From patchwork Fri Aug 7 16:28:56 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Bruce Ashfield X-Patchwork-Id: 94774 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 45171C5AC7A for ; Fri, 7 Aug 2026 16:29:10 +0000 (UTC) Received: from mail-qt1-f169.google.com (mail-qt1-f169.google.com [209.85.160.169]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.46457.1786120147033623352 for ; Fri, 07 Aug 2026 09:29:07 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=bmW9yqed; spf=pass (domain: gmail.com, ip: 209.85.160.169, mailfrom: bruce.ashfield@gmail.com) Received: by mail-qt1-f169.google.com with SMTP id d75a77b69052e-51c928bf172so22956161cf.3 for ; Fri, 07 Aug 2026 09:29:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786120146; x=1786724946; darn=lists.openembedded.org; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:from:to:cc:subject :date:message-id:reply-to:content-type; bh=E9INAHdKHApJNy8bd6aT0bAfnr8Fs7Z7pqBsKasx1OQ=; b=bmW9yqedi4xE74Id332OTW2bW3o4bL48NSh1fGSXKk0ns8n0xnRWu4tCZPyqNS3xa3 xNTMyqc6SHRnodgP83SnsSxkOzgN1zaqPTEAJHLPlyRuCnNGAJopjmL3ngjuYakfVa/c 3ARzFaeomxw0wAYJ/YwA1mHG7hY7r+jIZnvIVOBlonP5bIX8uNbWmw2zCb0BBBte4nxB 2MfiXXuYnC0tWvmhnDKHd7OvEaRY2QMrv4R+gqBrsl4GKLYpsKDo1q9asRLQsIoXX4fz CIinuR4qlkEGKpstfhLEt98ZWkCiFRczyhJLryPk7wyIkFTpIZmlzczdO05QFJKS1JYK AeBg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786120146; x=1786724946; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=E9INAHdKHApJNy8bd6aT0bAfnr8Fs7Z7pqBsKasx1OQ=; b=DBHX2aly3wagisNrb3pHAfaLa2k6XdB41XN3JQcyzWWn5ctnwD0yOH0WduRJMESGa1 HarHh19JWjG64wtGf8RAKPjJWQ0Km3ZzZc0q4Ap9ADEwI24COQZErIb9n1rFvndV8REa cTRL/4dd552PI90ehMA6mMPv7xeOVhGFtfmSEjyflEu6ISD5RG0icj+Yqjw8eEUKx/pP SPyvdhHL9XtMAlZ6gfozjRB89lapZ4lIr/ctl+JpR/N5ES5KWSj4BNZgoseHLcximKfs 0Vkv/5F8iOhjZn3ETa80zg8+VwfpJ7mUZF7xoMXycX8cPg6teqH7AEzmAPLZ5IvVmNj+ m3uw== X-Gm-Message-State: AOJu0YyoXTGZNKRf6cq89RlUaPLpGbkG/H8ukHZwSlktmOwJUpfb/R2u LRjB9olMxVap4eL46gm15F57EwkeJxSZUch3JDoGJnsbYq+TdBL2kXgvqzOWDTFM X-Gm-Gg: AR+sD13SlCFnnR0eg3YbMFkz7LFqlJehMd/kz8OkFXtOLiJFHA1ZQNR0GE/IZjo/Ay2 rgcGQ27XAgX6Xnbc7maU38yFsRU7g5UFPWucCKvsBDk/qnVmgzCxvFJNpoXUFqCgdNBjBFtjjFp JOJ/6StrpKvODUHWNjyDNRy8HRa5UFfMVDAQx4eKSKwO8GWCucicWSLMz5TIi5MI5ApbRiDeFei hQzlJ3WMEriI3+lqhuapMHxcfwORkL8mcBROcDz0yrVttJtKfHWu/jl5To50Gfqy2AaJE0OqKzp N3StK7sU3pXgQYU/3Wi+2q/zzHM74iMJVVnhMCzlwFPVvn9ctAU0eE/quhDqabj+oRe4u6Rxb/i AkHpJTe+nNC97j38cHQ40TO42Sf7BYHBXbWtbanPpvbNCQGBQFzED5ZLuopzmeBJYjUK01sOZ51 kTrlHQqm61nmD2Jm/5MODZZJTaUuPeFQKZeG1ODvfY3T1SnD/rC+VwMzra8mOz5Eg/IRpLxh6vO bQn5saMDxH3o/Rqr5WE3HuV4n6QPurfHityi0beTXkBAgcX1aix8wBa/Rtl7xmniCGZ+l81vrZG p42k4N6NJ6SHbllyaR9DmsDC43xSXT3W+rxYo7TS5YU442jB1PgxLffSU1S86oZKAzFEkBAsiuS /7uoFgg== X-Received: by 2002:a05:622a:228d:b0:516:d699:a99b with SMTP id d75a77b69052e-52ce61f545cmr267075331cf.40.1786120144706; Fri, 07 Aug 2026 09:29:04 -0700 (PDT) Received: from bruce-XPS-8940.localdomain (pool-174-112-62-108.cpe.net.cable.rogers.com. [174.112.62.108]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-908a92fed68sm12521756d6.31.2026.08.07.09.29.03 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 07 Aug 2026 09:29:03 -0700 (PDT) From: bruce.ashfield@gmail.com To: richard.purdie@linuxfoundation.org Cc: openembedded-core@lists.openembedded.org Subject: [meta][PATCH 01/04] linux-yocto/6.18: update to v6.18.41 Date: Fri, 7 Aug 2026 12:28:56 -0400 Message-ID: <20260807162900.2623274-2-bruce.ashfield@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260807162900.2623274-1-bruce.ashfield@gmail.com> References: <20260807162900.2623274-1-bruce.ashfield@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 07 Aug 2026 16:29:10 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/243018 From: Bruce Ashfield Updating linux-yocto/6.18 to the latest korg -stable release that comprises the following commits: 2fe596715f840 Linux 6.18.41 6a7ecc25abe6f posix-cpu-timers: Prevent UAF caused by non-leader exec() race 9f7268928ac0c posix-timers: Expand timer_[re]arm() callbacks with a boolean return value 221fc2f4d0eda Linux 6.18.40 478c4d24193fe RDMA/bnxt_re: Avoid repeated requests to allocate WC pages b87cbd4d198ae RDMA/bnxt_re: Initialize dpi variable to zero 81e6faa5b6405 ksmbd: fix durable reconnect double-bind race in ksmbd_reopen_durable_fd 1badb6866482d perf callchain: Handle multiple address spaces 275eb39930947 seqlock: fix scoped_seqlock_read kernel-doc 453cb79a15641 perf inject: With --convert-callchain ignore the dummy event for dwarf stacks 2764d031efd6d PCI: Fix Resizable BAR restore order 2fb74141ec54e PCI: Fix BAR resize rollback path overwriting ret 7425e7d82cb93 perf symbol: Fix ENOENT case for filename__read_build_id a888f3d5970ff pinctrl: airoha: fix pinctrl function mismatch issue 267fdd9b6530c bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized 779480ea79551 iommufd: Move vevent memory allocation outside spinlock 73b5d5cb1f5a1 iommufd: Propagate allocation failure in iommufd_veventq_deliver_fetch() ea7a76d7d614b KVM: arm64: nv: Re-translate VNCR before injecting abort 459adfc6cd35f KVM: arm64: Deduplicate ASID retrieval code 9d360fb820a3b samples/damon/mtier: fail early if address range parameters are invalid ec976851ad934 mm/damon/core: trace esz at first setup 3b91c35961fa5 mm/damon/core: always put unsuccessfully committed target pids ba37cd4d8a751 KVM: arm64: Fix propagation of TLBI level in kvm_pgtable_stage2_relax_perms() 19d9996435db8 KVM: arm64: Ensure level is always initialized when relaxing perms c3a3d39867190 btrfs: fix incorrect buffered IO fallback for append direct writes 998ee7f01ecfa btrfs: fix false IO failure after falling back to buffered write a4497a122e27f crypto: qat - fix restarting state leak on allocation failure 6c78081d047c5 btrfs: remove folio parameter from ordered io related functions 1a648c50a5057 btrfs: replace for_each_set_bit() with for_each_set_bitmap() 99d4ae3fbb5b1 btrfs: concentrate the error handling of submit_one_sector() 382fd8004cc60 crypto: atmel-sha204a - fail on hwrng registration error in probe path 952db4b985c79 usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile 69faa3779250d usb: gadget: f_fs: initialize reset_work at allocation time 8a2fdbf92cdc7 functionfs: use spinlock for FFS_DEACTIVATED/FFS_CLOSING transitions 5fb0b09180a0f functionfs: switch to simple_remove_by_name() 4744f07f6bb7c functionfs: don't bother with ffs->ref in ffs_data_{opened,closed}() 901c036cf6254 functionfs: don't abuse ffs_data_closed() on fs shutdown c3e6860252102 new helper: simple_remove_by_name() 509b51327320b usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect() b78826a657998 usb: atm: ueagle-atm: remove function entry/exit debug messages 6e5ef54b884f4 usb: atm: ueagle-atm: use dev_dbg() for 'device found' message 41a4e80d5af04 usb: dwc3: fix dwc3_readl() and dwc3_writel() calls in dwc3_ulpi_setup() e534790c4c272 usb: dwc3: Support USB3340x ULPI PHY high-speed negotiation. bce232923aa9e xfs: use bio_reuse in the zone GC code adadb181ad42a xfs: only log freed extents for the current RTG in zoned growfs 47c0e07433021 xfs: add a xfs_groups_to_rfsbs helper 57454944737f3 bpf: Allow LPM map access from sleepable BPF programs 8fccaeeb9e9c5 bpf: Consistently use bpf_rcu_lock_held() everywhere 0b92ad64d6e4b bpf: Keep dynamic inner array lookups nullable c447be8d88c30 bpf: Introduce struct bpf_map_desc in verifier dccb3c557879d bpf: Consistently use reg_state() for register access in the verifier 60eed44674295 xfs: initialize iomap->flags earlier in xfs_bmbt_to_iomap 607217f7ad419 hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length 7676ea09beb5d hfs/hfsplus: prevent getting negative values of offset/length f9b4b03ccc9c6 proc: protect ptrace_may_access() with exec_update_lock (part 1) 07bf18dc63f78 seqlock: Change do_task_stat() to use scoped_seqlock_read() c897fd63762e0 seqlock: Introduce scoped_seqlock_read() 497c6bae51674 proc: protect ptrace_may_access() with exec_update_lock (FD links) 903d78e5aca77 proc: rename proc_setattr to proc_nochmod_setattr b56400364aed5 ksmbd: validate NTLMv2 response before updating session key 74c2f0ffb81c8 ksmbd: Use HMAC-MD5 library for NTLMv2 51c5f7e84cfed ksmbd: Use HMAC-SHA256 library for message signing and key generation bd27d9504d200 ksmbd: Use SHA-512 library for SMB3.1.1 preauth hash 427faaa52b0b3 ksmbd: track the connection owning a byte-range lock 6a37bc484f12e ksmbd: centralize ksmbd_conn final release to plug transport leak c7c884a1305aa ksmbd: fix path resolution in ksmbd_vfs_kern_path_create e205f3e7e8c31 ksmbd: use opener credentials for FSCTL mutations 90a93fb3230c9 cifs: SMB1 split: Add some #includes ff943e1f3d31f cifs: SMB1 split: Rename cifstransport.c 36da806f7fbae Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() 6d0eeebe22ba7 Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister ef382a6baf0a9 media: nxp: imx8-isi: Fix use-after-free on remove 4278953ff0cd4 media: nxp: imx8-isi: use devm_pm_runtime_enable() to simplify code 49cd5ac6de8de crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() 4b51ee8a40fe4 staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr() 5d76bc296bb58 staging: rtl8723bs: fix spaces around binary operators 48323ebaeeeed staging: rtl8723bs: core: move constants to right side in comparison 73cc54326de45 PCI: Skip Resizable BAR restore on read error f33837a754473 PCI: Move Resizable BAR code to rebar.c 2242c75b63286 PCI: Add kerneldoc for pci_resize_resource() 4b5322f0002aa PCI: Fix restoring BARs on BAR resize rollback path c18646165f21f PCI: Free saved list without holding pci_bus_sem 534f20cdddc31 PCI: Try BAR resize even when no window was released dbb1d8507dd92 PCI: Change pci_dev variable from 'bridge' to 'dev' 0d1c263e6fd73 PCI/IOV: Adjust ->barsz[] when changing BAR size 0dfad346c293e PCI: imx6: Configure REF_USE_PAD before PHY reset for i.MX95 e53d54b92f0c2 PCI: imx6: Fix reference clock source selection for i.MX95 1228926e1e4d6 binder: cache secctx size before release zeroes it 79ac87bb1a4c8 binder: Use LIST_HEAD() to initialize on stack list head 7ed120b1a007b vfio/mlx5: Fix racy bitfields and tighten struct layout f8272331da877 ALSA: hda/tas2781: Cancel async firmware request at unbind 6438d0707087e firmware_loader: Add cancel helper for async requests 1ed7ff33cfc8c ALSA: scarlett2: Update offsets for 2i2 Gen 4 firmware 2417 ad5c5bdb0f580 ALSA: scarlett2: Allow selecting config_set by firmware version 2745574697ee4 iio: hid-sensor-rotation: Fix stale or zero output when reading raw values 7f680924c5c2b ACPI: NFIT: core: Fix possible deadlock and missing notifications cf5f93228e7ab ACPI: NFIT: core: Use devm_acpi_install_notify_handler() d57d2aae87b23 ACPI: bus: Introduce devm_acpi_install_notify_handler() 34f4d0e4e5065 ACPI: driver: Check ACPI_COMPANION() against NULL during probe 3b2628f7682ae ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup 83f29da85dc9d crypto: xilinx-trng - Remove crypto_rng interface f84c0bae0e8dd mmc: sdhci-esdhc-imx: fix resume error handling 174dc8103ab7b mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend 5b8f11cbe8ad5 mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend 4f96903e2fd22 mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt aa276aa6cbfbc mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore 52990f6b57526 mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume eefcd3ca245c1 mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore c02237966c199 mmc: sdhci-of-dwcmshc: check bus clock enable result in the probe() method 8d94498cc4453 mmc: block: fix RPMB device unregister ordering cf7258f57d180 mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout 4b5de4007e5bf mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout de2bc884d8870 mtd: rawnand: fsl_ifc: return errors for failed page reads bf9848a22a8e5 mmc: vub300: defer reset until cmd_mutex is unlocked 04ebd3766861f mtd: mchp23k256: use SPI match data for chip caps ac2d9f6b4f905 mtd: onenand: samsung: report DMA completion timeouts a59cfa165aee3 wifi: mwifiex: fix permanently busy scans after multiple roam iterations b8df3a993f690 wifi: mac80211: free ack status frame on TX header build failure 90576bd6921a9 wifi: ieee80211: validate MLE common info length 584657c5fc58d wifi: cfg80211: validate EHT MLE before MLD ID read 3c1e92f75e11a powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access() 82753ac86cb3d reset: sunxi: fix memory region leak on ioremap failure 3fb7edd2018bb ipvs: reload ip header after head reallocation d4ec18f48ce78 ipvs: fix more places with wrong ipv6 transport offsets 39151f0708c84 memstick: ms_block: reject a card that reports too many blocks a75d2b5249e38 macsec: fix promiscuity refcount leak in macsec_dev_open() fd701fc0d0652 llc: fix SAP refcount leak when creating incoming sockets 6744ab60dfac5 Bluetooth: btrtl: validate firmware patch bounds dbd14f736be02 net: openvswitch: reject oversized nested action attrs 6926d13865aaa regulator: ltc3676: Fix incorrect IRQSTAT bit offsets 688bd4c6144d2 riscv: vdso: Do not use LTO for the vDSO 55b26abb1fa1e wifi: brcmfmac: cyw: fix heap overflow on a short auth frame bdc0b8bfdc142 wifi: mac80211: fix memory leak in ieee80211_register_hw() 65446b85595a4 wifi: mwifiex: fix roaming to different channel in host_mlme mode 816559409e340 wifi: rt2x00: avoid full teardown before work setup in probe 262da8b6ea03d net/mlx5: free mlx5_st_idx_data on final dealloc 9b8df4da2cf79 powerpc/pseries: fix memory leak on krealloc failure in papr_init afa0db5322c5f mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume d94160a5d1ac3 selftests/landlock: Fix screwed up pointers in the scoped_signal_test ba481c0b53760 selftests/landlock: Skip scoped_signal subtest with MSG_OOB if not available 4ff3960f35271 pmdomain: imx: Fix i.MX8MP VC8000E power up sequence 9a0464fcfae4f pmdomain: imx: Fix i.MX8MP power notifier c844b7d9a9586 cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed 8131a91fe2dea selftests/rseq: Fix a building error for riscv arch 3dfec7490f3a2 s390/mm: Fix type mismatch in get_align_mask(). c6b4d454865a8 s390/diag: Add missing array_index_nospec() call to memtop_get_page_count() fad36954b2959 tracing/osnoise: Call synchronize_rcu() when unregistering eadd0c2c76aee riscv: Prevent NULL pointer dereference in machine_kexec_prepare() 38cc4867540ae drbd: reject data replies with an out-of-range payload size 91ec52dd2a5d9 ata: libata-core: Allow capacity transition to zero for locked drives 7a9a69641b68a ata: libata-core: Skip HPA resize for locked drives 52007bfdce531 fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list 1155a9d0a2e0d fs/resctrl: Free mon_data structures on rdt_get_tree() failure ccdf1770a4ba2 cpu/hotplug: Fix NULL kobject warning in cpuhp_smt_enable() 5f5783c7806fc arm64: smp: Fix hot-unplug tearing by forcing unregistration 26b131b2d5b55 net: macb: drop in-flight Tx SKBs on close b2f426a9a2288 dibs: loopback: validate offset and size in move_data() 2cf10d0425622 macsec: don't read an unset MAC header in macsec_encrypt() 83fb4c2c5344f ipvs: reset full ip_vs_seq structs in ip_vs_conn_new 247d055504dcc ipvs: use parsed transport offset in SCTP state lookup 61a7ff4a62003 llc: fix SAP refcount leak in llc_ui_autobind() 685fb410d90e5 selftests: net: make busywait timeout clock portable 5df30f05db965 octeontx2-pf: fix SQB pointer leak on init failure 77caf2d6eba7c mac802154: remove interfaces with RCU list deletion f0745496f7c17 s390/monwriter: Reject buffer reuse with different data length a5a367756926d irqchip/irq-riscv-imsic-early: Fix fwnode leak on state setup failure 018d7ad26cb8b mm/compaction: handle free_pages_prepare() properly in compaction_free() 2faf0198168d2 riscv: probes: save original sp in rethook trampoline d8d4fa0c4f818 hwmon: (asus_atk0110) Check package count before accessing element 07f5eb6d268a3 net: wwan: iosm: bound device offsets in the MUX downlink decoder 1286a41563337 ata: pata_pxa: Fix DMA channel leak on probe error 1dce4f4bb3c1c net/mlx5: HWS, fix matcher leak on resize target setup failure 82fc886e244c7 orangefs: keep the readdir entry size 64-bit in fill_from_part() 2c76c01a505c1 tracing/probes: Fix double addition of offset for @+FOFFSET b4427ee3667c5 hwmon: (max1619) add missing 'select REGMAP' to Kconfig 6c52226072a3c fhandle: reject detached mounts in capable_wrt_mount() e2b7ee61989f2 net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked 5889064919a1e net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked 99a6f37b113c4 net: lan743x: Initialize eth_syslock spinlock before use ac58088d70b8a fsl/fman: Free init resources on KeyGen failure in fman_init() f0aad157576da hwmon: (occ) unregister sysfs devices outside occ lock 715cce38424fb net: liquidio: fix BAR resource leak on PF number failure 664480021f6a4 hwmon: (w83793) remove vrm sysfs file on probe failure c6c990f7208c9 hwmon: (w83627hf) remove VID sysfs files on error and remove 8dc6c7e8c9678 rtc: mpfs: fix counter upload completion condition 6e21d1253ef13 rtc: renesas-rtca3: Fix PIE clear polling condition in alarm setup error path 6c98ccdb9a096 bnx2x: fix potential memory leak in bnx2x_alloc_mem_bp() f5c5065963024 ipmi: fix refcount leak in i_ipmi_request() a66d45e0ce6d7 espintcp: use sk_msg_free_partial to fix partial send ddbb6e3dc9bb4 ipmi: Fix user refcount underflow in event delivery a65f49b6f7ece LoongArch: Fix missing dirty page tracking in {pte,pmd}_wrprotect() 20ac8131f8c90 LoongArch: Fix nr passing in set_direct_map_valid_noflush() 612cda6630f2e pwm: rzg2l-gpt: Fix period_ticks type from u32 to u64 4b73889941b95 selftests/bpf: Add simple strscpy() implementation da7f17c2d5bb4 KVM: TDX: Account all non-transient page allocations for per-TD structures d0cc2c74060be drm/xe/userptr: Stub notifier_lock helpers when DRM_GPUSVM=n 6cec36c795c03 net/sched: sch_teql: move rcu_read_lock()/spin_lock() from _bh variants 55da782eb4545 platform/x86/amd/pmc: Avoid logging "(null)" for DMI values 35267819b2507 gve: fix header buffer corruption with header-split and HW-GRO 2059c28bd725b ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit cb5cca1d2a908 ieee802154: ca8210: fix cas_ctl leak on spi_async failure 314f21c9dd0dc ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation 1905ebabe638c ieee802154: admin-gate legacy LLSEC dump operations 19c148cb82d11 octeontx2-af: Free BPID bitmap on setup failure 234cd54fc500f net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink 03d8843b143eb net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink 68cadc3698c7d net: ipip: require CAP_NET_ADMIN in the device netns for changelink 9571af2eec802 net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink 0b2f9c908f930 net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink 6596baf804110 net: ena: clean up XDP TX queues when regular TX setup fails ab625256882e0 selftests: net: fix file owner for broadcast_ether_dst test b3d8354078461 net/sched: act_ct: preserve tc_skb_cb across defragmentation 3f85fcd520aa7 net: ixp4xx_hss: fix duplicate HDLC netdev allocation e89b8829693e6 net: wwan: t7xx: destroy DMA pool on CLDMA late init failure 121c5f31c3fb7 net: ethernet: ti: icssg: guard PA stat lookups 3118e97dae533 net: sit: require CAP_NET_ADMIN in the device netns for changelink 5d7bd8790309b gpios: palmas: add .get_direction() op d3b9026ef78da gpio: mt7621: avoid corruption of shared interrupt trigger state 4e16bc75c7502 gpio-f7188x: Add support for NCT6126D version B b6e040b5143cc gpio: mt7621: be sure IRQ domain is created before exposing GPIO chips ac761e66708d5 gpio: tegra: do not call pinctrl for GPIO direction 0630f2c3c16c0 gpio: mt7621: more robust management of IRQ domain teardown 6cb15b81ff545 cpu: hotplug: Bound hotplug states sysfs output f77117530fc3f cpu: hotplug: Preserve per instance callback errors afd147e59b32a selftests/ftrace: Drop invalid top-level local in test_ownership ea6a188ee805e posix-cpu-timers: Use u64 multiplication in update_rlimit_cpu() 633cadbc0b832 locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() fcff712d0e3d1 wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() b33ac2d39953e tracing/user_events: Fix use-after-free in user_event_mm_dup() ed3cc4218070d net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete 0e8115a7ed9a9 Input: ims-pcu - fix type confusion in CDC union descriptor parsing f516cba88bf95 Input: ims-pcu - fix race condition in reset_device sysfs callback 383934c249a98 Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing 9c964fc9507ae Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging 99c428d7ef644 Input: ims-pcu - fix firmware leak in async update 05ac85da12198 Input: ims-pcu - fix DMA mapping violation in line setup f28c5cabb2df0 Input: ims-pcu - add response length checks c8d3d83f2eaaf Input: ims-pcu - validate control endpoint type 6329d1af316a4 Input: ims-pcu - release data interface on disconnect 87e2f89dea078 Input: ims-pcu - only expose sysfs attributes on control interface 6aacc18004b1a Input: ims-pcu - fix use-after-free and double-free in disconnect df87532e92122 scsi: elx: efct: Fix I/O leak on unsupported additional CDB 9b871369cbb45 scsi: elx: efct: Fix refcount leak in efct_hw_io_abort() cb7bdae7fba40 scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE 004ccd2d3b4ac scsi: target: Bound PR-OUT TransportID parsing to the received buffer f1516c56ac540 scsi: xen: scsiback: Free unsubmitted command instead of double-putting it 255fb7b0cdc94 scsi: xen: scsiback: Free the command tag on the TMR submit-failure path d0a8a6660d58e scsi: sg: Report request-table problems when any status is set ed08497977820 scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup() d495b403d5b35 scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path 257321a1c036d accel/ivpu: Reject firmware log with size smaller than header 4e370b5289624 accel/amdxdna: Fix use-after-free in amdxdna_gem_dmabuf_mmap() 7aa8f3dba5342 dma-fence: Make dma_fence_dedup_array() robust against 0-count input 089e05b644d5a dm-verity: make error counter atomic c8d743bb0e98a dm-verity: increase sprintf buffer size f15eaa3801f2f dm-verity: fix a possible NULL pointer dereference 2a0858cba1dab dm-verity: avoid double increment of &use_bh_wq_enabled 5dfd804263527 dm-integrity: don't increment hash_offset twice aa5113e7155f4 dm-integrity: fix a bug if the bio is out of limits 0c4e9bb1d4101 dm-integrity: fix leaking uninitialized kernel memory 92e3c93d60be1 dm_early_create: fix freeing used table on dm_resume failure ee458c3c18343 dm-stats: fix merge accounting 461d36b5ddafc dm-stats: fix dm_jiffies_to_msec64 1247615aadb74 dm-pcache: reject option groups without values e0b0163a65758 dm-log: fix a bitset_size overflow on 32bit machines d61c12573ed97 dm-ioctl: fix a possible overflow in list_version_get_info 021dab70eb37d dm-bufio: fix wrong count calculation in dm_bufio_issue_discard 1fcb5e29dd7a5 dm era: fix out-of-bounds memory access for non-zero start sector 7f76245960a33 dm thin metadata: fix metadata snapshot consistency on commit failure ac2136dc4441d dm thin metadata: fix superblock refcount leak on snapshot shadow failure 8a3c44a003176 net: sparx5: unregister blocking notifier on init failure ffd17a393921a block: fix IORING_URING_CMD_REISSUE flags check in blkdev_uring_cmd 2977b5fe401c1 block: fix race in blk_time_get_ns() returning 0 af382ffca93e5 block: remove redundant GD_NEED_PART_SCAN in add_disk_final() 0b6252afcd196 bpf: Add missing access_ok call to copy_user_syms c4f626ddf2350 bpf,fork: wipe ->bpf_storage before bailouts that access it 0993dc5fc619c bpf: Reset register bounds before narrowing retval range in check_mem_access() b06a4a397ac82 can: bcm: add missing rcu list annotations and operations 35f0ac19efb1a can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure cd830e0bc25ee can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF 37beb16e08cae can: isotp: serialize TX state transitions under so->rx_lock 7bef39ba76eb7 can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER b88a511308779 can: isotp: use unconditional synchronize_rcu() in isotp_release() 765ba1c91823a can: esd_usb: kill anchored URBs before freeing netdevs 5e4c8e08ce957 netdev-genl: report NAPI thread PID in the caller's pid namespace 26355295ce21c nvmet: fix refcount leak in nvmet_sq_create() 2944113ad5fbc nvmet-rdma: handle inline data with a nonzero offset 2eaa3ad450141 nvmet-auth: reject short AUTH_RECEIVE buffers 59cef6abc924a nvme-apple: Prevent shared tags across queues on Apple A11 0ffc032294a29 NFS: Charge unstable writes by request size, not folio size ebe0a55d954fa sctp: validate STALE_COOKIE cause length before reading staleness d44b828eb551b spi: uniphier: Fix completion initialization order before devm_request_irq() 9b092f9e6b34d time: Fix off-by-one in compat settimeofday() usec validation ada4b9a5087ea tpm: Make the TPM character devices non-seekable 95bdf3950d668 tpm: fix event_size output in tpm1_binary_bios_measurements_show 8ca2a19a987a7 xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink e0f688ccb20f1 xfrm: use compat translator only for u64 alignment mismatch 5b0c4c916f202 xfrm: nat_keepalive: avoid double free on send error 16d3ccdabb8de xen/gntdev: fix error handling in ioctl e497fef9ad7e9 ufs: core: tracing: Do not dereference pointers in TP_printk() 0ced34b4bbc04 tcp: Decrement tcp_md5_needed static branch 33a1bee413628 tcp: defer md5sig_info kfree past RCU grace period in tcp_connect bccae122dab8f ice: fix ice_init_link() error return preventing probe 8bd84316bbaf3 i2c: spacemit: fix spurious IRQ handling returning IRQ_HANDLED e6a395a71f465 i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource() 2f3f471a448a5 i2c: mediatek: fix WRRD for SoCs without auto_restart option 5d3240f42a667 i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) 6d2c973926d06 i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) 500716a007b2e hwmon: (max6697) add missing 'select REGMAP_I2C' to Kconfig 1dcd7565e5909 hwmon: (ltc2992) add missing 'select REGMAP_I2C' to Kconfig 3cd6f93f3d593 ksmbd: fix integer overflow in set_file_allocation_info() 6cc1518357369 smb: client: use kvzalloc() for megabyte buffer in simple fallocate fe623f9515bb0 pkey: Move keytype check from pkey api to handler eafc5aca71564 platform/x86/amd/pmc: Don't log during intermediate wakeups e628d9169f9e1 platform/x86/amd/pmc: Add delay_suspend module parameter 27d16a19ae74f platform/x86/amd/pmc: Delay suspend for some Lenovo Laptops d8bc45c4c1a45 platform/x86/amd/pmc: Check for intermediate wakeup in function cea03d67db3a8 platform/x86: ISST: Restore SST-PP control to all domains 1e41ca4a7fba2 platform/x86: dell-laptop: fix missing cleanups in init error path ddbc4a8a4fe29 dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK 7926c1e4be863 dmaengine: tegra: Fix burst size calculation 933654508b2bc sunrpc: fix uninitialized xprt_create_args structure 934d1cd40e289 tpm: tpm2-sessions: wait for async KPP completion in tpm_buf_append_salt ba33b4f9d3423 tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat() 781f28bd982cf tpm: restore timeout for key creation commands 36ca587f55a2c irqchip/crossbar: Use correct index in crossbar_domain_free() 0d078152fcab7 taskstats: retain dead thread stats in TGID queries 9ac007affa77c mtd: maps: vmu-flash: fix NULL pointer dereference in initialization 3fac46068fe4c openrisc: Fix jump_label smp syncing ff7bcc9d71bf4 mtd: rawnand: Pause continuous reads at block boundaries 0fd20c1905abc mtd: spi-nor: spansion: use die erase for multi-die devices only c0806df5cf806 mtd: spi-nor: swp: Improve locking user experience 433e5e70cdc1e s390/pkey: Check length in pkey_pckmo handler implementation 693bf91d4db13 s390/pkey: Check length in PKEY_VERIFYPROTK ioctl c9ef79e34bc1e fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header() e5824d5b841d9 net: thunderbolt: Fix frags[] overflow by bounding frame_count fc74244e0cc25 bus: mhi: ep: Protect mhi_ep_handle_syserr() in the error path 3ebe0ee6527e8 bus: mhi: host: pci_generic: Fix the physical function check 012683accbb7d fpga: dfl: add bounds check in dfh_get_param_size() 2174c68f623b7 ocfs2: reject non-inline dinodes with i_size and zero i_clusters 5e512d370a01b ocfs2: reject dinodes whose i_rdev disagrees with the file type 4db3b6a2a8ecf ocfs2: reject dinodes with non-canonical i_mode type 499714de42ab4 ocfs2: add journal NULL check in ocfs2_checkpoint_inode() 671889c553ea5 ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2_sum_rightmost_rec bd73971fad89d ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits d5d5a21fb33cd ocfs2: avoid moving extents to occupied clusters 4bbfcf9c7e46c mtd: rawnand: fix condition in 'nand_select_target()' a8874c34c4a97 net/9p: fix infinite loop in p9_client_rpc on fatal signal ace3a0c839f3b mtd: rawnand: pl353: fix probe resource allocation b6337e3687d3d ocfs2: use kzalloc for quota recovery bitmap allocation bf53557a96d4c openrisc: Add full instruction cache invalidate functions 8d263bae573dc scsi: sas: Skip opt_sectors when DMA reports no real optimization hint 83405848e4030 scsi: smartpqi: Use shost_to_hba() in pqi_scan_finished() a7bbf83dfebdc power: supply: bq257xx: Fix VSYSMIN clamping logic 8d610017c992d 9p: skip nlink update in cacheless mode to fix WARN_ON d8dcbbfa0d695 mtd: slram: remove failed entries from the device list 4e4beef747c68 kcov: use WRITE_ONCE() for selftest mode stores da5234df09416 mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE 749e2051da3b0 powerpc/dt_cpu_ftrs: Set CPU_FTR_P11_PVR for Power11 and later processors 07ed8b1785480 fs/proc: fix KPF_KSM reported for all anonymous pages b6a6fb6803d52 proc: only bump parent nlink when registering directories 4d67bdef35c32 fs/proc/task_mmu: use huge_page_size() in pagemap_scan_hugetlb_entry() 43b987ed35be9 fs/proc/task_mmu: fix hugetlb self-deadlock in pagemap_scan_pte_hole() 40a04601a3f66 mm/damon/sysfs-schemes: put stats for scheme_add_dirs() internal error f18c561eb9c51 mm/damon/sysfs-schemes: fix dir put orders in access_pattern_add_dirs() f322955d9a1c3 riscv: cacheinfo: Fix node reference leak in populate_cache_leaves 1caee6e084a96 mips: sched: Fix CPUMASK_OFFSTACK memory corruption bd2e9be9ebb64 selftests/landlock: Test SCOPE_SIGNAL on the SIGIO/fowner pgid path 193e6471e985c power: supply: charger-manager: fix refcount leak in is_full_charged() 1f18aac263722 landlock: Fix LANDLOCK_SCOPE_SIGNAL bypass on the SIGIO path ff05a98150ebb ntfs3: fix out-of-bounds read in decompress_lznt f3624cc069195 ntfs3: validate split-point offset in indx_insert_into_buffer aaa1f956c0fc4 ntfs3: bound to_move in indx_insert_into_root before hdr_insert_head 0fad25687d4d3 ntfs3: cap RESTART_TABLE free-chain walker at rt->used be306b8d9143a fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation} 908c9243ba309 fs/ntfs3: add depth limit to indx_find_buffer to prevent stack overflow 7adb38279812c fs/ntfs3: validate lcns_follow in log_replay conversion 50b5e83384e7f fs/ntfs3: bound attr_off in UpdateResidentValue against data_off d240cd98f5f7b fs/ntfs3: bound copy_lcns dp->page_lcns[] index in analysis pass 09fddd52c1b0c fs/ntfs3: bound DeleteIndexEntryAllocation memmove length ccd6b70798737 fs/ntfs3: fix syncing wrong inode on DIRSYNC cross-directory rename 640627f07c79b mm/damon/core: make charge_addr_from aware of end-address exclusivity 722e6c54bde63 mm/memory_hotplug: fix incorrect altmap passing in error path 1697d253f51cf mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch 9227b387eee50 power: supply: max17042: fix OF node reference imbalance a3d81de441233 power: supply: cpcap-battery: Fix missing nvmem_device_put() causing reference leak a39d281f207b9 mm/mm_init: fix pageblock migratetype for ZONE_DEVICE compound pages d3fd2d358df0c MIPS: DEC: Ensure 32-bit stack location for o32 prom_printf() 11a3bc25f2c30 MIPS: ip22-gio: fix device reference leak in probe 2c551f14f55e4 MIPS: ip22-gio: fix kfree() of static object 620a37ea7d626 MIPS: ip22-gio: fix gio device memory leak 51aad3d89a2dd remoteproc: qcom: Fix leak when custom dump_segments addition fails 69e18135e2a00 SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing 46d59ff421824 lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure 1161c4b5bd004 lockd: Plug nlm_file leak when nlm_do_fopen() fails 66014ab165cb0 sunrpc: harden rq_procinfo lifecycle to prevent double-free 65b23bec1fca6 sunrpc: wait for in-flight TLS handshake callback when cancel loses race 3f9ee75a97a76 sunrpc: pin svc_xprt across the asynchronous TLS handshake callback 30d490bb2c4cd nvdimm/btt: Free arena sub-allocations on discover_arenas() error path f4ca396bdd60b nvdimm/btt: Free arenas on btt_init() error paths 78955fdce8ff6 jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit() 7199c78c3a3e3 Bluetooth: SCO: hold sk properly in sco_conn_ready 77eb0cf57009e Bluetooth: SCO: fix sleeping under spinlock in sco_conn_ready 96dd35f1942cd HID: playstation: validate num_touch_reports in DualShock 4 reports 88ba845468508 mfd: tps6586x: Fix OF node refcount d8e2f3e1bc207 cifs: invalidate cfid on unlink/rename/rmdir 3256c05d5a9db batman-adv: tt: prevent TVLV OOB check overflow d2b657c9653fc batman-adv: mcast: avoid OOB read of num_dests header a90f4fff90253 batman-adv: frag: fix primary_if leak on failed linearization c945f6007e785 batman-adv: clean untagged VLAN on netdev registration failure 8f54162e07d3e batman-adv: frag: free unfragmentable packet 2c989ab8e2054 batman-adv: fix VLAN priority offset 6a65ac8a81e90 batman-adv: tt: avoid request storms during pending request ee878decf9e57 batman-adv: dat: fix tie-break for candidate selection 9e16b6751a820 batman-adv: ensure minimal ethernet header on TX 8f76277d02176 batman-adv: dat: ensure accessible eth_hdr proto field e5e18886aadd3 batman-adv: bla: reacquire gw address after skb realloc 3b4c70c40f2e1 batman-adv: dat: acquire ARP hw source only after skb realloc b8afcf799b2cc batman-adv: access unicast_ttvn skb->data only after skb realloc 85a71a81854e0 batman-adv: retrieve ethhdr after potential skb realloc on RX e6b43acd34b21 batman-adv: gw: acquire ethernet header only after skb realloc fa1ebae4206e6 s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init() 8514585aa9553 cpufreq: intel_pstate: Set non-turbo capacity to HWP_GUARANTEED_PERF() 221ee479a49fb cpufreq: schedutil: Fix uncleared need_freq_update on the .adjust_perf() path 5ab0eba9c8819 perf/x86/amd/lbr: Fix kernel address leakage 046f6244da9b6 perf/x86/amd/brs: Fix kernel address leakage 394e2bdf7594e x86/boot: Reject too long acpi_rsdp= values f7c67c97b37c1 x86/boot: Validate console=uart8250 baud rate to fix early boot hang 1a1d6e3ef6cf5 x86/video: Only fall back to vga_default_device() without screen info 19ffeb30fdfce tools/power/x86/intel-speed-select: Harden daemon pidfile open 16a42c88c4667 mfd: sm501: Fix reference leak on failed device registration 6dd51d84a9502 leds: uleds: Fix potential buffer overread 3a134c3fb5f0d selinux: fix incorrect execmem checks on overlayfs d61a80b17254b selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() fc633a598206d selinux: check connect-related permissions on TCP Fast Open e9cdf741ffcb4 soc: fsl: qe: panic on ioremap() failure in qe_reset() c6854d9f4e1bd soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy c4d6442ac3ed0 gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path 1c4f67c89fd27 netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() 679ced28a9dc2 netfilter: xt_nat: reject unsupported target families b2dbbedfa935c netfilter: ecache: fix inverted time_after() check 3cd9a5792cbea netfilter: nf_conncount: fix zone comparison in tuple dedup a58230f3a7c4f netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag 2bcf2c5052fb5 netfilter: nf_nat_sip: reload possible stale data pointer 02b6b0e892aea netfilter: nft_set_pipapo: don't leak bad clone into future transaction 0ca505346c5e2 netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst 07f9ddbf5e799 netfilter: xt_cluster: reject template conntracks in hash match a1b672a3b5372 netfilter: nfnl_cthelper: apply per-class values when updating policies aff589556ed77 netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read ca028334343a1 ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback e42d8322b67f2 ASoC: mediatek: mt8183: Release reserved memory on cleanup 4b068759d3087 ASoC: mediatek: mt8183: Check runtime resume during probe 51c367230e30e ASoC: mediatek: mt8192: Release reserved memory on cleanup e0f276f1918a2 ASoC: mediatek: mt8192: Check runtime resume during probe d3abaedf6a584 ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control 121577383b5cf ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get 4ebe2c3a7db63 fbdev: tridentfb: fix potential memory leak in trident_pci_probe() 009a8514745b1 fbdev: nvidia: fix potential memory leak in nvidiafb_probe() 58bc18e03481b fbdev: vesafb: fix memory leak in vesafb_probe() d81860691e4cf fbdev: carminefb: fix potential memory leak in alloc_carmine_fb() e1ca9b8559e0f fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe() 12fe6a56506ed fbdev: uvesafb: fix potential memory leak in uvesafb_probe() ad54698255a4b fbdev: s3fb: fix potential memory leak in s3_pci_probe() 146b708bc75f1 fbdev: i740fb: fix potential memory leak in i740fb_probe() c2c795a320e7e fbdev: radeon: fix potential memory leak in radeonfb_pci_register() febb5b4f67ace fbdev: efifb: fix memory leak in efifb_probe() 9423e1f105270 fbdev: sm712: Fix operator precedence in big_swap macro d684ce2db92b1 fbdev: hecubafb: fix potential memory leak in hecubafb_probe() e8c9aae8c9508 fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe() 6854cf33dddb2 fbdev: metronomefb: fix potential memory leak in metronomefb_probe() d5436e18e4fc2 KVM: arm64: nv: Inject SEA if guest VNCR isn't normal memory 4ead4def04659 KVM: arm64: nv: Inject SEA if kvm_translate_vncr() can't resolve PFN 5c50db5bcbb90 KVM: arm64: nv: Respect read-only PFN when mapping L1 VNCR 884b44256041e KVM: arm64: nv: Fix SPSR_EL2 restore in kvm_hyp_handle_mops() 09f35145f3a4a KVM: arm64: nv: Write ESR_EL2 for injected nested SError exceptions 5000bcae71c86 KVM: arm64: nv: Drop bogus WARN for write to ZCR_EL2 7099e7148f81c KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers 7996013b85687 KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state d1379888cc423 KVM: x86: Nullify irqfd->producer if updating IRTE for bypass fails 97542f15dc4cf KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs ba06690b28be9 KVM: SEV: Do not allow intra-host migration/mirroring of SNP VMs df72596278b0e KVM: s390: pci: Fix handling of AIF enable without AISB d19dca8194ebe KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling 79fdd2aa774e4 KVM: arm64: vgic: Check the interrupt is still ours before migrating it 5fb75c5272950 KVM: s390: pci: Fix GISC refcount leak on AIF enable failure 9f8eaef40e955 powerpc/pseries/Kconfig: Enable CONFIG_VPA_PMU to be used with KVM 33d79ad6ecedf LoongArch: KVM: Return full old CSR value from kvm_emu_xchg_csr() f3efcef6648ba LoongArch: KVM: Fix FPU register width with user access API 45f2e6505fcf6 LoongArch: KVM: Check the return values for put_user() efe27b19a15c3 LoongArch: KVM: Check irq validity in kvm_vcpu_ioctl_interrupt() 199b570d7fca1 LoongArch: KVM: Validate irqchip index in irqfd routing 1ee200a1764f8 ARM: dts: stm32: stm32mp15x-mecio1-io: Move expander gpio-line-names to board files f550bf32b9a06 ARM: dts: stm32: stm32mp15x-mecio1-io: Fix expander gpio line typo 7da4d1a6b7400 ARM: dts: stm32: stm32mp15x-mecio1-io: Move gpio-line-names to board files 804821b69b2d1 ARM: dts: stm32: stm32mp15x-mecio1-io: Fix GPIO names typo c632a27f35cff arm64: dts: imx8ulp-evk: Correct Type-C int GPIO flags bd938c985ab34 ARM: dts: stm32: stm32mp15x-mecio1-io: Enable internal ADC reference ead9f10428c73 arm64: dts: ti: k3-am62a7-sk: Add bootph-all tag to vqmmc a98bda2305f3f ARM: dts: stm32: stm32mp15x-mecio1-io: Move divergent mecio1 ADC channels to board files 4fd52ac541ce1 ARM: dts: stm32: stm32mp15x-mecio1-io: Fix ADC sampling times 68f9773754f05 arm64: dts: rockchip: fix Ethernet PHY not found on PX30 Ringneck e2e3fb995175c arm64: dts: qcom: sdm630: describe adsp_mem region properly 508e55e81870d ARM: dts: imx6ul-var-som: fix warning for non-existent dc-supply property e8dc96a42571e arm64: dts: s32g3: Fix SWT8 watchdog address 89edae4161412 arm64: fpsimd: Fix type mismatch in sve_{save,load}_state() 5526d1997aea6 net: ife: require ETH_HLEN to be pullable in ife_decode() 908391d801b24 octeontx2-vf: clear stale mailbox IRQ state before request_irq() eebf439aa7a13 octeontx2-pf: clear stale mailbox IRQ state before request_irq() e62adb157c2ea net: atm: reject out-of-range traffic classes in QoS validation 22100a8f73d4a net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() 61a55fa24a5d7 tipc: restrict socket queue dumps in enqueue tracepoints d34deef34c99b ASoC: SOF: topology: validate vendor array size before parsing 0c4fbdaca225b ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get 711d912b18763 ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc fb4293173db2d ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put d8715b5a8fdb2 vduse: Fix race in vduse_dev_msg_sync and vduse_dev_read_iter 3a2b47d1b4b3d mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace() 2d8b3c3e12997 mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() b65e46eed9e52 idpf: add padding to PTP virtchnl structures 1627e7d5c9b09 smb: client: fix overflow in passthrough ioctl bounds check 327595e7c34e3 drm/xe: remove duplicate include 3de77d2f34c2b octeontx2-af: fix VF bringup affecting PF promiscuous state ee3f7566bcf33 net/mlx5: Fix L3 tunnel entropy refcount leak 1550b07bca2bb selftests/net: fix EVP_MD_CTX leak in tcp_mmap 346e2d666a29a regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK 14e03ecd3b1b5 dm era: fix NULL pointer dereference in metadata_open() 5b0427ba582d1 SUNRPC: pin upper rpc_clnt across the TLS connect_worker 13965a7b190f3 SUNRPC: release lower rpc_clnt if killed waiting for XPRT_LOCKED b784cd1c24d89 cifs: validate DFS referral string offsets df0e3e70f6995 s390/zcrypt: Remove the empty file 8f48cfe657409 ipvs: ensure inner headers in ICMP errors are in headroom 7510451a58c27 ipvs: fix PMTU for GUE/GRE tunnel ICMP errors d73f4249776dd ipvs: use parsed transport offset in TCP state lookup d340e351a0a74 ipvs: pass parsed transport offset to state handlers 238c612357b5a netfilter: nft_lookup: fix catchall element handling with inverted lookups f60ec3058a854 ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer() 27506827a01f6 ipv4: igmp: annotate data-races around timer-related fields d269eb67d2e58 ipv4: igmp: annotate data-races around im->users 9ce741c22df4f ipv6: mcast: Fix potential UAF in MLD delayed work 75e984fe0cb9e ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() 3bfcce441c552 gpio: mvebu: free generic chips on unbind 7cc438c99bba3 perf/x86/amd/core: Avoid enabling BRS from the SVM reload path 9579d625171a1 octeontx2-pf: check DMAC extraction support before filtering 7aa0e64fea778 net/sched: cake: reject overhead values that underflow length 72119397cdff6 net: mdio: select REGMAP_MMIO instead of depending on it 762116dfa7286 drm/v3d: Reject invalid indirect BO handle in indirect CSD setup 267809e2c56fb accel/amdxdna: Fix potential amdxdna_umap lifetime race 1cd434ac1c222 tracing: Make tracepoint_printk static as not exported 5e15cf51982f8 gpio: dwapb: Defer clock gating until noirq 6c736c5ccf4a3 gpio: dwapb: reduce allocation to single kzalloc d7b5497e0e45b gpio: dwapb: Use modern PM macros a3010b732d620 net: usb: lan78xx: disable VLAN filter in promiscuous mode e8a4c9fc437b1 net/tls: Consume empty data records in tls_sw_read_sock() b3eeb586f94c7 accel/amdxdna: Use unsigned long for nr_pages in amdxdna_hmm_register() ec5e96aee75d2 ring-buffer: Fix event length with forced 8-byte alignment 0c602cb8f148a Bluetooth: L2CAP: fix tx ident leak for commands without a response bfc9e7be289df Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup() b69b1ab121fe8 Bluetooth: ISO: exclude RFU bits from ISO_SDU_Length da4d8eea0c5f3 Bluetooth: sco: Fix a race condition in sco_sock_timeout() dfc8373893b18 Bluetooth: MGMT: Fix adv monitor add failure cleanup 23a83bac3356e Bluetooth: 6lowpan: hold L2CAP conn across debugfs control 026c236f0eefe amt: fix size calculation in amt_get_size() 3bfb96d9bc6a7 net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket 6f9b23eb92a89 net/sched: act_pedit: fix TOCTOU heap OOB write in tc offload 1b12612c367e4 net: qualcomm: rmnet: validate MAP frame length before ingress parsing b066420e57f34 qede: fix off-by-one in BD ring consumption on build_skb failure 1e71a40d10154 net: microchip: vcap: fix races on the shared Super VCAP block 5c7e3755abf66 net/mlx5e: Fix publication race for priv->channel_stats[] 60fddda7207d8 net/mlx5e: Fix HV VHCA stats agent registration race 420aabb32da43 net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation 6a802de97a8bf net/mlx5: LAG, MPESW, Fix missing complete() on devcom error 4eef84b09a383 netfilter: xt_connmark: reject invalid shift parameters b29b67c729de0 netfilter: nft_set_rbtree: get command skips end element with open interval 3d441be2b1c5e netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop e702f6dd5d21e netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt() a597a722fb71a netfilter: xt_u32: reject invalid shift counts 4a4a1d41c6e90 gue: validate REMCSUM private option length b153cfe84b134 net: usb: net1080: validate packet_len before pad-byte access in rx_fixup 66f57dc92aeb6 arm64/sysreg: Fix BWE field encoding in ID_AA64DFR2_EL1 a6185c21d5510 selftests/hid: Cover hid_bpf_get_data() size overflow 91ac1d7fd51e3 selftests/hid: Load only requested struct_ops maps 61a959b82f1ae HID: bpf: Fix hid_bpf_get_data() range check 4c65c3d9f660b arm64/mm: Optimize TLB flush in unmap_hotplug_[pmd|pud]_range() dd395744e4ed8 HID: core: Fix OOB read in hid_get_report for numbered reports d354e523c6f74 HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait() 793b55c3f36f5 ata: libata-scsi: limit simulated SCSI command copy to response length 232a2f2fce9b9 ata: sata_gemini: unwind clocks on IDE pinctrl errors 86652704a7fd4 cifs: Fix missing credit release on failure in cifs_issue_read() c9170c83b0e0f uprobes/x86: Use proper mm_struct in __in_uprobe_trampoline 2265b2b1c5aaa x86/uprobes: Keep shadow stack in sync for emulated CALLs adc7dda728ca3 drm/xe/pf: Don't attempt to process FAST_REQ or EVENT relays a0a56b4480a0d drm/xe/hw_engine: Fix double-free of managed BO in error path f9a9abd7bbdab drm/xe/userptr: Hold notifier_lock for write on inject test path 78b1074966d29 drm/xe/pt: Fix NULL pointer dereference in xe_pt_zap_ptes_entry() a9b89752c2726 netfs: Fix folio state after ENOMEM whilst under writeback iteration 1bb33d959aabc netfs: Fix writeback error handling 7838131e296df netfs: Fix writethrough to use collection offload 8ab75e445c161 netfs: Fix netfs_create_write_req() to handle async cache object creation 1f38f65bf965f iomap: guard io_size EOF trim against concurrent truncate underflow 08b2145470667 ovl: fix comment about locking order abe3536a4bedc minix: avoid overflow in bitmap block count calculation ce6aced2e8554 afs: Fix unchecked-length string display in debug statement 158c5a0b1dfc0 afs: Fix the volume AFS_VOLUME_RM_TREE is set on 657449e5581a4 afs: Fix premature cell exposure through /afs 2ffb70a8a0198 afs: Fix lack of locking around modifications of net->cells_dyn_ino 8afb1a787a280 afs: Fix vllist leak 5492799ec5d27 afs: Fix missing NULL pointer check in afs_break_some_callbacks() 0acbc09d2aca0 afs: Fix callback service message parsers to pass through -EAGAIN 63d3f283858fa afs: Fix reinitialisation of the inode, in particular ->lock_work 5ea289ca751c4 afs: Fix misplaced inc of net->cells_outstanding b5bc1e5d5ce57 afs: Fix bulk lookup malfunction due to change in dir_emit() API 083a0ddc9cd49 afs: Remove erroneous seq |= 1 in volume lookup loop 6eb0d929202a3 afs: use kvfree() to free memory allocated by kvcalloc() aa24cec5b3470 afs: Fix double netfs initialisation in afs_root_iget() 8530206911fd6 afs: Fix error code in afs_extract_vl_addrs() a2038514e6937 fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid 374fd8122421f net/sched: hhf: clear heavy-hitter state on reset fba8e250ce5f3 net/sched: dualpi2: clear stale classification on filter miss a203f2c3892b1 pinctrl: meson: restore non-sleeping GPIO access 47120164c63d3 gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe 5a5ac2852cd32 ksmbd: fix use-after-free of fp->owner.name in durable handle owner check d020e7f27bf65 ksmbd: reject undersized DACLs before parsing ACEs 6b1304ce6cff0 net/sched: act_bpf: use rcu_dereference_bh() to read the filter a03387e1f6251 selftests: drv-net: tso: don't touch dangerous feature bits df9ffdceac053 cxgb4: Fix decode strings dump for T6 adapters 124440df267dc virtio_net: disable cb when NAPI is busy-polled a8323fb2ab6cd sctp: fix addr_wq_timer race in sctp_free_addr_wq() 4e8d498d32b6c irqchip/ts4800: Fix missing chained handler cleanup on remove c5d75800539bc irqchip/gic-v3-its: Fix OF node reference leak f0069a262bd41 tracing/probes: Make the $ prefix mandatory for comm access 62988204162fc tracing/fprobe: Fix NULL pointer dereference in fprobe_fgraph_entry() 898cb5a7c4154 tracing: eprobe: read the complete FILTER_PTR_STRING pointer e0881f5cc4d71 tracing/events: Fix to check the simple_tsk_fn creation f148f86c65b8f tracing/probes: Remove WARN_ON_ONCE from parse_btf_arg 3b51d6f07a199 tracing/eprobes: Allow use of BTF names to dereference pointers acbf1ecc22f3c drm/panthor: Interrupt group start/resumption if group_bind_locked() fails a9d098b346db5 drm/panthor: Fix a leak when a group is evicted before the tiler OOM is serviced 1497a438ea34a drm/panthor: Don't overrule pending immediate ticks in sched_resume_tick() dd0b2976b7c0f drm/panthor: Fix potential invalid pointer deref in group_process_tiler_oom() b4b3458ef88df bridge: stp: Fix a potential use-after-free when deleting a bridge 9b7d05cbaa601 net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF ef940e042f329 net: gianfar: dispose irq mappings on probe failure and device removal 58ba00999898b net: libwx: fix VMDQ mask for 1-queue mode 86d379fcf1b79 net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy 0a7d9c7c5f1f2 usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup() d8a01d27873e0 ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump 83df3e2594cd7 eth: fbnic: don't cache shinfo across skb realloc 898ca04b096b9 hwmon: (aspeed-g6-pwm-tach) Guard fan RPM calculation against divide-by-zero 489291b6b5697 hwmon: (pmbus) Fix passing events to regulator core 36554592e2f5c hwmon: adm1275: Prevent reading uninitialized stack 1797eb92f0b39 ASoC: codecs: lpass-va-macro: Fix LPASS Codec Version for SC7280 f14c3926fee38 ASoC: codecs: lpass-va-macro: add SM6115 compatible 3d3638fe92137 MIPS: mm: Add check for highmem before removing memory block 4e9f4ca9dc73c MIPS: DEC: Ensure RTC platform device deregistration upon failure bca3100f55028 sctp: add INIT verification after cookie unpacking ad6215d76b644 sctp: fix SCTP_RESET_STREAMS stream list length limit 1681cc7974a61 net: enetc: check the number of BDs needed for xdp_frame b17751a2ebc4a qede: fix out-of-bounds check for cqe->len_list[] 8dba7a94a269b seg6: validate SRH length before reading fixed fields 8d501b1411548 net: pse-pd: scope pse_control regulator handle to kref lifetime e94d53a9ac22c gpio: htc-egpio: use managed gpiochip registration f4af803269ccd gpio: mvebu: fail probe if gpiochip registration fails 46dee20d30b70 riscv: Fix 32-bit call_on_irq_stack() frame pointer ABI 8e0b7f94fb394 ACPI: RIMT: Only defer the IOMMU configuration in init stage 776f70bafd45c spi: sh-msiof: abort transfers when reset times out d6cd34d17b951 tracing: probes: fix typo in a log message f28d7b5f1578a ALSA: FCP: Fix NULL pointer dereference in interface lookup d990a01b853e5 net: hns3: differentiate autoneg default values between copper and fiber 2d149a20275ac net: hns3: fix permanent link down deadlock after reset 92d05883ef337 net: hns3: refactor MAC autoneg and speed configuration 43a6c6fb6ec50 net: hns3: unify copper port ksettings configuration path de051b146022c selftests: tls: size splice_short pipe by page size 6727f580cf462 dt-bindings: net: renesas,ether: Drop example "ethernet-phy-ieee802.3-c22" fallback 9075efb9b2c1d net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync c1e7286d05318 ASoC: fsl_asrc_dma: fix eDMA maxburst misalignment with channel count 7a7c7263bbbc4 LoongArch: BPF: Fix off-by-one error in tail call ed295077a2214 LoongArch: BPF: Fix outdated tail call comments 0a8a729481c8e LoongArch: Move struct kimage forward declaration before use 2f3c0895fb20a net: ethernet: sunplus: spl2sw: fix phy_node refcount leak in remove b15a3cc68e245 net: sungem: fix probe error cleanup b84dd48f9da1e net: mvneta: re-enable percpu interrupt on resume e0ac054416bf4 octeontx2-af: Validate NIX maximum LFs correctly 9dc3cf8a35906 net: phy: realtek: Clear MDIO_AN_10GBT_CTRL_ADV10G bit 0c11a1da41a64 net: dsa: realtek: fix memory leak in rtl8366rb_setup_led() a69ccea6d7eb6 rtc: cmos: unregister HPET IRQ handler on probe failure 5fd1f0512748d rtc: ds1307: Fix off-by-one issue with wday for rx8130 d0bfd7004a87f smb/client: preserve errors from smb2_set_sparse() 5b6165d7ec384 ACPI: processor_idle: Mark LPI enter functions as __cpuidle ea43e7a231aa2 thermal: testing: zone: Flush work items during cleanup 4e62be1490d23 eth: fbnic: fix ordering of heartbeat vs ownership 123b559aa6bb6 ipv6: fix missing notification for ignore_routes_with_linkdown 419017dd2dda2 ipv6: fix state corruption during proxy_ndp sysctl restart ae58dbf1d78d7 ipv6: fix error handling in disable_policy sysctl 2bf70e0306f8d ipv6: fix error handling in forwarding sysctl b060606bc7e46 ipv6: fix error handling in ignore_routes_with_linkdown sysctl 56c26538f0e58 ipv6: fix error handling in disable_ipv6 sysctl 2140c2f3f2e7b net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle ff127c0aa5279 net: usb: lan78xx: restore VLAN and hash filters after link up a9e6707322ef2 veth: fix NAPI leak in XDP enable error path 4106295280670 net: dsa: sja1105: round up PTP perout pin duration 7557df1b60f20 net: do not acquire dev->tx_global_lock in netdev_watchdog_up() 03b743586a246 net, bpf: check master for NULL in xdp_master_redirect() a0904f7d27035 alpha/PCI: Fix __pci_mmap_fits() overflow for zero-length BARs 94defb18ac792 alpha/PCI: Add security_locked_down() check to pci_mmap_resource() 04117aea9bc11 NTB: epf: Fix doorbell bitmask and IRQ vector handling 56ec2a08d27b5 NTB: epf: Report 0-based doorbell vector via ntb_db_event() d2a41c85beb56 NTB: epf: Make db_valid_mask cover only real doorbell bits 60a6689b9a5df gpio: davinci: fix IRQ domain leak on devm_kzalloc failure 33e1875d6b5b5 netfilter: nft_compat: ebtables emulation must reject non-bridge targets d3e9a7e2ce9dc netfilter: nft_synproxy: stop bypassing the priv->info snapshot 329f2626ee5cb netfilter: nf_conncount: prevent connlimit drops for early confirmed ct a73e7ac3f3b69 netfilter: nf_nat: avoid invalid nat_net pointer use on failed nf_nat_init() 49fa1be621dde bpf: Disable xfrm_decode_session hook attachment 4d919c9b77099 md/raid5: avoid R5_Overlap races while breaking stripe batches 3db13f82ba314 md/raid5: use stripe state snapshot in break_stripe_batch_list() 828fad4fd418b ipv4: fib: Don't ignore error route in local/main tables. 630ce3806b706 eth: bnxt: improve the timing of stats c0057e5f762b9 eth: bnxt: rename ring_err_stats -> ring_drv_stats 33168db149d01 eth: bnxt: gather and report HW-GRO stats b0d0eb13a0441 ipv6: Fix null-ptr-deref in fib6_nh_mtu_change(). 77bb0bbfcc4e7 ksmbd: fix use-after-free of conn->preauth_info in concurrent SMB2 NEGOTIATE 1f6a4aec0d366 rtc: msc313: fix NULL deref in shared IRQ handler at probe 68115a7a336fc i40e: Fix i40e_debug() to use struct i40e_hw argument de80d04b13dec ice: dpll: fix memory leak in ice_dpll_init_info error paths eaffdd113f560 ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info 854065a75e375 rtc: isl1208: Balance enable_irq_wake() with disable_irq_wake() on cleanup 4cc632fe63df8 ice: call netif_keep_dst() once when entering switchdev mode 04c082b7dc5bf ice: fix AQ error code comparison in ice_set_pauseparam() dd6d8e4412f80 ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() 9415a94cf6227 PCI: endpoint: pci-epf-ntb: Add check to detect 'db_count' value of 0 e1e7c72a2301d PCI: endpoint: pci-epf-vntb: Add check to detect 'db_count' value of 0 9cc0f8e63e8c3 drm/edid: fix OOB read in drm_parse_tiled_block() 5e4c4ab99abc9 gpiolib: initialize return value in gpiochip_set_multiple() 7550becf33014 power: sequencing: fix ABBA deadlock in pwrseq_device_unregister() 9697db03e0103 bpf: Fix effective prog array index with BPF_F_PREORDER 3bdfa0e435f31 bpf: zero-initialize the fib lookup flow struct b05337635be3c bpftool: Fix vmlinux BTF leak in cgroup commands 68b41e68a6229 bpf: Fix stack slot index in nospec checks aa33b44f70bfe rtc: ds1307: handle oscillator stop flag for ds1337/ds1339/ds3231 56e5f8a409f8c rtc: abx80x: fix the RTC_VL_CLR clearing all status flags 93f95538b611a dpaa2-switch: do not accept VLAN uppers while bridged ea24f911ead85 ipv6: ioam: fix type confusion of dst_entry a6450f7cfae57 ipv6: ndisc: fix NULL deref in accept_untracked_na() 2066e692ec7a1 net: airoha: Fix skb->priority underflow in airoha_dev_select_queue() 1d51aff78f078 net/sched: act_ct: fix nf_connlabels leak on two error paths a103cdb0681e7 net: emac: Fix NULL pointer dereference in emac_probe 2855ec137a224 octeontx2-pf: mcs: Fix mcs resources free on PF shutdown da603b606ceb3 octeontx2-pf: Clear stats of all resources when freeing resources 5636f0f3bd99b octeontx2-af: mcs: Fix unsupported secy stats read ceef83f0eaf9c net: ethernet: mtk_ppe: Fix rhashtable leak in mtk_ppe_init error paths a0c5fdeb5fa25 tipc: fix use-after-free of the discoverer in tipc_disc_rcv() 5dda4f164a633 net: marvell: prestera: initialize err in prestera_port_sfp_bind 9200c8149910d selftests/mm: fix exclusive_cow test fork() handling 55fc2f99d0979 selftests/mm: allow PUD-level entries in compound testcase of hmm tests c8add1d06512b selftests/mm: clarify alternate unmapping in compaction_test 0caa28e978941 selftests/mm: skip uffd-stress test when nr_pages_per_cpu is zero 471b62966c782 selftests/mm: ensure destination is hugetlb-backed in hugetlb-mremap 9dbfd514148dd selftest/mm: register existing mapping with userfaultfd in hugetlb-mremap a8673dbd3d4a0 selftests/mm: free dynamically allocated PMD-sized buffers in split_huge_page_test 31b28910abe34 selftests/mm: size tmpfs according to PMD page size in split_huge_page_test fff7d3ea3a4c4 selftests/mm: fix cgroup task placement and drop memory.current checks in hugetlb_reparenting_test.sh 8c65c58868ecc selftests/mm: fix hugetlb pathname construction in hugetlb_reparenting_test.sh 58cd8ff69e33c selftests/mm: restore default nr_hugepages value via exit trap in hugetlb_reparenting_test.sh b805de2abfa34 selftests/mm: restore default nr_hugepages value via exit trap in charge_reserved_hugetlb.sh 37e3e8a2c3bfd alloc_tag: fix use-after-free in /proc/allocinfo after module unload 502b3ae43f798 irqchip/crossbar: Fix parent domain resource leak 002ebbcc8414c mailbox: imx: Forward the timeout/ error in imx_mu_generic_tx() 7e23965d44f06 netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak d32e4301a0e5e netfilter: nf_reject: skip iphdr options when looking for icmp header 8e935c51b65d9 netfilter: nft_flow_offload: zero device address for non-ether case 4c61d28634fbf netfilter: flowtable: move path discovery infrastructure to its own file 13c6ba6e0f216 netfilter: nft_meta_bridge: add validate callback for get operations 5baa149abb41a netfilter: nft_payload: reject offsets exceeding 65535 bytes 12088da6add5b netfilter: ipset: make sure gc is properly stopped 8087bb360a936 netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer() c4d257734e91b netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types a0afd353c2f7e netfilter: ipset: annotate "pos" for concurrent readers/writers 7228cc8ff6265 netfilter: ipset: Fix data race between add and dump in all hash types 6d92dbd73d19a md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry 2c5384c40a4ce md/raid1: honor REQ_NOWAIT when waiting for behind writes 119903c320830 md: merge mddev serialize_policy into mddev_flags 2e414af05a7cf md: merge mddev faillast_dev into mddev_flags 9408c233a5bbe md: merge mddev has_superblock into mddev_flags 5464ee6442376 mac802154: Prevent overwrite return code in mac802154_perform_association() de3bd9809af75 ieee802154: fix kernel-infoleak in dgram_recvmsg() d22e278cd0679 ieee802154: Remove WARN_ON() in cfg802154_pernet_exit() f4860dd988b10 ieee802154: Avoid calling WARN_ON() on -ENOMEM in cfg802154_switch_netns() 5d17ebdf6c236 ieee802154: Restore initial state on failed device_rename() in cfg802154_switch_netns() 3b40ebc19ad02 ACPI: IPMI: Fix inverted interface check in ipmi_bmc_gone() 45465b0e01354 ACPI: resource: Amend kernel-doc style 7ae67f0e1c16b thermal: intel: Fix dangling resources on thermal_throttle_online() failure 679fd0bf4f8ab arm64/hw_breakpoint: reject unaligned watchpoints that would truncate BAS 4c16176fc11a6 ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints a762b9865f494 selftests: vlan_bridge_binding: Fix flaky operational state check c6d3bcb0f934d flow_dissector: check device type before reading ETH_ADDRS 68af74ad696ce net: macb: add TX stall timeout callback to recover from lost TSTART write 112b5eff24e04 net: airoha: fix foe_check_time allocation size 5ffb2b4987cc9 devlink: Fix parent ref leak on tc-bw failure 02c884d9aaca3 devlink: Fix parent ref leak in devl_rate_node_create() 0dafdaaf8684b dpaa2-switch: fix VLAN upper check not rejecting bridge join c7fc9adf4e006 virtio-net: fix len check in receive_big() 0d95587d662a5 spi: rpc-if: Use correct device for hardware reinitialization on resume f37f2f804796e PCI: iproc: Restore .map_irq() for the platform bus driver 53c23d56b46b1 ALSA: usb-audio: qcom: clear opened when stream enable fails 25a867aa5e67a ALSA: usb-audio: qcom: reject stream disable with no active interface 207bb4ce8fe7d sctp: hold socket lock when dumping endpoints in sctp_diag a6cfb924ad74e net: psample: fix info leak in PSAMPLE_ATTR_DATA 3d45d40b872ae octeontx2-pf: Fix leak of SQ timestamp buffer on teardown 290ad0a548915 drm/amdgpu: initialize irq.lock spinlock earlier 96ac562a9ea30 drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm 211bb9d8f17c4 drm/amd/display: Fix mem_type change detection for async flips 0e27d92f69b8e drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free 7bcd4ef375fa3 ASoC: tlv320aic3x: restrict CLKDIV bypass Q values in dual-rate mode ca297485271c6 perf dso: Set standard errno on decompression failure 05b11debdffe0 perf bpf: Validate array presence before casting BPF prog info pointers c8cb4a92eda6e perf cs-etm: Bounds-check CPU in cs_etm__get_queue() b389a5b215e35 perf cs-etm: Require full global header in auxtrace_info size check c13532ff67fae perf cs-etm: Validate num_cpu before metadata allocation 87d23f25b5e97 perf machine: Use snprintf() for guestmount path construction 6d99379c58f7f xfrm: validate selector family and prefixlen during match 7248ae02a9453 xfrm: annotate data-races around xfrm_policy_count[] and xfrm_policy_default[] a1a3360a0c44b xfrm: Fix xfrm state cache insertion race 1467ca02ddac4 ALSA: usb-audio: qcom: Free sideband sg_table objects 507a7b07f3fa3 i3c: master: Add missing runtime PM get in dev_nack_retry_count_store() 34cd92141a024 i3c: master: Update dev_nack_retry_count under maintenance lock 95028569589f4 spi: dw: fix wrong BAUDR setting after resume 355e51eeffc6b drm/xe: Fix wa_oob codegen recipe for external module builds 2024940522ef4 drm/i915: clear CRTC color blob pointers after dropping refs 1348bf64c1978 gpio: mlxbf3: fail probe if gpiochip registration fails 7d3532a0b11a2 perf cs-etm: Reject CPU IDs that would overflow signed comparison a56f29ad8aacf perf: Remove redundant kernel.h include f8898d2eb71ae perf bpf: Bounds-check array offsets in bpil_offs_to_addr() cafd80d81f08b perf bpf: Reject oversized BPF metadata events that truncate header.size 1935d213aeb23 perf bpf: Validate func_info_rec_size and sub_id in synthesize_bpf_prog_name() aea30b437ebd0 perf sched: Replace (void*)1 sentinel with proper runtime allocation bc27041e8971e perf hwmon: Fix fd check to accept fd 0 in hwmon_pmu__describe_items() 661f60a8a5cf8 perf tools: Use snprintf() for root_dir path construction 5d080b7324f07 perf dso: Set error code when open() fails on uncompressed fallback path debfcd673a6d1 perf dso: Fix heap overflow in dso__get_filename() on decompressed path 95bf4dbcd5022 perf tools: Fix uninitialized pathname on uncompressed fallback in filename__decompress() fa870f951793d perf tools: Add O_CLOEXEC to open() calls in DSO and ELF code 3ae7947101b97 perf tools: Don't read build-ids from non-regular files 2c19e40753ec1 perf symbols: Break infinite loop on zero-filled notes in sysfs__read_build_id() 137eabe3c18ff perf symbols: Validate p_filesz before use in filename__read_build_id() ca3393e258f63 perf symbols: Fix bswap copy-paste error for 32-bit ELF p_filesz f231387f3d2bb sparc: led: avoid trimming a newline from empty writes 17955f1995bf9 accel/ivpu: fix HWS command queue leak on registration failure 85873b1bd3664 apparmor: fix label can not be immediately before a declaration 38d3d33bf42c2 i3c: master: Prevent reuse of dynamic address on device add failure c4f2afcdc5470 i3c: master: Defer new-device registration out of DAA caller context 3891c061341fb i3c: master: Ensure Hot-Join operations are stopped on shutdown 57490b302b984 i3c: master: Consolidate Hot-Join DAA work in the core 0bd450d40f874 i3c: master: Move rstdaa error suppression fd32e8d4a2933 i3c: master: Add i3c_master_do_daa_ext() for post-hibernation address recovery b07a318afca16 i3c: master: Introduce optional Runtime PM support 882ee831366a1 i3c: master: Replace WARN_ON() with dev_err() in i3c_dev_free_ibi_locked() de2106d99b87a i3c: add sysfs entry and attribute for Device NACK Retry count 0d66830f302fd i3c: master: Make hot-join workqueue freezable to block hot-join during suspend eb9db96a5deb3 i3c: master: add WQ_PERCPU to alloc_workqueue users 45bbc1e1fe626 i3c: mipi-i3c-hci: Preserve RUN bit when aborting DMA ring d22ab94261c7b i3c: mipi-i3c-hci: Switch PIO data allocation to devm_kzalloc() 973fda38b124c i3c: mipi-i3c-hci: Allow for Multi-Bus Instances 5625b8767ce3e i3c: mipi-i3c-hci: Quieten initialization messages 2791dd42d41e3 apparmor: fix uninitialised pointer passed to audit_log_untrustedstring() fdf610a9a9e72 apparmor: don't audit files pointing to aa_null.dentry b58d240883dfe apparmor: put secmark label after secid lookup 66a6c61369d41 apparmor: aa_getprocattr free procattr leak on format failure 22dc9433d458c apparmor: fail policy unpack on accept2 allocation failure 3b918f6f52390 apparmor: Fix return in ns_mkdir_op 566d1ef98a711 apparmor: remove or add symlinks to rawdata according to export_binary fbfdb5a94a487 apparmor: fix NULL pointer dereference in unpack_pdb 57b1bd4486d56 apparmor: fix potential UAF in aa_replace_profiles b427061ca4983 apparmor: grab ns lock and refresh when looking up changehat child profiles 9111f76e8dc8c apparmor: fix rawdata_f_data implicit flex array ae02e603c0b39 apparmor: aa_label_alloc use aa_label_free on alloc failure d821601323456 apparmor: check label build before no_new_privs test ad965f36d2986 security/apparmor/apparmorfs.c: conditionally compile get_loaddata_common_ref() 045dbe89ac317 apparmor: fix refcount leak when updating the sk_ctx d8ea44f6090c0 apparmor: fix race in unix socket mediation when peer_path is used ef488d7429d23 apparmor: fix shadowing of plabel that prevents cache from being updated f79519f636059 Revert "PCI/MSI: Unmap MSI-X region on error" 514b84b1bf30f PCI: dwc: Avoid dwc_pcie_rasdes_debugfs_deinit() NULL dereference when no RAS DES capability 11016555d7510 phy: freescale: phy-fsl-imx8qm-lvds-phy: Fix missing pm_runtime_disable() on probe error path 872f9a63a108e PCI: mediatek: Use actual physical address instead of virt_to_phys() f77c490c45d46 PCI: mediatek: Fix possible truncation in mtk_pcie_parse_port() 9ca0a78a5d561 dt-bindings: phy: sc8280xp-qmp-pcie: Disallow bifurcation register on Purwa f1f5f8d334e91 perf symbols: Add bounds checks to read_build_id() note iteration in minimal build cc6cd3fe8b8b1 perf symbols: Add bounds checks to elf_read_build_id() note iteration a3e758e741228 perf bpf: Fix metadata leak in perf_env__add_bpf_info() on duplicate insert f593775fecf5a perf bpf: Fix map data leak in bpf_metadata_create() on alloc failure bafb6bfb346fe perf bpf: Add NULL check for btf__type_by_id() in synthesize_bpf_prog_name() fe4d8ad2e96f4 tools lib api: Fix mount_overload() snprintf truncation and toupper range b0385203a09f0 tools lib api: Fix filename__write_int() writing uninitialized stack data 41b3a92310450 perf tools: Use snprintf() in dso__read_running_kernel_build_id() fbaf9bdfc0917 perf hwmon: Guard label read against empty or failed reads d34b42ee0c74d perf symbols: Bounds-check descsz in sysfs__read_build_id() GNU fallback bc2fc12ce6e4d perf hwmon: Fix parse_hwmon_filename() strlcpy buffer overflow f830bb8d221f3 perf hwmon: Use scnprintf() in hwmon_pmu__for_each_event() 76dfa13a0acb1 perf hwmon: Fix off-by-one null termination on sysfs reads 56b17c84394f1 perf tools: Fix thread__set_comm_from_proc() on empty comm file f2e5262589d94 perf intel-pt: Fix snprintf size tracking bug in insn decoder 45e7900e1555c perf symbols: Bounds-check .gnu_debuglink section data 4f883ab5bc7b7 perf symbols: Fix signed overflow in sysfs__read_build_id() size check 490473192ac2f tools lib api: Fix missing null termination in filename__read_int/ull() 09962b811ef14 perf pmu: Fix perf_pmu__parse_scale/unit() OOB access on empty sysfs file a6eec54329b43 perf pmu: Fix pmu_id() heap underwrite on empty identifier file e274dfa05904f perf cs-etm: Queue context packets for frontend fa9eb50ddfea3 perf s390: Fix TEXTREL in Python extension by compiling as PIC b5a0a4a564d21 xprtrdma: Return sendctx slot after Send preparation failure 007b4da2f38dc xprtrdma: Repost Receive buffers for malformed replies 469b22376ee73 xprtrdma: Sanitize the reply credit grant after parsing d7a2870dde3bb xprtrdma: Fix bcall rep leak and unbounded peek 345652531400f xprtrdma: Resize reply buffers before reposting receives 47b3dc59e09e9 xprtrdma: Document and assert reply-handler invariants 7471e66373a44 xprtrdma: Check frwr_wp_create() during connect 28743571c17b5 xprtrdma: Initialize re_id before removal registration d0479c2b12974 xprtrdma: Fix ep kref imbalance on ADDR_CHANGE 6d52921f47020 perf hists: Fix snprintf() in hists__scnprintf_title() UID filter path 56ad33189ed5f perf bpf: Use scnprintf() in snprintf_hex() and synthesize_bpf_prog_name() c32fe40b0c745 perf sched: Fix idle-hist callchain display using wrong rb_first variant 77051ef66e4ad perf sched: Bounds-check prio before test_bit() in timehist 2e0dd50e5a4da PCI: rcar-host: Remove unused LIST_HEAD(res) b9e8406651dcc perf tools: Use perf_env__get_cpu_topology() in machine__resolve() 504028f561b19 perf tools: Use scnprintf() in cpu_map__snprint() to prevent overflow 2a8244988316a perf tools: Fix get_max_num() size_t underflow on empty sysfs file 3f4476a089a6d platform/x86/intel/vsec: Restore BAR fallback for header walk d6565e08166c8 platform/x86/intel/vsec: Return real error codes from registration path 4df30a4dc0e97 platform/x86/intel/vsec: Switch exported helpers from pci_dev to device 817ab332d37ce platform/x86/intel/vsec: Decouple add/link helpers from PCI e6523bcafeb61 platform/x86/intel/vsec: correct kernel-doc comments c0d97519c9dfb platform/x86:intel/pmc: Relocate lpm_req_guid to pmc_reg_map b95e1facc5b7f platform/x86:intel/pmc: Rename PMC index variable to pmc_idx 3e86797c0699d platform/x86:intel/pmc: Add support for multiple DMU GUIDs 4f129fc6f756f fs/ntfs3: resize log->one_page_buf when adopting on-disk page size d3491b23bc207 PCI: meson: Add missing remove callback a5c0ba31eef9e PCI: meson: Propagate devm_add_action_or_reset() failure f0aaa198e068b pwm: rzg2l-gpt: Add missing newlines to dev_err_probe() messages a57692ad365f3 PCI: mediatek: Fix operator precedence in PCIE_FTS_NUM_L0 macro f161ef7b0dd2f nfs: use nfsi->rwsem to protect traversal of the file lock list a6f147b23e361 NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS in pg_get_mirror_count_write a70375f0b793e NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS on fatal DS connect errors b694c7de94bc5 nfs: keep PG_UPTODATE clear after read errors in page groups f84949dd17847 NFSv4/pnfs: defer return_range callbacks until after inode unlock 53442c7d0c888 xprtrdma: Decouple req recycling from RPC completion becc90a04780a xprtrdma: Use sendctx DMA state for Send signaling e7ae0883c8c89 xprtrdma: Post receive buffers after RPC completion f043dd58fbd79 xprtrdma: Close lost-wakeup race in xprt_rdma_alloc_slot b7bc8e7f09ae4 xprtrdma: Avoid 250 ms delay on backlog wakeup 44b73b4b7eff7 pNFS/filelayout: fix cheking if a layout is striped f3f21b94cf980 sunrpc: Fix error handling in rpc_sysfs_xprt_switch_add_xprt_store() e8dc126e80395 clk: qcom: a53: Corrected frequency multiplier for 1152MHz c0e6bb2b0408f dmaengine: dma-axi-dmac: use DMA pool to manange DMA descriptor 9f1ef67c041ef dmaengine: dma-axi-dmac: Properly free struct axi_dmac_desc 329ec20a86091 dmaengine: Fix possible use after free 7d49f0ddaf5a4 dmaengine: qcom: gpi: set DMA_PRIVATE capability 8e2c460a8f0e4 mshv: add bounds check on vp_index in mshv_intercept_isr() eaf937b501fd0 clk: qcom: camcc-x1e80100: Add support for camera QDSS debug clocks 032692e4525a0 dt-bindings: clock: qcom: Add X1P42100 camera clock controller c7c8bab87d0df perf tools: Fix int16_t truncation of max_cpu_num in set_max_cpu_num() e16012f8f63d3 perf timechart: Fix cpu2y() OOB read on untrusted CPU index 330219fe8523f perf c2c: Fix use-after-free in he__get_c2c_hists() error path 01564c1a260f6 perf stat: Introduce perf_env__get_cpu_topology() to guard NULL env->cpu c05ba5b57505a perf mmap: Fix NULL deref in aio cleanup on alloc failure c4406dbe5d8f4 perf sched: Replace BUG_ON and add NULL checks in replay event helpers b1f7683632712 perf sched: Use thread__put() in free_idle_threads() 1517402d0a81c perf sched: Clean up idle_threads entry on init failure d6b586bb8f489 perf c2c: Bounds-check CPU IDs in setup_nodes() topology loop 2f9f7224e7691 perf c2c: Bounds-check CPU and node IDs before bitmap and array access 278e30717c356 perf stat: Bounds-check CPU index in topology aggregation callbacks 21a9b87ada08d perf mmap: Guard cpu__get_node() return in aio_bind() 652cea73b7b7b perf sched: Fix register_pid() overflow, strcpy, and BUG_ON 068e9b6a07bc0 perf sched: Cap max_cpu at MAX_CPUS in timehist sample processing 1d25a8418c890 perf tools: Add bounds check to cpu__get_node() 89489a31f4443 perf sched: Fix thread reference leak in latency_switch_event ea486d61b1663 perf tools: Guard test_bit from out-of-bounds sample CPU 18961e0f8966e perf annotate: Fix crashes on empty annotate windows 93f3e84fc74e6 perf: Fix off-by-one stack buffer overflow in kallsyms__parse() d78b16d078149 dt-bindings: dma: nvidia,tegra186-gpc-dma: Make reset optional a498063f95bdd dmaengine: imx-sdma: Refine spba bus searching in probe da40583823153 thunderbolt: debugfs: Fix margining error counter buffer leak 038a0f01dda59 drm/amd/display: Add missing kdoc for ALLM parameters c5388a957cf1d fs/ntfs3: fix mount failure on 64K page-size kernels a318932065883 fs/ntfs3: add bounds check to run_get_highest_vcn() 097fcf945d93a HID: logitech-hidpp: remove excess kernel-doc member in hidpp_scroll_counter 26fa946925a09 clk: at91: keep securam node alive while mapping it 0147c544cbc6e iio: tcs3472: power down chip on probe failure 1cddef80a180a iio: accel: mma8452: handle I2C read error(s) in mma8452_read() 9ac3675bf8757 iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling 3d57672119525 iio: magnetometer: ak8975: fix potential kernel stack memory leak 6ec473b360342 iio: light: si1133: prevent race condition on timeout f835b69fbeaeb iio: light: si1133: reset counter to prevent race condition fd6b65ade1190 perf header: Sanity check HEADER_EVENT_DESC attr.size before swap be62602fe0797 PCI: qcom: Disable ASPM L0s for SA8775P de93ef83f99e8 powerpc tools perf: Initialize error code in auxtrace_record_init function 96c8f732cadf7 clk: renesas: rzg2l: Rename iterator in for_each_mod_clock() to avoid shadowing fdee9f207a48c gpib: fix double decrement of descriptor_busy in command_ioctl() 3d5e4cc0d9dce char: tlclk: fix use-after-free in tlclk_cleanup() d72ece584c448 gpib: Fix inappropriate ioctl error return 92f8b1d833834 perf test amd ibs: Fix incorrect kernel version check 2b2b1613b734b usb: host: max3421: Reject hub port requests for non-existent ports 02d03c61e8a7b usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control() 43078449ad623 staging: most: video: avoid double free on video register failure 45652323ce74b perf inject: Add --convert-callchain option 28ebd287a7fad perf build-id: Fix off-by-one bug when printing kernel/module build-id fc5ce5606db57 PCI: dwc: Fix signedness bug in fault injection test code 7d881615fb637 mailbox: mtk-adsp: fix UAF during device teardown 91353d63bbf61 mailbox: mpfs: fix check for syscon presence in mpfs_mbox_inbox_isr() e6bc4e127707d coresight: Fix source not disabled on idr_alloc_u32 failure 67d0475e78b39 soundwire: intel_ace2x: release bpt_stream when close it 5732869c70d42 clk: at91: sam9x7: Fix gmac_gclk clock definition f28906e7e32fd perf pmu: Skip test on Arm64 when #slots is zero 210c202c0576b phy: phy-can-transceiver: Check driver match and driver data against NULL 226feccaac818 clk: qcom: cmnpll: Account for reference clock divider 6abdf27fbcfb3 coresight: fix missing error code when trace ID is invalid 5bb87456dcd66 bus: mhi: ep: Fix potential deadlock in mhi_ep_reset_worker() 601a9b2e3b2fb rust: alloc: fix assert in `Vec::reserve` doc test b773c7161cea7 PCI: loongson: Do not ignore downstream devices on external bridges e1b79f77336d1 perf sched: Add missing mmap2 handler in timehist c788955b4a145 platform/x86: xo15-ebook: Fix wakeup source and GPE handling 2ce4d93768d2c x86/platform/olpc: xo15: Drop wakeup source on driver removal 1d495446ec7ac PCI: Check ROM header and data structure addr before accessing 78f264c0cb2ac PCI: Introduce named defines for PCI ROM 10021c2d33061 PCI/ASPM: Don't reconfigure ASPM entering low-power state 48dde5c56426c coresight: etm4x: Correct TRCVMIDCCTLR1 save and restore 65d87f28daec3 coresight: ete: Always save state on power down 1ac8f4c112aa9 coresight: etm4x: Remove the state_needs_restore flag a454f61747c97 soundwire: fix bug in sdw_add_element_group_count found by syzkaller d3896c944338c soundwire: don't program SDW_SCP_BUSCLOCK_SCALE on a unattached Peripheral c3ca7c6741af3 coresight: cti: Fix DT filter signals silently ignored fb940466fd4d3 perf debuginfo: Fix libdw API contract violations bb3d592c7d6c4 staging: nvec: fix use-after-free in nvec_rx_completed() 466c7f87de52d i3c: master: svc: Fix missed IBI after false SLVSTART on NPCM845 db2d8b6525bdd gpiolib: acpi: Only trigger ActiveBoth interrupts on boot 02e2dadd62eae eventpoll: Fix epoll_wait() report false negative f938bc8fde518 eventpoll: rename epi->next and txlist for clarity 430dac191905b eventpoll: wrap EP_UNACTIVE_PTR in typed sentinel helpers d8f88803152f0 eventpoll: extract ep_deliver_event() from ep_send_events() 4fd51f413d7b5 eventpoll: split ep_insert() into alloc + register stages 25e85dc040a6c eventpoll: rename attach_epitem() to ep_attach_file() baebd892f8a2c eventpoll: expand top-of-file overview / locking doc f04166c8677aa eventpoll: rename ep_remove_safe() back to ep_remove() 13bf9879b778b net/9p: fix race condition on rdma->state in trans_rdma.c 9c1c120471a67 9p: avoid returning ERR_PTR(0) from mkdir operations ae1f3460833d3 ocfs2: fix circular locking dependency in ocfs2_dio_end_io_write d35e4032f16d7 mfd: cs42l43: Sanity check firmware size 706fe1ce4f3a5 mfd: rsmu: Fix page register setup 35d3d6ff2bc1e ksmbd: fix use-after-free in same_client_has_lease() aa0c43c13c0bf RDMA/bnxt_re: Fail DBR related page allocation UAPIs if the feature is disabled 0fe155aa844e4 RDMA/bnxt_re: Move the UAPI methods to a dedicated file 95d46a8d3ba9f RDMA/bnxt_re: Avoid displaying the kernel pointer 104a7ff382a58 RDMA/bnxt_re: Free SRQ toggle page after firmware teardown 5a48dd5150d7c ionic: Fix check in ionic_get_link_ext_stats 4c55003566c0b net: ethernet: oa_tc6: Remove FCS size in RX frame 93e133b9193cb net: airoha: Fix always-true condition in PPE1 queue reservation loop d774cdbda6634 tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF) 0d8a12d714312 tipc: fix UAF in tipc_l2_send_msg() db1616263a2c5 KEYS: Use acquire when reading state in keyring search 66919a6d72b9e powerpc/kexec: fix double get_cpu() imbalance in kexec_prepare_cpus 527cd14a416f2 powerpc/powernv: fix preempt count leak in pnv_kexec_wait_secondaries_down 73711688479df powerpc/perf: fix preempt count underflow in fsl_emb_pmu_del 92f38fe85198a MIPS: mm: Fix out-of-bounds write in maar_res_walk() fe09dd288722f bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check 81567d2b3f4dc sockmap: Fix use-after-free in udp_bpf_recvmsg() 073d957252696 net: remove addr_len argument of recvmsg() handlers 4e40056bb5c82 bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() 264d6a79c96ee udf: fix nls leak on udf_fill_super() failure 5e8627b7a7b7c bpf: Fix bpf_get/setsockopt to tos for ipv4-mapped ipv6 socket e803077769248 selftests/bpf: Initialize operation name before use 9f32d4c2de85f selftests/bpf: Fix typo in verify_umulti_link_info 74badb5e2b00a smb/client: always return a value for FS_IOC_GETFLAGS 21303c4a2b727 cifs: remove all cifs files before kill super 7a59146cb9ade ALSA: core: Fix unintuitive behavior of snd_power_ref_and_wait() 87d1eaffeec41 netfilter: nf_conncount: callers must hold rcu read lock 98a965cb1e767 ALSA: seq: avoid stale FIFO cells during resize 287d506d4e086 ALSA: seq: oss: Serialize readq reset state with q->lock f01fb6138f8eb kcm: use WRITE_ONCE() when changing lower socket callbacks 4d48c08a0bf6c net: airoha: Fix debugfs new-tuple display for IPv4 ROUTE entries dcac6e4221f39 net: airoha: Fix register index for Tx-fwd counter configuration 36edab340a067 net: bcmgenet: Use weighted round-robin TX DMA arbitration b91b241a4eefe landlock: Fix unmarked concurrent access to socket family 1bb02353e79f7 dpll: balance create/delete notifications in __dpll_pin_(un)register 77a1ea975c877 dpll: guard sync-pair removal on full pin unregister 8008ef973f012 dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() 6564ce3a2f9c2 dpll: send delete notification before unregister in on-pin rollback f1e1c6eb82482 dpll: fix stale iteration in dpll_pin_on_pin_unregister() 20575400fc1ba dpll: Enhance and consolidate reference counting logic ebe4bd3560a7a dpll: Support dynamic pin index allocation f7aebaee2961b net: wwan: t7xx: check skb_clone in control TX 34bd255dba321 net: ethernet: mtk_wed: debugfs: correct index in wed_amsdu_show() 1d072cc3ba433 octeontx2-af: npc: Fix size of entry2cntr_map 417bd36a085d7 bpf: Fix setting retval to -EPERM for cgroup hooks not returning errno 3d90b15fb1918 net/mlx5: Check max_macs devlink param value against max capability 8d5f4be134882 bpf: Run generic devmap egress prog on private skb 450e48271827b net/sched: sch_dualpi2: Add missing module alias 6d585d0dc6743 net: ethernet: mtk_wed: fix loading WO firmware for MT7986 446fe8ce699ce net: watchdog: fix refcount tracking races 697db22a9dcc4 net: mana: guard TX wq object destroy with INVALID_MANA_HANDLE check 62ce489acb428 net: mana: initialize gdma queue id to INVALID_QUEUE_ID bd851b10daee7 net/sched: sch_dualpi2: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen 755108bb7a508 net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen 0500af8630c32 net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen a05d638b60746 virtio_net: do not allow tunnel csum offload for non GSO packets ce311bd2e3659 tcp: clear sock_ops cb flags before force-closing a child socket 67cec2f1eb9e5 handshake: Require admin permission for DONE command d0503357653ee power: supply: core: fix supplied_from allocations 7f4aa81f5bb27 ASoC: adau1372: Clear PLL_EN on failed PLL lock without reset GPIO 0c22c00924359 iommu: Avoid copying the user array twice in the full-array copy helper 1c9246a199e19 spi: xilinx: use FIFO occupancy register to determine buffer size dae23c545eb5a ALSA: seq: Fix kernel heap address leak in bounce_error_event() 1749fef4bda0f ALSA: usb-audio: qcom: Guard sideband endpoint removal 2ba2373151936 crypto: rng - Free default RNG on module exit fb4d57b83356d crypto: cavium/cpt - fix DMA cleanup using wrong loop index 5f99a396f706a crypto: marvell/octeontx - fix DMA cleanup using wrong loop index 4941205f5fa39 cxl/test: Add check after kzalloc() memory in alloc_mock_res() a27481516d32f cxl/test: Unregister cxl_acpi in cxl_test_init() error path 7e401233f9bb7 tipc: reject inverted service ranges from peer bindings 3cfa3d8e0dc16 tipc: prevent snt_unacked underflow on CONN_ACK cebaefe1aceb6 tipc: require net admin for TIPCv2 netlink mutators 66dbb13eeb2fc net/sched: sch_hfsc: Don't make class passive twice 51a1d9836acc7 net: pfcp: allocate per-cpu tstats for PFCP netdevs ed8605c6f39b9 sctp: validate embedded address parameter length a090880c1f544 bridge: cfm: reject invalid CCM interval at configuration time bb4a5b3c91af3 net: fib_rules: Don't dump dying fib_rule in fib_rules_dump(). 