HID: asus: add support for missing PX series fn keys - drm/gma500: Fix null dereference in hdmi teardown - octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() - net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port - net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() - net: dsa: lantiq_gswip: do also enable or disable cpu port - selftests: fib_nexthops: Fix creation of non-FDB nexthops - net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS - bnxt_en: correct offset handling for IPv6 destination address - vhost: Take a reference on the task in struct vhost_task. - Bluetooth: hci_sync: Fix hci_resume_advertising_sync - ethernet: rvu-af: Remove slash from the driver name - can: peak_usb: fix shift-out-of-bounds issue - can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow - can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow - can: hi311x: populate ndo_change_mtu() to prevent buffer overflow - can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow - bpf: Reject bpf_timer for PREEMPT_RT - can: rcar_can: rcar_can_resume(): fix s2ram with PSCI - wifi: virt_wifi: Fix page fault on connect - cpufreq: Initialize cpufreq-based invariance before subsys - ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients - arm64: dts: imx8mp: Correct thermal sensor index - mm: folio_may_be_lru_cached() unless folio_test_large() - mm/gup: local lru_add_drain() to avoid lru_add_drain_all() - mm/gup: check ref_count instead of lru before migration - mm: add folio_expected_ref_count() for reference count calculation - mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked" - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions - ALSA: usb-audio: Add mute TLV for playback volumes on more devices - ALSA: usb-audio: move mixer_quirks' min_mute into common quirk - ALSA: usb-audio: Add DSD support for Comtrue USB Audio device - i2c: designware: Add quirk for Intel Xe - mmc: sdhci-cadence: add Mobileye eyeQ support - usb: core: Add 0x prefix to quirks debug output - ALSA: usb-audio: Fix build with CONFIG_INPUT=n - ALSA: usb-audio: Convert comma to semicolon - ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 - ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks - ALSA: usb-audio: Simplify NULL comparison in mixer_quirks - ALSA: usb-audio: Avoid multiple assignments in mixer_quirks - ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks - ALSA: usb-audio: Fix block comments in mixer_quirks - firewire: core: fix overlooked update of subsystem ABI version - scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE - !20843 [OLK-6.6][linux-6.6.y sync] Backport 6.6.107-6.6.108 LTS Patches - !20869 ub:hisi-ubus: fix bug of security smatch - !20861 CVE-2026-23163 - ub: ubdevshm: supports the memory user to obtain and release shared memory - ub: ubdevshm: supports granting and revoking shared memory permissions - ub: ubdevshm: supports the registration and deregistration of shared memory segments - ub: ubdevshm: supports the registration and deregistration - KVM: arm64: Fix softirq masking in FPSIMD register saving sequence - !20886 Fix CVE-2026-23205 - !20803 Fix CVE-2026-23112 - !20868 sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure - !20811 smb/server: fix refcount leak in smb2_open() - !20810 smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() - !20809 smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() - sunrpc: fix NULL pointer dereference in rpcb_register_inet6 and rpcb_register_inet4 - sunrpc: fix race in cache cleanup causing stale nextcheck time - scsi: qla2xxx: Free sp in error path to fix system crash - scsi: qla2xxx: Delay module unload while fabric scan in progress - scsi: qla2xxx: Validate sp before freeing associated memory - dcache: Limit the minimal number of bucket to two - !20872 Fix CVE-2026-23220 - !20846 Fix CVE-2026-23193 - !20815 Fix CVE-2026-23216 - !20859 Fix CVE-2026-23179 - !20871 CVE-2026-23096 - !20858 ub: ubase: resolve the cmdq crq overflow problem - bpf: Deprecate hisock unused kfuncs and orig ingress logic - bpf: Add local connect support for hisock - bpf: Add ipv4-mapped ipv6 addr support for hisock - bpf: Add target comm parse to hisock_cmd - bpf: Add multi port parse to hisock_cmd - bpf: Only deploy hisock in server - bpf: Apply BPF_HISOCK_INGRESS to hisock ingress - bpf: Add bpf_handle_ingress/egress_ptype kfunc - bpf: Add bpf_get_skb_ethhdr kfunc - bpf: Add bpf_set_ingress/egress_dev kfunc - bpf: Add bpf_set_ingress_dst kfunc - bpf: Add BPF_HISOCK_INGRESS attach type - cgroup: make cgroup_bpf_prog_attach work when cgroup2 is not mounted - smb: client: fix potential UAF and double free in smb2_open_file() - smb/client: fix memory leak in smb2_open_file() - !20852 ASoC: amd: fix memory leak in acp3x pdm dma ops - ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths - uacce: fix cdev handling in the cleanup path - Revert "uacce: fix for cdev memory leak" - ub:hisi-ubus: fix bug of security smatch - ub:ubus: injected route event - ub:ubus: Black Box Development - !20865 urma: urma support uboe - sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure - urma: urma support uboe - !20857 ub_fwctl driver adds support for querying some functions - ub:ub_fwctl:Add illegal verification for scc - ub:ub_fwctl:Support querying the historical status of port links - drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove - drm/amdkfd: Don't use sw fault filter if retry cam enabled - ub:ub_fwctl:Support querying firmware version numbers - ub: ub_fwctl: Support querying real-time bandwidth statistics - ub:ub_fwctl:Support querying statistical indicators at the ub port and uboe port levels - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() - !20854 [URMA] add ping server for urma_ping - urma: add ping server - ub: ubase: resolve the cmdq crq overflow problem - ub: ubase: Optimized the QoS code naming to improve code readability. - ub: ubase&unic: optimizing code and configuration settings. - net: unic: not support query and configure ip by control plane in UBoE - net: unic: fix the automatically enable uc guid promisc mode. - !20844 urma:kernel header of userctl - urma: Kernel-mode header file for Jetty extension interface - ASoC: amd: fix memory leak in acp3x pdm dma ops - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() - phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again) - ACPICA: Work around bogus -Wstringop-overread warning since GCC 11 - !20835 Fix CVE-2026-23084 - minmax: add a few more MIN_T/MAX_T users - minmax: simplify and clarify min_t()/max_t() implementation - minmax: avoid overly complicated constant expressions in VM code - rtc: pcf2127: fix SPI command byte for PCF2131 backport - xhci: dbc: Fix full DbC transfer ring after several reconnects - xhci: dbc: decouple endpoint allocation from initialization - phy: ti: omap-usb2: fix device leak at unbind - phy: Use device_get_match_data() - drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path - ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message - ASoC: wm8974: Correct PLL rate rounding - ASoC: wm8940: Correct typo in control name - ASoC: wm8940: Correct PLL rate rounding - io_uring: include dying ring in task_work "should cancel" state - io_uring: backport io_should_terminate_tw() - ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx - selftests: mptcp: avoid spurious errors on TCP disconnect - selftests: mptcp: connect: catch IO errors on listen side - rds: ib: Increment i_fastreg_wrs before bailing out - KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active - mmc: mvsdio: Fix dma_unmap_sg() nents value - ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S - ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface - btrfs: tree-checker: fix the incorrect inode ref size check - iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page() - LoongArch: Check the return value when creating kobj - LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled - LoongArch: Update help info of ARCH_STRICT_ALIGN - nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* - octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() - net: liquidio: fix overflow in octeon_init_instr_queue() - bonding: don't set oif to bond dev when getting NS target destination - net/mlx5e: Consider aggregated port speed during rate configuration - i40e: remove redundant memory barrier when cleaning Tx descs - net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure - selftests: mptcp: sockopt: fix error messages - mptcp: tfo: record 'deny join id0' info - mptcp: set remote_deny_join_id0 on SYN recv - dpaa2-switch: fix buffer pool seeding for control traffic - btrfs: fix invalid extref key setup when replaying dentry - pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch - wifi: mac80211: fix incorrect type for ret - wifi: mac80211: increase scan_ies_len for S1G - ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported - !20769 [OLK-6.6][linux-6.6.y sync] Backport 6.6.106-6.6.107 LTS Patches - be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list - !20776 ub:ubfi: Release the chosen node - !20817 CVE-2026-23094 - !20819 dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() - ub:ubus: Add port num check - !20379 [OLK-6.6][sync from OLK-5.10]io_uring: Support forcing sq thread to be idle and woken up by hrtimer - !20830 sched/soft_domain: Increasing NR_MAX_CLUSTER to 32 - sched/soft_domain: Increasing NR_MAX_CLUSTER to 32 - btrfs: fix incorrect readahead expansion length - x86: disable image size check for test builds - drm/i915/power: fix size for for_each_set_bit() in abox iteration - drm/amdgpu: fix a memory leak in fence cleanup when unloading - net: mdiobus: release reset_gpio in mdiobus_unregister_device() - phy: ti-pipe3: fix device leak at unbind - phy: tegra: xusb: fix device and OF node leak at probe - dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate - usb: gadget: midi2: Fix MIDI2 IN EP max packet size - usb: gadget: midi2: Fix missing UMP group attributes initialization - USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels - RISC-V: Remove unnecessary include from compat.h - hrtimer: Rename __hrtimer_hres_active() to hrtimer_hres_active() - hrtimer: Remove unused function - regulator: sy7636a: fix lifecycle of power good gpio - dmaengine: ti: edma: Fix memory allocation size for queue_priority_map - hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr - hsr: use rtnl lock when iterating over ports - net: hsr: Add VLAN CTAG filter support - net: hsr: Add support for MC filtering at the slave device - can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB - can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails - can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed - igb: fix link test skipping when interface is admin down - docs: networking: can: change bcm_msg_head frames member to support flexible array - tunnels: reset the GSO metadata before reusing the skb - net: bridge: Bounce invalid boolopts - net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() - USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions - USB: serial: option: add Telit Cinterion FN990A w/audio compositions - dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks - serial: sc16is7xx: fix bug in flow control levels init - tty: hvc_console: Call hvc_kick in hvc_write unconditionally - Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups" - Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table - Input: iqs7222 - avoid enabling unused interrupts - mm/khugepaged: fix the address passed to notifier on testing young - btrfs: fix corruption reading compressed range when block size is smaller than page size - btrfs: use readahead_expand() on compressed extents - mm/damon/sysfs: fix use-after-free in state_show() - mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing - mtd: nand: raw: atmel: Fix comment in timings preparation - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages - drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time - mm/damon/core: set quota->charged_from to jiffies at first charge window - fuse: prevent overflow in copy_file_range return value - fuse: check if copy_file_range() returns larger than requested size - mtd: rawnand: stm32_fmc2: fix ECC overwrite - mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer - net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups - i2c: i801: Hide Intel Birch Stream SoC TCO WDT - ocfs2: fix recursive semaphore deadlock in fiemap call - mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN - compiler-clang.h: define __SANITIZE_*__ macros only when undefined - EDAC/altera: Delete an inappropriate dma_free_coherent() call - rcu-tasks: Maintain real-time response in rcu_tasks_postscan() - rcu-tasks: Eliminate deadlocks involving do_exit() and RCU tasks - rcu-tasks: Maintain lists to eliminate RCU-tasks/do_exit() deadlocks - s390/cpum_cf: Deny all sampling events by counter PMU - NFSv4/flexfiles: Fix layout merge mirror check. - NFSv4.2: Serialise O_DIRECT i/o and copy range - NFSv4.2: Serialise O_DIRECT i/o and clone range - NFSv4.2: Serialise O_DIRECT i/o and fallocate() - NFS: Serialise O_DIRECT i/o and truncate() - fs/nfs/io: make nfs_start_io_*() killable - ftrace/samples: Fix function size computation - NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server - NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set - media: i2c: imx214: Fix link frequency validation - NFSD: nfsd_unlink() clobbers non-zero status returned from fh_fill_pre_attrs() - nfsd: Fix a regression in nfsd_setattr() - kasan: fix GCC mem-intrinsic prefix with sw tags - kunit: kasan_test: disable fortify string checker on kasan_strings() test - io_uring: fix kabi broken in struct io_ring_ctx - io_uring: Support forcing sq thread to be idle and woken up by hrtimer - dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() - uacce: fix isolate sysfs check condition - Revert "uacce: fix isolate sysfs check condition" - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() - smb/server: fix refcount leak in smb2_open() - smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() - smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() - md: suspend array while updating raid_disks via sysfs - scsi: core: Wake up the error handler when final completions race against each other - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec - ub:ubfi: Release the chosen node - ub:ubus: Delete unused functions - Loongarch: Enable CONFIG_CRYPTO_XTS for disk encryption - Add sw64 support in kernel.spec - !21194 hisi-cca-da: Revert smmu realm enabled condition for arm_smmu_domain_finalise. - !21192 urma: bugfix of ubagg&ubcore&uburma - !21183 platform/x86: classmate-laptop: Add missing NULL pointer checks - urma: bugfix of ubagg&ubcore&uburma - hisi-cca-da: Revert smmu realm enabled condition for arm_smmu_domain_finalise. - platform/x86: classmate-laptop: Add missing NULL pointer checks - !21167 urma: fix kernel codecheck issues. - !21174 urma: change return value for provider err - !21127 urma: copy linked ports when importing bond jetty/seg - !20247 ubcore: query primary eid in ipourma loopback mode. - !21077 Fix hisi cca bugs - ubcore: route query refine and ipo loopback adapt. - hisi-cca-da: Transfer PCIe ECAM access requests to RMM for realm device. - hisi-cca-da: Write NS STE for PF drivers. - hisi-cca-da: Provide IO interfaces - hisi-cca-da: Destroy mmu stage2 pagetable after closing vfio devices - !21045 scsi: hisi_sas: Fix NULL pointer exception when do user_scan() - hisi-cca-da: Automatically unbind PF/VF drivers and prevent probe. - !21165 tools/interference: add ifstool utility for kernel interference statistics - !21166 urma: fix jfce uaf in batch cleanup - !21043 urma: fix tjetty ref in ping server - urma: change return value for provider err - !21128 sched/rt: Skip currently executing CPU in rto_next_cpu() - !21129 procfs: fix missing RCU protection when reading real_parent in do_task_stat() - urma: fix jfce uaf in batch cleanup - !21074 ipmi: Add HiSilicon IPMI Page Soft Offline driver - !21076 [OLK-6.6][linux-6.6.y sync] Backport 6.6.112-6.6.113 LTS Patches - urma: fix kernel codecheck issues. - tools/interference: add ifstool utility for kernel interference statistics - !20291 [Hygon][6.6][Bugfix] Bug fix for EDAC decode address fail issue on Hygon Dhyana processor - !21092 kexec: derive purgatory entry from symbol - !21154 sched: Add SOFT_DOMAIN feature interface for cgroup2 - !21153 fix CVE-2025-39981 - Revert "hisi-cca-da: Delay realm memory release to kvm_destroy_realm" - urma: fix tjetty ref in ping server - rme: Enforce isolation to solve compile error without config CONFIG_HISI_CCA - hisi-cca-da: Improve hisi cca dev validate and delegate - hisi-cca-da: Fix smmu enable rme problem - hisi-cca-da: Fix msi region shared problem - sched: Add SOFT_DOMAIN feature interface for cgroup2 - Bluetooth: MGMT: Fix memory leak in set_ssp_complete - Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete - overflow: Introduce __DEFINE_FLEX for having no initializer - overflow: Fix direct struct member initialization in _DEFINE_FLEX() - overflow: Change DEFINE_FLEX to take __counted_by member - overflow: add DEFINE_FLEX() for on-stack allocs - Bluetooth: MGMT: Fix possible UAFs - Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete() - !21103 Revert "mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()" - !21104 v2 vsock/virtio: cap TX credit to local buffer size - !21070 Fixes CVE-2026-23100 - !21135 RDMA/hns: Support configure and query the CNP DSCP through sysfs - !21088 ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref - RDMA/hns: Support configure and query the CNP DSCP through sysfs - RDMA/hns: Support query FW cap bit - RDMA/hns: Support query HW ID. - !20934 smb/server: fix refcount leak in parse_durable_handle_context() - !21004 regmap: Fix race condition in hwspinlock irqsave routine - !19568 [OLK-6.6]fix txgbe clang compile warning - urma: copy linked ports when importing bond jetty/seg - procfs: fix missing RCU protection when reading real_parent in do_task_stat() - sched/rt: Skip currently executing CPU in rto_next_cpu() - !21073 scsi: qla2xxx: Fix bsg_done() causing double free - !21114 CVE-2024-57979 - !21113 iommu: disable SVA when CONFIG_X86 is set - !20957 dmaengine: xilinx: xdma: Fix regmap max_register - !21087 net: unic: Multiple stability fixes for tx timeout, DFX capability and concurrent activation/reset - pps: Fix a use-after-free - fix kabi - pps: Fix a use-after-free - !21078 of: unittest: Fix memory leak in unittest_data_add() - !21079 *** fix CVE-2026-23208 *** - !21082 ALSA: aloop: Fix racy access at PCM trigger - !21083 bus: fsl-mc: fix use-after-free in driver_override_show() - iommu: disable SVA when CONFIG_X86 is set - vsock/virtio: cap TX credit to local buffer size - Revert "mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()" - !20983 Fix CVE-2026-23139 - !20878 Fix CVE-2026-23230 - kexec: derive purgatory entry from symbol - lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC - PCI/IOV: Fix race between SR-IOV enable/disable and hotplug - Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" - rtc: interface: Alarm race handling should not discard preceding error - perf test stat tests: Fix for virtualized machines - perf test stat: Update test expectations and events - perf test stat: Avoid hybrid assumption when virtualized - writeback: Avoid excessively long inode switching times - writeback: Avoid softlockup when switching many inodes - cramfs: Verify inode mode when loading from disk - fs: Add 'initramfs_options' to set initramfs mount options - minixfs: Verify inode mode when loading from disk - irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume - irqchip/sifive-plic: Make use of __assign_bit() - selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled - s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG - s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL - s390/bpf: Describe the frame using a struct instead of constants - s390/bpf: Centralize frame offset calculations - s390/bpf: Change seen_reg to a mask - ACPI: property: Do not pass NULL handles to acpi_attach_data() - ACPI: property: Add code comments explaining what is going on - ACPI: property: Disregard references in data-only subnode lists - ACPI: battery: Add synchronization between interface updates - ACPI: battery: Check for error code from devm_mutex_init() call - ACPI: battery: initialize mutexes through devm_ APIs - ACPI: battery: allocate driver data through devm_ APIs - arm64: mte: Do not flag the zero page as PG_mte_tagged - ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref - !20790 dm: use bio_clone_blkg_association - ipmi: Add HiSilicon IPMI Page Soft Offline driver - net: unic: Resolve network unavailability caused by concurrent activation and reset - net: unic: Provide the DFX capability for querying MNG table - net: unic: Delete the elr reset process after the tx timeout - bus: fsl-mc: fix use-after-free in driver_override_show() - ALSA: aloop: Fix racy access at PCM trigger - ALSA: usb-audio: Use the right limit for PCM OOB check - ALSA: usb-audio: Prevent excessive number of frames - of: unittest: Fix memory leak in unittest_data_add() - !21034 CVE-2026-23140 - !21016 net: fix segmentation of forwarding fraglist GRO - !21017 mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() - !21018 CVE-2026-23209 - !21019 ipv6: annotate data-race in ndisc_router_discovery() - !20881 ipvlan: Make the addrs_lock be per port - rme: Imporve range delegate - btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() - PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release - PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() - misc: fastrpc: Save actual DMA size in fastrpc_map structure - misc: fastrpc: Add missing dev_err newlines - mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag - mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type - mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value - media: mc: Clear minor number before put device - lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older - ACPICA: Allow to skip Global Lock initialization - ext4: validate ea_ino and size in check_xattrs - ext4: correctly handle queries for metadata mappings - ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() - nfsd: nfserr_jukebox in nlm_fopen should lead to a retry - NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() - mm/damon/vaddr: do not repeat pte_offset_map_lock() until success - mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 - mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations - wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 - wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again - selftests: mptcp: join: validate C-flag + def limit - spi: cadence-quadspi: Flush posted register writes before DAC access - spi: cadence-quadspi: Flush posted register writes before INDAC access - PCI: tegra194: Handle errors in BPMP response - PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() - PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock - PCI: rcar-host: Drop PMSR spinlock - PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit - PCI/AER: Support errors introduced by PCIe r6.0 - PCI/AER: Fix missing uevent on recovery when a reset is requested - PCI/ERR: Fix uevent on failure to recover - PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV - PCI/sysfs: Ensure devices are powered for config reads - PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock - rseq/selftests: Use weak symbol reference, not definition, to link with glibc - rtc: interface: Fix long-standing race when setting alarm - rtc: interface: Ensure alarm irq is enabled when UIE is enabled - memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe - mmc: core: SPI mode remove cmd7 - mtd: rawnand: fsmc: Default to autodetect buswidth - xtensa: simdisk: add input size check in proc_write_simdisk - sparc: fix error handling in scan_one_device() - sparc64: fix hugetlb for sun4u - scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() - sched/deadline: Fix race in push_dl_task() - pwm: berlin: Fix wrong register in suspend/resume - powerpc/pseries/msi: Fix potential underflow and leak issue - powerpc/powernv/pci: Fix underflow and leak issue - power: supply: max77976_charger: fix constant current reporting - pinctrl: samsung: Drop unused S3C24xx driver data - nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk - parisc: don't reference obsolete termio struct for TC* constants - openat2: don't trigger automounts with RESOLVE_NO_XDEV - of: unittest: Fix device reference count leak in of_unittest_pci_node_verify - lib/genalloc: fix device leak in of_gen_pool_get() - KEYS: trusted_tpm1: Compare HMAC values in constant time - iommu/vt-d: PRS isn't usable if PDS isn't supported - iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume - init: handle bootloader identifier in kernel parameters - iio: xilinx-ams: Unmask interrupts after updating alarms - iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK - iio: frequency: adf4350: Fix prescaler usage. - iio: dac: ad5421: use int type to store negative error codes - iio: dac: ad5360: use int type to store negative error codes - fs/ntfs3: Fix a resource leak bug in wnd_extend() - fbdev: Fix logic error in "offb" name match - crypto: rockchip - Fix dma_unmap_sg() nents value - crypto: atmel - Fix dma_unmap_sg() direction - crypto: aspeed - Fix dma_unmap_sg() direction - copy_sighand: Handle architectures where sizeof(unsigned long) < sizeof(u64) - bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() - bus: mhi: ep: Fix chained transfer handling in read path - btrfs: avoid potential out-of-bounds in btrfs_encode_fh() - blk-crypto: fix missing blktrace bio split events - drm/nouveau: fix bad ret code in nouveau_bo_move_prep - drm/rcar-du: dsi: Fix 1/2/3 lane support - media: lirc: Fix error handling in lirc_register() - media: venus: firmware: Use correct reset sequence for IRIS2 - media: pci: ivtv: Add missing check after DMA map - media: mc: Fix MUST_CONNECT handling for pads with no links - media: i2c: mt9v111: fix incorrect type for ret - media: cx18: Add missing check after DMA map - firmware: meson_sm: fix device leak at probe - xen/events: Update virq_to_irq on migration - xen/events: Return -EEXIST for bound VIRQs - xen/manage: Fix suspend error path - xen/events: Cleanup find_virq() return codes - dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required - ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init - arm64: dts: ti: k3-am62a-main: Fix main padcfg length - arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees - arm64: dts: qcom: msm8939: Add missing MDSS reset - arm64: dts: qcom: msm8916: Add missing MDSS reset - ACPI: debug: fix signedness issues in read/write helpers - ACPI: property: Fix buffer properties extraction for subnodes - gpio: wcd934x: mark the GPIO controller as sleeping - tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single - smb: client: fix missing timestamp updates after utime(2) - bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() - drm/amd/display: Properly disable scaling on DCE6 - drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 - drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs - drm/amdgpu: Add additional DCE6 SCL registers - mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes - mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call - tcp: take care of zero tp->window_clamp in tcp_set_rcvlowat() - perf python: split Clang options when invoking Popen - tools build: Align warning options with perf - net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe - drm/vmwgfx: Fix copy-paste typo in validation - net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() - LoongArch: Init acpi_gbl_use_global_lock to false - LoongArch: Remove CONFIG_ACPI_TABLE_UPGRADE in platform_init() - ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size - scsi: mvsas: Fix use-after-free bugs in mvs_work_queue - clk: tegra: do not overallocate memory for bpmp clocks - clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver - clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() - clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() - clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m - perf evsel: Ensure the fallback message is always written to - perf tools: Add fallback for exclude_guest - perf test: Add a test for default perf stat command - perf test: Don't leak workload gopipe in PERF_RECORD_* - perf session: Fix handling when buffer exceeds 2 GiB - perf arm_spe: Correct memory level for remote access - perf arm_spe: Correct setting remote access - rtc: optee: fix memory leak on driver removal - rtc: x1205: Fix Xicor X1205 vendor prefix - perf util: Fix compression checks returning -1 as bool - clk: at91: peripheral: fix return value - libperf event: Ensure tracing data is multiple of 8 sized - perf evsel: Avoid container_of on a NULL leader - asm-generic/io.h: Skip trace helpers if rwmmio events are disabled - iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE - clocksource/drivers/clps711x: Fix resource leaks in error paths - fscontext: do not consume log entries when returning -EMSGSIZE - fs: always return zero on success from replace_fd() - !21067 [OLK-6.6][linux-6.6.y sync] Backport 6.6.111-6.6.112 LTS Patches - scsi: qla2xxx: Fix bsg_done() causing double free - !21065 Fix CVE-2026-23069 - !21062 v4 Support multi-level cgroup - !20987 Fix CVE-2026-23212 - !20982 Fix CVE-2026-23119 - !20979 Fix CVE-2026-23111 - !20974 Fix CVE-2026-23099 - !20973 Fix CVE-2026-23105 - !20972 Fix CVE-2026-23074 - !20884 ksmbd: add chann_lock to protect ksmbd_chann_list xarray - !20947 Fix CVE-2026-23101 - ext4: clear i_state_flags when alloc inode - misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup - Revert "wifi: ath10k: avoid unnecessary wait for service ready message" - fs/ntfs3: fix mount failure for sparse runs in run_unpack() - !20825 efivarfs: fix error propagation in efivar_entry_get() - !20824 io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop - !20950 ub:ubus: protect iterator ue_list and mue_list with ub_bus_sem - mm/rmap: fix two comments related to huge_pmd_unshare() - mm/hugetlb: fix two comments related to huge_pmd_unshare() - mm/hugetlb: fix hugetlb_pmd_shared() - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count - !20728 drivers: Update vendor name of Chengdu NorthLink Technology N5/N6 Series Network Card Drivers - vsock/virtio: fix potential underflow in virtio_transport_get_credit() - !21001 Fix CVE-2026-23229 - usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call - arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode - !20999 Fix CVE-2026-23173 - usb: typec: tipd: Clear interrupts first - bus: fsl-mc: Check return value of platform_get_resource() - remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() - Input: atmel_mxt_ts - allow reset GPIO to sleep - misc: fastrpc: Skip reference for DMA handles - misc: fastrpc: fix possible map leak in fastrpc_put_args - misc: fastrpc: Fix fastrpc_map_lookup operation - nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() - ext4: fix checks for orphan inodes - ksmbd: fix error code overwriting in smb2_get_info_filesystem() - LoongArch: Automatically disable kaslr if boot from kexec_file - mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() - mfd: rz-mtu3: Fix MTU5 NFCR register offset - ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down - ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() - vhost: vringh: Modify the return value check - net/mlx5: fw reset, add reset timeout work - net/mlx5: pagealloc: Fix reclaim race during command interface teardown - net/mlx5: Stop polling for command response if interface goes down - net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable - nfp: fix RSS hash key size when RSS is not supported - mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands - drivers/base/node: fix double free in register_one_node() - hwrng: ks-sa - fix division by zero in ks_sa_rng_init - KEYS: X.509: Fix Basic Constraints CA flag parsing - Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements - Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO - vhost: vringh: Fix copy_to_iter return value check - RDMA/siw: Always report immediate post SQ errors - usb: vhci-hcd: Prevent suspending virtually attached devices - NFSv4.1: fix backchannel max_resp_sz verification check - coresight: trbe: Return NULL pointer for allocation failures - coresight: etm4x: Support atclk - coresight-etm4x: Conditionally access register TRCEXTINSELR - remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice - PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() - vfio/pds: replace bitmap_free with vfree - sparc: fix accurate exception reporting in copy_{from,to}_user for M7 - sparc: fix accurate exception reporting in copy_to_user for Niagara 4 - sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara - sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III - wifi: mac80211: fix Rx packet handling when pubsta information is not available - wifi: ath10k: avoid unnecessary wait for service ready message - Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram - IB/sa: Fix sa_local_svc_timeout_ms read race - RDMA/core: Resolve MAC of next-hop device without ARP support - f2fs: fix zero-sized extent for precache extents - scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() - scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() - scsi: qla2xxx: edif: Fix incorrect sign of error code - ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message - f2fs: fix to truncate first page in error path of f2fs_truncate() - f2fs: fix to update map->m_next_extent correctly in f2fs_map_blocks() - wifi: mt76: fix potential memory leak in mt76_wmac_probe() - RDMA/cm: Rate limit destroy CM ID timeout error message - drivers/base/node: handle error properly in register_one_node() - watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog - ipvs: Use READ_ONCE/WRITE_ONCE for ipvs->enable - iio: consumers: Fix offset handling in iio_convert_raw_to_processed() - iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() - fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist - fs: ntfs3: Fix integer overflow in run_unpack() - drm/msm/dpu: fix incorrect type for ret - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping - ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping - misc: genwqe: Fix incorrect cmd field being reported in error - usb: gadget: configfs: Correctly set use_os_string at bind - usb: phy: twl6030: Fix incorrect type for ret - drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() - tcp: fix __tcp_close() to only send RST when required - PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation - wifi: mwifiex: send world regulatory domain to driver - drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) - drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) - drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) - drm/amd/pm: Adjust si_upload_smc_data register programming (v3) - drm/amd/pm: Fix si_upload_smc_data (v3) - drm/amd/pm: Disable ULV even if unsupported (v3) - drm/amdgpu: Power up UVD 3 for FW validation (v2) - coresight: Only register perf symlink for sinks with alloc_buffer - inet: ping: check sock_net() in ping_get_port() and ping_lookup() - media: st-delta: avoid excessive stack usage - ALSA: lx_core: use int type to store negative error codes - media: rj54n1cb0c: Fix memleak in rj54n1_probe() - scsi: myrs: Fix dma_alloc_coherent() error check - hwrng: nomadik - add ARM_AMBA dependency - crypto: keembay - Add missing check after sg_nents_for_len() - drm/amd/display: Remove redundant semicolons - serial: max310x: Add error checking in probe() - usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls - usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup - phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 - media: zoran: Remove zoran_fh structure - drm/bridge: it6505: select REGMAP_I2C - f2fs: fix condition in __allow_reserved_blocks() - drm/radeon/r600_cs: clean up of dead code in r600_cs - drm/panel: novatek-nt35560: Fix invalid return value - bpf: Enforce expected_attach_type for tailcall compatibility - i2c: designware: Add disabling clocks when probe fails - i2c: designware: Fix clock issue when PM is disabled - i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD - thermal/drivers/qcom/lmh: Add missing IRQ includes - thermal/drivers/qcom: Make LMH select QCOM_SCM - hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems - once: fix race by moving DO_ONCE to separate section - smp: Fix up and expand the smp_call_function_many() kerneldoc - selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported - i3c: master: svc: Recycle unused IBI slot - i3c: master: svc: Use manual response for IBI events - ACPICA: Fix largest possible resource descriptor index - pwm: tiehrpwm: Fix corner case in clock divisor calculation - arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible - arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value - arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names - cpuidle: qcom-spm: fix device and OF node leaks at probe - firmware: firmware: meson-sm: fix compile-test default - arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 - null_blk: Fix the description of the cache_size module argument - pinctrl: renesas: Use int type to store negative error codes - power: supply: cw2015: Fix a alignment coding style issue - PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() - ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property - ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS - ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax - block: use int to store blk_stack_limits() return value - selftests/nolibc: fix EXPECT_NZ macro - regulator: scmi: Use int type to store negative error codes - arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map - ARM: at91: pm: fix MCKx restore routine - pinctrl: meson-gxl: add missing i2c_d pinmux - soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS - leds: flash: leds-qcom-flash: Update torch current clamp setting - ARM: dts: renesas: porter: Fix CAN pin group - libbpf: Fix reuse of DEVMAP - bpf: Remove migrate_disable in kprobe_multi_link_prog_run - bpf/selftests: Fix test_tcpnotify_user - regmap: Remove superfluous check for !config in __regmap_init() - arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 - x86/vdso: Fix output operand size of RDPID - smb: server: fix IRD/ORD negotiation with the client - coresight: trbe: Prevent overflow in PERF_IDX2OFF() - gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote - selftests: arm64: Check fread return value in exec_target - seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast - init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD - filelock: add FL_RECLAIM to show_fl_flags() macro - !21022 KVM: Don't clobber irqfd routing type when deassigning irqfd - !20998 ceph: fix oops due to invalid pointer for kfree() in parse_longname() - !21023 l2tp: avoid one data-race in l2tp_tunnel_del_work() - xsched: fix potential NULL dereference in xsched_quota_timeout_update - xsched: remove the standalone xcu_cfs_cg_deinit() helper - xsched: restructure xcu_cgrp_subsys teardown to align with cpu_cgrp_subsys lifecycle - xsched: simplify root group check by direct comparison with root_xcg - xsched: replace magic number with SCHED_CLASS_MAX_LENGTH for scheduler class string length - xsched/core: immediate cleanup of remaining operators on task exit - xsched: add init_fair_xsched_group() for XCU-specific fair group initialization - xsched: modify xcu_cg_initialize_components helper - xsched: refactor xsched_entity initialization - xsched: change rq_init() parameter from struct xsched_cu to struct xsched_rq - xsched: harden and clarify xcu_move_task() logic - xsched: move throttling-related fields from xsched_group_xcu_priv to xsched_rq_cfs - xsched/quota: add throttled flag to cfs_rq for robust hierarchical enqueue under throttling - xsched/quota: support multi-level cgroup - xsched: remove redundant xcu parameter from dequeue_ctx - xsched: update group shares using xcu_grp_shares_add/sub helpers - xsched: delete unused code - xsched/cfs: propagate group activation/deactivation up the hierarchy - xsched/cfs: move xruntime updates to pick/put paths - xsched: add has_running hook to xsched classes for wake-up eligibility check - !21012 [OLK-6.6][linux-6.6.y sync] Backport 6.6.110-6.6.111 LTS Patches - scsi: hisi_sas: Fix NULL pointer exception when do user_scan() - !21013 CVE-2026-23177 - !21007 bonding: fix use-after-free due to enslave fail after slave array update - !21006 net: Fix CVE-2026-23204 - bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path - bpf, test_run: Subtract size of xdp_frame from allowed metadata size - bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN - bpf: Make variables in bpf_prog_test_run_xdp less confusing - bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K - !21015 libceph: reset sparse-read state in osd_fault() - !21024 ub: udma: bugfix related to print messages. - !20980 Fix CVE-2026-23126 - !20922 Fix CVE-2026-23133 - ub: udma: bugfix related to print messages. - l2tp: avoid one data-race in l2tp_tunnel_del_work() - KVM: Don't clobber irqfd routing type when deassigning irqfd - ipv6: annotate data-race in ndisc_router_discovery() - macvlan: observe an RCU grace period in macvlan_common_newlink() error path - macvlan: fix error recovery in macvlan_common_newlink() - mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() - net: fix segmentation of forwarding fraglist GRO - can: rcar_canfd: Fix CAN-FD mode as default - libceph: reset sparse-read state in osd_fault() - !21008 uvb: fix cis call return value and obtain - mm, shmem: prevent infinite loop on truncate race - mm/shmem, swap: fix race of truncate and swap entry split - net/9p: fix double req put in p9_fd_cancelled - riscv: mm: Do not restrict mmap address based on hint - riscv: mm: Use hint address in mmap if available - driver core/PM: Set power.no_callbacks along with power.no_pm - serial: stm32: allow selecting console when the driver is module - hid: fix I2C read buffer overflow in raw_event() for mcp2221 - ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free - ALSA: usb-audio: Kill timer properly at removal - platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list - can: rcar_canfd: Fix controller mode setting - can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled - btrfs: ref-verify: handle damaged extent root tree - ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue - perf subcmd: avoid crash in exclude_cmds when excludes is empty - platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list - dm-integrity: limit MAX_TAG_SIZE to 255 - ASoC: amd: acp: Adjust pdm gain value - wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 - USB: serial: option: add SIMCom 8230C compositions - media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe - !20931 Fix CVE-2026-23060 - uvb: fix cis call return value and obtain - bonding: fix use-after-free due to enslave fail after slave array update - net/sched: cls_u32: use skb_header_pointer_careful() - net: add skb_header_pointer_careful() helper - regmap: Fix race condition in hwspinlock irqsave routine - crypto: virtio - Add spinlock protection with virtqueue notification - net/mlx5e: TC, delete flows only for existing peers - !20967 net: hns3: modify code of judging if SMMU DMA is enabled - ceph: fix oops due to invalid pointer for kfree() in parse_longname() - !20969 Fix CVE-2026-23125 - !20948 v4 arm64: Add memory poison recovery support for various paths - !20975 CVE-2026-23102 - !20977 v4 support apei_page_offline_policy - bonding: annotate data-races around slave->last_rx - netfilter: nf_conncount: update last_gc only when GC has been performed - bonding: provide a net pointer to __skb_flow_dissect() - netdevsim: fix a race issue related to the operation on bpf_bound_progs list - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() - apei/ghes: Add sysctl interface to control soft-offline page isolation - Revert "mm/memory-failure: support disabling soft offline for HugeTLB pages" - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - arm64/fpsimd: signal: Fix restoration of SVE context - arm64/fpsimd: signal: Consistently read FPSIMD context - arm64/fpsimd: signal: Mandate SVE payload for streaming-mode state - bonding: limit BOND_MODE_8023AD to Ethernet devices - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag - net/sched: Enforce that teql can only be used as root qdisc - sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT - drivers/net: Update vendor name of Chengdu NorthLink Technology N5/N6 Series Network Card Drivers - net: hns3: modify code of judging if SMMU DMA is enabled - dmaengine: xilinx: xdma: Fix regmap max_register - ub:ubus: protect iterator ue_list and mue_list with ub_bus_sem - ub:ubus: Avoid getting empty uent from ubc - ub:hisi-ubus: Use GFP_ATOMIC when alloc memory - arm64: send sig fault for user task when apei_claim_sea fails - arm64: add ras log during do_sea - arm64: move getting valid siaddr to the top of do_sea - arm64: mm: shmem: support poison recovery from shmem_file_read_iter() - arm64: fs: support poison recovery from __kernel_read() - iov_iter: add mc support for copy_page_to_iter - arm64: mm: support recovery from copy_{from/to}_user_page() - iov_iter: get rid of 'copy_mc' flag - leds: led-class: Only Add LED to leds_list when it is fully ready - wifi: ath10k: fix dma_free_coherent() pointer - smb/server: fix refcount leak in parse_durable_handle_context() - ksmbd: add chann_lock to protect ksmbd_chann_list xarray - ipvlan: Make the addrs_lock be per port - smb: client: split cached_fid bitfields to avoid shared-byte RMW races - efivarfs: fix error propagation in efivar_entry_get() - io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop - dm: use bio_clone_blkg_association - RAS/AMD/ATL: fix error nodes per socket on for Hygon Dhyana processor - net: txgbe: fix clang compile warning - !20552 ub: udma: fix some code issues. - !20313 Fix CVE-2025-40220 - !20321 nvme: fix admin request_queue lifetime - !20512 PM / devfreq: hisi: Fix potential UAF in OPP handling - !20544 Fix CVE-2025-71147 - !20548 v4 net: LTS-6.6 backport - !20503 Fix CVE-2025-39713 - !20133 Fix CVE-2025-39721 - !20438 Fix CVE-2025-38659 - !20264 Fix CVE-2025-40277 - !20340 Fix CVE-2025-40271 - !20319 Fix CVE-2025-40237 - !20392 vfs: Don't leak disconnected dentries on umount - !20554 iommu/s390: Implement blocking domain - !20489 [OLK-6.6][linux-6.6.y sync] Backport 6.6.101-6.6.102 LTS Patches - !20513 ACPI: PCC: Fix race condition by removing static qualifier - !20468 drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer - !20483 rcu: Protect ->defer_qs_iw_pending from data race - !20510 drivers/ub/sentry: fix primary eid index value - !20553 ub: cdma: support separated page table feature - ub: udma: fix some code issues. - !20480 iommu/ummu-core: fix error invalidate tid - !20561 iommu/ummu: Add ummu sva independent page table parameter - ub: udma: bugfix related to 2m_hugepage. - ub: udma: support for separate page tables - ub: udma: delete debugfs code. - ub: udma: bugfix related to ctrlq function. - ub: udma: verify get cqe/ae aux info out addr and len. - ub: cdma: support separated page table feature - iommu/ummu: Add ummu sva independent page table parameter - iommu: Adjust PLB refresh timing in 'grant' and 'ungrant' - !20505 Fix CVE-2026-23035 - iommu/s390: Implement blocking domain - drivers/ub/sentry: fix primary eid index value - !20535 libceph: make decode_pool() more resilient against corrupted osdmaps - !20536 mm/page_alloc: change all pageblocks migrate type on coalescing - !20537 mm/secretmem: fix use-after-free race in fault handler - !20538 wifi: avoid kernel-infoleak from struct iw_point - !20539 net: usb: rtl8150: fix memory leak on usb_submit_urb() failure - !20440 PCI/AER: Fix NULL pointer access by aer_info - !20262 Fix CVE-2025-68176 - netfilter: nf_reject: don't leak dst refcount for loopback packets - net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error - page_pool: always add GFP_NOWARN for ATOMIC allocations - virtio-net: fix received length check in big packets - net: bridge: fix use-after-free due to MST port state bypass - vsock: Ignore signal/timeout on connect() if already established - tls: make sure to abort the stream if headers are bogus - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI - xfrm: Duplicate SPI Handling - tls: handle data disappearing from under the TLS ULP - net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing - bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls - Bluetooth: hci_core: Fix use-after-free in vhci_flush() - KEYS: trusted: Fix a memory leak in tpm2_load_cmd - !20237 Fix CVE-2025-68724 - !20459 Fix CVE-2025-71131 - !20525 Fix CVE-2025-68816 - !20529 CVE-2025-68172 - net: usb: rtl8150: fix memory leak on usb_submit_urb() failure - !20370 Revert "Revert "RDMA/hns: Fix mismatch exception rollback"" - wifi: avoid kernel-infoleak from struct iw_point - mm/secretmem: fix use-after-free race in fault handler - mm/page_alloc: change all pageblocks migrate type on coalescing - libceph: make decode_pool() more resilient against corrupted osdmaps - pps: Fix kabi breakage of struct pps_device for last_fetched_ev - sched: Fix kabi breakage of struct task_struct for saved_state - crypto: aspeed - fix double free caused by devm - !20515 Bluetooth: bcsp: receive data only if registered - !20507 Fix CVE-2025-40358 - !20450 ub: ubase&unic: Fix some bug in concurrent process - !20452 iommu/ummu: Fix some bugs and optimize the code implementation - !20451 iommu/ummu: Add the function of creating devices with SVA-separated - !20500 mm: fix the inaccurate memory statistics issue for users - net/mlx5: fw_tracer, Validate format string parameters - Bluetooth: bcsp: receive data only if registered - ACPI: PCC: Fix race condition by removing static qualifier - ACPI: CPPC: Fix missing PCC check for guaranteed_perf - iommu/ummu: Add the function of creating devices with SVA-separated - iommu/ummu-core: fix error invalidate tid - riscv: stacktrace: Disable KASAN checks for non-current tasks - !20497 arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() - !20496 drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies - !20495 iommu/amd: Avoid stack buffer overflow from kernel cmdline - !20494 HID: core: Harden s32ton() against conversion to 0 bits - !20493 iommu: Fix two issues in iommu_copy_struct_from_user() - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv - PM / devfreq: hisi: Fix potential UAF in OPP handling - media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() - !20487 interference: Fix uninitialized ifs_clock compiling issue - MIPS: mm: kmalloc tlb_vpn array to avoid stack overflow - MIPS: mm: Prevent a TLB shutdown on initial uniquification - mm: fix the inaccurate memory statistics issue for users - mm: add config option for atomic mode in mm counter - Revert "mm: fix the inaccurate memory statistics issue for users" - !20444 net/mlx5e: Fix crash on profile change rollback failure - !20442 net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv - arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() - drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies - iommu/amd: Avoid stack buffer overflow from kernel cmdline - HID: core: Harden s32ton() against conversion to 0 bits - iommu: Fix two issues in iommu_copy_struct_from_user() - SUNRPC: call xs_sock_process_cmsg for all cmsg - flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read - !20374 [OLK 6.6]Use Hygon IBRS and IBPB rather than software-based mitigation to mitigate Retbleed and SRSO. - !20227 Rename leapioraid to leapraid and release v2.0 - mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery - MIPS: mm: tlb-r4k: Uniquify TLB entries on init - x86/fpu: Delay instruction pointer fixup until after warning - ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx() - ALSA: intel_hdmi: Fix off-by-one error in __hdmi_lpe_audio_probe() - x86/sev: Evict cache lines during SNP memory validation - net: usbnet: Fix the wrong netif_carrier_on() call - net: usbnet: Avoid potential RCU stall on LINK_CHANGE event - Bluetooth: btusb: Add USB ID 3625:010b for TP-LINK Archer TX10UB Nano - sched,freezer: Remove unnecessary warning in __thaw_task - freezer,sched: Clean saved_state when restoring it during thaw - freezer,sched: Do not restore saved_state of a thawed task - freezer,sched: Use saved_state to reduce some spurious wakeups - sched/core: Remove ifdeffery for saved_state - i2c: stm32f7: unmap DMA mapped buffer - i2c: stm32f7: simplify status messages in case of errors - i2c: stm32f7: perform most of irq job in threaded handler - i2c: stm32f7: use dev_err_probe upon calls of devm_request_irq - i2c: stm32f7: Use devm_clk_get_enabled() - USB: serial: option: add Foxconn T99W709 - smb: server: Fix extension string in ksmbd_extract_shortname() - ksmbd: fix corrupted mtime and ctime in smb2_open - ksmbd: fix Preauh_HashValue race condition - ksmbd: fix null pointer dereference error in generate_encryptionkey - vsock: Do not allow binding to VMADDR_PORT_ANY - selftests/perf_events: Add a mmap() correctness test - smb: client: return an error if rdma_connect does not return within 5 seconds - smb: client: let recv_done() cleanup before notifying the callers. - smb: client: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already - smb: client: make use of common smbdirect_socket - smb: smbdirect: add smbdirect_socket.h - smb: client: Correct typos in multiple comments across various files - smb: client: Use min() macro - smb: server: let recv_done() avoid touching data_transfer after cleanup/move - smb: server: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already - ALSA: hda/ca0132: Fix missing error handling in ca0132_alt_select_out() - irqchip: Build IMX_MU_MSI only on ARM - net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing - sunrpc: fix client side handling of tls alerts - net/sched: taprio: enforce minimum value for picos_per_byte - net: drop UFO packets in udp_rcv_segment() - ipv6: reject malicious packets in ipv6_gso_segment() - net/mlx5: Correctly set gso_segs when LRO is used - netlink: specs: ethtool: fix module EEPROM input/output arguments - net: ipa: add IPA v5.1 and v5.5 to ipa_version_string() - phy: mscc: Fix parsing of unicast frames - netpoll: prevent hanging NAPI when netcons gets enabled - md/md-cluster: handle REMOVE message earlier - NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY - NFS: Fix wakeup of __nfs_lookup_revalidate() in unblock_revalidate() - sched: Add test_and_clear_wake_up_bit() and atomic_dec_and_wake_up() - pNFS/flexfiles: don't attempt pnfs on fatal DS errors - PCI: pnv_php: Fix surprise plug detection and recovery - powerpc/eeh: Export eeh_unfreeze_pe() - PCI: pnv_php: Work around switches with broken presence detection - kconfig: qconf: fix ConfigList::updateListAllforAll() - scsi: sd: Make sd shutdown issue START STOP UNIT appropriately - scsi: ufs: core: Use link recovery when h8 exit fails during runtime resume - scsi: Revert "scsi: iscsi: Fix HW conn removal use after free" - scsi: mpt3sas: Fix a fw_event memory leak - vfio/pci: Separate SR-IOV VF dev_set - vfio/pds: Fix missing detach_ioas op - vfio: Prevent open_count decrement to negative - vfio: Fix unbalanced vfio_df_close call in no-iommu mode - f2fs: fix to calculate dirty data during has_not_enough_free_secs() - f2fs: fix to update upper_p in __get_secs_required() correctly - f2fs: vm_unmap_ram() may be called from an invalid context - f2fs: fix to avoid out-of-boundary access in devs.path - f2fs: doc: fix wrong quota mount option description - f2fs: fix KMSAN uninit-value in extent_info usage - rtc: rv3028: fix incorrect maximum clock rate handling - rtc: pcf8563: fix incorrect maximum clock rate handling - rtc: pcf85063: fix incorrect maximum clock rate handling - rtc: nct3018y: fix incorrect maximum clock rate handling - rtc: hym8563: fix incorrect maximum clock rate handling - rtc: ds1307: fix incorrect maximum clock rate handling - ucount: fix atomic_long_inc_below() argument type - module: Restore the moduleparam prefix length check - apparmor: fix loop detection used in conflicting attachment resolution - apparmor: ensure WB_HISTORY_SIZE value is a power of 2 - bpf: Check netfilter ctx accesses are aligned - bpf: Check flow_dissector ctx accesses are aligned - vhost-scsi: Fix log flooding with target does not exist errors - mtd: rawnand: atmel: set pmecc data setup time - mtd: rawnand: rockchip: Add missing check after DMA map - mtd: rawnand: atmel: Fix dma_mapping_error() address - jfs: fix metapage reference count leak in dbAllocCtl - crypto: qat - fix seq_file position update in adf_ring_next() - crypto: qat - fix DMA direction for compression on GEN2 devices - perf tools: Remove libtraceevent in .gitignore - sh: Do not use hyphen in exported variable name - ASoC: fsl_xcvr: get channel status data when PHY is not exists - dmaengine: nbpfaxi: Add missing check after DMA map - dmaengine: mv_xor: Fix missing check after DMA map and missing unmap - fs/orangefs: Allow 2 more characters in do_c_string() - PCI: endpoint: pci-epf-vntb: Fix the incorrect usage of __iomem attribute - soundwire: stream: restore params when prepare ports fail - crypto: img-hash - Fix dma_unmap_sg() nents value - crypto: keembay - Fix dma_unmap_sg() nents value - hwrng: mtk - handle devm_pm_runtime_enable errors - watchdog: ziirave_wdt: check record length in ziirave_firm_verify() - scsi: isci: Fix dma_unmap_sg() nents value - scsi: mvsas: Fix dma_unmap_sg() nents value - scsi: elx: efct: Fix dma_unmap_sg() nents value - scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value - clk: sunxi-ng: v3s: Fix de clock definition - perf tests bp_account: Fix leaked file descriptor - kernel: trace: preemptirq_delay_test: use offstack cpu mask - crypto: inside-secure - Fix `dma_unmap_sg()` nents value - perf sched: Fix memory leaks in 'perf sched latency' - perf sched: Fix memory leaks for evsel->priv in timehist - perf sched: Free thread->priv using priv_destructor - perf dso: Add missed dso__put to dso__load_kcore - perf tools: Fix use-after-free in help_unknown_cmd() - Fix dma_unmap_sg() nents value - clk: clk-axi-clkgen: fix fpfd_max frequency for zynq - fanotify: sanitize handle_type values when reporting fid - pinctrl: sunxi: Fix memory leak on krealloc failure - PCI: endpoint: pci-epf-vntb: Return -ENOENT if pci_epc_get_next_free_bar() fails - crypto: arm/aes-neonbs - work around gcc-15 warning - power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set - power: supply: cpcap-charger: Fix null check for power_supply_get_by_name - clk: xilinx: vcu: unregister pll_post only if registered correctly - media: v4l2-ctrls: Fix H264 SEPARATE_COLOUR_PLANE check - mtd: fix possible integer overflow in erase_xfer() - crypto: marvell/cesa - Fix engine load inaccuracy - crypto: qat - use unmanaged allocation for dc_data - crypto: sun8i-ce - fix nents passed to dma_unmap_sg() - PCI: rockchip-host: Fix "Unexpected Completion" log message - bpf/preload: Don't select USERMODE_DRIVER - ipv6: annotate data-races around rt->fib6_nsiblings - ipv6: fix possible infinite loop in fib6_info_uses_dev() - vrf: Drop existing dst reference in vrf_ip6_input_dst - selftests: rtnetlink.sh: remove esp4_offload after test - net/mlx5e: Clear Read-Only port buffer size in PBMC before update - netfilter: xt_nfacct: don't assume acct name is null-terminated - can: kvaser_usb: Assign netdev.dev_port based on device channel index - can: kvaser_pciefd: Store device channel index - can: peak_usb: fix USB FD devices potential malfunction - tools/rv: Do not skip idle in trace - Bluetooth: hci_event: Mask data status from LE ext adv reports - kcsan: test: Initialize dummy variable - wifi: mac80211: Write cnt before copying in ieee80211_copy_rnr_beacon() - wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE - wifi: ath12k: fix endianness handling while accessing wmi service bit - wifi: mac80211: Check 802.11 encaps offloading in ieee80211_tx_h_select_key() - wifi: mac80211: Don't call fq_flow_idx() for management frames - wifi: mac80211: Do not schedule stopped TXQs - wifi: plfxlc: Fix error handling in usb driver probe - wifi: mac80211: reject TDLS operations when station is not associated - iommu/amd: Fix geometry.aperture_end for V2 tables - mwl8k: Add missing check after DMA map - wifi: rtl8xxxu: Fix RX skb size for aggregation disabled - tcp: call tcp_measure_rcv_mss() for ooo packets - xen/gntdev: remove struct gntdev_copy_batch from stack - net_sched: act_ctinfo: use atomic64_t for three counters - net/sched: Restrict conditions for adding duplicating netems to qdisc tree - um: rtc: Avoid shadowing err in uml_rtc_start() - arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX - netfilter: nf_tables: adjust lockdep assertions handling - netfilter: nf_tables: Drop dead code from fill_*_info routines - fbcon: Fix outdated registered_fb reference in comment - drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value - m68k: Don't unregister boot console needlessly - drm/msm/dpu: Fill in min_prefill_lines for SC8180X - kselftest/arm64: Fix check for setting new VLs in sve-ptrace - net: dst: annotate data-races around dst->input - tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range - wifi: ath11k: clear initialized flag for deinit-ed srng lists - iwlwifi: Add missing check for alloc_ordered_workqueue - wifi: iwlwifi: Fix memory leak in iwl_mvm_init() - wifi: rtl818x: Kill URBs before clearing tx status queue - wifi: rtw89: avoid NULL dereference when RX problematic packet on unsupported 6 GHz band - caif: reduce stack size, again - bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure - drm/vmwgfx: Fix Host-Backed userspace on Guest-Backed kernel - net: ipv6: ip6mr: Fix in/out netdev to pass to the FORWARD chain - selftests/bpf: fix signedness bug in redir_partial() - bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls - bpf, sockmap: Fix psock incorrectly pointing to sk - drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed - staging: nvec: Fix incorrect null termination of battery manufacturer - interconnect: qcom: sc8180x: specify num_nodes - interconnect: qcom: sc8280xp: specify num_links for qnm_a1noc_cfg - soc: qcom: pmic_glink: fix OF node leak - samples: mei: Fix building on musl libc - cpufreq: Initialize cpufreq-based frequency-invariance later - cpufreq: intel_pstate: Always use HWP_DESIRED_PERF in passive mode - arm64: dts: imx8mn-beacon: Fix HS400 USDHC clock speed - arm64: dts: imx8mm-beacon: Fix HS400 USDHC clock speed - ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface - soc/tegra: cbb: Clear ERR_FORCE register with ERR_STATUS - arm: dts: ti: omap: Fixup pinheader typo - usb: early: xhci-dbc: Fix early_ioremap leak - powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw() - pps: fix poll support - staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() - spi: stm32: Check for cfg availability in stm32_spi_probe - usb: misc: apple-mfi-fastcharge: Make power supply names unique - usb: host: xhci-plat: fix incorrect type for of_match variable in xhci_plat_probe() - ARM: dts: vfxxx: Correctly use two tuples for timer address - arm64: dts: qcom: msm8976: Make blsp_dma controlled-remotely - arm64: dts: qcom: sc7180: Expand IMEM region - arm64: dts: qcom: sdm845: Expand IMEM region - soc: qcom: QMI encoding/decoding for big endian - selftests: Fix errno checking in syscall_user_dispatch test - ASoC: mediatek: use reserved memory or enable buffer pre-allocation - gfs2: No more self recovery - Revert "fs/ntfs3: Replace inode_trylock with inode_lock" - hfs: make splice write available again - hfsplus: make splice write available again - ublk: use vmalloc for ublk_device's __queues - fs_context: fix parameter name in infofc() macro - audit,module: restore audit logging in load failure case - ASoC: amd: yc: add DMI quirk for ASUS M6501RM - ASoC: Intel: fix SND_SOC_SOF dependencies - ASoC: amd: yc: Add DMI entries to support HP 15-fb1xxx - ethernet: intel: fix building with large NR_CPUS - ASoC: amd: yc: Add DMI quirk for HP Laptop 17 cp-2033dx - interference: Fix uninitialized ifs_clock compiling issue - iommu/ummu: optimize log printing - !20455 Fix compilation failure caused by PR#20174 - !20302 CVE-2026-22980 - !20142 CVE-2025-68803 - !20261 ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency - !20435 fix CVE-2026-22998 - !20433 scsi: target: Reset t_task_cdb pointer in error case - !20432 scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" - !20431 block: Use RCU in blk_mq_[un - !20307 tpm: Cap the number of PCR banks - !20062 xfs: Add xfs_dir3_leaf_header_check() in leaf/leafn read - !20157 v2 md: backport from mainline - rcu: Protect ->defer_qs_iw_pending from data race - platform/x86/intel/pmt: fix compilation failure caused by PR#20174 - iommu/ummu: optimize kv cache memory management - iommu/ummu: optimize permission table management - iommu/ummu: remove check for eid_type while del eid - iommu/ummu: optimize the code implementation - drivers/perf: fix ummu-pmu data reading exception - iommu/ummu: IOMMU_DOMAIN_BLOCKED type don not sync tct - drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer - crypto: seqiv - Do not use req->iv after crypto_aead_encrypt - net: unic: Notify mami of the bond ip change. - ub: ubase: Support for UE link by ctrlq message - ub: ubase: send a deactivate req in removing - ub: ubase: Querying TPG/TP contexts in the chip is no longer supported after enabling safe mode. - ub: ubase: Use an independent thread for the ctrlq workqueue. - !20368 ubcore: fix logging and permission for route query. - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id - !20344 ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr - net: unic: Fix the ummu 0xa event that occurs when modifying queues and resetting concurrent scenarios - ub: ubase: Add KABI compatibility - ub: ubase: fixing the issue of cdma ctp_req_vl parameter configuration - ub: ubase: add PMU IDEV interrupt supported abilities. - ub: ubase: Delete the tid mask for eq, jfs, jfr, and jfc context - ub: ubase: Set the completion event interrupt to auto - net: unic: fix poll tx read old skb cause a UAF bug - !20249 Fix CVE-2025-38489 - !20250 Fix CVE-2025-38480 - !20378 Fix CVE-2025-39838 - !20430 Fix CVE-2025-39942 - !20351 Fix CVE-2025-71149 - !20375 Fix CVE-2025-71150 - !20323 Fix CVE-2025-38730 - !20320 Fix CVE-2025-68814 - !20314 Fix CVE-2025-71072 - !20315 Fix CVE-2025-68794 - !20403 bpf: Check skb->transport_header is set in bpf_skb_check_mtu - !20402 bpf: Do not let BPF test infra emit invalid GSO types to stack - !20401 tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() - !20400 netfilter: nft_ct: add seqadj extension for natted connections - !20399 net: xfrm: Fix CVE-2025-40215 - !20398 net/sched: sch_qfq: Fix null-deref in agg_dequeue - !20397 bpf: Reject narrower access to pointer ctx fields - !20396 Bluetooth: eir: Fix possible crashes on eir_create_adv_data - !20394 IB/mlx5: Fix potential deadlock in MR deregistration - !20367 ub: cdma: cdma uaf bugfix - net/mlx5e: Fix crash on profile change rollback failure - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv - PCI/AER: Fix NULL pointer access by aer_info - gfs2: No more self recovery - drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE - crypto: qat - flush misc workqueue during device shutdown - !20174 Backport PMT spec 3.0 support - !20366 [Hygon][6.6][Bugfix]: Resolve FPU state corruption between atomic and non-atomic contexts - !19814 [OLK-6.6] Batch flushing user memory encrytion status change - !20393 [OLK-6.6][linux-6.6.y sync] Backport 6.6.100-6.6.101 LTS Patches - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec - nvmet-tcp: remove boilerplate code - scsi: target: Reset t_task_cdb pointer in error case - scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" - block: Use RCU in blk_mq_[un]quiesce_tagset() instead of set->tag_list_lock - ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size - ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer - smb: server: let recv_done() consistently call put_recvmsg/smb_direct_disconnect_rdma_connection - smb: server: remove separate empty_recvmsg_queue - !20384 ub:ubus: Fix ubus link message and pool device error - !20389 gfs2: Prevent recursive memory reclaim - !20388 *** fix CVE-2025-38062 *** - !20387 KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced - !20386 pinctrl: check the return value of pinmux_ops::get_function_name() - !20385 iommu/amd/pgtbl: Fix possible race while increase page table level - ub:ubus: Not cfg access during surprise down - ub:hisi-ubus: Delete validate_pa err print - PCI: cadence: Check for the existence of cdns_pcie::ops before using it - can: netlink: can_changelink(): allow disabling of automatic restart - Revert "selftests/bpf: Add a cgroup prog bpf_get_ns_current_pid_tgid() test" - drm/sched: Remove optimization that causes hang when killing dependent jobs - ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS - bpf: Check skb->transport_header is set in bpf_skb_check_mtu - bpf: Do not let BPF test infra emit invalid GSO types to stack - tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() - netfilter: nft_ct: add seqadj extension for natted connections - xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added - xfrm: delete x->tunnel as we delete x - x86/hw-vuln:Support hardware-based mitigation for Retbleed and SRSO via Hygon IBRS to avoid performance degradation caused by software-based mitigation. - net/sched: sch_qfq: Fix null-deref in agg_dequeue - bpf: Reject narrower access to pointer ctx fields - Bluetooth: eir: Fix possible crashes on eir_create_adv_data - IB/mlx5: Fix potential deadlock in MR deregistration - ub:ubus: Fix ubus link message and pool device error - ub:hisi-ubus: cq poller maximum handle 64 cqe per time - ub:hisi-ubus:Fix vdm message print error - ub:ubus:Fix ubus interrupt release issue - wifi: mt76: mt7921: prevent decap offload config before STA initialization - mtd: rawnand: qcom: Fix last codeword read in qcom_param_page_type_exec() - iio: hid-sensor-prox: Restore lost scale assignments - iio: hid-sensor-prox: Fix incorrect OFFSET calculation - crypto: powerpc/poly1305 - add depends on BROKEN for now - erofs: address D-cache aliasing - drm/i915/dp: Fix 2.7 Gbps DP_LINK_BW value on g4x - ALSA: hda: Add missing NVIDIA HDA codec IDs - ALSA: hda/tegra: Add Tegra264 support - comedi: comedi_test: Fix possible deletion of uninitialized timers - usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach - usb: typec: tcpm: allow switching to mode accessory to mux properly - usb: typec: tcpm: allow to use sink in accessory mode - drm/amdkfd: Don't call mmput from MMU notifier callback - mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n - selftests: mptcp: connect: also cover checksum - selftests: mptcp: connect: also cover alt modes - resource: fix false warning in __request_region() - gve: Fix stuck TX queue for DQ queue format - e1000e: ignore uninitialized checksum word on tgp - e1000e: disregard NVM checksum on tgp when valid checksum bit is not set - dpaa2-switch: Fix device reference count leak in MAC endpoint handling - dpaa2-eth: Fix device reference count leak in MAC endpoint handling - ALSA: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx - sprintf.h requires stdarg.h - bus: fsl-mc: Fix potential double device reference in fsl_mc_get_endpoint() - i2c: virtio: Avoid hang by using interruptible completion wait - i2c: tegra: Fix reset error handling with ACPI - platform/x86: ideapad-laptop: Fix kbd backlight not remembered among boots - can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode - can: dev: can_restart(): move debug message and stats after successful restart - can: dev: can_restart(): reverse logic to remove need for goto - i40e: When removing VF MAC filters, only check PF-set MAC - i40e: report VF tx_dropped with tx_errors instead of tx_discards - i40e: Add rx_missed_errors for buffer exhaustion - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch - net/mlx5: Fix memory leak in cmd_exec() - staging: vchiq_arm: Make vchiq_shutdown never fail - x86/hyperv: Fix usage of cpu_online_mask to get valid cpu - regmap: fix potential memory leak of regmap_bus - iio: adc: ad7949: use spi_is_bpw_supported() - interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1 node - RDMA/core: Rate limit GID cache warning messages - virtio_ring: Fix error reporting in virtqueue_resize - !20348 [OLK-6.6][linux-6.6.y sync] Backport 6.6.99-6.6.100 LTS Patches - !20346 tracing: Fix crash on synthetic stacktrace field usage - vfs: Don't leak disconnected dentries on umount - !20334 Fix CVE-2025-68780 - gfs2: Prevent recursive memory reclaim - amd/amdkfd: enhance kfd process check in switch partition - drm/amdkfd: allow compute partition mode switch with cgroup exclusions - KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced - pinctrl: check the return value of pinmux_ops::get_function_name() - iommu/amd/pgtbl: Fix possible race while increase page table level - !19966 nvme-fc: use lock accessing port_state and rport state - ASoC: fsl_sai: replace regmap_write with regmap_update_bits - comedi: Fix use of uninitialized data in insn_rw_emulate_bits() - cifs: prevent NULL pointer dereference in UTF16 conversion - ksmbd: Fix refcount leak when invalid session is found on session lookup - ubcore: fix logging and permission for route query. - !20232 driver/coda: VirtCCA supports MSI device DA - Revert "Revert "RDMA/hns: Fix mismatch exception rollback"" - !20197 ub: udma&ubase: fix a bug that caused long reboot time - x86: Resolve FPU state corruption between atomic and non-atomic contexts - ub: cdma: cdma uaf bugfix - ub: cdma: jfs call trace bugfix - !20353 x86/fpu: Clear XSTATE_BV[i - s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again - KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls - nvmem: layouts: u-boot-env: remove crc32 endianness conversion - i2c: omap: fix deprecated of_property_read_bool() use - ASoC: fsl_sai: Force a software reset when starting in consumer mode - regulator: pwm-regulator: Manage boot-on with disabled PWM channels - regulator: pwm-regulator: Calculate the output voltage for disabled PWMs - i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe() - i2c: omap: Fix an error handling path in omap_i2c_probe() - i2c: omap: Add support for setting mux - usb: dwc3: qcom: Don't leave BCR asserted - usb: hub: Don't try to recover devices lost during warm reset. - usb: hub: Fix flushing of delayed work used for post resume purposes - usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm - usb: hub: fix detection of high tier USB3 devices behind suspended hubs - arm64: Filter out SME hwcaps when FEAT_SME isn't implemented - ipv6: make addrconf_wq single threaded - !20354 cpufreq/sched: Explicitly synchronize limits_changed flag handling - sched/deadline: only set free_cpus for online runqueues - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 - cpufreq/sched: Explicitly synchronize limits_changed flag handling - io_uring/poll: correctly handle io_poll_add() return value on update - shmem: fix recovery on rename failures - io_uring: fix filename leak in __io_openat_prep() - Revert "cgroup_freezer: cgroup_freezing: Check if not frozen" - rxrpc: Fix transmission of an abort in response to an abort - rxrpc: Fix recv-recv race of completed call - net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree - net: bridge: Do not offload IGMP/MLD messages - hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf - netfilter: nf_conntrack: fix crash due to removal of uninitialised entry - ipv6: mcast: Delay put pmc->idev in mld_del_delrec() - net/mlx5: Correctly set gso_size when LRO is used - Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID - Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout - Bluetooth: SMP: If an unallowed command is received consider it a failure - Bluetooth: hci_sync: fix connectable extended advertising when using static random address - hwmon: (corsair-cpro) Validate the size of the received input buffer - selftests: net: increase inter-packet timeout in udpgro.sh - wifi: cfg80211: remove scan request n_channels counted_by - nvme: fix misaccounting of nvme-mpath inflight I/O - net: phy: Don't register LEDs for genphy - nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list() - rpl: Fix use-after-free in rpl_do_srh_inline(). - block: fix kobject leak in blk_unregister_queue - net: emaclite: Fix missing pointer increment in aligned_read() - soundwire: amd: fix for clearing command status register - soundwire: amd: fix for handling slave alerts after link is down - comedi: Fix use of uninitialized data in insn_rw_emulate_bits() - comedi: Fix some signed shift left operations - comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large - comedi: das6402: Fix bit shift out of bounds - comedi: das16m1: Fix bit shift out of bounds - comedi: aio_iiro_16: Fix bit shift out of bounds - comedi: pcl812: Fix bit shift out of bounds - iio: adc: stm32-adc: Fix race in installing chained IRQ handler - iio: adc: max1363: Reorder mode_list[] entries - iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] - iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush - soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled - soc: aspeed: lpc-snoop: Cleanup resources in stack-order - s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again - pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov - net: libwx: properly reset Rx ring descriptor - net: libwx: remove duplicate page_pool_put_full_page() - mmc: sdhci_am654: Workaround for Errata i2312 - mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models - mmc: bcm2835: Fix dma_unmap_sg() nents value - memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() - isofs: Verify inode mode when loading from disk - dmaengine: nbpfaxi: Fix memory corruption in probe() - af_packet: fix soft lockup issue caused by tpacket_snd() - af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() - arm64: dts: rockchip: use cs-gpios for spi1 on ringneck - arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on - arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency - net/mlx5: Update the list of the PCI supported devices - phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() - io_uring/poll: fix POLLERR handling - ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS - drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume - tracing/osnoise: Fix crash in timerlat_dump_stack() - spi: Add check for 8-bit transfer with 8 IO mode support - pch_uart: Fix dma_sync_sg_for_device() nents value - thunderbolt: Fix bit masking in tb_dp_port_set_hops() - i2c: stm32: fix the device used for the DMA map - tracing: Fix crash on synthetic stacktrace field usage - usb: musb: fix gadget state on disconnect - USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI - USB: serial: option: add Foxconn T99W640 - USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition - phy: tegra: xusb: Disable periodic tracking on Tegra234 - phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode - phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr - fs/proc: fix uaf in proc_readdir_de() - io_uring/net: commit partial buffers on retry - nvme: fix admin request_queue lifetime - fs/notify: call exportfs_encode_fid with s_umount - iomap: adjust read range correctly for non-block-aligned positions - fuse: fix livelock in synchronous file put from fuseblk workers - tpm: Cap the number of PCR banks - nfsd: provide locking for v4_end_grace - Revert "nfsd: provide locking for v4_end_grace" - config: enable config for PMT discovery driver - platform/x86/intel/pmt/discovery: use valid device pointer in dev_err_probe - platform/x86/intel/pmt: Fix kobject memory leak on init failure - platform/x86/intel/pmt: fix a crashlog NULL pointer access - platform/x86/intel/pmt: fix build dependency for kunit test - platform/x86/intel/pmt/discovery: fix format string warning - platform/x86/intel/pmt/discovery: Fix size_t specifiers for 32-bit - platform/x86/intel/pmt: KUNIT test for PMT Enhanced Discovery API - platform/x86/intel/pmt/telemetry: Add API to retrieve telemetry regions by feature - platform/x86/intel/pmt/discovery: Get telemetry attributes - platform/x86/intel/tpmi: Get OOBMSM CPU mapping from TPMI - platform/x86/intel/vsec: Set OOBMSM to CPU mapping - platform/x86/intel/tpmi: Relocate platform info to intel_vsec.h - docs: Add ABI documentation for intel_pmt feature directories - platform/x86/intel/pmt: Add PMT Discovery driver - sysfs: Fix crash on empty group attributes array - sysfs: Introduce a mechanism to hide static attribute_groups - platform/x86/intel/vsec: Add new Discovery feature - platform/x86/intel/vsec: Skip driverless features - platform/x86/intel/vsec: Skip absent features during initialization - platform/x86/intel/vsec: Add device links to enforce dependencies - platform/x86/intel/vsec: Create wrapper to walk PCI config space - platform/x86/intel/vsec: Add private data for per-device data - MAINTAINERS: Add link to documentation of Intel PMT ABI - platform/x86/intel/pmt: allow user offset for PMT callbacks - driver/coda: VirtCCA supports MSI device DA - ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency - Rename leapioraid to leapraid and release v2.0 - ub: udma: fix a bug that caused long reboot time. - ub: ubase: Accelerate when ctrl node is shutting down - platform/x86/intel/pmt: Use PMT callbacks - platform/x86/intel/vsec: Add PMT read callbacks - platform/x86/intel/vsec.h: Move to include/linux - md: prevent incorrect update of resync/recovery offset - md/raid1: Fix data corruption for degraded array with slow disk - md/raid1: set max_sectors during early return from choose_slow_rdev() - md-cluster: fix no recovery job when adding/re-adding a disk - md-cluster: fix hanging issue while a new disk adding - md/raid5: recheck if reshape has finished with device_lock held - md-cluster: Constify struct md_cluster_operations - md: Remove unneeded semicolon - md/raid5: fix spares errors about rcu usage - dm-raid: Fix WARN_ON_ONCE check for sync_thread in raid_resume - md: pass in max_sectors for pers->sync_request() - md: factor out helpers for different sync_action in md_do_sync() - md: replace last_sync_action with new enum type - md: use new helpers in md_do_sync() - md: don't fail action_store() if sync_thread is not registered - md: remove parameter check_seq for stop_sync_thread() - md: replace sysfs api sync_action with new helpers - md: factor out helper to start reshape from action_store() - md: add new helpers for sync_action - md: add a new enum type sync_action - md: rearrange recovery_flags - md/raid0: don't free conf on raid0_run failure - md: make md_flush_request() more readable - md: change the return value type of md_write_start to void - md: Revert "md: Fix overflow in is_mddev_idle" - md: don't account sync_io if iostats of the disk is disabled - md: Fix overflow in is_mddev_idle - md: add check for sleepers in md_wakeup_thread() - md: add a mddev_is_dm helper - md: add a mddev_add_trace_msg helper - md: add a mddev_trace_remap helper - dm-raid456, md/raid456: fix a deadlock for dm-raid456 while io concurrent with reshape - dm-raid: add a new helper prepare_suspend() in md_personality - dm-raid: really frozen sync_thread during suspend - md: add a new helper reshape_interrupted() - md: export helper md_is_rdwr() - md: export helpers to stop sync_thread - md: don't clear MD_RECOVERY_FROZEN for new dm-raid until resume - md/raid1: factor out helpers to choose the best rdev from read_balance() - md/raid1: factor out the code to manage sequential IO - md/raid1: factor out choose_bb_rdev() from read_balance() - md/raid1: factor out choose_slow_rdev() from read_balance() - md/raid1: factor out read_first_rdev() from read_balance() - md/raid1-10: factor out a new helper raid1_should_read_first() - md/raid1-10: add a helper raid1_check_read_range() - md/raid1: fix choose next idle in read_balance() - md/raid1: record nonrot rdevs while adding/removing rdevs to conf - md/raid1: factor out helpers to add rdev to conf - md: add a new helper rdev_has_badblock() - md: check mddev->pers before calling md_set_readonly() - md: clean up openers check in do_md_stop() and md_set_readonly() - md: sync blockdev before stopping raid or setting readonly - md: factor out a helper to sync mddev - md: return directly before setting did_set_md_closing - md: changed the switch of RAID_VERSION to if - md: merge the check of capabilities into md_ioctl_valid() - md: Don't suspend the array for interrupted reshape - md: Don't register sync_thread for reshape directly - md: Make sure md_do_sync() will set MD_RECOVERY_DONE - md: Don't ignore read-only array in md_check_recovery() - md: Don't ignore suspended array in md_check_recovery() - md: get rdev->mddev with READ_ONCE() - md: remove redundant md_wakeup_thread() - md: remove redundant check of 'mddev->sync_thread' - md: fix a suspicious RCU usage warning - raid: Remove now superfluous sentinel element from ctl_table array - NFSD: NFSv4 file creation neglects setting ACL - nfsd: set security label during create operations - xfs: Add xfs_dir3_leaf_header_check() in leaf/leafn read - nvme-fc: use lock accessing port_state and rport state - x86/mm: Batch flushing user memory encrytion status change - !20588 [OLK-6.6] Revert "x86/csv: Enhance CMA memory usage reporting for CSV3" - Revert "x86/csv: Enhance CMA memory usage reporting for CSV3" - !20576 media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg() - !20575 RDMA/cm: Fix leaking the multicast GID table reference - !20580 RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly - !20551 Fix CVE-2025-68785 - !20478 f2fs: fix to avoid potential deadlock - !20501 [OLK-6.6] backport important bugfix for bnxt driver from upstream linux-6.6.y - !20520 Fix CVE-2026-23038 - !20424 net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup - !20425 mlx5: Fix default values in create CQ - RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly - media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg() - RDMA/cm: Fix leaking the multicast GID table reference - net: openvswitch: fix middle attribute validation in push_nsh() action - net: openvswitch: remove never-working support for setting nsh fields - pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() - bnxt_en: Fix potential data corruption with HW GRO/LRO - f2fs: fix to avoid potential deadlock - mlx5: Fix default values in create CQ - net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup - riscv kernel upgrade to 6.6.0-138.0.0 - Fixed system hang when boot systemd on spacemit k3 - riscv: perf vendor events: fix lrw core PMU event mapping - !20727 v2 bpf: sockmap fixes - !20741 scsi: qla2xxx: Sanitize payload size to prevent member overflow - !20744 fix CVE-2025-38449 - !20763 net: usb: asix: validate PHY address before use - !20762 smc91x: fix broken irq-context in PREEMPT_RT - !20293 [Hygon][6.6][EDAC] The width of hash value is 2 bits for Hygon family 18h model 6h processors - !20290 [Hygon][6.6][Bugfix] Bug fix for EDAC to use unicast instead of broadcast on hygon family 18h model 4h - !20289 [Hygon][6.6][Bugfix] Bug fix for EDAC to correct the address translation on hygon family 18h model 4h - !20245 KVM: arm64: Refactor exit handlers - !20246 KVM: arm64: Mark some header functions as inline - !19005 [Hygon] [OLK-6.6] [Bugfix] Fix memory bandwidth counter width for Hygon QoS - !20292 [Hygon][6.6][TSC Adjust] Backport x86 TSC adjust patch - !20273 [Hygon][6.6][Bugfix] Get correct CPU LLC ID in guest for Hygon processors - !20722 [OLK-6.6][linux-6.6.y sync] Backport 6.6.104-6.6.106 LTS Patches - !20667 fix CVE-2024-50102 - !20736 netfilter: nf_tables: remove redundant chain validation on register store - !20758 ub: ubase: Fixed the alarm issue caused by the initialization of the structure variable definition. - !20721 obmm: reduce log noise for successful export/import/preimport - net: usb: asix: validate PHY address before use - smc91x: fix broken irq-context in PREEMPT_RT - !20731 devlink: rate: Unset parent pointer in devl_rate_nodes_destroy - !20732 libceph: return the handler error from mon_handle_auth_done() - !20743 mm: slub: avoid wake up kswapd in set_track_prepare - ub: ubase: Fixed the alarm issue caused by the initialization of the structure variable definition. - !20750 ub: cdma: adapted to UMMU interface changes - !20713 urma: DFX of log in kernel - urma: optimize log levels for kernel space - ub: cdma: adapted to UMMU interface changes - wifi: ath11k: avoid bit operation on key flags - drm/mediatek: fix potential OF node use-after-free - cpufreq: intel_pstate: Check IDA only before MSR_IA32_PERF_CTL writes - wifi: cfg80211: sme: store capped length in __cfg80211_connect_result() - !20708 ub:hisi-ubus: Add create bus instance ummu bypass - drm: fix kabi for struct drm_framebuffer - drm/framebuffer: Acquire internal references on GEM handles - drm/gem: Acquire references on GEM handles for framebuffers - mm: slub: avoid wake up kswapd in set_track_prepare - scsi: qla2xxx: Sanitize payload size to prevent member overflow - netfilter: nf_tables: remove redundant chain validation on register store - libceph: return the handler error from mon_handle_auth_done() - devlink: rate: Unset parent pointer in devl_rate_nodes_destroy - Documentation/hw-vuln: Add VMSCAPE documentation - dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status() - riscv: use lw when reading int cpu in asm_per_cpu - mm: slub: avoid wake up kswapd in set_track_prepare - tools: gpio: remove the include directory on make clean - tools: gpio: rm .