Linux Kernel

The 116 most recent commits in this release — the full changelog is longer:

• Linux 6.12.109
• mm/rmap: use huge_ptep_get() in try_to_unmap_one()
• mm: avoid unnecessary use of is_swap_pmd()
• platform/chrome: sensorhub: Fix dropped timestamp events and log spam
• udf: Fix i_lenExtents truncation on 32-bit kernels
• timer: Keep debugobjects state consistent in migrate_timer_list()
• taskstats: fix cpumask parsing cutting off the last character
• smack: fix cred UAF in smack_file_send_sigiotask()
• signal: avoid shared siginfo namespace rewrites
• sticon/parisc: Detect default STI graphics card for console output
• tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout
• xarray: honor XA_FLAGS_ACCOUNT in xas_split_alloc()
• w1: ds28e17: reject an oversize length on an I2C block read
• vsock/virtio: flush works in dependency order
• wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex
• wifi: rtw88: pci: fix resource leak on failed NAPI setup
• wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb()
• wifi: rtlwifi: rtl8192du: Fix possible memory leak in rtl92du_init_sw_vars()
• wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids
• wifi: rtl818x: initialize eeprom_93cx6 struct to zero
• wifi: mwifiex: Detach sync cmd buffer on interrupted wait
• crypto: sun8i-ss - Remove crypto_rng interface
• crypto: sun8i-ce - Remove crypto_rng interface
• wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop
• wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control()
• i3c: master: svc: bound IBI payload to the requested max_payload_len
• i3c: master: Fix info leak and UAF in device unregister path
• dm-switch: use WRITE_ONCE() in switch_region_table_write()
• dm-stats: fix a crash if allocation of per-cpu data fails
• arch_numa: avoid false positive fortify warning in setup_node_to_cpumask_map()
• PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip
• KVM: selftests: Remove duplicate LAUNCH_UPDATE_VMSA call in SEV-ES migrate test
• rust: rust_is_available: warn for bindgen < 0.72.1 && libclang >= 22
• x86/sev: Fix broken SNP support with KVM module built-in
• iommu/amd: remove return value of amd_iommu_detect
• ring-buffer: Fix subbuf resize race with ring buffer readers
• ALSA: virmidi: Check card index validity at probe
• ALSA: serial-u16550: Check card index validity at probe
• ALSA: portman2x4: Check card index validity at probe
• ALSA: pcxhr: initialize mutexes before requesting threaded IRQ
• ALSA: mts64: Check card index validity at probe
• ALSA: mpu401: Check card index validity at probe
• ALSA: bcd2000: clear the URB pointers on disconnect
• ALSA: aloop: Check card index validity at probe
• ALSA: 6fire: bound the MIDI event length from the device
• mfd: sm501: Fix potential memory leaks during remove
• seg6: reset IP6CB after IPv6 decapsulation
• net: skbuff: don't touch shared zerocopy state in skb_tx_error()
• net: fix spurious TX timeout after dev_activate()
• net: cap advertised IP tunnel headroom
• net/smc: unregister the connection before draining the rx tasklet
• net/smc: fix use-after-free in smc_rx_pipe_buf_release()
• net/smc: fix socket refcount leak in smc_switch_conns()
• net/smc: do not dereference an unset send buffer on the SMC-D teardown path
• net: ntb_netdev: Count packets dropped on RX refill failure
• net: ntb_netdev: Avoid double-accounting netif_rx() drops
• NTB: ntb_transport: Reject oversized TX buffers
• NTB: ntb_transport: Fail TX enqueue when the QP link is down
• NTB: ntb_transport: Recycle TX entries before client callbacks
• net: thunderbolt: Mark the connection down when bringing it up fails
• net: thunderbolt: Release the Rx HopID that was handed out on mismatch
• net: ravb: serialize PTP clock teardown
• net: ravb: avoid dereferencing an invalid PTP clock
• net: openvswitch: fix nf_connlabels leak in ovs_ct_init
• net: openvswitch: fix flow mask use-after-free on flow deletion
• net: l2tp: do not propagate multicast notification errors
• net: ipa: fix stalled modem TX queue after runtime resume
• net: dsa: realtek: use gpiod_set_value_cansleep for reset GPIO
• net: tun: bound receive headroom
• net: usb: qmi_wwan: add Telit Cinterion FE990D50 composition
• slip: fix use-after-free in sl_sync()
• xdp: fix zero-copy frame layout
• net/iucv: filter frames in afiucv_hs_rcv() by ingress device
• ipmi: si: Fix NULL pointer dereference after failed registration
• ipmi: ipmb: validate write message length
• interconnect: Fix use after free in icc_get() and of_icc_get_by_index()
• platform/x86: hp-bioscfg: warn on element type mismatch instead of failing
• platform/x86: hp-bioscfg: pass validated element count to package parsers
• platform/x86: hp-bioscfg: fix ORD_LIST_ELEMENTS never being parsed
• platform/x86: hp-bioscfg: fix off-by-one write in hp_get_string_from_buffer()
• platform/x86: hp-bioscfg: fix new_password_store() overwriting current_password
• platform/x86: hp-bioscfg: fix heap OOB read on empty password write
• platform/x86: hp-bioscfg: fix heap OOB read in sk_store() and kek_store()
• platform/x86: hp-bioscfg: bound ordered-list parsing by the package count
• platform/x86: hp-bioscfg: advance elem past consumed array elements
• platform/x86: hp-bioscfg: accept reduced ACPI packages from older HP BIOS
• platform/chrome: sensorhub: Bound the EC-reported sensor number
• platform/x86: ishtp_eclite: Fix ACPI device reference leak in probe error path
• platform/x86: ISST: Return error during profile addition
• platform/x86: ISST: Validate parameter for frequency and priority
• platform/x86: ISST: Validate parameter for core power state
• platform/x86: ISST: Validate logical CPU id and clos id
• platform/x86: ISST: Use PP level enable mask
• platform/x86: ISST: Just allow 2 bits for SST feature enable
• platform/x86: ISST: Add a NULL check for sst_inst[]
• mmc: via-sdmmc: stop card-detect handling on probe failure
• platform/x86: ISST: Validate socket ID in clos_assoc ioctl
• platform/x86: ISST: Validate level in perf mask ioctls
• platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer
• iommu/vt-d: Force requesting ACS when tboot is enabled
• iommu/vt-d: Fix no_iommu to disable platform opt-in
• iommu/arm-smmu-v3: Manage teardown with devm
• iommu/sva: Set handle->dev before the SVA handle is visible
• iommu/amd: Put PCI device after handling PPR faults
• PCI/proc: Warn on writes to kernel-exclusive config space regions
• PCI/proc: Use file_ns_capable() when checking config space read access
• PCI/proc: Avoid spurious runtime PM wakeup on config space accesses
• PCI/MSI: Enable memory decoding before restoring MSI-X messages
• PCI/sysfs: Avoid spurious runtime PM wakeup on config space accesses
• PCI: Add ACS quirk for Pericom PI7C9X2G608 switches [12d8:2608]
• PCI: plda: Fix IRQ domain leaks in the error paths of plda_init_interrupts()
• PCI: plda: Fix use-after-free of event IRQs during teardown
• PCI: meson: Fix GPIO state while requesting PERST#
• PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk
• s390/dasd: Propagate partial completion length across ERP recovery
• s390/dasd: Guard sysfs discipline callbacks against unallocated private data

The 114 most recent commits in this release — the full changelog is longer:

• Linux 6.18.50
• mm/rmap: use huge_ptep_get() in try_to_unmap_one()
• mm: avoid unnecessary use of is_swap_pmd()
• platform/chrome: sensorhub: Fix dropped timestamp events and log spam
• selftests/mm: fix on-fault-limit false failure under sudo-rs
• udf: Fix i_lenExtents truncation on 32-bit kernels
• timer: Keep debugobjects state consistent in migrate_timer_list()
• timekeeping: Check the return value of tk_get_aux_ts64 in __do_adjtimex()
• taskstats: fix cpumask parsing cutting off the last character
• smack: fix cred UAF in smack_file_send_sigiotask()
• signal: avoid shared siginfo namespace rewrites
• sticon/parisc: Detect default STI graphics card for console output
• sysctl: move the "cad_pid" entry from pid_table[] to kern_reboot_table[]
• tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout
• zloop: truncate finished zones to zone capacity
• xarray: honor XA_FLAGS_ACCOUNT in xas_split_alloc()
• w1: ds28e17: reject an oversize length on an I2C block read
• vsock/virtio: flush works in dependency order
• wifi: mt76: mt7996: validate default EEPROM firmware size
• wifi: mt76: mt7996: fix TX DMA mapping leak for AddBA req frames
• wifi: mt76: mt7925: cancel mlo_pm_work on stop
• wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy
• wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex
• wifi: rtw88: pci: fix resource leak on failed NAPI setup
• wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb()
• wifi: rtlwifi: rtl8192du: Fix possible memory leak in rtl92du_init_sw_vars()
• wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids
• wifi: rtl818x: initialize eeprom_93cx6 struct to zero
• wifi: mwifiex: Detach sync cmd buffer on interrupted wait
• crypto: sun8i-ss - Remove crypto_rng interface
• crypto: sun8i-ce - Remove crypto_rng interface
• wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop
• wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start()
• wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control()
• i3c: renesas: Reconfigure the DATBAS register on re-attach
• i3c: renesas: Clean DATBAS register on detach
• i3c: renesas: Check that the transfer is valid before accessing it
• i3c: master: svc: bound IBI payload to the requested max_payload_len
• i3c: master: Fix info leak and UAF in device unregister path
• i3c: master: adi: initialize the lock before enabling interrupts
• dm-pcache: fix use-after-free and invalid seg operations in kset_replay()
• dm-pcache: fix implicit u8 truncation of gc_percent in message handler
• dm-pcache: only hand out initialized cache segments
• dm-pcache: detect a cycle in the last-kset chain during replay
• dm-pcache: clamp the tail kset read to the segment data region
• dm-pcache: bound the persisted tail-position offset
• dm-pcache: validate on-media seg_num against the cache device size
• dm-pcache: validate kset key_num and intra-segment bounds
• dm-pcache: validate geometry fields from on-disk cache_info
• dm-switch: use WRITE_ONCE() in switch_region_table_write()
• dm-stats: fix a crash if allocation of per-cpu data fails
• arch_numa: avoid false positive fortify warning in setup_node_to_cpumask_map()
• net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry
• rust: rust_is_available: warn for bindgen < 0.72.1 && libclang >= 22
• ovpn: run deferred work on a module-owned workqueue
• ring-buffer: Fix subbuf resize race with ring buffer readers
• ALSA: hda/realtek: Fix Lenovo Yoga Slim 7 14AKP10 quirk ordering
• ALSA: hda/realtek: Enable micmute LED on HP EliteBook 6 G1a p/n: AD3Q9ET#UUG
• ALSA: hda/realtek: Add quirk for TongFang XxAF5xxx
• ALSA: virmidi: Check card index validity at probe
• ALSA: serial-u16550: Check card index validity at probe
• ALSA: portman2x4: Check card index validity at probe
• ALSA: pcxhr: initialize mutexes before requesting threaded IRQ
• ALSA: mts64: Check card index validity at probe
• ALSA: mpu401: Check card index validity at probe
• ALSA: hda/ext: preserve PPLCCTL bits when clearing reset
• ALSA: bcd2000: clear the URB pointers on disconnect
• ALSA: aloop: Check card index validity at probe
• ALSA: 6fire: bound the MIDI event length from the device
• mfd: sm501: Fix potential memory leaks during remove
• mfd: cgbc: Fix teardown ordering in cgbc_remove()
• hwrng: stm32 - Fix runtime PM cleanup on registration failure
• seg6: reset IP6CB after IPv6 decapsulation
• net: skbuff: don't touch shared zerocopy state in skb_tx_error()
• net: fix spurious TX timeout after dev_activate()
• net: cap advertised IP tunnel headroom
• net/smc: unregister the connection before draining the rx tasklet
• net/smc: stop killed, freed and out_of_sync sharing a byte
• net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link()
• net/smc: fix use-after-free in smc_rx_pipe_buf_release()
• net/smc: fix socket refcount leak in smc_switch_conns()
• net/smc: do not dereference an unset send buffer on the SMC-D teardown path
• net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages
• net: ntb_netdev: Count packets dropped on RX refill failure
• net: ntb_netdev: Avoid double-accounting netif_rx() drops
• net: ntb_netdev: Fix TX busy and drop handling
• NTB: ntb_transport: Reject oversized TX buffers
• NTB: ntb_transport: Fail TX enqueue when the QP link is down
• NTB: ntb_transport: Recycle TX entries before client callbacks
• net: thunderbolt: Mark the connection down when bringing it up fails
• net: thunderbolt: Release the Rx HopID that was handed out on mismatch
• net: ravb: serialize PTP clock teardown
• net: ravb: avoid dereferencing an invalid PTP clock
• net: phylink: correctly validate returned PCS in phylink_inband_caps
• net: openvswitch: fix nf_connlabels leak in ovs_ct_init
• net: openvswitch: fix flow mask use-after-free on flow deletion
• net: l2tp: do not propagate multicast notification errors
• net: ipa: fix stalled modem TX queue after runtime resume
• net: ibm: emac: mal: fix NAPI locking
• net: dsa: realtek: use gpiod_set_value_cansleep for reset GPIO
• net: tun: bound receive headroom
• net: usb: qmi_wwan: add Telit Cinterion FE990D50 composition
• slip: fix use-after-free in sl_sync()
• xdp: fix zero-copy frame layout
• net/iucv: filter frames in afiucv_hs_rcv() by ingress device
• ipmi:msghandler: Cancel work cleanly on an error
• ipmi: si: Fix NULL pointer dereference after failed registration
• ipmi: Remove all sysfs files on registration failure
• ipmi: ipmb: validate write message length
• interconnect: Fix use after free in icc_get() and of_icc_get_by_index()
• io_uring/query: cap user size passed to copy_struct_to_user
• platform/x86: hp-bioscfg: warn on element type mismatch instead of failing
• platform/x86: hp-bioscfg: pass validated element count to package parsers
• platform/x86: hp-bioscfg: fix ORD_LIST_ELEMENTS never being parsed

The 118 most recent commits in this release — the full changelog is longer:

• Linux 7.2.4
• platform/chrome: sensorhub: Fix dropped timestamp events and log spam
• ACPI: scan: Do not combine resources that overlap completely
• selftests/mm: fix on-fault-limit false failure under sudo-rs
• udf: Fix i_lenExtents truncation on 32-bit kernels
• timer: Keep debugobjects state consistent in migrate_timer_list()
• timekeeping: Check the return value of tk_get_aux_ts64 in __do_adjtimex()
• taskstats: fix cpumask parsing cutting off the last character
• smack: fix cred UAF in smack_file_send_sigiotask()
• signal: avoid shared siginfo namespace rewrites
• sticon/parisc: Detect default STI graphics card for console output
• sysctl: move the "cad_pid" entry from pid_table[] to kern_reboot_table[]
• tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout
• zloop: truncate finished zones to zone capacity
• xarray: honor XA_FLAGS_ACCOUNT in xas_split_alloc()
• w1: ds28e17: reject an oversize length on an I2C block read
• vsock/virtio: flush works in dependency order
• wifi: mt76: mt7996: validate default EEPROM firmware size
• wifi: mt76: mt7996: fix TX DMA mapping leak for AddBA req frames
• wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy
• wifi: mt76: mt7925: cancel mlo_pm_work on stop
• wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy
• wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex
• wifi: rtw89: pci: add .shutdown callback to stop rfkill polling on reboot
• wifi: rtw88: pci: fix resource leak on failed NAPI setup
• wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb()
• wifi: rtlwifi: rtl8192du: Fix possible memory leak in rtl92du_init_sw_vars()
• wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids
• wifi: rtl818x: initialize eeprom_93cx6 struct to zero
• wifi: mwifiex: Detach sync cmd buffer on interrupted wait
• mm/kmemleak: report RCU-tasks quiescent states during the scan
• mm/kmemleak: stop the task stack scan early when interrupted
• crypto: atmel-ecc - avoid stale fallback key after set_secret failure
• crypto: atmel-ecc - clean up and improve ECDH comments
• crypto: iaa - unmap dst before software fallback on decompress
• fuse: copy request headers via a stack buffer for io-uring
• fuse: decouple fuse_ring creation from ent registration
• wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop
• wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start()
• wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control()
• i3c: renesas: Perform Dynamic Address Assignment on resume
• i3c: renesas: Restore STDBR and EXTBR registers on resume
• i3c: renesas: Reset the controller on resume
• i3c: renesas: Reconfigure the DATBAS register on re-attach
• i3c: renesas: Follow the reset deassert order used in probe
• i3c: renesas: Clean DATBAS register on detach
• i3c: renesas: Check that the transfer is valid before accessing it
• i3c: master: svc: bound IBI payload to the requested max_payload_len
• i3c: master: Fix info leak and UAF in device unregister path
• i3c: master: adi: initialize the lock before enabling interrupts
• i3c: Fix unlocked dereference of dev->desc in i3c_device_get_supported_xfer_mode()
• dm-pcache: fix use-after-free and invalid seg operations in kset_replay()
• dm-pcache: fix implicit u8 truncation of gc_percent in message handler
• dm-pcache: only hand out initialized cache segments
• dm-pcache: detect a cycle in the last-kset chain during replay
• dm-pcache: clamp the tail kset read to the segment data region
• dm-pcache: bound the persisted tail-position offset
• dm-pcache: validate on-media seg_num against the cache device size
• dm-pcache: validate kset key_num and intra-segment bounds
• dm-pcache: validate geometry fields from on-disk cache_info
• dm-switch: use WRITE_ONCE() in switch_region_table_write()
• dm-stats: fix a crash if allocation of per-cpu data fails
• arch_numa: avoid false positive fortify warning in setup_node_to_cpumask_map()
• rust: num: reject Bounded::shr overshifts at build time
• ALSA: hda/realtek: Fix Lenovo Yoga Slim 7 14AKP10 quirk ordering
• ALSA: hda/realtek: Enable micmute LED on HP EliteBook 6 G1a p/n: AD3Q9ET#UUG
• ALSA: hda/realtek: Enable headset mic on F+ FLAPTOP r
• ALSA: hda/realtek: Add quirk for TongFang XxAF5xxx
• ALSA: virmidi: Check card index validity at probe
• ALSA: serial-u16550: Check card index validity at probe
• ALSA: portman2x4: Check card index validity at probe
• ALSA: pcxhr: initialize mutexes before requesting threaded IRQ
• ALSA: mts64: Check card index validity at probe
• ALSA: mpu401: Check card index validity at probe
• ALSA: hda/ext: preserve PPLCCTL bits when clearing reset
• ALSA: FCP: do not copy out an uninitialised init response
• ALSA: bcd2000: clear the URB pointers on disconnect
• ALSA: aloop: Check card index validity at probe
• ALSA: 6fire: bound the MIDI event length from the device
• mfd: sm501: Fix potential memory leaks during remove
• mfd: qnap-mcu: keep the reply buffer alive past a command timeout
• mfd: cgbc: Fix teardown ordering in cgbc_remove()
• hwrng: stm32 - Fix runtime PM cleanup on registration failure
• seg6: reset IP6CB after IPv6 decapsulation
• net: skbuff: don't touch shared zerocopy state in skb_tx_error()
• net: fix spurious TX timeout after dev_activate()
• net: cap advertised IP tunnel headroom
• net/smc: unregister the connection before draining the rx tasklet
• net/smc: stop killed, freed and out_of_sync sharing a byte
• net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link()
• net/smc: fix use-after-free in smc_rx_pipe_buf_release()
• net/smc: fix socket refcount leak in smc_switch_conns()
• net/smc: do not dereference an unset send buffer on the SMC-D teardown path
• net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry
• net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages
• net/mlx5e: do not HW-GRO coalesce small frames
• net: ntb_netdev: Count packets dropped on RX refill failure
• net: ntb_netdev: Avoid double-accounting netif_rx() drops
• net: ntb_netdev: Fix TX busy and drop handling
• NTB: ntb_transport: Reject oversized TX buffers
• NTB: ntb_transport: Fail TX enqueue when the QP link is down
• NTB: ntb_transport: Recycle TX entries before client callbacks
• net: thunderbolt: Mark the connection down when bringing it up fails
• net: thunderbolt: Release the Rx HopID that was handed out on mismatch
• net: ravb: serialize PTP clock teardown
• net: ravb: avoid dereferencing an invalid PTP clock
• net: phylink: correctly validate returned PCS in phylink_inband_caps
• net: openvswitch: fix nf_connlabels leak in ovs_ct_init
• net: openvswitch: fix flow mask use-after-free on flow deletion
• net: mctp: hold a reference to the route device in mctp_route_lookup()
• net: l2tp: do not propagate multicast notification errors
• net: ipa: fix stalled modem TX queue after runtime resume
• net: ibm: emac: mal: fix NAPI locking
• net: bnxt: ring the doorbell when SW USO exits early
• net: dsa: realtek: use gpiod_set_value_cansleep for reset GPIO
• net: tun: bound receive headroom
• net: usb: qmi_wwan: add Telit Cinterion FE990D50 composition
• slip: fix use-after-free in sl_sync()

77 commits in this release:

• Linux 7.1.13
• usb: usbfs: fix use-after-free of usb_device in usbdev_release()
• wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb
• USB: c67x00: fix use-after-free in c67x00_add_iso_urb()
• USB: serial: spcp8x5: drop broken carrier detect support
• USB: serial: option: fix slab OOB read in interrupt URB callback
• ALSA: usb-audio: Complete cleanup after system-resume errors
• ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output()
• ALSA: usb-audio: Fix sample rates for PreSonus AudioBox USB
• usb: core: Strengthen error handling in hub_hub_status()
• usb: core: Add lock to usb_wakeup_notification()
• KVM: s390: vsie: zero stale crypto bits
• crypto: qce - Remove unsafe/deprecated algorithms
• crypto: mxs-dcp - fix source scatterlist length access
• crypto: iaa - fall back to software for multi-entry scatterlists
• crypto: qce - fix CCM AAD buffer underallocation
• crypto: krb5 - use kfree_sensitive() for derived key buffers
• crypto: atmel-tdes - use scatterlist length before DMA mapping
• crypto: qcom-rng - Allow zero as a random number
• crypto: qcom-rng - Remove crypto_rng interface
• crypto: qcom-rng - Enable clock in hwrng case
• crypto: virtio - bound the akcipher result length
• kunit: irq: Continue increasing hrtimer interval for longer
• mm/swap: reject swapon() on filesystem-level encrypted files
• netfilter: nf_tables: don't queue packet path object notifications
• netfilter: nft_set_pipapo_avx2: add missing vzeroupper
• vxlan: keep the last remote linked during FDB flush
• batman-adv: reject unrepresentable multicast TVLV offsets
• ipv6: seg6: clear IPv4 control block on IPIP decapsulation
• net/packet: defer vmalloc TX_RING free until skbs finish
• net: bridge: mcast: fix use-after-free of a master VLAN's multicast context
• xfrm: bound nat keepalive state collection
• xfrm: fix xfrm_state_construct() auth-trunc leak
• xfrm: ah6: validate routing header segments_left
• xfrm: avoid lock inversion in nat keepalive work
• xfrm: drop ESP-in-TCP packets with no ingress device
• tcp: clamp route advmss to TCP_MIN_MSS
• xfrm: espintcp: fix UAF during close
• net: advertise TCP MSS from the configured MTU, not the learned PMTU
• net/tcp-ao: fix use-after-free of current_key on reconnect to another peer
• tcp: fix AO info use-after-free in tcp_ao_connect_init()
• net/tcp: fix TCP-AO key deletion in VRFs
• gtp: serialize PDP context updates
• tls: device: fix out-of-bounds write in tls_append_frag()
• KVM: SEV: Wire up kvm_x86_ops.gmem_xxx() if and only if CONFIG_KVM_AMD_SEV=y
• KVM: SEV: Mark vCPU RUNNABLE after AP_CREATE, even if VMSA is unusable
• KVM: SEV: Extract loading of guest-provided VMSA to a separate helper
• KVM: SEV: Track the GPA of the guest-controlled VMSA used for SNP guests
• KVM: SEV: Drop FOLL_WRITE for encrypted region registration
• usb: gadget: f_tcm: keep port count until LUN teardown completes
• usb: usbtest: disable dynamic ID support
• fuse: fix invalidate lock leak on open O_TRUNC DAX failure
• fuse: fix invalidate lock leak on setattr writeback failure
• xhci: dbgtty: Fix unregister on tty_alloc_driver() failure
• xhci: dbgtty: Fix unregister on tty_register_driver() failure
• usb: xhci: bail out of setup if the controller is inaccessible
• usb: xhci: Handle USB3 port events when there is one roothub
• usb: xhci: Handle bogus TRB pointers in Missed Service Error events
• accessibility: speakup: unregister tty ldisc on later init failures
• fpga: dfl: fme: add error handling
• ext4: zero out whole block for clean edges in WRITE_ZEROES
• ext4: track partial-zero outcome per edge in ext4_zero_partial_blocks()
• ext4: write back partial-zeroed edges in WRITE_ZEROES
• ext4: move partial block zeroing earlier in ext4_zero_range()
• ext4: protect WRITE_ZEROES written extents with orphan list
• ext4: export converted block count from ext4_convert_unwritten_extents()
• selinux: switch two allocations to use kzalloc_objs()
• selinux: require a class's permission values to cover its permission count
• selinux: reject a permission value exceeding the class permission count
• selinux: more strict policy parsing
• selinux: use u16 for security classes
• Revert "selinux: reject a permission value exceeding the class permission count"
• nvme-tcp: fix usage of page_frag_cache
• KVM: x86/mmu: Check write tracking in all address spaces
• RDMA/rxe: Fix OOB in free_rd_atomic_resources()
• RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp
• bpf: reject overlarge global subprog argument sizes

