[meta,scarthgap,03/07] linux-yocto/6.6: update to v6.6.159

From: Bruce Ashfield <bruce.ashfield@gmail.com>

Updating linux-yocto/6.6 to the latest korg -stable release that comprises
the following commits:

    cecd39af8a1ab Linux 6.6.159
    742f73df544e0 ipv4: free inet_opt and ireq_opt after an RCU grace period
    a65f69e0f38ff ipv4: validate checksum_start before completing checksum
    33aa3b7f4afbd netfilter: nfnetlink_queue: unbreak SCTP traffic
    a91a6aa9253c6 Linux 6.6.158
    81e82340170ae net: mediatek: Fix potential NULL pointer dereference in dummy net_device handling
    3c83e90204359 crypto: atmel-ecc - avoid stale fallback key after set_secret failure
    6989f298103f5 netfilter: nf_tables: don't queue packet path object notifications
    f268099fc0e38 netfilter: nf_tables: place base_seq in struct net
    7b74a4f71ca50 netfilter: nft_set_rbtree: Remove unused variable nft_net
    bd33cb19bcb43 crypto: virtio - bound the akcipher result length
    ca84bef594538 crypto: virtio - Drop superfluous [as]kcipher_req pointer
    895ab908ade68 crypto: virtio - Drop superfluous [as]kcipher_ctx pointer
    ba7b5b5e35407 crypto: virtio - Drop sign/verify operations
    9efc6119bfbe1 crypto: virtio - Less function calls in __virtio_crypto_akcipher_do_req() after error detection
    b38d7a4bc9c17 vlan: fix skb_under_panic and races when toggling HW VLAN offload
    7eca6b809c1d4 vlan: defer real device state propagation to netdev_work
    debf9f50140b3 net/packet: defer vmalloc TX_RING free until skbs finish
    b4ac2a5ce5a96 gtp: serialize PDP context updates
    301f4a3303b21 usb: xhci: bail out of setup if the controller is inaccessible
    9e85ecc77ffa0 usb: xhci: simplify handling of Structural Parameters 1 values
    608efac1ba6fb usb: xhci: use cached HCSPARAMS1 value
    aa709b4f370e0 usb: xhci: implement USB Port Register Set struct
    4687b927c6ab5 usb: xhci: add USB Port Register Set struct
    c02a85ecd92db usb: xhci: add helper to read PORTSC register
    ade5ca589d2f5 usb: xhci: add tracing for PORTSC register writes
    1c3f4b15eb185 ALSA: hda: Fix missing pointer check in hda_component_manager_init function
    73853208a497a drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked()
    6b38ca1c9dd47 lan78xx: Enable Auto Speed and Auto Duplex configuration for LAN7801 if NO EEPROM is detected
    0c5b7a12e1751 lan78xx: Enable 125 MHz CLK configuration for LAN7801 if NO EEPROM is detected
    b4a3e1bb94091 tools/thermal/tmon: Fix compilation warning for wrong format
    cc91c461cf390 nvme-fabrics: use reserved tag for reg read/write command
    a99d4f0c43eaa perf test: Change all remaining #!/bin/sh to #!/bin/bash
    fb05e973698f4 drm/mediatek: Fix potential NULL dereference in mtk_crtc_destroy()
    e2379b2e343e3 drm/amd/display: Validate function returns
    336bc3461b1c7 drm/amd/display: Check null pointers before using them
    15403445b873a drm/amd/display: Ensure array index tg_inst won't be -1
    3218df42ff3b1 drm/amd/display: Add a dc_state NULL check in dc_state_release
    9a38ba5561d96 wifi: ath12k: check M3 buffer size as well whey trying to reuse it
    7e323cb557053 wifi: ath12k: fix kernel crash during resume
    8c78593cf1229 net: tls: fix silent data drop under pipe back-pressure
    bc262c6d32b6c cxl/mem: Fix no cxl_nvd during pmem region auto-assembling
    5eaa11c500ed0 bpf: Defer work in bpf_timer_cancel_and_free
    4b48228eebce2 bpf: Fail verification for sign-extension of packet data/data_end/data_meta
    5be32f1ca915c xfs: fix blockgc group quota scanning when usrquota isn't enforced
    a40671025e915 smb: client: validate POSIX create context length
    e4c49012708c9 smb: client: fix create context out-of-bounds reads
    84ae3cfd7d3a6 Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO
    524e0450dd9a3 Bluetooth: mgmt: fix race in read_unconf_index_list()
    8c7556c7cd17e Bluetooth: L2CAP: validate frame length before control and FCS access
    ff28e6c67143c Bluetooth: ISO: balance the parent hold in hci_bind_bis()
    68f0bcc4e16e3 Bluetooth: hci_sock: reject out-of-range OCF values
    dca25c204f71b Bluetooth: hci_sock: validate event length before filtering
    10f959cb43521 Bluetooth: hci_conn: fix CIS hold ownership on reuse
    c5efcbf06d648 RISC-V: KVM: Fix HSM hart status error propagation
    2af03b606aada RISC-V: KVM: Synchronize hrtimer callback during teardown
    dbf30e661ceb9 s390/cio: Fix NULL pointer dereference in ccw_device_get_util_str()
    c0ba61180d153 pinctrl: single: free the IRQ on domain creation failure
    de96dc11aee0d scsi: libiscsi_tcp: Check the data direction of a Data-In PDU
    144ad477c381e nfc: port100: reject frames whose declared length exceeds the received data
    066205553a010 nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc()
    19bcfc2a56d0b nfc: fix use-after-free in nfc_get_local_general_bytes
    b89249819a7d6 netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read
    f49da48bd679c netfilter: ip6t_rpfilter: reject routes without inet6_dev
    b895bd3267e5a net: usb: lan78xx: Fix URB reference leak in lan78xx_submit_deferred_urbs()
    9a7140ea89a09 net: usb: cdc_mbim: add MeiG Smart SRM821 to ZLP whitelist
    1d8c85359b507 net: atl1e: fix soft lockup on out-of-range hw_next_to_clean read
    57b55367b6e3a net: atl1c: fix soft lockup on out-of-range tpd_cons read
    de41ee24f77b0 net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry
    2f57cef1a17cb net: hisilicon: hns_dsaf_mac: fix mdio device leak in hns_mac_register_phy()
    632cd7b81cb7b net: atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read
    1b08c5c3ac27c net: arp: terminate device name before lookup
    6c9f07bf88001 net/sched: reject IDR error pointers when deleting actions
    ff384b1bd7228 net/mlx5e: advertise MACsec offload only when supported
    288721013605b net/mlx5: Fix rev_entry reference leak in mlx5_tc_ct_shared_counter_get()
    65e7c4b5366b7 HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce()
    f4c21a259b4f3 HID: quirks: add ALWAYS_POLL quirk for SDINNOVATION gaming keyboard
    5a8ad63158165 HID: alps: fix use-after-free on input2 registration failure
    ccd32fa3489cb PCI: of_property: Omit bus properties without a subordinate bus
    822e8a473391e gpio: tps65219: Fix GPIO input value reads
    9571ab7493561 drm/virtio: fix NULL pointer dereference on fence allocation failure
    43bfe2b60c149 drm/virtio: fix memory leak of fence event on execbuffer failure
    9924c1d64405b drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked()
    74485cdc34306 drm/nouveau: Fix gem reference leak in validate_init()
    f09f4a536935b drm/nouveau: fix double-free in nvif_vmm_dtor
    ac4f1d28498b9 drm/nouveau: Fix bridge reference leak in nv1a_ram_new()
    1971720e6a979 drm/nouveau: fix autosuspend cleanup during teardown
    5c857b2e6e755 drm/amdgpu: Fix vmid_wait fence leak in amdgpu_ring_init()
    2c1a643942caa drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show()
    96833fbf28c03 drm/amdgpu: Fix last_update fence leak in amdgpu_vm_init()
    daeac72644124 drm/amd/display: Fix dc stream excess put in dm_update_crtc_state()
    c53db9cc24521 drm/i915: fix incorrect RCU teardown order
    49ba5ed012990 rds: ib: Clear the sg list when mapping an MR fails
    1937222c2511a llc: reserve device headroom for allocated frames
    25c08be2a5e77 gpio: zynq: fix runtime PM leak on request error path
    9d8d6cddcb7c0 gpio: arizona: Fix runtime PM leak in arizona_gpio_direction_out()
    66bf65fa10932 ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST
    dc92cb972e867 ipv6: do not let ipv6_find_hdr() return an offset past the packet end
    e560bdf62b11d fsl/fman: Fix clk reference leak in read_dts_node()
    ebf1555ad2821 writeback: report a Tasks-RCU quiescent state per cgwb drain pass
    513121e693886 workqueue: Fix NULL current_pwq deref in flush dependency check
    c96b4d1628868 writeback: bound cleanup_offline_cgwb() rescans by rotating scanned inodes
    3bcc1624cc1cd fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT
    c698f6deabf68 ata: libata-scsi: bound the ATA passthru sense descriptor writes
    be1aacff399d5 af_packet: fix integer overflow in prb_calc_retire_blk_tmo()
    1cd246b214dc9 sctp: discard the rest of the packet on a stale-cookie error
    80a9ccfc24d37 tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow
    fc8df272af64f x86/PCI: Disable enhanced atomics on AMD NBIO 7.7 and 7.11
    301bdc558a5eb af_unix: Drop all SCM attributes for SOCKMAP.
    00e370627f2e1 netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase
    3c5a6fa3fa004 rculist: add list_splice_rcu() for private lists
    d989c14cd70ab mptcp: return sk_wait_data() errors from recvmsg()
    a8f50c545ea5f perf/x86/intel: Make @data a mandatory param for intel_guest_get_msrs()
    599491e83e459 perf/x86/intel: Don't pointlessly context switch DS_AREA (and PEBS config) if PEBS is unused
    ed7ba11ed0859 perf/x86/intel: Don't write PEBS_ENABLED on host<=>guest xfers if CPU has PEBS isolation, to fix stuck PEBS_ENABLED
    5bce700da0580 perf/x86/intel: Ensure KVM guest PEBS path doesn't set unwanted PERF_GLOBAL_CTRL bits
    a58593b501b7b autofs: fix sbi->pipe file reference leak in autofs_kill_sb()
    ca797491f0ae4 vlan: ensure sufficient headroom in vlan_dev_hard_header()
    f623fe69f210d net/sched: sch_teql: fix shadowed err in __teql_resolve()
    1f4ac6ef54579 bridge: check llc_mac_hdr_init() return value in br_send_bpdu()
    d360b31f1a366 llc: fix skb UAF and leaks on llc_mac_hdr_init() failure
    b7d285a28a6dd net: ethernet: stmmac: dwmac-rk: fix bulk clock leak when the PHY clock fails
    c691d78c33da5 tipc: Fix a data race on mon->peer_cnt in mon_timeout()
    00a59600ae72d net/smc: fix UAF on lgr list traversal in smcr_port_err()
    c1b1639fb138d nfp: hold IPsec RX state under the XArray lock
    71d45049b0d63 tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack()
    bd172580e624b net: dsa: mt7530: fix NULL dereference on unbind of MT7531 and MT7621
    90464d595eb95 bonding: crypto offload enabled, non-offload slave failover, rekey failed
    9e841723ba482 net: xps: reject an out of range traffic class
    45a67662bf8ce vxlan: use one headroom snapshot for neighbour replies
    da2e0cfbb620b ip_gre: Reject enabling collect metadata through changelink
    97bb73b5a4672 net: bcmgenet: mask DMA_TIMEOUT_MASK when reading DMA_RING0_TIMEOUT
    075dca2b60dae net: bcmgenet: validate Ethernet address in bcmgenet_set_mac_addr
    f1fd173aea9b7 net: bcmgenet: do not skip WoL power up on GENET V1
    8055a4c6b9e38 net: bcmgenet: allow return of power up status
    b086fb2c4952e net: bcmgenet: move bcmgenet_power_up into resume_noirq
    ad0660587da4f net: bcmgenet: initialize u64 stats seq counter for all queues
    a61c0324e6187 net: bcmgenet: fix 64-bit RTNL stats reading in ethtool on 32-bit systems
    f187490352414 tg3: use random MAC address when tg3_get_device_address fails
    4092f59d1ce47 driver core: Add device probe log helper dev_warn_probe()
    7a527c6b27ba9 driver core: Make dev_err_probe() silent for -ENOMEM
    65451eb5a4599 driver core: Better advertise dev_err_probe()
    edf51b8dea6e9 bpf: Fix BSWAP 32 and 16 on MIPS64
    beeae92e70e70 bpf: Fix immediate JMP JEQ/JNE on MIPS32
    7d20eab09eb43 vrf: Stop corrupting skb->csum when capturing CHECKSUM_COMPLETE packets
    b2da5ed3d8c75 net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6()
    f0e8dba8c2249 veth: manage XDP program pointers during channel resize
    290c4a021dd59 net/sched: act_gate: budget the per-entry list in get_fill_size
    ea82b75767932 nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid()
    75bfd9ef4da2f nfc: llcp: fix slab-out-of-bounds reads when logging service names
    6fad2c34d451d nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap()
    6295a085cb91d nfc: llcp: fix -ENOMEM on connect with zero-length service name
    9fa21b0f78adb nfc: st21nfca: validate ISO15693 inventory length
    e43ec0191c163 nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure
    f3083512a5bb5 nfc: virtual_ncidev: Add missing ioctl compat handler
    9ba32ddb1cf91 selftests/nci: Fix out-of-bounds store on thread join
    3b52335611593 selftests: nci: Fix uninitialized family ID on missing attribute
    41256821762a7 nfc: llcp: Fix race condition in accept_queue lifecycle
    f2550d8a37878 selftests: nci: Correct pthread_create return value check
    c1e9ed52a6697 nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm()
    d4008c3499dba nfc: st21nfca: validate received frame size
    a4e56f57dd04d nfc: nfcmrvl: validate helper command length before pull
    e57f041943615 bpf: Reject dev-bound-only programs on other devices
    ad5b7fd1434a2 net: stmmac: dwmac4: Use the correct bufzise when the len is exactly 8K
    1d1d9e4f9541e net: stmmac: selftests: Capture all packets for vlan checks
    27bd3b0ce2001 net: stmmac: selftests: Check the dev->features for S-TAG offload testing
    ddcc8b626b08d net: stmmac: selftests: Support running selftests on DSA conduits
    9d3d39da05447 sctp: hold asoc or transport before mod_timer() in timer handlers
    66ae85e15f1c6 net/mlx5: Bridge, don't fail unlink of untracked/unsupported peer ports
    6020d85204742 net/mlx5: Bridge, don't fail switchdev events of sibling eswitch ports
    909f761868fda bpf, sockmap: Reject max_entries > INT_MAX in sock_map_alloc
    ea4dc96c902cc bpf: Fix bpf_sock context code generation
    1b923538598be bpf: Fix bounds check for skb-backed dynptrs
    062849d19dd31 genetlink: report the real command id for dump-only ops in policy dumps
    91be8331501f1 net: ethernet: ti: netcp: fix pm_runtime usage counter leak on error
    33f706884821d s390/debug: Fix NULL pointer dereference in debug_info_copy()
    34cf1535a78b9 s390/debug: Do not register views for failed static debug areas
    e766321288b50 tg3: clean up PHYLIB resources on probe failure
    e1f5b74edccf4 net: usb: sr9700: include receive overhead in the length check
    c25587fa26761 Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame()
    035f9b1809861 Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough
    77a43e00c5748 drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach
    a9bb8f8fd5694 drm/virtio: release the GEM object on virtio_gpu_vram_create() errors
    88c60c06a2a52 drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl()
    77dee8e9106d6 drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl()
    e2edd2d78d2cf drm/virtio: fix object leak when drm_gem_handle_create() fails
    e8f9979286f70 net/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget
    21e206dd88b3d net: usb: catc: bound the RX packet length in catc_rx_done()
    83b1a7f9e7188 sctp: avoid livelock while updating retransmit path
    2731601ad277a ip6_gre: Call ip6erspan_tunnel_unlink_md() in ip6erspan_changelink().