*.cmd on make clean - drm/amd/amdgpu: Fix missing error return on kzalloc failure - drm/amdgpu: Replace DRM_* with dev_* in amdgpu_psp.c - perf bpf-event: Fix use-after-free in synthesis - drm/bridge: ti-sn65dsi86: fix REFCLK setting - spi: spi-fsl-lpspi: Clear status register after disabling the module - spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort - spi: spi-fsl-lpspi: Set correct chip-select polarity bit - spi: spi-fsl-lpspi: Fix transmissions when using CONT - hwmon: mlxreg-fan: Prevent fans from getting stuck at 0 RPM - pcmcia: omap: Add missing check for platform_get_resource - Revert "drm/amdgpu: Avoid extra evict-restore process." - ALSA: hda/realtek: Fix headset mic for TongFang X6[AF]R5xxY - ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model - drm/mediatek: Fix device/node reference count leaks in mtk_drm_get_all_drm_priv - drm/mediatek: Fix using wrong drm private data to bind mediatek-drm - drm/mediatek: Add crtc path enum for all_drm_priv array - vmxnet3: update MTU after device quiesce - net: dsa: microchip: linearize skb for tail-tagging switches - net: dsa: microchip: update tag_ksz masks for KSZ9477 family - dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status() - ALSA: hda/realtek - Add new HP ZBook laptop with micmute led fixup - ALSA: hda/realtek: Add support for HP Agusta using CS35L41 HDA - iio: pressure: mprls0025pa: use aligned_s64 for timestamp - iio: chemical: pms7003: use aligned_s64 for timestamp - iio: imu: inv_mpu6050: align buffer for timestamp - thermal/drivers/mediatek/lvts: Disable low offset IRQ for minimum threshold - nouveau: fix disabling the nonstall irq due to storm code - cpufreq: intel_pstate: Unchecked MSR aceess in legacy mode - net: pcs: rzn1-miic: Correct MODCTRL register offset - platform/x86/amd/pmc: Add TUXEDO IB Pro Gen10 AMD to spurious 8042 quirks list - drm/amdgpu: drop hw access in non-DC audio fini - wifi: mt76: mt7996: Initialize hdr before passing to skb_put_data() - wifi: mwifiex: Initialize the chan_stats array to zero - tcp_bpf: Fix copied value in tcp_bpf_sendmsg - skmsg: Return copied bytes in sk_msg_memcopy_from_iter - tcp_bpf: Add sk_rmem_alloc related logic for tcp_bpf ingress redirection - Revert "bpf, sockmap: Add sk_rmem_alloc check for sockmap" - ALSA: usb-audio: Add mute TLV for playback volumes on some devices - phy: mscc: Stop taking ts_lock for tx_queue and use its own lock - selftest: net: Fix weird setsockopt() in bind_bhash.c. - net: atm: fix memory leak in atm_register_sysfs when device_register fail - ax25: properly unshare skbs in ax25_kiss_rcv() - mctp: return -ENOPROTOOPT for unknown getsockopt options - net/smc: Remove validation of reserved bits in CLC Decline message - ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init() - net: thunder_bgx: decrement cleanup index before use - net: thunder_bgx: add a missing of_node_put - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() - wifi: libertas: cap SSID len in lbs_associate() - wifi: cw1200: cap SSID length in cw1200_do_join() - net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets - wifi: ath11k: fix group data packet drops during rekey - wifi: ath11k: avoid forward declaration of ath11k_mac_start_vdev_delay() - wifi: ath11k: rename ath11k_start_vdev_delay() - wifi: ath11k: Introduce and use ath11k_sta_to_arsta() - net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() - macsec: read MACSEC_SA_ATTR_PN with nla_get_uint - netlink: add variable-length / auto integers - net: macb: Fix tx_ptr_lock locking - icmp: fix icmp_ndo_send address translation for reply direction - mISDN: Fix memory leak in dsp_hwec_enable() - xirc2ps_cs: fix register access when enabling FullDuplex - netfilter: conntrack: helper: Replace -EEXIST by -EBUSY - wifi: cfg80211: fix use-after-free in cmp_bss() - arm64: dts: imx8mp: Fix missing microSD slot vqmmc on Data Modul i.MX8M Plus eDM SBC - arm64: dts: imx8mp: Fix missing microSD slot vqmmc on DH electronics i.MX8M Plus DHCOM - tee: optee: ffa: fix a typo of "optee_ffa_api_is_compatible" - arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro - Bluetooth: hci_sync: Avoid adding default advertising on startup - cpupower: Fix a bug where the -t option of the set subcommand was not working. - drm/amd/display: Don't warn when missing DCE encoder caps - cdc_ncm: Flag Intel OEM version of Fibocom L850-GL as WWAN - LoongArch: Save LBT before FPU in setup_sigcontext() - btrfs: avoid load/store tearing races when checking if an inode was logged - btrfs: fix race between setting last_dir_index_offset and inode logging - btrfs: fix race between logging inode and checking if it was logged before - bpf: Fix oob access in cgroup local storage - !20556 urma: fix update topo logic - !20639 [OLK-6.6][linux-6.6.y sync] Backport 6.6.103-6.6.104 LTS Patches - !20641 [OLK-6.6][linux-6.6.y sync] LoongArch: Add more instruction opcodes and emit_* helpers - !20560 *** fix CVE-2025-38062 *** - !20662 pNFS: Fix a deadlock when returning a delegation during open() - ub:hisi-ubus: Add create bus instance ummu bypass - Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" - Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set" - HID: mcp2221: Handle reads greater than 60 bytes - HID: mcp2221: Don't set bus speed on every transfer - net/mlx5: SF, Fix add port error handling - drm/nouveau/disp: Always accept linear modifier - smb3 client: fix return code mapping of remap_file_range - net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions - dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted - HID: wacom: Add a new Art Pen 2 - HID: logitech: Add ids for G PRO 2 LIGHTSPEED - HID: quirks: add support for Legion Go dual dinput modes - net: stmmac: Set CIC bit only for TX queues with COE - net: stmmac: xgmac: Correct supported speed modes - net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts - net/mlx5e: Set local Xoff after FW update - net/mlx5e: Update and set Xon/Xoff upon port speed set - net/mlx5e: Update and set Xon/Xoff upon MTU set - net/mlx5: Nack sync reset when SFs are present - net/mlx5: Convert SF port_indices xarray to function_ids xarray - net/mlx5: Use devlink port pointer to get the pointer of container SF struct - net/mlx5: Call mlx5_sf_id_erase() once in mlx5_sf_dealloc() - phy: mscc: Fix when PTP clock is register and unregister - net: dlink: fix multicast stats being counted incorrectly - dt-bindings: display/msm: qcom,mdp5: drop lut clock - drm/nouveau: remove unused memory target test - drm/nouveau: remove unused increment in gm200_flcn_pio_imem_wr - Bluetooth: hci_sync: fix set_local_name race condition - Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced - Bluetooth: hci_event: Mark connection as closed during suspend disconnect - Bluetooth: hci_event: Treat UNKNOWN_CONN_ID on disconnect as success - HID: input: report battery status changes immediately - HID: input: rename hidinput_set_battery_charge_status() - powerpc/kvm: Fix ifdef to remove build warning - drm/msm: Defer fd_install in SUBMIT ioctl - vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() - ACPI: EC: Add device to acpi_ec_no_wakeup[] qurik list - erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC - ASoC: codecs: tx-macro: correct tx_macro_component_drv name - smb: client: fix race with concurrent opens in unlink(2) - scsi: core: sysfs: Correct sysfs attributes access rights - of: dynamic: Fix use after free in of_changeset_add_prop_helper() - of: Add a helper to free property struct - mips: lantiq: xway: sysctrl: rename the etop node - mips: dts: lantiq: danube: add missing burst length property - pinctrl: STMFX: add missing HAS_IOMEM dependency - of: dynamic: Fix memleak when of_pci_add_properties() failed - !20684 urma: adjust urma log format - !20355 udp: Deal with race between UDP socket address change and rehash - !20627 Fixes CVE-2025-38627 - !20702 CVE-2025-39948 - !20701 netfilter: ctnetlink: remove refcounting in expectation dumpers - !20700 CVE-2025-38678 - !20703 CVE-2025-38491 - !20690 tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. - obmm: reduce log noise for successful export/import/preimport - mptcp: avoid deadlock on fallback while reinjecting - mptcp: plug races between subflow fail and subflow creation - mptcp: make fallback action and fallback decision atomic - ice: fix Rx page leak on multi-buffer frames - ice: fix incorrect counter for buffer allocation failures - ice: stop storing XDP verdict within ice_rx_buf - ice: gather page_count()'s of each frag right before XDP prog call - ice: Introduce ice_xdp_buff - netfilter: ctnetlink: remove refcounting in expectation dumpers - netfilter: nf_tables: reject duplicate device on updates - netfilter: nf_tables: Introduce functions freeing nft_hook objects - netfilter: nf_tables: Fix percpu address space issues in nf_tables_api.c - err.h: add ERR_PTR_PCPU(), PTR_ERR_PCPU() and IS_ERR_PCPU() macros - tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. - !20498 Fix CVE-2025-71118 - !20608 pmdomain: arm: scmi: Fix genpd leak on provider registration failure - !20679 x86/CPU/AMD: Add RDSEED fix for Zen5 - !20650 fix cve-2025-40300 - !20661 Input: alps - fix use-after-free bugs caused by dev3_register_work - !20664 backport some net bugfix from 6.6 lts - urma: adjust urma log format - !20678 ub: udma: close debug switch load parameters. - ub: udma: close debug switch load parameters. - x86/CPU/AMD: Add RDSEED fix for Zen5 - !20630 net: LTS-6.6 bugfix backport - !20632 net/sched: sch_qfq: do not free existing class in qfq_change_class() - !20631 macvlan: fix possible UAF in macvlan_forward_source() - !20628 Fix CVE-2025-39910 - !20659 v2 Fix CVE-2025-22090 - !20506 XSched: Update XSched manual - !20647 media: imon: make send_packet() more robust - !20646 ksm: use range-walk function to jump over holes in scan_get_next_rmap_item - !20645 fbcon: Set fb_display[i - !20648 parse_longname(): strrchr() expects NUL-terminated string - !20621 urma: modify log level - !20602 urma: fix the jfe uaf issue that occurred during the killall process. - !20567 urma:change log level and pass status 9 - !20640 iio: common: st_sensors: Fix use of uninitialize device structs - !20634 usb: gadget: udc: fix use-after-free in usb_gadget_state_work - !20633 net: dsa: properly keep track of conduit reference - !20635 fix CVE-2025-68231 - !20651 mm/slub: avoid accessing metadata when pointer is invalid in object_err() - !20649 drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb - !20652 mm/vmalloc: fix data race in show_numa_info() - x86: uaccess: don't use runtime-const rewriting in modules - x86: fix off-by-one in access_ok() - x86: fix user address masking non-canonical speculation issue - x86/uaccess: Zero the 8-byte get_range case on failure on 32-bit - x86/uaccess: Improve the 8-byte getuser() case - x86: fix whitespace in runtime-const assembler output - dcache: keep dentry_hashtable or d_hash_shift even when not used - runtime constants: add x86 architecture support - runtime constants: deal with old decrepit linkers - x86/uaccess: Add missing __force to casts in __access_ok() and valid_user_address() - !20345 arm64: entry: xcall/xint: make asm conditionals compatible with clang IAS - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). - libceph: replace BUG_ON with bounds check for map->max_osd - libceph: prevent potential out-of-bounds writes in handle_auth_session_key() - libceph: fix potential use-after-free in have_mon_and_osd_map() - sctp: Hold sock lock while iterating over address list - sctp: Prevent TOCTOU out-of-bounds write - sctp: Hold RCU read lock while iterating over address list - tipc: Fix use-after-free in tipc_mon_reinit_self(). - sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto - sctp: avoid NULL dereference when chunk data buffer is missing - bpf: Explicitly check accesses to bpf_sock_addr - ipvs: Defer ip_vs_ftp unregister during netns cleanup - nexthop: Forbid FDB status change while nexthop is in a group - netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). - net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer - sctp: initialize more fields in sctp_v6_from_sk() - pNFS: Fix a deadlock when returning a delegation during open() - Input: alps - fix use-after-free bugs caused by dev3_register_work - x86/cpu: Get CPU LLC ID from CPUID 0x8000001d in guest for Hygon processors - kernel/fork: only call untrack_pfn_clear() on VMAs duplicated for fork() - mm: (un)track_pfn_copy() fix + doc improvements - x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range() - !20642 mtdchar: fix integer overflow in read/write ioctls - mm/vmalloc: fix data race in show_numa_info() - mm/slub: avoid accessing metadata when pointer is invalid in object_err() - config: enable CONFIG_MITIGATION_VMESCAPE by default on x86 - x86/vmscape: Enable the mitigation - x86/vmscape: Enumerate VMSCAPE bug - x86/vmscape: Add conditional IBPB mitigation - drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb - parse_longname(): strrchr() expects NUL-terminated string - media: imon: make send_packet() more robust - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item - fbcon: Set fb_display[i]->mode to NULL when the mode is released - !20569 CVE-2024-35808 - mtdchar: fix integer overflow in read/write ioctls - !20619 Fix CVE-2026-22991 - !20612 net: hns3: extend HCLGE_FD_AD_COUNTER_NUM to 8 bits - LoongArch: Add more instruction opcodes and emit_* helpers - iio: common: st_sensors: Fix use of uninitialize device structs - !20581 null_blk: fix kmemleak by releasing references to fault configfs items - mm/mempool: fix poisoning order>0 pages with HIGHMEM - mm/page_poison: replace kmap_atomic() with kmap_local_page() - mm/mempool: replace kmap_atomic() with kmap_local_page() - usb: gadget: udc: fix use-after-free in usb_gadget_state_work - net: dsa: properly keep track of conduit reference - net/sched: sch_qfq: do not free existing class in qfq_change_class() - macvlan: fix possible UAF in macvlan_forward_source() - netfilter: nft_objref: validate objref and objrefmap expressions - arp: do not assume dev_hard_header() does not change skb->head - ip6_gre: make ip6gre_header() robust - netfilter: nf_tables: avoid chain re-validation if possible - netfilter: nf_tables: drop unused 3rd argument from validate callback ops - Revert "netfilter: nft_objref: validate objref and objrefmap expressions" - bpf: Fix reference count leak in bpf_prog_test_run_xdp() - net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset - ethtool: Avoid overflowing userspace buffer on stats query - ipvs: fix ipv4 null-ptr-deref in route error path - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() - !20596 mm/page_alloc: prevent pcp corruption with SMP=n - !20598 team: fix check for port enabled in team_queue_override_port_prio_changed() - !18823 hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio - mm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc() - kasan: avoid sleepable page allocation from atomic context - f2fs: compress: fix UAF of f2fs_inode_info in f2fs_free_dic - f2fs: compress: change the first parameter of page_array_{alloc,free} to sbi - !20583 [OLK-6.6][linux-6.6.y sync] Backport 6.6.102-6.6.103 LTS Patches - !20460 fbdev: Fix vmalloc out-of-bounds write in fast_imageblit - urma:fix log level and pass status 9 - urma: modify log level - !20592 CVE-2025-71141 fixup - !20594 CVE-2025-39744 fixup - !20607 powerpc/64s/slb: Fix SLB multihit issue during SLB preload - !20606 mm/huge_memory: fix NULL pointer deference when splitting folio - !20604 Fix CVE-2026-22984 - !20603 Fix CVE-2026-23021 - !20600 Fix CVE-2026-22990 - urma: fix the jfe uaf issue that occurred during the killall process. - !20380 pswiotlb: Adapt to the IOMMU DMA API upgraded by IOMMUFD - libceph: make free_choose_arg_map() resilient to partial allocation - drm/dp: Change AUX DPCD probe address from LANE0_1_STATUS to TRAINING_PATTERN_SET - net: hns3: extend HCLGE_FD_AD_COUNTER_NUM to 8 bits - net: hns3: extend HCLGE_FD_AD_QID to 11 bits - net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue - net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M - Revert "net: hns3: add support for FD counter" - !20587 dmaengine: stm32: dmamux: fix device leak on route allocation - pmdomain: arm: scmi: Fix genpd leak on provider registration failure - powerpc/64s/slb: Fix SLB multihit issue during SLB preload - mm/huge_memory: fix NULL pointer deference when splitting folio - !20562 LoongArch: BPF: Sign extend kfunc call arguments - !20470 ipv4: Fix reference count leak when using error routes with nexthop objects - !20471 net: sock: fix hardened usercopy panic in sock_recv_errqueue - !20472 net: fix memory leak in skb_segment_list for GRO packets - !20473 ipv4: ip_gre: make ipgre_header() robust - !20469 SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf - !20476 ipv6: Fix use-after-free in inet6_addr_del(). - !20477 svcrdma: bound check rq_pages index in inline path - !20578 ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() - !20579 fix CVE-2025-68768 - !20542 Fix NFS deadlock - USB: storage: Remove subclass and protocol overrides from Novatek quirk - cpuidle: governors: menu: Select polling state in some more cases - cpuidle: governors: menu: Rearrange main loop in menu_select() - cpuidle: menu: Update documentation after previous changes - Revert "drm/tegra: dsi: Clear enable register if powered by bootloader" - parisc: Remove spurious if statement from raw_copy_from_user() - ata: libata-scsi: Fix system suspend for a security locked drive - Revert "drm/amdgpu: fix incorrect vm flags to map bo" - mfd: axp20x: Set explicit ID for regulator cell if no IRQ line is present - drm/amd/display: use udelay rather than fsleep - sched/fair: Revert max_newidle_lb_cost bump - net: ipv4: fix regression in local-broadcast routes - tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers - PM: runtime: Do not clear needs_force_resume with enabled runtime PM - usb: typec: ucsi: psy: Set max current to zero when disconnected - io_uring/rw: cast rw->flags assignment to rwf_t - Documentation: ACPI: i2c-muxes: fix I2C device references - s390/hypfs: Enable limited access during lockdown - s390/hypfs: Avoid unnecessary ioctl registration in debugfs - ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation - net/mlx5e: Preserve shared buffer capacity during headroom updates - net/mlx5: Base ECVF devlink port attrs from 0 - Octeontx2-af: Skip overlap check for SPI field - bonding: send LACPDUs periodically in passive mode after receiving partner's LACPDU - bonding: Add independent control state machine - bonding: update LACP activity flag after setting lacp_active - net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate - ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc - gve: prevent ethtool ops after shutdown - phy: mscc: Fix timestamping for vsc8584 - net: ethernet: mtk_ppe: add RCU lock around dev_fill_forward_path - ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add - net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM - ALSA: usb-audio: Fix size validation in convert_chmap_v3() - mlxsw: spectrum: Forward packets with an IPv4 link-local source IP - Bluetooth: hci_conn: do return error from hci_enhanced_setup_sync() - Bluetooth: hci_event: fix MTU for BN == 0 in CIS Established - scsi: qla4xxx: Prevent a potential error pointer dereference - RDMA/bnxt_re: Fix to initialize the PBL array - RDMA/bnxt_re: Fix to remove workload check in SRQ limit path - RDMA/bnxt_re: Fix to do SRQ armena by default - RDMA/erdma: Fix ignored return value of init_kernel_qp - iosys-map: Fix undefined behavior in iosys_map_clear() - cgroup/cpuset: Use static_branch_enable_cpuslocked() on cpusets_insane_config_key - spi: spi-fsl-lpspi: Clamp too high speed_hz - usb: typec: maxim_contaminant: disable low power mode when reading comparator values - usb: typec: maxim_contaminant: re-enable cc toggle if cc is open and port is clean - iio: imu: inv_icm42600: change invalid data error to -EBUSY - iio: imu: inv_icm42600: Convert to uXX and sXX integer types - iio: imu: inv_icm42600: use = { } instead of memset() - iio: imu: inv_icm42600: switch timestamp type from int64_t __aligned(8) to aligned_s64 - iio: temperature: maxim_thermocouple: use DMA-safe buffer for spi_read() - iio: light: as73211: Ensure buffer holes are zeroed - tls: fix handling of zero-length records on the rx_list - powerpc/boot: Fix build with gcc 15 - mmc: sdhci-pci-gli: GL9763e: Mask the replay timer timeout of AER - compiler: remove __ADDRESSABLE_ASM{_STR,}() again - drm/amd/display: Don't overclock DCE 6 by 15% - usb: dwc3: pci: add support for the Intel Wildcat Lake - usb: dwc3: Ignore late xferNotReady event to prevent halt timeout - USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles - usb: storage: realtek_cr: Use correct byte order for bcs->Residue - USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera - usb: renesas-xhci: Fix External ROM access timeouts - usb: core: hcd: fix accessing unmapped memory in SINGLE_STEP_SET_FEATURE test - comedi: Make insn_rw_emulate_bits() do insn->n samples - usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive - cdx: Fix off-by-one error in cdx_rpmsg_probe() - most: core: Drop device reference after usage in get_channel() - iio: proximity: isl29501: fix buffered read on big-endian systems - iio: pressure: bmp280: Use IS_ERR() in bmp280_common_probe() - fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable() - drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS - cpuidle: governors: menu: Avoid selecting states with too much latency - cpuidle: menu: Remove iowait influence - mmc: sdhci-pci-gli: Add a new function to simplify the code - mmc: sdhci-pci-gli: Use PCI AER definitions, not hard-coded values - mptcp: disable add_addr retransmission when timeout is 0 - mptcp: remove duplicate sk_reset_timer call - use uniform permission checks for all mount propagation changes - arm64: dts: ti: k3-am62-main: Remove eMMC High Speed DDR support - scsi: mpi3mr: Serialize admin queue BAR writes on 32-bit systems - scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers - scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE - PCI: imx6: Add IMX8MM_EP and IMX8MP_EP fixed 256-byte BAR 4 in epc_features - PCI: imx6: Delay link start until configfs 'start' written - PCI: rockchip: Set Target Link Speed to 5.0 GT/s before retraining - PCI: rockchip: Use standard PCIe definitions - drm/amd/display: Fill display clock and vblank time in dce110_fill_display_configs - drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs - drm/amd/display: Fix DP audio DTO1 clock source on DCE 6. - drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3 - ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and EliteBook 830 G6 - mm/debug_vm_pgtable: clear page table entries at destroy_args() - squashfs: fix memory leak in squashfs_fill_super - mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for consistency - memstick: Fix deadlock by moving removing flag earlier - KVM: arm64: Fix kernel BUG() due to bad backport of FPSIMD/SVE/SME fix - sched/fair: Fix frequency selection for non-invariant case - kbuild: userprogs: use correct linker when mixing clang and GNU ld - ata: libata-scsi: Return aborted command when missing sense and result TF - PM: runtime: Take active children into account in pm_runtime_get_if_in_use() - PM: runtime: Simplify pm_runtime_get_if_active() usage - ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig - usb: dwc3: imx8mp: fix device leak at unbind - wifi: mac80211: check basic rates validity in sta_link_apply_parameters - KVM: x86: Take irqfds.lock when adding/deleting IRQ bypass producer - s390/mm: Remove possible false-positive warning in pte_free_defer() - btrfs: send: make fs_path_len() inline and constify its argument - btrfs: send: use fallocate for hole punching with send stream v2 - btrfs: send: avoid path allocation for the current inode when issuing commands - btrfs: send: keep the current inode's path cached - btrfs: send: add and use helper to rename current inode when processing refs - btrfs: send: only use boolean variables at process_recorded_refs() - btrfs: send: factor out common logic when sending xattrs - btrfs: populate otime when logging an inode item - btrfs: constify more pointer parameters - btrfs: fix ssd_spread overallocation - btrfs: open code timespec64 in struct btrfs_inode - xfs: fully decouple XFS_IBULK* flags from XFS_IWALK* flags - btrfs: abort transaction on unexpected eb generation at btrfs_copy_root() - btrfs: always abort transaction on failure to add block group to free space tree - btrfs: move transaction aborts to the error site in add_block_group_free_space() - btrfs: qgroup: fix race between quota disable and quota rescan ioctl - usb: typec: fusb302: cache PD RX state - block: Make REQ_OP_ZONE_FINISH a write operation - block: reject invalid operation in submit_bio_noacct - leds: flash: leds-qcom-flash: Fix registry access after re-bind - leds: flash: leds-qcom-flash: Limit LED current based on thermal condition - selftests/memfd: add test for mapping write-sealed memfd read-only - mm: update memfd seal write check to include F_SEAL_WRITE - mptcp: pm: kernel: flush: do not reset ADD_ADDR limit - mptcp: drop skb if MPTCP skb extension allocation fails - ipv6: sr: Fix MAC comparison to be constant-time - drm/amd/display: Don't overwrite dce60_clk_mgr - drm/amd/display: Add primary plane to commits for correct VRR handling - drm/amdkfd: Destroy KFD debugfs after destroy KFD wq - drm/amdgpu: update mmhub 3.0.1 client id mappings - drm/amdgpu: Avoid extra evict-restore process. - drm/amd: Restore cached power limit during resume - media: venus: venc: Clamp param smaller than 1fps and bigger than 240 - media: venus: vdec: Clamp param smaller than 1fps and bigger than 240. - media: venus: protect against spurious interrupts during probe - media: venus: hfi: explicitly release IRQ during teardown - media: qcom: camss: cleanup media device allocated resource on error path - media: ov2659: Fix memory leaks in ov2659_probe() - media: usbtv: Lock resolution while streaming - media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free() - media: verisilicon: Fix AV1 decoder clock frequency - media: vivid: fix wrong pixel_array control size - media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init() - media: hi556: correct the test pattern configuration - media: gspca: Add bounds checking to firmware parser - parisc: Update comments in make_insert_tlb - parisc: Try to fixup kernel exception in bad_area_nosemaphore path of do_page_fault() - parisc: Rename pte_needs_flush() to pte_needs_cache_flush() in cache.c - parisc: Makefile: explain that 64BIT requires both 32-bit and 64-bit compilers - parisc: Define and use set_pte_at() - parisc: Check region is readable by user in raw_copy_from_user() - soc/tegra: pmc: Ensure power-domains are in a known state - f2fs: fix to avoid out-of-boundary access in dnode page - phy: qcom: phy-qcom-m31: Update IPQ5332 M31 USB phy initialization sequence - vhost/vsock: Avoid allocating arbitrarily-sized SKBs - PCI: endpoint: Fix configfs group removal on driver teardown - PCI: endpoint: Fix configfs group list head handling - mtd: rawnand: renesas: Add missing check after DMA map - mtd: rawnand: fsmc: Add missing check after DMA map - mtd: spinand: propagate spinand_wait() errors from spinand_write_page() - mtd: spi-nor: Fix spi_nor_try_unlock_all() - hwmon: (gsc-hwmon) fix fan pwm setpoint show functions - pwm: mediatek: Fix duty and period setting - pwm: mediatek: Handle hardware enable and clock enable separately - pwm: imx-tpm: Reset counter if CMOD is 0 - wifi: ath11k: fix dest ring-buffer corruption when ring is full - wifi: ath11k: fix source ring-buffer corruption - wifi: ath11k: fix dest ring-buffer corruption - wifi: ath12k: fix dest ring-buffer corruption when ring is full - wifi: ath12k: fix source ring-buffer corruption - wifi: ath12k: fix dest ring-buffer corruption - wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table() - iio: adc: ad_sigma_delta: change to buffer predisable - zynq_fpga: use sgtable-based scatterlist wrappers - scsi: ufs: ufs-pci: Fix default runtime and system PM levels - scsi: ufs: ufs-pci: Fix hibernate state transition for Intel MTL-like host controllers - ata: libata-scsi: Fix ata_to_sense_error() status handling - scsi: mpi3mr: Fix race between config read submit and interrupt completion - dt-bindings: display: sprd,sharkl3-dsi-host: Fix missing clocks constraints - dt-bindings: display: sprd,sharkl3-dpu: Fix missing clocks constraints - arm64: dts: ti: k3-am62-verdin: Enable pull-ups on I2C buses - arm64: dts: ti: k3-am62a7-sk: fix pinmux for main_uart1 - arm64: dts: ti: k3-pinctrl: Enable Schmitt Trigger by default - btrfs: zoned: fix write time activation failure for metadata block group - ext4: fix hole length calculation overflow in non-extent inodes - ext4: don't try to clear the orphan_present feature block device is r/o - ext4: fix reserved gdt blocks handling in fsmap - ext4: fix fsmap end of range reporting with bigalloc - ext4: check fast symlink for ea_inode correctly - tracing: fprobe-event: Sanitize wildcard for fprobe event name - crypto: qat - lower priority for skcipher and aead algorithms - lib/crypto: mips/chacha: Fix clang build and remove unneeded byteswap - vt: defkeymap: Map keycodes above 127 to K_HOLE - vt: keyboard: Don't process Unicode characters in K_OFF mode - bus: mhi: host: Fix endianness of BHI vector table - usb: dwc3: meson-g12a: fix device leaks at unbind - usb: musb: omap2430: fix device leak at unbind - usb: gadget: udc: renesas_usb3: fix device leak at unbind - usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init() - m68k: Fix lost column on framebuffer debug console - platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister() - cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table() - rcu: Fix racy re-initialization of irq_work causing hangs - HID: apple: avoid setting up battery timer for devices without battery - HID: magicmouse: avoid setting up battery timer when not needed - RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages - tools/nolibc: fix spelling of FD_SETBITMASK in FD_* macros - media: uvcvideo: Do not mark valid metadata as invalid - media: venus: Fix OOB read due to missing payload bound check - parisc: Makefile: fix a typo in palo.conf - fbdev: Fix vmalloc out-of-bounds write in fast_imageblit - btrfs: do not allow relocation of partially dropped subvolumes - btrfs: zoned: do not select metadata BG as finish target - btrfs: clear dirty status from extent buffer on error at insert_new_root() - btrfs: zoned: do not remove unwritten non-data block group - btrfs: abort transaction during log replay if walk_log_tree() failed - btrfs: zoned: use filesystem size not disk size for reclaim decision - cdc-acm: fix race between initial clearing halt and open - thunderbolt: Fix copy+paste error in match_service_id() - usb: typec: ucsi: Update power_supply on power role change - misc: rtsx: usb: Ensure mmc child device is active when card is present - iommufd: Report unmapped bytes in the error path of iopt_unmap_iova_range - cifs: reset iface weights when we cannot find a candidate - drm/amdgpu: fix incorrect vm flags to map bo - scsi: lpfc: Remove redundant assignment to avoid memory leak - rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe - pNFS: Handle RPC size limit for layoutcommits - pNFS: Fix disk addr range check in block/scsi layout - pNFS: Fix stripe mapping in block/scsi layout - ASoC: Intel: avs: Fix uninitialized pointer error in probe() - net: phy: smsc: add proper reset flags for LAN8710A - ipmi: Fix strcpy source and destination the same - kconfig: lxdialog: fix 'space' to (de)select options - kconfig: gconf: fix potential memory leak in renderer_edited() - kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed() - ipmi: Use dev_warn_ratelimited() for incorrect message warnings - vfio/mlx5: fix possible overflow in tracking max message size - scsi: aacraid: Stop using PCI_IRQ_AFFINITY - scsi: target: core: Generate correct identifiers for PR OUT transport IDs - scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans - kconfig: nconf: Ensure null termination where strncpy is used - vfio/type1: conditional rescheduling while pinning - kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c - f2fs: check the generic conditions first - exfat: add cluster chain loop check for dir - i2c: Force DLL0945 touchpad i2c freq to 100khz - apparmor: use the condition in AA_BUG_FMT even with debug disabled - dm-table: fix checking for rq stackable devices - dm-mpath: don't print the "loaded" message if registering fails - i3c: master: Initialize ret in i3c_i2c_notifier_call() - i3c: don't fail if GETHDRCAP is unsupported - apparmor: shift ouid when mediating hard links in userns - rtc: ds1307: handle oscillator stop flag (OSF) for ds1341 - i3c: add missing include to internal header - module: Prevent silent truncation of module name in delete_module(2) - md: dm-zoned-target: Initialize return variable r to avoid uninitialized use - soundwire: Move handle_nested_irq outside of sdw_dev_lock - soundwire: amd: serialize amd manager resume sequence during pm_prepare - crypto: octeontx2 - add timeout for load_fvc completion poll - media: uvcvideo: Fix bandwidth issue for Alcor camera - media: usb: hdpvr: disable zero-length read messages - media: tc358743: Increase FIFO trigger level to 374 - media: tc358743: Return an appropriate colorspace from tc358743_set_fmt - media: tc358743: Check I2C succeeded during probe - pinctrl: stm32: Manage irq affinity settings - scsi: mpi3mr: Correctly handle ATA device errors - scsi: mpt3sas: Correctly handle ATA device errors - power: supply: qcom_battmgr: Add lithium-polymer entry - RDMA/core: reduce stack using in nldev_stat_get_doit() - dmaengine: stm32-dma: configure next sg only if there are more than 2 sgs - leds: leds-lp50xx: Handle reg to get correct multi_index - media: v4l2-common: Reduce warnings about missing V4L2_CID_LINK_FREQ control - MIPS: lantiq: falcon: sysctrl: fix request memory check logic - crypto: jitter - fix intermediary handling - watchdog: iTCO_wdt: Report error if timeout configuration fails - MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free} - clk: qcom: ipq5018: keep XO clock always on - hwmon: (emc2305) Set initial PWM minimum value during probe based on thermal state - watchdog: dw_wdt: Fix default timeout - fs/orangefs: use snprintf() instead of sprintf() - phy: rockchip-pcie: Properly disable TEST_WRITE strobe signal - mfd: axp20x: Set explicit ID for AXP313 regulator - clk: tegra: periph: Fix error handling and resolve unsigned compare warning - fbdev: fix potential buffer overflow in do_register_framebuffer() - cifs: Fix calling CIFSFindFirst() for root path without msearch - watchdog: sbsa: Adjust keepalive timeout to avoid MediaTek WS0 race condition - drm/amd/display: Avoid configuring PSR granularity if PSR-SU not supported - drm/amd/display: Only finalize atomic_obj if it was initialized - vhost: fail early when __vhost_add_used() fails - vsock/virtio: Resize receive buffers so that each SKB fits in a 4K page - net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325 - rcu: Fix rcu_read_unlock() deadloop due to IRQ work - drm/amd/display: Avoid trying AUX transactions on disconnected ports - selftests/bpf: Fix a user_ringbuf failure with arm64 64KB page size - bpf: Make reg_not_null() true for CONST_PTR_TO_MAP - uapi: in6: restore visibility of most IPv6 socket options - drm/ttm: Should to return the evict error - drm: renesas: rz-du: mipi_dsi: Add min check for VCLK range - net: ncsi: Fix buffer overflow in fetching version id - ionic: clean dbpage in de-init - wifi: rtlwifi: fix possible skb memory leak in _rtl_pci_init_one_rxdesc() - ptp: Use ratelimite for freerun error message - bpftool: Fix JSON writer resource leak in version command - net: dsa: b53: prevent SWITCH_CTRL access on BCM5325 - net: dsa: b53: prevent DIS_LEARNING access on BCM5325 - net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325 - net: dsa: b53: fix b53_imp_vlan_setup for BCM5325 - gve: Return error for unknown admin queue command - net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs - net: vlan: Make is_vlan_dev() a stub when VLAN is not configured - drm/amd: Allow printing VanGogh OD SCLK levels without setting dpm to manual - dpaa_eth: don't use fixed_phy_change_carrier - wifi: iwlegacy: Check rate_idx range after addition - netmem: fix skb_frag_address_safe with unreadable skbs - powerpc: floppy: Add missing checks after DMA map - wifi: ath12k: Decrement TID on RX peer frag setup error handling - wifi: ath12k: Enable REO queue lookup table feature on QCN9274 hw2.0 - wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`. - wifi: mac80211: update radar_required in channel context after channel switch - drm/amd/display: Fix 'failed to blank crtc!' - wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect - wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd() - wifi: ath12k: Add memset and update default rate value in wmi tx completion - drm/amd/display: Separate set_gsl from set_gsl_source_select - net: fec: allow disable coalescing - net: atlantic: add set_power to fw_ops for atl2 to fix wol - net: thunderbolt: Fix the parameter passing of tb_xdomain_enable_paths()/tb_xdomain_disable_paths() - net: thunderbolt: Enable end-to-end flow control also in transmit - kselftest/arm64: Specify SVE data when testing VL set in sve-ptrace - wifi: mt76: mt7915: mcu: re-init MCU before loading FW patch - wifi: rtw89: Disable deep power saving for USB/SDIO - wifi: rtw89: Fix rtw89_mac_power_switch() for USB - drm/msm: use trylock for debugfs - wifi: mac80211: fix rx link assignment for non-MLO stations - ipv6: mcast: Check inet6_dev->dead under idev->mc_lock in __ipv6_dev_mc_inc(). - (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer - wifi: mac80211: don't complete management TX on SAE commit - sched/fair: Bump sd->max_newidle_lb_cost when newidle balance fails - s390/stp: Remove udelay from stp_sync_clock() - wifi: iwlwifi: mvm: fix scan request validation - um: Re-evaluate thread flags repeatedly - wifi: iwlwifi: mvm: set gtk id also in older FWs - perf/cxlpmu: Remove unintended newline from IRQ name format string - net: phy: micrel: Add ksz9131_resume() - net: thunderx: Fix format-truncation warning in bgx_acpi_match_id() - net: ipv4: fix incorrect MTU in broadcast routes - wifi: cfg80211: Fix interface type validation - net: mctp: Prevent duplicate binds - arm64: Mark kernel as tainted on SAE and SError panic - net/mlx5e: Properly access RCU protected qdisc_sleeping variable - net: ag71xx: Add missing check after DMA map - et131x: Add missing check after DMA map - wifi: rtw89: Lower the timeout in rtw89_fw_read_c2h_reg() for USB - be2net: Use correct byte order and format string for TCP seq and ack_seq - s390/time: Use monotonic clock in get_cycles() - wifi: cfg80211: reject HTC bit for management frames - ktest.pl: Prevent recursion of default variable options - wifi: ath12k: Correct tid cleanup when tid setup fails - net: usb: cdc-ncm: check for filtering capability - xen/netfront: Fix TX response spurious interrupts - Bluetooth: hci_sock: Reset cookie to zero in hci_sock_free_cookie() - powerpc/thp: tracing: Hide hugepage events under CONFIG_PPC_BOOK3S_64 - ASoC: qcom: use drvdata instead of component to keep id - ASoC: codecs: rt5640: Retry DEVICE_ID verification - iio: adc: ad7768-1: Ensure SYNC_IN pulse minimum timing requirement - ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros - ALSA: pcm: Rewrite recalculate_boundary() to avoid costly loop - platform/chrome: cros_ec_typec: Defer probe on missing EC parent - platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches - soc: qcom: mdt_loader: Actually use the e_phoff - imx8m-blk-ctrl: set ISI panic write hurry level - pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop() - usb: core: usb_submit_urb: downgrade type check - usb: typec: intel_pmc_mux: Defer probe if SCU IPC isn't present - ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4 - ASoC: hdac_hdmi: Rate limit logging on connection and disconnection - ALSA: hda: Disable jack polling at shutdown - ALSA: hda: Handle the jack polling always via a work - mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode() - mei: bus: Check for still connected devices in mei_cl_bus_dev_release() - char: misc: Fix improper and inaccurate error code returned by misc_init() - reset: brcmstb: Enable reset drivers for ARCH_BCM2835 - pps: clients: gpio: fix interrupt handling order in remove path - ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path - mmc: sdhci-msm: Ensure SD card power isn't ON when card removed - ACPI: processor: fix acpi_object initialization - PM: sleep: console: Fix the black screen issue - thermal: sysfs: Return ENODATA instead of EAGAIN for reads - PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit() - firmware: tegra: Fix IVC dependency problems - ACPI: PRM: Reduce unnecessary printing to avoid user confusion - selftests: tracing: Use mutex_unlock for testing glob filter - tools/build: Fix s390(x) cross-compilation with clang - gpio: tps65912: check the return value of regmap_update_bits() - iio: adc: ad_sigma_delta: don't overallocate scan buffer - tools/nolibc: define time_t in terms of __kernel_old_time_t - thermal/drivers/qcom-spmi-temp-alarm: Enable stage 2 shutdown when required - ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed - EDAC/synopsys: Clear the ECC counters on init - gpio: wcd934x: check the return value of regmap_update_bits() - remoteproc: imx_rproc: skip clock enable when M-core is managed by the SCU - soc: qcom: rpmh-rsc: Add RSC version 4 support - usb: xhci: Avoid showing errors during surprise removal - usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command - usb: xhci: Avoid showing warnings for dying controller - usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default - selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t - cpufreq: CPPC: Mark driver with NEED_UPDATE_LIMITS flag - platform/x86/amd: pmc: Add Lenovo Yoga 6 13ALC6 to pmc quirk list - usb: xhci: print xhci->xhc_state when queue_command failed - tracefs: Add d_delete to remove negative dentries - securityfs: don't pin dentries twice, once is enough... - fix locking in efi_secret_unlink() - ext2: Handle fiemap on empty files to prevent EINVAL - fs/ntfs3: correctly create symlink for relative path - fs/ntfs3: Add sanity check for file name - better lockdep annotations for simple_recursive_removal() - hfs: fix not erasing deleted b-tree node issue - drbd: add missing kref_get in handle_write_conflicts - udf: Verify partition map count - gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops - nvme-pci: try function level reset on init failure - smb/server: avoid deadlock when linking with ReplaceIfExists - arm64: Handle KCOV __init vs inline mismatches - ptp: prevent possible ABBA deadlock in ptp_clock_freerun() - intel_idle: Allow loading ACPI tables for any family - net: ti: icss-iep: Fix incorrect type for return value in extts_enable() - netfilter: ctnetlink: fix refcount leak on table dump - udp: also consider secpath when evaluating ipsec use for checksumming - KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs - KVM: nVMX: Check vmcs12->guest_ia32_debugctl on nested VM-Enter - KVM: VMX: Extract checking of guest's DEBUGCTL into helper - KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported - KVM: VMX: Handle forced exit due to preemption timer in fastpath - KVM: VMX: Re-enter guest in fastpath for "spurious" preemption timer exits - KVM: x86: Plumb "force_immediate_exit" into kvm_entry() tracepoint - libceph: prevent potential out-of-bounds reads in handle_auth_done() - net: usb: pegasus: fix memory leak in update_eth_regs_async() - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() - !20540 urma: added support for ipoverurma - team: fix check for port enabled in team_queue_override_port_prio_changed() - mm/page_alloc: prevent pcp corruption with SMP=n - !20528 Fix CVE-2025-71083 - KVM: nVMX: Defer SVI update to vmcs01 on EOI when L2 is active w/o VID - KVM: x86: Plumb in the vCPU to kvm_x86_ops.hwapic_isr_update() - KVM: SVM: Set RFLAGS.IF=1 in C code, to get VMRUN out of the STI shadow - smb: client: don't wait for info->send_pending == 0 on error - smb: client: let send_done() cleanup before calling smbd_disconnect_rdma_connection() - ACPI: processor: perflib: Move problematic pr->performance check - ACPI: processor: perflib: Fix initial _PPC limit application - Documentation: ACPI: Fix parent device references - fs: Prevent file descriptor table allocations exceeding INT_MAX - sunvdc: Balance device refcount in vdc_port_mpgroup_check - PCI: Extend isolated function probing to LoongArch - NFSD: detect mismatch of file handle and delegation stateid in OPEN op - net: dpaa: fix device leak when querying time stamp info - net: ti: icss-iep: fix device and OF node leaks at probe - net: mtk_eth_soc: fix device leak at probe - net: enetc: fix device and OF node leak at probe - net: gianfar: fix device leak when querying time stamp info - net: phy: micrel: fix KSZ8081/KSZ8091 cable test - gpio: mlxbf3: use platform_get_irq_optional() - gpio: mlxbf2: use platform_get_irq_optional() - gpio: virtio: Fix config space reading. - ALSA: hda/realtek: Add Framework Laptop 13 (AMD Ryzen AI 300) to quirks - ALSA: hda/realtek: Fix headset mic on HONOR BRB-X - ALSA: usb-audio: Validate UAC3 cluster segment descriptors - rcu: Fix racy re-initialization of irq_work causing hangs - rcu: Fix rcu_read_unlock() deadloop due to IRQ work - drm/tilcdc: Fix removal actions in case of failed probe - drm/tilcdc: request and mapp iomem with devres - urma: fix update topo logic - dmaengine: stm32: dmamux: fix device leak on route allocation - pswiotlb: Adapt to the IOMMU DMA API upgraded by IOMMUFD - null_blk: fix kmemleak by releasing references to fault configfs items - inet: frags: flush pending skbs in fqdir_pre_exit() - inet: frags: add inet_frag_queue_flush() - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() - md/dm-raid: don't clear MD_RECOVERY_FROZEN after setting frozen - md/dm-raid: don't call md_reap_sync_thread() directly - ACPICA: Avoid walking the Namespace if start_node is NULL - arm64: entry: xcall/xint: make asm conditionals compatible with clang IAS - LoongArch: BPF: Sign extend kfunc call arguments - genirq/msi:: Fix kabi break of struct msi_desc - genirq/msi: Store the IOMMU IOVA directly in msi_desc instead of iommu_cookie - NFS: Fix a deadlock involving nfs_release_folio() - Revert "[Huawei] Revert "NFS: fix up nfs_release_folio() to try to release the page"" - urma: added support for ipoverurma - drm/ttm: Avoid NULL pointer deref for evicted BOs - XSched: Update XSched manual - svcrdma: bound check rq_pages index in inline path - ipv6: Fix use-after-free in inet6_addr_del(). - ipv4: ip_gre: make ipgre_header() robust - net: fix memory leak in skb_segment_list for GRO packets - net: sock: fix hardened usercopy panic in sock_recv_errqueue - ipv4: Fix reference count leak when using error routes with nexthop objects - SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf - fbdev: Fix vmalloc out-of-bounds write in fast_imageblit - udp: Deal with race between UDP socket address change and rehash - EDAC/amd64: The width of hash value is 2 bits for Hygon family 18h model 6h processors - x86/tsc: Use topology_max_packages() to get package number - EDAC/amd64: Use unicast instead of broadcast to access the cs_config register - EDAC/amd64: Correct the address translation for hygon family 18h model 4h - KVM: arm64: Mark some header functions as inline - KVM: arm64: Refactor exit handlers - x86/resctrl: Fix memory bandwidth counter width for Hygon CPUs - hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio - !20820 ub/obmm: add sysfs interface for mempool statistics & bugfixes - ub/obmm: fix wrong pxm_numa parameter validation - ub/obmm: Remove unused parameters from obmm_addr_check.c - ub/obmm: Enhance mem_allocator_granu validation - ub/obmm: simplify allocator naming scheme - ub/obmm: fix allow_slow logic and optimize conti_alloc_memory - ub/obmm: add sysfs interface with fine-grained memory statistics - !20804 net: hv_netvsc: reject RSS hash key programming without RX indirection table - !20813 migrate: correct lock ordering for hugetlb file folios - !20812 libceph: make calc_target() set t->paused, not just clear it - !20719 drivers/ub/sentry: some bugfix - !20798 urma: log should not retrieve eid_idx from uctx - !20808 urma: support triple bonding device - urma: log should not retrieve eid_idx from uctx - migrate: correct lock ordering for hugetlb file folios - libceph: make calc_target() set t->paused, not just clear it - !20745 vfio platform VFIO support for hisi05a1 devices - urma: support triple bonding device - net: hv_netvsc: reject RSS hash key programming without RX indirection table - !20789 gic: Add hip09 support for HISILICON_ERRATUM_165010801 - !20726 tracing: Add recursion protection in kernel stack trace recording - !20668 irqchip/gic-v3-its: Avoid truncating memory addresses - !20795 ub: udma: support query and set qos info. - !20791 Migration/urma:optimize performance in live migration. - ub: udma: Support for UE link establishment message. - Migration/urma: optimize performance in live migration. - !20787 ub: cdma: modify the method of assigning values to the structure - !20759 ubcore: hotfix route query for port eid on the same node. - ub: udma: support query and set qos info. - Revert "ub: ubase: Support for RC saved by queue granularity" - ubcore: hotfix route query for port eid on the same node. - !20676 urma: set/get sl - !20765 urma: bugfix of UAF and double free in ubcm - !20778 ub: ubase&unic: Fixes some bugfix in resetting and dfx ability - gic: Add hip09 support for HISILICON_ERRATUM_165010801 - vfio/platform: Add CONFIG_VFIO_HISI05A1 to openeuler_defconfig and turn it on by default - vfio/platform: VFIO support for hisi05a1 devices - ub: cdma: modify the method of assigning values to the structure - urma: set/get sl - ub: ubase: support to query ub dl pkt stats and real-time peak bandwidth - ub: ubase: Support for RC saved by queue granularity - ub: ubase: Traverse mailbox AE events using interrupts and polling. - ub: ubase: Modify ubase ctrlq trace to distinguish between MUE and UE messages - net: unic: The function of dumping himac registers is added. - ub: ubase: Fix MAC is_pfc sync, optimize list ops and code style - ub: ubase: Retain the initial tm qset configuration and restore it - net: unic: Fixed an issue in the bond IP address notification and pause configuration when an exception occurs. - ub: ubase: Add a retransmission function to improve reliability. - net: unic: Increase the readability and reliability of loopback code - net: unic: Synchronize the code modify for ip management and deactivation - net: unic: Increase the readability and reliability of VLAN feature. - net: unic: Added unic DFX log information. - ub: ubase: Add and correct comments for some functions and data structures - net: unic: Notify MAMI when the bond port status changes - ub: ubase: Support for HIMAC reset during ELR reset and Optimize ELR reset - !20768 iommu/ummu-core: Fix separate page table compatibility - !20665 [OLK-6.6] Enhance CMA memory usage reporting for CSV3 - !20764 net: hns3: fix double free issue for tx spare buffer - urma: bugfix of UAF and double free in ubcm - iommu/ummu-core: Fix separate page table compatibility - net: hns3: fix double free issue for tx spare buffer - drivers/ub/sentry: fix memory leak in sentry_msg_helper - drivers/ub/sentry: initialize some variables - drivers/ub/sentry: fix potential buffer overflow in convert_str_to_smh_msg() - drivers/ub/sentry: fix potential null pointer reference in sentry_uvb_comm - drivers/ub/sentry: add input parameter verification for exported symbols - tracing: Add recursion protection in kernel stack trace recording - x86/csv: Enhance CMA memory usage reporting for CSV3 - irqchip/gic-v3-its: Avoid truncating memory addresses - change the package name of 64KB page size kernel to kernel-64k - !20704 kernel support hisi-cca-da - !20180 [virtCCA Live Migration 2]virtcca secure cvm supports live migration - !20905 v2 KVM: arm64: Fix softirq masking in FPSIMD register saving sequence - !20965 iommu/ummu: Optimized TID invalidation and tdev initialization - !20964 iommu/ummu: Support TID and EID Granularity for MPAM - !20970 ub: ubase&unic: Supporting the black box capability of the ubase&unic driver - hisi-cca-da: Start dev by rsi call - hisi-cca-da: Set ripas of the bar region as RIPAS_DEV - hisi-cca-da: Support swiotlb and realm memory use - hisi-cca-da: Add smmu info when dev attach - hisi-cca-da: Transfer realm msix access to rmm - hisi-cca-da: Support pcipc sriov capability - hisi-cca-da: Delay realm memory release to kvm_destroy_realm - hisi-cca-da: Create realm s2 host pgtable and map msi mmio to rmm - hisi-cca-da: Add cca realm s2 pgtable framework - hisi-cca-da: Use bitmap to determine whether the command can be forwarded - hisi-cca-da: Restrict Realm SMMU to stage-2 domain only - hisi-cca-da: Add cmd forward mechanism in realm smmu - hisi-cca-da: Add realm smmu event and gerror irq initialization - hisi-cca-da: Add realm smmu stream table initialization - hisi-cca-da: Add realm smmu cmdq and evtq initialization - hisi-cca-da: Add realm smmu initialization - hisi-cca-da: Add relam iommu support to iommufd - hisi-cca-da: Add realm iommu support for vfio-iommu-type1 - hisi-cca-da: Support dev map and unmap - hisi-cca-da: Support dev validate and dev start - hisi-cca-da: VFIO support ccada - hisi-cca-da: Support dev delegate and dev attach - hisi-cca-da: Support root dev delegate and dev init - hisi-cca-da: Add hisilicon extension smc and ccada cmd - hisi-cca-da: Add hisi ccada feature config - !20751 ARM CCA supports hugepage - !20944 ub: ubmempfd: supports for D2H mapping and demapping - !20888 HiSock Enhancement - ub: ubase&unic: Supporting the black box capability of the ubase&unic driver. - net: unic: Resolve the residual MAC address problem - net: unic: Optimized the code for the cmd structure and FEC function. - ub: ubase: add log for post mailbox timeout - ub: ubus: Remove black box header file to include dir - rme: Remove the secret bit of the vring desc addr - rme: improve hisi-cca data mmap and destroy method - !20943 uvb: fix wd_obtain logic err - !20942 urma: fix bond device id not release - !20892 dcache: Limit the minimal number of bucket to two - rme: isolate page when do delegation to avoid migration - rme: hisi-cca supports different levels for mapping ram - rme: rename ccal to hisi-cca - rme: support set ripas for ccal realm vm - rme: support destroy ram data for ccal realm vm - rme: support populate region for ccal realm vm - rme: support map ram for ccal realm vm - rme: support config ccal realm vm - rme: support ccal RMI calls - rme: realm vm supports wfx handler - !20952 urma: introduce ipourma module - iommu/ummu-core: Simplifies tdev initialization resources - iommu/ummu: Optimized log printing - iommu/ummu: Use passed gfp_mask in map_pages callback - uvb: fix wd_obtain logic err - !20949 ub: udma: support user ctl function. - urma: fix bond device id not release - !20901 drivers/ub/sentry: some bugfix - ub: ubmempfd: supports for D2H mapping and demapping - ub: ubmempfd: supports providing services to the QEMU process through file nodes - [virtCCA Live Migration 2]virtcca secure cvm supports live migration - urma: query priority and enable bit, support ring size configuration - urma: implement debugfs, improve boundary checks and error handling logic - urma: implement data plane interaction and statistics - urma: implement ipourma network device operations - urma: ipourma resource management - urma: ipourma resource management and err code - urma: introduce ipourma main module - iommu/ummu: Optimized the TID invalidation configuration - iommu/ummu: Optimized SVA permission table memory allocation approach - iommu/ummu: Adapt UMMU SVA interface adjustment - iommu/ummu: Support TID and EID Granularity for MPAM - !20848 [OLK-6.6] backport important bugfix for nvme driver from upstream linux-6.6.y - !20847 urma: sl resource query error - !20908 [OLK-6.6][linux-6.6.y sync] Backport 6.6.108-6.6.110 LTS Patches - !20084 Loongarch: Enable CONFIG_CRYPTO_XTS for disk encryption - !20929 PCI: Fix NVMe link speed downgrade to 2.5GT/s during hotplug - drivers/ub/sentry: fix check input parameters - ub: udma: support user ctl function. - ub: udma: support uboe function. - ub: udma: bugfix related to query aux info. - !20935 ub: ubmem_vmmu: supports IOMMU driver for the UB memory MMU in VMs - drivers/ub/sentry: do not use magic numbers - !20876 urma: Kernel-mode specific implementations file for Jetty extension interface - urma: sl resource query error - !20873 sunrpc: fix NULL pointer dereference in rpcb_register_inet6 and rpcb_register_inet4 - !20875 sunrpc: fix race in cache cleanup causing stale nextcheck time - ub: ubmem_vmmu: supports IOMMU driver for the UB memory MMU in VMs - ub: ubmem_vmmu: supports parsing and configuring the hardware node information - ub: ubmem_vmmu: HiSilicon ubmem_vmmu Architecture Implementation - !20806 Fix CVE-2025-71225 - !20896 scsi: qla2xxx: Free sp in error path to fix system crash - !20894 scsi: qla2xxx: Delay module unload while fabric scan in progress - !20893 scsi: qla2xxx: Validate sp before freeing associated memory - !20802 Fix CVE-2026-23110 - urma: Kernel-mode specific implementations file for Jetty extension interface - drivers/ub/sentry: fix memory leak in process_urma_data() - drivers/ub/sentry: initialize some variables - PCI: Fix NVMe link speed downgrade to 2.5GT/s during hotplug - !20770 ub: ubdevshm: supports the memory user to obtain and release shared memory - Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 - mm: consider non-anon swap cache folios in folio_expected_ref_count() - mm: simplify folio_expected_ref_count() - ASoC: qcom: audioreach: fix potential null pointer dereference - gcc-plugins: Remove TODO_verify_il for GCC >= 16 - crypto: sha256 - fix crash at kexec - drm/i915/backlight: Return immediately when scale() finds invalid parameters - minmax.h: remove some #defines that are only expanded once - minmax.h: simplify the variants of clamp() - minmax.h: move all the clamp() definitions after the min/max() ones - minmax.h: use BUILD_BUG_ON_MSG() for the lo < hi test in clamp() - minmax.h: reduce the #define expansion of min(), max() and clamp() - minmax.h: update some comments - minmax.h: add whitespace around operators and after commas - minmax: fix up min3() and max3() too - minmax: improve macro expansion and type checking - minmax: don't use max() in situations that want a C constant expression - minmax: simplify min()/max()/clamp() implementation - minmax: make generic MIN() and MAX() macros available everywhere - drm/ast: Use msleep instead of mdelay for edid read - gpiolib: Extend software-node support to support secondary software-nodes - ARM: bcm: Select ARM_GIC_V3 for ARCH_BRCMSTB - s390/cpum_cf: Fix uninitialized warning after backport of ce971233242b - kmsan: fix out-of-bounds access to shadow memory - afs: Fix potential null pointer dereference in afs_put_server - ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address - i40e: improve VF MAC filters accounting - i40e: add mask to apply valid bits for itr_idx - HID: asus: add support for missing PX series fn keys - drm/gma500: Fix null dereference in hdmi teardown - octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() - net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port - net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() - net: dsa: lantiq_gswip: do also enable or disable cpu port - selftests: fib_nexthops: Fix creation of non-FDB nexthops - net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS - bnxt_en: correct offset handling for IPv6 destination address - vhost: Take a reference on the task in struct vhost_task. - Bluetooth: hci_sync: Fix hci_resume_advertising_sync - ethernet: rvu-af: Remove slash from the driver name - can: peak_usb: fix shift-out-of-bounds issue - can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow - can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow - can: hi311x: populate ndo_change_mtu() to prevent buffer overflow - can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow - bpf: Reject bpf_timer for PREEMPT_RT - can: rcar_can: rcar_can_resume(): fix s2ram with PSCI - wifi: virt_wifi: Fix page fault on connect - cpufreq: Initialize cpufreq-based invariance before subsys - ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients - arm64: dts: imx8mp: Correct thermal sensor index - mm: folio_may_be_lru_cached() unless folio_test_large() - mm/gup: local lru_add_drain() to avoid lru_add_drain_all() - mm/gup: check ref_count instead of lru before migration - mm: add folio_expected_ref_count() for reference count calculation - mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked" - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions - ALSA: usb-audio: Add mute TLV for playback volumes on more devices - ALSA: usb-audio: move mixer_quirks' min_mute into common quirk - ALSA: usb-audio: Add DSD support for Comtrue USB Audio device - i2c: designware: Add quirk for Intel Xe - mmc: sdhci-cadence: add Mobileye eyeQ support - usb: core: Add 0x prefix to quirks debug output - ALSA: usb-audio: Fix build with CONFIG_INPUT=n - ALSA: usb-audio: Convert comma to semicolon - ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 - ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks - ALSA: usb-audio: Simplify NULL comparison in mixer_quirks - ALSA: usb-audio: Avoid multiple assignments in mixer_quirks - ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks - ALSA: usb-audio: Fix block comments in mixer_quirks - firewire: core: fix overlooked update of subsystem ABI version - scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE - !20843 [OLK-6.6][linux-6.6.y sync] Backport 6.6.107-6.6.108 LTS Patches - !20869 ub:hisi-ubus: fix bug of security smatch - !20861 CVE-2026-23163 - ub: ubdevshm: supports the memory user to obtain and release shared memory - ub: ubdevshm: supports granting and revoking shared memory permissions - ub: ubdevshm: supports the registration and deregistration of shared memory segments - ub: ubdevshm: supports the registration and deregistration - KVM: arm64: Fix softirq masking in FPSIMD register saving sequence - !20886 Fix CVE-2026-23205 - !20803 Fix CVE-2026-23112 - !20868 sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure - !20811 smb/server: fix refcount leak in smb2_open() - !20810 smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() - !20809 smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() - sunrpc: fix NULL pointer dereference in rpcb_register_inet6 and rpcb_register_inet4 - sunrpc: fix race in cache cleanup causing stale nextcheck time - scsi: qla2xxx: Free sp in error path to fix system crash - scsi: qla2xxx: Delay module unload while fabric scan in progress - scsi: qla2xxx: Validate sp before freeing associated memory - dcache: Limit the minimal number of bucket to two - !20872 Fix CVE-2026-23220 - !20846 Fix CVE-2026-23193 - !20815 Fix CVE-2026-23216 - !20859 Fix CVE-2026-23179 - !20871 CVE-2026-23096 - !20858 ub: ubase: resolve the cmdq crq overflow problem - bpf: Deprecate hisock unused kfuncs and orig ingress logic - bpf: Add local connect support for hisock - bpf: Add ipv4-mapped ipv6 addr support for hisock - bpf: Add target comm parse to hisock_cmd - bpf: Add multi port parse to hisock_cmd - bpf: Only deploy hisock in server - bpf: Apply BPF_HISOCK_INGRESS to hisock ingress - bpf: Add bpf_handle_ingress/egress_ptype kfunc - bpf: Add bpf_get_skb_ethhdr kfunc - bpf: Add bpf_set_ingress/egress_dev kfunc - bpf: Add bpf_set_ingress_dst kfunc - bpf: Add BPF_HISOCK_INGRESS attach type - cgroup: make cgroup_bpf_prog_attach work when cgroup2 is not mounted - smb: client: fix potential UAF and double free in smb2_open_file() - smb/client: fix memory leak in smb2_open_file() - !20852 ASoC: amd: fix memory leak in acp3x pdm dma ops - ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths - uacce: fix cdev handling in the cleanup path - Revert "uacce: fix for cdev memory leak" - ub:hisi-ubus: fix bug of security smatch - ub:ubus: injected route event - ub:ubus: Black Box Development - !20865 urma: urma support uboe - sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure - urma: urma support uboe - !20857 ub_fwctl driver adds support for querying some functions - ub:ub_fwctl:Add illegal verification for scc - ub:ub_fwctl:Support querying the historical status of port links - drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove - drm/amdkfd: Don't use sw fault filter if retry cam enabled - ub:ub_fwctl:Support querying firmware version numbers - ub: ub_fwctl: Support querying real-time bandwidth statistics - ub:ub_fwctl:Support querying statistical indicators at the ub port and uboe port levels - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() - !20854 [URMA] add ping server for urma_ping - urma: add ping server - ub: ubase: resolve the cmdq crq overflow problem - ub: ubase: Optimized the QoS code naming to improve code readability. - ub: ubase&unic: optimizing code and configuration settings. - net: unic: not support query and configure ip by control plane in UBoE - net: unic: fix the automatically enable uc guid promisc mode. - !20844 urma:kernel header of userctl - urma: Kernel-mode header file for Jetty extension interface - ASoC: amd: fix memory leak in acp3x pdm dma ops - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() - phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again) - ACPICA: Work around bogus -Wstringop-overread warning since GCC 11 - !20835 Fix CVE-2026-23084 - minmax: add a few more MIN_T/MAX_T users - minmax: simplify and clarify min_t()/max_t() implementation - minmax: avoid overly complicated constant expressions in VM code - rtc: pcf2127: fix SPI command byte for PCF2131 backport - xhci: dbc: Fix full DbC transfer ring after several reconnects - xhci: dbc: decouple endpoint allocation from initialization - phy: ti: omap-usb2: fix device leak at unbind - phy: Use device_get_match_data() - drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path - ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message - ASoC: wm8974: Correct PLL rate rounding - ASoC: wm8940: Correct typo in control name - ASoC: wm8940: Correct PLL rate rounding - io_uring: include dying ring in task_work "should cancel" state - io_uring: backport io_should_terminate_tw() - ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx - selftests: mptcp: avoid spurious errors on TCP disconnect - selftests: mptcp: connect: catch IO errors on listen side - rds: ib: Increment i_fastreg_wrs before bailing out - KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active - mmc: mvsdio: Fix dma_unmap_sg() nents value - ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S - ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface - btrfs: tree-checker: fix the incorrect inode ref size check - iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page() - LoongArch: Check the return value when creating kobj - LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled - LoongArch: Update help info of ARCH_STRICT_ALIGN - nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* - octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() - net: liquidio: fix overflow in octeon_init_instr_queue() - bonding: don't set oif to bond dev when getting NS target destination - net/mlx5e: Consider aggregated port speed during rate configuration - i40e: remove redundant memory barrier when cleaning Tx descs - net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure - selftests: mptcp: sockopt: fix error messages - mptcp: tfo: record 'deny join id0' info - mptcp: set remote_deny_join_id0 on SYN recv - dpaa2-switch: fix buffer pool seeding for control traffic - btrfs: fix invalid extref key setup when replaying dentry - pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch - wifi: mac80211: fix incorrect type for ret - wifi: mac80211: increase scan_ies_len for S1G - ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported - !20769 [OLK-6.6][linux-6.6.y sync] Backport 6.6.106-6.6.107 LTS Patches - be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list - !20776 ub:ubfi: Release the chosen node - !20817 CVE-2026-23094 - !20819 dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() - ub:ubus: Add port num check - !20379 [OLK-6.6][sync from OLK-5.10]io_uring: Support forcing sq thread to be idle and woken up by hrtimer - !20830 sched/soft_domain: Increasing NR_MAX_CLUSTER to 32 - sched/soft_domain: Increasing NR_MAX_CLUSTER to 32 - btrfs: fix incorrect readahead expansion length - x86: disable image size check for test builds - drm/i915/power: fix size for for_each_set_bit() in abox iteration - drm/amdgpu: fix a memory leak in fence cleanup when unloading - net: mdiobus: release reset_gpio in mdiobus_unregister_device() - phy: ti-pipe3: fix device leak at unbind - phy: tegra: xusb: fix device and OF node leak at probe - dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate - usb: gadget: midi2: Fix MIDI2 IN EP max packet size - usb: gadget: midi2: Fix missing UMP group attributes initialization - USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels - RISC-V: Remove unnecessary include from compat.h - hrtimer: Rename __hrtimer_hres_active() to hrtimer_hres_active() - hrtimer: Remove unused function - regulator: sy7636a: fix lifecycle of power good gpio - dmaengine: ti: edma: Fix memory allocation size for queue_priority_map - hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr - hsr: use rtnl lock when iterating over ports - net: hsr: Add VLAN CTAG filter support - net: hsr: Add support for MC filtering at the slave device - can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB - can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails - can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed - igb: fix link test skipping when interface is admin down - docs: networking: can: change bcm_msg_head frames member to support flexible array - tunnels: reset the GSO metadata before reusing the skb - net: bridge: Bounce invalid boolopts - net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() - USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions - USB: serial: option: add Telit Cinterion FN990A w/audio compositions - dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks - serial: sc16is7xx: fix bug in flow control levels init - tty: hvc_console: Call hvc_kick in hvc_write unconditionally - Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups" - Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table - Input: iqs7222 - avoid enabling unused interrupts - mm/khugepaged: fix the address passed to notifier on testing young - btrfs: fix corruption reading compressed range when block size is smaller than page size - btrfs: use readahead_expand() on compressed extents - mm/damon/sysfs: fix use-after-free in state_show() - mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing - mtd: nand: raw: atmel: Fix comment in timings preparation - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages - drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time - mm/damon/core: set quota->charged_from to jiffies at first charge window - fuse: prevent overflow in copy_file_range return value - fuse: check if copy_file_range() returns larger than requested size - mtd: rawnand: stm32_fmc2: fix ECC overwrite - mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer - net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups - i2c: i801: Hide Intel Birch Stream SoC TCO WDT - ocfs2: fix recursive semaphore deadlock in fiemap call - mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN - compiler-clang.h: define __SANITIZE_*__ macros only when undefined - EDAC/altera: Delete an inappropriate dma_free_coherent() call - rcu-tasks: Maintain real-time response in rcu_tasks_postscan() - rcu-tasks: Eliminate deadlocks involving do_exit() and RCU tasks - rcu-tasks: Maintain lists to eliminate RCU-tasks/do_exit() deadlocks - s390/cpum_cf: Deny all sampling events by counter PMU - NFSv4/flexfiles: Fix layout merge mirror check. - NFSv4.2: Serialise O_DIRECT i/o and copy range - NFSv4.2: Serialise O_DIRECT i/o and clone range - NFSv4.2: Serialise O_DIRECT i/o and fallocate() - NFS: Serialise O_DIRECT i/o and truncate() - fs/nfs/io: make nfs_start_io_*() killable - ftrace/samples: Fix function size computation - NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server - NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set - media: i2c: imx214: Fix link frequency validation - NFSD: nfsd_unlink() clobbers non-zero status returned from fh_fill_pre_attrs() - nfsd: Fix a regression in nfsd_setattr() - kasan: fix GCC mem-intrinsic prefix with sw tags - kunit: kasan_test: disable fortify string checker on kasan_strings() test - io_uring: fix kabi broken in struct io_ring_ctx - io_uring: Support forcing sq thread to be idle and woken up by hrtimer - dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() - uacce: fix isolate sysfs check condition - Revert "uacce: fix isolate sysfs check condition" - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() - smb/server: fix refcount leak in smb2_open() - smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() - smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() - md: suspend array while updating raid_disks via sysfs - scsi: core: Wake up the error handler when final completions race against each other - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec - ub:ubfi: Release the chosen node - ub:ubus: Delete unused functions - Loongarch: Enable CONFIG_CRYPTO_XTS for disk encryption - Add sw64 support in kernel.spec - !21194 hisi-cca-da: Revert smmu realm enabled condition for arm_smmu_domain_finalise. - !21192 urma: bugfix of ubagg&ubcore&uburma - !21183 platform/x86: classmate-laptop: Add missing NULL pointer checks - urma: bugfix of ubagg&ubcore&uburma - hisi-cca-da: Revert smmu realm enabled condition for arm_smmu_domain_finalise. - platform/x86: classmate-laptop: Add missing NULL pointer checks - !21167 urma: fix kernel codecheck issues. - !21174 urma: change return value for provider err - !21127 urma: copy linked ports when importing bond jetty/seg - !20247 ubcore: query primary eid in ipourma loopback mode. - !21077 Fix hisi cca bugs - ubcore: route query refine and ipo loopback adapt. - hisi-cca-da: Transfer PCIe ECAM access requests to RMM for realm device. - hisi-cca-da: Write NS STE for PF drivers. - hisi-cca-da: Provide IO interfaces - hisi-cca-da: Destroy mmu stage2 pagetable after closing vfio devices - !21045 scsi: hisi_sas: Fix NULL pointer exception when do user_scan() - hisi-cca-da: Automatically unbind PF/VF drivers and prevent probe. - !21165 tools/interference: add ifstool utility for kernel interference statistics - !21166 urma: fix jfce uaf in batch cleanup - !21043 urma: fix tjetty ref in ping server - urma: change return value for provider err - !21128 sched/rt: Skip currently executing CPU in rto_next_cpu() - !21129 procfs: fix missing RCU protection when reading real_parent in do_task_stat() - urma: fix jfce uaf in batch cleanup - !21074 ipmi: Add HiSilicon IPMI Page Soft Offline driver - !21076 [OLK-6.6][linux-6.6.y sync] Backport 6.6.112-6.6.113 LTS Patches - urma: fix kernel codecheck issues. - tools/interference: add ifstool utility for kernel interference statistics - !20291 [Hygon][6.6][Bugfix] Bug fix for EDAC decode address fail issue on Hygon Dhyana processor - !21092 kexec: derive purgatory entry from symbol - !21154 sched: Add SOFT_DOMAIN feature interface for cgroup2 - !21153 fix CVE-2025-39981 - Revert "hisi-cca-da: Delay realm memory release to kvm_destroy_realm" - urma: fix tjetty ref in ping server - rme: Enforce isolation to solve compile error without config CONFIG_HISI_CCA - hisi-cca-da: Improve hisi cca dev validate and delegate - hisi-cca-da: Fix smmu enable rme problem - hisi-cca-da: Fix msi region shared problem - sched: Add SOFT_DOMAIN feature interface for cgroup2 - Bluetooth: MGMT: Fix memory leak in set_ssp_complete - Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete - overflow: Introduce __DEFINE_FLEX for having no initializer - overflow: Fix direct struct member initialization in _DEFINE_FLEX() - overflow: Change DEFINE_FLEX to take __counted_by member - overflow: add DEFINE_FLEX() for on-stack allocs - Bluetooth: MGMT: Fix possible UAFs - Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete() - !21103 Revert "mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()" - !21104 v2 vsock/virtio: cap TX credit to local buffer size - !21070 Fixes CVE-2026-23100 - !21135 RDMA/hns: Support configure and query the CNP DSCP through sysfs - !21088 ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref - RDMA/hns: Support configure and query the CNP DSCP through sysfs - RDMA/hns: Support query FW cap bit - RDMA/hns: Support query HW ID. - !20934 smb/server: fix refcount leak in parse_durable_handle_context() - !21004 regmap: Fix race condition in hwspinlock irqsave routine - !19568 [OLK-6.6]fix txgbe clang compile warning - urma: copy linked ports when importing bond jetty/seg - procfs: fix missing RCU protection when reading real_parent in do_task_stat() - sched/rt: Skip currently executing CPU in rto_next_cpu() - !21073 scsi: qla2xxx: Fix bsg_done() causing double free - !21114 CVE-2024-57979 - !21113 iommu: disable SVA when CONFIG_X86 is set - !20957 dmaengine: xilinx: xdma: Fix regmap max_register - !21087 net: unic: Multiple stability fixes for tx timeout, DFX capability and concurrent activation/reset - pps: Fix a use-after-free - fix kabi - pps: Fix a use-after-free - !21078 of: unittest: Fix memory leak in unittest_data_add() - !21079 *** fix CVE-2026-23208 *** - !21082 ALSA: aloop: Fix racy access at PCM trigger - !21083 bus: fsl-mc: fix use-after-free in driver_override_show() - iommu: disable SVA when CONFIG_X86 is set - vsock/virtio: cap TX credit to local buffer size - Revert "mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()" - !20983 Fix CVE-2026-23139 - !20878 Fix CVE-2026-23230 - kexec: derive purgatory entry from symbol - lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC - PCI/IOV: Fix race between SR-IOV enable/disable and hotplug - Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" - rtc: interface: Alarm race handling should not discard preceding error - perf test stat tests: Fix for virtualized machines - perf test stat: Update test expectations and events - perf test stat: Avoid hybrid assumption when virtualized - writeback: Avoid excessively long inode switching times - writeback: Avoid softlockup when switching many inodes - cramfs: Verify inode mode when loading from disk - fs: Add 'initramfs_options' to set initramfs mount options - minixfs: Verify inode mode when loading from disk - irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume - irqchip/sifive-plic: Make use of __assign_bit() - selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled - s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG - s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL - s390/bpf: Describe the frame using a struct instead of constants - s390/bpf: Centralize frame offset calculations - s390/bpf: Change seen_reg to a mask - ACPI: property: Do not pass NULL handles to acpi_attach_data() - ACPI: property: Add code comments explaining what is going on - ACPI: property: Disregard references in data-only subnode lists - ACPI: battery: Add synchronization between interface updates - ACPI: battery: Check for error code from devm_mutex_init() call - ACPI: battery: initialize mutexes through devm_ APIs - ACPI: battery: allocate driver data through devm_ APIs - arm64: mte: Do not flag the zero page as PG_mte_tagged - ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref - !20790 dm: use bio_clone_blkg_association - ipmi: Add HiSilicon IPMI Page Soft Offline driver - net: unic: Resolve network unavailability caused by concurrent activation and reset - net: unic: Provide the DFX capability for querying MNG table - net: unic: Delete the elr reset process after the tx timeout - bus: fsl-mc: fix use-after-free in driver_override_show() - ALSA: aloop: Fix racy access at PCM trigger - ALSA: usb-audio: Use the right limit for PCM OOB check - ALSA: usb-audio: Prevent excessive number of frames - of: unittest: Fix memory leak in unittest_data_add() - !21034 CVE-2026-23140 - !21016 net: fix segmentation of forwarding fraglist GRO - !21017 mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() - !21018 CVE-2026-23209 - !21019 ipv6: annotate data-race in ndisc_router_discovery() - !20881 ipvlan: Make the addrs_lock be per port - rme: Imporve range delegate - btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() - PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release - PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() - misc: fastrpc: Save actual DMA size in fastrpc_map structure - misc: fastrpc: Add missing dev_err newlines - mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag - mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type - mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value - media: mc: Clear minor number before put device - lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older - ACPICA: Allow to skip Global Lock initialization - ext4: validate ea_ino and size in check_xattrs - ext4: correctly handle queries for metadata mappings - ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() - nfsd: nfserr_jukebox in nlm_fopen should lead to a retry - NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() - mm/damon/vaddr: do not repeat pte_offset_map_lock() until success - mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 - mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations - wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 - wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again - selftests: mptcp: join: validate C-flag + def limit - spi: cadence-quadspi: Flush posted register writes before DAC access - spi: cadence-quadspi: Flush posted register writes before INDAC access - PCI: tegra194: Handle errors in BPMP response - PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() - PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock - PCI: rcar-host: Drop PMSR spinlock - PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit - PCI/AER: Support errors introduced by PCIe r6.0 - PCI/AER: Fix missing uevent on recovery when a reset is requested - PCI/ERR: Fix uevent on failure to recover - PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV - PCI/sysfs: Ensure devices are powered for config reads - PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock - rseq/selftests: Use weak symbol reference, not definition, to link with glibc - rtc: interface: Fix long-standing race when setting alarm - rtc: interface: Ensure alarm irq is enabled when UIE is enabled - memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe - mmc: core: SPI mode remove cmd7 - mtd: rawnand: fsmc: Default to autodetect buswidth - xtensa: simdisk: add input size check in proc_write_simdisk - sparc: fix error handling in scan_one_device() - sparc64: fix hugetlb for sun4u - scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() - sched/deadline: Fix race in push_dl_task() - pwm: berlin: Fix wrong register in suspend/resume - powerpc/pseries/msi: Fix potential underflow and leak issue - powerpc/powernv/pci: Fix underflow and leak issue - power: supply: max77976_charger: fix constant current reporting - pinctrl: samsung: Drop unused S3C24xx driver data - nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk - parisc: don't reference obsolete termio struct for TC* constants - openat2: don't trigger automounts with RESOLVE_NO_XDEV - of: unittest: Fix device reference count leak in of_unittest_pci_node_verify - lib/genalloc: fix device leak in of_gen_pool_get() - KEYS: trusted_tpm1: Compare HMAC values in constant time - iommu/vt-d: PRS isn't usable if PDS isn't supported - iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume - init: handle bootloader identifier in kernel parameters - iio: xilinx-ams: Unmask interrupts after updating alarms - iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK - iio: frequency: adf4350: Fix prescaler usage. - iio: dac: ad5421: use int type to store negative error codes - iio: dac: ad5360: use int type to store negative error codes - fs/ntfs3: Fix a resource leak bug in wnd_extend() - fbdev: Fix logic error in "offb" name match - crypto: rockchip - Fix dma_unmap_sg() nents value - crypto: atmel - Fix dma_unmap_sg() direction - crypto: aspeed - Fix dma_unmap_sg() direction - copy_sighand: Handle architectures where sizeof(unsigned long) < sizeof(u64) - bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() - bus: mhi: ep: Fix chained transfer handling in read path - btrfs: avoid potential out-of-bounds in btrfs_encode_fh() - blk-crypto: fix missing blktrace bio split events - drm/nouveau: fix bad ret code in nouveau_bo_move_prep - drm/rcar-du: dsi: Fix 1/2/3 lane support - media: lirc: Fix error handling in lirc_register() - media: venus: firmware: Use correct reset sequence for IRIS2 - media: pci: ivtv: Add missing check after DMA map - media: mc: Fix MUST_CONNECT handling for pads with no links - media: i2c: mt9v111: fix incorrect type for ret - media: cx18: Add missing check after DMA map - firmware: meson_sm: fix device leak at probe - xen/events: Update virq_to_irq on migration - xen/events: Return -EEXIST for bound VIRQs - xen/manage: Fix suspend error path - xen/events: Cleanup find_virq() return codes - dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required - ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init - arm64: dts: ti: k3-am62a-main: Fix main padcfg length - arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees - arm64: dts: qcom: msm8939: Add missing MDSS reset - arm64: dts: qcom: msm8916: Add missing MDSS reset - ACPI: debug: fix signedness issues in read/write helpers - ACPI: property: Fix buffer properties extraction for subnodes - gpio: wcd934x: mark the GPIO controller as sleeping - tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single - smb: client: fix missing timestamp updates after utime(2) - bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() - drm/amd/display: Properly disable scaling on DCE6 - drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 - drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs - drm/amdgpu: Add additional DCE6 SCL registers - mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes - mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call - tcp: take care of zero tp->window_clamp in tcp_set_rcvlowat() - perf python: split Clang options when invoking Popen - tools build: Align warning options with perf - net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe - drm/vmwgfx: Fix copy-paste typo in validation - net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() - LoongArch: Init acpi_gbl_use_global_lock to false - LoongArch: Remove CONFIG_ACPI_TABLE_UPGRADE in platform_init() - ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size - scsi: mvsas: Fix use-after-free bugs in mvs_work_queue - clk: tegra: do not overallocate memory for bpmp clocks - clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver - clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() - clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() - clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m - perf evsel: Ensure the fallback message is always written to - perf tools: Add fallback for exclude_guest - perf test: Add a test for default perf stat command - perf test: Don't leak workload gopipe in PERF_RECORD_* - perf session: Fix handling when buffer exceeds 2 GiB - perf arm_spe: Correct memory level for remote access - perf arm_spe: Correct setting remote access - rtc: optee: fix memory leak on driver removal - rtc: x1205: Fix Xicor X1205 vendor prefix - perf util: Fix compression checks returning -1 as bool - clk: at91: peripheral: fix return value - libperf event: Ensure tracing data is multiple of 8 sized - perf evsel: Avoid container_of on a NULL leader - asm-generic/io.h: Skip trace helpers if rwmmio events are disabled - iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE - clocksource/drivers/clps711x: Fix resource leaks in error paths - fscontext: do not consume log entries when returning -EMSGSIZE - fs: always return zero on success from replace_fd() - !21067 [OLK-6.6][linux-6.6.y sync] Backport 6.6.111-6.6.112 LTS Patches - scsi: qla2xxx: Fix bsg_done() causing double free - !21065 Fix CVE-2026-23069 - !21062 v4 Support multi-level cgroup - !20987 Fix CVE-2026-23212 - !20982 Fix CVE-2026-23119 - !20979 Fix CVE-2026-23111 - !20974 Fix CVE-2026-23099 - !20973 Fix CVE-2026-23105 - !20972 Fix CVE-2026-23074 - !20884 ksmbd: add chann_lock to protect ksmbd_chann_list xarray - !20947 Fix CVE-2026-23101 - ext4: clear i_state_flags when alloc inode - misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup - Revert "wifi: ath10k: avoid unnecessary wait for service ready message" - fs/ntfs3: fix mount failure for sparse runs in run_unpack() - !20825 efivarfs: fix error propagation in efivar_entry_get() - !20824 io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop - !20950 ub:ubus: protect iterator ue_list and mue_list with ub_bus_sem - mm/rmap: fix two comments related to huge_pmd_unshare() - mm/hugetlb: fix two comments related to huge_pmd_unshare() - mm/hugetlb: fix hugetlb_pmd_shared() - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count - !20728 drivers: Update vendor name of Chengdu NorthLink Technology N5/N6 Series Network Card Drivers - vsock/virtio: fix potential underflow in virtio_transport_get_credit() - !21001 Fix CVE-2026-23229 - usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call - arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode - !20999 Fix CVE-2026-23173 - usb: typec: tipd: Clear interrupts first - bus: fsl-mc: Check return value of platform_get_resource() - remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() - Input: atmel_mxt_ts - allow reset GPIO to sleep - misc: fastrpc: Skip reference for DMA handles - misc: fastrpc: fix possible map leak in fastrpc_put_args - misc: fastrpc: Fix fastrpc_map_lookup operation - nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() - ext4: fix checks for orphan inodes - ksmbd: fix error code overwriting in smb2_get_info_filesystem() - LoongArch: Automatically disable kaslr if boot from kexec_file - mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() - mfd: rz-mtu3: Fix MTU5 NFCR register offset - ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down - ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() - vhost: vringh: Modify the return value check - net/mlx5: fw reset, add reset timeout work - net/mlx5: pagealloc: Fix reclaim race during command interface teardown - net/mlx5: Stop polling for command response if interface goes down - net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable - nfp: fix RSS hash key size when RSS is not supported - mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands - drivers/base/node: fix double free in register_one_node() - hwrng: ks-sa - fix division by zero in ks_sa_rng_init - KEYS: X.509: Fix Basic Constraints CA flag parsing - Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements - Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO - vhost: vringh: Fix copy_to_iter return value check - RDMA/siw: Always report immediate post SQ errors - usb: vhci-hcd: Prevent suspending virtually attached devices - NFSv4.1: fix backchannel max_resp_sz verification check - coresight: trbe: Return NULL pointer for allocation failures - coresight: etm4x: Support atclk - coresight-etm4x: Conditionally access register TRCEXTINSELR - remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice - PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() - vfio/pds: replace bitmap_free with vfree - sparc: fix accurate exception reporting in copy_{from,to}_user for M7 - sparc: fix accurate exception reporting in copy_to_user for Niagara 4 - sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara - sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III - wifi: mac80211: fix Rx packet handling when pubsta information is not available - wifi: ath10k: avoid unnecessary wait for service ready message - Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram - IB/sa: Fix sa_local_svc_timeout_ms read race - RDMA/core: Resolve MAC of next-hop device without ARP support - f2fs: fix zero-sized extent for precache extents - scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() - scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() - scsi: qla2xxx: edif: Fix incorrect sign of error code - ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message - f2fs: fix to truncate first page in error path of f2fs_truncate() - f2fs: fix to update map->m_next_extent correctly in f2fs_map_blocks() - wifi: mt76: fix potential memory leak in mt76_wmac_probe() - RDMA/cm: Rate limit destroy CM ID timeout error message - drivers/base/node: handle error properly in register_one_node() - watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog - ipvs: Use READ_ONCE/WRITE_ONCE for ipvs->enable - iio: consumers: Fix offset handling in iio_convert_raw_to_processed() - iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() - fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist - fs: ntfs3: Fix integer overflow in run_unpack() - drm/msm/dpu: fix incorrect type for ret - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping - ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping - misc: genwqe: Fix incorrect cmd field being reported in error - usb: gadget: configfs: Correctly set use_os_string at bind - usb: phy: twl6030: Fix incorrect type for ret - drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() - tcp: fix __tcp_close() to only send RST when required - PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation - wifi: mwifiex: send world regulatory domain to driver - drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) - drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) - drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) - drm/amd/pm: Adjust si_upload_smc_data register programming (v3) - drm/amd/pm: Fix si_upload_smc_data (v3) - drm/amd/pm: Disable ULV even if unsupported (v3) - drm/amdgpu: Power up UVD 3 for FW validation (v2) - coresight: Only register perf symlink for sinks with alloc_buffer - inet: ping: check sock_net() in ping_get_port() and ping_lookup() - media: st-delta: avoid excessive stack usage - ALSA: lx_core: use int type to store negative error codes - media: rj54n1cb0c: Fix memleak in rj54n1_probe() - scsi: myrs: Fix dma_alloc_coherent() error check - hwrng: nomadik - add ARM_AMBA dependency - crypto: keembay - Add missing check after sg_nents_for_len() - drm/amd/display: Remove redundant semicolons - serial: max310x: Add error checking in probe() - usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls - usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup - phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 - media: zoran: Remove zoran_fh structure - drm/bridge: it6505: select REGMAP_I2C - f2fs: fix condition in __allow_reserved_blocks() - drm/radeon/r600_cs: clean up of dead code in r600_cs - drm/panel: novatek-nt35560: Fix invalid return value - bpf: Enforce expected_attach_type for tailcall compatibility - i2c: designware: Add disabling clocks when probe fails - i2c: designware: Fix clock issue when PM is disabled - i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD - thermal/drivers/qcom/lmh: Add missing IRQ includes - thermal/drivers/qcom: Make LMH select QCOM_SCM - hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems - once: fix race by moving DO_ONCE to separate section - smp: Fix up and expand the smp_call_function_many() kerneldoc - selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported - i3c: master: svc: Recycle unused IBI slot - i3c: master: svc: Use manual response for IBI events - ACPICA: Fix largest possible resource descriptor index - pwm: tiehrpwm: Fix corner case in clock divisor calculation - arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible - arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value - arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names - cpuidle: qcom-spm: fix device and OF node leaks at probe - firmware: firmware: meson-sm: fix compile-test default - arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 - null_blk: Fix the description of the cache_size module argument - pinctrl: renesas: Use int type to store negative error codes - power: supply: cw2015: Fix a alignment coding style issue - PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() - ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property - ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS - ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax - block: use int to store blk_stack_limits() return value - selftests/nolibc: fix EXPECT_NZ macro - regulator: scmi: Use int type to store negative error codes - arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map - ARM: at91: pm: fix MCKx restore routine - pinctrl: meson-gxl: add missing i2c_d pinmux - soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS - leds: flash: leds-qcom-flash: Update torch current clamp setting - ARM: dts: renesas: porter: Fix CAN pin group - libbpf: Fix reuse of DEVMAP - bpf: Remove migrate_disable in kprobe_multi_link_prog_run - bpf/selftests: Fix test_tcpnotify_user - regmap: Remove superfluous check for !config in __regmap_init() - arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 - x86/vdso: Fix output operand size of RDPID - smb: server: fix IRD/ORD negotiation with the client - coresight: trbe: Prevent overflow in PERF_IDX2OFF() - gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote - selftests: arm64: Check fread return value in exec_target - seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast - init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD - filelock: add FL_RECLAIM to show_fl_flags() macro - !21022 KVM: Don't clobber irqfd routing type when deassigning irqfd - !20998 ceph: fix oops due to invalid pointer for kfree() in parse_longname() - !21023 l2tp: avoid one data-race in l2tp_tunnel_del_work() - xsched: fix potential NULL dereference in xsched_quota_timeout_update - xsched: remove the standalone xcu_cfs_cg_deinit() helper - xsched: restructure xcu_cgrp_subsys teardown to align with cpu_cgrp_subsys lifecycle - xsched: simplify root group check by direct comparison with root_xcg - xsched: replace magic number with SCHED_CLASS_MAX_LENGTH for scheduler class string length - xsched/core: immediate cleanup of remaining operators on task exit - xsched: add init_fair_xsched_group() for XCU-specific fair group initialization - xsched: modify xcu_cg_initialize_components helper - xsched: refactor xsched_entity initialization - xsched: change rq_init() parameter from struct xsched_cu to struct xsched_rq - xsched: harden and clarify xcu_move_task() logic - xsched: move throttling-related fields from xsched_group_xcu_priv to xsched_rq_cfs - xsched/quota: add throttled flag to cfs_rq for robust hierarchical enqueue under throttling - xsched/quota: support multi-level cgroup - xsched: remove redundant xcu parameter from dequeue_ctx - xsched: update group shares using xcu_grp_shares_add/sub helpers - xsched: delete unused code - xsched/cfs: propagate group activation/deactivation up the hierarchy - xsched/cfs: move xruntime updates to pick/put paths - xsched: add has_running hook to xsched classes for wake-up eligibility check - !21012 [OLK-6.6][linux-6.6.y sync] Backport 6.6.110-6.6.111 LTS Patches - scsi: hisi_sas: Fix NULL pointer exception when do user_scan() - !21013 CVE-2026-23177 - !21007 bonding: fix use-after-free due to enslave fail after slave array update - !21006 net: Fix CVE-2026-23204 - bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path - bpf, test_run: Subtract size of xdp_frame from allowed metadata size - bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN - bpf: Make variables in bpf_prog_test_run_xdp less confusing - bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K - !21015 libceph: reset sparse-read state in osd_fault() - !21024 ub: udma: bugfix related to print messages. - !20980 Fix CVE-2026-23126 - !20922 Fix CVE-2026-23133 - ub: udma: bugfix related to print messages. - l2tp: avoid one data-race in l2tp_tunnel_del_work() - KVM: Don't clobber irqfd routing type when deassigning irqfd - ipv6: annotate data-race in ndisc_router_discovery() - macvlan: observe an RCU grace period in macvlan_common_newlink() error path - macvlan: fix error recovery in macvlan_common_newlink() - mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() - net: fix segmentation of forwarding fraglist GRO - can: rcar_canfd: Fix CAN-FD mode as default - libceph: reset sparse-read state in osd_fault() - !21008 uvb: fix cis call return value and obtain - mm, shmem: prevent infinite loop on truncate race - mm/shmem, swap: fix race of truncate and swap entry split - net/9p: fix double req put in p9_fd_cancelled - riscv: mm: Do not restrict mmap address based on hint - riscv: mm: Use hint address in mmap if available - driver core/PM: Set power.no_callbacks along with power.no_pm - serial: stm32: allow selecting console when the driver is module - hid: fix I2C read buffer overflow in raw_event() for mcp2221 - ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free - ALSA: usb-audio: Kill timer properly at removal - platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list - can: rcar_canfd: Fix controller mode setting - can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled - btrfs: ref-verify: handle damaged extent root tree - ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue - perf subcmd: avoid crash in exclude_cmds when excludes is empty - platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list - dm-integrity: limit MAX_TAG_SIZE to 255 - ASoC: amd: acp: Adjust pdm gain value - wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 - USB: serial: option: add SIMCom 8230C compositions - media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe - !20931 Fix CVE-2026-23060 - uvb: fix cis call return value and obtain - bonding: fix use-after-free due to enslave fail after slave array update - net/sched: cls_u32: use skb_header_pointer_careful() - net: add skb_header_pointer_careful() helper - regmap: Fix race condition in hwspinlock irqsave routine - crypto: virtio - Add spinlock protection with virtqueue notification - net/mlx5e: TC, delete flows only for existing peers - !20967 net: hns3: modify code of judging if SMMU DMA is enabled - ceph: fix oops due to invalid pointer for kfree() in parse_longname() - !20969 Fix CVE-2026-23125 - !20948 v4 arm64: Add memory poison recovery support for various paths - !20975 CVE-2026-23102 - !20977 v4 support apei_page_offline_policy - bonding: annotate data-races around slave->last_rx - netfilter: nf_conncount: update last_gc only when GC has been performed - bonding: provide a net pointer to __skb_flow_dissect() - netdevsim: fix a race issue related to the operation on bpf_bound_progs list - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() - apei/ghes: Add sysctl interface to control soft-offline page isolation - Revert "mm/memory-failure: support disabling soft offline for HugeTLB pages" - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - arm64/fpsimd: signal: Fix restoration of SVE context - arm64/fpsimd: signal: Consistently read FPSIMD context - arm64/fpsimd: signal: Mandate SVE payload for streaming-mode state - bonding: limit BOND_MODE_8023AD to Ethernet devices - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag - net/sched: Enforce that teql can only be used as root qdisc - sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT - drivers/net: Update vendor name of Chengdu NorthLink Technology N5/N6 Series Network Card Drivers - net: hns3: modify code of judging if SMMU DMA is enabled - dmaengine: xilinx: xdma: Fix regmap max_register - ub:ubus: protect iterator ue_list and mue_list with ub_bus_sem - ub:ubus: Avoid getting empty uent from ubc - ub:hisi-ubus: Use GFP_ATOMIC when alloc memory - arm64: send sig fault for user task when apei_claim_sea fails - arm64: add ras log during do_sea - arm64: move getting valid siaddr to the top of do_sea - arm64: mm: shmem: support poison recovery from shmem_file_read_iter() - arm64: fs: support poison recovery from __kernel_read() - iov_iter: add mc support for copy_page_to_iter - arm64: mm: support recovery from copy_{from/to}_user_page() - iov_iter: get rid of 'copy_mc' flag - leds: led-class: Only Add LED to leds_list when it is fully ready - wifi: ath10k: fix dma_free_coherent() pointer - smb/server: fix refcount leak in parse_durable_handle_context() - ksmbd: add chann_lock to protect ksmbd_chann_list xarray - ipvlan: Make the addrs_lock be per port - smb: client: split cached_fid bitfields to avoid shared-byte RMW races - efivarfs: fix error propagation in efivar_entry_get() - io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop - dm: use bio_clone_blkg_association - RAS/AMD/ATL: fix error nodes per socket on for Hygon Dhyana processor - net: txgbe: fix clang compile warning - !20552 ub: udma: fix some code issues. - !20313 Fix CVE-2025-40220 - !20321 nvme: fix admin request_queue lifetime - !20512 PM / devfreq: hisi: Fix potential UAF in OPP handling - !20544 Fix CVE-2025-71147 - !20548 v4 net: LTS-6.6 backport - !20503 Fix CVE-2025-39713 - !20133 Fix CVE-2025-39721 - !20438 Fix CVE-2025-38659 - !20264 Fix CVE-2025-40277 - !20340 Fix CVE-2025-40271 - !20319 Fix CVE-2025-40237 - !20392 vfs: Don't leak disconnected dentries on umount - !20554 iommu/s390: Implement blocking domain - !20489 [OLK-6.6][linux-6.6.y sync] Backport 6.6.101-6.6.102 LTS Patches - !20513 ACPI: PCC: Fix race condition by removing static qualifier - !20468 drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer - !20483 rcu: Protect ->defer_qs_iw_pending from data race - !20510 drivers/ub/sentry: fix primary eid index value - !20553 ub: cdma: support separated page table feature - ub: udma: fix some code issues. - !20480 iommu/ummu-core: fix error invalidate tid - !20561 iommu/ummu: Add ummu sva independent page table parameter - ub: udma: bugfix related to 2m_hugepage. - ub: udma: support for separate page tables - ub: udma: delete debugfs code. - ub: udma: bugfix related to ctrlq function. - ub: udma: verify get cqe/ae aux info out addr and len. - ub: cdma: support separated page table feature - iommu/ummu: Add ummu sva independent page table parameter - iommu: Adjust PLB refresh timing in 'grant' and 'ungrant' - !20505 Fix CVE-2026-23035 - iommu/s390: Implement blocking domain - drivers/ub/sentry: fix primary eid index value - !20535 libceph: make decode_pool() more resilient against corrupted osdmaps - !20536 mm/page_alloc: change all pageblocks migrate type on coalescing - !20537 mm/secretmem: fix use-after-free race in fault handler - !20538 wifi: avoid kernel-infoleak from struct iw_point - !20539 net: usb: rtl8150: fix memory leak on usb_submit_urb() failure - !20440 PCI/AER: Fix NULL pointer access by aer_info - !20262 Fix CVE-2025-68176 - netfilter: nf_reject: don't leak dst refcount for loopback packets - net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error - page_pool: always add GFP_NOWARN for ATOMIC allocations - virtio-net: fix received length check in big packets - net: bridge: fix use-after-free due to MST port state bypass - vsock: Ignore signal/timeout on connect() if already established - tls: make sure to abort the stream if headers are bogus - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI - xfrm: Duplicate SPI Handling - tls: handle data disappearing from under the TLS ULP - net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing - bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls - Bluetooth: hci_core: Fix use-after-free in vhci_flush() - KEYS: trusted: Fix a memory leak in tpm2_load_cmd - !20237 Fix CVE-2025-68724 - !20459 Fix CVE-2025-71131 - !20525 Fix CVE-2025-68816 - !20529 CVE-2025-68172 - net: usb: rtl8150: fix memory leak on usb_submit_urb() failure - !20370 Revert "Revert "RDMA/hns: Fix mismatch exception rollback"" - wifi: avoid kernel-infoleak from struct iw_point - mm/secretmem: fix use-after-free race in fault handler - mm/page_alloc: change all pageblocks migrate type on coalescing - libceph: make decode_pool() more resilient against corrupted osdmaps - pps: Fix kabi breakage of struct pps_device for last_fetched_ev - sched: Fix kabi breakage of struct task_struct for saved_state - crypto: aspeed - fix double free caused by devm - !20515 Bluetooth: bcsp: receive data only if registered - !20507 Fix CVE-2025-40358 - !20450 ub: ubase&unic: Fix some bug in concurrent process - !20452 iommu/ummu: Fix some bugs and optimize the code implementation - !20451 iommu/ummu: Add the function of creating devices with SVA-separated - !20500 mm: fix the inaccurate memory statistics issue for users - net/mlx5: fw_tracer, Validate format string parameters - Bluetooth: bcsp: receive data only if registered - ACPI: PCC: Fix race condition by removing static qualifier - ACPI: CPPC: Fix missing PCC check for guaranteed_perf - iommu/ummu: Add the function of creating devices with SVA-separated - iommu/ummu-core: fix error invalidate tid - riscv: stacktrace: Disable KASAN checks for non-current tasks - !20497 arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() - !20496 drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies - !20495 iommu/amd: Avoid stack buffer overflow from kernel cmdline - !20494 HID: core: Harden s32ton() against conversion to 0 bits - !20493 iommu: Fix two issues in iommu_copy_struct_from_user() - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv - PM / devfreq: hisi: Fix potential UAF in OPP handling - media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() - !20487 interference: Fix uninitialized ifs_clock compiling issue - MIPS: mm: kmalloc tlb_vpn array to avoid stack overflow - MIPS: mm: Prevent a TLB shutdown on initial uniquification - mm: fix the inaccurate memory statistics issue for users - mm: add config option for atomic mode in mm counter - Revert "mm: fix the inaccurate memory statistics issue for users" - !20444 net/mlx5e: Fix crash on profile change rollback failure - !20442 net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv - arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() - drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies - iommu/amd: Avoid stack buffer overflow from kernel cmdline - HID: core: Harden s32ton() against conversion to 0 bits - iommu: Fix two issues in iommu_copy_struct_from_user() - SUNRPC: call xs_sock_process_cmsg for all cmsg - flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read - !20374 [OLK 6.6]Use Hygon IBRS and IBPB rather than software-based mitigation to mitigate Retbleed and SRSO. - !20227 Rename leapioraid to leapraid and release v2.0 - mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery - MIPS: mm: tlb-r4k: Uniquify TLB entries on init - x86/fpu: Delay instruction pointer fixup until after warning - ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx() - ALSA: intel_hdmi: Fix off-by-one error in __hdmi_lpe_audio_probe() - x86/sev: Evict cache lines during SNP memory validation - net: usbnet: Fix the wrong netif_carrier_on() call - net: usbnet: Avoid potential RCU stall on LINK_CHANGE event - Bluetooth: btusb: Add USB ID 3625:010b for TP-LINK Archer TX10UB Nano - sched,freezer: Remove unnecessary warning in __thaw_task - freezer,sched: Clean saved_state when restoring it during thaw - freezer,sched: Do not restore saved_state of a thawed task - freezer,sched: Use saved_state to reduce some spurious wakeups - sched/core: Remove ifdeffery for saved_state - i2c: stm32f7: unmap DMA mapped buffer - i2c: stm32f7: simplify status messages in case of errors - i2c: stm32f7: perform most of irq job in threaded handler - i2c: stm32f7: use dev_err_probe upon calls of devm_request_irq - i2c: stm32f7: Use devm_clk_get_enabled() - USB: serial: option: add Foxconn T99W709 - smb: server: Fix extension string in ksmbd_extract_shortname() - ksmbd: fix corrupted mtime and ctime in smb2_open - ksmbd: fix Preauh_HashValue race condition - ksmbd: fix null pointer dereference error in generate_encryptionkey - vsock: Do not allow binding to VMADDR_PORT_ANY - selftests/perf_events: Add a mmap() correctness test - smb: client: return an error if rdma_connect does not return within 5 seconds - smb: client: let recv_done() cleanup before notifying the callers. - smb: client: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already - smb: client: make use of common smbdirect_socket - smb: smbdirect: add smbdirect_socket.h - smb: client: Correct typos in multiple comments across various files - smb: client: Use min() macro - smb: server: let recv_done() avoid touching data_transfer after cleanup/move - smb: server: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already - ALSA: hda/ca0132: Fix missing error handling in ca0132_alt_select_out() - irqchip: Build IMX_MU_MSI only on ARM - net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing - sunrpc: fix client side handling of tls alerts - net/sched: taprio: enforce minimum value for picos_per_byte - net: drop UFO packets in udp_rcv_segment() - ipv6: reject malicious packets in ipv6_gso_segment() - net/mlx5: Correctly set gso_segs when LRO is used - netlink: specs: ethtool: fix module EEPROM input/output arguments - net: ipa: add IPA v5.1 and v5.5 to ipa_version_string() - phy: mscc: Fix parsing of unicast frames - netpoll: prevent hanging NAPI when netcons gets enabled - md/md-cluster: handle REMOVE message earlier - NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY - NFS: Fix wakeup of __nfs_lookup_revalidate() in unblock_revalidate() - sched: Add test_and_clear_wake_up_bit() and atomic_dec_and_wake_up() - pNFS/flexfiles: don't attempt pnfs on fatal DS errors - PCI: pnv_php: Fix surprise plug detection and recovery - powerpc/eeh: Export eeh_unfreeze_pe() - PCI: pnv_php: Work around switches with broken presence detection - kconfig: qconf: fix ConfigList::updateListAllforAll() - scsi: sd: Make sd shutdown issue START STOP UNIT appropriately - scsi: ufs: core: Use link recovery when h8 exit fails during runtime resume - scsi: Revert "scsi: iscsi: Fix HW conn removal use after free" - scsi: mpt3sas: Fix a fw_event memory leak - vfio/pci: Separate SR-IOV VF dev_set - vfio/pds: Fix missing detach_ioas op - vfio: Prevent open_count decrement to negative - vfio: Fix unbalanced vfio_df_close call in no-iommu mode - f2fs: fix to calculate dirty data during has_not_enough_free_secs() - f2fs: fix to update upper_p in __get_secs_required() correctly - f2fs: vm_unmap_ram() may be called from an invalid context - f2fs: fix to avoid out-of-boundary access in devs.path - f2fs: doc: fix wrong quota mount option description - f2fs: fix KMSAN uninit-value in extent_info usage - rtc: rv3028: fix incorrect maximum clock rate handling - rtc: pcf8563: fix incorrect maximum clock rate handling - rtc: pcf85063: fix incorrect maximum clock rate handling - rtc: nct3018y: fix incorrect maximum clock rate handling - rtc: hym8563: fix incorrect maximum clock rate handling - rtc: ds1307: fix incorrect maximum clock rate handling - ucount: fix atomic_long_inc_below() argument type - module: Restore the moduleparam prefix length check - apparmor: fix loop detection used in conflicting attachment resolution - apparmor: ensure WB_HISTORY_SIZE value is a power of 2 - bpf: Check netfilter ctx accesses are aligned - bpf: Check flow_dissector ctx accesses are aligned - vhost-scsi: Fix log flooding with target does not exist errors - mtd: rawnand: atmel: set pmecc data setup time - mtd: rawnand: rockchip: Add missing check after DMA map - mtd: rawnand: atmel: Fix dma_mapping_error() address - jfs: fix metapage reference count leak in dbAllocCtl - crypto: qat - fix seq_file position update in adf_ring_next() - crypto: qat - fix DMA direction for compression on GEN2 devices - perf tools: Remove libtraceevent in .gitignore - sh: Do not use hyphen in exported variable name - ASoC: fsl_xcvr: get channel status data when PHY is not exists - dmaengine: nbpfaxi: Add missing check after DMA map - dmaengine: mv_xor: Fix missing check after DMA map and missing unmap - fs/orangefs: Allow 2 more characters in do_c_string() - PCI: endpoint: pci-epf-vntb: Fix the incorrect usage of __iomem attribute - soundwire: stream: restore params when prepare ports fail - crypto: img-hash - Fix dma_unmap_sg() nents value - crypto: keembay - Fix dma_unmap_sg() nents value - hwrng: mtk - handle devm_pm_runtime_enable errors - watchdog: ziirave_wdt: check record length in ziirave_firm_verify() - scsi: isci: Fix dma_unmap_sg() nents value - scsi: mvsas: Fix dma_unmap_sg() nents value - scsi: elx: efct: Fix dma_unmap_sg() nents value - scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value - clk: sunxi-ng: v3s: Fix de clock definition - perf tests bp_account: Fix leaked file descriptor - kernel: trace: preemptirq_delay_test: use offstack cpu mask - crypto: inside-secure - Fix `dma_unmap_sg()` nents value - perf sched: Fix memory leaks in 'perf sched latency' - perf sched: Fix memory leaks for evsel->priv in timehist - perf sched: Free thread->priv using priv_destructor - perf dso: Add missed dso__put to dso__load_kcore - perf tools: Fix use-after-free in help_unknown_cmd() - Fix dma_unmap_sg() nents value - clk: clk-axi-clkgen: fix fpfd_max frequency for zynq - fanotify: sanitize handle_type values when reporting fid - pinctrl: sunxi: Fix memory leak on krealloc failure - PCI: endpoint: pci-epf-vntb: Return -ENOENT if pci_epc_get_next_free_bar() fails - crypto: arm/aes-neonbs - work around gcc-15 warning - power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set - power: supply: cpcap-charger: Fix null check for power_supply_get_by_name - clk: xilinx: vcu: unregister pll_post only if registered correctly - media: v4l2-ctrls: Fix H264 SEPARATE_COLOUR_PLANE check - mtd: fix possible integer overflow in erase_xfer() - crypto: marvell/cesa - Fix engine load inaccuracy - crypto: qat - use unmanaged allocation for dc_data - crypto: sun8i-ce - fix nents passed to dma_unmap_sg() - PCI: rockchip-host: Fix "Unexpected Completion" log message - bpf/preload: Don't select USERMODE_DRIVER - ipv6: annotate data-races around rt->fib6_nsiblings - ipv6: fix possible infinite loop in fib6_info_uses_dev() - vrf: Drop existing dst reference in vrf_ip6_input_dst - selftests: rtnetlink.sh: remove esp4_offload after test - net/mlx5e: Clear Read-Only port buffer size in PBMC before update - netfilter: xt_nfacct: don't assume acct name is null-terminated - can: kvaser_usb: Assign netdev.dev_port based on device channel index - can: kvaser_pciefd: Store device channel index - can: peak_usb: fix USB FD devices potential malfunction - tools/rv: Do not skip idle in trace - Bluetooth: hci_event: Mask data status from LE ext adv reports - kcsan: test: Initialize dummy variable - wifi: mac80211: Write cnt before copying in ieee80211_copy_rnr_beacon() - wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE - wifi: ath12k: fix endianness handling while accessing wmi service bit - wifi: mac80211: Check 802.11 encaps offloading in ieee80211_tx_h_select_key() - wifi: mac80211: Don't call fq_flow_idx() for management frames - wifi: mac80211: Do not schedule stopped TXQs - wifi: plfxlc: Fix error handling in usb driver probe - wifi: mac80211: reject TDLS operations when station is not associated - iommu/amd: Fix geometry.aperture_end for V2 tables - mwl8k: Add missing check after DMA map - wifi: rtl8xxxu: Fix RX skb size for aggregation disabled - tcp: call tcp_measure_rcv_mss() for ooo packets - xen/gntdev: remove struct gntdev_copy_batch from stack - net_sched: act_ctinfo: use atomic64_t for three counters - net/sched: Restrict conditions for adding duplicating netems to qdisc tree - um: rtc: Avoid shadowing err in uml_rtc_start() - arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX - netfilter: nf_tables: adjust lockdep assertions handling - netfilter: nf_tables: Drop dead code from fill_*_info routines - fbcon: Fix outdated registered_fb reference in comment - drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value - m68k: Don't unregister boot console needlessly - drm/msm/dpu: Fill in min_prefill_lines for SC8180X - kselftest/arm64: Fix check for setting new VLs in sve-ptrace - net: dst: annotate data-races around dst->input - tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range - wifi: ath11k: clear initialized flag for deinit-ed srng lists - iwlwifi: Add missing check for alloc_ordered_workqueue - wifi: iwlwifi: Fix memory leak in iwl_mvm_init() - wifi: rtl818x: Kill URBs before clearing tx status queue - wifi: rtw89: avoid NULL dereference when RX problematic packet on unsupported 6 GHz band - caif: reduce stack size, again - bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure - drm/vmwgfx: Fix Host-Backed userspace on Guest-Backed kernel - net: ipv6: ip6mr: Fix in/out netdev to pass to the FORWARD chain - selftests/bpf: fix signedness bug in redir_partial() - bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls - bpf, sockmap: Fix psock incorrectly pointing to sk - drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed - staging: nvec: Fix incorrect null termination of battery manufacturer - interconnect: qcom: sc8180x: specify num_nodes - interconnect: qcom: sc8280xp: specify num_links for qnm_a1noc_cfg - soc: qcom: pmic_glink: fix OF node leak - samples: mei: Fix building on musl libc - cpufreq: Initialize cpufreq-based frequency-invariance later - cpufreq: intel_pstate: Always use HWP_DESIRED_PERF in passive mode - arm64: dts: imx8mn-beacon: Fix HS400 USDHC clock speed - arm64: dts: imx8mm-beacon: Fix HS400 USDHC clock speed - ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface - soc/tegra: cbb: Clear ERR_FORCE register with ERR_STATUS - arm: dts: ti: omap: Fixup pinheader typo - usb: early: xhci-dbc: Fix early_ioremap leak - powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw() - pps: fix poll support - staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() - spi: stm32: Check for cfg availability in stm32_spi_probe - usb: misc: apple-mfi-fastcharge: Make power supply names unique - usb: host: xhci-plat: fix incorrect type for of_match variable in xhci_plat_probe() - ARM: dts: vfxxx: Correctly use two tuples for timer address - arm64: dts: qcom: msm8976: Make blsp_dma controlled-remotely - arm64: dts: qcom: sc7180: Expand IMEM region - arm64: dts: qcom: sdm845: Expand IMEM region - soc: qcom: QMI encoding/decoding for big endian - selftests: Fix errno checking in syscall_user_dispatch test - ASoC: mediatek: use reserved memory or enable buffer pre-allocation - gfs2: No more self recovery - Revert "fs/ntfs3: Replace inode_trylock with inode_lock" - hfs: make splice write available again - hfsplus: make splice write available again - ublk: use vmalloc for ublk_device's __queues - fs_context: fix parameter name in infofc() macro - audit,module: restore audit logging in load failure case - ASoC: amd: yc: add DMI quirk for ASUS M6501RM - ASoC: Intel: fix SND_SOC_SOF dependencies - ASoC: amd: yc: Add DMI entries to support HP 15-fb1xxx - ethernet: intel: fix building with large NR_CPUS - ASoC: amd: yc: Add DMI quirk for HP Laptop 17 cp-2033dx - interference: Fix uninitialized ifs_clock compiling issue - iommu/ummu: optimize log printing - !20455 Fix compilation failure caused by PR#20174 - !20302 CVE-2026-22980 - !20142 CVE-2025-68803 - !20261 ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency - !20435 fix CVE-2026-22998 - !20433 scsi: target: Reset t_task_cdb pointer in error case - !20432 scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" - !20431 block: Use RCU in blk_mq_[un - !20307 tpm: Cap the number of PCR banks - !20062 xfs: Add xfs_dir3_leaf_header_check() in leaf/leafn read - !20157 v2 md: backport from mainline - rcu: Protect ->defer_qs_iw_pending from data race - platform/x86/intel/pmt: fix compilation failure caused by PR#20174 - iommu/ummu: optimize kv cache memory management - iommu/ummu: optimize permission table management - iommu/ummu: remove check for eid_type while del eid - iommu/ummu: optimize the code implementation - drivers/perf: fix ummu-pmu data reading exception - iommu/ummu: IOMMU_DOMAIN_BLOCKED type don not sync tct - drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer - crypto: seqiv - Do not use req->iv after crypto_aead_encrypt - net: unic: Notify mami of the bond ip change. - ub: ubase: Support for UE link by ctrlq message - ub: ubase: send a deactivate req in removing - ub: ubase: Querying TPG/TP contexts in the chip is no longer supported after enabling safe mode. - ub: ubase: Use an independent thread for the ctrlq workqueue. - !20368 ubcore: fix logging and permission for route query. - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id - !20344 ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr - net: unic: Fix the ummu 0xa event that occurs when modifying queues and resetting concurrent scenarios - ub: ubase: Add KABI compatibility - ub: ubase: fixing the issue of cdma ctp_req_vl parameter