XanMod Kernel

Name: XanMod Kernel
Author: XanMod

Operating Systems

Linux kernel built for desktop and gaming workloads, with a low-latency scheduler and current hardware support.

Latest 6.18.41-rt-xanmod1 · Jul 30, 2026by XanModWebsite

Changelog

6.18.41-rt-xanmod1

Jul 30, 2026 · 1 day ago

Changed 1

Expand timer_[re]arm() callbacks with a boolean return value

Fixed 19

Prevent UAF caused by non-leader exec() race in posix-cpu-timers
Avoid repeated requests to allocate WC pages in RDMA/bnxt_re
Initialize dpi variable to zero in RDMA/bnxt_re
Fix durable reconnect double-bind race in ksmbd_reopen_durable_fd
Handle multiple address spaces in perf callchain
Fix scoped_seqlock_read kernel-doc in seqlock
Ignore the dummy event for dwarf stacks in perf inject --convert-callchain
Fix Resizable BAR restore order in PCI
Fix BAR resize rollback path overwriting ret in PCI
Fix ENOENT case for filename__read_build_id in perf symbol
Fix pinctrl function mismatch issue in airoha
Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized
Move vevent memory allocation outside spinlock in iommufd
Propagate allocation failure in iommufd_veventq_deliver_fetch()
Re-translate VNCR before injecting abort in KVM arm64 nv
Fix propagation of TLBI level in kvm_pgtable_stage2_relax_perms()
Ensure level is always initialized when relaxing perms in KVM arm64
Fix incorrect buffered IO fallback for append direct writes in btrfs
Fix false IO failure after falling back to buffered write in btrfs

93ee63dfc0db Linux 6.18.41-rt-xanmod1
3e27e81ebc48 Merge branch '6.18' into 6.18-rt
929ca27d531b Linux 6.18.41-xanmod1
1c784dbe2a35 Merge tag 'v6.18.41' into 6.18
2fe596715f84 Linux 6.18.41
6a7ecc25abe6 posix-cpu-timers: Prevent UAF caused by non-leader exec() race
9f7268928ac0 posix-timers: Expand timer_[re]arm() callbacks with a boolean return value
44db62f5aa97 Linux 6.18.40-xanmod1
8b49b49d26aa Merge tag 'v6.18.40' into 6.18
221fc2f4d0ed Linux 6.18.40
478c4d24193f RDMA/bnxt_re: Avoid repeated requests to allocate WC pages
b87cbd4d198a RDMA/bnxt_re: Initialize dpi variable to zero
81e6faa5b640 ksmbd: fix durable reconnect double-bind race in ksmbd_reopen_durable_fd
1badb6866482 perf callchain: Handle multiple address spaces
275eb3993094 seqlock: fix scoped_seqlock_read kernel-doc
453cb79a1564 perf inject: With --convert-callchain ignore the dummy event for dwarf stacks
2764d031efd6 PCI: Fix Resizable BAR restore order
2fb74141ec54 PCI: Fix BAR resize rollback path overwriting ret
7425e7d82cb9 perf symbol: Fix ENOENT case for filename__read_build_id
a888f3d5970f pinctrl: airoha: fix pinctrl function mismatch issue
267fdd9b6530 bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized
779480ea7955 iommufd: Move vevent memory allocation outside spinlock
73b5d5cb1f5a iommufd: Propagate allocation failure in iommufd_veventq_deliver_fetch()
ea7a76d7d614 KVM: arm64: nv: Re-translate VNCR before injecting abort
459adfc6cd35 KVM: arm64: Deduplicate ASID retrieval code
9d360fb820a3 samples/damon/mtier: fail early if address range parameters are invalid
ec976851ad93 mm/damon/core: trace esz at first setup
3b91c35961fa mm/damon/core: always put unsuccessfully committed target pids
ba37cd4d8a75 KVM: arm64: Fix propagation of TLBI level in kvm_pgtable_stage2_relax_perms()
19d9996435db KVM: arm64: Ensure level is always initialized when relaxing perms
c3a3d3986719 btrfs: fix incorrect buffered IO fallback for append direct writes
998ee7f01ecf btrfs: fix false IO failure after falling back to buffered write
a4497a122e27 crypto: qat - fix restarting state leak on allocation failure
6c78081d047c btrfs: remove folio parameter from ordered io related functions
1a648c50a505 btrfs: replace for_each_set_bit() with for_each_set_bitmap()
99d4ae3fbb5b btrfs: concentrate the error handling of submit_one_sector()
382fd8004cc6 crypto: atmel-sha204a - fail on hwrng registration error in probe path
952db4b985c7 usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile
69faa3779250 usb: gadget: f_fs: initialize reset_work at allocation time
8a2fdbf92cdc functionfs: use spinlock for FFS_DEACTIVATED/FFS_CLOSING transitions
5fb0b09180a0 functionfs: switch to simple_remove_by_name()
4744f07f6bb7 functionfs: don't bother with ffs->ref in ffs_data_{opened,closed}()
901c036cf625 functionfs: don't abuse ffs_data_closed() on fs shutdown
c3e686025210 new helper: simple_remove_by_name()
509b51327320 usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect()
b78826a65799 usb: atm: ueagle-atm: remove function entry/exit debug messages
6e5ef54b884f usb: atm: ueagle-atm: use dev_dbg() for 'device found' message
41a4e80d5af0 usb: dwc3: fix dwc3_readl() and dwc3_writel() calls in dwc3_ulpi_setup()
e534790c4c27 usb: dwc3: Support USB3340x ULPI PHY high-speed negotiation.
bce232923aa9 xfs: use bio_reuse in the zone GC code
adadb181ad42 xfs: only log freed extents for the current RTG in zoned growfs
47c0e0743302 xfs: add a xfs_groups_to_rfsbs helper
57454944737f bpf: Allow LPM map access from sleepable BPF programs
8fccaeeb9e9c bpf: Consistently use bpf_rcu_lock_held() everywhere
0b92ad64d6e4 bpf: Keep dynamic inner array lookups nullable
c447be8d88c3 bpf: Introduce struct bpf_map_desc in verifier
dccb3c557879 bpf: Consistently use reg_state() for register access in the verifier
60eed4467429 xfs: initialize iomap->flags earlier in xfs_bmbt_to_iomap
607217f7ad41 hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length
7676ea09beb5 hfs/hfsplus: prevent getting negative values of offset/length
f9b4b03ccc9c proc: protect ptrace_may_access() with exec_update_lock (part 1)
07bf18dc63f7 seqlock: Change do_task_stat() to use scoped_seqlock_read()
c897fd63762e seqlock: Introduce scoped_seqlock_read()
497c6bae5167 proc: protect ptrace_may_access() with exec_update_lock (FD links)
903d78e5aca7 proc: rename proc_setattr to proc_nochmod_setattr
b56400364aed ksmbd: validate NTLMv2 response before updating session key
74c2f0ffb81c ksmbd: Use HMAC-MD5 library for NTLMv2
51c5f7e84cfe ksmbd: Use HMAC-SHA256 library for message signing and key generation
bd27d9504d20 ksmbd: Use SHA-512 library for SMB3.1.1 preauth hash
427faaa52b0b ksmbd: track the connection owning a byte-range lock
6a37bc484f12 ksmbd: centralize ksmbd_conn final release to plug transport leak
c7c884a1305a ksmbd: fix path resolution in ksmbd_vfs_kern_path_create
e205f3e7e8c3 ksmbd: use opener credentials for FSCTL mutations
90a93fb3230c cifs: SMB1 split: Add some #includes
ff943e1f3d31 cifs: SMB1 split: Rename cifstransport.c
36da806f7fba Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()
6d0eeebe22ba Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister
ef382a6baf0a media: nxp: imx8-isi: Fix use-after-free on remove
4278953ff0cd media: nxp: imx8-isi: use devm_pm_runtime_enable() to simplify code
49cd5ac6de8d crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()
4b51ee8a40fe staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr()
5d76bc296bb5 staging: rtl8723bs: fix spaces around binary operators
48323ebaeeee staging: rtl8723bs: core: move constants to right side in comparison
73cc54326de4 PCI: Skip Resizable BAR restore on read error
f33837a75447 PCI: Move Resizable BAR code to rebar.c
2242c75b6328 PCI: Add kerneldoc for pci_resize_resource()
4b5322f0002a PCI: Fix restoring BARs on BAR resize rollback path
c18646165f21 PCI: Free saved list without holding pci_bus_sem
534f20cdddc3 PCI: Try BAR resize even when no window was released
dbb1d8507dd9 PCI: Change pci_dev variable from 'bridge' to 'dev'
0d1c263e6fd7 PCI/IOV: Adjust ->barsz[] when changing BAR size
0dfad346c293 PCI: imx6: Configure REF_USE_PAD before PHY reset for i.MX95
e53d54b92f0c PCI: imx6: Fix reference clock source selection for i.MX95
1228926e1e4d binder: cache secctx size before release zeroes it
79ac87bb1a4c binder: Use LIST_HEAD() to initialize on stack list head
7ed120b1a007 vfio/mlx5: Fix racy bitfields and tighten struct layout
f8272331da87 ALSA: hda/tas2781: Cancel async firmware request at unbind
6438d0707087 firmware_loader: Add cancel helper for async requests
1ed7ff33cfc8 ALSA: scarlett2: Update offsets for 2i2 Gen 4 firmware 2417
ad5c5bdb0f58 ALSA: scarlett2: Allow selecting config_set by firmware version
2745574697ee iio: hid-sensor-rotation: Fix stale or zero output when reading raw values
7f680924c5c2 ACPI: NFIT: core: Fix possible deadlock and missing notifications
cf5f93228e7a ACPI: NFIT: core: Use devm_acpi_install_notify_handler()
d57d2aae87b2 ACPI: bus: Introduce devm_acpi_install_notify_handler()
34f4d0e4e506 ACPI: driver: Check ACPI_COMPANION() against NULL during probe
3b2628f7682a ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup
83f29da85dc9 crypto: xilinx-trng - Remove crypto_rng interface
f84c0bae0e8d mmc: sdhci-esdhc-imx: fix resume error handling
174dc8103ab7 mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend
5b8f11cbe8ad mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend
4f96903e2fd2 mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt
aa276aa6cbfb mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore
52990f6b5752 mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume
eefcd3ca245c mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore
c02237966c19 mmc: sdhci-of-dwcmshc: check bus clock enable result in the probe() method
8d94498cc445 mmc: block: fix RPMB device unregister ordering
cf7258f57d18 mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout
4b5de4007e5b mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout
de2bc884d887 mtd: rawnand: fsl_ifc: return errors for failed page reads
bf9848a22a8e mmc: vub300: defer reset until cmd_mutex is unlocked
04ebd3766861 mtd: mchp23k256: use SPI match data for chip caps
ac2d9f6b4f90 mtd: onenand: samsung: report DMA completion timeouts
a59cfa165aee wifi: mwifiex: fix permanently busy scans after multiple roam iterations
b8df3a993f69 wifi: mac80211: free ack status frame on TX header build failure
90576bd6921a wifi: ieee80211: validate MLE common info length
584657c5fc58 wifi: cfg80211: validate EHT MLE before MLD ID read
3c1e92f75e11 powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access()
82753ac86cb3 reset: sunxi: fix memory region leak on ioremap failure
3fb7edd2018b ipvs: reload ip header after head reallocation
d4ec18f48ce7 ipvs: fix more places with wrong ipv6 transport offsets
39151f0708c8 memstick: ms_block: reject a card that reports too many blocks
a75d2b5249e3 macsec: fix promiscuity refcount leak in macsec_dev_open()
fd701fc0d065 llc: fix SAP refcount leak when creating incoming sockets
6744ab60dfac Bluetooth: btrtl: validate firmware patch bounds
dbd14f736be0 net: openvswitch: reject oversized nested action attrs
6926d13865aa regulator: ltc3676: Fix incorrect IRQSTAT bit offsets
688bd4c6144d riscv: vdso: Do not use LTO for the vDSO
55b26abb1fa1 wifi: brcmfmac: cyw: fix heap overflow on a short auth frame
bdc0b8bfdc14 wifi: mac80211: fix memory leak in ieee80211_register_hw()
65446b85595a wifi: mwifiex: fix roaming to different channel in host_mlme mode
816559409e34 wifi: rt2x00: avoid full teardown before work setup in probe
262da8b6ea03 net/mlx5: free mlx5_st_idx_data on final dealloc
9b8df4da2cf7 powerpc/pseries: fix memory leak on krealloc failure in papr_init
afa0db5322c5 mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume
d94160a5d1ac selftests/landlock: Fix screwed up pointers in the scoped_signal_test
ba481c0b5376 selftests/landlock: Skip scoped_signal subtest with MSG_OOB if not available
4ff3960f3527 pmdomain: imx: Fix i.MX8MP VC8000E power up sequence
9a0464fcfae4 pmdomain: imx: Fix i.MX8MP power notifier
c844b7d9a958 cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed
8131a91fe2de selftests/rseq: Fix a building error for riscv arch
3dfec7490f3a s390/mm: Fix type mismatch in get_align_mask().
c6b4d454865a s390/diag: Add missing array_index_nospec() call to memtop_get_page_count()
fad36954b295 tracing/osnoise: Call synchronize_rcu() when unregistering
eadd0c2c76ae riscv: Prevent NULL pointer dereference in machine_kexec_prepare()
38cc4867540a drbd: reject data replies with an out-of-range payload size
91ec52dd2a5d ata: libata-core: Allow capacity transition to zero for locked drives
7a9a69641b68 ata: libata-core: Skip HPA resize for locked drives
52007bfdce53 fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list
1155a9d0a2e0 fs/resctrl: Free mon_data structures on rdt_get_tree() failure
ccdf1770a4ba cpu/hotplug: Fix NULL kobject warning in cpuhp_smt_enable()
5f5783c7806f arm64: smp: Fix hot-unplug tearing by forcing unregistration
26b131b2d5b5 net: macb: drop in-flight Tx SKBs on close
b2f426a9a228 dibs: loopback: validate offset and size in move_data()
2cf10d042562 macsec: don't read an unset MAC header in macsec_encrypt()
83fb4c2c5344 ipvs: reset full ip_vs_seq structs in ip_vs_conn_new
247d055504dc ipvs: use parsed transport offset in SCTP state lookup
61a7ff4a6200 llc: fix SAP refcount leak in llc_ui_autobind()
685fb410d90e selftests: net: make busywait timeout clock portable
5df30f05db96 octeontx2-pf: fix SQB pointer leak on init failure
77caf2d6eba7 mac802154: remove interfaces with RCU list deletion
f0745496f7c1 s390/monwriter: Reject buffer reuse with different data length
a5a367756926 irqchip/irq-riscv-imsic-early: Fix fwnode leak on state setup failure
018d7ad26cb8 mm/compaction: handle free_pages_prepare() properly in compaction_free()
2faf0198168d riscv: probes: save original sp in rethook trampoline
d8d4fa0c4f81 hwmon: (asus_atk0110) Check package count before accessing element
07f5eb6d268a net: wwan: iosm: bound device offsets in the MUX downlink decoder
1286a4156333 ata: pata_pxa: Fix DMA channel leak on probe error
1dce4f4bb3c1 net/mlx5: HWS, fix matcher leak on resize target setup failure
82fc886e244c orangefs: keep the readdir entry size 64-bit in fill_from_part()
2c76c01a505c tracing/probes: Fix double addition of offset for @+FOFFSET
b4427ee3667c hwmon: (max1619) add missing 'select REGMAP' to Kconfig
6c52226072a3 fhandle: reject detached mounts in capable_wrt_mount()
e2b7ee61989f net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked
5889064919a1 net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked
99a6f37b113c net: lan743x: Initialize eth_syslock spinlock before use
ac58088d70b8 fsl/fman: Free init resources on KeyGen failure in fman_init()
f0aad157576d hwmon: (occ) unregister sysfs devices outside occ lock
715cce38424f net: liquidio: fix BAR resource leak on PF number failure
664480021f6a hwmon: (w83793) remove vrm sysfs file on probe failure
c6c990f7208c hwmon: (w83627hf) remove VID sysfs files on error and remove
8dc6c7e8c967 rtc: mpfs: fix counter upload completion condition
6e21d1253ef1 rtc: renesas-rtca3: Fix PIE clear polling condition in alarm setup error path
6c98ccdb9a09 bnx2x: fix potential memory leak in bnx2x_alloc_mem_bp()
f5c506596302 ipmi: fix refcount leak in i_ipmi_request()
a66d45e0ce6d espintcp: use sk_msg_free_partial to fix partial send
ddbb6e3dc9bb ipmi: Fix user refcount underflow in event delivery
a65f49b6f7ec LoongArch: Fix missing dirty page tracking in {pte,pmd}_wrprotect()
20ac8131f8c9 LoongArch: Fix nr passing in set_direct_map_valid_noflush()
612cda6630f2 pwm: rzg2l-gpt: Fix period_ticks type from u32 to u64
4b73889941b9 selftests/bpf: Add simple strscpy() implementation
da7f17c2d5bb KVM: TDX: Account all non-transient page allocations for per-TD structures
d0cc2c74060b drm/xe/userptr: Stub notifier_lock helpers when DRM_GPUSVM=n
6cec36c795c0 net/sched: sch_teql: move rcu_read_lock()/spin_lock() from _bh variants
55da782eb454 platform/x86/amd/pmc: Avoid logging "(null)" for DMI values
35267819b250 gve: fix header buffer corruption with header-split and HW-GRO
2059c28bd725 ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit
cb5cca1d2a90 ieee802154: ca8210: fix cas_ctl leak on spi_async failure
314f21c9dd0d ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation
1905ebabe638 ieee802154: admin-gate legacy LLSEC dump operations
19c148cb82d1 octeontx2-af: Free BPID bitmap on setup failure
234cd54fc500 net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink
03d8843b143e net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink
68cadc3698c7 net: ipip: require CAP_NET_ADMIN in the device netns for changelink
9571af2eec80 net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink
0b2f9c908f93 net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink
6596baf80411 net: ena: clean up XDP TX queues when regular TX setup fails
ab625256882e selftests: net: fix file owner for broadcast_ether_dst test
b3d835407846 net/sched: act_ct: preserve tc_skb_cb across defragmentation
3f85fcd520aa net: ixp4xx_hss: fix duplicate HDLC netdev allocation
e89b8829693e net: wwan: t7xx: destroy DMA pool on CLDMA late init failure
121c5f31c3fb net: ethernet: ti: icssg: guard PA stat lookups
3118e97dae53 net: sit: require CAP_NET_ADMIN in the device netns for changelink
5d7bd8790309 gpios: palmas: add .get_direction() op
d3b9026ef78d gpio: mt7621: avoid corruption of shared interrupt trigger state
4e16bc75c750 gpio-f7188x: Add support for NCT6126D version B
b6e040b5143c gpio: mt7621: be sure IRQ domain is created before exposing GPIO chips
ac761e66708d gpio: tegra: do not call pinctrl for GPIO direction
0630f2c3c16c gpio: mt7621: more robust management of IRQ domain teardown
6cb15b81ff54 cpu: hotplug: Bound hotplug states sysfs output
f77117530fc3 cpu: hotplug: Preserve per instance callback errors
afd147e59b32 selftests/ftrace: Drop invalid top-level local in test_ownership
ea6a188ee805 posix-cpu-timers: Use u64 multiplication in update_rlimit_cpu()
633cadbc0b83 locking/rt: Fix the incorrect RCU protection in rt_spin_unlock()
fcff712d0e3d wifi: libertas_tf: fix use-after-free in lbtf_free_adapter()
b33ac2d39953 tracing/user_events: Fix use-after-free in user_event_mm_dup()
ed3cc4218070 net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete
0e8115a7ed9a Input: ims-pcu - fix type confusion in CDC union descriptor parsing
f516cba88bf9 Input: ims-pcu - fix race condition in reset_device sysfs callback
383934c249a9 Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing
9c964fc9507a Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging
99c428d7ef64 Input: ims-pcu - fix firmware leak in async update
05ac85da1219 Input: ims-pcu - fix DMA mapping violation in line setup
f28c5cabb2df Input: ims-pcu - add response length checks
c8d3d83f2eaa Input: ims-pcu - validate control endpoint type
6329d1af316a Input: ims-pcu - release data interface on disconnect
87e2f89dea07 Input: ims-pcu - only expose sysfs attributes on control interface
6aacc18004b1 Input: ims-pcu - fix use-after-free and double-free in disconnect
df87532e9212 scsi: elx: efct: Fix I/O leak on unsupported additional CDB
9b871369cbb4 scsi: elx: efct: Fix refcount leak in efct_hw_io_abort()
cb7bdae7fba4 scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE
004ccd2d3b4a scsi: target: Bound PR-OUT TransportID parsing to the received buffer
f1516c56ac54 scsi: xen: scsiback: Free unsubmitted command instead of double-putting it
255fb7b0cdc9 scsi: xen: scsiback: Free the command tag on the TMR submit-failure path
d0a8a6660d58 scsi: sg: Report request-table problems when any status is set
ed0849797782 scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup()
d495b403d5b3 scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path
257321a1c036 accel/ivpu: Reject firmware log with size smaller than header
4e370b528962 accel/amdxdna: Fix use-after-free in amdxdna_gem_dmabuf_mmap()
7aa8f3dba534 dma-fence: Make dma_fence_dedup_array() robust against 0-count input
089e05b644d5 dm-verity: make error counter atomic
c8d743bb0e98 dm-verity: increase sprintf buffer size
f15eaa3801f2 dm-verity: fix a possible NULL pointer dereference
2a0858cba1da dm-verity: avoid double increment of &use_bh_wq_enabled
5dfd80426352 dm-integrity: don't increment hash_offset twice
aa5113e7155f dm-integrity: fix a bug if the bio is out of limits
0c4e9bb1d410 dm-integrity: fix leaking uninitialized kernel memory
92e3c93d60be dm_early_create: fix freeing used table on dm_resume failure
ee458c3c1834 dm-stats: fix merge accounting
461d36b5ddaf dm-stats: fix dm_jiffies_to_msec64
1247615aadb7 dm-pcache: reject option groups without values
e0b0163a6575 dm-log: fix a bitset_size overflow on 32bit machines
d61c12573ed9 dm-ioctl: fix a possible overflow in list_version_get_info
021dab70eb37 dm-bufio: fix wrong count calculation in dm_bufio_issue_discard
1fcb5e29dd7a dm era: fix out-of-bounds memory access for non-zero start sector
7f76245960a3 dm thin metadata: fix metadata snapshot consistency on commit failure
ac2136dc4441 dm thin metadata: fix superblock refcount leak on snapshot shadow failure
8a3c44a00317 net: sparx5: unregister blocking notifier on init failure
ffd17a393921 block: fix IORING_URING_CMD_REISSUE flags check in blkdev_uring_cmd
2977b5fe401c block: fix race in blk_time_get_ns() returning 0
af382ffca93e block: remove redundant GD_NEED_PART_SCAN in add_disk_final()
0b6252afcd19 bpf: Add missing access_ok call to copy_user_syms
c4f626ddf235 bpf,fork: wipe ->bpf_storage before bailouts that access it
0993dc5fc619 bpf: Reset register bounds before narrowing retval range in check_mem_access()
b06a4a397ac8 can: bcm: add missing rcu list annotations and operations
35f0ac19efb1 can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure
cd830e0bc25e can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF
37beb16e08ca can: isotp: serialize TX state transitions under so->rx_lock
7bef39ba76eb can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER
b88a51130877 can: isotp: use unconditional synchronize_rcu() in isotp_release()
765ba1c91823 can: esd_usb: kill anchored URBs before freeing netdevs
5e4c8e08ce95 netdev-genl: report NAPI thread PID in the caller's pid namespace
26355295ce21 nvmet: fix refcount leak in nvmet_sq_create()
2944113ad5fb nvmet-rdma: handle inline data with a nonzero offset
2eaa3ad45014 nvmet-auth: reject short AUTH_RECEIVE buffers
59cef6abc924 nvme-apple: Prevent shared tags across queues on Apple A11
0ffc032294a2 NFS: Charge unstable writes by request size, not folio size
ebe0a55d954f sctp: validate STALE_COOKIE cause length before reading staleness
d44b828eb551 spi: uniphier: Fix completion initialization order before devm_request_irq()
9b092f9e6b34 time: Fix off-by-one in compat settimeofday() usec validation
ada4b9a5087e tpm: Make the TPM character devices non-seekable
95bdf3950d66 tpm: fix event_size output in tpm1_binary_bios_measurements_show
8ca2a19a987a xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink
e0f688ccb20f xfrm: use compat translator only for u64 alignment mismatch
5b0c4c916f20 xfrm: nat_keepalive: avoid double free on send error
16d3ccdabb8d xen/gntdev: fix error handling in ioctl
e497fef9ad7e ufs: core: tracing: Do not dereference pointers in TP_printk()
0ced34b4bbc0 tcp: Decrement tcp_md5_needed static branch
33a1bee41362 tcp: defer md5sig_info kfree past RCU grace period in tcp_connect
bccae122dab8 ice: fix ice_init_link() error return preventing probe
8bd84316bbaf i2c: spacemit: fix spurious IRQ handling returning IRQ_HANDLED
e6a395a71f46 i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource()
2f3f471a448a i2c: mediatek: fix WRRD for SoCs without auto_restart option
5d3240f42a66 i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ)
6d2c973926d0 i2c: imx: fix locked bus on SMBus block-read of 0 (atomic)
500716a007b2 hwmon: (max6697) add missing 'select REGMAP_I2C' to Kconfig
1dcd7565e590 hwmon: (ltc2992) add missing 'select REGMAP_I2C' to Kconfig
3cd6f93f3d59 ksmbd: fix integer overflow in set_file_allocation_info()
6cc151835736 smb: client: use kvzalloc() for megabyte buffer in simple fallocate
fe623f9515bb pkey: Move keytype check from pkey api to handler
eafc5aca7156 platform/x86/amd/pmc: Don't log during intermediate wakeups
e628d9169f9e platform/x86/amd/pmc: Add delay_suspend module parameter
27d16a19ae74 platform/x86/amd/pmc: Delay suspend for some Lenovo Laptops
d8bc45c4c1a4 platform/x86/amd/pmc: Check for intermediate wakeup in function
cea03d67db3a platform/x86: ISST: Restore SST-PP control to all domains
1e41ca4a7fba platform/x86: dell-laptop: fix missing cleanups in init error path
ddbc4a8a4fe2 dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK
7926c1e4be86 dmaengine: tegra: Fix burst size calculation
933654508b2b sunrpc: fix uninitialized xprt_create_args structure
934d1cd40e28 tpm: tpm2-sessions: wait for async KPP completion in tpm_buf_append_salt
ba33b4f9d342 tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat()
781f28bd982c tpm: restore timeout for key creation commands
36ca587f55a2 irqchip/crossbar: Use correct index in crossbar_domain_free()
0d078152fcab taskstats: retain dead thread stats in TGID queries
9ac007affa77 mtd: maps: vmu-flash: fix NULL pointer dereference in initialization
3fac46068fe4 openrisc: Fix jump_label smp syncing
ff7bcc9d71bf mtd: rawnand: Pause continuous reads at block boundaries
0fd20c1905ab mtd: spi-nor: spansion: use die erase for multi-die devices only
c0806df5cf80 mtd: spi-nor: swp: Improve locking user experience
433e5e70cdc1 s390/pkey: Check length in pkey_pckmo handler implementation
693bf91d4db1 s390/pkey: Check length in PKEY_VERIFYPROTK ioctl
c9ef79e34bc1 fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header()
e5824d5b841d net: thunderbolt: Fix frags[] overflow by bounding frame_count
fc74244e0cc2 bus: mhi: ep: Protect mhi_ep_handle_syserr() in the error path
3ebe0ee6527e bus: mhi: host: pci_generic: Fix the physical function check
012683accbb7 fpga: dfl: add bounds check in dfh_get_param_size()
2174c68f623b ocfs2: reject non-inline dinodes with i_size and zero i_clusters
5e512d370a01 ocfs2: reject dinodes whose i_rdev disagrees with the file type
4db3b6a2a8ec ocfs2: reject dinodes with non-canonical i_mode type
499714de42ab ocfs2: add journal NULL check in ocfs2_checkpoint_inode()
671889c553ea ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2_sum_rightmost_rec
bd73971fad89 ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits
d5d5a21fb33c ocfs2: avoid moving extents to occupied clusters
4bbfcf9c7e46 mtd: rawnand: fix condition in 'nand_select_target()'
a8874c34c4a9 net/9p: fix infinite loop in p9_client_rpc on fatal signal
ace3a0c839f3 mtd: rawnand: pl353: fix probe resource allocation
b6337e3687d3 ocfs2: use kzalloc for quota recovery bitmap allocation
bf53557a96d4 openrisc: Add full instruction cache invalidate functions
8d263bae573d scsi: sas: Skip opt_sectors when DMA reports no real optimization hint
83405848e403 scsi: smartpqi: Use shost_to_hba() in pqi_scan_finished()
a7bbf83dfebd power: supply: bq257xx: Fix VSYSMIN clamping logic
8d610017c992 9p: skip nlink update in cacheless mode to fix WARN_ON
d8dcbbfa0d69 mtd: slram: remove failed entries from the device list
4e4beef747c6 kcov: use WRITE_ONCE() for selftest mode stores
da5234df0941 mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE
749e2051da3b powerpc/dt_cpu_ftrs: Set CPU_FTR_P11_PVR for Power11 and later processors
07ed8b178548 fs/proc: fix KPF_KSM reported for all anonymous pages
b6a6fb6803d5 proc: only bump parent nlink when registering directories
4d67bdef35c3 fs/proc/task_mmu: use huge_page_size() in pagemap_scan_hugetlb_entry()
43b987ed35be fs/proc/task_mmu: fix hugetlb self-deadlock in pagemap_scan_pte_hole()
40a04601a3f6 mm/damon/sysfs-schemes: put stats for scheme_add_dirs() internal error
f18c561eb9c5 mm/damon/sysfs-schemes: fix dir put orders in access_pattern_add_dirs()
f322955d9a1c riscv: cacheinfo: Fix node reference leak in populate_cache_leaves
1caee6e084a9 mips: sched: Fix CPUMASK_OFFSTACK memory corruption
bd2e9be9ebb6 selftests/landlock: Test SCOPE_SIGNAL on the SIGIO/fowner pgid path
193e6471e985 power: supply: charger-manager: fix refcount leak in is_full_charged()
1f18aac26372 landlock: Fix LANDLOCK_SCOPE_SIGNAL bypass on the SIGIO path
ff05a98150eb ntfs3: fix out-of-bounds read in decompress_lznt
f3624cc06919 ntfs3: validate split-point offset in indx_insert_into_buffer
aaa1f956c0fc ntfs3: bound to_move in indx_insert_into_root before hdr_insert_head
0fad25687d4d ntfs3: cap RESTART_TABLE free-chain walker at rt->used
be306b8d9143 fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation}
908c9243ba30 fs/ntfs3: add depth limit to indx_find_buffer to prevent stack overflow
7adb38279812 fs/ntfs3: validate lcns_follow in log_replay conversion
50b5e83384e7 fs/ntfs3: bound attr_off in UpdateResidentValue against data_off
d240cd98f5f7 fs/ntfs3: bound copy_lcns dp->page_lcns[] index in analysis pass
09fddd52c1b0 fs/ntfs3: bound DeleteIndexEntryAllocation memmove length
ccd6b7079873 fs/ntfs3: fix syncing wrong inode on DIRSYNC cross-directory rename
640627f07c79 mm/damon/core: make charge_addr_from aware of end-address exclusivity
722e6c54bde6 mm/memory_hotplug: fix incorrect altmap passing in error path
1697d253f51c mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch
9227b387eee5 power: supply: max17042: fix OF node reference imbalance
a3d81de44123 power: supply: cpcap-battery: Fix missing nvmem_device_put() causing reference leak
a39d281f207b mm/mm_init: fix pageblock migratetype for ZONE_DEVICE compound pages
d3fd2d358df0 MIPS: DEC: Ensure 32-bit stack location for o32 prom_printf()
11a3bc25f2c3 MIPS: ip22-gio: fix device reference leak in probe
2c551f14f55e MIPS: ip22-gio: fix kfree() of static object
620a37ea7d62 MIPS: ip22-gio: fix gio device memory leak
51aad3d89a2d remoteproc: qcom: Fix leak when custom dump_segments addition fails
69e18135e2a0 SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing
46d59ff42182 lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure
1161c4b5bd00 lockd: Plug nlm_file leak when nlm_do_fopen() fails
66014ab165cb sunrpc: harden rq_procinfo lifecycle to prevent double-free
65b23bec1fca sunrpc: wait for in-flight TLS handshake callback when cancel loses race
3f9ee75a97a7 sunrpc: pin svc_xprt across the asynchronous TLS handshake callback
30d490bb2c4c nvdimm/btt: Free arena sub-allocations on discover_arenas() error path
f4ca396bdd60 nvdimm/btt: Free arenas on btt_init() error paths
78955fdce8ff jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit()
7199c78c3a3e Bluetooth: SCO: hold sk properly in sco_conn_ready
77eb0cf57009 Bluetooth: SCO: fix sleeping under spinlock in sco_conn_ready
96dd35f1942c HID: playstation: validate num_touch_reports in DualShock 4 reports
88ba84546850 mfd: tps6586x: Fix OF node refcount
d8e2f3e1bc20 cifs: invalidate cfid on unlink/rename/rmdir
3256c05d5a9d batman-adv: tt: prevent TVLV OOB check overflow
d2b657c9653f batman-adv: mcast: avoid OOB read of num_dests header
a90f4fff9025 batman-adv: frag: fix primary_if leak on failed linearization
c945f6007e78 batman-adv: clean untagged VLAN on netdev registration failure
8f54162e07d3 batman-adv: frag: free unfragmentable packet
2c989ab8e205 batman-adv: fix VLAN priority offset
6a65ac8a81e9 batman-adv: tt: avoid request storms during pending request
ee878decf9e5 batman-adv: dat: fix tie-break for candidate selection
9e16b6751a82 batman-adv: ensure minimal ethernet header on TX
8f76277d0217 batman-adv: dat: ensure accessible eth_hdr proto field
e5e18886aadd batman-adv: bla: reacquire gw address after skb realloc
3b4c70c40f2e batman-adv: dat: acquire ARP hw source only after skb realloc
b8afcf799b2c batman-adv: access unicast_ttvn skb->data only after skb realloc
85a71a81854e batman-adv: retrieve ethhdr after potential skb realloc on RX
e6b43acd34b2 batman-adv: gw: acquire ethernet header only after skb realloc
fa1ebae4206e s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init()
8514585aa955 cpufreq: intel_pstate: Set non-turbo capacity to HWP_GUARANTEED_PERF()
221ee479a49f cpufreq: schedutil: Fix uncleared need_freq_update on the .adjust_perf() path
5ab0eba9c881 perf/x86/amd/lbr: Fix kernel address leakage
046f6244da9b perf/x86/amd/brs: Fix kernel address leakage
394e2bdf7594 x86/boot: Reject too long acpi_rsdp= values
f7c67c97b37c x86/boot: Validate console=uart8250 baud rate to fix early boot hang
1a1d6e3ef6cf x86/video: Only fall back to vga_default_device() without screen info
19ffeb30fdfc tools/power/x86/intel-speed-select: Harden daemon pidfile open
16a42c88c466 mfd: sm501: Fix reference leak on failed device registration
6dd51d84a950 leds: uleds: Fix potential buffer overread
3a134c3fb5f0 selinux: fix incorrect execmem checks on overlayfs
d61a80b17254 selinux: avoid sk_socket dereference in selinux_sctp_bind_connect()
fc633a598206 selinux: check connect-related permissions on TCP Fast Open
e9cdf741ffcb soc: fsl: qe: panic on ioremap() failure in qe_reset()
c6854d9f4e1b soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy
c4d6442ac3ed gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path
1c4f67c89fd2 netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment()
679ced28a9dc netfilter: xt_nat: reject unsupported target families
b2dbbedfa935 netfilter: ecache: fix inverted time_after() check
3cd9a5792cbe netfilter: nf_conncount: fix zone comparison in tuple dedup
a58230f3a7c4 netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag
2bcf2c5052fb netfilter: nf_nat_sip: reload possible stale data pointer
02b6b0e892ae netfilter: nft_set_pipapo: don't leak bad clone into future transaction
0ca505346c5e netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst
07f9ddbf5e79 netfilter: xt_cluster: reject template conntracks in hash match
a1b672a3b537 netfilter: nfnl_cthelper: apply per-class values when updating policies
aff589556ed7 netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read
ca028334343a ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback
e42d8322b67f ASoC: mediatek: mt8183: Release reserved memory on cleanup
4b068759d308 ASoC: mediatek: mt8183: Check runtime resume during probe
51c367230e30 ASoC: mediatek: mt8192: Release reserved memory on cleanup
e0f276f1918a ASoC: mediatek: mt8192: Check runtime resume during probe
d3abaedf6a58 ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control
121577383b5c ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get
4ebe2c3a7db6 fbdev: tridentfb: fix potential memory leak in trident_pci_probe()
009a8514745b fbdev: nvidia: fix potential memory leak in nvidiafb_probe()
58bc18e03481 fbdev: vesafb: fix memory leak in vesafb_probe()
d81860691e4c fbdev: carminefb: fix potential memory leak in alloc_carmine_fb()
e1ca9b8559e0 fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe()
12fe6a56506e fbdev: uvesafb: fix potential memory leak in uvesafb_probe()
ad54698255a4 fbdev: s3fb: fix potential memory leak in s3_pci_probe()
146b708bc75f fbdev: i740fb: fix potential memory leak in i740fb_probe()
c2c795a320e7 fbdev: radeon: fix potential memory leak in radeonfb_pci_register()
febb5b4f67ac fbdev: efifb: fix memory leak in efifb_probe()
9423e1f10527 fbdev: sm712: Fix operator precedence in big_swap macro
d684ce2db92b fbdev: hecubafb: fix potential memory leak in hecubafb_probe()
e8c9aae8c950 fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe()
6854cf33dddb fbdev: metronomefb: fix potential memory leak in metronomefb_probe()
d5436e18e4fc KVM: arm64: nv: Inject SEA if guest VNCR isn't normal memory
4ead4def0465 KVM: arm64: nv: Inject SEA if kvm_translate_vncr() can't resolve PFN
5c50db5bcbb9 KVM: arm64: nv: Respect read-only PFN when mapping L1 VNCR
884b44256041 KVM: arm64: nv: Fix SPSR_EL2 restore in kvm_hyp_handle_mops()
09f35145f3a4 KVM: arm64: nv: Write ESR_EL2 for injected nested SError exceptions
5000bcae71c8 KVM: arm64: nv: Drop bogus WARN for write to ZCR_EL2
7099e7148f81 KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers
7996013b8568 KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state
d1379888cc42 KVM: x86: Nullify irqfd->producer if updating IRTE for bypass fails
97542f15dc4c KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs
ba06690b28be KVM: SEV: Do not allow intra-host migration/mirroring of SNP VMs
df72596278b0 KVM: s390: pci: Fix handling of AIF enable without AISB
d19dca8194eb KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling
79fdd2aa774e KVM: arm64: vgic: Check the interrupt is still ours before migrating it
5fb75c527295 KVM: s390: pci: Fix GISC refcount leak on AIF enable failure
9f8eaef40e95 powerpc/pseries/Kconfig: Enable CONFIG_VPA_PMU to be used with KVM
33d79ad6eced LoongArch: KVM: Return full old CSR value from kvm_emu_xchg_csr()
f3efcef6648b LoongArch: KVM: Fix FPU register width with user access API
45f2e6505fcf LoongArch: KVM: Check the return values for put_user()
efe27b19a15c LoongArch: KVM: Check irq validity in kvm_vcpu_ioctl_interrupt()
199b570d7fca LoongArch: KVM: Validate irqchip index in irqfd routing
1ee200a1764f ARM: dts: stm32: stm32mp15x-mecio1-io: Move expander gpio-line-names to board files
f550bf32b9a0 ARM: dts: stm32: stm32mp15x-mecio1-io: Fix expander gpio line typo
7da4d1a6b740 ARM: dts: stm32: stm32mp15x-mecio1-io: Move gpio-line-names to board files
804821b69b2d ARM: dts: stm32: stm32mp15x-mecio1-io: Fix GPIO names typo
c632a27f35cf arm64: dts: imx8ulp-evk: Correct Type-C int GPIO flags
bd938c985ab3 ARM: dts: stm32: stm32mp15x-mecio1-io: Enable internal ADC reference
ead9f10428c7 arm64: dts: ti: k3-am62a7-sk: Add bootph-all tag to vqmmc
a98bda2305f3 ARM: dts: stm32: stm32mp15x-mecio1-io: Move divergent mecio1 ADC channels to board files
4fd52ac541ce ARM: dts: stm32: stm32mp15x-mecio1-io: Fix ADC sampling times
68f9773754f0 arm64: dts: rockchip: fix Ethernet PHY not found on PX30 Ringneck
e2e3fb995175 arm64: dts: qcom: sdm630: describe adsp_mem region properly
508e55e81870 ARM: dts: imx6ul-var-som: fix warning for non-existent dc-supply property
e8dc96a42571 arm64: dts: s32g3: Fix SWT8 watchdog address
89edae416141 arm64: fpsimd: Fix type mismatch in sve_{save,load}_state()
5526d1997aea net: ife: require ETH_HLEN to be pullable in ife_decode()
908391d801b2 octeontx2-vf: clear stale mailbox IRQ state before request_irq()
eebf439aa7a1 octeontx2-pf: clear stale mailbox IRQ state before request_irq()
e62adb157c2e net: atm: reject out-of-range traffic classes in QoS validation
22100a8f73d4 net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post()
61a55fa24a5d tipc: restrict socket queue dumps in enqueue tracepoints
d34deef34c99 ASoC: SOF: topology: validate vendor array size before parsing
0c4fbdaca225 ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get
711d912b1876 ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc
fb4293173db2 ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put
d8715b5a8fdb vduse: Fix race in vduse_dev_msg_sync and vduse_dev_read_iter
3a2b47d1b4b3 mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace()
2d8b3c3e1299 mlxsw: fix refcount leak in mlxsw_sp_port_lag_join()
b65e46eed9e5 idpf: add padding to PTP virtchnl structures
1627e7d5c9b0 smb: client: fix overflow in passthrough ioctl bounds check
327595e7c34e drm/xe: remove duplicate <kunit/test-bug.h> include
3de77d2f34c2 octeontx2-af: fix VF bringup affecting PF promiscuous state
ee3f7566bcf3 net/mlx5: Fix L3 tunnel entropy refcount leak
1550b07bca2b selftests/net: fix EVP_MD_CTX leak in tcp_mmap
346e2d666a29 regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK
14e03ecd3b1b dm era: fix NULL pointer dereference in metadata_open()
5b0427ba582d SUNRPC: pin upper rpc_clnt across the TLS connect_worker
13965a7b190f SUNRPC: release lower rpc_clnt if killed waiting for XPRT_LOCKED
b784cd1c24d8 cifs: validate DFS referral string offsets
df0e3e70f699 s390/zcrypt: Remove the empty file
8f48cfe65740 ipvs: ensure inner headers in ICMP errors are in headroom
7510451a58c2 ipvs: fix PMTU for GUE/GRE tunnel ICMP errors
d73f4249776d ipvs: use parsed transport offset in TCP state lookup
d340e351a0a7 ipvs: pass parsed transport offset to state handlers
238c612357b5 netfilter: nft_lookup: fix catchall element handling with inverted lookups
f60ec3058a85 ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer()
27506827a01f ipv4: igmp: annotate data-races around timer-related fields
d269eb67d2e5 ipv4: igmp: annotate data-races around im->users
9ce741c22df4 ipv6: mcast: Fix potential UAF in MLD delayed work
75e984fe0cb9 ipv4: igmp: Fix potential UAF in igmp_gq_start_timer()
3bfcce441c55 gpio: mvebu: free generic chips on unbind
7cc438c99bba perf/x86/amd/core: Avoid enabling BRS from the SVM reload path
9579d625171a octeontx2-pf: check DMAC extraction support before filtering
7aa0e64fea77 net/sched: cake: reject overhead values that underflow length
72119397cdff net: mdio: select REGMAP_MMIO instead of depending on it
762116dfa728 drm/v3d: Reject invalid indirect BO handle in indirect CSD setup
267809e2c56f accel/amdxdna: Fix potential amdxdna_umap lifetime race
1cd434ac1c22 tracing: Make tracepoint_printk static as not exported
5e15cf51982f gpio: dwapb: Defer clock gating until noirq
6c736c5ccf4a gpio: dwapb: reduce allocation to single kzalloc
d7b5497e0e45 gpio: dwapb: Use modern PM macros
a3010b732d62 net: usb: lan78xx: disable VLAN filter in promiscuous mode
e8a4c9fc437b net/tls: Consume empty data records in tls_sw_read_sock()
b3eeb586f94c accel/amdxdna: Use unsigned long for nr_pages in amdxdna_hmm_register()
ec5e96aee75d ring-buffer: Fix event length with forced 8-byte alignment
0c602cb8f148 Bluetooth: L2CAP: fix tx ident leak for commands without a response
bfc9e7be289d Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup()
b69b1ab121fe Bluetooth: ISO: exclude RFU bits from ISO_SDU_Length
da4d8eea0c5f Bluetooth: sco: Fix a race condition in sco_sock_timeout()
dfc8373893b1 Bluetooth: MGMT: Fix adv monitor add failure cleanup
23a83bac3356 Bluetooth: 6lowpan: hold L2CAP conn across debugfs control
026c236f0eef amt: fix size calculation in amt_get_size()
3bfb96d9bc6a net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket
6f9b23eb92a8 net/sched: act_pedit: fix TOCTOU heap OOB write in tc offload
1b12612c367e net: qualcomm: rmnet: validate MAP frame length before ingress parsing
b066420e57f3 qede: fix off-by-one in BD ring consumption on build_skb failure
1e71a40d1015 net: microchip: vcap: fix races on the shared Super VCAP block
5c7e3755abf6 net/mlx5e: Fix publication race for priv->channel_stats[]
60fddda7207d net/mlx5e: Fix HV VHCA stats agent registration race
420aabb32da4 net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation
6a802de97a8b net/mlx5: LAG, MPESW, Fix missing complete() on devcom error
4eef84b09a38 netfilter: xt_connmark: reject invalid shift parameters
b29b67c729de netfilter: nft_set_rbtree: get command skips end element with open interval
3d441be2b1c5 netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop
e702f6dd5d21 netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt()
a597a722fb71 netfilter: xt_u32: reject invalid shift counts
4a4a1d41c6e9 gue: validate REMCSUM private option length
b153cfe84b13 net: usb: net1080: validate packet_len before pad-byte access in rx_fixup
66f57dc92aeb arm64/sysreg: Fix BWE field encoding in ID_AA64DFR2_EL1
a6185c21d551 selftests/hid: Cover hid_bpf_get_data() size overflow
91ac1d7fd51e selftests/hid: Load only requested struct_ops maps
61a959b82f1a HID: bpf: Fix hid_bpf_get_data() range check
4c65c3d9f660 arm64/mm: Optimize TLB flush in unmap_hotplug_[pmd|pud]_range()
dd395744e4ed HID: core: Fix OOB read in hid_get_report for numbered reports
d354e523c6f7 HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait()
793b55c3f36f ata: libata-scsi: limit simulated SCSI command copy to response length
232a2f2fce9b ata: sata_gemini: unwind clocks on IDE pinctrl errors
86652704a7fd cifs: Fix missing credit release on failure in cifs_issue_read()
c9170c83b0e0 uprobes/x86: Use proper mm_struct in __in_uprobe_trampoline
2265b2b1c5aa x86/uprobes: Keep shadow stack in sync for emulated CALLs
adc7dda728ca drm/xe/pf: Don't attempt to process FAST_REQ or EVENT relays
a0a56b4480a0 drm/xe/hw_engine: Fix double-free of managed BO in error path
f9a9abd7bbda drm/xe/userptr: Hold notifier_lock for write on inject test path
78b1074966d2 drm/xe/pt: Fix NULL pointer dereference in xe_pt_zap_ptes_entry()
a9b89752c272 netfs: Fix folio state after ENOMEM whilst under writeback iteration
1bb33d959aab netfs: Fix writeback error handling
7838131e296d netfs: Fix writethrough to use collection offload
8ab75e445c16 netfs: Fix netfs_create_write_req() to handle async cache object creation
1f38f65bf965 iomap: guard io_size EOF trim against concurrent truncate underflow
08b214547066 ovl: fix comment about locking order
abe3536a4bed minix: avoid overflow in bitmap block count calculation
ce6aced2e855 afs: Fix unchecked-length string display in debug statement
158c5a0b1dfc afs: Fix the volume AFS_VOLUME_RM_TREE is set on
657449e5581a afs: Fix premature cell exposure through /afs
2ffb70a8a019 afs: Fix lack of locking around modifications of net->cells_dyn_ino
8afb1a787a28 afs: Fix vllist leak
5492799ec5d2 afs: Fix missing NULL pointer check in afs_break_some_callbacks()
0acbc09d2aca afs: Fix callback service message parsers to pass through -EAGAIN
63d3f283858f afs: Fix reinitialisation of the inode, in particular ->lock_work
5ea289ca751c afs: Fix misplaced inc of net->cells_outstanding
b5bc1e5d5ce5 afs: Fix bulk lookup malfunction due to change in dir_emit() API
083a0ddc9cd4 afs: Remove erroneous seq |= 1 in volume lookup loop
6eb0d929202a afs: use kvfree() to free memory allocated by kvcalloc()
aa24cec5b347 afs: Fix double netfs initialisation in afs_root_iget()
8530206911fd afs: Fix error code in afs_extract_vl_addrs()
a2038514e693 fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid
374fd8122421 net/sched: hhf: clear heavy-hitter state on reset
fba8e250ce5f net/sched: dualpi2: clear stale classification on filter miss
a203f2c3892b pinctrl: meson: restore non-sleeping GPIO access
47120164c63d gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe
5a5ac2852cd3 ksmbd: fix use-after-free of fp->owner.name in durable handle owner check
d020e7f27bf6 ksmbd: reject undersized DACLs before parsing ACEs
6b1304ce6cff net/sched: act_bpf: use rcu_dereference_bh() to read the filter
a03387e1f625 selftests: drv-net: tso: don't touch dangerous feature bits
df9ffdceac05 cxgb4: Fix decode strings dump for T6 adapters
124440df267d virtio_net: disable cb when NAPI is busy-polled
a8323fb2ab6c sctp: fix addr_wq_timer race in sctp_free_addr_wq()
4e8d498d32b6 irqchip/ts4800: Fix missing chained handler cleanup on remove
c5d75800539b irqchip/gic-v3-its: Fix OF node reference leak
f0069a262bd4 tracing/probes: Make the $ prefix mandatory for comm access
62988204162f tracing/fprobe: Fix NULL pointer dereference in fprobe_fgraph_entry()
898cb5a7c415 tracing: eprobe: read the complete FILTER_PTR_STRING pointer
e0881f5cc4d7 tracing/events: Fix to check the simple_tsk_fn creation
f148f86c65b8 tracing/probes: Remove WARN_ON_ONCE from parse_btf_arg
3b51d6f07a19 tracing/eprobes: Allow use of BTF names to dereference pointers
acbf1ecc22f3 drm/panthor: Interrupt group start/resumption if group_bind_locked() fails
a9d098b346db drm/panthor: Fix a leak when a group is evicted before the tiler OOM is serviced
1497a438ea34 drm/panthor: Don't overrule pending immediate ticks in sched_resume_tick()
dd0b2976b7c0 drm/panthor: Fix potential invalid pointer deref in group_process_tiler_oom()
b4b3458ef88d bridge: stp: Fix a potential use-after-free when deleting a bridge
9b7d05cbaa60 net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF
ef940e042f32 net: gianfar: dispose irq mappings on probe failure and device removal
58ba00999898 net: libwx: fix VMDQ mask for 1-queue mode
86d379fcf1b7 net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy
0a7d9c7c5f1f usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup()
d8a01d27873e ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump
83df3e2594cd eth: fbnic: don't cache shinfo across skb realloc
898ca04b096b hwmon: (aspeed-g6-pwm-tach) Guard fan RPM calculation against divide-by-zero
489291b6b569 hwmon: (pmbus) Fix passing events to regulator core
36554592e2f5 hwmon: adm1275: Prevent reading uninitialized stack
1797eb92f0b3 ASoC: codecs: lpass-va-macro: Fix LPASS Codec Version for SC7280
f14c3926fee3 ASoC: codecs: lpass-va-macro: add SM6115 compatible
3d3638fe9213 MIPS: mm: Add check for highmem before removing memory block
4e9f4ca9dc73 MIPS: DEC: Ensure RTC platform device deregistration upon failure
bca3100f5502 sctp: add INIT verification after cookie unpacking
ad6215d76b64 sctp: fix SCTP_RESET_STREAMS stream list length limit
1681cc7974a6 net: enetc: check the number of BDs needed for xdp_frame
b17751a2ebc4 qede: fix out-of-bounds check for cqe->len_list[]
8dba7a94a269 seg6: validate SRH length before reading fixed fields
8d501b141154 net: pse-pd: scope pse_control regulator handle to kref lifetime
e94d53a9ac22 gpio: htc-egpio: use managed gpiochip registration
f4af803269cc gpio: mvebu: fail probe if gpiochip registration fails
46dee20d30b7 riscv: Fix 32-bit call_on_irq_stack() frame pointer ABI
8e0b7f94fb39 ACPI: RIMT: Only defer the IOMMU configuration in init stage
776f70bafd45 spi: sh-msiof: abort transfers when reset times out
d6cd34d17b95 tracing: probes: fix typo in a log message
f28d7b5f1578 ALSA: FCP: Fix NULL pointer dereference in interface lookup
d990a01b853e net: hns3: differentiate autoneg default values between copper and fiber
2d149a20275a net: hns3: fix permanent link down deadlock after reset
92d05883ef33 net: hns3: refactor MAC autoneg and speed configuration
43a6c6fb6ec5 net: hns3: unify copper port ksettings configuration path
de051b146022 selftests: tls: size splice_short pipe by page size
6727f580cf46 dt-bindings: net: renesas,ether: Drop example "ethernet-phy-ieee802.3-c22" fallback
9075efb9b2c1 net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync
c1e7286d0531 ASoC: fsl_asrc_dma: fix eDMA maxburst misalignment with channel count
7a7c7263bbbc LoongArch: BPF: Fix off-by-one error in tail call
ed295077a221 LoongArch: BPF: Fix outdated tail call comments
0a8a729481c8 LoongArch: Move struct kimage forward declaration before use
2f3c0895fb20 net: ethernet: sunplus: spl2sw: fix phy_node refcount leak in remove
b15a3cc68e24 net: sungem: fix probe error cleanup
b84dd48f9da1 net: mvneta: re-enable percpu interrupt on resume
e0ac054416bf octeontx2-af: Validate NIX maximum LFs correctly
9dc3cf8a3590 net: phy: realtek: Clear MDIO_AN_10GBT_CTRL_ADV10G bit
0c11a1da41a6 net: dsa: realtek: fix memory leak in rtl8366rb_setup_led()
a69ccea6d7eb rtc: cmos: unregister HPET IRQ handler on probe failure
5fd1f0512748 rtc: ds1307: Fix off-by-one issue with wday for rx8130
d0bfd7004a87 smb/client: preserve errors from smb2_set_sparse()
5b6165d7ec38 ACPI: processor_idle: Mark LPI enter functions as __cpuidle
ea43e7a231aa thermal: testing: zone: Flush work items during cleanup
4e62be1490d2 eth: fbnic: fix ordering of heartbeat vs ownership
123b559aa6bb ipv6: fix missing notification for ignore_routes_with_linkdown
419017dd2dda ipv6: fix state corruption during proxy_ndp sysctl restart
ae58dbf1d78d ipv6: fix error handling in disable_policy sysctl
2bf70e0306f8 ipv6: fix error handling in forwarding sysctl
b060606bc7e4 ipv6: fix error handling in ignore_routes_with_linkdown sysctl
56c26538f0e5 ipv6: fix error handling in disable_ipv6 sysctl
2140c2f3f2e7 net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle
ff127c0aa527 net: usb: lan78xx: restore VLAN and hash filters after link up
a9e6707322ef veth: fix NAPI leak in XDP enable error path
410629528067 net: dsa: sja1105: round up PTP perout pin duration
7557df1b60f2 net: do not acquire dev->tx_global_lock in netdev_watchdog_up()
03b743586a24 net, bpf: check master for NULL in xdp_master_redirect()
a0904f7d2703 alpha/PCI: Fix __pci_mmap_fits() overflow for zero-length BARs
94defb18ac79 alpha/PCI: Add security_locked_down() check to pci_mmap_resource()
04117aea9bc1 NTB: epf: Fix doorbell bitmask and IRQ vector handling
56ec2a08d27b NTB: epf: Report 0-based doorbell vector via ntb_db_event()
d2a41c85beb5 NTB: epf: Make db_valid_mask cover only real doorbell bits
60a6689b9a5d gpio: davinci: fix IRQ domain leak on devm_kzalloc failure
33e1875d6b5b netfilter: nft_compat: ebtables emulation must reject non-bridge targets
d3e9a7e2ce9d netfilter: nft_synproxy: stop bypassing the priv->info snapshot
329f2626ee5c netfilter: nf_conncount: prevent connlimit drops for early confirmed ct
a73e7ac3f3b6 netfilter: nf_nat: avoid invalid nat_net pointer use on failed nf_nat_init()
49fa1be621dd bpf: Disable xfrm_decode_session hook attachment
4d919c9b7709 md/raid5: avoid R5_Overlap races while breaking stripe batches
3db13f82ba31 md/raid5: use stripe state snapshot in break_stripe_batch_list()
828fad4fd418 ipv4: fib: Don't ignore error route in local/main tables.
630ce3806b70 eth: bnxt: improve the timing of stats
c0057e5f762b eth: bnxt: rename ring_err_stats -> ring_drv_stats
33168db149d0 eth: bnxt: gather and report HW-GRO stats
b0d0eb13a044 ipv6: Fix null-ptr-deref in fib6_nh_mtu_change().
77bb0bbfcc4e ksmbd: fix use-after-free of conn->preauth_info in concurrent SMB2 NEGOTIATE
1f6a4aec0d36 rtc: msc313: fix NULL deref in shared IRQ handler at probe
68115a7a336f i40e: Fix i40e_debug() to use struct i40e_hw argument
de80d04b13de ice: dpll: fix memory leak in ice_dpll_init_info error paths
eaffdd113f56 ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info
854065a75e37 rtc: isl1208: Balance enable_irq_wake() with disable_irq_wake() on cleanup
4cc632fe63df ice: call netif_keep_dst() once when entering switchdev mode
04c082b7dc5b ice: fix AQ error code comparison in ice_set_pauseparam()
dd6d8e4412f8 ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs()
9415a94cf622 PCI: endpoint: pci-epf-ntb: Add check to detect 'db_count' value of 0
e1e7c72a2301 PCI: endpoint: pci-epf-vntb: Add check to detect 'db_count' value of 0
9cc0f8e63e8c drm/edid: fix OOB read in drm_parse_tiled_block()
5e4c4ab99abc gpiolib: initialize return value in gpiochip_set_multiple()
7550becf3301 power: sequencing: fix ABBA deadlock in pwrseq_device_unregister()
9697db03e010 bpf: Fix effective prog array index with BPF_F_PREORDER
3bdfa0e435f3 bpf: zero-initialize the fib lookup flow struct
b05337635be3 bpftool: Fix vmlinux BTF leak in cgroup commands
68b41e68a622 bpf: Fix stack slot index in nospec checks
aa33b44f70bf rtc: ds1307: handle oscillator stop flag for ds1337/ds1339/ds3231
56e5f8a409f8 rtc: abx80x: fix the RTC_VL_CLR clearing all status flags
93f95538b611 dpaa2-switch: do not accept VLAN uppers while bridged
ea24f911ead8 ipv6: ioam: fix type confusion of dst_entry
a6450f7cfae5 ipv6: ndisc: fix NULL deref in accept_untracked_na()
2066e692ec7a net: airoha: Fix skb->priority underflow in airoha_dev_select_queue()
1d51aff78f07 net/sched: act_ct: fix nf_connlabels leak on two error paths
a103cdb0681e net: emac: Fix NULL pointer dereference in emac_probe
2855ec137a22 octeontx2-pf: mcs: Fix mcs resources free on PF shutdown
da603b606ceb octeontx2-pf: Clear stats of all resources when freeing resources
5636f0f3bd99 octeontx2-af: mcs: Fix unsupported secy stats read
ceef83f0eaf9 net: ethernet: mtk_ppe: Fix rhashtable leak in mtk_ppe_init error paths
a0c5fdeb5fa2 tipc: fix use-after-free of the discoverer in tipc_disc_rcv()
5dda4f164a63 net: marvell: prestera: initialize err in prestera_port_sfp_bind
9200c8149910 selftests/mm: fix exclusive_cow test fork() handling
55fc2f99d097 selftests/mm: allow PUD-level entries in compound testcase of hmm tests
c8add1d06512 selftests/mm: clarify alternate unmapping in compaction_test
0caa28e97894 selftests/mm: skip uffd-stress test when nr_pages_per_cpu is zero
471b62966c78 selftests/mm: ensure destination is hugetlb-backed in hugetlb-mremap
9dbfd514148d selftest/mm: register existing mapping with userfaultfd in hugetlb-mremap
a8673dbd3d4a selftests/mm: free dynamically allocated PMD-sized buffers in split_huge_page_test
31b28910abe3 selftests/mm: size tmpfs according to PMD page size in split_huge_page_test
fff7d3ea3a4c selftests/mm: fix cgroup task placement and drop memory.current checks in hugetlb_reparenting_test.sh
8c65c58868ec selftests/mm: fix hugetlb pathname construction in hugetlb_reparenting_test.sh
58cd8ff69e33 selftests/mm: restore default nr_hugepages value via exit trap in hugetlb_reparenting_test.sh
b805de2abfa3 selftests/mm: restore default nr_hugepages value via exit trap in charge_reserved_hugetlb.sh
37e3e8a2c3bf alloc_tag: fix use-after-free in /proc/allocinfo after module unload
502b3ae43f79 irqchip/crossbar: Fix parent domain resource leak
002ebbcc8414 mailbox: imx: Forward the timeout/ error in imx_mu_generic_tx()
7e23965d44f0 netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak
d32e4301a0e5 netfilter: nf_reject: skip iphdr options when looking for icmp header
8e935c51b65d netfilter: nft_flow_offload: zero device address for non-ether case
4c61d28634fb netfilter: flowtable: move path discovery infrastructure to its own file
13c6ba6e0f21 netfilter: nft_meta_bridge: add validate callback for get operations
5baa149abb41 netfilter: nft_payload: reject offsets exceeding 65535 bytes
12088da6add5 netfilter: ipset: make sure gc is properly stopped
8087bb360a93 netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer()
c4d257734e91 netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types
a0afd353c2f7 netfilter: ipset: annotate "pos" for concurrent readers/writers
7228cc8ff626 netfilter: ipset: Fix data race between add and dump in all hash types
6d92dbd73d19 md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry
2c5384c40a4c md/raid1: honor REQ_NOWAIT when waiting for behind writes
119903c32083 md: merge mddev serialize_policy into mddev_flags
2e414af05a7c md: merge mddev faillast_dev into mddev_flags
9408c233a5bb md: merge mddev has_superblock into mddev_flags
5464ee644237 mac802154: Prevent overwrite return code in mac802154_perform_association()
de3bd9809af7 ieee802154: fix kernel-infoleak in dgram_recvmsg()
d22e278cd067 ieee802154: Remove WARN_ON() in cfg802154_pernet_exit()
f4860dd988b1 ieee802154: Avoid calling WARN_ON() on -ENOMEM in cfg802154_switch_netns()
5d17ebdf6c23 ieee802154: Restore initial state on failed device_rename() in cfg802154_switch_netns()
3b40ebc19ad0 ACPI: IPMI: Fix inverted interface check in ipmi_bmc_gone()
45465b0e0135 ACPI: resource: Amend kernel-doc style
7ae67f0e1c16 thermal: intel: Fix dangling resources on thermal_throttle_online() failure
679fd0bf4f8a arm64/hw_breakpoint: reject unaligned watchpoints that would truncate BAS
4c16176fc11a ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints
a762b9865f49 selftests: vlan_bridge_binding: Fix flaky operational state check
c6d3bcb0f934 flow_dissector: check device type before reading ETH_ADDRS
68af74ad696c net: macb: add TX stall timeout callback to recover from lost TSTART write
112b5eff24e0 net: airoha: fix foe_check_time allocation size
5ffb2b4987cc devlink: Fix parent ref leak on tc-bw failure
02c884d9aaca devlink: Fix parent ref leak in devl_rate_node_create()
0dafdaaf8684 dpaa2-switch: fix VLAN upper check not rejecting bridge join
c7fc9adf4e00 virtio-net: fix len check in receive_big()
0d95587d662a spi: rpc-if: Use correct device for hardware reinitialization on resume
f37f2f804796 PCI: iproc: Restore .map_irq() for the platform bus driver
53c23d56b46b ALSA: usb-audio: qcom: clear opened when stream enable fails
25a867aa5e67 ALSA: usb-audio: qcom: reject stream disable with no active interface
207bb4ce8fe7 sctp: hold socket lock when dumping endpoints in sctp_diag
a6cfb924ad74 net: psample: fix info leak in PSAMPLE_ATTR_DATA
3d45d40b872a octeontx2-pf: Fix leak of SQ timestamp buffer on teardown
290ad0a54891 drm/amdgpu: initialize irq.lock spinlock earlier
96ac562a9ea3 drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm
211bb9d8f17c drm/amd/display: Fix mem_type change detection for async flips
0e27d92f69b8 drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free
7bcd4ef375fa ASoC: tlv320aic3x: restrict CLKDIV bypass Q values in dual-rate mode
ca297485271c perf dso: Set standard errno on decompression failure
05b11debdffe perf bpf: Validate array presence before casting BPF prog info pointers
c8cb4a92eda6 perf cs-etm: Bounds-check CPU in cs_etm__get_queue()
b389a5b215e3 perf cs-etm: Require full global header in auxtrace_info size check
c13532ff67fa perf cs-etm: Validate num_cpu before metadata allocation
87d23f25b5e9 perf machine: Use snprintf() for guestmount path construction
6d99379c58f7 xfrm: validate selector family and prefixlen during match
7248ae02a945 xfrm: annotate data-races around xfrm_policy_count[] and xfrm_policy_default[]
a1a3360a0c44 xfrm: Fix xfrm state cache insertion race
1467ca02ddac ALSA: usb-audio: qcom: Free sideband sg_table objects
507a7b07f3fa i3c: master: Add missing runtime PM get in dev_nack_retry_count_store()
34cd92141a02 i3c: master: Update dev_nack_retry_count under maintenance lock
95028569589f spi: dw: fix wrong BAUDR setting after resume
355e51eeffc6 drm/xe: Fix wa_oob codegen recipe for external module builds
2024940522ef drm/i915: clear CRTC color blob pointers after dropping refs
1348bf64c197 gpio: mlxbf3: fail probe if gpiochip registration fails
7d3532a0b11a perf cs-etm: Reject CPU IDs that would overflow signed comparison
a56f29ad8aac perf: Remove redundant kernel.h include
f8898d2eb71a perf bpf: Bounds-check array offsets in bpil_offs_to_addr()
cafd80d81f08 perf bpf: Reject oversized BPF metadata events that truncate header.size
1935d213aeb2 perf bpf: Validate func_info_rec_size and sub_id in synthesize_bpf_prog_name()
aea30b437ebd perf sched: Replace (void*)1 sentinel with proper runtime allocation
bc27041e8971 perf hwmon: Fix fd check to accept fd 0 in hwmon_pmu__describe_items()
661f60a8a5cf perf tools: Use snprintf() for root_dir path construction
5d080b7324f0 perf dso: Set error code when open() fails on uncompressed fallback path
debfcd673a6d perf dso: Fix heap overflow in dso__get_filename() on decompressed path
95bf4dbcd502 perf tools: Fix uninitialized pathname on uncompressed fallback in filename__decompress()
fa870f951793 perf tools: Add O_CLOEXEC to open() calls in DSO and ELF code
3ae7947101b9 perf tools: Don't read build-ids from non-regular files
2c19e40753ec perf symbols: Break infinite loop on zero-filled notes in sysfs__read_build_id()
137eabe3c18f perf symbols: Validate p_filesz before use in filename__read_build_id()
ca3393e258f6 perf symbols: Fix bswap copy-paste error for 32-bit ELF p_filesz
f231387f3d2b sparc: led: avoid trimming a newline from empty writes
17955f1995bf accel/ivpu: fix HWS command queue leak on registration failure
85873b1bd366 apparmor: fix label can not be immediately before a declaration
38d3d33bf42c i3c: master: Prevent reuse of dynamic address on device add failure
c4f2afcdc547 i3c: master: Defer new-device registration out of DAA caller context
3891c061341f i3c: master: Ensure Hot-Join operations are stopped on shutdown
57490b302b98 i3c: master: Consolidate Hot-Join DAA work in the core
0bd450d40f87 i3c: master: Move rstdaa error suppression
fd32e8d4a293 i3c: master: Add i3c_master_do_daa_ext() for post-hibernation address recovery
b07a318afca1 i3c: master: Introduce optional Runtime PM support
882ee831366a i3c: master: Replace WARN_ON() with dev_err() in i3c_dev_free_ibi_locked()
de2106d99b87 i3c: add sysfs entry and attribute for Device NACK Retry count
0d66830f302f i3c: master: Make hot-join workqueue freezable to block hot-join during suspend
eb9db96a5deb i3c: master: add WQ_PERCPU to alloc_workqueue users
45bbc1e1fe62 i3c: mipi-i3c-hci: Preserve RUN bit when aborting DMA ring
d22ab94261c7 i3c: mipi-i3c-hci: Switch PIO data allocation to devm_kzalloc()
973fda38b124 i3c: mipi-i3c-hci: Allow for Multi-Bus Instances
5625b8767ce3 i3c: mipi-i3c-hci: Quieten initialization messages
2791dd42d41e apparmor: fix uninitialised pointer passed to audit_log_untrustedstring()
fdf610a9a9e7 apparmor: don't audit files pointing to aa_null.dentry
b58d240883df apparmor: put secmark label after secid lookup
66a6c61369d4 apparmor: aa_getprocattr free procattr leak on format failure
22dc9433d458 apparmor: fail policy unpack on accept2 allocation failure
3b918f6f5239 apparmor: Fix return in ns_mkdir_op
566d1ef98a71 apparmor: remove or add symlinks to rawdata according to export_binary
fbfdb5a94a48 apparmor: fix NULL pointer dereference in unpack_pdb
57b1bd4486d5 apparmor: fix potential UAF in aa_replace_profiles
b427061ca498 apparmor: grab ns lock and refresh when looking up changehat child profiles
9111f76e8dc8 apparmor: fix rawdata_f_data implicit flex array
ae02e603c0b3 apparmor: aa_label_alloc use aa_label_free on alloc failure
d82160132345 apparmor: check label build before no_new_privs test
ad965f36d298 security/apparmor/apparmorfs.c: conditionally compile get_loaddata_common_ref()
045dbe89ac31 apparmor: fix refcount leak when updating the sk_ctx
d8ea44f6090c apparmor: fix race in unix socket mediation when peer_path is used
ef488d7429d2 apparmor: fix shadowing of plabel that prevents cache from being updated
f79519f63605 Revert "PCI/MSI: Unmap MSI-X region on error"
514b84b1bf30 PCI: dwc: Avoid dwc_pcie_rasdes_debugfs_deinit() NULL dereference when no RAS DES capability
11016555d751 phy: freescale: phy-fsl-imx8qm-lvds-phy: Fix missing pm_runtime_disable() on probe error path
872f9a63a108 PCI: mediatek: Use actual physical address instead of virt_to_phys()
f77c490c45d4 PCI: mediatek: Fix possible truncation in mtk_pcie_parse_port()
9ca0a78a5d56 dt-bindings: phy: sc8280xp-qmp-pcie: Disallow bifurcation register on Purwa
f1f5f8d334e9 perf symbols: Add bounds checks to read_build_id() note iteration in minimal build
cc6cd3fe8b8b perf symbols: Add bounds checks to elf_read_build_id() note iteration
a3e758e74122 perf bpf: Fix metadata leak in perf_env__add_bpf_info() on duplicate insert
f593775fecf5 perf bpf: Fix map data leak in bpf_metadata_create() on alloc failure
bafb6bfb346f perf bpf: Add NULL check for btf__type_by_id() in synthesize_bpf_prog_name()
fe4d8ad2e96f tools lib api: Fix mount_overload() snprintf truncation and toupper range
b0385203a09f tools lib api: Fix filename__write_int() writing uninitialized stack data
41b3a9231045 perf tools: Use snprintf() in dso__read_running_kernel_build_id()
fbaf9bdfc091 perf hwmon: Guard label read against empty or failed reads
d34b42ee0c74 perf symbols: Bounds-check descsz in sysfs__read_build_id() GNU fallback
bc2fc12ce6e4 perf hwmon: Fix parse_hwmon_filename() strlcpy buffer overflow
f830bb8d221f perf hwmon: Use scnprintf() in hwmon_pmu__for_each_event()
76dfa13a0acb perf hwmon: Fix off-by-one null termination on sysfs reads
56b17c84394f perf tools: Fix thread__set_comm_from_proc() on empty comm file
f2e5262589d9 perf intel-pt: Fix snprintf size tracking bug in insn decoder
45e7900e1555 perf symbols: Bounds-check .gnu_debuglink section data
4f883ab5bc7b perf symbols: Fix signed overflow in sysfs__read_build_id() size check
490473192ac2 tools lib api: Fix missing null termination in filename__read_int/ull()
09962b811ef1 perf pmu: Fix perf_pmu__parse_scale/unit() OOB access on empty sysfs file
a6eec54329b4 perf pmu: Fix pmu_id() heap underwrite on empty identifier file
e274dfa05904 perf cs-etm: Queue context packets for frontend
fa9eb50ddfea perf s390: Fix TEXTREL in Python extension by compiling as PIC
b5a0a4a564d2 xprtrdma: Return sendctx slot after Send preparation failure
007b4da2f38d xprtrdma: Repost Receive buffers for malformed replies
469b22376ee7 xprtrdma: Sanitize the reply credit grant after parsing
d7a2870dde3b xprtrdma: Fix bcall rep leak and unbounded peek
345652531400 xprtrdma: Resize reply buffers before reposting receives
47b3dc59e09e xprtrdma: Document and assert reply-handler invariants
7471e66373a4 xprtrdma: Check frwr_wp_create() during connect
28743571c17b xprtrdma: Initialize re_id before removal registration
d0479c2b1297 xprtrdma: Fix ep kref imbalance on ADDR_CHANGE
6d52921f4702 perf hists: Fix snprintf() in hists__scnprintf_title() UID filter path
56ad33189ed5 perf bpf: Use scnprintf() in snprintf_hex() and synthesize_bpf_prog_name()
c32fe40b0c74 perf sched: Fix idle-hist callchain display using wrong rb_first variant
77051ef66e4a perf sched: Bounds-check prio before test_bit() in timehist
2e0dd50e5a4d PCI: rcar-host: Remove unused LIST_HEAD(res)
b9e8406651dc perf tools: Use perf_env__get_cpu_topology() in machine__resolve()
504028f561b1 perf tools: Use scnprintf() in cpu_map__snprint() to prevent overflow
2a8244988316 perf tools: Fix get_max_num() size_t underflow on empty sysfs file
3f4476a089a6 platform/x86/intel/vsec: Restore BAR fallback for header walk
d6565e08166c platform/x86/intel/vsec: Return real error codes from registration path
4df30a4dc0e9 platform/x86/intel/vsec: Switch exported helpers from pci_dev to device
817ab332d37c platform/x86/intel/vsec: Decouple add/link helpers from PCI
e6523bcafeb6 platform/x86/intel/vsec: correct kernel-doc comments
c0d97519c9df platform/x86:intel/pmc: Relocate lpm_req_guid to pmc_reg_map
b95e1facc5b7 platform/x86:intel/pmc: Rename PMC index variable to pmc_idx
3e86797c0699 platform/x86:intel/pmc: Add support for multiple DMU GUIDs
4f129fc6f756 fs/ntfs3: resize log->one_page_buf when adopting on-disk page size
d3491b23bc20 PCI: meson: Add missing remove callback
a5c0ba31eef9 PCI: meson: Propagate devm_add_action_or_reset() failure
f0aaa198e068 pwm: rzg2l-gpt: Add missing newlines to dev_err_probe() messages
a57692ad365f PCI: mediatek: Fix operator precedence in PCIE_FTS_NUM_L0 macro
f161ef7b0dd2 nfs: use nfsi->rwsem to protect traversal of the file lock list
a6f147b23e36 NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS in pg_get_mirror_count_write
a70375f0b793 NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS on fatal DS connect errors
b694c7de94bc nfs: keep PG_UPTODATE clear after read errors in page groups
f84949dd1784 NFSv4/pnfs: defer return_range callbacks until after inode unlock
53442c7d0c88 xprtrdma: Decouple req recycling from RPC completion
becc90a04780 xprtrdma: Use sendctx DMA state for Send signaling
e7ae0883c8c8 xprtrdma: Post receive buffers after RPC completion
f043dd58fbd7 xprtrdma: Close lost-wakeup race in xprt_rdma_alloc_slot
b7bc8e7f09ae xprtrdma: Avoid 250 ms delay on backlog wakeup
44b73b4b7eff pNFS/filelayout: fix cheking if a layout is striped
f3f21b94cf98 sunrpc: Fix error handling in rpc_sysfs_xprt_switch_add_xprt_store()
e8dc126e8039 clk: qcom: a53: Corrected frequency multiplier for 1152MHz
c0e6bb2b0408 dmaengine: dma-axi-dmac: use DMA pool to manange DMA descriptor
9f1ef67c041e dmaengine: dma-axi-dmac: Properly free struct axi_dmac_desc
329ec20a8609 dmaengine: Fix possible use after free
7d49f0ddaf5a dmaengine: qcom: gpi: set DMA_PRIVATE capability
8e2c460a8f0e mshv: add bounds check on vp_index in mshv_intercept_isr()
eaf937b501fd clk: qcom: camcc-x1e80100: Add support for camera QDSS debug clocks
032692e4525a dt-bindings: clock: qcom: Add X1P42100 camera clock controller
c7c8bab87d0d perf tools: Fix int16_t truncation of max_cpu_num in set_max_cpu_num()
e16012f8f63d perf timechart: Fix cpu2y() OOB read on untrusted CPU index
330219fe8523 perf c2c: Fix use-after-free in he__get_c2c_hists() error path
01564c1a260f perf stat: Introduce perf_env__get_cpu_topology() to guard NULL env->cpu
c05ba5b57505 perf mmap: Fix NULL deref in aio cleanup on alloc failure
c4406dbe5d8f perf sched: Replace BUG_ON and add NULL checks in replay event helpers
b1f768363271 perf sched: Use thread__put() in free_idle_threads()
1517402d0a81 perf sched: Clean up idle_threads entry on init failure
d6b586bb8f48 perf c2c: Bounds-check CPU IDs in setup_nodes() topology loop
2f9f7224e769 perf c2c: Bounds-check CPU and node IDs before bitmap and array access
278e30717c35 perf stat: Bounds-check CPU index in topology aggregation callbacks
21a9b87ada08 perf mmap: Guard cpu__get_node() return in aio_bind()
652cea73b7b7 perf sched: Fix register_pid() overflow, strcpy, and BUG_ON
068e9b6a07bc perf sched: Cap max_cpu at MAX_CPUS in timehist sample processing
1d25a8418c89 perf tools: Add bounds check to cpu__get_node()
89489a31f444 perf sched: Fix thread reference leak in latency_switch_event
ea486d61b166 perf tools: Guard test_bit from out-of-bounds sample CPU
18961e0f8966 perf annotate: Fix crashes on empty annotate windows
93f3e84fc74e perf: Fix off-by-one stack buffer overflow in kallsyms__parse()
d78b16d07814 dt-bindings: dma: nvidia,tegra186-gpc-dma: Make reset optional
a498063f95bd dmaengine: imx-sdma: Refine spba bus searching in probe
da4058382315 thunderbolt: debugfs: Fix margining error counter buffer leak
038a0f01dda5 drm/amd/display: Add missing kdoc for ALLM parameters
c5388a957cf1 fs/ntfs3: fix mount failure on 64K page-size kernels
a31893206588 fs/ntfs3: add bounds check to run_get_highest_vcn()
097fcf945d93 HID: logitech-hidpp: remove excess kernel-doc member in hidpp_scroll_counter
26fa946925a0 clk: at91: keep securam node alive while mapping it
0147c544cbc6 iio: tcs3472: power down chip on probe failure
1cddef80a180 iio: accel: mma8452: handle I2C read error(s) in mma8452_read()
9ac3675bf875 iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling
3d5767211952 iio: magnetometer: ak8975: fix potential kernel stack memory leak
6ec473b36034 iio: light: si1133: prevent race condition on timeout
f835b69fbeae iio: light: si1133: reset counter to prevent race condition
fd6b65ade119 perf header: Sanity check HEADER_EVENT_DESC attr.size before swap
be62602fe079 PCI: qcom: Disable ASPM L0s for SA8775P
de93ef83f99e powerpc tools perf: Initialize error code in auxtrace_record_init function
96c8f732cadf clk: renesas: rzg2l: Rename iterator in for_each_mod_clock() to avoid shadowing
fdee9f207a48 gpib: fix double decrement of descriptor_busy in command_ioctl()
3d5e4cc0d9dc char: tlclk: fix use-after-free in tlclk_cleanup()
d72ece584c44 gpib: Fix inappropriate ioctl error return
92f8b1d83383 perf test amd ibs: Fix incorrect kernel version check
2b2b1613b734 usb: host: max3421: Reject hub port requests for non-existent ports
02d03c61e8a7 usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control()
43078449ad62 staging: most: video: avoid double free on video register failure
45652323ce74 perf inject: Add --convert-callchain option
28ebd287a7fa perf build-id: Fix off-by-one bug when printing kernel/module build-id
fc5ce5606db5 PCI: dwc: Fix signedness bug in fault injection test code
7d881615fb63 mailbox: mtk-adsp: fix UAF during device teardown
91353d63bbf6 mailbox: mpfs: fix check for syscon presence in mpfs_mbox_inbox_isr()
e6bc4e127707 coresight: Fix source not disabled on idr_alloc_u32 failure
67d0475e78b3 soundwire: intel_ace2x: release bpt_stream when close it
5732869c70d4 clk: at91: sam9x7: Fix gmac_gclk clock definition
f28906e7e32f perf pmu: Skip test on Arm64 when #slots is zero
210c202c0576 phy: phy-can-transceiver: Check driver match and driver data against NULL
226feccaac81 clk: qcom: cmnpll: Account for reference clock divider
6abdf27fbcfb coresight: fix missing error code when trace ID is invalid
5bb87456dcd6 bus: mhi: ep: Fix potential deadlock in mhi_ep_reset_worker()
601a9b2e3b2f rust: alloc: fix assert in Vec::reserve doc test
b773c7161cea PCI: loongson: Do not ignore downstream devices on external bridges
e1b79f77336d perf sched: Add missing mmap2 handler in timehist
c788955b4a14 platform/x86: xo15-ebook: Fix wakeup source and GPE handling
2ce4d93768d2 x86/platform/olpc: xo15: Drop wakeup source on driver removal
1d495446ec7a PCI: Check ROM header and data structure addr before accessing
78f264c0cb2a PCI: Introduce named defines for PCI ROM
10021c2d3306 PCI/ASPM: Don't reconfigure ASPM entering low-power state
48dde5c56426 coresight: etm4x: Correct TRCVMIDCCTLR1 save and restore
65d87f28daec coresight: ete: Always save state on power down
1ac8f4c112aa coresight: etm4x: Remove the state_needs_restore flag
a454f61747c9 soundwire: fix bug in sdw_add_element_group_count found by syzkaller
d3896c944338 soundwire: don't program SDW_SCP_BUSCLOCK_SCALE on a unattached Peripheral
c3ca7c6741af coresight: cti: Fix DT filter signals silently ignored
fb940466fd4d perf debuginfo: Fix libdw API contract violations
bb3d592c7d6c staging: nvec: fix use-after-free in nvec_rx_completed()
466c7f87de52 i3c: master: svc: Fix missed IBI after false SLVSTART on NPCM845
db2d8b6525bd gpiolib: acpi: Only trigger ActiveBoth interrupts on boot
02e2dadd62ea eventpoll: Fix epoll_wait() report false negative
f938bc8fde51 eventpoll: rename epi->next and txlist for clarity
430dac191905 eventpoll: wrap EP_UNACTIVE_PTR in typed sentinel helpers
d8f88803152f eventpoll: extract ep_deliver_event() from ep_send_events()
4fd51f413d7b eventpoll: split ep_insert() into alloc + register stages
25e85dc040a6 eventpoll: rename attach_epitem() to ep_attach_file()
baebd892f8a2 eventpoll: expand top-of-file overview / locking doc
f04166c8677a eventpoll: rename ep_remove_safe() back to ep_remove()
13bf9879b778 net/9p: fix race condition on rdma->state in trans_rdma.c
9c1c120471a6 9p: avoid returning ERR_PTR(0) from mkdir operations
ae1f3460833d ocfs2: fix circular locking dependency in ocfs2_dio_end_io_write
d35e4032f16d mfd: cs42l43: Sanity check firmware size
706fe1ce4f3a mfd: rsmu: Fix page register setup
35d3d6ff2bc1 ksmbd: fix use-after-free in same_client_has_lease()
aa0c43c13c0b RDMA/bnxt_re: Fail DBR related page allocation UAPIs if the feature is disabled
0fe155aa844e RDMA/bnxt_re: Move the UAPI methods to a dedicated file
95d46a8d3ba9 RDMA/bnxt_re: Avoid displaying the kernel pointer
104a7ff382a5 RDMA/bnxt_re: Free SRQ toggle page after firmware teardown
5a48dd5150d7 ionic: Fix check in ionic_get_link_ext_stats
4c55003566c0 net: ethernet: oa_tc6: Remove FCS size in RX frame
93e133b9193c net: airoha: Fix always-true condition in PPE1 queue reservation loop
d774cdbda663 tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF)
0d8a12d71431 tipc: fix UAF in tipc_l2_send_msg()
db1616263a2c KEYS: Use acquire when reading state in keyring search
66919a6d72b9 powerpc/kexec: fix double get_cpu() imbalance in kexec_prepare_cpus
527cd14a416f powerpc/powernv: fix preempt count leak in pnv_kexec_wait_secondaries_down
73711688479d powerpc/perf: fix preempt count underflow in fsl_emb_pmu_del
92f38fe85198 MIPS: mm: Fix out-of-bounds write in maar_res_walk()
fe09dd288722 bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check
81567d2b3f4d sockmap: Fix use-after-free in udp_bpf_recvmsg()
073d95725269 net: remove addr_len argument of recvmsg() handlers
4e40056bb5c8 bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data()
264d6a79c96e udf: fix nls leak on udf_fill_super() failure
5e8627b7a7b7 bpf: Fix bpf_get/setsockopt to tos for ipv4-mapped ipv6 socket
e80307776924 selftests/bpf: Initialize operation name before use
9f32d4c2de85 selftests/bpf: Fix typo in verify_umulti_link_info
74badb5e2b00 smb/client: always return a value for FS_IOC_GETFLAGS
21303c4a2b72 cifs: remove all cifs files before kill super
7a59146cb9ad ALSA: core: Fix unintuitive behavior of snd_power_ref_and_wait()
87d1eaffeec4 netfilter: nf_conncount: callers must hold rcu read lock
98a965cb1e76 ALSA: seq: avoid stale FIFO cells during resize
287d506d4e08 ALSA: seq: oss: Serialize readq reset state with q->lock
f01fb6138f8e kcm: use WRITE_ONCE() when changing lower socket callbacks
4d48c08a0bf6 net: airoha: Fix debugfs new-tuple display for IPv4 ROUTE entries
dcac6e4221f3 net: airoha: Fix register index for Tx-fwd counter configuration
36edab340a06 net: bcmgenet: Use weighted round-robin TX DMA arbitration
b91b241a4eef landlock: Fix unmarked concurrent access to socket family
1bb02353e79f dpll: balance create/delete notifications in _dpll_pin(un)register
77a1ea975c87 dpll: guard sync-pair removal on full pin unregister
8008ef973f01 dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister()
6564ce3a2f9c dpll: send delete notification before unregister in on-pin rollback
f1e1c6eb8248 dpll: fix stale iteration in dpll_pin_on_pin_unregister()
20575400fc1b dpll: Enhance and consolidate reference counting logic
ebe4bd3560a7 dpll: Support dynamic pin index allocation
f7aebaee2961 net: wwan: t7xx: check skb_clone in control TX
34bd255dba32 net: ethernet: mtk_wed: debugfs: correct index in wed_amsdu_show()
1d072cc3ba43 octeontx2-af: npc: Fix size of entry2cntr_map
417bd36a085d bpf: Fix setting retval to -EPERM for cgroup hooks not returning errno
3d90b15fb191 net/mlx5: Check max_macs devlink param value against max capability
8d5f4be13488 bpf: Run generic devmap egress prog on private skb
450e48271827 net/sched: sch_dualpi2: Add missing module alias
6d585d0dc674 net: ethernet: mtk_wed: fix loading WO firmware for MT7986
446fe8ce699c net: watchdog: fix refcount tracking races
697db22a9dcc net: mana: guard TX wq object destroy with INVALID_MANA_HANDLE check
62ce489acb42 net: mana: initialize gdma queue id to INVALID_QUEUE_ID
bd851b10daee net/sched: sch_dualpi2: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen
755108bb7a50 net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen
0500af8630c3 net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen
a05d638b6074 virtio_net: do not allow tunnel csum offload for non GSO packets
ce311bd2e365 tcp: clear sock_ops cb flags before force-closing a child socket
67cec2f1eb9e handshake: Require admin permission for DONE command
d0503357653e power: supply: core: fix supplied_from allocations
7f4aa81f5bb2 ASoC: adau1372: Clear PLL_EN on failed PLL lock without reset GPIO
0c22c0092435 iommu: Avoid copying the user array twice in the full-array copy helper
1c9246a199e1 spi: xilinx: use FIFO occupancy register to determine buffer size
dae23c545eb5 ALSA: seq: Fix kernel heap address leak in bounce_error_event()
1749fef4bda0 ALSA: usb-audio: qcom: Guard sideband endpoint removal
2ba237315193 crypto: rng - Free default RNG on module exit
fb4d57b83356 crypto: cavium/cpt - fix DMA cleanup using wrong loop index
5f99a396f706 crypto: marvell/octeontx - fix DMA cleanup using wrong loop index
4941205f5fa3 cxl/test: Add check after kzalloc() memory in alloc_mock_res()
a27481516d32 cxl/test: Unregister cxl_acpi in cxl_test_init() error path
7e401233f9bb tipc: reject inverted service ranges from peer bindings
3cfa3d8e0dc1 tipc: prevent snt_unacked underflow on CONN_ACK
cebaefe1aceb tipc: require net admin for TIPCv2 netlink mutators
66dbb13eeb2f net/sched: sch_hfsc: Don't make class passive twice
51a1d9836acc net: pfcp: allocate per-cpu tstats for PFCP netdevs
ed8605c6f39b sctp: validate embedded address parameter length
a090880c1f54 bridge: cfm: reject invalid CCM interval at configuration time
bb4a5b3c91af net: fib_rules: Don't dump dying fib_rule in fib_rules_dump().
0a8b5b74f0e6 net/sched: cls_flow: Dont expose folded kernel pointers
10e05634ddc1 net: dsa: qca8k: fix led devicename when using external mdio bus
e098c9c6477d ASoC: tegra: tegra210_ahub: Validate written enum value
0f1510e84d7b ASoC: fsl: fsl_audmix: Validate written enum values
9131e4b023e0 ASoC: codecs: hdac_hdmi: Validate written enum value
cb527e063a32 ASoC: SOF: Intel: hda-sdw-bpt: select SND_SOF_SOF_HDA_SDW_BPT properly
d3ff718c0c71 RDMA/mlx5: Release the HWâ€‘provided UAR index rather than the SW one
4b87a2497276 RDMA/mlx5: Fix undefined shift of user RQ WQE size
1bc1487f7a7f RDMA/mlx5: Remove raw RSS QP restrack tracking
f704db4b0318 RDMA/mlx5: Remove DCT restrack tracking
3a1687e0506b fs: efs: remove unneeded debug prints
7e694ac97591 Bluetooth: vhci: validate devcoredump state before side effects
ec4d352747a6 Bluetooth: hci: validate codec capability element length
7f206a8d8d82 Bluetooth: btmtk: fix URB leak in alloc_mtk_intr_urb error path
a0fd1086a57b Bluetooth: hci_core: Fix UAF in hci_unregister_dev()
e8815ae9dcdc Bluetooth: hci_event: fix simultaneous discovery stuck in FINDING
f1b4df9c260c Bluetooth: eir: Fix stack OOB write when prepending the Flags AD
e284bb94ad45 Bluetooth: hci_qca: fix NULL pointer dereference in qca_dmp_hdr() for non-serdev device
c86c861c64b5 s390/process: Fix kernel thread function pointer type
0eab19ab9cb1 ASoC: cs35l56: Fix possible uninitialized value in cs35l56_spi_system_reset()
c83255f3cf22 arm64: dts: allwinner: a523: Add missing GPIO interrupt
ad6963c3bb45 pinctrl: airoha: an7581: fix misprint in gpio19 pinconf
5985ddfd3e83 pinctrl: airoha: an7581: add missed gpio32 pin group
db3cd694ded4 pinctrl: airoha: generalize pins/group/function/confs handling
0234e8fc296e pinctrl: sunxi: a523: Remove unneeded IRQ remuxing flag
46fbafe3d2d5 bpf: Tighten cgroup storage cookie checks for prog arrays
d416dcefdbac vfio/qat: fix f_pos race in qat_vf_resume_write()
1201dbb26050 of: cpu: add check in __of_find_n_match_cpu_property()
d2acea4f4747 cxl/test: Zero out LSA backing memory to avoid leaking to user
42a9a76f314e cxl/test: Fix integer overflow in mock LSA bounds checks
91ad3088ee1b selftests/bpf: Fix bpf_iter/task_vma test
f00f5c0dd553 ext4: fix kernel BUG in ext4_write_inline_data_end
c998a09c7144 bonding: 3ad: fix mux port state on oper down
f0ada4846d11 bonding: 3ad: fix carrier when no usable slaves
cb20a9b50efe bonding: 3ad: add lacp_strict configuration knob
47636f0a70b3 netlink: specs: rt-link: missed broadcast-neigh
6b2c271d2c39 tools: missed broadcast_neigh if_link uapi header
484b3b9aa798 ext4: fix ERR_PTR(0) in ext4_mkdir()
88cb304c0be0 ASoC: cs35l56: Don't leave parent IRQ disabled if system_suspend fails
8b55e7ec116c ASoC: cs35l56: Fix missing calls to wm_adsp2_remove()
3ef0cfa77a3d vdpa/octeon_ep: fix IRQ-to-ring mapping in interrupt handler
54556d539438 vdpa/octeon_ep: Fix PF->VF mailbox data address calculation
86e0b37738de tools/virtio: check mmap return value in vringh_test
321c73baf54d vhost/net: complete zerocopy ubufs only once
646614dcb160 vduse: Requeue failed read to send_list head
f9d922023445 virtio_console: read size from config space during device init
79366023aa89 virtio: rtc: tear down old virtqueues before restore
1f5f94c6c6b2 vhost/vdpa: validate virtqueue index in mmap and fault paths
a2d0a57538fd vduse: hold vduse_lock across IDR lookup in open path
3d56f3fb201f ASoC: codecs: aw88261: fix incorrect masks for boost regs
ecb9be4fc8be spi: meson-spifc: fix runtime PM leak on remove
da6f86ff4f2d NFSD: Handle layout stid in nfsd4_drop_revoked_stid()
37e85be551c4 IB/mlx4: Fill in the access_flags if IB_MR_REREG_ACCESS is not specified
e6d83f877d5a ASoC: sma1307: Fix uevent string leaks in fault worker
701ea71c17c9 igc: skip RX timestamp header for frame preemption verification
2aa37c8ef109 btrfs: fix deadlock cloning inline extent when using flushoncommit
f85410ebf20b btrfs: annotate lockless read of defrag_bytes in should_nocow()
18285888cb41 btrfs: zoned: always set max_active_zones for zoned devices
943f5917c53c Revert "btrfs: fix the file offset calculation inside btrfs_decompress_buf2page()"
ba641829c11c btrfs: zoned: don't account data relocation space-info in statfs free space
bd5e90b0f5a0 hwmon: (it87) Clamp negative values to zero in set_fan()
ebb579c5c0f0 vfs: add FS_USERNS_DELEGATABLE flag and set it for NFS
de590cdf7efe fbdev: sm501fb: Fix buffer errors in OF binding code
0678fed27def wifi: ath12k: enable IEEE80211_VHT_EXT_NSS_BW_CAPABLE when NSS ratio is reported
47e5302722e0 gpio: mt7621: fix interrupt banks mapping on gpio chips
90a9c909c5b7 ALSA: aloop: Drop superfluous break
3b15d02be05e btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs()
7ec839c7c0bc wifi: mt76: mt7996: fix potential tx_retries underflow
ad12fdaaed16 wifi: mt76: mt7925: fix potential tx_retries underflow
3b6e6fefa57f wifi: mt76: mt7921: fix potential tx_retries underflow
6b8e35685c18 wifi: mt76: mt7915: fix potential tx_retries underflow
6356a829a1ed wifi: mt76: fix argument to ieee80211_is_first_frag()
42f34c478fcd wifi: mt76: mt7996: limit work in set_bitrate_mask
1a399103cacc wifi: mt76: mt7996: fix reading zeroed info->control.flags after mt76_tx_status_skb_add()
dfb27e5dd9e4 wifi: mt76: mt7996: Fix possible NULL pointer dereference in mt7996_mac_write_txwi_80211()
06e65d6cf804 wifi: mt76: mt7996: Fix possible token leak in mt7996_tx_prepare_skb()
c386e90a7ce8 wifi: mt76: mt7925: validate skb length in testmode query
856fa6a21586 wifi: mt76: mt792x: skip MLD header rewrite for 802.3 encap TX
a10e4959a73b wifi: mt76: mt7925: keep TX BA state in the primary WCID
b8bf7c221b36 wifi: mt76: mt7925: fix stale pointer comparisons in change_vif_links
bd3b91ff1300 wifi: mt76: mt7996: add missing max_remain_on_channel_duration
c7a83899203e wifi: mt76: use kfree_rcu for offchannel link in mt76_put_vif_phy_link
3f0ea6d14fa4 wifi: mt76: mt7925: clean up DMA on probe failure
ce9d5a021cfc ARM: configs: Drop duplicated CONFIG_EXT4_FS
c788617705c3 sched/fair: Fix cpu_util runnable_avg arithmetic
a2e8b5264f92 hwspinlock: qcom: avoid uninitialized struct members
bbd664b7c77f vmalloc: fix NULL pointer dereference in is_vm_area_hugepages()
648a3960e366 pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins 34-39
44cff0737127 pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39
f775e7bda9a4 scsi: target: Remove tcm_loop target reset handling
c2bd9fdb448d scsi: target: Fix hexadecimal CHAP_I handling
0404baeb9e43 pinctrl: qcom: Fix resolving register base address from device node
298821692d44 watchdog: unregister PM notifier on watchdog unregister
637ef4961470 configfs: fix lockless traversals of ->s_children
f25d6e4ec4c2 firmware_loader: Fix recursive lock in device_cache_fw_images()
9e82497138ab ASoC: amd: acp-sdw-sof: Bound DAI link iteration
1279bdab5fa1 ASoC: amd: acp-sdw-legacy: Bound DAI link iteration
e8d89baf9217 spi: ep93xx: fix double-free of zeropage on DMA setup failure
e123f0ab02d0 IB/mlx5: Don't mangle the mr->pd inside the rereg callback
fd284b12810e IB/mlx5: Pull the pdn out of the depths of the umr machinery
8119fe468b01 IB/mlx5: Remove unused mkc bits in mlx5r_umr_update_mr_page_shift()
d4f84bfa089f IB/mlx5: Properly support implicit ODP rereg_mr
f5657d399b7e IB/mlx5: Don't take the rereg_mr fallback without a new translation
c213b71a2d41 btrfs: don't force DIO writes to be serialized
920dcf1cb8da thermal: testing: reject missing command arguments
dde04550fd6f cpufreq: Documentation: fix conservative governor freq_step description
6cb635ad1006 ACPI: IPMI: Fix message kref handling on dead device
b7474f4432dd bpf: Fix NULL pointer dereference in bpf_task_from_vpid()
84932636d020 powerpc/8xx: implement get_direction() in cpm1
8daa1a64711e kunit:tool: Don't write to stdout when it should be disabled
8b0510cc3a4a bpf: Fix NMI/tracepoint re-entry deadlock on lru locks
74ac1ce1f4af ALSA: seq: Clear variable event pointer on read
c04e0cde2fa3 riscv: stacktrace: Remove bogus -0x4 offset in non-FP walk_stackframe
834d4cc067fa riscv: cpu_ops: Change return value type of cpu_is_stopped() to bool
4b2b6bc7f5eb ALSA: seq: Fix partial userptr event expansion
af8f0ea1f0a3 wifi: wcn36xx: fix OOB read from short trigger BA firmware response
f03782f7f41f wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication
1b5d8a248c3a wifi: wcn36xx: fix heap overflow from oversized firmware HAL response
495e7e832c67 bpf: Update transport_header when encapsulating UDP tunnel in lwt
efe57b72196a bpf: Check tail zero of bpf_prog_info
58513d6d1241 bpf: Check tail zero of bpf_map_info
2eb39de4962f bpf: Clear rb node linkage when freeing bpf_rb_root
f6183983ce1f RDMA/siw: Fix endpoint/socket association handling
04255bda8d79 arm64: dts: imx8mp-kontron: Fix GPIO for display power switch
e6ab22200e44 arm64: dts: tqma8mpql-mba8mpxl: configure sai clock in audio codec as well
f3ef944c5599 arm64: dts: lx2162a-clearfog: use rev2 SoC dtsi
b5087fc4ef1f arm64: dts: imx95: Correct PCIe outbound address space configuration
ab4b5a07e1c1 arm64: dts: imx8mp-kontron: Reduce EERAM SPI clock frequency
f9173e0fc026 RDMA/irdma: Initialize iwmr->access during MR registration
54cab78df037 RDMA/irdma: Fix OOB read during CQ MR registration
844a1ae78e22 ALSA: hda: fix Kconfig dependency of HD Audio PCI
47831b503ecb IB/cm: Fix av cm device leak on an error path in cm_init_av_by_path()
fe5414d6b399 RDMA/hfi1: Open-code rvt_set_ibdev_name()
77b4bfc1ce32 netfilter: conntrack: call nf_ct_gre_keymap_destroy() if master helper is pptp
d53eecbca16f netfilter: conntrack: revert ct extension genid infrastructure
e6665d36b37b x86/cpu: Remove obsolete aperfmperf_get_khz() declaration
dd0d22fdae4c ALSA: usb-audio: qcom: Initialize offload control return value
8ebc31b86dcc netfilter: synproxy: protect nf_ct_seqadj_init() with conntrack lock
5c9c67cf7a3d netfilter: synproxy: fix unaligned memory access in timestamp adjustment
b171119082ba netfilter: synproxy: adjust duplicate timestamp options
4dbb71c046f7 netfilter: synproxy: drop packets if timestamp adjustment fails
dce1e3cf735d netfilter: nfnetlink_cthelper: use {READ,WRITE}_ONCE for accessing helper flags
7b819a84f1d5 netfilter: nfnetlink_osf: fix mss parsing on big-endian architectures
c3ebf67cf8a9 ocfs2: fix race between ocfs2_control_install_private() and ocfs2_control_release()
a087b2d3411e ocfs2/dlm: require a ref for locking_state debugfs open
3fa7139b5f42 ocfs2: reject FITRIM ranges shorter than a cluster
0e389fc290c3 ocfs2: fix buffer head management in ocfs2_read_blocks()
3fe2d0d21c8a lib: kunit_iov_iter: repeatedly call alloc_pages_bulk()
bb44a7690a4d ocfs2: rebase copied fsdlm LVB pointers in locking_state
9af58d10d0d8 of: reserved_mem: avoid post-init UAF when alloc_reserved_mem_array() fails
9a030fcb4b19 drm/amdkfd: always resume_all after suspend_all
b8d15e85596a cxl/fwctl: Fix __fortify_panic
b64120d54278 xfrm: fix NAT-related field inheritance in SA migration
ac9e29b191a0 perf/x86/amd/uncore: Use Node ID to identify DF and UMC domains
58cbb1c2aadf perf/x86/intel/uncore: Fix discovery unit lookup for multi-die systems
4e18e9361aab perf/x86/amd/core: Always use the NMI latency mitigation
f5102e0fc3c6 iommu/vt-d: Fix RB-tree corruption in probe error path
7f229d27bf27 vhost: fix vhost_get_avail_idx for a non empty ring
73f9f54d7174 bpftool: Use libbpf error code for flow dissector query
4beed798daf4 drm/amdgpu: set sub_block_index for mca ras sub-blocks
e82d515092a0 ext4: fix fast commit wait/wake bit mapping on 64-bit
8cbd587e8cdb lockdep/selftests: Restore sched_rt_mutex state on PREEMPT_RT
8d5ed4810e47 lockdep/selftests: Restore migrate_disable() state on PREEMPT_RT
c3b073a209a9 configfs_lookup(): don't leave ->s_dentry dangling on failure
778bb4939d45 riscv: dts: sophgo: sg2042: use hex for CPU unit address
efe71fbced52 riscv: dts: sophgo: sg2044: use hex for CPU unit address
5a1168ba0a95 lib/test_meminit: use && for bools
377758884852 tick/sched: Fix TOCTOU in nohz idle time fetch
5cf2c85b1231 bpf: Reject exclusive maps for bpf_map_elem iterators
0830287cc6cb driver core: Use system_percpu_wq instead of system_wq
5e406928404d nvme: fix FDP fdpcidx bounds check
36bdda0c86d5 sched: restore timer_slack_ns when resetting RT policy on fork
ffa974b2f50a ext2: fix ignored return value of generic_write_sync()
8d763babb2a2 mm/fake-numa: fix under-allocation detection in uniform split
61f197297282 bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs
d81370c6c4f5 scsi: ufs: Fix wrong value printed in unexpected UPIU response case
846052542cfa scsi: pm8001: Fix error code in non_fatal_log_show()
0de14eae6de8 libbpf: Skip max_entries override on signed loaders
abe383999640 libbpf: Skip initial_value override on signed loaders
b6862b6a25c6 libbpf: Reject non-exclusive metadata maps in the signed loader
3a0f73d27a8d bpf: Reject exclusive maps as inner maps in map-in-map
91ca9eab008b scsi: Revert "scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans"
5c53406098b5 nvdimm/btt: Handle preemption in BTT lane acquisition
d292b30e1b74 x86/cpu: Keep the PROCESSOR_SELECT menu together
901802925ebe ARM: imx31: Fix IIM mapping leak in revision check
617a5a67ce01 ata: libata: Fix ata_exec_internal()
cfcea221db93 wifi: ath12k: fix NULL deref in change_sta_links for unready link
eb9b89baf308 wifi: ath12k: fix incorrect HT/VHT/HE/EHT MCS reporting in monitor mode
adf0eb748d21 HID: wiimote: Fix table layout and whitespace errors
2d642797dd1c ARM: imx3: Fix CCM node reference leak
f0742d09eb6b NFSD: Fix delegation reference leak in nfsd4_revoke_states
9e565962d999 ASoC: rsnd: Fix RSND_SOC_MASK width to single nibble
8ec64276ecd2 spi: atmel: fix DMA channel and bounce buffer leaks
ab4d04bf8b2f ext4: fix LOGFLUSH shutdown ordering to allow ordered-mode data writeback
803087a16a4e libbpf: Skip endianness swap when loader generation failed
f3389fbaff1a libbpf: Skip hash computation when loader generation failed
a441c0794ac2 selftests/bpf: add verification for BPF_PROG_QUERY attr size boundaries
a7131340d0f9 bpf: fix BPF_PROG_QUERY OOB write and cgroup backward compat
5ac9e793ba25 raid1: fix nr_pending leak in REQ_ATOMIC bad-block error path
b7313f23ea5a md/raid10: reset read_slot when reusing r10bio for discard
e04e384274f8 rpmsg: use generic driver_override infrastructure
0e2f0833556c Drivers: hv: vmbus: use generic driver_override infrastructure
d2cf52ba2803 cdx: use generic driver_override infrastructure
b41923dbf676 amba: use generic driver_override infrastructure
ff4e38a37ba5 media: qcom: venus: relax encoder frame/blur step size on v6
bc7c166cc101 media: qcom: venus: relax encoder frame/blur dimension steps on v4
ffe754288750 media: qcom: venus: drop extra padding in NV12 raw size calculation
f8f48c851a0d Revert "media: venus: hfi_platform: Correct supported codecs for sc7280"