    245bea0c7ab27 net: ethernet: mtk_eth_soc: unregister net_devices in case of probe failure
    d5d57501f543f net: mediatek: mtk_eth_sock: allocate dummy net_device dynamically
    34c6214d0df49 net: create a dummy net_device allocator
    88530b58fe0b3 net: core: Fix documentation
    9767e57504739 net: Do not return value from init_dummy_netdev()
    1d664be4ca49d net: gue: reject invalid REMCSUM offsets
    d512c484bd93a net/sched: act_ct: don't WARN on benign flow_offload_alloc() failure
    999a6c71a6aa0 drm/nouveau/clk: don't clobber reclock status when restoring volt/fan
    a867abcfa85ab drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update
    15f52cbc35d4c ocfs2: make ocfs2_calc_xattr_init() return void
    fddc90d4af455 arm64: io: Reject non-user protection in ioremap_prot()
    5128b8b0bdb24 netfilter: ctnetlink: fix suspicious RCU usage in expect_iter_name
    2c23d95517547 ipvs: revalidate ihl before icmp_send
    d52caee4f0fcd netfilter: nft_synproxy: use the family-aware checksum helper
    d559e06a5ab7c netfilter: nfnetlink_queue: hold nfnl mutex in event notifier
    caa82500e231e netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation
    e20701843032c netfilter: flowtable: publish HW_DEAD after worker is done
    e87687b967dcd libbpf: Reject truncated ldimm64 CO-RE relocations
    a0b79cdfcf34b bpf: Restrict CO-RE poisoning to relocatable instructions
    0fac292d93fdb net/sched: cls_u32: fix manual hash table handle IDR aliasing
    c251ed48bd906 bpf: Skip unsettled links in link iterator
    123f90f394ca4 xsk: Use a 32-bit compare in xsk_map_gen_lookup
    937cbeca0554a s390/cio: Guard PMCW field accesses with dnv check
    e364f5c677e81 s390/cio: Check pmcw.dnv before pmcw.ena in I/O entry points
    0f0e459ccf390 s390/cio: Fix cio_update_schib() to not cache invalid schib
    396d4b0be238a s390/pci/docs: Fix sriov_numvfs attribute name
    5cf766c9cca44 docs: s390/pci: Improve and update PCI documentation
    77d5f05ef79be scsi: megaraid_sas: Protect megasas_get_ctrl_info() in megasas_resume()
    f8174bd3822c5 selftests: cgroup: give the O_TMPFILE open in get_temp_fd() a mode
    8fd91aa0cf78a cgroup: selftests: Move memcontrol specific helpers out of common cgroup_util.c
    718a8ffa180d4 Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel
    5b467087928c5 Bluetooth: SMP: reject Security Request over BR/EDR
    c68e0068a236f squashfs: Add dictionary size range check to prevent shift-out-of-bounds
    144d60ed22735 KVM: arm64: Return -EINVAL for an empty SMCCC filter range at base 0
    62cdbb3e096f9 KVM: arm64: vgic-its: Skip unreachable devices instead of failing the save
    2df1bc50a6633 KVM: arm64: vgic-its: Add stronger type-checking to the ITS entry sizes
    5ff24aa7af0bc HID: amd_sfh: Validate PCI BAR size before mapping
    a78414ede1dc6 pinctrl: meson: Fix typo in s4 group name
    dc98def81e3c6 bpf, sockmap: Fix self-redirect copied_seq double-counting
    a8a9becbac93a bpf: Fix out-of-bounds read of rtt_min in sock_ops
    77a3b52b4455e bpf: Avoid soft lockup in __htab_map_lookup_and_delete_batch()
    911818b449196 HID: elecom: fix bus type for M-XGL20DLBK
    23da88d1597ee tcp: Skip cond_resched() in inet_csk_listen_stop() under BPF context
    5b4eb82475ae1 bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destroy()
    934e9ba9f8d05 bpf: Fix divide-by-zero in btf_struct_walk()
    f831c7bf53e91 selftests/ftrace: Fix unique symbol check in kprobe_non_uniq_symbol.tc
    df0072be6fc37 bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL
    7e748e6e007b5 bpf: Fix bpf_skb_change_tail wrt csum partial skbs
    1572c4a24120f remoteproc: qcom_q6v5_adsp: Fix iommu_unmap() usage
    670fb8b0dbe0f netfilter: nf_tables: Simplify chain netdev notifier
    becc1f5adc77c netfilter: nf_tables: Tolerate chains with no remaining hooks
    0c415aaaffbf8 apparmor: Fix 8-byte alignment for initial dfa blob streams
    662e391e85af5 apparmor: Fix memory leak in unpack_profile()
    7e3717466403b apparmor: free the allocated pdb objects
    0b895b8faca11 erofs: fix large folio race in erofs_fscache_req_complete
    17309187f12d7 spi: zynqmp-gqspi: Use devm_spi_alloc_host()
    1ba2ffa759c5b selftests/landlock: Add layout1.refer_mount_root
    8706e18922fb9 spi: spi-zynqmp-gqspi: stop the controller on shutdown
    57230a74cf07d ksmbd: fix partial normalized name responses
    c3343cd7ec870 ipv6: mcast: fix RCU list diversion in ip6_mc_del1_src()
    ac51321d3b239 ipv6: mcast: use copy-on-write RCU updates in ip6_mc_source()
    5b24c8f815a44 ipv6: mcast: Don't hold RTNL for MCAST_ socket options.
    776668d3424c3 ipv6: mcast: Don't hold RTNL for IPV6_DROP_MEMBERSHIP and MCAST_LEAVE_GROUP.
    7157a0865debe ipv6: mcast: Don't hold RTNL for IPV6_ADD_MEMBERSHIP and MCAST_JOIN_GROUP.
    8355220e6166a ipv6: mcast: Use in6_dev_get() in ipv6_dev_mc_dec().
    d91b9a3b2b38e smb: client: fix missing iov bounds check in parse_posix_sids()
    6f5f4785b98c9 smb: client: fix missing lower-bound check on DFS referral string offsets
    e78fc1d240b27 smb: client: fix server->total_read for compound encrypted PDUs
    74995ee8305a7 smb: client: fix potential OOB read in smb3_enum_snapshots()
    491e33144dee8 smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs
    e3344bb0ff5ec smb: client: fix smbd_connection leak on cifs_get_tcp_session() error
    53d82794f890a smb: client: reject short Next offsets in parse_server_interfaces()
    b5f924ffbfa97 smb: client: fix rlist race and missing initialization
    180380272f116 smb: client: cancel reconnect work in clean_demultiplex_info()
    c46c47aef4982 drm/msm/hdmi_phy: fix runtime PM cleanup on probe failure
    48e46ea9b2c6a drm/msm/adreno: fix autosuspend cleanup during teardown
    5f5e565410b49 drm/gud: fix out-of-bounds write in gud_plane_atomic_check()
    0d1700394e9f5 wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver
    16abf3f5d727a wifi: mwifiex: validate action frame fixed fields
    c4943323fda22 wifi: mwifiex: validate scan response extents
    2402c9e2644b7 wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length
    bc83c04be042f wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST
    42f4b03971f9d wifi: p54: validate curve data length in the calibration curve converters
    612ed9224eae7 wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext()
    491df93b10d76 wifi: wilc1000: fix out-of-bounds read in P2P public action frames
    05b5e297bbf46 wifi: wlcore: release runtime PM ref on regdomain config failure
    00bea35892556 wifi: rsi: fix heap OOB write on key removal
    41b1a4d545ec3 wifi: libertas_tf: fix UAF in lbtf_free_adapter()
    85d847ff71fe7 wifi: iwlegacy: fix broadcast stations deallocation
    856dabd5f2617 wifi: brcmsmac: fix UAF in brcms_free_timer()
    ef3c2aef001a6 watchdog: starfive-wdt: Fix runtime PM leak in starfive_wdt_pm_start()
    135cf929db55d watchdog: sp5100_tco: Fix pci_dev reference leak in sp5100_tco_init()
    757c721545b9f watchdog: rtd119x: Avoid division by zero
    c52ba8375ff9c watchdog: msc313e: Propagate error code in resume()
    1c4aabc88fee1 watchdog: msc313e: Fix premature reset during timeout update
    08c58739c9984 watchdog: digicolor: Avoid division by zero
    c30b419c7e6fb watchdog: da9063: fix suspend/resume handling of HW_RUNNING watchdog
    b81989ecf97d1 hwmon: (w83793) release probe data through kref
    f6e2ab72f32d1 hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove
    3040bfd935599 hwmon: (pmbus/tps53679) Select page 0 for single-page TPS53676
    1209d2330bab3 hwmon: (pmbus/tps53679) Fix TPS53676 phase page decoding
    66368f682a53f hwmon: (pmbus/core) increase number of phases and add new mask
    b6b2a638aa36c hwmon: (hp-wmi-sensors) Fix use-after-free in fungible_show()
    c5e573bb095d5 Input: zero ff_effect before compat copy in input_ff_effect_from_user
    e2b6703465c1c Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound
    d06f72350d5d5 Input: synaptics - disable InterTouch on ThinkPad T440p (board id 2722)
    42c7afc0e5f5b Input: soc_button_array - check btns_desc->package.count
    fd9bc6c1e5c0d Input: soc_button_array - fix MS Surface Pro 11 probe failure
    50dd585bee766 Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block()
    84f863866adb0 Input: i8042 - add quirk for Acer Aspire Go 15 AG15-42P
    af5f7130cbf39 Input: evdev - zero absinfo before partial copy in EVIOCSABS
    b172c69e67bc7 Input: cyttsp5 - clamp the HID report size before memcpy
    e08c459870a65 Input: atkbd - skip deactivate for Xiaomi Redmi Book Pro 16 2026
    b266cbbad1a7a Input: adp5588-keys - cache GPIO state before registering the gpiochip
    7e1c98cb7249e mmc: sdhci_am654: Reset command and data lines on failed tuning
    da4929ee78ee7 mmc: spi: reset bytes_xfered before retrying CRC failures
    4adbd609686d5 mmc: sh_mmcif: initialize IRQ-thread mutex before requesting interrupt
    72f4c2b7a4842 mmc: sdio_uart: fix xmit_fifo leak when the port table is full
    b84d29f2541c8 mmc: sdhci-of-aspeed: Remove children before releasing SDC resources
    cd19ae28eb545 mmc: rtsx_pci_sdmmc: ignore broken write-protect on ThinkPad X260
    ae10838a7cdf0 mmc: mxcmmc: cancel data work and watchdog on remove
    c50d6515bffb1 mmc: hsq: Fix use-after-free in retry work
    ee47e50011c20 mmc: core: Fix OF node reference leak on card add failure
    0bf3d168a2cc2 mmc: core: Cancel SDIO IRQ work before freeing host
    e77461af13eab selinux: always fill AVC decision in avc_has_perm_noaudit()
    4d50ebe5a2772 selinux: recheck intermediate backing files on mprotect()
    caa1b913d90d5 selinux: preserve user SID across nested backing files
    535530bb2ea52 IB/hfi1: Fix the PIO_CRED credit-return mmap
    1b352c95a49a3 IB/hfi1: Resolve the credit-return buffer through the send context's node
    cf20d7476754c IB/mlx4: Fix use-after-free on pkey sysfs registration failure
    bf0252e908448 i2c: imx: disable autosuspend on remove
    ad793059a419f i2c: imx: release DMA channels on probe error
    2f5e42edbd232 i2c: atr: fix dangling adapter pointer on add failure
    3cb8ae257292f i2c: at91: release DMA channels on remove and probe error
    3fd487c69ad31 KEYS: trusted: Fix tpm2_load_cmd() boundary check
    6ecc3fef3db53 keys: translate request_key_auth pid for the reading procfs instance
    ce6009f753485 mm/mlock: use the IRQ-safe accessor for NR_MLOCK in __munlock_folio()
    19c3da6621a25 memstick: ms_block: destroy io_queue workqueue on removal
    937108dc0258d xfrm: serialize state GC with device state flush
    39491a1ae9305 scsi: core: Validate MODE SENSE lengths in scsi_cdl_enable()
    6106fb1246ead net/packet: avoid truncating TPACKET_V3 private size