0a8b5b74f0e6b net/sched: cls_flow: Dont expose folded kernel pointers 10e05634ddc19 net: dsa: qca8k: fix led devicename when using external mdio bus e098c9c6477df ASoC: tegra: tegra210_ahub: Validate written enum value 0f1510e84d7bf ASoC: fsl: fsl_audmix: Validate written enum values 9131e4b023e0d ASoC: codecs: hdac_hdmi: Validate written enum value cb527e063a32e ASoC: SOF: Intel: hda-sdw-bpt: select SND_SOF_SOF_HDA_SDW_BPT properly d3ff718c0c715 RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one 4b87a2497276a RDMA/mlx5: Fix undefined shift of user RQ WQE size 1bc1487f7a7f5 RDMA/mlx5: Remove raw RSS QP restrack tracking f704db4b0318a RDMA/mlx5: Remove DCT restrack tracking 3a1687e0506be fs: efs: remove unneeded debug prints 7e694ac97591c Bluetooth: vhci: validate devcoredump state before side effects ec4d352747a62 Bluetooth: hci: validate codec capability element length 7f206a8d8d822 Bluetooth: btmtk: fix URB leak in alloc_mtk_intr_urb error path a0fd1086a57b9 Bluetooth: hci_core: Fix UAF in hci_unregister_dev() e8815ae9dcdc5 Bluetooth: hci_event: fix simultaneous discovery stuck in FINDING f1b4df9c260c5 Bluetooth: eir: Fix stack OOB write when prepending the Flags AD e284bb94ad451 Bluetooth: hci_qca: fix NULL pointer dereference in qca_dmp_hdr() for non-serdev device c86c861c64b58 s390/process: Fix kernel thread function pointer type 0eab19ab9cb1b ASoC: cs35l56: Fix possible uninitialized value in cs35l56_spi_system_reset() c83255f3cf22d arm64: dts: allwinner: a523: Add missing GPIO interrupt ad6963c3bb458 pinctrl: airoha: an7581: fix misprint in gpio19 pinconf 5985ddfd3e83f pinctrl: airoha: an7581: add missed gpio32 pin group db3cd694ded4c pinctrl: airoha: generalize pins/group/function/confs handling 0234e8fc296e7 pinctrl: sunxi: a523: Remove unneeded IRQ remuxing flag 46fbafe3d2d56 bpf: Tighten cgroup storage cookie checks for prog arrays d416dcefdbac9 vfio/qat: fix f_pos race in qat_vf_resume_write() 1201dbb260507 of: cpu: add check in __of_find_n_match_cpu_property() d2acea4f47475 cxl/test: Zero out LSA backing memory to avoid leaking to user 42a9a76f314ef cxl/test: Fix integer overflow in mock LSA bounds checks 91ad3088ee1b7 selftests/bpf: Fix bpf_iter/task_vma test f00f5c0dd5531 ext4: fix kernel BUG in ext4_write_inline_data_end c998a09c7144e bonding: 3ad: fix mux port state on oper down f0ada4846d11b bonding: 3ad: fix carrier when no usable slaves cb20a9b50efe0 bonding: 3ad: add lacp_strict configuration knob 47636f0a70b36 netlink: specs: rt-link: missed broadcast-neigh 6b2c271d2c394 tools: missed broadcast_neigh if_link uapi header 484b3b9aa7986 ext4: fix ERR_PTR(0) in ext4_mkdir() 88cb304c0be0c ASoC: cs35l56: Don't leave parent IRQ disabled if system_suspend fails 8b55e7ec116ca ASoC: cs35l56: Fix missing calls to wm_adsp2_remove() 3ef0cfa77a3d5 vdpa/octeon_ep: fix IRQ-to-ring mapping in interrupt handler 54556d5394382 vdpa/octeon_ep: Fix PF->VF mailbox data address calculation 86e0b37738dea tools/virtio: check mmap return value in vringh_test 321c73baf54d9 vhost/net: complete zerocopy ubufs only once 646614dcb1607 vduse: Requeue failed read to send_list head f9d9220234451 virtio_console: read size from config space during device init 79366023aa891 virtio: rtc: tear down old virtqueues before restore 1f5f94c6c6b2e vhost/vdpa: validate virtqueue index in mmap and fault paths a2d0a57538fd0 vduse: hold vduse_lock across IDR lookup in open path 3d56f3fb201ff ASoC: codecs: aw88261: fix incorrect masks for boost regs ecb9be4fc8be0 spi: meson-spifc: fix runtime PM leak on remove da6f86ff4f2dd NFSD: Handle layout stid in nfsd4_drop_revoked_stid() 37e85be551c4d IB/mlx4: Fill in the access_flags if IB_MR_REREG_ACCESS is not specified e6d83f877d5ab ASoC: sma1307: Fix uevent string leaks in fault worker 701ea71c17c92 igc: skip RX timestamp header for frame preemption verification 2aa37c8ef1092 btrfs: fix deadlock cloning inline extent when using flushoncommit f85410ebf20bb btrfs: annotate lockless read of defrag_bytes in should_nocow() 18285888cb41a btrfs: zoned: always set max_active_zones for zoned devices 943f5917c53ca Revert "btrfs: fix the file offset calculation inside btrfs_decompress_buf2page()" ba641829c11cb btrfs: zoned: don't account data relocation space-info in statfs free space bd5e90b0f5a09 hwmon: (it87) Clamp negative values to zero in set_fan() ebb579c5c0f0f vfs: add FS_USERNS_DELEGATABLE flag and set it for NFS de590cdf7efec fbdev: sm501fb: Fix buffer errors in OF binding code 0678fed27def9 wifi: ath12k: enable IEEE80211_VHT_EXT_NSS_BW_CAPABLE when NSS ratio is reported 47e5302722e09 gpio: mt7621: fix interrupt banks mapping on gpio chips 90a9c909c5b75 ALSA: aloop: Drop superfluous break 3b15d02be05e7 btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs() 7ec839c7c0bc1 wifi: mt76: mt7996: fix potential tx_retries underflow ad12fdaaed16c wifi: mt76: mt7925: fix potential tx_retries underflow 3b6e6fefa57f4 wifi: mt76: mt7921: fix potential tx_retries underflow 6b8e35685c18c wifi: mt76: mt7915: fix potential tx_retries underflow 6356a829a1edc wifi: mt76: fix argument to ieee80211_is_first_frag() 42f34c478fcdf wifi: mt76: mt7996: limit work in set_bitrate_mask 1a399103cacc9 wifi: mt76: mt7996: fix reading zeroed info->control.flags after mt76_tx_status_skb_add() dfb27e5dd9e4d wifi: mt76: mt7996: Fix possible NULL pointer dereference in mt7996_mac_write_txwi_80211() 06e65d6cf8049 wifi: mt76: mt7996: Fix possible token leak in mt7996_tx_prepare_skb() c386e90a7ce8d wifi: mt76: mt7925: validate skb length in testmode query 856fa6a21586f wifi: mt76: mt792x: skip MLD header rewrite for 802.3 encap TX a10e4959a73be wifi: mt76: mt7925: keep TX BA state in the primary WCID b8bf7c221b364 wifi: mt76: mt7925: fix stale pointer comparisons in change_vif_links bd3b91ff13006 wifi: mt76: mt7996: add missing max_remain_on_channel_duration c7a83899203ed wifi: mt76: use kfree_rcu for offchannel link in mt76_put_vif_phy_link 3f0ea6d14fa44 wifi: mt76: mt7925: clean up DMA on probe failure ce9d5a021cfca ARM: configs: Drop duplicated CONFIG_EXT4_FS c788617705c3a sched/fair: Fix cpu_util runnable_avg arithmetic a2e8b5264f92e hwspinlock: qcom: avoid uninitialized struct members bbd664b7c77f6 vmalloc: fix NULL pointer dereference in is_vm_area_hugepages() 648a3960e3664 pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins 34-39 44cff0737127b pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39 f775e7bda9a4f scsi: target: Remove tcm_loop target reset handling c2bd9fdb448d6 scsi: target: Fix hexadecimal CHAP_I handling 0404baeb9e430 pinctrl: qcom: Fix resolving register base address from device node 298821692d447 watchdog: unregister PM notifier on watchdog unregister 637ef4961470e configfs: fix lockless traversals of ->s_children f25d6e4ec4c25 firmware_loader: Fix recursive lock in device_cache_fw_images() 9e82497138abe ASoC: amd: acp-sdw-sof: Bound DAI link iteration 1279bdab5fa1f ASoC: amd: acp-sdw-legacy: Bound DAI link iteration e8d89baf92170 spi: ep93xx: fix double-free of zeropage on DMA setup failure e123f0ab02d05 IB/mlx5: Don't mangle the mr->pd inside the rereg callback fd284b12810e4 IB/mlx5: Pull the pdn out of the depths of the umr machinery 8119fe468b01f IB/mlx5: Remove unused mkc bits in mlx5r_umr_update_mr_page_shift() d4f84bfa089fe IB/mlx5: Properly support implicit ODP rereg_mr f5657d399b7ef IB/mlx5: Don't take the rereg_mr fallback without a new translation c213b71a2d416 btrfs: don't force DIO writes to be serialized 920dcf1cb8dae thermal: testing: reject missing command arguments dde04550fd6ff cpufreq: Documentation: fix conservative governor freq_step description 6cb635ad1006d ACPI: IPMI: Fix message kref handling on dead device b7474f4432dd9 bpf: Fix NULL pointer dereference in bpf_task_from_vpid() 84932636d020b powerpc/8xx: implement get_direction() in cpm1 8daa1a64711ed kunit:tool: Don't write to stdout when it should be disabled 8b0510cc3a4a0 bpf: Fix NMI/tracepoint re-entry deadlock on lru locks 74ac1ce1f4afd ALSA: seq: Clear variable event pointer on read c04e0cde2fa38 riscv: stacktrace: Remove bogus -0x4 offset in non-FP walk_stackframe 834d4cc067fa6 riscv: cpu_ops: Change return value type of cpu_is_stopped() to bool 4b2b6bc7f5ebe ALSA: seq: Fix partial userptr event expansion af8f0ea1f0a3a wifi: wcn36xx: fix OOB read from short trigger BA firmware response f03782f7f41f2 wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication 1b5d8a248c3af wifi: wcn36xx: fix heap overflow from oversized firmware HAL response 495e7e832c670 bpf: Update transport_header when encapsulating UDP tunnel in lwt efe57b72196ae bpf: Check tail zero of bpf_prog_info 58513d6d12410 bpf: Check tail zero of bpf_map_info 2eb39de4962f8 bpf: Clear rb node linkage when freeing bpf_rb_root f6183983ce1ff RDMA/siw: Fix endpoint/socket association handling 04255bda8d795 arm64: dts: imx8mp-kontron: Fix GPIO for display power switch e6ab22200e449 arm64: dts: tqma8mpql-mba8mpxl: configure sai clock in audio codec as well f3ef944c55991 arm64: dts: lx2162a-clearfog: use rev2 SoC dtsi b5087fc4ef1f8 arm64: dts: imx95: Correct PCIe outbound address space configuration ab4b5a07e1c1a arm64: dts: imx8mp-kontron: Reduce EERAM SPI clock frequency f9173e0fc026c RDMA/irdma: Initialize iwmr->access during MR registration 54cab78df0375 RDMA/irdma: Fix OOB read during CQ MR registration 844a1ae78e220 ALSA: hda: fix Kconfig dependency of HD Audio PCI 47831b503ecb7 IB/cm: Fix av cm device leak on an error path in cm_init_av_by_path() fe5414d6b3995 RDMA/hfi1: Open-code rvt_set_ibdev_name() 77b4bfc1ce32a netfilter: conntrack: call nf_ct_gre_keymap_destroy() if master helper is pptp d53eecbca16f0 netfilter: conntrack: revert ct extension genid infrastructure e6665d36b37b4 x86/cpu: Remove obsolete aperfmperf_get_khz() declaration dd0d22fdae4cb ALSA: usb-audio: qcom: Initialize offload control return value 8ebc31b86dccd netfilter: synproxy: protect nf_ct_seqadj_init() with conntrack lock 5c9c67cf7a3d1 netfilter: synproxy: fix unaligned memory access in timestamp adjustment b171119082bab netfilter: synproxy: adjust duplicate timestamp options 4dbb71c046f72 netfilter: synproxy: drop packets if timestamp adjustment fails dce1e3cf735d1 netfilter: nfnetlink_cthelper: use {READ,WRITE}_ONCE for accessing helper flags 7b819a84f1d5f netfilter: nfnetlink_osf: fix mss parsing on big-endian architectures c3ebf67cf8a96 ocfs2: fix race between ocfs2_control_install_private() and ocfs2_control_release() a087b2d3411e7 ocfs2/dlm: require a ref for locking_state debugfs open 3fa7139b5f427 ocfs2: reject FITRIM ranges shorter than a cluster 0e389fc290c35 ocfs2: fix buffer head management in ocfs2_read_blocks() 3fe2d0d21c8ae lib: kunit_iov_iter: repeatedly call alloc_pages_bulk() bb44a7690a4d5 ocfs2: rebase copied fsdlm LVB pointers in locking_state 9af58d10d0d8c of: reserved_mem: avoid post-init UAF when alloc_reserved_mem_array() fails 9a030fcb4b192 drm/amdkfd: always resume_all after suspend_all b8d15e85596ad cxl/fwctl: Fix __fortify_panic b64120d54278e xfrm: fix NAT-related field inheritance in SA migration ac9e29b191a03 perf/x86/amd/uncore: Use Node ID to identify DF and UMC domains 58cbb1c2aadf8 perf/x86/intel/uncore: Fix discovery unit lookup for multi-die systems 4e18e9361aab0 perf/x86/amd/core: Always use the NMI latency mitigation f5102e0fc3c6d iommu/vt-d: Fix RB-tree corruption in probe error path 7f229d27bf27c vhost: fix vhost_get_avail_idx for a non empty ring 73f9f54d71749 bpftool: Use libbpf error code for flow dissector query 4beed798daf4d drm/amdgpu: set sub_block_index for mca ras sub-blocks e82d515092a0c ext4: fix fast commit wait/wake bit mapping on 64-bit 8cbd587e8cdb6 lockdep/selftests: Restore sched_rt_mutex state on PREEMPT_RT 8d5ed4810e479 lockdep/selftests: Restore migrate_disable() state on PREEMPT_RT c3b073a209a9b configfs_lookup(): don't leave ->s_dentry dangling on failure 778bb4939d457 riscv: dts: sophgo: sg2042: use hex for CPU unit address efe71fbced524 riscv: dts: sophgo: sg2044: use hex for CPU unit address 5a1168ba0a95b lib/test_meminit: use && for bools 3777588848520 tick/sched: Fix TOCTOU in nohz idle time fetch 5cf2c85b12312 bpf: Reject exclusive maps for bpf_map_elem iterators 0830287cc6cb7 driver core: Use system_percpu_wq instead of system_wq 5e406928404d6 nvme: fix FDP fdpcidx bounds check 36bdda0c86d51 sched: restore timer_slack_ns when resetting RT policy on fork ffa974b2f50ad ext2: fix ignored return value of generic_write_sync() 8d763babb2a2f mm/fake-numa: fix under-allocation detection in uniform split 61f1972972824 bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs d81370c6c4f5f scsi: ufs: Fix wrong value printed in unexpected UPIU response case 846052542cfa6 scsi: pm8001: Fix error code in non_fatal_log_show() 0de14eae6de88 libbpf: Skip max_entries override on signed loaders abe383999640f libbpf: Skip initial_value override on signed loaders b6862b6a25c6a libbpf: Reject non-exclusive metadata maps in the signed loader 3a0f73d27a8d3 bpf: Reject exclusive maps as inner maps in map-in-map 91ca9eab008b9 scsi: Revert "scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans" 5c53406098b59 nvdimm/btt: Handle preemption in BTT lane acquisition d292b30e1b746 x86/cpu: Keep the PROCESSOR_SELECT menu together 901802925ebed ARM: imx31: Fix IIM mapping leak in revision check 617a5a67ce016 ata: libata: Fix ata_exec_internal() cfcea221db933 wifi: ath12k: fix NULL deref in change_sta_links for unready link eb9b89baf3087 wifi: ath12k: fix incorrect HT/VHT/HE/EHT MCS reporting in monitor mode adf0eb748d21d HID: wiimote: Fix table layout and whitespace errors 2d642797dd1c1 ARM: imx3: Fix CCM node reference leak f0742d09eb6ba NFSD: Fix delegation reference leak in nfsd4_revoke_states 9e565962d999e ASoC: rsnd: Fix RSND_SOC_MASK width to single nibble 8ec64276ecd24 spi: atmel: fix DMA channel and bounce buffer leaks ab4d04bf8b2f3 ext4: fix LOGFLUSH shutdown ordering to allow ordered-mode data writeback 803087a16a4ea libbpf: Skip endianness swap when loader generation failed f3389fbaff1a1 libbpf: Skip hash computation when loader generation failed a441c0794ac28 selftests/bpf: add verification for BPF_PROG_QUERY attr size boundaries a7131340d0f95 bpf: fix BPF_PROG_QUERY OOB write and cgroup backward compat 5ac9e793ba258 raid1: fix nr_pending leak in REQ_ATOMIC bad-block error path b7313f23ea5a7 md/raid10: reset read_slot when reusing r10bio for discard e04e384274f83 rpmsg: use generic driver_override infrastructure 0e2f0833556c8 Drivers: hv: vmbus: use generic driver_override infrastructure d2cf52ba2803b cdx: use generic driver_override infrastructure b41923dbf6769 amba: use generic driver_override infrastructure ff4e38a37ba53 media: qcom: venus: relax encoder frame/blur step size on v6 bc7c166cc1012 media: qcom: venus: relax encoder frame/blur dimension steps on v4 ffe754288750a media: qcom: venus: drop extra padding in NV12 raw size calculation f8f48c851a0d2 Revert "media: venus: hfi_platform: Correct supported codecs for sc7280" 5420eebf3b3c1 RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path 02558c86b6b76 RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe 4779f435627b2 RDMA/umem: Add ib_umem_is_contiguous() stub for !CONFIG_INFINIBAND_USER_MEM bae436a78a058 arm64: dts: st: Fix SAI addresses on stm32mp251 5da012c605fd5 EDAC/{skx_common,skx}: Fix UBSAN shift-out-of-bounds in skx_get_dimm_info 9a84ced0243c7 EDAC/igen6: Fix call trace due to missing release() ed5c94cf4ee9e drm/msm/dp: Fix the ISR_* enum values bdaea74abcf0c drm/msm/dp: fix HPD state status bit shift value 6d536a9107172 sched/deadline: Reject debugfs dl_server writes for offline CPUs 4f3c17f14cf90 crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm 5eac10c521396 crypto: tegra - Fix dma_free_coherent size error 5231093c08295 crypto: inside-secure/eip93 - Add check for devm_request_threaded_irq 8572232ed74f5 crypto: hisilicon/qm - disable error report before flr ce7a2e26e144f ocfs2: kill osb->system_file_mutex lock 3852478d34c7b ocfs2: don't BUG_ON an invalid journal dinode 070f356ea4f41 rapidio/tsi721: prevent a bad dereference in tsi721_db_dpc() 598ed7393a639 dax/kmem: account for partial discontiguous resource upon removal afdb92d9c374d arm64: tegra: Add #{address,size}-cells to Chromium-based /firmware e545fcba3660c ARM: tegra: Add #{address,size}-cells to Chromium-based /firmware c87339cc08aa0 libbpf: Fix UAF in strset__add_str() 39e8be33387e3 bpftool: Fix typo in struct_ops map FD generation for light skeleton ed7ba8d048a4c libbpf: Harden parse_vma_segs() path parsing 340936ebf5aec drm/nouveau/bios: specify correct display fuse register for Ampere and Ada 2ab7c96d8c3fb drm/tegra: Fix iommu_map_sgtable() return value check 79240eee5a400 gpu: host1x: Fix iommu_map_sgtable() return value check 142b34f7e329c drm/tegra: dc: Fix device node reference leak in tegra_dc_has_output() 8c0d3cf0d5108 gpu: host1x: Allow entries in BO caches to be freed 6b617b6ccb6eb drm/tegra: gr2d/gr3d: Contain PM in the gr*d_probe/gr*d_remove 40a2a91da02c4 drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered 05d85fd32e4fe rtla/actions: Restore continue flag in actions_perform() b7ac7ba19a0b8 rtla: Introduce for_each_action() helper dc266f6c4e262 iommu/amd: Fix premature break in init_iommu_one() 10753da2d659d net/sched: cls_bpf: prevent unbounded recursion in offload rollback 0db1949084e85 ipv6: guard against possible NULL deref in __in6_dev_stats_get() dc1470299d11d workqueue: drop spurious '*' from print_worker_info() fn declaration 3e8aed5edaeeb nvme-pci: fix out-of-bounds access in nvme_setup_descriptor_pools 140d6fff4ed26 nvme-multipath: fix flex array size in struct nvme_ns_head cba2ee57fd302 nvmet-tcp: check return value of nvmet_tcp_set_queue_sock ba3209704b3cd nvmet-tcp: fix page fragment cache leak in error path 24639c4dc466e init/initramfs_test: wait_for_initramfs() before running eb9280ea8dbd2 pinctrl: cs42l43: Fix polarity on debounce 2739d234d8952 pinctrl: cs42l43: Fix leaked pm reference on error path 95e0b4bc29ab9 pinctrl: nuvoton: ma35d1: fix MFP register offset and pin table c418c956c21c9 selftests: Fix Makefile target for nsfs 11165fe2c5ea0 ALSA: seq: midi: Serialize output teardown with event_input 6dc781778b595 ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data de236b813d8b4 ALSA: xen-front: Connect event channel after stream prepare 56694f00fbe10 ALSA: xen-front: Reset event channel state on stream clear 02f156309de0d mtd: spi-nor: Drop duplicate Kconfig dependency c4bb92b3ef54c mtd: spi-nor: debugfs: Fix the flags list 3880ee7c88d78 driver core: Guard deferred probe timeout extension with delayed_work_pending() 0a294feec21b6 driver core: Fix missing jiffies conversion in deferred_probe_extend_timeout() 2c12b0dfcedad mips: n64: add __iomem for writel call 8db227dd895a8 mips: ralink: mt7621: add missing __iomem 0c83d13f9b3f1 MIPS: DEC: Remove do_IRQ() call indirection c9a3ceeddc6ad MIPS: Fix big-endian stack argument fetching in o32 wrapper c9670fd84df12 PM: sleep: Use complete() in device_pm_sleep_init() 80f8e2302e639 pinctrl: meson: amlogic-a4: fix gpio output glitch 9420871183eab RDMA/counter: Fix incorrect port index in rdma_counter_init() error cleanup 66f44ec974ab3 RDMA/hns: Fix log flood after cmd_mbox failure 16138ea9833d6 RDMA/hns: Fix warning in poll cq direct mode f67fbbfc3beb8 IB/mlx4: Fix refcount leak in add_port() error path e59a6aa89e0fc RDMA/rxe: Fix a use-after-free problem in rxe_mmap 424d51d33c754 RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs 7a551951ebeb5 pinctrl: spacemit: fix NULL check in spacemit_pin_set_config 394ed8ad05889 bus: sunxi-rsb: Always check register address validity 090f5fb1e3e23 RDMA/mana_ib: Use ib_get_eth_speed for reporting port speed c11039512df49 pwm: imx27: Fix variable truncation in .apply() 13db458099f28 cpufreq: conservative: Simplify frequency limit handling 3fcbfc50dd52f cpufreq: Documentation: fix sampling_down_factor range 376951c51cdd0 crypto: eip93 - fix reset ring register definition 4a6f5cc42c7bf of: dynamic: Fix overlayed devices not probing because of fw_devlink ae62edb00c0eb Revert "treewide: Fix probing of devices in DT overlays" 2df37ead6d84b driver core: Use mod_delayed_work to prevent lost deferred probe work 62c8cc825f49e device property: fix fwnode reference leak in fwnode_graph_get_endpoint_by_id() b0444205ba39e kernfs: fix suspicious RCU usage in kernfs_put() 29de8448174cf writeback: drop now-unnecessary rcu_barrier() in cgroup_writeback_umount() 2469039f0fd68 arm64: dts: qcom: lemans: Add eDP ref clock for eDP PHYs baa333b2700a7 tracing: Bound synthetic-field strings with seq_buf 09a2a7d041a78 arm64: dts: qcom: sm8750: Add power-domain and iface clk for ice node 4ba44339fd3ac arm64: dts: qcom: sm8650: Add power-domain and iface clk for ice node 3c808cac676c5 arm64: dts: qcom: sm8550: Add power-domain and iface clk for ice node 0d0ce8c7025ac arm64: dts: qcom: sm8450: Add power-domain and iface clk for ice node a8be1bc8d124f arm64: dts: qcom: kodiak: Add power-domain and iface clk for ice node dc36463b283d9 arm64: dts: qcom: sc7180: Add power-domain and iface clk for ice node a2303478e7301 arm64: dts: qcom: monaco: Add power-domain and iface clk for ice node b3e05859cb516 arm64: dts: qcom: lemans: Add power-domain and iface clk for ice node 11daac2817dca firmware: arm_scmi: Fix OOB in scmi_power_name_get() 15e7368de5842 media: rockchip: rga: fix too small buffer size a88f6da618e8b net/sched: sch_drr: annotate data-races around cl->deficit 276e731b1b577 nilfs2: Fix return in nilfs_mkdir 16bf3154f8a80 tools/nolibc: getopt: Fix potential out of bounds access c67c672047667 regulator: dt-bindings: mt6359: Drop regulator-name pattern restrictions 75c0bc011abdd bitops: use common function parameter names 407aeb8c1aee8 sysfs: clamp show() return value in sysfs_kf_read() bac3e70c2fb10 firmware: arm_scmi: Read sensor config as 32-bit value 1f60c3cc302d2 firmware: smccc: Fix Arm SMCCC SOC_ID name call 3024229e4a5af riscv: dts: spacemit: set console baud rate on Milk-V Jupiter 63aa7dda9a1ed staging: media: atomisp: fix loop shadowing in ia_css_stream_destroy() d57e67ea48e4d media: atomisp: gc2235: fix UAF and memory leak 2e3e4cc0dd349 media: atomisp: Fix memory leak in atomisp_fixed_pattern_table() 5d6f34dc4f056 arm64: dts: imx95-19x19-evk: Fix PCIe EP vpcie-supply 084d7d5668f30 arm64: dts: imx8qxp-mek: Remove unnecessary PCIe EP vpcie-supply 6a576739ce4c9 arm64: dts: imx8dxl-evk: Remove unnecessary PCIe EP properties 0da72a88dbbab firmware: arm_ffa: Honor partition info descriptor size 5e353d9497f95 selftests/mm: Fix resv_sz when parsing arm64 signal frame 6a357ceb21100 iommu/arm-smmu-qcom: Fix fastrpc compatible string in ACTLR client match table bcfc49f1bcf1b selftests/bpf: Fix test for refinement of single-value tnum e4d599a286b5a selftests/bpf: Reject unsupported -k option in vmtest.sh 7471006cd854d drm/syncobj: Fix memory leak in drm_syncobj_find_fence() be2c137f23d15 RDMA/hns: Initialize seqfile before creating file 65572fbd86033 RDMA/srpt: fix integer overflow in immediate data length check 5100febf8e9d6 RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference ffa85a2c19793 RDMA/mlx5: Fix UMR XLT cleanup on ODP populate failure 2cd221fca036b RDMA/hns: Fix arithmetic overflow in calc_hem_config() 65e344925fa30 IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier b61af0268e3d1 ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD 5c1196b5a3bf3 net/sched: sch_htb: annotate data-races (I) d8cae30582f06 net/sched: sch_htb: do not change sch->flags in htb_dump() 68eae3592438d spi: hisi-kunpeng: Use dev_err_probe() for host registration failure 21650fe221ea9 crypto: ccp - Treat zero-length cert chain as query for blob lengths cb414aff28e18 scsi: hisi_sas: Add slave_destroy interface for v3 hw 8b42290df1765 net/sched: sch_hfsc: annotate data-races in hfsc_dump_class_stats() d29b9c38f6eb4 clk: scpi: Unregister child clock providers on remove 69bc4a3998742 thermal: hwmon: Fix critical temperature attribute removal a0f64cf8bfcb3 evm: terminate and bound the evm_xattrs read buffer 4c57df82af833 drm/hisilicon/hibmc: use clock to look up the PLL value 28b91fd2adc4f drm/hisilicon/hibmc: move display contrl config to hibmc_probe() 94ab8a6e02bae drm/hisilicon/hibmc: fix no showing when no connectors connected 689bb48c828ca drm/hisilicon/hibmc: add updating link cap in DP detect() 27af16a44f590 arm64: dts: qcom: sm8450: Fix ICE reg size 886fb63981a92 arm64: dts: qcom: kodiak: Fix ICE reg size 2e2e5888764ba clk: scmi: Fix clock rate rounding 8200ffd8259f0 rust: alloc: fix `Vec::extend_with` SAFETY comment 9fe7605c1c143 arm64: dts: mediatek: mt8192-asurada: Move PCIe DMA bounce buffer to host 02367b12b303a uaccess: fix ignored_trailing logic in copy_struct_to_user() e003f3a4be738 bpf: fix crash in bpf_[set|remove]_dentry_xattr for negative dentries 8960088511ca1 soc: mediatek: mtk-mmsys: Restore MT8167 routing masks lost during merge 0dd1cf48a4217 iommu/amd: Fix a stale comment about which legacy mode is user visible feb10ab7abc24 media: venus: scale MMCX power domain on SM8250 9e642727b97dd media: iris: scale MMCX power domain on SM8250 e725aedd26e96 media: qcom: camss: vfe: fix PIX subdev naming on VFE lite f9f1a2cd912da nilfs2: fix backing_dev_info reference leak 712714f818d83 dlm: fix add msg handle in send_queue ordered 4695cfab48f90 ARM: multi_v7_defconfig: Correct QCOM_RPMH and QCOM_RPMHPD 6acd2fbd00f9c crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents 9b21d5bd33a7f crypto: ecrdsa - fix unknown OID check in ecrdsa_param_curve aac63bbea8fd5 crypto: atmel-sha204a - fix blocking and non-blocking rng logic c5c79d92da0f9 crypto: ccp - Fix snp_filter_reserved_mem_regions() off-by-one 25b0061adc1c1 crypto: ccp - Reverse the cleanup order in psp_dev_destroy() 46696b0b21234 OPP: Fix race between OPP addition and lookup 8fe4736532639 alarmtimer: Remove stale return description from alarm_handle_timer() 224d7300b5691 drm: renesas: rz-du: mipi_dsi: Fix return path on error 4a8cde6f7281e vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive(). 470984f1c2ed8 Revert "arm64: dts: imx8mp-kontron: Add support for reading SD_VSEL signal" 5f7777f0da030 Revert "arm64: dts: imx8mm-kontron: Add support for reading SD_VSEL signal" b9c6ad49a942d arm64: dts: imx8x-colibri: Correct SODIMM PAD settings a5e026d5b9487 arm64: dts: rockchip: fix rk809 interrupt pin on rk3566-roc-pc 6173c83d4d791 arm64: dts: rockchip: Add #{address,size}-cells to Chromium-based /firmware 2b553fcec1cd8 ARM: dts: rockchip: Add #{address,size}-cells to Chromium-based /firmware d003d9bb44da1 drm/panel: Clean up S6E3HA2 config dependencies and fill help text 76a4c3af3253d drm/gpuvm: take refcount on DRM device 02b001d89157a dt-bindings: vendor-prefixes: Add Displaytech Ltd. a402b3d093815 pinctrl: sunxi: fix regulator leak in sunxi_pmx_request() error path c599af2eacd66 dts: spacemit: set console baud rate on bpif3 796ff973077c7 lib/vsprintf: Fix to check field_width and precision 53baa6b90f499 crypto: qat - fix heartbeat error injection 928f758f8f214 memory: tegra: Wire up system sleep PM ops 2b2a17af8d8c7 media: v4l2-common: Add YUV24 format info 4534f70aa7042 media: cedrus: Fix failure to clean up hardware on probe failure facbb592e22dd watchdog: sprd_wdt: Remove redundant sprd_wdt_disable() on register failure 1917015aa0a1d watchdog: sama5d4_wdt: Fix WDDIS detection on SAM9X60 and SAMA7G5 d6e8d6b2f8f04 watchdog: sp5100_tco: Use EFCH MMIO for newer Hygon FCH 29fd4f4c73e2b Documentation/rv: Replace stale website link 19eb0ab0bdffb ARM: dts: am335x-sl50: Fix audio bitclock and frame master endpoint 5435fd3edcb11 wifi: ath9k: fix OOB access from firmware tx status queue ID 7c79be7e63447 pinctrl: mediatek: eint: Drop base from mtk_eint_chip_write_mask() a83e77d1e52c0 soc: xilinx: Shutdown and free rx mailbox channel fbeea02c3564d kconfig: fix potential NULL pointer dereference in conf_askvalue ad445de67359f wifi: rtw89: add bounds check on firmware mac_id in link lookup 01155ded5d4da wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer 7a1ab5fdcae89 wifi: rtw89: Correct data type for scan index to avoid infinite loop 1ef3d1338d94e wifi: rtw88: fix wrong pci_get_drvdata type in AER handlers aefc30e4a829c wifi: rtw89: fix wrong pci_get_drvdata type in AER handlers cc77f0d91e321 driver core: use READ_ONCE() for dev->driver in dev_has_sync_state() 543ed0f61d565 drm/amdkfd: Validate CRIU-restored IDs before idr_alloc 1638e178e4915 dt-bindings: pinctrl: nvidia,tegra234: Add missing required block cc6ef5ee7d88a arm64: tegra: Fix Tegra234 MGBE PTP clock 228db770fb086 wifi: cfg80211: fix grammar in MLO group key error message 123e1cd95ba54 arm64: dts: qcom: sdm845-mezzanine: Fix camss ports unit_address_vs_reg warning d8367ee271aba arm64: dts: qcom: sc8180x: Fix phy simple_bus_reg warning d72ae2c63b683 arm64: dts: qcom: ipq5424: Fix USB simple_bus_reg warnings 8f8233d544aca arm64: dts: rockchip: Fix gmac0 reset pin for NanoPi R5S 58d0b4c55cdfd arm64: dts: rockchip: fix Ethernet PHY not found on PX30 Cobra 6005cdd9f48fd Documentation: proc: fix section numbering in table of contents d10227f899c90 selftests/bpf: Use local type for bpf_fou_encap in test_tunnel_kern 595710e6838c3 selftests/bpf: Use local type for flow_offload_tuple_rhash in xdp_flowtable 2dfe817167af0 drm/amd/pm: remove trailing semicolon from AMDGPU_PM_POLICY_ATTR macro afea00ffcf41c dt-bindings: timer: Remove sifive,fine-ctr-bits property bc4737e55ec41 selftests/bpf: Fix off-by-one in bpf_cpumask_populate related selftest 392c03362c278 libbpf: Report error when a negative kprobe offset is specified 06dc892561f5a drm/radeon: fix memory leak in radeon_ring_restore() on lock failure d9dfa176899d4 drm/radeon: fix integer overflow in radeon_align_pitch() daf5d03ddb8cc drm/amdgpu: fix integer overflow in amdgpu_gem_align_pitch() 41a60487b5b04 drm/gpuvm: Do not prepare NULL objects 353f26c74660b drm/gpusvm: Reject VMAs with VM_IO or VM_PFNMAP when creating SVM ranges 626fa93d194db drm/tidss: Drop extra drm_mode_config_reset() call ab487bb0402af drm/rockchip: Test for imported buffers with drm_gem_is_imported() b3ec263a719e0 drm/rockchip: dw_dp: Fix null-ptr-deref in dw_dp_remove() 0d60b835bca42 drm/rockchip: dw_dp: Switch to drmm_kzalloc() 68dc52f308a17 accel/amdxdna: Fix leak when pinning ubuf pages 8e644d9a8c8dc clocksource/drivers/sun5i: Handle error returns from devm_reset_control_get_optional_exclusive() d50d320e88b4c openrisc: mm: Fix section mismatch between map_page and __set_fixmap 24186d6f9b07e fbcon: Use correct type for vc_resize() return value 6617df8c24631 fbcon: fix NULL pointer dereference for a console without vc_data 231414253b648 afs: Fix uncancelled rxrpc OOB message handler 8b4d1854295b0 afs: Fix further netns teardown to cancel the preallocation charger cc848a080f7a6 afs: handle CB.InitCallBackState3 requests without a server record 23b3d457d8387 afs: fix NULL pointer dereference in afs_get_tree() b83ecf80e28af afs: Fix netns teardown to cancel the preallocation charger 8cd8cf3052fff rxrpc: Fix double unlock in rxrpc_recvmsg() a89a13aea38ae rxrpc: Fix leak of connection from OOB challenge f9be514984471 rxrpc: Fix the reception of a reply packet before data transmission 8db6a2c95e369 rxrpc: Fix ACKALL packet handling 647e8e69c6ea3 rxrpc: Fix oob challenge leak in cleanup after notification failure 7940e5c535489 rxrpc: Fix rxrpc_rotate_tx_rotate() to check there's something to rotate 0fc5b37faec26 rxrpc: Fix potential infinite loop in rxrpc_recvmsg() 2b69b61057eb0 rxrpc: Fix leak of released call in recvmsg(MSG_PEEK) 0d643a46fdea6 rxrpc: Fix socket notification race 844b8525ce503 rxrpc: Fix UAF in rxgk_issue_challenge() 9ada3931beb37 rxrpc: Don't move a peeked OOB message onto the pending queue d3b642cf95d48 rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc 35a967ff8b24d rxrpc: serialize kernel accept preallocation with socket teardown 2ecd118fb6913 serial: 8250_omap: clear rx_running on zero-length DMA completes c37095c431c39 serial: max310x: implement gpio_chip::get_direction() d354716245192 serial: msm: Disable DMA for kernel console UART 03fd857c33456 dt-bindings: power: imx93: Add MIPI PHY power domain d97a6b4a5a4fb dt-bindings: media: sun4i-a10-video-engine: Add interconnect properties 79982331c1738 media: uvcvideo: Fix sequence number when no EOF 19cb644d0ca59 media: uvcvideo: Relax the constrains for interpolating the hw clock bf58be93c51ba media: uvcvideo: Do not add clock samples with small sof delta aed8111f2392d media: uvcvideo: Fix dev_sof filtering in hw timestamp 0f64f808fb4ee media: uvcvideo: Fix buffer sequence in frame gaps 1a9baac645769 media: uvcvideo: Avoid partial metadata buffers caf800e0cab94 media: uvcvideo: Use hw timestaming if the clock buffer is full 6b2c0cd5f9689 ALSA: hda/realtek: Fix speakers on Legion Pro 7 16ARX8H with codec SSID 17aa:38a7 2f33044aedd7a ALSA: hda: Fix cached processing coefficient verbs ae7f5b05d225c ALSA: hda: conexant: Remove mic bias threshold override 12e43f99242b0 ALSA: hda/realtek: Add quirk for TongFang X6xx45xU e0a71cbf0c190 af_unix: Drop all SCM attributes for SOCKMAP. 9b6c12e1a6be0 iommu/amd: Use maximum PPR log buffer size when SNP is enabled on Family 0x19 a4fb0954f3dc2 iommu/amd: Use maximum Event log buffer size when SNP is enabled on Family 0x19 62dde71ca2c8c exfat: preserve benign secondary entries during rename and move f3a0dd2d88e83 selftests/bpf: Add tests for stale delta leaking through id reassignment 985b8a0e52c58 selftests/bpf: Add tests for delta tracking when src_reg == dst_reg d75376fbc8563 bpf: Clear delta when clearing reg id for non-{add,sub} ops 19836e8145de9 selftests/bpf: Add a test cases for sync_linked_regs regarding zext propagation 07259d661c9d4 selftests/bpf: Add tests for improved linked register tracking 564e4ce9fb401 selftests: bpf: Add test for multiple syncs from linked register 3659deaf7bf69 media: uvcvideo: Fix deadlock if uvc_status_stop is called from async_ctrl.work c401492e01c7b crypto: sun4i-ss - Remove insecure and unused rng_alg 088ee46c18d99 nvmet-tcp: Fix potential UAF when ddgst mismatch 2ed3c9d955e8c nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path 588718101e844 iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry c646431865f4b KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU d7860b682da55 crypto: algif_skcipher - force synchronous processing de5a46f3b2c8d tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req(). e0caf7c3d49c7 smb/server: do not require delete access for non-replacing links bbf04810b2a06 nvme-pci: DMA unmap the correct regions in nvme_free_sgls 40e44eff5116d perf trace: Deal with compiler const checks 30bbd7e8999d1 perf trace: Don't change const char strings bc29e0699b35d perf diff: Constify strchr() return variables 292f32503eda3 perf list: Don't write to const memory d03adc7039c39 perf list: Signal changing const memory is ok 4283a813d7089 perf tp_pmu: Address const-correctness errors in recent glibcs 018533cfe83cf perf units: Constify variables storing the result of strchr() on const tables e7d3f92238a3d perf hwmon_pmu: Constify the variables returning bsearch() on const tables 5bcff7ce5c3b1 perf tools: Use const for variables receiving str{str,r?chr}() returns ee8ab4e8e7029 perf metricgroup: Constify variables storing the result of strchr() on const tables 8bac35a8fd98f perf trace-event: Constify variables storing the result of strchr() on const tables a816153dd8575 perf demangle-java: Constify variables storing the result of strchr() on const tables f8cb25b1d5ed2 perf session: Don't write to memory pointed to a const pointer 5f6d997641de9 perf bpf-event: Constify variables storing the result of strchr() on const tables 3b540ba9606bf perf tools: Switch printf("...%s", strerror(errno)) to printf("...%m") 659a56ba86a96 perf list: Remove unused 'sep' variable 33250aa5cfade perf jitdump: Constify variables storing the result of strchr() on const tables 972c65697792c perf time-utils: Constify variables storing the result of strchr() on const tables 9ae21594ee518 perf strlist: Remove dont_dupstr logic, used only once 110ce8fed0f8e perf strlist: Don't write to const memory Signed-off-by: Bruce Ashfield --- .../linux/linux-yocto-rt_6.18.bb | 6 ++--- .../linux/linux-yocto-tiny_6.18.bb | 6 ++--- meta/recipes-kernel/linux/linux-yocto_6.18.bb | 24 +++++++++---------- 3 files changed, 18 insertions(+), 18 deletions(-) diff --git a/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb b/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb index 9d44c803eb..3757053885 100644 --- a/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb +++ b/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb @@ -15,13 +15,13 @@ python () { raise bb.parse.SkipRecipe("Set PREFERRED_PROVIDER_virtual/kernel to linux-yocto-rt to enable it") } -SRCREV_machine ?= "56572c42354027a50e261f16fe13b057604873e7" -SRCREV_meta ?= "2f71b0a288c307062fc60948ac793d8d51c685e2" +SRCREV_machine ?= "fa4de2c8b38ef83fd991db3b507630001104cac5" +SRCREV_meta ?= "24949c3ef490d79a73a821f688efdc2f562fc851" SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;branch=${KBRANCH};name=machine;protocol=https \ git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-6.18;destsuffix=${KMETA};protocol=https" -LINUX_VERSION ?= "6.18.39" +LINUX_VERSION ?= "6.18.41" LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46" diff --git a/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb b/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb index 7ff47505aa..5addcaae07 100644 --- a/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb +++ b/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb @@ -9,7 +9,7 @@ require recipes-kernel/linux/linux-yocto.inc include recipes-kernel/linux/cve-exclusion.inc include recipes-kernel/linux/cve-exclusion_6.18.inc -LINUX_VERSION ?= "6.18.39" +LINUX_VERSION ?= "6.18.41" LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46" DEPENDS += "${@bb.utils.contains('ARCH', 'x86', 'elfutils-native', '', d)}" @@ -18,8 +18,8 @@ DEPENDS += "openssl-native util-linux-native" KMETA = "kernel-meta" KCONF_BSP_AUDIT_LEVEL = "2" -SRCREV_machine ?= "9eb7db1359675f27707b030ba228f381c10cd53e" -SRCREV_meta ?= "2f71b0a288c307062fc60948ac793d8d51c685e2" +SRCREV_machine ?= "06f4fd92efb65a6108294f43855ca32fe22cb96f" +SRCREV_meta ?= "24949c3ef490d79a73a821f688efdc2f562fc851" PV = "${LINUX_VERSION}+git" diff --git a/meta/recipes-kernel/linux/linux-yocto_6.18.bb b/meta/recipes-kernel/linux/linux-yocto_6.18.bb index 6111ae89da..3ceba003fa 100644 --- a/meta/recipes-kernel/linux/linux-yocto_6.18.bb +++ b/meta/recipes-kernel/linux/linux-yocto_6.18.bb @@ -17,25 +17,25 @@ KBRANCH:qemux86-64 ?= "v6.18/standard/base" KBRANCH:qemuloongarch64 ?= "v6.18/standard/base" KBRANCH:qemumips64 ?= "v6.18/standard/mti-malta" -SRCREV_machine:qemuarm ?= "78e0248ce3cecd33f63926cd1d54c64e163d076c" -SRCREV_machine:qemuarm64 ?= "9eb7db1359675f27707b030ba228f381c10cd53e" -SRCREV_machine:qemuloongarch64 ?= "9eb7db1359675f27707b030ba228f381c10cd53e" +SRCREV_machine:qemuarm ?= "fbf752dfa74a5be78586014f82002bca11063fa8" +SRCREV_machine:qemuarm64 ?= "06f4fd92efb65a6108294f43855ca32fe22cb96f" +SRCREV_machine:qemuloongarch64 ?= "06f4fd92efb65a6108294f43855ca32fe22cb96f" SRCREV_machine:qemumips ?= "62ea92a539f58803a222be98b81118403074206e" -SRCREV_machine:qemuppc ?= "9eb7db1359675f27707b030ba228f381c10cd53e" -SRCREV_machine:qemuriscv64 ?= "9eb7db1359675f27707b030ba228f381c10cd53e" -SRCREV_machine:qemuriscv32 ?= "9eb7db1359675f27707b030ba228f381c10cd53e" -SRCREV_machine:qemux86 ?= "9eb7db1359675f27707b030ba228f381c10cd53e" -SRCREV_machine:qemux86-64 ?= "9eb7db1359675f27707b030ba228f381c10cd53e" +SRCREV_machine:qemuppc ?= "06f4fd92efb65a6108294f43855ca32fe22cb96f" +SRCREV_machine:qemuriscv64 ?= "06f4fd92efb65a6108294f43855ca32fe22cb96f" +SRCREV_machine:qemuriscv32 ?= "06f4fd92efb65a6108294f43855ca32fe22cb96f" +SRCREV_machine:qemux86 ?= "06f4fd92efb65a6108294f43855ca32fe22cb96f" +SRCREV_machine:qemux86-64 ?= "06f4fd92efb65a6108294f43855ca32fe22cb96f" SRCREV_machine:qemumips64 ?= "9fb4ff0187c85426f21fd40d4c61b742800f65c4" -SRCREV_machine ?= "9eb7db1359675f27707b030ba228f381c10cd53e" -SRCREV_meta ?= "2f71b0a288c307062fc60948ac793d8d51c685e2" +SRCREV_machine ?= "06f4fd92efb65a6108294f43855ca32fe22cb96f" +SRCREV_meta ?= "24949c3ef490d79a73a821f688efdc2f562fc851" # set your preferred provider of linux-yocto to 'linux-yocto-upstream', and you'll # get the /base branch, which is pure upstream -stable, and the same # meta SRCREV as the linux-yocto-standard builds. Select your version using the # normal PREFERRED_VERSION settings. BBCLASSEXTEND = "devupstream:target" -SRCREV_machine:class-devupstream ?= "f89c296854b755a66657065c35b05406fc18264d" +SRCREV_machine:class-devupstream ?= "2fe596715f840d053aed5cee5455f701bdcd2b50" PN:class-devupstream = "linux-yocto-upstream" KBRANCH:class-devupstream = "v6.18/base" @@ -43,7 +43,7 @@ SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;name=machine;branch=${KBRA git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-6.18;destsuffix=${KMETA};protocol=https" LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46" -LINUX_VERSION ?= "6.18.39" +LINUX_VERSION ?= "6.18.41" PV = "${LINUX_VERSION}+git" From patchwork Fri Aug 7 16:28:57 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bruce Ashfield X-Patchwork-Id: 94773 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 600A6C5AC82 for ; Fri, 7 Aug 2026 16:29:10 +0000 (UTC) Received: from mail-qk1-f177.google.com (mail-qk1-f177.google.com [209.85.222.177]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.46633.1786120147853449601 for ; Fri, 07 Aug 2026 09:29:08 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=N36GwppN; spf=pass (domain: gmail.com, ip: 209.85.222.177, mailfrom: bruce.ashfield@gmail.com) Received: by mail-qk1-f177.google.com with SMTP id af79cd13be357-92edb12cdf2so235824185a.3 for ; Fri, 07 Aug 2026 09:29:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786120147; x=1786724947; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=0Kbgy3u7NjezHpaKOf3pZxJ/UziLVoUN4bhN2CI+nhU=; b=N36GwppNOhCnXlfaa57ea62l5hfxKKG6y3OWUi8mvVMhQSpm1iPut48/pFWcUiYt79 yaWUGkE8QmgN8PU/UsefAeuRsVNPBxPT4RhxmBSDh1gXs7EGip4TVeb7dp6nujD50UKD zCHqZo7hIdBW+dQ4EwOhRrUAlRcJurRoK0hY9u4eUTjvFdFm8uL+LRCp4Bw3zfh26fkW 7EHNPmeg8tzcdRJ5rSGquScxBdaZqLNB8mIVftJNezWej6OV9OtXtbjvhBSw22ny7HN8 367B9eIuOwitJP9alkuvGOoQ38JRrfHE7lKkQdmo8DilOrUacOpml0h8TZTMSZRY/vLD LrUA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786120147; x=1786724947; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=0Kbgy3u7NjezHpaKOf3pZxJ/UziLVoUN4bhN2CI+nhU=; b=gIS1gTXf4/qR9zF/FrM13TuunYaSOm5V1IvY0vOyjeSLEg0TYXmUgpgVu+u8mprS92 2G20F3MACbpzcP7QOPtZ0yJLGt54UIV3FFpU0AUwUp3tl/GdEBTu1XXKAHpy9ZM7GII2 5wbn/TYulaIrN1RciHjDEyPc8fJsptifVvY4N6wJyGVzkzuAcQi0H9x8MQHBCZasj2CK DLCao+iszwC/8sSPlpwwGHeE8W6GW/OP6SmDuo2GdJ45nOLsz1y/ulxp/8Mo9L3+8/OT nFFlfzlonrHLAOC0hIHejzqQRDJLJesDx/fQjyCIfLMDOtqhUOlk85mp1T3FmOumdy9Y EoMA== X-Gm-Message-State: AOJu0YwzDj0cOX0vkm4eH+BDmkyUh6/QF1ZfpYnBb/kx+VF3eLCO9JLA T2NggQFUDu6LkuQsK2IYIblWVcDScptLv7eE0z7je53c15wQnuO9a2qQsHNHSXhi X-Gm-Gg: AR+sD12YFloMiNnZUa3BxIYuXNtmHwh4GPjgGuQ8PsNFharjCA5b/xONt/tOuA5vvIs QgaMxo5X2U+9LCWCH0rmS4XdzqISZToJkScK9kCBMEg34LIJJ05/rd0JtKx9m7FXT+e1UrhvZa5 7ruPVSh2ZHajeLpXxIJaSO2V8HEbScItGVgLa/jLdw3ofaAoB5Hl99tb+jrB/ijp9qMAHLZSDWb HELEfdtKkSguGJpXUILnNTTSpK5gbEinOQvdRbUamOvfbj/u4Gj9LkBJTQZYAOot1cFkGTBQkCT 3iEGr0BFN/RdK7gHcZsEWWW/iutekIlQHf2RYSe9IXrzg+XGKzqyRpwjPWT4ZIhNJB0Sdejacua z9QRKAR4VC1Sg+3PCj07OgtAwqOUOL2pHzC1DcRPhb226IuYO1GoJt5uSDN/BOrUiifHY3xA68A o4IXtb9RCBWKY1Ofktf3zLSkLhoNjWt51T885hnB1Tk/Ggpxs6aSX4cu5BbYXnD6udigQm/2Rbl Jji3raefQfPT2gyEogt/DRZD8ZgJRFvwl8SSZfweVnMiw9dnVQFQRlR1rPVBJ0yUcmlzj3m2UAU gNCwrytFgC5oQzOKVga25pEXRKTAB17rywS9EWKmihTRBdyq2tMbmxdK7MHhDlD35A6eicBSzk4 y+O7HHA== X-Received: by 2002:a05:620a:bcb:b0:934:97c1:ca5c with SMTP id af79cd13be357-93671badbbbmr401616885a.16.1786120146082; Fri, 07 Aug 2026 09:29:06 -0700 (PDT) Received: from bruce-XPS-8940.localdomain (pool-174-112-62-108.cpe.net.cable.rogers.com. [174.112.62.108]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-908a92fed68sm12521756d6.31.2026.08.07.09.29.04 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 07 Aug 2026 09:29:05 -0700 (PDT) From: bruce.ashfield@gmail.com To: richard.purdie@linuxfoundation.org Cc: openembedded-core@lists.openembedded.org Subject: [meta][PATCH 02/04] linux-yocto/6.18: update to v6.18.43 Date: Fri, 7 Aug 2026 12:28:57 -0400 Message-ID: <20260807162900.2623274-3-bruce.ashfield@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260807162900.2623274-1-bruce.ashfield@gmail.com> References: <20260807162900.2623274-1-bruce.ashfield@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 07 Aug 2026 16:29:10 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/243019 From: Bruce Ashfield Updating linux-yocto/6.18 to the latest korg -stable release that comprises the following commits: 7b923c78b50d2 Linux 6.18.43 bfe7f9993467b x86/bugs: Make Safe-RET robust against interrupt injection 856a9b51680cb Linux 6.18.42 0f33b1c457c21 KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug 846ed916cfa0c gpu: Fix uninitialized buddy for built-in drivers bcb29986bbba8 net: stmmac: fix dwmac4 transmit performance regression a0d1a11b90a51 net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query f282242906c12 usb: gadget: f_tcm: synchronize delayed set_alt with teardown aeebcfa8237c3 rust: device: avoid trailing ; in printing macros e94e820df37d4 rust: allow `suspicious_runtime_symbol_definitions` lint for Rust >= 1.98 6ce0db97fb37a mm/damon/core: disallow overlapping input ranges for damon_set_regions() 4b6f1d6d5d078 mm/damon/core: validate ranges in damon_set_regions() deead12d2e650 i3c: mipi-i3c-hci: Fix handling of shared IRQs during early initialization 811b581fae651 i3c: mipi-i3c-hci: Fix Hot-Join NACK 4fd5b33faf092 pmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI c389893bb4037 pmdomain: imx93-blk-ctrl: convert to devm_* only dc8347f263b21 net: ipa: fix SMEM state handle leaks in SMP2P init 4c1e8ccd8655e ata: libata-core: Reject an invalid concurrent positioning ranges count 9466dc5e377f0 bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline() a88c2a70ea0ad bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c c73b8795b45f4 octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF 4467fa514482b octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify ae5ae3d5bfaa6 net: mana: Optimize irq affinity for low vcpu configs 6d13eaa13341a net: mana: Validate the packet length reported by the NIC 7b7bb07efe41b fs/resctrl: Fix use-after-free during unmount d48cf914c739e fs/resctrl: Move RMID initialization to first mount 682d3c2cd20e0 fs/resctrl: Move allocation/free of closid_num_dirty_rmid[] 8c5925f0fa128 x86,fs/resctrl: Rename some L3 specific functions 696c34a1964f4 x86,fs/resctrl: Rename struct rdt_mon_domain and rdt_hw_mon_domain ad4ea2a169a48 fs/resctrl: Split L3 dependent parts out of __mon_event_count() 5b82af744e06c mmc: vub300: fix use-after-free on probe failure 73d397ab54f2a mmc: vub300: rename probe error labels 8ced1d242c34e dm: avoid leaking the caller's thread keyring via the table device file dd73cc92a55d7 cred: add kernel_cred() helper af7a4c2caa7a1 accel/amdxdna: reject command submission on devices without a submit op 62dae36be7a62 ovl: use linked upper dentry in copy-up tmpfile 043acb00e4edd dmaengine: dw-edma-pcie: Reject devices without driver data 277a035cda47d dmaengine: dw-edma: Fix confusing cleanup.h syntax 19360c25135fc mtd: maps: vmu-flash: fix fault in unaligned fixup b8271be34bce1 kho: make sure scratch size is always aligned by CMA_MIN_ALIGNMENT_BYTES 3d561f46fa784 mm/sparse-vmemmap: fix vmemmap accounting underflow 8af652cd99460 remoteproc: xlnx: Check remote core state 6fc1919a6f2ed cxl: Fix CXL_HEADERLOG_SIZE to match RAS Capability size 89b2ae039d188 cxl/pci: Remove CXL VH handling in CONFIG_PCIEAER_CXL conditional blocks from core/pci.c eeab775069920 cxl/pci: Remove unnecessary CXL RCH handling helper functions a64661dccb2eb cxl/pci: Remove unnecessary CXL Endpoint handling helper functions 5d964cb2b7bc8 SUNRPC: Return an error from xdr_buf_to_bvec() on overflow b50b2cb87e7ac SUNRPC: Add helpers to convert xdr_buf byte ranges to scatterlists a112b91dd6349 sunrpc: allocate a separate bvec array for socket sends 3120f21df3fb0 NFSD: pass nfsd_file to nfsd_iter_read() 6876f767b0490 pinctrl: renesas: rzg2l: Use -ENOTSUPP instead of -EOPNOTSUPP 7185c5262435b gpu/buddy: bail out of try_harder when alignment cannot be honoured 9634fd144cdc1 drm: drop lib from header search path. 65677f7a20c48 gpu: Move DRM buddy allocator one level up (part two) 09755dc62b026 netfilter: nf_conntrack_sip: validate skb_dst() before accessing it a1a94a00b8844 netfilter: nf_conntrack_sip: remove net variable shadowing d01c913febead netfilter: nft_fib: reject fib expression on the netdev egress hook beeda5bf78577 netfilter: nf_tables: remove register tracking infrastructure 1de827e24d0ad arm64: dts: qcom: hamoa: Fix OPP tables for all