…

View originalPermalink

6.18.41-xanmod1

Jul 30, 2026 · 1 day ago

Changed 1

Expand timer_[re]arm() callbacks with a boolean return value in posix-timers

Fixed 1

Prevent UAF caused by non-leader exec() race in posix-cpu-timers

929ca27d531b Linux 6.18.41-xanmod1
1c784dbe2a35 Merge tag 'v6.18.41' into 6.18
2fe596715f84 Linux 6.18.41
6a7ecc25abe6 posix-cpu-timers: Prevent UAF caused by non-leader exec() race
9f7268928ac0 posix-timers: Expand timer_[re]arm() callbacks with a boolean return value

View originalPermalink

7.1.5-xanmod1

Jul 25, 2026 · 6 days ago

Added 1

Add cancel helper for async requests in firmware_loader

Changed 4

Update TCP 'bbr' congestion control module to BBRv3
Wait for pre-firmware load in usb: atm: ueagle-atm .disconnect()
Remove function entry/exit debug messages from usb: atm: ueagle-atm
Use dev_dbg() for 'device found' message in usb: atm: ueagle-atm

Fixed 14

Prevent UAF caused by non-leader exec() race in posix-cpu-timers
Fix Color Manager (3DLUT, Shaper, Blend) in drm/amd/display
Fix implicit declaration of brelse() in exfat
Validate session type before performing operation in liveupdate
Add newly added RTGs to the free pool in xfs growfs
Use opener credentials for FSCTL mutations in ksmbd
Fix path resolution in ksmbd_vfs_kern_path_create
Fix use-after-free in l2cap_sock_new_connection_cb() in Bluetooth L2CAP
Fix cyclic locking warning on netdev unregister in Bluetooth 6lowpan
Cache secctx size before release zeroes it in binder
Cancel async firmware request at unbind in ALSA: hda/tas2781
Update offsets for 2i2 Gen 4 firmware 2417 in ALSA: scarlett2
Fix stale or zero output when reading raw values in iio: hid-sensor-rotation
Fix listxattr handling of corrupted xattr entries in f2fs