93 commits in this release:

• Linux 6.1.187
• usb: usbfs: fix use-after-free of usb_device in usbdev_release()
• USB: c67x00: fix use-after-free in c67x00_add_iso_urb()
• USB: serial: spcp8x5: drop broken carrier detect support
• USB: serial: option: fix slab OOB read in interrupt URB callback
• ALSA: usb-audio: Complete cleanup after system-resume errors
• ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output()
• usb: core: Strengthen error handling in hub_hub_status()
• usb: core: Add lock to usb_wakeup_notification()
• Bluetooth: hci_core: Fix hci_conn_hash_lookup_cis
• KVM: s390: vsie: zero stale crypto bits
• crypto: qce - Remove unsafe/deprecated algorithms
• crypto: mxs-dcp - fix source scatterlist length access
• crypto: qce - fix CCM AAD buffer underallocation
• crypto: atmel-tdes - use scatterlist length before DMA mapping
• mm/swap: reject swapon() on filesystem-level encrypted files
• ipv6: seg6: clear IPv4 control block on IPIP decapsulation
• net: bridge: mcast: fix use-after-free of a master VLAN's multicast context
• xfrm: fix xfrm_state_construct() auth-trunc leak
• xfrm: ah6: validate routing header segments_left
• xfrm: drop ESP-in-TCP packets with no ingress device
• xfrm: espintcp: fix UAF during close
• tls: device: fix out-of-bounds write in tls_append_frag()
• usb: gadget: f_tcm: keep port count until LUN teardown completes
• usb: usbtest: disable dynamic ID support
• fuse: fix invalidate lock leak on open O_TRUNC DAX failure
• fuse: fix invalidate lock leak on setattr writeback failure
• xhci: dbgtty: Fix unregister on tty_alloc_driver() failure
• xhci: dbgtty: Fix unregister on tty_register_driver() failure
• usb: xhci: Handle USB3 port events when there is one roothub
• accessibility: speakup: unregister tty ldisc on later init failures
• fpga: dfl: fme: add error handling
• ipv4: igmp: Fix potential UAF in igmp_gq_start_timer()
• Bluetooth: hci_event: validate LE Set CIG Parameters response
• Bluetooth: hci_event: fix Set CIG Parameters error status handling
• Bluetooth: ISO: use correct CIS order in Set CIG Parameters event
• Bluetooth: hci_conn: Fix not matching by CIS ID
• Bluetooth: hci_sync: Fix accept list UAF during suspend
• Bluetooth: hci_sync: Use bt_dev_err() to log error message in hci_update_event_filter_sync()
• HID: ft260: fix stack-use-after-return write in I2C read race
• HID: ft260: validate i2c input report length
• HID: ft260: missed NACK from busy device
• HID: ft260: wake up device from power saving mode
• HID: ft260: skip unexpected HID input reports
• HID: ft260: improve i2c large reads performance
• HID: ft260: improve i2c write performance
• HID: uclogic: fix use-after-free of inrange_timer on remove
• HID: nintendo: stop device IO before hid_hw_stop on probe failure
• nvmet-tcp: bound SGL data length before allocating command buffers
• nvme: rename CDR/MORE/DNR to NVME_STATUS_*
• HID: magicmouse: re-enable multitouch after reset-resume
• HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event()
• HID: magicmouse: fix battery reporting for Bluetooth Magic Trackpad USB-C
• nfc: nci: add data_len bound checks to activation parameter extractors
• nilfs2: reject invalid block index in GC ioctl
• nilfs2: correct return value kernel-doc descriptions for ioctl functions
• ext4: propagate errors from fast commit range replay
• mptcp: pm: fix memory leak from alloc-during-teardown race
• block: make bio_check_eod work for zero sized devices
• ASoC: tegra: Fix Master Volume Control
• Revert "smb: client: use kvzalloc() for megabyte buffer in simple fallocate"
• Revert "mtd: maps: vmu-flash: fix fault in unaligned fixup"
• selinux: switch two allocations to use kzalloc_objs()
• smc: Use __sk_dst_get() and dst_dev_rcu() in smc_vlan_by_tcpsk().
• ASoC: nau8821: Cancel pending work before suspend
• Revert "PM: sleep: Use complete() in device_pm_sleep_init()"
• riscv: Fix register corruption from uninitialized cregs on error
• bpf: Fix use-after-free in offloaded map/prog info fill
• ASoC: nau8821: Cancel delayed work on component remove
• smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match().
• smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set().
• KVM: arm64: Prevent access to vCPU events before init
• smc: Fix use-after-free in __pnet_find_base_ndev().
• can: j1939: make j1939_sk_bind() fail if device is no longer registered
• can: j1939: add missing calls in NETDEV_UNREGISTER notification handler
• can: j1939: implement NETDEV_UNREGISTER notification handler
• mISDN: hfcpci: Fix warning when deleting uninitialized timer
• media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode()
• exfat: fix double free in delayed_free
• jfs: Fix null-ptr-deref in jfs_ioc_trim
• ibmvnic: Use kernel helpers for hex dumps
• jfs: add check read-only before txBeginAnon() call
• jfs: add check read-only before truncation in jfs_truncate_nolock()
• bpf: Remove tst_run from lwt_seg6local_prog_ops.
• drm/nouveau/kms/nv50-: init hpd_irq_lock for PIOR DP
• wifi: ath11k: Add missing hw_ops->get_ring_selector() for IPQ5018
• Revert "usb: phy: fsl-usb: Fix use-after-free in delayed work during device removal"
• ipvs: reload ip header after head reallocation
• io_uring/io-wq: fix worker accounting when canceling creation callbacks
• ext4: don't enable DAX on new encrypted files
• KVM: x86/mmu: Check write tracking in all address spaces
• inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP
• RDMA/rxe: Fix OOB in free_rd_atomic_resources()

70 commits in this release:

• Linux 5.15.220
• usb: usbfs: fix use-after-free of usb_device in usbdev_release()
• USB: c67x00: fix use-after-free in c67x00_add_iso_urb()
• USB: serial: spcp8x5: drop broken carrier detect support
• USB: serial: option: fix slab OOB read in interrupt URB callback
• ALSA: usb-audio: Complete cleanup after system-resume errors
• ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output()
• usb: core: Strengthen error handling in hub_hub_status()
• usb: core: Add lock to usb_wakeup_notification()
• KVM: s390: vsie: zero stale crypto bits
• crypto: qce - Remove unsafe/deprecated algorithms
• crypto: mxs-dcp - fix source scatterlist length access
• crypto: qce - fix CCM AAD buffer underallocation
• crypto: atmel-tdes - use scatterlist length before DMA mapping
• mm/swap: reject swapon() on filesystem-level encrypted files
• ipv6: seg6: clear IPv4 control block on IPIP decapsulation
• net: bridge: mcast: fix use-after-free of a master VLAN's multicast context
• xfrm: fix xfrm_state_construct() auth-trunc leak
• xfrm: ah6: validate routing header segments_left
• xfrm: drop ESP-in-TCP packets with no ingress device
• xfrm: espintcp: fix UAF during close
• usb: gadget: f_tcm: keep port count until LUN teardown completes
• usb: usbtest: disable dynamic ID support
• fuse: fix invalidate lock leak on open O_TRUNC DAX failure
• fuse: fix invalidate lock leak on setattr writeback failure
• xhci: dbgtty: Fix unregister on tty_alloc_driver() failure
• xhci: dbgtty: Fix unregister on tty_register_driver() failure
• accessibility: speakup: unregister tty ldisc on later init failures
• fpga: dfl: fme: add error handling
• HID: input: read battery capacity from its actual report offset
• HID: ft260: fix stack-use-after-return write in I2C read race
• HID: ft260: validate i2c input report length
• HID: ft260: missed NACK from busy device
• HID: ft260: wake up device from power saving mode
• HID: ft260: skip unexpected HID input reports
• HID: ft260: improve i2c large reads performance
• HID: ft260: improve i2c write performance
• HID: ft260: fix i2c probing for hwmon devices
• HID: uclogic: fix use-after-free of inrange_timer on remove
• nvmet-tcp: bound SGL data length before allocating command buffers
• nvme: rename CDR/MORE/DNR to NVME_STATUS_*
• HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event()
• nfc: nci: add data_len bound checks to activation parameter extractors
• nilfs2: reject invalid block index in GC ioctl
• nilfs2: correct return value kernel-doc descriptions for ioctl functions
• ext4: propagate errors from fast commit range replay
• kcov: fix data corruption and race conditions on PREEMPT_RT
• kcov: replace local_irq_save() with a local_lock_t
• ipv4: igmp: Fix potential UAF in igmp_gq_start_timer()
• ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams
• ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain()
• ASoC: tegra: Fix Master Volume Control
• ALSA: pcm: fix wait_time calculations
• Revert "smb: client: use kvzalloc() for megabyte buffer in simple fallocate"
• Revert "mtd: maps: vmu-flash: fix fault in unaligned fixup"
• selinux: switch two allocations to use kzalloc_objs()
• smc: Use __sk_dst_get() and dst_dev_rcu() in smc_vlan_by_tcpsk().
• Revert "PM: sleep: Use complete() in device_pm_sleep_init()"
• bpf: Fix use-after-free in offloaded map/prog info fill
• KVM: arm64: Prevent access to vCPU events before init
• can: j1939: make j1939_sk_bind() fail if device is no longer registered
• can: j1939: add missing calls in NETDEV_UNREGISTER notification handler
• can: j1939: implement NETDEV_UNREGISTER notification handler
• jfs: add check read-only before txBeginAnon() call
• jfs: add check read-only before truncation in jfs_truncate_nolock()
• bpf: Remove tst_run from lwt_seg6local_prog_ops.
• ipvs: reload ip header after head reallocation
• io_uring/io-wq: fix worker accounting when canceling creation callbacks
• ext4: don't enable DAX on new encrypted files
• RDMA/rxe: Fix OOB in free_rd_atomic_resources()

100 commits in this release:

• Linux 6.12.108
• usb: usbfs: fix use-after-free of usb_device in usbdev_release()
• wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb
• USB: c67x00: fix use-after-free in c67x00_add_iso_urb()
• USB: serial: spcp8x5: drop broken carrier detect support
• USB: serial: option: fix slab OOB read in interrupt URB callback
• ALSA: usb-audio: Complete cleanup after system-resume errors
• ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output()
• usb: core: Strengthen error handling in hub_hub_status()
• usb: core: Add lock to usb_wakeup_notification()
• KVM: s390: vsie: zero stale crypto bits
• crypto: qce - Remove unsafe/deprecated algorithms
• crypto: mxs-dcp - fix source scatterlist length access
• crypto: qce - fix CCM AAD buffer underallocation
• crypto: atmel-tdes - use scatterlist length before DMA mapping
• crypto: qcom-rng - Remove crypto_rng interface
• crypto: qcom-rng - Allow zero as a random number
• crypto: qcom-rng - Enable clock in hwrng case
• mm/swap: reject swapon() on filesystem-level encrypted files
• netfilter: nf_tables: don't queue packet path object notifications
• vxlan: keep the last remote linked during FDB flush
• batman-adv: reject unrepresentable multicast TVLV offsets
• ipv6: seg6: clear IPv4 control block on IPIP decapsulation
• net: bridge: mcast: fix use-after-free of a master VLAN's multicast context
• xfrm: bound nat keepalive state collection
• xfrm: fix xfrm_state_construct() auth-trunc leak
• xfrm: ah6: validate routing header segments_left
• xfrm: avoid lock inversion in nat keepalive work
• xfrm: drop ESP-in-TCP packets with no ingress device
• xfrm: espintcp: fix UAF during close
• net/tcp-ao: fix use-after-free of current_key on reconnect to another peer
• tcp: fix AO info use-after-free in tcp_ao_connect_init()
• net/tcp: fix TCP-AO key deletion in VRFs
• x86/CPU/AMD: Carve out a Zen5 models range
• gtp: serialize PDP context updates
• tls: device: fix out-of-bounds write in tls_append_frag()
• usb: gadget: f_tcm: keep port count until LUN teardown completes
• usb: usbtest: disable dynamic ID support
• fuse: fix invalidate lock leak on open O_TRUNC DAX failure
• fuse: fix invalidate lock leak on setattr writeback failure
• xhci: dbgtty: Fix unregister on tty_alloc_driver() failure
• xhci: dbgtty: Fix unregister on tty_register_driver() failure
• usb: xhci: Handle USB3 port events when there is one roothub
• accessibility: speakup: unregister tty ldisc on later init failures
• fpga: dfl: fme: add error handling
• HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event()
• Bluetooth: hci_sync: Fix accept list UAF during suspend
• Bluetooth: hci_sync: Use bt_dev_err() to log error message in hci_update_event_filter_sync()
• HID: uclogic: fix use-after-free of inrange_timer on remove
• HID: ft260: fix stack-use-after-return write in I2C read race
• HID: ft260: validate i2c input report length
• HID: asus: fix missing hid_is_usb() check
• HID: asus: simplify RGB init sequence
• HID: pidff: fix OOB write when hid->inputs is empty
• HID: pidff: clang-format pass
• HID: pidff: Use ARRAY_SIZE macro instead of sizeof
• HID: pidff: Rework pidff_set_time() to fix warnings
• nfc: nci: add data_len bound checks to activation parameter extractors
• nilfs2: reject invalid block index in GC ioctl
• nilfs2: correct return value kernel-doc descriptions for ioctl functions
• ksmbd: harden file lifetime during session teardown
• powerpc/hv-gpci: fix preempt count leak in sysfs show paths
• veth: fix OOB txq access in veth_poll() with asymmetric queue counts
• ring buffer: Propagate __rb_map_vma return value to caller
• selinux: switch two allocations to use kzalloc_objs()
• smc: Use __sk_dst_get() and dst_dev_rcu() in smc_vlan_by_tcpsk().
• ASoC: nau8821: Cancel pending work before suspend
• Revert "PM: sleep: Use complete() in device_pm_sleep_init()"
• riscv: Fix register corruption from uninitialized cregs on error
• bpf: Fix use-after-free in offloaded map/prog info fill
• ASoC: nau8821: Cancel delayed work on component remove
• smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match().
• smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set().
• KVM: arm64: Prevent access to vCPU events before init
• smc: Fix use-after-free in __pnet_find_base_ndev().
• can: j1939: make j1939_sk_bind() fail if device is no longer registered
• can: j1939: add missing calls in NETDEV_UNREGISTER notification handler
• can: j1939: implement NETDEV_UNREGISTER notification handler
• mISDN: hfcpci: Fix warning when deleting uninitialized timer
• media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode()
• exfat: fix double free in delayed_free
• jfs: Fix null-ptr-deref in jfs_ioc_trim
• ibmvnic: Use kernel helpers for hex dumps
• jfs: add check read-only before txBeginAnon() call
• jfs: add check read-only before truncation in jfs_truncate_nolock()
• perf: Reject exited events as group leaders
• selinux: require a class's permission values to cover its permission count
• selinux: reject a permission value exceeding the class permission count
• selinux: more strict policy parsing
• selinux: use u16 for security classes
• selinux: make more use of str_read() when loading the policy
• selinux: avoid unnecessary indirection in struct level_datum
• selinux: use known type instead of void pointer
• HID: uhid: convert to hid_safe_input_report()
• nvme-tcp: fix usage of page_frag_cache
• io_uring/io-wq: fix worker accounting when canceling creation callbacks
• ext4: don't enable DAX on new encrypted files
• KVM: x86/mmu: Check write tracking in all address spaces
• RDMA/rxe: Fix OOB in free_rd_atomic_resources()
• RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp

44 commits in this release:

• Linux 5.10.269
• usb: usbfs: fix use-after-free of usb_device in usbdev_release()
• USB: c67x00: fix use-after-free in c67x00_add_iso_urb()
• USB: serial: spcp8x5: drop broken carrier detect support
• USB: serial: option: fix slab OOB read in interrupt URB callback
• ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output()
• usb: core: Strengthen error handling in hub_hub_status()
• usb: core: Add lock to usb_wakeup_notification()
• KVM: s390: vsie: zero stale crypto bits
• crypto: mxs-dcp - fix source scatterlist length access
• crypto: atmel-tdes - use scatterlist length before DMA mapping
• mm/swap: reject swapon() on filesystem-level encrypted files
• ipv6: seg6: clear IPv4 control block on IPIP decapsulation
• xfrm: fix xfrm_state_construct() auth-trunc leak
• xfrm: ah6: validate routing header segments_left
• xfrm: drop ESP-in-TCP packets with no ingress device
• xfrm: espintcp: fix UAF during close
• usb: gadget: f_tcm: keep port count until LUN teardown completes
• usb: usbtest: disable dynamic ID support
• accessibility: speakup: unregister tty ldisc on later init failures
• fpga: dfl: fme: add error handling
• HID: input: read battery capacity from its actual report offset
• nvmet-tcp: bound SGL data length before allocating command buffers
• nfc: nci: add data_len bound checks to activation parameter extractors
• HID: magicmouse: do not keep a stale msc->input if no input is claimed
• nfc: nci: fix uninit-value in the RF discover/activated NTF handlers
• nilfs2: reject invalid block index in GC ioctl
• ext4: propagate errors from fast commit range replay
• kcov: fix data corruption and race conditions on PREEMPT_RT
• ipv4: igmp: Fix potential UAF in igmp_gq_start_timer()
• Revert "smb: client: use kvzalloc() for megabyte buffer in simple fallocate"
• Revert "mtd: maps: vmu-flash: fix fault in unaligned fixup"
• selinux: switch two allocations to use kzalloc_objs()
• Revert "PM: sleep: Use complete() in device_pm_sleep_init()"
• bpf: Fix use-after-free in offloaded map/prog info fill
• KVM: arm64: Prevent access to vCPU events before init
• jfs: add check read-only before txBeginAnon() call
• jfs: add check read-only before truncation in jfs_truncate_nolock()
• bpf: Remove tst_run from lwt_seg6local_prog_ops.
• io_uring/io-wq: fix worker accounting when canceling creation callbacks
• ipvs: reload ip header after head reallocation
• ext4: don't enable DAX on new encrypted files
• ipv6: mcast: Fix use-after-free when processing MLD queries
• RDMA/rxe: Fix OOB in free_rd_atomic_resources()

84 commits in this release:

• Linux 6.18.49
• usb: usbfs: fix use-after-free of usb_device in usbdev_release()
• wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb
• USB: c67x00: fix use-after-free in c67x00_add_iso_urb()
• USB: serial: spcp8x5: drop broken carrier detect support
• USB: serial: option: fix slab OOB read in interrupt URB callback
• ALSA: usb-audio: Complete cleanup after system-resume errors
• ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output()
• usb: core: Strengthen error handling in hub_hub_status()
• usb: core: Add lock to usb_wakeup_notification()
• KVM: s390: vsie: zero stale crypto bits
• crypto: qce - Remove unsafe/deprecated algorithms
• crypto: mxs-dcp - fix source scatterlist length access
• crypto: qce - fix CCM AAD buffer underallocation
• crypto: krb5 - use kfree_sensitive() for derived key buffers
• crypto: atmel-tdes - use scatterlist length before DMA mapping
• crypto: qcom-rng - Allow zero as a random number
• crypto: qcom-rng - Remove crypto_rng interface
• crypto: qcom-rng - Enable clock in hwrng case
• crypto: virtio - bound the akcipher result length
• kunit: irq: Continue increasing hrtimer interval for longer
• mm/swap: reject swapon() on filesystem-level encrypted files
• netfilter: nf_tables: don't queue packet path object notifications
• netfilter: nft_set_pipapo_avx2: add missing vzeroupper
• vxlan: keep the last remote linked during FDB flush
• batman-adv: reject unrepresentable multicast TVLV offsets
• ipv6: seg6: clear IPv4 control block on IPIP decapsulation
• net: bridge: mcast: fix use-after-free of a master VLAN's multicast context
• xfrm: bound nat keepalive state collection
• xfrm: fix xfrm_state_construct() auth-trunc leak
• xfrm: ah6: validate routing header segments_left
• xfrm: avoid lock inversion in nat keepalive work
• xfrm: drop ESP-in-TCP packets with no ingress device
• xfrm: espintcp: fix UAF during close
• net/tcp-ao: fix use-after-free of current_key on reconnect to another peer
• tcp: fix AO info use-after-free in tcp_ao_connect_init()
• net/tcp: fix TCP-AO key deletion in VRFs
• x86/CPU/AMD: Carve out a Zen5 models range
• gtp: serialize PDP context updates
• tls: device: fix out-of-bounds write in tls_append_frag()
• KVM: SEV: Wire up kvm_x86_ops.gmem_xxx() if and only if CONFIG_KVM_AMD_SEV=y
• KVM: SEV: Mark vCPU RUNNABLE after AP_CREATE, even if VMSA is unusable
• KVM: SEV: Extract loading of guest-provided VMSA to a separate helper
• KVM: SEV: Track the GPA of the guest-controlled VMSA used for SNP guests
• KVM: SEV: Drop FOLL_WRITE for encrypted region registration
• usb: gadget: f_tcm: keep port count until LUN teardown completes
• usb: usbtest: disable dynamic ID support
• fuse: fix invalidate lock leak on open O_TRUNC DAX failure
• fuse: fix invalidate lock leak on setattr writeback failure
• xhci: dbgtty: Fix unregister on tty_alloc_driver() failure
• xhci: dbgtty: Fix unregister on tty_register_driver() failure
• usb: xhci: Handle USB3 port events when there is one roothub
• usb: xhci: Handle bogus TRB pointers in Missed Service Error events
• accessibility: speakup: unregister tty ldisc on later init failures
• fpga: dfl: fme: add error handling
• ksmbd: harden file lifetime during session teardown
• HID: ft260: fix stack-use-after-return write in I2C read race
• HID: ft260: validate i2c input report length
• HID: asus: fix missing hid_is_usb() check
• HID: asus: simplify RGB init sequence
• HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event()
• io_uring: defer eventfd signaling when queued from a wakeup handler
• io_uring/rsrc: improve regbuf iov validation
• io_uring: simplify IORING_SETUP_DEFER_TASKRUN && !SQPOLL check
• io_uring/futex: only mark private futex waits as inflight
• powerpc/hv-gpci: fix preempt count leak in sysfs show paths
• veth: fix OOB txq access in veth_poll() with asymmetric queue counts
• selinux: switch two allocations to use kzalloc_objs()
• ASoC: nau8821: Cancel pending work before suspend
• riscv: Fix register corruption from uninitialized cregs on error
• bpf: Fix use-after-free in offloaded map/prog info fill
• ASoC: nau8821: Cancel delayed work on component remove
• selinux: require a class's permission values to cover its permission count
• selinux: reject a permission value exceeding the class permission count
• selinux: more strict policy parsing
• selinux: use u16 for security classes
• Revert "selinux: reject a permission value exceeding the class permission count"
• nvme-tcp: fix usage of page_frag_cache
• KVM: x86/mmu: Check write tracking in all address spaces
• drm/xe/guc_ads: use uncached mapping for UM queue BO
• drm/xe/guc_ads: allocate UM queues in VRAM on dGFX
• drm/xe/guc_ads: allocate UM queues in a separate BO
• RDMA/rxe: Fix OOB in free_rd_atomic_resources()
• RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp

92 commits in this release:

• Linux 6.6.156
• usb: usbfs: fix use-after-free of usb_device in usbdev_release()
• USB: c67x00: fix use-after-free in c67x00_add_iso_urb()
• USB: serial: spcp8x5: drop broken carrier detect support
• USB: serial: option: fix slab OOB read in interrupt URB callback
• ALSA: usb-audio: Complete cleanup after system-resume errors
• ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output()
• usb: core: Strengthen error handling in hub_hub_status()
• usb: core: Add lock to usb_wakeup_notification()
• KVM: s390: vsie: zero stale crypto bits
• crypto: qce - Remove unsafe/deprecated algorithms
• crypto: mxs-dcp - fix source scatterlist length access
• crypto: qce - fix CCM AAD buffer underallocation
• crypto: atmel-tdes - use scatterlist length before DMA mapping
• mm/swap: reject swapon() on filesystem-level encrypted files
• ipv6: seg6: clear IPv4 control block on IPIP decapsulation
• net: bridge: mcast: fix use-after-free of a master VLAN's multicast context
• xfrm: fix xfrm_state_construct() auth-trunc leak
• xfrm: ah6: validate routing header segments_left
• xfrm: drop ESP-in-TCP packets with no ingress device
• xfrm: espintcp: fix UAF during close
• x86/CPU/AMD: Carve out a Zen5 models range
• x86/CPU/AMD: Add models 0x60-0x6f to the Zen5 range
• x86/CPU/AMD: Add models 0x10-0x1f to the Zen5 range
• x86/CPU/AMD: Add more models to X86_FEATURE_ZEN5
• x86/CPU/AMD: Add X86_FEATURE_ZEN5
• tls: device: fix out-of-bounds write in tls_append_frag()
• usb: gadget: f_tcm: keep port count until LUN teardown completes
• usb: usbtest: disable dynamic ID support
• fuse: fix invalidate lock leak on open O_TRUNC DAX failure
• fuse: fix invalidate lock leak on setattr writeback failure
• xhci: dbgtty: Fix unregister on tty_alloc_driver() failure
• xhci: dbgtty: Fix unregister on tty_register_driver() failure
• usb: xhci: Handle USB3 port events when there is one roothub
• accessibility: speakup: unregister tty ldisc on later init failures
• fpga: dfl: fme: add error handling
• xfs: remove file_path tracepoint data
• Bluetooth: hci_sync: Fix accept list UAF during suspend
• Bluetooth: hci_sync: Use bt_dev_err() to log error message in hci_update_event_filter_sync()
• HID: pidff: fix OOB write when hid->inputs is empty
• HID: pidff: clang-format pass
• HID: pidff: Support device error response from PID_BLOCK_LOAD
• HID: uclogic: fix use-after-free of inrange_timer on remove
• HID: ft260: fix stack-use-after-return write in I2C read race
• HID: ft260: validate i2c input report length
• HID: nintendo: stop device IO before hid_hw_stop on probe failure
• nvmet-tcp: bound SGL data length before allocating command buffers
• nvme: rename CDR/MORE/DNR to NVME_STATUS_*
• nvme: fix status magic numbers
• nvme: rename nvme_sc_to_pr_err to nvme_status_to_pr_err
• HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event()
• HID: magicmouse: re-enable multitouch after reset-resume
• nfc: nci: add data_len bound checks to activation parameter extractors
• nilfs2: reject invalid block index in GC ioctl
• nilfs2: correct return value kernel-doc descriptions for ioctl functions
• ext4: propagate errors from fast commit range replay
• ext4: make some fast commit functions reuse extents path
• ext4: make state in ext4_mb_mark_bb to be bool
• ksmbd: harden file lifetime during session teardown
• crypto: starfive - Do not free stack buffer
• powerpc/hv-gpci: fix preempt count leak in sysfs show paths
• net/sched: initialize noop_qdisc owner
• net/sched: Fix mirred deadlock on device recursion
• selinux: switch two allocations to use kzalloc_objs()
• smc: Use __sk_dst_get() and dst_dev_rcu() in smc_vlan_by_tcpsk().
• ASoC: nau8821: Cancel pending work before suspend
• Revert "PM: sleep: Use complete() in device_pm_sleep_init()"
• riscv: Fix register corruption from uninitialized cregs on error
• bpf: Fix use-after-free in offloaded map/prog info fill
• ASoC: nau8821: Cancel delayed work on component remove
• smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match().
• smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set().
• KVM: arm64: Prevent access to vCPU events before init
• smc: Fix use-after-free in __pnet_find_base_ndev().
• can: j1939: make j1939_sk_bind() fail if device is no longer registered
• can: j1939: add missing calls in NETDEV_UNREGISTER notification handler
• can: j1939: implement NETDEV_UNREGISTER notification handler
• mISDN: hfcpci: Fix warning when deleting uninitialized timer
• media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode()
• exfat: fix double free in delayed_free
• jfs: Fix null-ptr-deref in jfs_ioc_trim
• ibmvnic: Use kernel helpers for hex dumps
• jfs: add check read-only before txBeginAnon() call
• jfs: add check read-only before truncation in jfs_truncate_nolock()
• bpf: Remove tst_run from lwt_seg6local_prog_ops.
• perf: Reject exited events as group leaders
• bpf: Ensure reg is PTR_TO_STACK in process_iter_arg
• Revert "usb: phy: fsl-usb: Fix use-after-free in delayed work during device removal"
• io_uring/io-wq: fix worker accounting when canceling creation callbacks
• ext4: don't enable DAX on new encrypted files
• KVM: x86/mmu: Check write tracking in all address spaces
• RDMA/rxe: Fix OOB in free_rd_atomic_resources()

72 commits in this release:

• Linux 7.2.3
• usb: usbfs: fix use-after-free of usb_device in usbdev_release()
• wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb
• USB: c67x00: fix use-after-free in c67x00_add_iso_urb()
• USB: serial: spcp8x5: drop broken carrier detect support
• USB: serial: option: fix slab OOB read in interrupt URB callback
• ALSA: usb-audio: Complete cleanup after system-resume errors
• ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output()
• ALSA: usb-audio: Fix sample rates for PreSonus AudioBox USB
• usb: core: Strengthen error handling in hub_hub_status()
• usb: core: Add lock to usb_wakeup_notification()
• KVM: s390: vsie: zero stale crypto bits
• crypto: qce - Remove unsafe/deprecated algorithms
• crypto: mxs-dcp - fix source scatterlist length access
• crypto: iaa - fall back to software for multi-entry scatterlists
• crypto: qce - fix CCM AAD buffer underallocation
• crypto: krb5 - use kfree_sensitive() for derived key buffers
• crypto: atmel-tdes - use scatterlist length before DMA mapping
• crypto: sun8i-ss - Remove crypto_rng interface
• crypto: sun8i-ce - Remove crypto_rng interface
• crypto: qcom-rng - Allow zero as a random number
• crypto: qcom-rng - Remove crypto_rng interface
• crypto: qcom-rng - Enable clock in hwrng case
• crypto: virtio - bound the akcipher result length
• kunit: irq: Continue increasing hrtimer interval for longer
• mm/swap: reject swapon() on filesystem-level encrypted files
• netfilter: nf_tables: don't queue packet path object notifications
• netfilter: nft_set_pipapo_avx2: add missing vzeroupper
• vxlan: keep the last remote linked during FDB flush
• batman-adv: reject unrepresentable multicast TVLV offsets
• ipv6: seg6: clear IPv4 control block on IPIP decapsulation
• net/packet: defer vmalloc TX_RING free until skbs finish
• vlan: fix skb_under_panic and races when toggling HW VLAN offload
• net: bridge: mcast: fix use-after-free of a master VLAN's multicast context
• xfrm: bound nat keepalive state collection
• xfrm: fix xfrm_state_construct() auth-trunc leak
• xfrm: ah6: validate routing header segments_left
• xfrm: avoid lock inversion in nat keepalive work
• xfrm: drop ESP-in-TCP packets with no ingress device
• tcp: clamp route advmss to TCP_MIN_MSS
• xfrm: espintcp: fix UAF during close
• net: advertise TCP MSS from the configured MTU, not the learned PMTU
• net/tcp-ao: fix use-after-free of current_key on reconnect to another peer
• tcp: fix AO info use-after-free in tcp_ao_connect_init()
• net/tcp: fix TCP-AO key deletion in VRFs
• gtp: serialize PDP context updates
• tls: device: fix out-of-bounds write in tls_append_frag()
• KVM: SEV: Wire up kvm_x86_ops.gmem_xxx() if and only if CONFIG_KVM_AMD_SEV=y
• KVM: SEV: Mark vCPU RUNNABLE after AP_CREATE, even if VMSA is unusable
• KVM: SEV: Extract loading of guest-provided VMSA to a separate helper
• KVM: SEV: Track the GPA of the guest-controlled VMSA used for SNP guests
• KVM: SEV: Drop FOLL_WRITE for encrypted region registration
• KVM: SEV: Allocate full pages for {DE,EN}CRYPT ops on SNP-enabled hosts
• usb: gadget: f_tcm: keep port count until LUN teardown completes
• usb: usbtest: disable dynamic ID support
• fuse: fix invalidate lock leak on open O_TRUNC DAX failure
• fuse: fix invalidate lock leak on setattr writeback failure
• fuse: wait for FR_FINISHED on abort_on_kill to prevent use-after-free
• fuse: publish io-uring queues with release semantics
• fuse: fix missing barrier when checking io-uring readiness
• fuse: fix race between interrupt and resend
• xhci: dbgtty: Fix unregister on tty_alloc_driver() failure
• xhci: dbgtty: Fix unregister on tty_register_driver() failure
• usb: xhci: bail out of setup if the controller is inaccessible
• usb: xhci: Handle USB3 port events when there is one roothub
• usb: xhci: Handle bogus TRB pointers in Missed Service Error events
• accessibility: speakup: unregister tty ldisc on later init failures
• fpga: dfl: fme: add error handling
• selftests/bpf: Fix test_maps sockmap failure
• nvme-tcp: fix usage of page_frag_cache
• RDMA/rxe: Fix OOB in free_rd_atomic_resources()
• RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp

2 commits in this release:

• Linux 6.18.48
• inet: frags: strip GSO state from fragments before reassembly

2 commits in this release:

• Linux 6.1.186
• inet: frags: strip GSO state from fragments before reassembly

2 commits in this release:

• Linux 5.15.219
• inet: frags: strip GSO state from fragments before reassembly

2 commits in this release:

• Linux 5.10.268
• inet: frags: strip GSO state from fragments before reassembly

2 commits in this release:

• Linux 6.12.107
• inet: frags: strip GSO state from fragments before reassembly

2 commits in this release:

• Linux 7.1.12
• inet: frags: strip GSO state from fragments before reassembly

2 commits in this release:

• Linux 7.2.2
• inet: frags: strip GSO state from fragments before reassembly

2 commits in this release:

• Linux 6.6.155
• inet: frags: strip GSO state from fragments before reassembly

78 commits in this release:

• Linux 6.12.106
• net: gro: properly validate BIG TCP aggregation criteria
• Bluetooth: hci_aml: validate firmware segment lengths
• Bluetooth: ISO: do not force BT_LISTEN after a failed BIG sync
• Bluetooth: hci_event: validate LE Set CIG Parameters response
• Bluetooth: hci_event: fix LE list UAF on reset
• HID: hyperv: validate initial device info bounds
• HID: sensor: custom: Fix use-after-free in enable_sensor
• HID: core: fix number/pointer type confusion on long items
• HID: nintendo: stop device IO before hid_hw_stop on probe failure
• HID: nintendo: register input device after capabilities are set
• HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler()
• Input: atkbd - skip deactivate for HONOR ZQC-P
• Input: atkbd - skip deactivate for HONOR FMB-P's internal keyboard
• mptcp: pm: fix memory leak from alloc-during-teardown race
• ipv4: start using dst_dev_rcu()
• xfrm: fix sk_dst_cache double-free in xfrm_user_policy()
• net/ionic: avoid OOB TX partner lookup for hwstamp RXQ
• HID: core: fix OOB read of field->usage in hid_set_field()
• HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID
• HID: magicmouse: do not keep a stale msc->input if no input is claimed
• HID: magicmouse: re-enable multitouch after reset-resume
• HID: magicmouse: fix battery reporting for Bluetooth Magic Trackpad USB-C
• drm/xe: Fix DPT allocation paths.
• ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses
• mptcp: pm: fix data race in add_addr timer callback
• nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations
• nvmet-tcp: bound SGL data length before allocating command buffers
• nvmet-fc: fix invalid free in LS IOD error path
• nvmet-auth: zero the AUTH_RECEIVE response buffer
• ipv6: fix use-after-free in ip6_finish_output2()
• ipv4: reject undersized MTUs in ip_do_fragment()
• Input: byd - synchronize timer deletion before freeing private data
• ndisc: ndisc_send_redirect() cleanup
• nfc: nci: free destination parameters when closing a connection
• nfc: nci: fix uninit-value in the RF discover/activated NTF handlers
• nfc: nci: fix out-of-bounds write in nci_target_auto_activated()
• nfc: st21nfca: validate ATR_REQ length against the received frame
• nfc: pn533: purge fragmented skbs during cleanup
• nfc: llcp: reject PDUs shorter than the LLCP header
• nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers
• nfc: llcp: bound the connect_sn TLV walk to the skb
• nfc: microread: validate target discovery payload lengths
• nfc: fdp: bound the device-reported read length and fix an skb leak
• nfc: digital: clamp SENSF_RES length to the destination buffer
• libceph: fix OOB read in decode_watchers() via missing bounds check
• xfs: validate attr entry pointer before field access
• ext4: propagate errors from fast commit range replay
• ext4: clear error before retrying inode xattr space fallback
• ext4: stop retrying saturated xattr cache entries
• kcov: fix data corruption and race conditions on PREEMPT_RT
• null_blk: fix UBSAN shift-out-of-bounds when zone_size is 0 or overflows
• ocfs2: fix missing metadata reservation for large xattrs
• ALSA: dummy: Check card index validity at probe
• xfs: don't livelock in scrub on a circular unlinked list
• xfs: hoist per-bucket unlinked list check to helper
• xfs: bounds-check buffer log item's dirty bitmap
• xfs: don't use a xfs_log_iovec for ri_buf in log recovery
• xfs: namespace the maximum length/refcount symbols
• serial: sc16is7xx: enable THRI before filling TX FIFO
• serial: sc16is7xx: use guards for simple mutex locks
• serial: sc16is7xx: rename EFR mutex with generic name
• serial: amba-pl011: synchronize DMA teardown
• NTB: ntb_netdev: Preserve RX queue depth on allocation failure
• serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx
• inet: frags: publish queues before arming timer
• inet: frags: save a pair of atomic operations in reassembly
• inet: frags: change inet_frag_kill() to defer refcount updates
• ipv4: frags: remove ipq_put()
• inet: frags: add inet_frag_putn() helper
• netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages()
• hwmon: (ltc4286) Fix symbol namespace of MODULE_IMPORT_NS()
• gve: fix zero-length skb frag with header-split
• gpio: ml-ioh: use raw_spinlock_t for the register lock
• rndis_host: add overflow check in rndis_rx_fixup()
• ALSA: scarlett2: Use a private URB for the notification endpoint
• Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept
• PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems

79 commits in this release:

• Linux 6.6.154
• net: gro: properly validate BIG TCP aggregation criteria
• Bluetooth: hci_event: validate LE Set CIG Parameters response
• Bluetooth: hci_event: fix LE list UAF on reset
• HID: hyperv: validate initial device info bounds
• HID: sensor: custom: Fix use-after-free in enable_sensor
• HID: core: fix number/pointer type confusion on long items
• HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler()
• mptcp: pm: fix memory leak from alloc-during-teardown race
• Input: atkbd - skip deactivate for HONOR ZQC-P
• Input: atkbd - skip deactivate for HONOR FMB-P's internal keyboard
• Bluetooth: hci_sync: Fix advertising data UAFs
• xfrm: fix sk_dst_cache double-free in xfrm_user_policy()
• HID: core: fix OOB read of field->usage in hid_set_field()
• HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID
• HID: magicmouse: do not keep a stale msc->input if no input is claimed
• HID: magicmouse: fix battery reporting for Bluetooth Magic Trackpad USB-C
• mptcp: pm: fix data race in add_addr timer callback
• ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses
• ASoC: SOF: ipc4-pcm: Continue the pipeline trigger in case of IPC timeout
• ASoC: SOF: pcm: Add snd_sof_pcm specific wrappers for dev_dbg() and dev_err()
• ASoC: SOF: pcm: Move period/buffer configuration print after platform open
• ASoC: SOF: Relocate and rework functionality for PCM stream freeing
• ASoC: sof: pcm: use snd_pcm_direction_name()
• nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations
• nvmet-fc: fix invalid free in LS IOD error path
• nvmet-auth: zero the AUTH_RECEIVE response buffer
• ipv6: fix use-after-free in ip6_finish_output2()
• ipv4: reject undersized MTUs in ip_do_fragment()
• libceph: fix OOB read in decode_watchers() via missing bounds check
• Input: byd - synchronize timer deletion before freeing private data
• ndisc: ndisc_send_redirect() cleanup
• nfc: nci: free destination parameters when closing a connection
• nfc: nci: fix uninit-value in the RF discover/activated NTF handlers
• nfc: nci: fix out-of-bounds write in nci_target_auto_activated()
• nfc: st21nfca: validate ATR_REQ length against the received frame
• nfc: pn533: purge fragmented skbs during cleanup
• nfc: llcp: reject PDUs shorter than the LLCP header
• nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers
• nfc: llcp: bound the connect_sn TLV walk to the skb
• nfc: microread: validate target discovery payload lengths
• nfc: fdp: bound the device-reported read length and fix an skb leak
• nfc: digital: clamp SENSF_RES length to the destination buffer
• drm/amdgpu: check ASPM on the dGPU host link
• drm/amd/display: fix BT.2020 YCbCr limited output CSC matrix
• drm/amd/display: Fix BT2020 YCbCr limited/full range input
• drm/amd/amdgpu: disable ASPM in some situations
• s390/vfio_ccw: Implement a crw lock
• s390/vfio_ccw: Calculate idal length based on idaw type
• s390/vfio_ccw: Ensure first IDAW remains constant
• s390/vfio_ccw: Free all memory if cp_init() fails
• gpio: ml-ioh: use raw_spinlock_t for the register lock
• xfs: validate attr entry pointer before field access
• ext4: clear error before retrying inode xattr space fallback
• ext4: stop retrying saturated xattr cache entries
• kcov: fix data corruption and race conditions on PREEMPT_RT
• null_blk: fix UBSAN shift-out-of-bounds when zone_size is 0 or overflows
• ocfs2: fix missing metadata reservation for large xattrs
• ALSA: dummy: Check card index validity at probe
• xfs: bounds-check buffer log item's dirty bitmap
• xfs: don't use a xfs_log_iovec for ri_buf in log recovery
• inet: frags: publish queues before arming timer
• inet: frags: save a pair of atomic operations in reassembly
• inet: frags: change inet_frag_kill() to defer refcount updates
• ipv4: frags: remove ipq_put()
• inet: frags: add inet_frag_putn() helper
• serial: sc16is7xx: enable THRI before filling TX FIFO
• serial: sc16is7xx: use guards for simple mutex locks
• serial: sc16is7xx: rename EFR mutex with generic name
• serial: sc16is7xx: convert bitmask definitions to use BIT() macro
• serial: sc16is7xx: fix copy-paste errors in EFR_SWFLOWx_BIT constants
• serial: qcom-geni: fix TX DMA buffer flush
• perf/core: Fix group leader use-after-free after sibling detach
• perf: Unify perf_event_free_task() / perf_event_exit_task_context()
• serial: amba-pl011: synchronize DMA teardown
• NTB: ntb_netdev: Preserve RX queue depth on allocation failure
• rndis_host: add overflow check in rndis_rx_fixup()
• Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept
• PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems

84 commits in this release:

• Linux 7.2.1
• ptp: vmclock: prevent read-only mappings from becoming writable
• futex: Fix might_sleep() warning in futex_pivot_pending()
• Bluetooth: hci_aml: validate firmware segment lengths
• Bluetooth: MGMT: reject HCI_CMD_SYNC params_len above 255
• Bluetooth: ISO: zero the sockaddr before returning it in getname
• Bluetooth: ISO: do not force BT_LISTEN after a failed BIG sync
• Bluetooth: hci_sync: Fix accept list UAF during suspend
• Bluetooth: hci_event: validate LE Set CIG Parameters response
• Bluetooth: hci_event: fix LE list UAF on reset
• HID: input: read battery capacity from its actual report offset
• HID: hyperv: validate initial device info bounds
• HID: uclogic: fix use-after-free of inrange_timer on remove
• HID: sensor: custom: Fix use-after-free in enable_sensor
• HID: ft260: fix stack-use-after-return write in I2C read race
• HID: core: fix number/pointer type confusion on long items
• HID: rapoo: fix missing hid_is_usb() check
• HID: nintendo: stop device IO before hid_hw_stop on probe failure
• HID: nintendo: register input device after capabilities are set
• HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler()
• HID: huawei: fix missing hid_is_usb() check
• HID: asus: fix missing hid_is_usb() check
• net/ionic: avoid OOB TX partner lookup for hwstamp RXQ
• HID: pidff: fix OOB write when hid->inputs is empty
• HID: core: fix OOB read of field->usage in hid_set_field()
• HID: magicmouse: do not keep a stale msc->input if no input is claimed
• HID: magicmouse: re-enable multitouch after reset-resume
• HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event()
• HID: magicmouse: fix battery reporting for Bluetooth Magic Trackpad USB-C
• nvmet: pci-epf: put CQ ref on create_cq mapping failure
• nvmet: pci-epf: fix use-after-free in nvmet_pci_epf_exec_iod_work()
• nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations
• nvmet-tcp: bound SGL data length before allocating command buffers
• nvmet-fc: fix invalid free in LS IOD error path
• nvmet-auth: zero the AUTH_RECEIVE response buffer
• dmaengine: fsl-edma: Add error handling for devm_kasprintf
• mailbox: mchp-ipc-sbi: Add null check for devm_kasprintf()
• ipv6: fix use-after-free in ip6_finish_output2()
• ipv4: reject undersized MTUs in ip_do_fragment()
• nfc: nci: free destination parameters when closing a connection
• nfc: nci: fix uninit-value in the RF discover/activated NTF handlers
• nfc: nci: fix out-of-bounds write in nci_target_auto_activated()
• nfc: nci: add data_len bound checks to activation parameter extractors
• nfc: st21nfca: validate ATR_REQ length against the received frame
• nfc: pn533: purge fragmented skbs during cleanup
• nfc: llcp: reject PDUs shorter than the LLCP header
• nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers
• nfc: llcp: bound the connect_sn TLV walk to the skb
• nfc: microread: validate target discovery payload lengths
• nfc: fdp: bound the device-reported read length and fix an skb leak
• nfc: digital: clamp SENSF_RES length to the destination buffer
• xfs: restore nofs context unconditionally in xfs_trans_roll
• xfs: validate attr entry pointer before field access
• ext4: fix incorrect function call when initializing s_resgid
• ext4: don't enable DAX on new encrypted files
• ext4: propagate errors from fast commit range replay
• ext4: avoid tail write_begin walk for uptodate folios
• ext4: clear error before retrying inode xattr space fallback
• nilfs2: reject invalid block index in GC ioctl
• ext4: stop retrying saturated xattr cache entries
• kcov: fix data corruption and race conditions on PREEMPT_RT
• null_blk: fix UBSAN shift-out-of-bounds when zone_size is 0 or overflows
• ocfs2: fix missing metadata reservation for large xattrs
• io_uring: defer eventfd signaling when queued from a wakeup handler
• io_uring/uring_cmd: don't skip completion for a synchronous multishot cmd
• io_uring/rsrc: fix folio size overflow in io_vec_fill_bvec()
• io_uring/io-wq: fix worker accounting when canceling creation callbacks
• io_uring/cmd: fix iovec leak when the async cmd is not recycled
• ALSA: dummy: Check card index validity at probe
• io_uring/futex: only mark private futex waits as inflight
• io_uring/futex: don't mark futex wake requests as inflight
• futex: Fix race on the initial mm->futex.phash.ref allocation
• futex: Avoid private hash use-after-free on final put
• futex/pi: Plug private futex exec() race
• futex: Sanitize and document task_struct::futex::state transitions
• futex/pi: Reject cross-mm private futex owners
• nvmet: fix NULL pointer dereference in nvmet_execute_identify_nslist()
• rndis_host: add overflow check in rndis_rx_fixup()
• ALSA: scarlett2: Use a private URB for the notification endpoint
• ALSA: FCP: Use a private URB for the notification endpoint
• iommu/iommufd: Fix NULL pointer deref in iommufd_ioas_change_process when racing with iopt_map_file_pages
• iommu/tegra241-cmdqv: Fix CMD_SYNC use-after-free on teardown
• Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept
• PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems

100 commits in this release:

• Linux 7.1.11
• ptp: vmclock: prevent read-only mappings from becoming writable
• futex: Avoid private hash use-after-free on final put
• Bluetooth: hci_aml: validate firmware segment lengths
• Bluetooth: MGMT: reject HCI_CMD_SYNC params_len above 255
• Bluetooth: ISO: zero the sockaddr before returning it in getname
• Bluetooth: ISO: do not force BT_LISTEN after a failed BIG sync
• Bluetooth: hci_sync: Fix accept list UAF during suspend
• Bluetooth: hci_event: validate LE Set CIG Parameters response
• Bluetooth: hci_event: fix LE list UAF on reset
• HID: input: read battery capacity from its actual report offset
• HID: hyperv: validate initial device info bounds
• HID: uclogic: fix use-after-free of inrange_timer on remove
• HID: sensor: custom: Fix use-after-free in enable_sensor
• HID: ft260: fix stack-use-after-return write in I2C read race
• HID: core: fix number/pointer type confusion on long items
• HID: rapoo: fix missing hid_is_usb() check
• HID: nintendo: stop device IO before hid_hw_stop on probe failure
• HID: nintendo: register input device after capabilities are set
• HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler()
• HID: huawei: fix missing hid_is_usb() check
• HID: asus: fix missing hid_is_usb() check
• futex: Fix might_sleep() warning in futex_pivot_pending()
• futex: Fix race on the initial mm->futex.phash.ref allocation
• futex: Fix race in futex_pivot_pending() during private hash resize
• futex/pi: Plug private futex exec() race
• futex: Sanitize and document task_struct::futex::state transitions
• futex/pi: Reject cross-mm private futex owners
• net/ionic: avoid OOB TX partner lookup for hwstamp RXQ
• HID: pidff: fix OOB write when hid->inputs is empty
• HID: core: fix OOB read of field->usage in hid_set_field()
• HID: magicmouse: do not keep a stale msc->input if no input is claimed
• HID: magicmouse: re-enable multitouch after reset-resume
• HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event()
• HID: magicmouse: fix battery reporting for Bluetooth Magic Trackpad USB-C
• mptcp: pm: fix memory leak from alloc-during-teardown race
• mptcp: pm: uniform announced addresses helpers
• mptcp: pm: rename add_entry structure to add_addr
• drm/amdgpu: Allocate coredump ring buffers per ring
• drm/amdgpu: fix recursive ww_mutex acquire in amdgpu_devcoredump_format
• fbdev: serialize mode sysfs access with lock_fb_info()
• fbdev: Wrap user-invoked calls to fb_set_var() in helper
• nvmet: pci-epf: put CQ ref on create_cq mapping failure
• nvmet: pci-epf: fix use-after-free in nvmet_pci_epf_exec_iod_work()
• nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations
• nvmet-tcp: bound SGL data length before allocating command buffers
• nvmet-fc: fix invalid free in LS IOD error path
• nvmet-auth: zero the AUTH_RECEIVE response buffer
• dmaengine: fsl-edma: Add error handling for devm_kasprintf
• mailbox: mchp-ipc-sbi: Add null check for devm_kasprintf()
• ipv6: fix use-after-free in ip6_finish_output2()
• ipv4: reject undersized MTUs in ip_do_fragment()
• nfc: nci: free destination parameters when closing a connection
• nfc: nci: fix uninit-value in the RF discover/activated NTF handlers
• nfc: nci: fix out-of-bounds write in nci_target_auto_activated()
• nfc: nci: add data_len bound checks to activation parameter extractors
• nfc: st21nfca: validate ATR_REQ length against the received frame
• nfc: pn533: purge fragmented skbs during cleanup
• nfc: llcp: reject PDUs shorter than the LLCP header
• nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers
• nfc: llcp: bound the connect_sn TLV walk to the skb
• nfc: microread: validate target discovery payload lengths
• nfc: fdp: bound the device-reported read length and fix an skb leak
• nfc: digital: clamp SENSF_RES length to the destination buffer
• drm/xe: Fix DPT allocation paths.
• drm/i915: Introduce struct intel_fb_pin_params
• drm/i915: Track fence region ID in plane state
• drm/i915/pin: s/dev_priv/i915/ and drop struct drm_device usage
• xfs: restore nofs context unconditionally in xfs_trans_roll
• xfs: validate attr entry pointer before field access
• ext4: fix incorrect function call when initializing s_resgid
• ext4: don't enable DAX on new encrypted files
• ext4: propagate errors from fast commit range replay
• ext4: avoid tail write_begin walk for uptodate folios
• ext4: clear error before retrying inode xattr space fallback
• nilfs2: reject invalid block index in GC ioctl
• ext4: stop retrying saturated xattr cache entries
• kcov: fix data corruption and race conditions on PREEMPT_RT
• null_blk: fix UBSAN shift-out-of-bounds when zone_size is 0 or overflows
• ocfs2: fix missing metadata reservation for large xattrs
• io_uring: defer eventfd signaling when queued from a wakeup handler
• io_uring/uring_cmd: don't skip completion for a synchronous multishot cmd
• io_uring/rsrc: fix folio size overflow in io_vec_fill_bvec()
• io_uring/io-wq: fix worker accounting when canceling creation callbacks
• io_uring/cmd: fix iovec leak when the async cmd is not recycled
• ALSA: dummy: Check card index validity at probe
• io_uring/futex: only mark private futex waits as inflight
• io_uring/futex: don't mark futex wake requests as inflight
• nvmet: fix NULL pointer dereference in nvmet_execute_identify_nslist()
• rndis_host: add overflow check in rndis_rx_fixup()
• ALSA: scarlett2: Use a private URB for the notification endpoint
• ALSA: FCP: Use a private URB for the notification endpoint
• iommu/iommufd: Fix NULL pointer deref in iommufd_ioas_change_process when racing with iopt_map_file_pages
• iommu/tegra241-cmdqv: Fix CMD_SYNC use-after-free on teardown
• Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept
• PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems
• xfs: rtsummary scrub should treat rtbitmap corruption errors as an xref error
• xfs: add a xchk_ip_set_corrupt helper
• xfs: don't livelock in scrub on a circular unlinked list
• xfs: hoist per-bucket unlinked list check to helper

80 commits in this release:

• Linux 6.1.185
• net: gro: properly validate BIG TCP aggregation criteria
• Bluetooth: hci_event: fix LE list UAF on reset
• HID: hyperv: validate initial device info bounds
• HID: sensor: custom: Fix use-after-free in enable_sensor
• HID: core: fix number/pointer type confusion on long items
• HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler()
• misc: fastrpc: Fix double free of 'buf' in error path
• can: isotp: fix timer drain order, wakeup handling and tx_gen ordering
• can: use skb hash instead of private variable in headroom
• Input: atkbd - skip deactivate for HONOR ZQC-P
• Input: atkbd - skip deactivate for HONOR FMB-P's internal keyboard
• s390/vfio_ccw: Free all memory if cp_init() fails
• xfrm: fix sk_dst_cache double-free in xfrm_user_policy()
• HID: core: fix OOB read of field->usage in hid_set_field()
• HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID
• HID: magicmouse: do not keep a stale msc->input if no input is claimed
• mptcp: pm: fix data race in add_addr timer callback
• mptcp: pm: ADD_ADDR rtx: free sk if last
• mptcp: pm: ADD_ADDR rtx: always decrease sk refcount
• ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses
• Input: byd - synchronize timer deletion before freeing private data
• nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations
• nvmet-fc: fix invalid free in LS IOD error path
• nvmet-auth: zero the AUTH_RECEIVE response buffer
• ipv6: fix use-after-free in ip6_finish_output2()
• ipv4: reject undersized MTUs in ip_do_fragment()
• libceph: fix OOB read in decode_watchers() via missing bounds check
• ndisc: ndisc_send_redirect() cleanup
• nfc: nci: free destination parameters when closing a connection
• nfc: nci: fix uninit-value in the RF discover/activated NTF handlers
• nfc: nci: fix out-of-bounds write in nci_target_auto_activated()
• nfc: st21nfca: validate ATR_REQ length against the received frame
• nfc: pn533: purge fragmented skbs during cleanup
• nfc: llcp: reject PDUs shorter than the LLCP header
• nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers
• nfc: llcp: bound the connect_sn TLV walk to the skb
• nfc: microread: validate target discovery payload lengths
• nfc: fdp: bound the device-reported read length and fix an skb leak
• nfc: digital: clamp SENSF_RES length to the destination buffer
• iomap: adjust read range correctly for non-block-aligned positions
• tls: handle data disappearing from under the TLS ULP
• tls: fix lockless read of strp->msg_ready in ->poll
• gpio: ml-ioh: use raw_spinlock_t for the register lock
• drm/amdgpu: check ASPM on the dGPU host link
• xfs: bounds-check buffer log item's dirty bitmap
• xfs: don't use a xfs_log_iovec for ri_buf in log recovery
• s390/vfio_ccw: Implement a crw lock
• s390/vfio_ccw: Selectively expand io_mutex
• s390/vfio_ccw: Move cp cleanup out of not operational
• drm/amdgpu: disallow multiple FENCE chunks in one submit
• s390/vfio_ccw: Cancel existing workqueues
• inet: frags: publish queues before arming timer
• packet: synchronize pressure clearing with ring reconfiguration
• net/packet: convert po->pressure to an atomic flag
• serial: sc16is7xx: enable THRI before filling TX FIFO
• serial: sc16is7xx: use guards for simple mutex locks
• serial: sc16is7xx: rename EFR mutex with generic name
• serial: sc16is7xx: convert bitmask definitions to use BIT() macro
• serial: sc16is7xx: fix copy-paste errors in EFR_SWFLOWx_BIT constants
• packet: use consistent hard_header_len in TX_RING send path
• packet: use consistent hard_header_len in non-ring send paths
• perf/core: Fix group leader use-after-free after sibling detach
• perf: Fix dangling cgroup pointer in cpuctx
• perf: Fix cgroup state vs ERROR
• perf/core: Fix child_total_time_enabled accounting bug at task exit
• serial: amba-pl011: synchronize DMA teardown
• NTB: ntb_netdev: Preserve RX queue depth on allocation failure
• misc: fastrpc: Remove buffer from list prior to unmap operation
• misc: fastrpc: Rework fastrpc_req_munmap
• xfs: validate attr entry pointer before field access
• ext4: clear error before retrying inode xattr space fallback
• ext4: stop retrying saturated xattr cache entries
• kcov: fix data corruption and race conditions on PREEMPT_RT
• null_blk: fix UBSAN shift-out-of-bounds when zone_size is 0 or overflows
• ocfs2: fix missing metadata reservation for large xattrs
• ALSA: dummy: Check card index validity at probe
• rndis_host: add overflow check in rndis_rx_fixup()
• Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept
• PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems

77 commits in this release:

• Linux 5.15.218
• Revert "ALSA: aoa: Use guard() for mutex locks"
• HID: hyperv: validate initial device info bounds
• HID: sensor: custom: Fix use-after-free in enable_sensor
• HID: core: fix number/pointer type confusion on long items
• can: isotp: fix timer drain order, wakeup handling and tx_gen ordering
• can: use skb hash instead of private variable in headroom
• mptcp: pm: fix data race in add_addr timer callback
• mptcp: pm: ADD_ADDR rtx: free sk if last
• mptcp: pm: ADD_ADDR rtx: always decrease sk refcount
• mptcp: pm: ADD_ADDR rtx: allow ID 0
• Input: atkbd - skip deactivate for HONOR ZQC-P
• Input: atkbd - skip deactivate for HONOR FMB-P's internal keyboard
• s390/vfio_ccw: Free all memory if cp_init() fails
• iomap: adjust read range correctly for non-block-aligned positions
• KVM: x86: Retry page fault if MMU reload is pending and root has no sp
• xfrm: fix sk_dst_cache double-free in xfrm_user_policy()
• HID: core: fix OOB read of field->usage in hid_set_field()
• HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID
• HID: magicmouse: do not keep a stale msc->input if no input is claimed
• KVM: x86: Check for invalid/obsolete root after making MMU pages available
• KVM: x86/mmu: Rename __direct_map() to direct_map()
• KVM: x86/mmu: Split out TDP MMU page fault handling
• KVM: Rename mmu_notifier_* to mmu_invalidate_*
• KVM: x86/mmu: Document the "rules" for using host_pfn_mapping_level()
• KVM: x86/mmu: Rename pte_list_{destroy,remove}() to show they zap SPTEs
• KVM: x86/mmu: Directly "destroy" PTE list when recycling rmaps
• KVM: x86/mmu: Retry page fault if root is invalidated by memslot update
• ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses
• mptcp: avoid combining some incoming suboptions
• s390/vfio_ccw: Implement a crw lock
• s390/vfio_ccw: Selectively expand io_mutex
• s390/vfio_ccw: Ensure index for read/write regions are within range
• nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations
• nvmet-fc: fix invalid free in LS IOD error path
• ipv6: fix use-after-free in ip6_finish_output2()
• ipv4: reject undersized MTUs in ip_do_fragment()
• drm/amdgpu: check ASPM on the dGPU host link
• libceph: fix OOB read in decode_watchers() via missing bounds check
• nfc: nci: free destination parameters when closing a connection
• nfc: nci: fix uninit-value in the RF discover/activated NTF handlers
• nfc: nci: fix out-of-bounds write in nci_target_auto_activated()
• nfc: st21nfca: validate ATR_REQ length against the received frame
• nfc: pn533: purge fragmented skbs during cleanup
• nfc: llcp: reject PDUs shorter than the LLCP header
• nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers
• nfc: llcp: bound the connect_sn TLV walk to the skb
• nfc: microread: validate target discovery payload lengths
• nfc: fdp: bound the device-reported read length and fix an skb leak
• nfc: digital: clamp SENSF_RES length to the destination buffer
• xfs: bounds-check buffer log item's dirty bitmap
• s390/vfio_ccw: Cancel existing workqueues
• inet: frags: publish queues before arming timer
• packet: synchronize pressure clearing with ring reconfiguration
• net/sched: reject overly deep qdisc hierarchies
• packet: use consistent hard_header_len in TX_RING send path
• packet: use consistent hard_header_len in non-ring send paths
• serial: amba-pl011: synchronize DMA teardown
• NTB: ntb_netdev: Preserve RX queue depth on allocation failure
• perf/core: Fix group leader use-after-free after sibling detach
• perf: Fix dangling cgroup pointer in cpuctx
• perf: Fix cgroup state vs ERROR
• perf/core: Fix child_total_time_enabled accounting bug at task exit
• misc: fastrpc: Remove buffer from list prior to unmap operation
• misc: fastrpc: Rework fastrpc_req_munmap
• misc: fastrpc: separate fastrpc device from channel context
• mm/huge_memory: fix huge_zero_pfn race
• gpio: ml-ioh: use raw_spinlock_t for the register lock
• xfs: validate attr entry pointer before field access
• ext4: clear error before retrying inode xattr space fallback
• ext4: stop retrying saturated xattr cache entries
• null_blk: fix UBSAN shift-out-of-bounds when zone_size is 0 or overflows
• ocfs2: fix missing metadata reservation for large xattrs
• ALSA: dummy: Check card index validity at probe
• rndis_host: add overflow check in rndis_rx_fixup()
• Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept
• PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems

58 commits in this release:

• Linux 5.10.267
• Revert "ALSA: aoa: Use guard() for mutex locks"
• HID: hyperv: validate initial device info bounds
• HID: sensor: custom: Fix use-after-free in enable_sensor
• HID: core: fix number/pointer type confusion on long items
• can: isotp: fix timer drain order, wakeup handling and tx_gen ordering
• can: use skb hash instead of private variable in headroom
• bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec()
• s390/vfio_ccw: Free all memory if cp_init() fails
• iomap: adjust read range correctly for non-block-aligned positions
• xfrm: fix sk_dst_cache double-free in xfrm_user_policy()
• Revert "Input: ims-pcu - fix race condition in reset_device sysfs callback"
• HID: core: fix OOB read of field->usage in hid_set_field()
• HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID
• libceph: fix OOB read in decode_watchers() via missing bounds check
• gpio: ml-ioh: use raw_spinlock_t for the register lock
• nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations
• nvmet-fc: fix invalid free in LS IOD error path
• ipv6: fix use-after-free in ip6_finish_output2()
• ipv4: reject undersized MTUs in ip_do_fragment()
• xfs: bounds-check buffer log item's dirty bitmap
• nfc: nci: free destination parameters when closing a connection
• nfc: nci: fix out-of-bounds write in nci_target_auto_activated()
• nfc: st21nfca: validate ATR_REQ length against the received frame
• nfc: pn533: purge fragmented skbs during cleanup
• nfc: llcp: reject PDUs shorter than the LLCP header
• nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers
• nfc: llcp: bound the connect_sn TLV walk to the skb
• nfc: microread: validate target discovery payload lengths
• nfc: fdp: bound the device-reported read length and fix an skb leak
• nfc: digital: clamp SENSF_RES length to the destination buffer
• KVM: arm64: Retry fault if vma_lookup() results become invalid
• s390/vfio_ccw: Cancel existing workqueues
• xfs: fix ilock leak on error in xfs_dq_get_next_id
• inet: frags: publish queues before arming timer
• packet: synchronize pressure clearing with ring reconfiguration
• net/sched: reject overly deep qdisc hierarchies
• packet: use consistent hard_header_len in TX_RING send path
• packet: use consistent hard_header_len in non-ring send paths
• perf/core: Fix group leader use-after-free after sibling detach
• perf: Fix dangling cgroup pointer in cpuctx
• perf: Fix cgroup state vs ERROR
• serial: amba-pl011: synchronize DMA teardown
• NTB: ntb_netdev: Preserve RX queue depth on allocation failure
• ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops
• net: ipv4: Publish fib_nlmsg_size()
• misc: fastrpc: Remove buffer from list prior to unmap operation
• misc: fastrpc: Rework fastrpc_req_munmap
• misc: fastrpc: separate fastrpc device from channel context
• staging: rtl8723bs: fix OOB read in WMM_param_handler()
• mm/huge_memory: fix huge_zero_pfn race
• net/x25: fix use-after-free of the socket by its timers
• xfs: validate attr entry pointer before field access
• ext4: clear error before retrying inode xattr space fallback
• ext4: stop retrying saturated xattr cache entries
• ocfs2: fix missing metadata reservation for large xattrs
• rndis_host: add overflow check in rndis_rx_fixup()
• Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept

94 commits in this release:

• Linux 6.18.47
• net: gro: properly validate BIG TCP aggregation criteria
• ptp: vmclock: prevent read-only mappings from becoming writable
• futex: Avoid private hash use-after-free on final put
• Bluetooth: hci_aml: validate firmware segment lengths
• Bluetooth: MGMT: reject HCI_CMD_SYNC params_len above 255
• Bluetooth: ISO: zero the sockaddr before returning it in getname
• Bluetooth: ISO: do not force BT_LISTEN after a failed BIG sync
• Bluetooth: hci_sync: Fix accept list UAF during suspend
• Bluetooth: hci_event: validate LE Set CIG Parameters response
• Bluetooth: hci_event: fix LE list UAF on reset
• HID: hyperv: validate initial device info bounds
• HID: uclogic: fix use-after-free of inrange_timer on remove
• HID: sensor: custom: Fix use-after-free in enable_sensor
• HID: core: fix number/pointer type confusion on long items
• HID: nintendo: stop device IO before hid_hw_stop on probe failure
• HID: nintendo: register input device after capabilities are set
• HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler()
• futex: Fix might_sleep() warning in futex_pivot_pending()
• futex: Fix race on the initial mm->futex.phash.ref allocation
• futex/pi: Plug private futex exec() race
• futex: Sanitize and document task_struct::futex::state transitions
• futex/pi: Reject cross-mm private futex owners
• Input: atkbd - skip deactivate for HONOR ZQC-P
• Input: atkbd - skip deactivate for HONOR FMB-P's internal keyboard
• xfrm: fix sk_dst_cache double-free in xfrm_user_policy()
• net/ionic: avoid OOB TX partner lookup for hwstamp RXQ
• HID: pidff: fix OOB write when hid->inputs is empty
• HID: core: fix OOB read of field->usage in hid_set_field()
• HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID
• HID: magicmouse: do not keep a stale msc->input if no input is claimed
• HID: magicmouse: re-enable multitouch after reset-resume
• HID: magicmouse: fix battery reporting for Bluetooth Magic Trackpad USB-C
• ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses
• mptcp: pm: fix memory leak from alloc-during-teardown race
• mptcp: pm: uniform announced addresses helpers
• mptcp: pm: rename add_entry structure to add_addr
• mptcp: pm: use for_each_subflow helper
• nvmet: pci-epf: put CQ ref on create_cq mapping failure
• nvmet: pci-epf: fix use-after-free in nvmet_pci_epf_exec_iod_work()
• nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations
• nvmet-tcp: bound SGL data length before allocating command buffers
• nvmet-fc: fix invalid free in LS IOD error path
• nvmet-auth: zero the AUTH_RECEIVE response buffer
• dmaengine: fsl-edma: Add error handling for devm_kasprintf
• mailbox: mchp-ipc-sbi: Add null check for devm_kasprintf()
• ipv6: fix use-after-free in ip6_finish_output2()
• ipv4: reject undersized MTUs in ip_do_fragment()
• drm/xe: Fix DPT allocation paths.
• nfc: nci: free destination parameters when closing a connection
• nfc: nci: fix uninit-value in the RF discover/activated NTF handlers
• nfc: nci: fix out-of-bounds write in nci_target_auto_activated()
• nfc: nci: add data_len bound checks to activation parameter extractors
• nfc: st21nfca: validate ATR_REQ length against the received frame
• nfc: pn533: purge fragmented skbs during cleanup
• nfc: llcp: reject PDUs shorter than the LLCP header
• nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers
• nfc: llcp: bound the connect_sn TLV walk to the skb
• nfc: microread: validate target discovery payload lengths
• nfc: fdp: bound the device-reported read length and fix an skb leak
• nfc: digital: clamp SENSF_RES length to the destination buffer
• libceph: fix OOB read in decode_watchers() via missing bounds check
• xfs: validate attr entry pointer before field access
• ext4: fix incorrect function call when initializing s_resgid
• ext4: don't enable DAX on new encrypted files
• ext4: propagate errors from fast commit range replay
• ext4: avoid tail write_begin walk for uptodate folios
• ext4: clear error before retrying inode xattr space fallback
• nilfs2: reject invalid block index in GC ioctl
• ext4: stop retrying saturated xattr cache entries
• kcov: fix data corruption and race conditions on PREEMPT_RT
• null_blk: fix UBSAN shift-out-of-bounds when zone_size is 0 or overflows
• ocfs2: fix missing metadata reservation for large xattrs
• io_uring/uring_cmd: don't skip completion for a synchronous multishot cmd
• io_uring/rsrc: fix folio size overflow in io_vec_fill_bvec()
• io_uring/io-wq: fix worker accounting when canceling creation callbacks
• io_uring/cmd: fix iovec leak when the async cmd is not recycled
• ALSA: dummy: Check card index validity at probe
• io_uring/futex: don't mark futex wake requests as inflight
• nvmet: fix NULL pointer dereference in nvmet_execute_identify_nslist()
• rndis_host: add overflow check in rndis_rx_fixup()
• ALSA: scarlett2: Use a private URB for the notification endpoint
• ALSA: FCP: Use a private URB for the notification endpoint
• iommu/iommufd: Fix NULL pointer deref in iommufd_ioas_change_process when racing with iopt_map_file_pages
• iommu/tegra241-cmdqv: Fix CMD_SYNC use-after-free on teardown
• Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept
• PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems
• xfs: don't livelock in scrub on a circular unlinked list
• xfs: hoist per-bucket unlinked list check to helper
• xfs: rtsummary scrub should treat rtbitmap corruption errors as an xref error
• xfs: add a xchk_ip_set_corrupt helper
• serial: sc16is7xx: enable THRI before filling TX FIFO
• serial: sc16is7xx: use guards for simple mutex locks
• serial: sc16is7xx: rename EFR mutex with generic name

The 120 most recent commits in this release — the full changelog is longer:

• Linux 7.1.10
• ALSA: hda/realtek: Enable headset mic on F+ FLAPTOP r
• erofs: fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS on some UP platforms
• spi: virtio: mark device ready before registering the controller
• drm/log: Fix infinite loop when scale is too large for display
• drm/log: Fix out-of-bounds read on empty message length
• drm/log: Fix division by zero when scale module parameter is 0
• drm/xe: Fix a bug in pc_adjust_freq_bounds()
• drm/xe: Set GT rp min frequency as 1.2GHz default for BMG/CRI
• drm/xe/oa: Check managed mutex initialization errors
• drm/xe/oa: Fix sync entry leak on OA config emit failure
• drm/xe/pxp: add termination on resume
• firewire: ohci: fix NULL pointer dereference in ar_context_release
• l2tp: fix tunnel and session refcount leak on seq_file release
• net/sched: cls_bpf: reject dev-bound programs bound to a different device
• accel/amdxdna: Skip unmapped range in aie2_populate_range()
• net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG
• regmap: sdw-mbq: don't call an unset readable_reg callback
• m68k: Define NR_CPUS to 1
• pid: reject allocations through dead ancestor pid namespaces
• net/sched: cls_u32: skip hash tables in u32_bind_class()
• net/sched: act_api: fix TOCTOU NULL deref on a->goto_chain
• af_packet: Don't send zero-byte data in tpacket_snd().
• regmap: sdw-mbq: Fix swap of timeout and retry times
• ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers
• net/tls: Fail tls_sw_splice_read() after a failed async decrypt
• net: ngbe: fix NULL pointer dereference in non-MSI-X interrupt enabling
• net: tap: fix wrong transport_header when sending VLAN-tagged frame
• net: packet: fix wrong transport_header when sending VLAN-tagged frame
• net: phy: realtek: fix EEE advertisement write on the internal PHY MMD path
• tcp: fix icsk_ack.ato bitfield overflow
• veth: fix queue index used to wake the peer txq in veth_poll
• macvlan: inherit needed_headroom and needed_tailroom from lowerdev
• ipvlan: inherit needed_headroom and needed_tailroom from phy_dev
• eth: bnxt: avoid deadlock when canceling IRQ affinity notifier
• eth: bnxt: decrease indent in bnxt_request_irq()
• eth: bnxt: keep the aRFS rmap updated when TPH is enabled
• eth: bnxt: cancel IRQ notifier before freeing affinity mask
• netfilter: ipset: let destroy callbacks adjust ext mem size
• netfilter: ipset: fix list type element drift bug
• netfilter: flowtable: publish GC-visible tuple last
• netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path
• ipvs: revalidate ihl to prevent out-of-bounds access
• netfilter: ipset: fix refcount race between list:set GC and swap
• tick: Include ktime.h and jiffies.h in linux/tick.h
• ASoC: tas2781: fix clang build error for goto bypassing cleanup variable
• gpio: ml-ioh: share the register lock across channels
• rseq: Prevent hard lockup on granted time slice extension
• ovpn: defer key slot crypto freeing to workqueue
• ovpn: run deferred work on a module-owned workqueue
• riscv: lib: Fix ZBB strnlen reading past count boundary
• ALSA: usb-audio: Fix mixer regression on SteelSeries Arctis Nova 5
• sctp: validate cookie AUTH state before use
• perf: Reject exited events as group leaders
• scsi: core: pair EH runtime PM get and put
• riscv: ftrace: Fix ftrace_modify_call failure on kprobed functions
• ovpn: finish crypto callback cleanup before peer release
• ovpn: fix NULL dereference when killing missing key
• af_unix: Unlink scc_entry in unix_del_edge().
• regulator: fp9931: Fix VPOS/VNEG voltage selector table
• gpiolib: Check gc->get_direction() before calling gpiod_get_direction()
• rhashtable: fix false-positive lockdep splat on rhltable destruction
• crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req()
• crypto: ccm - Set rfc4309 maxauthsize from child
• arm64: tegra: Add EL2 virtual timer interrupt for Tegra194
• clk: spacemit: k3: set hdma clock as critical
• clk: spacemit: k3: fix USB2 bus clock
• optee: ffa: Add NULL check in optee_ffa_lend_protmem
• clk: qcom: dispcc-eliza: Fix disp_cc_mdss_mdp_clk_src RCG stall on Eliza EVK
• ASoC: SOF: ipc4-topology: Refresh copier IPC payload before widget setup
• net: expect instance lock in netdev_queue_get_dma_dev()
• net: rename netdev_ops_assert_locked()
• drm/amdkfd: Add bounds check for CRAT subtype length
• drm/mediatek: mtk_dsi: Enable HS clock only at pre-enable
• drm/mediatek: Convert legacy DRM logging to drm_* helpers in mtk_dsi.c
• ASoC: tas2562: Validate values for volume writes
• ceph: fix hanging __ceph_get_caps() with stale mds_wanted
• ceph: avoid fs reclaim while using current->journal_info
• xfs: check v5 superblock features early
• xfs: check xfarray iteration errors when committing unlinked inode lists
• xfs: don't ignore runtime errors in xrep_iunlink_reload_next
• xfs: don't swallow dquot recovery verification errors
• xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN
• xfs: avoid UAF on sc->tempip in xrep_tempfile_create
• xfs: don't return EFSCORRUPTED when scrubbing corrupt parent pointers
• xfs: fix another iunlink infinite loop bug in online fsck
• xfs: fix allocated inodes that show up in the unlinked list
• xfs: don't walk off the end of a null sc->sa.agi_bp in AGI repair
• xfs: don't zap the attr fork on repair when there are queued pptr updates
• xfs: fix ilock leak on error in xfs_dq_get_next_id
• xfs: load next_agino from the correct xfarray in xrep_iunlink_relink_prev
• xfs: nlink scrub must take IOLOCK before determining ILOCK state
• xfs: pass runtime errors from xrep_iunlink_mark_ondisk_rec up to callers
• xfs: set the prev pointer when reinserting an inode on the unlinked list
• xfs: don't double-lock when deleting a self-referential directory
• xfs: only check mergeability of bnobt records
• xfs: zero i_nlink before repair puts inode on unlinked list
• xfs: fix transaction block reservation in xrep_rtbitmap
• xfs: check cowextsize in xrep_inode_cowextsize
• xfs: clear zapped attr fork state when bmap repair finds no attr fork
• xfs: mark nonzero sb_gquotino as corrupt on metadir filesystems
• xfs: bounds-check buffer log item's dirty bitmap
• xfs: fix off-by-one in rtrefcount btree root level validation
• xfs: propagate errors from xfs_rtginode_load
• drm/amdgpu: disallow multiple FENCE chunks in one submit
• drm/amdgpu: Fix UVD decode image min size calculation
• drm/amdgpu: Fix UVD dpb min size calculation for H264
• drm/amdgpu: Fix UVD min buffer sizes
• drm/amdgpu: Implement insert_end for VCE 3
• drm/amdgpu: Reject UVD message with dimensions above 4096
• drm/amdgpu: validate GEM_CREATE domain combinations
• drm/amdgpu: check ASPM on the dGPU host link
• drm/amdgpu: fix missing check in vm_flush()
• drm/amdgpu: fix nbif 6.3.1 l1 low power not functional
• drm/amdgpu: Prefer default discovery offset
• drm/amdgpu: Reject UVD message with invalid number of h265 refs
• drm/amd/display: fix BT.2020 YCbCr output CSC matrices for DCE
• drm/amd/display: fix BT.2020 YCbCr limited output CSC matrix
• drm/amd/display: Fix NULL pointer dereference in amdgpu_dm_crtc_set_vblank()
• s390/zcrypt: Pad trailing CCA or EP11 message with zeros