configuration - ub: ubase: add PMU IDEV interrupt supported abilities. - ub: ubase: Delete the tid mask for eq, jfs, jfr, and jfc context - ub: ubase: Set the completion event interrupt to auto - net: unic: fix poll tx read old skb cause a UAF bug - !20249 Fix CVE-2025-38489 - !20250 Fix CVE-2025-38480 - !20378 Fix CVE-2025-39838 - !20430 Fix CVE-2025-39942 - !20351 Fix CVE-2025-71149 - !20375 Fix CVE-2025-71150 - !20323 Fix CVE-2025-38730 - !20320 Fix CVE-2025-68814 - !20314 Fix CVE-2025-71072 - !20315 Fix CVE-2025-68794 - !20403 bpf: Check skb->transport_header is set in bpf_skb_check_mtu - !20402 bpf: Do not let BPF test infra emit invalid GSO types to stack - !20401 tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() - !20400 netfilter: nft_ct: add seqadj extension for natted connections - !20399 net: xfrm: Fix CVE-2025-40215 - !20398 net/sched: sch_qfq: Fix null-deref in agg_dequeue - !20397 bpf: Reject narrower access to pointer ctx fields - !20396 Bluetooth: eir: Fix possible crashes on eir_create_adv_data - !20394 IB/mlx5: Fix potential deadlock in MR deregistration - !20367 ub: cdma: cdma uaf bugfix - net/mlx5e: Fix crash on profile change rollback failure - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv - PCI/AER: Fix NULL pointer access by aer_info - gfs2: No more self recovery - drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE - crypto: qat - flush misc workqueue during device shutdown - !20174 Backport PMT spec 3.0 support - !20366 [Hygon][6.6][Bugfix]: Resolve FPU state corruption between atomic and non-atomic contexts - !19814 [OLK-6.6] Batch flushing user memory encrytion status change - !20393 [OLK-6.6][linux-6.6.y sync] Backport 6.6.100-6.6.101 LTS Patches - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec - nvmet-tcp: remove boilerplate code - scsi: target: Reset t_task_cdb pointer in error case - scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" - block: Use RCU in blk_mq_[un]quiesce_tagset() instead of set->tag_list_lock - ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size - ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer - smb: server: let recv_done() consistently call put_recvmsg/smb_direct_disconnect_rdma_connection - smb: server: remove separate empty_recvmsg_queue - !20384 ub:ubus: Fix ubus link message and pool device error - !20389 gfs2: Prevent recursive memory reclaim - !20388 *** fix CVE-2025-38062 *** - !20387 KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced - !20386 pinctrl: check the return value of pinmux_ops::get_function_name() - !20385 iommu/amd/pgtbl: Fix possible race while increase page table level - ub:ubus: Not cfg access during surprise down - ub:hisi-ubus: Delete validate_pa err print - PCI: cadence: Check for the existence of cdns_pcie::ops before using it - can: netlink: can_changelink(): allow disabling of automatic restart - Revert "selftests/bpf: Add a cgroup prog bpf_get_ns_current_pid_tgid() test" - drm/sched: Remove optimization that causes hang when killing dependent jobs - ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS - bpf: Check skb->transport_header is set in bpf_skb_check_mtu - bpf: Do not let BPF test infra emit invalid GSO types to stack - tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() - netfilter: nft_ct: add seqadj extension for natted connections - xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added - xfrm: delete x->tunnel as we delete x - x86/hw-vuln:Support hardware-based mitigation for Retbleed and SRSO via Hygon IBRS to avoid performance degradation caused by software-based mitigation. - net/sched: sch_qfq: Fix null-deref in agg_dequeue - bpf: Reject narrower access to pointer ctx fields - Bluetooth: eir: Fix possible crashes on eir_create_adv_data - IB/mlx5: Fix potential deadlock in MR deregistration - ub:ubus: Fix ubus link message and pool device error - ub:hisi-ubus: cq poller maximum handle 64 cqe per time - ub:hisi-ubus:Fix vdm message print error - ub:ubus:Fix ubus interrupt release issue - wifi: mt76: mt7921: prevent decap offload config before STA initialization - mtd: rawnand: qcom: Fix last codeword read in qcom_param_page_type_exec() - iio: hid-sensor-prox: Restore lost scale assignments - iio: hid-sensor-prox: Fix incorrect OFFSET calculation - crypto: powerpc/poly1305 - add depends on BROKEN for now - erofs: address D-cache aliasing - drm/i915/dp: Fix 2.7 Gbps DP_LINK_BW value on g4x - ALSA: hda: Add missing NVIDIA HDA codec IDs - ALSA: hda/tegra: Add Tegra264 support - comedi: comedi_test: Fix possible deletion of uninitialized timers - usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach - usb: typec: tcpm: allow switching to mode accessory to mux properly - usb: typec: tcpm: allow to use sink in accessory mode - drm/amdkfd: Don't call mmput from MMU notifier callback - mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n - selftests: mptcp: connect: also cover checksum - selftests: mptcp: connect: also cover alt modes - resource: fix false warning in __request_region() - gve: Fix stuck TX queue for DQ queue format - e1000e: ignore uninitialized checksum word on tgp - e1000e: disregard NVM checksum on tgp when valid checksum bit is not set - dpaa2-switch: Fix device reference count leak in MAC endpoint handling - dpaa2-eth: Fix device reference count leak in MAC endpoint handling - ALSA: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx - sprintf.h requires stdarg.h - bus: fsl-mc: Fix potential double device reference in fsl_mc_get_endpoint() - i2c: virtio: Avoid hang by using interruptible completion wait - i2c: tegra: Fix reset error handling with ACPI - platform/x86: ideapad-laptop: Fix kbd backlight not remembered among boots - can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode - can: dev: can_restart(): move debug message and stats after successful restart - can: dev: can_restart(): reverse logic to remove need for goto - i40e: When removing VF MAC filters, only check PF-set MAC - i40e: report VF tx_dropped with tx_errors instead of tx_discards - i40e: Add rx_missed_errors for buffer exhaustion - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch - net/mlx5: Fix memory leak in cmd_exec() - staging: vchiq_arm: Make vchiq_shutdown never fail - x86/hyperv: Fix usage of cpu_online_mask to get valid cpu - regmap: fix potential memory leak of regmap_bus - iio: adc: ad7949: use spi_is_bpw_supported() - interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1 node - RDMA/core: Rate limit GID cache warning messages - virtio_ring: Fix error reporting in virtqueue_resize - !20348 [OLK-6.6][linux-6.6.y sync] Backport 6.6.99-6.6.100 LTS Patches - !20346 tracing: Fix crash on synthetic stacktrace field usage - vfs: Don't leak disconnected dentries on umount - !20334 Fix CVE-2025-68780 - gfs2: Prevent recursive memory reclaim - amd/amdkfd: enhance kfd process check in switch partition - drm/amdkfd: allow compute partition mode switch with cgroup exclusions - KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced - pinctrl: check the return value of pinmux_ops::get_function_name() - iommu/amd/pgtbl: Fix possible race while increase page table level - !19966 nvme-fc: use lock accessing port_state and rport state - ASoC: fsl_sai: replace regmap_write with regmap_update_bits - comedi: Fix use of uninitialized data in insn_rw_emulate_bits() - cifs: prevent NULL pointer dereference in UTF16 conversion - ksmbd: Fix refcount leak when invalid session is found on session lookup - ubcore: fix logging and permission for route query. - !20232 driver/coda: VirtCCA supports MSI device DA - Revert "Revert "RDMA/hns: Fix mismatch exception rollback"" - !20197 ub: udma&ubase: fix a bug that caused long reboot time - x86: Resolve FPU state corruption between atomic and non-atomic contexts - ub: cdma: cdma uaf bugfix - ub: cdma: jfs call trace bugfix - !20353 x86/fpu: Clear XSTATE_BV[i - s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again - KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls - nvmem: layouts: u-boot-env: remove crc32 endianness conversion - i2c: omap: fix deprecated of_property_read_bool() use - ASoC: fsl_sai: Force a software reset when starting in consumer mode - regulator: pwm-regulator: Manage boot-on with disabled PWM channels - regulator: pwm-regulator: Calculate the output voltage for disabled PWMs - i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe() - i2c: omap: Fix an error handling path in omap_i2c_probe() - i2c: omap: Add support for setting mux - usb: dwc3: qcom: Don't leave BCR asserted - usb: hub: Don't try to recover devices lost during warm reset. - usb: hub: Fix flushing of delayed work used for post resume purposes - usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm - usb: hub: fix detection of high tier USB3 devices behind suspended hubs - arm64: Filter out SME hwcaps when FEAT_SME isn't implemented - ipv6: make addrconf_wq single threaded - !20354 cpufreq/sched: Explicitly synchronize limits_changed flag handling - sched/deadline: only set free_cpus for online runqueues - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 - cpufreq/sched: Explicitly synchronize limits_changed flag handling - io_uring/poll: correctly handle io_poll_add() return value on update - shmem: fix recovery on rename failures - io_uring: fix filename leak in __io_openat_prep() - Revert "cgroup_freezer: cgroup_freezing: Check if not frozen" - rxrpc: Fix transmission of an abort in response to an abort - rxrpc: Fix recv-recv race of completed call - net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree - net: bridge: Do not offload IGMP/MLD messages - hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf - netfilter: nf_conntrack: fix crash due to removal of uninitialised entry - ipv6: mcast: Delay put pmc->idev in mld_del_delrec() - net/mlx5: Correctly set gso_size when LRO is used - Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID - Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout - Bluetooth: SMP: If an unallowed command is received consider it a failure - Bluetooth: hci_sync: fix connectable extended advertising when using static random address - hwmon: (corsair-cpro) Validate the size of the received input buffer - selftests: net: increase inter-packet timeout in udpgro.sh - wifi: cfg80211: remove scan request n_channels counted_by - nvme: fix misaccounting of nvme-mpath inflight I/O - net: phy: Don't register LEDs for genphy - nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list() - rpl: Fix use-after-free in rpl_do_srh_inline(). - block: fix kobject leak in blk_unregister_queue - net: emaclite: Fix missing pointer increment in aligned_read() - soundwire: amd: fix for clearing command status register - soundwire: amd: fix for handling slave alerts after link is down - comedi: Fix use of uninitialized data in insn_rw_emulate_bits() - comedi: Fix some signed shift left operations - comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large - comedi: das6402: Fix bit shift out of bounds - comedi: das16m1: Fix bit shift out of bounds - comedi: aio_iiro_16: Fix bit shift out of bounds - comedi: pcl812: Fix bit shift out of bounds - iio: adc: stm32-adc: Fix race in installing chained IRQ handler - iio: adc: max1363: Reorder mode_list[] entries - iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] - iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush - soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled - soc: aspeed: lpc-snoop: Cleanup resources in stack-order - s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again - pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov - net: libwx: properly reset Rx ring descriptor - net: libwx: remove duplicate page_pool_put_full_page() - mmc: sdhci_am654: Workaround for Errata i2312 - mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models - mmc: bcm2835: Fix dma_unmap_sg() nents value - memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() - isofs: Verify inode mode when loading from disk - dmaengine: nbpfaxi: Fix memory corruption in probe() - af_packet: fix soft lockup issue caused by tpacket_snd() - af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() - arm64: dts: rockchip: use cs-gpios for spi1 on ringneck - arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on - arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency - net/mlx5: Update the list of the PCI supported devices - phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() - io_uring/poll: fix POLLERR handling - ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS - drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume - tracing/osnoise: Fix crash in timerlat_dump_stack() - spi: Add check for 8-bit transfer with 8 IO mode support - pch_uart: Fix dma_sync_sg_for_device() nents value - thunderbolt: Fix bit masking in tb_dp_port_set_hops() - i2c: stm32: fix the device used for the DMA map - tracing: Fix crash on synthetic stacktrace field usage - usb: musb: fix gadget state on disconnect - USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI - USB: serial: option: add Foxconn T99W640 - USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition - phy: tegra: xusb: Disable periodic tracking on Tegra234 - phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode - phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr - fs/proc: fix uaf in proc_readdir_de() - io_uring/net: commit partial buffers on retry - nvme: fix admin request_queue lifetime - fs/notify: call exportfs_encode_fid with s_umount - iomap: adjust read range correctly for non-block-aligned positions - fuse: fix livelock in synchronous file put from fuseblk workers - tpm: Cap the number of PCR banks - nfsd: provide locking for v4_end_grace - Revert "nfsd: provide locking for v4_end_grace" - config: enable config for PMT discovery driver - platform/x86/intel/pmt/discovery: use valid device pointer in dev_err_probe - platform/x86/intel/pmt: Fix kobject memory leak on init failure - platform/x86/intel/pmt: fix a crashlog NULL pointer access - platform/x86/intel/pmt: fix build dependency for kunit test - platform/x86/intel/pmt/discovery: fix format string warning - platform/x86/intel/pmt/discovery: Fix size_t specifiers for 32-bit - platform/x86/intel/pmt: KUNIT test for PMT Enhanced Discovery API - platform/x86/intel/pmt/telemetry: Add API to retrieve telemetry regions by feature - platform/x86/intel/pmt/discovery: Get telemetry attributes - platform/x86/intel/tpmi: Get OOBMSM CPU mapping from TPMI - platform/x86/intel/vsec: Set OOBMSM to CPU mapping - platform/x86/intel/tpmi: Relocate platform info to intel_vsec.h - docs: Add ABI documentation for intel_pmt feature directories - platform/x86/intel/pmt: Add PMT Discovery driver - sysfs: Fix crash on empty group attributes array - sysfs: Introduce a mechanism to hide static attribute_groups - platform/x86/intel/vsec: Add new Discovery feature - platform/x86/intel/vsec: Skip driverless features - platform/x86/intel/vsec: Skip absent features during initialization - platform/x86/intel/vsec: Add device links to enforce dependencies - platform/x86/intel/vsec: Create wrapper to walk PCI config space - platform/x86/intel/vsec: Add private data for per-device data - MAINTAINERS: Add link to documentation of Intel PMT ABI - platform/x86/intel/pmt: allow user offset for PMT callbacks - driver/coda: VirtCCA supports MSI device DA - ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency - Rename leapioraid to leapraid and release v2.0 - ub: udma: fix a bug that caused long reboot time. - ub: ubase: Accelerate when ctrl node is shutting down - platform/x86/intel/pmt: Use PMT callbacks - platform/x86/intel/vsec: Add PMT read callbacks - platform/x86/intel/vsec.h: Move to include/linux - md: prevent incorrect update of resync/recovery offset - md/raid1: Fix data corruption for degraded array with slow disk - md/raid1: set max_sectors during early return from choose_slow_rdev() - md-cluster: fix no recovery job when adding/re-adding a disk - md-cluster: fix hanging issue while a new disk adding - md/raid5: recheck if reshape has finished with device_lock held - md-cluster: Constify struct md_cluster_operations - md: Remove unneeded semicolon - md/raid5: fix spares errors about rcu usage - dm-raid: Fix WARN_ON_ONCE check for sync_thread in raid_resume - md: pass in max_sectors for pers->sync_request() - md: factor out helpers for different sync_action in md_do_sync() - md: replace last_sync_action with new enum type - md: use new helpers in md_do_sync() - md: don't fail action_store() if sync_thread is not registered - md: remove parameter check_seq for stop_sync_thread() - md: replace sysfs api sync_action with new helpers - md: factor out helper to start reshape from action_store() - md: add new helpers for sync_action - md: add a new enum type sync_action - md: rearrange recovery_flags - md/raid0: don't free conf on raid0_run failure - md: make md_flush_request() more readable - md: change the return value type of md_write_start to void - md: Revert "md: Fix overflow in is_mddev_idle" - md: don't account sync_io if iostats of the disk is disabled - md: Fix overflow in is_mddev_idle - md: add check for sleepers in md_wakeup_thread() - md: add a mddev_is_dm helper - md: add a mddev_add_trace_msg helper - md: add a mddev_trace_remap helper - dm-raid456, md/raid456: fix a deadlock for dm-raid456 while io concurrent with reshape - dm-raid: add a new helper prepare_suspend() in md_personality - dm-raid: really frozen sync_thread during suspend - md: add a new helper reshape_interrupted() - md: export helper md_is_rdwr() - md: export helpers to stop sync_thread - md: don't clear MD_RECOVERY_FROZEN for new dm-raid until resume - md/raid1: factor out helpers to choose the best rdev from read_balance() - md/raid1: factor out the code to manage sequential IO - md/raid1: factor out choose_bb_rdev() from read_balance() - md/raid1: factor out choose_slow_rdev() from read_balance() - md/raid1: factor out read_first_rdev() from read_balance() - md/raid1-10: factor out a new helper raid1_should_read_first() - md/raid1-10: add a helper raid1_check_read_range() - md/raid1: fix choose next idle in read_balance() - md/raid1: record nonrot rdevs while adding/removing rdevs to conf - md/raid1: factor out helpers to add rdev to conf - md: add a new helper rdev_has_badblock() - md: check mddev->pers before calling md_set_readonly() - md: clean up openers check in do_md_stop() and md_set_readonly() - md: sync blockdev before stopping raid or setting readonly - md: factor out a helper to sync mddev - md: return directly before setting did_set_md_closing - md: changed the switch of RAID_VERSION to if - md: merge the check of capabilities into md_ioctl_valid() - md: Don't suspend the array for interrupted reshape - md: Don't register sync_thread for reshape directly - md: Make sure md_do_sync() will set MD_RECOVERY_DONE - md: Don't ignore read-only array in md_check_recovery() - md: Don't ignore suspended array in md_check_recovery() - md: get rdev->mddev with READ_ONCE() - md: remove redundant md_wakeup_thread() - md: remove redundant check of 'mddev->sync_thread' - md: fix a suspicious RCU usage warning - raid: Remove now superfluous sentinel element from ctl_table array - NFSD: NFSv4 file creation neglects setting ACL - nfsd: set security label during create operations - xfs: Add xfs_dir3_leaf_header_check() in leaf/leafn read - nvme-fc: use lock accessing port_state and rport state - x86/mm: Batch flushing user memory encrytion status change - !20588 [OLK-6.6] Revert "x86/csv: Enhance CMA memory usage reporting for CSV3" - Revert "x86/csv: Enhance CMA memory usage reporting for CSV3" - !20576 media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg() - !20575 RDMA/cm: Fix leaking the multicast GID table reference - !20580 RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly - !20551 Fix CVE-2025-68785 - !20478 f2fs: fix to avoid potential deadlock - !20501 [OLK-6.6] backport important bugfix for bnxt driver from upstream linux-6.6.y - !20520 Fix CVE-2026-23038 - !20424 net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup - !20425 mlx5: Fix default values in create CQ - RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly - media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg() - RDMA/cm: Fix leaking the multicast GID table reference - net: openvswitch: fix middle attribute validation in push_nsh() action - net: openvswitch: remove never-working support for setting nsh fields - pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() - bnxt_en: Fix potential data corruption with HW GRO/LRO - f2fs: fix to avoid potential deadlock - mlx5: Fix default values in create CQ - net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup - riscv kernel upgrade to 6.6.0-138.0.0 - Fixed system hang when boot systemd on spacemit k3 - riscv: perf vendor events: fix lrw core PMU event mapping - !20727 v2 bpf: sockmap fixes - !20741 scsi: qla2xxx: Sanitize payload size to prevent member overflow - !20744 fix CVE-2025-38449 - !20763 net: usb: asix: validate PHY address before use - !20762 smc91x: fix broken irq-context in PREEMPT_RT - !20293 [Hygon][6.6][EDAC] The width of hash value is 2 bits for Hygon family 18h model 6h processors - !20290 [Hygon][6.6][Bugfix] Bug fix for EDAC to use unicast instead of broadcast on hygon family 18h model 4h - !20289 [Hygon][6.6][Bugfix] Bug fix for EDAC to correct the address translation on hygon family 18h model 4h - !20245 KVM: arm64: Refactor exit handlers - !20246 KVM: arm64: Mark some header functions as inline - !19005 [Hygon] [OLK-6.6] [Bugfix] Fix memory bandwidth counter width for Hygon QoS - !20292 [Hygon][6.6][TSC Adjust] Backport x86 TSC adjust patch - !20273 [Hygon][6.6][Bugfix] Get correct CPU LLC ID in guest for Hygon processors - !20722 [OLK-6.6][linux-6.6.y sync] Backport 6.6.104-6.6.106 LTS Patches - !20667 fix CVE-2024-50102 - !20736 netfilter: nf_tables: remove redundant chain validation on register store - !20758 ub: ubase: Fixed the alarm issue caused by the initialization of the structure variable definition. - !20721 obmm: reduce log noise for successful export/import/preimport - net: usb: asix: validate PHY address before use - smc91x: fix broken irq-context in PREEMPT_RT - !20731 devlink: rate: Unset parent pointer in devl_rate_nodes_destroy - !20732 libceph: return the handler error from mon_handle_auth_done() - !20743 mm: slub: avoid wake up kswapd in set_track_prepare - ub: ubase: Fixed the alarm issue caused by the initialization of the structure variable definition. - !20750 ub: cdma: adapted to UMMU interface changes - !20713 urma: DFX of log in kernel - urma: optimize log levels for kernel space - ub: cdma: adapted to UMMU interface changes - wifi: ath11k: avoid bit operation on key flags - drm/mediatek: fix potential OF node use-after-free - cpufreq: intel_pstate: Check IDA only before MSR_IA32_PERF_CTL writes - wifi: cfg80211: sme: store capped length in __cfg80211_connect_result() - !20708 ub:hisi-ubus: Add create bus instance ummu bypass - drm: fix kabi for struct drm_framebuffer - drm/framebuffer: Acquire internal references on GEM handles - drm/gem: Acquire references on GEM handles for framebuffers - mm: slub: avoid wake up kswapd in set_track_prepare - scsi: qla2xxx: Sanitize payload size to prevent member overflow - netfilter: nf_tables: remove redundant chain validation on register store - libceph: return the handler error from mon_handle_auth_done() - devlink: rate: Unset parent pointer in devl_rate_nodes_destroy - Documentation/hw-vuln: Add VMSCAPE documentation - dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status() - riscv: use lw when reading int cpu in asm_per_cpu - mm: slub: avoid wake up kswapd in set_track_prepare - tools: gpio: remove the include directory on make clean - tools: gpio: rm .*.cmd on make clean - drm/amd/amdgpu: Fix missing error return on kzalloc failure - drm/amdgpu: Replace DRM_* with dev_* in amdgpu_psp.c - perf bpf-event: Fix use-after-free in synthesis - drm/bridge: ti-sn65dsi86: fix REFCLK setting - spi: spi-fsl-lpspi: Clear status register after disabling the module - spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort - spi: spi-fsl-lpspi: Set correct chip-select polarity bit - spi: spi-fsl-lpspi: Fix transmissions when using CONT - hwmon: mlxreg-fan: Prevent fans from getting stuck at 0 RPM - pcmcia: omap: Add missing check for platform_get_resource - Revert "drm/amdgpu: Avoid extra evict-restore process." - ALSA: hda/realtek: Fix headset mic for TongFang X6[AF]R5xxY - ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model - drm/mediatek: Fix device/node reference count leaks in mtk_drm_get_all_drm_priv - drm/mediatek: Fix using wrong drm private data to bind mediatek-drm - drm/mediatek: Add crtc path enum for all_drm_priv array - vmxnet3: update MTU after device quiesce - net: dsa: microchip: linearize skb for tail-tagging switches - net: dsa: microchip: update tag_ksz masks for KSZ9477 family - dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status() - ALSA: hda/realtek - Add new HP ZBook laptop with micmute led fixup - ALSA: hda/realtek: Add support for HP Agusta using CS35L41 HDA - iio: pressure: mprls0025pa: use aligned_s64 for timestamp - iio: chemical: pms7003: use aligned_s64 for timestamp - iio: imu: inv_mpu6050: align buffer for timestamp - thermal/drivers/mediatek/lvts: Disable low offset IRQ for minimum threshold - nouveau: fix disabling the nonstall irq due to storm code - cpufreq: intel_pstate: Unchecked MSR aceess in legacy mode - net: pcs: rzn1-miic: Correct MODCTRL register offset - platform/x86/amd/pmc: Add TUXEDO IB Pro Gen10 AMD to spurious 8042 quirks list - drm/amdgpu: drop hw access in non-DC audio fini - wifi: mt76: mt7996: Initialize hdr before passing to skb_put_data() - wifi: mwifiex: Initialize the chan_stats array to zero - tcp_bpf: Fix copied value in tcp_bpf_sendmsg - skmsg: Return copied bytes in sk_msg_memcopy_from_iter - tcp_bpf: Add sk_rmem_alloc related logic for tcp_bpf ingress redirection - Revert "bpf, sockmap: Add sk_rmem_alloc check for sockmap" - ALSA: usb-audio: Add mute TLV for playback volumes on some devices - phy: mscc: Stop taking ts_lock for tx_queue and use its own lock - selftest: net: Fix weird setsockopt() in bind_bhash.c. - net: atm: fix memory leak in atm_register_sysfs when device_register fail - ax25: properly unshare skbs in ax25_kiss_rcv() - mctp: return -ENOPROTOOPT for unknown getsockopt options - net/smc: Remove validation of reserved bits in CLC Decline message - ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init() - net: thunder_bgx: decrement cleanup index before use - net: thunder_bgx: add a missing of_node_put - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() - wifi: libertas: cap SSID len in lbs_associate() - wifi: cw1200: cap SSID length in cw1200_do_join() - net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets - wifi: ath11k: fix group data packet drops during rekey - wifi: ath11k: avoid forward declaration of ath11k_mac_start_vdev_delay() - wifi: ath11k: rename ath11k_start_vdev_delay() - wifi: ath11k: Introduce and use ath11k_sta_to_arsta() - net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() - macsec: read MACSEC_SA_ATTR_PN with nla_get_uint - netlink: add variable-length / auto integers - net: macb: Fix tx_ptr_lock locking - icmp: fix icmp_ndo_send address translation for reply direction - mISDN: Fix memory leak in dsp_hwec_enable() - xirc2ps_cs: fix register access when enabling FullDuplex - netfilter: conntrack: helper: Replace -EEXIST by -EBUSY - wifi: cfg80211: fix use-after-free in cmp_bss() - arm64: dts: imx8mp: Fix missing microSD slot vqmmc on Data Modul i.MX8M Plus eDM SBC - arm64: dts: imx8mp: Fix missing microSD slot vqmmc on DH electronics i.MX8M Plus DHCOM - tee: optee: ffa: fix a typo of "optee_ffa_api_is_compatible" - arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro - Bluetooth: hci_sync: Avoid adding default advertising on startup - cpupower: Fix a bug where the -t option of the set subcommand was not working. - drm/amd/display: Don't warn when missing DCE encoder caps - cdc_ncm: Flag Intel OEM version of Fibocom L850-GL as WWAN - LoongArch: Save LBT before FPU in setup_sigcontext() - btrfs: avoid load/store tearing races when checking if an inode was logged - btrfs: fix race between setting last_dir_index_offset and inode logging - btrfs: fix race between logging inode and checking if it was logged before - bpf: Fix oob access in cgroup local storage - !20556 urma: fix update topo logic - !20639 [OLK-6.6][linux-6.6.y sync] Backport 6.6.103-6.6.104 LTS Patches - !20641 [OLK-6.6][linux-6.6.y sync] LoongArch: Add more instruction opcodes and emit_* helpers - !20560 *** fix CVE-2025-38062 *** - !20662 pNFS: Fix a deadlock when returning a delegation during open() - ub:hisi-ubus: Add create bus instance ummu bypass - Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" - Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set" - HID: mcp2221: Handle reads greater than 60 bytes - HID: mcp2221: Don't set bus speed on every transfer - net/mlx5: SF, Fix add port error handling - drm/nouveau/disp: Always accept linear modifier - smb3 client: fix return code mapping of remap_file_range - net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions - dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted - HID: wacom: Add a new Art Pen 2 - HID: logitech: Add ids for G PRO 2 LIGHTSPEED - HID: quirks: add support for Legion Go dual dinput modes - net: stmmac: Set CIC bit only for TX queues with COE - net: stmmac: xgmac: Correct supported speed modes - net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts - net/mlx5e: Set local Xoff after FW update - net/mlx5e: Update and set Xon/Xoff upon port speed set - net/mlx5e: Update and set Xon/Xoff upon MTU set - net/mlx5: Nack sync reset when SFs are present - net/mlx5: Convert SF port_indices xarray to function_ids xarray - net/mlx5: Use devlink port pointer to get the pointer of container SF struct - net/mlx5: Call mlx5_sf_id_erase() once in mlx5_sf_dealloc() - phy: mscc: Fix when PTP clock is register and unregister - net: dlink: fix multicast stats being counted incorrectly - dt-bindings: display/msm: qcom,mdp5: drop lut clock - drm/nouveau: remove unused memory target test - drm/nouveau: remove unused increment in gm200_flcn_pio_imem_wr - Bluetooth: hci_sync: fix set_local_name race condition - Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced - Bluetooth: hci_event: Mark connection as closed during suspend disconnect - Bluetooth: hci_event: Treat UNKNOWN_CONN_ID on disconnect as success - HID: input: report battery status changes immediately - HID: input: rename hidinput_set_battery_charge_status() - powerpc/kvm: Fix ifdef to remove build warning - drm/msm: Defer fd_install in SUBMIT ioctl - vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() - ACPI: EC: Add device to acpi_ec_no_wakeup[] qurik list - erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC - ASoC: codecs: tx-macro: correct tx_macro_component_drv name - smb: client: fix race with concurrent opens in unlink(2) - scsi: core: sysfs: Correct sysfs attributes access rights - of: dynamic: Fix use after free in of_changeset_add_prop_helper() - of: Add a helper to free property struct - mips: lantiq: xway: sysctrl: rename the etop node - mips: dts: lantiq: danube: add missing burst length property - pinctrl: STMFX: add missing HAS_IOMEM dependency - of: dynamic: Fix memleak when of_pci_add_properties() failed - !20684 urma: adjust urma log format - !20355 udp: Deal with race between UDP socket address change and rehash - !20627 Fixes CVE-2025-38627 - !20702 CVE-2025-39948 - !20701 netfilter: ctnetlink: remove refcounting in expectation dumpers - !20700 CVE-2025-38678 - !20703 CVE-2025-38491 - !20690 tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. - obmm: reduce log noise for successful export/import/preimport - mptcp: avoid deadlock on fallback while reinjecting - mptcp: plug races between subflow fail and subflow creation - mptcp: make fallback action and fallback decision atomic - ice: fix Rx page leak on multi-buffer frames - ice: fix incorrect counter for buffer allocation failures - ice: stop storing XDP verdict within ice_rx_buf - ice: gather page_count()'s of each frag right before XDP prog call - ice: Introduce ice_xdp_buff - netfilter: ctnetlink: remove refcounting in expectation dumpers - netfilter: nf_tables: reject duplicate device on updates - netfilter: nf_tables: Introduce functions freeing nft_hook objects - netfilter: nf_tables: Fix percpu address space issues in nf_tables_api.c - err.h: add ERR_PTR_PCPU(), PTR_ERR_PCPU() and IS_ERR_PCPU() macros - tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. - !20498 Fix CVE-2025-71118 - !20608 pmdomain: arm: scmi: Fix genpd leak on provider registration failure - !20679 x86/CPU/AMD: Add RDSEED fix for Zen5 - !20650 fix cve-2025-40300 - !20661 Input: alps - fix use-after-free bugs caused by dev3_register_work - !20664 backport some net bugfix from 6.6 lts - urma: adjust urma log format - !20678 ub: udma: close debug switch load parameters. - ub: udma: close debug switch load parameters. - x86/CPU/AMD: Add RDSEED fix for Zen5 - !20630 net: LTS-6.6 bugfix backport - !20632 net/sched: sch_qfq: do not free existing class in qfq_change_class() - !20631 macvlan: fix possible UAF in macvlan_forward_source() - !20628 Fix CVE-2025-39910 - !20659 v2 Fix CVE-2025-22090 - !20506 XSched: Update XSched manual - !20647 media: imon: make send_packet() more robust - !20646 ksm: use range-walk function to jump over holes in scan_get_next_rmap_item - !20645 fbcon: Set fb_display[i - !20648 parse_longname(): strrchr() expects NUL-terminated string - !20621 urma: modify log level - !20602 urma: fix the jfe uaf issue that occurred during the killall process. - !20567 urma:change log level and pass status 9 - !20640 iio: common: st_sensors: Fix use of uninitialize device structs - !20634 usb: gadget: udc: fix use-after-free in usb_gadget_state_work - !20633 net: dsa: properly keep track of conduit reference - !20635 fix CVE-2025-68231 - !20651 mm/slub: avoid accessing metadata when pointer is invalid in object_err() - !20649 drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb - !20652 mm/vmalloc: fix data race in show_numa_info() - x86: uaccess: don't use runtime-const rewriting in modules - x86: fix off-by-one in access_ok() - x86: fix user address masking non-canonical speculation issue - x86/uaccess: Zero the 8-byte get_range case on failure on 32-bit - x86/uaccess: Improve the 8-byte getuser() case - x86: fix whitespace in runtime-const assembler output - dcache: keep dentry_hashtable or d_hash_shift even when not used - runtime constants: add x86 architecture support - runtime constants: deal with old decrepit linkers - x86/uaccess: Add missing __force to casts in __access_ok() and valid_user_address() - !20345 arm64: entry: xcall/xint: make asm conditionals compatible with clang IAS - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). - libceph: replace BUG_ON with bounds check for map->max_osd - libceph: prevent potential out-of-bounds writes in handle_auth_session_key() - libceph: fix potential use-after-free in have_mon_and_osd_map() - sctp: Hold sock lock while iterating over address list - sctp: Prevent TOCTOU out-of-bounds write - sctp: Hold RCU read lock while iterating over address list - tipc: Fix use-after-free in tipc_mon_reinit_self(). - sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto - sctp: avoid NULL dereference when chunk data buffer is missing - bpf: Explicitly check accesses to bpf_sock_addr - ipvs: Defer ip_vs_ftp unregister during netns cleanup - nexthop: Forbid FDB status change while nexthop is in a group - netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). - net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer - sctp: initialize more fields in sctp_v6_from_sk() - pNFS: Fix a deadlock when returning a delegation during open() - Input: alps - fix use-after-free bugs caused by dev3_register_work - x86/cpu: Get CPU LLC ID from CPUID 0x8000001d in guest for Hygon processors - kernel/fork: only call untrack_pfn_clear() on VMAs duplicated for fork() - mm: (un)track_pfn_copy() fix + doc improvements - x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range() - !20642 mtdchar: fix integer overflow in read/write ioctls - mm/vmalloc: fix data race in show_numa_info() - mm/slub: avoid accessing metadata when pointer is invalid in object_err() - config: enable CONFIG_MITIGATION_VMESCAPE by default on x86 - x86/vmscape: Enable the mitigation - x86/vmscape: Enumerate VMSCAPE bug - x86/vmscape: Add conditional IBPB mitigation - drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb - parse_longname(): strrchr() expects NUL-terminated string - media: imon: make send_packet() more robust - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item - fbcon: Set fb_display[i]->mode to NULL when the mode is released - !20569 CVE-2024-35808 - mtdchar: fix integer overflow in read/write ioctls - !20619 Fix CVE-2026-22991 - !20612 net: hns3: extend HCLGE_FD_AD_COUNTER_NUM to 8 bits - LoongArch: Add more instruction opcodes and emit_* helpers - iio: common: st_sensors: Fix use of uninitialize device structs - !20581 null_blk: fix kmemleak by releasing references to fault configfs items - mm/mempool: fix poisoning order>0 pages with HIGHMEM - mm/page_poison: replace kmap_atomic() with kmap_local_page() - mm/mempool: replace kmap_atomic() with kmap_local_page() - usb: gadget: udc: fix use-after-free in usb_gadget_state_work - net: dsa: properly keep track of conduit reference - net/sched: sch_qfq: do not free existing class in qfq_change_class() - macvlan: fix possible UAF in macvlan_forward_source() - netfilter: nft_objref: validate objref and objrefmap expressions - arp: do not assume dev_hard_header() does not change skb->head - ip6_gre: make ip6gre_header() robust - netfilter: nf_tables: avoid chain re-validation if possible - netfilter: nf_tables: drop unused 3rd argument from validate callback ops - Revert "netfilter: nft_objref: validate objref and objrefmap expressions" - bpf: Fix reference count leak in bpf_prog_test_run_xdp() - net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset - ethtool: Avoid overflowing userspace buffer on stats query - ipvs: fix ipv4 null-ptr-deref in route error path - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() - !20596 mm/page_alloc: prevent pcp corruption with SMP=n - !20598 team: fix check for port enabled in team_queue_override_port_prio_changed() - !18823 hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio - mm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc() - kasan: avoid sleepable page allocation from atomic context - f2fs: compress: fix UAF of f2fs_inode_info in f2fs_free_dic - f2fs: compress: change the first parameter of page_array_{alloc,free} to sbi - !20583 [OLK-6.6][linux-6.6.y sync] Backport 6.6.102-6.6.103 LTS Patches - !20460 fbdev: Fix vmalloc out-of-bounds write in fast_imageblit - urma:fix log level and pass status 9 - urma: modify log level - !20592 CVE-2025-71141 fixup - !20594 CVE-2025-39744 fixup - !20607 powerpc/64s/slb: Fix SLB multihit issue during SLB preload - !20606 mm/huge_memory: fix NULL pointer deference when splitting folio - !20604 Fix CVE-2026-22984 - !20603 Fix CVE-2026-23021 - !20600 Fix CVE-2026-22990 - urma: fix the jfe uaf issue that occurred during the killall process. - !20380 pswiotlb: Adapt to the IOMMU DMA API upgraded by IOMMUFD - libceph: make free_choose_arg_map() resilient to partial allocation - drm/dp: Change AUX DPCD probe address from LANE0_1_STATUS to TRAINING_PATTERN_SET - net: hns3: extend HCLGE_FD_AD_COUNTER_NUM to 8 bits - net: hns3: extend HCLGE_FD_AD_QID to 11 bits - net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue - net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M - Revert "net: hns3: add support for FD counter" - !20587 dmaengine: stm32: dmamux: fix device leak on route allocation - pmdomain: arm: scmi: Fix genpd leak on provider registration failure - powerpc/64s/slb: Fix SLB multihit issue during SLB preload - mm/huge_memory: fix NULL pointer deference when splitting folio - !20562 LoongArch: BPF: Sign extend kfunc call arguments - !20470 ipv4: Fix reference count leak when using error routes with nexthop objects - !20471 net: sock: fix hardened usercopy panic in sock_recv_errqueue - !20472 net: fix memory leak in skb_segment_list for GRO packets - !20473 ipv4: ip_gre: make ipgre_header() robust - !20469 SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf - !20476 ipv6: Fix use-after-free in inet6_addr_del(). - !20477 svcrdma: bound check rq_pages index in inline path - !20578 ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() - !20579 fix CVE-2025-68768 - !20542 Fix NFS deadlock - USB: storage: Remove subclass and protocol overrides from Novatek quirk - cpuidle: governors: menu: Select polling state in some more cases - cpuidle: governors: menu: Rearrange main loop in menu_select() - cpuidle: menu: Update documentation after previous changes - Revert "drm/tegra: dsi: Clear enable register if powered by bootloader" - parisc: Remove spurious if statement from raw_copy_from_user() - ata: libata-scsi: Fix system suspend for a security locked drive - Revert "drm/amdgpu: fix incorrect vm flags to map bo" - mfd: axp20x: Set explicit ID for regulator cell if no IRQ line is present - drm/amd/display: use udelay rather than fsleep - sched/fair: Revert max_newidle_lb_cost bump - net: ipv4: fix regression in local-broadcast routes - tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers - PM: runtime: Do not clear needs_force_resume with enabled runtime PM - usb: typec: ucsi: psy: Set max current to zero when disconnected - io_uring/rw: cast rw->flags assignment to rwf_t - Documentation: ACPI: i2c-muxes: fix I2C device references - s390/hypfs: Enable limited access during lockdown - s390/hypfs: Avoid unnecessary ioctl registration in debugfs - ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation - net/mlx5e: Preserve shared buffer capacity during headroom updates - net/mlx5: Base ECVF devlink port attrs from 0 - Octeontx2-af: Skip overlap check for SPI field - bonding: send LACPDUs periodically in passive mode after receiving partner's LACPDU - bonding: Add independent control state machine - bonding: update LACP activity flag after setting lacp_active - net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate - ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc - gve: prevent ethtool ops after shutdown - phy: mscc: Fix timestamping for vsc8584 - net: ethernet: mtk_ppe: add RCU lock around dev_fill_forward_path - ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add - net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM - ALSA: usb-audio: Fix size validation in convert_chmap_v3() - mlxsw: spectrum: Forward packets with an IPv4 link-local source IP - Bluetooth: hci_conn: do return error from hci_enhanced_setup_sync() - Bluetooth: hci_event: fix MTU for BN == 0 in CIS Established - scsi: qla4xxx: Prevent a potential error pointer dereference - RDMA/bnxt_re: Fix to initialize the PBL array - RDMA/bnxt_re: Fix to remove workload check in