Removed 1

Remove crypto_rng interface from crypto: xilinx-trng

2fb7a627a9c6 Linux 7.1.5-xanmod1
022aeb4a9152 tcp_bbr: v3: update TCP 'bbr' congestion control module to BBRv3 [v7.1.5+]
c50e105d5af1 Merge tag 'v7.1.5' into 7.1
8392dcae53e5 Revert "tcp_bbr: v3: update TCP 'bbr' congestion control module to BBRv3"
155b42bec9cb Linux 7.1.5
872380f930c9 Revert "gpib: cb7210: Fix region leak when request_irq fails"
ad1cafa1bdaa posix-cpu-timers: Prevent UAF caused by non-leader exec() race
60325bf5e2c1 posix-timers: Expand timer_[re]arm() callbacks with a boolean return value
5638dbfe9cf1 drm/amd/display: Fix Color Manager (3DLUT, Shaper, Blend)
570967e9c615 iomap: consolidate bio submission
e2f0122bd566 exfat: fix implicit declaration of brelse()
8e4e884f1bef exfat: add data_start_bytes and exfat_cluster_to_phys_bytes() helper
390f1d72a478 exfat: add balloc parameter to exfat_map_cluster() for iomap support
69b31ef6f853 exfat: replace unsafe macros with static inline functions
9634db561e15 crypto: xilinx-trng - Remove crypto_rng interface
3dc8a46d08a8 liveupdate: validate session type before performing operation
ddcdac47e1f2 usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect()
53430a3768b5 usb: atm: ueagle-atm: remove function entry/exit debug messages
10cfea5091f0 usb: atm: ueagle-atm: use dev_dbg() for 'device found' message
28f19c97eab4 xfs: add newly added RTGs to the free pool in growfs
615104cd66f8 xfs: factor out a xfs_zone_mark_free helper
cfb2c6f71d61 ksmbd: use opener credentials for FSCTL mutations
cba4ee1092b3 smb: move compression definitions into common/fscc.h
98185b3025be ksmbd: fix path resolution in ksmbd_vfs_kern_path_create
733e76e74e40 Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()
a2a2f68c42e0 Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister
4257f45ee1fd binder: cache secctx size before release zeroes it
3f54f2310de0 binder: Use LIST_HEAD() to initialize on stack list head
da9e3be9cf31 ALSA: hda/tas2781: Cancel async firmware request at unbind
cd992747d717 firmware_loader: Add cancel helper for async requests
ac1328962db1 ALSA: scarlett2: Update offsets for 2i2 Gen 4 firmware 2417
53e3dcfa74b3 ALSA: scarlett2: Allow selecting config_set by firmware version
b80d60249686 iio: hid-sensor-rotation: Fix stale or zero output when reading raw values
3c0dbfecd859 f2fs: fix listxattr handling of corrupted xattr entries
aa807064473a f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs()
cf8b5937b7b2 f2fs: fix potential deadlock in f2fs_balance_fs()
c81e2af41de6 device property: initialize the remaining fields of fwnode_handle in fwnode_init()
db20589d7b24 samples/damon/mtier: fail early if address range parameters are invalid
810c9ae71dad mm/damon/core: trace esz at first setup
314bd592085c bpf: Reject negative const offsets for buffer pointers
a419421281fb mmc: sdhci-esdhc-imx: fix resume error handling
89b63cd133fe mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend
6355749aebf6 mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend
9bf4ee05a110 mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt
bb72b2398c05 mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore
24300decd8bd mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume
48188934d5d2 mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore
657e0acce5b8 mmc: sdhci-of-dwcmshc: check bus clock enable result in the probe() method
f59d0244d90b mmc: mmc_test: Fix __counted_by handling after kzalloc_flex() conversion
0e93010b52bb mmc: block: fix RPMB device unregister ordering
cb2031f8b226 mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout
791fc00d116e mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout
1773c6e292b0 mtd: rawnand: fsl_ifc: return errors for failed page reads
c2e1d3392956 mmc: vub300: defer reset until cmd_mutex is unlocked
09e044192a42 mtd: mchp23k256: use SPI match data for chip caps
9fc23fc52fc9 mtd: onenand: samsung: report DMA completion timeouts
0e65079d28e5 mtd: virt-concat: free duplicate generated name
6126e12bf8c8 wifi: mwifiex: fix permanently busy scans after multiple roam iterations
625fc704b19c wifi: mac80211: validate extension-frame layout before RX
179d9be632d8 wifi: mac80211: free ack status frame on TX header build failure
2b1589fd9a07 wifi: ieee80211: validate MLE common info length
3b0505e43da8 wifi: cfg80211: validate EHT MLE before MLD ID read
d5c234774a82 powerpc/uaccess: correct check for CONFIG_PPC_E500 in mask_user_address()
4efa313b1592 powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access()
d826d3e04c5b reset: sunxi: fix memory region leak on ioremap failure
68176d47421f reset: imx7: Correct polarity of MIPI CSI resets on i.MX8MQ
ad1e14710b36 ipvs: reload ip header after head reallocation
905d7a363ade ipvs: fix more places with wrong ipv6 transport offsets
47f0c7d856c6 memstick: ms_block: reject a card that reports too many blocks
492cf7778a55 macsec: fix promiscuity refcount leak in macsec_dev_open()
3cc37687227b llc: fix SAP refcount leak when creating incoming sockets
5c1e8f56d84c crypto: aes - Fix conditions for selecting MAC dependencies
f1ca750c0510 Bluetooth: btrtl: validate firmware patch bounds
1b41cbe05b18 net: openvswitch: reject oversized nested action attrs
b7f5bd59ed1c regulator: ltc3676: Fix incorrect IRQSTAT bit offsets
c8874e338d51 arch/riscv: vdso: remove CFI landing pad from rt_sigreturn
73a7bdf06dbd riscv: vdso: Do not use LTO for the vDSO
185bb156c427 wifi: brcmfmac: cyw: fix heap overflow on a short auth frame
a7584f261e64 wifi: mac80211: fix memory leak in ieee80211_register_hw()
564e3fce81eb wifi: mwifiex: fix roaming to different channel in host_mlme mode
56994852d704 wifi: rt2x00: avoid full teardown before work setup in probe
6eb4cf2fa899 net/mlx5: free mlx5_st_idx_data on final dealloc
0b24b11ecda4 powerpc/pseries: fix memory leak on krealloc failure in papr_init
cc5c99b606ff mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume
90dfffc360df selftests/landlock: Fix screwed up pointers in the scoped_signal_test
19a1785250c7 selftests/landlock: Skip scoped_signal subtest with MSG_OOB if not available
4907f4c2d98b pmdomain: imx: Fix i.MX8MP VC8000E power up sequence
331ee3bc4edf pmdomain: imx: Fix i.MX8MP power notifier
36c2d7728540 pmdomain: mediatek: Fix possible nullptr KP in HWV cleanup/on-check
4ba6d7166750 pmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI
c17f06d8a085 cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed
f45c8d3818da selftests/rseq: Fix a building error for riscv arch
28673209eeea s390/mm: Fix type mismatch in get_align_mask().
83fe36f81200 s390/diag: Add missing array_index_nospec() call to memtop_get_page_count()
dd0160a08423 tracing/osnoise: Call synchronize_rcu() when unregistering
d5b2752a17ef riscv: Prevent NULL pointer dereference in machine_kexec_prepare()
648d4317326e drbd: reject data replies with an out-of-range payload size
f713d7a7e0f2 ata: libata-core: Allow capacity transition to zero for locked drives
f723ea50a96d ata: libata-core: Skip HPA resize for locked drives
f7628eea9212 fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list
fa5c7c313018 fs/resctrl: Free mon_data structures on rdt_get_tree() failure
901a489d89ee cpu/hotplug: Fix NULL kobject warning in cpuhp_smt_enable()
c3f200efb454 arm64: smp: Fix hot-unplug tearing by forcing unregistration
f50d87f97527 amdkfd: properly free secondary context id
109241d98804 net: macb: drop in-flight Tx SKBs on close
94fe0ab01b48 dibs: loopback: validate offset and size in move_data()
c39087ad0b97 macsec: don't read an unset MAC header in macsec_encrypt()
6335ab62d5fc ipvs: reset full ip_vs_seq structs in ip_vs_conn_new
e5d0bb887166 ipvs: use parsed transport offset in SCTP state lookup
21a537606fe3 llc: fix SAP refcount leak in llc_ui_autobind()
680d9dcbf428 selftests: net: make busywait timeout clock portable
23d917acd9c9 octeontx2-pf: fix SQB pointer leak on init failure
d8b5b66388a5 mac802154: remove interfaces with RCU list deletion
ae5347f3db17 s390/monwriter: Reject buffer reuse with different data length
b321a046d771 irqchip/irq-riscv-imsic-early: Fix fwnode leak on state setup failure
23afc3786acf mm/compaction: handle free_pages_prepare() properly in compaction_free()
91b4d76dd07f riscv: probes: save original sp in rethook trampoline
b770fcfcdced hwmon: (asus_atk0110) Check package count before accessing element
3034e5d67ea6 net: ipa: fix SMEM state handle leaks in SMP2P init
77f0023f22f6 net: wwan: iosm: bound device offsets in the MUX downlink decoder
d43efd1b5d97 ata: libata-core: Reject an invalid concurrent positioning ranges count
7ba60286ed14 ata: pata_pxa: Fix DMA channel leak on probe error
299739909c48 ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD
ae0265f0a95a net/mlx5: HWS, fix matcher leak on resize target setup failure
e3d325c0bdb7 orangefs: keep the readdir entry size 64-bit in fill_from_part()
aac98ec816b0 tracing/probes: Fix double addition of offset for @+FOFFSET
4a97d08d4ace hwmon: (max1619) add missing 'select REGMAP' to Kconfig
6ee183d89261 fhandle: reject detached mounts in capable_wrt_mount()
2dcebbd1ad2e net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked
fffeb2ab5eeb net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked
b99e890e6b32 net: lan743x: Initialize eth_syslock spinlock before use
ca096be8de31 fsl/fman: Free init resources on KeyGen failure in fman_init()
7ee43ec8e677 hwmon: (occ) unregister sysfs devices outside occ lock
8519e89c7f4d ACPI: TAD: Check AC wake capability before enabling wakeup
4140c516473a net: liquidio: fix BAR resource leak on PF number failure
1f11a29a3c80 hwmon: (w83793) remove vrm sysfs file on probe failure
8a604fe15d03 hwmon: (w83627hf) remove VID sysfs files on error and remove
a3020a389cb1 rtc: mpfs: fix counter upload completion condition
a36b9528b071 fscrypt: Replace mk_users keyring with simple list
03f1725f91e8 rtc: renesas-rtca3: Fix PIE clear polling condition in alarm setup error path
356077547b1a bnx2x: fix potential memory leak in bnx2x_alloc_mem_bp()
0fd23994ec8c ipmi: fix refcount leak in i_ipmi_request()
a338ce41bc93 espintcp: use sk_msg_free_partial to fix partial send
7be349d4fcc5 ipmi: Fix user refcount underflow in event delivery
e483da960892 LoongArch: Fix missing dirty page tracking in {pte,pmd}_wrprotect()
7bcce38cbebd LoongArch: Fix nr passing in set_direct_map_valid_noflush()
c97d44a5bdf9 pwm: rzg2l-gpt: Fix period_ticks type from u32 to u64
c270eaa919f6 riscv: vdso: Always declare vdso_start symbols
fe08be92f2b6 KVM: arm64: Fix propagation of TLBI level in kvm_pgtable_stage2_relax_perms()
d1d73a3a37b7 netfilter: nfnetlink_cthelper: cap to maximum number of expectation per master on updates
835a2f9d9f17 drm/xe/userptr: Stub notifier_lock helpers when DRM_GPUSVM=n
1b31e160430c ACPICA: Define acpi_ut_safe_strncpy() as strscpy_pad() alias
227dd2eeab0f net/sched: sch_teql: move rcu_read_lock()/spin_lock() from _bh variants
fcc621f5b25d platform/x86/amd/pmc: Avoid logging "(null)" for DMI values
744da2443f40 netfilter: nfnetlink_cthelper: cap to maximum number of expectation per master
9a7f7b55d7d0 ksmbd: fix stack buffer overflow in multichannel session-key copy
59da37fee81a octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF
9f8e7f59b0c2 gve: fix header buffer corruption with header-split and HW-GRO
d8ce67fa6a5e ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit
7e3630fbb6aa ieee802154: ca8210: fix cas_ctl leak on spi_async failure
2953ec261bcf ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation
638324805895 ieee802154: admin-gate legacy LLSEC dump operations
d0c880c9f405 octeontx2-af: Free BPID bitmap on setup failure
d4bcc202a353 net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink
c38c8b0db3c6 net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink
d49edcc65e0a net: ipip: require CAP_NET_ADMIN in the device netns for changelink
88b33ee458a6 net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink
f97e93ebf2f9 net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink
11f68ebc6891 net: ena: clean up XDP TX queues when regular TX setup fails
6fed707239c4 selftests: net: fix file owner for broadcast_ether_dst test
f7f45ceb855d net/sched: act_ct: preserve tc_skb_cb across defragmentation
91850f582783 net: ixp4xx_hss: fix duplicate HDLC netdev allocation
0c0a8c782148 net: wwan: t7xx: destroy DMA pool on CLDMA late init failure
b3763f7e22ec net: ethernet: ti: icssg: guard PA stat lookups
99ae3248b33d net: sit: require CAP_NET_ADMIN in the device netns for changelink
f4170f45c251 gpios: palmas: add .get_direction() op
a60a40c9ba30 gpio: mt7621: avoid corruption of shared interrupt trigger state
b90f24527723 gpio-f7188x: Add support for NCT6126D version B
422a0567cd1b gpio: mt7621: be sure IRQ domain is created before exposing GPIO chips
628c63f96f45 gpio: tegra: do not call pinctrl for GPIO direction
e187f6fbc8d6 gpio: mt7621: more robust management of IRQ domain teardown
bc650dd5ce64 net: mana: Sync page pool RX frags for CPU
282c5214ca4e net: mana: Validate the packet length reported by the NIC
631d53102da9 cpu: hotplug: Bound hotplug states sysfs output
9f7dc355f62c cpu: hotplug: Preserve per instance callback errors
f563358661ea selftests/ftrace: Drop invalid top-level local in test_ownership
571e1f10b599 posix-cpu-timers: Use u64 multiplication in update_rlimit_cpu()
83f9fb561c1c locking/rt: Fix the incorrect RCU protection in rt_spin_unlock()
bcf7968cb97c wifi: libertas_tf: fix use-after-free in lbtf_free_adapter()
05b24f68f78f tracing/user_events: Fix use-after-free in user_event_mm_dup()
088873af1359 net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete
618cf6b13950 mmc: vub300: fix use-after-free on probe failure
f4cf878dcc4f Input: ims-pcu - fix type confusion in CDC union descriptor parsing
025955847e15 Input: ims-pcu - fix race condition in reset_device sysfs callback
bbbe31486cf2 Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing
f97bfc1a0766 Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging
e555f00621bd Input: ims-pcu - fix logic error in packet reset
47a9889a9325 Input: ims-pcu - fix firmware leak in async update
40693fcc88bc Input: ims-pcu - fix DMA mapping violation in line setup
f3c63aecca90 Input: ims-pcu - add response length checks
cbfa059dfb48 Input: ims-pcu - validate control endpoint type
8c3095c43291 Input: ims-pcu - release data interface on disconnect
73e6687be0c1 Input: ims-pcu - only expose sysfs attributes on control interface
bf0b58ba489d Input: ims-pcu - fix use-after-free and double-free in disconnect
7d330a1d6633 fs/resctrl: Fix use-after-free during unmount
94cbfed19124 scsi: elx: efct: Fix I/O leak on unsupported additional CDB
747eaead2db2 scsi: elx: efct: Fix refcount leak in efct_hw_io_abort()
ef2ee18fec92 scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE
555a89846ed8 scsi: target: Bound PR-OUT TransportID parsing to the received buffer
1e97c404e449 scsi: xen: scsiback: Free unsubmitted command instead of double-putting it
1357fb32d42a scsi: xen: scsiback: Free the command tag on the TMR submit-failure path
3cbabbf1722e scsi: sg: Report request-table problems when any status is set
0ce5a37f7ddf scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup()
782e1bf48672 scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path
6920e62be4c9 accel/ivpu: Reject firmware log with size smaller than header
216e43d93dd4 accel/amdxdna: Use caller client for debug BO sync
fff6509d976f accel/amdxdna: reject user command submission without a command BO
f7d08603c87b accel/amdxdna: reject command submission on devices without a submit op
5da885c39baa accel/amdxdna: Fix use-after-free in amdxdna_gem_dmabuf_mmap()
15ecfdf0ef6f dma-buf: dma-fence: Fix potential NULL pointer dereference
562d5e6f9b99 dma-fence: use correct callback in dma_fence_timeline_name()
e2d9a2ea178a dma-fence: Make dma_fence_dedup_array() robust against 0-count input
752e214b2c6f dm-verity: make error counter atomic
e96df7fdbec9 dm-verity: increase sprintf buffer size
81f41d989a32 dm-verity: fix a possible NULL pointer dereference
414650265267 dm-verity: avoid double increment of &use_bh_wq_enabled
f7990c2b0f08 dm-verity: fix buffer overflow in FEC calculation
829476c06496 dm-integrity: don't increment hash_offset twice
3d1afaa07462 dm-integrity: fix a bug if the bio is out of limits
8f0af8493009 dm-integrity: fix leaking uninitialized kernel memory
7d8ed7cb844d dm_early_create: fix freeing used table on dm_resume failure
f00105be6a59 dm: avoid leaking the caller's thread keyring via the table device file
750b23d4935b dm-stats: fix merge accounting
f3441b3bf519 dm-stats: fix dm_jiffies_to_msec64
0cbe13fe5403 dm-pcache: reject option groups without values
79feb87ab239 dm-log: fix a bitset_size overflow on 32bit machines
df50c24c6447 dm-ioctl: fix a possible overflow in list_version_get_info
53477ce5ef90 dm-bufio: fix wrong count calculation in dm_bufio_issue_discard
bafe3e720cda dm era: fix out-of-bounds memory access for non-zero start sector
9f1a0d27586c dm thin metadata: fix metadata snapshot consistency on commit failure
0562bd39d361 dm thin metadata: fix superblock refcount leak on snapshot shadow failure
17f113e7b622 net: sparx5: unregister blocking notifier on init failure
d4cc255f35d5 block: fix IORING_URING_CMD_REISSUE flags check in blkdev_uring_cmd
c0f10f43ffa5 block: fix race in blk_time_get_ns() returning 0
02f8ad12545c block: remove redundant GD_NEED_PART_SCAN in add_disk_final()
fe1d9121b4b7 selftests/bpf: Cover negative buffer pointer offsets
28ce7bcf8a29 bpf: Add missing access_ok call to copy_user_syms
43f0005f81b8 bpf,fork: wipe ->bpf_storage before bailouts that access it
5a55f9aecc08 bpf: Reset register bounds before narrowing retval range in check_mem_access()
0639ea767fe0 io_uring/bpf-ops: reject re-registration of an already-bound ops
04d23061bbf1 can: bcm: add missing device refcount for CAN filter removal
59bfddea6415 can: bcm: validate frame length in bcm_rx_setup() for RTR replies
b6317022b685 can: bcm: track a single source interface for ANYDEV timeout/throttle ops
b31d0933509c can: bcm: fix stale rx/tx ops after device removal
c312b750bb5a can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler()
df47f07cdc80 can: bcm: fix CAN frame rx/tx statistics
337f966c0066 can: bcm: extend bcm_tx_lock usage for data and timer updates
30f7bb922cb7 can: bcm: add missing rcu list annotations and operations
fc9f5ee1b073 can: bcm: add locking when updating filter and timer values
b9c6ac6fb4e0 can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure
ce2d4b121fb7 can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF
4f1fdf1a1c31 can: isotp: serialize TX state transitions under so->rx_lock
e442b62ba5a7 can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER
b8278ff60518 can: isotp: use unconditional synchronize_rcu() in isotp_release()
5832c55b3c82 can: esd_usb: kill anchored URBs before freeing netdevs
046380f3e111 ovl: use linked upper dentry in copy-up tmpfile
fd750b694f1f netdev-genl: report NAPI thread PID in the caller's pid namespace
fcef60ed5f71 nvmet: fix refcount leak in nvmet_sq_create()
98bcdfa61915 nvmet-rdma: handle inline data with a nonzero offset
bc111698b46e nvmet-auth: reject short AUTH_RECEIVE buffers
b7d9aaedf024 nvme-apple: Prevent shared tags across queues on Apple A11
a192b6c149c6 NFS: Charge unstable writes by request size, not folio size
bbd6b2ea966c sctp: validate STALE_COOKIE cause length before reading staleness
077a7bc1c32d spi: uniphier: Fix completion initialization order before devm_request_irq()
40dee2d3e999 spi: imx: reconfigure for PIO when DMA cannot be started
91376c61a5fd time: Fix off-by-one in compat settimeofday() usec validation
947b773caaa5 tpm: Make the TPM character devices non-seekable
98fa6e42fd51 tpm: fix event_size output in tpm1_binary_bios_measurements_show
3ba2b2ef7d6a xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink
b4e9dcf4143e xfrm: use compat translator only for u64 alignment mismatch
a8a7e6a9ff8a xfrm: nat_keepalive: avoid double free on send error
6883269a3236 xen/gntdev: fix error handling in ioctl
2510434307a2 ufs: core: tracing: Do not dereference pointers in TP_printk()
f48d3ae9d320 tcp: Decrement tcp_md5_needed static branch
da48b9bf1eb9 tcp: defer md5sig_info kfree past RCU grace period in tcp_connect
b7ef06d010c9 ice: fix ice_init_link() error return preventing probe
35176f104612 i2c: spacemit: fix spurious IRQ handling returning IRQ_HANDLED
fb267770bf82 i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource()
bbc08be46f00 i2c: mediatek: fix WRRD for SoCs without auto_restart option
56ddfc18ea8f i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ)
60ed00d46616 i2c: imx: fix locked bus on SMBus block-read of 0 (atomic)
c9a0f2bff2cb hwmon: (max6697) add missing 'select REGMAP_I2C' to Kconfig
b9f07a4ec6e3 hwmon: (ltc2992) add missing 'select REGMAP_I2C' to Kconfig
a0d8e415ebf3 ksmbd: fix integer overflow in set_file_allocation_info()
c32f565f3291 smb: client: use kvzalloc() for megabyte buffer in simple fallocate
0bf6482919b9 pkey: Move keytype check from pkey api to handler
301bb780d1b9 platform/x86/amd/pmc: Don't log during intermediate wakeups
d53314ae31fd platform/x86/amd/pmc: Add delay_suspend module parameter
675592e86e81 platform/x86/amd/pmc: Delay suspend for some Lenovo Laptops
3002e2dda621 platform/x86/amd/pmc: Check for intermediate wakeup in function
2a42f651cce9 platform/x86: ISST: Restore SST-PP control to all domains
14812174d720 platform/x86: hp-wmi: Add support for Omen 16-ap0xxx (8E35)
4676e81d55ab platform/x86: hp-wmi: Add support for Omen 16-ap0xxx (8D26)
b351e082711d platform/x86: dell-laptop: fix missing cleanups in init error path
2137f2154290 platform/x86/intel/tpmi: use cleanup helpers in mem_write()
07ae600bd353 dmaengine: sh: rz-dmac: Move interrupt request after everything is set up
044f7b3252d4 dmaengine: dw-edma-pcie: Reject devices without driver data
070b92cbb82a dmaengine: sh: rz-dmac: Fix incorrect NULL check for list_first_entry()
1553ca96e9df dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK
6e37e9e230c7 dmaengine: tegra: Fix burst size calculation
7d3ce3bd23c0 sunrpc: fix uninitialized xprt_create_args structure
493333f16792 tpm: tpm2-sessions: wait for async KPP completion in tpm_buf_append_salt
4bb3e1bc142d tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat()
711cbcb464d2 tpm: restore timeout for key creation commands
e5be5d452d5f irqchip/crossbar: Use correct index in crossbar_domain_free()
c267911b4226 taskstats: retain dead thread stats in TGID queries
f4599793240d mtd: maps: vmu-flash: fix NULL pointer dereference in initialization
57740658042d openrisc: Fix jump_label smp syncing
a145b47e22fd mtd: rawnand: Pause continuous reads at block boundaries
007e28b2916d mtd: spi-nor: spansion: use die erase for multi-die devices only
12d4d6922115 mtd: spi-nor: swp: Improve locking user experience
614aa0491c7a s390/pkey: Check length in pkey_pckmo handler implementation
7e7e03848c91 s390/pkey: Check length in PKEY_VERIFYPROTK ioctl
3da8eaf5469e fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header()
fe6b606fbf0c net: thunderbolt: Fix frags[] overflow by bounding frame_count
4f6542b14288 bus: mhi: ep: Protect mhi_ep_handle_syserr() in the error path
e0578493c950 bus: mhi: host: pci_generic: Fix the physical function check
f3df5386e3bb fpga: dfl: add bounds check in dfh_get_param_size()
3bfeb436d4be ocfs2: reject non-inline dinodes with i_size and zero i_clusters
60ceecda550e ocfs2: reject dinodes whose i_rdev disagrees with the file type
b858f2d57cfc ocfs2: reject dinodes with non-canonical i_mode type
63921f790234 ocfs2: add journal NULL check in ocfs2_checkpoint_inode()
858aa4965ffa ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2_sum_rightmost_rec
253ed993e0b3 ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits
4d1953d3aeb4 ocfs2: avoid moving extents to occupied clusters
8f575fc17360 mtd: rawnand: fix condition in 'nand_select_target()'
823886a1b089 net/9p: fix infinite loop in p9_client_rpc on fatal signal
3c44f6c62f65 mtd: rawnand: pl353: fix probe resource allocation
20869525a283 ocfs2: use kzalloc for quota recovery bitmap allocation
455519f6b70f mtd: maps: vmu-flash: fix fault in unaligned fixup
9f457beb601d openrisc: Add full instruction cache invalidate functions
c8f8e61332ba scsi: sas: Skip opt_sectors when DMA reports no real optimization hint
9fefab759f59 kho: make sure scratch size is always aligned by CMA_MIN_ALIGNMENT_BYTES
d52d4c9ac716 scsi: smartpqi: Use shost_to_hba() in pqi_scan_finished()
8c1b23d83008 power: supply: bq257xx: Fix VSYSMIN clamping logic
8faccac11e13 9p: skip nlink update in cacheless mode to fix WARN_ON
bdcdfc246465 mtd: slram: remove failed entries from the device list
3afd3929fbc7 kcov: use WRITE_ONCE() for selftest mode stores
b91e27bce37c mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE
1712a7fa1339 powerpc/dt_cpu_ftrs: Set CPU_FTR_P11_PVR for Power11 and later processors
8e7709aaed66 fs/proc: fix KPF_KSM reported for all anonymous pages
b09d5ad00338 proc: only bump parent nlink when registering directories
319caaca072a fs/proc/task_mmu: do not warn on seeing non-migration pmd entry
5ac8f1c56ba1 fs/proc/task_mmu: use huge_page_size() in pagemap_scan_hugetlb_entry()
18b8a9700610 fs/proc/task_mmu: fix hugetlb self-deadlock in pagemap_scan_pte_hole()
6b7f774b8882 fs/proc/task_mmu: fix make_uffd_wp_huge_pte() prot-update race
6b6b5d7c2c95 mm/damon/sysfs-schemes: put stats for scheme_add_dirs() internal error
ee59df7a886a mm/damon/sysfs-schemes: fix dir put orders in access_pattern_add_dirs()
837f619f1d98 mm/damon/core: always put unsuccessfully committed target pids
36e4843fe39e riscv: cacheinfo: Fix node reference leak in populate_cache_leaves
2611f7521c6c mm/huge_memory: preserve pmd_swp_uffd_wp on device-private PMD downgrade
a1dd41d00c57 mips: sched: Fix CPUMASK_OFFSTACK memory corruption
4d46e07b23d8 selftests/landlock: Test SCOPE_SIGNAL on the SIGIO/fowner pgid path
e8631b883338 power: supply: charger-manager: fix refcount leak in is_full_charged()
04916f7dc6d3 landlock: Fix LANDLOCK_SCOPE_SIGNAL bypass on the SIGIO path
7d7f72cb21a8 ntfs: fix hole runlist memory leak in insert range error path
b397b1238a21 ntfs: fix WARN_ON for resident attribute in ntfs_map_runlist_nolock()
8f313e92522a ntfs: make system files immutable to prevent corruption
5a5f877c5df7 ntfs: avoid self-deadlock during inode eviction
83f396d881c4 ntfs: sanitize MFT references returned from ntfs_lookup_inode_by_name()
d5379035355c ntfs: fail attrlist updates when the superblock is inactive
b3d09502b80d ntfs: fix mrec_lock ABBA deadlock in rename
a93980141253 ntfs3: fix out-of-bounds read in decompress_lznt
1758a564b6eb ntfs3: validate split-point offset in indx_insert_into_buffer
d240f5f9d036 ntfs3: bound to_move in indx_insert_into_root before hdr_insert_head
d313416280d4 ntfs3: cap RESTART_TABLE free-chain walker at rt->used
36feda687afe fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation}
fdf50c788e09 fs/ntfs3: add depth limit to indx_find_buffer to prevent stack overflow
32b9f8733feb fs/ntfs3: validate lcns_follow in log_replay conversion
a89c66674283 fs/ntfs3: bound attr_off in UpdateResidentValue against data_off
49c86dae0c0c fs/ntfs3: bound copy_lcns dp->page_lcns[] index in analysis pass
554700c65d39 fs/ntfs3: bound DeleteIndexEntryAllocation memmove length
007977325021 fs/ntfs3: fix syncing wrong inode on DIRSYNC cross-directory rename
b54c9beb90e5 ntfs: reject non-resident records for resident-only attributes
bfb01dd319b6 ntfs: validate resident index root values on lookup
18fe978d265b ntfs: validate resident volume name values on lookup
82510cb5c658 ntfs: do not replace volume name after lookup errors
7fb64788812d ntfs: detect mapping-pairs LCN accumulator overflow
e2b95d3adb55 ntfs: validate index entries on reading
40ee64e633e5 ntfs: avoid heap allocation for free-cluster readahead state
a9cafa8c780f ntfs: only alias volume $UpCase to default on exact match
d7773b7af1d2 ntfs: reinit search context before volume information lookup
f831ab09d521 ntfs: skip extent mft records in writeback to prevent deadlock
b06730c6af58 ntfs: centalize $INDEX_ROOT header validation
0527a81e85ee ntfs: update index root allocated size before shrink
aca3d383a23c ntfs: free volume-wide resources on fill_super failure
34a49b3e94a5 ntfs: validate index block header more strictly
ceb49c372501 ntfs: not change 0-byte $DATA attribute to non-resident
d9d9925de1d8 ntfs: add bounds check before accessing EA entries
e4c36dfac57a ntfs: validate attribute values on lookup
353a79fb76bf ntfs: Add WQ_PERCPU to alloc_workqueue users
bfe835e535fe ntfs: fix off-by-one in mapping pairs decoding bounds checks
7d702aee1589 ntfs: fix incorrect size of symbolic link
38d444271604 ntfs: grow index root value before reparent header update
57094929cf09 mm/damon/core: make charge_addr_from aware of end-address exclusivity
2f9e3ec17c3d mm/memory_hotplug: fix incorrect altmap passing in error path
b785f2bd9496 mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch
fc3f0eef426f power: supply: max17042: fix OF node reference imbalance
b56a5cbf8f1f power: supply: cpcap-battery: Fix missing nvmem_device_put() causing reference leak
b03e62112c9d mm/mm_init: fix pageblock migratetype for ZONE_DEVICE compound pages
3ae86630b94f MIPS: DEC: Ensure 32-bit stack location for o32 prom_printf()
35521e4ec762 MIPS: ip22-gio: fix device reference leak in probe
b04bbb89ca3a MIPS: ip22-gio: fix kfree() of static object
a018c9b8805c MIPS: ip22-gio: fix gio device memory leak
25bec992181d mm/sparse-vmemmap: fix vmemmap accounting underflow
f80fafe24f72 remoteproc: xlnx: Check remote core state
e5b1aaa74118 remoteproc: qcom: Fix leak when custom dump_segments addition fails
98414b42530a SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing
3a5c55a19cad lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure
3f2dc01b9cb5 lockd: Plug nlm_file leak when nlm_do_fopen() fails
31ba490c02d4 sunrpc: harden rq_procinfo lifecycle to prevent double-free
a4f878e8ecd7 sunrpc: wait for in-flight TLS handshake callback when cancel loses race
083e9c2ec7e8 sunrpc: pin svc_xprt across the asynchronous TLS handshake callback
c49df5f1e193 pinctrl: renesas: rzg2l: Use -ENOTSUPP instead of -EOPNOTSUPP
ba59b96d8d21 nvdimm/btt: Free arena sub-allocations on discover_arenas() error path
7e49684d90fa nvdimm/btt: Free arenas on btt_init() error paths
a58fc10adf50 jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit()
fc5eb0962a5e cxl: Fix CXL_HEADERLOG_SIZE to match RAS Capability size
0ec5c7f03ecf backlight: ktd2801: Enable BL_CORE_SUSPENDRESUME
089ea1e2faf4 mfd: tps6586x: Fix OF node refcount
da743704c647 cifs: invalidate cfid on unlink/rename/rmdir
6222b4436865 batman-adv: tt: prevent TVLV OOB check overflow
7d1a877670bc batman-adv: mcast: avoid OOB read of num_dests header
777a88256d6f batman-adv: frag: fix primary_if leak on failed linearization
5a82c5580988 batman-adv: clean untagged VLAN on netdev registration failure
080478388175 batman-adv: frag: free unfragmentable packet
ae8355b24abe batman-adv: fix VLAN priority offset
aba1cf21954e batman-adv: tt: avoid request storms during pending request
64fd0b0dbb52 batman-adv: dat: fix tie-break for candidate selection
dbeb4145d977 batman-adv: ensure minimal ethernet header on TX
4407ff3af469 batman-adv: dat: ensure accessible eth_hdr proto field
f4fb97ecf677 batman-adv: bla: reacquire gw address after skb realloc
059a70e1d12d batman-adv: dat: acquire ARP hw source only after skb realloc
9a7b72487981 batman-adv: access unicast_ttvn skb->data only after skb realloc
b031fc97e199 batman-adv: retrieve ethhdr after potential skb realloc on RX
916dac5f2944 batman-adv: gw: acquire ethernet header only after skb realloc
f79dff8c721b s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init()
cabcfbc069d8 cpufreq: intel_pstate: Set non-turbo capacity to HWP_GUARANTEED_PERF()
a18afd69408c cpufreq: schedutil: Fix uncleared need_freq_update on the .adjust_perf() path
fb3b76b5ad2e perf/x86/amd/lbr: Fix kernel address leakage
2e706be56f41 perf/x86/amd/brs: Fix kernel address leakage
64193ed819db x86/boot: Reject too long acpi_rsdp= values
4dad7e870c7e x86/boot: Validate console=uart8250 baud rate to fix early boot hang
e5158ff53fdf x86/virt/sev: Revert "Drop WBINVD before setting MSR_AMD64_SYSCFG_SNP_EN"
8a2a0b911cd6 x86/video: Only fall back to vga_default_device() without screen info
e8adac69d1bd tools/power/x86/intel-speed-select: Harden daemon pidfile open
2ff8156fd500 mfd: sm501: Fix reference leak on failed device registration
263ccdd627ca leds: uleds: Fix potential buffer overread
c9a691350e28 selinux: fix incorrect execmem checks on overlayfs
37d642b37ccd selinux: avoid sk_socket dereference in selinux_sctp_bind_connect()
646ebbc5f2ff selinux: check connect-related permissions on TCP Fast Open
fe11d6ce19b2 soc: fsl: qe: panic on ioremap() failure in qe_reset()
9b3325f5a9fb soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy
419d7d930649 gpu/buddy: bail out of try_harder when alignment cannot be honoured
8559b1501f77 gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path
392d033fd372 netfilter: flowtable: use correct direction to set up tunnel route
4ac981a8b7ce netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment()
ec88fa71c820 netfilter: xt_nat: reject unsupported target families
4301ae9ce3d4 netfilter: ecache: fix inverted time_after() check
b7a1626c28ba netfilter: xt_physdev: masks are not c-strings
6ff07ac5405b netfilter: nf_conncount: fix zone comparison in tuple dedup
0880c4ed122d netfilter: flowtable: support IPIP tunnel with direct xmit
ecb78fbb03d3 netfilter: flowtable: use dst in this direction when pushing IPIP header
00bdce2fda7e netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag
0e76e3e886cc netfilter: nf_nat_sip: reload possible stale data pointer
e74f9680e1b6 netfilter: nft_set_pipapo: don't leak bad clone into future transaction
b843a96252f6 netfilter: nf_conntrack_sip: validate skb_dst() before accessing it
f68305267ebd netfilter: nft_fib: reject fib expression on the netdev egress hook
47b3af24de5f netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst
5b2d4f001001 netfilter: xt_cluster: reject template conntracks in hash match
29e06c8f616c netfilter: nfnl_cthelper: apply per-class values when updating policies
eeef3b81f449 netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read
214af790e3a3 ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback
03009465312c ASoC: mediatek: mt8183: Release reserved memory on cleanup
80506fcac597 ASoC: mediatek: mt8183: Check runtime resume during probe
4c9df23e121f ASoC: mediatek: mt8192: Release reserved memory on cleanup
f6e424835cc0 ASoC: mediatek: mt8192: Check runtime resume during probe
2a591bf6fd41 ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control
f4933e1d11b9 ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get
6ed7787c43ec ASoC: SOF: topology: fix memory leak in snd_sof_load_topology
2efd9797331a fbdev: tridentfb: fix potential memory leak in trident_pci_probe()
ed3b3eb21244 fbdev: nvidia: fix potential memory leak in nvidiafb_probe()
7b96ce9f8e47 fbdev: vesafb: fix memory leak in vesafb_probe()
dae8f6ddc35c fbdev: carminefb: fix potential memory leak in alloc_carmine_fb()
2fd16a94bea5 fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe()
aa387a3e5180 fbdev: uvesafb: fix potential memory leak in uvesafb_probe()
56964e803915 fbdev: s3fb: fix potential memory leak in s3_pci_probe()
2ede8fa70823 fbdev: i740fb: fix potential memory leak in i740fb_probe()
1b1b43342fbf fbdev: radeon: fix potential memory leak in radeonfb_pci_register()
5276e3f75ddb fbdev: efifb: fix memory leak in efifb_probe()
f6a1ac55e6ca fbdev: sm712: Fix operator precedence in big_swap macro
9a94b8553185 fbdev: hecubafb: fix potential memory leak in hecubafb_probe()
e818c397548c fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe()
a889978ec44f fbdev: metronomefb: fix potential memory leak in metronomefb_probe()
bc00e0e376ee KVM: arm64: nv: Inject SEA if guest VNCR isn't normal memory
0a5dd8cf4d58 KVM: arm64: nv: Re-translate VNCR before injecting abort
53804b683957 KVM: arm64: nv: Inject SEA if kvm_translate_vncr() can't resolve PFN
d35defbdfcb1 KVM: arm64: nv: Respect read-only PFN when mapping L1 VNCR
dd3b237eb778 KVM: arm64: nv: Fix SPSR_EL2 restore in kvm_hyp_handle_mops()
29227821e232 KVM: arm64: nv: Write ESR_EL2 for injected nested SError exceptions
7deadbc5dab5 KVM: arm64: nv: Drop bogus WARN for write to ZCR_EL2
a805ab1914ea KVM: arm64: Ensure level is always initialized when relaxing perms
34d8d7242c52 KVM: arm64: account pKVM reclaim against the VM mm
0cbae0e296d2 KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers
2c87a087c206 KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state
d5560b6569cd KVM: x86: Nullify irqfd->producer if updating IRTE for bypass fails
32bdca80aa81 KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs
d6b5aba65e99 KVM: TDX: Reject concurrent change to CPUID entry count
d2f9df3b615c KVM: SEV: Do not allow intra-host migration/mirroring of SNP VMs
124a3769c437 KVM: s390: pci: Fix handling of AIF enable without AISB
7d066368f72e KVM: nVMX: Move vTPR vs. TPR Threshold consistency check into "normal" checks
b1a89d12d35a KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling
0658b09cba7f KVM: arm64: vgic: Check the interrupt is still ours before migrating it
adce12bb0e0d KVM: s390: pci: Fix GISC refcount leak on AIF enable failure
a2e7bbc91cf6 powerpc/pseries/Kconfig: Enable CONFIG_VPA_PMU to be used with KVM
ce587046baac KVM: s390: Fix unlikely race in try_get_locked_pte()
a4a19941ccb2 KVM: s390: Initialize KVM_S390_GET_CMMA_BITS memory
5fc9690db3bf KVM: s390: vsie: Use mmu cache to allocate rmap
eeeb9bc71831 KVM: s390: Silence potential warnings in _gmap_crstep_xchg_atomic()
0c3d4ca328e6 KVM: s390: vsie: Add missing radix_tree_preload() in _gaccess_shadow_fault()
bcc6b684fcf6 KVM: s390: vsie: Fix allocation of struct vsie_rmap
ac3366245221 LoongArch: KVM: Return full old CSR value from kvm_emu_xchg_csr()
31e99851ee99 LoongArch: KVM: Fix FPU register width with user access API
5c827b66a626 LoongArch: KVM: Check the return values for put_user()
d4574547e04a LoongArch: KVM: Check irq validity in kvm_vcpu_ioctl_interrupt()
8b3e188d19e4 LoongArch: KVM: Validate irqchip index in irqfd routing
81f5b85a5fb0 ARM: dts: stm32: stm32mp15x-mecio1-io: Move expander gpio-line-names to board files
7b5e3c15eee1 ARM: dts: stm32: stm32mp15x-mecio1-io: Fix expander gpio line typo
d735c64a1462 ARM: dts: stm32: stm32mp15x-mecio1-io: Move gpio-line-names to board files
e61543c0aa5a arm64: dts: qcom: hamoa: Fix OPP tables for all DisplayPort controllers
fc58177cca3b ARM: dts: stm32: stm32mp15x-mecio1-io: Fix GPIO names typo
73e14c8bf53c arm64: dts: imx8ulp-evk: Correct Type-C int GPIO flags
520de5e79dda ARM: dts: stm32: stm32mp15x-mecio1-io: Enable internal ADC reference
0623e082e99a arm64: dts: ti: k3-am62a7-sk: Add bootph-all tag to vqmmc
ba13b141ddb5 ARM: dts: stm32: stm32mp15x-mecio1-io: Move divergent mecio1 ADC channels to board files
d09c701a531c ARM: dts: stm32: stm32mp15x-mecio1-io: Fix ADC sampling times
12cabe872172 arm64: dts: rockchip: fix Ethernet PHY not found on PX30 Ringneck
b5ab9ada87e8 arm64: dts: qcom: sdm630: describe adsp_mem region properly
17b7ab1d26b3 ARM: dts: imx6ul-var-som: fix warning for non-existent dc-supply property
7cc51bb053f6 arm64: dts: renesas: ironhide: Describe inline ECC carveouts
7b71b69719eb arm64: dts: s32g3: Fix SWT8 watchdog address
9b6a94b187f4 arm64: fpsimd: Fix type mismatch in sve_{save,load}_state()
b69ad768cd4a net: ife: require ETH_HLEN to be pullable in ife_decode()
463d417a905d octeontx2-vf: clear stale mailbox IRQ state before request_irq()
1ffc164c4744 octeontx2-pf: clear stale mailbox IRQ state before request_irq()
806b7b6edc84 net: atm: reject out-of-range traffic classes in QoS validation
7f72c285f6d3 net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post()
6acbbe54215d tipc: restrict socket queue dumps in enqueue tracepoints
201b60c4d155 ASoC: SOF: topology: validate vendor array size before parsing
92f90917413b ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get
312c7d2ebe69 ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc
c29f5b449889 ASoC: SOF: ipc4-control: Validate notification payload size
038406abde0d ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put
00335df9da20 VDUSE: avoid leaking information to userspace
8062ff9d366c vduse: Fix race in vduse_dev_msg_sync and vduse_dev_read_iter
8adebf07b46d mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace()
cab468c3c03f mlxsw: fix refcount leak in mlxsw_sp_port_lag_join()
708df5274cee idpf: add padding to PTP virtchnl structures
21710f27d55e ring-buffer: Allow sparse CPU masks in ring_buffer_desc()
57e566db78fc tracing/remotes: Fix struct_len in trace_remote_alloc_buffer()
81a7b7ddb07e tracing/remotes: Fix leak in trace_remote_alloc_buffer() error path
c25212f274a5 drm/imagination: make pvr_fw_trace_init_mask_ops static
1a638c55f2db smb: client: fix overflow in passthrough ioctl bounds check
bf126747e7bf drm/xe: free madvise VMA array on L2 flush failure
c69369057b30 drm/xe: remove duplicate <kunit/test-bug.h> include
3cf83432e056 octeontx2-af: fix VF bringup affecting PF promiscuous state
2ae146bcfcc1 ethtool: rss: Fix hfunc and input_xfrm parsing on big endian
7b2fbdafc6de net/mlx5: Fix L3 tunnel entropy refcount leak
ddd5ab921fdd selftests/net: fix EVP_MD_CTX leak in tcp_mmap
7d84acf641af drm/fb-helper: Only consider active CRTCs for vblank sync
153d1b8b5bc3 regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK
f0eac9c3c371 smb: client: fix busy dentry warning on unmount after DIO
b69ea153d30c dm era: fix NULL pointer dereference in metadata_open()
d49f6d098ed4 SUNRPC: pin upper rpc_clnt across the TLS connect_worker
9359aac4999e SUNRPC: release lower rpc_clnt if killed waiting for XPRT_LOCKED
c37abc99bb3d cifs: validate DFS referral string offsets
b0640acace25 s390/zcrypt: Remove the empty file
92185d6f7819 ipvs: ensure inner headers in ICMP errors are in headroom
f0f35153de83 ipvs: fix PMTU for GUE/GRE tunnel ICMP errors
c2ee845e292c ipvs: use parsed transport offset in TCP state lookup
568720055fbd ipvs: pass parsed transport offset to state handlers
ef0c7d4b04a0 netfilter: nft_lookup: fix catchall element handling with inverted lookups
95128dc74425 ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer()
1fcabcba272d ipv4: igmp: annotate data-races around timer-related fields
16e5b2dbea49 ipv4: igmp: annotate data-races around im->users
0458ba1cda83 ipv6: mcast: Fix potential UAF in MLD delayed work
8d4394ffa405 ipv4: igmp: Fix potential UAF in igmp_gq_start_timer()
d73e4d790db6 gpio: mvebu: free generic chips on unbind
46d0fd8535ed perf/x86/amd/core: Avoid enabling BRS from the SVM reload path
543c66cea0e2 octeontx2-pf: check DMAC extraction support before filtering
f1e7807df5bf net/sched: cake: reject overhead values that underflow length
e3d1ca7882a5 net: mdio: select REGMAP_MMIO instead of depending on it
3861bae3ffe4 selftests: gpio: add gpio-cdev-uaf to .gitignore
5d65dade4d84 drm/v3d: Reject invalid indirect BO handle in indirect CSD setup
91e8109ecffb accel/amdxdna: Fix potential amdxdna_umap lifetime race
6cb18e712feb tracing: Make tracepoint_printk static as not exported
170c008d3f49 drm: Guard DRM_CLIENT_CAP_PLANE_COLOR_PIPELINE
82202fc724f4 gpio: dwapb: Defer clock gating until noirq
8aede22b6a69 net: usb: lan78xx: disable VLAN filter in promiscuous mode
81acef3a247f net/liquidio: drop cached VF pci_dev LUT
40824fc26ad3 net: rnpgbe: fix mailbox endianness and remove pointer casts
ebc295ce3436 net/tls: Consume empty data records in tls_sw_read_sock()
bea20225c67f accel/amdxdna: Fix VMA access race
cf10c506fdbe accel/amdxdna: Use unsigned long for nr_pages in amdxdna_hmm_register()
2d8eeb0578ae accel/amdxdna: Prevent PM resume deadlock in hwctx_sync_debug_bo()
3a63a11897c7 ring-buffer: Fix event length with forced 8-byte alignment
d0a2b0c81f11 Bluetooth: L2CAP: fix tx ident leak for commands without a response
a8e169d30877 Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup()
058d0d087a27 Bluetooth: ISO: exclude RFU bits from ISO_SDU_Length
990e65eb9387 Bluetooth: ISO: fix malformed ISO_END/CONT handling
1f9375f55ead Bluetooth: btintel_pcie: Refactor FLR to use device_reprobe()
c36895aa1122 Bluetooth: btintel_pcie: Separate coredump work from RX work
fb6fc74cc10f Bluetooth: btintel_pcie: Add support for smart trigger dump
4ff5778e8ee3 Bluetooth: btintel_pcie: Support Product level reset
a50da115b588 Bluetooth: sco: Fix a race condition in sco_sock_timeout()
dbd935a9e056 Bluetooth: MGMT: Fix adv monitor add failure cleanup
32c48c7f6cc8 Bluetooth: 6lowpan: hold L2CAP conn across debugfs control
feb3fc2c38ed Bluetooth: 6lowpan: avoid untracked enable work
b601c031d4fa drm/i915/ltphy: Fix SSC Enablement bit in PORT_CLOCK_CTL
0b98a503ed1e gpio: shared: make the voting mechanism adaptable
8d12d1fede47 smb: client: preserve leading slash for POSIX absolute symlink targets
a1f2ada2e4d3 ksmbd: fix multichannel binding and enforce channel limit
5a632f2f207e amt: fix size calculation in amt_get_size()
ce5aa8084329 net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket
8e49cd891bda net/sched: act_pedit: fix TOCTOU heap OOB write in tc offload
231a8a4b76cb net: qualcomm: rmnet: validate MAP frame length before ingress parsing
982d6d6bc059 qede: fix off-by-one in BD ring consumption on build_skb failure
952928564cc5 net: microchip: vcap: fix races on the shared Super VCAP block
815515ec68f5 net/mlx5e: Fix publication race for priv->channel_stats[]
f5677797b094 net/mlx5e: Fix HV VHCA stats agent registration race
abc4c56427f1 net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation
98fc2deffcf1 drm/bridge: analogix_dp: Fix PE/VS value shift mismatch during link training
5a95aa0198af net/mlx5e: TC, skip peer flow cleanup when LAG seq is unavailable
4d720c6c60e1 net/mlx5: LAG, MPESW, Fix missing complete() on devcom error
40cc06bf7147 net/mlx5: LAG, Fix off-by-one in single-FDB error rollback
fd2ef924a56f net/mlx5: LAG, extend shared FDB API with group_id filter
d14f2dbf727c net/mlx5: LAG, prepare for SD device integration
5092213b9a31 net/mlx5: LAG, replace peer count check with direct peer lookup
3b8b364f97f4 net/mlx5: LAG, factor out shared FDB code into dedicated file
7ac37a167cc6 net/mlx5: Lag, avoid LAG and representor lock cycles
db9e44e0ed63 net/mlx5: E-Switch, add representor lifecycle lock
25d4c0948300 net/mlx5: Lag: refactor representor reload handling
6f2cb20d8e28 platform/x86: bitland-mifs-wmi: Fix NULL pointer dereference during suspend/resume
230173cc6105 netfilter: xt_connmark: reject invalid shift parameters
94427ca35943 netfilter: nft_set_rbtree: get command skips end element with open interval
d5e39e5eb6b3 netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop
905a927b2e6f netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt()
00d034fe8230 netfilter: xt_u32: reject invalid shift counts
f618cbe9b24c gue: validate REMCSUM private option length
ea866cab12db net: usb: net1080: validate packet_len before pad-byte access in rx_fixup
9d343a4889e5 arm64/sysreg: Fix BWE field encoding in ID_AA64DFR2_EL1
79b33d9f1d9c selftests/hid: Cover hid_bpf_get_data() size overflow
b56f874e49e6 selftests/hid: Load only requested struct_ops maps
f81bc5a709dc HID: bpf: Fix hid_bpf_get_data() range check
3dd3e43f17cd ntfs: avoid stale runlist element dereference in fallocate
6706e332151b iio: dac: mcp47feb02: Fix passing uninitialized vref1_uV for no Vref1 case
9a1479b05bd9 arm64/mm: Optimize TLB flush in unmap_hotplug_[pmd|pud]_range()
67a863ceb348 arm64: Avoid eager DVMSync reclaim batches with C1-Pro SME erratum
f7e8117e42b2 HID: core: Fix OOB read in hid_get_report for numbered reports
ef649703dce0 HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait()
9a2e36963a3f ntfs: avoid stale runlist element dereference in MFT writeback
be47c0472506 netfs: Fix barriering when walking subrequest list
9da2e4275e64 ata: libata-scsi: limit simulated SCSI command copy to response length
35cb43b721c0 ata: sata_gemini: unwind clocks on IDE pinctrl errors
3a303f985c6b cifs: Fix missing credit release on failure in cifs_issue_read()
1acddd3e22dd uprobes/x86: Use proper mm_struct in __in_uprobe_trampoline
fa8fd23e3a87 x86/uprobes: Keep shadow stack in sync for emulated CALLs
2b6b3f98d0e9 drm/xe/pt: prevent invalid cursor access for purged BOs
5ff2212f0e07 drm/xe: fix NPD in bo_meminfo()
a4208d8032ab drm/xe/pf: Don't attempt to process FAST_REQ or EVENT relays
23ee91355e31 drm/xe/hw_engine: Fix double-free of managed BO in error path
f1a1909f36b7 drm/xe/userptr: Drop bogus static from finish in force_invalidate
ab9ea5c943c7 drm/xe/userptr: Hold notifier_lock for write on inject test path
159f9aa8d2e0 drm/imagination: Fix returned size for DRM_IOCTL_PVR_DEV_QUERY
d94b9922b2ae drm/xe/pt: Fix NULL pointer dereference in xe_pt_zap_ptes_entry()
1a4421c7a561 netfs: Fix folio state after ENOMEM whilst under writeback iteration
89df9c158a25 netfs: Fix writeback error handling
0348e3fa0dfb netfs: Fix writethrough to use collection offload
68fb8a93a34b cachefiles: Fix file burial to take lock when unsetting S_KERNEL_FILE
1188a9846fad netfs: Fix netfs_create_write_req() to handle async cache object creation
7f7780abb4c0 iomap: guard io_size EOF trim against concurrent truncate underflow
3c181e6ff1f4 ovl: fix comment about locking order
26757dac1517 cachefiles: Fix double unlock in nomem_d_alloc error path
8a29e60e2176 minix: avoid overflow in bitmap block count calculation
27ddd3442fc6 iomap: release pages on atomic dio size mismatch
89ec425b454e afs: Fix unchecked-length string display in debug statement
d0c8ad418b47 afs: Fix the volume AFS_VOLUME_RM_TREE is set on
c9a0b9e5f3d4 afs: Fix premature cell exposure through /afs
e94f92fd56c5 afs: Fix lack of locking around modifications of net->cells_dyn_ino
91d8f8e5fd34 afs: Fix vllist leak
9cabf1c86948 afs: Fix leak of ungot volume
1bdbc50e2d41 afs: Use scoped_seqlock_read() rather than manually doing seqlock stuff
e3e59ff22a0d afs: Fix missing NULL pointer check in afs_break_some_callbacks()
f14dd036fad3 afs: Fix callback service message parsers to pass through -EAGAIN
ebfd13c0367a afs: Fix reinitialisation of the inode, in particular ->lock_work
654a546c34f3 afs: Fix misplaced inc of net->cells_outstanding
552d3c0f184a afs: Fix bulk lookup malfunction due to change in dir_emit() API
ca9f19505077 afs: Remove erroneous seq |= 1 in volume lookup loop
84e4b9232a32 afs: use kvfree() to free memory allocated by kvcalloc()
6d52ff4c866e afs: Fix directory inode initialisation order
9d6b0f6d437e afs: Remove setting of AS_RELEASE_ALWAYS for symlinks and mountpoints
462eada939f2 afs: Fix double netfs initialisation in afs_root_iget()
bdcd80ff1293 afs: Fix error code in afs_extract_vl_addrs()
47e434da476b fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid
fc9332533a58 net/sched: hhf: clear heavy-hitter state on reset
d25cdea6226c net/sched: dualpi2: clear stale classification on filter miss
d1297a9e2fd6 xen/pvcalls: bound backend response req_id before indexing rsp[]
feba85c0eeda pinctrl: meson: restore non-sleeping GPIO access
2ef42bd9a8b7 gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe
ed98719be413 ksmbd: fix use-after-free of fp->owner.name in durable handle owner check
15a9e9b8f7f5 ksmbd: reject undersized DACLs before parsing ACEs
b0933dede95d net/sched: act_bpf: use rcu_dereference_bh() to read the filter
24e63c47668a selftests: drv-net: tso: don't touch dangerous feature bits
9717091371d7 cxgb4: Fix decode strings dump for T6 adapters
13741bad74d4 virtio_net: disable cb when NAPI is busy-polled
c3e5cac47519 sctp: fix addr_wq_timer race in sctp_free_addr_wq()
ac39628cb3ef spi: rzv2h-rspi: Fix DMA transfer error handling for signal interruption
9ed0dca2aa05 irqchip/ts4800: Fix missing chained handler cleanup on remove
5459f4f32a8e irqchip/gic-v3-its: Fix OF node reference leak
57e1f2cd6a0e tracing/probes: Make the $ prefix mandatory for comm access
d655cca1c6e6 tracing/fprobe: Fix NULL pointer dereference in fprobe_fgraph_entry()
f4461db8eb8e tracing: eprobe: read the complete FILTER_PTR_STRING pointer
10a33029e1cf tracing/events: Fix to check the simple_tsk_fn creation
8a662d8c05e2 tracing/probes: Remove WARN_ON_ONCE from parse_btf_arg
9acf6f34eb48 tracing/eprobes: Allow use of BTF names to dereference pointers
2c88ad0d06c6 drm/panthor: Interrupt group start/resumption if group_bind_locked() fails
893ed1a7c837 drm/panthor: Fix a leak when a group is evicted before the tiler OOM is serviced
50556bfe1d6c drm/panthor: Fix panthor_pwr_unplug()
1352cd192e5b drm/panthor: Don't overrule pending immediate ticks in sched_resume_tick()
361adc5343e9 drm/panthor: Fix theoretical IOMEM access in suspended state
1c942c3c5179 drm/panthor: Store IRQ register base iomem pointer in panthor_irq
34eb9945a075 drm/panthor: Split register definitions by components
85c6f80499e6 drm/panthor: Pass an iomem pointer to GPU register access helpers
053522ba6158 drm/panthor: Fix potential invalid pointer deref in group_process_tiler_oom()
752a08cfeeea drm/panthor: Keep the reset work disabled until everything is initialized
2946aa6c97ac drm/panthor: Always use the IRQ-safe variant when acquiring the fence lock
8a277a20258d gpio: shared-proxy: always serialize with a sleeping mutex
40cbfa3a28e0 bridge: stp: Fix a potential use-after-free when deleting a bridge
b26aa9d99353 net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF
b637d6b72661 net: gianfar: dispose irq mappings on probe failure and device removal
14b4cb78c332 net: libwx: fix VMDQ mask for 1-queue mode
2381bf3f484e net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy
3ef79fa3860e usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup()
110ccbd28c94 ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump
21f304c2aae4 eth: fbnic: don't cache shinfo across skb realloc
fb8a5afe6f1f hwmon: (aspeed-g6-pwm-tach) Guard fan RPM calculation against divide-by-zero
b0ff6b6ae9c5 hwmon: (pmbus) Fix passing events to regulator core
93b96e723bdc hwmon: adm1275: Prevent reading uninitialized stack
65e7e2b8d71b accel/amdxdna: Fix iommu domain lifetime race during device removal
5bd0d4764039 hwmon: (pmbus/core) honor vrm_version in pmbus_data2reg_vid()
492d0c8f78d4 ASoC: codecs: lpass-va-macro: Fix LPASS Codec Version for SC7280
f3ed74540244 MIPS: mm: Add check for highmem before removing memory block
3aca736e177f MIPS: DEC: Ensure RTC platform device deregistration upon failure
062bcbf8d1f1 sctp: add INIT verification after cookie unpacking
f7776052bb23 sctp: fix SCTP_RESET_STREAMS stream list length limit
d22829101ab6 net: enetc: check the number of BDs needed for xdp_frame
6d46ab395803 qede: fix out-of-bounds check for cqe->len_list[]
c9961336aa5f seg6: validate SRH length before reading fixed fields
e1fc4b00b96d net: pse-pd: scope pse_control regulator handle to kref lifetime
151db2b54744 gpio: htc-egpio: use managed gpiochip registration
537e75aeb9cc gpio: mvebu: fail probe if gpiochip registration fails
d8df91756890 bpf: Fix insn_aux_data leak on verifier err_free_env path
1c53d16b174d bpf: Mask pseudo pointer values in verifier logs
5c907c11615f riscv: Fix 32-bit call_on_irq_stack() frame pointer ABI
d1a22906727b ACPI: RIMT: Only defer the IOMMU configuration in init stage
c637ec6a4592 spi: sh-msiof: abort transfers when reset times out
b2fa801be46d tracing: probes: fix typo in a log message
3ab06151ffcb ALSA: FCP: Fix NULL pointer dereference in interface lookup
b4c34415b82b net: hns3: differentiate autoneg default values between copper and fiber
783dcef78cb0 net: hns3: fix permanent link down deadlock after reset
99f6a07add50 net: hns3: refactor MAC autoneg and speed configuration
ac04c2c833dd net: hns3: unify copper port ksettings configuration path
9715ea1ceab7 selftests: tls: size splice_short pipe by page size
522d1d950b9e tipc: avoid busy looping in tipc_exit_net()
1c8393eefa3c tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy()
46d8d5b02f89 tipc: Store struct sock in struct udp_bearer.
80e9adfed05d udp_tunnel: Pass struct sock to setup_udp_tunnel_sock().
ea0eb61029e0 udp_tunnel: Pass struct sock to udp_tunnel_sock_release().
cd37bcb67f90 net: enetc: fix potential divide-by-zero when num_vsi is zero
2542ce01d811 dt-bindings: net: renesas,ether: Drop example "ethernet-phy-ieee802.3-c22" fallback
54292b167466 net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync
c5fafece300c ASoC: fsl_asrc_dma: fix eDMA maxburst misalignment with channel count
0ddb9dcabf0b LoongArch: BPF: Fix off-by-one error in tail call
09068613dd0d LoongArch: BPF: Fix outdated tail call comments
ee79d03aafb5 LoongArch: Move struct kimage forward declaration before use
fe0669928f27 net: stmmac: dwmac-spacemit: Fix wrong irq definition
a77abd7a3490 net: stmmac: dwmac-spacemit: Fix wrong phy interface definition
c3e27e4ee524 net: ethernet: sunplus: spl2sw: fix phy_node refcount leak in remove
bc49e8746584 net: sungem: fix probe error cleanup
fb42560afec5 tools: ynl: build archives with $(AR)
e2087447f562 geneve: validate inner network offset in geneve_gro_complete()
49c2e7c0a699 geneve: gate GRO hint in geneve_gro_complete() on gs->gro_hint
5bdb33ff6e58 net: mvneta: re-enable percpu interrupt on resume
0fd234bc1264 octeontx2-af: fix CGX debugfs RVU AF PCI reference leaks
b1f6381acf9d octeontx2-af: Validate NIX maximum LFs correctly
ba933c5f3568 net: phy: realtek: Clear MDIO_AN_10GBT_CTRL_ADV10G bit
7d47925c2c64 net: mana: Fall back to standard MTU when PF reports adapter_mtu of 0
cf52622fbc27 net: dsa: mxl862xx: fix use-after-free of DSA ports in crc_err_work
245c6c8a2958 net: dsa: mxl862xx: avoid unaligned 16-bit access in api_wrap
c21f7ee511ae net: dsa: realtek: fix memory leak in rtl8366rb_setup_led()
a427cfa41796 rtc: cmos: unregister HPET IRQ handler on probe failure
5904fd94f919 rtc: ds1307: Fix off-by-one issue with wday for rx8130
cddbfbc71085 smb/client: preserve errors from smb2_set_sparse()
8bbe4dd79645 ACPI: processor_idle: Mark LPI enter functions as __cpuidle
42d4fc933280 ACPICA: Unbreak tools build after switching over to strscpy_pad()
156af6606f36 thermal: testing: zone: Flush work items during cleanup
fda07c8e4b54 s390/mm: Fix handling of _PAGE_UNUSED pte bit
ca2dbee8fea6 eth: fbnic: fix ordering of heartbeat vs ownership
7a368c754a96 ipv6: fix missing notification for ignore_routes_with_linkdown
b91ac71fc2a2 ipv6: fix state corruption during proxy_ndp sysctl restart
764ac02cbd3b ipv6: fix error handling in disable_policy sysctl
420e895fb41d ipv6: fix error handling in forwarding sysctl
a39ff02a241c ipv6: fix error handling in ignore_routes_with_linkdown sysctl
e28bada56f4f ipv6: fix error handling in disable_ipv6 sysctl
94f55994e19e sctp: fix err_chunk memory leaks in INIT handling
e28aedab9488 net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle
19eec11f3ab5 net: lwtunnel: Drop skb metadata before LWT encapsulation
cc27e4514e6e net: usb: lan78xx: restore VLAN and hash filters after link up
4bd2e5dbe623 veth: fix NAPI leak in XDP enable error path
20d4a9dea55b net: ti: icssg: Fix XSK zero copy TX during application wakeup
09efce96c909 net: dsa: sja1105: round up PTP perout pin duration
a3d0c8b437ef net: do not acquire dev->tx_global_lock in netdev_watchdog_up()
89c103d702b2 net, bpf: check master for NULL in xdp_master_redirect()
752b781b0c0a Docs/driver-api/uio-howto: document mmap_prepare callback
c19faa40b37d alpha/PCI: Fix __pci_mmap_fits() overflow for zero-length BARs
257b55dc3d18 alpha/PCI: Add security_locked_down() check to pci_mmap_resource()
75d7a27c506e NTB: epf: Fix doorbell bitmask and IRQ vector handling
bfe11cd91ab0 NTB: epf: Report 0-based doorbell vector via ntb_db_event()
583a4a19eefc NTB: epf: Make db_valid_mask cover only real doorbell bits
9787c2d17111 PCI: endpoint: pci-epf-vntb: Exclude reserved slots from db_valid_mask
9e105f6a14fb ASoC: rt5575: Use __le32 for SPI burst write address
33387bf9bb61 ASoC: SDCA: Validate written enum value in ge_put_enum_double()
0ae6e70edc33 cpuidle: Allow exit latency to exceed target residency
c239f2d879ab netfilter: nf_conntrack_helper: cap maximum number of expectation at helper registration
e3b7789be80d netfilter: nft_ct: expectation timeouts are passed in milliseconds
f32e644fe365 netfilter: nf_conntrack_expect: run expectation eviction with no helper
3401ab813d27 netfilter: nf_conntrack_expect: store master_tuple in expectation
7ec786f4230c netfilter: nf_conntrack_expect: use conntrack GC to reap expectations
743209358ff8 netfilter: conntrack: check NULL when retrieving ct extension
ae568b6f16e0 netfilter: nf_conntrack_pptp: move GRE specific cleanup to GRE tracker
a1572284b14e netfilter: nf_conntrack_helper: dynamically allocate struct nf_conntrack_helper
40c14ce49963 gpio: davinci: fix IRQ domain leak on devm_kzalloc failure
c129b0185e70 netfilter: nft_compat: ebtables emulation must reject non-bridge targets
2f71ca368ffd netfilter: nft_synproxy: stop bypassing the priv->info snapshot
025a41e76b51 netfilter: flowtable: Validate iph->ihl in nf_flow_ip4_tunnel_proto()
be52572c6d55 netfilter: nf_conncount: prevent connlimit drops for early confirmed ct
eb14aba91163 netfilter: nf_nat: avoid invalid nat_net pointer use on failed nf_nat_init()
1bb3b6a5c3c5 bpf: Disable xfrm_decode_session hook attachment
d684b72dfbd3 md/raid5: avoid R5_Overlap races while breaking stripe batches
4465211d195d md/raid5: use stripe state snapshot in break_stripe_batch_list()
a668fa160247 ipv4: fib: Don't ignore error route in local/main tables.
c5bd84c6cd77 eth: bnxt: improve the timing of stats
6428634f7a0b ipv6: Fix null-ptr-deref in fib6_nh_mtu_change().
1c89da3baa2b ksmbd: fix use-after-free of conn->preauth_info in concurrent SMB2 NEGOTIATE
03ae998ae623 selftests/bpf: Cover small conntrack opts error writes
dd74c8020384 bpf: Guard conntrack opts error writes
bb3e624808c9 rtc: msc313: fix NULL deref in shared IRQ handler at probe
5f2cfe30af5a e1000e: Reconfigure PLL clock gate timeout and re-enable K1 on Meteor Lake
939756efe505 i40e: Fix i40e_debug() to use struct i40e_hw argument
40c68e35e700 ice: dpll: fix memory leak in ice_dpll_init_info error paths
17c0a9db05e3 ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info
19ec35b79913 rtc: isl1208: Balance enable_irq_wake() with disable_irq_wake() on cleanup
6c70914ab629 ice: call netif_keep_dst() once when entering switchdev mode
4f13a0a479b5 ice: fix AQ error code comparison in ice_set_pauseparam()
b1fc5bafbc5f ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs()
0f9278b22cda bpf: Preserve pointer spill metadata during half-slot cleanup
233170ad54d3 PCI: endpoint: pci-epf-vntb: Report 0-based doorbell vector via ntb_db_event()
93a85a6aca19 PCI: endpoint: pci-epf-vntb: Defer pci_epc_raise_irq() out of atomic context
528cfbcc47bb PCI: endpoint: pci-epf-vntb: Document legacy MSI doorbell offset
a58543f1e1cc PCI: endpoint: pci-epf-ntb: Add check to detect 'db_count' value of 0
750dd7546de3 PCI: endpoint: pci-epf-vntb: Add check to detect 'db_count' value of 0
937f77a79636 ASoC: cs530x: Fix expected MCLK rates for CS5302/4/8
50456f445fee erofs: handle 48-bit blocks_hi for compressed inodes
4137e1ecec9c drm/edid: fix OOB read in drm_parse_tiled_block()
6558811274c8 gpiolib: initialize return value in gpiochip_set_multiple()
7dba66caf98e power: sequencing: fix ABBA deadlock in pwrseq_device_unregister()
b584f107ab90 bpf: Fix effective prog array index with BPF_F_PREORDER
d977b2aff9f7 bpf: Fix BPF_PROG_ASSOC_STRUCT_OPS last field check
8b996c555575 bpf: zero-initialize the fib lookup flow struct
7faf89ed5b4c bpftool: Fix vmlinux BTF leak in cgroup commands
89cf4d0c71a2 bpf: Fix partial copy of non-linear test_run output
db8f1dcf5950 bpf: Fix stack slot index in nospec checks
9242939dd6d9 rtc: ds1307: handle oscillator stop flag for ds1337/ds1339/ds3231
fc4f78e8f034 rtc: abx80x: fix the RTC_VL_CLR clearing all status flags
84ac7a0f9562 dpaa2-switch: do not accept VLAN uppers while bridged
5a3b2ee1e96d ipv6: ioam: fix type confusion of dst_entry
63d1c23764de ipv6: ndisc: fix NULL deref in accept_untracked_na()
f4d7d8fdcc59 net: airoha: Fix skb->priority underflow in airoha_dev_select_queue()
0c3d8fc87e10 net/sched: act_ct: fix nf_connlabels leak on two error paths
44068b6863fb net: emac: Fix NULL pointer dereference in emac_probe
d0ab67f7e7cf octeontx2-pf: mcs: Fix mcs resources free on PF shutdown
e7f1311e7ef3 octeontx2-pf: Clear stats of all resources when freeing resources
a56fd8449de8 octeontx2-af: mcs: Fix unsupported secy stats read
e129d1a4c2ba octeontx2-af: npc: cn20k: fix NPC defrag
c36cecf9903f net: ethernet: mtk_ppe: Fix rhashtable leak in mtk_ppe_init error paths
7ce31739fe88 net: dst_metadata: fix false-positive memcpy overflow in tun_dst_unclone
b65289e1c3f3 tipc: fix use-after-free of the discoverer in tipc_disc_rcv()
31d486562062 net: marvell: prestera: initialize err in prestera_port_sfp_bind
8c439591f703 selftests/mm: fix exclusive_cow test fork() handling
214ba4596887 selftests/mm: remove hardcoded THP sizing assumptions in hmm tests
679642fa56d5 selftests/mm: allow PUD-level entries in compound testcase of hmm tests
0481f4bad161 selftests/mm: clarify alternate unmapping in compaction_test
2a018e29ac5f selftests/mm: move hwpoison setup into run_test() and silence modprobe output for memory-failure category
835ef922f3ba selftests/mm: run_vmtests.sh: free memory if available memory is low
de72caed5077 selftests/mm: skip uffd-stress test when nr_pages_per_cpu is zero
e186a9ac7af4 selftests/mm: ensure destination is hugetlb-backed in hugetlb-mremap
e0f39f7671a9 selftest/mm: register existing mapping with userfaultfd in hugetlb-mremap
7c0ba2376d40 selftests/mm: free dynamically allocated PMD-sized buffers in split_huge_page_test
5b136718617a selftests/mm: size tmpfs according to PMD page size in split_huge_page_test
aef0f2059a97 selftests/mm: fix cgroup task placement and drop memory.current checks in hugetlb_reparenting_test.sh
4a1e9beaff98 selftests/mm: fix hugetlb pathname construction in hugetlb_reparenting_test.sh
95f64f30431e selftests/mm: restore default nr_hugepages value via exit trap in hugetlb_reparenting_test.sh
65a7bc39d4a2 selftests/mm: fix hugetlb pathname construction in charge_reserved_hugetlb.sh
83d9d5f63cc9 selftests/mm: restore default nr_hugepages value via exit trap in charge_reserved_hugetlb.sh
008ceffd4404 alloc_tag: fix use-after-free in /proc/allocinfo after module unload
810779623104 irqchip/crossbar: Fix parent domain resource leak
74b19383580d mailbox: imx: Forward the timeout/ error in imx_mu_generic_tx()
c041d2be785f tpm_crb: Check ACPI_COMPANION() against NULL during probe
4dce8bf588a8 netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak
a259780ddf1d netfilter: nf_reject: skip iphdr options when looking for icmp header
a75f7745dc8f netfilter: nft_flow_offload: zero device address for non-ether case
c3167c9c6433 netfilter: nft_meta_bridge: add validate callback for get operations
94daa48ea7b6 netfilter: nft_payload: reject offsets exceeding 65535 bytes
c78bd5195a59 netfilter: ipset: make sure gc is properly stopped
93a775fd67f3 netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer()
7efd8a1c96c7 netfilter: ipset: Don't use test_bit() in lockless RCU readers in bitmap types
3219d74e4536 netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types
c6e635429584 md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry
937c3e44ecaf md/raid1: honor REQ_NOWAIT when waiting for behind writes
d1324b41dabd md/raid10: fix writes_pending and barrier reference leaks on discard failures
f94031c94eae md/raid10: fix writes_pending leak on write request failures
bffbbfcbd939 md/raid1: fix writes_pending and barrier reference leaks on write failures
4fe0635fe604 mac802154: Prevent overwrite return code in mac802154_perform_association()
f14802465f59 ieee802154: fix kernel-infoleak in dgram_recvmsg()
4c3717546878 ieee802154: Remove WARN_ON() in cfg802154_pernet_exit()
6fcba77571c5 ieee802154: Avoid calling WARN_ON() on -ENOMEM in cfg802154_switch_netns()
8a4eae78287a ieee802154: Restore initial state on failed device_rename() in cfg802154_switch_netns()
315e1efc3f16 ACPI: IPMI: Fix inverted interface check in ipmi_bmc_gone()
8dcf676092ff ACPI: resource: Amend kernel-doc style
172e690bab7a thermal: intel: Fix dangling resources on thermal_throttle_online() failure
02f1d4b40eb4 arm64/hw_breakpoint: reject unaligned watchpoints that would truncate BAS
fde42e9f5c59 arm64: static_call: include asm/insns.h
7f8d816a9aa2 netfilter: flowtable: fix and simplify IP6IP6 tunnel handling
68286258698e ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints
d9ac4239157e eth: fbnic: take netif_addr_lock_bh() around rx mode address programming
41b70eff0392 selftests: vlan_bridge_binding: Fix flaky operational state check
0b17f320893a netconsole: don't drop the last byte of a full-sized message
825de39f0c35 flow_dissector: check device type before reading ETH_ADDRS
9acbcb89190a net: macb: add TX stall timeout callback to recover from lost TSTART write
9f7cd1e26d2f net: airoha: fix foe_check_time allocation size
f5adcb9245ae devlink: Fix parent ref leak on tc-bw failure
21f7e96cf164 devlink: Fix parent ref leak in devl_rate_node_create()
dbb6321c2977 dpaa2-switch: fix VLAN upper check not rejecting bridge join
e6b8463b7d79 virtio-net: fix len check in receive_big()
d654af91739a spi: rpc-if: Use correct device for hardware reinitialization on resume
aa80fca32cf7 PCI: iproc: Restore .map_irq() for the platform bus driver
ec6fb1ecada8 ALSA: usb-audio: qcom: clear opened when stream enable fails
a22356d1f731 ALSA: usb-audio: qcom: reject stream disable with no active interface
f09a245f33e5 sctp: hold socket lock when dumping endpoints in sctp_diag
794a0d8bdbb3 net: psample: fix info leak in PSAMPLE_ATTR_DATA
e19d38d397d4 octeontx2-af: npc: Log successful MCAM drop-on-non-hit install at debug level
452ec5058ea4 octeontx2-pf: Fix leak of SQ timestamp buffer on teardown
043ed6924c63 selftests/ftrace: Fix trace_marker_raw test on 64K page kernels
e5c6debdad28 net: ethernet: mtk_eth_soc: fix supported_interface set after phylink_create
bc88744dc556 drm/amdgpu: initialize irq.lock spinlock earlier
e33a3bd5cb8d drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm
db803223edc4 drm/amd/display: Fix mem_type change detection for async flips
db70b4a08211 drm/amd/display: Skip PHY SSC reduction on some 8K panels
7f20ce7b2bcf drm/amdgpu: initialize iter.start in amdgpu_devcoredump_format
1d12ae8b079e drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free
e2ab48e8591d ASoC: tlv320aic3x: restrict CLKDIV bypass Q values in dual-rate mode
77961e12ea16 perf dso: Set standard errno on decompression failure
aa967ae8b256 perf bpf: Validate array presence before casting BPF prog info pointers
bfc764f9de65 perf c2c: Fix hist entry and format list leaks in c2c_he_free()
502ee1fe757a perf c2c: Free format list entries when c2c_hists__init() fails
79b92b298b5c perf cs-etm: Bounds-check CPU in cs_etm__get_queue()
2d5a695a9d19 perf cs-etm: Require full global header in auxtrace_info size check
f22dbfb71c3d perf cs-etm: Validate num_cpu before metadata allocation
7c7245321599 perf machine: Use snprintf() for guestmount path construction
5a03a2ee17e8 xfrm: validate selector family and prefixlen during match
7394a276f869 xfrm: annotate data-races around xfrm_policy_count[] and xfrm_policy_default[]
041859fd55c8 xfrm: Fix xfrm state cache insertion race
f83ef148a94b ALSA: usb-audio: qcom: Free sideband sg_table objects
9104559db16b erofs: call erofs_exit_ishare() before rcu_barrier()
a6b17b34aedc i3c: master: Add missing runtime PM get in dev_nack_retry_count_store()
b5d5cfea4f23 i3c: master: Update dev_nack_retry_count under maintenance lock
7f29c063c53f spi: dw: fix wrong BAUDR setting after resume
a5c5676ad3b0 drm/xe: Fix wa_oob codegen recipe for external module builds
ac554ad94361 drm/i915: clear CRTC color blob pointers after dropping refs
9f171aa115ec regcache: Do not overwrite error code when finalizing cache after error
e06ad4356915 gpio: mlxbf3: fail probe if gpiochip registration fails
99ab295d8025 perf cs-etm: Reject CPU IDs that would overflow signed comparison
6d2aa8dfea1f perf c2c: Free format list entries when releasing c2c hist entries
62a11653847f perf bpf: Bounds-check array offsets in bpil_offs_to_addr()
f9ec0eda83ea perf bpf: Reject oversized BPF metadata events that truncate header.size
3fe6751a0697 perf bpf: Validate func_info_rec_size and sub_id in synthesize_bpf_prog_name()
eaab676863cb perf sched: Replace (void*)1 sentinel with proper runtime allocation
dd8e455fd91e perf hwmon: Fix fd check to accept fd 0 in hwmon_pmu__describe_items()
97584371d5d8 perf tools: Use snprintf() for root_dir path construction
2367ebcd0d4b perf dso: Set error code when open() fails on uncompressed fallback path
c5dcbd5cf007 perf dso: Fix heap overflow in dso__get_filename() on decompressed path
df77307da9da perf symbols: Break infinite loop on zero-filled notes in sysfs__read_build_id()
6172d92a7f15 perf symbols: Validate p_filesz before use in filename__read_build_id()
1ce03f1d990e perf symbols: Fix bswap copy-paste error for 32-bit ELF p_filesz
a06241a08631 perf maps: Add maps__mutate_mapping
abbdd94e6a10 sparc: led: avoid trimming a newline from empty writes
f55b1ff89938 accel/ivpu: fix HWS command queue leak on registration failure
30521e7ec4d8 apparmor: fix label can not be immediately before a declaration
4b0c34521747 i3c: master: Prevent reuse of dynamic address on device add failure
8f851cab401c i3c: mipi-i3c-hci: Fix race in i3c_hci_addr_to_dev()
50eabb91d2de i3c: master: Defer new-device registration out of DAA caller context
fef9bdaa0df0 i3c: master: Ensure Hot-Join operations are stopped on shutdown
08b33dfd457b i3c: master: Consolidate Hot-Join DAA work in the core
21cf9175b370 i3c: master: Serialize i3c_set_hotjoin() with the maintenance lock
af6df5d50607 i3c: master: Make hot-join workqueue freezable to block hot-join during suspend
88116f41086a i3c: mipi-i3c-hci: Preserve RUN bit when aborting DMA ring
49a230c2aea4 i3c: mipi-i3c-hci: Fix suspend behavior when bus disable falls back to software reset
4238195ed989 apparmor: Fix inverted comparison in cache_hold_inc()
a5c79d44ef19 apparmor: fix uninitialised pointer passed to audit_log_untrustedstring()
3f172fbbe357 apparmor: don't audit files pointing to aa_null.dentry
859ba6c7fc6e apparmor: put secmark label after secid lookup
b1abb5340737 apparmor: aa_getprocattr free procattr leak on format failure
de91788aa6b8 apparmor: remove unnecessary goto and associated label
393809a05cfb apparmor: release exe file resources on path failure
106e909e12ba apparmor: fail policy unpack on accept2 allocation failure
bd30d91f9f22 apparmor: Fix return in ns_mkdir_op
2118a9f7a7ed apparmor: remove or add symlinks to rawdata according to export_binary
73d86ca950b8 apparmor: fix NULL pointer dereference in unpack_pdb
dd5f1202f45a apparmor: fix potential UAF in aa_replace_profiles
67ee65ec1a3e apparmor: grab ns lock and refresh when looking up changehat child profiles
4a2c4f2b45dc apparmor: fix rawdata_f_data implicit flex array
6d9147917424 apparmor: aa_label_alloc use aa_label_free on alloc failure
ec926b2a351e apparmor: check label build before no_new_privs test
25b262492539 security/apparmor/apparmorfs.c: conditionally compile get_loaddata_common_ref()
b8642f147898 apparmor: fix refcount leak when updating the sk_ctx
d680472db988 apparmor: fix race in unix socket mediation when peer_path is used
ec95dec9ae2c apparmor: fix shadowing of plabel that prevents cache from being updated
3691a82be209 Revert "PCI/MSI: Unmap MSI-X region on error"
91fbf0de91bc Documentation: ABI: sysfs-class-reboot-mode-reboot_modes: fix doc warnings
375e1defdeb8 sparc: Avoid -Wunused-but-set-parameter in clear_user_page()
63a300151999 xfrm: Fix dev use-after-free in xfrm async resumption
855870e8c59b PCI: dwc: Avoid dwc_pcie_rasdes_debugfs_deinit() NULL dereference when no RAS DES capability
972052764672 phy: freescale: phy-fsl-imx8qm-lvds-phy: Fix missing pm_runtime_disable() on probe error path
d31244d1732e phy: freescale: phy-fsl-imx8qm-lvds-phy: Use synchronous PM runtime put in reset
393f0bb61545 PCI: mediatek: Use actual physical address instead of virt_to_phys()
f66b4e65c4cc dt-bindings: phy: sc8280xp-qmp-pcie: Disallow bifurcation register on Purwa
e30fa32cd078 dt-bindings: dma: snps,dw-axi-dmac: Add fallback compatible for CV1800B
65a406f5bbd9 perf symbols: Add bounds checks to read_build_id() note iteration in minimal build
e525be3207ed perf symbols: Add bounds checks to elf_read_build_id() note iteration
802257fbe4ea perf bpf: Fix metadata leak in perf_env__add_bpf_info() on duplicate insert
7e841b7b1014 perf bpf: Fix map data leak in bpf_metadata_create() on alloc failure
77373bfa2564 perf bpf: Add NULL check for btf__type_by_id() in synthesize_bpf_prog_name()
df7d723d66bd tools lib api: Fix mount_overload() snprintf truncation and toupper range
62adda4bb1b8 tools lib api: Fix filename__write_int() writing uninitialized stack data
908bc5238979 perf tools: Use snprintf() in dso__read_running_kernel_build_id()
1577822e1fa1 perf hwmon: Guard label read against empty or failed reads
2bfaa207732a perf tools: Fix uninitialized pathname on uncompressed fallback in filename__decompress()
a11731df15af perf symbols: Bounds-check descsz in sysfs__read_build_id() GNU fallback
354a61c752ea perf hwmon: Fix parse_hwmon_filename() strlcpy buffer overflow
f99e250f8085 perf hwmon: Use scnprintf() in hwmon_pmu__for_each_event()
4c7ed5f4ff36 perf hwmon: Fix off-by-one null termination on sysfs reads
6290c0c0fb2b perf tools: Fix thread__set_comm_from_proc() on empty comm file
8532c1725abb perf intel-pt: Fix snprintf size tracking bug in insn decoder
5e5b4cfffb4a perf tools: Use mkostemp() for O_CLOEXEC on temporary files
51d3124590bc perf symbols: Bounds-check .gnu_debuglink section data
519b4ad15b2c perf symbols: Fix signed overflow in sysfs__read_build_id() size check
b4333af83c12 tools lib api: Fix missing null termination in filename__read_int/ull()
a407a5177cd1 perf pmu: Fix perf_pmu__parse_scale/unit() OOB access on empty sysfs file
1202ebd3a9b4 perf pmu: Fix pmu_id() heap underwrite on empty identifier file
4d72f46d420f perf cs-etm: Queue context packets for frontend
c091fe7073b0 perf data convert json: Fix addr_location leak on time-filtered samples
d625d9b320c2 perf s390: Fix TEXTREL in Python extension by compiling as PIC
31298d37687b xprtrdma: Return sendctx slot after Send preparation failure
d7c531ab477a xprtrdma: Repost Receive buffers for malformed replies
33db78b1b24f xprtrdma: Sanitize the reply credit grant after parsing
118a16a18c59 xprtrdma: Fix bcall rep leak and unbounded peek
69c956c1b67d xprtrdma: Resize reply buffers before reposting receives
96da53e7d6f9 xprtrdma: Document and assert reply-handler invariants
ef3b79edf14b xprtrdma: Check frwr_wp_create() during connect
264ccd787191 xprtrdma: Initialize re_id before removal registration
ffc077905397 xprtrdma: Fix ep kref imbalance on ADDR_CHANGE
f025990647c8 perf tools: Use scnprintf() in build_id__snprintf() and hwmon read_events()
a6d9b8184656 perf hists: Fix snprintf() in hists__scnprintf_title() UID filter path
5f3b8ff3f632 perf bpf: Use scnprintf() in snprintf_hex() and synthesize_bpf_prog_name()
01d67b6f44ed perf tools: Add O_CLOEXEC to open() calls in DSO and ELF code
a757d523741d perf sched: Fix idle-hist callchain display using wrong rb_first variant
23af74f538b7 perf sched: Bounds-check prio before test_bit() in timehist
2c0461f5393b PCI: rcar-host: Remove unused LIST_HEAD(res)
027c177da2b5 perf tools: NULL bitmap pointers after bitmap_free()
eb266a14c16a perf tools: Use perf_env__get_cpu_topology() in machine__resolve()
36d2c15a33ec perf tools: Use scnprintf() in cpu_map__snprint() to prevent overflow
678bb88bb977 perf tools: Fix get_max_num() size_t underflow on empty sysfs file
962c7a1f8f1e platform/x86/intel/vsec: Restore BAR fallback for header walk
c99444f6dfca fs/ntfs3: resize log->one_page_buf when adopting on-disk page size
7ae7e98b7143 fs/ntfs3: prevent potential lcn remains uninitialized
b052df3a5953 virtio: add missing kernel-doc for map and vmap members
a2cc03ee5d34 lockd: Correct kernel-doc status descriptions for NLMv4 GRANTED
ec52cdcbf23f PCI: meson: Add missing remove callback
221972a90c56 PCI: meson: Propagate devm_add_action_or_reset() failure
f966db2568c4 pwm: rzg2l-gpt: Add missing newlines to dev_err_probe() messages
fa7ce7dfbd2d PCI: mediatek: Fix operator precedence in PCIE_FTS_NUM_L0 macro
e68035178e65 nfs: use nfsi->rwsem to protect traversal of the file lock list
51e5adebef61 NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS in pg_get_mirror_count_write
0fe1ac2bda64 NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS on fatal DS connect errors
7471673936d1 nfs: keep PG_UPTODATE clear after read errors in page groups
72c578ca2f9e NFSv4/pnfs: defer return_range callbacks until after inode unlock
8203f760a72b xprtrdma: Decouple req recycling from RPC completion
7c42bc9cb7d3 xprtrdma: Use sendctx DMA state for Send signaling
fa977d37765b pNFS/filelayout: fix cheking if a layout is striped
f0dfbca47b9e sunrpc: Fix error handling in rpc_sysfs_xprt_switch_add_xprt_store()
e2414f2a3f12 clk: qcom: a53: Corrected frequency multiplier for 1152MHz
65e82fa24965 dmaengine: dma-axi-dmac: use DMA pool to manange DMA descriptor
f055829151ee dmaengine: dma-axi-dmac: Properly free struct axi_dmac_desc
0bc191050c32 dmaengine: Fix possible use after free
c1a2159c1100 dmaengine: qcom: gpi: set DMA_PRIVATE capability
fb372cbccab6 mshv: add bounds check on vp_index in mshv_intercept_isr()
89acfa8ad3af docs: memfd_preservation: fix rendering of ABI documentation
2ce2a2e19b62 clk: qcom: camcc-x1e80100: Add support for camera QDSS debug clocks
ca461a2a7390 dt-bindings: clock: qcom: Add X1P42100 camera clock controller
a0c08cdaf63a perf sched: Free callchain nodes in idle thread cleanup
5e7c076511bf perf tools: Fix int16_t truncation of max_cpu_num in set_max_cpu_num()
cb47a3546f52 perf timechart: Fix cpu2y() OOB read on untrusted CPU index
231acb6d0e14 perf c2c: Fix use-after-free in he__get_c2c_hists() error path
423c520416d7 perf stat: Introduce perf_env__get_cpu_topology() to guard NULL env->cpu
6cfa75ce9a82 perf mmap: Fix NULL deref in aio cleanup on alloc failure
f09f7be6bba1 perf sched: Replace BUG_ON and add NULL checks in replay event helpers
6380a4f550dc perf sched: Use thread__put() in free_idle_threads()
1f0a529864d8 perf sched: Fix thread reference leak in idle hist processing
3ba9b69aef73 perf sched: Use is_idle_sample() for idle thread runtime cast guard
340b08cfa751 perf sched: Clean up idle_threads entry on init failure
4884cfb0d36d perf c2c: Bounds-check CPU IDs in setup_nodes() topology loop
937be22cf6d2 perf c2c: Bounds-check CPU and node IDs before bitmap and array access
9cbb9f3e532e perf stat: Bounds-check CPU index in topology aggregation callbacks
5257dfb9619c perf mmap: Guard cpu__get_node() return in aio_bind()
5ea1dcc9418c perf sched: Fix register_pid() overflow, strcpy, and BUG_ON
68b6157d2c62 perf sched: Cap max_cpu at MAX_CPUS in timehist sample processing
380ad7297fa0 perf sched: Fix thread reference leaks in timehist_get_thread()
6587c61570f4 perf tools: Add bounds check to cpu__get_node()
bd027a461624 perf tools: Guard remaining test_bit calls from OOB sample CPU
e94a56aac6b4 perf sched: Fix comp_cpus heap overflow with cross-machine recordings
70d31bdd3789 perf sched: Fix NULL dereference in latency_runtime_event
bbaa0a0441d2 perf sched: Replace BUG_ON on invalid CPU with graceful skip
a4ec6bf24145 perf sample: Add file_offset field to struct perf_sample
b189fce8d2ac perf sched: Fix thread reference leak in latency_switch_event
d88a630bacfa perf tools: Guard test_bit from out-of-bounds sample CPU
885bd036cbdf perf annotate: Fix crashes on empty annotate windows
25b1f78ef352 perf: Fix off-by-one stack buffer overflow in kallsyms__parse()
4442e8c8f20f dt-bindings: dma: nvidia,tegra186-gpc-dma: Make reset optional
4e8f512e2b8f dmaengine: imx-sdma: Refine spba bus searching in probe
3ea71aa629a7 thunderbolt: debugfs: Fix margining error counter buffer leak
994a42b890ce drm/amd/display: Add missing kdoc for ALLM parameters
668791009a21 fs/ntfs3: fix mount failure on 64K page-size kernels
bc95e2f61192 ntfs3: avoid another -Wmaybe-uninitialized warning
3cd2212012c0 ntfs3: Allocate iomap inline_data using alloc_page
ff825bf0521f fs/ntfs3: call _ntfs_bad_inode() when failing to rename
1f6111ad30d2 fs/ntfs3: fix wrong LCN in run_remove_range() when splitting a run
41081202eb82 fs/ntfs3: add bounds check to run_get_highest_vcn()
3dcdf8ddb509 clk: spacemit: k3: Fix PCIe clock register offset
0b4739fc72db clk: spacemit: k3: Switch to pll2_d6 as parent for PCIe clock
d823ab4592b3 docs: changes.rst: restore pahole 1.26 minimum (regressed by sort)
83d87cbfa3aa HID: logitech-hidpp: remove excess kernel-doc member in hidpp_scroll_counter
b7ef2eb23936 clk: at91: keep securam node alive while mapping it
8c00cabb1982 iio: tcs3472: power down chip on probe failure
f3d413e701c5 iio: accel: mma8452: handle I2C read error(s) in mma8452_read()
3c374d33f133 iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling
fb27ebf81136 iio: magnetometer: ak8975: fix potential kernel stack memory leak
7f167853ef3c iio: light: si1133: prevent race condition on timeout
2413ede67e39 iio: light: si1133: reset counter to prevent race condition
8e8b52ad5ab5 perf header: Validate bitmap size before allocating in do_read_bitmap()
ea63c57eb2f1 perf header: Sanity check HEADER_EVENT_DESC attr.size before swap
27ca3f615c1a timers/migration: Update stale @online doc to @available
d61e42f63a00 PCI: qcom: Disable ASPM L0s for SA8775P
c764d5092b92 powerpc tools perf: Initialize error code in auxtrace_record_init function
0e1db8dc4623 docs: threat-model: add missing closing parenthesis
789d1b0e1118 clk: renesas: rzg2l: Rename iterator in for_each_mod_clock() to avoid shadowing
f15a545f7518 gpib: cb7210: Fix region leak when request_irq fails
8b5f1d295dda gpib: fix double decrement of descriptor_busy in command_ioctl()
a41f0fbd77ae sonypi: Check ACPI_COMPANION() against NULL at probe time
99a34d028293 hpet: Check ACPI_COMPANION() against NULL at probe time
42223445607a char: tlclk: fix use-after-free in tlclk_cleanup()
49489a18afa5 gpib: Fix inappropriate ioctl error return
ecdd8af41197 perf test amd ibs: Fix incorrect kernel version check
684a58dd845e usb: host: max3421: Reject hub port requests for non-existent ports
4da073d57176 usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control()
7fc162453cfb staging: most: video: avoid double free on video register failure
b1493c42183f perf inject: Fix itrace branch stack synthesis
034182b63108 perf event: Fix size of synthesized sample with branch stacks
7e374ac7702b perf build-id: Fix off-by-one bug when printing kernel/module build-id
8b54808fcced clk: microchip: mpfs-ccc: fix peripheral driver registration failures after oob fix
b670ac2731dd platform/x86: classmate-laptop: Address memory leaks on driver removal
ce5633204a4b PCI: mediatek-gen3: Fix incorrectly skipped pwrctrl error message
e31173a19466 PCI: dwc: Fix signedness bug in fault injection test code
8ca9adc80588 coresight: platform: defer connection counter increment until alloc succeeds
f344f6ae8517 PCI/pwrctrl: Lock device when calling device_is_bound()
ac8a86dcaf59 mailbox: don't free the channel if the startup callback failed
25d6ea6c76e1 mailbox: mtk-adsp: fix UAF during device teardown
8ceeb0541978 mailbox: mpfs: fix check for syscon presence in mpfs_mbox_inbox_isr()
80cf6501acb9 PCI: mediatek-gen3: Do full device power down on removal
8c1dac9c05d4 coresight: Handle helper enable failure properly
c37f87151990 coresight: Fix source not disabled on idr_alloc_u32 failure
81ed540159ef soundwire: intel_ace2x: release bpt_stream when close it
abdfdb8e6220 iio: light: acpi-als: Check ACPI_COMPANION() against NULL
14622b111e4e clk: at91: sam9x7: Fix gmac_gclk clock definition
8a7a8ac82791 perf pmu: Skip test on Arm64 when #slots is zero
03dda04f2f76 perf unwind: Refactor get_entries to allow dynamic libdw/libunwind selection
9810f833df66 perf pmu-events AMD: Switch l2_itlb_misses to bp_l1_tlb_miss_l2_tlb_miss.all
cb329b1fa702 phy: phy-can-transceiver: Check driver match and driver data against NULL
0ba6fd199192 PCI: qcom: Set max OPP before DBI access during resume
72a7bfee9fe8 PCI: dwc: Apply ECRC workaround for DesignWare cores prior to 5.10a
f478709f7be8 dt-bindings: clock: qcom,sm6125-dispcc: reference qcom,gcc.yaml
6c7f2108af20 clk: qcom: cmnpll: Account for reference clock divider
d1da8fcb8802 coresight: fix missing error code when trace ID is invalid
adec0b0df4e2 bus: mhi: ep: Add missing state_lock protection for mhi_state access
e30fa2246972 bus: mhi: ep: Fix potential deadlock in mhi_ep_reset_worker()
34b2a1076dd7 rust: alloc: fix assert in Vec::reserve doc test
1f95260a8237 PCI: loongson: Do not ignore downstream devices on external bridges
f62ffd973b07 PCI: intel-gw: Add .start_link() callback
b2dd40f1d15e PCI: intel-gw: Enable clock before PHY init
28c35ea3515f PCI: intel-gw: Move interrupt enable to own function
fc9d6f815871 perf tool: Fix missing schedstat delegates and dont_split_sample_group in delegate_tool
6ed3cea56b77 perf sched: Add missing mmap2 handler in timehist
f05c3b4c9cc0 platform/x86: xo15-ebook: Fix wakeup source and GPE handling
df6d71c9a818 x86/platform/olpc: xo15: Drop wakeup source on driver removal
721ad5b72448 PCI: Check ROM header and data structure addr before accessing
4e82818ead50 PCI: Introduce named defines for PCI ROM
d50ba5e4642c PCI/ASPM: Don't reconfigure ASPM entering low-power state
12007c55d9c0 coresight: etm4x: Correct TRCVMIDCCTLR1 save and restore
293dacd5b6a9 coresight: ete: Always save state on power down
9d802907fc2a coresight: tmc: Fix overflow when calculating is bigger than 2GiB
e483a406a23a soundwire: fix bug in sdw_add_element_group_count found by syzkaller
f0481e6bcc5d soundwire: don't program SDW_SCP_BUSCLOCK_SCALE on a unattached Peripheral
fbd5d3168740 coresight: cti: Fix DT filter signals silently ignored
2830eedfcc7d perf callchain: Handle multiple address spaces
ffddd64eae0b perf debuginfo: Fix libdw API contract violations
2a86103b44af perf annotate-data: Fix libdw API contract violations
881af00c02c0 perf probe-finder: Fix libdw API contract violations
d739d9f4525b perf libdw: Fix libdw API contract violations and memory leaks
e542c8800bbc perf srcline: Introduce inline_node__clear_frames()
eb0062b3e76d perf dwarf-aux: Fix libdw API contract violations
23ec342a8fa6 perf dwarf-aux: Fix libdw segmentation fault in cu_walk_functions_at
5de04caa46b6 staging: nvec: fix use-after-free in nvec_rx_completed()
fde2296f87b7 staging: rtl8723bs: fix stainfo check in rtw_aes_decrypt
697af8745d5c i3c: master: svc: Fix missed IBI after false SLVSTART on NPCM845
b0194db10032 gpiolib: acpi: Only trigger ActiveBoth interrupts on boot
4791b91daeb1 eventpoll: Fix epoll_wait() report false negative
8679e9e06876 eventpoll: rename epi->next and txlist for clarity
b698ee9abf40 eventpoll: expand top-of-file overview / locking doc
0c44866f4a23 9p: Add missing read barrier in virtio zero-copy path
ebbcbe5c0db2 net/9p: fix race condition on rdma->state in trans_rdma.c
fdc9043cfd50 9p: avoid returning ERR_PTR(0) from mkdir operations
f3dd1e534e9d ocfs2: fix circular locking dependency in ocfs2_dio_end_io_write
17d79248b4f3 mfd: cs42l43: Sanity check firmware size
afb1a5af6dd9 mfd: rsmu: Fix page register setup
e18ffb7541de mfd: bd72720: Drop BUCK11 ID
0ff82a9cf931 ksmbd: fix use-after-free in same_client_has_lease()
2fface6e0bbd net: serialize netif_running() check in enqueue_to_backlog()
bde37aed0724 RDMA/irdma: Replace waitqueue and flag with completion
bc4caea7a82b RDMA/hns: Fix memory leak of bonding resources
967099102562 RDMA/bnxt_re: Reject GET_TOGGLE_MEM when toggle page was not allocated
03c9a2fba68e RDMA/bnxt_re: Fail DBR related page allocation UAPIs if the feature is disabled
da406b8b49c1 RDMA/bnxt_re: Avoid repeated requests to allocate WC pages
303f6fef95df RDMA/bnxt_re: Proper rollback if the ioremap fails
a59d815cbe66 RDMA/bnxt_re: Add a max slot check for SQ
a65b5258b14c RDMA/bnxt_re: Enable app allocated QPs
6eceb09df972 RDMA/bnxt_re: Support doorbells for app allocated QPs
2234acd1d1d2 RDMA/bnxt_re: Enhance dbr usecnt logic in doorbell uapis
3169824fd8f4 RDMA/bnxt_re: Update msn table size for app allocated QPs
7605fd8bbf4d RDMA/bnxt_re: Refactor bnxt_re_init_user_qp()
0c403e078676 RDMA/bnxt_re: Avoid displaying the kernel pointer
b193854675ec RDMA/bnxt_re: Free CQ toggle page after firmware teardown
0adcd67f3d6f RDMA/bnxt_re: Free SRQ toggle page after firmware teardown
3d00b375853f RDMA/bnxt_re: Initialize dpi variable to zero
5126f099295c ionic: Fix check in ionic_get_link_ext_stats
d01d4cfc806a net: ethernet: oa_tc6: Remove FCS size in RX frame
785e3765bf9a net: ti: icssg: Use undirected TX tag for XDP zero copy in HSR offload mode
40a91dcc6260 net: ti: icssg: Use undirected TX tag for native XDP in HSR offload mode
b478a6ffda4e net: ti: icssg-prueth: Fix AF_XDP fill ring alloc and wakeup condition
ad262d2b96be net: airoha: Fix always-true condition in PPE1 queue reservation loop
a210791f3334 tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF)
35e0297a93c3 tipc: fix UAF in tipc_l2_send_msg()
d2fb2ef76008 KEYS: Use acquire when reading state in keyring search
c893bfb0d696 powerpc/kexec: fix double get_cpu() imbalance in kexec_prepare_cpus
e4e69cee0b01 powerpc/powernv: fix preempt count leak in pnv_kexec_wait_secondaries_down
b504fd953664 powerpc/perf: fix preempt count underflow in fsl_emb_pmu_del
038f068cced8 MIPS: mm: Fix out-of-bounds write in maar_res_walk()
e09f7bd72739 bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check
39d44ed6904b sockmap: Fix use-after-free in udp_bpf_recvmsg()
bd004716ba75 bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data()
478c7f68ef25 udf: fix nls leak on udf_fill_super() failure
c12e3c9e5224 bpf: Fix bpf_get/setsockopt to tos for ipv4-mapped ipv6 socket
e68343ee3c13 selftests/bpf: Initialize operation name before use
85100de4f473 selftests/bpf: Fix typo in verify_umulti_link_info
c6d51ad36490 bpf: Guard __get_user acesss with access_ok for uprobe_multi data
590d696f846a btrfs: Drop WQ_PERCPU from ordered_flags in btrfs_init_workqueues()
2bc610c9db5d smb/client: always return a value for FS_IOC_GETFLAGS
7839f1817a0c cifs: remove all cifs files before kill super
018b3c8248f5 smb: client: fix conflicting option validation for new mount API
b8ca5fcc3182 ALSA: core: Fix unintuitive behavior of snd_power_ref_and_wait()
1e8ff78520d9 geneve: Fix off-by-one comparing with GRO_LEGACY_MAX_SIZE
edf234f71fb3 netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them
db50e2d289b6 netfilter: nf_conncount: callers must hold rcu read lock
1c4c35fb68d5 ALSA: seq: avoid stale FIFO cells during resize
43e10709b1ba ALSA: seq: oss: Serialize readq reset state with q->lock
9684fff87124 kcm: use WRITE_ONCE() when changing lower socket callbacks
6b638db5ec06 net: airoha: Fix debugfs new-tuple display for IPv4 ROUTE entries
2ac37fca3052 net: airoha: Fix register index for Tx-fwd counter configuration
be55f99a0b08 octeontx2-af: fix NPC mailbox codes in mbox.h
6be4da4f5a16 net: bcmgenet: Use weighted round-robin TX DMA arbitration
d0de5037dce5 landlock: Fix unmarked concurrent access to socket family
467ae77921ad dpll: balance create/delete notifications in _dpll_pin(un)register
8c48e6581c43 dpll: guard sync-pair removal on full pin unregister
dc37a9a94954 dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister()
0ea6703cb3dc dpll: send delete notification before unregister in on-pin rollback
75a52d107203 dpll: fix stale iteration in dpll_pin_on_pin_unregister()
4c1b25d85f4c net: wwan: t7xx: check skb_clone in control TX