    23cd30498891d net/packet: clear RX owner on VNET header error
    d8e2f1f0263b7 net/sched: hhf: cap hh_flows_limit at change time
    dd136f1fdd105 net: wwan: mhi_wwan_mbim: check skb_copy_bits() return value
    19b5e8dd884a5 net: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain
    fba45070e25ab net: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb()
    a58024835c704 net: lan743x: fix RX checksum use-after-free
    60459c670329d ipv6: xfrm: use full sockets in local error paths
    89f5414660724 dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn()
    aacd1c4cbe06a dmaengine: sun6i: fix undefined behaviour in sun6i_dma_tx_status
    b4025915131c6 dmaengine: sun6i: fix non-atomic read of DMA position registers
    560ed4373c06a Bluetooth: hci_sync: Serialize local codec list cleanup
    a6da782fefae6 Bluetooth: hci_codec: validate vendor codec count length
    3a640fee27ce4 Bluetooth: eir: validate service data length before reading UUID
    063d409c54703 Bluetooth: btusb: fix NXP IW610 composite device handling
    df4920b133343 arm64: percpu: Fix this_cpu_and() mask generation
    9397a97eba3d5 arm64: percpu: Fix this_cpu_write() casting
    0b2144175502d arm64: dts: renesas: r8a779f0: Set UFS lane count
    909e92423db72 arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc
    a8b826076a41e kselftest/arm64: Fix size of thread_data values for pthread_join()
    8f282d12550e3 HID: logitech-hidpp: fix race condition when accessing stale stack pointer
    b2b84e73e0386 net: xfrm: reject unrepresentable espintcp transport headers
    579d87ec1e1e8 openvswitch: avoid reallocating confirmed conntrack labels
    2fbac8a56004b RDMA/core: fix refcount bug in iwpm_get_nlmsg_request()
    ae805d204cf1f RDMA/ucma: Serialize join and leave on copy_to_user failure
    1c8448db5cf35 tcp: exclude old ACKs from tcp fast path
    b5c9f2951d330 rds: ib: use rds_conn_drop() on protocol version mismatch
    6f1977cea3e85 exec: Cleanup POSIX timers right after de_thread()
    0338489960dda cifs: Fix server use-after-free in cifs_chan_skip_or_disable()
    a5a8b4737f68b ata: libahci: clear PxCLBU and PxFBU for AHCI_HFLAG_32BIT_ONLY
    6507055733a9d ASoC: codecs: rt712-sdca-dmic: fix uninitialized stream_config->type
    830012feadc22 ALSA: virtio: reset device before deleting virtqueues
    5658739b54f5e Input: xpad - fix PDP Marvel Xbox 360 controller
    1fb92056c8fcc Input: xpad - add support for Azeron devices
    2e74f1f22a0e3 Input: xpad - add support for Victrix Pro BFG Controller
    93e3eb481be0f wifi: rtw88: Fix the random "error beacon valid" messages for USB
    f689260c48fb4 wifi: rtw88: TX QOS Null data the same way as Null data
    fa252fe7dc329 net: cpsw: Execute ndo_set_rx_mode callback in a work queue
    74852715757d9 net: cpsw_new: Execute ndo_set_rx_mode callback in a work queue
    7e22e5bcbfacf mm/huge_memory: use folio's memcg inside __folio_split()
    2605eb9ba3bbd btrfs: abort transaction on failure to update inode for hole punching and reflinking
    71d45a04ea99c btrfs: remove redundant root argument from btrfs_update_inode()
    a66b626d3b4b7 btrfs: simplify error check condition at btrfs_dirty_inode()
    b7c7f07a40037 drm/amdgpu: check ras and obj before dereference
    6569fd85b0ef9 net: mvpp2: prevent buffer overflow in page_pool allocation
    afaddc3fbf2ae net: macb: fix ordering around PTP timestamp read
    472493d1d3334 net: ethernet: cortina: Ack RX overrun interrupt correctly
    17b2a1eb97fdb net: lock the socket in sock_gettstamp()
    c10101baba9d3 net: netsec: fix device_node reference leak on phy_np
    aeec38e773c66 ASoC: hdmi-codec: Report a change when the channel status moves
    9cc2fae796b79 ASoC: ux500: Parenthesize MSP_{RX,TX}_CLKPOL_BIT() arguments
    d6a1779129d93 powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba
    c41088b2765af KVM: PPC: Book3S HV: fix secure device page leak on uv_page_in() failure
    e37fba1ba6938 KVM: PPC: Book3S HV: fix use-after-free in kvmhv_emulate_tlbie_all_lpid()
    d54a044136b12 drop_monitor: fix out-of-bounds write in reset_per_cpu_data()
    86f1151aa6ac3 drop_monitor: synchronize tracepoint unregistration on error path
    ffc448eb54f5b pppoatm: ensure a writable skb header and linear data
    c741977e413f5 Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup
    3b00027c71345 Bluetooth: btmtksdio: Fix PM runtime reference leak in shutdown
    ad13c739dedcc Bluetooth: btmtk: fix wrong status for short WMT FUNC_CTRL events
    ea8a262662be6 Bluetooth: ISO: Fix parent socket leak in iso_conn_ready()
    4a33886057e6d dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg()
    a444c0115665a ksmbd: keep compound responses on query info errors
    2107d60053c88 ksmbd: fix partial file information responses
    39685131e5bda ksmbd: return buffer overflow for partial filesystem info
    9a4f49bf8d2da tcp: do not let tcp_rmem be set below 4096
    b727e3d58cb90 tcp: Don't call skb_clone_and_charge_r() for close()d listener in tcp_v6_do_rcv().
    6b431b6321985 net: bridge: mst: move switchdev call outside rcu
    50b1adbb39fc0 wifi: brcmfmac: fix lost 802.1x TX completion wakeup
    822903ed99197 net: fddi: skfp: fix NULL deref when setting the MAC address while down
    83aa83f81a8fe ipv4: icmp: reject RTN_UNREACHABLE input routes in icmp_route_lookup
    5130afa025c95 seg6: set IPSKB_L3SLAVE from IP6SKB_L3SLAVE on IPIP decapsulation
    35cbe34c3704c drm/msm/dsi: round the byte clock rate after reparenting to the PHY PLL
    a7cd161e4ba2b btrfs: tree-checker: print dev extent offset in error message
    0a52ba6d3b268 ALSA: hda: trace PCM open only after assigning a stream
    b6beee927e7f4 drm/vc4: Use managed KMS polling to fix UAF on unbind
    f1a232fdc1012 drm/ast: Automatically clean up poll helper
    e8304e25c6dab wifi: virt_wifi: don't transfer operstate before register
    246de677552fe ALSA: 6fire: fix OOB write from device-reported iso length
    8b8559aeaba2e ALSA: usb: 6fire: Avoid embedded URBs
    910bde5a7f188 ALSA: 6fire: Clean ups with guard()
    aff058605007c Input: trackpoint - fix the inertia attribute name in the ABI document
    686c7a6af1eea ALSA: pcm: set timer->private_data before registering the PCM timer
    d54a90f2b9376 phy: mediatek: phy-mtk-hdmi-mt8195: Fix TMDS clk bit ratio setting
    5d6c7370d515e phy: mediatek: phy-mtk-hdmi-mt8195: Fix PLL calc divisor overflow
    c83d6b0a65f7b ALSA: bcd2000: Fix race between rawmidi and disconnect
    3d5f7e77b2e1b keys: fix lost wakeup when reaping a dead key type
    780716e2e0191 drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr
    136cb27bf8f5b perf/arm-cmn: Fix wp_dev_sel2 setting for multi-DTM configurations
    a43cd2b67b91e netfilter: flowtable: hold reference on ct until flow is released
    e4982c489ee35 netfilter: nft_nat: fully initialise new_addr in netmap setup
    eb4d7a9469704 RDMA/siw: Bound fragmented header copies by the remaining length
    c767e2812cac8 RDMA/efa: Keep EQ resources alive while IRQ is registered
    00f7df59543cc RDMA/efa: Keep admin queues alive while IRQ is registered
    87793933dc54f dmaengine: xilinx_dma: Fix hardware buffer descriptor chain after cyclic DMA
    209cf79a4f8a6 dmaengine: xilinx_dma: Fix hardware buffer descriptor reuse order
    aaf4ae1730d40 scsi: qla2xxx: Fix the ql2xfc2target parameter description
    7343f2575868f mm: memblock: show all region flags in debugfs
    420fcc2fdeae6 wifi: mac80211: set up the TX info early to fix failure paths
    7e32c6ed25548 wifi: mac80211: rework ack_frame_id handling a bit
    b51f5a310bd68 wifi: mac80211: mesh: release the channel if start fails
    be7bfdea1ec9b wifi: mac80211: add HE 6 GHz capability in the scan elems len
    f17a3fb26beca wifi: mac80211: don't access the TSF of a down interface
    e4bb995f61e23 wifi: mac80211: don't RCU-dereference the mesh CSA settings we just set
    ed8d5f5b74d0f wifi: mac80211: don't allow link changes when iface is down
    d0afa5395c46d wifi: mac80211: require a peer station for TDLS setup confirm
    7775759e3cb35 wifi: mac80211: reset the AP_VLAN tailroom counter on ifdown
    c4e4fe330294e wifi: mac80211_hwsim: don't hand frames to mac80211 while stopping
    20a56e96a6f7b wifi: mac80211: unlist vifs when their netdev is unregistered
    06f1c819700db wifi: mac80211: suppress chanctx warning for debugfs reset
    790221efbfece wifi: mac80211: don't offload TC setup on AP_VLAN interfaces
    65fdb973bd905 wifi: cfg80211: don't filter by BSS type when removing stale entries
    73365b81630b5 wifi: cfg80211: only group hidden BSSes with beacon entries
    8577a5ec4f7e0 dmaengine: wait for RCU readers before releasing dma_device
    07eb075b60d56 dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel()
    7c3f4ce651d43 dmaengine: Fix device kref underflow in dma_chan_put()
    cee7e641245c3 dma-coherent: report a failed reserved memory assignment
    c9cee0989b55d dma-coherent: Warn if OF reserved memory is beyond current coherent DMA mask
    dd579fd27593d MIPS: Octeon: apply USB FDT fixups also when USB is modular
    c58a21667bd5e soundwire: cadence_master: wait and cancel cdns->work before clock stop
    12c0abd4d1c1b wifi: cfg80211: check IP header size in cfg80211_classify8021d()
    326f7d34bd7e6 IB/IPoIB: Avoid restoring OPER_UP after multicast flush
    46aa75291056b wifi: libipw: reject too-short association responses
    14ae269c13060 wifi: libipw: reject too-short beacon and probe responses
    2761b21cb896b wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path
    36727a702cf8e wifi: virt_wifi: free skb when disconnected
    3eff16074d061 dmaengine: sprd: Fix runtime PM reference leak in probe
    6f8020fe7465f RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted
    aacfef2480876 RDMA/irdma: Enforce local fence for IB_WR_REG_MR
    752b30e9d3390 RDMA/mad: Fix receive buffer leak when PKey enforcement fails
    505b242d93516 IB/isert: wait for deferred control PDU completions before releasing the connection
    9d145a2d8d6f8 IB/iser: reject a remote invalidation of an unregistered direction
    45c60ffc79771 RDMA/core: Reject unregistering netdevs in ib_get_eth_speed
    1c4cc9f0d8f45 net: convert dev->reg_state to u8
    c79a789aa1518 RDMA/rxe: insert mcg into mcg_tree only after rxe_mcast_add() succeeds
    56b7a9d89c679 clk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate
    f17865332cc4c firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS
    b7d2118660545 RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access
    08f12745cb729 RDMA/rxe: validate access flags before swapping the MR's PD
    030306bbb9273 RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept
    70d509b6bdf74 RDMA/siw: Cleanup siw_accept
    0b6ac53b6bd5f RDMA/siw: Introduce siw_cep_set_free_and_put
    5219c5652b2f3 ARM: socfpga: select the PL310 erratum 753970 workaround
    69a768c12398c esp: downgrade zerocopy managed frags before mutating skb frags
    0cda8273265d3 xfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for xfrm_trans_reinject()
    2b63341e2ebc9 xfrm: fix compat ALLOCSPI request use-after-free
    60610a5dab6ed xfrm: avoid RCU warnings around the per-netns netlink socket
    f1fde49cabc90 ipv6: Honor oif when choosing nexthop for locally generated traffic
    8a13003b50b97 ipv6: Select best matching nexthop object in fib6_table_lookup()
    4bc97d3bf5d72 media: video-i2c: fix buffer queue ordering
    04317f3fb8be2 sunvdc: fix -EIO issue due to lack of retries
    9a622ea3662c8 selftests/landlock: Add tests for whiteout object creation
    b6e45216aecc8 Revert "alpha: fix ieee_swcr_to_fpcr setting FPCR_DNOD unconditionally"
    f5d1ea9bb08d9 Revert "alpha: don't leak hardware-fabricated FP exception bits to user space"
    c337c14afcf7e selftests/landlock: Add disconnected leafs and branch test suites
    b15ec9fef1b16 selftests/landlock: Add tests for access through disconnected paths
    82e198df9c252 Revert "hwmon: (emc1403) Rely on subsystem locking"
    e08063fb0d02f Revert "hwmon: (emc1403) Drop hysteresis for low limit temperature"
    0a926b5df8efd mptcp: close race between scheduler and state change
    1962841387087 mptcp: avoid unneeded actions on subflow reset
    ddbf9f03c1cc7 mptcp: fix bad accounting in __mptcp_subflow_push_pending()
    cf6e04377bdde Bluetooth: btintel: Fix compiler warning for multi_v7_defconfig config
    9107e43ba1e03 workqueue: Update documentation as per system_percpu_wq naming
    1100e075a0e09 netfilter: nft_set_pipapo_avx2: add missing vzeroupper
    2c8fa22997892 crypto: sun8i-ce - Remove crypto_rng interface
    a41e4ba94ad45 crypto: sun8i-ss - Remove crypto_rng interface
    99f4d3120b244 fou: Fix use-after-free in fou_create()
    542c1dd41e1b0 net: appletalk: fix NULL pointer dereference in aarp_send_ddp()
    df077253f6405 i2c: smbus: reject oversized block transfers in the common path
    938e8d6cee8d3 ALSA: us122l: Prevent write upgrades for read mappings
    05d47f540d85c net: usb: pegasus: don't rely on id table pointer arithmetic
    be5996349328b media: as102: do not rely on id table address comparison
    0bbcbe9f7cfce usb: serial: spcp8x5: don't store usb_device_id
    367af2b4d5168 usb: usbtmc: don't store usb_device_id
    8cb99d4a71593 wifi: ath9k_htc: don't store usb_device_id
    5086f5639197f usb: xusbatm: don't rely on id table pointer arithmetic
    8f4422c14d6a2 perf evsel: Add per-thread warning for EOPNOTSUPP open failues
    44441aa9630fa Revert "perf tests: Fix flakiness in BPF counters test on hybrid systems"
    a3ca496b63fb9 Revert "selftests/mm: report unique test names for each cow test"
    289dfa824fb24 Revert "selftests/mm: skip COW tmpfile cases when fallocate() is unsupported"
    ad1be9fe255b4 Revert "nvme: apple: Add Apple A11 support"
    187187eea3441 Revert "nvme-apple: Drop the PRP null check chicken bit"
    eb51cbf1b091c Revert "nvme-apple: Prevent shared tags across queues on Apple A11"
    b66ef13b72f4f Revert "nvme-apple: Reset q->sq_tail during queue init"
    f91df9f3ed6ca Revert "arm64: dts: qcom: sc8180x: Fix the PCIe iommu-map entries"
    bddd4544e80b2 Revert "arm64: dts: qcom: sdm845: Fix the PCIe iommu-map entries"
    492c1a89a5c94 Revert "arm64: dts: qcom: sm8150: Fix the PCIe iommu-map entries"
    a0441be048ddd Revert "arm64: dts: qcom: sm8250: Fix the PCIe iommu-map entries"
    654a2e749883b Revert "arm64: dts: qcom: sm8350: Fix the PCIe iommu-map entries"
    91d04c96ef14b Revert "arm64: dts: qcom: sm8450: Fix the PCIe iommu-map entries"
    6805046d2db02 Revert "arm64: dts: qcom: sm8550: Fix the PCIe iommu-map entries"
    c2bf1299aeff6 xfs: bail out on bitmap errors in xrep_agfl_fill
    2cc0af2204070 xfs: count escaped corruption errors in scrub stats
    201995b1e9839 xfs: signal inode btree xref error if get_rec returns an error
    6e55aac5a1008 xfs: snapshot old AGFL before rewriting it
    e0873cce0e132 xfs: snapshot scrub stats when rendering them
    d5cea6766ae18 smb: client: fix heap overflow in DACL owner/group rewrite
    e9c5bcc88b833 smb: client: avoid leaking refcount when cifs_sb_tlink() fails
    de2a6bcff2659 smb: client: avoid leaking refcount in cifs_queue_oplock_break()
    f73341e1ef134 smb: client: fix file type corruption in wsl_to_fattr()
    0f723c20d2ced smb: client: fix file type corruption in cifs_reparse_point_to_fattr()
    ff411fcbfc55e smb: client: fix one-byte OOB read in smb2_parse_native_symlink()
    3c9acc9835c30 smb: client: pin DFS superblock in iterator callback
    17c93bcd17755 smb: client: reject userspace cifs.idmap descriptions
    f00c31be52f5c selftests: mptcp: fix an UAF in mptcp_connect.c
    360d99258a640 mptcp: syncookies: remember the request backup flag
    a2431bea521ef mptcp: subflow: no need to copy thmac during ulp_clone
    654381b0b176e mptcp: options: handle MPC data + csum reqd + no csum
    c3eb07e78e628 bnxt_en: Propagate RX ring init failures in bnxt_init_nic()
    cfec9e7f15a56 bnxt_en: Handle buffer allocation failure in bnxt_rx_ring_reset()
    aae9a450af63e bnxt_en: Only restore LRO if the device supports TPA
    1afaf85c4990f media: v4l2-ctrls: validate AV1 tile counts
    724915535558b media: v4l2-ctrls: validate HEVC tile counts
    95ee48eb17c91 media: verisilicon: rockchip: reject AV1 frames exceeding the tile capacity
    8659e5fc21a82 media: verisilicon: rockchip: guard VPU981 AV1 divisor and tile buffer
    279fb47254f37 media: v4l2-h264: Fix memcmp() size in B1 reference list comparison
    f19acf00818a9 media: mediatek: vcodec: bound AV1 tile-start copy to the array capacity
    2887a98c03d97 media: verisilicon: hantro: bound G2 HEVC tile loop to the buffer capacity
    98018ea5a682a media: hevc: add bounded tile-count helpers
    137c1b88507a4 hwmon: (pmbus) Clear generic status alarms with CLEAR_FAULTS
    e9fc7d53b2eb3 hwmon: (gpio-fan) Fix use-after-free in alarm work
    716beceaf70c1 hwmon: (applesmc) fix key backlight workqueue leak on register failure
    991c875310254 s390/crypto: Fix missing scrub of temp buffers with AES ctr and gcm algorithm
    b3f8200ec5285 s390/qeth: allow bridgeport queries despite OS_MISMATCH
    5f33ae947f52f KVM: PPC: Book3S HV: Set irqfd->producer only on success
    4826fd8373f68 mac802154: fix use-after-free of sdata via queued RX frames
    652d9caa5ac92 ipvs: reject invalid states in connection template sync records
    3080f9e653d8c ipv4: fib: bound automatic table ID allocation
    e3b4681197aa0 ieee802154: hwsim: serialize pib updates to fix double-free
    543994fa03c36 ieee802154: 6lowpan: fix NULL dereference in lowpan_newlink
    ff83367cda8ee inet: frags: invalidate queues before flushing them
    de5a0eda59fe4 fbdev: vfb: defer cleanup until the last reference
    b534dca2db93c scripts/sorttable: Mark long_size as __maybe_unused
    f464fde4fd880 vdpa: solidrun: Free IRQs after request failure
    123acfd63d767 vdpa: ifcvf: Put device on unsupported feature error
    b6204011c79eb netfilter: report NLM_F_DUMP_FILTERED when all is filtered out
    90166834b7dc6 netfilter: nf_log: unregister loggers before per-net teardown
    76678217cdabc net: openvswitch: fix use-after-free of the flow table mask array
    0b3425fd0ecd5 net: mpls: clear inner_protocol when the last label is popped
    f7d76b84b9206 net: mana: Reserve extra CQ slot for the fence completion CQE
    84ba968d7b35c net: hso: fix TIOCMIWAIT race
    9e28471d22a49 ring-buffer: Acquire the lock with irqsave in rb_wake_up_waiters()
    362c42720259f drm/i915: Fix memory leak in query_perf_config_list()
    506cfed91e50c drm/drm_exec: fix up contended obj when num_objects is 0
    3feb4020bfb7c exec: do_close_on_exec() before taking exec_update_lock
    b22193eea2ce3 cpufreq: initialize policy rwsem before sysfs publication
    06f273d29e5e0 cpufreq: zero-initialize policy cpumask before sysfs publication
    ba96047bba4a6 Bluetooth: btrtl: Don't leak return code when parsing firmware format v2
    45021eb562114 ASoC: sti: initialize IRQ lock before requesting IRQ
    1467e3989c6ed ASoC: sprd: validate compress buffer sizes against fixed allocations
    fe05eeed27128 tracing: Keep the entry count when the histogram stats allocation fails
    01966c9569230 tracing: Let histogram values keep the percent and graph modifiers
    3d42fed18b2c5 tracing: Free histogram the field rejected for a bad modifier
    b513a4c60a7aa tracing: Free histogram var refs regardless of how often they are referenced
    4924328d6991f tracing: Free histogram the var ref when its initialization fails
    a3d9b8b7c8f36 tracing/user_events: Don't destroy fields when event removal fails
    757aa9f548c18 tick/broadcast: Plug clockevents replacement race
    7cd398799eeb6 tunnels: Drop stale dst when building an ICMP error for PMTUD
    58c0c414b2b8d ufs: validate cylinder group metadata before caching it
    cd21f1ff74b1c ufs: create the root dentry after loading cylinder metadata
    c9e4a2c11ff61 watchdog: sunxi_wdt: preserve boot-enabled watchdog
    c42eadbcf68ca dm/amdgpu: fix malformed link_settings debugfs output
    d170cfbe38c88 ALSA: usbusx2y: fix in04_last array size mismatch with in04_buf
    3570468cc34e7 ALSA: ctxfi: Fix CA20K2 S/PDIF passthrough
    98da3379cdee3 tracing: Fix memory corruption from the histogram stacktrace modifier
    14fdaba201fdf ipv6: fix fib6 walker UAF on seq stop
    b5dec6dfb593d x86/mm: Fix user-space data loss with MADV_FREE and THP
    b0c201a596816 crypto: x86/aria - add missing vzeroupper in AVX-512 code
    3dee28df79cb7 crypto: x86/aria - add missing vzeroupper in AVX2 code
    460fab22b6513 powerpc/eeh: Fix recursive locking on devices without EEH sensitive driver
    e52bf7c4f2b2e powerpc/ps3: Fix repository.c build failure
    fd636a87161de ksmbd: prevent out-of-bounds reads in share config responses
    9c777f8e0cb04 scsi: target: iscsi: Fix hang for aborted WRITE_PENDING commands
    b0de6463667e9 sunvdc: unmap LDC cookies when the descriptor send fails
    4cd165b5f3eae openvswitch: fix wrong flag value in get_ipv6_ext_hdrs()
    348492de88bc6 net/rds: fix tcp stream corruption with large pages
    5c353c5a76e30 octeontx2-af: fix PF/CGX debugfs PCI bus lookup
    c622bbc212207 net: hinic: fix mailbox segment buffer overflow
    5aab3e8d71644 net: sun4i-emac: fix missing of_node_put() for phy_node
    96c2fc5daf983 net/sched: cls_api: Don't replay RTM_GETCHAIN in tc_ctl_chain().