DisplayPort controllers 0d810ff7a6f65 arm64: dts: qcom: correct RBR opp entry 690fb82c4122f VDUSE: avoid leaking information to userspace 7764e9c727d58 vduse: take out allocations from vduse_dev_alloc_coherent db5c554b36d50 vduse: remove unused vaddr parameter of vduse_domain_free_coherent 82e48ad2a1326 vduse: return internal vq group struct as map token b1f38c3ec620a xfs: don't replace the wrong part of the cow fork 3bca70235a706 fuse-uring: fix race between registration and connection abortion 40879c39d6740 audit: fix recursive locking deadlock in audit_dupe_exe() 91b64f0be4163 audit: use 'unsigned int' instead of 'unsigned' eef6914f2b456 audit: widen ino fields to u64 c5772ced573ea landlock: Account all audit data allocations to user space a95b62759f3b9 landlock: Fix formatting 682a0066dde05 drm/amd/display: Fix DTB DTO updates breaking live pixel rate sources 81ea8e8221853 fscrypt: Avoid dynamic allocation in fscrypt_get_devices() 337022d9dfac4 ksmbd: validate ACE size against SID sub-authorities f1eba60db813e ksmbd: bound DACL dedup walk to copied ACEs 847ecd4eb3c11 ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL b6d3cc6a52441 ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl 17e6b8c4319fa net: qrtr: ns: Raise node count limit to 512 7dd26adf7e7d4 ublk: wait on ublk_dev_ready() instead of ub->completion 5a15eaa50f92b drm/xe/uapi: Reject coh_none PAT index for CPU_ADDR_MIRROR 5488d3a69d205 dm-verity: fix buffer overflow in FEC calculation 3f31bde63f9ae dm-verity-fec: replace {MAX,MIN}_RSN with {MIN,MAX}_ROOTS d47281b9a4472 dm-verity-fec: fix reading parity bytes split across blocks (take 3) a556189c06756 dm-verity-fec: fix the size of dm_verity_fec_io::erasures 22400725de070 bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops 15a7cb71a5748 drm/amdgpu: fix check in amdgpu_hmm_invalidate_gfx ab7b40c638e0d drm/amd/pm: fix smu13 power limit range calculation 6405c4e75b3bc drm/amdgpu: fix aperture mapping leak 08fee493e0261 drm/amdgpu: invoke pm_genpd_remove() before freeing genpd 68eab5a64ddbc drm/amdgpu: fix resource leak on ACP reset timeout ffb33d466a68c drm/amdgpu: fix division by zero with invalid uvd dimensions 8c6d84a54823c drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe() bd868c077f675 drm/amdgpu/vcn4: avoid rereading IB param length 7eebef042c12d drm/amdgpu/vce: fix integer overflow in image size f7e9eeaccca54 drm/amdgpu/soc24: reset dGPU if suspend got aborted dc3f5da1ba8e2 drm/amdgpu/sdma4.4.2: replace BUG_ON() with WARN_ON() 76c977d396f12 drm/amdgpu/jpeg: fix jpeg_v5_0_1_is_idle detection 058373af59551 drm/amdgpu/jpeg: fix jpeg_v4_0_3_is_idle detection 042c047e8bc9c drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON() 05aea3344c422 drm/amdgpu/gfx9.4.3: replace BUG_ON() with WARN_ON() f70bd5235d9ef drm/amdgpu/gfx8: drop unecessary BUG_ON() 987bedd3ea89d drm/amdgpu/gfx12: replace BUG_ON() with WARN_ON() dfd9bf09fd8fe drm/amdgpu/gfx11: replace BUG_ON() with WARN_ON() 7e22de67e545d drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON() e75f71143b68b drm/amd/pm: make pp_features read-only when scpm is enabled ada47af5c215e drm/amd/pm: fix amdgpu_pm_info power display units 7b263cf1dd4c0 watchdog: s32g_wdt: remove incorrect options in watchdog_info struct 79370b573e92e vxlan: mdb: Fix source list corruption on a failed replace f60bac115d8dc vsock/virtio: collapse receive queue under memory pressure 5f5a41a48dbf9 tipc: clear sock->sk on the failed-insert path in tipc_sk_create() 234f9ffbd9b2c tcp: challenge ACK for non-exact RST in SYN-RECEIVED fadaff3f66e12 tcp: initialize standalone TCP-AO response padding 4a4f3aa6af205 rtase: Workaround for TX hang caused by hardware packet parsing 6866abf59976d pppoe: reload header pointer after dev_hard_header() 460b9f0609d26 ovpn: hold peer before scheduling keepalive work b08526bf0bbf8 ovpn: fix peer refcount leak in TCP error paths 100a23b1613e9 openvswitch: fix GSO userspace truncation underflow f80ba170d7b3a mctp: serial: handle zero-length frames to prevent rx buffer overflow f20dedce0429b mac802154: llsec: reject frames shorter than the authentication tag 59c1d5463b7bc mac802154: hold an interface reference across the scan worker 472aba2603ca7 ila: reload IPv6 header after pskb_may_pull in checksum adjust 919d0accf2600 ice: use READ_ONCE() to access cached PHC time 5e496f2b615ce ice: reject out-of-range ptype in ice_parser_profile_init 91e0249f3ef62 gve: fix Rx queue stall on alloc failure 18705cace0619 ksmbd: defer destroy_previous_session() until after NTLM authentication 6098b55f6a0cf smb: client: handle STATUS_STOPPED_ON_SYMLINK responses without a symlink target 34f2a2f32af57 rbd: Reset positive result codes to zero in object map update path 63d78b546eefc super: fix emergency thaw deadlock on frozen block devices e4406cbdd915f ice: fix PTP Call Trace during PTP release b3efb4744abf4 ptp: ptp_s390: Add missing facility check 9a8a247f0f17b s390/ptff: Export ptff_function_mask[] 4afc58ea75b96 proc: Fix broken error paths for namespace links 4056cc19071a3 net: pcs: xpcs: fix SGMII state reading 80d977f280b4e net: hip04: fix RX buffer leak on build_skb failure a4dfd46cc8f08 net: gro: fix double aggregation of flush-marked skbs ec6d91a1bf2eb net/x25: fix use-after-free in x25_kill_by_neigh() 40f9a124ebbe0 net/mlx5e: Use sender devcom for MPV master-up 900cd6d8119b7 net/iucv: fix use-after-free of a severed iucv_path 33736ff5e7c97 net/af_iucv: fix NULL deref in afiucv_hs_callback_syn() f8c498585d2a0 geneve: require CAP_NET_ADMIN in the device netns for changelink 5d07b178bef51 net: slip: serialize receive against buffer reallocation 730c7e5fea7f0 vxlan: require CAP_NET_ADMIN in the device netns for changelink a48a889b60f73 phonet: pep: fix use-after-free in pep_get_sb() 03157872da5ed net: stmmac: intel: skip SerDes reconfig when rate is unchanged 1b44a5f584bff iommu/vt-d: Disallow SVA if page walk is not coherent 7037e7bdcd26f iomap: fix out-of-bounds bitmap_set() with zero-length range f139498c5ebdd io_uring/rw: fix missing ERESTARTSYS conversion in read paths 65bf73bee1a4f ftrace: Add global mutex to serialize trace_parser access 95376fe9c145b fscrypt: Add missing superblock check in find_or_insert_direct_key() a019b074903b3 fs: preserve ACL_DONT_CACHE state in forget_cached_acl() c78e38745ff1b fs/super: fix emergency thaw double-unlock of s_umount 89b9121c3b016 binfmt_elf_fdpic: only honour the first PT_INTERP d309f8b52b34c ASoC: fsl_sai: Fix spurious BCLK on resume by clearing BYP c4d77740eca21 ASoC: fsl: imx-card: Skip sysclk reset for active DAIs in shutdown 1a644db2cf59f amt: fix use-after-free in AMT delayed works 8f5a3abc54ba2 libceph: remove debugfs files before client teardown 3b2f1937f5fce libceph: reject zero bucket types in crush_decode e67e8b694872c libceph: Reject monmaps advertising zero monitors 0060ec912292a libceph: refresh auth->authorizer_buf{,_len} after authorizer update 4716a64b7cc27 libceph: guard missing CRUSH type name lookup 1732d89dfcd74 libceph: Fix multiplication overflow in decode_new_up_state_weight() 4e7ebfaa0d14c libceph: bound get_version reply decode to front len 7d03e08b763fd ceph: fix writeback_count leak in write_folio_nounlock() a7c2dfa610a12 ceph: fix refcount leak in ceph_readdir() a4228b93706fb ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() 3bf0e349cbb4f sctp: close UDP tunnel sockets during netns teardown be6aae9d1b91c sctp: avoid auth_enable sysctl UAF during netns teardown 85aca407c560a sctp: don't free the ASCONF's own transport in DEL-IP processing 3db217a4c2bdc mm/huge_memory: set PG_has_hwpoisoned only after new folio head is established ac7a6f61f56fe mm/kmemleak: fix checksum computation for per-cpu objects f2b2933599241 afs: Fix afs_edit_dir_remove() to get, not find, block 0 d64f6c02495f3 mptcp: pm: userspace: fix use-after-free in get_local_id 6cd3c3d631555 mptcp: only set DATA_FIN when a mapping is present 6c936b5ad557e mptcp: decrement subflows counter on failed passive join 35c4b274d4cc4 Revert "arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates" 64ab0964c7db9 arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates 9cd4b1a52eff3 arm64: make huge_ptep_get handled unaligned addresses 9025946adec9a tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err() 3b3be8653c594 tracing/probes: Fix potential underflow in LEN_OR_ZERO macro 949ac1aeb37b8 tracing/probes: Avoid temporary buffer truncation in trace_probe_match_command_args() 6b5098d745811 tracing/eprobe: Fix exact system name matching in eprobe_dyn_event_match() b6a4575f22925 tracing: Fix union collision of module and refcnt for dynamic events cf5a82bef623b tracing: Fix resource leak on mmiotrace trace_pipe close 8464427e1c177 tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev 1f2e7cd0ff976 tracing: Fix context switch counter truncation 1da310b94504d misc: nsm: pin the module while the device is open 8f068342096b0 misc: nsm: only unlock nsm_dev on post-lock error paths caba30eb8bd32 intel_th: fix MSC output device reference leak 59dd34854202d mei: bus: access mei_device under device_lock on cleanup 5118872357279 selftests: ntsync: correct CONFIG_NTSYNC name b2a3eeb57ba24 serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms 4fae473b856b4 serial: sc16is7xx: implement gpio get_direction() callback 635be8b097f0c uio_hv_generic: Bind to FCopy device by default cf26dd2d84158 comedi: comedi_parport: deal with premature interrupt 9bb71b59e0aa3 x86/boot/compressed: Disable jump tables 4f2db41a09eba firmware: stratix10-svc: fix memory leaks and list corruption bugs 3ff7c1dbf722c rhashtable: clear stale iter->p on table restart d43c5c0c93552 cdrom: fix stack out-of-bounds read in CDROMVOLCTRL 4427a33faabb4 LoongArch: Retrieve CPU package ID from PPTT when available 38b025fcdc45b LoongArch: Move jump_label_init() before parse_early_param() 6ab0abb5a2e0c LoongArch: Fix oops during single-step debugging a94d6726ec868 LoongArch: Fix address space mismatch in kexec command line lookup c404b1f30b252 objtool/rust: add one more `noreturn` Rust function for Rust 1.99.0 8ccfb3b315a0e rust: allow `clippy::unwrap_or_default` globally 6db0c42c87c46 rust: time: fix as_micros_ceil() to round correctly for negative Delta 12be1d75e9b29 rust_binder: only print failure if error has source cc3bbff10b1a7 platform/loongarch: laptop: Explicitly reset bl_powered state when suspend 1cd4e9b7967da binfmt_misc: set have_execfd only once the interpreter is opened 2bc6bf70d4105 exec: fix unsigned loop counter wrap in transfer_args_to_stack() 780b04d09c941 Bluetooth: RFCOMM: Fix session UAF in set_termios a42f5536ea9c0 Bluetooth: hci_sync: Protect UUID list traversal 91eff666c9078 staging: rtl8723bs: fix inverted HT40 secondary channel offset 875479f18835a staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie() 0dbaff14fd6a8 wifi: ath11k: fix refcount leak in ath11k_ahb_fw_resources_init() efe9de178e4b9 wifi: brcmfmac: set F2 blocksize to 256 for BCM43752 044fca8f45ba9 wifi: brcmfmac: make release_scratchbuffers idempotent 9cb72f67e1502 wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses 263816e92e8d6 wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses ab4d213393e84 wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses e511e93abd6ee wifi: wilc1000: validate assoc response length before subtracting header 9375a4ea41216 wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper 18965470d41e6 wifi: ath6kl: fix use-after-free in aggr_reset_state() 58c6c8dc2e022 wifi: ath6kl: fix OOB access from firmware ADDBA window size 1395327a96614 ALSA: timer: don't re-enter an instance callback that is still running 426c0ff1c433d ALSA: timer: drain a slave's callback before its master detaches it 3bc4de57fc7d1 ALSA: hda: codecs: hdmi: disable keep-alive before audio format change 6a10025c7fd09 ALSA: seq: close a re-opened queue timer in the destructor 2ec8f95a08fed ALSA: hda/realtek: Fix speakers on Lunnen Ground 14 4091b216d11b3 media: vpif_capture: fix OF node reference imbalance 1349af7f87df5 media: vivid: fix cleanup bugs in vivid_init() 492c97cb50fea media: vivid: check for vb2_is_busy() when toggling caps 26e7a8ac286f3 media: vivid: add vivid_update_reduced_fps() 3780ad3810718 media: vimc: fix reference leak on failed device registration 86ece01fba2d5 media: vidtv: fix reference leak on failed device registration 16ae8c166e787 media: verisilicon: Export only needed pixels formats b88c929188e3c media: vb2: use ssize_t for vb2_read/vb2_write 072a883061a46 media: v4l2-subdev: Fail {enable,disable}_streams and s_streaming nicely cf9732fd6c4f2 media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor() 3068ab802fc98 media: v4l2-ctrls: validate HEVC active reference counts 836cfffb2ddbb media: v4l2-ctrls-request: add NULL check in v4l2_ctrl_request_complete() 7e6521dd747ec media: ti: vpe: unwind v4l2 device registration on probe error 127fc44e83256 media: tegra-video: vi: fix invalid u32 return value in format lookup 118c2f5d1d363 media: synopsys: hdmirx: Fix HPD lane hold time b5184b3f0e9d4 media: sun4i-csi: Return queued buffers on start_streaming() failure 931abe1deb65b media: stm32: dcmi: unregister notifier on probe failure ed342a86bb2f9 media: stm32-dcmipp: Return queued buffers on start_streaming() failure b7936e8cbec1b media: saa7134: Fix a possible memory leak in saa7134_video_init1 a7a141e4e93c8 media: rzg2l-cru: Skip ICnMC configuration when ICnSVC is used 894e83509c669 media: rtl2832_sdr: Return queued buffers on start_streaming() failure 2c71bda6edc63 media: rtl2832: fix use-after-free in rtl2832_remove() 64cb15878b35e media: radio-si476x: Unregister v4l2_device on probe failure a58d01a0ed397 media: qcom: camss: Fix RDI streaming for CSID GEN3 c39a1d9fde82b media: qcom: camss: Fix RDI streaming for CSID GEN2 4e451100b35ee media: qcom: camss: Fix RDI streaming for CSID 680 cb16b79a2be2c media: pwc: Return queued buffers on start_streaming() failure 9afd605dcd96c media: pwc: Drain fill_buf on start_streaming() failure 08ddfd628a2db media: pci: dm1105: Free allocated workqueue 4e077bcb5e1f6 media: nxp: imx8-isi: Fix scale factor calculation for hardware rounding 28ae75dba701d media: nxp: imx8-isi: Fix potential out-of-bounds issues 659a7cea0be80 media: nxp: imx8-isi: Fix missing v4l2_subdev_cleanup() in pipe init error path 4702afbd56f1d media: nxp: imx8-isi: Clean up already-initialized pipes on probe failure 9e61258fbc3cf media: nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and pipe 181a0aeefd56f media: nuvoton: npcm-video: fix memory leaks in probe and remove 2147acb948a94 media: nuvoton: npcm-video: fix error handling in npcm_video_init() 264b5380c4f8a media: msi2500: Return queued buffers on start_streaming() failure 1391b75bf0119 media: meson: vdec: Fix memory leak in error path of vdec_open 18e3b838e09d7 media: marvell-cam: fix missing pci_disable_device() on remove cf48e9db85652 media: iris: Fix use IRQF_NO_AUTOEN when requesting the IRQ d56044558a757 media: intel/ipu6: Improve DWC PHY HSFREQRANGE band selection for overlapping ranges 00a98fb2a6fb2 media: imx219: Fix maximum frame length in lines 7337c88205ed0 media: i2c: alvium: fix critical pointer access in alvium_ctrl_init c68c4ce72feb6 media: cx23885: add ioremap return check and cleanup f468b7ee5d633 media: cx231xx: fix devres lifetime f24ca8b53fe15 media: chips-media: wave5: Move src_buf Removal to finish_encode 9924cb548ee77 media: cedrus: skip invalid H.264 reference list entries 000e51afb6068 media: cedrus: Fix missing cleanup in error path 73504935e4365 media: cedrus: clean up media device on probe failure 6efe665356ec8 media: cec: seco: unregister adapter on IR probe failure 0459a4304cff8 media: aspeed: fix missing of_reserved_mem_device_release() on probe failure 391fe3e36e59f media: amlogic-c3: Add validations for ae and awb config 73bd277986537 media: airspy: Return queued buffers on start_streaming() failure a096a6aba6011 drm/v3d: Reach the GMP through the hub registers on V3D 7.x a2212fef8e187 drm/gpusvm: Fix MM reference leak in drm_gpusvm_range_evict 6deaa31720185 drm/vc4: Prevent shader BO mappings from becoming writable b1379f0c42b88 drm/vmwgfx: Validate vmw_surface_metadata::array_size 2b85e19792be4 drm/amd/display: Fix missing DCE check in dm_gpureset_toggle_interrupts() a38f2724eb93a drm/vc4: Shut down BO cache timer before teardown ee44ea4f7e309 drm/amd/display: Fix flip-done timeouts on mode1 reset ba7b6444097a7 drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved fd2de80f28a07 drm/amdgpu: Disable PCIe dynamic speed switching on Ryzen Pinnacle Ridge 490ceacd2162d drm/amd/display: Fix backlight max_brightness to match exported range 9c0432044d34b drm/amd/display: Force PWM backlight on Lenovo Legion 5 15ARH05 51ea665c30c42 drm/amd/display: dce100: skip non-DP stream encoders for DP MST 0b9fa4272e24b drm/amd/display: consolidate DCN vblank/flip handling onto vupdate_no_lock 679f23f0a3606 drm/amd/display: set new_stream to NULL after release 123692ebc1ea7 drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X) d8dc3a9e815d6 drm/amdgpu: Fix VFCT bus number matching with soft filter 312278b309191 drm/amdgpu: Release VFCT ACPI table reference e64b2f1e826af drm/panthor: return error on truncated firmware 22aa7fb4e7d0b drm/ttm: Account for NULL and handle pages in ttm_pool_backup b2d8b66c67393 drm/virtio: Don't detach GEM from a non-created context a4a1866d50c49 drm/gfx10: Program DB_RING_CONTROL e163c5a0946de drm/amd/pm: fix smu14 power limit range calculation e3bcd3bf7eeca drm/i915/mst: limit DP MST ESI service loop 726f27bca93e6 drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU 37951ce1567cc drm/i915/gem: Do not leak siblings[] on proto context error 1173190412fb9 drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() 5df5a59c32b46 drm/amd/amdgpu: disable ASPM on VI if pcie dpm is disabled 8b2da44446f9d drm/i915/bios: range check LFP Data Block panel_type2 cbec6a57959ab drm/i915: Return NULL on error in active_instance d20b5c139b290 drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON() 09da54636bac1 drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON() 51fd520871651 drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON() 4c09483325360 drm/amdgpu/sdma7.0: replace BUG_ON() with WARN_ON() 3d2ef8d389495 drm/i915/hdcp: check streams[] bounds before overflow 1f876bd8adc79 drm/i915/hdcp: require monotonically increasing seq_num_v 35be0e2c6862a drm/virtio: bound EDID block reads to the response buffer 4ee77643e6194 drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink reference 8a77ccf9cb992 drm/amd/display: Handle struct drm_plane_state.ignore_damage_clips abce3276c57e3 drm/amdkfd: fix 32-bit overflow in CWSR total size calculation fd1691ec62701 drm/amdkfd: Check bounds on CRIU restore queue type and mqd size 50319efb865f7 drm/amdkfd: Check bounds in allocate_event_notification_slot 14a631dca9df0 drm/amdkfd: Use kvcalloc to allocate arrays 6253bb56bb2eb drm/imagination: acquire vm_ctx->lock before mapping memory to GPU VM c45fafa69fe3f drm/imagination: fix error checking of pvr_vm_context_lookup() b983a35dad370 drm/imagination: Fix user array stride in pvr_set_uobj_array() c88fdbf3da26e drm/imagination: Fix double call to drm_sched_entity_fini() c1954c66662de drm/xe: Hold a dma-buf reference for imported BOs 038d0b80ab778 drm/xe: Fix PTE index in xe_vm_populate_pgtable() for chunked binds 90a8a938e0cae drm/xe: Return error on non-migratable faults requiring devmem 3e1f909556aa6 drm/radeon: fix r100_copy_blit for large BOs fbb9effc81683 drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit() 45db277b2e1e3 drm/i915/gem: Add missing nospec on parallel submit slot 748d425e53c31 drm/displayid: fix Tiled Display Topology ID size 5452eb5c16630 drm/sysfb: Return errno code from drm_sysfb_get_visible_size() 154795885e8f0 drm/sysfb: Avoid possible truncation with calculating visible size 4e109faa9ea2b drm/nouveau: fix reversed error cleanup order in ucopy functions 315d2e5741a81 drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1 3fb10ec43c25a drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT 9c2b01508831b drm/amdgpu/gfx9: Fix Ring and IB test fail after mode2 f835eda74cf65 drm/sysfb: Avoid truncating maximum stride 7daefc6d51952 drm/sysfb: Do not page-align visible size of the framebuffer ddba17b3dfa0e drm/amdgpu: check amdgpu_vm_bo_find() result in GET_MAPPING_INFO d068a2f53afc8 drm/amdgpu/uvd: Place VCPU BO only in VRAM for UVD 4.x and older b3a01cda0ae16 drm/amdgpu/uvd: Fix forcing MSG, FB BOs into VCPU segment when it isn't at 0 (v2) e28420e36542a drm/amdgpu/gfx: fix cleaner shader IB buffer overflow d5c70523cafa2 drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers e2c29d51c0f65 drm/imagination: Fit paired fragment job in the correct CCCB 1e5827839ad0c drm/dp/mst: fix buffer overflows in sideband chunk accumulation 533d9e2bede4a drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers c0384d6872f4d drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS() 943fa73ea0efa drm/imagination: Count paired job fence as dependency in prepare_job() 6ab29a8683572 drm/rockchip: analogix_dp: Add missing error check for platform_get_resource() 50cd8a7e98dd2 drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video() 86ab4d93b3d47 drm/tidss: Fix missing drm_bridge_add() call 300a2d970a535 drm: renesas: rzg2l_mipi_dsi: Move rzg2l_mipi_dsi_set_display_timing() aa8ad3e0d1fe9 drm: renesas: rzg2l_mipi_dsi: Increase reset deassertion delay 786d690257ec7 bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() 3a924139cf526 net: airoha: fix ETS channel derivation in airoha_tc_setup_qdisc_ets() 391a23c503856 mctp: check register_netdevice_notifier() error in mctp_device_init() 74ecebfbf1555 ptp: netc: explicitly clear TMR_OFF during initialization 16df2d154ec82 rds: tcp: unregister sysctl before tearing down listen socket 1db34097998cc ipv6: Change allocation flags to match rcu_read_lock section requirements 684d4d0bda95a ice: prevent tstamp ring allocation for non-PF VSI types a32604e8d9e2c ice: fix LAG recipe to profile association 3a81345467674 ice: allow creating VFs when !CONFIG_ICE_SWITCHDEV 5d54d603cf3e9 net: ipv6: fix dif and sdif mismatch in raw6_icmp_error e60e6009d3bae octeontx2-pf: tc: fix egress ratelimiting d612754a515cb net/mlx5e: Reject unsupported CB Shaper TSA in ETS validation a7e430349fc5e net/mlx5e: Report zero bandwidth for non-ETS traffic classes cdddc8188db46 net/mlx5: E-Switch, fix zero num_dest in prio_tag egress vlan rule 87b39a8c875ca net/mlx5: Fix MCIA register buffer overflow on 32 dword reads 5f2ef3d53d374 net/mlx5: Refactor EEPROM query error handling to return status separately 953d47cfe529a raw: annotate lockless match fields in raw_v4_match() 8150c48fb978e net: qrtr: restrict socket creation to the initial network namespace 0d57d43d7c4c6 hinic: remove unused ethtool RSS user configuration buffers 8fc45a2a7cc24 ppp: annotate data races in ppp_generic 19fe119dfa93f ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup e037a41938c69 octeontx2-vf: set TC flower flag on MCAM entry allocation 15a1c5f2ed2ee net: gre: fix lltx regression for GRE tunnels with SEQ/CSUM 55515c1b1285a net: stmmac: enable the MAC on link up for all supported speeds 1bcb737fb884d net: stmmac: reset residual action in L3L4 filters on delete 370dde2b70e58 net: stmmac: fix l3l4 filter rejecting unsupported offload requests 55d2a8d184e24 net: stmmac: xgmac: fix l4 filter port overwrite on register update 40413da850363 net: stmmac: cores: remove many xxx_SHIFT definitions 4a3eea468a041 net: stmmac: socfpga: Add hardware supported cross-timestamp 01d45e6b2c500 net: stmmac: socfpga: Enable TBS support for Agilex5 dac8c2ab943a2 net: stmmac: socfpga: Agilex5 EMAC platform configuration d67136a931e5f net: stmmac: remove xstats.pcs_* members 9f27c4f0ae35b bpf: tcp: fix double sock release on batch realloc b43bb9ab60035 drm/tests: shmem: Set DMA mask to 64-bit in drm_gem_shmem 1b8fb5a20508b tipc: fix u16 MTU truncation in media and bearer MTU validation c8e4b2a567efb iomap: correct the range of a partial dirty clear 279339aa8bdcf drm/xe/vm: Fix SVM leak on resv obj alloc failure in xe_vm_create() d18d9b2c29a12 drm/xe/i2c: Allow per domain unique id 4fdb0f162ccdb vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets 18957373920ca sctp: auth: verify auth requirement when auth_chunk is NULL ae0ec759865e0 net: dpaa: fix mode setting b5ded444621b6 net: hsr: fix memory leak on slave unregistration by removing synced VLANs 17bb59682b8e6 net: bridge: vlan: fix vlan range dumps starting with pvid 0a347ca1d6a2e amt: make the head writable before rewriting the L2 header ca0e8b661957f amt: re-read skb header pointers after every pull 9ec22c8113d8c ovl: check access to copy_file_range source with src mounter creds 31f5f7c959c3e ovl: port ovl_copyfile() to cred guard cde234a493f6d ovl: add override_creds cleanup guard extension for overlayfs 35f0b504394e0 cred: add scoped_with_kernel_creds() 3139b806923b1 drm/panel: s6e3ha8: fix unmet dependency on DRM_DISPLAY_HELPER 790da254031cc ovl: fix trusted xattr escape prefix matching 00ebbf030d8c4 wifi: brcmfmac: fix 802.1X-SHA256 call trace warning d5628f39fccc1 wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht() 95b0cf02731c7 wifi: mt76: mt7925: fix crash in reset link replay d14238523ca4c wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap() 313343ab8cab7 wifi: mt76: mt7925: fix possible NULL-pointer deref in mt7925_mcu_bss_he_tlv() c058786b09cfa wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv() 871549814eb4d wifi: mt76: mt7915: guard HE capability lookups f1ee53e08fdd2 wifi: mt76: mt7925: guard link STA in decap offload cc4d2f8b984c2 ppp: annotate concurrent dev->stats accesses b52ff80948d1c ppp: don't store tx skb in the fastpath cb9d3e0b55699 ppp: enable TX scatter-gather e740e90ca8e7f tipc: fix infinite loop in __tipc_nl_compat_dumpit d536bf205c71f nexthop: initialize extack in nh_res_bucket_migrate() 961e9b1e33445 gtp: check skb_pull_data() return in gtp1u_send_echo_resp() 023c5e0d0294a selftests: drv-net: increase timeout fa065685c8a91 selftests: ovpn: increase timeout e2b3d426c7ee5 selftests: ovpn: add IPV6 and VETH configs 69eab5c4d9aa6 selftests: openvswitch: add config file 340c389fd3d5d selftests: af_unix: add USER_NS config fbd91910c5025 tls: device: push pending open record on splice EOF a8bd8c109da5a net: mctp i3c: clean up notifier and buses if driver register fails 1a10fe1aa9c01 sctp: validate stream count in sctp_process_strreset_inreq() c984a4184f810 pds_core: check for workqueue allocation failure cf0ed2ba202f5 pds_core: fix auxiliary device add/del races 0e87fe52b560f pds_core: order completion reads after the ownership check 3a831f40e88d3 pds_core: yield the CPU while waiting for the adminq to drain 9e0f80fac50ab pds_core: fix use-after-free on workqueue during remove 19ef775c91c6b pds_core: fix deadlock between reset thread and remove 11092d79eb2b7 sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid 2d34421bfa261 net: txgbe: fix FDIR filter leak on remove 245bfe72a5ad4 net: Call net_enable_timestamp() before failure in sk_clone(). 4122792923312 soreuseport: Clear sk_reuseport_cb before failure in sk_clone(). f97d199287689 amd-xgbe: fix MAC_AUTO_SW handling in CL37 AN e695cb9becbbb arm64: Correct value returned by ESR_ELx_FSC_ADDRSZ_nL() f5b8b8ccf9a4a pds_core: reject component parameter in legacy firmware update b5fcd1da05622 wifi: mac80211: recalculate TIM when a station enters power save d06fea9b85f03 iommu/intel: Fix out-of-bounds memset in dmar_latency_disable() e5ebe8544df1a iommu/amd: Bound the early ACPI HID map d21464d93f8ba wifi: mwifiex: bound uAP association event IEs to the event buffer a0980682d84d2 vhost-net: fix TX stall when vhost owns virtio-net header 59cbe6cfa0fa2 wan: wanxl: Only reset hardware after BAR mapping 3b1d4fc3b73ea nfp: Check resource mutex allocation 0f7eaeb950adb wifi: mac80211: tear down new links on vif update error path d053eb7e09e10 iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() 76fc5604308a1 net: airoha: Fix DMA direction for NPU mailbox buffer f112df0744e2d dpaa2-eth: put MAC endpoint device on disconnect 46e3bed4b0710 net: airoha: Fix potential use-after-free in airoha_ppe_deinit() 26ac2d3602347 dpaa2-switch: put MAC endpoint device on disconnect c9165e199f569 rxrpc: fix io_thread race in rxrpc_wake_up_io_thread() b78547914bee5 gtp: parse extension headers before reading inner protocol 9591042533140 rds: drop incoming messages that cross network namespace boundaries 992dce02bdabb bonding: fix devconf_all NULL dereference when IPv6 is disabled 1bc55c29cd858 net/packet: avoid fanout hook re-registration after unregister 9f4f75df77c89 netlink: specs: rt-link: convert bridge port flag attributes to u8 4264dbc84ca0a net: phy: marvell: fix return code 8881daaafadbe Bluetooth: btusb: validate Realtek vendor event length 9d208de7a8f64 regulator: mt6358: use regmap helper to read fixed LDO calibration 538d862cc0dbd hwmon: occ: validate poll response sensor blocks 2f0f661998941 ovpn: use monotonic clock for peer keepalive timeouts 5b96227c0e8b2 ovpn: fix use after free in unlock_ovpn() 47cd68e050a63 selftests/net: ovpn: fix getaddrinfo memory leak in ovpn_parse_remote() c5bf6b39be235 ovpn: avoid putting unrelated P2P peer on socket release 2fdd6d196c656 smb: client: validate DFS referral PathConsumed d6959dd79088a hwmon: (asus-ec-sensors) add missed handle for ENOMEM dd6f730be95b5 hwmon: (asus-ec-sensors) fix EC read intervals 22e449c1dd543 hwmon: (asus-ec-sensors) fix looping over banks while reading from EC d5913f97b5b60 drivers/virt: pkvm: Fix end calculation in mmio_guard_ioremap_hook() d0a57f19fe286 usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect 2d5dec517b539 wifi: iwlwifi: mvm: fix read in wake packet notification handler eae7fdf7d4469 wifi: iwlwifi: validate payload length in iwl_pnvm_complete_fn 70a6de303c9b3 wifi: iwlwifi: fix pointer arithmetic in iwl_add_mcc_to_tas_block_list a076b0c457c71 wifi: iwlwifi: mvm: validate SAR GEO response payload size cdf895bfd8035 ASoC: cs35l56: Use complete_all() to signal init_completion 3c26e8bb14cc6 ASoC: cs35l56: Fix potential probe() deadlock 1ddb3e0e502a1 ASoC: cs35l56: Don't use devres to unregister component 9153fa1ee99bf ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI 08433c71f1598 ALSA: hda: cs35l41: validate and free ACPI mute object eca9fcf9f5d89 ASoC: sun4i-codec: Set quirks.playback_only for H616 codec 41ae2b7d37c3d ASoC: tas2781: bound firmware description string parsing 797dc567146c7 btrfs: free mapping node on duplicate reloc root insert 9304713b70e7e btrfs: don't propagate EXTENT_FLAG_LOGGING to split extent maps 39f196f64bd38 btrfs: fix u32 to s64 type conversion in dirty_metadata_bytes accounting f49ff44831d52 btrfs: declare btrfs_ioctl_search_args_v2::buf as __u8 4503829843353 wifi: carl9170: fix buffer overflow in rx_stream failover path fab6ff91d5b8c wifi: carl9170: fix OOB read from off-by-two in TX status handler 9aee949c68dc6 wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read 33b5342d20806 wifi: ath6kl: fix OOB read from firmware IE lengths in connect event eb636fbc44314 wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler 0177e578d7a88 firewire: net: Fix fragmented datagram reassembly 51516fda914cc wifi: ath12k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET 9a9b0ea72d8b9 wifi: ath11k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET a154ca3c441a6 wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() 8681e5addf717 watchdog: airoha: Prevent division by zero when clock frequency is zero 7d1658b066de3 watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() 305c23993e43d hwmon: (nzxt-kraken3) Stop device IO before calling hid_hw_stop 205cff797a947 hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop f36e12cc8cfe9 hwmon: (gigabyte_waterforce) Stop device IO before calling hid_hw_stop 56d2deb644837 hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop ec477af3a7e8d hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop e5394605f9a98 wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin 48a69cedde738 wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request 593072aae7fc8 selftests/bpf: Keep verifier_map_ptr exercising ops pointer access 938bcf99f53e8 selftests/bpf: Adjust verifier_map_ptr for the map's excl field fe7892d46921e usb: xhci-pci: Limit VIA VL805 DMA addressing to 36 bits 958624d638603 Revert "drm/amd/display: Add missing kdoc for ALLM parameters" 03eb7a8099474 RISC-V: KVM: Serialize virtual interrupt pending state updates 731acda5ba777 wifi: mwifiex: fix freeze for 60 seconds caused by request_firmware 0905b3ce1deb7 usb: typec: ucsi: Add duplicate detection to nvidia registration path fe8cde072293c usb: typec: ucsi: Detect and skip duplicate altmodes from buggy firmware 67d2626827e3c USB: serial: option: add TDTECH MT5710-CN 601f75671b8fb USB: serial: keyspan_pda: fix data loss on receive throttling cbe00048b69d6 USB: serial: io_edgeport: cap received transmit credits c1611c6744e3a USB: serial: ftdi_sio: add support for E+H FXA291 1f03658f3e9b2 usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer dcf3e2f164435 usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown 40c706a0224bd usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() 12b3edca90d4d USB: gadget: fsl-udc: fix dev_printk() device 66956a5a4258c USB: gadget: fsl-udc: fix device name leak on probe failure e5ecfb7767526 USB: gadget: snps-udc: fix device name leak on probe failure 4cde0b38cc0cb usb: gadget: printer: fix infinite loop in printer_read() f45089eaad0a0 usb: gadget: f_midi: cancel pending IN work before freeing the midi object e239ea91b4818 usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback ace1a0adfc786 usb: chipidea: fix usage_count leak when autosuspend_delay is negative 8eca14198c202 USB: storage: add NO_ATA_1X quirk for Longmai USB Key 0950ac52426b0 usb: musb: omap2430: Do not put borrowed of_node in probe 7714fb896ed30 usb: core: port: Deattach Type-C connector on component unbind fb1b50ab69921 wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() 217774e143d7b usb: core: sysfs: add lock to bos_descriptors_read() 5f6e7b32bd1fb mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n a8d20ba0ab518 sctp: fix auth_hmacs array size in struct sctp_cookie fed1b1ddab41a net/sched: act_tunnel_key: Defer dst_release to RCU callback 51c2fcc4cd2e4 dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() e666af5dcc905 tcp: fix TIME_WAIT socket reference leak on PSP policy failure 6875ee2bef48f accel/amdxdna: Fix use-after-free of mm_struct in job scheduler f6b522033bc83 drm/i915/selftests: Fix GT PM sort comparators c23abdb922c39 drm/i915/wm: clear the plane ddb_y entries on plane disable f0e337e7db67c ksmbd: validate compound request size before reading StructureSize2 6ecb252efa0b4 ksmbd: pin conn during async oplock break notification 5e5f298d0af64 drm/xe/wopcm: fix WOPCM size for LNL+ 35ba43b541117 drm/xe/vf: Fix VF CCS attach/detach race with in-flight BO moves c1b19d8556265 drm/xe/vf: Shadow buffer management for CCS read/write operations bf293b5bcff41 drm/xe/sa: Shadow buffer support in the sub-allocator pool 65129a03a8018 drm/xe: Allow the caller to pass guc_buf_cache size cfb66ad4aa8e5 can: j1939: fix lockless local-destination check 3f398d45f3c75 riscv: hwprobe: Avoid uninitialized read in hwprobe_get_cpus() 1d9a2f01b3c4e s390/checksum: Fix csum_partial() without vector facility 5b06cf93341fe drm/panthor: Check debugfs GEM lock initialization 250474c69bc3f bpf, sockmap: Reject unhashed UDP sockets on sockmap update c3e61df6fabca powerpc/vtime: Initialize starttime at boot for native accounting 5c3a1cede86fd powerpc/time: Prepare to stop elapsing in dynticks-idle c1bbd0a6906b8 powerpc/85xx: Add fsl,ifc to common device ids 00ba4bf879824 can: raw: add locking for raw flags bitfield 479425744b219 drm/i915/gt: use correct selftest config symbol 7e08ab7a061b1 smb/client: handle overlapping allocated ranges in fallocate cefb44c367b2b Bluetooth: hci_qca: Clear memdump state on invalid dump size d5b3b484b62bb Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds ca58ad287bfc5 Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync 83b7e67698d0b Bluetooth: hci_sync: extend conn_hash lookup critical sections 57059ff14d81d Bluetooth: MGMT: revalidate LOAD_CONN_PARAM queued update a087ed960fce5 Bluetooth: qca: fix NVM tag length underflow in TLV parser f4e23e661a259 ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC b133f007ba02c accel/ivpu: Fix wrong register read in LNL failure diagnostics 1842d45f461a7 ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning d28920db56960 ata: sata_dwc_460ex: fix clear_interrupt_bit() clearing all pending interrupts 678d874e6ae11 ata: sata_dwc_460ex: use platform_get_irq() daa80b422ed92 ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered c7a1509123720 scsi: core: wake eh reliably when using scsi_schedule_eh 2c77ed279c4bb udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf() c75a950e77356 net/iucv: take a reference on the socket found in afiucv_hs_rcv() cb8be318b4432 ipv4: fib: free fib_alias with kfree_rcu() on insert error path c9574b8a8edeb ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF 88f87cb4b52ed cpufreq: Make cpufreq_update_pressure() fall back to cpuinfo.max_freq 640a33e77f91b firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context fb343716fad46 ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup 7f2cb99eaf53c ASoC: cs42l43: Correct report for forced microphone jack 9f393d8160435 ASoC: amd: ps: replace bitwise OR with logical OR in IRQ return check 3b2d32f528152 ASoC: amd: ps: fix wrong ACP version string in pci_request_regions() f33ad19e3e3d6 ASoC: amd: ps: disable MSI on resume in ACP PCI driver 4801f6690f984 ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop b39b08e6bee81 firmware: arm_ffa: Fix Endpoint Memory Access Descriptor offset calculation cf5708c9d78c9 firmware: arm_ffa: Fix out-of-bound writes in ffa_setup_and_transmit() 11ac7a5e75f51 wifi: cfg80211: bound element ID read when checking non-inheritance 5c342437ea44b wifi: brcmfmac: initialize SDIO data work before cleanup a424985c3ef2a wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock 44eda4a8d1dcd wifi: mac80211: avoid non-S1G AID fallback for S1G assoc fbaa8c31ef940 wifi: cfg80211: reject unsupported PMSR FTM location requests cfbda103aeae6 wifi: cfg80211: validate PMSR FTM preamble range 0caf6416bfbb3 wifi: cfg80211: validate PMSR measurement type data 0b6efde0ed970 wifi: nl80211: constrain MBSSID TX link ID range f8c547e543e12 wifi: nl80211: validate nested MBSSID IE blobs f649dc9c5e657 wifi: cfg80211: derive S1G beacon TSF from S1G fields fb052a6e2fa86 wifi: nl80211: free RNR data on MBSSID mismatch 133684982dd0c wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock d38f5d868a0a4 wifi: p54: validate RX frame length in p54_rx_eeprom_readback() 2aa1789880fa5 wifi: mac80211: defer link RX stats percpu free to RCU 6cda91bbb8dc3 wifi: libertas: fix memory leak in helper_firmware_cb() 5baaa1042f71d wifi: mac80211: fix fils_discovery double free on alloc failure d62b55b7c7dc6 wifi: mac80211: fix unsol_bcast_probe_resp double free on alloc failure 6dc76371a9a36 wifi: mac80211_hwsim: clamp virtio RX length before skb_put e67dc2b8d5ac4 wifi: cfg80211: Fix an error handling path in cfg80211_wext_siwscan() f442e581a8893 wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one() 9293574ac208d wifi: cfg80211: cancel sched scan results work on unregister 7acc5ed2f3360 xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert ff636d7b7cba6 xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() d8aaf06b29f5a xfrm: iptfs: propagate SKBFL_SHARED_FRAG in iptfs_skb_add_frags() 9845a35986a65 xfrm: clear mode callbacks after failed mode setup 9e632a70f2044 RDMA/irdma: Prevent overflows in memory contiguity checks 124382a2a9756 selftests/alsa: Fix memory leak in find_controls error path f98ae09c727dc mtd: fix double free and WARN_ON in add_mtd_device() error paths fcc9d50022bcd RDMA/siw: publish QP after initialization e221dde026af2 RDMA/hns: Fix potential integer overflow in mhop hem cleanup d842ef03d9145 RDMA/mana_ib: initialize err for empty send WR lists 14e519f93a48c RDMA/erdma: initialize ret for empty receive WR lists ec675b4cdfd37 RDMA/irdma: Prevent user-triggered null deref on QP create 1cd56258fe1a0 RDMA/irdma: Remove redundant legacy_mode checks ca1c29f05274b RDMA/irdma: Prevent rereg_mr for non-mem regions dbb945b80a3a4 RDMA/umem: Add pinned revocable dmabuf import interface c4ef25de94d73 RDMA/cma: Fix hardware address comparison length in netevent callback d7fc6f351c478 xfrm: reject optional IPTFS templates in outbound policies 2907e9d0f05b5 sched_ext: Don't warn on core-sched forced idle in put_prev_task_scx() 57acd51928333 sched/ext: Avoid null ptr traversal when ->put_prev_task() is called with NULL next 996c5c19d5b5a firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() 8edc925251780 btrfs: fallback to transaction csum tree on a commit root csum miss a84ca16ce07e7 btrfs: use bool type for btrfs_path members used as booleans 60a23d4ea169e btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() 5e1b2ca6b3493 btrfs: reject free space cache with more entries than pages 0ac9c7d9ccfd7 mtd: nand: mtk-ecc: stop on ECC idle timeouts fdb53a9b26071 mtd: mtdswap: remove debugfs stats file on teardown 98d2d468b4faa IB/mad: Drop unmatched RMPP responses before reassembly 59114e0ff6e3a firmware: arm_ffa: Respect firmware advertised RX/TX buffer size limits 33e1b0d25ca0d xfrm: fix stale skb->prev after async crypto steals a GSO segment eae16fbc7ce20 xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() 23bbb9eafec7a net: plumb drop reasons to __dev_queue_xmit() 4cc4d6fb08e75 net: dropreason: add SKB_DROP_REASON_RECURSION_LIMIT 4c22b4e3ff502 arm64: tegra: Fix CPU compatible string to cortex-a78ae on Tegra234 0b9858484d096 arm64: tegra: Remove fallback compatible for GPCDMA 903f2edc04770 fuse: fix writeback array overflow when max_pages is one afe9cda0862aa Input: ims-pcu - fix logic error in packet reset d03a740e087de Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() 6cbed4be9a6ca xprtrdma: Clear receive-side ownership pointers on release 0892b427c4b8b crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin 5f4de3c717d34 gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings ec9f66c91bffd dmaengine: sh: rz-dmac: Move interrupt request after everything is set up eca8b44d51fc6 can: bcm: track a single source interface for ANYDEV timeout/throttle ops 136de17f38630 can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler() 6be3e1fedf03e can: bcm: fix stale rx/tx ops after device removal b024c21c9066f can: bcm: add missing device refcount for CAN filter removal deb6a697cce3f can: bcm: validate frame length in bcm_rx_setup() for RTR replies bd46f55dec608 can: bcm: extend bcm_tx_lock usage for data and timer updates 8104bcdb2612f can: bcm: fix CAN frame rx/tx statistics 19b1994069dd2 can: bcm: add locking when updating filter and timer values ec9daa8fd1b6f KVM: x86/mmu: Fix use-after-free on vendor module reload 8001d2ce9d9bd KVM: nVMX: Hide shadow VMCS right after VMCLEAR dd50ad7935d57 KVM: x86: Only reset TSC Deadline Timer in apic_timer_expired on KVM_RUN f3477a6a4164f KVM: x86: Check for invalid/obsolete root *after* making MMU pages available 865dfe76c150b seqlock: Allow UBSAN_ALIGNMENT to fail optimizing 3958b1aeef43b seqlock: Allow KASAN to fail optimizing ec46baf830825 seqlock: Cure some more scoped_seqlock() optimization fails 8e39ed92d7c5c fs/proc/task_mmu: fix make_uffd_wp_huge_pte() prot-update race 89890a5fcefad drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker f6410d18c1e2d netfilter: nf_tables: revert commit_mutex usage in reset path 0c8a9022f4c56 netfilter: nft_quota: use atomic64_xchg for reset cd968dcdec6ae netfilter: nft_counter: serialize reset with spinlock 55904f1a4689a selftests/bpf: Add tests for ld_{abs,ind} failure path in subprogs ce01a4e5cfac7 bpf: Fix ld_{abs,ind} failure path analysis in subprogs bffc0b27e457c platform/x86/intel-uncore-freq: Fix current_freq_khz after CPU hotplug Signed-off-by: Bruce Ashfield --- .../linux/linux-yocto-rt_6.18.bb | 6 ++--- .../linux/linux-yocto-tiny_6.18.bb | 6 ++--- meta/recipes-kernel/linux/linux-yocto_6.18.bb | 24 +++++++++---------- 3 files changed, 18 insertions(+), 18 deletions(-) diff --git a/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb b/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb index 3757053885..edb3696b25 100644 --- a/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb +++ b/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb @@ -15,13 +15,13 @@ python () { raise bb.parse.SkipRecipe("Set PREFERRED_PROVIDER_virtual/kernel to linux-yocto-rt to enable it") } -SRCREV_machine ?= "fa4de2c8b38ef83fd991db3b507630001104cac5" -SRCREV_meta ?