…

View originalPermalink

6.18.40-xanmod1

Jul 25, 2026 · 6 days ago

Fixed 20

RDMA/bnxt_re: Avoid repeated requests to allocate WC pages
RDMA/bnxt_re: Initialize dpi variable to zero
ksmbd: fix durable reconnect double-bind race in ksmbd_reopen_durable_fd
perf callchain: Handle multiple address spaces
seqlock: fix scoped_seqlock_read kernel-doc
perf inject: With --convert-callchain ignore the dummy event for dwarf stacks
PCI: Fix Resizable BAR restore order
PCI: Fix BAR resize rollback path overwriting ret
perf symbol: Fix ENOENT case for filename__read_build_id
pinctrl: airoha: fix pinctrl function mismatch issue
bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized
iommufd: Move vevent memory allocation outside spinlock
iommufd: Propagate allocation failure in iommufd_veventq_deliver_fetch()
KVM: arm64: nv: Re-translate VNCR before injecting abort
KVM: arm64: Fix propagation of TLBI level in kvm_pgtable_stage2_relax_perms()
KVM: arm64: Ensure level is always initialized when relaxing perms
btrfs: fix incorrect buffered IO fallback for append direct writes
btrfs: fix false IO failure after falling back to buffered write
crypto: qat - fix restarting state leak on allocation failure
crypto: atmel-sha204a - fail on hwrng registration error in probe path