    2cad4a521942d net/sched: cls_route: Fix in-place replace
    3d4c403aa780b net/sched: cls_route: make netlink errors meaningful
    cec2052fcecc2 net/sched: cls_route: Reject handle aliasing
    41e94079200aa net/sched: cls_route: free emptied bucket on filter move
    7fd4a45ee721d perf/x86/intel: Correct pt_regs->flags update for PEBS path
    82e79fdbf68ca perf/x86/intel/ds: Factor out PEBS group processing code to functions
    e2e2ca292449e perf/x86/intel/ds: Remove redundant assignments to sample.period
    421bc24582a36 perf/x86/intel/ds: Clarify adaptive PEBS processing
    85382012bbc33 perf/core: Check sample_type in perf_sample_save_callchain
    b799264c7b1f7 selftests/powerpc/tm: Fix tcheck() reading uninitialised CR value
    79fb5bcc50996 net: stmmac: initialize ptp_lock at probe time
    7953946f68262 ppp_synctty: ensure a writeable skb header
    16c5c8ea50179 octeontx2-pf: reset HTB scheduler topology before freeing queues
    3b90136e3df4f hwmon: (aspeed-pwm-tacho) Propagate reset deassert errors
    4a641ec4a73a6 hwmon: (gpio-fan) take fan_data->lock in gpio_fan_shutdown()
    ce3479e4a647b net: ks8851: Fix receiver error in 100BASE-TX mode following software power-down
    01a3ec43ad635 net/micrel: Fix typos in micrel driver code comments
    4afef977f36da watchdog: msc313e: Sync timeout value if WDT was running at boot
    079c8c2891d35 watchdog: msc313e: Fix undefined behavior
    aea1af21e3028 watchdog: msc313e: Fix spurious reset on suspend
    b4f3a54fd1949 watchdog: msc313e: Enable clock before accessing hardware registers
    a1dd0817776ea watchdog: msc313e: Fix clock leak and spurious timer in settimeout()
    660571b082331 watchdog: msc313e: Avoid division by zero
    0a1c1f26c68b1 watchdog: fix hrtimer start when pretimeout is zero
    c1de1e7b51ab2 net: macb: destroy the phylink instance on the probe error path
    5242050195a71 Bluetooth: btusb: Fix UAF of btusb_data by rx_work
    c075a91fe5762 ice: add missing xa_destroy for sched_node_ids
    e56a339e3de5e ALSA: hda: Report a change when only the channel status bytes move
    621a4bb3ec3c2 ALSA: hda/common: Use guard() for mutex locks
    934b404b6063d ALSA: hda/common: Use cleanup macros for PM controls
    3fe9102ae0a82 ALSA: hda: Introduce auto cleanup macros for PM
    4bc6df61a100a drm/logicvc: Drop the select of the nonexistent CONFIG_DRM_KMS_DMA_HELPER
    f2de9df262c47 net: ethernet: cortina: Count RX descriptors for freeq refill
    742f06928960c net: ethernet: cortina: Count RX drops once per frame
    dd792f4154b69 net: ethernet: cortina: No mapping is a dropped rx
    e858b9b1ea3cb net: ethernet: cortina: Count dropped frames as NAPI work
    d2541cfbd41cd net: ethernet: cortina: Finish RX updates before NAPI completion
    4ca84049c6428 net: ethernet: cortina: Fix budget accounting
    565be2ffa33fe net: ipv6: Clamp to IP6_MAX_MTU in ip6_dst_mtu_maybe_forward
    1dd562f301901 net: ipv6: Fix UDP length overflow with PMTU discover and big MTU
    550aa32d46f2a ipv6: lockless IPV6_MTU implementation
    20c41165e8efd ipv6: lockless IPV6_MULTICAST_HOPS implementation
    c79c67de42d6e ipv6: lockless IPV6_MULTICAST_LOOP implementation
    e6c6b0059d624 ipv6: lockless IPV6_UNICAST_HOPS implementation
    81073bca2062c virtio_input: stop callbacks before unregistering input device
    16c90260ae7ae virtio_input: reset device if input_register_device() fails
    fa2ec3f48a679 virtio-pci: return IRQ_HANDLED after non-zero ISR
    1b803d382cde6 vdpa_sim_net: check TX pull result before RX copy
    000c6300776ce vdpa_sim_blk: reject out-of-range sector starts
    59fc7c1c6b4d3 vhost-vdpa: don't install the eventfd_ctx_fdget() error in config_ctx
    4875c65ca5379 vhost/vdpa: reject VRING_NUM larger than device max
    bd94e2ba56d02 vhost-vdpa: clean iotlb map during reset for older userspace
    b46594205234a vdpa: introduce .compat_reset operation callback
    dc74887a56e58 vhost-vdpa: introduce IOTLB_PERSIST backend feature bit
    fde77a9a589f3 vdpa: introduce .reset_map operation callback
    c147d62316ce0 vhost-vdpa: introduce descriptor group backend feature
    d76182012a5df vdpa: introduce dedicated descriptor group for virtqueue
    2e40c69b9c344 virtio_console: do not free control-out buffers on remove
    74bdd312e78d0 ASoC: mt6351: Publish the OF module alias
    0f7dcaaff3b24 netfilter: ip6_tables: set F_PROTO when proto value is nonzero
    3161186a2ff81 netfilter: nfnetlink_log: cope with concurrent instance destruction
    79d93d8b49f05 ASoC: Intel: SST: Publish the PCI module aliases
    ebae165ad8352 ASoC: bcm: bcm63xx: Publish the OF module aliases
    671037b282eb7 ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev
    2ff38b3552af5 bpf: Reject non-scalar bpf_loop iteration counts
    054ad8e66025e net: macb: fix NULL pointer dereference on unbind with fixed-link
    2efc0d08fda24 net: macb: rename bp->sgmii_phy field to bp->phy
    94b12a42cf8e8 workqueue: Introduce from_work() helper for cleaner callback declarations
    226d2702e74a5 net/sched: ets: clamp quantum in parse and fallback paths
    b464affe9f9df net/sched: drr: clamp quantum in change class
    3685934a0620f net/sched: pie: clamp psched_mtu in pie_drop_early
    6570f326a6a96 net/sched: hhf: clamp quantum in change and init paths
    e4192bcf83aaa net/sched: sfq: clamp quantum in change path
    215df1e953ae7 net/sched: fq_pie: clamp quantum in change path
    439a3dc17964e net_sched: sch_fq_pie: implement lockless fq_pie_dump()
    5a2b87dfceccf net/mlx5: E-Switch, prevent mc_list repopulation during vport disable
    a5833fdf53350 net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put
    8267e46d14e84 net/mlx5e: Fix use-after-free race in sample_restore_put()
    1886540daeaff net/mlx5e: Fix ETS zero BW reporting when one TC holds 100%
    874e90f3d8806 net/mlx5e: Fix setting RS FEC after remapping
    6a1b49bb9fdf9 net/sched: defer qdisc freeing after failed creation
    04a6cdb3fd13e powerpc/kexec_file: Use inclusive range checks in add_usable_mem()
    0bf9f3bae3c4b pds_core: fix cmd_regs access racing BAR unmap on reset
    c2362c500931e net: cap tx_queue_len at S16_MAX to prevent oversized ring allocations
    b2a8e165ddb6c vxlan: reject dynamic fdb entries that reference a nexthop id
    90f6f5cb331af s390/ism: folio_put() after error
    59bf9e94bdc49 net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow
    e5f4a054b9dc4 octeontx2-af: mcs: Clear stale X2P calibration state before calibration
    37cb9a81600da net: bridge: mcast: properly convert mglist to rcu
    c5b5c52b6524c net: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer size
    f5e93162b3dd1 net: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size
    f24eb5bd870ca bonding: use skb_cow_head() in bond_do_alb_xmit() and rlb_arp_xmit()
    17acbcd4c5a6c nexthop: Initialize extack in remove_nh_grp_entry()
    8d282b2703899 selftests/bpf: Fix flaky bpf_nf test when random NAT port is 0
    0ba57948dc23a selftests/bpf: Update tests for new ct zone opts for nf_conntrack kfuncs
    b843ab43ac9d2 bpf: Mark bpf_btf_find_by_name_kind() as sleepable
    990df1ba4d080 net: bcmasp: fix tx_spb_ring_full() checking same slot cnt times
    1e213ba7cb3b9 net: bcmasp: clear txcb->last before writing each descriptor
    a16ca1987ce86 ASoC: Intel: avs: Clean up the bus when fetching ML caps fails
    aec0a9c1579eb bpf: Fix NULL-ptr-deref in btf_var_show()
    86d86f9fcf62d bpf: Fix NULL-ptr-deref when showing a void BTF type
    75b20534d7a37 ALSA: caiaq: Fix potential double-free at error path
    401aedb4632ae selftests/alsa: Fix the step check for INTEGER controls
    92748cdff7388 net: stmmac: reconfigure RX packet parser table in stmmac_hw_setup() after reset
    0ec75c69918b7 net/rds: don't let rds_conn_shutdown() consume a concurrent drop
    2e46248e375a5 net/rds: acquire the fastpath locks in rds_conn_shutdown()
    d184e6dd4b8f3 net/rds: acquire RDS_IN_XMIT in rds_tcp_reset_callbacks()
    51164c0597405 net/rds: tcp: don't force RDS_CONN_RESETTING over a concurrent shutdown
    b8a8b6d25e742 net/rds: clear cp_flags bits individually in rds_conn_path_reset()
    14d0a842e1696 net/rds: use clear_bit_unlock() in release_refill()
    3d401934b7edb net/rds: use wq_has_sleeper() in release_in_xmit()
    7b435c69a30b4 bonding: do not clear curr_active_slave prematurely when releasing all slaves
    8cb75f7ada25b bpf: reject BPF_PSEUDO_FUNC reference to the main program
    9379e193826f2 tracing/probes: Fix use-after-free on field name/type of events with multiple probes
    c6beb08b1a9fd netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace()
    677ff8ab30a66 ipvs: fix reversed sequence option serialization
    7caaae233a55e btrfs: do not force reloc root creation during qgroup_account_snapshot()
    02ebc4d4e5d73 btrfs: send: fix lost error return value in will_overwrite_ref()
    d043c43d2b4eb btrfs: fix the possible bioc_list memory leak during error
    81116d3c6b27d btrfs: directly return 0 on no error code in btrfs_insert_raid_extent()
    089d9c45ea49f btrfs: fix transaction use-after-free in raid stripe insertion
    77a771b5083c7 ASoC: ux500: Program the MSP FIFO watermarks
    507f239aacedd ASoC: ux500: Request the MSP MMIO resource
    737e29e7dbf6e mfd: db8500-prcmu: Fold dbx500 header into db8500
    f30aae1a465f2 arm: Handle KCOV __init vs inline mismatches
    3f87eece1edde mfd: db8500-prcmu: Remove needless return in three void APIs
    2e5e878e321f1 ASoC: ux500: Validate MSP DAI configuration
    054396ce4a4eb ASoC: ux500: Correct MSP frame and bit clock setup
    3b2d65cadf1f6 ASoC: ux500: Propagate MSP setup errors
    80c65fbc57d21 ASoC: ux500: Fix MSP stream lifecycle handling
    d6f9af093dc91 ALSA: ump: do not touch legacy_rmidi before it exists
    d2baaf94766e2 ALSA: ump: Update rawmidi name per EP name update
    b8ca1a95e9c52 ALSA: ump: Copy safe string name to rawmidi
    ee432ab0658c8 ALSA: ump: Copy FB name string more safely
    5447926ddbe75 ALSA: rawmidi: Show substream activity in info ioctl
    210a9fc6678ce ALSA: rawmidi: Expose the tied device number in info ioctl
    6bc345f6d81eb locking/lockdep: Invalidate stale class_cache entries for zapped classes
    c049f114bcb9e perf/core: Skip empty AUX records with only format flags
    7bcce856c79c1 scsi: mpt3sas: Avoid out-of-bounds cpumask_of_node() call in _base_assign_reply_queues()
    7adb1bf25b0c5 bonding: alb: fix uninitialized transport header access in alb_determine_nd()
    0a0ee38ad6324 btrfs: restore active device pointers after failed sprout
    7fe9dfbca4346 btrfs: detach failed sprout device from transaction update list
    d356c188a653d ASoC: amd: yc: fix memory leak in acp6x_pdm_dma_close()
    d744a26619bc9 ASoC: amd: renoir: fix disable_pdm_interrupts() to clear mask bits
    65736547074cb s390/boot: Fix physical memory search range
    68e920cb06ddd ALSA: hda: restore MFG widget enumeration after core split
    02f8dcb5c9be4 ALSA: hda/core: Use guard() for mutex locks
    10cc145b87367 staging: fbtft: make dirty_lock IRQ-safe
    2b9fa12fbdbfc af_packet: Don't cast tpacket_hdr.tp_len to int in tpacket_parse_header().