= "24949c3ef490d79a73a821f688efdc2f562fc851" +SRCREV_machine ?= "f3301719a9aa0f6e52a9ef3f54f7339a4241f7b9" +SRCREV_meta ?= "7f630b9b05e171d09925e2f0edd84697ff826f93" SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;branch=${KBRANCH};name=machine;protocol=https \ git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-6.18;destsuffix=${KMETA};protocol=https" -LINUX_VERSION ?= "6.18.41" +LINUX_VERSION ?= "6.18.43" LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46" diff --git a/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb b/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb index 5addcaae07..894267acdf 100644 --- a/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb +++ b/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb @@ -9,7 +9,7 @@ require recipes-kernel/linux/linux-yocto.inc include recipes-kernel/linux/cve-exclusion.inc include recipes-kernel/linux/cve-exclusion_6.18.inc -LINUX_VERSION ?= "6.18.41" +LINUX_VERSION ?= "6.18.43" LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46" DEPENDS += "${@bb.utils.contains('ARCH', 'x86', 'elfutils-native', '', d)}" @@ -18,8 +18,8 @@ DEPENDS += "openssl-native util-linux-native" KMETA = "kernel-meta" KCONF_BSP_AUDIT_LEVEL = "2" -SRCREV_machine ?= "06f4fd92efb65a6108294f43855ca32fe22cb96f" -SRCREV_meta ?= "24949c3ef490d79a73a821f688efdc2f562fc851" +SRCREV_machine ?= "73fd4709c133ba2ee6012cfb6a63eb908d1a5cc6" +SRCREV_meta ?= "7f630b9b05e171d09925e2f0edd84697ff826f93" PV = "${LINUX_VERSION}+git" diff --git a/meta/recipes-kernel/linux/linux-yocto_6.18.bb b/meta/recipes-kernel/linux/linux-yocto_6.18.bb index 3ceba003fa..e510ff01aa 100644 --- a/meta/recipes-kernel/linux/linux-yocto_6.18.bb +++ b/meta/recipes-kernel/linux/linux-yocto_6.18.bb @@ -17,25 +17,25 @@ KBRANCH:qemux86-64 ?= "v6.18/standard/base" KBRANCH:qemuloongarch64 ?= "v6.18/standard/base" KBRANCH:qemumips64 ?= "v6.18/standard/mti-malta" -SRCREV_machine:qemuarm ?= "fbf752dfa74a5be78586014f82002bca11063fa8" -SRCREV_machine:qemuarm64 ?= "06f4fd92efb65a6108294f43855ca32fe22cb96f" -SRCREV_machine:qemuloongarch64 ?= "06f4fd92efb65a6108294f43855ca32fe22cb96f" +SRCREV_machine:qemuarm ?= "6e4861d133214a07c0b2f3e6d8de190fa2734697" +SRCREV_machine:qemuarm64 ?= "73fd4709c133ba2ee6012cfb6a63eb908d1a5cc6" +SRCREV_machine:qemuloongarch64 ?= "73fd4709c133ba2ee6012cfb6a63eb908d1a5cc6" SRCREV_machine:qemumips ?= "62ea92a539f58803a222be98b81118403074206e" -SRCREV_machine:qemuppc ?= "06f4fd92efb65a6108294f43855ca32fe22cb96f" -SRCREV_machine:qemuriscv64 ?= "06f4fd92efb65a6108294f43855ca32fe22cb96f" -SRCREV_machine:qemuriscv32 ?= "06f4fd92efb65a6108294f43855ca32fe22cb96f" -SRCREV_machine:qemux86 ?= "06f4fd92efb65a6108294f43855ca32fe22cb96f" -SRCREV_machine:qemux86-64 ?= "06f4fd92efb65a6108294f43855ca32fe22cb96f" +SRCREV_machine:qemuppc ?= "73fd4709c133ba2ee6012cfb6a63eb908d1a5cc6" +SRCREV_machine:qemuriscv64 ?= "73fd4709c133ba2ee6012cfb6a63eb908d1a5cc6" +SRCREV_machine:qemuriscv32 ?= "73fd4709c133ba2ee6012cfb6a63eb908d1a5cc6" +SRCREV_machine:qemux86 ?= "73fd4709c133ba2ee6012cfb6a63eb908d1a5cc6" +SRCREV_machine:qemux86-64 ?= "73fd4709c133ba2ee6012cfb6a63eb908d1a5cc6" SRCREV_machine:qemumips64 ?= "9fb4ff0187c85426f21fd40d4c61b742800f65c4" -SRCREV_machine ?= "06f4fd92efb65a6108294f43855ca32fe22cb96f" -SRCREV_meta ?= "24949c3ef490d79a73a821f688efdc2f562fc851" +SRCREV_machine ?= "73fd4709c133ba2ee6012cfb6a63eb908d1a5cc6" +SRCREV_meta ?= "7f630b9b05e171d09925e2f0edd84697ff826f93" # set your preferred provider of linux-yocto to 'linux-yocto-upstream', and you'll # get the /base branch, which is pure upstream -stable, and the same # meta SRCREV as the linux-yocto-standard builds. Select your version using the # normal PREFERRED_VERSION settings. BBCLASSEXTEND = "devupstream:target" -SRCREV_machine:class-devupstream ?= "2fe596715f840d053aed5cee5455f701bdcd2b50" +SRCREV_machine:class-devupstream ?= "7b923c78b50d2ec52690c4353e5aad8302e80599" PN:class-devupstream = "linux-yocto-upstream" KBRANCH:class-devupstream = "v6.18/base" @@ -43,7 +43,7 @@ SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;name=machine;branch=${KBRA git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-6.18;destsuffix=${KMETA};protocol=https" LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46" -LINUX_VERSION ?= "6.18.41" +LINUX_VERSION ?= "6.18.43" PV = "${LINUX_VERSION}+git" From patchwork Fri Aug 7 16:28:58 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Bruce Ashfield X-Patchwork-Id: 94776 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5BE2FC5AC7A for ; Fri, 7 Aug 2026 16:29:20 +0000 (UTC) Received: from mail-qv1-f49.google.com (mail-qv1-f49.google.com [209.85.219.49]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.46460.1786120150127111385 for ; Fri, 07 Aug 2026 09:29:10 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=r77XC+aE; spf=pass (domain: gmail.com, ip: 209.85.219.49, mailfrom: bruce.ashfield@gmail.com) Received: by mail-qv1-f49.google.com with SMTP id 6a1803df08f44-8f0e5e36912so20289526d6.2 for ; Fri, 07 Aug 2026 09:29:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786120149; x=1786724949; darn=lists.openembedded.org; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:from:to:cc:subject :date:message-id:reply-to:content-type; bh=UsVdkHlGSF+7aYeKGe6BF4ckcbTdN6ttny2WwMVolIc=; b=r77XC+aE72SZG5qG5Ld3RRVFNjxacyRvjPOJBOkgkbPf3pk0CJHjwx4urSmNmy0QcG oAEWIm6j87+/vJNWQQMZaDGanyi+684m+pSqhepcw1XgT8EPN5UYUSQwdplzjNp/8v1P YWGk1irxdtW5lnk8l4RubqGp9ZaJrFrgC63hdDbUAaJN5ulIIxQQdWF9V3h0cGkJcgS/ 4UFKQtSNNoEqVL0CpNdpHMEOpIEvQAz/FFhmpk6i0rUTrjxlc5/QAwR5l6g+MVYWzzvW eVR6W+BrBRmga/EJPoFDnmpZHN6P63g2SS2tGXY3uU0IWvPiUFO8r0zJsba61x4oo8eo fEFg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786120149; x=1786724949; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=UsVdkHlGSF+7aYeKGe6BF4ckcbTdN6ttny2WwMVolIc=; b=new3x3iC8FMzW31UtA9M57UtpS49oSqHmClicvxToRbIV7/JtEo8S5dyL8bCUrd6Oj 6ztaRTN1wyRz+xz1NuySdOzF9nLEXpGVQDWqs1hVxP+Vrrr20PEbDPG9c2jICGjW/EGF aPJTJecUfK1Fld5inraWJHTW1zpCYuD97AgaogvtZQ1E7m8lfleuX7ZPrGcNcLn3Gbug 3n81KWbi/w7bpTXUfyFe81W2cpysETtWQq1h7gdw7tmhlZfmtNeArY+SGDxuYea2iSmb 6u+5YL24gRXOqEWGQuMrjKNxQenW/nabpFUMmcCsTmKPqELyhNgVdsQMJFOc5cut3jpV Og2w== X-Gm-Message-State: AOJu0Yz2QJ7d9lFUi2H/A09DKEIHrdwMXBvCq/t6gAIDgVFZlapZorWo eFMVacdQyJDbkk2/Nu7ld2B2TpLLZwM/CoMqtaSzyvSjYxTZSf38aqtFz2nuPCzE X-Gm-Gg: AR+sD113aiANOjqIyX+8Iz5I5QCiHvSisAJbVTKe84B4O21ypd7FrLJMZDDtf9c2fti pJyZjSgdxRjp6gxqu94P5il8Q45o+CkI7FoJmhyDevIwe6pg/sO25qJBzXDWK1jInYHwAfRQjay tvluVDyGGInrxidasPpwUMtLPJ2rl2qaU9lv5PB7w6odoTvGDlTABJsSw5sAmsXPEgYx/lBGqLs F14rJ7pXgnJsK8MSr+Nem4N+dX3p9jh4ZL0XbJxO0oyqu1hvN14KlUQAVBaj+XZJLAsvY14pktL Vzs2oc+iXusveLn+LJPyxlnnt6aeQNh2p0RjXI9nB+7UsHl58nvbqYZ688RaTyPkAsOE+e1ux+G /iG93M0HL7VLG8ChVD0F+lm42tnU2nIunY4pYOe2WoouU6aJ/xyy7U6VUhzxOpqNDkkFE3gcper ScEDZzdgDnkgH07xcyMZuYtG55piMYlsaFdltKo8/MCihiQtmG55Fq7wCiKQ8BfKbIFKovnT8Aw hyhNy8G8tXUZzo5XB5pd7diosIxS0cosmmJQAkD71lklAyeyG8CQZNbIXZ+qp8DeGs4rhsS6n9y 7F4P436WyGojNcgBCH780GhDrQV/rCFukQMf6Hp6mipduxxIjtpaW0pjU7zqYQ6GeqnrNEuWpRo suYfRMw== X-Received: by 2002:a05:6214:252a:b0:8fd:7913:b34e with SMTP id 6a1803df08f44-908812548b8mr269413486d6.17.1786120147714; Fri, 07 Aug 2026 09:29:07 -0700 (PDT) Received: from bruce-XPS-8940.localdomain (pool-174-112-62-108.cpe.net.cable.rogers.com. [174.112.62.108]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-908a92fed68sm12521756d6.31.2026.08.07.09.29.06 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 07 Aug 2026 09:29:06 -0700 (PDT) From: bruce.ashfield@gmail.com To: richard.purdie@linuxfoundation.org Cc: openembedded-core@lists.openembedded.org Subject: [meta-yocto-bsp][PATCH 03/04] yocto-bsps: update to v6.18.41 Date: Fri, 7 Aug 2026 12:28:58 -0400 Message-ID: <20260807162900.2623274-4-bruce.ashfield@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260807162900.2623274-1-bruce.ashfield@gmail.com> References: <20260807162900.2623274-1-bruce.ashfield@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 07 Aug 2026 16:29:20 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/243020 From: Bruce Ashfield Updating linux-yocto/6.18 to the latest korg -stable release that comprises the following commits: 2fe596715f840 Linux 6.18.41 6a7ecc25abe6f posix-cpu-timers: Prevent UAF caused by non-leader exec() race 9f7268928ac0c posix-timers: Expand timer_[re]arm() callbacks with a boolean return value 221fc2f4d0eda Linux 6.18.40 478c4d24193fe RDMA/bnxt_re: Avoid repeated requests to allocate WC pages b87cbd4d198ae RDMA/bnxt_re: Initialize dpi variable to zero 81e6faa5b6405 ksmbd: fix durable reconnect double-bind race in ksmbd_reopen_durable_fd 1badb6866482d perf callchain: Handle multiple address spaces 275eb39930947 seqlock: fix scoped_seqlock_read kernel-doc 453cb79a15641 perf inject: With --convert-callchain ignore the dummy event for dwarf stacks 2764d031efd6d PCI: Fix Resizable BAR restore order 2fb74141ec54e PCI: Fix BAR resize rollback path overwriting ret 7425e7d82cb93 perf symbol: Fix ENOENT case for filename__read_build_id a888f3d5970ff pinctrl: airoha: fix pinctrl function mismatch issue 267fdd9b6530c bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized 779480ea79551 iommufd: Move vevent memory allocation outside spinlock 73b5d5cb1f5a1 iommufd: Propagate allocation failure in iommufd_veventq_deliver_fetch() ea7a76d7d614b KVM: arm64: nv: Re-translate VNCR before injecting abort 459adfc6cd35f KVM: arm64: Deduplicate ASID retrieval code 9d360fb820a3b samples/damon/mtier: fail early if address range parameters are invalid ec976851ad934 mm/damon/core: trace esz at first setup 3b91c35961fa5 mm/damon/core: always put unsuccessfully committed target pids ba37cd4d8a751 KVM: arm64: Fix propagation of TLBI level in kvm_pgtable_stage2_relax_perms() 19d9996435db8 KVM: arm64: Ensure level is always initialized when relaxing perms c3a3d39867190 btrfs: fix incorrect buffered IO fallback for append direct writes 998ee7f01ecfa btrfs: fix false IO failure after falling back to buffered write a4497a122e27f crypto: qat - fix restarting state leak on allocation failure 6c78081d047c5 btrfs: remove folio parameter from ordered io related functions 1a648c50a5057 btrfs: replace for_each_set_bit() with for_each_set_bitmap() 99d4ae3fbb5b1 btrfs: concentrate the error handling of submit_one_sector() 382fd8004cc60 crypto: atmel-sha204a - fail on hwrng registration error in probe path 952db4b985c79 usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile 69faa3779250d usb: gadget: f_fs: initialize reset_work at allocation time 8a2fdbf92cdc7 functionfs: use spinlock for FFS_DEACTIVATED/FFS_CLOSING transitions 5fb0b09180a0f functionfs: switch to simple_remove_by_name() 4744f07f6bb7c functionfs: don't bother with ffs->ref in ffs_data_{opened,closed}() 901c036cf6254 functionfs: don't abuse ffs_data_closed() on fs shutdown c3e6860252102 new helper: simple_remove_by_name() 509b51327320b usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect() b78826a657998 usb: atm: ueagle-atm: remove function entry/exit debug messages 6e5ef54b884f4 usb: atm: ueagle-atm: use dev_dbg() for 'device found' message 41a4e80d5af04 usb: dwc3: fix dwc3_readl() and dwc3_writel() calls in dwc3_ulpi_setup() e534790c4c272 usb: dwc3: Support USB3340x ULPI PHY high-speed negotiation. bce232923aa9e xfs: use bio_reuse in the zone GC code adadb181ad42a xfs: only log freed extents for the current RTG in zoned growfs 47c0e07433021 xfs: add a xfs_groups_to_rfsbs helper 57454944737f3 bpf: Allow LPM map access from sleepable BPF programs 8fccaeeb9e9c5 bpf: Consistently use bpf_rcu_lock_held() everywhere 0b92ad64d6e4b bpf: Keep dynamic inner array lookups nullable c447be8d88c30 bpf: Introduce struct bpf_map_desc in verifier dccb3c557879d bpf: Consistently use reg_state() for register access in the verifier 60eed44674295 xfs: initialize iomap->flags earlier in xfs_bmbt_to_iomap 607217f7ad419 hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length 7676ea09beb5d hfs/hfsplus: prevent getting negative values of offset/length f9b4b03ccc9c6 proc: protect ptrace_may_access() with exec_update_lock (part 1) 07bf18dc63f78 seqlock: Change do_task_stat() to use scoped_seqlock_read() c897fd63762e0 seqlock: Introduce scoped_seqlock_read() 497c6bae51674 proc: protect ptrace_may_access() with exec_update_lock (FD links) 903d78e5aca77 proc: rename proc_setattr to proc_nochmod_setattr b56400364aed5 ksmbd: validate NTLMv2 response before updating session key 74c2f0ffb81c8 ksmbd: Use HMAC-MD5 library for NTLMv2 51c5f7e84cfed ksmbd: Use HMAC-SHA256 library for message signing and key generation bd27d9504d200 ksmbd: Use SHA-512 library for SMB3.1.1 preauth hash 427faaa52b0b3 ksmbd: track the connection owning a byte-range lock 6a37bc484f12e ksmbd: centralize ksmbd_conn final release to plug transport leak c7c884a1305aa ksmbd: fix path resolution in ksmbd_vfs_kern_path_create e205f3e7e8c31 ksmbd: use opener credentials for FSCTL mutations 90a93fb3230c9 cifs: SMB1 split: Add some #includes ff943e1f3d31f cifs: SMB1 split: Rename cifstransport.c 36da806f7fbae Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() 6d0eeebe22ba7 Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister ef382a6baf0a9 media: nxp: imx8-isi: Fix use-after-free on remove 4278953ff0cd4 media: nxp: imx8-isi: use devm_pm_runtime_enable() to simplify code 49cd5ac6de8de crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() 4b51ee8a40fe4 staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr() 5d76bc296bb58 staging: rtl8723bs: fix spaces around binary operators 48323ebaeeeed staging: rtl8723bs: core: move constants to right side in comparison 73cc54326de45 PCI: Skip Resizable BAR restore on read error f33837a754473 PCI: Move Resizable BAR code to rebar.c 2242c75b63286 PCI: Add kerneldoc for pci_resize_resource() 4b5322f0002aa PCI: Fix restoring BARs on BAR resize rollback path c18646165f21f PCI: Free saved list without holding pci_bus_sem 534f20cdddc31 PCI: Try BAR resize even when no window was released dbb1d8507dd92 PCI: Change pci_dev variable from 'bridge' to 'dev' 0d1c263e6fd73 PCI/IOV: Adjust ->barsz[] when changing BAR size 0dfad346c293e PCI: imx6: Configure REF_USE_PAD before PHY reset for i.MX95 e53d54b92f0c2 PCI: imx6: Fix reference clock source selection for i.MX95 1228926e1e4d6 binder: cache secctx size before release zeroes it 79ac87bb1a4c8 binder: Use LIST_HEAD() to initialize on stack list head 7ed120b1a007b vfio/mlx5: Fix racy bitfields and tighten struct layout f8272331da877 ALSA: hda/tas2781: Cancel async firmware request at unbind 6438d0707087e firmware_loader: Add cancel helper for async requests 1ed7ff33cfc8c ALSA: scarlett2: Update offsets for 2i2 Gen 4 firmware 2417 ad5c5bdb0f580 ALSA: scarlett2: Allow selecting config_set by firmware version 2745574697ee4 iio: hid-sensor-rotation: Fix stale or zero output when reading raw values 7f680924c5c2b ACPI: NFIT: core: Fix possible deadlock and missing notifications cf5f93228e7ab ACPI: NFIT: core: Use devm_acpi_install_notify_handler() d57d2aae87b23 ACPI: bus: Introduce devm_acpi_install_notify_handler() 34f4d0e4e5065 ACPI: driver: Check ACPI_COMPANION() against NULL during probe 3b2628f7682ae ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup 83f29da85dc9d crypto: xilinx-trng - Remove crypto_rng interface f84c0bae0e8dd mmc: sdhci-esdhc-imx: fix resume error handling 174dc8103ab7b mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend 5b8f11cbe8ad5 mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend 4f96903e2fd22 mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt aa276aa6cbfbc mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore 52990f6b57526 mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume eefcd3ca245c1 mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore c02237966c199 mmc: sdhci-of-dwcmshc: check bus clock enable result in the probe() method 8d94498cc4453 mmc: block: fix RPMB device unregister ordering cf7258f57d180 mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout 4b5de4007e5bf mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout de2bc884d8870 mtd: rawnand: fsl_ifc: return errors for failed page reads bf9848a22a8e5 mmc: vub300: defer reset until cmd_mutex is unlocked 04ebd3766861f mtd: mchp23k256: use SPI match data for chip caps ac2d9f6b4f905 mtd: onenand: samsung: report DMA completion timeouts a59cfa165aee3 wifi: mwifiex: fix permanently busy scans after multiple roam iterations b8df3a993f690 wifi: mac80211: free ack status frame on TX header build failure 90576bd6921a9 wifi: ieee80211: validate MLE common info length 584657c5fc58d wifi: cfg80211: validate EHT MLE before MLD ID read 3c1e92f75e11a powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access() 82753ac86cb3d reset: sunxi: fix memory region leak on ioremap failure 3fb7edd2018bb ipvs: reload ip header after head reallocation d4ec18f48ce78 ipvs: fix more places with wrong ipv6 transport offsets 39151f0708c84 memstick: ms_block: reject a card that reports too many blocks a75d2b5249e38 macsec: fix promiscuity refcount leak in macsec_dev_open() fd701fc0d0652 llc: fix SAP refcount leak when creating incoming sockets 6744ab60dfac5 Bluetooth: btrtl: validate firmware patch bounds dbd14f736be02 net: openvswitch: reject oversized nested action attrs 6926d13865aaa regulator: ltc3676: Fix incorrect IRQSTAT bit offsets 688bd4c6144d2 riscv: vdso: Do not use LTO for the vDSO 55b26abb1fa1e wifi: brcmfmac: cyw: fix heap overflow on a short auth frame bdc0b8bfdc142 wifi: mac80211: fix memory leak in ieee80211_register_hw() 65446b85595a4 wifi: mwifiex: fix roaming to different channel in host_mlme mode 816559409e340 wifi: rt2x00: avoid full teardown before work setup in probe 262da8b6ea03d net/mlx5: free mlx5_st_idx_data on final dealloc 9b8df4da2cf79 powerpc/pseries: fix memory leak on krealloc failure in papr_init afa0db5322c5f mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume d94160a5d1ac3 selftests/landlock: Fix screwed up pointers in the scoped_signal_test ba481c0b53760 selftests/landlock: Skip scoped_signal subtest with MSG_OOB if not available 4ff3960f35271 pmdomain: imx: Fix i.MX8MP VC8000E power up sequence 9a0464fcfae4f pmdomain: imx: Fix i.MX8MP power notifier c844b7d9a9586 cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed 8131a91fe2dea selftests/rseq: Fix a building error for riscv arch 3dfec7490f3a2 s390/mm: Fix type mismatch in get_align_mask(). c6b4d454865a8 s390/diag: Add missing array_index_nospec() call to memtop_get_page_count() fad36954b2959 tracing/osnoise: Call synchronize_rcu() when unregistering eadd0c2c76aee riscv: Prevent NULL pointer dereference in machine_kexec_prepare() 38cc4867540ae drbd: reject data replies with an out-of-range payload size 91ec52dd2a5d9 ata: libata-core: Allow capacity transition to zero for locked drives 7a9a69641b68a ata: libata-core: Skip HPA resize for locked drives 52007bfdce531 fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list 1155a9d0a2e0d fs/resctrl: Free mon_data structures on rdt_get_tree() failure ccdf1770a4ba2 cpu/hotplug: Fix NULL kobject warning in cpuhp_smt_enable() 5f5783c7806fc arm64: smp: Fix hot-unplug tearing by forcing unregistration 26b131b2d5b55 net: macb: drop in-flight Tx SKBs on close b2f426a9a2288 dibs: loopback: validate offset and size in move_data() 2cf10d0425622 macsec: don't read an unset MAC header in macsec_encrypt() 83fb4c2c5344f ipvs: reset full ip_vs_seq structs in ip_vs_conn_new 247d055504dcc ipvs: use parsed transport offset in SCTP state lookup 61a7ff4a62003 llc: fix SAP refcount leak in llc_ui_autobind() 685fb410d90e5 selftests: net: make busywait timeout clock portable 5df30f05db965 octeontx2-pf: fix SQB pointer leak on init failure 77caf2d6eba7c mac802154: remove interfaces with RCU list deletion f0745496f7c17 s390/monwriter: Reject buffer reuse with different data length a5a367756926d irqchip/irq-riscv-imsic-early: Fix fwnode leak on state setup failure 018d7ad26cb8b mm/compaction: handle free_pages_prepare() properly in compaction_free() 2faf0198168d2 riscv: probes: save original sp in rethook trampoline d8d4fa0c4f818 hwmon: (asus_atk0110) Check package count before accessing element 07f5eb6d268a3 net: wwan: iosm: bound device offsets in the MUX downlink decoder 1286a41563337 ata: pata_pxa: Fix DMA channel leak on probe error 1dce4f4bb3c1c net/mlx5: HWS, fix matcher leak on resize target setup failure 82fc886e244c7 orangefs: keep the readdir entry size 64-bit in fill_from_part() 2c76c01a505c1 tracing/probes: Fix double addition of offset for @+FOFFSET b4427ee3667c5 hwmon: (max1619) add missing 'select REGMAP' to Kconfig 6c52226072a3c fhandle: reject detached mounts in capable_wrt_mount() e2b7ee61989f2 net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked 5889064919a1e net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked 99a6f37b113c4 net: lan743x: Initialize eth_syslock spinlock before use ac58088d70b8a fsl/fman: Free init resources on KeyGen failure in fman_init() f0aad157576da hwmon: (occ) unregister sysfs devices outside occ lock 715cce38424fb net: liquidio: fix BAR resource leak on PF number failure 664480021f6a4 hwmon: (w83793) remove vrm sysfs file on probe failure c6c990f7208c9 hwmon: (w83627hf) remove VID sysfs files on error and remove 8dc6c7e8c9678 rtc: mpfs: fix counter upload completion condition 6e21d1253ef13 rtc: renesas-rtca3: Fix PIE clear polling condition in alarm setup error path 6c98ccdb9a096 bnx2x: fix potential memory leak in bnx2x_alloc_mem_bp() f5c5065963024 ipmi: fix refcount leak in i_ipmi_request() a66d45e0ce6d7 espintcp: use sk_msg_free_partial to fix partial send ddbb6e3dc9bb4 ipmi: Fix user refcount underflow in event delivery a65f49b6f7ece LoongArch: Fix missing dirty page tracking in {pte,pmd}_wrprotect() 20ac8131f8c90 LoongArch: Fix nr passing in set_direct_map_valid_noflush() 612cda6630f2e pwm: rzg2l-gpt: Fix period_ticks type from u32 to u64 4b73889941b95 selftests/bpf: Add simple strscpy() implementation da7f17c2d5bb4 KVM: TDX: Account all non-transient page allocations for per-TD structures d0cc2c74060be drm/xe/userptr: Stub notifier_lock helpers when DRM_GPUSVM=n 6cec36c795c03 net/sched: sch_teql: move rcu_read_lock()/spin_lock() from _bh variants 55da782eb4545 platform/x86/amd/pmc: Avoid logging "(null)" for DMI values 35267819b2507 gve: fix header buffer corruption with header-split and HW-GRO 2059c28bd725b ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit cb5cca1d2a908 ieee802154: ca8210: fix cas_ctl leak on spi_async failure 314f21c9dd0dc ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation 1905ebabe638c ieee802154: admin-gate legacy LLSEC dump operations 19c148cb82d11 octeontx2-af: Free BPID bitmap on setup failure 234cd54fc500f net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink 03d8843b143eb net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink 68cadc3698c7d net: ipip: require CAP_NET_ADMIN in the device netns for changelink 9571af2eec802 net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink 0b2f9c908f930 net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink 6596baf804110 net: ena: clean up XDP TX queues when regular TX setup fails ab625256882e0 selftests: net: fix file owner for broadcast_ether_dst test b3d8354078461 net/sched: act_ct: preserve tc_skb_cb across defragmentation 3f85fcd520aa7 net: ixp4xx_hss: fix duplicate HDLC netdev allocation e89b8829693e6 net: wwan: t7xx: destroy DMA pool on CLDMA late init failure 121c5f31c3fb7 net: ethernet: ti: icssg: guard PA stat lookups 3118e97dae533 net: sit: require CAP_NET_ADMIN in the device netns for changelink 5d7bd8790309b gpios: palmas: add .get_direction() op d3b9026ef78da gpio: mt7621: avoid corruption of shared interrupt trigger state 4e16bc75c7502 gpio-f7188x: Add support for NCT6126D version B b6e040b5143cc gpio: mt7621: be sure IRQ domain is created before exposing GPIO chips ac761e66708d5 gpio: tegra: do not call pinctrl for GPIO direction 0630f2c3c16c0 gpio: mt7621: more robust management of IRQ domain teardown 6cb15b81ff545 cpu: hotplug: Bound hotplug states sysfs output f77117530fc3f cpu: hotplug: Preserve per instance callback errors afd147e59b32a selftests/ftrace: Drop invalid top-level local in test_ownership ea6a188ee805e posix-cpu-timers: Use u64 multiplication in update_rlimit_cpu() 633cadbc0b832 locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() fcff712d0e3d1 wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() b33ac2d39953e tracing/user_events: Fix use-after-free in user_event_mm_dup() ed3cc4218070d net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete 0e8115a7ed9a9 Input: ims-pcu - fix type confusion in CDC union descriptor parsing f516cba88bf95 Input: ims-pcu - fix race condition in reset_device sysfs callback 383934c249a98 Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing 9c964fc9507ae Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging 99c428d7ef644 Input: ims-pcu - fix firmware leak in async update 05ac85da12198 Input: ims-pcu - fix DMA mapping violation in line setup f28c5cabb2df0 Input: ims-pcu - add response length checks c8d3d83f2eaaf Input: ims-pcu - validate control endpoint type 6329d1af316a4 Input: ims-pcu - release data interface on disconnect 87e2f89dea078 Input: ims-pcu - only expose sysfs attributes on control interface 6aacc18004b1a Input: ims-pcu - fix use-after-free and double-free in disconnect df87532e92122 scsi: elx: efct: Fix I/O leak on unsupported additional CDB 9b871369cbb45 scsi: elx: efct: Fix refcount leak in efct_hw_io_abort() cb7bdae7fba40 scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE 004ccd2d3b4ac scsi: target: Bound PR-OUT TransportID parsing to the received buffer f1516c56ac540 scsi: xen: scsiback: Free unsubmitted command instead of double-putting it 255fb7b0cdc94 scsi: xen: scsiback: Free the command tag on the TMR submit-failure path d0a8a6660d58e scsi: sg: Report request-table problems when any status is set ed08497977820 scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup() d495b403d5b35 scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path 257321a1c036d accel/ivpu: Reject firmware log with size smaller than header 4e370b5289624 accel/amdxdna: Fix use-after-free in amdxdna_gem_dmabuf_mmap() 7aa8f3dba5342 dma-fence: Make dma_fence_dedup_array() robust against 0-count input 089e05b644d5a dm-verity: make error counter atomic c8d743bb0e98a dm-verity: increase sprintf buffer size f15eaa3801f2f dm-verity: fix a possible NULL pointer dereference 2a0858cba1dab dm-verity: avoid double increment of &use_bh_wq_enabled 5dfd804263527 dm-integrity: don't increment hash_offset twice aa5113e7155f4 dm-integrity: fix a bug if the bio is out of limits 0c4e9bb1d4101 dm-integrity: fix leaking uninitialized kernel memory 92e3c93d60be1 dm_early_create: fix freeing used table on dm_resume failure ee458c3c18343 dm-stats: fix merge accounting 461d36b5ddafc dm-stats: fix dm_jiffies_to_msec64 1247615aadb74 dm-pcache: reject option groups without values e0b0163a65758 dm-log: fix a bitset_size overflow on 32bit machines d61c12573ed97 dm-ioctl: fix a possible overflow in list_version_get_info 021dab70eb37d dm-bufio: fix wrong count calculation in dm_bufio_issue_discard 1fcb5e29dd7a5 dm era: fix out-of-bounds memory access for non-zero start sector 7f76245960a33 dm thin metadata: fix metadata snapshot consistency on commit failure ac2136dc4441d dm thin metadata: fix superblock refcount leak on snapshot shadow failure 8a3c44a003176 net: sparx5: unregister blocking notifier on init failure ffd17a393921a block: fix IORING_URING_CMD_REISSUE flags check in blkdev_uring_cmd 2977b5fe401c1 block: fix race in blk_time_get_ns() returning 0 af382ffca93e5 block: remove redundant GD_NEED_PART_SCAN in add_disk_final() 0b6252afcd196 bpf: Add missing access_ok call to copy_user_syms c4f626ddf2350 bpf,fork: wipe ->bpf_storage before bailouts that access it 0993dc5fc619c bpf: Reset register bounds before narrowing retval range in check_mem_access() b06a4a397ac82 can: bcm: add missing rcu list annotations and operations 35f0ac19efb1a can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure cd830e0bc25ee can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF 37beb16e08cae can: isotp: serialize TX state transitions under so->rx_lock 7bef39ba76eb7 can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER b88a511308779 can: isotp: use unconditional synchronize_rcu() in isotp_release() 765ba1c91823a can: esd_usb: kill anchored URBs before freeing netdevs 5e4c8e08ce957 netdev-genl: report NAPI thread PID in the caller's pid namespace 26355295ce21c nvmet: fix refcount leak in nvmet_sq_create() 2944113ad5fbc nvmet-rdma: handle inline data with a nonzero offset 2eaa3ad450141 nvmet-auth: reject short AUTH_RECEIVE buffers 59cef6abc924a nvme-apple: Prevent shared tags across queues on Apple A11 0ffc032294a29 NFS: Charge unstable writes by request size, not folio size ebe0a55d954fa sctp: validate STALE_COOKIE cause length before reading staleness d44b828eb551b spi: uniphier: Fix completion initialization order before devm_request_irq() 9b092f9e6b34d time: Fix off-by-one in compat settimeofday() usec validation ada4b9a5087ea tpm: Make the TPM character devices non-seekable 95bdf3950d668 tpm: fix event_size output in tpm1_binary_bios_measurements_show 8ca2a19a987a7 xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink e0f688ccb20f1 xfrm: use compat translator only for u64 alignment mismatch 5b0c4c916f202 xfrm: nat_keepalive: avoid double free on send error 16d3ccdabb8de xen/gntdev: fix error handling in ioctl e497fef9ad7e9 ufs: core: tracing: Do not dereference pointers in TP_printk() 0ced34b4bbc04 tcp: Decrement tcp_md5_needed static branch 33a1bee413628 tcp: defer md5sig_info kfree past RCU grace period in tcp_connect bccae122dab8f ice: fix ice_init_link() error return preventing probe 8bd84316bbaf3 i2c: spacemit: fix spurious IRQ handling returning IRQ_HANDLED e6a395a71f465 i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource() 2f3f471a448a5 i2c: mediatek: fix WRRD for SoCs without auto_restart option 5d3240f42a667 i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) 6d2c973926d06 i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) 500716a007b2e hwmon: (max6697) add missing 'select REGMAP_I2C' to Kconfig 1dcd7565e5909 hwmon: (ltc2992) add missing 'select REGMAP_I2C' to Kconfig 3cd6f93f3d593 ksmbd: fix integer overflow in set_file_allocation_info() 6cc1518357369 smb: client: use kvzalloc() for megabyte buffer in simple fallocate fe623f9515bb0 pkey: Move keytype check from pkey api to handler eafc5aca71564 platform/x86/amd/pmc: Don't log during intermediate wakeups e628d9169f9e1 platform/x86/amd/pmc: Add delay_suspend module parameter 27d16a19ae74f platform/x86/amd/pmc: Delay suspend for some Lenovo Laptops d8bc45c4c1a45 platform/x86/amd/pmc: Check for intermediate wakeup in function cea03d67db3a8 platform/x86: ISST: Restore SST-PP control to all domains 1e41ca4a7fba2 platform/x86: dell-laptop: fix missing cleanups in init error path ddbc4a8a4fe29 dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK 7926c1e4be863 dmaengine: tegra: Fix burst size calculation 933654508b2bc sunrpc: fix uninitialized xprt_create_args structure 934d1cd40e289 tpm: tpm2-sessions: wait for async KPP completion in tpm_buf_append_salt ba33b4f9d3423 tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat() 781f28bd982cf tpm: restore timeout for key creation commands 36ca587f55a2c irqchip/crossbar: Use correct index in crossbar_domain_free() 0d078152fcab7 taskstats: retain dead thread stats in TGID queries 9ac007affa77c mtd: maps: vmu-flash: fix NULL pointer dereference in initialization 3fac46068fe4c openrisc: Fix jump_label smp syncing ff7bcc9d71bf4 mtd: rawnand: Pause continuous reads at block boundaries 0fd20c1905abc mtd: spi-nor: spansion: use die erase for multi-die devices only c0806df5cf806 mtd: spi-nor: swp: Improve locking user experience 433e5e70cdc1e s390/pkey: Check length in pkey_pckmo handler implementation 693bf91d4db13 s390/pkey: Check length in PKEY_VERIFYPROTK ioctl c9ef79e34bc1e fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header() e5824d5b841d9 net: thunderbolt: Fix frags[] overflow by bounding frame_count fc74244e0cc25 bus: mhi: ep: Protect mhi_ep_handle_syserr() in the error path 3ebe0ee6527e8 bus: mhi: host: pci_generic: Fix the physical function check 012683accbb7d fpga: dfl: add bounds check in dfh_get_param_size() 2174c68f623b7 ocfs2: reject non-inline dinodes with i_size and zero i_clusters 5e512d370a01b ocfs2: reject dinodes whose i_rdev disagrees with the file type 4db3b6a2a8ecf ocfs2: reject dinodes with non-canonical i_mode type 499714de42ab4 ocfs2: add journal NULL check in ocfs2_checkpoint_inode() 671889c553ea5 ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2_sum_rightmost_rec bd73971fad89d ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits d5d5a21fb33cd ocfs2: avoid moving extents to occupied clusters 4bbfcf9c7e46c mtd: rawnand: fix condition in 'nand_select_target()' a8874c34c4a97 net/9p: fix infinite loop in p9_client_rpc on fatal signal ace3a0c839f3b mtd: rawnand: pl353: fix probe resource allocation b6337e3687d3d ocfs2: use kzalloc for quota recovery bitmap allocation bf53557a96d4c openrisc: Add full instruction cache invalidate functions 8d263bae573dc scsi: sas: Skip opt_sectors when DMA reports no real optimization hint 83405848e4030 scsi: smartpqi: Use shost_to_hba() in pqi_scan_finished() a7bbf83dfebdc power: supply: bq257xx: Fix VSYSMIN clamping logic 8d610017c992d 9p: skip nlink update in cacheless mode to fix WARN_ON d8dcbbfa0d695 mtd: slram: remove failed entries from the device list 4e4beef747c68 kcov: use WRITE_ONCE() for selftest mode stores da5234df09416 mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE 749e2051da3b0 powerpc/dt_cpu_ftrs: Set CPU_FTR_P11_PVR for Power11 and later processors 07ed8b1785480 fs/proc: fix KPF_KSM reported for all anonymous pages b6a6fb6803d52 proc: only bump parent nlink when registering directories 4d67bdef35c32 fs/proc/task_mmu: use huge_page_size() in pagemap_scan_hugetlb_entry() 43b987ed35be9 fs/proc/task_mmu: fix hugetlb self-deadlock in pagemap_scan_pte_hole() 40a04601a3f66 mm/damon/sysfs-schemes: put stats for scheme_add_dirs() internal error f18c561eb9c51 mm/damon/sysfs-schemes: fix dir put orders in access_pattern_add_dirs() f322955d9a1c3 riscv: cacheinfo: Fix node reference leak in populate_cache_leaves 1caee6e084a96 mips: sched: Fix CPUMASK_OFFSTACK memory corruption bd2e9be9ebb64 selftests/landlock: Test SCOPE_SIGNAL on the SIGIO/fowner pgid path 193e6471e985c power: supply: charger-manager: fix refcount leak in is_full_charged() 1f18aac263722 landlock: Fix LANDLOCK_SCOPE_SIGNAL bypass on the SIGIO path ff05a98150ebb ntfs3: fix out-of-bounds read in decompress_lznt f3624cc069195 ntfs3: validate split-point offset in indx_insert_into_buffer aaa1f956c0fc4 ntfs3: bound to_move in indx_insert_into_root before hdr_insert_head 0fad25687d4d3 ntfs3: cap RESTART_TABLE free-chain walker at rt->used be306b8d9143a fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation} 908c9243ba309 fs/ntfs3: add depth limit to indx_find_buffer to prevent stack overflow 7adb38279812c fs/ntfs3: validate lcns_follow in log_replay conversion 50b5e83384e7f fs/ntfs3: bound attr_off in UpdateResidentValue against data_off d240cd98f5f7b fs/ntfs3: bound copy_lcns dp->page_lcns[] index in analysis pass 09fddd52c1b0c fs/ntfs3: bound DeleteIndexEntryAllocation memmove length ccd6b70798737 fs/ntfs3: fix syncing wrong inode on DIRSYNC cross-directory rename 640627f07c79b mm/damon/core: make charge_addr_from aware of end-address exclusivity 722e6c54bde63 mm/memory_hotplug: fix incorrect altmap passing in error path 1697d253f51cf mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch 9227b387eee50 power: supply: max17042: fix OF node reference imbalance a3d81de441233 power: supply: cpcap-battery: Fix missing nvmem_device_put() causing reference leak a39d281f207b9 mm/mm_init: fix pageblock migratetype for ZONE_DEVICE compound pages d3fd2d358df0c MIPS: DEC: Ensure 32-bit stack location for o32 prom_printf() 11a3bc25f2c30 MIPS: ip22-gio: fix device reference leak in probe 2c551f14f55e4 MIPS: ip22-gio: fix kfree() of static object 620a37ea7d626 MIPS: ip22-gio: fix gio device memory leak 51aad3d89a2dd remoteproc: qcom: Fix leak when custom dump_segments addition fails 69e18135e2a00 SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing 46d59ff421824 lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure 1161c4b5bd004 lockd: Plug nlm_file leak when nlm_do_fopen() fails 66014ab165cb0 sunrpc: harden rq_procinfo lifecycle to prevent double-free 65b23bec1fca6 sunrpc: wait for in-flight TLS handshake callback when cancel loses race 3f9ee75a97a76 sunrpc: pin svc_xprt across the asynchronous TLS handshake callback 30d490bb2c4cd nvdimm/btt: Free arena sub-allocations on discover_arenas() error path f4ca396bdd60b nvdimm/btt: Free arenas on btt_init() error paths 78955fdce8ff6 jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit() 7199c78c3a3e3 Bluetooth: SCO: hold sk properly in sco_conn_ready 77eb0cf57009e Bluetooth: SCO: fix sleeping under spinlock in sco_conn_ready 96dd35f1942cd HID: playstation: validate num_touch_reports in DualShock 4 reports 88ba845468508 mfd: tps6586x: Fix OF node refcount d8e2f3e1bc207 cifs: invalidate cfid on unlink/rename/rmdir 3256c05d5a9db batman-adv: tt: prevent TVLV OOB check overflow d2b657c9653fc batman-adv: mcast: avoid OOB read of num_dests header a90f4fff90253 batman-adv: frag: fix primary_if leak on failed linearization c945f6007e785 batman-adv: clean untagged VLAN on netdev registration failure 8f54162e07d3e batman-adv: frag: free unfragmentable packet 2c989ab8e2054 batman-adv: fix VLAN priority offset 6a65ac8a81e90 batman-adv: tt: avoid request storms during pending request ee878decf9e57 batman-adv: dat: fix tie-break for candidate selection 9e16b6751a820 batman-adv: ensure minimal ethernet header on TX 8f76277d02176 batman-adv: dat: ensure accessible eth_hdr proto field e5e18886aadd3 batman-adv: bla: reacquire gw address after skb realloc 3b4c70c40f2e1 batman-adv: dat: acquire ARP hw source only after skb realloc b8afcf799b2cc batman-adv: access unicast_ttvn skb->data only after skb realloc 85a71a81854e0 batman-adv: retrieve ethhdr after potential skb realloc on RX e6b43acd34b21 batman-adv: gw: acquire ethernet header only after skb realloc fa1ebae4206e6 s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init() 8514585aa9553 cpufreq: intel_pstate: Set non-turbo capacity to HWP_GUARANTEED_PERF() 221ee479a49fb cpufreq: schedutil: Fix uncleared need_freq_update on the .adjust_perf() path 5ab0eba9c8819 perf/x86/amd/lbr: Fix kernel address leakage 046f6244da9b6 perf/x86/amd/brs: Fix kernel address leakage 394e2bdf7594e x86/boot: Reject too long acpi_rsdp= values f7c67c97b37c1 x86/boot: Validate console=uart8250 baud rate to fix early boot hang 1a1d6e3ef6cf5 x86/video: Only fall back to vga_default_device() without screen info 19ffeb30fdfce tools/power/x86/intel-speed-select: Harden daemon pidfile open 16a42c88c4667 mfd: sm501: Fix reference leak on failed device registration 6dd51d84a9502 leds: uleds: Fix potential buffer overread 3a134c3fb5f0d selinux: fix incorrect execmem checks on overlayfs d61a80b17254b selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() fc633a598206d selinux: check connect-related permissions on TCP Fast Open e9cdf741ffcb4 soc: fsl: qe: panic on ioremap() failure in qe_reset() c6854d9f4e1bd soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy c4d6442ac3ed0 gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path 1c4f67c89fd27 netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() 679ced28a9dc2 netfilter: xt_nat: reject unsupported target families b2dbbedfa935c netfilter: ecache: fix inverted time_after() check 3cd9a5792cbea netfilter: nf_conncount: fix zone comparison in tuple dedup a58230f3a7c4f netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag 2bcf2c5052fb5 netfilter: nf_nat_sip: reload possible stale data pointer 02b6b0e892aea netfilter: nft_set_pipapo: don't leak bad clone into future transaction 0ca505346c5e2 netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst 07f9ddbf5e799 netfilter: xt_cluster: reject template conntracks in hash match a1b672a3b5372 netfilter: nfnl_cthelper: apply per-class values when updating policies aff589556ed77 netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read ca028334343a1 ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback e42d8322b67f2 ASoC: mediatek: mt8183: Release reserved memory on cleanup 4b068759d3087 ASoC: mediatek: mt8183: Check runtime resume during probe 51c367230e30e ASoC: mediatek: mt8192: Release reserved memory on cleanup e0f276f1918a2 ASoC: mediatek: mt8192: Check runtime resume during probe d3abaedf6a584 ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control 121577383b5cf ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get 4ebe2c3a7db63 fbdev: tridentfb: fix potential memory leak in trident_pci_probe() 009a8514745b1 fbdev: nvidia: fix potential memory leak in nvidiafb_probe() 58bc18e03481b fbdev: vesafb: fix memory leak in vesafb_probe() d81860691e4cf fbdev: carminefb: fix potential memory leak in alloc_carmine_fb() e1ca9b8559e0f fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe() 12fe6a56506ed fbdev: uvesafb: fix potential memory leak in uvesafb_probe() ad54698255a4b fbdev: s3fb: fix potential memory leak in s3_pci_probe() 146b708bc75f1 fbdev: i740fb: fix potential memory leak in i740fb_probe() c2c795a320e7e fbdev: radeon: fix potential memory leak in radeonfb_pci_register() febb5b4f67ace fbdev: efifb: fix memory leak in efifb_probe() 9423e1f105270 fbdev: sm712: Fix operator precedence in big_swap macro d684ce2db92b1 fbdev: hecubafb: fix potential memory leak in hecubafb_probe() e8c9aae8c9508 fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe() 6854cf33dddb2 fbdev: metronomefb: fix potential memory leak in metronomefb_probe() d5436e18e4fc2 KVM: arm64: nv: Inject SEA if guest VNCR isn't normal memory 4ead4def04659 KVM: arm64: nv: Inject SEA if kvm_translate_vncr() can't resolve PFN 5c50db5bcbb90 KVM: arm64: nv: Respect read-only PFN when mapping L1 VNCR 884b44256041e KVM: arm64: nv: Fix SPSR_EL2 restore in kvm_hyp_handle_mops() 09f35145f3a4a KVM: arm64: nv: Write ESR_EL2 for injected nested SError exceptions 5000bcae71c86 KVM: arm64: nv: Drop bogus WARN for write to ZCR_EL2 7099e7148f81c KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers 7996013b85687 KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state d1379888cc423 KVM: x86: Nullify irqfd->producer if updating IRTE for bypass fails 97542f15dc4cf KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs ba06690b28be9 KVM: SEV: Do not allow intra-host migration/mirroring of SNP VMs df72596278b0e KVM: s390: pci: Fix handling of AIF enable without AISB d19dca8194ebe KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling 79fdd2aa774e4 KVM: arm64: vgic: Check the interrupt is still ours before migrating it 5fb75c5272950 KVM: s390: pci: Fix GISC refcount leak on AIF enable failure 9f8eaef40e955 powerpc/pseries/Kconfig: Enable CONFIG_VPA_PMU to be used with KVM 33d79ad6ecedf LoongArch: KVM: Return full old CSR value from kvm_emu_xchg_csr() f3efcef6648ba LoongArch: KVM: Fix FPU register width with user access API 45f2e6505fcf6 LoongArch: KVM: Check the return values for put_user() efe27b19a15c3 LoongArch: KVM: Check irq validity in kvm_vcpu_ioctl_interrupt() 199b570d7fca1 LoongArch: KVM: Validate irqchip index in irqfd routing 1ee200a1764f8 ARM: dts: stm32: stm32mp15x-mecio1-io: Move expander gpio-line-names to board files f550bf32b9a06 ARM: dts: stm32: stm32mp15x-mecio1-io: Fix expander gpio line typo 7da4d1a6b7400 ARM: dts: stm32: stm32mp15x-mecio1-io: Move gpio-line-names to board files 804821b69b2d1 ARM: dts: stm32: stm32mp15x-mecio1-io: Fix GPIO names typo c632a27f35cff arm64: dts: imx8ulp-evk: Correct Type-C int GPIO flags bd938c985ab34 ARM: dts: stm32: stm32mp15x-mecio1-io: Enable internal ADC reference ead9f10428c73 arm64: dts: ti: k3-am62a7-sk: Add bootph-all tag to vqmmc a98bda2305f3f ARM: dts: stm32: stm32mp15x-mecio1-io: Move divergent mecio1 ADC channels to board files 4fd52ac541ce1 ARM: dts: stm32: stm32mp15x-mecio1-io: Fix ADC sampling times 68f9773754f05 arm64: dts: rockchip: fix Ethernet PHY not found on PX30 Ringneck e2e3fb995175c arm64: dts: qcom: sdm630: describe adsp_mem region properly 508e55e81870d ARM: dts: imx6ul-var-som: fix warning for non-existent dc-supply property e8dc96a42571e arm64: dts: s32g3: Fix SWT8 watchdog address 89edae4161412 arm64: fpsimd: Fix type mismatch in sve_{save,load}_state() 5526d1997aea6 net: ife: require ETH_HLEN to be pullable in ife_decode() 908391d801b24 octeontx2-vf: clear stale mailbox IRQ state before request_irq() eebf439aa7a13 octeontx2-pf: clear stale mailbox IRQ state before request_irq() e62adb157c2ea net: atm: reject