44db62f5aa97 Linux 6.18.40-xanmod1
8b49b49d26aa Merge tag 'v6.18.40' into 6.18
221fc2f4d0ed Linux 6.18.40
478c4d24193f RDMA/bnxt_re: Avoid repeated requests to allocate WC pages
b87cbd4d198a RDMA/bnxt_re: Initialize dpi variable to zero
81e6faa5b640 ksmbd: fix durable reconnect double-bind race in ksmbd_reopen_durable_fd
1badb6866482 perf callchain: Handle multiple address spaces
275eb3993094 seqlock: fix scoped_seqlock_read kernel-doc
453cb79a1564 perf inject: With --convert-callchain ignore the dummy event for dwarf stacks
2764d031efd6 PCI: Fix Resizable BAR restore order
2fb74141ec54 PCI: Fix BAR resize rollback path overwriting ret
7425e7d82cb9 perf symbol: Fix ENOENT case for filename__read_build_id
a888f3d5970f pinctrl: airoha: fix pinctrl function mismatch issue
267fdd9b6530 bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized
779480ea7955 iommufd: Move vevent memory allocation outside spinlock
73b5d5cb1f5a iommufd: Propagate allocation failure in iommufd_veventq_deliver_fetch()
ea7a76d7d614 KVM: arm64: nv: Re-translate VNCR before injecting abort
459adfc6cd35 KVM: arm64: Deduplicate ASID retrieval code
9d360fb820a3 samples/damon/mtier: fail early if address range parameters are invalid
ec976851ad93 mm/damon/core: trace esz at first setup
3b91c35961fa mm/damon/core: always put unsuccessfully committed target pids
ba37cd4d8a75 KVM: arm64: Fix propagation of TLBI level in kvm_pgtable_stage2_relax_perms()
19d9996435db KVM: arm64: Ensure level is always initialized when relaxing perms
c3a3d3986719 btrfs: fix incorrect buffered IO fallback for append direct writes
998ee7f01ecf btrfs: fix false IO failure after falling back to buffered write
a4497a122e27 crypto: qat - fix restarting state leak on allocation failure
6c78081d047c btrfs: remove folio parameter from ordered io related functions
1a648c50a505 btrfs: replace for_each_set_bit() with for_each_set_bitmap()
99d4ae3fbb5b btrfs: concentrate the error handling of submit_one_sector()
382fd8004cc6 crypto: atmel-sha204a - fail on hwrng registration error in probe path
952db4b985c7 usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile
69faa3779250 usb: gadget: f_fs: initialize reset_work at allocation time
8a2fdbf92cdc functionfs: use spinlock for FFS_DEACTIVATED/FFS_CLOSING transitions
5fb0b09180a0 functionfs: switch to simple_remove_by_name()
4744f07f6bb7 functionfs: don't bother with ffs->ref in ffs_data_{opened,closed}()
901c036cf625 functionfs: don't abuse ffs_data_closed() on fs shutdown
c3e686025210 new helper: simple_remove_by_name()
509b51327320 usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect()
b78826a65799 usb: atm: ueagle-atm: remove function entry/exit debug messages
6e5ef54b884f usb: atm: ueagle-atm: use dev_dbg() for 'device found' message
41a4e80d5af0 usb: dwc3: fix dwc3_readl() and dwc3_writel() calls in dwc3_ulpi_setup()
e534790c4c27 usb: dwc3: Support USB3340x ULPI PHY high-speed negotiation.
bce232923aa9 xfs: use bio_reuse in the zone GC code
adadb181ad42 xfs: only log freed extents for the current RTG in zoned growfs
47c0e0743302 xfs: add a xfs_groups_to_rfsbs helper
57454944737f bpf: Allow LPM map access from sleepable BPF programs
8fccaeeb9e9c bpf: Consistently use bpf_rcu_lock_held() everywhere
0b92ad64d6e4 bpf: Keep dynamic inner array lookups nullable
c447be8d88c3 bpf: Introduce struct bpf_map_desc in verifier
dccb3c557879 bpf: Consistently use reg_state() for register access in the verifier
60eed4467429 xfs: initialize iomap->flags earlier in xfs_bmbt_to_iomap
607217f7ad41 hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length
7676ea09beb5 hfs/hfsplus: prevent getting negative values of offset/length
f9b4b03ccc9c proc: protect ptrace_may_access() with exec_update_lock (part 1)
07bf18dc63f7 seqlock: Change do_task_stat() to use scoped_seqlock_read()
c897fd63762e seqlock: Introduce scoped_seqlock_read()
497c6bae5167 proc: protect ptrace_may_access() with exec_update_lock (FD links)
903d78e5aca7 proc: rename proc_setattr to proc_nochmod_setattr
b56400364aed ksmbd: validate NTLMv2 response before updating session key
74c2f0ffb81c ksmbd: Use HMAC-MD5 library for NTLMv2
51c5f7e84cfe ksmbd: Use HMAC-SHA256 library for message signing and key generation
bd27d9504d20 ksmbd: Use SHA-512 library for SMB3.1.1 preauth hash
427faaa52b0b ksmbd: track the connection owning a byte-range lock
6a37bc484f12 ksmbd: centralize ksmbd_conn final release to plug transport leak
c7c884a1305a ksmbd: fix path resolution in ksmbd_vfs_kern_path_create
e205f3e7e8c3 ksmbd: use opener credentials for FSCTL mutations
90a93fb3230c cifs: SMB1 split: Add some #includes
ff943e1f3d31 cifs: SMB1 split: Rename cifstransport.c
36da806f7fba Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()
6d0eeebe22ba Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister
ef382a6baf0a media: nxp: imx8-isi: Fix use-after-free on remove
4278953ff0cd media: nxp: imx8-isi: use devm_pm_runtime_enable() to simplify code
49cd5ac6de8d crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()
4b51ee8a40fe staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr()
5d76bc296bb5 staging: rtl8723bs: fix spaces around binary operators
48323ebaeeee staging: rtl8723bs: core: move constants to right side in comparison
73cc54326de4 PCI: Skip Resizable BAR restore on read error
f33837a75447 PCI: Move Resizable BAR code to rebar.c
2242c75b6328 PCI: Add kerneldoc for pci_resize_resource()
4b5322f0002a PCI: Fix restoring BARs on BAR resize rollback path
c18646165f21 PCI: Free saved list without holding pci_bus_sem
534f20cdddc3 PCI: Try BAR resize even when no window was released
dbb1d8507dd9 PCI: Change pci_dev variable from 'bridge' to 'dev'
0d1c263e6fd7 PCI/IOV: Adjust ->barsz[] when changing BAR size
0dfad346c293 PCI: imx6: Configure REF_USE_PAD before PHY reset for i.MX95
e53d54b92f0c PCI: imx6: Fix reference clock source selection for i.MX95
1228926e1e4d binder: cache secctx size before release zeroes it
79ac87bb1a4c binder: Use LIST_HEAD() to initialize on stack list head
7ed120b1a007 vfio/mlx5: Fix racy bitfields and tighten struct layout
f8272331da87 ALSA: hda/tas2781: Cancel async firmware request at unbind
6438d0707087 firmware_loader: Add cancel helper for async requests
1ed7ff33cfc8 ALSA: scarlett2: Update offsets for 2i2 Gen 4 firmware 2417
ad5c5bdb0f58 ALSA: scarlett2: Allow selecting config_set by firmware version
2745574697ee iio: hid-sensor-rotation: Fix stale or zero output when reading raw values
7f680924c5c2 ACPI: NFIT: core: Fix possible deadlock and missing notifications
cf5f93228e7a ACPI: NFIT: core: Use devm_acpi_install_notify_handler()
d57d2aae87b2 ACPI: bus: Introduce devm_acpi_install_notify_handler()
34f4d0e4e506 ACPI: driver: Check ACPI_COMPANION() against NULL during probe
3b2628f7682a ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup
83f29da85dc9 crypto: xilinx-trng - Remove crypto_rng interface
f84c0bae0e8d mmc: sdhci-esdhc-imx: fix resume error handling
174dc8103ab7 mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend
5b8f11cbe8ad mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend
4f96903e2fd2 mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt
aa276aa6cbfb mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore
52990f6b5752 mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume
eefcd3ca245c mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore
c02237966c19 mmc: sdhci-of-dwcmshc: check bus clock enable result in the probe() method
8d94498cc445 mmc: block: fix RPMB device unregister ordering
cf7258f57d18 mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout
4b5de4007e5b mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout
de2bc884d887 mtd: rawnand: fsl_ifc: return errors for failed page reads
bf9848a22a8e mmc: vub300: defer reset until cmd_mutex is unlocked
04ebd3766861 mtd: mchp23k256: use SPI match data for chip caps
ac2d9f6b4f90 mtd: onenand: samsung: report DMA completion timeouts
a59cfa165aee wifi: mwifiex: fix permanently busy scans after multiple roam iterations
b8df3a993f69 wifi: mac80211: free ack status frame on TX header build failure
90576bd6921a wifi: ieee80211: validate MLE common info length
584657c5fc58 wifi: cfg80211: validate EHT MLE before MLD ID read
3c1e92f75e11 powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access()
82753ac86cb3 reset: sunxi: fix memory region leak on ioremap failure
3fb7edd2018b ipvs: reload ip header after head reallocation
d4ec18f48ce7 ipvs: fix more places with wrong ipv6 transport offsets
39151f0708c8 memstick: ms_block: reject a card that reports too many blocks
a75d2b5249e3 macsec: fix promiscuity refcount leak in macsec_dev_open()
fd701fc0d065 llc: fix SAP refcount leak when creating incoming sockets
6744ab60dfac Bluetooth: btrtl: validate firmware patch bounds
dbd14f736be0 net: openvswitch: reject oversized nested action attrs
6926d13865aa regulator: ltc3676: Fix incorrect IRQSTAT bit offsets
688bd4c6144d riscv: vdso: Do not use LTO for the vDSO
55b26abb1fa1 wifi: brcmfmac: cyw: fix heap overflow on a short auth frame
bdc0b8bfdc14 wifi: mac80211: fix memory leak in ieee80211_register_hw()
65446b85595a wifi: mwifiex: fix roaming to different channel in host_mlme mode
816559409e34 wifi: rt2x00: avoid full teardown before work setup in probe
262da8b6ea03 net/mlx5: free mlx5_st_idx_data on final dealloc
9b8df4da2cf7 powerpc/pseries: fix memory leak on krealloc failure in papr_init
afa0db5322c5 mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume
d94160a5d1ac selftests/landlock: Fix screwed up pointers in the scoped_signal_test
ba481c0b5376 selftests/landlock: Skip scoped_signal subtest with MSG_OOB if not available
4ff3960f3527 pmdomain: imx: Fix i.MX8MP VC8000E power up sequence
9a0464fcfae4 pmdomain: imx: Fix i.MX8MP power notifier
c844b7d9a958 cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed
8131a91fe2de selftests/rseq: Fix a building error for riscv arch
3dfec7490f3a s390/mm: Fix type mismatch in get_align_mask().
c6b4d454865a s390/diag: Add missing array_index_nospec() call to memtop_get_page_count()
fad36954b295 tracing/osnoise: Call synchronize_rcu() when unregistering
eadd0c2c76ae riscv: Prevent NULL pointer dereference in machine_kexec_prepare()
38cc4867540a drbd: reject data replies with an out-of-range payload size
91ec52dd2a5d ata: libata-core: Allow capacity transition to zero for locked drives
7a9a69641b68 ata: libata-core: Skip HPA resize for locked drives
52007bfdce53 fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list
1155a9d0a2e0 fs/resctrl: Free mon_data structures on rdt_get_tree() failure
ccdf1770a4ba cpu/hotplug: Fix NULL kobject warning in cpuhp_smt_enable()
5f5783c7806f arm64: smp: Fix hot-unplug tearing by forcing unregistration
26b131b2d5b5 net: macb: drop in-flight Tx SKBs on close
b2f426a9a228 dibs: loopback: validate offset and size in move_data()
2cf10d042562 macsec: don't read an unset MAC header in macsec_encrypt()
83fb4c2c5344 ipvs: reset full ip_vs_seq structs in ip_vs_conn_new
247d055504dc ipvs: use parsed transport offset in SCTP state lookup
61a7ff4a6200 llc: fix SAP refcount leak in llc_ui_autobind()
685fb410d90e selftests: net: make busywait timeout clock portable
5df30f05db96 octeontx2-pf: fix SQB pointer leak on init failure
77caf2d6eba7 mac802154: remove interfaces with RCU list deletion
f0745496f7c1 s390/monwriter: Reject buffer reuse with different data length
a5a367756926 irqchip/irq-riscv-imsic-early: Fix fwnode leak on state setup failure
018d7ad26cb8 mm/compaction: handle free_pages_prepare() properly in compaction_free()
2faf0198168d riscv: probes: save original sp in rethook trampoline
d8d4fa0c4f81 hwmon: (asus_atk0110) Check package count before accessing element
07f5eb6d268a net: wwan: iosm: bound device offsets in the MUX downlink decoder
1286a4156333 ata: pata_pxa: Fix DMA channel leak on probe error
1dce4f4bb3c1 net/mlx5: HWS, fix matcher leak on resize target setup failure
82fc886e244c orangefs: keep the readdir entry size 64-bit in fill_from_part()
2c76c01a505c tracing/probes: Fix double addition of offset for @+FOFFSET
b4427ee3667c hwmon: (max1619) add missing 'select REGMAP' to Kconfig
6c52226072a3 fhandle: reject detached mounts in capable_wrt_mount()
e2b7ee61989f net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked
5889064919a1 net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked
99a6f37b113c net: lan743x: Initialize eth_syslock spinlock before use
ac58088d70b8 fsl/fman: Free init resources on KeyGen failure in fman_init()
f0aad157576d hwmon: (occ) unregister sysfs devices outside occ lock
715cce38424f net: liquidio: fix BAR resource leak on PF number failure
664480021f6a hwmon: (w83793) remove vrm sysfs file on probe failure
c6c990f7208c hwmon: (w83627hf) remove VID sysfs files on error and remove
8dc6c7e8c967 rtc: mpfs: fix counter upload completion condition
6e21d1253ef1 rtc: renesas-rtca3: Fix PIE clear polling condition in alarm setup error path
6c98ccdb9a09 bnx2x: fix potential memory leak in bnx2x_alloc_mem_bp()
f5c506596302 ipmi: fix refcount leak in i_ipmi_request()
a66d45e0ce6d espintcp: use sk_msg_free_partial to fix partial send
ddbb6e3dc9bb ipmi: Fix user refcount underflow in event delivery
a65f49b6f7ec LoongArch: Fix missing dirty page tracking in {pte,pmd}_wrprotect()
20ac8131f8c9 LoongArch: Fix nr passing in set_direct_map_valid_noflush()
612cda6630f2 pwm: rzg2l-gpt: Fix period_ticks type from u32 to u64
4b73889941b9 selftests/bpf: Add simple strscpy() implementation
da7f17c2d5bb KVM: TDX: Account all non-transient page allocations for per-TD structures
d0cc2c74060b drm/xe/userptr: Stub notifier_lock helpers when DRM_GPUSVM=n
6cec36c795c0 net/sched: sch_teql: move rcu_read_lock()/spin_lock() from _bh variants
55da782eb454 platform/x86/amd/pmc: Avoid logging "(null)" for DMI values
35267819b250 gve: fix header buffer corruption with header-split and HW-GRO
2059c28bd725 ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit
cb5cca1d2a90 ieee802154: ca8210: fix cas_ctl leak on spi_async failure
314f21c9dd0d ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation
1905ebabe638 ieee802154: admin-gate legacy LLSEC dump operations
19c148cb82d1 octeontx2-af: Free BPID bitmap on setup failure
234cd54fc500 net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink
03d8843b143e net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink
68cadc3698c7 net: ipip: require CAP_NET_ADMIN in the device netns for changelink
9571af2eec80 net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink
0b2f9c908f93 net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink
6596baf80411 net: ena: clean up XDP TX queues when regular TX setup fails
ab625256882e selftests: net: fix file owner for broadcast_ether_dst test
b3d835407846 net/sched: act_ct: preserve tc_skb_cb across defragmentation
3f85fcd520aa net: ixp4xx_hss: fix duplicate HDLC netdev allocation
e89b8829693e net: wwan: t7xx: destroy DMA pool on CLDMA late init failure
121c5f31c3fb net: ethernet: ti: icssg: guard PA stat lookups
3118e97dae53 net: sit: require CAP_NET_ADMIN in the device netns for changelink
5d7bd8790309 gpios: palmas: add .get_direction() op
d3b9026ef78d gpio: mt7621: avoid corruption of shared interrupt trigger state
4e16bc75c750 gpio-f7188x: Add support for NCT6126D version B
b6e040b5143c gpio: mt7621: be sure IRQ domain is created before exposing GPIO chips
ac761e66708d gpio: tegra: do not call pinctrl for GPIO direction
0630f2c3c16c gpio: mt7621: more robust management of IRQ domain teardown
6cb15b81ff54 cpu: hotplug: Bound hotplug states sysfs output
f77117530fc3 cpu: hotplug: Preserve per instance callback errors
afd147e59b32 selftests/ftrace: Drop invalid top-level local in test_ownership
ea6a188ee805 posix-cpu-timers: Use u64 multiplication in update_rlimit_cpu()
633cadbc0b83 locking/rt: Fix the incorrect RCU protection in rt_spin_unlock()
fcff712d0e3d wifi: libertas_tf: fix use-after-free in lbtf_free_adapter()
b33ac2d39953 tracing/user_events: Fix use-after-free in user_event_mm_dup()
ed3cc4218070 net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete
0e8115a7ed9a Input: ims-pcu - fix type confusion in CDC union descriptor parsing
f516cba88bf9 Input: ims-pcu - fix race condition in reset_device sysfs callback
383934c249a9 Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing
9c964fc9507a Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging
99c428d7ef64 Input: ims-pcu - fix firmware leak in async update
05ac85da1219 Input: ims-pcu - fix DMA mapping violation in line setup
f28c5cabb2df Input: ims-pcu - add response length checks
c8d3d83f2eaa Input: ims-pcu - validate control endpoint type
6329d1af316a Input: ims-pcu - release data interface on disconnect
87e2f89dea07 Input: ims-pcu - only expose sysfs attributes on control interface
6aacc18004b1 Input: ims-pcu - fix use-after-free and double-free in disconnect
df87532e9212 scsi: elx: efct: Fix I/O leak on unsupported additional CDB
9b871369cbb4 scsi: elx: efct: Fix refcount leak in efct_hw_io_abort()
cb7bdae7fba4 scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE
004ccd2d3b4a scsi: target: Bound PR-OUT TransportID parsing to the received buffer
f1516c56ac54 scsi: xen: scsiback: Free unsubmitted command instead of double-putting it
255fb7b0cdc9 scsi: xen: scsiback: Free the command tag on the TMR submit-failure path
d0a8a6660d58 scsi: sg: Report request-table problems when any status is set
ed0849797782 scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup()
d495b403d5b3 scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path
257321a1c036 accel/ivpu: Reject firmware log with size smaller than header
4e370b528962 accel/amdxdna: Fix use-after-free in amdxdna_gem_dmabuf_mmap()
7aa8f3dba534 dma-fence: Make dma_fence_dedup_array() robust against 0-count input
089e05b644d5 dm-verity: make error counter atomic
c8d743bb0e98 dm-verity: increase sprintf buffer size
f15eaa3801f2 dm-verity: fix a possible NULL pointer dereference
2a0858cba1da dm-verity: avoid double increment of &use_bh_wq_enabled
5dfd80426352 dm-integrity: don't increment hash_offset twice
aa5113e7155f dm-integrity: fix a bug if the bio is out of limits
0c4e9bb1d410 dm-integrity: fix leaking uninitialized kernel memory
92e3c93d60be dm_early_create: fix freeing used table on dm_resume failure
ee458c3c1834 dm-stats: fix merge accounting
461d36b5ddaf dm-stats: fix dm_jiffies_to_msec64
1247615aadb7 dm-pcache: reject option groups without values
e0b0163a6575 dm-log: fix a bitset_size overflow on 32bit machines
d61c12573ed9 dm-ioctl: fix a possible overflow in list_version_get_info
021dab70eb37 dm-bufio: fix wrong count calculation in dm_bufio_issue_discard
1fcb5e29dd7a dm era: fix out-of-bounds memory access for non-zero start sector
7f76245960a3 dm thin metadata: fix metadata snapshot consistency on commit failure
ac2136dc4441 dm thin metadata: fix superblock refcount leak on snapshot shadow failure
8a3c44a00317 net: sparx5: unregister blocking notifier on init failure
ffd17a393921 block: fix IORING_URING_CMD_REISSUE flags check in blkdev_uring_cmd
2977b5fe401c block: fix race in blk_time_get_ns() returning 0
af382ffca93e block: remove redundant GD_NEED_PART_SCAN in add_disk_final()
0b6252afcd19 bpf: Add missing access_ok call to copy_user_syms
c4f626ddf235 bpf,fork: wipe ->bpf_storage before bailouts that access it
0993dc5fc619 bpf: Reset register bounds before narrowing retval range in check_mem_access()
b06a4a397ac8 can: bcm: add missing rcu list annotations and operations
35f0ac19efb1 can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure
cd830e0bc25e can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF
37beb16e08ca can: isotp: serialize TX state transitions under so->rx_lock
7bef39ba76eb can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER
b88a51130877 can: isotp: use unconditional synchronize_rcu() in isotp_release()
765ba1c91823 can: esd_usb: kill anchored URBs before freeing netdevs
5e4c8e08ce95 netdev-genl: report NAPI thread PID in the caller's pid namespace
26355295ce21 nvmet: fix refcount leak in nvmet_sq_create()
2944113ad5fb nvmet-rdma: handle inline data with a nonzero offset
2eaa3ad45014 nvmet-auth: reject short AUTH_RECEIVE buffers
59cef6abc924 nvme-apple: Prevent shared tags across queues on Apple A11
0ffc032294a2 NFS: Charge unstable writes by request size, not folio size
ebe0a55d954f sctp: validate STALE_COOKIE cause length before reading staleness
d44b828eb551 spi: uniphier: Fix completion initialization order before devm_request_irq()
9b092f9e6b34 time: Fix off-by-one in compat settimeofday() usec validation
ada4b9a5087e tpm: Make the TPM character devices non-seekable
95bdf3950d66 tpm: fix event_size output in tpm1_binary_bios_measurements_show
8ca2a19a987a xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink
e0f688ccb20f xfrm: use compat translator only for u64 alignment mismatch
5b0c4c916f20 xfrm: nat_keepalive: avoid double free on send error
16d3ccdabb8d xen/gntdev: fix error handling in ioctl
e497fef9ad7e ufs: core: tracing: Do not dereference pointers in TP_printk()
0ced34b4bbc0 tcp: Decrement tcp_md5_needed static branch
33a1bee41362 tcp: defer md5sig_info kfree past RCU grace period in tcp_connect
bccae122dab8 ice: fix ice_init_link() error return preventing probe
8bd84316bbaf i2c: spacemit: fix spurious IRQ handling returning IRQ_HANDLED
e6a395a71f46 i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource()
2f3f471a448a i2c: mediatek: fix WRRD for SoCs without auto_restart option
5d3240f42a66 i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ)
6d2c973926d0 i2c: imx: fix locked bus on SMBus block-read of 0 (atomic)
500716a007b2 hwmon: (max6697) add missing 'select REGMAP_I2C' to Kconfig
1dcd7565e590 hwmon: (ltc2992) add missing 'select REGMAP_I2C' to Kconfig
3cd6f93f3d59 ksmbd: fix integer overflow in set_file_allocation_info()
6cc151835736 smb: client: use kvzalloc() for megabyte buffer in simple fallocate
fe623f9515bb pkey: Move keytype check from pkey api to handler
eafc5aca7156 platform/x86/amd/pmc: Don't log during intermediate wakeups
e628d9169f9e platform/x86/amd/pmc: Add delay_suspend module parameter
27d16a19ae74 platform/x86/amd/pmc: Delay suspend for some Lenovo Laptops
d8bc45c4c1a4 platform/x86/amd/pmc: Check for intermediate wakeup in function
cea03d67db3a platform/x86: ISST: Restore SST-PP control to all domains
1e41ca4a7fba platform/x86: dell-laptop: fix missing cleanups in init error path
ddbc4a8a4fe2 dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK
7926c1e4be86 dmaengine: tegra: Fix burst size calculation
933654508b2b sunrpc: fix uninitialized xprt_create_args structure
934d1cd40e28 tpm: tpm2-sessions: wait for async KPP completion in tpm_buf_append_salt
ba33b4f9d342 tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat()
781f28bd982c tpm: restore timeout for key creation commands
36ca587f55a2 irqchip/crossbar: Use correct index in crossbar_domain_free()
0d078152fcab taskstats: retain dead thread stats in TGID queries
9ac007affa77 mtd: maps: vmu-flash: fix NULL pointer dereference in initialization
3fac46068fe4 openrisc: Fix jump_label smp syncing
ff7bcc9d71bf mtd: rawnand: Pause continuous reads at block boundaries
0fd20c1905ab mtd: spi-nor: spansion: use die erase for multi-die devices only
c0806df5cf80 mtd: spi-nor: swp: Improve locking user experience
433e5e70cdc1 s390/pkey: Check length in pkey_pckmo handler implementation
693bf91d4db1 s390/pkey: Check length in PKEY_VERIFYPROTK ioctl
c9ef79e34bc1 fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header()
e5824d5b841d net: thunderbolt: Fix frags[] overflow by bounding frame_count
fc74244e0cc2 bus: mhi: ep: Protect mhi_ep_handle_syserr() in the error path
3ebe0ee6527e bus: mhi: host: pci_generic: Fix the physical function check
012683accbb7 fpga: dfl: add bounds check in dfh_get_param_size()
2174c68f623b ocfs2: reject non-inline dinodes with i_size and zero i_clusters
5e512d370a01 ocfs2: reject dinodes whose i_rdev disagrees with the file type
4db3b6a2a8ec ocfs2: reject dinodes with non-canonical i_mode type
499714de42ab ocfs2: add journal NULL check in ocfs2_checkpoint_inode()
671889c553ea ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2_sum_rightmost_rec
bd73971fad89 ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits
d5d5a21fb33c ocfs2: avoid moving extents to occupied clusters
4bbfcf9c7e46 mtd: rawnand: fix condition in 'nand_select_target()'
a8874c34c4a9 net/9p: fix infinite loop in p9_client_rpc on fatal signal
ace3a0c839f3 mtd: rawnand: pl353: fix probe resource allocation
b6337e3687d3 ocfs2: use kzalloc for quota recovery bitmap allocation
bf53557a96d4 openrisc: Add full instruction cache invalidate functions
8d263bae573d scsi: sas: Skip opt_sectors when DMA reports no real optimization hint
83405848e403 scsi: smartpqi: Use shost_to_hba() in pqi_scan_finished()
a7bbf83dfebd power: supply: bq257xx: Fix VSYSMIN clamping logic
8d610017c992 9p: skip nlink update in cacheless mode to fix WARN_ON
d8dcbbfa0d69 mtd: slram: remove failed entries from the device list
4e4beef747c6 kcov: use WRITE_ONCE() for selftest mode stores
da5234df0941 mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE
749e2051da3b powerpc/dt_cpu_ftrs: Set CPU_FTR_P11_PVR for Power11 and later processors
07ed8b178548 fs/proc: fix KPF_KSM reported for all anonymous pages
b6a6fb6803d5 proc: only bump parent nlink when registering directories
4d67bdef35c3 fs/proc/task_mmu: use huge_page_size() in pagemap_scan_hugetlb_entry()
43b987ed35be fs/proc/task_mmu: fix hugetlb self-deadlock in pagemap_scan_pte_hole()
40a04601a3f6 mm/damon/sysfs-schemes: put stats for scheme_add_dirs() internal error
f18c561eb9c5 mm/damon/sysfs-schemes: fix dir put orders in access_pattern_add_dirs()
f322955d9a1c riscv: cacheinfo: Fix node reference leak in populate_cache_leaves
1caee6e084a9 mips: sched: Fix CPUMASK_OFFSTACK memory corruption
bd2e9be9ebb6 selftests/landlock: Test SCOPE_SIGNAL on the SIGIO/fowner pgid path
193e6471e985 power: supply: charger-manager: fix refcount leak in is_full_charged()
1f18aac26372 landlock: Fix LANDLOCK_SCOPE_SIGNAL bypass on the SIGIO path
ff05a98150eb ntfs3: fix out-of-bounds read in decompress_lznt
f3624cc06919 ntfs3: validate split-point offset in indx_insert_into_buffer
aaa1f956c0fc ntfs3: bound to_move in indx_insert_into_root before hdr_insert_head
0fad25687d4d ntfs3: cap RESTART_TABLE free-chain walker at rt->used
be306b8d9143 fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation}
908c9243ba30 fs/ntfs3: add depth limit to indx_find_buffer to prevent stack overflow
7adb38279812 fs/ntfs3: validate lcns_follow in log_replay conversion
50b5e83384e7 fs/ntfs3: bound attr_off in UpdateResidentValue against data_off
d240cd98f5f7 fs/ntfs3: bound copy_lcns dp->page_lcns[] index in analysis pass
09fddd52c1b0 fs/ntfs3: bound DeleteIndexEntryAllocation memmove length
ccd6b7079873 fs/ntfs3: fix syncing wrong inode on DIRSYNC cross-directory rename
640627f07c79 mm/damon/core: make charge_addr_from aware of end-address exclusivity
722e6c54bde6 mm/memory_hotplug: fix incorrect altmap passing in error path
1697d253f51c mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch
9227b387eee5 power: supply: max17042: fix OF node reference imbalance
a3d81de44123 power: supply: cpcap-battery: Fix missing nvmem_device_put() causing reference leak
a39d281f207b mm/mm_init: fix pageblock migratetype for ZONE_DEVICE compound pages
d3fd2d358df0 MIPS: DEC: Ensure 32-bit stack location for o32 prom_printf()
11a3bc25f2c3 MIPS: ip22-gio: fix device reference leak in probe
2c551f14f55e MIPS: ip22-gio: fix kfree() of static object
620a37ea7d62 MIPS: ip22-gio: fix gio device memory leak
51aad3d89a2d remoteproc: qcom: Fix leak when custom dump_segments addition fails
69e18135e2a0 SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing
46d59ff42182 lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure
1161c4b5bd00 lockd: Plug nlm_file leak when nlm_do_fopen() fails
66014ab165cb sunrpc: harden rq_procinfo lifecycle to prevent double-free
65b23bec1fca sunrpc: wait for in-flight TLS handshake callback when cancel loses race
3f9ee75a97a7 sunrpc: pin svc_xprt across the asynchronous TLS handshake callback
30d490bb2c4c nvdimm/btt: Free arena sub-allocations on discover_arenas() error path
f4ca396bdd60 nvdimm/btt: Free arenas on btt_init() error paths
78955fdce8ff jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit()
7199c78c3a3e Bluetooth: SCO: hold sk properly in sco_conn_ready
77eb0cf57009 Bluetooth: SCO: fix sleeping under spinlock in sco_conn_ready
96dd35f1942c HID: playstation: validate num_touch_reports in DualShock 4 reports
88ba84546850 mfd: tps6586x: Fix OF node refcount
d8e2f3e1bc20 cifs: invalidate cfid on unlink/rename/rmdir
3256c05d5a9d batman-adv: tt: prevent TVLV OOB check overflow
d2b657c9653f batman-adv: mcast: avoid OOB read of num_dests header
a90f4fff9025 batman-adv: frag: fix primary_if leak on failed linearization
c945f6007e78 batman-adv: clean untagged VLAN on netdev registration failure
8f54162e07d3 batman-adv: frag: free unfragmentable packet
2c989ab8e205 batman-adv: fix VLAN priority offset
6a65ac8a81e9 batman-adv: tt: avoid request storms during pending request
ee878decf9e5 batman-adv: dat: fix tie-break for candidate selection
9e16b6751a82 batman-adv: ensure minimal ethernet header on TX
8f76277d0217 batman-adv: dat: ensure accessible eth_hdr proto field
e5e18886aadd batman-adv: bla: reacquire gw address after skb realloc
3b4c70c40f2e batman-adv: dat: acquire ARP hw source only after skb realloc
b8afcf799b2c batman-adv: access unicast_ttvn skb->data only after skb realloc
85a71a81854e batman-adv: retrieve ethhdr after potential skb realloc on RX
e6b43acd34b2 batman-adv: gw: acquire ethernet header only after skb realloc
fa1ebae4206e s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init()
8514585aa955 cpufreq: intel_pstate: Set non-turbo capacity to HWP_GUARANTEED_PERF()
221ee479a49f cpufreq: schedutil: Fix uncleared need_freq_update on the .adjust_perf() path
5ab0eba9c881 perf/x86/amd/lbr: Fix kernel address leakage
046f6244da9b perf/x86/amd/brs: Fix kernel address leakage
394e2bdf7594 x86/boot: Reject too long acpi_rsdp= values
f7c67c97b37c x86/boot: Validate console=uart8250 baud rate to fix early boot hang
1a1d6e3ef6cf x86/video: Only fall back to vga_default_device() without screen info
19ffeb30fdfc tools/power/x86/intel-speed-select: Harden daemon pidfile open
16a42c88c466 mfd: sm501: Fix reference leak on failed device registration
6dd51d84a950 leds: uleds: Fix potential buffer overread
3a134c3fb5f0 selinux: fix incorrect execmem checks on overlayfs
d61a80b17254 selinux: avoid sk_socket dereference in selinux_sctp_bind_connect()
fc633a598206 selinux: check connect-related permissions on TCP Fast Open
e9cdf741ffcb soc: fsl: qe: panic on ioremap() failure in qe_reset()
c6854d9f4e1b soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy
c4d6442ac3ed gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path
1c4f67c89fd2 netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment()
679ced28a9dc netfilter: xt_nat: reject unsupported target families
b2dbbedfa935 netfilter: ecache: fix inverted time_after() check
3cd9a5792cbe netfilter: nf_conncount: fix zone comparison in tuple dedup
a58230f3a7c4 netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag
2bcf2c5052fb netfilter: nf_nat_sip: reload possible stale data pointer
02b6b0e892ae netfilter: nft_set_pipapo: don't leak bad clone into future transaction
0ca505346c5e netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst
07f9ddbf5e79 netfilter: xt_cluster: reject template conntracks in hash match
a1b672a3b537 netfilter: nfnl_cthelper: apply per-class values when updating policies
aff589556ed7 netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read
ca028334343a ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback
e42d8322b67f ASoC: mediatek: mt8183: Release reserved memory on cleanup
4b068759d308 ASoC: mediatek: mt8183: Check runtime resume during probe
51c367230e30 ASoC: mediatek: mt8192: Release reserved memory on cleanup
e0f276f1918a ASoC: mediatek: mt8192: Check runtime resume during probe
d3abaedf6a58 ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control
121577383b5c ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get
4ebe2c3a7db6 fbdev: tridentfb: fix potential memory leak in trident_pci_probe()
009a8514745b fbdev: nvidia: fix potential memory leak in nvidiafb_probe()
58bc18e03481 fbdev: vesafb: fix memory leak in vesafb_probe()
d81860691e4c fbdev: carminefb: fix potential memory leak in alloc_carmine_fb()
e1ca9b8559e0 fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe()
12fe6a56506e fbdev: uvesafb: fix potential memory leak in uvesafb_probe()
ad54698255a4 fbdev: s3fb: fix potential memory leak in s3_pci_probe()
146b708bc75f fbdev: i740fb: fix potential memory leak in i740fb_probe()
c2c795a320e7 fbdev: radeon: fix potential memory leak in radeonfb_pci_register()
febb5b4f67ac fbdev: efifb: fix memory leak in efifb_probe()
9423e1f10527 fbdev: sm712: Fix operator precedence in big_swap macro
d684ce2db92b fbdev: hecubafb: fix potential memory leak in hecubafb_probe()
e8c9aae8c950 fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe()
6854cf33dddb fbdev: metronomefb: fix potential memory leak in metronomefb_probe()
d5436e18e4fc KVM: arm64: nv: Inject SEA if guest VNCR isn't normal memory
4ead4def0465 KVM: arm64: nv: Inject SEA if kvm_translate_vncr() can't resolve PFN
5c50db5bcbb9 KVM: arm64: nv: Respect read-only PFN when mapping L1 VNCR
884b44256041 KVM: arm64: nv: Fix SPSR_EL2 restore in kvm_hyp_handle_mops()
09f35145f3a4 KVM: arm64: nv: Write ESR_EL2 for injected nested SError exceptions
5000bcae71c8 KVM: arm64: nv: Drop bogus WARN for write to ZCR_EL2
7099e7148f81 KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers
7996013b8568 KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state
d1379888cc42 KVM: x86: Nullify irqfd->producer if updating IRTE for bypass fails
97542f15dc4c KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs
ba06690b28be KVM: SEV: Do not allow intra-host migration/mirroring of SNP VMs
df72596278b0 KVM: s390: pci: Fix handling of AIF enable without AISB
d19dca8194eb KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling
79fdd2aa774e KVM: arm64: vgic: Check the interrupt is still ours before migrating it
5fb75c527295 KVM: s390: pci: Fix GISC refcount leak on AIF enable failure
9f8eaef40e95 powerpc/pseries/Kconfig: Enable CONFIG_VPA_PMU to be used with KVM
33d79ad6eced LoongArch: KVM: Return full old CSR value from kvm_emu_xchg_csr()
f3efcef6648b LoongArch: KVM: Fix FPU register width with user access API
45f2e6505fcf LoongArch: KVM: Check the return values for put_user()
efe27b19a15c LoongArch: KVM: Check irq validity in kvm_vcpu_ioctl_interrupt()
199b570d7fca LoongArch: KVM: Validate irqchip index in irqfd routing
1ee200a1764f ARM: dts: stm32: stm32mp15x-mecio1-io: Move expander gpio-line-names to board files
f550bf32b9a0 ARM: dts: stm32: stm32mp15x-mecio1-io: Fix expander gpio line typo
7da4d1a6b740 ARM: dts: stm32: stm32mp15x-mecio1-io: Move gpio-line-names to board files
804821b69b2d ARM: dts: stm32: stm32mp15x-mecio1-io: Fix GPIO names typo
c632a27f35cf arm64: dts: imx8ulp-evk: Correct Type-C int GPIO flags
bd938c985ab3 ARM: dts: stm32: stm32mp15x-mecio1-io: Enable internal ADC reference
ead9f10428c7 arm64: dts: ti: k3-am62a7-sk: Add bootph-all tag to vqmmc
a98bda2305f3 ARM: dts: stm32: stm32mp15x-mecio1-io: Move divergent mecio1 ADC channels to board files
4fd52ac541ce ARM: dts: stm32: stm32mp15x-mecio1-io: Fix ADC sampling times
68f9773754f0 arm64: dts: rockchip: fix Ethernet PHY not found on PX30 Ringneck
e2e3fb995175 arm64: dts: qcom: sdm630: describe adsp_mem region properly
508e55e81870 ARM: dts: imx6ul-var-som: fix warning for non-existent dc-supply property
e8dc96a42571 arm64: dts: s32g3: Fix SWT8 watchdog address
89edae416141 arm64: fpsimd: Fix type mismatch in sve_{save,load}_state()
5526d1997aea net: ife: require ETH_HLEN to be pullable in ife_decode()
908391d801b2 octeontx2-vf: clear stale mailbox IRQ state before request_irq()
eebf439aa7a1 octeontx2-pf: clear stale mailbox IRQ state before request_irq()
e62adb157c2e net: atm: reject out-of-range traffic classes in QoS validation
22100a8f73d4 net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post()
61a55fa24a5d tipc: restrict socket queue dumps in enqueue tracepoints
d34deef34c99 ASoC: SOF: topology: validate vendor array size before parsing
0c4fbdaca225 ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get
711d912b1876 ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc
fb4293173db2 ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put
d8715b5a8fdb vduse: Fix race in vduse_dev_msg_sync and vduse_dev_read_iter
3a2b47d1b4b3 mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace()
2d8b3c3e1299 mlxsw: fix refcount leak in mlxsw_sp_port_lag_join()
b65e46eed9e5 idpf: add padding to PTP virtchnl structures
1627e7d5c9b0 smb: client: fix overflow in passthrough ioctl bounds check
327595e7c34e drm/xe: remove duplicate <kunit/test-bug.h> include
3de77d2f34c2 octeontx2-af: fix VF bringup affecting PF promiscuous state
ee3f7566bcf3 net/mlx5: Fix L3 tunnel entropy refcount leak
1550b07bca2b selftests/net: fix EVP_MD_CTX leak in tcp_mmap
346e2d666a29 regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK
14e03ecd3b1b dm era: fix NULL pointer dereference in metadata_open()
5b0427ba582d SUNRPC: pin upper rpc_clnt across the TLS connect_worker
13965a7b190f SUNRPC: release lower rpc_clnt if killed waiting for XPRT_LOCKED
b784cd1c24d8 cifs: validate DFS referral string offsets
df0e3e70f699 s390/zcrypt: Remove the empty file
8f48cfe65740 ipvs: ensure inner headers in ICMP errors are in headroom
7510451a58c2 ipvs: fix PMTU for GUE/GRE tunnel ICMP errors
d73f4249776d ipvs: use parsed transport offset in TCP state lookup
d340e351a0a7 ipvs: pass parsed transport offset to state handlers
238c612357b5 netfilter: nft_lookup: fix catchall element handling with inverted lookups
f60ec3058a85 ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer()
27506827a01f ipv4: igmp: annotate data-races around timer-related fields
d269eb67d2e5 ipv4: igmp: annotate data-races around im->users
9ce741c22df4 ipv6: mcast: Fix potential UAF in MLD delayed work
75e984fe0cb9 ipv4: igmp: Fix potential UAF in igmp_gq_start_timer()
3bfcce441c55 gpio: mvebu: free generic chips on unbind
7cc438c99bba perf/x86/amd/core: Avoid enabling BRS from the SVM reload path
9579d625171a octeontx2-pf: check DMAC extraction support before filtering
7aa0e64fea77 net/sched: cake: reject overhead values that underflow length
72119397cdff net: mdio: select REGMAP_MMIO instead of depending on it
762116dfa728 drm/v3d: Reject invalid indirect BO handle in indirect CSD setup
267809e2c56f accel/amdxdna: Fix potential amdxdna_umap lifetime race
1cd434ac1c22 tracing: Make tracepoint_printk static as not exported
5e15cf51982f gpio: dwapb: Defer clock gating until noirq
6c736c5ccf4a gpio: dwapb: reduce allocation to single kzalloc
d7b5497e0e45 gpio: dwapb: Use modern PM macros
a3010b732d62 net: usb: lan78xx: disable VLAN filter in promiscuous mode
e8a4c9fc437b net/tls: Consume empty data records in tls_sw_read_sock()
b3eeb586f94c accel/amdxdna: Use unsigned long for nr_pages in amdxdna_hmm_register()
ec5e96aee75d ring-buffer: Fix event length with forced 8-byte alignment
0c602cb8f148 Bluetooth: L2CAP: fix tx ident leak for commands without a response
bfc9e7be289d Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup()
b69b1ab121fe Bluetooth: ISO: exclude RFU bits from ISO_SDU_Length
da4d8eea0c5f Bluetooth: sco: Fix a race condition in sco_sock_timeout()
dfc8373893b1 Bluetooth: MGMT: Fix adv monitor add failure cleanup
23a83bac3356 Bluetooth: 6lowpan: hold L2CAP conn across debugfs control
026c236f0eef amt: fix size calculation in amt_get_size()
3bfb96d9bc6a net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket
6f9b23eb92a8 net/sched: act_pedit: fix TOCTOU heap OOB write in tc offload
1b12612c367e net: qualcomm: rmnet: validate MAP frame length before ingress parsing
b066420e57f3 qede: fix off-by-one in BD ring consumption on build_skb failure
1e71a40d1015 net: microchip: vcap: fix races on the shared Super VCAP block
5c7e3755abf6 net/mlx5e: Fix publication race for priv->channel_stats[]
60fddda7207d net/mlx5e: Fix HV VHCA stats agent registration race
420aabb32da4 net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation
6a802de97a8b net/mlx5: LAG, MPESW, Fix missing complete() on devcom error
4eef84b09a38 netfilter: xt_connmark: reject invalid shift parameters
b29b67c729de netfilter: nft_set_rbtree: get command skips end element with open interval
3d441be2b1c5 netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop
e702f6dd5d21 netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt()
a597a722fb71 netfilter: xt_u32: reject invalid shift counts
4a4a1d41c6e9 gue: validate REMCSUM private option length
b153cfe84b13 net: usb: net1080: validate packet_len before pad-byte access in rx_fixup
66f57dc92aeb arm64/sysreg: Fix BWE field encoding in ID_AA64DFR2_EL1
a6185c21d551 selftests/hid: Cover hid_bpf_get_data() size overflow
91ac1d7fd51e selftests/hid: Load only requested struct_ops maps
61a959b82f1a HID: bpf: Fix hid_bpf_get_data() range check
4c65c3d9f660 arm64/mm: Optimize TLB flush in unmap_hotplug_[pmd|pud]_range()
dd395744e4ed HID: core: Fix OOB read in hid_get_report for numbered reports
d354e523c6f7 HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait()
793b55c3f36f ata: libata-scsi: limit simulated SCSI command copy to response length
232a2f2fce9b ata: sata_gemini: unwind clocks on IDE pinctrl errors
86652704a7fd cifs: Fix missing credit release on failure in cifs_issue_read()
c9170c83b0e0 uprobes/x86: Use proper mm_struct in __in_uprobe_trampoline
2265b2b1c5aa x86/uprobes: Keep shadow stack in sync for emulated CALLs
adc7dda728ca drm/xe/pf: Don't attempt to process FAST_REQ or EVENT relays
a0a56b4480a0 drm/xe/hw_engine: Fix double-free of managed BO in error path
f9a9abd7bbda drm/xe/userptr: Hold notifier_lock for write on inject test path
78b1074966d2 drm/xe/pt: Fix NULL pointer dereference in xe_pt_zap_ptes_entry()
a9b89752c272 netfs: Fix folio state after ENOMEM whilst under writeback iteration
1bb33d959aab netfs: Fix writeback error handling
7838131e296d netfs: Fix writethrough to use collection offload
8ab75e445c16 netfs: Fix netfs_create_write_req() to handle async cache object creation
1f38f65bf965 iomap: guard io_size EOF trim against concurrent truncate underflow
08b214547066 ovl: fix comment about locking order
abe3536a4bed minix: avoid overflow in bitmap block count calculation
ce6aced2e855 afs: Fix unchecked-length string display in debug statement
158c5a0b1dfc afs: Fix the volume AFS_VOLUME_RM_TREE is set on
657449e5581a afs: Fix premature cell exposure through /afs
2ffb70a8a019 afs: Fix lack of locking around modifications of net->cells_dyn_ino
8afb1a787a28 afs: Fix vllist leak
5492799ec5d2 afs: Fix missing NULL pointer check in afs_break_some_callbacks()
0acbc09d2aca afs: Fix callback service message parsers to pass through -EAGAIN
63d3f283858f afs: Fix reinitialisation of the inode, in particular ->lock_work
5ea289ca751c afs: Fix misplaced inc of net->cells_outstanding
b5bc1e5d5ce5 afs: Fix bulk lookup malfunction due to change in dir_emit() API
083a0ddc9cd4 afs: Remove erroneous seq |= 1 in volume lookup loop
6eb0d929202a afs: use kvfree() to free memory allocated by kvcalloc()
aa24cec5b347 afs: Fix double netfs initialisation in afs_root_iget()
8530206911fd afs: Fix error code in afs_extract_vl_addrs()
a2038514e693 fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid
374fd8122421 net/sched: hhf: clear heavy-hitter state on reset
fba8e250ce5f net/sched: dualpi2: clear stale classification on filter miss
a203f2c3892b pinctrl: meson: restore non-sleeping GPIO access
47120164c63d gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe
5a5ac2852cd3 ksmbd: fix use-after-free of fp->owner.name in durable handle owner check
d020e7f27bf6 ksmbd: reject undersized DACLs before parsing ACEs
6b1304ce6cff net/sched: act_bpf: use rcu_dereference_bh() to read the filter
a03387e1f625 selftests: drv-net: tso: don't touch dangerous feature bits
df9ffdceac05 cxgb4: Fix decode strings dump for T6 adapters
124440df267d virtio_net: disable cb when NAPI is busy-polled
a8323fb2ab6c sctp: fix addr_wq_timer race in sctp_free_addr_wq()
4e8d498d32b6 irqchip/ts4800: Fix missing chained handler cleanup on remove
c5d75800539b irqchip/gic-v3-its: Fix OF node reference leak
f0069a262bd4 tracing/probes: Make the $ prefix mandatory for comm access
62988204162f tracing/fprobe: Fix NULL pointer dereference in fprobe_fgraph_entry()
898cb5a7c415 tracing: eprobe: read the complete FILTER_PTR_STRING pointer
e0881f5cc4d7 tracing/events: Fix to check the simple_tsk_fn creation
f148f86c65b8 tracing/probes: Remove WARN_ON_ONCE from parse_btf_arg
3b51d6f07a19 tracing/eprobes: Allow use of BTF names to dereference pointers
acbf1ecc22f3 drm/panthor: Interrupt group start/resumption if group_bind_locked() fails
a9d098b346db drm/panthor: Fix a leak when a group is evicted before the tiler OOM is serviced
1497a438ea34 drm/panthor: Don't overrule pending immediate ticks in sched_resume_tick()
dd0b2976b7c0 drm/panthor: Fix potential invalid pointer deref in group_process_tiler_oom()
b4b3458ef88d bridge: stp: Fix a potential use-after-free when deleting a bridge
9b7d05cbaa60 net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF
ef940e042f32 net: gianfar: dispose irq mappings on probe failure and device removal
58ba00999898 net: libwx: fix VMDQ mask for 1-queue mode
86d379fcf1b7 net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy
0a7d9c7c5f1f usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup()
d8a01d27873e ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump
83df3e2594cd eth: fbnic: don't cache shinfo across skb realloc
898ca04b096b hwmon: (aspeed-g6-pwm-tach) Guard fan RPM calculation against divide-by-zero
489291b6b569 hwmon: (pmbus) Fix passing events to regulator core
36554592e2f5 hwmon: adm1275: Prevent reading uninitialized stack
1797eb92f0b3 ASoC: codecs: lpass-va-macro: Fix LPASS Codec Version for SC7280
f14c3926fee3 ASoC: codecs: lpass-va-macro: add SM6115 compatible
3d3638fe9213 MIPS: mm: Add check for highmem before removing memory block
4e9f4ca9dc73 MIPS: DEC: Ensure RTC platform device deregistration upon failure
bca3100f5502 sctp: add INIT verification after cookie unpacking
ad6215d76b64 sctp: fix SCTP_RESET_STREAMS stream list length limit
1681cc7974a6 net: enetc: check the number of BDs needed for xdp_frame
b17751a2ebc4 qede: fix out-of-bounds check for cqe->len_list[]
8dba7a94a269 seg6: validate SRH length before reading fixed fields
8d501b141154 net: pse-pd: scope pse_control regulator handle to kref lifetime
e94d53a9ac22 gpio: htc-egpio: use managed gpiochip registration
f4af803269cc gpio: mvebu: fail probe if gpiochip registration fails
46dee20d30b7 riscv: Fix 32-bit call_on_irq_stack() frame pointer ABI
8e0b7f94fb39 ACPI: RIMT: Only defer the IOMMU configuration in init stage
776f70bafd45 spi: sh-msiof: abort transfers when reset times out
d6cd34d17b95 tracing: probes: fix typo in a log message
f28d7b5f1578 ALSA: FCP: Fix NULL pointer dereference in interface lookup
d990a01b853e net: hns3: differentiate autoneg default values between copper and fiber
2d149a20275a net: hns3: fix permanent link down deadlock after reset
92d05883ef33 net: hns3: refactor MAC autoneg and speed configuration
43a6c6fb6ec5 net: hns3: unify copper port ksettings configuration path
de051b146022 selftests: tls: size splice_short pipe by page size
6727f580cf46 dt-bindings: net: renesas,ether: Drop example "ethernet-phy-ieee802.3-c22" fallback
9075efb9b2c1 net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync
c1e7286d0531 ASoC: fsl_asrc_dma: fix eDMA maxburst misalignment with channel count
7a7c7263bbbc LoongArch: BPF: Fix off-by-one error in tail call
ed295077a221 LoongArch: BPF: Fix outdated tail call comments
0a8a729481c8 LoongArch: Move struct kimage forward declaration before use
2f3c0895fb20 net: ethernet: sunplus: spl2sw: fix phy_node refcount leak in remove
b15a3cc68e24 net: sungem: fix probe error cleanup
b84dd48f9da1 net: mvneta: re-enable percpu interrupt on resume
e0ac054416bf octeontx2-af: Validate NIX maximum LFs correctly
9dc3cf8a3590 net: phy: realtek: Clear MDIO_AN_10GBT_CTRL_ADV10G bit
0c11a1da41a6 net: dsa: realtek: fix memory leak in rtl8366rb_setup_led()
a69ccea6d7eb rtc: cmos: unregister HPET IRQ handler on probe failure
5fd1f0512748 rtc: ds1307: Fix off-by-one issue with wday for rx8130
d0bfd7004a87 smb/client: preserve errors from smb2_set_sparse()
5b6165d7ec38 ACPI: processor_idle: Mark LPI enter functions as __cpuidle
ea43e7a231aa thermal: testing: zone: Flush work items during cleanup
4e62be1490d2 eth: fbnic: fix ordering of heartbeat vs ownership
123b559aa6bb ipv6: fix missing notification for ignore_routes_with_linkdown
419017dd2dda ipv6: fix state corruption during proxy_ndp sysctl restart
ae58dbf1d78d ipv6: fix error handling in disable_policy sysctl
2bf70e0306f8 ipv6: fix error handling in forwarding sysctl
b060606bc7e4 ipv6: fix error handling in ignore_routes_with_linkdown sysctl
56c26538f0e5 ipv6: fix error handling in disable_ipv6 sysctl
2140c2f3f2e7 net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle
ff127c0aa527 net: usb: lan78xx: restore VLAN and hash filters after link up
a9e6707322ef veth: fix NAPI leak in XDP enable error path
410629528067 net: dsa: sja1105: round up PTP perout pin duration
7557df1b60f2 net: do not acquire dev->tx_global_lock in netdev_watchdog_up()
03b743586a24 net, bpf: check master for NULL in xdp_master_redirect()
a0904f7d2703 alpha/PCI: Fix __pci_mmap_fits() overflow for zero-length BARs
94defb18ac79 alpha/PCI: Add security_locked_down() check to pci_mmap_resource()
04117aea9bc1 NTB: epf: Fix doorbell bitmask and IRQ vector handling
56ec2a08d27b NTB: epf: Report 0-based doorbell vector via ntb_db_event()
d2a41c85beb5 NTB: epf: Make db_valid_mask cover only real doorbell bits
60a6689b9a5d gpio: davinci: fix IRQ domain leak on devm_kzalloc failure
33e1875d6b5b netfilter: nft_compat: ebtables emulation must reject non-bridge targets
d3e9a7e2ce9d netfilter: nft_synproxy: stop bypassing the priv->info snapshot
329f2626ee5c netfilter: nf_conncount: prevent connlimit drops for early confirmed ct
a73e7ac3f3b6 netfilter: nf_nat: avoid invalid nat_net pointer use on failed nf_nat_init()
49fa1be621dd bpf: Disable xfrm_decode_session hook attachment
4d919c9b7709 md/raid5: avoid R5_Overlap races while breaking stripe batches
3db13f82ba31 md/raid5: use stripe state snapshot in break_stripe_batch_list()
828fad4fd418 ipv4: fib: Don't ignore error route in local/main tables.
630ce3806b70 eth: bnxt: improve the timing of stats
c0057e5f762b eth: bnxt: rename ring_err_stats -> ring_drv_stats
33168db149d0 eth: bnxt: gather and report HW-GRO stats
b0d0eb13a044 ipv6: Fix null-ptr-deref in fib6_nh_mtu_change().
77bb0bbfcc4e ksmbd: fix use-after-free of conn->preauth_info in concurrent SMB2 NEGOTIATE
1f6a4aec0d36 rtc: msc313: fix NULL deref in shared IRQ handler at probe
68115a7a336f i40e: Fix i40e_debug() to use struct i40e_hw argument
de80d04b13de ice: dpll: fix memory leak in ice_dpll_init_info error paths
eaffdd113f56 ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info
854065a75e37 rtc: isl1208: Balance enable_irq_wake() with disable_irq_wake() on cleanup
4cc632fe63df ice: call netif_keep_dst() once when entering switchdev mode
04c082b7dc5b ice: fix AQ error code comparison in ice_set_pauseparam()
dd6d8e4412f8 ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs()
9415a94cf622 PCI: endpoint: pci-epf-ntb: Add check to detect 'db_count' value of 0
e1e7c72a2301 PCI: endpoint: pci-epf-vntb: Add check to detect 'db_count' value of 0
9cc0f8e63e8c drm/edid: fix OOB read in drm_parse_tiled_block()
5e4c4ab99abc gpiolib: initialize return value in gpiochip_set_multiple()
7550becf3301 power: sequencing: fix ABBA deadlock in pwrseq_device_unregister()
9697db03e010 bpf: Fix effective prog array index with BPF_F_PREORDER
3bdfa0e435f3 bpf: zero-initialize the fib lookup flow struct
b05337635be3 bpftool: Fix vmlinux BTF leak in cgroup commands
68b41e68a622 bpf: Fix stack slot index in nospec checks
aa33b44f70bf rtc: ds1307: handle oscillator stop flag for ds1337/ds1339/ds3231
56e5f8a409f8 rtc: abx80x: fix the RTC_VL_CLR clearing all status flags
93f95538b611 dpaa2-switch: do not accept VLAN uppers while bridged
ea24f911ead8 ipv6: ioam: fix type confusion of dst_entry
a6450f7cfae5 ipv6: ndisc: fix NULL deref in accept_untracked_na()
2066e692ec7a net: airoha: Fix skb->priority underflow in airoha_dev_select_queue()
1d51aff78f07 net/sched: act_ct: fix nf_connlabels leak on two error paths
a103cdb0681e net: emac: Fix NULL pointer dereference in emac_probe
2855ec137a22 octeontx2-pf: mcs: Fix mcs resources free on PF shutdown
da603b606ceb octeontx2-pf: Clear stats of all resources when freeing resources
5636f0f3bd99 octeontx2-af: mcs: Fix unsupported secy stats read
ceef83f0eaf9 net: ethernet: mtk_ppe: Fix rhashtable leak in mtk_ppe_init error paths
a0c5fdeb5fa2 tipc: fix use-after-free of the discoverer in tipc_disc_rcv()
5dda4f164a63 net: marvell: prestera: initialize err in prestera_port_sfp_bind
9200c8149910 selftests/mm: fix exclusive_cow test fork() handling
55fc2f99d097 selftests/mm: allow PUD-level entries in compound testcase of hmm tests
c8add1d06512 selftests/mm: clarify alternate unmapping in compaction_test
0caa28e97894 selftests/mm: skip uffd-stress test when nr_pages_per_cpu is zero
471b62966c78 selftests/mm: ensure destination is hugetlb-backed in hugetlb-mremap
9dbfd514148d selftest/mm: register existing mapping with userfaultfd in hugetlb-mremap
a8673dbd3d4a selftests/mm: free dynamically allocated PMD-sized buffers in split_huge_page_test
31b28910abe3 selftests/mm: size tmpfs according to PMD page size in split_huge_page_test
fff7d3ea3a4c selftests/mm: fix cgroup task placement and drop memory.current checks in hugetlb_reparenting_test.sh
8c65c58868ec selftests/mm: fix hugetlb pathname construction in hugetlb_reparenting_test.sh
58cd8ff69e33 selftests/mm: restore default nr_hugepages value via exit trap in hugetlb_reparenting_test.sh
b805de2abfa3 selftests/mm: restore default nr_hugepages value via exit trap in charge_reserved_hugetlb.sh
37e3e8a2c3bf alloc_tag: fix use-after-free in /proc/allocinfo after module unload
502b3ae43f79 irqchip/crossbar: Fix parent domain resource leak
002ebbcc8414 mailbox: imx: Forward the timeout/ error in imx_mu_generic_tx()
7e23965d44f0 netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak
d32e4301a0e5 netfilter: nf_reject: skip iphdr options when looking for icmp header
8e935c51b65d netfilter: nft_flow_offload: zero device address for non-ether case
4c61d28634fb netfilter: flowtable: move path discovery infrastructure to its own file
13c6ba6e0f21 netfilter: nft_meta_bridge: add validate callback for get operations
5baa149abb41 netfilter: nft_payload: reject offsets exceeding 65535 bytes
12088da6add5 netfilter: ipset: make sure gc is properly stopped
8087bb360a93 netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer()
c4d257734e91 netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types
a0afd353c2f7 netfilter: ipset: annotate "pos" for concurrent readers/writers
7228cc8ff626 netfilter: ipset: Fix data race between add and dump in all hash types
6d92dbd73d19 md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry
2c5384c40a4c md/raid1: honor REQ_NOWAIT when waiting for behind writes
119903c32083 md: merge mddev serialize_policy into mddev_flags
2e414af05a7c md: merge mddev faillast_dev into mddev_flags
9408c233a5bb md: merge mddev has_superblock into mddev_flags
5464ee644237 mac802154: Prevent overwrite return code in mac802154_perform_association()
de3bd9809af7 ieee802154: fix kernel-infoleak in dgram_recvmsg()
d22e278cd067 ieee802154: Remove WARN_ON() in cfg802154_pernet_exit()
f4860dd988b1 ieee802154: Avoid calling WARN_ON() on -ENOMEM in cfg802154_switch_netns()
5d17ebdf6c23 ieee802154: Restore initial state on failed device_rename() in cfg802154_switch_netns()
3b40ebc19ad0 ACPI: IPMI: Fix inverted interface check in ipmi_bmc_gone()
45465b0e0135 ACPI: resource: Amend kernel-doc style
7ae67f0e1c16 thermal: intel: Fix dangling resources on thermal_throttle_online() failure
679fd0bf4f8a arm64/hw_breakpoint: reject unaligned watchpoints that would truncate BAS
4c16176fc11a ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints
a762b9865f49 selftests: vlan_bridge_binding: Fix flaky operational state check
c6d3bcb0f934 flow_dissector: check device type before reading ETH_ADDRS
68af74ad696c net: macb: add TX stall timeout callback to recover from lost TSTART write
112b5eff24e0 net: airoha: fix foe_check_time allocation size
5ffb2b4987cc devlink: Fix parent ref leak on tc-bw failure
02c884d9aaca devlink: Fix parent ref leak in devl_rate_node_create()
0dafdaaf8684 dpaa2-switch: fix VLAN upper check not rejecting bridge join
c7fc9adf4e00 virtio-net: fix len check in receive_big()
0d95587d662a spi: rpc-if: Use correct device for hardware reinitialization on resume
f37f2f804796 PCI: iproc: Restore .map_irq() for the platform bus driver
53c23d56b46b ALSA: usb-audio: qcom: clear opened when stream enable fails
25a867aa5e67 ALSA: usb-audio: qcom: reject stream disable with no active interface
207bb4ce8fe7 sctp: hold socket lock when dumping endpoints in sctp_diag
a6cfb924ad74 net: psample: fix info leak in PSAMPLE_ATTR_DATA
3d45d40b872a octeontx2-pf: Fix leak of SQ timestamp buffer on teardown
290ad0a54891 drm/amdgpu: initialize irq.lock spinlock earlier
96ac562a9ea3 drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm
211bb9d8f17c drm/amd/display: Fix mem_type change detection for async flips
0e27d92f69b8 drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free
7bcd4ef375fa ASoC: tlv320aic3x: restrict CLKDIV bypass Q values in dual-rate mode
ca297485271c perf dso: Set standard errno on decompression failure
05b11debdffe perf bpf: Validate array presence before casting BPF prog info pointers
c8cb4a92eda6 perf cs-etm: Bounds-check CPU in cs_etm__get_queue()
b389a5b215e3 perf cs-etm: Require full global header in auxtrace_info size check
c13532ff67fa perf cs-etm: Validate num_cpu before metadata allocation
87d23f25b5e9 perf machine: Use snprintf() for guestmount path construction
6d99379c58f7 xfrm: validate selector family and prefixlen during match
7248ae02a945 xfrm: annotate data-races around xfrm_policy_count[] and xfrm_policy_default[]
a1a3360a0c44 xfrm: Fix xfrm state cache insertion race
1467ca02ddac ALSA: usb-audio: qcom: Free sideband sg_table objects
507a7b07f3fa i3c: master: Add missing runtime PM get in dev_nack_retry_count_store()
34cd92141a02 i3c: master: Update dev_nack_retry_count under maintenance lock
95028569589f spi: dw: fix wrong BAUDR setting after resume
355e51eeffc6 drm/xe: Fix wa_oob codegen recipe for external module builds
2024940522ef drm/i915: clear CRTC color blob pointers after dropping refs
1348bf64c197 gpio: mlxbf3: fail probe if gpiochip registration fails
7d3532a0b11a perf cs-etm: Reject CPU IDs that would overflow signed comparison
a56f29ad8aac perf: Remove redundant kernel.h include
f8898d2eb71a perf bpf: Bounds-check array offsets in bpil_offs_to_addr()
cafd80d81f08 perf bpf: Reject oversized BPF metadata events that truncate header.size
1935d213aeb2 perf bpf: Validate func_info_rec_size and sub_id in synthesize_bpf_prog_name()
aea30b437ebd perf sched: Replace (void*)1 sentinel with proper runtime allocation
bc27041e8971 perf hwmon: Fix fd check to accept fd 0 in hwmon_pmu__describe_items()
661f60a8a5cf perf tools: Use snprintf() for root_dir path construction
5d080b7324f0 perf dso: Set error code when open() fails on uncompressed fallback path
debfcd673a6d perf dso: Fix heap overflow in dso__get_filename() on decompressed path
95bf4dbcd502 perf tools: Fix uninitialized pathname on uncompressed fallback in filename__decompress()
fa870f951793 perf tools: Add O_CLOEXEC to open() calls in DSO and ELF code
3ae7947101b9 perf tools: Don't read build-ids from non-regular files
2c19e40753ec perf symbols: Break infinite loop on zero-filled notes in sysfs__read_build_id()
137eabe3c18f perf symbols: Validate p_filesz before use in filename__read_build_id()
ca3393e258f6 perf symbols: Fix bswap copy-paste error for 32-bit ELF p_filesz
f231387f3d2b sparc: led: avoid trimming a newline from empty writes
17955f1995bf accel/ivpu: fix HWS command queue leak on registration failure
85873b1bd366 apparmor: fix label can not be immediately before a declaration
38d3d33bf42c i3c: master: Prevent reuse of dynamic address on device add failure
c4f2afcdc547 i3c: master: Defer new-device registration out of DAA caller context
3891c061341f i3c: master: Ensure Hot-Join operations are stopped on shutdown
57490b302b98 i3c: master: Consolidate Hot-Join DAA work in the core
0bd450d40f87 i3c: master: Move rstdaa error suppression
fd32e8d4a293 i3c: master: Add i3c_master_do_daa_ext() for post-hibernation address recovery
b07a318afca1 i3c: master: Introduce optional Runtime PM support
882ee831366a i3c: master: Replace WARN_ON() with dev_err() in i3c_dev_free_ibi_locked()
de2106d99b87 i3c: add sysfs entry and attribute for Device NACK Retry count
0d66830f302f i3c: master: Make hot-join workqueue freezable to block hot-join during suspend
eb9db96a5deb i3c: master: add WQ_PERCPU to alloc_workqueue users
45bbc1e1fe62 i3c: mipi-i3c-hci: Preserve RUN bit when aborting DMA ring
d22ab94261c7 i3c: mipi-i3c-hci: Switch PIO data allocation to devm_kzalloc()
973fda38b124 i3c: mipi-i3c-hci: Allow for Multi-Bus Instances
5625b8767ce3 i3c: mipi-i3c-hci: Quieten initialization messages
2791dd42d41e apparmor: fix uninitialised pointer passed to audit_log_untrustedstring()
fdf610a9a9e7 apparmor: don't audit files pointing to aa_null.dentry
b58d240883df apparmor: put secmark label after secid lookup
66a6c61369d4 apparmor: aa_getprocattr free procattr leak on format failure
22dc9433d458 apparmor: fail policy unpack on accept2 allocation failure
3b918f6f5239 apparmor: Fix return in ns_mkdir_op
566d1ef98a71 apparmor: remove or add symlinks to rawdata according to export_binary
fbfdb5a94a48 apparmor: fix NULL pointer dereference in unpack_pdb
57b1bd4486d5 apparmor: fix potential UAF in aa_replace_profiles
b427061ca498 apparmor: grab ns lock and refresh when looking up changehat child profiles
9111f76e8dc8 apparmor: fix rawdata_f_data implicit flex array
ae02e603c0b3 apparmor: aa_label_alloc use aa_label_free on alloc failure
d82160132345 apparmor: check label build before no_new_privs test
ad965f36d298 security/apparmor/apparmorfs.c: conditionally compile get_loaddata_common_ref()
045dbe89ac31 apparmor: fix refcount leak when updating the sk_ctx
d8ea44f6090c apparmor: fix race in unix socket mediation when peer_path is used
ef488d7429d2 apparmor: fix shadowing of plabel that prevents cache from being updated
f79519f63605 Revert "PCI/MSI: Unmap MSI-X region on error"
514b84b1bf30 PCI: dwc: Avoid dwc_pcie_rasdes_debugfs_deinit() NULL dereference when no RAS DES capability
11016555d751 phy: freescale: phy-fsl-imx8qm-lvds-phy: Fix missing pm_runtime_disable() on probe error path
872f9a63a108 PCI: mediatek: Use actual physical address instead of virt_to_phys()
f77c490c45d4 PCI: mediatek: Fix possible truncation in mtk_pcie_parse_port()
9ca0a78a5d56 dt-bindings: phy: sc8280xp-qmp-pcie: Disallow bifurcation register on Purwa
f1f5f8d334e9 perf symbols: Add bounds checks to read_build_id() note iteration in minimal build
cc6cd3fe8b8b perf symbols: Add bounds checks to elf_read_build_id() note iteration
a3e758e74122 perf bpf: Fix metadata leak in perf_env__add_bpf_info() on duplicate insert
f593775fecf5 perf bpf: Fix map data leak in bpf_metadata_create() on alloc failure
bafb6bfb346f perf bpf: Add NULL check for btf__type_by_id() in synthesize_bpf_prog_name()
fe4d8ad2e96f tools lib api: Fix mount_overload() snprintf truncation and toupper range
b0385203a09f tools lib api: Fix filename__write_int() writing uninitialized stack data
41b3a9231045 perf tools: Use snprintf() in dso__read_running_kernel_build_id()
fbaf9bdfc091 perf hwmon: Guard label read against empty or failed reads
d34b42ee0c74 perf symbols: Bounds-check descsz in sysfs__read_build_id() GNU fallback
bc2fc12ce6e4 perf hwmon: Fix parse_hwmon_filename() strlcpy buffer overflow
f830bb8d221f perf hwmon: Use scnprintf() in hwmon_pmu__for_each_event()
76dfa13a0acb perf hwmon: Fix off-by-one null termination on sysfs reads
56b17c84394f perf tools: Fix thread__set_comm_from_proc() on empty comm file
f2e5262589d9 perf intel-pt: Fix snprintf size tracking bug in insn decoder
45e7900e1555 perf symbols: Bounds-check .gnu_debuglink section data
4f883ab5bc7b perf symbols: Fix signed overflow in sysfs__read_build_id() size check
490473192ac2 tools lib api: Fix missing null termination in filename__read_int/ull()
09962b811ef1 perf pmu: Fix perf_pmu__parse_scale/unit() OOB access on empty sysfs file
a6eec54329b4 perf pmu: Fix pmu_id() heap underwrite on empty identifier file
e274dfa05904 perf cs-etm: Queue context packets for frontend
fa9eb50ddfea perf s390: Fix TEXTREL in Python extension by compiling as PIC
b5a0a4a564d2 xprtrdma: Return sendctx slot after Send preparation failure
007b4da2f38d xprtrdma: Repost Receive buffers for malformed replies
469b22376ee7 xprtrdma: Sanitize the reply credit grant after parsing
d7a2870dde3b xprtrdma: Fix bcall rep leak and unbounded peek
345652531400 xprtrdma: Resize reply buffers before reposting receives
47b3dc59e09e xprtrdma: Document and assert reply-handler invariants
7471e66373a4 xprtrdma: Check frwr_wp_create() during connect
28743571c17b xprtrdma: Initialize re_id before removal registration
d0479c2b1297 xprtrdma: Fix ep kref imbalance on ADDR_CHANGE
6d52921f4702 perf hists: Fix snprintf() in hists__scnprintf_title() UID filter path
56ad33189ed5 perf bpf: Use scnprintf() in snprintf_hex() and synthesize_bpf_prog_name()
c32fe40b0c74 perf sched: Fix idle-hist callchain display using wrong rb_first variant
77051ef66e4a perf sched: Bounds-check prio before test_bit() in timehist
2e0dd50e5a4d PCI: rcar-host: Remove unused LIST_HEAD(res)
b9e8406651dc perf tools: Use perf_env__get_cpu_topology() in machine__resolve()
504028f561b1 perf tools: Use scnprintf() in cpu_map__snprint() to prevent overflow
2a8244988316 perf tools: Fix get_max_num() size_t underflow on empty sysfs file
3f4476a089a6 platform/x86/intel/vsec: Restore BAR fallback for header walk
d6565e08166c platform/x86/intel/vsec: Return real error codes from registration path
4df30a4dc0e9 platform/x86/intel/vsec: Switch exported helpers from pci_dev to device
817ab332d37c platform/x86/intel/vsec: Decouple add/link helpers from PCI
e6523bcafeb6 platform/x86/intel/vsec: correct kernel-doc comments
c0d97519c9df platform/x86:intel/pmc: Relocate lpm_req_guid to pmc_reg_map
b95e1facc5b7 platform/x86:intel/pmc: Rename PMC index variable to pmc_idx
3e86797c0699 platform/x86:intel/pmc: Add support for multiple DMU GUIDs
4f129fc6f756 fs/ntfs3: resize log->one_page_buf when adopting on-disk page size
d3491b23bc20 PCI: meson: Add missing remove callback
a5c0ba31eef9 PCI: meson: Propagate devm_add_action_or_reset() failure
f0aaa198e068 pwm: rzg2l-gpt: Add missing newlines to dev_err_probe() messages
a57692ad365f PCI: mediatek: Fix operator precedence in PCIE_FTS_NUM_L0 macro
f161ef7b0dd2 nfs: use nfsi->rwsem to protect traversal of the file lock list
a6f147b23e36 NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS in pg_get_mirror_count_write
a70375f0b793 NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS on fatal DS connect errors
b694c7de94bc nfs: keep PG_UPTODATE clear after read errors in page groups
f84949dd1784 NFSv4/pnfs: defer return_range callbacks until after inode unlock
53442c7d0c88 xprtrdma: Decouple req recycling from RPC completion
becc90a04780 xprtrdma: Use sendctx DMA state for Send signaling
e7ae0883c8c8 xprtrdma: Post receive buffers after RPC completion
f043dd58fbd7 xprtrdma: Close lost-wakeup race in xprt_rdma_alloc_slot
b7bc8e7f09ae xprtrdma: Avoid 250 ms delay on backlog wakeup
44b73b4b7eff pNFS/filelayout: fix cheking if a layout is striped
f3f21b94cf98 sunrpc: Fix error handling in rpc_sysfs_xprt_switch_add_xprt_store()
e8dc126e8039 clk: qcom: a53: Corrected frequency multiplier for 1152MHz
c0e6bb2b0408 dmaengine: dma-axi-dmac: use DMA pool to manange DMA descriptor
9f1ef67c041e dmaengine: dma-axi-dmac: Properly free struct axi_dmac_desc
329ec20a8609 dmaengine: Fix possible use after free
7d49f0ddaf5a dmaengine: qcom: gpi: set DMA_PRIVATE capability
8e2c460a8f0e mshv: add bounds check on vp_index in mshv_intercept_isr()
eaf937b501fd clk: qcom: camcc-x1e80100: Add support for camera QDSS debug clocks
032692e4525a dt-bindings: clock: qcom: Add X1P42100 camera clock controller
c7c8bab87d0d perf tools: Fix int16_t truncation of max_cpu_num in set_max_cpu_num()
e16012f8f63d perf timechart: Fix cpu2y() OOB read on untrusted CPU index
330219fe8523 perf c2c: Fix use-after-free in he__get_c2c_hists() error path
01564c1a260f perf stat: Introduce perf_env__get_cpu_topology() to guard NULL env->cpu
c05ba5b57505 perf mmap: Fix NULL deref in aio cleanup on alloc failure
c4406dbe5d8f perf sched: Replace BUG_ON and add NULL checks in replay event helpers
b1f768363271 perf sched: Use thread__put() in free_idle_threads()
1517402d0a81 perf sched: Clean up idle_threads entry on init failure
d6b586bb8f48 perf c2c: Bounds-check CPU IDs in setup_nodes() topology loop
2f9f7224e769 perf c2c: Bounds-check CPU and node IDs before bitmap and array access
278e30717c35 perf stat: Bounds-check CPU index in topology aggregation callbacks
21a9b87ada08 perf mmap: Guard cpu__get_node() return in aio_bind()
652cea73b7b7 perf sched: Fix register_pid() overflow, strcpy, and BUG_ON
068e9b6a07bc perf sched: Cap max_cpu at MAX_CPUS in timehist sample processing
1d25a8418c89 perf tools: Add bounds check to cpu__get_node()
89489a31f444 perf sched: Fix thread reference leak in latency_switch_event
ea486d61b166 perf tools: Guard test_bit from out-of-bounds sample CPU
18961e0f8966 perf annotate: Fix crashes on empty annotate windows
93f3e84fc74e perf: Fix off-by-one stack buffer overflow in kallsyms__parse()
d78b16d07814 dt-bindings: dma: nvidia,tegra186-gpc-dma: Make reset optional
a498063f95bd dmaengine: imx-sdma: Refine spba bus searching in probe
da4058382315 thunderbolt: debugfs: Fix margining error counter buffer leak
038a0f01dda5 drm/amd/display: Add missing kdoc for ALLM parameters
c5388a957cf1 fs/ntfs3: fix mount failure on 64K page-size kernels
a31893206588 fs/ntfs3: add bounds check to run_get_highest_vcn()
097fcf945d93 HID: logitech-hidpp: remove excess kernel-doc member in hidpp_scroll_counter
26fa946925a0 clk: at91: keep securam node alive while mapping it
0147c544cbc6 iio: tcs3472: power down chip on probe failure
1cddef80a180 iio: accel: mma8452: handle I2C read error(s) in mma8452_read()
9ac3675bf875 iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling
3d5767211952 iio: magnetometer: ak8975: fix potential kernel stack memory leak
6ec473b36034 iio: light: si1133: prevent race condition on timeout
f835b69fbeae iio: light: si1133: reset counter to prevent race condition
fd6b65ade119 perf header: Sanity check HEADER_EVENT_DESC attr.size before swap
be62602fe079 PCI: qcom: Disable ASPM L0s for SA8775P
de93ef83f99e powerpc tools perf: Initialize error code in auxtrace_record_init function
96c8f732cadf clk: renesas: rzg2l: Rename iterator in for_each_mod_clock() to avoid shadowing
fdee9f207a48 gpib: fix double decrement of descriptor_busy in command_ioctl()
3d5e4cc0d9dc char: tlclk: fix use-after-free in tlclk_cleanup()
d72ece584c44 gpib: Fix inappropriate ioctl error return
92f8b1d83383 perf test amd ibs: Fix incorrect kernel version check
2b2b1613b734 usb: host: max3421: Reject hub port requests for non-existent ports
02d03c61e8a7 usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control()
43078449ad62 staging: most: video: avoid double free on video register failure
45652323ce74 perf inject: Add --convert-callchain option
28ebd287a7fa perf build-id: Fix off-by-one bug when printing kernel/module build-id
fc5ce5606db5 PCI: dwc: Fix signedness bug in fault injection test code
7d881615fb63 mailbox: mtk-adsp: fix UAF during device teardown
91353d63bbf6 mailbox: mpfs: fix check for syscon presence in mpfs_mbox_inbox_isr()
e6bc4e127707 coresight: Fix source not disabled on idr_alloc_u32 failure
67d0475e78b3 soundwire: intel_ace2x: release bpt_stream when close it
5732869c70d4 clk: at91: sam9x7: Fix gmac_gclk clock definition
f28906e7e32f perf pmu: Skip test on Arm64 when #slots is zero
210c202c0576 phy: phy-can-transceiver: Check driver match and driver data against NULL
226feccaac81 clk: qcom: cmnpll: Account for reference clock divider
6abdf27fbcfb coresight: fix missing error code when trace ID is invalid
5bb87456dcd6 bus: mhi: ep: Fix potential deadlock in mhi_ep_reset_worker()
601a9b2e3b2f rust: alloc: fix assert in Vec::reserve doc test
b773c7161cea PCI: loongson: Do not ignore downstream devices on external bridges
e1b79f77336d perf sched: Add missing mmap2 handler in timehist
c788955b4a14 platform/x86: xo15-ebook: Fix wakeup source and GPE handling
2ce4d93768d2 x86/platform/olpc: xo15: Drop wakeup source on driver removal
1d495446ec7a PCI: Check ROM header and data structure addr before accessing
78f264c0cb2a PCI: Introduce named defines for PCI ROM
10021c2d3306 PCI/ASPM: Don't reconfigure ASPM entering low-power state
48dde5c56426 coresight: etm4x: Correct TRCVMIDCCTLR1 save and restore
65d87f28daec coresight: ete: Always save state on power down
1ac8f4c112aa coresight: etm4x: Remove the state_needs_restore flag
a454f61747c9 soundwire: fix bug in sdw_add_element_group_count found by syzkaller
d3896c944338 soundwire: don't program SDW_SCP_BUSCLOCK_SCALE on a unattached Peripheral
c3ca7c6741af coresight: cti: Fix DT filter signals silently ignored
fb940466fd4d perf debuginfo: Fix libdw API contract violations
bb3d592c7d6c staging: nvec: fix use-after-free in nvec_rx_completed()
466c7f87de52 i3c: master: svc: Fix missed IBI after false SLVSTART on NPCM845
db2d8b6525bd gpiolib: acpi: Only trigger ActiveBoth interrupts on boot
02e2dadd62ea eventpoll: Fix epoll_wait() report false negative
f938bc8fde51 eventpoll: rename epi->next and txlist for clarity
430dac191905 eventpoll: wrap EP_UNACTIVE_PTR in typed sentinel helpers
d8f88803152f eventpoll: extract ep_deliver_event() from ep_send_events()
4fd51f413d7b eventpoll: split ep_insert() into alloc + register stages
25e85dc040a6 eventpoll: rename attach_epitem() to ep_attach_file()
baebd892f8a2 eventpoll: expand top-of-file overview / locking doc
f04166c8677a eventpoll: rename ep_remove_safe() back to ep_remove()
13bf9879b778 net/9p: fix race condition on rdma->state in trans_rdma.c
9c1c120471a6 9p: avoid returning ERR_PTR(0) from mkdir operations
ae1f3460833d ocfs2: fix circular locking dependency in ocfs2_dio_end_io_write
d35e4032f16d mfd: cs42l43: Sanity check firmware size
706fe1ce4f3a mfd: rsmu: Fix page register setup
35d3d6ff2bc1 ksmbd: fix use-after-free in same_client_has_lease()
aa0c43c13c0b RDMA/bnxt_re: Fail DBR related page allocation UAPIs if the feature is disabled
0fe155aa844e RDMA/bnxt_re: Move the UAPI methods to a dedicated file
95d46a8d3ba9 RDMA/bnxt_re: Avoid displaying the kernel pointer
104a7ff382a5 RDMA/bnxt_re: Free SRQ toggle page after firmware teardown
5a48dd5150d7 ionic: Fix check in ionic_get_link_ext_stats
4c55003566c0 net: ethernet: oa_tc6: Remove FCS size in RX frame
93e133b9193c net: airoha: Fix always-true condition in PPE1 queue reservation loop
d774cdbda663 tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF)
0d8a12d71431 tipc: fix UAF in tipc_l2_send_msg()
db1616263a2c KEYS: Use acquire when reading state in keyring search
66919a6d72b9 powerpc/kexec: fix double get_cpu() imbalance in kexec_prepare_cpus
527cd14a416f powerpc/powernv: fix preempt count leak in pnv_kexec_wait_secondaries_down
73711688479d powerpc/perf: fix preempt count underflow in fsl_emb_pmu_del
92f38fe85198 MIPS: mm: Fix out-of-bounds write in maar_res_walk()
fe09dd288722 bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check
81567d2b3f4d sockmap: Fix use-after-free in udp_bpf_recvmsg()
073d95725269 net: remove addr_len argument of recvmsg() handlers
4e40056bb5c8 bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data()
264d6a79c96e udf: fix nls leak on udf_fill_super() failure
5e8627b7a7b7 bpf: Fix bpf_get/setsockopt to tos for ipv4-mapped ipv6 socket
e80307776924 selftests/bpf: Initialize operation name before use
9f32d4c2de85 selftests/bpf: Fix typo in verify_umulti_link_info
74badb5e2b00 smb/client: always return a value for FS_IOC_GETFLAGS
21303c4a2b72 cifs: remove all cifs files before kill super
7a59146cb9ad ALSA: core: Fix unintuitive behavior of snd_power_ref_and_wait()
87d1eaffeec4 netfilter: nf_conncount: callers must hold rcu read lock
98a965cb1e76 ALSA: seq: avoid stale FIFO cells during resize
287d506d4e08 ALSA: seq: oss: Serialize readq reset state with q->lock
f01fb6138f8e kcm: use WRITE_ONCE() when changing lower socket callbacks
4d48c08a0bf6 net: airoha: Fix debugfs new-tuple display for IPv4 ROUTE entries
dcac6e4221f3 net: airoha: Fix register index for Tx-fwd counter configuration
36edab340a06 net: bcmgenet: Use weighted round-robin TX DMA arbitration
b91b241a4eef landlock: Fix unmarked concurrent access to socket family
1bb02353e79f dpll: balance create/delete notifications in _dpll_pin(un)register
77a1ea975c87 dpll: guard sync-pair removal on full pin unregister
8008ef973f01 dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister()
6564ce3a2f9c dpll: send delete notification before unregister in on-pin rollback
f1e1c6eb8248 dpll: fix stale iteration in dpll_pin_on_pin_unregister()
20575400fc1b dpll: Enhance and consolidate reference counting logic
ebe4bd3560a7 dpll: Support dynamic pin index allocation
f7aebaee2961 net: wwan: t7xx: check skb_clone in control TX
34bd255dba32 net: ethernet: mtk_wed: debugfs: correct index in wed_amsdu_show()
1d072cc3ba43 octeontx2-af: npc: Fix size of entry2cntr_map
417bd36a085d bpf: Fix setting retval to -EPERM for cgroup hooks not returning errno
3d90b15fb191 net/mlx5: Check max_macs devlink param value against max capability
8d5f4be13488 bpf: Run generic devmap egress prog on private skb
450e48271827 net/sched: sch_dualpi2: Add missing module alias
6d585d0dc674 net: ethernet: mtk_wed: fix loading WO firmware for MT7986
446fe8ce699c net: watchdog: fix refcount tracking races
697db22a9dcc net: mana: guard TX wq object destroy with INVALID_MANA_HANDLE check
62ce489acb42 net: mana: initialize gdma queue id to INVALID_QUEUE_ID
bd851b10daee net/sched: sch_dualpi2: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen
755108bb7a50 net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen
0500af8630c3 net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen
a05d638b6074 virtio_net: do not allow tunnel csum offload for non GSO packets
ce311bd2e365 tcp: clear sock_ops cb flags before force-closing a child socket
67cec2f1eb9e handshake: Require admin permission for DONE command
d0503357653e power: supply: core: fix supplied_from allocations
7f4aa81f5bb2 ASoC: adau1372: Clear PLL_EN on failed PLL lock without reset GPIO
0c22c0092435 iommu: Avoid copying the user array twice in the full-array copy helper
1c9246a199e1 spi: xilinx: use FIFO occupancy register to determine buffer size
dae23c545eb5 ALSA: seq: Fix kernel heap address leak in bounce_error_event()
1749fef4bda0 ALSA: usb-audio: qcom: Guard sideband endpoint removal
2ba237315193 crypto: rng - Free default RNG on module exit
fb4d57b83356 crypto: cavium/cpt - fix DMA cleanup using wrong loop index
5f99a396f706 crypto: marvell/octeontx - fix DMA cleanup using wrong loop index
4941205f5fa3 cxl/test: Add check after kzalloc() memory in alloc_mock_res()
a27481516d32 cxl/test: Unregister cxl_acpi in cxl_test_init() error path
7e401233f9bb tipc: reject inverted service ranges from peer bindings
3cfa3d8e0dc1 tipc: prevent snt_unacked underflow on CONN_ACK
cebaefe1aceb tipc: require net admin for TIPCv2 netlink mutators
66dbb13eeb2f net/sched: sch_hfsc: Don't make class passive twice
51a1d9836acc net: pfcp: allocate per-cpu tstats for PFCP netdevs
ed8605c6f39b sctp: validate embedded address parameter length
a090880c1f54 bridge: cfm: reject invalid CCM interval at configuration time
bb4a5b3c91af net: fib_rules: Don't dump dying fib_rule in fib_rules_dump().
0a8b5b74f0e6 net/sched: cls_flow: Dont expose folded kernel pointers
10e05634ddc1 net: dsa: qca8k: fix led devicename when using external mdio bus
e098c9c6477d ASoC: tegra: tegra210_ahub: Validate written enum value
0f1510e84d7b ASoC: fsl: fsl_audmix: Validate written enum values
9131e4b023e0 ASoC: codecs: hdac_hdmi: Validate written enum value
cb527e063a32 ASoC: SOF: Intel: hda-sdw-bpt: select SND_SOF_SOF_HDA_SDW_BPT properly
d3ff718c0c71 RDMA/mlx5: Release the HWâ€‘provided UAR index rather than the SW one
4b87a2497276 RDMA/mlx5: Fix undefined shift of user RQ WQE size
1bc1487f7a7f RDMA/mlx5: Remove raw RSS QP restrack tracking
f704db4b0318 RDMA/mlx5: Remove DCT restrack tracking
3a1687e0506b fs: efs: remove unneeded debug prints
7e694ac97591 Bluetooth: vhci: validate devcoredump state before side effects
ec4d352747a6 Bluetooth: hci: validate codec capability element length
7f206a8d8d82 Bluetooth: btmtk: fix URB leak in alloc_mtk_intr_urb error path
a0fd1086a57b Bluetooth: hci_core: Fix UAF in hci_unregister_dev()
e8815ae9dcdc Bluetooth: hci_event: fix simultaneous discovery stuck in FINDING
f1b4df9c260c Bluetooth: eir: Fix stack OOB write when prepending the Flags AD
e284bb94ad45 Bluetooth: hci_qca: fix NULL pointer dereference in qca_dmp_hdr() for non-serdev device
c86c861c64b5 s390/process: Fix kernel thread function pointer type
0eab19ab9cb1 ASoC: cs35l56: Fix possible uninitialized value in cs35l56_spi_system_reset()
c83255f3cf22 arm64: dts: allwinner: a523: Add missing GPIO interrupt
ad6963c3bb45 pinctrl: airoha: an7581: fix misprint in gpio19 pinconf
5985ddfd3e83 pinctrl: airoha: an7581: add missed gpio32 pin group
db3cd694ded4 pinctrl: airoha: generalize pins/group/function/confs handling
0234e8fc296e pinctrl: sunxi: a523: Remove unneeded IRQ remuxing flag
46fbafe3d2d5 bpf: Tighten cgroup storage cookie checks for prog arrays
d416dcefdbac vfio/qat: fix f_pos race in qat_vf_resume_write()
1201dbb26050 of: cpu: add check in __of_find_n_match_cpu_property()
d2acea4f4747 cxl/test: Zero out LSA backing memory to avoid leaking to user
42a9a76f314e cxl/test: Fix integer overflow in mock LSA bounds checks
91ad3088ee1b selftests/bpf: Fix bpf_iter/task_vma test
f00f5c0dd553 ext4: fix kernel BUG in ext4_write_inline_data_end
c998a09c7144 bonding: 3ad: fix mux port state on oper down
f0ada4846d11 bonding: 3ad: fix carrier when no usable slaves
cb20a9b50efe bonding: 3ad: add lacp_strict configuration knob
47636f0a70b3 netlink: specs: rt-link: missed broadcast-neigh
6b2c271d2c39 tools: missed broadcast_neigh if_link uapi header
484b3b9aa798 ext4: fix ERR_PTR(0) in ext4_mkdir()
88cb304c0be0 ASoC: cs35l56: Don't leave parent IRQ disabled if system_suspend fails
8b55e7ec116c ASoC: cs35l56: Fix missing calls to wm_adsp2_remove()
3ef0cfa77a3d vdpa/octeon_ep: fix IRQ-to-ring mapping in interrupt handler
54556d539438 vdpa/octeon_ep: Fix PF->VF mailbox data address calculation
86e0b37738de tools/virtio: check mmap return value in vringh_test
321c73baf54d vhost/net: complete zerocopy ubufs only once
646614dcb160 vduse: Requeue failed read to send_list head
f9d922023445 virtio_console: read size from config space during device init
79366023aa89 virtio: rtc: tear down old virtqueues before restore
1f5f94c6c6b2 vhost/vdpa: validate virtqueue index in mmap and fault paths
a2d0a57538fd vduse: hold vduse_lock across IDR lookup in open path
3d56f3fb201f ASoC: codecs: aw88261: fix incorrect masks for boost regs
ecb9be4fc8be spi: meson-spifc: fix runtime PM leak on remove
da6f86ff4f2d NFSD: Handle layout stid in nfsd4_drop_revoked_stid()
37e85be551c4 IB/mlx4: Fill in the access_flags if IB_MR_REREG_ACCESS is not specified
e6d83f877d5a ASoC: sma1307: Fix uevent string leaks in fault worker
701ea71c17c9 igc: skip RX timestamp header for frame preemption verification
2aa37c8ef109 btrfs: fix deadlock cloning inline extent when using flushoncommit
f85410ebf20b btrfs: annotate lockless read of defrag_bytes in should_nocow()
18285888cb41 btrfs: zoned: always set max_active_zones for zoned devices
943f5917c53c Revert "btrfs: fix the file offset calculation inside btrfs_decompress_buf2page()"
ba641829c11c btrfs: zoned: don't account data relocation space-info in statfs free space
bd5e90b0f5a0 hwmon: (it87) Clamp negative values to zero in set_fan()
ebb579c5c0f0 vfs: add FS_USERNS_DELEGATABLE flag and set it for NFS
de590cdf7efe fbdev: sm501fb: Fix buffer errors in OF binding code
0678fed27def wifi: ath12k: enable IEEE80211_VHT_EXT_NSS_BW_CAPABLE when NSS ratio is reported
47e5302722e0 gpio: mt7621: fix interrupt banks mapping on gpio chips
90a9c909c5b7 ALSA: aloop: Drop superfluous break
3b15d02be05e btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs()
7ec839c7c0bc wifi: mt76: mt7996: fix potential tx_retries underflow
ad12fdaaed16 wifi: mt76: mt7925: fix potential tx_retries underflow
3b6e6fefa57f wifi: mt76: mt7921: fix potential tx_retries underflow
6b8e35685c18 wifi: mt76: mt7915: fix potential tx_retries underflow
6356a829a1ed wifi: mt76: fix argument to ieee80211_is_first_frag()
42f34c478fcd wifi: mt76: mt7996: limit work in set_bitrate_mask
1a399103cacc wifi: mt76: mt7996: fix reading zeroed info->control.flags after mt76_tx_status_skb_add()
dfb27e5dd9e4 wifi: mt76: mt7996: Fix possible NULL pointer dereference in mt7996_mac_write_txwi_80211()
06e65d6cf804 wifi: mt76: mt7996: Fix possible token leak in mt7996_tx_prepare_skb()
c386e90a7ce8 wifi: mt76: mt7925: validate skb length in testmode query
856fa6a21586 wifi: mt76: mt792x: skip MLD header rewrite for 802.3 encap TX
a10e4959a73b wifi: mt76: mt7925: keep TX BA state in the primary WCID
b8bf7c221b36 wifi: mt76: mt7925: fix stale pointer comparisons in change_vif_links
bd3b91ff1300 wifi: mt76: mt7996: add missing max_remain_on_channel_duration
c7a83899203e wifi: mt76: use kfree_rcu for offchannel link in mt76_put_vif_phy_link
3f0ea6d14fa4 wifi: mt76: mt7925: clean up DMA on probe failure
ce9d5a021cfc ARM: configs: Drop duplicated CONFIG_EXT4_FS
c788617705c3 sched/fair: Fix cpu_util runnable_avg arithmetic
a2e8b5264f92 hwspinlock: qcom: avoid uninitialized struct members
bbd664b7c77f vmalloc: fix NULL pointer dereference in is_vm_area_hugepages()
648a3960e366 pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins 34-39
44cff0737127 pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39
f775e7bda9a4 scsi: target: Remove tcm_loop target reset handling
c2bd9fdb448d scsi: target: Fix hexadecimal CHAP_I handling
0404baeb9e43 pinctrl: qcom: Fix resolving register base address from device node
298821692d44 watchdog: unregister PM notifier on watchdog unregister
637ef4961470 configfs: fix lockless traversals of ->s_children
f25d6e4ec4c2 firmware_loader: Fix recursive lock in device_cache_fw_images()
9e82497138ab ASoC: amd: acp-sdw-sof: Bound DAI link iteration
1279bdab5fa1 ASoC: amd: acp-sdw-legacy: Bound DAI link iteration
e8d89baf9217 spi: ep93xx: fix double-free of zeropage on DMA setup failure
e123f0ab02d0 IB/mlx5: Don't mangle the mr->pd inside the rereg callback
fd284b12810e IB/mlx5: Pull the pdn out of the depths of the umr machinery
8119fe468b01 IB/mlx5: Remove unused mkc bits in mlx5r_umr_update_mr_page_shift()
d4f84bfa089f IB/mlx5: Properly support implicit ODP rereg_mr
f5657d399b7e IB/mlx5: Don't take the rereg_mr fallback without a new translation
c213b71a2d41 btrfs: don't force DIO writes to be serialized
920dcf1cb8da thermal: testing: reject missing command arguments
dde04550fd6f cpufreq: Documentation: fix conservative governor freq_step description
6cb635ad1006 ACPI: IPMI: Fix message kref handling on dead device
b7474f4432dd bpf: Fix NULL pointer dereference in bpf_task_from_vpid()
84932636d020 powerpc/8xx: implement get_direction() in cpm1
8daa1a64711e kunit:tool: Don't write to stdout when it should be disabled
8b0510cc3a4a bpf: Fix NMI/tracepoint re-entry deadlock on lru locks
74ac1ce1f4af ALSA: seq: Clear variable event pointer on read
c04e0cde2fa3 riscv: stacktrace: Remove bogus -0x4 offset in non-FP walk_stackframe
834d4cc067fa riscv: cpu_ops: Change return value type of cpu_is_stopped() to bool
4b2b6bc7f5eb ALSA: seq: Fix partial userptr event expansion
af8f0ea1f0a3 wifi: wcn36xx: fix OOB read from short trigger BA firmware response
f03782f7f41f wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication
1b5d8a248c3a wifi: wcn36xx: fix heap overflow from oversized firmware HAL response
495e7e832c67 bpf: Update transport_header when encapsulating UDP tunnel in lwt
efe57b72196a bpf: Check tail zero of bpf_prog_info
58513d6d1241 bpf: Check tail zero of bpf_map_info
2eb39de4962f bpf: Clear rb node linkage when freeing bpf_rb_root
f6183983ce1f RDMA/siw: Fix endpoint/socket association handling
04255bda8d79 arm64: dts: imx8mp-kontron: Fix GPIO for display power switch
e6ab22200e44 arm64: dts: tqma8mpql-mba8mpxl: configure sai clock in audio codec as well
f3ef944c5599 arm64: dts: lx2162a-clearfog: use rev2 SoC dtsi
b5087fc4ef1f arm64: dts: imx95: Correct PCIe outbound address space configuration
ab4b5a07e1c1 arm64: dts: imx8mp-kontron: Reduce EERAM SPI clock frequency
f9173e0fc026 RDMA/irdma: Initialize iwmr->access during MR registration
54cab78df037 RDMA/irdma: Fix OOB read during CQ MR registration
844a1ae78e22 ALSA: hda: fix Kconfig dependency of HD Audio PCI
47831b503ecb IB/cm: Fix av cm device leak on an error path in cm_init_av_by_path()
fe5414d6b399 RDMA/hfi1: Open-code rvt_set_ibdev_name()
77b4bfc1ce32 netfilter: conntrack: call nf_ct_gre_keymap_destroy() if master helper is pptp
d53eecbca16f netfilter: conntrack: revert ct extension genid infrastructure
e6665d36b37b x86/cpu: Remove obsolete aperfmperf_get_khz() declaration
dd0d22fdae4c ALSA: usb-audio: qcom: Initialize offload control return value
8ebc31b86dcc netfilter: synproxy: protect nf_ct_seqadj_init() with conntrack lock
5c9c67cf7a3d netfilter: synproxy: fix unaligned memory access in timestamp adjustment
b171119082ba netfilter: synproxy: adjust duplicate timestamp options
4dbb71c046f7 netfilter: synproxy: drop packets if timestamp adjustment fails
dce1e3cf735d netfilter: nfnetlink_cthelper: use {READ,WRITE}_ONCE for accessing helper flags
7b819a84f1d5 netfilter: nfnetlink_osf: fix mss parsing on big-endian architectures
c3ebf67cf8a9 ocfs2: fix race between ocfs2_control_install_private() and ocfs2_control_release()
a087b2d3411e ocfs2/dlm: require a ref for locking_state debugfs open
3fa7139b5f42 ocfs2: reject FITRIM ranges shorter than a cluster
0e389fc290c3 ocfs2: fix buffer head management in ocfs2_read_blocks()
3fe2d0d21c8a lib: kunit_iov_iter: repeatedly call alloc_pages_bulk()
bb44a7690a4d ocfs2: rebase copied fsdlm LVB pointers in locking_state
9af58d10d0d8 of: reserved_mem: avoid post-init UAF when alloc_reserved_mem_array() fails
9a030fcb4b19 drm/amdkfd: always resume_all after suspend_all
b8d15e85596a cxl/fwctl: Fix __fortify_panic
b64120d54278 xfrm: fix NAT-related field inheritance in SA migration
ac9e29b191a0 perf/x86/amd/uncore: Use Node ID to identify DF and UMC domains
58cbb1c2aadf perf/x86/intel/uncore: Fix discovery unit lookup for multi-die systems
4e18e9361aab perf/x86/amd/core: Always use the NMI latency mitigation
f5102e0fc3c6 iommu/vt-d: Fix RB-tree corruption in probe error path
7f229d27bf27 vhost: fix vhost_get_avail_idx for a non empty ring
73f9f54d7174 bpftool: Use libbpf error code for flow dissector query
4beed798daf4 drm/amdgpu: set sub_block_index for mca ras sub-blocks
e82d515092a0 ext4: fix fast commit wait/wake bit mapping on 64-bit
8cbd587e8cdb lockdep/selftests: Restore sched_rt_mutex state on PREEMPT_RT
8d5ed4810e47 lockdep/selftests: Restore migrate_disable() state on PREEMPT_RT
c3b073a209a9 configfs_lookup(): don't leave ->s_dentry dangling on failure
778bb4939d45 riscv: dts: sophgo: sg2042: use hex for CPU unit address
efe71fbced52 riscv: dts: sophgo: sg2044: use hex for CPU unit address
5a1168ba0a95 lib/test_meminit: use && for bools
377758884852 tick/sched: Fix TOCTOU in nohz idle time fetch
5cf2c85b1231 bpf: Reject exclusive maps for bpf_map_elem iterators
0830287cc6cb driver core: Use system_percpu_wq instead of system_wq
5e406928404d nvme: fix FDP fdpcidx bounds check
36bdda0c86d5 sched: restore timer_slack_ns when resetting RT policy on fork
ffa974b2f50a ext2: fix ignored return value of generic_write_sync()
8d763babb2a2 mm/fake-numa: fix under-allocation detection in uniform split
61f197297282 bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs
d81370c6c4f5 scsi: ufs: Fix wrong value printed in unexpected UPIU response case
846052542cfa scsi: pm8001: Fix error code in non_fatal_log_show()
0de14eae6de8 libbpf: Skip max_entries override on signed loaders
abe383999640 libbpf: Skip initial_value override on signed loaders
b6862b6a25c6 libbpf: Reject non-exclusive metadata maps in the signed loader
3a0f73d27a8d bpf: Reject exclusive maps as inner maps in map-in-map
91ca9eab008b scsi: Revert "scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans"
5c53406098b5 nvdimm/btt: Handle preemption in BTT lane acquisition
d292b30e1b74 x86/cpu: Keep the PROCESSOR_SELECT menu together
901802925ebe ARM: imx31: Fix IIM mapping leak in revision check
617a5a67ce01 ata: libata: Fix ata_exec_internal()
cfcea221db93 wifi: ath12k: fix NULL deref in change_sta_links for unready link
eb9b89baf308 wifi: ath12k: fix incorrect HT/VHT/HE/EHT MCS reporting in monitor mode
adf0eb748d21 HID: wiimote: Fix table layout and whitespace errors
2d642797dd1c ARM: imx3: Fix CCM node reference leak
f0742d09eb6b NFSD: Fix delegation reference leak in nfsd4_revoke_states
9e565962d999 ASoC: rsnd: Fix RSND_SOC_MASK width to single nibble
8ec64276ecd2 spi: atmel: fix DMA channel and bounce buffer leaks
ab4d04bf8b2f ext4: fix LOGFLUSH shutdown ordering to allow ordered-mode data writeback
803087a16a4e libbpf: Skip endianness swap when loader generation failed
f3389fbaff1a libbpf: Skip hash computation when loader generation failed
a441c0794ac2 selftests/bpf: add verification for BPF_PROG_QUERY attr size boundaries
a7131340d0f9 bpf: fix BPF_PROG_QUERY OOB write and cgroup backward compat
5ac9e793ba25 raid1: fix nr_pending leak in REQ_ATOMIC bad-block error path
b7313f23ea5a md/raid10: reset read_slot when reusing r10bio for discard
e04e384274f8 rpmsg: use generic driver_override infrastructure
0e2f0833556c Drivers: hv: vmbus: use generic driver_override infrastructure
d2cf52ba2803 cdx: use generic driver_override infrastructure
b41923dbf676 amba: use generic driver_override infrastructure
ff4e38a37ba5 media: qcom: venus: relax encoder frame/blur step size on v6
bc7c166cc101 media: qcom: venus: relax encoder frame/blur dimension steps on v4
ffe754288750 media: qcom: venus: drop extra padding in NV12 raw size calculation
f8f48c851a0d Revert "media: venus: hfi_platform: Correct supported codecs for sc7280"
5420eebf3b3c RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path
02558c86b6b7 RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe
4779f435627b RDMA/umem: Add ib_umem_is_contiguous() stub for !CONFIG_INFINIBAND_USER_MEM
bae436a78a05 arm64: dts: st: Fix SAI addresses on stm32mp251
5da012c605fd EDAC/{skx_common,skx}: Fix UBSAN shift-out-of-bounds in skx_get_dimm_info

…

View originalPermalink

7.1.4-xanmod1

Jul 18, 2026 · 14 days ago

Fixed 20

xfs: use rtrefcount btree cursor in xchk_xref_is_rt_cow_staging
xfs: write the rg superblock when fixing it
xfs: fix off-by-one error when calling xchk_xref_has_rt_owner
xfs: don't zap bmbt forks if they are MAXLEVELS tall
xfs: fully check the parent handle when it points to the rootdir
xfs: clamp timestamp nanoseconds correctly
xfs: handle non-inode owners for rtrmap record checking
xfs: set xfarray killable sort correctly
xfs: use the rt version of the cow staging checker
xfs: grab rtrmap btree when checking rgsuper
xfs: don't wrap around quota ids in dqiterate
xfs: resample the data fork mapping after cycling ILOCK
xfs: fail recovery on a committed log item with no regions
xfs: fix null pointer dereference in tracepoint
smb: client: reject overlapping data areas in SMB2 responses
Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev
timekeeping: Register default clocksource before taking tk_core.lock
fuse-uring: remove request-less entries from ent_w_req_queue to fix NULL deref
fuse-uring: make a fuse_req on SQE commit only findable after memcpy
fuse-uring: Avoid queue->stopped races and set/read that value under lock