The 115 most recent commits in this release — the full changelog is longer:

• Linux 6.12.105
• net: ethernet: mtk_eth_soc: improve support for named interrupts
• net: ethernet: mtk_eth_soc: only use legacy mode on missing IRQ name
• ALSA: hda/realtek: Enable headset mic on F+ FLAPTOP r
• ring-buffer: Use current_context for safe per-CPU buffer swap
• ring-buffer: Remove jump to out label in ring_buffer_swap_cpu()
• ip_tunnel: adapt iptunnel_xmit_stats() to NETDEV_PCPU_STAT_DSTATS
• net: harmonize tstats and dstats
• binfmt_misc: use exe_file_deny_write_access() for the interpreter clone
• fs: unlock the superblock during iterate_supers_type
• perf/core: Fix group leader use-after-free after sibling detach
• perf: Unify perf_event_free_task() / perf_event_exit_task_context()
• erofs: fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS on some UP platforms
• drm/xe/oa: Fix sync entry leak on OA config emit failure
• net/sched: cls_bpf: reject dev-bound programs bound to a different device
• net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG
• m68k: Define NR_CPUS to 1
• net/sched: cls_u32: skip hash tables in u32_bind_class()
• net/sched: act_api: fix TOCTOU NULL deref on a->goto_chain
• af_packet: Don't send zero-byte data in tpacket_snd().
• ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers
• net/tls: Fail tls_sw_splice_read() after a failed async decrypt
• net: packet: fix wrong transport_header when sending VLAN-tagged frame
• tcp: fix icsk_ack.ato bitfield overflow
• veth: fix queue index used to wake the peer txq in veth_poll
• macvlan: inherit needed_headroom and needed_tailroom from lowerdev
• ipvlan: inherit needed_headroom and needed_tailroom from phy_dev
• netfilter: ipset: let destroy callbacks adjust ext mem size
• netfilter: ipset: fix list type element drift bug
• netfilter: flowtable: publish GC-visible tuple last
• netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path
• netfilter: ipset: fix refcount race between list:set GC and swap
• crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req()
• crypto: ccm - Set rfc4309 maxauthsize from child
• arm64: tegra: Add EL2 virtual timer interrupt for Tegra194
• net/x25: fix use-after-free of the socket by its timers
• ASoC: SOF: ipc4-topology: Refresh copier IPC payload before widget setup
• x86/mce: Set up the polling timer before CMCI discovery
• x86/mce: Set CR4.MCE last during init
• x86/mce: Remove __mcheck_cpu_init_early()
• ring-buffer: Prevent resizing of persistent ring buffer
• ring-buffer: Make ring_buffer_{un}map() simpler with guard(mutex)
• ring-buffer: Simplify ring_buffer_read_page() with guard()
• KVM: SVM: Serialize accesses to the owner and mirror list with separate lock
• mm/ptdump: always stabilise against page table freeing using init_mm
• mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF
• mm/pagewalk: split walk_page_range_novma() into kernel/user parts
• ring-buffer: Initialise reader page order in rb_allocate_cpu_buffer()
• ring-buffer: Simplify functions with __free(kfree) to free allocations
• drm/vmwgfx: take fman->lock around fence list mutation in fifo_down
• net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp()
• drm/amd/pm: fix pptable use-after-free
• drm/amd/pm: adjust the visibility of pp_table sysfs node
• drm/amdgpu: move debug_vm handling to amdgpu_cs_parser_fini
• drm/amdgpu: remove unused function parameter
• drm/amd/pm: fix torn gpu metrics reads
• drm/amd/pm: Use macro to initialize metrics table
• drm/amd/pm: Use same metric table for APU
• can: rcar_canfd: change the initializing flow for clocks and resets
• cifs: add fscache_resize_cookie() to cifs_setsize()
• smb: client: fix race with fallocate(2) and AIO+DIO
• include/linux/fs.h: add inode_lock_killable()
• ice: fix VF interrupts cleanup
• vxlan: use pskb_network_may_pull() for transmit path header pulls
• vxlan: Handle stats using NETDEV_PCPU_STAT_DSTATS.
• vrf: Make pcpu_dstats update functions available to other modules.
• binfmt_misc: restore write access when removing an entry
• fs: don't block write during exec on pre-content watched files
• fsnotify: opt-in for permission events at file open time
• fsnotify, lsm: Decouple fsnotify from lsm
• binfmt_misc: don't leak the user namespace when the mount fails
• net: pktgen: fix proc entry use-after-free
• net: pktgen: fix code style (WARNING: Block comments)
• ksmbd: reject repeated SMB2 NEGOTIATE requests
• ksmbd: conn lock to serialize smb2 negotiate
• igc: remove napi_synchronize() in igc_down()
• ata: libata-scsi: terminate deferred commands on time out
• ASoC: tas2562: Validate values for volume writes
• KVM: x86: Cancel delayed I/O APIC EOI handling before destroying vCPUs
• btrfs: zoned: fix missing chunk metadata reservation
• btrfs: remove fs_info argument from btrfs_zoned_activate_one_bg()
• btrfs: add space_info argument to btrfs_chunk_alloc()
• btrfs: add debug build only WARN
• iommufd: Fix wrong hwpt passed to iommufd_auto_response_faults on replace
• tcp: challenge ACK for non-exact RST in SYN-RECEIVED
• tcp: reorganize tcp_sock_write_txrx group for variables later
• tcp: fast path functions later
• tcp: Pass flags to __tcp_send_ack
• eventpoll: pin files while checking reverse paths
• ksmbd: validate minimum PDU size for transform requests
• smb/server: fix minimum SMB2 PDU size
• smb/server: fix minimum SMB1 PDU size
• ksmbd: rename smb2_get_msg to smb_get_msg
• smb/server: rename include guard in smb_common.h
• smb: move get_rfc1002_len() to common/smbglob.h
• smb: move smb_version_values to common/smbglob.h
• super: fix emergency thaw deadlock on frozen block devices
• fs/super: fix emergency thaw double-unlock of s_umount
• super: use common iterator (Part 2)
• super: use a common iterator (Part 1)
• super: skip dying superblocks early
• super: remove pointless s_root checks
• net/sched: serialize qdisc_rtab_list against concurrent get/put
• libceph: fix two unsafe bare decodes in decode_lockers()
• userfaultfd: prevent registration of special VMAs
• mm/khugepaged: guard is_zero_pfn() calls with pte_present()
• libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE
• libceph: Amend checking to fix make W=1 build breakage
• ceph: fix hanging __ceph_get_caps() with stale mds_wanted
• ceph: avoid fs reclaim while using current->journal_info
• ceph: fix writeback_count leak in write_folio_nounlock()
• ceph: Convert writepage_nounlock() to write_folio_nounlock()
• ceph: Convert ceph_find_incompatible() to take a folio
• ceph: Use a folio in ceph_page_mkwrite()
• ceph: Remove ceph_writepage()

The 120 most recent commits in this release — the full changelog is longer:

• Linux 5.10.266
• ring-buffer: Use current_context for safe per-CPU buffer swap
• ring-buffer: Remove jump to out label in ring_buffer_swap_cpu()
• USB: serial: keyspan_pda: fix information leak
• net: ethernet: ti: am65-cpsw: fix error handling in am65_cpsw_nuss_probe()
• i2c: smbus: Check for parent device before dereference
• udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf()
• binfmt_misc: use exe_file_deny_write_access() for the interpreter clone
• net: smc: fix splice entry lifetime imbalance in smc_rx_splice
• net/smc: rdma write inline if qp has sufficient inline space
• net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG
• net: ethernet: ti: am65-cpsw: add multi port support in mac-only mode
• net: ethernet: ti: am65-cpsw: move free desc queue mode selection in pdata
• net: ethernet: ti: am65-cpsw: move ale selection in pdata
• af_packet: Don't send zero-byte data in tpacket_snd().
• ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers
• net: packet: fix wrong transport_header when sending VLAN-tagged frame
• netfilter: ipset: fix list type element drift bug
• netfilter: flowtable: publish GC-visible tuple last
• netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path
• netfilter: ipset: fix refcount race between list:set GC and swap
• crypto: ccm - Set rfc4309 maxauthsize from child
• arm64: tegra: Add EL2 virtual timer interrupt for Tegra194
• net: atlantic: free stranded TX buffers on ring deinit
• mm/ptdump: always stabilise against page table freeing using init_mm
• net/sched: act_gact, act_police: range check the fallback control action
• sched/psi: Shut down rtpoll_timer in psi_cgroup_free()
• ALSA: usx2y: bound the hwdep mmap fault offset
• ALSA: usx2y: Fix potential leaks of uninitialized memory
• drm/amd/pm: fix torn gpu metrics reads
• hwmon: (npcm750-pwm-fan): stop fan timer on device detach
• can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure
• binfmt_misc: restore write access when removing an entry
• fs: don't block write during exec on pre-content watched files
• fsnotify: opt-in for permission events at file open time
• i2c: iproc: reset bus after timeout if START_BUSY is stuck
• i2c: bcm-iproc: remove printout on handled timeouts
• ice: fix memory leak in ice_lbtest_prepare_rings()
• ice: fix VF interrupts cleanup
• scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write
• scsi: scsi_debug: Rename zone type constants
• scsi: sd: sd_zbc: Return early in sd_zbc_check_zoned_characteristics()
• scsi: sd: sd_zbc: Use logical blocks as unit when querying zones
• scsi: sd: sd_zbc: Improve source code documentation
• net: pktgen: fix proc entry use-after-free
• net: pktgen: fix code style (WARNING: Block comments)
• mm/vmstat: fold stranded per-cpu node stats when a node comes online
• Bluetooth: HIDP: reject frames without a transaction header
• skbuff: introduce skb_pull_data
• ftrace: Add global mutex to serialize trace_parser access
• super: fix emergency thaw deadlock on frozen block devices
• net: gro: fix double aggregation of flush-marked skbs
• net/sched: serialize qdisc_rtab_list against concurrent get/put
• ceph: fix hanging __ceph_get_caps() with stale mds_wanted
• ceph: rename _to_client() to _to_fs_client()
• libceph: add doutc and *_client debug macros support
• libceph: fix two unsafe bare decodes in decode_lockers()
• libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE
• libceph: Amend checking to fix make W=1 build breakage
• ceph: avoid fs reclaim while using current->journal_info
• sctp: avoid auth_enable sysctl UAF during netns teardown
• mptcp: decrement subflows counter on failed passive join
• mptcp: fix subflow accounting on close
• serial: sc16is7xx: implement gpio get_direction() callback
• serial: sc16is7xx: fix regression with GPIO configuration
• serial: sc16is7xx: remove obsolete out_thread label
• serial: sc16is7xx: Fill in rs485_supported
• sc16is7xx: Properly resume TX after stop
• mptcp: only set DATA_FIN when a mapping is present
• serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms
• serial: 8250_mid: Remove unneeded test for ->setup() presence
• ALSA: seq: close a re-opened queue timer in the destructor
• wifi: brcmfmac: drain bus_reset work on device removal
• media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor()
• media: v4l: async: Set owner for async sub-devices
• wifi: ath6kl: fix use-after-free in aggr_reset_state()
• media: imx219: Fix maximum frame length in lines
• media: i2c: imx219: Rename VTS to FRM_LENGTH
• media: i2c: imx219: Correct the minimum vblanking value
• media: i2c: imx219: Drop IMX219_VTS_* macros
• media: marvell-cam: fix missing pci_disable_device() on remove
• drm/i915/hdcp: require monotonically increasing seq_num_v
• media: aspeed: fix missing of_reserved_mem_device_release() on probe failure
• drm/virtio: bound EDID block reads to the response buffer
• drm/virtio: Return proper error codes instead of -1
• drm/tegra: fbdev: Remove offset into framebuffer memory
• drm/displayid: fix Tiled Display Topology ID size
• drm/virtio: use uninterruptible resv lock for plane updates
• dma-buf/drivers: make reserving a shared slot mandatory v4
• drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers
• drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers
• usb: gadget: f_tcm: synchronize delayed set_alt with teardown
• drm/dp/mst: fix buffer overflows in sideband chunk accumulation
• KVM: x86: Only reset TSC Deadline Timer in apic_timer_expired on KVM_RUN
• KVM: Introduce vcpu->wants_to_run
• KVM: x86: Move "apicv_active" into "struct kvm_lapic"
• KVM: x86: Check for in-kernel xAPIC when querying APICv for directed yield
• KVM: x86: Drop @vcpu parameter from kvm_x86_ops.hwapic_isr_update()
• USB: serial: keyspan_pda: fix data loss on receive throttling
• USB: serial: keyspan_pda: clean up comments and whitespace
• USB: serial: keyspan_pda: add write-fifo support
• USB: serial: keyspan_pda: fix write implementation
• USB: serial: keyspan_pda: refactor write-room handling
• usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown
• usb: gadget: bdc: fix checkpatch.pl spacing error
• fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list
• octeontx2-pf: fix SQB pointer leak on init failure
• net: ipa: fix SMEM state handle leaks in SMP2P init
• espintcp: use sk_msg_free_partial to fix partial send
• bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline()
• bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c
• bootconfig: do not put quotes on cmdline items unless necessary
• gpio: tegra: do not call pinctrl for GPIO direction
• net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked
• net/sched: taprio: avoid calling child->ops->dequeue(child) twice
• net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink
• net: ipip: require CAP_NET_ADMIN in the device netns for changelink
• net: Add helper function to parse netlink msg of ip_tunnel_encap
• Input: ims-pcu - fix firmware leak in async update
• firmware_loader: introduce __free() cleanup hanler

The 120 most recent commits in this release — the full changelog is longer:

• Linux 5.15.217
• ring-buffer: Use current_context for safe per-CPU buffer swap
• ring-buffer: Remove jump to out label in ring_buffer_swap_cpu()
• jiffies: Cast to unsigned long in secs_to_jiffies() conversion
• drm/virtio: Unlock reservations on dma_resv_reserve_fences() error
• drm/vmwgfx: Reserve fence slots on buffer objects in cotables
• udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf()
• binfmt_misc: use exe_file_deny_write_access() for the interpreter clone
• net/x25: fix use-after-free of the socket by its timers
• net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG
• af_packet: Don't send zero-byte data in tpacket_snd().
• ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers
• net: packet: fix wrong transport_header when sending VLAN-tagged frame
• netfilter: ipset: fix list type element drift bug
• netfilter: flowtable: publish GC-visible tuple last
• netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path
• netfilter: ipset: fix refcount race between list:set GC and swap
• crypto: ccm - Set rfc4309 maxauthsize from child
• arm64: tegra: Add EL2 virtual timer interrupt for Tegra194
• net: smc: fix splice entry lifetime imbalance in smc_rx_splice
• net/smc: rdma write inline if qp has sufficient inline space
• net: atlantic: free stranded TX buffers on ring deinit
• net/sched: act_ct: fix sk_buff leak when the header checks reject a packet
• openvswitch: move key and ovs_cb update out of handle_fragments
• net: sched: use skb_ip_totlen and iph_totlen
• openvswitch: use skb_ip_totlen in conntrack
• net: add a couple of helpers for iph tot_len
• mm/ptdump: always stabilise against page table freeing using init_mm
• sched/psi: Shut down rtpoll_timer in psi_cgroup_free()
• drm/amd/pm: fix torn gpu metrics reads
• ice: wait for reset completion in ice_resume()
• jiffies: Define secs_to_jiffies()
• can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure
• i2c: iproc: reset bus after timeout if START_BUSY is stuck
• i2c: bcm-iproc: remove printout on handled timeouts
• i2c: imx: Fix slave registration race and error handling
• binfmt_misc: restore write access when removing an entry
• fs: don't block write during exec on pre-content watched files
• fsnotify: opt-in for permission events at file open time
• ice: fix memory leak in ice_lbtest_prepare_rings()
• ice: fix VF interrupts cleanup
• scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write
• scsi: scsi_debug: Rename zone type constants
• scsi: sd: sd_zbc: Return early in sd_zbc_check_zoned_characteristics()
• scsi: sd: sd_zbc: Introduce struct zoned_disk_info
• scsi: sd: sd_zbc: Use logical blocks as unit when querying zones
• scsi: sd: sd_zbc: Improve source code documentation
• net: pktgen: fix proc entry use-after-free
• net: pktgen: fix code style (WARNING: Block comments)
• igc: remove napi_synchronize() in igc_down()
• wifi: libertas_tf: fix use-after-free in lbtf_free_adapter()
• ksmbd: reject repeated SMB2 NEGOTIATE requests
• ksmbd: conn lock to serialize smb2 negotiate
• mm/vmstat: fold stranded per-cpu node stats when a node comes online
• ksmbd: validate minimum PDU size for transform requests
• smb/server: fix minimum SMB2 PDU size
• smb/server: fix minimum SMB1 PDU size
• ksmbd: rename smb2_get_msg to smb_get_msg
• super: fix emergency thaw deadlock on frozen block devices
• ftrace: Add global mutex to serialize trace_parser access
• net/sched: serialize qdisc_rtab_list against concurrent get/put
• ksmbd: defer destroy_previous_session() until after NTLM authentication
• libceph: fix two unsafe bare decodes in decode_lockers()
• ceph: fix hanging __ceph_get_caps() with stale mds_wanted
• ceph: print cluster fsid and client global_id in all debug logs
• ceph: rename _to_client() to _to_fs_client()
• libceph: add doutc and *_client debug macros support
• libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE
• libceph: Amend checking to fix make W=1 build breakage
• ceph: avoid fs reclaim while using current->journal_info
• sctp: avoid auth_enable sysctl UAF during netns teardown
• mptcp: decrement subflows counter on failed passive join
• mptcp: fix subflow accounting on close
• mptcp: cleanup MPJ subflow list handling
• serial: sc16is7xx: implement gpio get_direction() callback
• serial: sc16is7xx: fix regression with GPIO configuration
• serial: sc16is7xx: remove obsolete out_thread label
• serial: sc16is7xx: Fill in rs485_supported
• sc16is7xx: Properly resume TX after stop
• wifi: brcmfmac: set F2 blocksize to 256 for BCM43752
• wifi: brcmfmac: fix 43752 SDIO FWVID incorrectly labelled as Cypress (CYW)
• serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms
• serial: 8250_mid: Remove unneeded test for ->setup() presence
• wifi: brcmfmac: drain bus_reset work on device removal
• ALSA: seq: close a re-opened queue timer in the destructor
• media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor()
• media: v4l: async: Set owner for async sub-devices
• wifi: ath6kl: fix use-after-free in aggr_reset_state()
• media: imx219: Fix maximum frame length in lines
• media: i2c: imx219: Rename VTS to FRM_LENGTH
• media: i2c: imx219: Correct the minimum vblanking value
• media: i2c: imx219: Drop IMX219_VTS_* macros
• media: marvell-cam: fix missing pci_disable_device() on remove
• drm/i915/hdcp: require monotonically increasing seq_num_v
• drm/i915/hdcp: check streams[] bounds before overflow
• drm/i915/vrr: require valid min/max vfreq for VRR
• media: aspeed: fix missing of_reserved_mem_device_release() on probe failure
• drm/virtio: bound EDID block reads to the response buffer
• drm/virtio: Return proper error codes instead of -1
• drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT
• drm/tegra: fbdev: Remove offset into framebuffer memory
• drm/displayid: fix Tiled Display Topology ID size
• drm/virtio: use uninterruptible resv lock for plane updates
• dma-buf/drivers: make reserving a shared slot mandatory v4
• drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers
• drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers
• usb: gadget: f_tcm: synchronize delayed set_alt with teardown
• drm/dp/mst: fix buffer overflows in sideband chunk accumulation
• fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list
• octeontx2-pf: fix SQB pointer leak on init failure
• net: ipa: fix SMEM state handle leaks in SMP2P init
• espintcp: use sk_msg_free_partial to fix partial send
• bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline()
• bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c
• bootconfig: do not put quotes on cmdline items unless necessary
• net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked
• net/sched: taprio: avoid calling child->ops->dequeue(child) twice
• gpio: tegra: do not call pinctrl for GPIO direction
• treewide: rename pinctrl_gpio_direction_output_new()
• octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF

The 120 most recent commits in this release — the full changelog is longer:

• Linux 6.18.46
• ALSA: hda/realtek: Enable headset mic on F+ FLAPTOP r
• firewire: ohci: initialize page array to use alloc_pages_bulk() correctly
• drm/vmwgfx: Set surface-framebuffer GEM objects
• erofs: fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS on some UP platforms
• spi: virtio: mark device ready before registering the controller
• drm/log: Fix infinite loop when scale is too large for display
• drm/client: Remove drm_client_framebuffer_delete()
• drm/client: Deprecate struct drm_client_buffer.gem
• drm/client: Inline drm_client_buffer_addfb() and _rmfb()
• drm/client: Move dumb-buffer handling to drm_client_framebuffer_create()
• drm/client: Remove pitch from struct drm_client_buffer
• drm/log: Fix out-of-bounds read on empty message length
• drm/xe/oa: Fix sync entry leak on OA config emit failure
• firewire: ohci: fix NULL pointer dereference in ar_context_release
• firewire: ohci: split page allocation from dma mapping
• net/sched: cls_bpf: reject dev-bound programs bound to a different device
• accel/amdxdna: Skip unmapped range in aie2_populate_range()
• net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG
• regmap: sdw-mbq: don't call an unset readable_reg callback
• m68k: Define NR_CPUS to 1
• net/sched: cls_u32: skip hash tables in u32_bind_class()
• net/sched: act_api: fix TOCTOU NULL deref on a->goto_chain
• af_packet: Don't send zero-byte data in tpacket_snd().
• regmap: sdw-mbq: Fix swap of timeout and retry times
• ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers
• net/tls: Fail tls_sw_splice_read() after a failed async decrypt
• net: ngbe: fix NULL pointer dereference in non-MSI-X interrupt enabling
• net: tap: fix wrong transport_header when sending VLAN-tagged frame
• net: packet: fix wrong transport_header when sending VLAN-tagged frame
• net: phy: realtek: fix EEE advertisement write on the internal PHY MMD path
• tcp: fix icsk_ack.ato bitfield overflow
• veth: fix queue index used to wake the peer txq in veth_poll
• macvlan: inherit needed_headroom and needed_tailroom from lowerdev
• ipvlan: inherit needed_headroom and needed_tailroom from phy_dev
• eth: bnxt: keep the aRFS rmap updated when TPH is enabled
• eth: bnxt: cancel IRQ notifier before freeing affinity mask
• netfilter: ipset: let destroy callbacks adjust ext mem size
• netfilter: ipset: fix list type element drift bug
• netfilter: flowtable: publish GC-visible tuple last
• netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path
• netfilter: ipset: fix refcount race between list:set GC and swap
• ASoC: tas2781: fix clang build error for goto bypassing cleanup variable
• gpio: ml-ioh: share the register lock across channels
• perf: Reject exited events as group leaders
• riscv: ftrace: Fix ftrace_modify_call failure on kprobed functions
• ovpn: finish crypto callback cleanup before peer release
• ovpn: fix NULL dereference when killing missing key
• crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req()
• crypto: ccm - Set rfc4309 maxauthsize from child
• arm64: tegra: Add EL2 virtual timer interrupt for Tegra194
• NTB: ntb_netdev: Preserve RX queue depth on allocation failure
• net: ntb_netdev: Introduce per-queue context
• ASoC: SOF: ipc4-topology: Refresh copier IPC payload before widget setup
• drm/amd/pm: fix pptable use-after-free
• drm/amd/pm: adjust the visibility of pp_table sysfs node
• mm/page_table_check: skip special zero mappings
• ring-buffer: Prevent resizing of persistent ring buffer
• ring-buffer: Store bpage pointers into subbuf_ids
• ring-buffer: Add helper functions for allocations
• sched_ext: Take cgroup_lock() first in scx_cgroup_lock()
• sched_ext: Reorganize enable/disable path for multi-scheduler support
• sched_ext: Update p->scx.disallow warning in scx_init_task()
• futex: Fix race in futex_pivot_pending() during private hash resize
• can: rcar_canfd: change the initializing flow for clocks and resets
• can: rcar_canfd: Extract rcar_canfd_global_{,de}init()
• can: rcar_canfd: Use devm_clk_get_optional() for RAM clk
• can: rcar_canfd: Invert global vs. channel teardown
• can: rcar_canfd: Invert reset assert order
• binfmt_misc: don't leak the user namespace when the mount fails
• ata: libata-scsi: terminate deferred commands on time out
• ASoC: tas2562: Validate values for volume writes
• KVM: x86: Cancel delayed I/O APIC EOI handling before destroying vCPUs
• userfaultfd: wait on source PMD during UFFDIO_MOVE
• mm: replace pmd_to_swp_entry() with softleaf_from_pmd()
• fs/proc/task_mmu: refactor pagemap_pmd_range()
• btrfs: zoned: fix missing chunk metadata reservation
• btrfs: remove fs_info argument from btrfs_zoned_activate_one_bg()
• ksmbd: validate minimum PDU size for transform requests
• smb/server: fix minimum SMB2 PDU size
• smb/server: fix minimum SMB1 PDU size
• ksmbd: rename smb2_get_msg to smb_get_msg
• ksmbd: Fix to handle removal of rfc1002 header from smb_hdr
• smb/server: rename include guard in smb_common.h
• smb: move get_rfc1002_len() to common/smbglob.h
• net/sched: serialize qdisc_rtab_list against concurrent get/put
• libceph: fix two unsafe bare decodes in decode_lockers()
• libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE
• libceph: Amend checking to fix make W=1 build breakage
• ceph: fix hanging __ceph_get_caps() with stale mds_wanted
• ceph: avoid fs reclaim while using current->journal_info
• xfs: check v5 superblock features early
• xfs: check xfarray iteration errors when committing unlinked inode lists
• xfs: don't ignore runtime errors in xrep_iunlink_reload_next
• xfs: don't swallow dquot recovery verification errors
• xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN
• xfs: avoid UAF on sc->tempip in xrep_tempfile_create
• xfs: don't return EFSCORRUPTED when scrubbing corrupt parent pointers
• xfs: fix another iunlink infinite loop bug in online fsck
• xfs: fix allocated inodes that show up in the unlinked list
• xfs: don't walk off the end of a null sc->sa.agi_bp in AGI repair
• xfs: don't zap the attr fork on repair when there are queued pptr updates
• xfs: fix ilock leak on error in xfs_dq_get_next_id
• xfs: load next_agino from the correct xfarray in xrep_iunlink_relink_prev
• xfs: nlink scrub must take IOLOCK before determining ILOCK state
• xfs: pass runtime errors from xrep_iunlink_mark_ondisk_rec up to callers
• xfs: set the prev pointer when reinserting an inode on the unlinked list
• xfs: don't double-lock when deleting a self-referential directory
• xfs: only check mergeability of bnobt records
• xfs: zero i_nlink before repair puts inode on unlinked list
• xfs: fix transaction block reservation in xrep_rtbitmap
• xfs: check cowextsize in xrep_inode_cowextsize
• xfs: clear zapped attr fork state when bmap repair finds no attr fork
• xfs: mark nonzero sb_gquotino as corrupt on metadir filesystems
• xfs: bounds-check buffer log item's dirty bitmap
• xfs: fix off-by-one in rtrefcount btree root level validation
• xfs: propagate errors from xfs_rtginode_load
• drm/amdgpu: disallow multiple FENCE chunks in one submit
• drm/amdgpu: Fix UVD decode image min size calculation
• drm/amdgpu: Fix UVD dpb min size calculation for H264

The 117 most recent commits in this release — the full changelog is longer:

• Linux 6.6.153
• ring-buffer: Use current_context for safe per-CPU buffer swap
• ring-buffer: Remove jump to out label in ring_buffer_swap_cpu()
• net: harmonize tstats and dstats
• binfmt_misc: use exe_file_deny_write_access() for the interpreter clone
• net/x25: fix use-after-free of the socket by its timers
• erofs: fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS on some UP platforms
• net/sched: cls_bpf: reject dev-bound programs bound to a different device
• net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG
• m68k: Define NR_CPUS to 1
• m68k: use the coherent DMA code for coldfire without data cache
• dma-direct: add a CONFIG_ARCH_HAS_DMA_ALLOC symbol
• net/sched: cls_u32: skip hash tables in u32_bind_class()
• net/sched: act_api: fix TOCTOU NULL deref on a->goto_chain
• net: sched: Add initial TC error skb drop reasons
• net: sched: Move drop_reason to struct tc_skb_cb
• packet: add a generic drop reason for receive
• net, sched: Fix SKB_NOT_DROPPED_YET splat under debug config
• net, sched: Add tcf_set_drop_reason for {__,}tcf_classify
• net, sched: Make tc-related drop reason more flexible
• af_packet: Don't send zero-byte data in tpacket_snd().
• ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers
• net/tls: Fail tls_sw_splice_read() after a failed async decrypt
• net: packet: fix wrong transport_header when sending VLAN-tagged frame
• macvlan: inherit needed_headroom and needed_tailroom from lowerdev
• ipvlan: inherit needed_headroom and needed_tailroom from phy_dev
• netfilter: ipset: let destroy callbacks adjust ext mem size
• netfilter: ipset: fix list type element drift bug
• netfilter: flowtable: publish GC-visible tuple last
• netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path
• netfilter: ipset: fix refcount race between list:set GC and swap
• crypto: ccm - Set rfc4309 maxauthsize from child
• arm64: tegra: Add EL2 virtual timer interrupt for Tegra194
• mm/huge_memory: fix huge_zero_pfn race
• KVM: SVM: Serialize accesses to the owner and mirror list with separate lock
• mm/ptdump: always stabilise against page table freeing using init_mm
• mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF
• mm/pagewalk: split walk_page_range_novma() into kernel/user parts
• drm/amdgpu: move debug_vm handling to amdgpu_cs_parser_fini
• drm/amd/pm: fix pptable use-after-free
• drm/amd/pm: fix torn gpu metrics reads
• can: rcar_canfd: change the initializing flow for clocks and resets
• i2c: iproc: reset bus after timeout if START_BUSY is stuck
• i2c: bcm-iproc: remove printout on handled timeouts
• vxlan: use pskb_network_may_pull() for transmit path header pulls
• vxlan: Handle stats using NETDEV_PCPU_STAT_DSTATS.
• vrf: Make pcpu_dstats update functions available to other modules.
• net: core,vrf: Change pcpu_dstat fields to u64_stats_t
• vxlan: Do not alloc tstats manually
• ice: fix VF interrupts cleanup
• binfmt_misc: restore write access when removing an entry
• fs: don't block write during exec on pre-content watched files
• veth: convert frag_list skbs before running XDP
• net: pktgen: fix proc entry use-after-free
• net: pktgen: fix code style (WARNING: Block comments)
• ksmbd: reject repeated SMB2 NEGOTIATE requests
• ksmbd: conn lock to serialize smb2 negotiate
• igc: remove napi_synchronize() in igc_down()
• ASoC: tas2562: Validate values for volume writes
• mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE
• btrfs: zoned: fix missing chunk metadata reservation
• btrfs: remove fs_info argument from btrfs_zoned_activate_one_bg()
• btrfs: add space_info argument to btrfs_chunk_alloc()
• btrfs: add debug build only WARN
• tcp: challenge ACK for non-exact RST in SYN-RECEIVED
• tcp: fast path functions later
• tcp: Pass flags to __tcp_send_ack
• ksmbd: validate minimum PDU size for transform requests
• smb/server: fix minimum SMB2 PDU size
• smb/server: fix minimum SMB1 PDU size
• ksmbd: rename smb2_get_msg to smb_get_msg
• smb/server: rename include guard in smb_common.h
• smb: move get_rfc1002_len() to common/smbglob.h
• smb: move smb_version_values to common/smbglob.h
• super: fix emergency thaw deadlock on frozen block devices
• net/sched: serialize qdisc_rtab_list against concurrent get/put
• net: gro: fix double aggregation of flush-marked skbs
• net: move skb_gro_receive_list from udp to core
• libceph: fix two unsafe bare decodes in decode_lockers()
• userfaultfd: prevent registration of special VMAs
• userfaultfd: move vma_can_userfault out of line
• mm: userfaultfd: add pgtable_supports_uffd_wp()
• iomap: fix out-of-bounds bitmap_set() with zero-length range
• iomap: hold state_lock over call to ifs_set_range_uptodate()
• ASoC: fsl_sai: Fix spurious BCLK on resume by clearing BYP
• libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE
• libceph: Amend checking to fix make W=1 build breakage
• ceph: Use a folio in ceph_page_mkwrite()
• ceph: fix hanging __ceph_get_caps() with stale mds_wanted
• ceph: Remove ceph_writepage()
• ceph: avoid fs reclaim while using current->journal_info
• RISC-V: Provide pgtable_l5_enabled on rv32
• xfs: check v5 superblock features early
• xfs: don't swallow dquot recovery verification errors
• xfs: fix ilock leak on error in xfs_dq_get_next_id
• xfs: only check mergeability of bnobt records
• drm/amdgpu: disallow multiple FENCE chunks in one submit
• drm/amdgpu: Fix UVD decode image min size calculation
• drm/amdgpu: Fix UVD dpb min size calculation for H264
• drm/amdgpu: Fix UVD min buffer sizes
• drm/amdgpu: Implement insert_end for VCE 3
• drm/amdgpu: Reject UVD message with dimensions above 4096
• drm/amdgpu: validate GEM_CREATE domain combinations
• drm/amdgpu: Reject UVD message with invalid number of h265 refs
• s390/vfio_ccw: Selectively expand io_mutex
• s390/vfio_ccw: Move cp cleanup out of not operational
• s390/vfio_ccw: Fix out of bounds check on CCW array
• s390/vfio_ccw: Ensure index for read/write regions are within range
• s390/vfio_ccw: Cancel existing workqueues
• s390/vfio_ccw: Limit the number of channel program segments
• drm/radeon: fix autosuspend cleanup during teardown
• mmc: sdhci: make tuning_err a signed int
• mmc: sdhci: unmap the bounce buffer before device release
• mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit
• libceph: tolerate addrvecs with multiple entries of the same type
• ceph: fix MDS random selection readiness predicate
• libceph: Avoid using i

The 107 most recent commits in this release — the full changelog is longer:

• Linux 6.1.184
• ring-buffer: Use current_context for safe per-CPU buffer swap
• ring-buffer: Remove jump to out label in ring_buffer_swap_cpu()
• Bluetooth: mgmt: fix pending command UAF in EIR updates
• Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync
• Bluetooth: hci_sync: call destroy in hci_cmd_sync_run if immediate
• Bluetooth: hci_sock: Prevent race in socket write iter and sock bind
• udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf()
• erofs: fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS on some UP platforms
• usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path
• RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages
• Bluetooth: hci_sync: Fix not using correct handle
• binfmt_misc: use exe_file_deny_write_access() for the interpreter clone
• mm/huge_memory: fix huge_zero_pfn race
• net/x25: fix use-after-free of the socket by its timers
• net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG
• net/sched: cls_u32: skip hash tables in u32_bind_class()
• af_packet: Don't send zero-byte data in tpacket_snd().
• ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers
• net/tls: Fail tls_sw_splice_read() after a failed async decrypt
• net: packet: fix wrong transport_header when sending VLAN-tagged frame
• macvlan: inherit needed_headroom and needed_tailroom from lowerdev
• ipvlan: inherit needed_headroom and needed_tailroom from phy_dev
• netfilter: ipset: let destroy callbacks adjust ext mem size
• netfilter: ipset: fix list type element drift bug
• netfilter: flowtable: publish GC-visible tuple last
• netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path
• netfilter: ipset: fix refcount race between list:set GC and swap
• crypto: ccm - Set rfc4309 maxauthsize from child
• arm64: tegra: Add EL2 virtual timer interrupt for Tegra194
• netfilter: nf_conntrack: defer invalid log until after unlock
• netfilter: conntrack: sctp: use nf log infrastructure for invalid packets
• net/sched: act_ct: fix sk_buff leak when the header checks reject a packet
• openvswitch: move key and ovs_cb update out of handle_fragments
• net: sched: use skb_ip_totlen and iph_totlen
• openvswitch: use skb_ip_totlen in conntrack
• KVM: SVM: Serialize accesses to the owner and mirror list with separate lock
• veth: fix skb length accounting after XDP frag adjustment
• veth: Introduce veth_xdp_buff wrapper for xdp_buff
• mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF
• drm/amdgpu: move debug_vm handling to amdgpu_cs_parser_fini
• can: rcar_canfd: change the initializing flow for clocks and resets
• can: rcar_canfd: Extract rcar_canfd_global_{,de}init()
• can: rcar_canfd: Use devm_clk_get_optional() for RAM clk
• can: rcar_canfd: Invert reset assert order
• drm/amd/pm: fix pptable use-after-free
• drm/amd/pm: fix torn gpu metrics reads
• can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure
• i2c: iproc: reset bus after timeout if START_BUSY is stuck
• i2c: bcm-iproc: remove printout on handled timeouts
• binfmt_misc: restore write access when removing an entry
• fs: don't block write during exec on pre-content watched files
• fsnotify: opt-in for permission events at file open time
• ice: fix memory leak in ice_lbtest_prepare_rings()
• ice: fix VF interrupts cleanup
• veth: convert frag_list skbs before running XDP
• net: pktgen: fix proc entry use-after-free
• net: pktgen: fix code style (WARNING: Block comments)
• igc: remove napi_synchronize() in igc_down()
• ksmbd: reject repeated SMB2 NEGOTIATE requests
• ksmbd: conn lock to serialize smb2 negotiate
• Bluetooth: hci_sync: Fix advertising data UAFs
• Bluetooth: hci_core: Fix not handling hdev->le_num_of_adv_sets=1
• Bluetooth: hci_conn, hci_sync: Use __counted_by() to avoid -Wfamnae warnings
• overflow: Change DEFINE_FLEX to take __counted_by member
• mm/vmstat: fold stranded per-cpu node stats when a node comes online
• Bluetooth: mgmt: fix UAF in pair command cancellation
• Bluetooth: MGMT: Protect mgmt_pending list with its own lock
• Bluetooth: MGMT: Remove unused mgmt_pending_find_data
• Bluetooth: MGMT: Fix not generating command complete for MGMT_OP_DISCONNECT
• Bluetooth: hci_sync: Introduce hci_cmd_sync_run/hci_cmd_sync_run_once
• erofs: cap LZMA stream pool size
• erofs: maintain cookies of share domain in self-contained list
• erofs: tidy up internal.h
• mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE
• mm/migrate_device: page_remove_rmap() -> folio_remove_rmap_pte()
• ksmbd: validate minimum PDU size for transform requests
• smb/server: fix minimum SMB2 PDU size
• smb/server: fix minimum SMB1 PDU size
• ksmbd: rename smb2_get_msg to smb_get_msg
• smb/server: rename include guard in smb_common.h
• super: fix emergency thaw deadlock on frozen block devices
• ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL
• ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl
• ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow
• net/sched: serialize qdisc_rtab_list against concurrent get/put
• net: gro: fix double aggregation of flush-marked skbs
• net: move skb_gro_receive_list from udp to core
• libceph: fix two unsafe bare decodes in decode_lockers()
• ASoC: fsl_sai: Fix spurious BCLK on resume by clearing BYP
• ceph: fix hanging __ceph_get_caps() with stale mds_wanted
• ceph: rename _to_client() to _to_fs_client()
• ceph: pass the mdsc to several helpers
• libceph: add doutc and *_client debug macros support
• libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE
• libceph: Amend checking to fix make W=1 build breakage
• ceph: avoid fs reclaim while using current->journal_info
• sctp: avoid auth_enable sysctl UAF during netns teardown
• mptcp: pm: userspace: fix use-after-free in get_local_id
• mptcp: pm: use addr entry for get_local_id
• mptcp: add mptcp_userspace_pm_lookup_addr helper
• mptcp: pm: avoid code duplication to lookup endp
• mei: bus: access mei_device under device_lock on cleanup
• ALSA: hda: codecs: hdmi: disable keep-alive before audio format change
• wifi: brcmfmac: set F2 blocksize to 256 for BCM43752
• wifi: brcmfmac: fix 43752 SDIO FWVID incorrectly labelled as Cypress (CYW)
• wifi: brcmfmac: drain bus_reset work on device removal

The 113 most recent commits in this release — the full changelog is longer:

• Linux 6.1.183
• hwmon: (nct6775) Fix non-existent ALARM warning
• hwmon: (nct6775) Fix register for nct6799
• regulator: devres: fix devm_regulator_get_enable_read_voltage() return
• bpf: tcp: fix double sock release on batch realloc
• thunderbolt: Bound the DROM dual link port number before indexing sw->ports
• sctp: clear new_transport when removing a peer
• sctp: fix use-after-free of cached ASCONF chunk
• sctp: keep chunk->transport in step with the list it is queued on
• scsi: scsi_debug: Negate wrapped memcmp() result
• bpf, sockmap: Fix sk_redir use-after-free in send verdict
• sched/psi: Shut down rtpoll_timer in psi_cgroup_free()
• ip6_tunnel: clear skb2->cb[] in ip6ip6_err()
• ipv6: fix Route Information option length validation
• ptp: ocp: Fix board ID over-read
• Revert "thermal/drivers/hwmon: Cleanup coding style a bit"
• KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page
• smb: client: Fix use-after-free in cifs_try_adding_channels()
• tipc: read le->link under the node lock in tipc_node_link_down()
• vhost: reset the vring metadata cache on vring reconfiguration
• vsock/virtio: avoid refilling the RX queue after teardown
• vsock/virtio: read virtqueues under worker locks
• vxlan: do not arm the ageing timer on a device that is down
• xdp: reject clones that overrun skb_shared_info tailroom
• net/sched: act_gact, act_police: range check the fallback control action
• net: atlantic: free RX pages of consumed but not refilled buffers
• net: atlantic: free stranded TX buffers on ring deinit
• netfilter: bridge: release template ct on non-IP path
• ipv6: prevent in6_dev_get() from resurrecting inet6_dev
• net: smc: fix splice entry lifetime imbalance in smc_rx_splice
• fbdev: bitblit: bound-check glyph index in bit_cursor()
• tracing: Fix race between update_event_fields and, event_define_fields
• ALSA: usx2y: bound the hwdep mmap fault offset
• ring-buffer: Fix crash passing ERR_PTR to kthread_stop()
• misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free
• misc: fastrpc: fix channel ctx ref leak when session alloc fails
• staging: rtl8723bs: validate monitor transmit frame lengths
• staging: rtl8723bs: fix missing shared-key auth challenge length check
• staging: rtl8723bs: fix OOB read in WMM_param_handler()
• staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie()
• serial: 8250_dma: Clear stale RX state on shutdown
• ipv4: fix use-after-free in fib_nhc_update_mtu()
• ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops
• selftests/bpf: Fail unbound UDP on sockmap update
• selftests/bpf: Adapt sockmap update error handling
• fscrypt: Replace mk_users keyring with simple list
• RDMA/rxe: Fix a use-after-free problem in rxe_mmap
• pinctrl: renesas: rzg2l: Use -ENOTSUPP instead of -EOPNOTSUPP
• fortify: Disable -Wstringop-overread in tests
• fortify: refactor test_fortify Makefile to fix some build problems
• futex: Prevent robust futex exit race some more
• net: bridge: mrp: fix uninitialised bytes on the wire
• netfilter: ebt_nflog: pin the NFLOG backend
• net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header
• net: octeontx2-pf: Fix UB in shift operation
• net/sched: reject overly deep qdisc hierarchies
• net: openvswitch: reallocate update replies for mismatched IDs
• net/packet: reset the MAC header on the packet-socket transmit path
• ipvs: clear IPv4 options after rebasing tunnel ICMP errors
• ipvs: properly update the overload flag on dest edit
• ipvs: add totalconns for dest
• ima: fix out-of-bounds read in xattr_verify()
• Input: evdev - fix information leak in evdev_pass_values()
• vt: stabilize tty reference in kbd_keycode with tty_port_tty_get
• vt: add permission check for KDSKBMETA ioctl
• net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup()
• usb: gadget: f_ncm: Use unsigned int for ndp_index
• usb: cdnsp: fix incorrect endian conversions for APB timeout register
• thunderbolt: icm: Preserve USB4 proxy data-valid bit
• usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm()
• ALSA: usb-audio: fix OOB write on Type II inbound URBs
• Input: evdev - sanitize event type index when fetching event masks
• spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers
• KVM: x86: Check for invalid/obsolete root after making MMU pages available
• KVM: x86/mmu: Rename __direct_map() to direct_map()
• hwmon: (ads7828) Fix external VREF regulator handling
• regulator: devres: add API for reference voltage supplies
• hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination
• tls: don't abort the connection on signal-interrupted sends
• sctp: clear control chunk transport if it is being removed
• net/atm: fix slab-out-of-bounds read in vcc_setsockopt()
• ata: pata_sl82c105: fix bridge revision use-after-free
• net: thunderbolt: Tear down DMA paths before stopping the rings
• net: qrtr: ns: Raise lookup limit to 128
• net/smc: fix TOCTOU race between smc_listen_out() and listener close
• net: remove WARN_ON_ONCE() from sk_mc_loop()
• net: prestera: validate firmware header length
• net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length
• tcp: fix TFO max_qlen accounting across reuseport migration
• sctp: fix addip_serial increment on ASCONF_ACK allocation failure
• bnxt_en: Fix PTP PPS setting bug
• bnxt_en: Disable EOP for TPA on all chips to prevent data corruption
• bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips
• selftests/ftrace: refactor eprobes test to fix argument checks
• hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations
• hwmon: (lm25066) Use i2c_get_match_data()
• hwmon: (nzxt-smart2) Check return value of init_device() in probe
• net/openvswitch: check Ethernet header length in key_extract()
• net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter
• udp: fix potential use-after-free in tunnel segmentation
• vhost/vdpa: reject overflowing PA map page counts on 32-bit
• bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()
• bpf: tcp: Avoid socket skips and repeats during iteration
• bpf: tcp: Use bpf_tcp_iter_batch_item for bpf_tcp_iter_state batch items
• bpf: tcp: Get rid of st_bucket_done
• bpf: tcp: Make sure iter->batch always contains a full bucket snapshot
• bpf: tcp: Make mem flags configurable through bpf_iter_tcp_realloc_batch
• tcp: add a scheduling point in established_get_first()
• counter: microchip-tcb-capture: Fix DT channel validation
• net/mlx5: fw_tracer, return NULL on create error
• net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete
• net/sched: cls_route: fix fastmap use-after-free on filter
• net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler()

The 107 most recent commits in this release — the full changelog is longer:

• Linux 7.1.9
• thunderbolt: Fix bandwidth group reservation indexing
• thunderbolt: Bound the DROM dual link port number before indexing sw->ports
• sctp: clear new_transport when removing a peer
• sctp: fix use-after-free of cached ASCONF chunk
• sctp: keep chunk->transport in step with the list it is queued on
• scsi: scsi_debug: Negate wrapped memcmp() result
• bpf, sockmap: Fix sk_redir use-after-free in send verdict
• fsverity: Fix silent truncation in bpf_get_fsverity_digest()
• fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions
• mm/filemap: __filemap_add_folio() restore index before retrying
• ima: Instantiate file_truncate and path_truncate hooks
• sched_ext: Take cgroup_lock() first in scx_cgroup_lock()
• sched/psi: Create the psimon kthread outside of cgroup_mutex
• sched/psi: Shut down rtpoll_timer in psi_cgroup_free()
• fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy()
• fs,fsverity: remove check for fsverity being enabled in setattr_prepare()
• ip6_tunnel: clear skb2->cb[] in ip6ip6_err()
• ipv6: fix Route Information option length validation
• mm/ptdump: always stabilise against page table freeing using init_mm
• mm/page_table_check: skip special zero mappings
• ring-buffer: Use current_context for safe per-CPU buffer swap
• ring-buffer: Initialise reader page order in rb_allocate_cpu_buffer()
• ptp: ocp: Fix board ID over-read
• Revert "thermal: hwmon: Register a hwmon device for each thermal zone"
• Revert "thermal/drivers/hwmon: Cleanup coding style a bit"
• ring-buffer: Prevent resizing of persistent ring buffer
• eventfs: Use children field for rcu head and add memory barriers
• eventfs: Fix use-after-free in eventfs_remove_rec()
• KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page
• KVM: SVM: Serialize accesses to the owner and mirror list with separate lock
• smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive()
• smb: client: Fix use-after-free in cifs_try_adding_channels()
• tipc: read le->link under the node lock in tipc_node_link_down()
• tls: don't leave a full plaintext sk_msg ring unpushed
• tls: rx: restore msg_iter before TLS 1.3 optimistic retry
• vhost: reset the vring metadata cache on vring reconfiguration
• veth: fix skb length accounting after XDP frag adjustment
• vsock/virtio: avoid refilling the RX queue after teardown
• vsock/virtio: read virtqueues under worker locks
• vxlan: do not arm the ageing timer on a device that is down
• xdp: reject clones that overrun skb_shared_info tailroom
• x86/mce: Set up the polling timer before CMCI discovery
• x86/CPU: Add a tlbi= cmdline switch
• arm64: remove redundant concurrent ptdump UAF mitigation
• dibs: initialise dibs->lock in dibs_dev_alloc()
• Revert "drm/amdgpu: fix aperture mapping leak"
• binfmt_misc: don't warn when the mount is completed from another user namespace
• ovl: don't warn when the mount is completed from another user namespace
• net/sched: act_gact, act_police: range check the fallback control action
• net/sched: act_ct: fix sk_buff leak when the header checks reject a packet
• net: atlantic: free RX pages of consumed but not refilled buffers
• net: atlantic: free stranded TX buffers on ring deinit
• netfilter: nf_conntrack: defer invalid log until after unlock
• netfilter: bridge: release template ct on non-IP path
• NTB: ntb_netdev: Preserve RX queue depth on allocation failure
• net: devmem: prevent net-iov / page mixing
• net/x25: fix use-after-free of the socket by its timers
• net/dibs: Correct freeing of dmb_clientid_arr
• ipv6: prevent in6_dev_get() from resurrecting inet6_dev
• net: smc: fix splice entry lifetime imbalance in smc_rx_splice
• net: phy: mediatek: fix TX blink masks using the RX bits
• mm/huge_memory: fix huge_zero_pfn race
• mm/huge_memory: initialise workingset state before folio split
• tracing: Fix NULL pointer dereference in module event cache removal
• ring-buffer: Prevent subbuf order change when resizing is disabled
• fbdev: bitblit: bound-check glyph index in bit_cursor()
• tracing: Fix race between update_event_fields and, event_define_fields
• perf/core: Fix group leader use-after-free after sibling detach
• drm/v3d: Serialize the scheduler timeout handlers
• ALSA: us144mkii: re-anchor capture URBs on resubmission
• ALSA: hda/tas2781: fix ACPI reference handling
• ALSA: FCP: fix OOB write in fcp_meter_ctl_get()
• ALSA: usx2y: bound the hwdep mmap fault offset
• ALSA: usb: Fix UAF at delayed release of MIDI2 EPs
• mm/damon: adjust isolated pages stat for DAMOS_MIGRATE_{HOT,COLD}
• samples/damon/mtier: error out for zero quota goal target values
• mm/damon/ops-common: putback folios on invalid migrate nid
• mm/damon/lru_sort: error out for >10000 active_mem_bp
• ring-buffer: Fix crash passing ERR_PTR to kthread_stop()
• misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free
• misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke
• misc: fastrpc: Remove buffer from list prior to unmap operation
• misc: fastrpc: fix channel ctx ref leak when session alloc fails
• misc: fastrpc: Fix initial memory allocation for Audio PD memory pool
• staging: rtl8723bs: validate monitor transmit frame lengths
• staging: rtl8723bs: fix missing shared-key auth challenge length check
• staging: rtl8723bs: fix OOB read in WMM_param_handler()
• staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie()
• serial: amba-pl011: synchronize DMA teardown
• serial: amba-pl011: cancel RS485 hrtimers after freeing IRQ
• serial: amba-pl011: fix indefinite RS485 post-send delay
• serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx
• serial: 8250_dma: Clear stale RX state on shutdown
• serial: sc16is7xx: enable THRI before filling TX FIFO
• serial: qcom-geni: fix TX DMA buffer flush
• rust_binder: do not query current thread for all ioctls
• nvmem: layouts: Add fixed-layout driver
• nvmem: apple-spmi-nvmem: wrap regmap calls to satisfy CFI
• mei: pull kvfree out of spinlock
• ipv4: fix use-after-free in fib_nhc_update_mtu()
• ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops
• selftests/bpf: Adapt sockmap update error handling
• selftests/bpf: Ensure UDP sockets are bound
• Bluetooth: btusb: Add TP-Link UB600 for Realtek 8761BUV
• Bluetooth: btrtl: fix RTL8761B/BU broken LE extended scan
• selftests/xsk: acc

The 106 most recent commits in this release — the full changelog is longer:

• Linux 6.18.45
• netfilter: flowtable: ensure sufficient headroom in xmit path
• netfilter: always set route tuple out ifindex
• thunderbolt: Fix bandwidth group reservation indexing
• thunderbolt: Bound the DROM dual link port number before indexing sw->ports
• sctp: clear new_transport when removing a peer
• sctp: fix use-after-free of cached ASCONF chunk
• sctp: keep chunk->transport in step with the list it is queued on
• scsi: scsi_debug: Negate wrapped memcmp() result
• bpf, sockmap: Fix sk_redir use-after-free in send verdict
• fsverity: Fix silent truncation in bpf_get_fsverity_digest()
• fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions
• mm/filemap: __filemap_add_folio() restore index before retrying
• ima: Instantiate file_truncate and path_truncate hooks
• sched/psi: Create the psimon kthread outside of cgroup_mutex
• sched/psi: Shut down rtpoll_timer in psi_cgroup_free()
• fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy()
• ip6_tunnel: clear skb2->cb[] in ip6ip6_err()
• ipv6: fix Route Information option length validation
• mm/ptdump: always stabilise against page table freeing using init_mm
• ring-buffer: Use current_context for safe per-CPU buffer swap
• ring-buffer: Initialise reader page order in rb_allocate_cpu_buffer()
• ptp: ocp: Fix board ID over-read
• Revert "thermal/drivers/hwmon: Cleanup coding style a bit"
• eventfs: Fix use-after-free in eventfs_remove_rec()
• KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page
• KVM: SVM: Serialize accesses to the owner and mirror list with separate lock
• smb: client: Fix use-after-free in cifs_try_adding_channels()
• tipc: read le->link under the node lock in tipc_node_link_down()
• tls: don't leave a full plaintext sk_msg ring unpushed
• tls: rx: restore msg_iter before TLS 1.3 optimistic retry
• vhost: reset the vring metadata cache on vring reconfiguration
• veth: fix skb length accounting after XDP frag adjustment
• vsock/virtio: avoid refilling the RX queue after teardown
• vsock/virtio: read virtqueues under worker locks
• vxlan: do not arm the ageing timer on a device that is down
• xdp: reject clones that overrun skb_shared_info tailroom
• x86/mce: Set up the polling timer before CMCI discovery
• x86/CPU: Add a tlbi= cmdline switch
• arm64: remove redundant concurrent ptdump UAF mitigation
• dibs: initialise dibs->lock in dibs_dev_alloc()
• Revert "drm/amdgpu: fix aperture mapping leak"
• binfmt_misc: don't warn when the mount is completed from another user namespace
• ovl: don't warn when the mount is completed from another user namespace
• net/sched: act_gact, act_police: range check the fallback control action
• net/sched: act_ct: fix sk_buff leak when the header checks reject a packet
• net: atlantic: free RX pages of consumed but not refilled buffers
• net: atlantic: free stranded TX buffers on ring deinit
• netfilter: nf_conntrack: defer invalid log until after unlock
• netfilter: bridge: release template ct on non-IP path
• net: devmem: prevent net-iov / page mixing
• net/x25: fix use-after-free of the socket by its timers
• net/dibs: Correct freeing of dmb_clientid_arr
• ipv6: prevent in6_dev_get() from resurrecting inet6_dev
• net: smc: fix splice entry lifetime imbalance in smc_rx_splice
• net: phy: mediatek: fix TX blink masks using the RX bits
• mm/huge_memory: fix huge_zero_pfn race
• tracing: Fix NULL pointer dereference in module event cache removal
• ring-buffer: Prevent subbuf order change when resizing is disabled
• fbdev: bitblit: bound-check glyph index in bit_cursor()
• tracing: Fix race between update_event_fields and, event_define_fields
• perf/core: Fix group leader use-after-free after sibling detach
• drm/v3d: Serialize the scheduler timeout handlers
• ALSA: us144mkii: re-anchor capture URBs on resubmission
• ALSA: hda/tas2781: fix ACPI reference handling
• ALSA: FCP: fix OOB write in fcp_meter_ctl_get()
• ALSA: usx2y: bound the hwdep mmap fault offset
• ALSA: usb: Fix UAF at delayed release of MIDI2 EPs
• mm/damon: adjust isolated pages stat for DAMOS_MIGRATE_{HOT,COLD}
• samples/damon/mtier: error out for zero quota goal target values
• mm/damon/ops-common: putback folios on invalid migrate nid
• ring-buffer: Fix crash passing ERR_PTR to kthread_stop()
• misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free
• misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke
• misc: fastrpc: Remove buffer from list prior to unmap operation
• misc: fastrpc: fix channel ctx ref leak when session alloc fails
• misc: fastrpc: Fix initial memory allocation for Audio PD memory pool
• staging: rtl8723bs: validate monitor transmit frame lengths
• staging: rtl8723bs: fix missing shared-key auth challenge length check
• staging: rtl8723bs: fix OOB read in WMM_param_handler()
• staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie()
• serial: amba-pl011: synchronize DMA teardown
• serial: amba-pl011: cancel RS485 hrtimers after freeing IRQ
• serial: amba-pl011: fix indefinite RS485 post-send delay
• serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx
• serial: 8250_dma: Clear stale RX state on shutdown
• serial: qcom-geni: fix TX DMA buffer flush
• rust_binder: do not query current thread for all ioctls
• nvmem: layouts: Add fixed-layout driver
• nvmem: apple-spmi-nvmem: wrap regmap calls to satisfy CFI
• mei: pull kvfree out of spinlock
• ipv4: fix use-after-free in fib_nhc_update_mtu()
• ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops
• selftests/bpf: Adapt sockmap update error handling
• selftests/bpf: Ensure UDP sockets are bound
• Bluetooth: btusb: Add TP-Link UB600 for Realtek 8761BUV
• Bluetooth: btrtl: fix RTL8761B/BU broken LE extended scan
• netfilter: nf_tables: avoid softlockup warnings in nft_chain_validate
• futex: Prevent robust futex exit race some more
• iommu/vt-d: Gather the unmapped range before freeing its page tables
• dt-bindings: crypto: qcom,ice: Fix missing power-domain and iface clk
• KVM: s390: pci: Fix aisb calculation
• blk-mq: reinsert cached request to the list
• blk-mq: pop cached request if it is usable
• Revert "drm/amd/display: Fix backlight max_brightness to match exported range"
• net: bridge: mrp: fix uninitialised bytes on the wire

The 113 most recent commits in this release — the full changelog is longer:

• Linux 6.12.104
• bpf: tcp: fix double sock release on batch realloc
• thunderbolt: Fix bandwidth group reservation indexing
• thunderbolt: Bound the DROM dual link port number before indexing sw->ports
• sctp: clear new_transport when removing a peer
• sctp: fix use-after-free of cached ASCONF chunk
• sctp: keep chunk->transport in step with the list it is queued on
• scsi: scsi_debug: Negate wrapped memcmp() result
• bpf, sockmap: Fix sk_redir use-after-free in send verdict
• fsverity: Fix silent truncation in bpf_get_fsverity_digest()
• fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions
• ima: Instantiate file_truncate and path_truncate hooks
• sched/psi: Shut down rtpoll_timer in psi_cgroup_free()
• fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy()
• ip6_tunnel: clear skb2->cb[] in ip6ip6_err()
• ipv6: fix Route Information option length validation
• ptp: ocp: Fix board ID over-read
• Revert "thermal/drivers/hwmon: Cleanup coding style a bit"
• eventfs: Fix use-after-free in eventfs_remove_rec()
• KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page
• smb: client: Fix use-after-free in cifs_try_adding_channels()
• tipc: read le->link under the node lock in tipc_node_link_down()
• tls: don't leave a full plaintext sk_msg ring unpushed
• vhost: reset the vring metadata cache on vring reconfiguration
• veth: fix skb length accounting after XDP frag adjustment
• vsock/virtio: avoid refilling the RX queue after teardown
• vsock/virtio: read virtqueues under worker locks
• vxlan: do not arm the ageing timer on a device that is down
• xdp: reject clones that overrun skb_shared_info tailroom
• Revert "drm/amdgpu: fix aperture mapping leak"
• binfmt_misc: don't warn when the mount is completed from another user namespace
• ovl: don't warn when the mount is completed from another user namespace
• net/sched: act_gact, act_police: range check the fallback control action
• net/sched: act_ct: fix sk_buff leak when the header checks reject a packet
• net: atlantic: free RX pages of consumed but not refilled buffers
• net: atlantic: free stranded TX buffers on ring deinit
• netfilter: nf_conntrack: defer invalid log until after unlock
• netfilter: bridge: release template ct on non-IP path
• ipv6: prevent in6_dev_get() from resurrecting inet6_dev
• net: smc: fix splice entry lifetime imbalance in smc_rx_splice
• mm/huge_memory: fix huge_zero_pfn race
• ring-buffer: Prevent subbuf order change when resizing is disabled
• fbdev: bitblit: bound-check glyph index in bit_cursor()
• tracing: Fix race between update_event_fields and, event_define_fields
• ALSA: usx2y: bound the hwdep mmap fault offset
• ALSA: usb: Fix UAF at delayed release of MIDI2 EPs
• ring-buffer: Fix crash passing ERR_PTR to kthread_stop()
• misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free
• misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke
• misc: fastrpc: Remove buffer from list prior to unmap operation
• misc: fastrpc: fix channel ctx ref leak when session alloc fails
• staging: rtl8723bs: validate monitor transmit frame lengths
• staging: rtl8723bs: fix missing shared-key auth challenge length check
• staging: rtl8723bs: fix OOB read in WMM_param_handler()
• staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie()
• serial: 8250_dma: Clear stale RX state on shutdown
• serial: qcom-geni: fix TX DMA buffer flush
• nvmem: layouts: Add fixed-layout driver
• mei: pull kvfree out of spinlock
• ipv4: fix use-after-free in fib_nhc_update_mtu()
• ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops
• selftests/bpf: Adapt sockmap update error handling
• selftests/bpf: Ensure UDP sockets are bound
• pinctrl: renesas: rzg2l: Use -ENOTSUPP instead of -EOPNOTSUPP
• kunit/fortify: Add back "volatile" for sizeof() constants
• kunit/fortify: Replace "volatile" with OPTIMIZER_HIDE_VAR()
• futex: Prevent robust futex exit race some more
• crypto: ccp - Abort doing SEV INIT if SNP INIT fails
• crypto: ccp - Fix checks for SNP_VLEK_LOAD input buffer length
• KVM: SVM: Add support to initialize SEV/SNP functionality in KVM
• crypto: ccp - Add new SEV/SNP platform shutdown API
• dt-bindings: crypto: qcom,ice: Fix missing power-domain and iface clk
• blk-mq: reinsert cached request to the list
• blk-mq: pop cached request if it is usable
• block: Reorder the request allocation code in blk_mq_submit_bio()
• KVM: s390: pci: Fix aisb calculation
• KVM: s390: pci: Fix resource leak on IRQ registration failure
• KVM: s390: pci: Fix missing error codes and memory unaccounting
• KVM: s390: pci: Fix memory accounting for pinned/unpinned pages
• net: bridge: mrp: fix uninitialised bytes on the wire
• netfilter: ebt_nflog: pin the NFLOG backend
• mac802154: fix netdev use-after-free in beacon worker
• net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header
• net: octeontx2-pf: Fix UB in shift operation
• net/sched: reject overly deep qdisc hierarchies
• net: openvswitch: reallocate update replies for mismatched IDs
• net: fix skb length accounting after generic XDP frag adjustment
• packet: synchronize pressure clearing with ring reconfiguration
• net/packet: reset the MAC header on the packet-socket transmit path
• packet: use consistent hard_header_len in TX_RING send path
• packet: use consistent hard_header_len in non-ring send paths
• ipvs: clear IPv4 options after rebasing tunnel ICMP errors
• ipvs: properly update the overload flag on dest edit
• ipvs: add totalconns for dest
• ipvs: stop estimator after disabled calc phase
• ima: fix out-of-bounds read in xattr_verify()
• Input: evdev - fix information leak in evdev_pass_values()
• vt: stabilize tty reference in kbd_keycode with tty_port_tty_get
• vt: add permission check for KDSKBMETA ioctl
• net: usb: ipheth: fix carrier_work UAF on disconnect
• net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup()
• usb: gadget: f_ncm: Use unsigned int for ndp_index
• usb: cdnsp: fix incorrect endian conversions for APB timeout register
• thunderbolt: icm: Preserve USB4 proxy data-valid bit
• usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm()
• ALSA: usb-audio: fix OOB write on Type II inbound URBs
• Input: evdev - sanitize event type index when fetching event masks
• swapfile: call cond_resched() before locking si->lock
• mtd: spinand: repeat reading in regular mode if continuous reading fails
• mtd: spinand: try a regular dirmap if creating a dirmap for continuous reading fails
• mtd: spinand: fix direct mapping creation sizes
• spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers
• net: fec: do not release NULL pages when RX buffer allocation fails

The 114 most recent commits in this release — the full changelog is longer:

• Linux 6.6.152
• regulator: devres: fix devm_regulator_get_enable_read_voltage() return
• net/tcp_sigpool: Use kref_get_unless_zero()
• net/tcp_sigpool: Fix some off by one bugs
• bpf: tcp: fix double sock release on batch realloc
• thunderbolt: Bound the DROM dual link port number before indexing sw->ports
• sctp: clear new_transport when removing a peer
• sctp: fix use-after-free of cached ASCONF chunk
• sctp: keep chunk->transport in step with the list it is queued on
• scsi: scsi_debug: Negate wrapped memcmp() result
• bpf, sockmap: Fix sk_redir use-after-free in send verdict
• sched/psi: Shut down rtpoll_timer in psi_cgroup_free()
• fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy()
• ip6_tunnel: clear skb2->cb[] in ip6ip6_err()
• ipv6: fix Route Information option length validation
• ptp: ocp: Fix board ID over-read
• Revert "thermal/drivers/hwmon: Cleanup coding style a bit"
• eventfs: Fix use-after-free in eventfs_remove_rec()
• KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page
• smb: client: Fix use-after-free in cifs_try_adding_channels()
• tipc: read le->link under the node lock in tipc_node_link_down()
• tls: don't leave a full plaintext sk_msg ring unpushed
• vhost: reset the vring metadata cache on vring reconfiguration
• veth: fix skb length accounting after XDP frag adjustment
• vsock/virtio: avoid refilling the RX queue after teardown
• vsock/virtio: read virtqueues under worker locks
• vxlan: do not arm the ageing timer on a device that is down
• xdp: reject clones that overrun skb_shared_info tailroom
• Revert "drm/amdgpu: fix aperture mapping leak"
• ovl: don't warn when the mount is completed from another user namespace
• net/sched: act_gact, act_police: range check the fallback control action
• net/sched: act_ct: fix sk_buff leak when the header checks reject a packet
• net: atlantic: free RX pages of consumed but not refilled buffers
• net: atlantic: free stranded TX buffers on ring deinit
• netfilter: nf_conntrack: defer invalid log until after unlock
• netfilter: bridge: release template ct on non-IP path
• ipv6: prevent in6_dev_get() from resurrecting inet6_dev
• net: smc: fix splice entry lifetime imbalance in smc_rx_splice
• fbdev: bitblit: bound-check glyph index in bit_cursor()
• tracing: Fix race between update_event_fields and, event_define_fields
• ALSA: usx2y: bound the hwdep mmap fault offset
• ALSA: usb: Fix UAF at delayed release of MIDI2 EPs
• ring-buffer: Fix crash passing ERR_PTR to kthread_stop()
• misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free
• misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke
• misc: fastrpc: Remove buffer from list prior to unmap operation
• misc: fastrpc: fix channel ctx ref leak when session alloc fails
• staging: rtl8723bs: validate monitor transmit frame lengths
• staging: rtl8723bs: fix missing shared-key auth challenge length check
• staging: rtl8723bs: fix OOB read in WMM_param_handler()
• staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie()
• serial: 8250_dma: Clear stale RX state on shutdown
• mei: pull kvfree out of spinlock
• ipv4: fix use-after-free in fib_nhc_update_mtu()
• ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops
• selftests/bpf: Adapt sockmap update error handling
• fscrypt: Replace mk_users keyring with simple list
• pinctrl: renesas: rzg2l: Use -ENOTSUPP instead of -EOPNOTSUPP
• fortify: Disable -Wstringop-overread in tests
• fortify: refactor test_fortify Makefile to fix some build problems
• futex: Prevent robust futex exit race some more
• dt-bindings: crypto: qcom,ice: Fix missing power-domain and iface clk
• KVM: s390: pci: Fix aisb calculation
• KVM: s390: pci: Fix resource leak on IRQ registration failure
• KVM: s390: pci: Fix missing error codes and memory unaccounting
• KVM: s390: pci: Fix memory accounting for pinned/unpinned pages
• net: bridge: mrp: fix uninitialised bytes on the wire
• netfilter: ebt_nflog: pin the NFLOG backend
• mac802154: fix netdev use-after-free in beacon worker
• net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header
• net: octeontx2-pf: Fix UB in shift operation
• net/sched: reject overly deep qdisc hierarchies
• net: openvswitch: reallocate update replies for mismatched IDs
• packet: synchronize pressure clearing with ring reconfiguration
• net/packet: reset the MAC header on the packet-socket transmit path
• packet: use consistent hard_header_len in TX_RING send path
• packet: use consistent hard_header_len in non-ring send paths
• ipvs: clear IPv4 options after rebasing tunnel ICMP errors
• ipvs: properly update the overload flag on dest edit
• ipvs: add totalconns for dest
• ipvs: stop estimator after disabled calc phase
• ima: fix out-of-bounds read in xattr_verify()
• Input: evdev - fix information leak in evdev_pass_values()
• vt: stabilize tty reference in kbd_keycode with tty_port_tty_get
• vt: add permission check for KDSKBMETA ioctl
• net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup()
• usb: gadget: f_ncm: Use unsigned int for ndp_index
• usb: cdnsp: fix incorrect endian conversions for APB timeout register
• thunderbolt: icm: Preserve USB4 proxy data-valid bit
• usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm()
• ALSA: usb-audio: fix OOB write on Type II inbound URBs
• Input: evdev - sanitize event type index when fetching event masks
• spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers
• net: fec: do not release NULL pages when RX buffer allocation fails
• hwmon: (ads7828) Fix external VREF regulator handling
• regulator: devres: add API for reference voltage supplies
• hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination
• tls: don't abort the connection on signal-interrupted sends
• sctp: clear control chunk transport if it is being removed
• net/atm: fix slab-out-of-bounds read in vcc_setsockopt()
• net/tcp: Add TCP-AO config and structures
• net/tcp: Prepare tcp_md5sig_pool for TCP-AO
• ata: pata_sl82c105: fix bridge revision use-after-free
• net: thunderbolt: Tear down DMA paths before stopping the rings
• net/smc: fix TOCTOU race between smc_listen_out() and listener close
• net: remove WARN_ON_ONCE() from sk_mc_loop()
• net: prestera: validate firmware header length
• net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length
• tcp: fix TFO max_qlen accounting across reuseport migration
• sctp: fix addip_serial increment on ASCONF_ACK allocation failure
• bnxt_en: Fix PTP PPS setting bug
• bnxt_en: Disable EOP for TPA on all chips to prevent data corruption
• bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips
• selftests/ftrace: refactor eprobes test to fix argument checks

The 120 most recent commits in this release — the full changelog is longer:

• Linux 5.10.265
• hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors
• hwmon: (adt7470) Add missing dependency on REGMAP_I2C
• prestera: fix fallback to previous version on same major version
• thunderbolt: Bound the DROM dual link port number before indexing sw->ports
• sctp: clear new_transport when removing a peer
• sctp: fix use-after-free of cached ASCONF chunk
• sctp: keep chunk->transport in step with the list it is queued on
• scsi: scsi_debug: Negate wrapped memcmp() result
• bpf, sockmap: Fix sk_redir use-after-free in send verdict
• ip6_tunnel: clear skb2->cb[] in ip6ip6_err()
• ipv6: fix Route Information option length validation
• tipc: read le->link under the node lock in tipc_node_link_down()
• vhost: reset the vring metadata cache on vring reconfiguration
• vsock/virtio: avoid refilling the RX queue after teardown
• vxlan: do not arm the ageing timer on a device that is down
• net: atlantic: free RX pages of consumed but not refilled buffers
• netfilter: bridge: release template ct on non-IP path
• ipv6: prevent in6_dev_get() from resurrecting inet6_dev
• fbdev: bitblit: bound-check glyph index in bit_cursor()
• misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free
• misc: fastrpc: fix channel ctx ref leak when session alloc fails
• staging: rtl8723bs: validate monitor transmit frame lengths
• staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie()
• serial: 8250_dma: Clear stale RX state on shutdown
• ipv4: fix use-after-free in fib_nhc_update_mtu()
• fscrypt: Replace mk_users keyring with simple list
• mips: sched: Fix CPUMASK_OFFSTACK memory corruption
• RDMA/rxe: Fix a use-after-free problem in rxe_mmap
• futex: Prevent robust futex exit race some more
• ima: fix out-of-bounds read in xattr_verify()
• Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev
• Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref
• Input: evdev - fix information leak in evdev_pass_values()
• vt: stabilize tty reference in kbd_keycode with tty_port_tty_get
• vt: add permission check for KDSKBMETA ioctl
• netfilter: ebt_nflog: pin the NFLOG backend
• net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header
• net: openvswitch: reallocate update replies for mismatched IDs
• net/packet: reset the MAC header on the packet-socket transmit path
• ipvs: clear IPv4 options after rebasing tunnel ICMP errors
• ipvs: properly update the overload flag on dest edit
• ipvs: add totalconns for dest
• usb: gadget: f_ncm: Use unsigned int for ndp_index
• usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm()
• ALSA: usb-audio: fix OOB write on Type II inbound URBs
• Input: evdev - sanitize event type index when fetching event masks
• ALSA: usb-audio: Evaluate packsize caps at the right place
• spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers
• tls: don't abort the connection on signal-interrupted sends
• sctp: extract sctp_v4_err_handle function from sctp_v4_err
• sctp: extract sctp_v6_err_handle function from sctp_v6_err
• sctp: remove the unessessary hold for idev in sctp_v6_err
• sctp: clear control chunk transport if it is being removed
• ata: pata_sl82c105: fix bridge revision use-after-free
• net: qrtr: ns: Raise lookup limit to 128
• net: remove WARN_ON_ONCE() from sk_mc_loop()
• net: prestera: validate firmware header length
• net: marvell: prestera: try to load previous fw version
• net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length
• sctp: fix addip_serial increment on ASCONF_ACK allocation failure
• bnxt_en: Disable EOP for TPA on all chips to prevent data corruption
• bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips
• net/openvswitch: check Ethernet header length in key_extract()
• net: openvswitch: fix kernel-doc warnings in flow.c
• net: openvswitch: Fix kerneldoc warnings
• net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter
• udp: fix potential use-after-free in tunnel segmentation
• counter: microchip-tcb-capture: Fix DT channel validation
• net/mlx5: fw_tracer, return NULL on create error
• net/mlx5: Remove second FW tracer check
• net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete
• net/sched: cls_route: fix fastmap use-after-free on filter
• net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler()
• bpf: Preserve pointer state for commuted arithmetic
• bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor
• ARM: npcm: Fix OF node refcount leaks in SMP setup
• NFS: Pin the 'struct nfs_server' during a FREE_STATEID call
• nfs4: take a reference on the nfs_client when running FREE_STATEID
• s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey()
• mount: honour SB_NOUSER in the new mount API
• gpio: pch: use raw_spinlock_t for the register lock
• firmware: stratix10-svc: fix memory leaks and list corruption bugs
• net: openvswitch: fix skb leak on flow key update failure during recirculation
• Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold
• Bluetooth: SCO: Fix UAF on sco_sock_timeout
• mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios
• HID: logitech-dj: Fix maxfield check in DJ short report validation
• drm/vmwgfx: bound DMA command body size against suffix pointer
• drm/vmwgfx: validate DRAW_PRIMITIVES header size before division
• drm/amdgpu: cap GTT size to physical RAM on APUs
• drm/vc4: Zero the tile state data array before each BIN job
• can: peak_usb: validate uCAN receive record lengths
• can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error
• can: peak_usb: add bounds check for USB channel index
• can: softing: fw_parse(): validate firmware record spans
• can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents
• can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams()
• can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer
• i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock
• net: openvswitch: fix skb leak on flow key update failure during ct
• net: openvswitch: fix potential UAF on meter attach failure
• phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB
• phy: zynqmp: use read-modify-write for SERDES scrambler bypass
• phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask
• s390/zcrypt: Validate length for CCA ECC private key requests
• s390/zcrypt: Validate length for CCA AES cipher key requests
• s390/dasd: Fix potential NULL pointer dereference
• cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init()
• i2c: amd-mp2: Unregister callback on adapter add failure
• sctp: prevent peer transport count overflow
• sctp: reject stale cookies with mismatched verification tags
• selftests/clone3: fix wild pointer access of getline due to missing init
• tracing/filters: Fix false positive match in regex_match_full()
• tracing: Check return value of __register_event() in trace_module_add_events()
• vxlan: use pskb_network_may_pull() in route_shortcircuit()
• vxlan: use neigh_ha_snapshot() in route_shortcircuit()
• vxlan: unclone skb head before modifying eth header in route_shortcircuit()
• vxlan: re-fetch eth header after route_shortcircuit()
• um: vector: fix use-after-free in vector_mmsg_rx()

The 113 most recent commits in this release — the full changelog is longer:

• Linux 5.15.216
• thunderbolt: Bound the DROM dual link port number before indexing sw->ports
• sctp: clear new_transport when removing a peer
• sctp: fix use-after-free of cached ASCONF chunk
• sctp: keep chunk->transport in step with the list it is queued on
• scsi: scsi_debug: Negate wrapped memcmp() result
• bpf, sockmap: Fix sk_redir use-after-free in send verdict
• ip6_tunnel: clear skb2->cb[] in ip6ip6_err()
• ipv6: fix Route Information option length validation
• Revert "thermal/drivers/hwmon: Cleanup coding style a bit"
• tipc: read le->link under the node lock in tipc_node_link_down()
• vhost: reset the vring metadata cache on vring reconfiguration
• vsock/virtio: avoid refilling the RX queue after teardown
• vsock/virtio: read virtqueues under worker locks
• vxlan: do not arm the ageing timer on a device that is down
• xdp: reject clones that overrun skb_shared_info tailroom
• net/sched: act_gact, act_police: range check the fallback control action
• net: atlantic: free RX pages of consumed but not refilled buffers
• netfilter: bridge: release template ct on non-IP path
• ipv6: prevent in6_dev_get() from resurrecting inet6_dev
• fbdev: bitblit: bound-check glyph index in bit_cursor()
• tracing: Fix race between update_event_fields and, event_define_fields
• ALSA: usx2y: bound the hwdep mmap fault offset
• misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free
• misc: fastrpc: fix channel ctx ref leak when session alloc fails
• staging: rtl8723bs: validate monitor transmit frame lengths
• staging: rtl8723bs: fix missing shared-key auth challenge length check
• staging: rtl8723bs: fix OOB read in WMM_param_handler()
• staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie()
• serial: 8250_dma: Clear stale RX state on shutdown
• ipv4: fix use-after-free in fib_nhc_update_mtu()
• ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops
• fscrypt: Replace mk_users keyring with simple list
• RDMA/rxe: Fix a use-after-free problem in rxe_mmap
• pinctrl: renesas: rzg2l: Use -ENOTSUPP instead of -EOPNOTSUPP
• futex: Prevent robust futex exit race some more
• Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev
• Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref
• Input: evdev - fix information leak in evdev_pass_values()
• vt: stabilize tty reference in kbd_keycode with tty_port_tty_get
• vt: add permission check for KDSKBMETA ioctl
• net: bridge: mrp: fix uninitialised bytes on the wire
• netfilter: ebt_nflog: pin the NFLOG backend
• net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header
• net: octeontx2-pf: Fix UB in shift operation
• net: openvswitch: reallocate update replies for mismatched IDs
• net/packet: reset the MAC header on the packet-socket transmit path
• ipvs: clear IPv4 options after rebasing tunnel ICMP errors
• ipvs: properly update the overload flag on dest edit
• ipvs: add totalconns for dest
• ima: fix out-of-bounds read in xattr_verify()
• usb: gadget: f_ncm: Use unsigned int for ndp_index
• usb: cdnsp: fix incorrect endian conversions for APB timeout register
• thunderbolt: icm: Preserve USB4 proxy data-valid bit
• usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm()
• ALSA: usb-audio: fix OOB write on Type II inbound URBs
• Input: evdev - sanitize event type index when fetching event masks
• spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers
• hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination
• tls: don't abort the connection on signal-interrupted sends
• sctp: clear control chunk transport if it is being removed
• ata: pata_sl82c105: fix bridge revision use-after-free
• net: thunderbolt: Tear down DMA paths before stopping the rings
• net: qrtr: ns: Raise lookup limit to 128
• net/smc: fix TOCTOU race between smc_listen_out() and listener close
• net: remove WARN_ON_ONCE() from sk_mc_loop()
• net: prestera: validate firmware header length
• net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length
• tcp: fix TFO max_qlen accounting across reuseport migration
• sctp: fix addip_serial increment on ASCONF_ACK allocation failure
• bnxt_en: Fix PTP PPS setting bug
• bnxt_en: Disable EOP for TPA on all chips to prevent data corruption
• bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips
• selftests/ftrace: refactor eprobes test to fix argument checks
• selftests/ftrace: Add test case for GRP/ only input
• net/openvswitch: check Ethernet header length in key_extract()
• net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter
• udp: fix potential use-after-free in tunnel segmentation
• vhost/vdpa: reject overflowing PA map page counts on 32-bit
• counter: microchip-tcb-capture: Fix DT channel validation
• net/mlx5: fw_tracer, return NULL on create error
• net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete
• net/sched: cls_route: fix fastmap use-after-free on filter
• net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler()
• bpf: Preserve pointer state for commuted arithmetic
• bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor
• ARM: npcm: Fix OF node refcount leaks in SMP setup
• NFS: Pin the 'struct nfs_server' during a FREE_STATEID call
• nfs4: take a reference on the nfs_client when running FREE_STATEID
• s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey()
• mount: honour SB_NOUSER in the new mount API
• gpio: pch: use raw_spinlock_t for the register lock
• firmware: stratix10-svc: fix memory leaks and list corruption bugs
• net: openvswitch: fix skb leak on flow key update failure during recirculation
• mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios
• HID: logitech-dj: Fix maxfield check in DJ short report validation
• drm/vmwgfx: bound DMA command body size against suffix pointer
• drm/vmwgfx: validate DRAW_PRIMITIVES header size before division
• drm/amdgpu: cap GTT size to physical RAM on APUs
• drm/amdgpu: restore UMD profile pstate after runtime resume
• drm/vc4: Zero the tile state data array before each BIN job
• can: peak_usb: validate uCAN receive record lengths
• can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error
• can: peak_usb: add bounds check for USB channel index
• can: softing: fw_parse(): validate firmware record spans
• can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents
• can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams()
• can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer
• can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure
• can: ems_usb: validate CPC message lengths
• can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured
• i2c: imx: Cancel hrtimer before clearing slave pointer
• i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock

The 119 most recent commits in this release — the full changelog is longer:

• Linux 7.2
• wifi: mt76: mt7921: refactor regd update to fix recursive mutex deadlock
• Revert "i2c: designware: defer probe if child GpioInt controllers are not bound"
• drbd: don't leak the shared secret to unprivileged netlink dumps
• openrisc: signal: do not restore privileged SR bits on sigreturn
• erofs: fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS on some UP platforms
• sched: Update time before requeueing delayed entities
• tracing: Fix race between update_event_fields and, event_define_fields
• tracing: Fix NULL pointer dereference in module event cache removal
• spi: virtio: mark device ready before registering the controller
• Revert "wifi: mt76: Disable napi when removing device"
• drm/log: Fix infinite loop when scale is too large for display
• drm/log: Fix out-of-bounds read on empty message length
• drm/log: Fix division by zero when scale module parameter is 0
• drm/xe: Fix xe_device_probe() failure
• drm/xe: Fix a bug in pc_adjust_freq_bounds()
• drm/xe/oa: Check managed mutex initialization errors
• drm/xe/oa: Fix sync entry leak on OA config emit failure
• drm/xe/lrc: document sentinel and make CTX_TIMESTAMP read TOCTOU-safe
• drm/xe/pxp: add termination on resume
• drm/xe: Order ring writes before ring tail updates
• drm/xe/guc_ads: use uncached mapping for UM queue BO
• drm/xe/guc_ads: allocate UM queues in VRAM on dGFX
• drm/xe/guc_ads: allocate UM queues in a separate BO
• drm/xe: Fix DPT allocation paths.
• firewire: ohci: fix NULL pointer dereference in ar_context_release
• l2tp: fix tunnel and session refcount leak on seq_file release
• net/sched: cls_bpf: reject dev-bound programs bound to a different device
• accel/amdxdna: Skip unmapped range in aie2_populate_range()
• io_uring/rsrc: reject overflowing regvec bvec byte counts
• sctp: fix use-after-free of cached ASCONF chunk
• Input: sur40 - fix V4L error path cleanup
• Input: sur40 - fix input device registration ordering
• net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG
• sctp: clear new_transport when removing a peer
• net/dibs: Correct freeing of dmb_clientid_arr
• ceph: use the mount idmap for the owner checks in the SET_LAYOUT ioctls
• ceph: fix MDS random selection readiness predicate
• libceph: Avoid using invalid osd indices from primary_temp
• libceph: fix OOB read in decode_watchers() via missing bounds check
• libceph: fix multiple unsafe decodes in decode_locker()
• libceph: tolerate addrvecs with multiple entries of the same type
• regmap: sdw-mbq: don't call an unset readable_reg callback
• clocksource/drivers/arm_arch_timer: Workaround bcm2712 broken EL2 virtual timer
• drm/amdgpu: Prefer default discovery offset
• drm/amdgpu: Reject UVD message with invalid number of h265 refs
• drm/amdgpu: fix nbif 6.3.1 l1 low power not functional
• drm/amd/display: fix BT.2020 YCbCr output CSC matrices for DCE
• drm/amd/display: fix BT.2020 YCbCr limited output CSC matrix
• drm/amdgpu: Implement insert_end for VCE 3
• drm/amdgpu: Fix UVD min buffer sizes
• drm/amdgpu: Fix UVD decode image min size calculation
• drm/amdgpu: Fix UVD dpb min size calculation for H264
• drm/amdgpu: Reject UVD message with dimensions above 4096
• drm/amdgpu: check ASPM on the dGPU host link
• drm/radeon: fix autosuspend cleanup during teardown
• drm/amdgpu: fix missing check in vm_flush()
• drm/amd/display: Fix NULL pointer dereference in amdgpu_dm_crtc_set_vblank()
• drm/amdgpu: validate GEM_CREATE domain combinations
• drm/amdgpu: disallow multiple FENCE chunks in one submit
• m68k: Define NR_CPUS to 1
• pid: reject allocations through dead ancestor pid namespaces
• pmdomain: mediatek: mfg: initialize prev_o in mtk_mfg_attach_dev()
• net/sched: cls_u32: skip hash tables in u32_bind_class()
• gve: fix NULL dereference due to missing ptp adjfine
• gve: fix zero-length skb frag with header-split
• net/sched: act_api: fix TOCTOU NULL deref on a->goto_chain
• af_packet: Don't send zero-byte data in tpacket_snd().
• drm/sched: Mark fair policy as experimental
• Revert "drm/sched: Switch default policy to fair"
• Revert "drm/sched: Remove FIFO and RR and simplify to a single run queue"
• Revert "drm/sched: Embed run queue singleton into the scheduler"
• Revert "accel/amdxdna: Remove drm_sched_init_args->num_rqs usage"
• Revert "accel/rocket: Remove drm_sched_init_args->num_rqs usage"
• Revert "accel/ethosu: Remove drm_sched_init_args->num_rqs usage"
• Revert "drm/amdgpu: Remove drm_sched_init_args->num_rqs usage"
• Revert "drm/etnaviv: Remove drm_sched_init_args->num_rqs usage"
• Revert "drm/imagination: Remove drm_sched_init_args->num_rqs usage"
• Revert "drm/lima: Remove drm_sched_init_args->num_rqs usage"
• Revert "drm/msm: Remove drm_sched_init_args->num_rqs usage"
• Revert "drm/nouveau: Remove drm_sched_init_args->num_rqs usage"
• Revert "drm/panfrost: Remove drm_sched_init_args->num_rqs usage"
• Revert "drm/panthor: Remove drm_sched_init_args->num_rqs usage"
• Revert "drm/sched: Remove drm_sched_init_args->num_rqs usage"
• Revert "drm/v3d: Remove drm_sched_init_args->num_rqs usage"
• Revert "drm/xe: Remove drm_sched_init_args->num_rqs usage"
• Revert "drm/sched: Remove drm_sched_init_args->num_rqs"
• ASoC: Intel: NVL: Add entry for HDMI-In capture support to non-I2S codec boards.
• regmap: sdw-mbq: Fix swap of timeout and retry times
• ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers
• spi: dw: fix wrong RX_SAMPLE_DLY setting after resume
• tipc: read le->link under the node lock in tipc_node_link_down()
• ASoC: tac5xx2-sdw: select REGMAP_SOUNDWIRE_MBQ
• selftests: tls: cover splice after a failed decrypt
• net/tls: Fail tls_sw_splice_read() after a failed async decrypt
• net: ngbe: fix NULL pointer dereference in non-MSI-X interrupt enabling
• net: tap: fix wrong transport_header when sending VLAN-tagged frame
• net: packet: fix wrong transport_header when sending VLAN-tagged frame
• pmdomain: qcom: rpmhpd: Add missing MXC and MMCX power domains for Eliza
• vxlan: do not arm the ageing timer on a device that is down
• ipv4: fix use-after-free in fib_nhc_update_mtu()
• NTB: ntb_netdev: Preserve RX queue depth on allocation failure
• selftests: tc-testing: add act_ct test for malformed header handling
• net/sched: act_ct: fix sk_buff leak when the header checks reject a packet
• net: phy: realtek: fix EEE advertisement write on the internal PHY MMD path
• tcp: fix icsk_ack.ato bitfield overflow
• net/sched: act_gact, act_police: range check the fallback control action
• veth: fix queue index used to wake the peer txq in veth_poll
• net: expect instance lock in netdev_queue_get_dma_dev()
• macvlan: inherit needed_headroom and needed_tailroom from lowerdev
• ipvlan: inherit needed_headroom and needed_tailroom from phy_dev
• eth: bnxt: avoid deadlock when canceling IRQ affinity notifier
• eth: bnxt: decrease indent in bnxt_request_irq()
• eth: bnxt: keep the aRFS rmap updated when TPH is enabled
• eth: bnxt: cancel IRQ notifier before freeing affinity mask
• netfilter: ipset: let destroy callbacks adjust ext mem size
• netfilter: ipset: fix list type element drift bug
• netfilter: flowtable: publish GC-visible tuple last
• netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path

The 120 most recent commits in this release — the full changelog is longer:

• Linux 7.1.8
• usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path
• drm/amd/display: Exit idle optimizations before programming
• drm/amd/display: check GRPH_FLIP status before sending event
• media: chips-media: wave5: Support CBP profile
• drm/xe: Wait on external BO kernel fences in exec IOCTL
• drm/exec: Remove the index parameter from drm_exec_for_each_locked_obj[_reverse]
• drm/xe: Set TTM device beneficial_order to 9 (2M)
• drm/xe: Separate early xe_device initialization
• drm/xe: Move xe->info.devid|revid initialization
• drm/xe: Move xe->info.force_execlist initialization
• drm/xe: Drop unused param from xe_device_create()
• usb: typec: ucsi: Fix race condition and ordering in port unregistration
• usb: typec: ucsi: split connector lock classes
• drm/xe/rtp: Ensure locking/ref counting for OA whitelists
• drm/xe/oa: (De-)whitelist OA registers on OA stream open/release
• drm/xe/rtp: (De-)whitelist OA registers for all hwe's for a gt
• drm/xe/rtp: Toggle 'deny' bit to (de-)whitelist OA regs
• drm/xe/rtp: Save OA nonpriv registers to register save/restore lists
• drm/xe/rtp: Generalize whitelist_apply_to_hwe
• drm/xe/rtp: Keep track of non-OA nonpriv slots
• drm/xe/rtp: Maintain OA whitelists separately
• drm/vmwgfx: validate external BO copy bounds for both stride paths
• drm/vmwgfx: use check_add_overflow for shader size+offset bound
• drm/vmwgfx: enforce cursor size limits for MOB cursors
• drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure
• drm/vmwgfx: bound DMA command body size against suffix pointer
• drm/vmwgfx: validate DRAW_PRIMITIVES header size before division
• drm/vmwgfx: drop dma_buf reference on foreign-fd prime import
• drm/vmwgfx: take fman->lock around fence list mutation in fifo_down
• drm/vmwgfx: clamp dirty-page range with min, not max
• drm/vmwgfx: reject DX_BIND_QUERY without a DX context
• drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size
• drm/amdkfd: hold event_mutex while checkpointing CRIU events
• drm/amdkfd: Handle invalid event type in CRIU event restore
• drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment
• drm/amdkfd: fix QID bit leak in pqm_create_queue()
• drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE
• drm/amd/display: use proper context for logging
• drm/amd/display: Silence link_dpms I2C retimer failures
• drm/amd/display: Increase HDMI AV mute wait from 2 to 3 frames
• drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport
• drm/amd/display: check if dml21_add_phantom_plane() is successful
• drm/amd/pm: use milliwatts for GPU power sensors
• drm/amd/pm: hide pp_table sysfs on APUs
• drm/amd/pm: fix pptable use-after-free
• drm/amd/pm: fix torn gpu metrics reads
• drm/amdgpu: cap GTT size to physical RAM on APUs
• drm/amdgpu: restore UMD profile pstate after runtime resume
• drm/amdgpu: move debug_vm handling to amdgpu_cs_parser_fini
• drm/mediatek: ovl_adaptor: balance component registrations
• drm/mediatek: mtk_hdmi: Fix DDC adapter double put in v2
• drm/panthor: validate firmware interface structure sizes
• drm/panthor: reject firmware sections with oversized data
• drm/bridge: display-connector: Fix I2C adapter resource leak
• drm/vc4: Zero the tile state data array before each BIN job
• drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size
• drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs
• can: ctucanfd: mark error-active controller status valid
• can: ctucanfd: handle bus error interrupts
• can: ctucanfd: unmap BAR0 using base address
• can: ctucanfd: use self-test mode for PRESUME_ACK
• can: ctucanfd: add missing MODULE_DEVICE_TABLE()
• can: peak_usb: validate uCAN receive record lengths
• can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error
• can: peak_usb: add bounds check for USB channel index
• can: softing: fw_parse(): validate firmware record spans
• can: rcar_canfd: change the initializing flow for clocks and resets
• can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents
• can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams()
• can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking
• can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer
• can: isotp: fix timer drain order, wakeup handling and tx_gen ordering
• can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure
• can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure
• can: ems_usb: validate CPC message lengths
• can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured
• i2c: imx: Cancel hrtimer before clearing slave pointer
• i2c: imx: Fix slave registration race and error handling
• i2c: imx: mark I2C adapter when hardware is powered down
• i2c: iproc: reset bus after timeout if START_BUSY is stuck
• i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock
• i2c: qcom-cci: drop custom suspend/resume and rely on runtime PM helpers
• i2c: spacemit: request IRQ after controller initialization
• ice: fix memory leak in ice_lbtest_prepare_rings()
• ice: fix VF interrupts cleanup
• ice: wait for reset completion in ice_resume()
• net: openvswitch: fix skb leak on flow key update failure during ct
• net: openvswitch: fix skb leak on flow key update failure during recirculation
• net: openvswitch: fix potential UAF on meter attach failure
• phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB
• phy: zynqmp: use read-modify-write for SERDES scrambler bypass
• phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask
• s390/zcrypt: Validate length for CCA ECC private key requests
• s390/zcrypt: Validate length for CCA AES cipher key requests
• s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey()
• s390/zcrypt: Fix buffer over-read in cca_cipher2protkey
• s390/zcrypt: Close speculative mem read possibility
• s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs
• s390/dasd: Fix undersized format-check buffer
• s390/dasd: Fix potential NULL pointer dereference
• s390/qeth: Check CAP_NET_ADMIN for private ioctls
• s390/pci: Fix s390_pci_mmio_write syscall error return without MIO
• power: supply: max17040: handle missing status supplier
• power: supply: macsmc: Support macOS 27 SMC firmware
• power: supply: bq25890: fix the -10 C NTC lookup entry
• cpufreq: schedutil: Publish util hooks only after all sg_cpu are initialized
• cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init()
• cpufreq: cppc: Sanitize lockless policy limit snapshots
• cifs: add fscache_resize_cookie() to cifs_setsize()
• gpio: pch: use raw_spinlock_t for the register lock
• gpio: pca953x: fix cache_only and IRQ state on restore_context() failure
• gpiolib: tolerate gpio-hogs lacking a hogging state
• i2c: amd-mp2: Unregister callback on adapter add failure
• hwmon: (pmbus/core) notify on the hwmon device, not the i2c client
• hwmon: (npcm750-pwm-fan): stop fan timer on device detach
• sctp: prevent peer transport count overflow
• sctp: reject stale cookies with mismatched verification tags
• scsi: ufs: dt-bindings: Add missing mcq reg for qcom,sa8255p-ufshc
• scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write