SRQ limit path - RDMA/bnxt_re: Fix to do SRQ armena by default - RDMA/erdma: Fix ignored return value of init_kernel_qp - iosys-map: Fix undefined behavior in iosys_map_clear() - cgroup/cpuset: Use static_branch_enable_cpuslocked() on cpusets_insane_config_key - spi: spi-fsl-lpspi: Clamp too high speed_hz - usb: typec: maxim_contaminant: disable low power mode when reading comparator values - usb: typec: maxim_contaminant: re-enable cc toggle if cc is open and port is clean - iio: imu: inv_icm42600: change invalid data error to -EBUSY - iio: imu: inv_icm42600: Convert to uXX and sXX integer types - iio: imu: inv_icm42600: use = { } instead of memset() - iio: imu: inv_icm42600: switch timestamp type from int64_t __aligned(8) to aligned_s64 - iio: temperature: maxim_thermocouple: use DMA-safe buffer for spi_read() - iio: light: as73211: Ensure buffer holes are zeroed - tls: fix handling of zero-length records on the rx_list - powerpc/boot: Fix build with gcc 15 - mmc: sdhci-pci-gli: GL9763e: Mask the replay timer timeout of AER - compiler: remove __ADDRESSABLE_ASM{_STR,}() again - drm/amd/display: Don't overclock DCE 6 by 15% - usb: dwc3: pci: add support for the Intel Wildcat Lake - usb: dwc3: Ignore late xferNotReady event to prevent halt timeout - USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles - usb: storage: realtek_cr: Use correct byte order for bcs->Residue - USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera - usb: renesas-xhci: Fix External ROM access timeouts - usb: core: hcd: fix accessing unmapped memory in SINGLE_STEP_SET_FEATURE test - comedi: Make insn_rw_emulate_bits() do insn->n samples - usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive - cdx: Fix off-by-one error in cdx_rpmsg_probe() - most: core: Drop device reference after usage in get_channel() - iio: proximity: isl29501: fix buffered read on big-endian systems - iio: pressure: bmp280: Use IS_ERR() in bmp280_common_probe() - fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable() - drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS - cpuidle: governors: menu: Avoid selecting states with too much latency - cpuidle: menu: Remove iowait influence - mmc: sdhci-pci-gli: Add a new function to simplify the code - mmc: sdhci-pci-gli: Use PCI AER definitions, not hard-coded values - mptcp: disable add_addr retransmission when timeout is 0 - mptcp: remove duplicate sk_reset_timer call - use uniform permission checks for all mount propagation changes - arm64: dts: ti: k3-am62-main: Remove eMMC High Speed DDR support - scsi: mpi3mr: Serialize admin queue BAR writes on 32-bit systems - scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers - scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE - PCI: imx6: Add IMX8MM_EP and IMX8MP_EP fixed 256-byte BAR 4 in epc_features - PCI: imx6: Delay link start until configfs 'start' written - PCI: rockchip: Set Target Link Speed to 5.0 GT/s before retraining - PCI: rockchip: Use standard PCIe definitions - drm/amd/display: Fill display clock and vblank time in dce110_fill_display_configs - drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs - drm/amd/display: Fix DP audio DTO1 clock source on DCE 6. - drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3 - ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and EliteBook 830 G6 - mm/debug_vm_pgtable: clear page table entries at destroy_args() - squashfs: fix memory leak in squashfs_fill_super - mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for consistency - memstick: Fix deadlock by moving removing flag earlier - KVM: arm64: Fix kernel BUG() due to bad backport of FPSIMD/SVE/SME fix - sched/fair: Fix frequency selection for non-invariant case - kbuild: userprogs: use correct linker when mixing clang and GNU ld - ata: libata-scsi: Return aborted command when missing sense and result TF - PM: runtime: Take active children into account in pm_runtime_get_if_in_use() - PM: runtime: Simplify pm_runtime_get_if_active() usage - ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig - usb: dwc3: imx8mp: fix device leak at unbind - wifi: mac80211: check basic rates validity in sta_link_apply_parameters - KVM: x86: Take irqfds.lock when adding/deleting IRQ bypass producer - s390/mm: Remove possible false-positive warning in pte_free_defer() - btrfs: send: make fs_path_len() inline and constify its argument - btrfs: send: use fallocate for hole punching with send stream v2 - btrfs: send: avoid path allocation for the current inode when issuing commands - btrfs: send: keep the current inode's path cached - btrfs: send: add and use helper to rename current inode when processing refs - btrfs: send: only use boolean variables at process_recorded_refs() - btrfs: send: factor out common logic when sending xattrs - btrfs: populate otime when logging an inode item - btrfs: constify more pointer parameters - btrfs: fix ssd_spread overallocation - btrfs: open code timespec64 in struct btrfs_inode - xfs: fully decouple XFS_IBULK* flags from XFS_IWALK* flags - btrfs: abort transaction on unexpected eb generation at btrfs_copy_root() - btrfs: always abort transaction on failure to add block group to free space tree - btrfs: move transaction aborts to the error site in add_block_group_free_space() - btrfs: qgroup: fix race between quota disable and quota rescan ioctl - usb: typec: fusb302: cache PD RX state - block: Make REQ_OP_ZONE_FINISH a write operation - block: reject invalid operation in submit_bio_noacct - leds: flash: leds-qcom-flash: Fix registry access after re-bind - leds: flash: leds-qcom-flash: Limit LED current based on thermal condition - selftests/memfd: add test for mapping write-sealed memfd read-only - mm: update memfd seal write check to include F_SEAL_WRITE - mptcp: pm: kernel: flush: do not reset ADD_ADDR limit - mptcp: drop skb if MPTCP skb extension allocation fails - ipv6: sr: Fix MAC comparison to be constant-time - drm/amd/display: Don't overwrite dce60_clk_mgr - drm/amd/display: Add primary plane to commits for correct VRR handling - drm/amdkfd: Destroy KFD debugfs after destroy KFD wq - drm/amdgpu: update mmhub 3.0.1 client id mappings - drm/amdgpu: Avoid extra evict-restore process. - drm/amd: Restore cached power limit during resume - media: venus: venc: Clamp param smaller than 1fps and bigger than 240 - media: venus: vdec: Clamp param smaller than 1fps and bigger than 240. - media: venus: protect against spurious interrupts during probe - media: venus: hfi: explicitly release IRQ during teardown - media: qcom: camss: cleanup media device allocated resource on error path - media: ov2659: Fix memory leaks in ov2659_probe() - media: usbtv: Lock resolution while streaming - media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free() - media: verisilicon: Fix AV1 decoder clock frequency - media: vivid: fix wrong pixel_array control size - media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init() - media: hi556: correct the test pattern configuration - media: gspca: Add bounds checking to firmware parser - parisc: Update comments in make_insert_tlb - parisc: Try to fixup kernel exception in bad_area_nosemaphore path of do_page_fault() - parisc: Rename pte_needs_flush() to pte_needs_cache_flush() in cache.c - parisc: Makefile: explain that 64BIT requires both 32-bit and 64-bit compilers - parisc: Define and use set_pte_at() - parisc: Check region is readable by user in raw_copy_from_user() - soc/tegra: pmc: Ensure power-domains are in a known state - f2fs: fix to avoid out-of-boundary access in dnode page - phy: qcom: phy-qcom-m31: Update IPQ5332 M31 USB phy initialization sequence - vhost/vsock: Avoid allocating arbitrarily-sized SKBs - PCI: endpoint: Fix configfs group removal on driver teardown - PCI: endpoint: Fix configfs group list head handling - mtd: rawnand: renesas: Add missing check after DMA map - mtd: rawnand: fsmc: Add missing check after DMA map - mtd: spinand: propagate spinand_wait() errors from spinand_write_page() - mtd: spi-nor: Fix spi_nor_try_unlock_all() - hwmon: (gsc-hwmon) fix fan pwm setpoint show functions - pwm: mediatek: Fix duty and period setting - pwm: mediatek: Handle hardware enable and clock enable separately - pwm: imx-tpm: Reset counter if CMOD is 0 - wifi: ath11k: fix dest ring-buffer corruption when ring is full - wifi: ath11k: fix source ring-buffer corruption - wifi: ath11k: fix dest ring-buffer corruption - wifi: ath12k: fix dest ring-buffer corruption when ring is full - wifi: ath12k: fix source ring-buffer corruption - wifi: ath12k: fix dest ring-buffer corruption - wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table() - iio: adc: ad_sigma_delta: change to buffer predisable - zynq_fpga: use sgtable-based scatterlist wrappers - scsi: ufs: ufs-pci: Fix default runtime and system PM levels - scsi: ufs: ufs-pci: Fix hibernate state transition for Intel MTL-like host controllers - ata: libata-scsi: Fix ata_to_sense_error() status handling - scsi: mpi3mr: Fix race between config read submit and interrupt completion - dt-bindings: display: sprd,sharkl3-dsi-host: Fix missing clocks constraints - dt-bindings: display: sprd,sharkl3-dpu: Fix missing clocks constraints - arm64: dts: ti: k3-am62-verdin: Enable pull-ups on I2C buses - arm64: dts: ti: k3-am62a7-sk: fix pinmux for main_uart1 - arm64: dts: ti: k3-pinctrl: Enable Schmitt Trigger by default - btrfs: zoned: fix write time activation failure for metadata block group - ext4: fix hole length calculation overflow in non-extent inodes - ext4: don't try to clear the orphan_present feature block device is r/o - ext4: fix reserved gdt blocks handling in fsmap - ext4: fix fsmap end of range reporting with bigalloc - ext4: check fast symlink for ea_inode correctly - tracing: fprobe-event: Sanitize wildcard for fprobe event name - crypto: qat - lower priority for skcipher and aead algorithms - lib/crypto: mips/chacha: Fix clang build and remove unneeded byteswap - vt: defkeymap: Map keycodes above 127 to K_HOLE - vt: keyboard: Don't process Unicode characters in K_OFF mode - bus: mhi: host: Fix endianness of BHI vector table - usb: dwc3: meson-g12a: fix device leaks at unbind - usb: musb: omap2430: fix device leak at unbind - usb: gadget: udc: renesas_usb3: fix device leak at unbind - usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init() - m68k: Fix lost column on framebuffer debug console - platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister() - cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table() - rcu: Fix racy re-initialization of irq_work causing hangs - HID: apple: avoid setting up battery timer for devices without battery - HID: magicmouse: avoid setting up battery timer when not needed - RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages - tools/nolibc: fix spelling of FD_SETBITMASK in FD_* macros - media: uvcvideo: Do not mark valid metadata as invalid - media: venus: Fix OOB read due to missing payload bound check - parisc: Makefile: fix a typo in palo.conf - fbdev: Fix vmalloc out-of-bounds write in fast_imageblit - btrfs: do not allow relocation of partially dropped subvolumes - btrfs: zoned: do not select metadata BG as finish target - btrfs: clear dirty status from extent buffer on error at insert_new_root() - btrfs: zoned: do not remove unwritten non-data block group - btrfs: abort transaction during log replay if walk_log_tree() failed - btrfs: zoned: use filesystem size not disk size for reclaim decision - cdc-acm: fix race between initial clearing halt and open - thunderbolt: Fix copy+paste error in match_service_id() - usb: typec: ucsi: Update power_supply on power role change - misc: rtsx: usb: Ensure mmc child device is active when card is present - iommufd: Report unmapped bytes in the error path of iopt_unmap_iova_range - cifs: reset iface weights when we cannot find a candidate - drm/amdgpu: fix incorrect vm flags to map bo - scsi: lpfc: Remove redundant assignment to avoid memory leak - rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe - pNFS: Handle RPC size limit for layoutcommits - pNFS: Fix disk addr range check in block/scsi layout - pNFS: Fix stripe mapping in block/scsi layout - ASoC: Intel: avs: Fix uninitialized pointer error in probe() - net: phy: smsc: add proper reset flags for LAN8710A - ipmi: Fix strcpy source and destination the same - kconfig: lxdialog: fix 'space' to (de)select options - kconfig: gconf: fix potential memory leak in renderer_edited() - kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed() - ipmi: Use dev_warn_ratelimited() for incorrect message warnings - vfio/mlx5: fix possible overflow in tracking max message size - scsi: aacraid: Stop using PCI_IRQ_AFFINITY - scsi: target: core: Generate correct identifiers for PR OUT transport IDs - scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans - kconfig: nconf: Ensure null termination where strncpy is used - vfio/type1: conditional rescheduling while pinning - kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c - f2fs: check the generic conditions first - exfat: add cluster chain loop check for dir - i2c: Force DLL0945 touchpad i2c freq to 100khz - apparmor: use the condition in AA_BUG_FMT even with debug disabled - dm-table: fix checking for rq stackable devices - dm-mpath: don't print the "loaded" message if registering fails - i3c: master: Initialize ret in i3c_i2c_notifier_call() - i3c: don't fail if GETHDRCAP is unsupported - apparmor: shift ouid when mediating hard links in userns - rtc: ds1307: handle oscillator stop flag (OSF) for ds1341 - i3c: add missing include to internal header - module: Prevent silent truncation of module name in delete_module(2) - md: dm-zoned-target: Initialize return variable r to avoid uninitialized use - soundwire: Move handle_nested_irq outside of sdw_dev_lock - soundwire: amd: serialize amd manager resume sequence during pm_prepare - crypto: octeontx2 - add timeout for load_fvc completion poll - media: uvcvideo: Fix bandwidth issue for Alcor camera - media: usb: hdpvr: disable zero-length read messages - media: tc358743: Increase FIFO trigger level to 374 - media: tc358743: Return an appropriate colorspace from tc358743_set_fmt - media: tc358743: Check I2C succeeded during probe - pinctrl: stm32: Manage irq affinity settings - scsi: mpi3mr: Correctly handle ATA device errors - scsi: mpt3sas: Correctly handle ATA device errors - power: supply: qcom_battmgr: Add lithium-polymer entry - RDMA/core: reduce stack using in nldev_stat_get_doit() - dmaengine: stm32-dma: configure next sg only if there are more than 2 sgs - leds: leds-lp50xx: Handle reg to get correct multi_index - media: v4l2-common: Reduce warnings about missing V4L2_CID_LINK_FREQ control - MIPS: lantiq: falcon: sysctrl: fix request memory check logic - crypto: jitter - fix intermediary handling - watchdog: iTCO_wdt: Report error if timeout configuration fails - MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free} - clk: qcom: ipq5018: keep XO clock always on - hwmon: (emc2305) Set initial PWM minimum value during probe based on thermal state - watchdog: dw_wdt: Fix default timeout - fs/orangefs: use snprintf() instead of sprintf() - phy: rockchip-pcie: Properly disable TEST_WRITE strobe signal - mfd: axp20x: Set explicit ID for AXP313 regulator - clk: tegra: periph: Fix error handling and resolve unsigned compare warning - fbdev: fix potential buffer overflow in do_register_framebuffer() - cifs: Fix calling CIFSFindFirst() for root path without msearch - watchdog: sbsa: Adjust keepalive timeout to avoid MediaTek WS0 race condition - drm/amd/display: Avoid configuring PSR granularity if PSR-SU not supported - drm/amd/display: Only finalize atomic_obj if it was initialized - vhost: fail early when __vhost_add_used() fails - vsock/virtio: Resize receive buffers so that each SKB fits in a 4K page - net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325 - rcu: Fix rcu_read_unlock() deadloop due to IRQ work - drm/amd/display: Avoid trying AUX transactions on disconnected ports - selftests/bpf: Fix a user_ringbuf failure with arm64 64KB page size - bpf: Make reg_not_null() true for CONST_PTR_TO_MAP - uapi: in6: restore visibility of most IPv6 socket options - drm/ttm: Should to return the evict error - drm: renesas: rz-du: mipi_dsi: Add min check for VCLK range - net: ncsi: Fix buffer overflow in fetching version id - ionic: clean dbpage in de-init - wifi: rtlwifi: fix possible skb memory leak in _rtl_pci_init_one_rxdesc() - ptp: Use ratelimite for freerun error message - bpftool: Fix JSON writer resource leak in version command - net: dsa: b53: prevent SWITCH_CTRL access on BCM5325 - net: dsa: b53: prevent DIS_LEARNING access on BCM5325 - net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325 - net: dsa: b53: fix b53_imp_vlan_setup for BCM5325 - gve: Return error for unknown admin queue command - net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs - net: vlan: Make is_vlan_dev() a stub when VLAN is not configured - drm/amd: Allow printing VanGogh OD SCLK levels without setting dpm to manual - dpaa_eth: don't use fixed_phy_change_carrier - wifi: iwlegacy: Check rate_idx range after addition - netmem: fix skb_frag_address_safe with unreadable skbs - powerpc: floppy: Add missing checks after DMA map - wifi: ath12k: Decrement TID on RX peer frag setup error handling - wifi: ath12k: Enable REO queue lookup table feature on QCN9274 hw2.0 - wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`. - wifi: mac80211: update radar_required in channel context after channel switch - drm/amd/display: Fix 'failed to blank crtc!' - wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect - wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd() - wifi: ath12k: Add memset and update default rate value in wmi tx completion - drm/amd/display: Separate set_gsl from set_gsl_source_select - net: fec: allow disable coalescing - net: atlantic: add set_power to fw_ops for atl2 to fix wol - net: thunderbolt: Fix the parameter passing of tb_xdomain_enable_paths()/tb_xdomain_disable_paths() - net: thunderbolt: Enable end-to-end flow control also in transmit - kselftest/arm64: Specify SVE data when testing VL set in sve-ptrace - wifi: mt76: mt7915: mcu: re-init MCU before loading FW patch - wifi: rtw89: Disable deep power saving for USB/SDIO - wifi: rtw89: Fix rtw89_mac_power_switch() for USB - drm/msm: use trylock for debugfs - wifi: mac80211: fix rx link assignment for non-MLO stations - ipv6: mcast: Check inet6_dev->dead under idev->mc_lock in __ipv6_dev_mc_inc(). - (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer - wifi: mac80211: don't complete management TX on SAE commit - sched/fair: Bump sd->max_newidle_lb_cost when newidle balance fails - s390/stp: Remove udelay from stp_sync_clock() - wifi: iwlwifi: mvm: fix scan request validation - um: Re-evaluate thread flags repeatedly - wifi: iwlwifi: mvm: set gtk id also in older FWs - perf/cxlpmu: Remove unintended newline from IRQ name format string - net: phy: micrel: Add ksz9131_resume() - net: thunderx: Fix format-truncation warning in bgx_acpi_match_id() - net: ipv4: fix incorrect MTU in broadcast routes - wifi: cfg80211: Fix interface type validation - net: mctp: Prevent duplicate binds - arm64: Mark kernel as tainted on SAE and SError panic - net/mlx5e: Properly access RCU protected qdisc_sleeping variable - net: ag71xx: Add missing check after DMA map - et131x: Add missing check after DMA map - wifi: rtw89: Lower the timeout in rtw89_fw_read_c2h_reg() for USB - be2net: Use correct byte order and format string for TCP seq and ack_seq - s390/time: Use monotonic clock in get_cycles() - wifi: cfg80211: reject HTC bit for management frames - ktest.pl: Prevent recursion of default variable options - wifi: ath12k: Correct tid cleanup when tid setup fails - net: usb: cdc-ncm: check for filtering capability - xen/netfront: Fix TX response spurious interrupts - Bluetooth: hci_sock: Reset cookie to zero in hci_sock_free_cookie() - powerpc/thp: tracing: Hide hugepage events under CONFIG_PPC_BOOK3S_64 - ASoC: qcom: use drvdata instead of component to keep id - ASoC: codecs: rt5640: Retry DEVICE_ID verification - iio: adc: ad7768-1: Ensure SYNC_IN pulse minimum timing requirement - ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros - ALSA: pcm: Rewrite recalculate_boundary() to avoid costly loop - platform/chrome: cros_ec_typec: Defer probe on missing EC parent - platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches - soc: qcom: mdt_loader: Actually use the e_phoff - imx8m-blk-ctrl: set ISI panic write hurry level - pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop() - usb: core: usb_submit_urb: downgrade type check - usb: typec: intel_pmc_mux: Defer probe if SCU IPC isn't present - ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4 - ASoC: hdac_hdmi: Rate limit logging on connection and disconnection - ALSA: hda: Disable jack polling at shutdown - ALSA: hda: Handle the jack polling always via a work - mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode() - mei: bus: Check for still connected devices in mei_cl_bus_dev_release() - char: misc: Fix improper and inaccurate error code returned by misc_init() - reset: brcmstb: Enable reset drivers for ARCH_BCM2835 - pps: clients: gpio: fix interrupt handling order in remove path - ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path - mmc: sdhci-msm: Ensure SD card power isn't ON when card removed - ACPI: processor: fix acpi_object initialization - PM: sleep: console: Fix the black screen issue - thermal: sysfs: Return ENODATA instead of EAGAIN for reads - PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit() - firmware: tegra: Fix IVC dependency problems - ACPI: PRM: Reduce unnecessary printing to avoid user confusion - selftests: tracing: Use mutex_unlock for testing glob filter - tools/build: Fix s390(x) cross-compilation with clang - gpio: tps65912: check the return value of regmap_update_bits() - iio: adc: ad_sigma_delta: don't overallocate scan buffer - tools/nolibc: define time_t in terms of __kernel_old_time_t - thermal/drivers/qcom-spmi-temp-alarm: Enable stage 2 shutdown when required - ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed - EDAC/synopsys: Clear the ECC counters on init - gpio: wcd934x: check the return value of regmap_update_bits() - remoteproc: imx_rproc: skip clock enable when M-core is managed by the SCU - soc: qcom: rpmh-rsc: Add RSC version 4 support - usb: xhci: Avoid showing errors during surprise removal - usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command - usb: xhci: Avoid showing warnings for dying controller - usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default - selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t - cpufreq: CPPC: Mark driver with NEED_UPDATE_LIMITS flag - platform/x86/amd: pmc: Add Lenovo Yoga 6 13ALC6 to pmc quirk list - usb: xhci: print xhci->xhc_state when queue_command failed - tracefs: Add d_delete to remove negative dentries - securityfs: don't pin dentries twice, once is enough... - fix locking in efi_secret_unlink() - ext2: Handle fiemap on empty files to prevent EINVAL - fs/ntfs3: correctly create symlink for relative path - fs/ntfs3: Add sanity check for file name - better lockdep annotations for simple_recursive_removal() - hfs: fix not erasing deleted b-tree node issue - drbd: add missing kref_get in handle_write_conflicts - udf: Verify partition map count - gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops - nvme-pci: try function level reset on init failure - smb/server: avoid deadlock when linking with ReplaceIfExists - arm64: Handle KCOV __init vs inline mismatches - ptp: prevent possible ABBA deadlock in ptp_clock_freerun() - intel_idle: Allow loading ACPI tables for any family - net: ti: icss-iep: Fix incorrect type for return value in extts_enable() - netfilter: ctnetlink: fix refcount leak on table dump - udp: also consider secpath when evaluating ipsec use for checksumming - KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs - KVM: nVMX: Check vmcs12->guest_ia32_debugctl on nested VM-Enter - KVM: VMX: Extract checking of guest's DEBUGCTL into helper - KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported - KVM: VMX: Handle forced exit due to preemption timer in fastpath - KVM: VMX: Re-enter guest in fastpath for "spurious" preemption timer exits - KVM: x86: Plumb "force_immediate_exit" into kvm_entry() tracepoint - libceph: prevent potential out-of-bounds reads in handle_auth_done() - net: usb: pegasus: fix memory leak in update_eth_regs_async() - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() - !20540 urma: added support for ipoverurma - team: fix check for port enabled in team_queue_override_port_prio_changed() - mm/page_alloc: prevent pcp corruption with SMP=n - !20528 Fix CVE-2025-71083 - KVM: nVMX: Defer SVI update to vmcs01 on EOI when L2 is active w/o VID - KVM: x86: Plumb in the vCPU to kvm_x86_ops.hwapic_isr_update() - KVM: SVM: Set RFLAGS.IF=1 in C code, to get VMRUN out of the STI shadow - smb: client: don't wait for info->send_pending == 0 on error - smb: client: let send_done() cleanup before calling smbd_disconnect_rdma_connection() - ACPI: processor: perflib: Move problematic pr->performance check - ACPI: processor: perflib: Fix initial _PPC limit application - Documentation: ACPI: Fix parent device references - fs: Prevent file descriptor table allocations exceeding INT_MAX - sunvdc: Balance device refcount in vdc_port_mpgroup_check - PCI: Extend isolated function probing to LoongArch - NFSD: detect mismatch of file handle and delegation stateid in OPEN op - net: dpaa: fix device leak when querying time stamp info - net: ti: icss-iep: fix device and OF node leaks at probe - net: mtk_eth_soc: fix device leak at probe - net: enetc: fix device and OF node leak at probe - net: gianfar: fix device leak when querying time stamp info - net: phy: micrel: fix KSZ8081/KSZ8091 cable test - gpio: mlxbf3: use platform_get_irq_optional() - gpio: mlxbf2: use platform_get_irq_optional() - gpio: virtio: Fix config space reading. - ALSA: hda/realtek: Add Framework Laptop 13 (AMD Ryzen AI 300) to quirks - ALSA: hda/realtek: Fix headset mic on HONOR BRB-X - ALSA: usb-audio: Validate UAC3 cluster segment descriptors - rcu: Fix racy re-initialization of irq_work causing hangs - rcu: Fix rcu_read_unlock() deadloop due to IRQ work - drm/tilcdc: Fix removal actions in case of failed probe - drm/tilcdc: request and mapp iomem with devres - urma: fix update topo logic - dmaengine: stm32: dmamux: fix device leak on route allocation - pswiotlb: Adapt to the IOMMU DMA API upgraded by IOMMUFD - null_blk: fix kmemleak by releasing references to fault configfs items - inet: frags: flush pending skbs in fqdir_pre_exit() - inet: frags: add inet_frag_queue_flush() - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() - md/dm-raid: don't clear MD_RECOVERY_FROZEN after setting frozen - md/dm-raid: don't call md_reap_sync_thread() directly - ACPICA: Avoid walking the Namespace if start_node is NULL - arm64: entry: xcall/xint: make asm conditionals compatible with clang IAS - LoongArch: BPF: Sign extend kfunc call arguments - genirq/msi:: Fix kabi break of struct msi_desc - genirq/msi: Store the IOMMU IOVA directly in msi_desc instead of iommu_cookie - NFS: Fix a deadlock involving nfs_release_folio() - Revert "[Huawei] Revert "NFS: fix up nfs_release_folio() to try to release the page"" - urma: added support for ipoverurma - drm/ttm: Avoid NULL pointer deref for evicted BOs - XSched: Update XSched manual - svcrdma: bound check rq_pages index in inline path - ipv6: Fix use-after-free in inet6_addr_del(). - ipv4: ip_gre: make ipgre_header() robust - net: fix memory leak in skb_segment_list for GRO packets - net: sock: fix hardened usercopy panic in sock_recv_errqueue - ipv4: Fix reference count leak when using error routes with nexthop objects - SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf - fbdev: Fix vmalloc out-of-bounds write in fast_imageblit - udp: Deal with race between UDP socket address change and rehash - EDAC/amd64: The width of hash value is 2 bits for Hygon family 18h model 6h processors - x86/tsc: Use topology_max_packages() to get package number - EDAC/amd64: Use unicast instead of broadcast to access the cs_config register - EDAC/amd64: Correct the address translation for hygon family 18h model 4h - KVM: arm64: Mark some header functions as inline - KVM: arm64: Refactor exit handlers - x86/resctrl: Fix memory bandwidth counter width for Hygon CPUs - hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio - !20820 ub/obmm: add sysfs interface for mempool statistics & bugfixes - ub/obmm: fix wrong pxm_numa parameter validation - ub/obmm: Remove unused parameters from obmm_addr_check.c - ub/obmm: Enhance mem_allocator_granu validation - ub/obmm: simplify allocator naming scheme - ub/obmm: fix allow_slow logic and optimize conti_alloc_memory - ub/obmm: add sysfs interface with fine-grained memory statistics - !20804 net: hv_netvsc: reject RSS hash key programming without RX indirection table - !20813 migrate: correct lock ordering for hugetlb file folios - !20812 libceph: make calc_target() set t->paused, not just clear it - !20719 drivers/ub/sentry: some bugfix - !20798 urma: log should not retrieve eid_idx from uctx - !20808 urma: support triple bonding device - urma: log should not retrieve eid_idx from uctx - migrate: correct lock ordering for hugetlb file folios - libceph: make calc_target() set t->paused, not just clear it - !20745 vfio platform VFIO support for hisi05a1 devices - urma: support triple bonding device - net: hv_netvsc: reject RSS hash key programming without RX indirection table - !20789 gic: Add hip09 support for HISILICON_ERRATUM_165010801 - !20726 tracing: Add recursion protection in kernel stack trace recording - !20668 irqchip/gic-v3-its: Avoid truncating memory addresses - !20795 ub: udma: support query and set qos info. - !20791 Migration/urma:optimize performance in live migration. - ub: udma: Support for UE link establishment message. - Migration/urma: optimize performance in live migration. - !20787 ub: cdma: modify the method of assigning values to the structure - !20759 ubcore: hotfix route query for port eid on the same node. - ub: udma: support query and set qos info. - Revert "ub: ubase: Support for RC saved by queue granularity" - ubcore: hotfix route query for port eid on the same node. - !20676 urma: set/get sl - !20765 urma: bugfix of UAF and double free in ubcm - !20778 ub: ubase&unic: Fixes some bugfix in resetting and dfx ability - gic: Add hip09 support for HISILICON_ERRATUM_165010801 - vfio/platform: Add CONFIG_VFIO_HISI05A1 to openeuler_defconfig and turn it on by default - vfio/platform: VFIO support for hisi05a1 devices - ub: cdma: modify the method of assigning values to the structure - urma: set/get sl - ub: ubase: support to query ub dl pkt stats and real-time peak bandwidth - ub: ubase: Support for RC saved by queue granularity - ub: ubase: Traverse mailbox AE events using interrupts and polling. - ub: ubase: Modify ubase ctrlq trace to distinguish between MUE and UE messages - net: unic: The function of dumping himac registers is added. - ub: ubase: Fix MAC is_pfc sync, optimize list ops and code style - ub: ubase: Retain the initial tm qset configuration and restore it - net: unic: Fixed an issue in the bond IP address notification and pause configuration when an exception occurs. - ub: ubase: Add a retransmission function to improve reliability. - net: unic: Increase the readability and reliability of loopback code - net: unic: Synchronize the code modify for ip management and deactivation - net: unic: Increase the readability and reliability of VLAN feature. - net: unic: Added unic DFX log information. - ub: ubase: Add and correct comments for some functions and data structures - net: unic: Notify MAMI when the bond port status changes - ub: ubase: Support for HIMAC reset during ELR reset and Optimize ELR reset - !20768 iommu/ummu-core: Fix separate page table compatibility - !20665 [OLK-6.6] Enhance CMA memory usage reporting for CSV3 - !20764 net: hns3: fix double free issue for tx spare buffer - urma: bugfix of UAF and double free in ubcm - iommu/ummu-core: Fix separate page table compatibility - net: hns3: fix double free issue for tx spare buffer - drivers/ub/sentry: fix memory leak in sentry_msg_helper - drivers/ub/sentry: initialize some variables - drivers/ub/sentry: fix potential buffer overflow in convert_str_to_smh_msg() - drivers/ub/sentry: fix potential null pointer reference in sentry_uvb_comm - drivers/ub/sentry: add input parameter verification for exported symbols - tracing: Add recursion protection in kernel stack trace recording - x86/csv: Enhance CMA memory usage reporting for CSV3 - irqchip/gic-v3-its: Avoid truncating memory addresses - change the package name of 64KB page size kernel to kernel-64k - !20704 kernel support hisi-cca-da - !20180 [virtCCA Live Migration 2]virtcca secure cvm supports live migration - !20905 v2 KVM: arm64: Fix softirq masking in FPSIMD register saving sequence - !20965 iommu/ummu: Optimized TID invalidation and tdev initialization - !20964 iommu/ummu: Support TID and EID Granularity for MPAM - !20970 ub: ubase&unic: Supporting the black box capability of the ubase&unic driver - hisi-cca-da: Start dev by rsi call - hisi-cca-da: Set ripas of the bar region as RIPAS_DEV - hisi-cca-da: Support swiotlb and realm memory use - hisi-cca-da: Add smmu info when dev attach - hisi-cca-da: Transfer realm msix access to rmm - hisi-cca-da: Support pcipc sriov capability - hisi-cca-da: Delay realm memory release to kvm_destroy_realm - hisi-cca-da: Create realm s2 host pgtable and map msi mmio to rmm - hisi-cca-da: Add cca realm s2 pgtable framework - hisi-cca-da: Use bitmap to determine whether the command can be forwarded - hisi-cca-da: Restrict Realm SMMU to stage-2 domain only - hisi-cca-da: Add cmd forward mechanism in realm smmu - hisi-cca-da: Add realm smmu event and gerror irq initialization - hisi-cca-da: Add realm smmu stream table initialization - hisi-cca-da: Add realm smmu cmdq and evtq initialization - hisi-cca-da: Add realm smmu initialization - hisi-cca-da: Add relam iommu support to iommufd - hisi-cca-da: Add realm iommu support for vfio-iommu-type1 - hisi-cca-da: Support dev map and unmap - hisi-cca-da: Support dev validate and dev start - hisi-cca-da: VFIO support ccada - hisi-cca-da: Support dev delegate and dev attach - hisi-cca-da: Support root dev delegate and dev init - hisi-cca-da: Add hisilicon extension smc and ccada cmd - hisi-cca-da: Add hisi ccada feature config - !20751 ARM CCA supports hugepage - !20944 ub: ubmempfd: supports for D2H mapping and demapping - !20888 HiSock Enhancement - ub: ubase&unic: Supporting the black box capability of the ubase&unic driver. - net: unic: Resolve the residual MAC address problem - net: unic: Optimized the code for the cmd structure and FEC function. - ub: ubase: add log for post mailbox timeout - ub: ubus: Remove black box header file to include dir - rme: Remove the secret bit of the vring desc addr - rme: improve hisi-cca data mmap and destroy method - !20943 uvb: fix wd_obtain logic err - !20942 urma: fix bond device id not release - !20892 dcache: Limit the minimal number of bucket to two - rme: isolate page when do delegation to avoid migration - rme: hisi-cca supports different levels for mapping ram - rme: rename ccal to hisi-cca - rme: support set ripas for ccal realm vm - rme: support destroy ram data for ccal realm vm - rme: support populate region for ccal realm vm - rme: support map ram for ccal realm vm - rme: support config ccal realm vm - rme: support ccal RMI calls - rme: realm vm supports wfx handler - !20952 urma: introduce ipourma module - iommu/ummu-core: Simplifies tdev initialization resources - iommu/ummu: Optimized log printing - iommu/ummu: Use passed gfp_mask in map_pages callback - uvb: fix wd_obtain logic err - !20949 ub: udma: support user ctl function. - urma: fix bond device id not release - !20901 drivers/ub/sentry: some bugfix - ub: ubmempfd: supports for D2H mapping and demapping - ub: ubmempfd: supports providing services to the QEMU process through file nodes - [virtCCA Live Migration 2]virtcca secure cvm supports live migration - urma: query priority and enable bit, support ring size configuration - urma: implement debugfs, improve boundary checks and error handling logic - urma: implement data plane interaction and statistics - urma: implement ipourma network device operations - urma: ipourma resource management - urma: ipourma resource management and err code - urma: introduce ipourma main module - iommu/ummu: Optimized the TID invalidation configuration - iommu/ummu: Optimized SVA permission table memory allocation approach - iommu/ummu: Adapt UMMU SVA interface adjustment - iommu/ummu: Support TID and EID Granularity for MPAM - !20848 [OLK-6.6] backport important bugfix for nvme driver from upstream linux-6.6.y - !20847 urma: sl resource query error - !20908 [OLK-6.6][linux-6.6.y sync] Backport 6.6.108-6.6.110 LTS Patches - !20084 Loongarch: Enable CONFIG_CRYPTO_XTS for disk encryption - !20929 PCI: Fix NVMe link speed downgrade to 2.5GT/s during hotplug - drivers/ub/sentry: fix check input parameters - ub: udma: support user ctl function. - ub: udma: support uboe function. - ub: udma: bugfix related to query aux info. - !20935 ub: ubmem_vmmu: supports IOMMU driver for the UB memory MMU in VMs - drivers/ub/sentry: do not use magic numbers - !20876 urma: Kernel-mode specific implementations file for Jetty extension interface - urma: sl resource query error - !20873 sunrpc: fix NULL pointer dereference in rpcb_register_inet6 and rpcb_register_inet4 - !20875 sunrpc: fix race in cache cleanup causing stale nextcheck time - ub: ubmem_vmmu: supports IOMMU driver for the UB memory MMU in VMs - ub: ubmem_vmmu: supports parsing and configuring the hardware node information - ub: ubmem_vmmu: HiSilicon ubmem_vmmu Architecture Implementation - !20806 Fix CVE-2025-71225 - !20896 scsi: qla2xxx: Free sp in error path to fix system crash - !20894 scsi: qla2xxx: Delay module unload while fabric scan in progress - !20893 scsi: qla2xxx: Validate sp before freeing associated memory - !20802 Fix CVE-2026-23110 - urma: Kernel-mode specific implementations file for Jetty extension interface - drivers/ub/sentry: fix memory leak in process_urma_data() - drivers/ub/sentry: initialize some variables - PCI: Fix NVMe link speed downgrade to 2.5GT/s during hotplug - !20770 ub: ubdevshm: supports the memory user to obtain and release shared memory - Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 - mm: consider non-anon swap cache folios in folio_expected_ref_count() - mm: simplify folio_expected_ref_count() - ASoC: qcom: audioreach: fix potential null pointer dereference - gcc-plugins: Remove TODO_verify_il for GCC >= 16 - crypto: sha256 - fix crash at kexec - drm/i915/backlight: Return immediately when scale() finds invalid parameters - minmax.h: remove some #defines that are only expanded once - minmax.h: simplify the variants of clamp() - minmax.h: move all the clamp() definitions after the min/max() ones - minmax.h: use BUILD_BUG_ON_MSG() for the lo < hi test in clamp() - minmax.h: reduce the #define expansion of min(), max() and clamp() - minmax.h: update some comments - minmax.h: add whitespace around operators and after commas - minmax: fix up min3() and max3() too - minmax: improve macro expansion and type checking - minmax: don't use max() in situations that want a C constant expression - minmax: simplify min()/max()/clamp() implementation - minmax: make generic MIN() and MAX() macros available everywhere - drm/ast: Use msleep instead of mdelay for edid read - gpiolib: Extend software-node support to support secondary software-nodes - ARM: bcm: Select ARM_GIC_V3 for ARCH_BRCMSTB - s390/cpum_cf: Fix uninitialized warning after backport of ce971233242b - kmsan: fix out-of-bounds access to shadow memory - afs: Fix potential null pointer dereference in afs_put_server - ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address - i40e: improve VF MAC filters accounting - i40e: add mask to apply valid bits for itr_idx - HID: asus: add support for missing PX series fn keys - drm/gma500: Fix null dereference in hdmi teardown - octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() - net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port - net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() - net: dsa: lantiq_gswip: do also enable or disable cpu port - selftests: fib_nexthops: Fix creation of non-FDB nexthops - net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS - bnxt_en: correct offset handling for IPv6 destination address - vhost: Take a reference on the task in struct vhost_task. - Bluetooth: hci_sync: Fix hci_resume_advertising_sync - ethernet: rvu-af: Remove slash from the driver name - can: peak_usb: fix shift-out-of-bounds issue - can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow - can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow - can: hi311x: populate ndo_change_mtu() to prevent buffer overflow - can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow - bpf: Reject bpf_timer for PREEMPT_RT - can: rcar_can: rcar_can_resume(): fix s2ram with PSCI - wifi: virt_wifi: Fix page fault on connect - cpufreq: Initialize cpufreq-based invariance before subsys - ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients - arm64: dts: imx8mp: Correct thermal sensor index - mm: folio_may_be_lru_cached() unless folio_test_large() - mm/gup: local lru_add_drain() to avoid lru_add_drain_all() - mm/gup: check ref_count instead of lru before migration - mm: add folio_expected_ref_count() for reference count calculation - mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked" - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions - ALSA: usb-audio: Add mute TLV for playback volumes on more devices - ALSA: usb-audio: move mixer_quirks' min_mute into common quirk - ALSA: usb-audio: Add DSD support for Comtrue USB Audio device - i2c: designware: Add quirk for Intel Xe - mmc: sdhci-cadence: add Mobileye eyeQ support - usb: core: Add 0x prefix to quirks debug output - ALSA: usb-audio: Fix build with CONFIG_INPUT=n - ALSA: usb-audio: Convert comma to semicolon - ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 - ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks - ALSA: usb-audio: Simplify NULL comparison in mixer_quirks - ALSA: usb-audio: Avoid multiple assignments in mixer_quirks - ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks - ALSA: usb-audio: Fix block comments in mixer_quirks - firewire: core: fix overlooked update of subsystem ABI version - scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE - !20843 [OLK-6.6][linux-6.6.y sync] Backport 6.6.107-6.6.108 LTS Patches - !20869 ub:hisi-ubus: fix bug of security smatch - !20861 CVE-2026-23163 - ub: ubdevshm: supports the memory user to obtain and release shared memory - ub: ubdevshm: supports granting and revoking shared memory permissions - ub: ubdevshm: supports the registration and deregistration of shared memory segments - ub: ubdevshm: supports the registration and deregistration - KVM: arm64: Fix softirq masking in FPSIMD