967cc061f0dc Linux 7.1.4-xanmod1
d3dc120f721d Merge tag 'v7.1.4' into 7.1
7a5cef0db479 Linux 7.1.4
63940a3adc7d xfs: use rtrefcount btree cursor in xchk_xref_is_rt_cow_staging
5394c215efde xfs: write the rg superblock when fixing it
4d281a74eed8 xfs: fix off-by-one error when calling xchk_xref_has_rt_owner
19fa8bc0df48 xfs: don't zap bmbt forks if they are MAXLEVELS tall
704a6ba079f0 xfs: fully check the parent handle when it points to the rootdir
cb1f92cb29cc xfs: clamp timestamp nanoseconds correctly
b7e9edbed705 xfs: handle non-inode owners for rtrmap record checking
261c7a32f637 xfs: set xfarray killable sort correctly
5da68d6c927a xfs: use the rt version of the cow staging checker
b19e5b47424b xfs: grab rtrmap btree when checking rgsuper
2b14fe1e0924 xfs: don't wrap around quota ids in dqiterate
44f891bc0889 xfs: resample the data fork mapping after cycling ILOCK
cccbabeb9a18 xfs: fail recovery on a committed log item with no regions
0bc4d4a97302 xfs: fix null pointer dereference in tracepoint
57cba95f0e97 smb: client: reject overlapping data areas in SMB2 responses
25e2ac320c3d Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev
07e454687b13 timekeeping: Register default clocksource before taking tk_core.lock
ae8f855a28e0 ALSA: doc: usb-audio: Add doc for QUIRK_FLAG_IFB_SILENCE_ON_EMPTY
0a7f33010c0e fuse-uring: remove request-less entries from ent_w_req_queue to fix NULL deref
a635f427d57e fuse-uring: make a fuse_req on SQE commit only findable after memcpy
4021a3a79eee fuse-uring: Avoid queue->stopped races and set/read that value under lock
95d7f50aff2a fuse-uring: Avoid use-after-free in fuse_uring_async_stop_queues
4f45f276d5b4 fuse-uring: end fuse_req on io-uring cancel task work
e8afc85acdf3 fuse-uring: fix moving cancelled entry to ent_in_userspace list
d01a09b442cb fuse-uring: fix data races on ring->ready
fe604c08d874 fuse-uring: fix EFAULT clobber in fuse_uring_commit
893479015cb6 fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req
1ec674d3d0ed fuse: don't block in fuse_get_dev() for non-sync_init case
1f3f4060e656 fuse: fix io-uring background queue dispatch on request completion
65a1c2551f7e fuse: re-lock request before returning from fuse_ref_folio()
779b7f1fcdee fuse: do not use start_removing_noperm()
81b1045c401c fuse: fix device node leak in cuse_process_init_reply()
a37a64ebc9d7 Revert "fuse: fix conversion of fuse_reverse_inval_entry() to start_removing()"
c78c4b242299 fuse: avoid 32-bit prune notification count wrap
7ddcbd4dd85f fuse: back uncached readdir buffers with pages
75c93cd3c421 RDMA/siw: bound Read Response placement to the RREAD length
020700a2fdc4 RDMA/core: Fix broadcast address falsely detected as local
da3e44add94b RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg
2ffcdbfd1431 Input: maplecontrol - set driver data before registering input device
79e6fd106356 Input: maplemouse - set driver data before registering input device
2351e841951c Input: maple_keyb - set driver data before registering input device
d5ab7e52e86e Input: mms114 - fix multi-touch slot corruption
2914e243ec9e Input: maplemouse - fix NULL pointer dereference in open()
b75371bc87ae Input: gscps2 - advance receive buffer write index
f3d5e77b27fd Input: mms114 - reject an oversized device packet size
a8d87184576c Input: touchwin - reset the packet index on every complete packet
2691b68f9b03 Input: ads7846 - don't use scratch for tx_buf when clearing register
a747c4eb0265 Input: mms114 - fix touch indexing for MMS134S and MMS136
a40250f97c31 Input: iforce - bound the device-reported force-feedback effect index
2a6766869012 Input: goodix - clamp the device-reported contact count
6bac57d8fe2a Input: elan_i2c - prevent division by zero and arithmetic underflow
bfe622efecd4 Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count
64fb0e1161cc Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count
43d61346c040 Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure
00904687b9c5 i2c: i801: fix hardware state machine corruption in error path
5800647d19d3 i2c: imx-lpi2c: mark I2C adapter when hardware is powered down
1f0ab044e106 i2c: stm32f7: truncate clock period instead of rounding it
cb037e697da0 i2c: davinci: Unregister cpufreq notifier on probe failure
d8c97bde8224 i2c: mpc: Fix timeout calculations
35dbd1f1f603 i2c: core: fix adapter deregistration race
036d554f532b i2c: core: fix adapter debugfs creation
76402d37a5de i2c: core: fix adapter probe deferral loop
034e30742811 i2c: core: fix NULL-deref on adapter registration failure
3d760ca230b0 i2c: core: fix irq domain leak on adapter registration failure
fb2c0eab51ae fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()
284d5ba931a5 Revert "svcrdma: Use contiguous pages for RDMA Read sink buffers"
40eedc4253db svcrdma: wake sq waiters when the transport closes
0449a6583c0e dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning
18bd476ef4a1 udmabuf: fix DMA direction mismatch in release_udmabuf()
cd1067ccc0db KVM: arm64: Don't leak PFN when kvm_translate_vncr() races MMU notifier
f3a98d5881b9 KVM: guest_memfd: Treat memslot binding offset+size as unsigned values
f2ca2b532621 KVM: x86: Ensure vendor's exit handler runs before fastpath userspace exits
bf27cd2d58a4 KVM: TDX: Account all non-transient page allocations for per-TD structures
f0a47e6cb035 KVM: VMX: Handle bad values on proxied writes to LBR MSRs
aa41338ee2db KVM: SEV: Don't terminate SNP VMs on #VMGEXIT without a registered GHCB
77eab9571f6d KVM: VMX: Refresh GUEST_PENDING_DBG_EXCEPTIONS.BS on all injected #DBs
dda5ce3fdf89 KVM: SVM: Only disable x2AVIC WRMSR interception for MSRs that are accelerated
a3487d5926dd KVM: SVM: Disable x2AVIC RDMSR interception for MSRs KVM actually supports
256034648b9e KVM: x86: Add dedicated API for getting mask of accelerated x2APIC MSRs
dcdb476f5fc5 KVM: SEV: Pin source page for write when adding CPUID data for SNP guest
d4f4d61715d1 KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU
7fca3fcef81c KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU
60e51a62170a LoongArch: KVM: Add missing slots_lock for device register/unregister
5fd30133af86 KVM: arm64: nv: Avoid dereferencing NULL VNCR pseudo-TLB
5c22e38cfb73 selftests/landlock: Increase default audit socket timeout
395135628ad5 selftests/landlock: Filter dealloc records in audit_count_records()
7621e00a4059 landlock: Account all audit data allocations to user space
c02f2a0ae1c1 selftests/landlock: Explicitly disable audit in teardowns
0254cef9bf18 landlock: Set audit_net.sk for socket access checks
fe85607ceffc audit: fix removal of dangling executable rules
2c6381d90898 iommufd: Set upper bounds on cache invalidation entry_num and entry_len
0714e5a4c83e iommufd: Avoid partial fault group delivery in iommufd_fault_fops_read()
f66c16b17550 iommufd: Break the loop on failure in iommufd_fault_fops_read()
76c05bd8f634 iommufd: Reject invalid read count in iommufd_fault_fops_read()
db4e1a1e9f13 iommufd: Propagate allocation failure in iommufd_veventq_deliver_fetch()
f682c833f7d5 iommufd: Reject invalid read count in iommufd_veventq_fops_read()
7a860d6f260e iommufd: Rewind header length in done if iommufd_veventq_fops_read() fails
e7b5e5565274 iommufd: Set veventq_depth upper bound
6c5fc40200cd iommufd: Move vevent memory allocation outside spinlock
f9f08e46b9e3 iommufd: Fix data_len byte-count vs element-count mismatch
0cdbb97a4dbd iommufd: Use sizeof(*hdr) instead of sizeof(hdr) in veventq read
ff189754fc34 iommu/amd: Don't split flush for amd_iommu_domain_flush_all()
477f8dec3b5a iommu/vt-d: Avoid WARNING in sva unbind path
c76b8abce575 bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized
49af4044ed98 nouveau/vmm: fix another SPT/LPT race
f250db8ea6e9 selftests/mm: fix ksft_process_madv.sh test category
913324904ce9 selftests/mm: pagemap_ioctl: use the correct page size for transact_test()
04ba248d02d9 mm: do file ownership checks with the proper mount idmap
377b1cd6bbcf mm: page_ext: add count limit to page_ext_iter_next to prevent invalid PFN access
fceca62a095e selftests: mm: fix and speedup "droppable" test
246f0713360a mm: fix mmap errno value when MAP_DROPPABLE is not supported
9adedf9c885c lib/test_hmm: use kvfree() to free kvcalloc() allocations
ede985ff4b56 riscv: mm: Unconditionally sfence.vma for spurious fault
bc773b8b4c81 riscv: mm: Define DIRECT_MAP_PHYSMEM_END
84ab222021c2 NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr()
c8e041c68c0b exfat: bound uniname advance in exfat_find_dir_entry()
5bfa2814528d exfat: preserve benign secondary entries during rename and move
c4c82cdfdf8a vt: fix spurious modifier in CSI/cursor key sequences
e7da02659c22 module: decompress: check return value of module_extend_max_pages()
8e0a22bc728e rqspinlock: Fix order in raw_res_spin_(un)lock_irq to allow schedule
e36501b7d4ab NFSv4: include MAY_WRITE in open permission mask for O_TRUNC
80a7608376e5 audit: fix potential integer overflow in audit_log_n_hex()
e5d5f3bd053a tracing: Prevent out-of-bounds read in glob matching
792118d05f01 selftests/liveupdate: add test cases for LIVEUPDATE_IOCTL_CREATE_SESSION calls with invalid length
c04873ea85d9 liveupdate: reject LIVEUPDATE_IOCTL_CREATE_SESSION with invalid name length
0cff05bd2186 perf/aux: Fix page UAF in map_range()
5fd2dbeded54 i2c: core: fix hang on adapter registration failure
a935b64548fc regulator: scmi: fix of_node refcount leak in scmi_regulator_probe()
3e6e9f17f583 watchdog: apple: Add "apple,t8103-wdt" compatible
7057fcf3a6d3 EDAC/i10nm: Don't fail probing if ADXL is missing
03f6ecbc446c x86/mm: Fix freeing of PMD-sized vmemmap pages
9d000bdd250d spi: fsl-lpspi: terminate the RX channel on TX prepare failure path
507c13781101 spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync()
02d9dac2b843 arm64: fpsimd: Fix type mismatch in sme_{save,load}_state()
4519290ed20d crypto: talitos/hash - fix SEC2 64k - 1 ahash request limitation
1691f2c4a4f2 crypto: talitos/hash - remove useless wrapper
a4ffe8e7bdfe crypto: talitos/hash - rename first_desc/last_desc to first_request/last_request
ab3b0f3e4e72 crypto: talitos/hash - drop workqueue mechanism for SEC1
96a8955d7020 crypto: talitos/hash - use descriptor chaining for SEC1 instead of workqueue
a0cf230cb4df crypto: talitos/hash - prepare SEC1 descriptor chaining, remove additional descriptor
0f21d65f4381 crypto: talitos - move code in current_desc_hdr() into a standalone function
873e34c46cb7 crypto: talitos - move dma mapping code in talitos_submit() into a standalone dma_map_request() function
ec6669f1c162 crypto: talitos - move dma unmapping code in flush_channel() into a standalone dma_unmap_request() function
b624dcd2fda9 crypto: talitos - add chaining of arbitrary number of descriptor for the SEC1
9d4ea20a402d crypto: talitos - use dma_sync_single_for_cpu() before reading descriptor header
abf9a568013c crypto: qat - factor out AER reset helpers
ce42224487c5 crypto: qat - validate RSA CRT component lengths
8e8391469a92 crypto: qat - skip restart for down devices
0dbcecea740d crypto: qat - protect service table iterations with service_lock
425f1260ecb9 crypto: qat - notify fatal error before AER reset preparation
6f52fe576ac6 crypto: qat - keep VFs enabled during reset
4515bf525c96 crypto: qat - handle sysfs-triggered reset callbacks
59c0901db2b7 crypto: qat - fix restarting state leak on allocation failure
c98aed00e65a crypto: qat - centralize bus master enable
d5c0a6f8dc7e crypto: drbg - Fix the fips_enabled priority boost
044aaaba99e1 crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels
59a27cf2d01a crypto: drbg - Fix ineffective sanity check
d9f4acde5ae9 crypto: drbg - Fix misaligned writes in CTR_DRBG and HASH_DRBG
a9e886f73dd7 crypto: drbg - Fix returning success on failure in CTR_DRBG
20f548cdac94 crypto: ccp - Do not initialize SNP for ioctl(SNP_CONFIG)
8836801847b9 crypto: ccp - Do not initialize SNP for ioctl(SNP_VLEK_LOAD)
67ed191b4c8b crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT)
d51207735e7c crypto: ccp - Do not initialize SNP for SEV ioctls
43de8b9f01b7 crypto: loongson - Remove broken and unused loongson-rng
0927083d5e3e crypto: loongson - Select CRYPTO_RNG
855240d4d243 crypto: tegra - fix refcount leak in tegra_se_host1x_submit()
83fa1397d585 crypto: pcrypt - restore callback for non-parallel fallback
98a771d340bd crypto: hisi-trng - Remove crypto_rng interface
ebaae7c4251c crypto: ecc - Fix carry overflow in vli multiplication
a856bc7d0fbb crypto: crypto4xx - Remove insecure and unused rng_alg
e74df53b36cd crypto: chacha20poly1305 - validate poly1305 template argument
59057f5d4e9a crypto: caam - use print_hex_dump_devel to guard key hex dumps again
8cf5fb050312 crypto: caam - use print_hex_dump_devel to guard key hex dumps
d9dbf9a484cb crypto: af_alg - Remove zero-copy support from skcipher and aead
9830725078c8 isofs: bound Rock Ridge symlink components to the SL record
b8df7f486a46 btrfs: fix incorrect buffered IO fallback for append direct writes
44f37ee92fdc partitions: aix: bound the pp_count scan to the ppe array
b4af31b898a9 btrfs: do not trim a device which is not writeable
5d444a2a06d0 btrfs: check and set EXTENT_DELALLOC_NEW before clearing EXTENT_DELALLOC
caa71b3a43ea nvmet-auth: validate reply message payload bounds against transfer length
05645271751e btrfs: fix false IO failure after falling back to buffered write
a29b316b9bbf nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page
16898de2ca35 nvme-multipath: set BIO_REMAPPED on bios remapped to per-path namespace disks
f815869f926c dm-ioctl: report an error if a device has no table
0d3d19f78595 block: partitions: fix of_node refcount leak in of_partition()
5828517d17ed nvme: target: rdma: fix ndev refcount leak on queue connect
1c0462532916 crypto: atmel-sha204a - fail on hwrng registration error in probe path
5c925be839d8 crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A
68896ba8ccb8 hwrng: jh7110 - fix refcount leak in starfive_trng_read()
7f7774b9da0e udf: validate sparing table length as an entry count, not a byte count
74580fdf0229 udf: validate VAT header length against the VAT inode size
be87de7789a8 udf: validate free block extents against the partition length
77e7b127472a wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon
aa4c4a931576 block: skip sync_blockdev() on surprise removal in bdev_mark_dead()
dfecbb9ee08d usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile
f99f32ea9aa9 usb: gadget: f_fs: Initialize epfile->in early to fix endpoint direction checks
0cae3d610942 usb: gadget: f_fs: Fix DMA fence leak
ba1867999dbc usb: gadget: f_fs: initialize reset_work at allocation time
3aeed2451603 usb: typec: ucsi: cancel pending work on system suspend
dbb500bad021 usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove
f1736bb63f74 usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode
42ac1cc7de06 usb: typec: ucsi: Invert DisplayPort role assignment
313ca06e7e22 usb: typec: tcpm: Validate SVID index in svdm_consume_modes()
20f38be1d262 usb: typec: tcpm: Fix VDM type for Enter Mode commands
9a95bf88c6e4 usb: typec: ps883x: Fix DP+USB3 configuration
14457cb92258 usb: typec: class: drop PD lookup reference
575cb72b5ed0 usb: typec: anx7411: use devm_pm_runtime_enable()
0443e4416aa1 usbip: vudc: fix NULL deref in vep_dequeue()
ddc4619707af usbip: tools: support SuperSpeedPlus devices
e9b316d99a5c USB: usb-storage: ene_ub6250: restore media-ready check
e5493c9a98ff USB: ulpi: fix memory leak on registration failure
a3a13fdc5310 USB: serial: digi_acceleport: fix write buffer corruption
79bc131df0e5 USB: serial: digi_acceleport: fix hard lockup on disconnect
92fa3e1a4984 USB: serial: digi_acceleport: fix broken rx after throttle
6c8ccd8db36e USB: serial: option: add Telit Cinterion FE990D50 compositions
d4b12b6b395e USB: serial: keyspan_pda: fix information leak
835b0596d4c9 usb: mtu3: unmap request DMA on queue failure
48dd0b2ec9f2 USB: misc: uss720: unregister parport on probe failure
fc1b546973c1 usb: misc: usbio: bound bulk IN response length to the received transfer
88bf7b68ac90 USB: storage: include US_FL_NO_SAME in quirks mask
e4271a74bf99 usb: sl811-hcd: disable controller wakeup on remove
9ba62966461a USB: legousbtower: fix use-after-free on disconnect race
452c5d97ba38 USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD
71590982700f USB: iowarrior: fix use-after-free on disconnect race
e4596816984e USB: iowarrior: fix use-after-free on disconnect
a3e794136ab5 USB: ldusb: fix use-after-free on disconnect race
e88cff5fbaa6 USB: idmouse: fix use-after-free on disconnect race
7f1f24c36793 usb: gadget: f_printer: take kref only for successful open
54fa390aae39 usb: gadget: udc: Fix use-after-free in gadget_match_driver
fcb21bf74764 usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler
4bb88aee6b86 usb: free iso schedules on failed submit
f4f5219c06d4 usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume()
4349e487a114 usb: dwc3: fix dwc3_readl() and dwc3_writel() calls in dwc3_ulpi_setup()
effc5f7942b4 USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub
963075c4da0c usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info()
35179684907c usb: cdc_acm: Add quirk for Uniden BC125AT scanner
0aa71f258810 Revert "usb: typec: mux: avoid duplicated mux switches"
51e65f1d7845 net: usb: kalmia: bound RX frame length in kalmia_rx_fixup()
bd6ad9a6b304 bpf: Allow LPM map access from sleepable BPF programs
d57db0d97505 bpf: Keep dynamic inner array lookups nullable
ff77d013b737 bpf: Validate BTF repeated field counts before expansion
ee7099359f96 bpf: Restore sysctl new-value from 1 to 0
51d07c12ca41 bpf: Reject fragmented frames in devmap
06a2e6dbaa26 xfs: fix memory leak in xfs_dqinode_metadir_create()
4707344b0d36 xfs: fix exchmaps reservation limit check
60db12509ec0 xfs: fix pointer arithmetic error on 32-bit systems
cbcb09dacb71 xfs: fix unreachable BIGTIME check in dquot flush validation
ed16544d0d8b xfs: initialize iomap->flags earlier in xfs_bmbt_to_iomap
ce03e51a24c1 xfs: only log freed extents for the current RTG in zoned growfs
4693131bee05 xfs: pass back updated nb from xfs_growfs_compute_deltas
d108043cc04e xfs: release dquot buffer after dqflush failure
33c2c9d717f6 xfs: use null daddr for unset first bad log block
9690e8a34263 serial: 8250_mid: Disable DMA for selected platforms
4c4b4af4a9f2 media: mtk-jpeg: cancel workqueue on release for supported platforms only
d26aef771b4f nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers
d5b45bad75cd hfs/hfsplus: zero-initialize buffer in hfs_bnode_read
c25d3c931a63 hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length
d36e69c8c0c8 HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte reads
8131f4226688 HID: lg-g15: cancel pending work on remove to fix a use-after-free
6b0838e86da8 HID: appleir: fix UAF on pending key_up_timer in remove()
6493ebf9489e HID: multitouch: fix out-of-bounds bit access on mt_io_flags
df3d8aa1a939 HID: letsketch: fix UAF on inrange_timer at driver unbind
27c4dad1b791 HID: wacom: use GFP_ATOMIC in wacom_wac_queue_flush()
57bdd10ad50d HID: wacom: fix slab-out-of-bounds write in wacom_wac_queue_insert
3e7761f7bf9f HID: hid-lenovo-go: cancel cfg_setup work in hid_go_cfg_remove()
48218df04220 HID: pidff: Use correct effect type in effect update
e2cc711a9df3 HID: wacom: stop hardware after post-start probe failures
cfc0d283d931 HID: uhid: convert to hid_safe_input_report()
835fcc865556 HID: hid-goodix-spi: validate report size to prevent stack buffer overflow
493f261c0772 tools/mm/slabinfo: fix total_objects attribute name
27c83f667575 tools/mm/slabinfo: Fix trace disable logic inversion
0d18ccef142f mm/slab: do not limit zeroing to orig_size when only red zoning is enabled
d33dc0d5824c X.509: Fix validation of ASN.1 certificate header
942dfe844229 perf/arm-cmn: Fix DVM node events
c94806905e02 s390: Revert support for DCACHE_WORD_ACCESS
c67b06370ade clocksource/drivers/timer-tegra186: Fix support for multiple watchdog instances
75b478096c6b time/jiffies: Register jiffies clocksource before usage
8f06363446c5 posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path
c1cfd63326f5 proc: protect ptrace_may_access() with exec_update_lock (part 1)
0e3c739a2f6f cpufreq: pcc: fix use-after-free and double free in _OSC evaluation
a0106b41f9a7 cpufreq: Fix hotplug-suspend race during reboot
a18f80bf5359 sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT
e0d0adc3d204 cpufreq: intel_pstate: Sync policy->cur during CPU offline
a5f5f5053f98 perf/x86/intel/uncore: Defer ADL global PMON enable to enable_box()
dfd1894cb64c proc: protect ptrace_may_access() with exec_update_lock (FD links)
8e931557b317 libfs: set SB_I_NOEXEC and SB_I_NODEV by default in init_pseudo()
15432f19562f firmware_loader: fix device reference leak in firmware_upload_register()
9de568ef6cdf cpufreq: qcom-cpufreq-hw: Fix possible double free
625b014f922c OPP: of: Fix potential memory leak in opp_parse_supplies()
53eeaf4d6306 writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs()
eedf142d994e smb/server: do not require delete access for non-replacing links
f80add1bfb34 smb: client: mask server-provided mode to 07777 in modefromsid
fc25bbc893f6 smb: client: fix atime clamp check in read completion
46a84715a015 smb: client: harden POSIX SID length parsing
52f9c9dafefc smb: client: use unaligned reads in parse_posix_ctxt()
927d4805aea0 smb: client: Fix next buffer leak in receive_encrypted_standard()
b18ed621dbfc smb: client: fix double-free in SMB2_close() replay
ff2d30927bc3 smb: client: fix double-free in SMB2_open() replay
013a9a3da46c smb: client: fix double-free in SMB2_flush() replay
901891513951 smb: client: fix change notify replay double-free
fc65ffb4ef1b smb: client: fix double-free in SMB2_ioctl() replay
89234773e834 smb: client: fix query_info() replay double-free
3317a5d015fc smb: client: fix query directory replay double-free
550cfb8a8118 smb/client: fix chown/chgrp with SMB3 POSIX Extensions
89ca7756d556 ksmbd: validate NTLMv2 response before updating session key
5fecc15a30cb ksmbd: track the connection owning a byte-range lock
52a56cf53ec8 ksmbd: use opener credentials for ADS I/O
4b7059974549 ksmbd: use opener credentials for delete-on-close
3bed9974fdf8 ksmbd: add per-handle permission check to FILE_LINK_INFORMATION
5bc2aa358b57 ksmbd: enforce FILE_READ_ATTRIBUTES on SMB_FIND_FILE_POSIX_INFORMATION
8cc9ec711f52 ksmbd: run set info with opener credentials
aae600cdaffc ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY
a10942af2783 ksmbd: require source read access for duplicate extents
5c75275c0fc9 ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation
fd22b039a5a0 ksmbd: serialize QUERY_DIRECTORY requests per file
deffa929086d ksmbd: add a permission check for FSCTL_SET_ZERO_DATA
c917e4522d25 ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE
8c9a4f1327eb ksmbd: prevent path traversal bypass by restricting caseless retry
a1cc432cb0b0 smb/client: Fix error code in smb2_aead_req_alloc()
0700f946659d smb: client: resolve SWN tcon from live registrations
daf6246ab988 coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer()
6b47bdaacfd0 Bluetooth: L2CAP: validate option length before reading conf opt value
e96fbac8d3a7 Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock
01afd198c2c2 Bluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync()
714d861d35d9 Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled
b42cb640a049 Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn()
50c662bdcd51 Bluetooth: fix UAF in bt_accept_dequeue()
49bcb39e3a04 Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3()
563a85730471 Bluetooth: bnep: pin L2CAP connection during netdev registration
0f0a83e26a9c Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work()
9efe838c1313 netfilter: flowtable: IPIP tunnel hardware offload is not yet support
419835f1bd5f netfilter: flowtable: fix offloaded ct timeout never being extended
b6183b1b88a7 netfilter: ebtables: terminate table name before find_table_lock()
7b217960e88b netfilter: ebtables: module names must be null-terminated
5ee856e4208a netfilter: ebtables: zero chainstack array
57056be3ec12 netfilter: handle unreadable frags
02f8a0a1da2e netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump
2a55fdf9f746 mm/swap: add cond_resched() in swap_reclaim_full_clusters to prevent softlockup
6a4196d19f47 mm: swap_cgroup: fix NULL deref in lookup_swap_cgroup_id on swapless host
b9beed2322f3 mm: shrinker: fix NULL pointer dereference in debugfs
284c267f013e mm: shrinker: fix shrinker_info teardown race with expansion
86237e56091e mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show()
fc030c5b116f mfd: cros_ec: Delay dev_set_drvdata() until probe success
c12a5b226135 media: nxp: imx8-isi: Fix use-after-free on remove
a094ac95d3b6 net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes
f91883031e5a ipv4: igmp: remove multicast group from hash table on device destruction
5ed09a108d93 netpoll: fix a use-after-free on shutdown path
f254713ac539 io_uring/rw: preserve partial result for iopoll
ab85765cbe32 io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item
7267717f3578 io_uring/nop: fix file reference leak with IOSQE_FIXED_FILE
7a89ad762fad HID: logitech-dj: Fix maxfield check in DJ short report validation
41cad91a09d6 gpio: sch: use raw_spinlock_t in the irq startup path
5c3c9ec1172a gpio: eic-sprd: use raw_spinlock_t in the irq startup path
6350df503897 NTB: epf: Avoid calling pci_irq_vector() from hardirq context
e2018628301a ntfs: avoid calling post_write_mst_fixup() for invalid index_block
f433acc85b86 fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns
1f4f02b336c3 debugobjects: Plug race against a concurrent OOM disable
2edd162cbd4a coresight: etb10: restore atomic_t for shared reading state
9531014c60c8 Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete
50c38d9f42a5 Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref
c5186201fa70 audit: Fix data races of skb_queue_len() readers on audit_queue
cea34abc94b0 net: af_key: initialize alg_key_len for IPComp states
12c36c99655f ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL
6e92b28cd74f crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()
2b7bd6dccff1 crypto: krb5 - filter out async aead implementations at alloc
6dda8406d8a3 crypto: amlogic - avoid double cleanup in meson_crypto_probe()
225b6d3fc7e9 staging: rtl8723bs: fix OOB write in HT_caps_handler()
729c4e72563b staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr()
4380b3860d88 staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop
402f13ec9594 staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl()
b5cc2f999927 staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop
7e7741c8315e staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop
d90b9f39f375 staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()
138cd190efd5 staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie()
35f4dbec7380 staging: rtl8723bs: don't drop short TX frames in _rtw_pktfile_read()
837c1f965542 staging: media: ipu7: fix double-free and use-after-free in error paths
7c973c5113e3 staging: media: atomisp: reduce load_primary_binaries() stack usage
753e684fa55f media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe
c6cda17e9854 staging: vme_user: fix location monitor leak in tsi148 bridge
157bcfc7955c staging: vme_user: fix location monitor leak in fake bridge
6e9d10f62773 smb: client: restrict implied bcc[0] exemption to responses without data area
1b495fa0d492 staging: vme_user: bound slave read/write to the kern_buf size
f333b6851bdf tipc: fix out-of-bounds read in broadcast Gap ACK blocks
69f17ac132a3 tracing: Fix NULL pointer dereference in func_set_flag()
b713aa0cc344 6lowpan: fix NHC entry use-after-free on error path
1947b6411460 usb: misc: usbio: fix disconnect UAF in client teardown
642e04f5c292 usb: dwc3: run gadget disconnect from sleepable suspend context
8f50613bff22 USB: chaoskey: Fix slab-use-after-free in chaoskey_release()
92d5736a6204 hwrng: virtio: clamp device-reported used.len at copy_data()
378493da2980 virtio-mmio: fix device release warning on module unload
64a4c0befa77 virtio_pci: fix vq info pointer lookup via wrong index
e8ee198bbc04 netfilter: ipset: fix race between dump and ip_set_list resize
76e415ea88d2 mm/damon/ops-common: handle extreme intervals in damon_hot_score()
4caf12c778fe tcp: restore RCU grace period in tcp_ao_destroy_sock
55fd485e66d0 PCI/IOV: Skip VF Resizable BAR restore on read error
7908ddb6f8b3 PCI: Skip Resizable BAR restore on read error
67a8b1d876d5 PCI: qcom: Initialize DWC MSI lock for firmware-managed ECAM hosts
df77314b3bed PCI: mediatek: Fix IRQ domain leak when port fails to enable
6a2363bf9eae PCI: imx6: Assert ref_clk_en after reference clock stabilizes on i.MX95
edefa5f4b701 PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling
76143cbb18dc PCI: imx6: Configure REF_USE_PAD before PHY reset for i.MX95
7707ac040967 PCI: host-common: Request bus reassignment when not probe-only
669c4f387600 PCI: Always lift 2.5GT/s restriction in PCIe failed link retraining
6864c789b570 PCI: altera: Fix resource leaks on probe failure
ff396bab155f PCI: altera: Do not dispose parent IRQ mapping
bc29e49364ea PCI: loongson: Override PCIe bridge supported speeds for Loongson-3C6000 series
1d3f464bb158 riscv: dts: sophgo: Add dma-coherent to SG2042 PCIe controllers
569f18a83eed usb: typec: tcpci_rt1711h: unregister TCPCI port with devres
a3eaf82ff842 xhci: sideband: fix ring sg table pages leak
93cd037da94f usb: xhci: Fix sleep in atomic context in xhci_free_streams()
0644da3621dd rust_binder: clear freeze listener on node removal
59fbe6b20456 rust_binder: synchronize Rust Binder stats with freeze commands
ad6af5c32dac rust_binder: reject context manager self-transaction
3ffc336432da rust_binder: fix BINDER_GET_EXTENDED_ERROR
74920b1b4e47 rust_binder: use a u64 stride when cleaning up the offsets array
0f15f0f6ca5d binder: fix UAF in binder_free_transaction()
ef5439ba5b9a binder: fix UAF in binder_thread_release()
087a305e025c Bluetooth: btusb: fix wakeup source leak on probe failure
838c917a2f16 Bluetooth: btusb: fix use-after-free on marvell probe failure
da7d7758fe88 Bluetooth: btusb: fix use-after-free on registration failure
c028dfa0a3c7 Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB
39d163627b51 vfio/mlx5: Fix racy bitfields and tighten struct layout
a5df401dc84f vfio: Remove device debugfs before releasing devres
a3a8afa2f6e7 vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc
ad0f12d2dfc2 vfio/pci: Fix racy bitfields and tighten struct layout
278a5659c391 vfio/pci: Release the VGA arbiter client on register_device() failure
062b820290bc vfio/pci: Latch disable_idle_d3 per device
2bdb4c96287d vfio/pci: Use a private flag to prevent power state change with VFs
58c5ec23b1a2 x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled
c4fe3d9551ea ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes
3314c5af8a13 ALSA: usb-audio: Update Babyface Pro control caches only after successful writes
4e01d542e910 ALSA: usb-audio: Roll back quirk control caches on write errors
14dfb2abae01 ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks
edf3ce5a72ca ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put()
4246dd043b7a ALSA: usb-audio: avoid kobject path lookup in DualSense match
344b64d4d411 ALSA: usb-audio: add IFB_SILENCE_ON_EMPTY quirk for Behringer Flow 8
ab1db6491242 ALSA: us144mkii: capture_urb_complete: redundant usb_anchor_urb corrupts anchor list on each resubmission
6ded42615fa1 ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup()
38a7cc46370a ALSA: ice1712: check snd_ctl_new1() return value
17f31b904e8c ALSA: hda/realtek: Fix noisy mic for Clevo V6xxAW
8bbba4ab5e6d ALSA: hda/hdmi: Use 'AC_PINSENSE_ELDV' to detect pinsense for Loongson
0056958bf308 ALSA: hda/hdmi: Add force-connect quirk for HP EliteDesk 800 G5 Mini
d6a40a4d083e ALSA: hda/cs35l41: Fix firmware load work teardown
465075c68351 ALSA: gus: check snd_ctl_new1() return value
31a01b70bb90 ALSA: firewire: isight: bound the sample count to the packet payload
aeeeae9c1a51 ALSA: FCP: Add Focusrite ISA C8X support
1949163dee39 ALSA: es1938: check snd_ctl_new1() return value
426a9947a38d ALSA: compress: Fix task creation error unwind
67e9ea92cd59 ALSA: cmipci: check snd_ctl_new1() return value
0680413f2f10 ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser
e47f2a341adb ALSA: aoa: check snd_ctl_new1() return value
18ec7d7785be ALSA: ymfpci: check snd_ctl_new1() return value
21584672fd69 ALSA: virtio: Validate control metadata from the device
6f3c7e552fd8 ALSA: virtio: Add missing 384 kHz PCM rate mapping
27161c68d5e7 ALSA: usx2y: us144mkii: fix work UAF on disconnect
d90f868f56a1 iio: temperature: tmp006: use devm_iio_trigger_register
d8274d1a79af iio: temperature: ltc2983: Fix reinit_completion() called after conversion start
e52f7939a41c iio: temperature: ltc2983: Fix n_wires default bypassing rotation check
f87b86a7fd9e iio: temperature: Build mlx90635 with CONFIG_MLX90635
1c8150ee8f2f iio: resolver: ad2s1210: notify trigger and clear state on fault read error
769e819e6925 iio: proximity: vl53l0x: notify trigger and clear IRQ on error paths
46e69d3dd429 iio: pressure: mpl115: fix runtime PM leak on read error
9990e06016af iio: pressure: bmp280: zero-init bmp580 trigger handler buffer
0adca7d78b7b iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call
8a383705c455 iio: light: veml6030: fix channel type when pushing events
9f45d437ce24 iio: light: tsl2591: return actual error from probe IRQ failure
56447eeab51e iio: light: opt3001: fix missing state reset on timeout
2ebaea7f3089 iio: light: gp2ap002: fix runtime PM leak on read error
a82b89a35692 iio: light: al3320a: read both ALS ADC registers again
2b42c313b941 iio: light: al3320a: add missing REGMAP_I2C to Kconfig
e297afa1845f iio: light: al3010: read both ALS ADC registers again
78451f43e3f4 iio: light: al3010: fix incorrect scale for the highest gain range
acd4946b583a iio: light: al3010: add missing REGMAP_I2C to Kconfig
c2d8c2696b8c iio: light: al3000a: add missing REGMAP_I2C to Kconfig
4f49fef6179d iio: imu: st_lsm6dsx: deselect shub page before reading whoami
2e2595765dcb iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading
9fdc477b652a iio: imu: inv_icm42600: fix timestamp clock period by using lower value
65f1f81e7521 iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ
9f5690f2dc54 iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ
a11bc637375e iio: gyro: bmg160: wait full startup time after mode change at probe
6c8675468862 iio: gyro: bmg160: bail out when bandwidth/filter is not in table
f187dc5a4c48 iio: event: Fix event FIFO reset race
b03fb2f8c6fc iio: dac: ad3552r-hs: fix uninitialized data ni ad3552r_hs_write_data_source()
89fbd3e32dff iio: core: fix uninitialized data in debugfs
20a5fee40c3d iio: common: st_sensors: honour channel endianness in read_axis_data
d49ff54b2784 iio: chemical: scd30: Cleanup initializations and fix sign-extension bug
fb8e18f8ca72 iio: buffer: hw-consumer: free scan_mask on buffer release
33b29764f6c4 iio: backend: fix uninitialized data in debugfs
84552fdcef8f iio: adc: ti-ads124s08: Return reset GPIO lookup errors
6537f0810018 iio: adc: ti-ads1119: fix PM reference leak in buffer preenable
eb5b07c9d0ec iio: adc: spear: Initialize completion before requesting IRQ
af885d419b4d iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for()
2f18c5551aa9 iio: adc: lpc32xx: Initialize completion before requesting IRQ
f1de829ee87a iio: adc: ad_sigma_delta: fix CS held asserted and state leaks
3bceb26dfaf7 iio: adc: ad_sigma_delta: fix clear_pending_event for registerless devices
73a92d5e3d78 iio: adc: ad7779: add missing 'select IIO_TRIGGERED_BUFFER' to Kconfig
f75a12808cd3 iio: adc: ad7768-1: Select GPIOLIB
e3f3fcf011e7 iio: adc: ad7380: select REGMAP
5d32dd6338c8 iio: adc: ad4062: add GPIOLIB dependency
13a91e8631cf iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error
35a3cd8fd65e iio: accel: bmc150: clamp the device-reported FIFO frame count
9facd79028a7 usb: gadget: function: rndis: add length check for header
b09716040f3f usb: gadget: function: rndis: add length check to response query
994994cfadaf wifi: rtw89: correct drop logic for malformed AMPDU frames
29d3f527bc1a bpf: Prefer dirty packs for eBPF allocations
3448efcb18ae bpf: Prefer packs that won't trigger an IBPB flush on allocation
80a96785fe42 bpf: Skip redundant IBPB in pack allocator
7ff3b159b8b7 bpf: Restrict JIT predictor flush to cBPF
52440e15d962 x86/bugs: Enable IBPB flush on BPF JIT allocation
7a6c171c6a1a bpf: Support for hardening against JIT spraying
06ccef0434e9 perf/core: Detach event groups during remove_on_exec
007f071b2c39 futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock""
89592176b718 rust: Kbuild: set frame-pointer llvm module flag for CONFIG_FRAME_POINTER
c781009975c5 rust: doctest: fix incorrect pattern in replacement
6822a2685b4d rust: block: fix GenDisk cleanup paths
afa40a464072 rust: pci: use 'static lifetime for PCI BAR resource names
1b1cac9887ec rust: kasan: KASAN+RUST requires clang
3f096fb8647b rust: cpufreq: clean new clippy::map_or_identity lint for Rust 1.98.0
fbe9f0ff0b5b LoongArch: Add PIO for early access before ACPI PCI root register
eace3b3e729d platform/x86: intel-hid: Protect ACPI notify handler against recursion
7d69235bdc58 ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup
873576e585da ACPI: NFIT: core: Fix possible NULL pointer dereference
dc066bd13c86 ACPI: CPPC: Suppress UBSAN warning caused by field misuse
8c8e8ac22ee1 KVM: x86: Unconditionally recompute CR8 intercept on PPR update
db8407b9fd06 KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode
3db1ef139956 KVM: x86: Move update_cr8_intercept() to lapic.c
3b3ca5d3a28e perf trace beauty fcntl: Fix build with older kernel headers
7d45ca69164e slab: recognize @GFP parameter as optional in kernel-doc
2dfe9f5c91d0 mm/khugepaged: write all dirty file folios when collapsing
806586e33891 net/sched: dualpi2: fix GSO backlog accounting
710183888174 userfaultfd: gate must_wait writability check on pte_present()
6537884e9cf2 rust: str: clean unused import for Rust >= 1.98
77ddefb1aeda rust: str: use the "kernel vertical" imports style

View originalPermalink

6.18.39-xanmod1

Jul 18, 2026 · 14 days ago

Fixed 19

xfs: use rtrefcount btree cursor in xchk_xref_is_rt_cow_staging
xfs: write the rg superblock when fixing it
xfs: fix off-by-one error when calling xchk_xref_has_rt_owner
xfs: don't zap bmbt forks if they are MAXLEVELS tall
xfs: fully check the parent handle when it points to the rootdir
xfs: clamp timestamp nanoseconds correctly
xfs: handle non-inode owners for rtrmap record checking
xfs: set xfarray killable sort correctly
xfs: use the rt version of the cow staging checker
xfs: grab rtrmap btree when checking rgsuper
xfs: don't wrap around quota ids in dqiterate
xfs: resample the data fork mapping after cycling ILOCK
xfs: fail recovery on a committed log item with no regions
xfs: fix null pointer dereference in tracepoint
Revert "f2fs: remove non-uptodate folio from the page cache in move_data_block"
Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev
timekeeping: Register default clocksource before taking tk_core.lock
usb: gadget: f_fs: Initialize epfile->in early to fix endpoint direction checks
sched/fair: Only update stats for allowed CPUs when looking for dst group

Security 1

smb: client: reject overlapping data areas in SMB2 responses

27e97e554390 Linux 6.18.39-xanmod1
a4b496b054d4 Merge tag 'v6.18.39' into 6.18
f89c296854b7 Linux 6.18.39
06b1729436ef xfs: use rtrefcount btree cursor in xchk_xref_is_rt_cow_staging
457a93a233bd xfs: write the rg superblock when fixing it
e696ef088f55 xfs: fix off-by-one error when calling xchk_xref_has_rt_owner
6403ef9a81e6 xfs: don't zap bmbt forks if they are MAXLEVELS tall
1ea0868a477b xfs: fully check the parent handle when it points to the rootdir
c9662ffd62c4 xfs: clamp timestamp nanoseconds correctly
424be21ed8cd xfs: handle non-inode owners for rtrmap record checking
d399b026a6b3 xfs: set xfarray killable sort correctly
08b191ae6465 xfs: use the rt version of the cow staging checker
104584477883 xfs: grab rtrmap btree when checking rgsuper
d1c4c40599c3 xfs: don't wrap around quota ids in dqiterate
206c09b04dc5 xfs: resample the data fork mapping after cycling ILOCK
d98f22d2e11e xfs: fail recovery on a committed log item with no regions
dca861f2cc9e xfs: fix null pointer dereference in tracepoint
fdafa1e68dc7 smb: client: reject overlapping data areas in SMB2 responses
1991d49433e9 Revert "f2fs: remove non-uptodate folio from the page cache in move_data_block"
1c56c4651935 Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev
e697df336662 timekeeping: Register default clocksource before taking tk_core.lock
9e04055ab5fc usb: gadget: f_fs: Initialize epfile->in early to fix endpoint direction checks
75e1d2787005 sched/fair: Only update stats for allowed CPUs when looking for dst group
0b466cf1b96e fuse-uring: remove request-less entries from ent_w_req_queue to fix NULL deref
e1711479e906 fuse-uring: make a fuse_req on SQE commit only findable after memcpy
39c8e925b207 fuse-uring: Avoid queue->stopped races and set/read that value under lock
23a356e0bd96 fuse-uring: Avoid use-after-free in fuse_uring_async_stop_queues
bb476ef8e102 fuse-uring: end fuse_req on io-uring cancel task work
50f3e03db823 fuse-uring: fix moving cancelled entry to ent_in_userspace list
b156bb996697 fuse-uring: fix data races on ring->ready
0483fffdeeb3 fuse-uring: fix EFAULT clobber in fuse_uring_commit
7366e6f4d2b4 fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req
096cb2e58a6d fuse: fix io-uring background queue dispatch on request completion
be353caffa86 fuse: re-lock request before returning from fuse_ref_folio()
e6620208bdd3 fuse: fix device node leak in cuse_process_init_reply()
6e2d84fdeac0 fuse: avoid 32-bit prune notification count wrap
69cfae58b9a3 fuse: back uncached readdir buffers with pages
423a78ff7928 RDMA/siw: bound Read Response placement to the RREAD length
ab45808c141a RDMA/core: Fix broadcast address falsely detected as local
5a45d0aa1fa5 RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg
95de76f6ad47 Input: maplecontrol - set driver data before registering input device
9376c744bea2 Input: maplemouse - set driver data before registering input device
699e3abac02d Input: maple_keyb - set driver data before registering input device
d7f66fbab5d2 Input: mms114 - fix multi-touch slot corruption
1b4cb75f254f Input: maplemouse - fix NULL pointer dereference in open()
37fbe63bccf2 Input: gscps2 - advance receive buffer write index
8301c3353053 Input: mms114 - reject an oversized device packet size
3e6f007b43e2 Input: touchwin - reset the packet index on every complete packet
05dee4007cf3 Input: ads7846 - don't use scratch for tx_buf when clearing register
75b12874b417 Input: mms114 - fix touch indexing for MMS134S and MMS136
70019779325f Input: iforce - bound the device-reported force-feedback effect index
3b3230346015 Input: goodix - clamp the device-reported contact count
01e0317c256c Input: elan_i2c - prevent division by zero and arithmetic underflow
e849c6f51e68 Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count
8db211aed837 Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count
11f275f01c46 Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure
bb5133a7d5f3 i2c: i801: fix hardware state machine corruption in error path
b2523f26979e i2c: imx-lpi2c: mark I2C adapter when hardware is powered down
369635fbcf7f i2c: stm32f7: truncate clock period instead of rounding it
b65667ec5e9a i2c: davinci: Unregister cpufreq notifier on probe failure
56945871123e i2c: mpc: Fix timeout calculations
b6d2af6fe9c1 i2c: core: fix adapter deregistration race
71b7da959031 i2c: core: fix adapter debugfs creation
0345994d6476 i2c: core: fix adapter probe deferral loop
3351c5e77749 i2c: core: fix NULL-deref on adapter registration failure
9ec02cc9a04e i2c: core: fix irq domain leak on adapter registration failure
59070040fd12 fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()
34696563461c dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning
f8e1dc70efe4 udmabuf: fix DMA direction mismatch in release_udmabuf()
0c93681aea0a KVM: arm64: Don't leak PFN when kvm_translate_vncr() races MMU notifier
4ad73ef0e796 KVM: x86: Ensure vendor's exit handler runs before fastpath userspace exits
ab253cf6e111 KVM: VMX: Handle bad values on proxied writes to LBR MSRs
eeb456eb3556 KVM: VMX: Refresh GUEST_PENDING_DBG_EXCEPTIONS.BS on all injected #DBs
35f3ea7e49a3 KVM: SVM: Only disable x2AVIC WRMSR interception for MSRs that are accelerated
7949aa38e109 KVM: SVM: Disable x2AVIC RDMSR interception for MSRs KVM actually supports
4b200e0c9c33 KVM: x86: Add dedicated API for getting mask of accelerated x2APIC MSRs
6bea2f8becdb KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU
2d710d4fcd2c LoongArch: KVM: Add missing slots_lock for device register/unregister
7c73a269a880 KVM: arm64: nv: Avoid dereferencing NULL VNCR pseudo-TLB
b51a7439c166 selftests/landlock: Filter dealloc records in audit_count_records()
859fef2c3d40 landlock: Set audit_net.sk for socket access checks
e4427c19554b audit: fix removal of dangling executable rules
32ca4aed2a66 iommufd: Set upper bounds on cache invalidation entry_num and entry_len
67daea4c0935 iommufd: Avoid partial fault group delivery in iommufd_fault_fops_read()
5539da127d03 iommufd: Break the loop on failure in iommufd_fault_fops_read()
f2dbe1dba01e iommufd: Reject invalid read count in iommufd_fault_fops_read()
f549a749b625 iommufd: Reject invalid read count in iommufd_veventq_fops_read()
64011399d881 iommufd: Rewind header length in done if iommufd_veventq_fops_read() fails
f565297edf31 iommufd: Set veventq_depth upper bound
5c5f1b5184f7 iommufd: Fix data_len byte-count vs element-count mismatch
04a177f91160 iommufd: Use sizeof(*hdr) instead of sizeof(hdr) in veventq read
50612ce318b1 iommu/amd: Don't split flush for amd_iommu_domain_flush_all()
bb354384f40b iommu/vt-d: Avoid WARNING in sva unbind path
037ec8353711 crypto: loongson - Remove broken and unused loongson-rng
6bbe2000d9f9 selftests/mm: pagemap_ioctl: use the correct page size for transact_test()
5c942ad7df75 mm: do file ownership checks with the proper mount idmap
8dcaa0f87a88 mm: page_ext: add count limit to page_ext_iter_next to prevent invalid PFN access
785ebd42b8b5 selftests: mm: fix and speedup "droppable" test
279c2fa73112 mm: fix mmap errno value when MAP_DROPPABLE is not supported
4d730cab96e6 riscv: mm: Unconditionally sfence.vma for spurious fault
90405c8822c5 riscv: mm: Define DIRECT_MAP_PHYSMEM_END
1c8889e0db01 NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr()
33c0b96d7e16 exfat: bound uniname advance in exfat_find_dir_entry()
a82e170637e0 module: decompress: check return value of module_extend_max_pages()
b88373330250 rqspinlock: Fix order in raw_res_spin_(un)lock_irq to allow schedule
a937e92c1d00 NFSv4: include MAY_WRITE in open permission mask for O_TRUNC
75ca99875aa4 audit: fix potential integer overflow in audit_log_n_hex()
2dad64a97e1d tracing: Prevent out-of-bounds read in glob matching
c8b7e113f7b6 perf/aux: Fix page UAF in map_range()
af6048e91305 i2c: core: fix hang on adapter registration failure
22cb337370e6 regulator: scmi: fix of_node refcount leak in scmi_regulator_probe()
6b01ed165d29 watchdog: apple: Add "apple,t8103-wdt" compatible
f4dd5621a6ee EDAC/i10nm: Don't fail probing if ADXL is missing
add1e4112e00 x86/mm: Fix freeing of PMD-sized vmemmap pages
808033d80d5c spi: fsl-lpspi: terminate the RX channel on TX prepare failure path
18d6048b1b1b spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync()
75422f5e5022 arm64: fpsimd: Fix type mismatch in sme_{save,load}_state()
93f000e89976 crypto: talitos/hash - fix SEC2 64k - 1 ahash request limitation
fda9cb9b7191 crypto: talitos/hash - remove useless wrapper
99cc3f5511d8 crypto: talitos/hash - rename first_desc/last_desc to first_request/last_request
b960edc92c81 crypto: talitos/hash - drop workqueue mechanism for SEC1
042730207a99 crypto: talitos/hash - use descriptor chaining for SEC1 instead of workqueue
40a2e90acdb1 crypto: talitos/hash - prepare SEC1 descriptor chaining, remove additional descriptor
a8decb89920a crypto: talitos - move code in current_desc_hdr() into a standalone function
aea8cfbd60da crypto: talitos - move dma mapping code in talitos_submit() into a standalone dma_map_request() function
3fa1846f75ed crypto: talitos - move dma unmapping code in flush_channel() into a standalone dma_unmap_request() function
664e7f16e74f crypto: talitos - add chaining of arbitrary number of descriptor for the SEC1
f52aa95e3cae crypto: talitos - use dma_sync_single_for_cpu() before reading descriptor header
7584c92f7244 crypto: qat - factor out AER reset helpers
6fb62b767f3e crypto: qat - validate RSA CRT component lengths
fabf364ef9db crypto: qat - skip restart for down devices
c3c5925791cf crypto: qat - protect service table iterations with service_lock
e310e8dc8ce7 crypto: qat - notify fatal error before AER reset preparation
45b65a21edbe crypto: qat - keep VFs enabled during reset
33cfc0ce28ac crypto: qat - handle sysfs-triggered reset callbacks
050bded706ee crypto: qat - centralize bus master enable
5337b5cd3608 crypto: drbg - Fix the fips_enabled priority boost
53d38b93cadc crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels
23b8b188cb32 crypto: drbg - Fix returning success on failure in CTR_DRBG
441ea32cf275 crypto: ccp - Do not initialize SNP for ioctl(SNP_CONFIG)
92567ed9306d crypto: ccp - Do not initialize SNP for ioctl(SNP_VLEK_LOAD)
7a361c74bb12 crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT)
9e983d0a74a6 crypto: ccp - Do not initialize SNP for SEV ioctls
53b8fb85f332 crypto: loongson - Select CRYPTO_RNG
cc4e42b3ee9f crypto: tegra - fix refcount leak in tegra_se_host1x_submit()
c4bd2f4c35b0 crypto: pcrypt - restore callback for non-parallel fallback
ee6a2a25665c crypto: hisi-trng - Remove crypto_rng interface
774ddddf5eb2 crypto: ecc - Fix carry overflow in vli multiplication
ac667f9f18c6 crypto: crypto4xx - Remove insecure and unused rng_alg
0016d3c21c6a crypto: chacha20poly1305 - validate poly1305 template argument
d0b8cafd529b crypto: caam - use print_hex_dump_devel to guard key hex dumps again
6f7b8e0321f3 crypto: caam - use print_hex_dump_devel to guard key hex dumps
7465ed1524ac crypto: af_alg - Remove zero-copy support from skcipher and aead
b5699642640d isofs: bound Rock Ridge symlink components to the SL record
ce93228e2193 partitions: aix: bound the pp_count scan to the ppe array
7a6452180299 btrfs: do not trim a device which is not writeable
0912b98151ee btrfs: check and set EXTENT_DELALLOC_NEW before clearing EXTENT_DELALLOC
6d7649c1231d nvmet-auth: validate reply message payload bounds against transfer length
56c021a08692 nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page
7a69463e9ad2 nvme-multipath: set BIO_REMAPPED on bios remapped to per-path namespace disks
13f2f5defb4d dm-ioctl: report an error if a device has no table
427c82497e26 block: partitions: fix of_node refcount leak in of_partition()
a8803c4f0ac3 nvme: target: rdma: fix ndev refcount leak on queue connect
d161d47aba31 crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A
c60932d6f837 hwrng: jh7110 - fix refcount leak in starfive_trng_read()
04f4599a9efb udf: validate sparing table length as an entry count, not a byte count
e610fb113cdf udf: validate VAT header length against the VAT inode size
335202ab25b0 udf: validate free block extents against the partition length
d944b8add331 bpf: Prefer dirty packs for eBPF allocations
0229944ba792 bpf: Prefer packs that won't trigger an IBPB flush on allocation
f1f36bf9bb11 bpf: Skip redundant IBPB in pack allocator
666fc2e6e4d0 bpf: Restrict JIT predictor flush to cBPF
8a4c8af9ae67 x86/bugs: Enable IBPB flush on BPF JIT allocation
8ff183ee4d8c bpf: Support for hardening against JIT spraying
bd818dcf4783 rust_binder: fix BINDER_GET_EXTENDED_ERROR
e5049526a7aa rust_binder: introduce TransactionInfo
be1567992417 x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled
b7b2d2ccdbc4 mm: shmem: fix potential livelock issue for shmem direct swapin
9818bcae3c0c block: skip sync_blockdev() on surprise removal in bdev_mark_dead()
e086c16962a1 usb: gadget: f_fs: Fix DMA fence leak
b45be66ed47d usb: typec: ucsi: cancel pending work on system suspend
f5c772b76bbd usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove
b1dfdff51a86 usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode
8c00aec752ce usb: typec: ucsi: Invert DisplayPort role assignment
3e1b1ac47e81 usb: typec: tcpm: Validate SVID index in svdm_consume_modes()
0bc177820bd3 usb: typec: tcpm: Fix VDM type for Enter Mode commands
bf6aa6c0ce0d usb: typec: class: drop PD lookup reference
1126f1110b86 usb: typec: anx7411: use devm_pm_runtime_enable()
347b59e9f967 usbip: vudc: fix NULL deref in vep_dequeue()
6c7e8e251437 usbip: tools: support SuperSpeedPlus devices
2d84c8376f7a USB: usb-storage: ene_ub6250: restore media-ready check
1967a7f0cd5c USB: ulpi: fix memory leak on registration failure
1243f1207900 USB: serial: digi_acceleport: fix write buffer corruption
2b7dc482f859 USB: serial: digi_acceleport: fix hard lockup on disconnect
eab394781e93 USB: serial: digi_acceleport: fix broken rx after throttle
4b147eb6ae6e USB: serial: option: add Telit Cinterion FE990D50 compositions
cf6ca0aefae0 USB: serial: keyspan_pda: fix information leak
8c29d9cfab1c usb: mtu3: unmap request DMA on queue failure
729b68a5bad7 USB: misc: uss720: unregister parport on probe failure
48394f94211c usb: misc: usbio: bound bulk IN response length to the received transfer
964d572b6c00 USB: storage: include US_FL_NO_SAME in quirks mask
e0886775952e usb: sl811-hcd: disable controller wakeup on remove
766738ecf2b8 USB: legousbtower: fix use-after-free on disconnect race
6af28345cbf8 USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD
b748f97aff33 USB: iowarrior: fix use-after-free on disconnect
2107a4fc8ff1 USB: ldusb: fix use-after-free on disconnect race
54c2b7356b4a USB: idmouse: fix use-after-free on disconnect race
8a5eba992c86 usb: gadget: f_printer: take kref only for successful open
b52476a83d9e usb: gadget: udc: Fix use-after-free in gadget_match_driver
01feaf024f29 usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler
6bc17a78a056 usb: free iso schedules on failed submit
0bbab8882a31 usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume()
4b0779207e36 USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub
c00826e87bb7 usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info()
e22f044b0b20 usb: cdc_acm: Add quirk for Uniden BC125AT scanner
e24eb271061d net: usb: kalmia: bound RX frame length in kalmia_rx_fixup()
cd407de2ef5d bpf: Validate BTF repeated field counts before expansion
d94ab0e91d3f bpf: Restore sysctl new-value from 1 to 0
a9bb2d9c798c bpf: Reject fragmented frames in devmap
c3d3d2212c29 xfs: fix memory leak in xfs_dqinode_metadir_create()
a62ef2d13d6e xfs: fix exchmaps reservation limit check
55e4d8413fb5 xfs: fix pointer arithmetic error on 32-bit systems
dd8d0665cdab xfs: fix unreachable BIGTIME check in dquot flush validation
936618643591 xfs: release dquot buffer after dqflush failure
200794d0354c xfs: use null daddr for unset first bad log block
1cd54e217c6e serial: 8250_mid: Disable DMA for selected platforms
973408ceab14 media: mtk-jpeg: cancel workqueue on release for supported platforms only
223463c488b0 nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers
f3461b84a486 hfs/hfsplus: zero-initialize buffer in hfs_bnode_read
c63bc6308da7 HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte reads
4d0d51bc12d2 HID: lg-g15: cancel pending work on remove to fix a use-after-free
b363d964ca82 HID: appleir: fix UAF on pending key_up_timer in remove()
37daa8c96bd5 HID: multitouch: fix out-of-bounds bit access on mt_io_flags
3eca1a8165b5 HID: letsketch: fix UAF on inrange_timer at driver unbind
bbe1e55629bf HID: wacom: use GFP_ATOMIC in wacom_wac_queue_flush()
ca899a926c11 HID: wacom: fix slab-out-of-bounds write in wacom_wac_queue_insert
cb90a01e478c HID: pidff: Use correct effect type in effect update
416095e9a603 HID: wacom: stop hardware after post-start probe failures
7ce2c7dd28ab HID: uhid: convert to hid_safe_input_report()
dae1d000ddfd HID: hid-goodix-spi: validate report size to prevent stack buffer overflow
abf07f5c3584 tools/mm/slabinfo: fix total_objects attribute name
e0eec7497bcc tools/mm/slabinfo: Fix trace disable logic inversion
2382971aaaef mm/slab: do not limit zeroing to orig_size when only red zoning is enabled
18d90dc05d98 X.509: Fix validation of ASN.1 certificate header
28390912740a perf/arm-cmn: Fix DVM node events
be79d285bea7 s390: Revert support for DCACHE_WORD_ACCESS
2421a7b24f9c clocksource/drivers/timer-tegra186: Fix support for multiple watchdog instances
cd25e9819620 time/jiffies: Register jiffies clocksource before usage
7776f9226e99 posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path
6ba6f6783be2 cpufreq: pcc: fix use-after-free and double free in _OSC evaluation
6e175c00c62d cpufreq: Fix hotplug-suspend race during reboot
4bd0da48fbc1 sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT
f77e55baeeb8 cpufreq: intel_pstate: Sync policy->cur during CPU offline
59626d0d2921 perf/x86/intel/uncore: Defer ADL global PMON enable to enable_box()
b9d45d328fcd libfs: set SB_I_NOEXEC and SB_I_NODEV by default in init_pseudo()
92f41769e5fd firmware_loader: fix device reference leak in firmware_upload_register()
e90496133280 cpufreq: qcom-cpufreq-hw: Fix possible double free
a277489337c7 OPP: of: Fix potential memory leak in opp_parse_supplies()
685fc15a4108 writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs()
c6c484a7d5bf smb: client: mask server-provided mode to 07777 in modefromsid
157c67a657a7 smb: client: fix atime clamp check in read completion
86c5d470f5d4 smb: client: harden POSIX SID length parsing
3d89ae65ef78 smb: client: use unaligned reads in parse_posix_ctxt()
297243e365fc smb: client: Fix next buffer leak in receive_encrypted_standard()
d15d83125007 smb: client: fix double-free in SMB2_close() replay
14498ff5ce0f smb: client: fix double-free in SMB2_open() replay
3407240cde13 smb: client: fix double-free in SMB2_flush() replay
52af1975f0df smb: client: fix change notify replay double-free
276c8efbc49f smb: client: fix double-free in SMB2_ioctl() replay
f1add4acb656 smb: client: fix query_info() replay double-free
00b0fa425941 smb: client: fix query directory replay double-free
2b4592cea214 ksmbd: use opener credentials for ADS I/O
e72c15085b6d ksmbd: use opener credentials for delete-on-close
df501c0f320b ksmbd: add per-handle permission check to FILE_LINK_INFORMATION
2ca82bfff49c ksmbd: enforce FILE_READ_ATTRIBUTES on SMB_FIND_FILE_POSIX_INFORMATION
20ee516a6298 ksmbd: run set info with opener credentials
f56535db508e ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY
db231af84286 ksmbd: require source read access for duplicate extents
5aa1cb01155f ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation
a1d5d31cad59 ksmbd: serialize QUERY_DIRECTORY requests per file
57f2042fd87d ksmbd: add a permission check for FSCTL_SET_ZERO_DATA
baae7b39673e ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE
a187883cc1dc smb/client: Fix error code in smb2_aead_req_alloc()
91b8a58c6ac1 smb: client: resolve SWN tcon from live registrations
661a019ac041 coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer()
08fad5d5a26c fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked()
6dd58c56ab86 fs/ntfs3: zero-fill folios beyond i_valid in ntfs_read_folio()
764e6f76fdbd fs/ntfs3: fsync files by syncing parent inodes
38cbb1feebcf fs/ntfs3: rename ni_readpage_cmpr into ni_read_folio_cmpr
471800787054 iommu/vt-d: Fix race condition during PASID entry replacement
73abbaf91aa3 Bluetooth: L2CAP: validate option length before reading conf opt value
d5616beb3355 Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock
b84eeb7636d6 Bluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync()
b9dd39cf1667 Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled
61701912c58a Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn()
26168db1ce5a Bluetooth: fix UAF in bt_accept_dequeue()
2a68a7730892 Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3()
a6b22dbd8092 Bluetooth: bnep: pin L2CAP connection during netdev registration
0039bdde36b2 Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work()
81a5971cbe18 netfilter: flowtable: fix offloaded ct timeout never being extended
6fe8d3cecd20 netfilter: ebtables: terminate table name before find_table_lock()
13a5f532e3a4 netfilter: ebtables: module names must be null-terminated
9f74d28e903f netfilter: ebtables: zero chainstack array
fc5bfe63bacf netfilter: handle unreadable frags
a8f03a379328 netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump
69c0e6246575 mm/swap: add cond_resched() in swap_reclaim_full_clusters to prevent softlockup
b415c00bf23d mm: swap_cgroup: fix NULL deref in lookup_swap_cgroup_id on swapless host
006467ab9326 mm: shrinker: fix NULL pointer dereference in debugfs
6465ff3ce651 mm: shrinker: fix shrinker_info teardown race with expansion
560e21e8ccff mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show()
b5f41d5bf08e mfd: cros_ec: Delay dev_set_drvdata() until probe success
bbae351c0f32 net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes
2ca18df1c261 ipv4: igmp: remove multicast group from hash table on device destruction
a33f37f8d079 netpoll: fix a use-after-free on shutdown path
f090acf881a2 io_uring/rw: preserve partial result for iopoll
1636d85dc139 io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item
722869fcff59 io_uring/nop: fix file reference leak with IOSQE_FIXED_FILE
4508366ab7dd gpio: sch: use raw_spinlock_t in the irq startup path
4750909a40da gpio: eic-sprd: use raw_spinlock_t in the irq startup path
f71e8d987506 NTB: epf: Avoid calling pci_irq_vector() from hardirq context
cf28fc165846 fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns
c00164c9e7fa debugobjects: Plug race against a concurrent OOM disable
cbb684ef39e9 coresight: etb10: restore atomic_t for shared reading state
b346efa825b5 Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete
d3b739db5dc6 Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref
fe997a84a385 audit: Fix data races of skb_queue_len() readers on audit_queue
e8417353cbd0 net: af_key: initialize alg_key_len for IPComp states
94083db75193 ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL
ef6feb77e2d9 crypto: krb5 - filter out async aead implementations at alloc
84a00be9b736 crypto: amlogic - avoid double cleanup in meson_crypto_probe()
6f91621fc450 staging: rtl8723bs: fix OOB write in HT_caps_handler()
a6105ea8ca6e staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop
c38d16b1ffac staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl()
69f174a0673b staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop
04f612dc0342 staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop
64ec4192d9c1 staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()
b9c4bf133c3c staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie()
b5ddc7257bee staging: media: ipu7: fix double-free and use-after-free in error paths
1ca4f310c6b1 staging: media: atomisp: reduce load_primary_binaries() stack usage
b4ba13dafa13 media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe
e3ceafa6d8ee staging: vme_user: fix location monitor leak in tsi148 bridge
a92148631397 staging: vme_user: fix location monitor leak in fake bridge
ceb875a375de smb: client: restrict implied bcc[0] exemption to responses without data area
e99f2df433c6 staging: vme_user: bound slave read/write to the kern_buf size
2de42e268174 tipc: fix out-of-bounds read in broadcast Gap ACK blocks
0beccbcf50de 6lowpan: fix NHC entry use-after-free on error path
c40090f8d19b usb: misc: usbio: fix disconnect UAF in client teardown
c4e232bd07fe usb: dwc3: run gadget disconnect from sleepable suspend context
2a52d55c86a4 USB: chaoskey: Fix slab-use-after-free in chaoskey_release()
285e17c44e38 hwrng: virtio: clamp device-reported used.len at copy_data()
65e93ec592f5 virtio-mmio: fix device release warning on module unload
075bc3c779e1 virtio_pci: fix vq info pointer lookup via wrong index
81d54c766337 netfilter: ipset: fix race between dump and ip_set_list resize
9c8f31eaae61 mm/damon/ops-common: handle extreme intervals in damon_hot_score()
657646c08c94 tcp: restore RCU grace period in tcp_ao_destroy_sock
b77524621250 PCI/IOV: Skip VF Resizable BAR restore on read error
1115680bca1d PCI: qcom: Initialize DWC MSI lock for firmware-managed ECAM hosts
6e6a529d6f77 PCI: mediatek: Fix IRQ domain leak when port fails to enable
69416a530867 PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling
1d2e66a4bc0d PCI: host-common: Request bus reassignment when not probe-only
9c698af5c2a1 PCI: Always lift 2.5GT/s restriction in PCIe failed link retraining
09c43b7b7d29 PCI: altera: Fix resource leaks on probe failure
5e42a981887d PCI: altera: Do not dispose parent IRQ mapping
d666c5aec822 PCI: loongson: Override PCIe bridge supported speeds for Loongson-3C6000 series
e5406c8fb71c usb: typec: tcpci_rt1711h: unregister TCPCI port with devres
99d00a9e35e3 xhci: sideband: fix ring sg table pages leak
f90586129cf9 usb: xhci: Fix sleep in atomic context in xhci_free_streams()
91b27f8172cd rust_binder: clear freeze listener on node removal
281335996ab2 rust_binder: synchronize Rust Binder stats with freeze commands
08e21d86d272 rust_binder: reject context manager self-transaction
89b8cc948dce rust_binder: use a u64 stride when cleaning up the offsets array
328ccf32acb8 binder: fix UAF in binder_free_transaction()
ea02df466df6 binder: fix UAF in binder_thread_release()
17a2d3f90345 Bluetooth: btusb: fix wakeup source leak on probe failure
a7e941a39571 Bluetooth: btusb: fix use-after-free on marvell probe failure
8db0ce3de783 Bluetooth: btusb: fix use-after-free on registration failure
79f9e221ddde Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB
a53109ffb6b5 vfio: Remove device debugfs before releasing devres
7f2d6b31089e vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc
ba96666d991e vfio/pci: Fix racy bitfields and tighten struct layout
52adb2dff7ce vfio/pci: Release the VGA arbiter client on register_device() failure
f6c67cf0051f vfio/pci: Latch disable_idle_d3 per device
a385d3435a7a vfio/pci: Use a private flag to prevent power state change with VFs
afc90150551d ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes
54c448e4f26a ALSA: usb-audio: Update Babyface Pro control caches only after successful writes
f3e8a6cca15b ALSA: usb-audio: Roll back quirk control caches on write errors
3061b6c11445 ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks
bfd28b07541e ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put()
a263eb12cbe2 ALSA: usb-audio: avoid kobject path lookup in DualSense match
16f14f55141d ALSA: us144mkii: capture_urb_complete: redundant usb_anchor_urb corrupts anchor list on each resubmission
651ba82fe2a1 ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup()
71b87108ad93 ALSA: ice1712: check snd_ctl_new1() return value
04dd21018057 ALSA: hda/realtek: Fix noisy mic for Clevo V6xxAW
1933e6ee136b ALSA: hda/hdmi: Use 'AC_PINSENSE_ELDV' to detect pinsense for Loongson
4dd2552e559b ALSA: hda/hdmi: Add force-connect quirk for HP EliteDesk 800 G5 Mini
ce0a903d0591 ALSA: hda/cs35l41: Fix firmware load work teardown
5e74e5e8cb7c ALSA: gus: check snd_ctl_new1() return value
8e48a29813df ALSA: firewire: isight: bound the sample count to the packet payload
db25755e7629 ALSA: FCP: Add Focusrite ISA C8X support
9e53e99b6fa3 ALSA: es1938: check snd_ctl_new1() return value
b27a75d42044 ALSA: compress: Fix task creation error unwind
af2b009b773b ALSA: cmipci: check snd_ctl_new1() return value
a5fd3122283b ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser
fd786466889e ALSA: aoa: check snd_ctl_new1() return value
f6538a318947 ALSA: ymfpci: check snd_ctl_new1() return value
5da9742de22d ALSA: virtio: Validate control metadata from the device
df0fe53a7104 ALSA: virtio: Add missing 384 kHz PCM rate mapping
c071df05bcda ALSA: usx2y: us144mkii: fix work UAF on disconnect
a4f8491da956 iio: temperature: tmp006: use devm_iio_trigger_register
62a0d75bedd4 iio: temperature: ltc2983: Fix reinit_completion() called after conversion start
e16258913be6 iio: temperature: ltc2983: Fix n_wires default bypassing rotation check
b50344ab202f iio: temperature: Build mlx90635 with CONFIG_MLX90635
7d4d60f7c054 iio: resolver: ad2s1210: notify trigger and clear state on fault read error
c6ca87c7bbb3 iio: proximity: vl53l0x: notify trigger and clear IRQ on error paths
b3f1af4ba8e9 iio: pressure: mpl115: fix runtime PM leak on read error
e2d5b9673bf7 iio: pressure: bmp280: zero-init bmp580 trigger handler buffer
f829d6c32f31 iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call
0975e013179d iio: light: veml6030: fix channel type when pushing events
ef6c2a521454 iio: light: tsl2591: return actual error from probe IRQ failure
9d421c2827ea iio: light: opt3001: fix missing state reset on timeout
0c655d067ac6 iio: light: gp2ap002: fix runtime PM leak on read error
a60bf629a760 iio: light: al3320a: read both ALS ADC registers again
a1dafc918d79 iio: light: al3320a: add missing REGMAP_I2C to Kconfig
a00d471cf358 iio: light: al3010: read both ALS ADC registers again
cd278561640c iio: light: al3010: fix incorrect scale for the highest gain range
9fb4ff07d97e iio: light: al3010: add missing REGMAP_I2C to Kconfig
6afb69bb969e iio: light: al3000a: add missing REGMAP_I2C to Kconfig
482b24660ec3 iio: imu: st_lsm6dsx: deselect shub page before reading whoami
76e12a71ac05 iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading
34656a59322e iio: imu: inv_icm42600: fix timestamp clock period by using lower value
052281922828 iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ
bdafd53ae671 iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ
001527e2382e iio: gyro: bmg160: wait full startup time after mode change at probe
7bbf02b63961 iio: gyro: bmg160: bail out when bandwidth/filter is not in table
9edefd4c56be iio: event: Fix event FIFO reset race
2358da87315d iio: dac: ad3552r-hs: fix uninitialized data ni ad3552r_hs_write_data_source()
e166a8cfb28a iio: core: fix uninitialized data in debugfs
b947bde73461 iio: common: st_sensors: honour channel endianness in read_axis_data
82accdd57404 iio: chemical: scd30: Cleanup initializations and fix sign-extension bug
c28835b8618e iio: backend: fix uninitialized data in debugfs
0f30e68dd6c1 iio: adc: ti-ads124s08: Return reset GPIO lookup errors
ffb2195921c3 iio: adc: ti-ads1119: fix PM reference leak in buffer preenable
bbfebae473ac iio: adc: spear: Initialize completion before requesting IRQ
9e2e8b8cdfd3 iio: adc: lpc32xx: Initialize completion before requesting IRQ
c313bb7c3885 iio: adc: ad_sigma_delta: fix CS held asserted and state leaks
3394e0b33284 iio: adc: ad_sigma_delta: fix clear_pending_event for registerless devices
46e93fcbe7c2 iio: adc: ad7779: add missing 'select IIO_TRIGGERED_BUFFER' to Kconfig
24a9514b606e iio: adc: ad7768-1: Select GPIOLIB
e6ade81631d7 iio: adc: ad7380: select REGMAP
6293211d1426 iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error
3e766526827a iio: accel: bmc150: clamp the device-reported FIFO frame count
7515a6d4a9e9 usb: gadget: function: rndis: add length check for header
e01e7814b422 usb: gadget: function: rndis: add length check to response query
9d1dc507b99c fscrypt: Replace mk_users keyring with simple list
85f8b440a09b fscrypt: Fix key setup in edge case with multiple data unit sizes
20133754d46f rust: kasan: KASAN+RUST requires clang
a2d5d3ee7b6e perf/core: Detach event groups during remove_on_exec
94396fd93226 futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock""
1cc8f512cd90 rust: Kbuild: set frame-pointer llvm module flag for CONFIG_FRAME_POINTER
70fe1ac8647b rust: doctest: fix incorrect pattern in replacement
e7636f26f770 rust: block: fix GenDisk cleanup paths
c1dd0b107100 rust: cpufreq: clean new clippy::map_or_identity lint for Rust 1.98.0
30d5d4eef35a LoongArch: Add PIO for early access before ACPI PCI root register
86df6499dfd2 platform/x86: intel-hid: Protect ACPI notify handler against recursion
452945662fd8 ACPI: NFIT: core: Fix possible NULL pointer dereference
f29dc6132d49 ACPI: CPPC: Suppress UBSAN warning caused by field misuse
ff9c4c642888 KVM: x86: Unconditionally recompute CR8 intercept on PPR update
3dcfb04dd43b KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode
0d0187a46b16 KVM: x86: Move update_cr8_intercept() to lapic.c
9baa2833e6bc perf trace beauty fcntl: Fix build with older kernel headers
47e4c6e06e78 slab: recognize @GFP parameter as optional in kernel-doc
1776f29327a1 default_gfp(): avoid using the "newfangled" VA_OPT trick
50c26b461b8e add default_gfp() helper macro and use it in the new *alloc_obj() helpers
2dca62902eb3 slab: Introduce kmalloc_flex() and family
1c2672781b1b mm/khugepaged: write all dirty file folios when collapsing
2539f67b7546 nfsd: change nfs4_client_to_reclaim() to allocate data
05e48af3bf58 nfsd: move name lookup out of nfsd4_list_rec_dir()
c4b70c1512b8 net/sched: dualpi2: fix GSO backlog accounting
076b1aa65f77 fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()
406c28af7512 f2fs: fix to do sanity check on f2fs_get_node_folio_ra()
3f42fbd3c891 f2fs: detect more inconsistent cases in sanity_check_node_footer()
ed87e57558dc f2fs: optimize trace_f2fs_write_checkpoint with enums
8dbc4c568682 f2fs: introduce f2fs_schedule_timeout()
599d7d82eeec f2fs: use memalloc_retry_wait() as much as possible
ec9f79c8d5b2 f2fs: fix listxattr handling of corrupted xattr entries
89479a27fa4e f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs()
998536c96b6a f2fs: fix potential deadlock in f2fs_balance_fs()
4ce2d52f680c f2fs: bound i_inline_xattr_size for non-inline-xattr inodes
a499f77c0605 f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode
5a4d3968cf82 f2fs: remove non-uptodate folio from the page cache in move_data_block
9c86a1f930bb device property: initialize the remaining fields of fwnode_handle in fwnode_init()
60d696a037ee userfaultfd: gate must_wait writability check on pte_present()
3436a7dd067c rust: str: clean unused import for Rust >= 1.98
3603500c868a rust: str: use the "kernel vertical" imports style
8dee7c278f1c nfsd: release layout stid on setlease failure
6f88ca186a98 nfsd: update mtime/ctime on COPY in presence of delegated attributes
7c702bb4f8d8 nfsd: update mtime/ctime on CLONE in presense of delegated attributes
501543207378 bpf, arm64: Reject out-of-range B.cond targets