    af08f62b5a5a4 ipv6: sr: restore network header before routing and forwarding
    b5344e459996a tipc: fix NULL deref in tipc_named_node_up() on empty publication list
    f614c83fd7664 ip6_gre: check tunnel info before xmit in ip6gre_tunnel_xmit
    faaa80fad1f5d ppp: ppp_async: simplify tty disc_data access
    84223baf21bc9 net/sched: cls_u32: fix duplicate handle when node ID pool is exhausted
    6245425c04be5 ASoC: ab8500: Validate and program TDM slots correctly
    780e00c41886a ASoC: ab8500: Correct digital interface format setup
    84ce73fefeb17 ASoC: ab8500: Repair the DAPM capture graph
    a2db840c01162 ASoC: ab8500: Reset the audio block before configuring it
    b67584161b7f9 Bluetooth: hci_mrvl: Fix wrong return value check of wait_on_bit_timeout()
    a8841f6653164 Bluetooth: L2CAP: clear FLAG_DEFER_SETUP only for same PID/PSM
    0e1fc7cab95ad Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan
    593e64f64a20b Bluetooth: hci_core: Fix race condition during device registration
    e9cf7f175c00d Bluetooth: btintel: validate version TLV value lengths
    17b61f59914b5 Bluetooth: btintel: Export few static functions
    b9b36a0e3d77a Bluetooth: btintel: Print firmware SHA1
    abf3623af5d67 workqueue: reject watchdog thresholds that overflow jiffies
    198734bee7945 workqueue: replace use of system_wq with system_percpu_wq
    41647864e62b2 s390/ipl: Fix NULL deref in dump_reipl without re-IPL parm block
    030e88812435f s390/ipl: Fix NULL deref in kdump without re-IPL parm block
    948d0090e7250 s390/os_info: Introduce value entries
    b0fc13ff74a13 s390/checksum: provide and use cksm() inline assembly
    581896f229b39 s390/checksum: call instrument_read() instead of kasan_check_read()
    486876f957456 ksmbd: rate limit unmapped SID errors
    cbadf2575d25e ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF
    dcaa77d10ea19 OPP: of: Fix potential multiplication overflow when calculating freq
    a135415be5683 watchdog: msc313e: Fix NULL pointer dereference in PM callbacks
    069d5527bb0f2 vxlan: mdb: Fix use-after-free in vxlan_mdb_remote_src_del()
    c60066fa5e2fe net: amd-xgbe: discard rx packets with bad FCS
    e3f4ffbde379c raw: annotate disconnect-side IPv4 match writers
    4548d843e7b29 sctp: fix soft lockup from unpadded ASCONF-ACK parameter iteration
    377e01e4f3104 smb: client: transport: Fix debug printing in __release_mid()
    60a93d9f0fa06 smb/client: mark file sparse before emulating insert range
    58e3d2fbc8c91 scsi: mpi3mr: Fix target device refcount leak in mpi3mr_sas_port_add()
    c848a1bbe1104 scsi: mpi3mr: Fix NULL pointer dereference in mpi3mr_sas_port_add()
    09e7f9290d631 sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START
    1ea521961c110 net/sched: act_api: fix skb sizing and action leak on reoffload delete
    5fe7f53543e85 net/sched: act_api: conditional notification of events
    4587ff1844ebb net/sched: act_api: don't open code max()
    8611126b2637d rtnl: add helper to send if skb is not null
    52a6bb47ef80d net/sched: act_api: size the RTM_GETACTION reply from the actions
    606c29451264d net/sched: act_api: budget all shared attributes in notify skbs
    99654b651c6d5 net: icmp: avoid invalid transport header access in icmp_send tracepoint
    2a0e7bcff3fa6 drm/cirrus-qemu: Validate BAR0 size during probe
    6a8aa0068d476 drm/cirrus: Use video aperture helpers
    5b269f6682a7f ufs: do not treat unreadable directory blocks as empty
    364e65b2e81ed ufs: Convert ufs_get_page() to ufs_get_folio()
    1ca5c166deeac ufs: Convert ufs_get_page() to use a folio
    f8f3d946fe4b0 ufs: convert to new timestamp accessors
    23d2429aecd6f selftests/cgroup: Fix cg_run_in_subcgroups ignoring arg parameter
    965804b20c0f0 nvme-rdma: fix -EIO cleanup order in queue_rq
    5807a65f301b6 accel/qaic: Address potential out-of-bounds read in resp_worker()
    3fe8a33715265 drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create()
    541fc6f733b32 EDAC/device_sysfs: Use kstrtouint() for poll_msec to prevent truncation
    9a5b471f95dd4 EDAC/igen6: Fix channel address decode for non-hash mode
    c359c9c9c9f8a EDAC/igen6: Fix channel selection hash
    149df8bf827f3 EDAC/igen6: Fix interleave boundary condition
    d019542ed3324 ARM: ensure interrupts are enabled in __do_user_fault()
    ec9f166e6573c ARM: 9484/1: enable interrupts when unhandled user faults are triggered
    881c5b1faf110 Revert "Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU"
    8a69620b23e7b Revert "Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU"
    5b0953f86d658 mm/damon/core: avoid infinite kdamond_merge_regions() internal loop
    258d54030481f of: dynamic: Fix overlayed devices not probing because of fw_devlink
    6fda5c51b8e43 af_unix: Unlink scc_entry in unix_del_edge().
    5a0367bf5ce42 ksmbd: use memcmp() to compare ClientGUIDs
    90703664dbc5a ASoC: meson: aiu: Validate written enum values
    c405b07246bf1 ASoC: topology: Check PCM and DAI name strings before use
    7907a395701b3 ipv4: fib: Don't dump dying fib_info in fib_leaf_notify().
    ff6c5ee77dcc9 bpf: Guard __get_user acesss with access_ok for uprobe_multi data
    00444baa8f74d RDMA/bnxt_re: Proper rollback if the ioremap fails
    dd3c9e1c9858c coresight: platform: defer connection counter increment until alloc succeeds
    43ddbcdc0ed74 sctp: fix err_chunk memory leaks in INIT handling
    6181239115e19 bpf: Mask pseudo pointer values in verifier logs
    7250b6b5ba9b7 Bluetooth: ISO: fix malformed ISO_END/CONT handling
    93580911f02d1 tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream()
    3c0bc7dcc5f92 net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD
    0da8f531336b2 drop_monitor: fix size calculations for 64-bit attributes
    3454c729ee8aa drop_monitor: perform u64_stats updates under IRQ-disabled section
    c4bb894362d22 ppp_async: drop the errored frame instead of resetting its headroom
    16110d1a0e95a wifi: mt76: mt7921: skip unknown CLC firmware records
    740272d46ffc8 wifi: mt76: mt7921: validate CLC firmware records
    5ffe08b81a74d tracing/histograms: Simplify last_cmd_set()
    9cd6d714d3ca0 ksmbd: remove stale channels from all sessions on teardown
    a2ac6a057409d firmware: stratix10-svc: fix FCS SMC call kernel-doc
    3b9aa62d78ce8 netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state
    8138a6951111d ASoC: amd: yc: Add DMI quirk for HyperX OMEN Gaming Laptop 16-ap1xxx
    6b450c277c106 scsi: core: Do not block on tag allocation in scsi_eh_lock_door()
    7c8b6b4d6f9de ASoC: rt5645: Perform the initial jack detect at probe
    64f3ffba03b37 spi: dw: fix wrong RX_SAMPLE_DLY setting after resume
    0737441d20b34 hwmon: (corsair-psu) Fix linear11 calculation
    be2636e1b21fe vhost-scsi: flush backend after device ioctls
    37d743def9b6b ASoC: amd: yc: Add DMI quirk for HP Victus Laptop 16-e1xxx
    887c8a9635dcb Drivers: hv: vmbus: add VTL2 redirect connection ID
    b44293b1598fa ALSA: usb-audio: Add quirk for Corsair Virtuoso (later revision)
    30d1d9f349546 Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame
    d01f1600e8b07 wifi: cfg80211: validate IEs in cfg80211_wext_siwgenie()
    3a4a34a732e8a cifs: validate idmap key payload length
    cf8497dc74b3c powerpc/pseries: Ensure vpa,slb_shadow & dtl are unregistered during crash
    07c121859d49e ice: pass the return value of skb_checksum_help()
    ce1b98bfe0cdb ALSA: hda/realtek: Add mute LED quirk for HP Laptop 14s-dr1xxx
    b0cd3daf4710e ALSA: usb-audio: Add dB map quirk for Razer Barracuda X 2.4
    f4e8477e7af81 phonet: check register_netdevice_notifier() error in phonet_device_init()
    8add43887cca1 drm/gma500: return errors from Oaktrail HDMI I2C reads
    4a19bb1c45667 ksmbd: preserve VFS inherited POSIX ACL mask
    6f6368b20f8c9 wifi: mac80211_hwsim: reject undersized HWSIM_ATTR_TX_INFO
    97aa48806d90e regulator: core: clamp voltage constraints before applying apply_uV
    cf87ef1e62ed3 smb: client: bound dirent name against end of SMB response in cifs_filldir
    063b26637dcb2 wifi: mwifiex: replace one-element arrays with flexible array members
    a273c0336699e ALSA: hda/realtek: Add HDA_CODEC_QUIRK for Samsung 750XBE/730XBE
    9096509e63ddd wifi: iwlwifi: acpi: validate WGDS table revision index
    a5af3b3e76760 ALSA: usb-audio: Add FIXED_RATE quirk for JBL Quantum650 Wireless
    4cfadb2e01566 wifi: iwlwifi: bound aligned TLV advance in FW parser
    e9b2633918c73 ALSA: hda/realtek: Add quirk for HP Pavilion x360
    2750f52b58d92 drm/amd/pm/si: Don't schedule thermal work when queue isn't initialized
    c8e84e292ed4c arm64: kprobes: Allow reentering kprobes while single-stepping
    35f991d685fea wifi: iwlwifi: mvm: fix out-of-bounds tid_data access in BA notif
    0f690fd3b5535 wifi: iwlwifi: mvm: add a check on the tid coming from the firmware
    861bd61732148 arm64: fixmap: Allow 256K early_ioremap() at any offset
    3ea815f401652 wifi: iwlwifi: mvm: fix a possible underflow
    216e469586057 smb/client: flush dirty data before punching a hole
    c3650be82ef6e blk-cgroup: fix leaks and online flag on radix_tree_insert failure
    7e307cbae23d9 ALSA: hda/realtek: Add quirk for HP EliteBook 830 G8 (8AB8) to enable mute LEDs
    05f79cea3b15c wifi: iwlwifi: mvm: fix sched scan IE sizing
    7a2d4efea2c41 wifi: iwlwifi: mvm: fix an off-by-1 boundary check
    0bc25f0a2d1b3 btrfs: fix reloc root cleanup in merge_reloc_roots()
    f9938eb95e2dd wifi: iwlwifi: mvm: validate sta_id in BA window status notif
    091e097c2f829 spi: dw-dma: Wait for controller idle before completing Tx
    a01837ae174a2 btrfs: fix use-after-free on reloc root after error in insert_dirty_subvol()
    6d04872f36e83 btrfs: only account delalloc bytes for regular file inodes in btrfs_getattr()
    8db6d96ac93f4 ALSA: hda/realtek: Fix speakers on MECHREVO WUJIE Series
    631b292f93a3d smb/client: reduce fallocate zero buffer allocation
    f08d7f3c91633 wifi: rsi: validate beacon length before fixed buffer copy
    ecb48c6b9edc7 netfilter: ipset: mark the rcu locked areas properly
    0b61c465ea620 wifi: libipw: fix key index receive bound checks
    fbbdda4753ec3 gpio: dwapb: Mask interrupts at hardware initialization
    6bdf4dcff98df wifi: cfg80211: validate rx/tx MLME callback frame lengths before access
    9c4ace62a7511 ksmbd: validate SID namespace before mapping IDs
    e790f72f2c99e ksmbd: mark invalid session responses as signed
    47b018dba6ec7 ksmbd: find bound sessions during reauthentication
    71be658246c90 wifi: cfg80211: validate assoc response length before status and IE access
    b657cc98d7936 wifi: libertas: reject short monitor TX frames
    5207727e53fba wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers
    a78689e2beed2 wifi: mac80211: validate deauth frame length before reason access
    6acaf2d10ad1c wifi: ralink: RT2X00: init EEPROM properly
    319393151367e ALSA: usb-audio: caiaq: validate EP1 reply lengths
    58b767c74930a ksmbd: fix credit charge calculation for SMB2 QUERY_INFO
    717db0d436875 drm/amdgpu: flush pending RCU callbacks on module unload
    4a69504f5d691 ASoC: amd: yc: Add Alienware m15 R7 AMD to DMIC quirk table
    246098a2b8e88 cachefiles: Fix double fput
    720554c04acba xen/gntalloc: validate grant count before allocation
    7ada9807e3710 freevxfs: don't BUG() on unknown typed-extent type
    ac97b55d9e989 xen/front-pgdir-shbuf: free grant reference head on errors
    edc17db830856 ksmbd: Fix acl.sd_buf memory leak and invalid sd_size error handling
    aa9bd2c8513e4 ksmbd: fix n.data memory leak in ksmbd_vfs_set_dos_attrib_xattr
    43658ba7f701e drm/arm/komeda: fix error handling for clk_prepare_enable() and callers
    c866c3314a685 ksmbd: fix sd_ndr.data memory leak in ksmbd_vfs_set_sd_xattr
    b7f3ee925aee9 netfilter: nf_conntrack_expect: zero at allocation time