out-of-range traffic classes in QoS validation 22100a8f73d4a net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() 61a55fa24a5d7 tipc: restrict socket queue dumps in enqueue tracepoints d34deef34c99b ASoC: SOF: topology: validate vendor array size before parsing 0c4fbdaca225b ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get 711d912b18763 ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc fb4293173db2d ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put d8715b5a8fdb2 vduse: Fix race in vduse_dev_msg_sync and vduse_dev_read_iter 3a2b47d1b4b3d mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace() 2d8b3c3e12997 mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() b65e46eed9e52 idpf: add padding to PTP virtchnl structures 1627e7d5c9b09 smb: client: fix overflow in passthrough ioctl bounds check 327595e7c34e3 drm/xe: remove duplicate include 3de77d2f34c2b octeontx2-af: fix VF bringup affecting PF promiscuous state ee3f7566bcf33 net/mlx5: Fix L3 tunnel entropy refcount leak 1550b07bca2bb selftests/net: fix EVP_MD_CTX leak in tcp_mmap 346e2d666a29a regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK 14e03ecd3b1b5 dm era: fix NULL pointer dereference in metadata_open() 5b0427ba582d1 SUNRPC: pin upper rpc_clnt across the TLS connect_worker 13965a7b190f3 SUNRPC: release lower rpc_clnt if killed waiting for XPRT_LOCKED b784cd1c24d89 cifs: validate DFS referral string offsets df0e3e70f6995 s390/zcrypt: Remove the empty file 8f48cfe657409 ipvs: ensure inner headers in ICMP errors are in headroom 7510451a58c27 ipvs: fix PMTU for GUE/GRE tunnel ICMP errors d73f4249776dd ipvs: use parsed transport offset in TCP state lookup d340e351a0a74 ipvs: pass parsed transport offset to state handlers 238c612357b5a netfilter: nft_lookup: fix catchall element handling with inverted lookups f60ec3058a854 ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer() 27506827a01f6 ipv4: igmp: annotate data-races around timer-related fields d269eb67d2e58 ipv4: igmp: annotate data-races around im->users 9ce741c22df4f ipv6: mcast: Fix potential UAF in MLD delayed work 75e984fe0cb9e ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() 3bfcce441c552 gpio: mvebu: free generic chips on unbind 7cc438c99bba3 perf/x86/amd/core: Avoid enabling BRS from the SVM reload path 9579d625171a1 octeontx2-pf: check DMAC extraction support before filtering 7aa0e64fea778 net/sched: cake: reject overhead values that underflow length 72119397cdff6 net: mdio: select REGMAP_MMIO instead of depending on it 762116dfa7286 drm/v3d: Reject invalid indirect BO handle in indirect CSD setup 267809e2c56fb accel/amdxdna: Fix potential amdxdna_umap lifetime race 1cd434ac1c222 tracing: Make tracepoint_printk static as not exported 5e15cf51982f8 gpio: dwapb: Defer clock gating until noirq 6c736c5ccf4a3 gpio: dwapb: reduce allocation to single kzalloc d7b5497e0e45b gpio: dwapb: Use modern PM macros a3010b732d620 net: usb: lan78xx: disable VLAN filter in promiscuous mode e8a4c9fc437b1 net/tls: Consume empty data records in tls_sw_read_sock() b3eeb586f94c7 accel/amdxdna: Use unsigned long for nr_pages in amdxdna_hmm_register() ec5e96aee75d2 ring-buffer: Fix event length with forced 8-byte alignment 0c602cb8f148a Bluetooth: L2CAP: fix tx ident leak for commands without a response bfc9e7be289df Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup() b69b1ab121fe8 Bluetooth: ISO: exclude RFU bits from ISO_SDU_Length da4d8eea0c5f3 Bluetooth: sco: Fix a race condition in sco_sock_timeout() dfc8373893b18 Bluetooth: MGMT: Fix adv monitor add failure cleanup 23a83bac3356e Bluetooth: 6lowpan: hold L2CAP conn across debugfs control 026c236f0eefe amt: fix size calculation in amt_get_size() 3bfb96d9bc6a7 net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket 6f9b23eb92a89 net/sched: act_pedit: fix TOCTOU heap OOB write in tc offload 1b12612c367e4 net: qualcomm: rmnet: validate MAP frame length before ingress parsing b066420e57f34 qede: fix off-by-one in BD ring consumption on build_skb failure 1e71a40d10154 net: microchip: vcap: fix races on the shared Super VCAP block 5c7e3755abf66 net/mlx5e: Fix publication race for priv->channel_stats[] 60fddda7207d8 net/mlx5e: Fix HV VHCA stats agent registration race 420aabb32da43 net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation 6a802de97a8bf net/mlx5: LAG, MPESW, Fix missing complete() on devcom error 4eef84b09a383 netfilter: xt_connmark: reject invalid shift parameters b29b67c729de0 netfilter: nft_set_rbtree: get command skips end element with open interval 3d441be2b1c5e netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop e702f6dd5d21e netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt() a597a722fb71a netfilter: xt_u32: reject invalid shift counts 4a4a1d41c6e90 gue: validate REMCSUM private option length b153cfe84b134 net: usb: net1080: validate packet_len before pad-byte access in rx_fixup 66f57dc92aeb6 arm64/sysreg: Fix BWE field encoding in ID_AA64DFR2_EL1 a6185c21d5510 selftests/hid: Cover hid_bpf_get_data() size overflow 91ac1d7fd51e3 selftests/hid: Load only requested struct_ops maps 61a959b82f1ae HID: bpf: Fix hid_bpf_get_data() range check 4c65c3d9f660b arm64/mm: Optimize TLB flush in unmap_hotplug_[pmd|pud]_range() dd395744e4ed8 HID: core: Fix OOB read in hid_get_report for numbered reports d354e523c6f74 HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait() 793b55c3f36f5 ata: libata-scsi: limit simulated SCSI command copy to response length 232a2f2fce9b9 ata: sata_gemini: unwind clocks on IDE pinctrl errors 86652704a7fd4 cifs: Fix missing credit release on failure in cifs_issue_read() c9170c83b0e0f uprobes/x86: Use proper mm_struct in __in_uprobe_trampoline 2265b2b1c5aaa x86/uprobes: Keep shadow stack in sync for emulated CALLs adc7dda728ca3 drm/xe/pf: Don't attempt to process FAST_REQ or EVENT relays a0a56b4480a0d drm/xe/hw_engine: Fix double-free of managed BO in error path f9a9abd7bbdab drm/xe/userptr: Hold notifier_lock for write on inject test path 78b1074966d29 drm/xe/pt: Fix NULL pointer dereference in xe_pt_zap_ptes_entry() a9b89752c2726 netfs: Fix folio state after ENOMEM whilst under writeback iteration 1bb33d959aabc netfs: Fix writeback error handling 7838131e296df netfs: Fix writethrough to use collection offload 8ab75e445c161 netfs: Fix netfs_create_write_req() to handle async cache object creation 1f38f65bf965f iomap: guard io_size EOF trim against concurrent truncate underflow 08b2145470667 ovl: fix comment about locking order abe3536a4bedc minix: avoid overflow in bitmap block count calculation ce6aced2e8554 afs: Fix unchecked-length string display in debug statement 158c5a0b1dfc0 afs: Fix the volume AFS_VOLUME_RM_TREE is set on 657449e5581a4 afs: Fix premature cell exposure through /afs 2ffb70a8a0198 afs: Fix lack of locking around modifications of net->cells_dyn_ino 8afb1a787a280 afs: Fix vllist leak 5492799ec5d27 afs: Fix missing NULL pointer check in afs_break_some_callbacks() 0acbc09d2aca0 afs: Fix callback service message parsers to pass through -EAGAIN 63d3f283858fa afs: Fix reinitialisation of the inode, in particular ->lock_work 5ea289ca751c4 afs: Fix misplaced inc of net->cells_outstanding b5bc1e5d5ce57 afs: Fix bulk lookup malfunction due to change in dir_emit() API 083a0ddc9cd49 afs: Remove erroneous seq |= 1 in volume lookup loop 6eb0d929202a3 afs: use kvfree() to free memory allocated by kvcalloc() aa24cec5b3470 afs: Fix double netfs initialisation in afs_root_iget() 8530206911fd6 afs: Fix error code in afs_extract_vl_addrs() a2038514e6937 fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid 374fd8122421f net/sched: hhf: clear heavy-hitter state on reset fba8e250ce5f3 net/sched: dualpi2: clear stale classification on filter miss a203f2c3892b1 pinctrl: meson: restore non-sleeping GPIO access 47120164c63d3 gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe 5a5ac2852cd32 ksmbd: fix use-after-free of fp->owner.name in durable handle owner check d020e7f27bf65 ksmbd: reject undersized DACLs before parsing ACEs 6b1304ce6cff0 net/sched: act_bpf: use rcu_dereference_bh() to read the filter a03387e1f6251 selftests: drv-net: tso: don't touch dangerous feature bits df9ffdceac053 cxgb4: Fix decode strings dump for T6 adapters 124440df267dc virtio_net: disable cb when NAPI is busy-polled a8323fb2ab6cd sctp: fix addr_wq_timer race in sctp_free_addr_wq() 4e8d498d32b6c irqchip/ts4800: Fix missing chained handler cleanup on remove c5d75800539bc irqchip/gic-v3-its: Fix OF node reference leak f0069a262bd41 tracing/probes: Make the $ prefix mandatory for comm access 62988204162fc tracing/fprobe: Fix NULL pointer dereference in fprobe_fgraph_entry() 898cb5a7c4154 tracing: eprobe: read the complete FILTER_PTR_STRING pointer e0881f5cc4d71 tracing/events: Fix to check the simple_tsk_fn creation f148f86c65b8f tracing/probes: Remove WARN_ON_ONCE from parse_btf_arg 3b51d6f07a199 tracing/eprobes: Allow use of BTF names to dereference pointers acbf1ecc22f3c drm/panthor: Interrupt group start/resumption if group_bind_locked() fails a9d098b346db5 drm/panthor: Fix a leak when a group is evicted before the tiler OOM is serviced 1497a438ea34a drm/panthor: Don't overrule pending immediate ticks in sched_resume_tick() dd0b2976b7c0f drm/panthor: Fix potential invalid pointer deref in group_process_tiler_oom() b4b3458ef88df bridge: stp: Fix a potential use-after-free when deleting a bridge 9b7d05cbaa601 net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF ef940e042f329 net: gianfar: dispose irq mappings on probe failure and device removal 58ba00999898b net: libwx: fix VMDQ mask for 1-queue mode 86d379fcf1b79 net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy 0a7d9c7c5f1f2 usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup() d8a01d27873e0 ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump 83df3e2594cd7 eth: fbnic: don't cache shinfo across skb realloc 898ca04b096b9 hwmon: (aspeed-g6-pwm-tach) Guard fan RPM calculation against divide-by-zero 489291b6b5697 hwmon: (pmbus) Fix passing events to regulator core 36554592e2f5c hwmon: adm1275: Prevent reading uninitialized stack 1797eb92f0b39 ASoC: codecs: lpass-va-macro: Fix LPASS Codec Version for SC7280 f14c3926fee38 ASoC: codecs: lpass-va-macro: add SM6115 compatible 3d3638fe92137 MIPS: mm: Add check for highmem before removing memory block 4e9f4ca9dc73c MIPS: DEC: Ensure RTC platform device deregistration upon failure bca3100f55028 sctp: add INIT verification after cookie unpacking ad6215d76b644 sctp: fix SCTP_RESET_STREAMS stream list length limit 1681cc7974a61 net: enetc: check the number of BDs needed for xdp_frame b17751a2ebc4a qede: fix out-of-bounds check for cqe->len_list[] 8dba7a94a269b seg6: validate SRH length before reading fixed fields 8d501b1411548 net: pse-pd: scope pse_control regulator handle to kref lifetime e94d53a9ac22c gpio: htc-egpio: use managed gpiochip registration f4af803269ccd gpio: mvebu: fail probe if gpiochip registration fails 46dee20d30b70 riscv: Fix 32-bit call_on_irq_stack() frame pointer ABI 8e0b7f94fb394 ACPI: RIMT: Only defer the IOMMU configuration in init stage 776f70bafd45c spi: sh-msiof: abort transfers when reset times out d6cd34d17b951 tracing: probes: fix typo in a log message f28d7b5f1578a ALSA: FCP: Fix NULL pointer dereference in interface lookup d990a01b853e5 net: hns3: differentiate autoneg default values between copper and fiber 2d149a20275ac net: hns3: fix permanent link down deadlock after reset 92d05883ef337 net: hns3: refactor MAC autoneg and speed configuration 43a6c6fb6ec50 net: hns3: unify copper port ksettings configuration path de051b146022c selftests: tls: size splice_short pipe by page size 6727f580cf462 dt-bindings: net: renesas,ether: Drop example "ethernet-phy-ieee802.3-c22" fallback 9075efb9b2c1d net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync c1e7286d05318 ASoC: fsl_asrc_dma: fix eDMA maxburst misalignment with channel count 7a7c7263bbbc4 LoongArch: BPF: Fix off-by-one error in tail call ed295077a2214 LoongArch: BPF: Fix outdated tail call comments 0a8a729481c8e LoongArch: Move struct kimage forward declaration before use 2f3c0895fb20a net: ethernet: sunplus: spl2sw: fix phy_node refcount leak in remove b15a3cc68e245 net: sungem: fix probe error cleanup b84dd48f9da1e net: mvneta: re-enable percpu interrupt on resume e0ac054416bf4 octeontx2-af: Validate NIX maximum LFs correctly 9dc3cf8a35906 net: phy: realtek: Clear MDIO_AN_10GBT_CTRL_ADV10G bit 0c11a1da41a64 net: dsa: realtek: fix memory leak in rtl8366rb_setup_led() a69ccea6d7eb6 rtc: cmos: unregister HPET IRQ handler on probe failure 5fd1f0512748d rtc: ds1307: Fix off-by-one issue with wday for rx8130 d0bfd7004a87f smb/client: preserve errors from smb2_set_sparse() 5b6165d7ec384 ACPI: processor_idle: Mark LPI enter functions as __cpuidle ea43e7a231aa2 thermal: testing: zone: Flush work items during cleanup 4e62be1490d23 eth: fbnic: fix ordering of heartbeat vs ownership 123b559aa6bb6 ipv6: fix missing notification for ignore_routes_with_linkdown 419017dd2dda2 ipv6: fix state corruption during proxy_ndp sysctl restart ae58dbf1d78d7 ipv6: fix error handling in disable_policy sysctl 2bf70e0306f8d ipv6: fix error handling in forwarding sysctl b060606bc7e46 ipv6: fix error handling in ignore_routes_with_linkdown sysctl 56c26538f0e58 ipv6: fix error handling in disable_ipv6 sysctl 2140c2f3f2e7b net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle ff127c0aa5279 net: usb: lan78xx: restore VLAN and hash filters after link up a9e6707322ef2 veth: fix NAPI leak in XDP enable error path 4106295280670 net: dsa: sja1105: round up PTP perout pin duration 7557df1b60f20 net: do not acquire dev->tx_global_lock in netdev_watchdog_up() 03b743586a246 net, bpf: check master for NULL in xdp_master_redirect() a0904f7d27035 alpha/PCI: Fix __pci_mmap_fits() overflow for zero-length BARs 94defb18ac792 alpha/PCI: Add security_locked_down() check to pci_mmap_resource() 04117aea9bc11 NTB: epf: Fix doorbell bitmask and IRQ vector handling 56ec2a08d27b5 NTB: epf: Report 0-based doorbell vector via ntb_db_event() d2a41c85beb56 NTB: epf: Make db_valid_mask cover only real doorbell bits 60a6689b9a5df gpio: davinci: fix IRQ domain leak on devm_kzalloc failure 33e1875d6b5b5 netfilter: nft_compat: ebtables emulation must reject non-bridge targets d3e9a7e2ce9dc netfilter: nft_synproxy: stop bypassing the priv->info snapshot 329f2626ee5cb netfilter: nf_conncount: prevent connlimit drops for early confirmed ct a73e7ac3f3b69 netfilter: nf_nat: avoid invalid nat_net pointer use on failed nf_nat_init() 49fa1be621dde bpf: Disable xfrm_decode_session hook attachment 4d919c9b77099 md/raid5: avoid R5_Overlap races while breaking stripe batches 3db13f82ba314 md/raid5: use stripe state snapshot in break_stripe_batch_list() 828fad4fd418b ipv4: fib: Don't ignore error route in local/main tables. 630ce3806b706 eth: bnxt: improve the timing of stats c0057e5f762b9 eth: bnxt: rename ring_err_stats -> ring_drv_stats 33168db149d01 eth: bnxt: gather and report HW-GRO stats b0d0eb13a0441 ipv6: Fix null-ptr-deref in fib6_nh_mtu_change(). 77bb0bbfcc4e7 ksmbd: fix use-after-free of conn->preauth_info in concurrent SMB2 NEGOTIATE 1f6a4aec0d366 rtc: msc313: fix NULL deref in shared IRQ handler at probe 68115a7a336fc i40e: Fix i40e_debug() to use struct i40e_hw argument de80d04b13dec ice: dpll: fix memory leak in ice_dpll_init_info error paths eaffdd113f560 ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info 854065a75e375 rtc: isl1208: Balance enable_irq_wake() with disable_irq_wake() on cleanup 4cc632fe63df8 ice: call netif_keep_dst() once when entering switchdev mode 04c082b7dc5bf ice: fix AQ error code comparison in ice_set_pauseparam() dd6d8e4412f80 ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() 9415a94cf6227 PCI: endpoint: pci-epf-ntb: Add check to detect 'db_count' value of 0 e1e7c72a2301d PCI: endpoint: pci-epf-vntb: Add check to detect 'db_count' value of 0 9cc0f8e63e8c3 drm/edid: fix OOB read in drm_parse_tiled_block() 5e4c4ab99abc9 gpiolib: initialize return value in gpiochip_set_multiple() 7550becf33014 power: sequencing: fix ABBA deadlock in pwrseq_device_unregister() 9697db03e0103 bpf: Fix effective prog array index with BPF_F_PREORDER 3bdfa0e435f31 bpf: zero-initialize the fib lookup flow struct b05337635be3c bpftool: Fix vmlinux BTF leak in cgroup commands 68b41e68a6229 bpf: Fix stack slot index in nospec checks aa33b44f70bfe rtc: ds1307: handle oscillator stop flag for ds1337/ds1339/ds3231 56e5f8a409f8c rtc: abx80x: fix the RTC_VL_CLR clearing all status flags 93f95538b611a dpaa2-switch: do not accept VLAN uppers while bridged ea24f911ead85 ipv6: ioam: fix type confusion of dst_entry a6450f7cfae57 ipv6: ndisc: fix NULL deref in accept_untracked_na() 2066e692ec7a1 net: airoha: Fix skb->priority underflow in airoha_dev_select_queue() 1d51aff78f078 net/sched: act_ct: fix nf_connlabels leak on two error paths a103cdb0681e7 net: emac: Fix NULL pointer dereference in emac_probe 2855ec137a224 octeontx2-pf: mcs: Fix mcs resources free on PF shutdown da603b606ceb3 octeontx2-pf: Clear stats of all resources when freeing resources 5636f0f3bd99b octeontx2-af: mcs: Fix unsupported secy stats read ceef83f0eaf9c net: ethernet: mtk_ppe: Fix rhashtable leak in mtk_ppe_init error paths a0c5fdeb5fa25 tipc: fix use-after-free of the discoverer in tipc_disc_rcv() 5dda4f164a633 net: marvell: prestera: initialize err in prestera_port_sfp_bind 9200c8149910d selftests/mm: fix exclusive_cow test fork() handling 55fc2f99d0979 selftests/mm: allow PUD-level entries in compound testcase of hmm tests c8add1d06512b selftests/mm: clarify alternate unmapping in compaction_test 0caa28e978941 selftests/mm: skip uffd-stress test when nr_pages_per_cpu is zero 471b62966c782 selftests/mm: ensure destination is hugetlb-backed in hugetlb-mremap 9dbfd514148dd selftest/mm: register existing mapping with userfaultfd in hugetlb-mremap a8673dbd3d4a0 selftests/mm: free dynamically allocated PMD-sized buffers in split_huge_page_test 31b28910abe34 selftests/mm: size tmpfs according to PMD page size in split_huge_page_test fff7d3ea3a4c4 selftests/mm: fix cgroup task placement and drop memory.current checks in hugetlb_reparenting_test.sh 8c65c58868ecc selftests/mm: fix hugetlb pathname construction in hugetlb_reparenting_test.sh 58cd8ff69e33c selftests/mm: restore default nr_hugepages value via exit trap in hugetlb_reparenting_test.sh b805de2abfa34 selftests/mm: restore default nr_hugepages value via exit trap in charge_reserved_hugetlb.sh 37e3e8a2c3bfd alloc_tag: fix use-after-free in /proc/allocinfo after module unload 502b3ae43f798 irqchip/crossbar: Fix parent domain resource leak 002ebbcc8414c mailbox: imx: Forward the timeout/ error in imx_mu_generic_tx() 7e23965d44f06 netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak d32e4301a0e5e netfilter: nf_reject: skip iphdr options when looking for icmp header 8e935c51b65d9 netfilter: nft_flow_offload: zero device address for non-ether case 4c61d28634fbf netfilter: flowtable: move path discovery infrastructure to its own file 13c6ba6e0f216 netfilter: nft_meta_bridge: add validate callback for get operations 5baa149abb41a netfilter: nft_payload: reject offsets exceeding 65535 bytes 12088da6add5b netfilter: ipset: make sure gc is properly stopped 8087bb360a936 netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer() c4d257734e91b netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types a0afd353c2f7e netfilter: ipset: annotate "pos" for concurrent readers/writers 7228cc8ff6265 netfilter: ipset: Fix data race between add and dump in all hash types 6d92dbd73d19a md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry 2c5384c40a4ce md/raid1: honor REQ_NOWAIT when waiting for behind writes 119903c320830 md: merge mddev serialize_policy into mddev_flags 2e414af05a7cf md: merge mddev faillast_dev into mddev_flags 9408c233a5bbe md: merge mddev has_superblock into mddev_flags 5464ee6442376 mac802154: Prevent overwrite return code in mac802154_perform_association() de3bd9809af75 ieee802154: fix kernel-infoleak in dgram_recvmsg() d22e278cd0679 ieee802154: Remove WARN_ON() in cfg802154_pernet_exit() f4860dd988b10 ieee802154: Avoid calling WARN_ON() on -ENOMEM in cfg802154_switch_netns() 5d17ebdf6c236 ieee802154: Restore initial state on failed device_rename() in cfg802154_switch_netns() 3b40ebc19ad02 ACPI: IPMI: Fix inverted interface check in ipmi_bmc_gone() 45465b0e01354 ACPI: resource: Amend kernel-doc style 7ae67f0e1c16b thermal: intel: Fix dangling resources on thermal_throttle_online() failure 679fd0bf4f8ab arm64/hw_breakpoint: reject unaligned watchpoints that would truncate BAS 4c16176fc11a6 ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints a762b9865f494 selftests: vlan_bridge_binding: Fix flaky operational state check c6d3bcb0f934d flow_dissector: check device type before reading ETH_ADDRS 68af74ad696ce net: macb: add TX stall timeout callback to recover from lost TSTART write 112b5eff24e04 net: airoha: fix foe_check_time allocation size 5ffb2b4987cc9 devlink: Fix parent ref leak on tc-bw failure 02c884d9aaca3 devlink: Fix parent ref leak in devl_rate_node_create() 0dafdaaf8684b dpaa2-switch: fix VLAN upper check not rejecting bridge join c7fc9adf4e006 virtio-net: fix len check in receive_big() 0d95587d662a5 spi: rpc-if: Use correct device for hardware reinitialization on resume f37f2f804796e PCI: iproc: Restore .map_irq() for the platform bus driver 53c23d56b46b1 ALSA: usb-audio: qcom: clear opened when stream enable fails 25a867aa5e67a ALSA: usb-audio: qcom: reject stream disable with no active interface 207bb4ce8fe7d sctp: hold socket lock when dumping endpoints in sctp_diag a6cfb924ad74e net: psample: fix info leak in PSAMPLE_ATTR_DATA 3d45d40b872ae octeontx2-pf: Fix leak of SQ timestamp buffer on teardown 290ad0a548915 drm/amdgpu: initialize irq.lock spinlock earlier 96ac562a9ea30 drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm 211bb9d8f17c4 drm/amd/display: Fix mem_type change detection for async flips 0e27d92f69b8e drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free 7bcd4ef375fa3 ASoC: tlv320aic3x: restrict CLKDIV bypass Q values in dual-rate mode ca297485271c6 perf dso: Set standard errno on decompression failure 05b11debdffe0 perf bpf: Validate array presence before casting BPF prog info pointers c8cb4a92eda6e perf cs-etm: Bounds-check CPU in cs_etm__get_queue() b389a5b215e35 perf cs-etm: Require full global header in auxtrace_info size check c13532ff67fae perf cs-etm: Validate num_cpu before metadata allocation 87d23f25b5e97 perf machine: Use snprintf() for guestmount path construction 6d99379c58f7f xfrm: validate selector family and prefixlen during match 7248ae02a9453 xfrm: annotate data-races around xfrm_policy_count[] and xfrm_policy_default[] a1a3360a0c44b xfrm: Fix xfrm state cache insertion race 1467ca02ddac4 ALSA: usb-audio: qcom: Free sideband sg_table objects 507a7b07f3fa3 i3c: master: Add missing runtime PM get in dev_nack_retry_count_store() 34cd92141a024 i3c: master: Update dev_nack_retry_count under maintenance lock 95028569589f4 spi: dw: fix wrong BAUDR setting after resume 355e51eeffc6b drm/xe: Fix wa_oob codegen recipe for external module builds 2024940522ef4 drm/i915: clear CRTC color blob pointers after dropping refs 1348bf64c1978 gpio: mlxbf3: fail probe if gpiochip registration fails 7d3532a0b11a2 perf cs-etm: Reject CPU IDs that would overflow signed comparison a56f29ad8aacf perf: Remove redundant kernel.h include f8898d2eb71ae perf bpf: Bounds-check array offsets in bpil_offs_to_addr() cafd80d81f08b perf bpf: Reject oversized BPF metadata events that truncate header.size 1935d213aeb23 perf bpf: Validate func_info_rec_size and sub_id in synthesize_bpf_prog_name() aea30b437ebd0 perf sched: Replace (void*)1 sentinel with proper runtime allocation bc27041e8971e perf hwmon: Fix fd check to accept fd 0 in hwmon_pmu__describe_items() 661f60a8a5cf8 perf tools: Use snprintf() for root_dir path construction 5d080b7324f07 perf dso: Set error code when open() fails on uncompressed fallback path debfcd673a6d1 perf dso: Fix heap overflow in dso__get_filename() on decompressed path 95bf4dbcd5022 perf tools: Fix uninitialized pathname on uncompressed fallback in filename__decompress() fa870f951793d perf tools: Add O_CLOEXEC to open() calls in DSO and ELF code 3ae7947101b97 perf tools: Don't read build-ids from non-regular files 2c19e40753ec1 perf symbols: Break infinite loop on zero-filled notes in sysfs__read_build_id() 137eabe3c18ff perf symbols: Validate p_filesz before use in filename__read_build_id() ca3393e258f63 perf symbols: Fix bswap copy-paste error for 32-bit ELF p_filesz f231387f3d2bb sparc: led: avoid trimming a newline from empty writes 17955f1995bf9 accel/ivpu: fix HWS command queue leak on registration failure 85873b1bd3664 apparmor: fix label can not be immediately before a declaration 38d3d33bf42c2 i3c: master: Prevent reuse of dynamic address on device add failure c4f2afcdc5470 i3c: master: Defer new-device registration out of DAA caller context 3891c061341fb i3c: master: Ensure Hot-Join operations are stopped on shutdown 57490b302b984 i3c: master: Consolidate Hot-Join DAA work in the core 0bd450d40f874 i3c: master: Move rstdaa error suppression fd32e8d4a2933 i3c: master: Add i3c_master_do_daa_ext() for post-hibernation address recovery b07a318afca16 i3c: master: Introduce optional Runtime PM support 882ee831366a1 i3c: master: Replace WARN_ON() with dev_err() in i3c_dev_free_ibi_locked() de2106d99b87a i3c: add sysfs entry and attribute for Device NACK Retry count 0d66830f302fd i3c: master: Make hot-join workqueue freezable to block hot-join during suspend eb9db96a5deb3 i3c: master: add WQ_PERCPU to alloc_workqueue users 45bbc1e1fe626 i3c: mipi-i3c-hci: Preserve RUN bit when aborting DMA ring d22ab94261c7b i3c: mipi-i3c-hci: Switch PIO data allocation to devm_kzalloc() 973fda38b124c i3c: mipi-i3c-hci: Allow for Multi-Bus Instances 5625b8767ce3e i3c: mipi-i3c-hci: Quieten initialization messages 2791dd42d41e3 apparmor: fix uninitialised pointer passed to audit_log_untrustedstring() fdf610a9a9e72 apparmor: don't audit files pointing to aa_null.dentry b58d240883dfe apparmor: put secmark label after secid lookup 66a6c61369d41 apparmor: aa_getprocattr free procattr leak on format failure 22dc9433d458c apparmor: fail policy unpack on accept2 allocation failure 3b918f6f52390 apparmor: Fix return in ns_mkdir_op 566d1ef98a711 apparmor: remove or add symlinks to rawdata according to export_binary fbfdb5a94a487 apparmor: fix NULL pointer dereference in unpack_pdb 57b1bd4486d56 apparmor: fix potential UAF in aa_replace_profiles b427061ca4983 apparmor: grab ns lock and refresh when looking up changehat child profiles 9111f76e8dc8c apparmor: fix rawdata_f_data implicit flex array ae02e603c0b39 apparmor: aa_label_alloc use aa_label_free on alloc failure d821601323456 apparmor: check label build before no_new_privs test ad965f36d2986 security/apparmor/apparmorfs.c: conditionally compile get_loaddata_common_ref() 045dbe89ac317 apparmor: fix refcount leak when updating the sk_ctx d8ea44f6090c0 apparmor: fix race in unix socket mediation when peer_path is used ef488d7429d23 apparmor: fix shadowing of plabel that prevents cache from being updated f79519f636059 Revert "PCI/MSI: Unmap MSI-X region on error" 514b84b1bf30f PCI: dwc: Avoid dwc_pcie_rasdes_debugfs_deinit() NULL dereference when no RAS DES capability 11016555d7510 phy: freescale: phy-fsl-imx8qm-lvds-phy: Fix missing pm_runtime_disable() on probe error path 872f9a63a108e PCI: mediatek: Use actual physical address instead of virt_to_phys() f77c490c45d46 PCI: mediatek: Fix possible truncation in mtk_pcie_parse_port() 9ca0a78a5d561 dt-bindings: phy: sc8280xp-qmp-pcie: Disallow bifurcation register on Purwa f1f5f8d334e91 perf symbols: Add bounds checks to read_build_id() note iteration in minimal build cc6cd3fe8b8b1 perf symbols: Add bounds checks to elf_read_build_id() note iteration a3e758e741228 perf bpf: Fix metadata leak in perf_env__add_bpf_info() on duplicate insert f593775fecf5a perf bpf: Fix map data leak in bpf_metadata_create() on alloc failure bafb6bfb346fe perf bpf: Add NULL check for btf__type_by_id() in synthesize_bpf_prog_name() fe4d8ad2e96f4 tools lib api: Fix mount_overload() snprintf truncation and toupper range b0385203a09f0 tools lib api: Fix filename__write_int() writing uninitialized stack data 41b3a92310450 perf tools: Use snprintf() in dso__read_running_kernel_build_id() fbaf9bdfc0917 perf hwmon: Guard label read against empty or failed reads d34b42ee0c74d perf symbols: Bounds-check descsz in sysfs__read_build_id() GNU fallback bc2fc12ce6e4d perf hwmon: Fix parse_hwmon_filename() strlcpy buffer overflow f830bb8d221f3 perf hwmon: Use scnprintf() in hwmon_pmu__for_each_event() 76dfa13a0acb1 perf hwmon: Fix off-by-one null termination on sysfs reads 56b17c84394f1 perf tools: Fix thread__set_comm_from_proc() on empty comm file f2e5262589d94 perf intel-pt: Fix snprintf size tracking bug in insn decoder 45e7900e1555c perf symbols: Bounds-check .gnu_debuglink section data 4f883ab5bc7b7 perf symbols: Fix signed overflow in sysfs__read_build_id() size check 490473192ac2f tools lib api: Fix missing null termination in filename__read_int/ull() 09962b811ef14 perf pmu: Fix perf_pmu__parse_scale/unit() OOB access on empty sysfs file a6eec54329b43 perf pmu: Fix pmu_id() heap underwrite on empty identifier file e274dfa05904f perf cs-etm: Queue context packets for frontend fa9eb50ddfea3 perf s390: Fix TEXTREL in Python extension by compiling as PIC b5a0a4a564d21 xprtrdma: Return sendctx slot after Send preparation failure 007b4da2f38dc xprtrdma: Repost Receive buffers for malformed replies 469b22376ee73 xprtrdma: Sanitize the reply credit grant after parsing d7a2870dde3bb xprtrdma: Fix bcall rep leak and unbounded peek 345652531400f xprtrdma: Resize reply buffers before reposting receives 47b3dc59e09e9 xprtrdma: Document and assert reply-handler invariants 7471e66373a44 xprtrdma: Check frwr_wp_create() during connect 28743571c17b5 xprtrdma: Initialize re_id before removal registration d0479c2b12974 xprtrdma: Fix ep kref imbalance on ADDR_CHANGE 6d52921f47020 perf hists: Fix snprintf() in hists__scnprintf_title() UID filter path 56ad33189ed5f perf bpf: Use scnprintf() in snprintf_hex() and synthesize_bpf_prog_name() c32fe40b0c745 perf sched: Fix idle-hist callchain display using wrong rb_first variant 77051ef66e4ad perf sched: Bounds-check prio before test_bit() in timehist 2e0dd50e5a4da PCI: rcar-host: Remove unused LIST_HEAD(res) b9e8406651dcc perf tools: Use perf_env__get_cpu_topology() in machine__resolve() 504028f561b19 perf tools: Use scnprintf() in cpu_map__snprint() to prevent overflow 2a8244988316a perf tools: Fix get_max_num() size_t underflow on empty sysfs file 3f4476a089a6d platform/x86/intel/vsec: Restore BAR fallback for header walk d6565e08166c8 platform/x86/intel/vsec: Return real error codes from registration path 4df30a4dc0e97 platform/x86/intel/vsec: Switch exported helpers from pci_dev to device 817ab332d37ce platform/x86/intel/vsec: Decouple add/link helpers from PCI e6523bcafeb61 platform/x86/intel/vsec: correct kernel-doc comments c0d97519c9dfb platform/x86:intel/pmc: Relocate lpm_req_guid to pmc_reg_map b95e1facc5b7f platform/x86:intel/pmc: Rename PMC index variable to pmc_idx 3e86797c0699d platform/x86:intel/pmc: Add support for multiple DMU GUIDs 4f129fc6f756f fs/ntfs3: resize log->one_page_buf when adopting on-disk page size d3491b23bc207 PCI: meson: Add missing remove callback a5c0ba31eef9e PCI: meson: Propagate devm_add_action_or_reset() failure f0aaa198e068b pwm: rzg2l-gpt: Add missing newlines to dev_err_probe() messages a57692ad365f3 PCI: mediatek: Fix operator precedence in PCIE_FTS_NUM_L0 macro f161ef7b0dd2f nfs: use nfsi->rwsem to protect traversal of the file lock list a6f147b23e361 NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS in pg_get_mirror_count_write a70375f0b793e NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS on fatal DS connect errors b694c7de94bc5 nfs: keep PG_UPTODATE clear after read errors in page groups f84949dd17847 NFSv4/pnfs: defer return_range callbacks until after inode unlock 53442c7d0c888 xprtrdma: Decouple req recycling from RPC completion becc90a04780a xprtrdma: Use sendctx DMA state for Send signaling e7ae0883c8c89 xprtrdma: Post receive buffers after RPC completion f043dd58fbd79 xprtrdma: Close lost-wakeup race in xprt_rdma_alloc_slot b7bc8e7f09ae4 xprtrdma: Avoid 250 ms delay on backlog wakeup 44b73b4b7eff7 pNFS/filelayout: fix cheking if a layout is striped f3f21b94cf980 sunrpc: Fix error handling in rpc_sysfs_xprt_switch_add_xprt_store() e8dc126e80395 clk: qcom: a53: Corrected frequency multiplier for 1152MHz c0e6bb2b0408f dmaengine: dma-axi-dmac: use DMA pool to manange DMA descriptor 9f1ef67c041ef dmaengine: dma-axi-dmac: Properly free struct axi_dmac_desc 329ec20a86091 dmaengine: Fix possible use after free 7d49f0ddaf5a4 dmaengine: qcom: gpi: set DMA_PRIVATE capability 8e2c460a8f0e4 mshv: add bounds check on vp_index in mshv_intercept_isr() eaf937b501fd0 clk: qcom: camcc-x1e80100: Add support for camera QDSS debug clocks 032692e4525a0 dt-bindings: clock: qcom: Add X1P42100 camera clock controller c7c8bab87d0df perf tools: Fix int16_t truncation of max_cpu_num in set_max_cpu_num() e16012f8f63d3 perf timechart: Fix cpu2y() OOB read on untrusted CPU index 330219fe8523f perf c2c: Fix use-after-free in he__get_c2c_hists() error path 01564c1a260f6 perf stat: Introduce perf_env__get_cpu_topology() to guard NULL env->cpu c05ba5b57505a perf mmap: Fix NULL deref in aio cleanup on alloc failure c4406dbe5d8f4 perf sched: Replace BUG_ON and add NULL checks in replay event helpers b1f7683632712 perf sched: Use thread__put() in free_idle_threads() 1517402d0a81c perf sched: Clean up idle_threads entry on init failure d6b586bb8f489 perf c2c: Bounds-check CPU IDs in setup_nodes() topology loop 2f9f7224e7691 perf c2c: Bounds-check CPU and node IDs before bitmap and array access 278e30717c356 perf stat: Bounds-check CPU index in topology aggregation callbacks 21a9b87ada08d perf mmap: Guard cpu__get_node() return in aio_bind() 652cea73b7b7b perf sched: Fix register_pid() overflow, strcpy, and BUG_ON 068e9b6a07bc0 perf sched: Cap max_cpu at MAX_CPUS in timehist sample processing 1d25a8418c890 perf tools: Add bounds check to cpu__get_node() 89489a31f4443 perf sched: Fix thread reference leak in latency_switch_event ea486d61b1663 perf tools: Guard test_bit from out-of-bounds sample CPU 18961e0f8966e perf annotate: Fix crashes on empty annotate windows 93f3e84fc74e6 perf: Fix off-by-one stack buffer overflow in kallsyms__parse() d78b16d078149 dt-bindings: dma: nvidia,tegra186-gpc-dma: Make reset optional a498063f95bdd dmaengine: imx-sdma: Refine spba bus searching in probe da40583823153 thunderbolt: debugfs: Fix margining error counter buffer leak 038a0f01dda59 drm/amd/display: Add missing kdoc for ALLM parameters c5388a957cf1d fs/ntfs3: fix mount failure on 64K page-size kernels a318932065883 fs/ntfs3: add bounds check to run_get_highest_vcn() 097fcf945d93a HID: logitech-hidpp: remove excess kernel-doc member in hidpp_scroll_counter 26fa946925a09 clk: at91: keep securam node alive while mapping it 0147c544cbc6e iio: tcs3472: power down chip on probe failure 1cddef80a180a iio: accel: mma8452: handle I2C read error(s) in mma8452_read() 9ac3675bf8757 iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling 3d57672119525 iio: magnetometer: ak8975: fix potential kernel stack memory leak 6ec473b360342 iio: light: si1133: prevent race condition on timeout f835b69fbeaeb iio: light: si1133: reset counter to prevent race condition fd6b65ade1190 perf header: Sanity check HEADER_EVENT_DESC attr.size before swap be62602fe0797 PCI: qcom: Disable ASPM L0s for SA8775P de93ef83f99e8 powerpc tools perf: Initialize error code in auxtrace_record_init function 96c8f732cadf7 clk: renesas: rzg2l: Rename iterator in for_each_mod_clock() to avoid shadowing fdee9f207a48c gpib: fix double decrement of descriptor_busy in command_ioctl() 3d5e4cc0d9dce char: tlclk: fix use-after-free in tlclk_cleanup() d72ece584c448 gpib: Fix inappropriate ioctl error return 92f8b1d833834 perf test amd ibs: Fix incorrect kernel version check 2b2b1613b734b usb: host: max3421: Reject hub port requests for non-existent ports 02d03c61e8a7b usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control() 43078449ad623 staging: most: video: avoid double free on video register failure 45652323ce74b perf inject: Add --convert-callchain option 28ebd287a7fad perf build-id: Fix off-by-one bug when printing kernel/module build-id fc5ce5606db57 PCI: dwc: Fix signedness bug in fault injection test code 7d881615fb637 mailbox: mtk-adsp: fix UAF during device teardown 91353d63bbf61 mailbox: mpfs: fix check for syscon presence in mpfs_mbox_inbox_isr() e6bc4e127707d coresight: Fix source not disabled on idr_alloc_u32 failure 67d0475e78b39 soundwire: intel_ace2x: release bpt_stream when close it 5732869c70d42 clk: at91: sam9x7: Fix gmac_gclk clock definition f28906e7e32fd perf pmu: Skip test on Arm64 when #slots is zero 210c202c0576b phy: phy-can-transceiver: Check driver match and driver data against NULL 226feccaac818 clk: qcom: cmnpll: Account for reference clock divider 6abdf27fbcfb3 coresight: fix missing error code when trace ID is invalid 5bb87456dcd66 bus: mhi: ep: Fix potential deadlock in mhi_ep_reset_worker() 601a9b2e3b2fb rust: alloc: fix assert in `Vec::reserve` doc test b773c7161cea7 PCI: loongson: Do not ignore downstream devices on external bridges e1b79f77336d1 perf sched: Add missing mmap2 handler in timehist c788955b4a145 platform/x86: xo15-ebook: Fix wakeup source and GPE handling 2ce4d93768d2c x86/platform/olpc: xo15: Drop wakeup source on driver removal 1d495446ec7ac PCI: Check ROM header and data structure addr before accessing 78f264c0cb2ac PCI: Introduce named defines for PCI ROM 10021c2d33061 PCI/ASPM: Don't reconfigure ASPM entering low-power state 48dde5c56426c coresight: etm4x: Correct TRCVMIDCCTLR1 save and restore 65d87f28daec3 coresight: ete: Always save state on power down 1ac8f4c112aa9 coresight: etm4x: Remove the state_needs_restore flag a454f61747c97 soundwire: fix bug in sdw_add_element_group_count found by syzkaller d3896c944338c soundwire: don't program SDW_SCP_BUSCLOCK_SCALE on a unattached Peripheral c3ca7c6741af3 coresight: cti: Fix DT filter signals silently ignored fb940466fd4d3 perf debuginfo: Fix libdw API contract violations bb3d592c7d6c4 staging: nvec: fix use-after-free in nvec_rx_completed() 466c7f87de52d i3c: master: svc: Fix missed IBI after false SLVSTART on NPCM845 db2d8b6525bdd gpiolib: acpi: Only trigger ActiveBoth interrupts on boot 02e2dadd62eae eventpoll: Fix epoll_wait() report false negative f938bc8fde518 eventpoll: rename epi->next and txlist for clarity 430dac191905b eventpoll: wrap EP_UNACTIVE_PTR in typed sentinel helpers d8f88803152f0 eventpoll: extract ep_deliver_event() from ep_send_events() 4fd51f413d7b5 eventpoll: split ep_insert() into alloc + register stages 25e85dc040a6c eventpoll: rename attach_epitem() to ep_attach_file() baebd892f8a2c eventpoll: expand top-of-file overview / locking doc f04166c8677aa eventpoll: rename ep_remove_safe() back to ep_remove() 13bf9879b778b net/9p: fix race condition on rdma->state in trans_rdma.c 9c1c120471a67 9p: avoid returning ERR_PTR(0) from mkdir operations ae1f3460833d3 ocfs2: fix circular locking dependency in ocfs2_dio_end_io_write d35e4032f16d7 mfd: cs42l43: Sanity check firmware size 706fe1ce4f3a5 mfd: rsmu: Fix page register setup 35d3d6ff2bc1e ksmbd: fix use-after-free in same_client_has_lease() aa0c43c13c0bf RDMA/bnxt_re: Fail DBR related page allocation UAPIs if the feature is disabled 0fe155aa844e4 RDMA/bnxt_re: Move the UAPI methods to a dedicated file 95d46a8d3ba9f RDMA/bnxt_re: Avoid displaying the kernel pointer 104a7ff382a58 RDMA/bnxt_re: Free SRQ toggle page after firmware teardown 5a48dd5150d7c ionic: Fix check in ionic_get_link_ext_stats 4c55003566c0b net: ethernet: oa_tc6: Remove FCS size in RX frame 93e133b9193cb net: airoha: Fix always-true condition in PPE1 queue reservation loop d774cdbda6634 tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF) 0d8a12d714312 tipc: fix UAF in tipc_l2_send_msg() db1616263a2c5 KEYS: Use acquire when reading state in keyring search 66919a6d72b9e powerpc/kexec: fix double get_cpu() imbalance in kexec_prepare_cpus 527cd14a416f2 powerpc/powernv: fix preempt count leak in pnv_kexec_wait_secondaries_down 73711688479df powerpc/perf: fix preempt count underflow in fsl_emb_pmu_del 92f38fe85198a MIPS: mm: Fix out-of-bounds write in maar_res_walk() fe09dd288722f bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check 81567d2b3f4dc sockmap: Fix use-after-free in udp_bpf_recvmsg() 073d957252696 net: remove addr_len argument of recvmsg() handlers 4e40056bb5c82 bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() 264d6a79c96ee udf: fix nls leak on udf_fill_super() failure 5e8627b7a7b7c bpf: Fix bpf_get/setsockopt to tos for ipv4-mapped ipv6 socket e803077769248 selftests/bpf: Initialize operation name before use 9f32d4c2de85f selftests/bpf: Fix typo in verify_umulti_link_info 74badb5e2b00a smb/client: always return a value for FS_IOC_GETFLAGS 21303c4a2b727 cifs: remove all cifs files before kill super 7a59146cb9ade ALSA: core: Fix unintuitive behavior of snd_power_ref_and_wait() 87d1eaffeec41 netfilter: nf_conncount: callers must hold rcu read lock 98a965cb1e767 ALSA: seq: avoid stale FIFO cells during resize 287d506d4e086 ALSA: seq: oss: Serialize readq reset state with q->lock f01fb6138f8eb kcm: use WRITE_ONCE() when changing lower socket callbacks 4d48c08a0bf6c net: airoha: Fix debugfs new-tuple display for IPv4 ROUTE entries dcac6e4221f39 net: airoha: Fix register index for Tx-fwd counter configuration 36edab340a067 net: bcmgenet: Use weighted round-robin TX DMA arbitration b91b241a4eefe landlock: Fix unmarked concurrent access to socket family 1bb02353e79f7 dpll: balance create/delete notifications in __dpll_pin_(un)register 77a1ea975c877 dpll: guard sync-pair removal on full pin unregister 8008ef973f012 dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() 6564ce3a2f9c2 dpll: send delete notification before unregister in on-pin rollback f1e1c6eb82482 dpll: fix stale iteration in dpll_pin_on_pin_unregister() 20575400fc1ba dpll: Enhance and consolidate reference counting logic ebe4bd3560a7a dpll: Support dynamic pin index allocation f7aebaee2961b net: wwan: t7xx: check skb_clone in control TX 34bd255dba321 net: ethernet: mtk_wed: debugfs: correct index in wed_amsdu_show() 1d072cc3ba433 octeontx2-af: npc: Fix size of entry2cntr_map 417bd36a085d7 bpf: Fix setting retval to -EPERM for cgroup hooks not returning errno 3d90b15fb1918 net/mlx5: Check max_macs devlink param value against max capability 8d5f4be134882 bpf: Run generic devmap egress prog on private skb 450e48271827b net/sched: sch_dualpi2: Add missing module alias 6d585d0dc6743 net: ethernet: mtk_wed: fix loading WO firmware for MT7986 446fe8ce699ce net: watchdog: fix refcount tracking races 697db22a9dcc4 net: mana: guard TX wq object destroy with INVALID_MANA_HANDLE check 62ce489acb428 net: mana: initialize gdma queue id to INVALID_QUEUE_ID bd851b10daee7 net/sched: sch_dualpi2: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen 755108bb7a508 net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen 0500af8630c32 net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen a05d638b60746 virtio_net: do not allow tunnel csum offload for non GSO packets ce311bd2e3659 tcp: clear sock_ops cb flags before force-closing a child socket 67cec2f1eb9e5 handshake: Require admin permission for DONE command d0503357653ee power: supply: core: fix supplied_from allocations 7f4aa81f5bb27 ASoC: adau1372: Clear PLL_EN on failed PLL lock without reset GPIO 0c22c00924359 iommu: Avoid copying the user array twice in the full-array copy helper 1c9246a199e19 spi: xilinx: use FIFO occupancy register to determine buffer size dae23c545eb5a ALSA: seq: Fix kernel heap address leak in bounce_error_event() 1749fef4bda0f ALSA: usb-audio: qcom: Guard sideband endpoint removal 2ba2373151936 crypto: rng - Free default RNG on module exit fb4d57b83356d crypto: cavium/cpt - fix DMA cleanup using wrong loop index 5f99a396f706a crypto: marvell/octeontx - fix DMA cleanup using wrong loop index 4941205f5fa39 cxl/test: Add check after kzalloc() memory in alloc_mock_res() a27481516d32f cxl/test: Unregister cxl_acpi in cxl_test_init() error path 7e401233f9bb7 tipc: reject inverted service ranges from peer bindings 3cfa3d8e0dc16 tipc: prevent snt_unacked underflow on CONN_ACK cebaefe1aceb6 tipc: require net admin for TIPCv2 netlink mutators 66dbb13eeb2fc net/sched: sch_hfsc: Don't make class passive twice 51a1d9836acc7 net: pfcp: allocate per-cpu tstats for PFCP netdevs ed8605c6f39b9 sctp: validate embedded address parameter length a090880c1f544 bridge: cfm: reject invalid CCM interval at configuration time bb4a5b3c91af3 net: fib_rules: Don't dump dying fib_rule in fib_rules_dump(). 