View originalPermalink

7.1.3-xanmod1

Jul 4, 2026 · 28 days ago

Fixed 20

apparmor: advertise the tcp fast open fix is applied
net/tcp-ao: fix use-after-free of key in del_async path
ksmbd: fix out-of-bounds read in smb_check_perm_dacl()
NFS: Prevent resource leak in nfs_alloc_server()
NFSv4: clear exception state on successful mkdir retry
NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr
NFSv4/flexfiles: reject zero filehandle version count
nfsd: reset write verifier on deferred writeback errors
nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race
nfsd: fix dead ACL conflict guard in nfsd4_create
nfsd: check get_user() return when reading princhashlen
nfsd: fix posix_acl leak and ignored error in nfsd4_create_file
nfsd: fix inverted cp_ttl check in async copy reaper
nfsd: fix posix_acl leak on SETACL decode failure
NFSD: Fix SECINFO_NO_NAME decode error cleanup
nfsd: release layout stid on setlease failure
i2c: core: fix adapter registration race
fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode
fbdev: modedb: fix a possible UAF in fb_find_mode()
fbdev: omap2: fix use-after-free in omapfb_mmap

ece066880fc5 Linux 7.1.3-xanmod1
2ddd8fb98217 Merge tag 'v7.1.3' into 7.1
199c9959d3a9 Linux 7.1.3
5b872b77bd35 apparmor: advertise the tcp fast open fix is applied
7ddc29a094d9 net/tcp-ao: fix use-after-free of key in del_async path
e36e35660adb ksmbd: fix out-of-bounds read in smb_check_perm_dacl()
65b1bb5d24e5 NFS: Prevent resource leak in nfs_alloc_server()
a2c8befd06a4 NFSv4: clear exception state on successful mkdir retry
30aae62e50b4 NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr
2131ed64b767 NFSv4/flexfiles: reject zero filehandle version count
b027cca33c97 nfsd: reset write verifier on deferred writeback errors
a10bf67fe064 nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race
8371cc5c0a2c nfsd: fix dead ACL conflict guard in nfsd4_create
ff3ecd17db74 nfsd: check get_user() return when reading princhashlen
18cf006a08ba nfsd: fix posix_acl leak and ignored error in nfsd4_create_file
80866c84137e nfsd: fix inverted cp_ttl check in async copy reaper
a5b42c1e4ff2 nfsd: fix posix_acl leak on SETACL decode failure
46eb17d45be6 NFSD: Fix SECINFO_NO_NAME decode error cleanup
83c2b7797742 nfsd: release layout stid on setlease failure
a4c8094bbf4c i2c: core: fix adapter registration race
7e58653d4352 fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode
13b6f0cdd5cd fbdev: modedb: fix a possible UAF in fb_find_mode()
6eb6ebcc8590 fbdev: omap2: fix use-after-free in omapfb_mmap
39815715cbcf fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()
88913059c77e fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var
acd744019460 ntfs: serialize volume label accesses
7f7a9d6cb0ed riscv: kfence: Call mark_new_valid_map() for kfence_unprotect()
d6d6051fd15a riscv: mm: Extract helper mark_new_valid_map()
d109e72f3fbc power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init()
2753a097d1fe KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path
f636cf6a1e7b KVM: x86: hyper-v: Bound the bank index when querying sparse banks
9fef09df42df MIPS: smp: report dying CPU to RCU in stop_this_cpu()
a7656d368265 9p: avoid putting oldfid in p9_client_walk() error path
99c21e726324 ocfs2: reject oversized group bitmap descriptors
ff268cd9ccbc rpmsg: char: Fix use-after-free on probe error path
5e098e40e8ba fpga: region: fix use-after-free in child_regions_with_firmware()
0405a65e4ebd irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove
8d32856fb72b sched/mmcid: Fix OOB clear_bit when CID is MM_CID_UNSET in fixup path
9645aaf689af pNFS: Fix use-after-free in pnfs_update_layout()
0833b2b84c2f LoongArch: Report dying CPU to RCU in stop_this_cpu()
1eea5e1820a2 tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done
afebe44facc4 blk-cgroup: fix UAF in __blkcg_rstat_flush()
a594debfd4e7 hdlc_ppp: sync per-proto timers before freeing hdlc state
73569a44fca2 pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next()
9d0d5ba20cad gfs2: fix use-after-free in gfs2_qd_dealloc
833033e6e55a crypto: nx - fix nx_crypto_ctx_exit argument
5c87b4737468 KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned()
b2ae3245ea44 KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level
708b97e79294 exfat: fix potential use-after-free in exfat_find_dir_entry()
07c245bc39f9 MIPS: DEC: Prevent initial console buffer from landing in XKPHYS
70df4de46577 bpf: use kvfree() for replaced sysctl write buffer
717f721eb67d block: Avoid mounting the bdev pseudo-filesystem in userspace
a92332f32a8d f2fs: read COW data with the original inode during atomic write
d52dbbcad61d f2fs: keep atomic write retry from zeroing original data
edf12cbeeeab f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node()
6e035dae4415 Revert "f2fs: remove non-uptodate folio from the page cache in move_data_block"
5d8a39649947 f2fs: validate ACL entry sizes in f2fs_acl_from_disk()
16bc237ce3c4 f2fs: bound i_inline_xattr_size for non-inline-xattr inodes
536c7e7482e0 f2fs: fix to round down start offset of fallocate for pin file
a805fec35c20 f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode
0969926d987b f2fs: validate compress cache inode only when enabled
2e12381d4495 f2fs: validate orphan inode entry count
0cc21c1ffe15 f2fs: fix to do sanity check on f2fs_get_node_folio_ra()
f5b8b3dd6e85 f2fs: reject setattr size changes on large folio files
8a2d8a34ef0b f2fs: pass correct iostat type for single node writes
48c92559e7b6 f2fs: fix missing read bio submission on large folio error
fe7f339f63c9 wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers
9579781cd16d wifi: iwlwifi: mld: fix race condition in PTP removal
032e49805099 wifi: iwlwifi: mvm: fix race condition in PTP removal
8206d173d18e wifi: rtw88: usb: fix memory leaks on USB write failures
a68c04f4ee6a wifi: rtw88: increase TX report timeout to fix race condition
2a42951e935f wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor
4b75e6180f46 wifi: rtl8xxxu: Detect the maximum supported channel width
051f954b9447 wifi: ath11k: fix warning when unbinding
84139c1ab368 wifi: mt76: mt7925: don't disable AP BSS when removing TDLS peer
f10e6d5a35c4 wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S
5db89515fc28 userfaultfd: build __VMA_UFFD_FLAGS from config-gated masks
19ad7bfbd7f8 userfaultfd: ensure mremap_userfaultfd_fail() releases mmap_changing
83c0a1cb296d keys: Pin request_key_auth payload in instantiate paths
670fc6a311ed KEYS: fix overflow in keyctl_pkey_params_get_2()
5b959c1dbb45 gcov: use atomic counter updates to fix concurrent access crashes
450ee7ff510a err.h: use __always_inline on all error pointer helpers
8ead17358119 KVM: arm64: Omit tag sync on stage-2 mappings of the zero page
dcb7416212e6 block: invalidate cached plug timestamp after task switch
77bba61a20f1 kernel/fork: clear PF_BLOCK_TS in copy_process()
43e40c7a7b26 fscrypt: Fix key setup in edge case with multiple data unit sizes
70f1e000b88c fbdev: fix use-after-free in store_modes()
9764a786ba98 NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR
5e34fa9f6f7c apparmor: fix use-after-free in rawdata dedup loop
45ebb934ea50 apparmor: mediate the implicit connect of TCP fast open sendmsg
cbad530277b5 PCI/P2PDMA: Add Intel QAT, DSA, IAA devices to whitelist
47b5d3d50660 net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink
21ed9540a8e1 net: skmsg: preserve sg.copy across SG transforms
86d531337ea1 mac802154: llsec: add skb_cow_data() before in-place crypto
55e014aaec65 wifi: mt76: add wcid publish check in mt76_sta_add
293a84fa40b3 ntfs3: reject direct userspace writes to reserved $LX* xattrs
c04d9ece23de ipv4: account for fraggap on the paged allocation path
e9eacf19281e ipv6: account for fraggap on the paged allocation path
d25df4f62eea batman-adv: tvlv: avoid race of cifsnotfound handler state
56910cfd3116 batman-adv: tvlv: enforce 2-byte alignment
3e4555177235 batman-adv: dat: prevent false sharing between VLANs
f91d579a085b batman-adv: tt: track roam count per VID
6ae315914113 batman-adv: tt: don't merge change entries with different VIDs
39aadfa35160 batman-adv: tp_meter: handle overlapping packets
aa9fe4cb1acb batman-adv: tp_meter: prevent parallel modifications of last_recv
7c5f5f680dfc batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE
1fb8762600a3 batman-adv: tp_meter: restrict number of unacked list entries
86ab6b6fb5b8 batman-adv: v: prevent OGM aggregation on disabled hardif
5d8e32165427 batman-adv: frag: avoid underflow of TTL
cc97b6311190 batman-adv: frag: ensure fragment is writable before modifying TTL
09927ad14a5d batman-adv: fix (m|b)cast csum after decrementing TTL
4f121f393811 batman-adv: ensure bcast is writable before modifying TTL
c14d3619a1f7 batman-adv: gw: don't deselect gateway with active hardif
26ac02e6ae5d batman-adv: tp_meter: initialize last_recv_time during init
b4284cac3095 batman-adv: prevent ELP transmission interval underflow
7f58e114c1f3 batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE
bafe4928d321 batman-adv: tp_meter: add only finished tp_vars to lists
1d8b344e8dfc batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection
47ca1ecb85b9 batman-adv: tp_meter: fix fast recovery precondition
585616dab0aa batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd
f1be6ca7c183 batman-adv: tp_meter: avoid window underflow
fa54b5d133cd batman-adv: tp_meter: initialize dec_cwnd explicitly
fd46e54c0601 batman-adv: tp_meter: initialize dup_acks explicitly
d7f6ffe69078 batman-adv: tp_meter: keep unacked list in ascending ordered
1ae7d5a6db6c KVM: x86: Fix shadow paging use-after-free due to unexpected role

View originalPermalink

6.18.38-rt-xanmod1

Jul 4, 2026 · 28 days ago

Fixed 20

Advertise the tcp fast open fix is applied in apparmor
Fix use-after-free of key in del_async path in net/tcp-ao
Unregister 8250 port if clk_notifier_register() fails in serial 8250_dw
Fix out-of-bounds read in smb_check_perm_dacl() in ksmbd
Prevent resource leak in nfs_alloc_server() in NFS
Clear exception state on successful mkdir retry in NFSv4
Reject zero-length r_addr in nfs4_decode_mp_ds_addr in NFSv4/pNFS
Reject zero filehandle version count in NFSv4/flexfiles
Reset write verifier on deferred writeback errors in nfsd
Avoid leaking pre-allocated openowner on unconfirmed retry race in nfsd
Check get_user() return when reading princhashlen in nfsd
Fix inverted cp_ttl check in async copy reaper in nfsd
Fix posix_acl leak on SETACL decode failure in nfsd
Fix SECINFO_NO_NAME decode error cleanup in NFSD
Fix adapter registration race in i2c core
Fix misaligned fields in the 1920x1080-60 mode in fbdev modedb
Fix a possible UAF in fb_find_mode() in fbdev modedb
Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var in fbdev
Fix use-after-free in linkstation_poweroff_init() in power reset linkstation-poweroff
Fix page overflow in sev_dbg_crypt() for ENCRYPT path in KVM SVM