register saving sequence - !20886 Fix CVE-2026-23205 - !20803 Fix CVE-2026-23112 - !20868 sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure - !20811 smb/server: fix refcount leak in smb2_open() - !20810 smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() - !20809 smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() - sunrpc: fix NULL pointer dereference in rpcb_register_inet6 and rpcb_register_inet4 - sunrpc: fix race in cache cleanup causing stale nextcheck time - scsi: qla2xxx: Free sp in error path to fix system crash - scsi: qla2xxx: Delay module unload while fabric scan in progress - scsi: qla2xxx: Validate sp before freeing associated memory - dcache: Limit the minimal number of bucket to two - !20872 Fix CVE-2026-23220 - !20846 Fix CVE-2026-23193 - !20815 Fix CVE-2026-23216 - !20859 Fix CVE-2026-23179 - !20871 CVE-2026-23096 - !20858 ub: ubase: resolve the cmdq crq overflow problem - bpf: Deprecate hisock unused kfuncs and orig ingress logic - bpf: Add local connect support for hisock - bpf: Add ipv4-mapped ipv6 addr support for hisock - bpf: Add target comm parse to hisock_cmd - bpf: Add multi port parse to hisock_cmd - bpf: Only deploy hisock in server - bpf: Apply BPF_HISOCK_INGRESS to hisock ingress - bpf: Add bpf_handle_ingress/egress_ptype kfunc - bpf: Add bpf_get_skb_ethhdr kfunc - bpf: Add bpf_set_ingress/egress_dev kfunc - bpf: Add bpf_set_ingress_dst kfunc - bpf: Add BPF_HISOCK_INGRESS attach type - cgroup: make cgroup_bpf_prog_attach work when cgroup2 is not mounted - smb: client: fix potential UAF and double free in smb2_open_file() - smb/client: fix memory leak in smb2_open_file() - !20852 ASoC: amd: fix memory leak in acp3x pdm dma ops - ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths - uacce: fix cdev handling in the cleanup path - Revert "uacce: fix for cdev memory leak" - ub:hisi-ubus: fix bug of security smatch - ub:ubus: injected route event - ub:ubus: Black Box Development - !20865 urma: urma support uboe - sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure - urma: urma support uboe - !20857 ub_fwctl driver adds support for querying some functions - ub:ub_fwctl:Add illegal verification for scc - ub:ub_fwctl:Support querying the historical status of port links - drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove - drm/amdkfd: Don't use sw fault filter if retry cam enabled - ub:ub_fwctl:Support querying firmware version numbers - ub: ub_fwctl: Support querying real-time bandwidth statistics - ub:ub_fwctl:Support querying statistical indicators at the ub port and uboe port levels - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() - !20854 [URMA] add ping server for urma_ping - urma: add ping server - ub: ubase: resolve the cmdq crq overflow problem - ub: ubase: Optimized the QoS code naming to improve code readability. - ub: ubase&unic: optimizing code and configuration settings. - net: unic: not support query and configure ip by control plane in UBoE - net: unic: fix the automatically enable uc guid promisc mode. - !20844 urma:kernel header of userctl - urma: Kernel-mode header file for Jetty extension interface - ASoC: amd: fix memory leak in acp3x pdm dma ops - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() - phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again) - ACPICA: Work around bogus -Wstringop-overread warning since GCC 11 - !20835 Fix CVE-2026-23084 - minmax: add a few more MIN_T/MAX_T users - minmax: simplify and clarify min_t()/max_t() implementation - minmax: avoid overly complicated constant expressions in VM code - rtc: pcf2127: fix SPI command byte for PCF2131 backport - xhci: dbc: Fix full DbC transfer ring after several reconnects - xhci: dbc: decouple endpoint allocation from initialization - phy: ti: omap-usb2: fix device leak at unbind - phy: Use device_get_match_data() - drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path - ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message - ASoC: wm8974: Correct PLL rate rounding - ASoC: wm8940: Correct typo in control name - ASoC: wm8940: Correct PLL rate rounding - io_uring: include dying ring in task_work "should cancel" state - io_uring: backport io_should_terminate_tw() - ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx - selftests: mptcp: avoid spurious errors on TCP disconnect - selftests: mptcp: connect: catch IO errors on listen side - rds: ib: Increment i_fastreg_wrs before bailing out - KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active - mmc: mvsdio: Fix dma_unmap_sg() nents value - ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S - ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface - btrfs: tree-checker: fix the incorrect inode ref size check - iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page() - LoongArch: Check the return value when creating kobj - LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled - LoongArch: Update help info of ARCH_STRICT_ALIGN - nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* - octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() - net: liquidio: fix overflow in octeon_init_instr_queue() - bonding: don't set oif to bond dev when getting NS target destination - net/mlx5e: Consider aggregated port speed during rate configuration - i40e: remove redundant memory barrier when cleaning Tx descs - net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure - selftests: mptcp: sockopt: fix error messages - mptcp: tfo: record 'deny join id0' info - mptcp: set remote_deny_join_id0 on SYN recv - dpaa2-switch: fix buffer pool seeding for control traffic - btrfs: fix invalid extref key setup when replaying dentry - pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch - wifi: mac80211: fix incorrect type for ret - wifi: mac80211: increase scan_ies_len for S1G - ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported - !20769 [OLK-6.6][linux-6.6.y sync] Backport 6.6.106-6.6.107 LTS Patches - be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list - !20776 ub:ubfi: Release the chosen node - !20817 CVE-2026-23094 - !20819 dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() - ub:ubus: Add port num check - !20379 [OLK-6.6][sync from OLK-5.10]io_uring: Support forcing sq thread to be idle and woken up by hrtimer - !20830 sched/soft_domain: Increasing NR_MAX_CLUSTER to 32 - sched/soft_domain: Increasing NR_MAX_CLUSTER to 32 - btrfs: fix incorrect readahead expansion length - x86: disable image size check for test builds - drm/i915/power: fix size for for_each_set_bit() in abox iteration - drm/amdgpu: fix a memory leak in fence cleanup when unloading - net: mdiobus: release reset_gpio in mdiobus_unregister_device() - phy: ti-pipe3: fix device leak at unbind - phy: tegra: xusb: fix device and OF node leak at probe - dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate - usb: gadget: midi2: Fix MIDI2 IN EP max packet size - usb: gadget: midi2: Fix missing UMP group attributes initialization - USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels - RISC-V: Remove unnecessary include from compat.h - hrtimer: Rename __hrtimer_hres_active() to hrtimer_hres_active() - hrtimer: Remove unused function - regulator: sy7636a: fix lifecycle of power good gpio - dmaengine: ti: edma: Fix memory allocation size for queue_priority_map - hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr - hsr: use rtnl lock when iterating over ports - net: hsr: Add VLAN CTAG filter support - net: hsr: Add support for MC filtering at the slave device - can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB - can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails - can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed - igb: fix link test skipping when interface is admin down - docs: networking: can: change bcm_msg_head frames member to support flexible array - tunnels: reset the GSO metadata before reusing the skb - net: bridge: Bounce invalid boolopts - net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() - USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions - USB: serial: option: add Telit Cinterion FN990A w/audio compositions - dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks - serial: sc16is7xx: fix bug in flow control levels init - tty: hvc_console: Call hvc_kick in hvc_write unconditionally - Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups" - Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table - Input: iqs7222 - avoid enabling unused interrupts - mm/khugepaged: fix the address passed to notifier on testing young - btrfs: fix corruption reading compressed range when block size is smaller than page size - btrfs: use readahead_expand() on compressed extents - mm/damon/sysfs: fix use-after-free in state_show() - mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing - mtd: nand: raw: atmel: Fix comment in timings preparation - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages - drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time - mm/damon/core: set quota->charged_from to jiffies at first charge window - fuse: prevent overflow in copy_file_range return value - fuse: check if copy_file_range() returns larger than requested size - mtd: rawnand: stm32_fmc2: fix ECC overwrite - mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer - net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups - i2c: i801: Hide Intel Birch Stream SoC TCO WDT - ocfs2: fix recursive semaphore deadlock in fiemap call - mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN - compiler-clang.h: define __SANITIZE_*__ macros only when undefined - EDAC/altera: Delete an inappropriate dma_free_coherent() call - rcu-tasks: Maintain real-time response in rcu_tasks_postscan() - rcu-tasks: Eliminate deadlocks involving do_exit() and RCU tasks - rcu-tasks: Maintain lists to eliminate RCU-tasks/do_exit() deadlocks - s390/cpum_cf: Deny all sampling events by counter PMU - NFSv4/flexfiles: Fix layout merge mirror check. - NFSv4.2: Serialise O_DIRECT i/o and copy range - NFSv4.2: Serialise O_DIRECT i/o and clone range - NFSv4.2: Serialise O_DIRECT i/o and fallocate() - NFS: Serialise O_DIRECT i/o and truncate() - fs/nfs/io: make nfs_start_io_*() killable - ftrace/samples: Fix function size computation - NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server - NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set - media: i2c: imx214: Fix link frequency validation - NFSD: nfsd_unlink() clobbers non-zero status returned from fh_fill_pre_attrs() - nfsd: Fix a regression in nfsd_setattr() - kasan: fix GCC mem-intrinsic prefix with sw tags - kunit: kasan_test: disable fortify string checker on kasan_strings() test - io_uring: fix kabi broken in struct io_ring_ctx - io_uring: Support forcing sq thread to be idle and woken up by hrtimer - dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() - uacce: fix isolate sysfs check condition - Revert "uacce: fix isolate sysfs check condition" - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() - smb/server: fix refcount leak in smb2_open() - smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() - smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() - md: suspend array while updating raid_disks via sysfs - scsi: core: Wake up the error handler when final completions race against each other - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec - ub:ubfi: Release the chosen node - ub:ubus: Delete unused functions - Loongarch: Enable CONFIG_CRYPTO_XTS for disk encryption - Add sw64 support in kernel.spec - !21194 hisi-cca-da: Revert smmu realm enabled condition for arm_smmu_domain_finalise. - !21192 urma: bugfix of ubagg&ubcore&uburma - !21183 platform/x86: classmate-laptop: Add missing NULL pointer checks - urma: bugfix of ubagg&ubcore&uburma - hisi-cca-da: Revert smmu realm enabled condition for arm_smmu_domain_finalise. - platform/x86: classmate-laptop: Add missing NULL pointer checks - !21167 urma: fix kernel codecheck issues. - !21174 urma: change return value for provider err - !21127 urma: copy linked ports when importing bond jetty/seg - !20247 ubcore: query primary eid in ipourma loopback mode. - !21077 Fix hisi cca bugs - ubcore: route query refine and ipo loopback adapt. - hisi-cca-da: Transfer PCIe ECAM access requests to RMM for realm device. - hisi-cca-da: Write NS STE for PF drivers. - hisi-cca-da: Provide IO interfaces - hisi-cca-da: Destroy mmu stage2 pagetable after closing vfio devices - !21045 scsi: hisi_sas: Fix NULL pointer exception when do user_scan() - hisi-cca-da: Automatically unbind PF/VF drivers and prevent probe. - !21165 tools/interference: add ifstool utility for kernel interference statistics - !21166 urma: fix jfce uaf in batch cleanup - !21043 urma: fix tjetty ref in ping server - urma: change return value for provider err - !21128 sched/rt: Skip currently executing CPU in rto_next_cpu() - !21129 procfs: fix missing RCU protection when reading real_parent in do_task_stat() - urma: fix jfce uaf in batch cleanup - !21074 ipmi: Add HiSilicon IPMI Page Soft Offline driver - !21076 [OLK-6.6][linux-6.6.y sync] Backport 6.6.112-6.6.113 LTS Patches - urma: fix kernel codecheck issues. - tools/interference: add ifstool utility for kernel interference statistics - !20291 [Hygon][6.6][Bugfix] Bug fix for EDAC decode address fail issue on Hygon Dhyana processor - !21092 kexec: derive purgatory entry from symbol - !21154 sched: Add SOFT_DOMAIN feature interface for cgroup2 - !21153 fix CVE-2025-39981 - Revert "hisi-cca-da: Delay realm memory release to kvm_destroy_realm" - urma: fix tjetty ref in ping server - rme: Enforce isolation to solve compile error without config CONFIG_HISI_CCA - hisi-cca-da: Improve hisi cca dev validate and delegate - hisi-cca-da: Fix smmu enable rme problem - hisi-cca-da: Fix msi region shared problem - sched: Add SOFT_DOMAIN feature interface for cgroup2 - Bluetooth: MGMT: Fix memory leak in set_ssp_complete - Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete - overflow: Introduce __DEFINE_FLEX for having no initializer - overflow: Fix direct struct member initialization in _DEFINE_FLEX() - overflow: Change DEFINE_FLEX to take __counted_by member - overflow: add DEFINE_FLEX() for on-stack allocs - Bluetooth: MGMT: Fix possible UAFs - Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete() - !21103 Revert "mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()" - !21104 v2 vsock/virtio: cap TX credit to local buffer size - !21070 Fixes CVE-2026-23100 - !21135 RDMA/hns: Support configure and query the CNP DSCP through sysfs - !21088 ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref - RDMA/hns: Support configure and query the CNP DSCP through sysfs - RDMA/hns: Support query FW cap bit - RDMA/hns: Support query HW ID. - !20934 smb/server: fix refcount leak in parse_durable_handle_context() - !21004 regmap: Fix race condition in hwspinlock irqsave routine - !19568 [OLK-6.6]fix txgbe clang compile warning - urma: copy linked ports when importing bond jetty/seg - procfs: fix missing RCU protection when reading real_parent in do_task_stat() - sched/rt: Skip currently executing CPU in rto_next_cpu() - !21073 scsi: qla2xxx: Fix bsg_done() causing double free - !21114 CVE-2024-57979 - !21113 iommu: disable SVA when CONFIG_X86 is set - !20957 dmaengine: xilinx: xdma: Fix regmap max_register - !21087 net: unic: Multiple stability fixes for tx timeout, DFX capability and concurrent activation/reset - pps: Fix a use-after-free - fix kabi - pps: Fix a use-after-free - !21078 of: unittest: Fix memory leak in unittest_data_add() - !21079 *** fix CVE-2026-23208 *** - !21082 ALSA: aloop: Fix racy access at PCM trigger - !21083 bus: fsl-mc: fix use-after-free in driver_override_show() - iommu: disable SVA when CONFIG_X86 is set - vsock/virtio: cap TX credit to local buffer size - Revert "mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()" - !20983 Fix CVE-2026-23139 - !20878 Fix CVE-2026-23230 - kexec: derive purgatory entry from symbol - lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC - PCI/IOV: Fix race between SR-IOV enable/disable and hotplug - Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" - rtc: interface: Alarm race handling should not discard preceding error - perf test stat tests: Fix for virtualized machines - perf test stat: Update test expectations and events - perf test stat: Avoid hybrid assumption when virtualized - writeback: Avoid excessively long inode switching times - writeback: Avoid softlockup when switching many inodes - cramfs: Verify inode mode when loading from disk - fs: Add 'initramfs_options' to set initramfs mount options - minixfs: Verify inode mode when loading from disk - irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume - irqchip/sifive-plic: Make use of __assign_bit() - selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled - s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG - s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL - s390/bpf: Describe the frame using a struct instead of constants - s390/bpf: Centralize frame offset calculations - s390/bpf: Change seen_reg to a mask - ACPI: property: Do not pass NULL handles to acpi_attach_data() - ACPI: property: Add code comments explaining what is going on - ACPI: property: Disregard references in data-only subnode lists - ACPI: battery: Add synchronization between interface updates - ACPI: battery: Check for error code from devm_mutex_init() call - ACPI: battery: initialize mutexes through devm_ APIs - ACPI: battery: allocate driver data through devm_ APIs - arm64: mte: Do not flag the zero page as PG_mte_tagged - ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref - !20790 dm: use bio_clone_blkg_association - ipmi: Add HiSilicon IPMI Page Soft Offline driver - net: unic: Resolve network unavailability caused by concurrent activation and reset - net: unic: Provide the DFX capability for querying MNG table - net: unic: Delete the elr reset process after the tx timeout - bus: fsl-mc: fix use-after-free in driver_override_show() - ALSA: aloop: Fix racy access at PCM trigger - ALSA: usb-audio: Use the right limit for PCM OOB check - ALSA: usb-audio: Prevent excessive number of frames - of: unittest: Fix memory leak in unittest_data_add() - !21034 CVE-2026-23140 - !21016 net: fix segmentation of forwarding fraglist GRO - !21017 mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() - !21018 CVE-2026-23209 - !21019 ipv6: annotate data-race in ndisc_router_discovery() - !20881 ipvlan: Make the addrs_lock be per port - rme: Imporve range delegate - btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() - PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release - PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() - misc: fastrpc: Save actual DMA size in fastrpc_map structure - misc: fastrpc: Add missing dev_err newlines - mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag - mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type - mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value - media: mc: Clear minor number before put device - lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older - ACPICA: Allow to skip Global Lock initialization - ext4: validate ea_ino and size in check_xattrs - ext4: correctly handle queries for metadata mappings - ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() - nfsd: nfserr_jukebox in nlm_fopen should lead to a retry - NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() - mm/damon/vaddr: do not repeat pte_offset_map_lock() until success - mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 - mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations - wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 - wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again - selftests: mptcp: join: validate C-flag + def limit - spi: cadence-quadspi: Flush posted register writes before DAC access - spi: cadence-quadspi: Flush posted register writes before INDAC access - PCI: tegra194: Handle errors in BPMP response - PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() - PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock - PCI: rcar-host: Drop PMSR spinlock - PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit - PCI/AER: Support errors introduced by PCIe r6.0 - PCI/AER: Fix missing uevent on recovery when a reset is requested - PCI/ERR: Fix uevent on failure to recover - PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV - PCI/sysfs: Ensure devices are powered for config reads - PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock - rseq/selftests: Use weak symbol reference, not definition, to link with glibc - rtc: interface: Fix long-standing race when setting alarm - rtc: interface: Ensure alarm irq is enabled when UIE is enabled - memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe - mmc: core: SPI mode remove cmd7 - mtd: rawnand: fsmc: Default to autodetect buswidth - xtensa: simdisk: add input size check in proc_write_simdisk - sparc: fix error handling in scan_one_device() - sparc64: fix hugetlb for sun4u - scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() - sched/deadline: Fix race in push_dl_task() - pwm: berlin: Fix wrong register in suspend/resume - powerpc/pseries/msi: Fix potential underflow and leak issue - powerpc/powernv/pci: Fix underflow and leak issue - power: supply: max77976_charger: fix constant current reporting - pinctrl: samsung: Drop unused S3C24xx driver data - nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk - parisc: don't reference obsolete termio struct for TC* constants - openat2: don't trigger automounts with RESOLVE_NO_XDEV - of: unittest: Fix device reference count leak in of_unittest_pci_node_verify - lib/genalloc: fix device leak in of_gen_pool_get() - KEYS: trusted_tpm1: Compare HMAC values in constant time - iommu/vt-d: PRS isn't usable if PDS isn't supported - iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume - init: handle bootloader identifier in kernel parameters - iio: xilinx-ams: Unmask interrupts after updating alarms - iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK - iio: frequency: adf4350: Fix prescaler usage. - iio: dac: ad5421: use int type to store negative error codes - iio: dac: ad5360: use int type to store negative error codes - fs/ntfs3: Fix a resource leak bug in wnd_extend() - fbdev: Fix logic error in "offb" name match - crypto: rockchip - Fix dma_unmap_sg() nents value - crypto: atmel - Fix dma_unmap_sg() direction - crypto: aspeed - Fix dma_unmap_sg() direction - copy_sighand: Handle architectures where sizeof(unsigned long) < sizeof(u64) - bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() - bus: mhi: ep: Fix chained transfer handling in read path - btrfs: avoid potential out-of-bounds in btrfs_encode_fh() - blk-crypto: fix missing blktrace bio split events - drm/nouveau: fix bad ret code in nouveau_bo_move_prep - drm/rcar-du: dsi: Fix 1/2/3 lane support - media: lirc: Fix error handling in lirc_register() - media: venus: firmware: Use correct reset sequence for IRIS2 - media: pci: ivtv: Add missing check after DMA map - media: mc: Fix MUST_CONNECT handling for pads with no links - media: i2c: mt9v111: fix incorrect type for ret - media: cx18: Add missing check after DMA map - firmware: meson_sm: fix device leak at probe - xen/events: Update virq_to_irq on migration - xen/events: Return -EEXIST for bound VIRQs - xen/manage: Fix suspend error path - xen/events: Cleanup find_virq() return codes - dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required - ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init - arm64: dts: ti: k3-am62a-main: Fix main padcfg length - arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees - arm64: dts: qcom: msm8939: Add missing MDSS reset - arm64: dts: qcom: msm8916: Add missing MDSS reset - ACPI: debug: fix signedness issues in read/write helpers - ACPI: property: Fix buffer properties extraction for subnodes - gpio: wcd934x: mark the GPIO controller as sleeping - tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single - smb: client: fix missing timestamp updates after utime(2) - bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() - drm/amd/display: Properly disable scaling on DCE6 - drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 - drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs - drm/amdgpu: Add additional DCE6 SCL registers - mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes - mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call - tcp: take care of zero tp->window_clamp in tcp_set_rcvlowat() - perf python: split Clang options when invoking Popen - tools build: Align warning options with perf - net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe - drm/vmwgfx: Fix copy-paste typo in validation - net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() - LoongArch: Init acpi_gbl_use_global_lock to false - LoongArch: Remove CONFIG_ACPI_TABLE_UPGRADE in platform_init() - ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size - scsi: mvsas: Fix use-after-free bugs in mvs_work_queue - clk: tegra: do not overallocate memory for bpmp clocks - clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver - clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() - clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() - clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m - perf evsel: Ensure the fallback message is always written to - perf tools: Add fallback for exclude_guest - perf test: Add a test for default perf stat command - perf test: Don't leak workload gopipe in PERF_RECORD_* - perf session: Fix handling when buffer exceeds 2 GiB - perf arm_spe: Correct memory level for remote access - perf arm_spe: Correct setting remote access - rtc: optee: fix memory leak on driver removal - rtc: x1205: Fix Xicor X1205 vendor prefix - perf util: Fix compression checks returning -1 as bool - clk: at91: peripheral: fix return value - libperf event: Ensure tracing data is multiple of 8 sized - perf evsel: Avoid container_of on a NULL leader - asm-generic/io.h: Skip trace helpers if rwmmio events are disabled - iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE - clocksource/drivers/clps711x: Fix resource leaks in error paths - fscontext: do not consume log entries when returning -EMSGSIZE - fs: always return zero on success from replace_fd() - !21067 [OLK-6.6][linux-6.6.y sync] Backport 6.6.111-6.6.112 LTS Patches - scsi: qla2xxx: Fix bsg_done() causing double free - !21065 Fix CVE-2026-23069 - !21062 v4 Support multi-level cgroup - !20987 Fix CVE-2026-23212 - !20982 Fix CVE-2026-23119 - !20979 Fix CVE-2026-23111 - !20974 Fix CVE-2026-23099 - !20973 Fix CVE-2026-23105 - !20972 Fix CVE-2026-23074 - !20884 ksmbd: add chann_lock to protect ksmbd_chann_list xarray - !20947 Fix CVE-2026-23101 - ext4: clear i_state_flags when alloc inode - misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup - Revert "wifi: ath10k: avoid unnecessary wait for service ready message" - fs/ntfs3: fix mount failure for sparse runs in run_unpack() - !20825 efivarfs: fix error propagation in efivar_entry_get() - !20824 io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop - !20950 ub:ubus: protect iterator ue_list and mue_list with ub_bus_sem - mm/rmap: fix two comments related to huge_pmd_unshare() - mm/hugetlb: fix two comments related to huge_pmd_unshare() - mm/hugetlb: fix hugetlb_pmd_shared() - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count - !20728 drivers: Update vendor name of Chengdu NorthLink Technology N5/N6 Series Network Card Drivers - vsock/virtio: fix potential underflow in virtio_transport_get_credit() - !21001 Fix CVE-2026-23229 - usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call - arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode - !20999 Fix CVE-2026-23173 - usb: typec: tipd: Clear interrupts first - bus: fsl-mc: Check return value of platform_get_resource() - remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() - Input: atmel_mxt_ts - allow reset GPIO to sleep - misc: fastrpc: Skip reference for DMA handles - misc: fastrpc: fix possible map leak in fastrpc_put_args - misc: fastrpc: Fix fastrpc_map_lookup operation - nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() - ext4: fix checks for orphan inodes - ksmbd: fix error code overwriting in smb2_get_info_filesystem() - LoongArch: Automatically disable kaslr if boot from kexec_file - mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() - mfd: rz-mtu3: Fix MTU5 NFCR register offset - ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down - ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() - vhost: vringh: Modify the return value check - net/mlx5: fw reset, add reset timeout work - net/mlx5: pagealloc: Fix reclaim race during command interface teardown - net/mlx5: Stop polling for command response if interface goes down - net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable - nfp: fix RSS hash key size when RSS is not supported - mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands - drivers/base/node: fix double free in register_one_node() - hwrng: ks-sa - fix division by zero in ks_sa_rng_init - KEYS: X.509: Fix Basic Constraints CA flag parsing - Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements - Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO - vhost: vringh: Fix copy_to_iter return value check - RDMA/siw: Always report immediate post SQ errors - usb: vhci-hcd: Prevent suspending virtually attached devices - NFSv4.1: fix backchannel max_resp_sz verification check - coresight: trbe: Return NULL pointer for allocation failures - coresight: etm4x: Support atclk - coresight-etm4x: Conditionally access register TRCEXTINSELR - remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice - PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() - vfio/pds: replace bitmap_free with vfree - sparc: fix accurate exception reporting in copy_{from,to}_user for M7 - sparc: fix accurate exception reporting in copy_to_user for Niagara 4 - sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara - sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III - wifi: mac80211: fix Rx packet handling when pubsta information is not available - wifi: ath10k: avoid unnecessary wait for service ready message - Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram - IB/sa: Fix sa_local_svc_timeout_ms read race - RDMA/core: Resolve MAC of next-hop device without ARP support - f2fs: fix zero-sized extent for precache extents - scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() - scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() - scsi: qla2xxx: edif: Fix incorrect sign of error code - ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message - f2fs: fix to truncate first page in error path of f2fs_truncate() - f2fs: fix to update map->m_next_extent correctly in f2fs_map_blocks() - wifi: mt76: fix potential memory leak in mt76_wmac_probe() - RDMA/cm: Rate limit destroy CM ID timeout error message - drivers/base/node: handle error properly in register_one_node() - watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog - ipvs: Use READ_ONCE/WRITE_ONCE for ipvs->enable - iio: consumers: Fix offset handling in iio_convert_raw_to_processed() - iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() - fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist - fs: ntfs3: Fix integer overflow in run_unpack() - drm/msm/dpu: fix incorrect type for ret - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping - ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping - misc: genwqe: Fix incorrect cmd field being reported in error - usb: gadget: configfs: Correctly set use_os_string at bind - usb: phy: twl6030: Fix incorrect type for ret - drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() - tcp: fix __tcp_close() to only send RST when required - PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation - wifi: mwifiex: send world regulatory domain to driver - drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) - drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) - drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) - drm/amd/pm: Adjust si_upload_smc_data register programming (v3) - drm/amd/pm: Fix si_upload_smc_data (v3) - drm/amd/pm: Disable ULV even if unsupported (v3) - drm/amdgpu: Power up UVD 3 for FW validation (v2) - coresight: Only register perf symlink for sinks with alloc_buffer - inet: ping: check sock_net() in ping_get_port() and ping_lookup() - media: st-delta: avoid excessive stack usage - ALSA: lx_core: use int type to store negative error codes - media: rj54n1cb0c: Fix memleak in rj54n1_probe() - scsi: myrs: Fix dma_alloc_coherent() error check - hwrng: nomadik - add ARM_AMBA dependency - crypto: keembay - Add missing check after sg_nents_for_len() - drm/amd/display: Remove redundant semicolons - serial: max310x: Add error checking in probe() - usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls - usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup - phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 - media: zoran: Remove zoran_fh structure - drm/bridge: it6505: select REGMAP_I2C - f2fs: fix condition in __allow_reserved_blocks() - drm/radeon/r600_cs: clean up of dead code in r600_cs - drm/panel: novatek-nt35560: Fix invalid return value - bpf: Enforce expected_attach_type for tailcall compatibility - i2c: designware: Add disabling clocks when probe fails - i2c: designware: Fix clock issue when PM is disabled - i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD - thermal/drivers/qcom/lmh: Add missing IRQ includes - thermal/drivers/qcom: Make LMH select QCOM_SCM - hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems - once: fix race by moving DO_ONCE to separate section - smp: Fix up and expand the smp_call_function_many() kerneldoc - selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported - i3c: master: svc: Recycle unused IBI slot - i3c: master: svc: Use manual response for IBI events - ACPICA: Fix largest possible resource descriptor index - pwm: tiehrpwm: Fix corner case in clock divisor calculation - arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible - arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value - arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names - cpuidle: qcom-spm: fix device and OF node leaks at probe - firmware: firmware: meson-sm: fix compile-test default - arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 - null_blk: Fix the description of the cache_size module argument - pinctrl: renesas: Use int type to store negative error codes - power: supply: cw2015: Fix a alignment coding style issue - PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() - ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property - ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS - ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax - block: use int to store blk_stack_limits() return value - selftests/nolibc: fix EXPECT_NZ macro - regulator: scmi: Use int type to store negative error codes - arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map - ARM: at91: pm: fix MCKx restore routine - pinctrl: meson-gxl: add missing i2c_d pinmux - soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS - leds: flash: leds-qcom-flash: Update torch current clamp setting - ARM: dts: renesas: porter: Fix CAN pin group - libbpf: Fix reuse of DEVMAP - bpf: Remove migrate_disable in kprobe_multi_link_prog_run - bpf/selftests: Fix test_tcpnotify_user - regmap: Remove superfluous check for !config in __regmap_init() - arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 - x86/vdso: Fix output operand size of RDPID - smb: server: fix IRD/ORD negotiation with the client - coresight: trbe: Prevent overflow in PERF_IDX2OFF() - gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote - selftests: arm64: Check fread return value in exec_target - seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast - init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD - filelock: add FL_RECLAIM to show_fl_flags() macro - !21022 KVM: Don't clobber irqfd routing type when deassigning irqfd - !20998 ceph: fix oops due to invalid pointer for kfree() in parse_longname() - !21023 l2tp: avoid one data-race in l2tp_tunnel_del_work() - xsched: fix potential NULL dereference in xsched_quota_timeout_update - xsched: remove the standalone xcu_cfs_cg_deinit() helper - xsched: restructure xcu_cgrp_subsys teardown to align with cpu_cgrp_subsys lifecycle - xsched: simplify root group check by direct comparison with root_xcg - xsched: replace magic number with SCHED_CLASS_MAX_LENGTH for scheduler class string length - xsched/core: immediate cleanup of remaining operators on task exit - xsched: add init_fair_xsched_group() for XCU-specific fair group initialization - xsched: modify xcu_cg_initialize_components helper - xsched: refactor xsched_entity initialization - xsched: change rq_init() parameter from struct xsched_cu to struct xsched_rq - xsched: harden and clarify xcu_move_task() logic - xsched: move throttling-related fields from xsched_group_xcu_priv to xsched_rq_cfs - xsched/quota: add throttled flag to cfs_rq for robust hierarchical enqueue under throttling - xsched/quota: support multi-level cgroup - xsched: remove redundant xcu parameter from dequeue_ctx - xsched: update group shares using xcu_grp_shares_add/sub helpers - xsched: delete unused code - xsched/cfs: propagate group activation/deactivation up the hierarchy - xsched/cfs: move xruntime updates to pick/put paths - xsched: add has_running hook to xsched classes for wake-up eligibility check - !21012 [OLK-6.6][linux-6.6.y sync] Backport 6.6.110-6.6.111 LTS Patches - scsi: hisi_sas: Fix NULL pointer exception when do user_scan() - !21013 CVE-2026-23177 - !21007 bonding: fix use-after-free due to enslave fail after slave array update - !21006 net: Fix CVE-2026-23204 - bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path - bpf, test_run: Subtract size of xdp_frame from allowed metadata size - bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN - bpf: Make variables in bpf_prog_test_run_xdp less confusing - bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K - !21015 libceph: reset sparse-read state in osd_fault() - !21024 ub: udma: bugfix related to print messages. - !20980 Fix CVE-2026-23126 - !20922 Fix CVE-2026-23133 - ub: udma: bugfix related to print messages. - l2tp: avoid one data-race in l2tp_tunnel_del_work() - KVM: Don't clobber irqfd routing type when deassigning irqfd - ipv6: annotate data-race in ndisc_router_discovery() - macvlan: observe an RCU grace period in macvlan_common_newlink() error path - macvlan: fix error recovery in macvlan_common_newlink() - mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() - net: fix segmentation of forwarding fraglist GRO - can: rcar_canfd: Fix CAN-FD mode as default - libceph: reset sparse-read state in osd_fault() - !21008 uvb: fix cis call return value and obtain - mm, shmem: prevent infinite loop on truncate race - mm/shmem, swap: fix race of truncate and swap entry split - net/9p: fix double req put in p9_fd_cancelled - riscv: mm: Do not restrict mmap address based on hint - riscv: mm: Use hint address in mmap if available - driver core/PM: Set power.no_callbacks along with power.no_pm - serial: stm32: allow selecting console when the driver is module - hid: fix I2C read buffer overflow in raw_event() for mcp2221 - ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free - ALSA: usb-audio: Kill timer properly at removal - platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list - can: rcar_canfd: Fix controller mode setting - can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled - btrfs: ref-verify: handle damaged extent root tree - ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue - perf subcmd: avoid crash in exclude_cmds when excludes is empty - platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list - dm-integrity: limit MAX_TAG_SIZE to 255 - ASoC: amd: acp: Adjust pdm gain value - wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 - USB: serial: option: add SIMCom 8230C compositions - media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe - !20931 Fix CVE-2026-23060 - uvb: fix cis call return value and obtain - bonding: fix use-after-free due to enslave fail after slave array update - net/sched: cls_u32: use skb_header_pointer_careful() - net: add skb_header_pointer_careful() helper - regmap: Fix race condition in hwspinlock irqsave routine - crypto: virtio - Add spinlock protection with virtqueue notification - net/mlx5e: TC, delete flows only for existing peers - !20967 net: hns3: modify code of judging if SMMU DMA is enabled - ceph: fix oops due to invalid pointer for kfree() in parse_longname() - !20969 Fix CVE-2026-23125 - !20948 v4 arm64: Add memory poison recovery support for various paths - !20975 CVE-2026-23102 - !20977 v4 support apei_page_offline_policy - bonding: annotate data-races around slave->last_rx - netfilter: nf_conncount: update last_gc only when GC has been performed - bonding: provide a net pointer to __skb_flow_dissect() - netdevsim: fix a race issue related to the operation on bpf_bound_progs list - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() - apei/ghes: Add sysctl interface to control soft-offline page isolation - Revert "mm/memory-failure: support disabling soft offline for HugeTLB pages" - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - arm64/fpsimd: signal: Fix restoration of SVE context - arm64/fpsimd: signal: Consistently read FPSIMD context - arm64/fpsimd: signal: Mandate SVE payload for streaming-mode state - bonding: limit BOND_MODE_8023AD to Ethernet devices - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag - net/sched: Enforce that teql can only be used as root qdisc - sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT - drivers/net: Update vendor name of Chengdu NorthLink Technology N5/N6 Series Network Card Drivers - net: hns3: modify code of judging if SMMU DMA is enabled - dmaengine: xilinx: xdma: Fix regmap max_register - ub:ubus: protect iterator ue_list and mue_list with ub_bus_sem - ub:ubus: Avoid getting empty uent from ubc - ub:hisi-ubus: Use GFP_ATOMIC when alloc memory - arm64: send sig fault for user task when apei_claim_sea fails - arm64: add ras log during do_sea - arm64: move getting valid siaddr to the top of do_sea - arm64: mm: shmem: support poison recovery from shmem_file_read_iter() - arm64: fs: support poison recovery from __kernel_read() - iov_iter: add mc support for copy_page_to_iter - arm64: mm: support recovery from copy_{from/to}_user_page() - iov_iter: get rid of 'copy_mc' flag - leds: led-class: Only Add LED to leds_list when it is fully ready - wifi: ath10k: fix dma_free_coherent() pointer - smb/server: fix refcount leak in parse_durable_handle_context() - ksmbd: add chann_lock to protect ksmbd_chann_list xarray - ipvlan: Make the addrs_lock be per port - smb: client: split cached_fid bitfields to avoid shared-byte RMW races - efivarfs: fix error propagation in efivar_entry_get() - io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop - dm: use bio_clone_blkg_association - RAS/AMD/ATL: fix error nodes per socket on for Hygon Dhyana processor - net: txgbe: fix clang compile warning