0a8b5b74f0e6b net/sched: cls_flow: Dont expose folded kernel pointers 10e05634ddc19 net: dsa: qca8k: fix led devicename when using external mdio bus e098c9c6477df ASoC: tegra: tegra210_ahub: Validate written enum value 0f1510e84d7bf ASoC: fsl: fsl_audmix: Validate written enum values 9131e4b023e0d ASoC: codecs: hdac_hdmi: Validate written enum value cb527e063a32e ASoC: SOF: Intel: hda-sdw-bpt: select SND_SOF_SOF_HDA_SDW_BPT properly d3ff718c0c715 RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one 4b87a2497276a RDMA/mlx5: Fix undefined shift of user RQ WQE size 1bc1487f7a7f5 RDMA/mlx5: Remove raw RSS QP restrack tracking f704db4b0318a RDMA/mlx5: Remove DCT restrack tracking 3a1687e0506be fs: efs: remove unneeded debug prints 7e694ac97591c Bluetooth: vhci: validate devcoredump state before side effects ec4d352747a62 Bluetooth: hci: validate codec capability element length 7f206a8d8d822 Bluetooth: btmtk: fix URB leak in alloc_mtk_intr_urb error path a0fd1086a57b9 Bluetooth: hci_core: Fix UAF in hci_unregister_dev() e8815ae9dcdc5 Bluetooth: hci_event: fix simultaneous discovery stuck in FINDING f1b4df9c260c5 Bluetooth: eir: Fix stack OOB write when prepending the Flags AD e284bb94ad451 Bluetooth: hci_qca: fix NULL pointer dereference in qca_dmp_hdr() for non-serdev device c86c861c64b58 s390/process: Fix kernel thread function pointer type 0eab19ab9cb1b ASoC: cs35l56: Fix possible uninitialized value in cs35l56_spi_system_reset() c83255f3cf22d arm64: dts: allwinner: a523: Add missing GPIO interrupt ad6963c3bb458 pinctrl: airoha: an7581: fix misprint in gpio19 pinconf 5985ddfd3e83f pinctrl: airoha: an7581: add missed gpio32 pin group db3cd694ded4c pinctrl: airoha: generalize pins/group/function/confs handling 0234e8fc296e7 pinctrl: sunxi: a523: Remove unneeded IRQ remuxing flag 46fbafe3d2d56 bpf: Tighten cgroup storage cookie checks for prog arrays d416dcefdbac9 vfio/qat: fix f_pos race in qat_vf_resume_write() 1201dbb260507 of: cpu: add check in __of_find_n_match_cpu_property() d2acea4f47475 cxl/test: Zero out LSA backing memory to avoid leaking to user 42a9a76f314ef cxl/test: Fix integer overflow in mock LSA bounds checks 91ad3088ee1b7 selftests/bpf: Fix bpf_iter/task_vma test f00f5c0dd5531 ext4: fix kernel BUG in ext4_write_inline_data_end c998a09c7144e bonding: 3ad: fix mux port state on oper down f0ada4846d11b bonding: 3ad: fix carrier when no usable slaves cb20a9b50efe0 bonding: 3ad: add lacp_strict configuration knob 47636f0a70b36 netlink: specs: rt-link: missed broadcast-neigh 6b2c271d2c394 tools: missed broadcast_neigh if_link uapi header 484b3b9aa7986 ext4: fix ERR_PTR(0) in ext4_mkdir() 88cb304c0be0c ASoC: cs35l56: Don't leave parent IRQ disabled if system_suspend fails 8b55e7ec116ca ASoC: cs35l56: Fix missing calls to wm_adsp2_remove() 3ef0cfa77a3d5 vdpa/octeon_ep: fix IRQ-to-ring mapping in interrupt handler 54556d5394382 vdpa/octeon_ep: Fix PF->VF mailbox data address calculation 86e0b37738dea tools/virtio: check mmap return value in vringh_test 321c73baf54d9 vhost/net: complete zerocopy ubufs only once 646614dcb1607 vduse: Requeue failed read to send_list head f9d9220234451 virtio_console: read size from config space during device init 79366023aa891 virtio: rtc: tear down old virtqueues before restore 1f5f94c6c6b2e vhost/vdpa: validate virtqueue index in mmap and fault paths a2d0a57538fd0 vduse: hold vduse_lock across IDR lookup in open path 3d56f3fb201ff ASoC: codecs: aw88261: fix incorrect masks for boost regs ecb9be4fc8be0 spi: meson-spifc: fix runtime PM leak on remove da6f86ff4f2dd NFSD: Handle layout stid in nfsd4_drop_revoked_stid() 37e85be551c4d IB/mlx4: Fill in the access_flags if IB_MR_REREG_ACCESS is not specified e6d83f877d5ab ASoC: sma1307: Fix uevent string leaks in fault worker 701ea71c17c92 igc: skip RX timestamp header for frame preemption verification 2aa37c8ef1092 btrfs: fix deadlock cloning inline extent when using flushoncommit f85410ebf20bb btrfs: annotate lockless read of defrag_bytes in should_nocow() 18285888cb41a btrfs: zoned: always set max_active_zones for zoned devices 943f5917c53ca Revert "btrfs: fix the file offset calculation inside btrfs_decompress_buf2page()" ba641829c11cb btrfs: zoned: don't account data relocation space-info in statfs free space bd5e90b0f5a09 hwmon: (it87) Clamp negative values to zero in set_fan() ebb579c5c0f0f vfs: add FS_USERNS_DELEGATABLE flag and set it for NFS de590cdf7efec fbdev: sm501fb: Fix buffer errors in OF binding code 0678fed27def9 wifi: ath12k: enable IEEE80211_VHT_EXT_NSS_BW_CAPABLE when NSS ratio is reported 47e5302722e09 gpio: mt7621: fix interrupt banks mapping on gpio chips 90a9c909c5b75 ALSA: aloop: Drop superfluous break 3b15d02be05e7 btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs() 7ec839c7c0bc1 wifi: mt76: mt7996: fix potential tx_retries underflow ad12fdaaed16c wifi: mt76: mt7925: fix potential tx_retries underflow 3b6e6fefa57f4 wifi: mt76: mt7921: fix potential tx_retries underflow 6b8e35685c18c wifi: mt76: mt7915: fix potential tx_retries underflow 6356a829a1edc wifi: mt76: fix argument to ieee80211_is_first_frag() 42f34c478fcdf wifi: mt76: mt7996: limit work in set_bitrate_mask 1a399103cacc9 wifi: mt76: mt7996: fix reading zeroed info->control.flags after mt76_tx_status_skb_add() dfb27e5dd9e4d wifi: mt76: mt7996: Fix possible NULL pointer dereference in mt7996_mac_write_txwi_80211() 06e65d6cf8049 wifi: mt76: mt7996: Fix possible token leak in mt7996_tx_prepare_skb() c386e90a7ce8d wifi: mt76: mt7925: validate skb length in testmode query 856fa6a21586f wifi: mt76: mt792x: skip MLD header rewrite for 802.3 encap TX a10e4959a73be wifi: mt76: mt7925: keep TX BA state in the primary WCID b8bf7c221b364 wifi: mt76: mt7925: fix stale pointer comparisons in change_vif_links bd3b91ff13006 wifi: mt76: mt7996: add missing max_remain_on_channel_duration c7a83899203ed wifi: mt76: use kfree_rcu for offchannel link in mt76_put_vif_phy_link 3f0ea6d14fa44 wifi: mt76: mt7925: clean up DMA on probe failure ce9d5a021cfca ARM: configs: Drop duplicated CONFIG_EXT4_FS c788617705c3a sched/fair: Fix cpu_util runnable_avg arithmetic a2e8b5264f92e hwspinlock: qcom: avoid uninitialized struct members bbd664b7c77f6 vmalloc: fix NULL pointer dereference in is_vm_area_hugepages() 648a3960e3664 pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins 34-39 44cff0737127b pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39 f775e7bda9a4f scsi: target: Remove tcm_loop target reset handling c2bd9fdb448d6 scsi: target: Fix hexadecimal CHAP_I handling 0404baeb9e430 pinctrl: qcom: Fix resolving register base address from device node 298821692d447 watchdog: unregister PM notifier on watchdog unregister 637ef4961470e configfs: fix lockless traversals of ->s_children f25d6e4ec4c25 firmware_loader: Fix recursive lock in device_cache_fw_images() 9e82497138abe ASoC: amd: acp-sdw-sof: Bound DAI link iteration 1279bdab5fa1f ASoC: amd: acp-sdw-legacy: Bound DAI link iteration e8d89baf92170 spi: ep93xx: fix double-free of zeropage on DMA setup failure e123f0ab02d05 IB/mlx5: Don't mangle the mr->pd inside the rereg callback fd284b12810e4 IB/mlx5: Pull the pdn out of the depths of the umr machinery 8119fe468b01f IB/mlx5: Remove unused mkc bits in mlx5r_umr_update_mr_page_shift() d4f84bfa089fe IB/mlx5: Properly support implicit ODP rereg_mr f5657d399b7ef IB/mlx5: Don't take the rereg_mr fallback without a new translation c213b71a2d416 btrfs: don't force DIO writes to be serialized 920dcf1cb8dae thermal: testing: reject missing command arguments dde04550fd6ff cpufreq: Documentation: fix conservative governor freq_step description 6cb635ad1006d ACPI: IPMI: Fix message kref handling on dead device b7474f4432dd9 bpf: Fix NULL pointer dereference in bpf_task_from_vpid() 84932636d020b powerpc/8xx: implement get_direction() in cpm1 8daa1a64711ed kunit:tool: Don't write to stdout when it should be disabled 8b0510cc3a4a0 bpf: Fix NMI/tracepoint re-entry deadlock on lru locks 74ac1ce1f4afd ALSA: seq: Clear variable event pointer on read c04e0cde2fa38 riscv: stacktrace: Remove bogus -0x4 offset in non-FP walk_stackframe 834d4cc067fa6 riscv: cpu_ops: Change return value type of cpu_is_stopped() to bool 4b2b6bc7f5ebe ALSA: seq: Fix partial userptr event expansion af8f0ea1f0a3a wifi: wcn36xx: fix OOB read from short trigger BA firmware response f03782f7f41f2 wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication 1b5d8a248c3af wifi: wcn36xx: fix heap overflow from oversized firmware HAL response 495e7e832c670 bpf: Update transport_header when encapsulating UDP tunnel in lwt efe57b72196ae bpf: Check tail zero of bpf_prog_info 58513d6d12410 bpf: Check tail zero of bpf_map_info 2eb39de4962f8 bpf: Clear rb node linkage when freeing bpf_rb_root f6183983ce1ff RDMA/siw: Fix endpoint/socket association handling 04255bda8d795 arm64: dts: imx8mp-kontron: Fix GPIO for display power switch e6ab22200e449 arm64: dts: tqma8mpql-mba8mpxl: configure sai clock in audio codec as well f3ef944c55991 arm64: dts: lx2162a-clearfog: use rev2 SoC dtsi b5087fc4ef1f8 arm64: dts: imx95: Correct PCIe outbound address space configuration ab4b5a07e1c1a arm64: dts: imx8mp-kontron: Reduce EERAM SPI clock frequency f9173e0fc026c RDMA/irdma: Initialize iwmr->access during MR registration 54cab78df0375 RDMA/irdma: Fix OOB read during CQ MR registration 844a1ae78e220 ALSA: hda: fix Kconfig dependency of HD Audio PCI 47831b503ecb7 IB/cm: Fix av cm device leak on an error path in cm_init_av_by_path() fe5414d6b3995 RDMA/hfi1: Open-code rvt_set_ibdev_name() 77b4bfc1ce32a netfilter: conntrack: call nf_ct_gre_keymap_destroy() if master helper is pptp d53eecbca16f0 netfilter: conntrack: revert ct extension genid infrastructure e6665d36b37b4 x86/cpu: Remove obsolete aperfmperf_get_khz() declaration dd0d22fdae4cb ALSA: usb-audio: qcom: Initialize offload control return value 8ebc31b86dccd netfilter: synproxy: protect nf_ct_seqadj_init() with conntrack lock 5c9c67cf7a3d1 netfilter: synproxy: fix unaligned memory access in timestamp adjustment b171119082bab netfilter: synproxy: adjust duplicate timestamp options 4dbb71c046f72 netfilter: synproxy: drop packets if timestamp adjustment fails dce1e3cf735d1 netfilter: nfnetlink_cthelper: use {READ,WRITE}_ONCE for accessing helper flags 7b819a84f1d5f netfilter: nfnetlink_osf: fix mss parsing on big-endian architectures c3ebf67cf8a96 ocfs2: fix race between ocfs2_control_install_private() and ocfs2_control_release() a087b2d3411e7 ocfs2/dlm: require a ref for locking_state debugfs open 3fa7139b5f427 ocfs2: reject FITRIM ranges shorter than a cluster 0e389fc290c35 ocfs2: fix buffer head management in ocfs2_read_blocks() 3fe2d0d21c8ae lib: kunit_iov_iter: repeatedly call alloc_pages_bulk() bb44a7690a4d5 ocfs2: rebase copied fsdlm LVB pointers in locking_state 9af58d10d0d8c of: reserved_mem: avoid post-init UAF when alloc_reserved_mem_array() fails 9a030fcb4b192 drm/amdkfd: always resume_all after suspend_all b8d15e85596ad cxl/fwctl: Fix __fortify_panic b64120d54278e xfrm: fix NAT-related field inheritance in SA migration ac9e29b191a03 perf/x86/amd/uncore: Use Node ID to identify DF and UMC domains 58cbb1c2aadf8 perf/x86/intel/uncore: Fix discovery unit lookup for multi-die systems 4e18e9361aab0 perf/x86/amd/core: Always use the NMI latency mitigation f5102e0fc3c6d iommu/vt-d: Fix RB-tree corruption in probe error path 7f229d27bf27c vhost: fix vhost_get_avail_idx for a non empty ring 73f9f54d71749 bpftool: Use libbpf error code for flow dissector query 4beed798daf4d drm/amdgpu: set sub_block_index for mca ras sub-blocks e82d515092a0c ext4: fix fast commit wait/wake bit mapping on 64-bit 8cbd587e8cdb6 lockdep/selftests: Restore sched_rt_mutex state on PREEMPT_RT 8d5ed4810e479 lockdep/selftests: Restore migrate_disable() state on PREEMPT_RT c3b073a209a9b configfs_lookup(): don't leave ->s_dentry dangling on failure 778bb4939d457 riscv: dts: sophgo: sg2042: use hex for CPU unit address efe71fbced524 riscv: dts: sophgo: sg2044: use hex for CPU unit address 5a1168ba0a95b lib/test_meminit: use && for bools 3777588848520 tick/sched: Fix TOCTOU in nohz idle time fetch 5cf2c85b12312 bpf: Reject exclusive maps for bpf_map_elem iterators 0830287cc6cb7 driver core: Use system_percpu_wq instead of system_wq 5e406928404d6 nvme: fix FDP fdpcidx bounds check 36bdda0c86d51 sched: restore timer_slack_ns when resetting RT policy on fork ffa974b2f50ad ext2: fix ignored return value of generic_write_sync() 8d763babb2a2f mm/fake-numa: fix under-allocation detection in uniform split 61f1972972824 bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs d81370c6c4f5f scsi: ufs: Fix wrong value printed in unexpected UPIU response case 846052542cfa6 scsi: pm8001: Fix error code in non_fatal_log_show() 0de14eae6de88 libbpf: Skip max_entries override on signed loaders abe383999640f libbpf: Skip initial_value override on signed loaders b6862b6a25c6a libbpf: Reject non-exclusive metadata maps in the signed loader 3a0f73d27a8d3 bpf: Reject exclusive maps as inner maps in map-in-map 91ca9eab008b9 scsi: Revert "scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans" 5c53406098b59 nvdimm/btt: Handle preemption in BTT lane acquisition d292b30e1b746 x86/cpu: Keep the PROCESSOR_SELECT menu together 901802925ebed ARM: imx31: Fix IIM mapping leak in revision check 617a5a67ce016 ata: libata: Fix ata_exec_internal() cfcea221db933 wifi: ath12k: fix NULL deref in change_sta_links for unready link eb9b89baf3087 wifi: ath12k: fix incorrect HT/VHT/HE/EHT MCS reporting in monitor mode adf0eb748d21d HID: wiimote: Fix table layout and whitespace errors 2d642797dd1c1 ARM: imx3: Fix CCM node reference leak f0742d09eb6ba NFSD: Fix delegation reference leak in nfsd4_revoke_states 9e565962d999e ASoC: rsnd: Fix RSND_SOC_MASK width to single nibble 8ec64276ecd24 spi: atmel: fix DMA channel and bounce buffer leaks ab4d04bf8b2f3 ext4: fix LOGFLUSH shutdown ordering to allow ordered-mode data writeback 803087a16a4ea libbpf: Skip endianness swap when loader generation failed f3389fbaff1a1 libbpf: Skip hash computation when loader generation failed a441c0794ac28 selftests/bpf: add verification for BPF_PROG_QUERY attr size boundaries a7131340d0f95 bpf: fix BPF_PROG_QUERY OOB write and cgroup backward compat 5ac9e793ba258 raid1: fix nr_pending leak in REQ_ATOMIC bad-block error path b7313f23ea5a7 md/raid10: reset read_slot when reusing r10bio for discard e04e384274f83 rpmsg: use generic driver_override infrastructure 0e2f0833556c8 Drivers: hv: vmbus: use generic driver_override infrastructure d2cf52ba2803b cdx: use generic driver_override infrastructure b41923dbf6769 amba: use generic driver_override infrastructure ff4e38a37ba53 media: qcom: venus: relax encoder frame/blur step size on v6 bc7c166cc1012 media: qcom: venus: relax encoder frame/blur dimension steps on v4 ffe754288750a media: qcom: venus: drop extra padding in NV12 raw size calculation f8f48c851a0d2 Revert "media: venus: hfi_platform: Correct supported codecs for sc7280" 5420eebf3b3c1 RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path 02558c86b6b76 RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe 4779f435627b2 RDMA/umem: Add ib_umem_is_contiguous() stub for !CONFIG_INFINIBAND_USER_MEM bae436a78a058 arm64: dts: st: Fix SAI addresses on stm32mp251 5da012c605fd5 EDAC/{skx_common,skx}: Fix UBSAN shift-out-of-bounds in skx_get_dimm_info 9a84ced0243c7 EDAC/igen6: Fix call trace due to missing release() ed5c94cf4ee9e drm/msm/dp: Fix the ISR_* enum values bdaea74abcf0c drm/msm/dp: fix HPD state status bit shift value 6d536a9107172 sched/deadline: Reject debugfs dl_server writes for offline CPUs 4f3c17f14cf90 crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm 5eac10c521396 crypto: tegra - Fix dma_free_coherent size error 5231093c08295 crypto: inside-secure/eip93 - Add check for devm_request_threaded_irq 8572232ed74f5 crypto: hisilicon/qm - disable error report before flr ce7a2e26e144f ocfs2: kill osb->system_file_mutex lock 3852478d34c7b ocfs2: don't BUG_ON an invalid journal dinode 070f356ea4f41 rapidio/tsi721: prevent a bad dereference in tsi721_db_dpc() 598ed7393a639 dax/kmem: account for partial discontiguous resource upon removal afdb92d9c374d arm64: tegra: Add #{address,size}-cells to Chromium-based /firmware e545fcba3660c ARM: tegra: Add #{address,size}-cells to Chromium-based /firmware c87339cc08aa0 libbpf: Fix UAF in strset__add_str() 39e8be33387e3 bpftool: Fix typo in struct_ops map FD generation for light skeleton ed7ba8d048a4c libbpf: Harden parse_vma_segs() path parsing 340936ebf5aec drm/nouveau/bios: specify correct display fuse register for Ampere and Ada 2ab7c96d8c3fb drm/tegra: Fix iommu_map_sgtable() return value check 79240eee5a400 gpu: host1x: Fix iommu_map_sgtable() return value check 142b34f7e329c drm/tegra: dc: Fix device node reference leak in tegra_dc_has_output() 8c0d3cf0d5108 gpu: host1x: Allow entries in BO caches to be freed 6b617b6ccb6eb drm/tegra: gr2d/gr3d: Contain PM in the gr*d_probe/gr*d_remove 40a2a91da02c4 drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered 05d85fd32e4fe rtla/actions: Restore continue flag in actions_perform() b7ac7ba19a0b8 rtla: Introduce for_each_action() helper dc266f6c4e262 iommu/amd: Fix premature break in init_iommu_one() 10753da2d659d net/sched: cls_bpf: prevent unbounded recursion in offload rollback 0db1949084e85 ipv6: guard against possible NULL deref in __in6_dev_stats_get() dc1470299d11d workqueue: drop spurious '*' from print_worker_info() fn declaration 3e8aed5edaeeb nvme-pci: fix out-of-bounds access in nvme_setup_descriptor_pools 140d6fff4ed26 nvme-multipath: fix flex array size in struct nvme_ns_head cba2ee57fd302 nvmet-tcp: check return value of nvmet_tcp_set_queue_sock ba3209704b3cd nvmet-tcp: fix page fragment cache leak in error path 24639c4dc466e init/initramfs_test: wait_for_initramfs() before running eb9280ea8dbd2 pinctrl: cs42l43: Fix polarity on debounce 2739d234d8952 pinctrl: cs42l43: Fix leaked pm reference on error path 95e0b4bc29ab9 pinctrl: nuvoton: ma35d1: fix MFP register offset and pin table c418c956c21c9 selftests: Fix Makefile target for nsfs 11165fe2c5ea0 ALSA: seq: midi: Serialize output teardown with event_input 6dc781778b595 ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data de236b813d8b4 ALSA: xen-front: Connect event channel after stream prepare 56694f00fbe10 ALSA: xen-front: Reset event channel state on stream clear 02f156309de0d mtd: spi-nor: Drop duplicate Kconfig dependency c4bb92b3ef54c mtd: spi-nor: debugfs: Fix the flags list 3880ee7c88d78 driver core: Guard deferred probe timeout extension with delayed_work_pending() 0a294feec21b6 driver core: Fix missing jiffies conversion in deferred_probe_extend_timeout() 2c12b0dfcedad mips: n64: add __iomem for writel call 8db227dd895a8 mips: ralink: mt7621: add missing __iomem 0c83d13f9b3f1 MIPS: DEC: Remove do_IRQ() call indirection c9a3ceeddc6ad MIPS: Fix big-endian stack argument fetching in o32 wrapper c9670fd84df12 PM: sleep: Use complete() in device_pm_sleep_init() 80f8e2302e639 pinctrl: meson: amlogic-a4: fix gpio output glitch 9420871183eab RDMA/counter: Fix incorrect port index in rdma_counter_init() error cleanup 66f44ec974ab3 RDMA/hns: Fix log flood after cmd_mbox failure 16138ea9833d6 RDMA/hns: Fix warning in poll cq direct mode f67fbbfc3beb8 IB/mlx4: Fix refcount leak in add_port() error path e59a6aa89e0fc RDMA/rxe: Fix a use-after-free problem in rxe_mmap 424d51d33c754 RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs 7a551951ebeb5 pinctrl: spacemit: fix NULL check in spacemit_pin_set_config 394ed8ad05889 bus: sunxi-rsb: Always check register address validity 090f5fb1e3e23 RDMA/mana_ib: Use ib_get_eth_speed for reporting port speed c11039512df49 pwm: imx27: Fix variable truncation in .apply() 13db458099f28 cpufreq: conservative: Simplify frequency limit handling 3fcbfc50dd52f cpufreq: Documentation: fix sampling_down_factor range 376951c51cdd0 crypto: eip93 - fix reset ring register definition 4a6f5cc42c7bf of: dynamic: Fix overlayed devices not probing because of fw_devlink ae62edb00c0eb Revert "treewide: Fix probing of devices in DT overlays" 2df37ead6d84b driver core: Use mod_delayed_work to prevent lost deferred probe work 62c8cc825f49e device property: fix fwnode reference leak in fwnode_graph_get_endpoint_by_id() b0444205ba39e kernfs: fix suspicious RCU usage in kernfs_put() 29de8448174cf writeback: drop now-unnecessary rcu_barrier() in cgroup_writeback_umount() 2469039f0fd68 arm64: dts: qcom: lemans: Add eDP ref clock for eDP PHYs baa333b2700a7 tracing: Bound synthetic-field strings with seq_buf 09a2a7d041a78 arm64: dts: qcom: sm8750: Add power-domain and iface clk for ice node 4ba44339fd3ac arm64: dts: qcom: sm8650: Add power-domain and iface clk for ice node 3c808cac676c5 arm64: dts: qcom: sm8550: Add power-domain and iface clk for ice node 0d0ce8c7025ac arm64: dts: qcom: sm8450: Add power-domain and iface clk for ice node a8be1bc8d124f arm64: dts: qcom: kodiak: Add power-domain and iface clk for ice node dc36463b283d9 arm64: dts: qcom: sc7180: Add power-domain and iface clk for ice node a2303478e7301 arm64: dts: qcom: monaco: Add power-domain and iface clk for ice node b3e05859cb516 arm64: dts: qcom: lemans: Add power-domain and iface clk for ice node 11daac2817dca firmware: arm_scmi: Fix OOB in scmi_power_name_get() 15e7368de5842 media: rockchip: rga: fix too small buffer size a88f6da618e8b net/sched: sch_drr: annotate data-races around cl->deficit 276e731b1b577 nilfs2: Fix return in nilfs_mkdir 16bf3154f8a80 tools/nolibc: getopt: Fix potential out of bounds access c67c672047667 regulator: dt-bindings: mt6359: Drop regulator-name pattern restrictions 75c0bc011abdd bitops: use common function parameter names 407aeb8c1aee8 sysfs: clamp show() return value in sysfs_kf_read() bac3e70c2fb10 firmware: arm_scmi: Read sensor config as 32-bit value 1f60c3cc302d2 firmware: smccc: Fix Arm SMCCC SOC_ID name call 3024229e4a5af riscv: dts: spacemit: set console baud rate on Milk-V Jupiter 63aa7dda9a1ed staging: media: atomisp: fix loop shadowing in ia_css_stream_destroy() d57e67ea48e4d media: atomisp: gc2235: fix UAF and memory leak 2e3e4cc0dd349 media: atomisp: Fix memory leak in atomisp_fixed_pattern_table() 5d6f34dc4f056 arm64: dts: imx95-19x19-evk: Fix PCIe EP vpcie-supply 084d7d5668f30 arm64: dts: imx8qxp-mek: Remove unnecessary PCIe EP vpcie-supply 6a576739ce4c9 arm64: dts: imx8dxl-evk: Remove unnecessary PCIe EP properties 0da72a88dbbab firmware: arm_ffa: Honor partition info descriptor size 5e353d9497f95 selftests/mm: Fix resv_sz when parsing arm64 signal frame 6a357ceb21100 iommu/arm-smmu-qcom: Fix fastrpc compatible string in ACTLR client match table bcfc49f1bcf1b selftests/bpf: Fix test for refinement of single-value tnum e4d599a286b5a selftests/bpf: Reject unsupported -k option in vmtest.sh 7471006cd854d drm/syncobj: Fix memory leak in drm_syncobj_find_fence() be2c137f23d15 RDMA/hns: Initialize seqfile before creating file 65572fbd86033 RDMA/srpt: fix integer overflow in immediate data length check 5100febf8e9d6 RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference ffa85a2c19793 RDMA/mlx5: Fix UMR XLT cleanup on ODP populate failure 2cd221fca036b RDMA/hns: Fix arithmetic overflow in calc_hem_config() 65e344925fa30 IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier b61af0268e3d1 ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD 5c1196b5a3bf3 net/sched: sch_htb: annotate data-races (I) d8cae30582f06 net/sched: sch_htb: do not change sch->flags in htb_dump() 68eae3592438d spi: hisi-kunpeng: Use dev_err_probe() for host registration failure 21650fe221ea9 crypto: ccp - Treat zero-length cert chain as query for blob lengths cb414aff28e18 scsi: hisi_sas: Add slave_destroy interface for v3 hw 8b42290df1765 net/sched: sch_hfsc: annotate data-races in hfsc_dump_class_stats() d29b9c38f6eb4 clk: scpi: Unregister child clock providers on remove 69bc4a3998742 thermal: hwmon: Fix critical temperature attribute removal a0f64cf8bfcb3 evm: terminate and bound the evm_xattrs read buffer 4c57df82af833 drm/hisilicon/hibmc: use clock to look up the PLL value 28b91fd2adc4f drm/hisilicon/hibmc: move display contrl config to hibmc_probe() 94ab8a6e02bae drm/hisilicon/hibmc: fix no showing when no connectors connected 689bb48c828ca drm/hisilicon/hibmc: add updating link cap in DP detect() 27af16a44f590 arm64: dts: qcom: sm8450: Fix ICE reg size 886fb63981a92 arm64: dts: qcom: kodiak: Fix ICE reg size 2e2e5888764ba clk: scmi: Fix clock rate rounding 8200ffd8259f0 rust: alloc: fix `Vec::extend_with` SAFETY comment 9fe7605c1c143 arm64: dts: mediatek: mt8192-asurada: Move PCIe DMA bounce buffer to host 02367b12b303a uaccess: fix ignored_trailing logic in copy_struct_to_user() e003f3a4be738 bpf: fix crash in bpf_[set|remove]_dentry_xattr for negative dentries 8960088511ca1 soc: mediatek: mtk-mmsys: Restore MT8167 routing masks lost during merge 0dd1cf48a4217 iommu/amd: Fix a stale comment about which legacy mode is user visible feb10ab7abc24 media: venus: scale MMCX power domain on SM8250 9e642727b97dd media: iris: scale MMCX power domain on SM8250 e725aedd26e96 media: qcom: camss: vfe: fix PIX subdev naming on VFE lite f9f1a2cd912da nilfs2: fix backing_dev_info reference leak 712714f818d83 dlm: fix add msg handle in send_queue ordered 4695cfab48f90 ARM: multi_v7_defconfig: Correct QCOM_RPMH and QCOM_RPMHPD 6acd2fbd00f9c crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents 9b21d5bd33a7f crypto: ecrdsa - fix unknown OID check in ecrdsa_param_curve aac63bbea8fd5 crypto: atmel-sha204a - fix blocking and non-blocking rng logic c5c79d92da0f9 crypto: ccp - Fix snp_filter_reserved_mem_regions() off-by-one 25b0061adc1c1 crypto: ccp - Reverse the cleanup order in psp_dev_destroy() 46696b0b21234 OPP: Fix race between OPP addition and lookup 8fe4736532639 alarmtimer: Remove stale return description from alarm_handle_timer() 224d7300b5691 drm: renesas: rz-du: mipi_dsi: Fix return path on error 4a8cde6f7281e vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive(). 470984f1c2ed8 Revert "arm64: dts: imx8mp-kontron: Add support for reading SD_VSEL signal" 5f7777f0da030 Revert "arm64: dts: imx8mm-kontron: Add support for reading SD_VSEL signal" b9c6ad49a942d arm64: dts: imx8x-colibri: Correct SODIMM PAD settings a5e026d5b9487 arm64: dts: rockchip: fix rk809 interrupt pin on rk3566-roc-pc 6173c83d4d791 arm64: dts: rockchip: Add #{address,size}-cells to Chromium-based /firmware 2b553fcec1cd8 ARM: dts: rockchip: Add #{address,size}-cells to Chromium-based /firmware d003d9bb44da1 drm/panel: Clean up S6E3HA2 config dependencies and fill help text 76a4c3af3253d drm/gpuvm: take refcount on DRM device 02b001d89157a dt-bindings: vendor-prefixes: Add Displaytech Ltd. a402b3d093815 pinctrl: sunxi: fix regulator leak in sunxi_pmx_request() error path c599af2eacd66 dts: spacemit: set console baud rate on bpif3 796ff973077c7 lib/vsprintf: Fix to check field_width and precision 53baa6b90f499 crypto: qat - fix heartbeat error injection 928f758f8f214 memory: tegra: Wire up system sleep PM ops 2b2a17af8d8c7 media: v4l2-common: Add YUV24 format info 4534f70aa7042 media: cedrus: Fix failure to clean up hardware on probe failure facbb592e22dd watchdog: sprd_wdt: Remove redundant sprd_wdt_disable() on register failure 1917015aa0a1d watchdog: sama5d4_wdt: Fix WDDIS detection on SAM9X60 and SAMA7G5 d6e8d6b2f8f04 watchdog: sp5100_tco: Use EFCH MMIO for newer Hygon FCH 29fd4f4c73e2b Documentation/rv: Replace stale website link 19eb0ab0bdffb ARM: dts: am335x-sl50: Fix audio bitclock and frame master endpoint 5435fd3edcb11 wifi: ath9k: fix OOB access from firmware tx status queue ID 7c79be7e63447 pinctrl: mediatek: eint: Drop base from mtk_eint_chip_write_mask() a83e77d1e52c0 soc: xilinx: Shutdown and free rx mailbox channel fbeea02c3564d kconfig: fix potential NULL pointer dereference in conf_askvalue ad445de67359f wifi: rtw89: add bounds check on firmware mac_id in link lookup 01155ded5d4da wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer 7a1ab5fdcae89 wifi: rtw89: Correct data type for scan index to avoid infinite loop 1ef3d1338d94e wifi: rtw88: fix wrong pci_get_drvdata type in AER handlers aefc30e4a829c wifi: rtw89: fix wrong pci_get_drvdata type in AER handlers cc77f0d91e321 driver core: use READ_ONCE() for dev->driver in dev_has_sync_state() 543ed0f61d565 drm/amdkfd: Validate CRIU-restored IDs before idr_alloc 1638e178e4915 dt-bindings: pinctrl: nvidia,tegra234: Add missing required block cc6ef5ee7d88a arm64: tegra: Fix Tegra234 MGBE PTP clock 228db770fb086 wifi: cfg80211: fix grammar in MLO group key error message 123e1cd95ba54 arm64: dts: qcom: sdm845-mezzanine: Fix camss ports unit_address_vs_reg warning d8367ee271aba arm64: dts: qcom: sc8180x: Fix phy simple_bus_reg warning d72ae2c63b683 arm64: dts: qcom: ipq5424: Fix USB simple_bus_reg warnings 8f8233d544aca arm64: dts: rockchip: Fix gmac0 reset pin for NanoPi R5S 58d0b4c55cdfd arm64: dts: rockchip: fix Ethernet PHY not found on PX30 Cobra 6005cdd9f48fd Documentation: proc: fix section numbering in table of contents d10227f899c90 selftests/bpf: Use local type for bpf_fou_encap in test_tunnel_kern 595710e6838c3 selftests/bpf: Use local type for flow_offload_tuple_rhash in xdp_flowtable 2dfe817167af0 drm/amd/pm: remove trailing semicolon from AMDGPU_PM_POLICY_ATTR macro afea00ffcf41c dt-bindings: timer: Remove sifive,fine-ctr-bits property bc4737e55ec41 selftests/bpf: Fix off-by-one in bpf_cpumask_populate related selftest 392c03362c278 libbpf: Report error when a negative kprobe offset is specified 06dc892561f5a drm/radeon: fix memory leak in radeon_ring_restore() on lock failure d9dfa176899d4 drm/radeon: fix integer overflow in radeon_align_pitch() daf5d03ddb8cc drm/amdgpu: fix integer overflow in amdgpu_gem_align_pitch() 41a60487b5b04 drm/gpuvm: Do not prepare NULL objects 353f26c74660b drm/gpusvm: Reject VMAs with VM_IO or VM_PFNMAP when creating SVM ranges 626fa93d194db drm/tidss: Drop extra drm_mode_config_reset() call ab487bb0402af drm/rockchip: Test for imported buffers with drm_gem_is_imported() b3ec263a719e0 drm/rockchip: dw_dp: Fix null-ptr-deref in dw_dp_remove() 0d60b835bca42 drm/rockchip: dw_dp: Switch to drmm_kzalloc() 68dc52f308a17 accel/amdxdna: Fix leak when pinning ubuf pages 8e644d9a8c8dc clocksource/drivers/sun5i: Handle error returns from devm_reset_control_get_optional_exclusive() d50d320e88b4c openrisc: mm: Fix section mismatch between map_page and __set_fixmap 24186d6f9b07e fbcon: Use correct type for vc_resize() return value 6617df8c24631 fbcon: fix NULL pointer dereference for a console without vc_data 231414253b648 afs: Fix uncancelled rxrpc OOB message handler 8b4d1854295b0 afs: Fix further netns teardown to cancel the preallocation charger cc848a080f7a6 afs: handle CB.InitCallBackState3 requests without a server record 23b3d457d8387 afs: fix NULL pointer dereference in afs_get_tree() b83ecf80e28af afs: Fix netns teardown to cancel the preallocation charger 8cd8cf3052fff rxrpc: Fix double unlock in rxrpc_recvmsg() a89a13aea38ae rxrpc: Fix leak of connection from OOB challenge f9be514984471 rxrpc: Fix the reception of a reply packet before data transmission 8db6a2c95e369 rxrpc: Fix ACKALL packet handling 647e8e69c6ea3 rxrpc: Fix oob challenge leak in cleanup after notification failure 7940e5c535489 rxrpc: Fix rxrpc_rotate_tx_rotate() to check there's something to rotate 0fc5b37faec26 rxrpc: Fix potential infinite loop in rxrpc_recvmsg() 2b69b61057eb0 rxrpc: Fix leak of released call in recvmsg(MSG_PEEK) 0d643a46fdea6 rxrpc: Fix socket notification race 844b8525ce503 rxrpc: Fix UAF in rxgk_issue_challenge() 9ada3931beb37 rxrpc: Don't move a peeked OOB message onto the pending queue d3b642cf95d48 rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc 35a967ff8b24d rxrpc: serialize kernel accept preallocation with socket teardown 2ecd118fb6913 serial: 8250_omap: clear rx_running on zero-length DMA completes c37095c431c39 serial: max310x: implement gpio_chip::get_direction() d354716245192 serial: msm: Disable DMA for kernel console UART 03fd857c33456 dt-bindings: power: imx93: Add MIPI PHY power domain d97a6b4a5a4fb dt-bindings: media: sun4i-a10-video-engine: Add interconnect properties 79982331c1738 media: uvcvideo: Fix sequence number when no EOF 19cb644d0ca59 media: uvcvideo: Relax the constrains for interpolating the hw clock bf58be93c51ba media: uvcvideo: Do not add clock samples with small sof delta aed8111f2392d media: uvcvideo: Fix dev_sof filtering in hw timestamp 0f64f808fb4ee media: uvcvideo: Fix buffer sequence in frame gaps 1a9baac645769 media: uvcvideo: Avoid partial metadata buffers caf800e0cab94 media: uvcvideo: Use hw timestaming if the clock buffer is full 6b2c0cd5f9689 ALSA: hda/realtek: Fix speakers on Legion Pro 7 16ARX8H with codec SSID 17aa:38a7 2f33044aedd7a ALSA: hda: Fix cached processing coefficient verbs ae7f5b05d225c ALSA: hda: conexant: Remove mic bias threshold override 12e43f99242b0 ALSA: hda/realtek: Add quirk for TongFang X6xx45xU e0a71cbf0c190 af_unix: Drop all SCM attributes for SOCKMAP. 9b6c12e1a6be0 iommu/amd: Use maximum PPR log buffer size when SNP is enabled on Family 0x19 a4fb0954f3dc2 iommu/amd: Use maximum Event log buffer size when SNP is enabled on Family 0x19 62dde71ca2c8c exfat: preserve benign secondary entries during rename and move f3a0dd2d88e83 selftests/bpf: Add tests for stale delta leaking through id reassignment 985b8a0e52c58 selftests/bpf: Add tests for delta tracking when src_reg == dst_reg d75376fbc8563 bpf: Clear delta when clearing reg id for non-{add,sub} ops 19836e8145de9 selftests/bpf: Add a test cases for sync_linked_regs regarding zext propagation 07259d661c9d4 selftests/bpf: Add tests for improved linked register tracking 564e4ce9fb401 selftests: bpf: Add test for multiple syncs from linked register 3659deaf7bf69 media: uvcvideo: Fix deadlock if uvc_status_stop is called from async_ctrl.work c401492e01c7b crypto: sun4i-ss - Remove insecure and unused rng_alg 088ee46c18d99 nvmet-tcp: Fix potential UAF when ddgst mismatch 2ed3c9d955e8c nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path 588718101e844 iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry c646431865f4b KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU d7860b682da55 crypto: algif_skcipher - force synchronous processing de5a46f3b2c8d tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req(). e0caf7c3d49c7 smb/server: do not require delete access for non-replacing links bbf04810b2a06 nvme-pci: DMA unmap the correct regions in nvme_free_sgls 40e44eff5116d perf trace: Deal with compiler const checks 30bbd7e8999d1 perf trace: Don't change const char strings bc29e0699b35d perf diff: Constify strchr() return variables 292f32503eda3 perf list: Don't write to const memory d03adc7039c39 perf list: Signal changing const memory is ok 4283a813d7089 perf tp_pmu: Address const-correctness errors in recent glibcs 018533cfe83cf perf units: Constify variables storing the result of strchr() on const tables e7d3f92238a3d perf hwmon_pmu: Constify the variables returning bsearch() on const tables 5bcff7ce5c3b1 perf tools: Use const for variables receiving str{str,r?chr}() returns ee8ab4e8e7029 perf metricgroup: Constify variables storing the result of strchr() on const tables 8bac35a8fd98f perf trace-event: Constify variables storing the result of strchr() on const tables a816153dd8575 perf demangle-java: Constify variables storing the result of strchr() on const tables f8cb25b1d5ed2 perf session: Don't write to memory pointed to a const pointer 5f6d997641de9 perf bpf-event: Constify variables storing the result of strchr() on const tables 3b540ba9606bf perf tools: Switch printf("...%s", strerror(errno)) to printf("...%m") 659a56ba86a96 perf list: Remove unused 'sep' variable 33250aa5cfade perf jitdump: Constify variables storing the result of strchr() on const tables 972c65697792c perf time-utils: Constify variables storing the result of strchr() on const tables 9ae21594ee518 perf strlist: Remove dont_dupstr logic, used only once 110ce8fed0f8e perf strlist: Don't write to const memory Signed-off-by: Bruce Ashfield --- meta-yocto-bsp/recipes-kernel/linux/linux-yocto_6.18.bbappend | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/meta-yocto-bsp/recipes-kernel/linux/linux-yocto_6.18.bbappend b/meta-yocto-bsp/recipes-kernel/linux/linux-yocto_6.18.bbappend index 8816184..b37de5f 100644 --- a/meta-yocto-bsp/recipes-kernel/linux/linux-yocto_6.18.bbappend +++ b/meta-yocto-bsp/recipes-kernel/linux/linux-yocto_6.18.bbappend @@ -8,4 +8,4 @@ KMACHINE:genericx86 ?= "common-pc" KMACHINE:genericx86-64 ?= "common-pc-64" KBRANCH:genericarm64 ?= "v6.18/standard/genericarm64" -SRCREV_machine:genericarm64 ?= "08d2d1aaeb84ad2774df573efc336bb7ca773d40" +SRCREV_machine:genericarm64 ?= "358a6b85383d690246c3c1b53ceb711b3b2146dc" From patchwork Fri Aug 7 16:28:59 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bruce Ashfield X-Patchwork-Id: 94775 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 71DC5C5AC82 for ; Fri, 7 Aug 2026 16:29:20 +0000 (UTC) Received: from mail-qv1-f41.google.com (mail-qv1-f41.google.com [209.85.219.41]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.46461.1786120151090258742 for ; Fri, 07 Aug 2026 09:29:11 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=dQwEQBwY; spf=pass (domain: gmail.com, ip: 209.85.219.41, mailfrom: bruce.ashfield@gmail.com) Received: by mail-qv1-f41.google.com with SMTP id 6a1803df08f44-902e4af2d9dso17068906d6.0 for ; Fri, 07 Aug 2026 09:29:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786120150; x=1786724950; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=+TnA8TYBRdDq/vih9zltHoYw3LiNT4CCZgM18lBxAFk=; b=dQwEQBwYgc8OvOFFfgA0zuLTwVWdO3UyNnkvWt0A5ZUDYZ53JiPJMSdzTJS60cP6P4 gUT+e6XNjuA6/cnXPeeARZ2r8cCdv5CpdJiLtndRqJFq1mrxbRGGJkgo9p+orKYoUwZx cE5cg+bKzpbKjnxDr8+mCTWdQc8ylBmnum9XK0NeGIZDmYzDWqkw10B4qgnb+7+klG4c LYyn0xkJ5TlD4DBXBBq5kNwC0LpeGvzpGFUH0IKJXKrgydqt4ERCCGS8tXqflj9dQT2s kmawpqWlbpSBE7y2y/ra4STWB4ZsbkV0bN8qJr4RphnxmWIQY1bAobIxyJqLEATi2D8A O6GQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786120150; x=1786724950; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=+TnA8TYBRdDq/vih9zltHoYw3LiNT4CCZgM18lBxAFk=; b=jt7O0omUA35E7kfNagR2zjzIDDBV7JjXw9zMUHEHQ4iosQjDGTUQSu41PaMAe8i/uR Pa3WA3HDPd688a8XQaZ6bYgTtgEYdCtZveh6jKYZ1/M+3j6YrY5uNSwu8YOxIx5U+1/u 94XZgWd7vn/zYMyL73WhtpdlPGHKXED3+7P9n0TcrwLymWokApaiVvvg1fBSH//IMS6R zjE3LvFruFWWvA7TlDRYkkiB3XOhFShAChb1J1UtG50R8LdqrKKnADeHtuRqsl8gMWsn uHAkdBFqbYogHJOxRUaKoRD/2yG6FhsTrQY+U281HkcecJnZF7QVX2utbAmx/P79UHEU ncjQ== X-Gm-Message-State: AOJu0Yy3Elo0m4CbFrWVC4lQOsDazNPkszeez+uZFlioMV3SLbDKwQPc XhIAbPSwCOAS2S/u4OVhwSZkm5W1ijj0jYWgVMRYbi0e6sLUAQKI2VQ1PS8GM/Qx X-Gm-Gg: AR+sD139L3Pyq81OYy8ud3JJAyJYh88ZA467uIRweNZVPydEPtGv7mbdSWhA4E8DrgZ YA63Ok+o0OBR+vhGYxHuJilSv9a0+TNcvc10J0cnBAPJvlB0+MuNEvzsSpdgvWPpCJVXnwxYGM0 FIfGPKhgKuc7y3AGGheHs57ruforKJRiPWJqhkgKX5QvckeDSOopWGqFUFR+lE/gpZLN1kAy3F6 WlI2w/qCcVSvQgrqR4I1rGHdMy4yz5ZrCWaB+I9itmFbH3OOa6kokxk3hUnr6xhr+Oj0vxNDPn4 MXodQFwTPSly3BJiU7rs0+pUNUT+OdpkIaF4d3ajR0+GALb5PfakME9faqSb4W/ya1xVFM9l7Zp csEoFRXGLqeCm/eFdtLfebZPX5M2TbH37UM1p/AcQBhUE50ywExvCw4JX+k3k/zAVsumWYeIxEE /g+uxJEThgZ2M3SbcytX6uPiCwKpL1EkXlvxgPFvGJ5ZQ5z098SPg58MENwHWZ0TqNoQWjPmzhz O60FBtpPZZJ0DlupnPR2go9wSG6BBKkBsr3rwHKMQa6wwUHxmJqBJzAgh6eW4WsL4lUvlKKqCST UsnNBoqYOkg+I0Cceugxat0fd1SU0zt8SdDhcPFETIl3Z+6J/J18HJceQrV1t00oE0FGt7JwSvo Pr913bg== X-Received: by 2002:a05:6214:5f0b:b0:8ef:74ad:e62b with SMTP id 6a1803df08f44-90a34ced408mr13923396d6.7.1786120149490; Fri, 07 Aug 2026 09:29:09 -0700 (PDT) Received: from bruce-XPS-8940.localdomain (pool-174-112-62-108.cpe.net.cable.rogers.com. [174.112.62.108]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-908a92fed68sm12521756d6.31.2026.08.07.09.29.07 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 07 Aug 2026 09:29:08 -0700 (PDT) From: bruce.ashfield@gmail.com To: richard.purdie@linuxfoundation.org Cc: openembedded-core@lists.openembedded.org Subject: [meta-yocto-bsp][PATCH 04/04] yocto-bsps: update to v6.18.43 Date: Fri, 7 Aug 2026 12:28:59 -0400 Message-ID: <20260807162900.2623274-5-bruce.ashfield@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260807162900.2623274-1-bruce.ashfield@gmail.com> References: <20260807162900.2623274-1-bruce.ashfield@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 07 Aug 2026 16:29:20 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/243021 From: Bruce Ashfield Updating linux-yocto/6.18 to the latest korg -stable release that comprises the following commits: 7b923c78b50d2 Linux 6.18.43 bfe7f9993467b x86/bugs: Make Safe-RET robust against interrupt injection 856a9b51680cb Linux 6.18.42 0f33b1c457c21 KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug 846ed916cfa0c gpu: Fix uninitialized buddy for built-in drivers bcb29986bbba8 net: stmmac: fix dwmac4 transmit performance regression a0d1a11b90a51 net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query f282242906c12 usb: gadget: f_tcm: synchronize delayed set_alt with teardown aeebcfa8237c3 rust: device: avoid trailing ; in printing macros e94e820df37d4 rust: allow `suspicious_runtime_symbol_definitions` lint for Rust >= 1.98 6ce0db97fb37a mm/damon/core: disallow overlapping input ranges for damon_set_regions() 4b6f1d6d5d078 mm/damon/core: validate ranges in damon_set_regions() deead12d2e650 i3c: mipi-i3c-hci: Fix handling of shared IRQs during early initialization 811b581fae651 i3c: mipi-i3c-hci: Fix Hot-Join NACK 4fd5b33faf092 pmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI c389893bb4037 pmdomain: imx93-blk-ctrl: convert to devm_* only dc8347f263b21 net: ipa: fix SMEM state handle leaks in SMP2P init 4c1e8ccd8655e ata: libata-core: Reject an invalid concurrent positioning ranges count 9466dc5e377f0 bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline() a88c2a70ea0ad bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c c73b8795b45f4 octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF 4467fa514482b octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify ae5ae3d5bfaa6 net: mana: Optimize irq affinity for low vcpu configs 6d13eaa13341a net: mana: Validate the packet length reported by the NIC 7b7bb07efe41b fs/resctrl: Fix use-after-free during unmount d48cf914c739e fs/resctrl: Move RMID initialization to first mount 682d3c2cd20e0 fs/resctrl: Move allocation/free of closid_num_dirty_rmid[] 8c5925f0fa128 x86,fs/resctrl: Rename some L3 specific functions 696c34a1964f4 x86,fs/resctrl: Rename struct rdt_mon_domain and rdt_hw_mon_domain ad4ea2a169a48 fs/resctrl: Split L3 dependent parts out of __mon_event_count() 5b82af744e06c mmc: vub300: fix use-after-free on probe failure 73d397ab54f2a mmc: vub300: rename probe error labels 8ced1d242c34e dm: avoid leaking the caller's thread keyring via the table device file dd73cc92a55d7 cred: add kernel_cred() helper af7a4c2caa7a1 accel/amdxdna: reject command submission on devices without a submit op 62dae36be7a62 ovl: use linked upper dentry in copy-up tmpfile 043acb00e4edd dmaengine: dw-edma-pcie: Reject devices without driver data 277a035cda47d dmaengine: dw-edma: Fix confusing cleanup.h syntax 19360c25135fc mtd: maps: vmu-flash: fix fault in unaligned fixup b8271be34bce1 kho: make sure scratch size is always aligned by CMA_MIN_ALIGNMENT_BYTES 3d561f46fa784 mm/sparse-vmemmap: fix vmemmap accounting underflow 8af652cd99460 remoteproc: xlnx: Check remote core state 6fc1919a6f2ed cxl: Fix CXL_HEADERLOG_SIZE to match RAS Capability size 89b2ae039d188 cxl/pci: Remove CXL VH handling in CONFIG_PCIEAER_CXL conditional blocks from core/pci.c eeab775069920 cxl/pci: Remove unnecessary CXL RCH handling helper functions a64661dccb2eb cxl/pci: Remove unnecessary CXL Endpoint handling helper functions 5d964cb2b7bc8 SUNRPC: Return an error from xdr_buf_to_bvec() on overflow b50b2cb87e7ac SUNRPC: Add helpers to convert xdr_buf byte ranges to scatterlists a112b91dd6349 sunrpc: allocate a separate bvec array for socket sends 3120f21df3fb0 NFSD: pass nfsd_file to nfsd_iter_read() 6876f767b0490 pinctrl: renesas: rzg2l: Use -ENOTSUPP instead of -EOPNOTSUPP 7185c5262435b gpu/buddy: bail out of try_harder when alignment cannot be honoured 9634fd144cdc1 drm: drop lib from header search path. 65677f7a20c48 gpu: Move DRM buddy allocator one level up (part two) 09755dc62b026 netfilter: nf_conntrack_sip: validate skb_dst() before accessing it a1a94a00b8844 netfilter: nf_conntrack_sip: remove net variable shadowing d01c913febead netfilter: nft_fib: reject fib expression on the netdev egress hook beeda5bf78577 netfilter: nf_tables: remove register tracking infrastructure 1de827e24d0ad arm64: dts: qcom: hamoa: Fix OPP tables for all