    223bf70736b49 drm/arm/malidp: use clk_bulk API in runtime PM resume and suspend
    4cb41f07685f8 btrfs: tree-checker: validate INODE_REF's namelen
    1cc84ca8599b8 spi: core: Abort active target transfer on controller suspend
    2b3c4c381fb23 fbdev: pm2fb: unwind WC setup on probe failure
    69aea5ee498fb eth: mlx5: fix macsec dependency
    42a37f4a89665 rtc: bq32000: add delay between RTC reads
    e6a404ac2a1e8 blk-cgroup: protect iterating blkgs with blkcg->lock in blkcg_print_stat()
    e1b5a13249975 net: au1000: move free_irq out of the close-time spinlocked section
    8efa52abbff2e regulator: da9121: Use subvariant ids in the I2C table
    249be9b5704d4 PCI/sysfs: Use kstrtobool() to parse the ROM attribute input
    aa1ad3c1f3976 PCI/proc: Fix race between pci_proc_init() and pci_bus_add_device()
    4114c357386d7 ksmbd: treat read-control opens as stat opens only for leases
    3df8918da4630 ksmbd: break RH leases before delete-on-close
    9e2cccbbf3b63 ksmbd: start file id allocation at 1
    5c37c7275d757 ksmbd: deny renaming directory with open children
    52bceb4629bf4 ksmbd: apply create security descriptor first
    58a0a1c399a08 ksmbd: treat unnamed DATA stream as base file
    3b64cae18fd79 ksmbd: use connection ClientGUID for lease lookup
    3281d27b4d974 ksmbd: align SMB2 oplock break ack handling
    223a923582afa ksmbd: validate SMB2 lease create contexts
    17699905a3816 ksmbd: fix lease break and ack state handling
    52fa4ba4268ce rtc: aspeed: add AST2700 compatible
    aee4e6de71ca7 f2fs: validate inline dentry name lengths before conversion
    2fdc51228d9a8 md/raid5: let stripe batch bm_seq comparison wrap-safe
    fc0fab337d554 md/raid5: account discard IO
    31e33dcc89652 PCI: mediatek: Protect root bus removal with rescan lock
    5d566ac3a055f PCI: rockchip: Protect root bus removal with rescan lock
    4b69c63cc247f PCI: altera: Protect root bus removal with rescan lock
    aaf4153caed9f PCI: iproc: Protect root bus removal with rescan lock
    53da3557621a3 ALSA: usb-audio: Add quirk for YAMAHA CDS3000
    67a5885f846b0 drm/amdgpu: Use system unbound workqueue for soft IH ring
    89ed4a0ce8beb drm/amdkfd: check find_first_zero_bit before __set_bit on kfd->doorbell_bitmap
    d51841bb5ceee drm/amdkfd: Let driver decide buffer size at AMDKFD_IOC_GET_DMABUF_INFO ioctl
    af84fb6ac0cb7 mfd: rsmu: Add 8a34002 support
    9e54c47bc8407 mfd: tps65219: Make poweroff handler conditional on system-power-controller
    31aab1e3d0f3a leds: pca9532: Don't stop blinking for non-zero brightness
    9f0d6bb71a6bc leds: uleds: Return -EFAULT on copy_to_user() failure
    804302aca977b ALSA: hda/conexant: Add pin config quirk for Lenovo IdeaPad Slim 5 16AKP10
    e26aa709454d4 tls: reject the combination of TLS and sockmap
    1d8050de0ca2a ALSA: usb-audio: Add quirk flags for SC13A
    359b3442e66c5 spi: Add NULL check for spi_get_device_id() in spi_get_device_match_data()
    12e4118b5b4f8 gpio: pisosr: Read "ngpios" as u32
    111b36e7b6dc6 scsi: bfa: Reduce kernel stack usage in bfa_fcs_lport_fdmi_build_portattr_block()
    f58daade5963a fuse: set ff->flock only on success
    5d7637f4d050d HID: hidpp: fix potential UAF in hidpp_connect_event()
    97313af1820db ALSA: hda/realtek: Add quirk for Lenovo Xiaoxin 14 GT
    71fcc902af9c2 sparc: Disable compat support with LLD
    737a90fcd99d1 i3c: mipi-i3c-hci: Tolerate i3c_master_add_i3c_dev_locked() failures in DAA
    cfa09f63e75cf smb: client: fix races in cifsd thread creation
    ea0af96a1b939 net/sched: act_csum: don't mangle UDP tunnel GSO packets
    f948534a042fa e1000e: limit endianness conversion to boundary words
    76e678bdc5170 vsock: use sk_acceptq_is_full() helper in all transports
    af16e8f97c622 ptp: ocp: add shutdown callback
    74dbb85a6a254 net: stmmac: xgmac2: disable RBUE in default RX interrupt mask
    665089ff4f8a2 sparc64: uprobes: add missing break
    01e350c0641f5 Bluetooth: btusb: Add TP-Link UB600 for Realtek 8761BUV
    98deaf6117195 ASoC: rockchip: spdif: Restore regcache cache-only mode on sync failure
    1994a4bdaa7fc ASoC: rockchip: rockchip_pdm: Reorder clock enable sequence
    7f0fd754c7087 ASoC: rockchip: rockchip_pdm: Handle runtime PM resume failures in set_fmt
    72e26293a231f Bluetooth: L2CAP: validate connectionless PSM length
    c8d249de9e97d Bluetooth: btusb: Add support for TP-Link TL-UB250
    e86071156ea99 Bluetooth: btusb: Add Mercusys MA530 for Realtek RTL8761BUV
    fa9d74b9bb0cd spi: xilinx: let transfers timeout in case of no IRQ
    23f05d42f189d hwmon: (pmbus/lm25066) Fix PMBus coefficients for LM5064/5066/5066i
    3c8c0c786f3f0 dmaengine: dw-axi-dmac: fix PM for system sleep and channel alloc
    58d882c723ae9 PCI: Avoid SBR for Qualcomm WCN6855/WCN7850 WiFi, SDX62/SDX65 modems
    f2db152beb06c sctp: Unwind address notifier registration on failure
    5488e2706c584 nvme-fc: Do not cancel requests in io target before it is initialized
    8cd46f24e8411 platform/x86: intel-hid: Add HP ProBook x360 440 G1 to button_array_table
    4ecbe6a5ac28e ata: libata-pmp: add JMicron JMS562 quirk
    58ae36b6f20c7 ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IRH8
    21730289e0af9 ALSA: hda/realtek: Add quirk for HP 255 15.6 inch G9 Notebook PC
    ba180821a4e23 vdpa/ifcvf: handle dev_set_name() failure in ifcvf_vdpa_dev_add()
    a432bf58906b7 net: dsa: qca8k: Add support for force mode for fixed link topology
    86ace5b321108 hwmon: (adt7462) Add of_match_table to support devicetree
    1a6c92aa7242a btrfs: protect sb_write_pointer() with invalidate lock
    d51ba5fe3459b wifi: mt76: transform aspm_conf for pci_disable_link_state
    466e727a3481b platform/x86: dell-laptop: add Inspiron N5110 to touchpad LED quirk table
    7521c2e260855 tls: Flush backlog before waiting for a new record
    f0399b3e21274 net: ibm: emac: mal: fix potential system hang in mal_remove()
    f38f5acb4942f configfs_depend_prep(): pass configfs_dirent instead of dentry
    0d099caebc3e0 xprtrdma: Add request-pool slack for delayed recycling
    b042b4947752d RDMA/rtrs-srv: Fix integer underflow in process_read and process_write
    f556c3d4d64dc NFS: fix eof updates after NFSv4.2 fallocate/zero-range
    ba6c4fc662853 btrfs: tree-checker: validate names in ROOT_REF and ROOT_BACKREF
    81a664ed8b1a4 btrfs: balance: fix potential bg lookup failure in btrfs_may_alloc_data_chunk()
    0d5ad732e4fdc netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack()
    91c97a7969dae ALSA: es18xx: check control allocation before private data setup
    a7625d408f7f0 net: microchip: sparx5: clean up PSFP resources on flower setup failure
    016b8eaca53bf hsr: broadcast netlink notifications in the device's net namespace
    8af61d5bd87fd net: cpsw_new: unregister devlink on port registration failure
    31377675c3d75 bpf: NUL-terminate replaced sysctl value
    b1e111f93deef RDMA/mlx5: Fix state and counter desync on loopback enable failure
    e9bbb5f5349ef RDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz()
    2095eceaedddf wifi: nl80211: Increase ie_len size to prevent truncated IEs in new peer notifications
    641be20110cdf drm/amdkfd: Unwind debug trap enable on copy_to_user failure
    5eade80288a03 ipmi: si: Use platform_get_irq_optional() to retrieve interrupt
    3b389d479f831 ALSA: hda/realtek: Add quirk for ASUS VivoBook X509DAP
    fd36e829eb3c1 clk: keystone: don't cache clock rate
    0e646d3912ff5 net/mlx5: E-Switch, align disable sequence with switchdev-to-legacy transition
    025293b9d0cf6 RDMA/irdma: Fix typo in SQ completions generation
    4a1b0a4c5acbe drm/amdgpu: fix buffer overflow during vBIOS update
    9b5cb2e4eb297 drm/amd/pm: bound pp_dpm_set_pp_table() memcpy
    090b51e2dabf8 drm/amdkfd: fix UAF race in destroy_queue_cpsch
    fec259e46d443 xhci: Prevent queuing new commands if xhci is inaccessible
    97c2c0b1233b3 thermal/drivers/qcom/tsens: Atomic temperature read with hardware-guided retries
    c996faba71fc4 dpaa2-switch: fix handling of NAPI on the remove path
    d0e54098c072b net: dsa: sja1105: flower: reject cross-chip redirect
    259ad6093204b dpaa2-switch: fix the error path in dpaa2_switch_rx()
    dc626f2abb305 dpaa2-switch: rework FDB management on the bridge leave path
    2922cf2583e59 ALSA: seq: oss: Reject reads that cannot fit the next event
    a92d497bc768e ASoC: codecs: rk3328: Use managed GPIO and clock helpers
    2f7d0ec8c10dc ntfs3: fix out-of-bounds read in ntfs_dir_emit() and hdr_find_e()
    d564a885219a6 fs/ntfs3: validate index entry key bounds
    fdc9f65aa6631 fs/ntfs3: preserve non-DOS attribute bits in system.dos_attrib
    fce90e41601e3 iommu/rockchip: disable fetch dte time limit
    356a4983340df net: wwan: t7xx: Add delay between MD and SAP suspend
    f76a39c45182d net: qrtr: fix node refcount leak on ctrl packet alloc failure
    6b6be7328f2b2 ACPI: PCI: Clear _DEP dependencies after PCI root bridge attach
    6d29b91164424 ata: ahci: fail probe if BAR too small for claimed ports
    0ccf0d4dddbe5 ASoC: codecs: pcm3168a: Drop CONFIG_PM-conditional preproc directive
    43cb6295c3a6d ASoC: qcom: q6apm: return error code to consumers on failures
    b4ef30f1d107a wifi: ath11k: fix invalid data access in ath11k_dp_rx_h_undecap_nwifi
    b511b56f63daa net: ibm: emac: Reserve VLAN header in MJS limit
    bc6e3444a6d7a libbpf: Also reset {insn,data}_cur on realloc failure
    da92b1a8560a5 iio: accel: mma8452: switch to non-devm request_threaded_irq()
    d85b5591ea459 perf/ftrace: Fix WARNING in __unregister_ftrace_function
    2c2d63f410557 iio: light: stk3310: Deal with the ps interrupt issue in PM
    b5fa000eaf6bb mmc: renesas_sdhi: Add OF entry for RZ/G2E SoC
    3657383a477ab tracing: Disable KCOV instrumentation for trace_irqsoff.o
    345b1dfa73be0 mmc: renesas_sdhi: Add OF entry for RZ/G2N SoC
    cfc0b65a29b41 mmc: davinci: fix mmc_add_host order in probe
    86ac37d42a8b1 soundwire: only handle alert events when the peripheral is attached
    c8abef7c07c10 gfs2: page poisoning fix
    26532163b3cef soundwire: dmi-quirks: Disable ghost Realtek devices
    5cdfd851fa205 libbpf: Add __NR_bpf definition for LoongArch
    1bdf84bbe14a7 ASoC: Intel: catpt: Complete coredump handling
    feb1ad41281ae drm/nouveau/gsp: add SEC2 to GA100 chip table
    c6ad6451f88f0 scripts: modpost: detect and report truncated buf_printf() output
    74bd1f05d9ba2 host1x: bus: Fix missing ops null check in error teardown
    37acac6d2d6d3 pinctrl: renesas: rzv2m: Use -ENOTSUPP instead of -EOPNOTSUPP
    1ca2411d90c85 hfs: rework hfsplus_readdir() logic
    38ee32a9ace6f ACPICA: add boundary checks in two places
    50a11e2f3dc8a ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources()
    08c5dee5da1d8 ACPICA: Fix NULL pointer dereference in acpi_ns_custom_package()
    e301b6132be06 ACPICA: Enhance OEM ID and Table ID validation in acpi_ex_load_table_op()
    26dd27000e954 ACPICA: Add validation for node in acpi_ns_build_normalized_path()
    2442772fd79a4 ACPICA: Add package limit checks in parser functions
    254e304f68dc0 ACPICA: validate handler object type in two places
    72d75287bc6d6 ACPICA: Improve argument parsing in acpi_ps_get_next_simple_arg()
    4532c9cf006bb ACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op)
    c2cf936b07b0a ACPICA: Prevent adding invalid references
    6e0d26e6ec903 ACPICA: validate byte_count in acpi_ps_get_next_package_length()
    7d97ecf2a4c7a ACPICA: add boundary checks in acpi_ps_get_next_field()
    63ca6f67816a2 ACPICA: Fix use-after-free in acpi_ds_terminate_control_method()
    4c22c9842c53b ACPICA: Fix condition check in acpi_ps_parse_loop()
    121352772b326 drm/amd/pm/si: Fix updating clock limits from power states
    c8bc44a1d86d5 net: thunderx: fix PTP device ref leak in nicvf_probe()
    f601ec5c92b32 ipv6: addrconf: fix temp address generation after prefix deprecation