4b8d52e3d233 Linux 6.18.38-rt-xanmod1
0b987ae8e20a Merge branch '6.18' into 6.18-rt
e67923a55781 Linux 6.18.38-xanmod1
82e2790add06 Merge tag 'v6.18.38' into 6.18
e46dc0adfe39 Linux 6.18.38
92c63a5ef3c7 apparmor: advertise the tcp fast open fix is applied
e77fbefd1269 net/tcp-ao: fix use-after-free of key in del_async path
3d205fe80f21 serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails
7627ff8c4f99 ksmbd: fix out-of-bounds read in smb_check_perm_dacl()
62c26720121b NFS: Prevent resource leak in nfs_alloc_server()
6919eb549e8f NFSv4: clear exception state on successful mkdir retry
012d37a568bf NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr
d8c90c7cc061 NFSv4/flexfiles: reject zero filehandle version count
4367afc119c5 nfsd: reset write verifier on deferred writeback errors
017a6150106b nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race
0f28337f54cf nfsd: check get_user() return when reading princhashlen
dba7da4835de nfsd: fix inverted cp_ttl check in async copy reaper
136b416593f1 nfsd: fix posix_acl leak on SETACL decode failure
c8a24effd96d NFSD: Fix SECINFO_NO_NAME decode error cleanup
6a946038f2a5 i2c: core: fix adapter registration race
fc6aa9bdbae6 fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode
4d418cf8daf5 fbdev: modedb: fix a possible UAF in fb_find_mode()
eea16b6f805c fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var
7643e5622994 riscv: kfence: Call mark_new_valid_map() for kfence_unprotect()
3b33dbb43e21 riscv: mm: Extract helper mark_new_valid_map()
2205275be9be power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init()
720949ed666f KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path
e36095d8d922 KVM: x86: hyper-v: Bound the bank index when querying sparse banks
f9b57a0015c2 MIPS: smp: report dying CPU to RCU in stop_this_cpu()
6dbe9443d9f5 9p: avoid putting oldfid in p9_client_walk() error path
4cd57ebee395 ocfs2: reject oversized group bitmap descriptors
104d10021239 rpmsg: char: Fix use-after-free on probe error path
369496d885b4 fpga: region: fix use-after-free in child_regions_with_firmware()
b3a3831b2eb8 irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove
200e7637f4d6 pNFS: Fix use-after-free in pnfs_update_layout()
90e254f18b8c LoongArch: Report dying CPU to RCU in stop_this_cpu()
e18769616fd5 tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done
5e5b7f2ef854 blk-cgroup: fix UAF in __blkcg_rstat_flush()
5a84398101bf hdlc_ppp: sync per-proto timers before freeing hdlc state
e91df6d27344 pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next()
b85ef03f726b gfs2: fix use-after-free in gfs2_qd_dealloc
8d8507a45766 crypto: nx - fix nx_crypto_ctx_exit argument
5da9b1a87ec7 KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned()
18587f983161 KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level
adfacfbaeae2 exfat: fix potential use-after-free in exfat_find_dir_entry()
6e61fc2e06e4 MIPS: DEC: Prevent initial console buffer from landing in XKPHYS
65bd0c0afb0e bpf: use kvfree() for replaced sysctl write buffer
3804e6de30ae block: Avoid mounting the bdev pseudo-filesystem in userspace
db2c5b9fb908 f2fs: keep atomic write retry from zeroing original data
20190e498057 f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node()
ff83de56882c f2fs: validate ACL entry sizes in f2fs_acl_from_disk()
888d94cc9afb f2fs: fix to round down start offset of fallocate for pin file
77f216ff9ce5 f2fs: validate compress cache inode only when enabled
8aad54746c25 f2fs: validate orphan inode entry count
1e48fefac682 f2fs: pass correct iostat type for single node writes
1de92789ce31 wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers
b0b07e04f0c7 wifi: iwlwifi: mld: fix race condition in PTP removal
df626f284cb9 wifi: iwlwifi: mvm: fix race condition in PTP removal
200d58c851b8 wifi: rtw88: usb: fix memory leaks on USB write failures
73d427d271f7 wifi: rtw88: increase TX report timeout to fix race condition
0aeb4d3ff6ce wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor
40aa3c2b0cb8 wifi: ath11k: fix warning when unbinding
a7cdc384c9c5 wifi: mt76: mt7925: don't disable AP BSS when removing TDLS peer
7e25b5e22c1f wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S
ec1c9e896255 userfaultfd: ensure mremap_userfaultfd_fail() releases mmap_changing
7216ce8cb12f keys: Pin request_key_auth payload in instantiate paths
b11c1fa32667 KEYS: fix overflow in keyctl_pkey_params_get_2()
49d893b9cbcf gcov: use atomic counter updates to fix concurrent access crashes
2b7ec7278609 err.h: use __always_inline on all error pointer helpers
1fcca1260c6e KVM: arm64: Omit tag sync on stage-2 mappings of the zero page
97e1044e79c5 block: invalidate cached plug timestamp after task switch
99e6c712cc30 kernel/fork: clear PF_BLOCK_TS in copy_process()
0d35f9f194a8 fbdev: fix use-after-free in store_modes()
81371dbd2360 NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR
c3ca2631073b apparmor: fix use-after-free in rawdata dedup loop
4a69b83045d3 apparmor: mediate the implicit connect of TCP fast open sendmsg
1697957eb097 net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink
1acdd14c0990 net: skmsg: preserve sg.copy across SG transforms
bd968bdd568b mac802154: llsec: add skb_cow_data() before in-place crypto
0cfa78c05066 af_unix: Set gc_in_progress to true in unix_gc().
3c499851753a wifi: mt76: add wcid publish check in mt76_sta_add
5e658b9245a5 ntfs3: reject direct userspace writes to reserved $LX* xattrs
77798d7be6ef ipv4: account for fraggap on the paged allocation path
6374fb9edf72 ipv6: account for fraggap on the paged allocation path
565ab66005b1 batman-adv: tvlv: avoid race of cifsnotfound handler state
4cc9f7711bb8 batman-adv: tvlv: enforce 2-byte alignment
04e1a6557fbf batman-adv: dat: prevent false sharing between VLANs
3f82fc92cf52 batman-adv: tt: track roam count per VID
3470d583fc65 batman-adv: tt: don't merge change entries with different VIDs
af5a069805f6 batman-adv: tp_meter: handle overlapping packets
d511c72a83dd batman-adv: tp_meter: prevent parallel modifications of last_recv
1dafdd0794be batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE
2233787658db batman-adv: tp_meter: restrict number of unacked list entries
3d4548c96d6f batman-adv: v: prevent OGM aggregation on disabled hardif
44ae137a2ace batman-adv: frag: avoid underflow of TTL
116e94025f0f batman-adv: frag: ensure fragment is writable before modifying TTL
0473ae882624 batman-adv: fix (m|b)cast csum after decrementing TTL
49bf27fcd7ee batman-adv: ensure bcast is writable before modifying TTL
646b68639c06 batman-adv: gw: don't deselect gateway with active hardif
95a061f587b7 batman-adv: tp_meter: initialize last_recv_time during init
75612c100a9e batman-adv: prevent ELP transmission interval underflow
43733e5b525f batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE
23d085bd6308 batman-adv: tp_meter: add only finished tp_vars to lists
b8bf8400e50c batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection
1db02f3e315d batman-adv: tp_meter: fix fast recovery precondition
7d2a44bc6bbe batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd
8e77fe0414f5 batman-adv: tp_meter: avoid window underflow
7cb88d91d5f9 batman-adv: tp_meter: initialize dec_cwnd explicitly
696c4cae872c batman-adv: tp_meter: initialize dup_acks explicitly
1c5a1268418e batman-adv: tp_meter: keep unacked list in ascending ordered
e055e74b80eb lockd: fix TEST handling when not all permissions are available.
671ec2eabb87 Revert "PCI: qcom: Advertise Hotplug Slot Capability with no Command Completion support"
d84470219839 selinux: fix overlayfs mmap() and mprotect() access checks
5dfcb15974e7 lsm: add backing_file LSM hooks
5e470998a23e KVM: x86: Fix shadow paging use-after-free due to unexpected role
6e2cd08aa3e8 Linux 6.18.37-xanmod1
0d25ba9b7110 Merge tag 'v6.18.37' into 6.18
0c503cf3dde2 Linux 6.18.37
71003a32bef5 mm: do not copy page tables unnecessarily for VM_UFFD_WP
2abfd3ffbd94 virtiofs: fix UAF on submount umount
f965cf22dda7 media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si
7cad3ceaf679 ksmbd: reject non-VALID session in compound request branch
6c25bf4e44a2 drivers/base/memory: set mem->altmap after successful device registration
50b72074c5e8 serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero
7cc3dd79777f vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write
b8ebf008696d crypto: qat - remove unused character device and IOCTLs
d08d82d83ed4 iio: adc: ti-ads1298: add bounds check to pga_settings index
0a89002737ee iio: light: veml6075: add bounds check to veml6075_it_ms index
76db05493184 net: net_failover: Fix the deadlock in slave register
c5b3871b567c net: export netif_open for self_test usage
cc1494fd6c65 testing/selftests/mm: add soft-dirty merge self-test
f563ce913a83 mm: propagate VM_SOFTDIRTY on merge
b836839c1fd9 mm: set the VM_MAYBE_GUARD flag on guard region install
3d6cb2ed06f7 mm: introduce copy-on-fork VMAs and make VM_MAYBE_GUARD one
05cdec24a858 mm: implement sticky VMA flags
a093c80a1f13 mm: update vma_modify_flags() to handle residual flags, document
bdeadba74337 mm: add atomic VMA flags and set VM_MAYBE_GUARD as such
efce8a486bff mm: introduce VM_MAYBE_GUARD and make visible in /proc/$pid/smaps
0de7db2eb27e sctp: disable BH before calling udp_tunnel_xmit_skb()
eee6be6ab637 firmware: samsung: acpm: Fix cross-thread RX length corruption
02ac3ba41628 Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs
072bbd2846d1 hv: utils: handle and propagate errors in kvp_register
bde74af8d446 regulator: core: fix locking in regulator_resolve_supply() error path
9477cbc5107a rose: don't free fd-owned sockets when reaping in the heartbeat
395b6573b389 rose: clear neighbour pointer in rose_kill_by_device()
9e8fc2195f8b rose: cancel neighbour timers in rose_neigh_put() before freeing
c31a0fa15a4b rose: drop CALL_REQUEST in loopback timer when device is not running
74cbe94c913a rose: release netdev ref and destroy orphaned incoming sockets
c794d35f73a7 rose: fix netdev double-hold in rose_make_new()
ce27bcdd857a rose: disconnect orphaned STATE_2 sockets when device is gone
ab849a6972c9 rose: set SOCK_DESTROY in rose_kill_by_device() for prompt cleanup
c98cc00c2d3b rose: fix notifier unregistered too early in rose_exit()
19139026dc1c rose: fix netdev double-hold in rose_rx_call_request()
1d94857c11d6 rose: guard rose_neigh_put() against NULL in timer expiry
270ef709257e rose: clear neighbour pointer after rose_neigh_put() in state machines
940f39e15332 rose: fix race between loopback timer and module removal
fe8cbcc3e79d rose: hold loopback neighbour reference across timer callback
7dac298524b4 rose: fix dev_put() leak in rose_loopback_timer()
19b3691ec940 ACPI: scan: Use async schedule function in acpi_scan_clear_dep_fn()
53483a9f4ee9 agp/amd64: Fix broken error propagation in agp_amd64_probe()
8b17adf6d4fb net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink()
5f4d2bd028eb i2c: stub: Reject I2C block transfers with invalid length
e2b143df2900 RDMA/bnxt_re: zero shared page before exposing to userspace
44b8b03a9fb5 debugobjects: Dont call fill_pool() in early boot hardirq context
3a408cae608d debugobjects: Do not fill_pool() if pi_blocked_on
9cd2087cd702 debugobjects: Use LD_WAIT_CONFIG instead of LD_WAIT_SLEEP
a460935022f5 debugobjects: Allow to refill the pool before SYSTEM_SCHEDULING
95f9eb19d5e6 Revert "NFSD: Defer sub-object cleanup in export put callbacks"
af2892249d98 fuse: re-lock request before replacing page cache folio
29706ac73f93 net: stmmac: fix stm32 (and potentially others) resume regression
b6099150949f io_uring/net: Avoid msghdr on op_connect/op_bind async data
e5609e8d8cac Linux 6.18.36-xanmod1
a240262f0bf0 Merge tag 'v6.18.36' into 6.18
275d294b2b24 Linux 6.18.36
5d634afb8b83 netfilter: require Ethernet MAC header before using eth_hdr()
bf7a9cacd95e cfi: Include uaccess.h for get_kernel_nofault()
f455405e3207 vsock/virtio: fix skb overhead overflow on 32-bit builds
36a0faaa4e3d block: fix handling of dead zone write plugs
7b569b3a2f29 arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU
99abe00c605e arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU
d4fd42822040 arm64: errata: Mitigate TLBI errata on various Arm CPUs
8097f93f9b77 arm64: cputype: Add C1-Premium definitions
e9ea7cb17677 arm64: cputype: Add C1-Ultra definitions
eca6743b148a vsock/virtio: fix skb overhead accounting to preserve full buf_alloc
9bdc637fde66 vsock/virtio: fix potential unbounded skb queue
cdce1e797add ipvs: skip ipv6 extension headers for csum checks
afd35fec9297 RDMA/umem: Fix truncation for block sizes >= 4G
cd26d54bfbc2 RDMA: Move DMA block iterator logic into dedicated files
ebf22feff492 RDMA/umem: fix kernel-doc warnings
84d8f58cf28a netfilter: nft_fib: fix stale stack leak via the OIFNAME register
2904e985a291 RDMA: During rereg_mr ensure that REREG_ACCESS is compatible
f58efaf9fcf7 RDMA/umem: Add helpers for umem dmabuf revoke lock
5f3286ca5fbb RDMA/umem: Move umem dmabuf revoke logic into helper function
ceddd32231dd RDMA/umem: Add ib_umem_dmabuf_get_pinned_and_lock helper
0ffcad63b19a sched_ext: Don't warn on NULL cgrp_moving_from in scx_cgroup_move_task()
37c059d4d92f wifi: mac80211: tests: mark HT check strict
4dac39a4db14 wifi: mac80211: skip ieee80211_verify_sta_ht_mcs_support check in non-strict mode
17faa39ba980 driver core: reject devices with unregistered buses
20a93e397abe fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling
e09689286385 drm/amd/display: Use krealloc_array() in dal_vector_reserve()
454d3b3d499c drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval()
bb6f705b73b5 drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs
c000da79df78 drm/amd/display: add missing CSC entries for BT.2020 for DCE IPs
3f32d52ec604 drm/amd/display: Clamp VBIOS HDMI retimer register count to array size
1906064d50d1 drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size
0e56f460bddb drm/amd/display: Bound VBIOS record-chain walk loops
57607fe55e6d drm/amd/pm: smu_v14_0_0: use SoftMin for gfxclk in set_soft_freq_limited_range
932642791cb1 drm/amd/pm: mark metrics.energy_accumulator is invalid for smu 14.0.2
8979ded4d899 drm/amd/pm: fix smu13 power limit default/cap calculation
39b5397bf8de drm/amdgpu: set noretry=1 as default for GFX 10.1.x (Navi10/12/14)
fcd51a085e9a drm/amdgpu: restart the CS if some parts of the VM are still invalidated
68455b117258 drm/amdgpu: fix waiting for all submissions for userptrs
9655b56b6de9 drm/v3d: Skip CSD when it has zeroed workgroups
90b629269088 drm/v3d: Fix vaddr leak when indirect CSD has zeroed workgroups
3e1947573140 drm/v3d: Fix global performance monitor reference counting
11e9bdf8824b drm/v3d: Wait for pending L2T flush before cleaning caches
4c10fd55187a drm/xe: Clear pending_disable before signaling suspend fence
0f68ddfaaebf drm/xe/display: fix oops in suspend/shutdown without display
d3efcadfe3ee drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11
72e259a32084 drm/amdkfd: fix NULL dereference in get_queue_ids()
c0639ede2f24 drm/gem: Try to fix change_handle ioctl, attempt 4
9f0d45d509b4 slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock
8f4b371f4939 slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD
5204cd22c1c7 slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership
dd8e1025a84e slimbus: qcom-ngd-ctrl: Initialize controller resources in controller
24ec89123fc9 slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd
3bb2ac834ed3 slimbus: qcom-ngd-ctrl: Fix probe error path ordering
d6cb003e4661 slimbus: qcom-ngd-ctrl: Fix up platform_driver registration
6890bd2451a9 slimbus: qcom-ngd-ctrl: fix OF node refcount
b5daa920f44c thunderbolt: Limit XDomain response copy to actual frame size
46da5c3ea011 thunderbolt: Validate XDomain request packet size before type cast
fcbd0cdab928 thunderbolt: Clamp XDomain response data copy to allocation size
60ba62174607 thunderbolt: Bound root directory content to block size
2e0ddac549eb thunderbolt: Reject zero-length property entries in validator
d5ea0b3e261f sctp: stream: fully roll back denied add-stream state
78c4f964b2f9 sctp: diag: reject stale associations in dump_one path
566c4c1244de rxrpc: Fix the ACK parser to extract the SACK table for parsing
1bf84f4013fa rtase: Reset TX subqueue when clearing TX ring
54f9cdcd7311 rtase: Avoid sleeping in get_stats64()
ddcf84b25af0 pmdomain: ti_sci: add wakeup constraint to parent devices of wakeup source
0d11992d1898 pmdomain: imx: fix OF node refcount
0aecf3c7b8f8 mmc: sdhci: add signal voltage switch in sdhci_resume_host
535ff092b686 mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC
2f72d36f8acc mmc: litex_mmc: Set mandatory idle clocks before CMD0
7f8007be13e6 mmc: dw_mmc-rockchip: Add missing private data for very old controllers
c677b13671dc mmc: core: Fix host controller programming for fixed driver type
a8f91ddf67f6 mm/mincore: handle non-swap entries before !CONFIG_SWAP guard
c19ff4351214 mm/list_lru: drain before clearing xarray entry on reparent
c72469ac0f27 mm/hugetlb: restore reservation on error in hugetlb folio copy paths
ecc24f0a8a30 mm/hugetlb: avoid false positive lockdep assertion
66bc00ea37fa mm/damon/reclaim: handle ctx allocation failure
6d48f1565939 mm/damon/lru_sort: handle ctx allocation failure
d83390b21a02 mm/cma_debug: fix invalid accesses for inactive CMA areas
52078596dce1 mm/cma: fix reserved page leak on activation failure
d5d37b7b72a9 io_uring/wait: fix min_timeout behavior
c888d5198ffc io_uring/kbuf: don't truncate end buffer for bundles
3fdcca838f97 pinctrl: mcp23s08: Read spi-present-mask as u8 not u32
e646b86b3b48 octeontx2-af: fix memory leak in rvu_setup_hw_resources()
4a4d21f531cc nvmem: layouts: onie-tlv: fix hang on unknown types
cb85ef5a227b nvmem: core: fix use-after-free bugs in error paths
bef389a210e7 net: sfp: initialize i2c_block_size at adapter configure time
1d4ec754ee38 net: rds: clear i_sends on setup unwind
52b8f5ef82c8 net: phonet: free phonet_device after RCU grace period
4a73cacb5586 net: mv643xx: fix OF node refcount
bcb8fad90f27 net: bonding: fix NULL pointer dereference in bond_do_ioctl()
01f7d4b50458 net: airoha: Add NULL check for of_reserved_mem_lookup() in airoha_qdma_init_hfwd_queues()
e0df4d9c0909 net/mlx5: Reorder completion before putting command entry in cmd_work_handler
0a46c7a5646d firmware: samsung: acpm: Fix mailbox channel leak on probe error
d5de9cb5355d misc: fastrpc: Fix NULL pointer dereference in rpmsg callback
53e06f8a3c2b misc: fastrpc: fix DMA address corruption due to find_vma misuse
992f121796b7 misc: fastrpc: fix use-after-free race in fastrpc_map_create
5278ccd357e0 misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context
89bd8215e25a memcg: use round-robin victim selection in refill_stock
a388e3dfaf95 locking/rtmutex: Skip remove_waiter() when waiter is not enqueued
db752ebfdaf2 ipc/shm: serialize orphan cleanup with shm_nattch updates
ab61c990a87d iommu/dma: Do not try to iommu_map a 0 length region in swiotlb
f35a368fee8a Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard
a3dff1e1a554 Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK)
7f59e4f72a78 i2c: tegra: Fix NOIRQ suspend/resume
6018d73137cd i2c: stm32f7: fix timing computation ignoring i2c-analog-filter
a162a260c8c4 i2c: qcom-cci: Fix NULL pointer dereference in cci_remove()
9fa82cf393ba i2c: imx: fix clock and pinctrl state inconsistency in runtime PM
b39f30c0a72f i2c: imx-lpi2c: fix resource leaks switching to devm_dma_request_chan()
16f8e17184b3 futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock
56763afa0134 fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios
12df4cfa738a fuse: reject fuse_notify() pagecache ops on directories
57a9c085be07 fs/qnx6: fix pointer arithmetic in directory iteration
2990f143ec86 pidfd: refuse access to tasks that have started exiting harder
89b909e97045 inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush
df422fd273c9 IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN
32138633e51e fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh()
3884976f8744 bnxt_en: Fix NULL pointer dereference
6f72b902c34d ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write
735dabdf2156 staging: rtl8723bs: fix buffer over-read in rtw_update_protection
1d6c2062b77b timers/migration: Fix livelock in tmigr_handle_remote_up()
ba9ad6015937 vsock/vmci: fix sk_ack_backlog leak on failed handshake
265c07c09c83 wifi: nl80211: reject oversized EMA RNR lists
ac2000be0cbe wifi: iwlwifi: pcie: simplify the resume flow if fast resume is not used
fcfdff42e841 xfs: fix rtgroup cleanup in CoW fork repair
d84ed2f9718e xfs: fix error returns in CoW fork repair
9f21885c11ba mptcp: add-addr: always drop other suboptions
6ea1134f1b5f selftests: mptcp: add test for extra_subflows underflow on userspace PM
7bbc11437a20 mptcp: sockopt: set sockopt on all subflows
f591cbc088c9 mptcp: sockopt: check timestamping ret value
c0c152fc4ae6 mptcp: pm: fix extra_subflows underflow on userspace PM subflow creation
653245266913 mptcp: allow subflow rcv wnd to shrink
3b8cbba7c0ed mptcp: close TOCTOU race while computing rcv_wnd
edaf0c955ace mptcp: fix retransmission loop when csum is enabled
95f27fcda681 arm64: mm: call pagetable dtor when freeing hot-removed page tables
517720913bd3 ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow
da295adc9dab ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O
6243a363ec90 ARM: socfpga: Fix OF node refcount leak in SMP setup
6822eed69572 udp: clear skb->dev before running a sockmap verdict
c96786d6ff1a zram: fix use-after-free in zram_bvec_write_partial()
f92a285db7ff RDMA/srp: bound SRP_RSP sense copy by the received length
bd5e818be796 RDMA/core: Validate cpu_id against nr_cpu_ids in DMAH alloc
96b6e98ff12d RDMA/core: Validate the passed in fops for ib_get_ucaps()
e99807bdcd20 mm/huge_memory: update file PUD counter before folio_put()
cb5230b6d8a0 mm/damon/ops-common: call folio_test_lru() after folio_get()
5f5b604e1e6b mm/huge_memory: update file PMD counter before folio_put()
edabfe80e34e drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info()
8348567a6afb drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait()
0bbc9481f970 io_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv retries
3d39da65b5c4 ALSA: timer: Fix UAF at snd_timer_user_params()
f46093dd2296 ALSA: timer: Forcibly close timer instances at closing
372f33ebed74 USB: serial: kl5kusb105: fix bulk-out buffer overflow
85bd2b3afa0a USB: serial: option: add usb-id for Dell Wireless DW5826e-m
294692d3296e USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr()
f96cf7bf9fbf USB: serial: io_ti: fix heap overflow in get_manuf_info()
a13ca53e47e5 xfrm: iptfs: fix ABBA deadlock in iptfs_destroy_state()
dd66f7f6e360 xfrm: iptfs: preserve shared-frag marker in iptfs_consume_frags()
f9b38a8fbfa0 xfrm: espintcp: do not reuse an in-progress partial send
14d2eee0193a ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL
0b38870d81ab hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf
32d4c5d328a3 drm/i915/gem: Fix phys BO pread/pwrite with offset
0b79bcff7210 KVM: arm64: Restore POR_EL0 access to host EL0
196f1ee137eb KVM: SEV: Decouple the need to sync the GHCB SA from the need to free the SA
343e95c8ecc4 KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying
0864bdde152e mshv: add a missing padding field
8bcbedce9bfa mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation
a0a4600b396b rust: kasan/kbuild: fix rustc-option when cross-compiling
d0f25a1755f2 rust: arm64: set uwtable llvm module flag for CONFIG_UNWIND_TABLES
5037b2ee1a17 ARM: Do not select HAVE_RUST when KASAN is enabled
00875811f372 rust: x86: support Rust >= 1.98.0 target spec
592be0dc491d tracing/probes: Point the error offset correctly for eprobe argument error
09df291fdf96 tracing: Fix CFI violation in probestub being called by tprobes
45cb105b8642 accel/ivpu: Fix signed integer truncation in IPC receive
fa598556ecef accel/ivpu: Add buffer overflow check in MS get_info_ioctl
8ec70c0dbdf0 accel/ivpu: Add bounds checks for firmware log indices
dd77a83915b0 mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison
cc160ce08540 soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get()
dedc92b96dc1 Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig
dafc9f57140e Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend
c10c9c48b290 tee: shm: fix shm leak in register_shm_helper()
07acb9798477 netfilter: nft_meta_bridge: fix stale stack leak via IIFHWADDR register
941d7394efda netfilter: nft_tunnel: fix use-after-free on object destroy
e83fc4c28226 accel/amdxdna: Fix mm_struct reference leak in aie2_populate_range()
361e97d81331 drm/xe: fix refcount leak in xe_range_fence_insert()
02f5e4db57c0 drm/vc4: fix krealloc() memory leak
19a6a00ff50c drm/virtio: Fix driver removal with disabled KMS
dda720b2928d drm/i915/edp: Check supported link rates DPCD read
489f6d759fa4 clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time
3a4fc3617b7e clk: samsung: gs101: Fix missing USI7_USI DIV clock in peric0_clk_regs
656939c67595 clk: qcom: x1e80100-dispcc: Stop disp_cc_mdss_mdp_clk_src from getting parked
f34689e7a0b3 KVM: VMX: Update SVI during runtime APICv activation
07d9a0870a17 ipv6: Fix a potential NPD in cleanup_prefix_route()
2c98343c9b23 net: txgbe: initialize module info buffer
19a4d2aace1d net: txgbe: rename the SFP related
9157060fed92 net: txgbe: support CR modules for AML devices
7649ba2b1291 net: txgbe: optimize the flow to setup PHY for AML devices
af08fe9ba091 net: mvpp2: build skb from XDP-adjusted data on XDP_PASS
8a2126c5afe8 net: mvpp2: refill RX buffers before XDP or skb use
910617a4e67d net: mvpp2: limit XDP frame size to the RX buffer
a13199fa224e net: mvpp2: sync RX data at the hardware packet offset
78069a6d8bc8 netfilter: nft_exthdr: fix register tracking for F_PRESENT flag
af1b7699466f netfilter: nf_log: validate MAC header was set before dumping it
08a3e218064d netfilter: x_tables: avoid leaking percpu counter pointers
9d017671dcfc netfilter: nf_conntrack: destroy stale expectfn expectations on unregister
4beffcd726e2 netfilter: revalidate bridge ports
865e94f6d8a5 spi: rzv2h-rspi: Fix SPDR read access width for 16-bit RX
5ae8a38169fc rds: mark snapshot pages dirty in rds_info_getsockopt()
2abfb19bbb81 ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()
5fd1fa5a4254 tun: zero the whole vnet header in tun_put_user()
dcf458120add net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion
3dde4fb941fa net: guard timestamp cmsgs to real error queue skbs
7560afb8cdda sctp: validate embedded INIT chunk and address list lengths in cookie
ecf8904067dc ip6_vti: set netns_immutable on the fallback device.
f76a8b323e28 sctp: fix uninit-value in __sctp_rcv_asconf_lookup()
d23d53355300 ASoC: SOF: amd: fix for ipc flags check
6c75ee4d1d40 net: mctp: usb: don't fail mctp_usb_rx_queue on a deferred submission
9c46f3ee1837 net: mctp: usb: fix race between urb completion and rx_retry cancellation
bace7b99bfa5 gpio: rockchip: fix generic IRQ chip leak on remove
5d4bca5cbb69 gpio: zynq: fix runtime PM leak on remove
c838ffc154cb r8152: handle the return value of usb_reset_device()
ecc55aad3390 net: openvswitch: fix possible kfree_skb of ERR_PTR
2fa49b2715e1 ipv6: sit: reload inner IPv6 header after GSO offloads
289c06418ed9 net/mlx5: Use effective affinity mask for IRQ selection
2789b74ae1f4 net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure
0f807764bb12 net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list
ab269990ed58 net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove
3a254779c169 net: phy: clean the sfp upstream if phy probing fails
c299321bc623 netdev: fix double-free in netdev_nl_bind_rx_doit()
c09c2e236eef net: ibm: emac: Fix use-after-free during device removal
8b0541231091 net/mlx4: avoid GCC 10 __bad_copy_from() false positive
0cde3a004119 net: add pskb_may_pull() to skb_gro_receive_list()
ede69b8f6670 tcp: restrict SO_ATTACH_FILTER to priv users
12e579b88962 ASoC: wm_adsp: Fix NULL dereference when removing firmware controls
6136c1474db8 gpio: mvebu: fix NULL pointer dereference in suspend/resume
0c4bb32ad7fd netlabel: validate unlabeled address and mask attribute lengths
972c106f5d01 bnge: fix context mem iteration
6b8baf42b1b7 net: ena: PHC: Add missing barrier
640edc281d2f idpf: fix mailbox capability for set device clock time
6bdbe6f43ecf ice: fix missing priority callbacks for U.FL DPLL pins
b5316e2b8614 xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()
5513dcb378f9 dma-debug: fix physical address retrieval in debug_dma_sync_sg_for_device
4ee4d628c4d9 dma-mapping: direct: fix missing mapping for THRU_HOST_BRIDGE segments
8d9a79fbf517 xfrm: iptfs: fix use-after-free on first_skb in __input_process_payload
e27c17346628 tap: free page on error paths in tap_get_user_xdp()
0c03692e2372 verification/rvgen: Fix ltl2k writing True as a literal
43ad0a0da486 verification/rvgen: Fix options shared among commands
73590b4cfd05 tools/rv: Fix cleanup after failed trace setup
fd1923910bbf tools/rv: Fix substring match when listing container monitors
2122d68f0864 tools/rv: Fix substring match bug in monitor name search
618193aba6fe tools/rv: Ensure monitor name and desc are NUL-terminated
65046b0d853d cpufreq/amd-pstate: drop stale @epp_cached kdoc
63a9f6012f45 spi: cadence-quadspi: fix unclocked access on unbind
6671a46144f8 ALSA: seq: dummy: fix UMP event stack overread
cd98837db15f ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams
6b71956c25f9 time: Fix off-by-one in settimeofday() usec validation
ed0ad6574126 hyperv: Clean up and fix the guest ID comment in hvgdk.h
8c046f36222c signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads()
6dc6e5b5c32e selftests: harness: fix pidfd leak in __wait_for_test
752e22ecf4df drm/hyperv: During panic do VMBus unload after frame buffer is flushed
b0f77f76231b Drivers: hv: vmbus: Provide option to skip VMBus unload on panic
1639df1a9844 Drivers: hv: VMBus protocol version 6.0
a6207349e703 sctp: purge outqueue on stale COOKIE-ECHO handling
42446ca0f357 net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr
285b0842f2e0 ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()
3b7ee029b556 vxlan: vnifilter: fix spurious notification on VNI update
8e4d1188bad7 vxlan: vnifilter: send notification on VNI add
eb676fb14427 octeontx2-af: npc: Fix CPT channel mask in npc_install_flow
cc272185c9a9 sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing
b198ed4e5258 net/sched: fix pedit partial COW leading to page cache corruption
e634408d2b0c net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown
6f829e2c17a5 net: airoha: Fix use-after-free in metadata dst teardown
9a263bbd1ec0 ptp: vclock: Switch from RCU to SRCU
a4f3fd651692 ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options
91106d0348a5 af_unix: Fix inq_len update problem in partial read
f010cf9aea01 octeontx2-af: Fix initialization of mcam's entry2target_pffunc field
ddf930f28be6 octeontx2-pf: Fix NDC sync operation errors
0dfe05b93843 xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata()
58d810354de1 Bluetooth: MGMT: Fix backward compatibility with userspace
446a17b1b509 Bluetooth: SCO: Fix data-race on sco_pi fields in sco_connect
ab84fd7779a2 Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls
33d677d2e371 Bluetooth: ISO: Fix not releasing hdev reference on iso_conn_big_sync
ce4b4cac3c57 Bluetooth: fix memory leak in error path of hci_alloc_dev()
c893e17d2809 Bluetooth: bnep: reject short frames before parsing
7f5367f1ad9b Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling
3eabc6d47a0a Bluetooth: RFCOMM: validate skb length in MCC handlers
1a3c8ffbb469 Bluetooth: MGMT: validate advertising TLV before type checks
8802413ce631 Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()
fb8db813eba2 wifi: fix leak if split 6 GHz scanning fails
15be7e9fdbff ipv6: anycast: insert aca into global hash under idev->lock
23bf7d5c250b net: fec: fix pinctrl default state restore order on resume
76244b33640b net: lan743x: permit VLAN-tagged packets up to configured MTU
04e22fefac1a net: garp: fix unsigned integer underflow in garp_pdu_parse_attr
66a46e22396f hsr: Remove WARN_ONCE() in hsr_addr_is_self().
07f13816be5a net: Annotate sk->sk_write_space() for UDP SOCKMAP.
83810d51d699 pcnet32: stop holding device spin lock during napi_complete_done
9b40c59bab08 wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap
e3f6ba5f8cf3 drm/imx: Fix three kernel-doc warnings in dcss-scaler.c
927f96861f93 devlink: Release nested relation on devlink free
e251d4cdfc72 l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl()
c32f30ef5e66 6lowpan: fix off-by-one in multicast context address compression
b60e9391142e net/sched: act_api: use RCU with deferred freeing for action lifecycle
42ff6774ecd9 dm cache policy smq: check allocation under invalidate lock
b18675263db1 netfilter: bridge: make ebt_snat ARP rewrite writable
f071b0bf0781 netfilter: nft_ct: bail out on template ct in get eval
9e5da2379f96 netfilter: conntrack_irc: fix possible out-of-bounds read
aaf80701dc2f netfilter: synproxy: add mutex to guard hook reference counting
25918720ba97 ipvs: clear the svc scheduler ptr early on edit
cdaf13260c99 netfilter: xt_NFQUEUE: prefer raw_smp_processor_id
e735dbd489e3 ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers
9dca67624721 wifi: iwlwifi: mvm: don't support the reset handshake for old firmwares
00bf6868df65 erofs: fix use-after-free on sbi->sync_decompress
50fd261b1ec4 erofs: tidy up synchronous decompression
8db2fabb5ecd tee: qcomtee: add missing va_end in early return qcomtee_object_user_init()
ac7eca1ae4e5 tee: fix tee_ioctl_object_invoke_arg padding
633db9a1991a soc: qcom: ice: Return -ENODEV if the ICE platform device is not found
40fc6ed12f91 ARM: dts: microchip: sam9x7: fix GMAC clock configuration
9cb93ec617fb arm64: dts: qcom: x1-dell-thena: remove i2c20 (battery SMBus) and reserve its pins
a171bc68e9af soc: qcom: ice: Allow explicit votes on 'iface' clock for ICE
d5b57bb314d7 tee: optee: prevent use-after-free when the client exits before the supplicant
dcd90f42a33e net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS
4203806f700b ipv6: mcast: Fix use-after-free when processing MLD queries
ffbcf31f032e i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl
97706097f9b8 KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation
9e767af5f109 ARM: fix branch predictor hardening
05e22564a4f9 ARM: fix hash_name() fault
8bdb574b2176 ARM: allow __do_kernel_fault() to report execution of memory faults
22e26df355af ARM: group is_permission_fault() with is_translation_fault()
87dfb977bdb6 bpf: Free reuseport cBPF prog after RCU grace period.
b0ffe362d9f8 Linux 6.18.35-rt-xanmod1
a42985600ae2 Merge branch '6.18' into 6.18-rt
da2d87f71ae2 Linux 6.18.35-xanmod1
f718432d2e3a Merge tag 'v6.18.35' into 6.18
acb7cf4c1184 Linux 6.18.35
918450ad6010 KVM: arm64: Reassign nested_mmus array behind mmu_lock
2bbc395e81bd KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry
adc6fc240a61 tools: ynl: add scope qualifier for definitions
f54b30f3316a usb: core: Fix SuperSpeed root hub wMaxPacketSize
830c8a9b467e thunderbolt: property: Cap recursion depth in __tb_property_parse_dir()
21bfa15a89d8 drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable
00869f2320dc mailbox: Fix NULL message support in mbox_send_message()
5372f6f10b0a xhci: tegra: Fix ghost USB device on dual-role port unplug
58b2c0f096b3 net: phy: micrel: fix LAN8814 QSGMII soft reset
972ea882d4bf mm/slub: hold cpus_read_lock around flush_rcu_sheaves_on_cache()
56857385f313 hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock
6b94f9f5fe28 hwmon: (pmbus/adm1266) serialize sequencer_state debugfs read with pmbus_lock
192516d72774 hwmon: (pmbus) Add support for guarded PMBus lock
d8fdf33d6fcf USB: serial: mct_u232: fix memory corruption with small endpoint
062dcc0b324a USB: serial: digi_acceleport: fix memory corruption with small endpoints
284105c40fc3 USB: serial: cypress_m8: fix memory corruption with small endpoint
c73c62a4bd52 usb: dwc3: xilinx: fix error handling in zynqmp init error paths
9327252e0462 xfrm: iptfs: reset runtime state when cloning SAs
bb50838a2a06 cpufreq: intel_pstate: Use correct scaling factor on Raptor Lake-E
7cb2daed3509 cpufreq: intel_pstate: Add and use hybrid_get_cpu_type()
8f72a2509163 mptcp: reset rcv wnd on disconnect
82e742b9d2cc mptcp: cleanup fallback dummy mapping generation
0d9b9d7dbef9 octeontx2-pf: avoid double free of pool->stack on AQ init failure
fe93e907b1af arm64: tlb: Flush walk cache when unsharing PMD tables
bb37498a99e4 mptcp: do not drop partial packets
a84164847b1e mptcp: borrow forward memory from subflow
c67f986fc02c mptcp: handle first subflow closing consistently
134c517dfa63 net: devmem: reject dma-buf bind with non-page-aligned size or SG length
b2beed6ad149 selftests: mptcp: drop nanoseconds width specifier
c5e7d4865292 Bluetooth: hci_qca: Convert timeout from jiffies to ms
8264178afb5c Bluetooth: hci_qca: Migrate to serdev specific shutdown function
0acba63d7d46 serdev: Provide a bustype shutdown function
8bf7dbb741dd rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer
46cb765e2e5a rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg
fed725cace3a x86/mm: Disable broadcast TLB flush when PCID is disabled
81181a39bde9 platform/x86/intel/vsec: Fix enable_cnt imbalance on PCIe error recovery
1730c91a8b9a platform/x86/intel/vsec: Make driver_data info const
4b0e87f9b50f platform/x86/intel/vsec: Refactor base_addr handling
71b88acec0a7 serial: 8250_dw: dispatch SysRq character in dw8250_handle_irq()
7f8b194ed720 serial: 8250: dispatch SysRq character in serial8250_handle_irq()
5f2172d799f3 serial: core: introduce guard(uart_port_lock_check_sysrq_irqsave)
237dc8c08de3 serial: zs: Convert to use a platform device
81984447eac4 serial: zs: Switch to using channel reset
b1ceeaef4fbc serial: zs: Fix bootconsole handover lockup
2ff0401ffdda serial: dz: Convert to use a platform device
2c5b693d918c serial: dz: Fix bootconsole handover lockup
24b7be239b0b serial: dz: Fix bootconsole message clobbering at chip reset
f059b4c493df drm/amdgpu: check num_entries in GEM_OP GET_MAPPING_INFO
fa372f4e8aef drm/amdgpu: fix calling VM invalidation in amdgpu_hmm_invalidate_gfx
1eb86334e391 drm/amdgpu: fix lock leak on ENOMEM in AMDGPU_GEM_OP_GET_MAPPING_INFO
275396bf71c4 drm/amdkfd: Check for pdd drm file first in CRIU restore path
5cf4a41aa0d7 drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger
2f9c3c161692 drm/amdkfd: fix NULL pointer bug in svm_range_set_attr
348e01e64a87 serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma
8e39badab090 serial: zs: Fix swapped RI/DSR modem line transition counting
10ddd1a320e1 serial: sh-sci: fix memory region release in error path
654f45a8569f serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ
78d0d6f69bd6 serial: qcom-geni: fix UART_RX_PAR_EN bit position
9a91692fae5c serial: altera_jtaguart: handle uart_add_one_port() failures
ffa7dce35b64 drm/amd/pm/si: Disregard vblank time when no displays are connected
c9ae7e7e3bc9 drm/i915: Fix potential UAF in TTM object purge
fed64e47a32f drm/i915/psr: Block DC states on vblank enable when Panel Replay supported
0dfa42cfe4db drm/gem: fix race between change_handle and handle_delete
164dc7bf1760 drm/hyperv: validate VMBus packet size in receive callback
9c698b2c43c2 drm/hyperv: validate resolution_count and fix WIN8 fallback
4a3a19c98a82 scsi: target: iscsi: Validate CHAP_R length before base64 decode
594a40360012 scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf
89c81d1228c0 scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()
35461d237441 scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32
14dd80a20a72 scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker
d548179adcc8 thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow
31b98e503ecc thunderbolt: property: Reject u32 wrap in tb_property_entry_valid()
c7d421123b98 usb: gadget: f_fs: serialize DMABUF cancel against request completion
607730a41477 usb: gadget: f_fs: copy only received bytes on short ep0 read
5933063935e8 usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports
f8f5a8f48c7c usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling
f928630f450b usb: gadget: f_hid: fix device reference leak in hidg_alloc()
e6f8be12f030 usb: gadget: net2280: Fix double free in probe error path
caec0145e597 usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind
f06bcaba2970 USB: serial: mct_u232: fix missing interrupt-in transfer sanity check
6c0cf56f00f2 USB: serial: mxuport: fix memory corruption with small endpoint
ea2b792330b4 USB: serial: keyspan: fix missing indat transfer sanity check
ae03453f2c80 USB: serial: cypress_m8: validate interrupt packet headers
22823a319fb2 USB: serial: belkin_sa: validate interrupt status length
f7c3fcd63405 USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL
38ba1a464c0d USB: serial: option: add MeiG SRM813Q
62fbc1396108 usb: typec: ucsi: Don't update power_supply on power role change if not connected
d62d97c9c8c2 usb: typec: ucsi: Check if power role change actually happened before handling
f34effb0b545 usb: typec: tcpm: improve handling of DISCOVER_MODES failures
02d9d8b79e18 usb: typec: tipd: Fix error code in tps6598x_probe()
a90139ff1eba usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize
75f6d3da2cc6 usb: usbtmc: check URB actual_length for interrupt-IN notifications
88d459e5b5a4 usbip: vudc: Fix use after free bug in vudc_remove due to race condition
5b78d8b9a832 usb: storage: Add quirks for PNY Elite Portable SSD
94b05aec1985 USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers
69f9f2b30af0 usb: musb: omap2430: Fix use-after-free in omap2430_probe()
3bc65566331a usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval
7118304b1a77 usb: chipidea: core: convert ci_role_switch to local variable
9fd48937046e tty: serial: samsung: Remove redundant port lock acquisition in rx helpers
66f8bfea055b tty: serial: pch_uart: add check for dma_alloc_coherent()
b4bebb6e0a44 counter: Fix refcount leak in counter_alloc() error path
c7e670cb2538 comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest()
269f5be6a6e4 comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest()
fdb74898d91d Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490
7f95f4792c0d Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem
639fa8af506e misc: rp1: Send IACK on IRQ activate to fix kdump/kexec
94215d55b094 ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops
6617ee91062b Input: xpad - add support for ASUS ROG RAIKIRI II
3d63b8077f5b Input: xpad - add "Nova 2 Lite" from GameSir
2ffd8b0dd448 ALSA: hda/realtek: Fix speaker output on ASUS ROG Strix G615LP
c093468aea82 xfrm: esp: restore combined single-frag length gate
c4609fff0665 ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks
35be14ea8298 ASoC: qcom: q6asm-dai: close stream only when running
b98ab51c45c5 netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check
b9027ff112b6 ALSA: firewire-motu: Protect register DSP event queue positions
befcb15c1f05 ALSA: scarlett2: Fix 2i2 Gen 4 direct monitor gain on firmware 2417
aa0c7e59192b xfrm: ah: use skb_to_full_sk in async output callbacks
dc6dcba80d72 xfrm: ipcomp: Free destination pages on acomp errors
448bb92ca101 xfrm: route MIGRATE notifications to caller's netns
22d41b176b99 nfc: hci: fix out-of-bounds read in HCP header parsing
8b1f4f618fd8 iommu, debugobjects: avoid gcc-16.1 section mismatch warnings
b8338111e141 HID: wacom: Fix OOB write in wacom_hid_set_device_mode()
59139473a7a7 spi: spi-mem: avoid mutating op template in spi_mem_supports_op()
96a4713ae041 net: skbuff: fix missing zerocopy reference in pskb_carve helpers
fc32be9ac278 ip6: vti: Use ip6_tnl.net in vti6_changelink().
947013fd7c8c l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname
9f7ebb45a83a xfrm: input: hold netns during deferred transport reinjection
a35daeabb433 ipv6: validate extension header length before copying to cmsg
853f6ea482df ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().
751db1b802a0 ipv6: exthdrs: refresh nh after handling HAO option
90983f841dfa ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params
c512e1c819df ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()
6d00f5c7e5ff macsec: fix replay protection at XPN lower-PN wrap
5e1902866796 bpf: sockmap: fix tail fragment offset in bpf_msg_push_data
e4892b1ecd73 wireguard: send: append trailer after expanding head
d59cc66b7027 x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines
3f43865cb64d i2c: davinci: fix division by zero on missing clock-frequency
bf769358419e Input: elan_i2c - validate firmware size before use
84ea928ed584 usb: dwc2: Fix use after free in debug code
94c92f9c886c usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles
459c4fa089f7 usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure
b2723bd468c5 usb: cdns3: gadget: fix request skipping after clearing halt
0fee0ccac29e USB: serial: omninet: fix memory corruption with small endpoint
3412a95afaa5 iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf()
a3763ae33476 iio: buffer: hw-consumer: fix use-after-free in error path
390254cf509b iio: light: cm3323: fix reg_conf not being initialized correctly
5e4d34092a5e iio: chemical: scd30: fix division by zero in write_raw
a5a05410cb34 iio: chemical: mhz19b: reject oversized serial replies
cbd2d7e6bd4f iio: Fix iio_multiply_value use in iio_read_channel_processed_scale
8d4daa614440 iio: light: veml6070: Fix resource leak in probe error path
ae01ec83841d iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL
aefc19ca3dd3 iio: temperature: tsys01: fix broken PROM checksum validation
04a4d9822210 iio: ssp_sensors: cancel delayed work_refresh on remove
aaf9d640e9ae iio: gyro: adis16260: fix division by zero in write_raw
15a0b3f33ffb iio: gyro: itg3200: fix i2c read into the wrong stack location
5cb8cede8baf iio: adc: ad4695: Fix call ordering in offload buffer postenable
7155e7fce429 iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw
944082fdb028 iio: adc: mt6359: fix unchecked return value in mt6358_read_imp
991d359faa95 iio: dac: ad5686: fix powerdown control on dual-channel devices
31de336a2c0d iio: dac: ad5686: acquire lock when doing powerdown control
f541c9a1eb89 iio: dac: ad5686: fix input raw value check
69f7d101976c iio: dac: ad5686: fix ref bit initialization for single-channel parts
684bfd655b80 iio: dac: max5821: fix return value check in powerdown sync
88c9dd5170e0 iio: dac: ad3530r: Fix AD3531/AD3531R powerdown mode strings
2ce5ca7824a1 iio: adc: npcm: fix unbalanced clk_disable_unprepare()
0ee771fff32e iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux
bb1b43e8a7ed Disable -Wattribute-alias for clang-23 and newer
bbd989d6fd36 KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc()
b1dfaa6f7a95 KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer
75c8d1d72912 KVM: SEV: Check PSC request indices against the actual size of the buffer
9f0a9e780f02 KVM: SEV: Compute the correct max length of the in-GHCB scratch area
5300aedbee56 KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0
e4ab26f81a63 KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests
2254972d4d69 KVM: SEV: Ignore Port I/O requests of length '0'
c9b4198fbc6e KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use
ec62e8480e82 KVM: SVM: Flush the current TLB when transitioning from xAVIC => x2AVIC
b1fc4a83dd44 KVM: arm64: PMU: Preserve AArch32 counter low bits
625153b917bc USB: cdc-acm: Fix bit overlap and move quirk definitions to header
667599e71832 rust_binder: avoid calling pending_oneway_finished() on TF_UPDATE_TXN
f2f2671e32c5 rust_binder: Avoid holding lock when dropping delivered_death
74d6aae1df45 parport: Fix race between port and client registration
9749db57233b Input: xpad - fix out-of-bounds access for Share button
d9019210c8c3 Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync
2b7651f58670 Bluetooth: hci_qca: Use 100 ms SSR delay for rampatch and NVM loading
e6b78019664d Bluetooth: hci_conn: Fix memory leak in hci_le_big_terminate()
bc08c15746f2 Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock
c318aa51830a Bluetooth: ISO: fix UAF in iso_recv_frame
6348dfed5b0f Bluetooth: HIDP: fix missing length checks in hidp_input_report()
e8a5baff5be2 Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn
859d3ace791e Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen()
388051f7389a smb: client: fix uninitialized variable in smb2_writev_callback
197476b12601 auxdisplay: line-display: fix OOB read on zero-length message_store()
0fcc34d0d8fe mm/rmap: initialize nr_pages to 1 at loop start in try_to_unmap_one
0995d1f79aed memfd: deny writeable mappings when implying SEAL_WRITE
f1f0cdca932b mm: memcontrol: propagate NMI slab stats to memcg vmstats
a3cc795129e5 ipc: limit next_id allocation to the valid ID range
0ba6c05156d9 mm/damon/sysfs-schemes: delete tried region in regions_rmdirs()
0886c6f257fe hpfs: fix a crash if hpfs_map_dnode_bitmap fails
4064a30381fa Bluetooth: btusb: Allow firmware re-download when version matches
6728e80c9d29 HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse
8735a28f2dcd Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free()
f33b5a61673b media: rc: igorplugusb: fix control request setup packet
f793b67d41e5 USB: serial: safe_serial: fix memory corruption with small endpoint
0edd1e21587b usb: typec: ucsi: validate connector number in ucsi_connector_change()
9b496e3371c0 usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT
e94933dc41b8 usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer()
b10eff5abe6a usb: typec: altmodes/displayport: validate count before reading Status Update VDO
052dbef45cb3 usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO
4505f33dab56 usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes()
f9d787fbe831 usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers
a38ed87818b2 usb: typec: ucsi: ccg: reject firmware images without a ':' record header
a58400f58f82 iio: pressure: bmp280: fix stack leak in bmp580 trigger handler
ce582b22dd2f iio: imu: adis16550: fix stack leak in trigger handler
e6bb3a49c5f9 iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer
278b0df1f736 phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X
487393023feb drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used
c058cf6b84c1 drm/i915/psr: Read Intel DPCD workaround register
dd4cbab2a446 drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register
600ad63124de s390/cio: Restore GFP_DMA for CHSC allocation
0171e01de47a Revert "x86/fpu: Refine and simplify the magic number check during signal return"
ff0ca46b13b9 smb: client: validate the whole DACL before rewriting it in cifsacl
efacf63ed087 media: rc: ttusbir: fix inverted error logic
e250b672d40a media: rc: fix race between unregister and urb/irq callbacks
814be4a0924b net: skbuff: fix pskb_carve leaking zcopy pages
ab9a10969a90 ipv6: fix possible infinite loop in fib6_select_path()
dc36a04621dc ipv6: fix possible infinite loop in rt6_fill_node()
b62e2b2b4a50 vsock/virtio: bind uarg before filling zerocopy skb
68667ee4c7da sctp: fix race between sctp_wait_for_connect and peeloff
c4152b4e28b3 net: mana: Skip redundant detach on already-detached port
da87896f34e0 net: mana: Add NULL guards in teardown path to prevent panic on attach failure
7f945f7f10f4 gpio: rockchip: teardown bugs and resource leaks
e2fabb984bfd gpio: rockchip: convert bank->clk to devm_clk_get_enabled()
5d43c71fa8e1 gpio: virtuser: Fix uninitialized data bug in gpio_virtuser_direction_do_write()
b6cdbb681ce1 gpio: adnp: fix flow control regression caused by scoped_guard()
ae2eac5e9cfe Bluetooth: hci_sync: Reset device counters in hci_dev_close_sync()
47330cc875b3 Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close
41e29548b5e8 Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp
f39049304ba6 Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success
1d4dcfe60fe1 net/handshake: Pass negative errno through handshake_complete()
25b2fcdea6f6 nvme-tcp: store negative errno in queue->tls_err
0866569fc36a net/handshake: Use spin_lock_bh for hn_lock
c35064294eca net: hibmcge: disable Relaxed Ordering to fix RX packet corruption
7f97b8352ce5 net/sched: Revert "net/sched: Restrict conditions for adding duplicating netems to qdisc tree"
6fe1cb312038 ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()
fd0de51c54fa ethtool: eeprom: add more safeties to EEPROM Netlink fallback
c944cab3df82 ethtool: eeprom: add missing ethnl_ops_begin() / _complete() during fallback
3e656023a649 ethtool: strset: fix header attribute index in ethnl_req_get_phydev()
2008f9bb1ede ethtool: tsinfo: don't pass ERR_PTR to genlmsg_cancel on prepare failure
ab94e0d6664d ethtool: tsinfo: fix uninitialized stats on the by-PHC path
d02342d9bb4f ethtool: tsconfig: fix missing ethnl_ops_complete()
912f8b23bc4b ethtool: pse-pd: fix missing ethnl_ops_complete()
49455e27838a ethtool: linkstate: fix unbalanced ethnl_ops_complete() on PHY lookup error
d11c98484485 ethtool: tsconfig: fix reply error handling
0c02c190bcd9 ethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES
e976e3f2f200 bridge: Fix sleep in atomic context in sysfs path
c9c2e609e839 bridge: Fix sleep in atomic context in netlink path
9ea8a648d912 bonding: refuse to enslave CAN devices
e673889a35a5 Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt()
75cf24709037 drm/xe: Restore IDLEDLY regiter on engine reset
164dcbec9632 ASoC: codecs: simple-mux: Fix enum control bounds check
de9eb0b44fa9 ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE
43368636c663 tunnels: do not assume transport header in iptunnel_pmtud_check_icmp()
5303925e3605 vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()
6dff77899b9e tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmpv6
2a8c9994406b cxl/test: Update mock dev array before calling platform_device_add()
41d2dc766bf8 ethtool: cmis: validate fw->size against start_cmd_payload_size
0696709e951b ethtool: cmis: validate start_cmd_payload_size from module
0cbce444db75 ethtool: cmis: fix u16-to-u8 truncation of msleep_pre_rpl
4d42fb88ec61 ethtool: cmis: require exact CDB reply length
e1dd697094f1 ethtool: module: fix cleanup if socket used for flashing multiple devices
9e70c8efb0ca ethtool: module: check fw_flash_in_progress under rtnl_lock
9f5108f5ee27 ethtool: module: avoid racy updates to dev->ethtool bitfield
61848c83b913 ethtool: module: avoid leaking a netdev ref on module flash errors
d9defbf8b62b ethtool: module: call ethnl_ops_complete() on module flash errors
7877d8fbbec2 ethtool: rss: avoid device context leak on reply-build failure
7ddc3b3ddee8 ethtool: rss: fix hkey leak when indir_size is 0
33d05c22d6f2 ethtool: rss: fix indir_table and hkey leak on get_rxfh failure
39c01c405063 ethtool: rss: fix falsely ignoring indir table updates
6a775ec73210 ethtool: rss: add missing errno on RSS context delete
f23e4d7324b8 ethtool: rss: avoid modifying the RSS context response
48fd840a26d3 net: Avoid checksumming unreadable skb tail on trim
03e9405c518c net: team: fix NULL pointer dereference in team_xmit during mode change
c2af23b48f93 net: team: Rename port_disabled team mode op to port_tx_disabled
a20e6ae5f05e net: team: Remove unused team_mode_op, port_enabled
f2e077e8979f gpio: mxc: fix irq_high handling
fbd0662f9c9a net: hsr: fix potential OOB access in supervision frame handling
2a15a03e58b0 net/mlx5: HWS: Reject unsupported remove-header action
f0ac76e3d55e ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors
e13922bb97b4 ALSA: pcm: oss: Fix setup list UAF on proc write error
a7f4eefb6e14 ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()
475f2b37a78f scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues
981736924338 net/iucv: fix locking in .getsockopt
55cba6b883b4 net/smc: Do not re-initialize smc hashtables
bcd0d19db3e6 net: netlink: don't set nsid on local notifications
ca5e36629641 net: netlink: fix sending unassigned nsid after assigned one
ef3b3ea864d0 vsock: keep poll shutdown state consistent
aa308e9dbb9a tun: free page on build_skb failure in tun_xdp_one()
37a1c268c2c8 tun: free page on short-frame rejection in tun_xdp_one()
96bea2a7baac netfilter: nf_tables: fix dst corruption in same register operation
bf8e8eac7ede netfilter: ebtables: fix OOB read in compat_mtw_from_user
052468b1c93b netfilter: xt_cpu: prefer raw_smp_processor_id
f0fea2b6d545 netfilter: synproxy: refresh tcphdr after skb_ensure_writable
18abd88d19ea accel/rocket: fix UAF via dangling GEM handle in create_bo
45564a16a24f kunit: fix use-after-free in debugfs when using kunit.filter
e1b8a53834dc HID: remove duplicate hid_warn_ratelimited definition
bebc7dc0fb4b tools/bootconfig: Fix buf leaks in apply_xbc
b4702049417f nfc: nxp-nci: i2c: use rising-edge IRQ on ACPI systems
82ac903e0b51 xfrm: Check for underflow in xfrm_state_mtu
650bdd8fdfab nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc()
912ebc49d440 nfc: llcp: Fix use-after-free in llcp_sock_release()
8b733ee4aecd bcache: fix uninitialized closure object
dbc560858da8 net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked
91cc13978ab0 xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit
54ed418de62a net: mctp: ensure our nlmsg responses are initialised
41845bc5bb64 net/sched: cls_fw: fix NULL dereference of "old" filters before change()
0ca809ea8e03 Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size
599f0b059dab Linux 6.18.34-xanmod1
a17ef3eb3ae0 Merge tag 'v6.18.34' into 6.18
18ad16ce4a6b Linux 6.18.34
50bb3435a5e6 security/keys: fix missed RCU read section on lookup
239172639075 drm/msm: Restore second parameter name in purge() and evict()
306ba9d0e5aa LoongArch: kprobes: Fix handling of fatal unrecoverable recursions
a1a39f227c80 ksmbd: fix durable reconnect error path file lifetime
6836f694126e io_uring/nop: pass all errors to userspace
e334cbf3388f net: gro: don't merge zcopy skbs
8129611d4ede pds_core: ensure null-termination for firmware version strings
d1d76bbb6d7a net: airoha: Disable GDM2 forwarding before configuring GDM2 loopback
719007c3492f tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR
fa627a5eaa83 net: mana: validate rx_req_idx to prevent out-of-bounds array access
bc0020490f88 octeontx2-af: npc: Fix allmulticast skip logic for LBK and SDP VFs
76dd50b7888d selftests: net: Fix checksums in xdp_native
04ef7592eaad drm/xe/oa: Fix exec_queue leak on width check in stream open
db86ac6d8daf ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove()
decacc6308c5 gpio: aggregator: lock device when calling device_is_bound()
3e657619cf72 gpio: aggregator: remove the software node when deactivating the aggregator
80d94cf1773a gpio: aggregator: stop using dev-sync-probe
ea28b286649b gpio: aggregator: fix a potential use-after-free
4669f84adcb1 gpio: cdev: check if uAPI v2 config attributes are correctly zeroed
e47f7060eaf6 tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction
1861d369efd6 bpf, skmsg: fix verdict sk_data_ready racing with ktls rx
26f1d4522060 net: ag71xx: check error for platform_get_irq
585f9f6aef5c crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks
2417df5e7bb4 net: shaper: rework the VALID marking (again)
5a2c2aa139c8 net: shaper: annotate the data races
b5bd4249e430 net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA
a0f5268c77eb Bluetooth: btmtk: fix urb->setup_packet leak in error paths
c7860b6a6d2d Bluetooth: btintel_pcie: Fix incorrect MAC access programming
d6c8b3ebdcdb tracing: Avoid NULL return from hist_field_name() on truncation
8bf00d3ac425 cgroup: rstat: relax NMI guard after switch to try_cmpxchg
3aab4a58d23f ALSA: seq: Serialize UMP output teardown with event_input
95c82d498d74 wifi: wilc1000: fix dma_buffer leak on bus acquire failure
55c479aae99b wifi: mac80211: fix MLE defragmentation
2d8379834800 wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs
425d32d6288d erofs: fix managed cache race for unaligned extents
91d13e92b983 pds_core: fix debugfs_lookup dentry leak and error handling
784dd2bdc622 pds_core: fix error handling in pdsc_devcmd_wait
ce23832071af net: airoha: Fix NPU RX DMA descriptor bits
0c277d203684 net: phy: honor eee_disabled_modes in phy_advertise_eee_all()
bd731994cff1 net: phy: honor eee_disabled_modes in phy_support_eee()
a9224862d597 bridge: mcast: Fix a possible use-after-free when removing a bridge port
981aea209977 net: bridge: Flush multicast groups when snooping is disabled
eae62c5451e6 RDMA/rtrs: Fix use-after-free in path file creation cleanup
8c63698737b4 RDMA/mana_ib: Report max_msg_sz in mana_ib_query_port
d5b11e15ee67 ASoC: soc-utils: Add missing va_end in snd_soc_ret()
09deb063eecf platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL
f6dfd64bfd9b platform/x86: intel-hid: Check ACPI_HANDLE() against NULL
ed864a7b881c platform/x86: hp_accel: Check ACPI_COMPANION() against NULL
7ea5aad8d351 platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL
098419a4b062 platform/surface: aggregator_registry: omit battery & AC nodes on Surface Laptop 7
09ec063d87c2 net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer
f71fc35b5e45 net: dsa: mt7530: preserve VLAN tags on trapped link-local frames
89bed786f231 net: dsa: mt7530: fix FDB entries not aging out with short timeout
f1739debda62 kbuild: pacman-pkg: make "rc" releases adhere to pacman versioning scheme
ad8e3d096fa1 drm/i915/dp: Fix readback for target_rr in Adaptive Sync SDP
1f83545f432d igc: set tx buffer type for SMD frames
89964ddb322a ice: ptp: use primary NAC semaphore on E825
0010296879df ice: ptp: serialize E825 PHY timer start with PTP lock
6a01413a4e8f cgroup/rstat: validate cpu before css_rstat_cpu() access
83b8a0f72ecc drm/mediatek: mtk_hdmi_ddc: Fix non-static global variable
8ea34da68964 drm/mediatek: mtk_cec: Fix non-static global variable
926a08cf19be wifi: ath11k: fix peer resolution on rx path when peer_id=0
6c9e9272bc37 drm/xe/pf: Fix CFI failure in debugfs access
dc26e00860a1 drm/xe/vf: Fix signature of print functions
2c890e71ae26 drm/xe/gsc: Fix double-free of managed BO in error path
181e67bc11c5 dma-mapping: move dma_map_resource() sanity check into debug code
3a74aaad0473 wifi: iwlwifi: mld: don't dereference a pointer before NULL checking it
9e360e610a73 wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled
bed1fc32e0eb hwmon: (lm90) Add lock protection to lm90_alert
c98107817b0f hwmon: (lm90) Stop work before releasing hwmon device
cdd1aaf0ee96 drm/msm/snapshot: fix dumping of the unaligned regions
0c9e4d9484cc ALSA: hda/realtek: Use ALC287_FIXUP_TXNW2781_I2C for ASUS Strix Gxx5
df19b6af1716 netfilter: nft_inner: release local_lock before re-enabling softirqs
0fa225896f4b spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache()
fecfed41da73 ASoC: amd: acp-sdw-legacy: check CPU DAI name before logging
7e91d3a1a98a btrfs: fix squota accounting during enable generation
ca56ffdb017b btrfs: check for subvolume before deleting squota qgroup
b422609291f6 btrfs: relax squota parent qgroup deletion rule
22d558df51d9 btrfs: check squota parent usage on membership change
a1296bb9f44a btrfs: remaining BTRFS_PATH_AUTO_FREE conversions
76ad957a72c7 btrfs: don't search back for dir inode item in INO_LOOKUP_USER
16141bef6fb1 btrfs: use the key format macros when printing keys
35f69e993d00 btrfs: add macros to facilitate printing of keys
76b995bc57bd vsock/virtio: fix zerocopy completion for multi-skb sends
782693eb53f8 io_uring/net: punt IORING_OP_BIND async if it needs file create
c53cac053d62 ALSA: scarlett2: Add missing error check when initialise Autogain Status
1ddf678bb75b ASoC: codecs: fs210x: fix possible buffer overflow
36de63965464 scsi: sd: Fix return code handling in sd_spinup_disk()
b4dc0056397f net/mlx5: Do not restore destination-less TC rules
81c8a9f75a42 tls: Preserve sk_err across recvmsg() when data has been copied
1370acb8bc39 ovpn: disable BHs when updating device stats
f7808b7ddcf2 x86/xen: Fix xen_e820_swap_entry_with_ram()
2378d25675da gcc-plugins: Always define CONST_CAST_GIMPLE and CONST_CAST_TREE
097d62df3831 ovpn: fix race between deleting interface and adding new peer
8298834912d7 ovpn: respect peer refcount in CMD_NEW_PEER error path
e5460eb7238c ovpn: tcp - use cached peer pointer in ovpn_tcp_close()
2bc34520ce5c net: phy: DP83TC811: add reading of abilities
af855f4c966a net: tls: prevent chain-after-chain in plain text SG
eca989eab4b2 net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring
afa9036b8c99 net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot
6dcd072a5ae3 powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise()
f4e37f3df436 drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN
eea43d5ed450 drm/msm/adreno: fix userspace-triggered crash on a2xx-a4xx
3a7b59d2385d Documentation: intel_pstate: Fix description of asymmetric packing with SMT
3ad2d8be6e4d x86/mce: Restore MCA polling interval halving
15dba511d569 selftests: ublk: cap nthreads to kernel's actual nr_hw_queues
ff58e5ef1b46 drm/msm/dpu: don't mix devm and drmm functions
a184aec79013 drm/msm/dsi: don't dump registers past the mapped region
d235f8f7b264 ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics
d2ea0b8aef87 net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint
97a8e89cdef3 accel/qaic: Add overflow check to remap_pfn_range during mmap
76410790f149 block: bio-integrity: Fix null-ptr-deref in bio_integrity_map_user()
086695145000 HID: quirks: really enable the intended work around for appledisplay
0943f81e1b31 block: recompute nr_integrity_segments in blk_insert_cloned_request
0d48654af4d1 block: don't overwrite bip_vcnt in bio_integrity_copy_user()
a52486394493 net: shaper: reject QUEUE scope handle with missing id
77ec90d41c59 net: shaper: enforce singleton NETDEV scope with id 0
d7c2bbbaa2c4 net: shaper: fix undersized reply skb allocation in GROUP command
f817ce8d1943 net: shaper: set ret to -ENOMEM when genlmsg_new() fails in group_doit
5098b223f0f0 net: shaper: reject duplicate leaves in GROUP request
d6128451c591 net: shaper: fix trivial ordering issue in net_shaper_commit()
d947e6685ff4 net: shaper: flip the polarity of the valid flag
e1b429d8e712 wifi: ath10k: skip WMI and beacon transmission when device is wedged
d94127d04017 wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm()
acde4692afcd wifi: ath11k: fix error path leaks in some WMI WOW calls
9bc70fe995da net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS reference
c373b34877af net: ethernet: cortina: Carry over frag counter
3cd05250a2df net: ethernet: cortina: Drop half-assembled SKB
cfd62907f3cd net: ethernet: cortina: Make RX SKB per-port
77bb293049d6 netfs, afs: Fix write skipping in dir/link writepages
f17b9121bb99 netfs: Fix netfs_read_folio() to wait on writeback
551b5c71ee31 netfs: Fix folio->private handling in netfs_perform_write()
3d9601c029b9 netfs: Fix partial invalidation of streaming-write folio
6080fa3ecfbb netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages()
22ae28aae436 netfs: Fix leak of request in netfs_write_begin() error handling
d4f4bc87c765 netfs: Fix early put of sink folio in netfs_read_gaps()
616578e40dcb netfs: Fix write streaming disablement if fd open O_RDWR
0b18cd70ebab netfs: Fix read-gaps to remove netfs_folio from filled folio
003aa0dd26c9 netfs: Fix potential deadlock in write-through mode
ef9b521212e4 netfs: Fix streaming write being overwritten
185ded4112cd netfs: Defer the emission of trace_netfs_folio()
fb6ec883b48b netfs: Fix netfs_invalidate_folio() to clear dirty bit if all changes gone
afeb32d9bf9a netfs: Fix overrun check in netfs_extract_user_iter()
b63971238beb netfs: fix VM_BUG_ON_FOLIO() issue in netfs_write_begin() call
884c4c4f35e5 netfs: Fix netfs_read_to_pagecache() to pause on subreq failure
5366199be46f netfs: Fix cancellation of a DIO and single read subrequests
9c6f23cf3a07 powerpc: fix dead default for GUEST_STATE_BUFFER_TEST
822bb1614ec4 powerpc: 82xx: fix uninitialized pointers with free attribute
aed60070ed7b ASoC: SOF: amd: Fix error code handling in psp_send_cmd()
510db031ba6e tcp: Fix out-of-bounds access for twsk in tcp_ao_established_key().
eba8af785fde zonefs: handle integer overflow in zonefs_fname_to_fno
9525e3a6fbb1 nvme-pci: fix use-after-free in nvme_free_host_mem()
fea4b46f84c5 nvme: fix bio leak on mapping failure
18c0456ea261 irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT
06ee55f78fbe nsfs: fix wrong error code returned for pidns ioctls
d168a71fc1d6 ublk: reject max_sectors smaller than PAGE_SECTORS in parameter validation
617a2564d863 irqchip/ath79-cpu: Remove unused function
ace6b3e033c6 fs: Fix return in jfs_mkdir and orangefs_mkdir
e37ea2c6f17f fs/statmount: fix slab out-of-bounds write in statmount_mnt_idmap
56b4cfcf1518 fprobe: Fix unregister_fprobe() to wait for RCU grace period
36dc0cea30db ASoC: sdw_utils: Add quirk to ignore RT721 CODEC_MIC
5afefecfe054 ASoC: sdw_utils: Add quirk to ignore RT712 CODEC_MIC
fe59ae27d734 NFSD: Fix infinite loop in layout state revocation
e9405f704127 phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access
994358adc098 net: ti: icssm-prueth: fix eth_ports_node leak in probe
7df3e1dfee53 net: lan966x: avoid unregistering netdev on register failure
d91a9a049698 ice: fix locking in ice_dcb_rebuild()
34ad3c782644 ice: fix setting RSS VSI hash for E830
eb5991d4c8ba idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init()
a248793f00ab net: shaper: Reject reparenting of existing nodes
bfe08fe5624b net: napi: Avoid gro timer misfiring at end of busypoll
77e7818eb347 tcp: Fix imbalanced icsk_accept_queue count.
1c24cf1fd67f test_kprobes: clear kprobes between test runs
ae8a5c6b0316 kprobes: skip non-symbol addresses in kprobe_add_ksym_blacklist()
c647e2a21bbb netfilter: bridge: eb_tables: close module init race
524b6337277a netfilter: x_tables: close dangling table module init race
cc989ef1c044 netfilter: ebtables: close dangling table module init race
739d5dac7b2d netfilter: ebtables: move to two-stage removal scheme
86ee5bc9c0f0 netfilter: x_tables: add and use xtables_unregister_table_exit
89ebafe7910d netfilter: x_tables: add and use xt_unregister_table_pre_exit
a9b2f73f6ba7 netfilter: x_tables: unregister the templates first
c32a7e0e3c73 btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file()
373f65b448ed ALSA: hda: cs35l41: Put ACPI device on missing physical node
fecae8b1fb2d ALSA: hda: cs35l56: Put ACPI device after setting companion
e984dc22e2c2 ARM: integrator: Fix early initialization
9e472874c954 firmware: arm_ffa: Fix sched-recv callback partition lookup
d1e38551fade firmware: arm_ffa: Snapshot notifier callbacks under lock
419cef661ae8 firmware: arm_ffa: Align RxTx buffer size before mapping
3c51d99449dc firmware: arm_ffa: Validate framework notification message layout
0a5dbac5ef53 firmware: arm_ffa: Keep framework RX release under lock
f39bc7ebe75e firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies
fd2b01637e56 pinctrl: qcom: Fix wakeirq map by removing disconnected irqs for sm8150
3f4d82780001 kunit: config: KUNIT_DEBUGFS should depend on DEBUG_FS
91e4446b35f6 kunit: config: Enable KUNIT_DEBUGFS by default
96b8b9d0dead riscv: mm: Fixup no5lvl failure when vaddr is invalid
f3216d930c0f riscv: errata: Fix bitwise vs logical AND in MIPS errata patching
1aa01b46fe3b firmware: arm_ffa: Unregister bus notifier on teardown for FF-A v1.0
07907b897bb7 firmware: arm_ffa: Fix per-vcpu self notifications handling in workqueue
1418765d28ab firmware: arm_ffa: Skip free_pages on RX buffer alloc failure
820245d86ce5 firmware: arm_ffa: Check for NULL FF-A ID table while driver registration
4894847fcec1 HID: uclogic: Fix regression of input name assignment
e912d5dc0096 HID: intel-thc-hid: Intel-quickspi: Fix some error codes
1fce9dcb3a66 pinctrl: qcom: Fix GPIO to PDC wake irq map for qcs615
e917713f0134 pinctrl: meson: amlogic-a4: fix deadlock issue
8d1c6b603327 pinctrl: renesas: rzg2l: Fix SMT register cache handling
c4cfa8ee7737 pinctrl: renesas: rzg2l: Fix incorrect PUPD register offset for high pins during suspend/resume
a7fee1322683 ARM: dts: renesas: rskrza1: Drop superfluous cells
d27b29e474a6 ARM: dts: renesas: genmai: Drop superfluous cells
00aca89f5e34 pinctrl: qcom: ipq4019: mark gpio as a GPIO pin function
eb3cd9bb5904 hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors
dd12c6dbe2ac hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe()
a203125c0e81 hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe()
b2998ae90331 hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in get_multiple
fa7ca363069a hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR
97a9cf2a8217 hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer
2279c342d94e hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer
75c862adf3d3 hwmon: (pmbus/adm1266) reject implausible blackbox record_count
e9b8f85daebf hwmon: (pmbus/adm1266) seed timestamp from the real-time clock
e37dbe150515 batman-adv: tt: prevent TVLV entry number overflow
730de8733dd9 batman-adv: tt: fix negative tt_buff_len
179eb62506a0 batman-adv: tt: fix negative last_changeset_len
b93ca6012712 batman-adv: tt: avoid empty VLAN responses
7cac9c9ef4b7 batman-adv: tt: reject oversized local TVLV buffers
4cc85aec8d3c batman-adv: tt: fix TOCTOU race for reported vlans
2d2d365d0b9d batman-adv: tp_meter: avoid role confusion in tp_list
72d670d7a492 batman-adv: tp_meter: fix race condition in send error reporting
b285bc0a97f4 batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown
770bf0a35f06 batman-adv: tp_meter: directly shut down timer on cleanup
dc2ae5fbd2da batman-adv: tp_meter: avoid use of uninit sender vars
6921a7683ae9 batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface
45384612f296 batman-adv: bla: avoid double decrement of bla.num_requests
c6de1a5a9c40 batman-adv: bla: fix report_work leak on backbone_gw purge
5895ad21c705 batman-adv: frag: disallow unicast fragment in fragment
90ae3eae06b7 batman-adv: fix tp_meter counter underflow during shutdown
3eb8bcb82339 batman-adv: fix fragment reassembly length accounting
9cceea8eeba7 batman-adv: dat: handle forward allocation error
ae7aeb0ce3c0 batman-adv: clear current gateway during teardown
8a3707653ab6 batman-adv: mcast: fix use-after-free in orig_node RCU release
ca3ff3d2a0af batman-adv: iv: recover OGM scheduling after forward packet error
ede47988ac56 batman-adv: tvlv: reject oversized TVLV packets
23d4ce84df4d batman-adv: tvlv: abort OGM send on tvlv append failure
1be1e99cbd5b batman-adv: v: stop OGMv2 on disabled interface
1ecde19bfce6 drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async
7ca695b31222 drm/amd/display: Validate GPIO pin LUT table size before iterating
6bbd703ea1c1 drm/amd/display: Fix integer overflow in bios_get_image()
d35563813296 drm/bridge: megachips: remove bridge when irq request fails
95306db11956 drm/bridge: it66121: acquire reset GPIO in probe
3ed448c1dc78 drm/amdgpu/vpe: Force collaborate sync after TRAP
8fadd01cf461 drm/virtio: use uninterruptible resv lock for plane updates
35671087a272 drm/v3d: Release indirect CSD GEM reference on CPU job free
0f8efc45740b drm/v3d: Fix use-after-free of CPU job query arrays on error path
942968260e61 drm/msm: Fix shrinker deadlock
508fd8ab158a device property: set fwnode->secondary to NULL in fwnode_init()
22d9b9739b8e LoongArch: Remove unused code to avoid build warning
f27a3b9aadfb LoongArch: kprobes: Use larch_insn_text_copy() to patch instructions
9e3f18883a98 fwctl: pds: Validate RPC input size before parsing
1012896f4225 RDMA/siw: Reject MPA FPDU length underflow before signed receive math
d7a076fb596c spi: ti-qspi: fix use-after-free after DMA setup failure
be409d2bbe9c spi: sprd: fix error pointer deref after DMA setup failure
8e027db9fa31 spi: ep93xx: fix error pointer deref after DMA setup failure
b9ff86310062 scsi: isci: Fix use-after-free in device removal path
78a369a065f1 phy: qcom-qmp-ufs: Fix kaanapali PHY PLL lock failure after SM8650 G4 fix
58f4a7bd8d73 phy: tegra: xusb: Fix per-pad high-speed termination calibration
a1f50f5aaa69 phy: exynos5-usbdrd: fix USB 2.0 HS PHY tuning values for Exynos7870
4bb4764f2c51 spi: qup: fix error pointer deref after DMA setup failure
ecdf21536c6d drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe
bee400ad4f42 virt: sev-guest: Explicitly leak pages in unknown state
4f087193b5ff riscv: kvm: return SBI_ERR_FAILURE for pmu_event_info() when OOM
77071943c752 riscv: kvm: return SBI_ERR_FAILURE for pmu_snapshot_set_shmem() when OOM
94ade38f317e KVM: SVM: Disable AVIC IPI virtualization on Hygon Family 18h (erratum #1235)
7023900b4988 KVM: arm64: vgic: Free private_irqs when init fails after allocation
0680f5119265 KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits
240373425e2d arm64: probes: Handle probes on hinted conditional branch instructions
798183376d9d tracing: Do not call map->ops->elt_free() if elt_alloc() fails
5e7d9d0805e5 cifs: Fix busy dentry used after unmounting
2dd9304727c7 wifi: mac80211: consume only present negotiated TTLM maps
acdff9907478 af_unix: Fix UAF read of tail->len in unix_stream_data_wait()
6cfae4914439 wifi: cfg80211: advance loop vars in cfg80211_merge_profile()
50884c2afd7a ice: restore PTP Rx timestamp config after ethtool set-channels
0b9431b972a0 ice: fix setting promisc mode while adding VID filter
9c9d00d81b41 ice: fix locking around wait_event_interruptible_locked_irq
f1bafd35f11b igc: fix potential skb leak in igc_fpe_xmit_smd_frame()
8864b664d044 octeontx2-pf: fix double free in rvu_rep_rsrc_init()
47a4cf2229be octeontx2-af: CGX: add bounds check to cgx_speed_mbps index
5b906f31e977 lsm: hold cred_guard_mutex for lsm_set_self_attr()
9dcd4f5c99b4 rbd: eliminate a race in lock_dwork draining on unmap
dfef79e09ed2 ixgbevf: fix use-after-free in VEPA multicast source pruning
7725cd3b4717 ipv4: raw: reject IP_HDRINCL packets with ihl < 5
dc31c6947652 wifi: iwlwifi: mld: stop TX during firmware restart
6fe92651b44f wifi: iwlwifi: mvm: fix driver-set TX rates on old devices
614cacec60fe wifi: ath11k: clear shared SRNG pointer state on restart
a3529032afe2 ice: fix VF queue configuration with low MTU values
c618cf8926c0 vsock/virtio: reset connection on receiving queue overflow
440447699c68 vsock/vmci: fix UAF when peer resets connection during handshake
29b643351012 mptcp: pm: fix ADD_ADDR timer infinite retry on option space insufficient
abdd03229414 ipv6: ioam: add NULL check for idev in ipv6_hop_ioam()
2bc60c175568 ring-buffer: Flush and stop persistent ring buffer on panic
610ff6bc2f44 ring-buffer: Fix reporting of missed events in iterator
0e47fc1c9181 qed: fix double free in qed_cxt_tables_alloc()
e0c3dd7b30cc l2tp: use list_del_rcu in l2tp_session_unhash
d73dcd1520d6 fs/ntfs3: handle attr_set_size() errors when truncating files
358692462555 net: ethtool: phy: avoid NULL deref when PHY driver is unbound
61f53c1e58d6 net: ethtool: fix NULL pointer dereference in phy_reply_size
752ea4a105e6 cgroup/cpuset: Reset DL migration state on can_attach() failure
1aed73795392 tracing/fprobe: Check the same type fprobe on table as the unregistered one
f0ad68d2f0ad tracing/fprobe: Avoid kcalloc() in rcu_read_lock section
bb92f356d2b7 tracing: fprobe: use ftrace if CONFIG_DYNAMIC_FTRACE_WITH_ARGS
52cc572c9565 tracing: fprobe: Remove unused local variable
45c7c4e3db8b sched_ext: Avoid UAF in scx_root_enable_workfn() init failure path
6e73ec10b2a3 sched_ext: Fix missing warning in scx_set_task_state() default case
689bbf48c1f4 netfilter: nft_inner: Fix IPv6 inner_thoff desync
952e988163c2 netfilter: ipset: stop hash:* range iteration at end
15d464265120 netfilter: nf_queue: hold bridge skb->dev while queued
57b0ac5e1b46 netfilter: ip6t_hbh: reject oversized option lists
dac025c4e8f9 net: pse-pd: fix sign on -ENOENT check in of_load_pse_pis()
f8a5a76b4a68 net: ifb: report ethtool stats over num_tx_queues
1604a2d68414 net/mlx5e: Fix use-after-free in mlx5e_tx_reporter_timeout_recover
49eff79967fd net: phy: skip EEE advertisement write when autoneg is disabled
3d4ef05266ab net: bcmgenet: keep RBUF EEE/PM disabled
84bc87beb4cd phonet/pep: disable BH around forwarded sk_receive_skb()
8b4c412e001b Bluetooth: serialize accept_q access
f1febe93ef07 Bluetooth: MGMT: validate Add Extended Advertising Data length
051922ab709c Bluetooth: L2CAP: ecred_reconfigure: send packed pdu, not stack pointer
192cb0f1ca70 Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths
5506aec79513 Bluetooth: bnep: Fix UAF read of dev->name
61f2410a96de Bluetooth: ISO: drop ISO_END frames received without prior ISO_START
added1213395 Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del()
ffb6dbb49c96 net: wwan: iosm: fix potential memory leaks in ipc_imem_init()
0fa24311bd42 selftests/mm: run_vmtests.sh: fix destructive tests invocation
738d18f1da35 mm/page_alloc: fix initialization of tags of the huge zero folio with init_on_free
09ce923071e7 mm/memory_hotplug: fix memory block reference leak on remove
62153767e8fc mm: fix __vm_normal_page() to handle missing support for pmd_special()/pud_special()
2fff0cdd9422 mm/memory: fix spurious warning when unmapping device-private/exclusive pages
24de676da63c ipv6: ioam: refresh hdr pointer before ioam6_event()
24840b3139d7 drivers/base/memory: fix memory block reference leak in poison accounting
b737c6612c60 io_uring/waitid: clear waitid info before copying it to userspace
5fb947ddae55 spi: amd: Set correct bus number in ACPI probe path
c32a1fbe0f9a efi: Allocate runtime workqueue before ACPI init
fcbd0a5fd812 ALSA: scarlett2: Allow flash writes ending at segment boundary
61c5017c64e2 ALSA: asihpi: Fix potential OOB array access at reading cache
feff0251386a ALSA: pcm: Don't setup bogus iov_iter for silencing
cba8dab72e9b ALSA: ua101: Reject too-short USB descriptors
ca560f7566df hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX
9803e75c9813 smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close
d65104a4a815 smb: client: use data_len for SMB2 READ encrypted folioq copy
bf4ebdb19ff9 smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked()
a8d17d22db59 smb: client: require net admin for CIFS SWN netlink
6827647fd2dc regulator: tps65219: fix irq_data.rdev not being assigned
18d8db24b0a5 ksmbd: validate SID in parent security descriptor during ACL inheritance
0e198f09cb2a ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow
cd5c1b75d2f4 ksmbd: fix null pointer dereference in compare_guid_key()
302e02f9ba49 mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break()
48fa96538bd2 sysfs: don't remove existing directory on update failure
141ffb83abe9 drm/vblank: Fix kernel docs for vblank timer
ed39ecd3a96c drm/atomic: Increase timeout in drm_atomic_helper_wait_for_vblanks()
a0582cc92398 drm/vkms: Convert to DRM's vblank timer
60918357456d drm/vblank: Add CRTC helpers for simple use cases
fa4b91eea433 drm/vblank: Add vblank timer
18a08b87db71 Revert "ice: Remove jumbo_remove step from TX path"
523cd0ea0324 Revert "ice: fix double-free of tx_buf skb"
515de0a3b6c1 ata: libata-scsi: do not needlessly defer commands when using PMP with FBS
4e6eada8de38 ata: libata-scsi: do not use the deferred QC feature on PMPs with CBS
f207ebd5656e ata: libata-scsi: do not use the deferred QC feature for ATA_DEFER_PORT
62ee00c1042c ata: libata-scsi: improve readability of ata_scsi_qc_issue()
9d11e4b1db1c mfd: bcm2835-pm: Add support for BCM2712
ed915823d469 arm64: dts: broadcom: bcm2712: Add watchdog DT node
375d5a17dc8d dt-bindings: soc: bcm: Add bcm2712 compatible
91f89c1d83e8 smb: client: reject userspace cifs.spnego descriptions
5da69a65b282 ksmbd: close durable scavenger races against m_fp_list lookups
aae4a47073b1 spi: spi-dw-dma: fix print error log when wait finish transaction
e8ec80430bfa bridge: mrp: reject zero test interval to avoid OOM panic
0638bf16b7a7 sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting
3f0543bdf446 sched: Employ sched_change guards
dc184ac2f0ba cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed()
da3d241c5b92 fuse: fix uninit-value in fuse_dentry_revalidate()
488d2c76bd9f iommu/amd: Remove latent out-of-bounds access in IOMMU debugfs
b9a4184271b9 iommu/amd: Fix illegal cap/mmio access in IOMMU debugfs
814326e86e92 drm/xe/hdcp: Add NULL check for media_gt in intel_hdcp_gsc_check_status()
e469a636f608 Linux 6.18.33-xanmod1
b1dc0d89228b tcp_bbr: v3: update TCP 'bbr' congestion control module to BBRv3 [v6.18.33+]
bddb6a8ebea6 Merge tag 'v6.18.33' into 6.18
ac95f57c40f3 Revert "tcp_bbr: v3: update TCP 'bbr' congestion control module to BBRv3 [v6.18.14+]"
83657f418961 Linux 6.18.33
664736cc1f95 netfs: Fix potential uninitialised var in netfs_extract_user_iter()
e9a23ec9461e selftests/bpf: Remove test_access_variable_array
ff375cc75f91 net: skbuff: propagate shared-frag marker through frag-transfer helpers
3bd9e113d500 net: skbuff: preserve shared-frag marker during coalescing
640e37f58f99 net/rds: reset op_nents when zerocopy page pin fails
6bf4253af814 spi: sifive: fix controller deregistration
27fcf3dd04df spi: sifive: Simplify clock handling with devm_clk_get_enabled()
fac9cfad2f90 f2fs: fix false alarm of lockdep on cp_global_sem lock
a4a0340d20ab sched_ext: Pass held rq to SCX_CALL_OP() for core_sched_before
255c3998dae8 sched_ext: Guard scx_dsq_move() against NULL kit->dsq after failed iter_new
a3c44e77f379 perf/x86/intel: Disable PMI for self-reloaded ACR events
b6437e6f8f3d btrfs: do not mark inode incompressible after inline attempt fails
2647b8fe2f1f smb: client: Use FullSessionKey for AES-256 encryption key derivation
244575d0c695 eventfs: Use list_add_tail_rcu() for SRCU-protected children list
4fa42a249e8c drm/v3d: Reject empty multisync extension to prevent infinite loop
4e003e2fb6d3 drm/gma500/oaktrail_lvds: fix i2c adapter leaks on init
ab9256936b58 drm/gma500/oaktrail_lvds: fix hang on init failure
6d835a99474c drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup
9a34b94832c3 drm/ttm: Convert -EAGAIN from dmem_cgroup_try_charge to -ENOSPC
39fdac6be02e drm/xe/dma-buf: fix UAF with retry loop
20a99ea1e2fd drm/xe/dma-buf: handle empty bo and UAF races
c76273c3eba9 drm/panfrost: Fix wait_bo ioctl leaking positive return from dma_resv_wait_timeout()
65a3a1cf29eb drm/i915: skip __i915_request_skip() for already signaled requests
9022cb9ac0c2 iommu/vt-d: Avoid NULL pointer dereference or refcount corruption
88397fad7914 iommu/vt-d: Fix oops due to out of scope access
637b7ce89e54 iommu/vt-d: Disable DMAR for Intel Q35 IGFX
4d2b37abda95 libceph: handle rbtree insertion error in decode_choose_args()
0f3604cbe4df libceph: Fix potential out-of-bounds access in crush_decode()
f2f95e6d4b97 libceph: Fix potential null-ptr-deref in decode_choose_args()
48df98d12b15 libceph: Fix potential out-of-bounds access in osdmap_decode()
0de5cb2d61d0 irqchip/gic-v5: Allocate ITS parent LPIs as a range
2cbd4abe413e irqchip/gic-v5: Support range allocation for LPIs
e6550b17cc0e irqchip/gic-v5: Move LPI allocation into the LPI domain
84ff9ae64d9b irqchip/meson-gpio: Use the correct register in meson_s4_gpio_irq_set_type()
5b0756b6b757 irqchip/riscv-imsic: Clear interrupt move state during CPU offlining
42558732af4a nfsd: fix file change detection in CB_GETATTR
fc6db1e47c55 netfs: fix error handling in netfs_extract_user_iter()
1a78bea6a5e9 powerpc/warp: Fix error handling in pika_dtm_thread
3f6fb0211b39 virt: sev-guest: Do not use host-controlled page order in cleanup path
690b7ca1f9b3 xfs: fix memory leak on error in xfs_alloc_zone_info()
b0bd7a850e1f x86/kexec: Push kjump return address even for non-kjump kexec
f0a0f01787ec iommu/amd: Bounds-check devid in __rlookup_amd_iommu()
252c5051dba9 io-wq: check that the predecessor is hashed in io_wq_remove_pending()
d5bd8b4e39cf ceph: fix BUG_ON in __ceph_build_xattrs_blob() due to stale blob size
3fa13ceefbc5 ceph: fix a buffer leak in __ceph_setxattr()
9ebb7eba1237 btrfs: only release the dirty pages io tree after successful writes
d7b2de5d9862 ALSA: usb-audio: qcom: Check offload mapping failures
09141583bd97 ALSA: usb-audio: Bound MIDI endpoint descriptor scans
f9c184a83574 ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans
651760f57fe0 ALSA: hda/realtek: Add quirk for Samsung Galaxy Book5 360 headphone
a424946e00f2 ALSA: hda/realtek: Add mute LED quirk for HP Pavilion Laptop 16-ag0xxx
d3e03c25d520 accel/rocket: Fix prep_bo ioctl leaking positive return from dma_resv_wait_timeout()
9b718ebe0e97 platform/x86: lenovo-wmi-other: Fix tunable_attr_01 struct members
b6c0f545c8f9 platform/x86: lenovo-wmi-helpers: Move gamezone enums to wmi-helpers
1b2dca1f9b5a platform/x86: intel: Move debugfs register before creating devices
d25b863e2dff drm/i915/dp: Fix VSC dynamic range signaling for RGB formats
318b995cffcf drm: Replace old pointer to new idr
d31c6b334215 drm/loongson: Use managed KMS polling
97a05b0ae9ea smb/client: fix possible infinite loop and oob read in symlink_data()
0ea9d6e036be nvme-apple: Reset q->sq_tail during queue init
527cb4a55155 Bluetooth: btmtk: accept too short WMT FUNC_CTRL events
151cfe527f0a media: staging: imx: configure src_mux in csi_start
7c96f2e5b6fb ata: libata-scsi: fix requeue of deferred ATA PASS-THROUGH commands
d92229dfa3f9 fuse: avoid 0x10 fault in fuse_readahead when max_pages == 0
3ab135238832 HID: core: Fix size_t specifier in hid_report_raw_event()
301338b8edad HID: core: introduce hid_safe_input_report()
509c26050650 HID: pass the buffer size to hid_report_raw_event
8adc988e9f20 KVM: x86: Fix Xen hypercall tracepoint argument assignment
b22a2da8792a KVM: s390: pci: fix GAIT table indexing due to double-scaling pointer arithmetic
0d419c23bb11 KVM: Reject wrapped offset in kvm_reset_dirty_gfn()
d9017d233258 audit: enforce AUDIT_LOCKED for AUDIT_TRIM and AUDIT_MAKE_EQUIV
e029cbd8c06d net: atlantic: preserve PCI wake-from-D3 on shutdown when WOL enabled
1dced0725e2f netfilter: nft_ct: fix missing expect put in obj eval
a9f76de38ba3 Revert "ACPI: CPPC: Adjust debug messages in amd_set_max_freq_ratio() to warn"
722b91d5086a idpf: fix double free and use-after-free in aux device error paths
c4a8998aafb8 cgroup/dmem: Return -ENOMEM on failed pool preallocation
bddf59818ae5 net: ena: PHC: Check return code before setting timestamp output
e35f3550c5b4 audit: fix incorrect inheritable capability in CAPSET records
430b05f6c918 netfilter: nf_conntrack_sip: get helper before allocating expectation
95e8ae9af2a6 net: ena: PHC: Fix potential use-after-free in get_timestamp
10addc25fa17 workqueue: Fix wq->cpu_pwq leak in alloc_and_link_pwqs() WQ_UNBOUND path
f43240068791 i40e: Cleanup PTP pins on probe failure
a1c5672faf8e crypto: af_alg - Cap AEAD AD length to 0x80000000
b4e1c03b876c sched/fair: Revert force wakeup preemption
ec4f6da3373d sched/fair: Fix wakeup_preempt_fair() for not waking up task
ce8ac8432fd7 net: mana: Init gf_stats_work before potential error paths in probe
45d6c6c10b8b net: mana: Fix use-after-free in reset service rescan path
80c025618524 net: airoha: Fix VIP configuration for AN7583 SoC
81a2a3607866 net: airoha: Use gdm port enum value whenever possible
106581064439 net: airoha: Remove code duplication in airoha_regs.h
db9af8a2efad net/sched: sch_pie: annotate more data-races in pie_dump_stats()
90619fdedfb9 net: airoha: Move ndesc initialization at end of airoha_qdma_init_tx()
7645ead02939 net: airoha: Move entries to queue head in case of DMA mapping failure in airoha_dev_xmit()
95fdee73c39c rtla: Fix parse_cpu_set() bug introduced by strtoi()
26b4ea23f511 net: airoha: Fix a copy and paste bug in probe()
dbbd60129f79 bpf: Fix sync_linked_regs regarding BPF_ADD_CONST32 zext propagation
22f72b1dccfe PCI: Initialize temporary device in new_id_store()
735439394dde Revert "papr-hvpipe: convert papr_hvpipe_dev_create_handle() to FD_PREPARE()"
d66dc9505935 Revert "pseries/papr-hvpipe: Fix race with interrupt handler"
1dcd36420af2 futex: Drop CLONE_THREAD requirement for private default hash alloc
dcb89deed40b arm64: Reserve an extra page for early kernel mapping
b9d854388988 kselftest/arm64: Include <asm/ptrace.h> for user_gcs definition
5704a90c0970 net/sched: cls_flower: revert unintended changes
3f4a3f740c23 sfc: fix error code in efx_devlink_info_running_versions()
9c54e76f8d6e net: tls: fix strparser anchor skb leak on offload RX setup failure
f5c5692a61f7 ice: add dpll peer notification for paired SMA and U.FL pins
f5f1b59bdb12 dpll: export __dpll_pin_change_ntf() for use under dpll_lock
47e53940451c dpll: Add notifier chain for dpll events
8bcfd78bbc32 dpll: Allow associating dpll pin with a firmware node
a723643ee055 ice: fix missing dpll notifications for SW pins
3b3aab57e33f ice: fix SMA and U.FL pin state changes affecting paired pin
0c56810ce1ba ice: fix missing SMA pin initialization in DPLL subsystem
c3cad2ae8088 ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw
1e9185b13ce5 ice: fix NULL pointer dereference in ice_reset_all_vfs()
b166453d8d01 iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler
e469b1ff3319 iavf: wait for PF confirmation before removing VLAN filters
b0173c36977c iavf: stop removing VLAN filters from PF on interface down
033fa40dff77 iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING
864577384d72 page_pool: fix memory-provider leak in page_pool_create_percpu() error path
c169c5837525 bonding: 3ad: implement proper RCU rules for port->aggregator
f2edb41645bf bonding: print churn state via netlink
c1e0b5eccdf0 net: airoha: Do not return err in ndo_stop() callback
aaad53a55812 net: airoha: fix BQL imbalance in TX path
d1469eb93af7 drm/xe/gsc: Fix BO leak on error in query_compatibility_version()
bebce43f34b5 drm/xe/eustall: Fix drm_dev_put called before stream disable in close
753b149d5a43 drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl()
2d8656c27ff6 drm/xe/debugfs: Correct printing of register whitelist ranges
8b85ffe52052 drm/amd/display: Read EDID from VBIOS embedded panel info
07822f1d9bdb drm/amd/display: Allow constructing DCE8 link encoder without DDC
e0f874f209d4 drm/amd/display: Allow constructing DCE6 link encoder without DDC
9b84d67ce8c9 drm/amd/display: Allow DCE link encoder without AUX registers
69a7cfc66405 futex: Prevent lockup in requeue-PI during signal/ timeout wakeup
24c22c644ea5 ALSA: hda/tas2781: Fix incorrect bit update for non-book-zero or book 0 pages >1
7e6f7ac79abe ALSA: hda: cs35l56: Fix uninitialized value in cs35l56_hda_read_acpi()
f837c7b85143 ALSA: hda/conexant: Fix missing error check for jack detection
47984e9db9ca netconsole: propagate device name truncation in dev_name_store()
b19a6804d498 net/sched: sch_cake: annotate data-races in cake_dump_stats() (V)
cd0401593b2d net/sched: sch_cake: annotate data-races in cake_dump_stats() (III)
74a02921c48f bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst()

…

View originalPermalink

6.18.38-xanmod1

Jul 4, 2026 · 28 days ago

Fixed 20

AppArmor: advertise the TCP fast open fix is applied
Fix use-after-free of key in TCP-AO del_async path
Serial 8250_dw: unregister 8250 port if clk_notifier_register() fails
ksmbd: fix out-of-bounds read in smb_check_perm_dacl()
NFS: prevent resource leak in nfs_alloc_server()
NFSv4: clear exception state on successful mkdir retry
NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr
NFSv4/flexfiles: reject zero filehandle version count
nfsd: reset write verifier on deferred writeback errors
nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race
nfsd: check get_user() return when reading princhashlen
nfsd: fix inverted cp_ttl check in async copy reaper
nfsd: fix posix_acl leak on SETACL decode failure
NFSD: fix SECINFO_NO_NAME decode error cleanup
i2c: core: fix adapter registration race
fbdev: modedb: fix misaligned fields in the 1920x1080-60 mode
fbdev: modedb: fix a possible UAF in fb_find_mode()
fbdev: fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var
riscv: kfence: call mark_new_valid_map() for kfence_unprotect()
riscv: mm: extract helper mark_new_valid_map()

e67923a55781 Linux 6.18.38-xanmod1
82e2790add06 Merge tag 'v6.18.38' into 6.18
e46dc0adfe39 Linux 6.18.38
92c63a5ef3c7 apparmor: advertise the tcp fast open fix is applied
e77fbefd1269 net/tcp-ao: fix use-after-free of key in del_async path
3d205fe80f21 serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails
7627ff8c4f99 ksmbd: fix out-of-bounds read in smb_check_perm_dacl()
62c26720121b NFS: Prevent resource leak in nfs_alloc_server()
6919eb549e8f NFSv4: clear exception state on successful mkdir retry
012d37a568bf NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr
d8c90c7cc061 NFSv4/flexfiles: reject zero filehandle version count
4367afc119c5 nfsd: reset write verifier on deferred writeback errors
017a6150106b nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race
0f28337f54cf nfsd: check get_user() return when reading princhashlen
dba7da4835de nfsd: fix inverted cp_ttl check in async copy reaper
136b416593f1 nfsd: fix posix_acl leak on SETACL decode failure
c8a24effd96d NFSD: Fix SECINFO_NO_NAME decode error cleanup
6a946038f2a5 i2c: core: fix adapter registration race
fc6aa9bdbae6 fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode
4d418cf8daf5 fbdev: modedb: fix a possible UAF in fb_find_mode()
eea16b6f805c fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var
7643e5622994 riscv: kfence: Call mark_new_valid_map() for kfence_unprotect()
3b33dbb43e21 riscv: mm: Extract helper mark_new_valid_map()
2205275be9be power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init()
720949ed666f KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path
e36095d8d922 KVM: x86: hyper-v: Bound the bank index when querying sparse banks
f9b57a0015c2 MIPS: smp: report dying CPU to RCU in stop_this_cpu()
6dbe9443d9f5 9p: avoid putting oldfid in p9_client_walk() error path
4cd57ebee395 ocfs2: reject oversized group bitmap descriptors
104d10021239 rpmsg: char: Fix use-after-free on probe error path
369496d885b4 fpga: region: fix use-after-free in child_regions_with_firmware()
b3a3831b2eb8 irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove
200e7637f4d6 pNFS: Fix use-after-free in pnfs_update_layout()
90e254f18b8c LoongArch: Report dying CPU to RCU in stop_this_cpu()
e18769616fd5 tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done
5e5b7f2ef854 blk-cgroup: fix UAF in __blkcg_rstat_flush()
5a84398101bf hdlc_ppp: sync per-proto timers before freeing hdlc state
e91df6d27344 pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next()
b85ef03f726b gfs2: fix use-after-free in gfs2_qd_dealloc
8d8507a45766 crypto: nx - fix nx_crypto_ctx_exit argument
5da9b1a87ec7 KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned()
18587f983161 KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level
adfacfbaeae2 exfat: fix potential use-after-free in exfat_find_dir_entry()
6e61fc2e06e4 MIPS: DEC: Prevent initial console buffer from landing in XKPHYS
65bd0c0afb0e bpf: use kvfree() for replaced sysctl write buffer
3804e6de30ae block: Avoid mounting the bdev pseudo-filesystem in userspace
db2c5b9fb908 f2fs: keep atomic write retry from zeroing original data
20190e498057 f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node()
ff83de56882c f2fs: validate ACL entry sizes in f2fs_acl_from_disk()
888d94cc9afb f2fs: fix to round down start offset of fallocate for pin file
77f216ff9ce5 f2fs: validate compress cache inode only when enabled
8aad54746c25 f2fs: validate orphan inode entry count
1e48fefac682 f2fs: pass correct iostat type for single node writes
1de92789ce31 wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers
b0b07e04f0c7 wifi: iwlwifi: mld: fix race condition in PTP removal
df626f284cb9 wifi: iwlwifi: mvm: fix race condition in PTP removal
200d58c851b8 wifi: rtw88: usb: fix memory leaks on USB write failures
73d427d271f7 wifi: rtw88: increase TX report timeout to fix race condition
0aeb4d3ff6ce wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor
40aa3c2b0cb8 wifi: ath11k: fix warning when unbinding
a7cdc384c9c5 wifi: mt76: mt7925: don't disable AP BSS when removing TDLS peer
7e25b5e22c1f wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S
ec1c9e896255 userfaultfd: ensure mremap_userfaultfd_fail() releases mmap_changing
7216ce8cb12f keys: Pin request_key_auth payload in instantiate paths
b11c1fa32667 KEYS: fix overflow in keyctl_pkey_params_get_2()
49d893b9cbcf gcov: use atomic counter updates to fix concurrent access crashes
2b7ec7278609 err.h: use __always_inline on all error pointer helpers
1fcca1260c6e KVM: arm64: Omit tag sync on stage-2 mappings of the zero page
97e1044e79c5 block: invalidate cached plug timestamp after task switch
99e6c712cc30 kernel/fork: clear PF_BLOCK_TS in copy_process()
0d35f9f194a8 fbdev: fix use-after-free in store_modes()
81371dbd2360 NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR
c3ca2631073b apparmor: fix use-after-free in rawdata dedup loop
4a69b83045d3 apparmor: mediate the implicit connect of TCP fast open sendmsg
1697957eb097 net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink
1acdd14c0990 net: skmsg: preserve sg.copy across SG transforms
bd968bdd568b mac802154: llsec: add skb_cow_data() before in-place crypto
0cfa78c05066 af_unix: Set gc_in_progress to true in unix_gc().
3c499851753a wifi: mt76: add wcid publish check in mt76_sta_add
5e658b9245a5 ntfs3: reject direct userspace writes to reserved $LX* xattrs
77798d7be6ef ipv4: account for fraggap on the paged allocation path
6374fb9edf72 ipv6: account for fraggap on the paged allocation path
565ab66005b1 batman-adv: tvlv: avoid race of cifsnotfound handler state
4cc9f7711bb8 batman-adv: tvlv: enforce 2-byte alignment
04e1a6557fbf batman-adv: dat: prevent false sharing between VLANs
3f82fc92cf52 batman-adv: tt: track roam count per VID
3470d583fc65 batman-adv: tt: don't merge change entries with different VIDs
af5a069805f6 batman-adv: tp_meter: handle overlapping packets
d511c72a83dd batman-adv: tp_meter: prevent parallel modifications of last_recv
1dafdd0794be batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE
2233787658db batman-adv: tp_meter: restrict number of unacked list entries
3d4548c96d6f batman-adv: v: prevent OGM aggregation on disabled hardif
44ae137a2ace batman-adv: frag: avoid underflow of TTL
116e94025f0f batman-adv: frag: ensure fragment is writable before modifying TTL
0473ae882624 batman-adv: fix (m|b)cast csum after decrementing TTL
49bf27fcd7ee batman-adv: ensure bcast is writable before modifying TTL
646b68639c06 batman-adv: gw: don't deselect gateway with active hardif
95a061f587b7 batman-adv: tp_meter: initialize last_recv_time during init
75612c100a9e batman-adv: prevent ELP transmission interval underflow
43733e5b525f batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE
23d085bd6308 batman-adv: tp_meter: add only finished tp_vars to lists
b8bf8400e50c batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection
1db02f3e315d batman-adv: tp_meter: fix fast recovery precondition
7d2a44bc6bbe batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd
8e77fe0414f5 batman-adv: tp_meter: avoid window underflow
7cb88d91d5f9 batman-adv: tp_meter: initialize dec_cwnd explicitly
696c4cae872c batman-adv: tp_meter: initialize dup_acks explicitly
1c5a1268418e batman-adv: tp_meter: keep unacked list in ascending ordered
e055e74b80eb lockd: fix TEST handling when not all permissions are available.
671ec2eabb87 Revert "PCI: qcom: Advertise Hotplug Slot Capability with no Command Completion support"
d84470219839 selinux: fix overlayfs mmap() and mprotect() access checks
5dfcb15974e7 lsm: add backing_file LSM hooks
5e470998a23e KVM: x86: Fix shadow paging use-after-free due to unexpected role

View originalPermalink

7.1.2-xanmod1

Jun 27, 2026 · about 1 month ago

Fixed 13

virtiofs: fix UAF on submount umount
media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si
ksmbd: reject non-VALID session in compound request branch
drivers/base/memory: set mem->altmap after successful device registration
serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails
serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero
vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write
iio: adc: ti-ads1298: add bounds check to pga_settings index
iio: light: veml6075: add bounds check to veml6075_it_ms index
agp/amd64: Fix broken error propagation in agp_amd64_probe()
Revert NFSD: Defer sub-object cleanup in export put callbacks
fuse: re-lock request before replacing page cache folio
io_uring/net: Avoid msghdr on op_connect/op_bind async data

Removed 1

crypto: qat - remove unused character device and IOCTLs

74edfbf88678 Linux 7.1.2-xanmod1
963a4a40216b Merge tag 'v7.1.2' into 7.1
03e2778d1f11 Linux 7.1.2
e09412a714bc virtiofs: fix UAF on submount umount
232e4b313ea3 media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si
5f983b864d3d ksmbd: reject non-VALID session in compound request branch
059ac6252a63 drivers/base/memory: set mem->altmap after successful device registration
778b9dda4b24 serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails
ee6754f583a9 serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero
09a43e81279b vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write
3ae49dd04dbb crypto: qat - remove unused character device and IOCTLs
abd776ded3e2 iio: adc: ti-ads1298: add bounds check to pga_settings index
e545936e06f1 iio: light: veml6075: add bounds check to veml6075_it_ms index
cefe535a60a2 agp/amd64: Fix broken error propagation in agp_amd64_probe()
613257f91906 Revert "NFSD: Defer sub-object cleanup in export put callbacks"
e28db6ac4792 fuse: re-lock request before replacing page cache folio
7e00cafa33b5 io_uring/net: Avoid msghdr on op_connect/op_bind async data

View originalPermalink

Changelog

Discussion