DisplayPort controllers 0d810ff7a6f65 arm64: dts: qcom: correct RBR opp entry 690fb82c4122f VDUSE: avoid leaking information to userspace 7764e9c727d58 vduse: take out allocations from vduse_dev_alloc_coherent db5c554b36d50 vduse: remove unused vaddr parameter of vduse_domain_free_coherent 82e48ad2a1326 vduse: return internal vq group struct as map token b1f38c3ec620a xfs: don't replace the wrong part of the cow fork 3bca70235a706 fuse-uring: fix race between registration and connection abortion 40879c39d6740 audit: fix recursive locking deadlock in audit_dupe_exe() 91b64f0be4163 audit: use 'unsigned int' instead of 'unsigned' eef6914f2b456 audit: widen ino fields to u64 c5772ced573ea landlock: Account all audit data allocations to user space a95b62759f3b9 landlock: Fix formatting 682a0066dde05 drm/amd/display: Fix DTB DTO updates breaking live pixel rate sources 81ea8e8221853 fscrypt: Avoid dynamic allocation in fscrypt_get_devices() 337022d9dfac4 ksmbd: validate ACE size against SID sub-authorities f1eba60db813e ksmbd: bound DACL dedup walk to copied ACEs 847ecd4eb3c11 ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL b6d3cc6a52441 ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl 17e6b8c4319fa net: qrtr: ns: Raise node count limit to 512 7dd26adf7e7d4 ublk: wait on ublk_dev_ready() instead of ub->completion 5a15eaa50f92b drm/xe/uapi: Reject coh_none PAT index for CPU_ADDR_MIRROR 5488d3a69d205 dm-verity: fix buffer overflow in FEC calculation 3f31bde63f9ae dm-verity-fec: replace {MAX,MIN}_RSN with {MIN,MAX}_ROOTS d47281b9a4472 dm-verity-fec: fix reading parity bytes split across blocks (take 3) a556189c06756 dm-verity-fec: fix the size of dm_verity_fec_io::erasures 22400725de070 bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops 15a7cb71a5748 drm/amdgpu: fix check in amdgpu_hmm_invalidate_gfx ab7b40c638e0d drm/amd/pm: fix smu13 power limit range calculation 6405c4e75b3bc drm/amdgpu: fix aperture mapping leak 08fee493e0261 drm/amdgpu: invoke pm_genpd_remove() before freeing genpd 68eab5a64ddbc drm/amdgpu: fix resource leak on ACP reset timeout ffb33d466a68c drm/amdgpu: fix division by zero with invalid uvd dimensions 8c6d84a54823c drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe() bd868c077f675 drm/amdgpu/vcn4: avoid rereading IB param length 7eebef042c12d drm/amdgpu/vce: fix integer overflow in image size f7e9eeaccca54 drm/amdgpu/soc24: reset dGPU if suspend got aborted dc3f5da1ba8e2 drm/amdgpu/sdma4.4.2: replace BUG_ON() with WARN_ON() 76c977d396f12 drm/amdgpu/jpeg: fix jpeg_v5_0_1_is_idle detection 058373af59551 drm/amdgpu/jpeg: fix jpeg_v4_0_3_is_idle detection 042c047e8bc9c drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON() 05aea3344c422 drm/amdgpu/gfx9.4.3: replace BUG_ON() with WARN_ON() f70bd5235d9ef drm/amdgpu/gfx8: drop unecessary BUG_ON() 987bedd3ea89d drm/amdgpu/gfx12: replace BUG_ON() with WARN_ON() dfd9bf09fd8fe drm/amdgpu/gfx11: replace BUG_ON() with WARN_ON() 7e22de67e545d drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON() e75f71143b68b drm/amd/pm: make pp_features read-only when scpm is enabled ada47af5c215e drm/amd/pm: fix amdgpu_pm_info power display units 7b263cf1dd4c0 watchdog: s32g_wdt: remove incorrect options in watchdog_info struct 79370b573e92e vxlan: mdb: Fix source list corruption on a failed replace f60bac115d8dc vsock/virtio: collapse receive queue under memory pressure 5f5a41a48dbf9 tipc: clear sock->sk on the failed-insert path in tipc_sk_create() 234f9ffbd9b2c tcp: challenge ACK for non-exact RST in SYN-RECEIVED fadaff3f66e12 tcp: initialize standalone TCP-AO response padding 4a4f3aa6af205 rtase: Workaround for TX hang caused by hardware packet parsing 6866abf59976d pppoe: reload header pointer after dev_hard_header() 460b9f0609d26 ovpn: hold peer before scheduling keepalive work b08526bf0bbf8 ovpn: fix peer refcount leak in TCP error paths 100a23b1613e9 openvswitch: fix GSO userspace truncation underflow f80ba170d7b3a mctp: serial: handle zero-length frames to prevent rx buffer overflow f20dedce0429b mac802154: llsec: reject frames shorter than the authentication tag 59c1d5463b7bc mac802154: hold an interface reference across the scan worker 472aba2603ca7 ila: reload IPv6 header after pskb_may_pull in checksum adjust 919d0accf2600 ice: use READ_ONCE() to access cached PHC time 5e496f2b615ce ice: reject out-of-range ptype in ice_parser_profile_init 91e0249f3ef62 gve: fix Rx queue stall on alloc failure 18705cace0619 ksmbd: defer destroy_previous_session() until after NTLM authentication 6098b55f6a0cf smb: client: handle STATUS_STOPPED_ON_SYMLINK responses without a symlink target 34f2a2f32af57 rbd: Reset positive result codes to zero in object map update path 63d78b546eefc super: fix emergency thaw deadlock on frozen block devices e4406cbdd915f ice: fix PTP Call Trace during PTP release b3efb4744abf4 ptp: ptp_s390: Add missing facility check 9a8a247f0f17b s390/ptff: Export ptff_function_mask[] 4afc58ea75b96 proc: Fix broken error paths for namespace links 4056cc19071a3 net: pcs: xpcs: fix SGMII state reading 80d977f280b4e net: hip04: fix RX buffer leak on build_skb failure a4dfd46cc8f08 net: gro: fix double aggregation of flush-marked skbs ec6d91a1bf2eb net/x25: fix use-after-free in x25_kill_by_neigh() 40f9a124ebbe0 net/mlx5e: Use sender devcom for MPV master-up 900cd6d8119b7 net/iucv: fix use-after-free of a severed iucv_path 33736ff5e7c97 net/af_iucv: fix NULL deref in afiucv_hs_callback_syn() f8c498585d2a0 geneve: require CAP_NET_ADMIN in the device netns for changelink 5d07b178bef51 net: slip: serialize receive against buffer reallocation 730c7e5fea7f0 vxlan: require CAP_NET_ADMIN in the device netns for changelink a48a889b60f73 phonet: pep: fix use-after-free in pep_get_sb() 03157872da5ed net: stmmac: intel: skip SerDes reconfig when rate is unchanged 1b44a5f584bff iommu/vt-d: Disallow SVA if page walk is not coherent 7037e7bdcd26f iomap: fix out-of-bounds bitmap_set() with zero-length range f139498c5ebdd io_uring/rw: fix missing ERESTARTSYS conversion in read paths 65bf73bee1a4f ftrace: Add global mutex to serialize trace_parser access 95376fe9c145b fscrypt: Add missing superblock check in find_or_insert_direct_key() a019b074903b3 fs: preserve ACL_DONT_CACHE state in forget_cached_acl() c78e38745ff1b fs/super: fix emergency thaw double-unlock of s_umount 89b9121c3b016 binfmt_elf_fdpic: only honour the first PT_INTERP d309f8b52b34c ASoC: fsl_sai: Fix spurious BCLK on resume by clearing BYP c4d77740eca21 ASoC: fsl: imx-card: Skip sysclk reset for active DAIs in shutdown 1a644db2cf59f amt: fix use-after-free in AMT delayed works 8f5a3abc54ba2 libceph: remove debugfs files before client teardown 3b2f1937f5fce libceph: reject zero bucket types in crush_decode e67e8b694872c libceph: Reject monmaps advertising zero monitors 0060ec912292a libceph: refresh auth->authorizer_buf{,_len} after authorizer update 4716a64b7cc27 libceph: guard missing CRUSH type name lookup 1732d89dfcd74 libceph: Fix multiplication overflow in decode_new_up_state_weight() 4e7ebfaa0d14c libceph: bound get_version reply decode to front len 7d03e08b763fd ceph: fix writeback_count leak in write_folio_nounlock() a7c2dfa610a12 ceph: fix refcount leak in ceph_readdir() a4228b93706fb ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() 3bf0e349cbb4f sctp: close UDP tunnel sockets during netns teardown be6aae9d1b91c sctp: avoid auth_enable sysctl UAF during netns teardown 85aca407c560a sctp: don't free the ASCONF's own transport in DEL-IP processing 3db217a4c2bdc mm/huge_memory: set PG_has_hwpoisoned only after new folio head is established ac7a6f61f56fe mm/kmemleak: fix checksum computation for per-cpu objects f2b2933599241 afs: Fix afs_edit_dir_remove() to get, not find, block 0 d64f6c02495f3 mptcp: pm: userspace: fix use-after-free in get_local_id 6cd3c3d631555 mptcp: only set DATA_FIN when a mapping is present 6c936b5ad557e mptcp: decrement subflows counter on failed passive join 35c4b274d4cc4 Revert "arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates" 64ab0964c7db9 arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates 9cd4b1a52eff3 arm64: make huge_ptep_get handled unaligned addresses 9025946adec9a tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err() 3b3be8653c594 tracing/probes: Fix potential underflow in LEN_OR_ZERO macro 949ac1aeb37b8 tracing/probes: Avoid temporary buffer truncation in trace_probe_match_command_args() 6b5098d745811 tracing/eprobe: Fix exact system name matching in eprobe_dyn_event_match() b6a4575f22925 tracing: Fix union collision of module and refcnt for dynamic events cf5a82bef623b tracing: Fix resource leak on mmiotrace trace_pipe close 8464427e1c177 tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev 1f2e7cd0ff976 tracing: Fix context switch counter truncation 1da310b94504d misc: nsm: pin the module while the device is open 8f068342096b0 misc: nsm: only unlock nsm_dev on post-lock error paths caba30eb8bd32 intel_th: fix MSC output device reference leak 59dd34854202d mei: bus: access mei_device under device_lock on cleanup 5118872357279 selftests: ntsync: correct CONFIG_NTSYNC name b2a3eeb57ba24 serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms 4fae473b856b4 serial: sc16is7xx: implement gpio get_direction() callback 635be8b097f0c uio_hv_generic: Bind to FCopy device by default cf26dd2d84158 comedi: comedi_parport: deal with premature interrupt 9bb71b59e0aa3 x86/boot/compressed: Disable jump tables 4f2db41a09eba firmware: stratix10-svc: fix memory leaks and list corruption bugs 3ff7c1dbf722c rhashtable: clear stale iter->p on table restart d43c5c0c93552 cdrom: fix stack out-of-bounds read in CDROMVOLCTRL 4427a33faabb4 LoongArch: Retrieve CPU package ID from PPTT when available 38b025fcdc45b LoongArch: Move jump_label_init() before parse_early_param() 6ab0abb5a2e0c LoongArch: Fix oops during single-step debugging a94d6726ec868 LoongArch: Fix address space mismatch in kexec command line lookup c404b1f30b252 objtool/rust: add one more `noreturn` Rust function for Rust 1.99.0 8ccfb3b315a0e rust: allow `clippy::unwrap_or_default` globally 6db0c42c87c46 rust: time: fix as_micros_ceil() to round correctly for negative Delta 12be1d75e9b29 rust_binder: only print failure if error has source cc3bbff10b1a7 platform/loongarch: laptop: Explicitly reset bl_powered state when suspend 1cd4e9b7967da binfmt_misc: set have_execfd only once the interpreter is opened 2bc6bf70d4105 exec: fix unsigned loop counter wrap in transfer_args_to_stack() 780b04d09c941 Bluetooth: RFCOMM: Fix session UAF in set_termios a42f5536ea9c0 Bluetooth: hci_sync: Protect UUID list traversal 91eff666c9078 staging: rtl8723bs: fix inverted HT40 secondary channel offset 875479f18835a staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie() 0dbaff14fd6a8 wifi: ath11k: fix refcount leak in ath11k_ahb_fw_resources_init() efe9de178e4b9 wifi: brcmfmac: set F2 blocksize to 256 for BCM43752 044fca8f45ba9 wifi: brcmfmac: make release_scratchbuffers idempotent 9cb72f67e1502 wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses 263816e92e8d6 wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses ab4d213393e84 wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses e511e93abd6ee wifi: wilc1000: validate assoc response length before subtracting header 9375a4ea41216 wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper 18965470d41e6 wifi: ath6kl: fix use-after-free in aggr_reset_state() 58c6c8dc2e022 wifi: ath6kl: fix OOB access from firmware ADDBA window size 1395327a96614 ALSA: timer: don't re-enter an instance callback that is still running 426c0ff1c433d ALSA: timer: drain a slave's callback before its master detaches it 3bc4de57fc7d1 ALSA: hda: codecs: hdmi: disable keep-alive before audio format change 6a10025c7fd09 ALSA: seq: close a re-opened queue timer in the destructor 2ec8f95a08fed ALSA: hda/realtek: Fix speakers on Lunnen Ground 14 4091b216d11b3 media: vpif_capture: fix OF node reference imbalance 1349af7f87df5 media: vivid: fix cleanup bugs in vivid_init() 492c97cb50fea media: vivid: check for vb2_is_busy() when toggling caps 26e7a8ac286f3 media: vivid: add vivid_update_reduced_fps() 3780ad3810718 media: vimc: fix reference leak on failed device registration 86ece01fba2d5 media: vidtv: fix reference leak on failed device registration 16ae8c166e787 media: verisilicon: Export only needed pixels formats b88c929188e3c media: vb2: use ssize_t for vb2_read/vb2_write 072a883061a46 media: v4l2-subdev: Fail {enable,disable}_streams and s_streaming nicely cf9732fd6c4f2 media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor() 3068ab802fc98 media: v4l2-ctrls: validate HEVC active reference counts 836cfffb2ddbb media: v4l2-ctrls-request: add NULL check in v4l2_ctrl_request_complete() 7e6521dd747ec media: ti: vpe: unwind v4l2 device registration on probe error 127fc44e83256 media: tegra-video: vi: fix invalid u32 return value in format lookup 118c2f5d1d363 media: synopsys: hdmirx: Fix HPD lane hold time b5184b3f0e9d4 media: sun4i-csi: Return queued buffers on start_streaming() failure 931abe1deb65b media: stm32: dcmi: unregister notifier on probe failure ed342a86bb2f9 media: stm32-dcmipp: Return queued buffers on start_streaming() failure b7936e8cbec1b media: saa7134: Fix a possible memory leak in saa7134_video_init1 a7a141e4e93c8 media: rzg2l-cru: Skip ICnMC configuration when ICnSVC is used 894e83509c669 media: rtl2832_sdr: Return queued buffers on start_streaming() failure 2c71bda6edc63 media: rtl2832: fix use-after-free in rtl2832_remove() 64cb15878b35e media: radio-si476x: Unregister v4l2_device on probe failure a58d01a0ed397 media: qcom: camss: Fix RDI streaming for CSID GEN3 c39a1d9fde82b media: qcom: camss: Fix RDI streaming for CSID GEN2 4e451100b35ee media: qcom: camss: Fix RDI streaming for CSID 680 cb16b79a2be2c media: pwc: Return queued buffers on start_streaming() failure 9afd605dcd96c media: pwc: Drain fill_buf on start_streaming() failure 08ddfd628a2db media: pci: dm1105: Free allocated workqueue 4e077bcb5e1f6 media: nxp: imx8-isi: Fix scale factor calculation for hardware rounding 28ae75dba701d media: nxp: imx8-isi: Fix potential out-of-bounds issues 659a7cea0be80 media: nxp: imx8-isi: Fix missing v4l2_subdev_cleanup() in pipe init error path 4702afbd56f1d media: nxp: imx8-isi: Clean up already-initialized pipes on probe failure 9e61258fbc3cf media: nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and pipe 181a0aeefd56f media: nuvoton: npcm-video: fix memory leaks in probe and remove 2147acb948a94 media: nuvoton: npcm-video: fix error handling in npcm_video_init() 264b5380c4f8a media: msi2500: Return queued buffers on start_streaming() failure 1391b75bf0119 media: meson: vdec: Fix memory leak in error path of vdec_open 18e3b838e09d7 media: marvell-cam: fix missing pci_disable_device() on remove cf48e9db85652 media: iris: Fix use IRQF_NO_AUTOEN when requesting the IRQ d56044558a757 media: intel/ipu6: Improve DWC PHY HSFREQRANGE band selection for overlapping ranges 00a98fb2a6fb2 media: imx219: Fix maximum frame length in lines 7337c88205ed0 media: i2c: alvium: fix critical pointer access in alvium_ctrl_init c68c4ce72feb6 media: cx23885: add ioremap return check and cleanup f468b7ee5d633 media: cx231xx: fix devres lifetime f24ca8b53fe15 media: chips-media: wave5: Move src_buf Removal to finish_encode 9924cb548ee77 media: cedrus: skip invalid H.264 reference list entries 000e51afb6068 media: cedrus: Fix missing cleanup in error path 73504935e4365 media: cedrus: clean up media device on probe failure 6efe665356ec8 media: cec: seco: unregister adapter on IR probe failure 0459a4304cff8 media: aspeed: fix missing of_reserved_mem_device_release() on probe failure 391fe3e36e59f media: amlogic-c3: Add validations for ae and awb config 73bd277986537 media: airspy: Return queued buffers on start_streaming() failure a096a6aba6011 drm/v3d: Reach the GMP through the hub registers on V3D 7.x a2212fef8e187 drm/gpusvm: Fix MM reference leak in drm_gpusvm_range_evict 6deaa31720185 drm/vc4: Prevent shader BO mappings from becoming writable b1379f0c42b88 drm/vmwgfx: Validate vmw_surface_metadata::array_size 2b85e19792be4 drm/amd/display: Fix missing DCE check in dm_gpureset_toggle_interrupts() a38f2724eb93a drm/vc4: Shut down BO cache timer before teardown ee44ea4f7e309 drm/amd/display: Fix flip-done timeouts on mode1 reset ba7b6444097a7 drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved fd2de80f28a07 drm/amdgpu: Disable PCIe dynamic speed switching on Ryzen Pinnacle Ridge 490ceacd2162d drm/amd/display: Fix backlight max_brightness to match exported range 9c0432044d34b drm/amd/display: Force PWM backlight on Lenovo Legion 5 15ARH05 51ea665c30c42 drm/amd/display: dce100: skip non-DP stream encoders for DP MST 0b9fa4272e24b drm/amd/display: consolidate DCN vblank/flip handling onto vupdate_no_lock 679f23f0a3606 drm/amd/display: set new_stream to NULL after release 123692ebc1ea7 drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X) d8dc3a9e815d6 drm/amdgpu: Fix VFCT bus number matching with soft filter 312278b309191 drm/amdgpu: Release VFCT ACPI table reference e64b2f1e826af drm/panthor: return error on truncated firmware 22aa7fb4e7d0b drm/ttm: Account for NULL and handle pages in ttm_pool_backup b2d8b66c67393 drm/virtio: Don't detach GEM from a non-created context a4a1866d50c49 drm/gfx10: Program DB_RING_CONTROL e163c5a0946de drm/amd/pm: fix smu14 power limit range calculation e3bcd3bf7eeca drm/i915/mst: limit DP MST ESI service loop 726f27bca93e6 drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU 37951ce1567cc drm/i915/gem: Do not leak siblings[] on proto context error 1173190412fb9 drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() 5df5a59c32b46 drm/amd/amdgpu: disable ASPM on VI if pcie dpm is disabled 8b2da44446f9d drm/i915/bios: range check LFP Data Block panel_type2 cbec6a57959ab drm/i915: Return NULL on error in active_instance d20b5c139b290 drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON() 09da54636bac1 drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON() 51fd520871651 drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON() 4c09483325360 drm/amdgpu/sdma7.0: replace BUG_ON() with WARN_ON() 3d2ef8d389495 drm/i915/hdcp: check streams[] bounds before overflow 1f876bd8adc79 drm/i915/hdcp: require monotonically increasing seq_num_v 35be0e2c6862a drm/virtio: bound EDID block reads to the response buffer 4ee77643e6194 drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink reference 8a77ccf9cb992 drm/amd/display: Handle struct drm_plane_state.ignore_damage_clips abce3276c57e3 drm/amdkfd: fix 32-bit overflow in CWSR total size calculation fd1691ec62701 drm/amdkfd: Check bounds on CRIU restore queue type and mqd size 50319efb865f7 drm/amdkfd: Check bounds in allocate_event_notification_slot 14a631dca9df0 drm/amdkfd: Use kvcalloc to allocate arrays 6253bb56bb2eb drm/imagination: acquire vm_ctx->lock before mapping memory to GPU VM c45fafa69fe3f drm/imagination: fix error checking of pvr_vm_context_lookup() b983a35dad370 drm/imagination: Fix user array stride in pvr_set_uobj_array() c88fdbf3da26e drm/imagination: Fix double call to drm_sched_entity_fini() c1954c66662de drm/xe: Hold a dma-buf reference for imported BOs 038d0b80ab778 drm/xe: Fix PTE index in xe_vm_populate_pgtable() for chunked binds 90a8a938e0cae drm/xe: Return error on non-migratable faults requiring devmem 3e1f909556aa6 drm/radeon: fix r100_copy_blit for large BOs fbb9effc81683 drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit() 45db277b2e1e3 drm/i915/gem: Add missing nospec on parallel submit slot 748d425e53c31 drm/displayid: fix Tiled Display Topology ID size 5452eb5c16630 drm/sysfb: Return errno code from drm_sysfb_get_visible_size() 154795885e8f0 drm/sysfb: Avoid possible truncation with calculating visible size 4e109faa9ea2b drm/nouveau: fix reversed error cleanup order in ucopy functions 315d2e5741a81 drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1 3fb10ec43c25a drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT 9c2b01508831b drm/amdgpu/gfx9: Fix Ring and IB test fail after mode2 f835eda74cf65 drm/sysfb: Avoid truncating maximum stride 7daefc6d51952 drm/sysfb: Do not page-align visible size of the framebuffer ddba17b3dfa0e drm/amdgpu: check amdgpu_vm_bo_find() result in GET_MAPPING_INFO d068a2f53afc8 drm/amdgpu/uvd: Place VCPU BO only in VRAM for UVD 4.x and older b3a01cda0ae16 drm/amdgpu/uvd: Fix forcing MSG, FB BOs into VCPU segment when it isn't at 0 (v2) e28420e36542a drm/amdgpu/gfx: fix cleaner shader IB buffer overflow d5c70523cafa2 drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers e2c29d51c0f65 drm/imagination: Fit paired fragment job in the correct CCCB 1e5827839ad0c drm/dp/mst: fix buffer overflows in sideband chunk accumulation 533d9e2bede4a drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers c0384d6872f4d drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS() 943fa73ea0efa drm/imagination: Count paired job fence as dependency in prepare_job() 6ab29a8683572 drm/rockchip: analogix_dp: Add missing error check for platform_get_resource() 50cd8a7e98dd2 drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video() 86ab4d93b3d47 drm/tidss: Fix missing drm_bridge_add() call 300a2d970a535 drm: renesas: rzg2l_mipi_dsi: Move rzg2l_mipi_dsi_set_display_timing() aa8ad3e0d1fe9 drm: renesas: rzg2l_mipi_dsi: Increase reset deassertion delay 786d690257ec7 bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() 3a924139cf526 net: airoha: fix ETS channel derivation in airoha_tc_setup_qdisc_ets() 391a23c503856 mctp: check register_netdevice_notifier() error in mctp_device_init() 74ecebfbf1555 ptp: netc: explicitly clear TMR_OFF during initialization 16df2d154ec82 rds: tcp: unregister sysctl before tearing down listen socket 1db34097998cc ipv6: Change allocation flags to match rcu_read_lock section requirements 684d4d0bda95a ice: prevent tstamp ring allocation for non-PF VSI types a32604e8d9e2c ice: fix LAG recipe to profile association 3a81345467674 ice: allow creating VFs when !CONFIG_ICE_SWITCHDEV 5d54d603cf3e9 net: ipv6: fix dif and sdif mismatch in raw6_icmp_error e60e6009d3bae octeontx2-pf: tc: fix egress ratelimiting d612754a515cb net/mlx5e: Reject unsupported CB Shaper TSA in ETS validation a7e430349fc5e net/mlx5e: Report zero bandwidth for non-ETS traffic classes cdddc8188db46 net/mlx5: E-Switch, fix zero num_dest in prio_tag egress vlan rule 87b39a8c875ca net/mlx5: Fix MCIA register buffer overflow on 32 dword reads 5f2ef3d53d374 net/mlx5: Refactor EEPROM query error handling to return status separately 953d47cfe529a raw: annotate lockless match fields in raw_v4_match() 8150c48fb978e net: qrtr: restrict socket creation to the initial network namespace 0d57d43d7c4c6 hinic: remove unused ethtool RSS user configuration buffers 8fc45a2a7cc24 ppp: annotate data races in ppp_generic 19fe119dfa93f ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup e037a41938c69 octeontx2-vf: set TC flower flag on MCAM entry allocation 15a1c5f2ed2ee net: gre: fix lltx regression for GRE tunnels with SEQ/CSUM 55515c1b1285a net: stmmac: enable the MAC on link up for all supported speeds 1bcb737fb884d net: stmmac: reset residual action in L3L4 filters on delete 370dde2b70e58 net: stmmac: fix l3l4 filter rejecting unsupported offload requests 55d2a8d184e24 net: stmmac: xgmac: fix l4 filter port overwrite on register update 40413da850363 net: stmmac: cores: remove many xxx_SHIFT definitions 4a3eea468a041 net: stmmac: socfpga: Add hardware supported cross-timestamp 01d45e6b2c500 net: stmmac: socfpga: Enable TBS support for Agilex5 dac8c2ab943a2 net: stmmac: socfpga: Agilex5 EMAC platform configuration d67136a931e5f net: stmmac: remove xstats.pcs_* members 9f27c4f0ae35b bpf: tcp: fix double sock release on batch realloc b43bb9ab60035 drm/tests: shmem: Set DMA mask to 64-bit in drm_gem_shmem 1b8fb5a20508b tipc: fix u16 MTU truncation in media and bearer MTU validation c8e4b2a567efb iomap: correct the range of a partial dirty clear 279339aa8bdcf drm/xe/vm: Fix SVM leak on resv obj alloc failure in xe_vm_create() d18d9b2c29a12 drm/xe/i2c: Allow per domain unique id 4fdb0f162ccdb vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets 18957373920ca sctp: auth: verify auth requirement when auth_chunk is NULL ae0ec759865e0 net: dpaa: fix mode setting b5ded444621b6 net: hsr: fix memory leak on slave unregistration by removing synced VLANs 17bb59682b8e6 net: bridge: vlan: fix vlan range dumps starting with pvid 0a347ca1d6a2e amt: make the head writable before rewriting the L2 header ca0e8b661957f amt: re-read skb header pointers after every pull 9ec22c8113d8c ovl: check access to copy_file_range source with src mounter creds 31f5f7c959c3e ovl: port ovl_copyfile() to cred guard cde234a493f6d ovl: add override_creds cleanup guard extension for overlayfs 35f0b504394e0 cred: add scoped_with_kernel_creds() 3139b806923b1 drm/panel: s6e3ha8: fix unmet dependency on DRM_DISPLAY_HELPER 790da254031cc ovl: fix trusted xattr escape prefix matching 00ebbf030d8c4 wifi: brcmfmac: fix 802.1X-SHA256 call trace warning d5628f39fccc1 wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht() 95b0cf02731c7 wifi: mt76: mt7925: fix crash in reset link replay d14238523ca4c wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap() 313343ab8cab7 wifi: mt76: mt7925: fix possible NULL-pointer deref in mt7925_mcu_bss_he_tlv() c058786b09cfa wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv() 871549814eb4d wifi: mt76: mt7915: guard HE capability lookups f1ee53e08fdd2 wifi: mt76: mt7925: guard link STA in decap offload cc4d2f8b984c2 ppp: annotate concurrent dev->stats accesses b52ff80948d1c ppp: don't store tx skb in the fastpath cb9d3e0b55699 ppp: enable TX scatter-gather e740e90ca8e7f tipc: fix infinite loop in __tipc_nl_compat_dumpit d536bf205c71f nexthop: initialize extack in nh_res_bucket_migrate() 961e9b1e33445 gtp: check skb_pull_data() return in gtp1u_send_echo_resp() 023c5e0d0294a selftests: drv-net: increase timeout fa065685c8a91 selftests: ovpn: increase timeout e2b3d426c7ee5 selftests: ovpn: add IPV6 and VETH configs 69eab5c4d9aa6 selftests: openvswitch: add config file 340c389fd3d5d selftests: af_unix: add USER_NS config fbd91910c5025 tls: device: push pending open record on splice EOF a8bd8c109da5a net: mctp i3c: clean up notifier and buses if driver register fails 1a10fe1aa9c01 sctp: validate stream count in sctp_process_strreset_inreq() c984a4184f810 pds_core: check for workqueue allocation failure cf0ed2ba202f5 pds_core: fix auxiliary device add/del races 0e87fe52b560f pds_core: order completion reads after the ownership check 3a831f40e88d3 pds_core: yield the CPU while waiting for the adminq to drain 9e0f80fac50ab pds_core: fix use-after-free on workqueue during remove 19ef775c91c6b pds_core: fix deadlock between reset thread and remove 11092d79eb2b7 sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid 2d34421bfa261 net: txgbe: fix FDIR filter leak on remove 245bfe72a5ad4 net: Call net_enable_timestamp() before failure in sk_clone(). 4122792923312 soreuseport: Clear sk_reuseport_cb before failure in sk_clone(). f97d199287689 amd-xgbe: fix MAC_AUTO_SW handling in CL37 AN e695cb9becbbb arm64: Correct value returned by ESR_ELx_FSC_ADDRSZ_nL() f5b8b8ccf9a4a pds_core: reject component parameter in legacy firmware update b5fcd1da05622 wifi: mac80211: recalculate TIM when a station enters power save d06fea9b85f03 iommu/intel: Fix out-of-bounds memset in dmar_latency_disable() e5ebe8544df1a iommu/amd: Bound the early ACPI HID map d21464d93f8ba wifi: mwifiex: bound uAP association event IEs to the event buffer a0980682d84d2 vhost-net: fix TX stall when vhost owns virtio-net header 59cbe6cfa0fa2 wan: wanxl: Only reset hardware after BAR mapping 3b1d4fc3b73ea nfp: Check resource mutex allocation 0f7eaeb950adb wifi: mac80211: tear down new links on vif update error path d053eb7e09e10 iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() 76fc5604308a1 net: airoha: Fix DMA direction for NPU mailbox buffer f112df0744e2d dpaa2-eth: put MAC endpoint device on disconnect 46e3bed4b0710 net: airoha: Fix potential use-after-free in airoha_ppe_deinit() 26ac2d3602347 dpaa2-switch: put MAC endpoint device on disconnect c9165e199f569 rxrpc: fix io_thread race in rxrpc_wake_up_io_thread() b78547914bee5 gtp: parse extension headers before reading inner protocol 9591042533140 rds: drop incoming messages that cross network namespace boundaries 992dce02bdabb bonding: fix devconf_all NULL dereference when IPv6 is disabled 1bc55c29cd858 net/packet: avoid fanout hook re-registration after unregister 9f4f75df77c89 netlink: specs: rt-link: convert bridge port flag attributes to u8 4264dbc84ca0a net: phy: marvell: fix return code 8881daaafadbe Bluetooth: btusb: validate Realtek vendor event length 9d208de7a8f64 regulator: mt6358: use regmap helper to read fixed LDO calibration 538d862cc0dbd hwmon: occ: validate poll response sensor blocks 2f0f661998941 ovpn: use monotonic clock for peer keepalive timeouts 5b96227c0e8b2 ovpn: fix use after free in unlock_ovpn() 47cd68e050a63 selftests/net: ovpn: fix getaddrinfo memory leak in ovpn_parse_remote() c5bf6b39be235 ovpn: avoid putting unrelated P2P peer on socket release 2fdd6d196c656 smb: client: validate DFS referral PathConsumed d6959dd79088a hwmon: (asus-ec-sensors) add missed handle for ENOMEM dd6f730be95b5 hwmon: (asus-ec-sensors) fix EC read intervals 22e449c1dd543 hwmon: (asus-ec-sensors) fix looping over banks while reading from EC d5913f97b5b60 drivers/virt: pkvm: Fix end calculation in mmio_guard_ioremap_hook() d0a57f19fe286 usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect 2d5dec517b539 wifi: iwlwifi: mvm: fix read in wake packet notification handler eae7fdf7d4469 wifi: iwlwifi: validate payload length in iwl_pnvm_complete_fn 70a6de303c9b3 wifi: iwlwifi: fix pointer arithmetic in iwl_add_mcc_to_tas_block_list a076b0c457c71 wifi: iwlwifi: mvm: validate SAR GEO response payload size cdf895bfd8035 ASoC: cs35l56: Use complete_all() to signal init_completion 3c26e8bb14cc6 ASoC: cs35l56: Fix potential probe() deadlock 1ddb3e0e502a1 ASoC: cs35l56: Don't use devres to unregister component 9153fa1ee99bf ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI 08433c71f1598 ALSA: hda: cs35l41: validate and free ACPI mute object eca9fcf9f5d89 ASoC: sun4i-codec: Set quirks.playback_only for H616 codec 41ae2b7d37c3d ASoC: tas2781: bound firmware description string parsing 797dc567146c7 btrfs: free mapping node on duplicate reloc root insert 9304713b70e7e btrfs: don't propagate EXTENT_FLAG_LOGGING to split extent maps 39f196f64bd38 btrfs: fix u32 to s64 type conversion in dirty_metadata_bytes accounting f49ff44831d52 btrfs: declare btrfs_ioctl_search_args_v2::buf as __u8 4503829843353 wifi: carl9170: fix buffer overflow in rx_stream failover path fab6ff91d5b8c wifi: carl9170: fix OOB read from off-by-two in TX status handler 9aee949c68dc6 wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read 33b5342d20806 wifi: ath6kl: fix OOB read from firmware IE lengths in connect event eb636fbc44314 wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler 0177e578d7a88 firewire: net: Fix fragmented datagram reassembly 51516fda914cc wifi: ath12k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET 9a9b0ea72d8b9 wifi: ath11k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET a154ca3c441a6 wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() 8681e5addf717 watchdog: airoha: Prevent division by zero when clock frequency is zero 7d1658b066de3 watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() 305c23993e43d hwmon: (nzxt-kraken3) Stop device IO before calling hid_hw_stop 205cff797a947 hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop f36e12cc8cfe9 hwmon: (gigabyte_waterforce) Stop device IO before calling hid_hw_stop 56d2deb644837 hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop ec477af3a7e8d hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop e5394605f9a98 wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin 48a69cedde738 wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request 593072aae7fc8 selftests/bpf: Keep verifier_map_ptr exercising ops pointer access 938bcf99f53e8 selftests/bpf: Adjust verifier_map_ptr for the map's excl field fe7892d46921e usb: xhci-pci: Limit VIA VL805 DMA addressing to 36 bits 958624d638603 Revert "drm/amd/display: Add missing kdoc for ALLM parameters" 03eb7a8099474 RISC-V: KVM: Serialize virtual interrupt pending state updates 731acda5ba777 wifi: mwifiex: fix freeze for 60 seconds caused by request_firmware 0905b3ce1deb7 usb: typec: ucsi: Add duplicate detection to nvidia registration path fe8cde072293c usb: typec: ucsi: Detect and skip duplicate altmodes from buggy firmware 67d2626827e3c USB: serial: option: add TDTECH MT5710-CN 601f75671b8fb USB: serial: keyspan_pda: fix data loss on receive throttling cbe00048b69d6 USB: serial: io_edgeport: cap received transmit credits c1611c6744e3a USB: serial: ftdi_sio: add support for E+H FXA291 1f03658f3e9b2 usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer dcf3e2f164435 usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown 40c706a0224bd usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() 12b3edca90d4d USB: gadget: fsl-udc: fix dev_printk() device 66956a5a4258c USB: gadget: fsl-udc: fix device name leak on probe failure e5ecfb7767526 USB: gadget: snps-udc: fix device name leak on probe failure 4cde0b38cc0cb usb: gadget: printer: fix infinite loop in printer_read() f45089eaad0a0 usb: gadget: f_midi: cancel pending IN work before freeing the midi object e239ea91b4818 usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback ace1a0adfc786 usb: chipidea: fix usage_count leak when autosuspend_delay is negative 8eca14198c202 USB: storage: add NO_ATA_1X quirk for Longmai USB Key 0950ac52426b0 usb: musb: omap2430: Do not put borrowed of_node in probe 7714fb896ed30 usb: core: port: Deattach Type-C connector on component unbind fb1b50ab69921 wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() 217774e143d7b usb: core: sysfs: add lock to bos_descriptors_read() 5f6e7b32bd1fb mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n a8d20ba0ab518 sctp: fix auth_hmacs array size in struct sctp_cookie fed1b1ddab41a net/sched: act_tunnel_key: Defer dst_release to RCU callback 51c2fcc4cd2e4 dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() e666af5dcc905 tcp: fix TIME_WAIT socket reference leak on PSP policy failure 6875ee2bef48f accel/amdxdna: Fix use-after-free of mm_struct in job scheduler f6b522033bc83 drm/i915/selftests: Fix GT PM sort comparators c23abdb922c39 drm/i915/wm: clear the plane ddb_y entries on plane disable f0e337e7db67c ksmbd: validate compound request size before reading StructureSize2 6ecb252efa0b4 ksmbd: pin conn during async oplock break notification 5e5f298d0af64 drm/xe/wopcm: fix WOPCM size for LNL+ 35ba43b541117 drm/xe/vf: Fix VF CCS attach/detach race with in-flight BO moves c1b19d8556265 drm/xe/vf: Shadow buffer management for CCS read/write operations bf293b5bcff41 drm/xe/sa: Shadow buffer support in the sub-allocator pool 65129a03a8018 drm/xe: Allow the caller to pass guc_buf_cache size cfb66ad4aa8e5 can: j1939: fix lockless local-destination check 3f398d45f3c75 riscv: hwprobe: Avoid uninitialized read in hwprobe_get_cpus() 1d9a2f01b3c4e s390/checksum: Fix csum_partial() without vector facility 5b06cf93341fe drm/panthor: Check debugfs GEM lock initialization 250474c69bc3f bpf, sockmap: Reject unhashed UDP sockets on sockmap update c3e61df6fabca powerpc/vtime: Initialize starttime at boot for native accounting 5c3a1cede86fd powerpc/time: Prepare to stop elapsing in dynticks-idle c1bbd0a6906b8 powerpc/85xx: Add fsl,ifc to common device ids 00ba4bf879824 can: raw: add locking for raw flags bitfield 479425744b219 drm/i915/gt: use correct selftest config symbol 7e08ab7a061b1 smb/client: handle overlapping allocated ranges in fallocate cefb44c367b2b Bluetooth: hci_qca: Clear memdump state on invalid dump size d5b3b484b62bb Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds ca58ad287bfc5 Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync 83b7e67698d0b Bluetooth: hci_sync: extend conn_hash lookup critical sections 57059ff14d81d Bluetooth: MGMT: revalidate LOAD_CONN_PARAM queued update a087ed960fce5 Bluetooth: qca: fix NVM tag length underflow in TLV parser f4e23e661a259 ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC b133f007ba02c accel/ivpu: Fix wrong register read in LNL failure diagnostics 1842d45f461a7 ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning d28920db56960 ata: sata_dwc_460ex: fix clear_interrupt_bit() clearing all pending interrupts 678d874e6ae11 ata: sata_dwc_460ex: use platform_get_irq() daa80b422ed92 ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered c7a1509123720 scsi: core: wake eh reliably when using scsi_schedule_eh 2c77ed279c4bb udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf() c75a950e77356 net/iucv: take a reference on the socket found in afiucv_hs_rcv() cb8be318b4432 ipv4: fib: free fib_alias with kfree_rcu() on insert error path c9574b8a8edeb ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF 88f87cb4b52ed cpufreq: Make cpufreq_update_pressure() fall back to cpuinfo.max_freq 640a33e77f91b firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context fb343716fad46 ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup 7f2cb99eaf53c ASoC: cs42l43: Correct report for forced microphone jack 9f393d8160435 ASoC: amd: ps: replace bitwise OR with logical OR in IRQ return check 3b2d32f528152 ASoC: amd: ps: fix wrong ACP version string in pci_request_regions() f33ad19e3e3d6 ASoC: amd: ps: disable MSI on resume in ACP PCI driver 4801f6690f984 ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop b39b08e6bee81 firmware: arm_ffa: Fix Endpoint Memory Access Descriptor offset calculation cf5708c9d78c9 firmware: arm_ffa: Fix out-of-bound writes in ffa_setup_and_transmit() 11ac7a5e75f51 wifi: cfg80211: bound element ID read when checking non-inheritance 5c342437ea44b wifi: brcmfmac: initialize SDIO data work before cleanup a424985c3ef2a wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock 44eda4a8d1dcd wifi: mac80211: avoid non-S1G AID fallback for S1G assoc fbaa8c31ef940 wifi: cfg80211: reject unsupported PMSR FTM location requests cfbda103aeae6 wifi: cfg80211: validate PMSR FTM preamble range 0caf6416bfbb3 wifi: cfg80211: validate PMSR measurement type data 0b6efde0ed970 wifi: nl80211: constrain MBSSID TX link ID range f8c547e543e12 wifi: nl80211: validate nested MBSSID IE blobs f649dc9c5e657 wifi: cfg80211: derive S1G beacon TSF from S1G fields fb052a6e2fa86 wifi: nl80211: free RNR data on MBSSID mismatch 133684982dd0c wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock d38f5d868a0a4 wifi: p54: validate RX frame length in p54_rx_eeprom_readback() 2aa1789880fa5 wifi: mac80211: defer link RX stats percpu free to RCU 6cda91bbb8dc3 wifi: libertas: fix memory leak in helper_firmware_cb() 5baaa1042f71d wifi: mac80211: fix fils_discovery double free on alloc failure d62b55b7c7dc6 wifi: mac80211: fix unsol_bcast_probe_resp double free on alloc failure 6dc76371a9a36 wifi: mac80211_hwsim: clamp virtio RX length before skb_put e67dc2b8d5ac4 wifi: cfg80211: Fix an error handling path in cfg80211_wext_siwscan() f442e581a8893 wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one() 9293574ac208d wifi: cfg80211: cancel sched scan results work on unregister 7acc5ed2f3360 xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert ff636d7b7cba6 xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() d8aaf06b29f5a xfrm: iptfs: propagate SKBFL_SHARED_FRAG in iptfs_skb_add_frags() 9845a35986a65 xfrm: clear mode callbacks after failed mode setup 9e632a70f2044 RDMA/irdma: Prevent overflows in memory contiguity checks 124382a2a9756 selftests/alsa: Fix memory leak in find_controls error path f98ae09c727dc mtd: fix double free and WARN_ON in add_mtd_device() error paths fcc9d50022bcd RDMA/siw: publish QP after initialization e221dde026af2 RDMA/hns: Fix potential integer overflow in mhop hem cleanup d842ef03d9145 RDMA/mana_ib: initialize err for empty send WR lists 14e519f93a48c RDMA/erdma: initialize ret for empty receive WR lists ec675b4cdfd37 RDMA/irdma: Prevent user-triggered null deref on QP create 1cd56258fe1a0 RDMA/irdma: Remove redundant legacy_mode checks ca1c29f05274b RDMA/irdma: Prevent rereg_mr for non-mem regions dbb945b80a3a4 RDMA/umem: Add pinned revocable dmabuf import interface c4ef25de94d73 RDMA/cma: Fix hardware address comparison length in netevent callback d7fc6f351c478 xfrm: reject optional IPTFS templates in outbound policies 2907e9d0f05b5 sched_ext: Don't warn on core-sched forced idle in put_prev_task_scx() 57acd51928333 sched/ext: Avoid null ptr traversal when ->put_prev_task() is called with NULL next 996c5c19d5b5a firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() 8edc925251780 btrfs: fallback to transaction csum tree on a commit root csum miss a84ca16ce07e7 btrfs: use bool type for btrfs_path members used as booleans 60a23d4ea169e btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() 5e1b2ca6b3493 btrfs: reject free space cache with more entries than pages 0ac9c7d9ccfd7 mtd: nand: mtk-ecc: stop on ECC idle timeouts fdb53a9b26071 mtd: mtdswap: remove debugfs stats file on teardown 98d2d468b4faa IB/mad: Drop unmatched RMPP responses before reassembly 59114e0ff6e3a firmware: arm_ffa: Respect firmware advertised RX/TX buffer size limits 33e1b0d25ca0d xfrm: fix stale skb->prev after async crypto steals a GSO segment eae16fbc7ce20 xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() 23bbb9eafec7a net: plumb drop reasons to __dev_queue_xmit() 4cc4d6fb08e75 net: dropreason: add SKB_DROP_REASON_RECURSION_LIMIT 4c22b4e3ff502 arm64: tegra: Fix CPU compatible string to cortex-a78ae on Tegra234 0b9858484d096 arm64: tegra: Remove fallback compatible for GPCDMA 903f2edc04770 fuse: fix writeback array overflow when max_pages is one afe9cda0862aa Input: ims-pcu - fix logic error in packet reset d03a740e087de Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() 6cbed4be9a6ca xprtrdma: Clear receive-side ownership pointers on release 0892b427c4b8b crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin 5f4de3c717d34 gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings ec9f66c91bffd dmaengine: sh: rz-dmac: Move interrupt request after everything is set up eca8b44d51fc6 can: bcm: track a single source interface for ANYDEV timeout/throttle ops 136de17f38630 can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler() 6be3e1fedf03e can: bcm: fix stale rx/tx ops after device removal b024c21c9066f can: bcm: add missing device refcount for CAN filter removal deb6a697cce3f can: bcm: validate frame length in bcm_rx_setup() for RTR replies bd46f55dec608 can: bcm: extend bcm_tx_lock usage for data and timer updates 8104bcdb2612f can: bcm: fix CAN frame rx/tx statistics 19b1994069dd2 can: bcm: add locking when updating filter and timer values ec9daa8fd1b6f KVM: x86/mmu: Fix use-after-free on vendor module reload 8001d2ce9d9bd KVM: nVMX: Hide shadow VMCS right after VMCLEAR dd50ad7935d57 KVM: x86: Only reset TSC Deadline Timer in apic_timer_expired on KVM_RUN f3477a6a4164f KVM: x86: Check for invalid/obsolete root *after* making MMU pages available 865dfe76c150b seqlock: Allow UBSAN_ALIGNMENT to fail optimizing 3958b1aeef43b seqlock: Allow KASAN to fail optimizing ec46baf830825 seqlock: Cure some more scoped_seqlock() optimization fails 8e39ed92d7c5c fs/proc/task_mmu: fix make_uffd_wp_huge_pte() prot-update race 89890a5fcefad drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker f6410d18c1e2d netfilter: nf_tables: revert commit_mutex usage in reset path 0c8a9022f4c56 netfilter: nft_quota: use atomic64_xchg for reset cd968dcdec6ae netfilter: nft_counter: serialize reset with spinlock 55904f1a4689a selftests/bpf: Add tests for ld_{abs,ind} failure path in subprogs ce01a4e5cfac7 bpf: Fix ld_{abs,ind} failure path analysis in subprogs bffc0b27e457c platform/x86/intel-uncore-freq: Fix current_freq_khz after CPU hotplug Signed-off-by: Bruce Ashfield --- meta-yocto-bsp/recipes-kernel/linux/linux-yocto_6.18.bbappend | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/meta-yocto-bsp/recipes-kernel/linux/linux-yocto_6.18.bbappend b/meta-yocto-bsp/recipes-kernel/linux/linux-yocto_6.18.bbappend index b37de5f..dec64c2 100644 --- a/meta-yocto-bsp/recipes-kernel/linux/linux-yocto_6.18.bbappend +++ b/meta-yocto-bsp/recipes-kernel/linux/linux-yocto_6.18.bbappend @@ -8,4 +8,4 @@ KMACHINE:genericx86 ?= "common-pc" KMACHINE:genericx86-64 ?= "common-pc-64" KBRANCH:genericarm64 ?= "v6.18/standard/genericarm64" -SRCREV_machine:genericarm64 ?= "358a6b85383d690246c3c1b53ceb711b3b2146dc" +SRCREV_machine:genericarm64 ?= "19b324105e674270fa4f09ec74c6229a3901893e"