    f5d3088e1a9f3 net: hsr: require valid EOT supervision TLV
    52c61420923e4 ALSA: usb-audio: Add quirk for Novation Mininova
    4761493dd6634 irqchip/gic-v4: Don't advertise VLPIs if no ITS is probed
    566b1fc9a4fb8 iio: adc: qcom-spmi-iadc: balance enable_irq_wake() on driver unbind
    df904e01b710f mips: cps: Assemble jr.hb with an R2 ISA level
    cf82a9d15ae69 drm/panel: simple: Add AM-1280800W8TZQW-T00H
    a643ce49ddcdb thermal/drivers/tegra/soctherma: Switch to devm cooling device registration
    99a1ae9c1e058 clk: socfpga: agilex: implement l3_main_free_clk
    ff8e9b793effc s390/zcore: Removed unused variables
    2e6b5c4b59351 rds: annotate data-race around rs_seen_congestion
    65fae4b42269d rds: filter RDS_INFO_* getsockopt by caller's netns
    4892962af7896 netlabel: fix IPv6 unlabeled address add error handling
    4cf3a3f61c88c wifi: rtw89: pci: enable LTR based on pcie control register
    df2f6c977a94a rcu-tasks: Fix possible boot-time tests failed for the call_rcu_tasks()
    47850643464ba char/nvram: Remove redundant nvram_mutex
    cd4f278f30021 usb: host: add ARCH_AIROHA in XHCI MTK dependency
    03ed804a0ddc3 serial: 8250: fix possible ISR soft lockup
    99fcf2d8daf24 usb: gadget: aspeed_udc: avoid past-the-end iterator in dequeue
    c055449f384b1 USB: cdc-acm: start bulk-IN polling when ALWAYS_POLL_CTRL is set
    a018d4195114c usb: gadget: goku_udc: avoid NULL deref of dev->driver in INT_USBRESET log
    d0291fb4d9198 usb: core: hcd: fix possible deadlock in rh control transfers
    517c353e5358b usbip: vhci_hcd: fix NULL deref in status_show_vhci
    28d1f6aa14f59 isofs: handle set_blocksize failures
    29186cd17bb5f omfs: handle set_blocksize failures
    0451927f42b02 hpfs: handle set_blocksize failures
    87d6852f06c5a jfs: handle set_blocksize failures
    f83e416c2242f qnx4: handle set_blocksize failures
    8e788c14b72d6 minix: handle set_blocksize failures
    8a96010d230a8 bfs: handle set_blocksize failures
    ea8a4a9f3cc10 affs: handle set_blocksize failures
    df9dac4dbe557 ntfs3: handle set_blocksize failures
    ceb89faa8ead6 befs: handle set_blocksize failures
    07a348d48e589 net/rds: Don't sleep inside rds_ib_conn_path_shutdown
    4fc0430de152f net/sched: sch_drr: make cl->quantum lockless
    f0018acf0b66f net: bridge: remove stale rcu_barrier() in br_multicast_dev_del()
    513cab0e49ebe net: usb: qmi_wwan: add MeiG SRM813Q
    ac8cc00c0fb60 nvme-core: align fabrics_q teardown with admin_q in nvme_free_ctrl
    b4d8264ca70f3 bitfield: wire __bf_shf to __builtin_ctzll
    85cbb946b9c59 thunderbolt: Verify Router Ready bit is set after router enumeration
    5428342dd66ed thunderbolt: Increase timeout for Configuration Ready bit
    c0742f23ec13f firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size
    1bbe431fc5970 firmware: arm_scmi: Validate SENSOR_UPDATE payload size
    7496466121155 thunderbolt: Improve multi-display DisplayPort tunnel allocation
    a13e408c554be thunderbolt: Don't access path config space on Lane 1 adapters in tb_switch_reset_host()
    de4b7f9bfee2c bridge: Add missing READ_ONCE() annotations around FDB destination port
    4904370513ad6 9p: use kvzalloc for readdir buffer
    c2319e1cfb78c arm64/daifflags: Make local_daif_*() helpers __always_inline
    b6b5175b4da92 9p: invalidate readdir buffer on seek
    3167b620815c4 sched/fair: Reject misfit pulls onto busy SMT siblings on asym-capacity
    d04cff45c9d2a ALSA: usx2y: Drain pending US-428 pipe-4 output commands
    3d2ddfc9b361b drm/amdkfd: Check bounds on allocate_doorbell
    e2bef0f168be4 drm/amdkfd: Fix OOB memory exposure in get_wave_state()
    25e1b29ecc8da drm/amdkfd: Check bounds for allocate_sdma_queue restore_sdma_id
    c1797a31c5fe8 PCI: Wait for device readiness after D3hot -> D0uninitialized transition
    bb42eed92e401 mailbox: Make mbox_send_message() return error code when tx fails
    91c6fdcdf22bd RDMA/mlx5: Use QP port when decoding responder CQEs
    0a996ad14fbbb media: imon: Add iMON VFD HID OEM v1.2 key mappings
    c4f2d6c924263 crypto: atmel-ecc - add support for atecc608b
    bec33e03d2244 crypto: ecc - Unbreak the build on arm with CONFIG_KASAN_STACK=y
    3b3ae5517658a scsi: pm8001: Reject non-fatal dump when controller is crashed
    cb789c65aa703 scsi: pm8001: Reject firmware update in fatal error state
    e4fe7a56992ee clk: samsung: exynos850: mark APM I3C clocks as critical
    959913c0d51e1 soundwire: intel: Move suspend tracking from trigger to pm suspend
    c0cbb58df7d21 drivers/of: validate status properties in reconfig state changes
    a6ce8632fbdc0 integrity: Check for NULL returned by asymmetric_key_public_key
    32ff92cc9f91e net: dsa: realtek: rtl8365mb: add support for RTL8367SB
    72bf6944e336d wifi: rtw89: phy: check length before parsing PHY status IE
    b7afb0c24a761 media: video-i2c: use vb2_video_unregister_device on driver removal
    3d2ac2f6ed2e2 drm/gud: Add RCade Display Adapter VID/PID pair
    9eb4ca55f5b61 net: phy: motorcomm: use device properties for firmware tuning
    bfdb4d0fab516 hfsplus: rework hfsplus_readdir() logic
    03505f0c7c277 PCI: intel-gw: Enable clock before PHY init
    dc4fd6c0d9323 drm/amd/display: Fix CRC open failure during active rendering
    3c5e3e5badbf0 mmc: davinci: avoid NULL deref of host->data in IRQ handler
    a8283f7d93f0d mmc: core: Add validation for host-provided max_segs
    120c4c6e07f94 ASoC: ti: omap3pandora: update board check to use DT compatible
    38570c33dc367 drm/bridge: tc358768: Set pre_enable_prev_first for reverse order
    1b793329699b5 clk: renesas: cpg-mssr: Add number of clock cells check
    827c30511b02a crypto: omap - add omap_des_unregister_algs helper
    8c37bc8d6a6f7 crypto: ixp4xx - fix buffer chain unwind on allocation failure
    c75237294a70d media: em28xx-video: fix missing res_free() on init_usb_xfer failure
    0d252fe2012d9 net: dsa: mv88e6xxx: enable .rmu_disable() for 6320 family
    2381e99226b53 net: dsa: mv88e6xxx: define .pot_clear() for 6321
    c43bc7bd2e68a PCI: switchtec: Add Gen6 Device IDs
    d2c97bf5b1ff2 net: dsa: mv88e6xxx: fix number of g1 interrupts for 6320 family
    b6327023dcc74 media: dm1105: fix missing error check for dma_alloc_coherent
    bed89ef877c9e thunderbolt: Don't create multiple DMA tunnels on firmware connection manager
    83d1af5b1b6e6 thunderbolt: Set tb->root_switch to NULL when domain is stopped
    b61a4ae2ec6a0 thunderbolt: Keep the domain reference while processing hotplug
    57359bb31526c thunderbolt: Keep XDomain reference during the lifetime of a service
    9d6657674919b thunderbolt: Release request if tb_cfg_request() fails in __tb_xdomain_response()
    f5e6286350c86 media: rc: mceusb: Add support for 04eb:e033
    d9fa79ccd0920 spi: spi-qcom-qspi: Fix incomplete error handling in runtime PM
    71ab6046cb940 soundwire: validate DT compatible before parsing it
    827d1eebd5f24 bridge: Do not suppress ARP probes and DAD NS unconditionally
    b9efc7bdadca8 firmware: stratix10-svc: change get provision data to async SMC call
    ad65a12f6a0a4 kcsan: Silence -Wmaybe-uninitialized when calling __kcsan_check_access()
    0b58a5ac9170a wifi: rtw88: Add NULL check for chip->edcca_th in rtw_fw_adaptivity_result()
    adf23deb60387 wifi: mac80211: always allow transmitting null-data on TXQs
    8fe5eb7b68d76 wifi: nl80211: reject beacons with bad HE operation
    5a46a1b5dcbae hfsplus: fix issue of direct writes beyond end-of-file
    0f8a92c198893 PCI: Stop setting cached power state to 'unknown' on unbind
    5a99d68c32927 tools/nolibc: avoid call to wcslen() in _start_c() inserted by clang
    e9260bc729335 tee: optee: Allow MT_NORMAL_TAGGED shared memory
    11c633d24780a usb: gadget: udc: skip pullup() if already connected
    8c77312728d07 ima: return error early if file xattr cannot be changed
    c6dfcaea6d3ae ALSA: usb-audio: Propagate write errors in generic mixer put callbacks
    5a7c355f83c63 drm/amd/pm: Check SMUv13.0.6/12 metrics integrity
    e0ae7248bae11 drm/panel: jadard-jd9365da-h3: set prepare_prev_first
    3ad0c3cf4a163 drm/amd/display: Fix DPMS using partially updated pipe context
    82f51c4addcac bus: fsl-mc: wait for the MC firmware to complete its boot
    30cd0f44e983e drm/gem: Consider GEM object reclaimable if shrinking fails
    892f643b141ae ksmbd: fix use-after-free in oplock break notification

Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
---
 .../linux/linux-yocto-rt_6.6.bb               |  6 ++--
 .../linux/linux-yocto-tiny_6.6.bb             |  6 ++--
 meta/recipes-kernel/linux/linux-yocto_6.6.bb  | 28 +++++++++----------
 3 files changed, 20 insertions(+), 20 deletions(-)

Thank you for your submission. Patchtest identified one
or more issues with the patch. Please see the log below for
more information:

---
Testing patch /home/patchtest/share/mboxes/meta-scarthgap-03-07-linux-yocto-6.6-update-to-v6.6.159.patch

FAIL: test commit message user tags: Mbox includes one or more GitHub-style username tags. Ensure that any "@" symbols are stripped out of usernames (test_mbox.TestMbox.test_commit_message_user_tags)

PASS: test CVE check ignore (test_metadata.TestMetadata.test_cve_check_ignore)
PASS: test Signed-off-by presence (test_mbox.TestMbox.test_signed_off_by_presence)
PASS: test auh changelog truncation notice (test_mbox.TestMbox.test_auh_changelog_truncation_notice)
PASS: test author valid (test_mbox.TestMbox.test_author_valid)
PASS: test commit message presence (test_mbox.TestMbox.test_commit_message_presence)
PASS: test lic files chksum modified not mentioned (test_metadata.TestMetadata.test_lic_files_chksum_modified_not_mentioned)
PASS: test max line length (test_metadata.TestMetadata.test_max_line_length)
PASS: test mbox format (test_mbox.TestMbox.test_mbox_format)
PASS: test non-AUH upgrade (test_mbox.TestMbox.test_non_auh_upgrade)
PASS: test shortlog format (test_mbox.TestMbox.test_shortlog_format)
PASS: test shortlog length (test_mbox.TestMbox.test_shortlog_length)
PASS: test target mailing list (test_mbox.TestMbox.test_target_mailing_list)

SKIP: pretest pylint: No python related patches, skipping test (test_python_pylint.PyLint.pretest_pylint)
SKIP: pretest src uri left files: Patch cannot be merged (test_metadata.TestMetadata.pretest_src_uri_left_files)
SKIP: test CVE tag format: No new source patches introduced (test_patch.TestPatch.test_cve_tag_format)
SKIP: test Signed-off-by presence: No new source patches introduced (test_patch.TestPatch.test_signed_off_by_presence)
SKIP: test Upstream-Status presence: No new source patches introduced (test_patch.TestPatch.test_upstream_status_presence_format)
SKIP: test bugzilla entry format: No bug ID found (test_mbox.TestMbox.test_bugzilla_entry_format)
SKIP: test lic files chksum presence: No added recipes, skipping test (test_metadata.TestMetadata.test_lic_files_chksum_presence)
SKIP: test license presence: No added recipes, skipping test (test_metadata.TestMetadata.test_license_presence)
SKIP: test pylint: No python related patches, skipping test (test_python_pylint.PyLint.test_pylint)
SKIP: test series merge on head: Merge test is disabled for now (test_mbox.TestMbox.test_series_merge_on_head)
SKIP: test src uri left files: Patch cannot be merged (test_metadata.TestMetadata.test_src_uri_left_files)
SKIP: test summary presence: No added recipes, skipping test (test_metadata.TestMetadata.test_summary_presence)

---

Please address the issues identified and
submit a new revision of the patch, or alternatively, reply to this
email with an explanation of why the patch should be accepted. If you
believe these results are due to an error in patchtest, please submit a
bug at https://bugzilla.yoctoproject.org/ (use the 'Patchtest' category
under 'Yocto Project Subprojects'). For more information on specific
failures, see: https://wiki.yoctoproject.org/wiki/Patchtest. Thank
you!