XanMod Kernel 6.18.44-rt-xanmod1

6.18.44-rt-xanmod1
Added 5
  • drm/xe: Add page reclamation info to device info
  • drm/xe: Stub out new pagefault layer
  • drm/xe/bo: Add purgeable bo state tracking and field madv to xe_bo
  • drm/xe: add xe_migrate_resolve wrapper and is_vram_resolve support
  • drm/xe/pat: Add helper to query compression enable status
Changed 3
  • drm/xe: Use SVM range helpers in PT layer
  • drm/i915/vrr: Check HAS_VRR() first in intel_vrr_is_capable()
  • drm/exec: Remove the index parameter from drm_exec_for_each_locked_obj[_reverse]
Fixed 12
  • drm/tegra: fbdev: Do not assign to struct drm_fb_helper.info
  • drm/fb-helper: Fix a locking bug in an error path
  • usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path
  • can: isotp: fix timer drain order, wakeup handling and tx_gen ordering
  • can: use skb hash instead of private variable in headroom
  • drm/xe/pt: Reset current_op in xe_pt_update_ops_init()
  • da3165ece5d7 Linux 6.18.44-rt-xanmod1
  • 3a2180dd4bbe Merge branch '6.18' into 6.18-rt
  • ad6ed82a8a85 Linux 6.18.44-xanmod1
  • 3412e4a7152c Merge tag 'v6.18.44' into 6.18
  • 1efe5d048a39 Linux 6.18.44
  • 358b5dcf1fd7 drm/tegra: fbdev: Do not assign to struct drm_fb_helper.info
  • e7731507270c drm/fb-helper: Fix a locking bug in an error path
  • 7bc7af179916 usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path
  • 10be509fa8fd can: isotp: fix timer drain order, wakeup handling and tx_gen ordering
  • 0902f06a6c0b can: use skb hash instead of private variable in headroom
  • 157b1e3384d7 drm/xe/pt: Reset current_op in xe_pt_update_ops_init()
  • b1a71151317c drm/xe: Add page reclamation info to device info
  • 6107b64cfcce drm/xe: Stub out new pagefault layer
  • 184de3d31f72 drm/xe: Use SVM range helpers in PT layer
  • df1582c0a101 drm/i915/vrr: require valid min/max vfreq for VRR
  • 894d4a739566 drm/i915/vrr: Check HAS_VRR() first in intel_vrr_is_capable()
  • 21976fe52584 drm/xe: Wait on external BO kernel fences in exec IOCTL
  • b8ad916ba4e1 drm/exec: Remove the index parameter from drm_exec_for_each_locked_obj[_reverse]
  • d256dac008d1 drm/xe/vm: Fix BO prefetch with CONSULT_MEM_ADVISE_PREF_LOC
  • 8fa8b0a46372 drm/xe/vm: Prevent binding of purged buffer objects
  • 1ba553ee0b52 drm/xe/bo: Add purgeable bo state tracking and field madv to xe_bo
  • 0015b054b06d drm/xe: add xe_migrate_resolve wrapper and is_vram_resolve support
  • 005b9b443160 drm/xe/pat: Add helper to query compression enable status
  • 3cb42a973f88 drm/amd/display: Exit idle optimizations before programming
  • dbbe08d73b8b drm/amd/display: check GRPH_FLIP status before sending event
  • b485bfb45555 drm/xe/guc: Fix buffer overflow in steered register list allocation
  • 30b2d0843a41 drm/amdgpu: Respect placement requirements in amdgpu_gtt_mgr functions
  • e06c39cc1c48 drm/amdgpu: Fix context pstate override handling
  • 4d49ca777cf1 drm/tegra: fbdev: Remove offset into framebuffer memory
  • 3f5807745798 drm/fb-helper: Allocate and release fb_info in single place
  • 165613191ad9 userfaultfd: prevent registration of special VMAs
  • 02d378828af8 wifi: brcmfmac: drain bus_reset work on device removal
  • d6f322d68abf media: uapi: rkisp: Correct name version enum
  • 5c6d5d2484ca media: qcom: camss: Fix RDI streaming for CSID 340
  • f730ee0ef8fa media: qcom: camss: csid-340: Fix unused variables
  • 276420a86e75 media: chips-media: wave5: Support CBP profile
  • 3f7b3728dd90 usb: typec: ucsi: Fix race condition and ordering in port unregistration
  • 58d9caa64f9c usb: typec: ucsi: split connector lock classes
  • 2bf24a7e190a net/handshake: Drain pending requests at net namespace exit
  • 6e7b52bd1394 net/handshake: Close the submit-side sock_hold race
  • 68eba6519cbd net/handshake: hand off the pinned file reference to accept_doit
  • b913801ad9b9 net/handshake: Take a long-lived file reference at submit
  • 5ddfc47e1228 net/handshake: Fix null-ptr-deref in handshake_complete()
  • 97e745b4ea05 net/handshake: convert handshake_nl_accept_doit() to FD_PREPARE()
  • f00dd592abe7 file: ensure cleanup
  • 10827847c40c file: add FD_{ADD,PREPARE}()
  • 10065fb89165 mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios
  • be11b4bf498a fs/proc/task_mmu: fix PAGEMAP_SCAN written state for unpopulated ptes
  • 2b9a07002c2f mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork()
  • fc0c76b0450f drm/xe/rtp: Ensure locking/ref counting for OA whitelists
  • 9783d8662b56 drm/xe/oa: (De-)whitelist OA registers on OA stream open/release
  • f5966d900662 drm/xe/rtp: (De-)whitelist OA registers for all hwe's for a gt
  • d43abc858f08 drm/xe/rtp: Toggle 'deny' bit to (de-)whitelist OA regs
  • c2cfee9bf8d4 drm/xe/rtp: Save OA nonpriv registers to register save/restore lists
  • 4bb92418e749 drm/xe/rtp: Generalize whitelist_apply_to_hwe
  • cc716d3ac560 drm/xe/rtp: Keep track of non-OA nonpriv slots
  • f73e97080deb drm/xe/rtp: Maintain OA whitelists separately
  • 7982678fa21e drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists
  • 542d3b9fa8ec drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting
  • 2b70bebc7094 HID: logitech-dj: Fix maxfield check in DJ short report validation
  • 6be3dbe45b28 spi: spi-cadence: enable SPI_CONTROLLER_MUST_TX
  • 042ca3877955 drm/vmwgfx: validate external BO copy bounds for both stride paths
  • cfd163169af3 drm/vmwgfx: use check_add_overflow for shader size+offset bound
  • 1eb4f796695b drm/vmwgfx: enforce cursor size limits for MOB cursors
  • 96efee36453b drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure
  • 7e40e6120fb2 drm/vmwgfx: bound DMA command body size against suffix pointer
  • dc0be7662b7b drm/vmwgfx: validate DRAW_PRIMITIVES header size before division
  • a8434b145b1e drm/vmwgfx: drop dma_buf reference on foreign-fd prime import
  • b79e82ea1823 drm/vmwgfx: take fman->lock around fence list mutation in fifo_down
  • 10460699c312 drm/vmwgfx: clamp dirty-page range with min, not max
  • e479240a1e07 drm/vmwgfx: reject DX_BIND_QUERY without a DX context
  • 282f261cb035 drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size
  • 6a52f48157fa drm/amdkfd: hold event_mutex while checkpointing CRIU events
  • 6189ceca5ce7 drm/amdkfd: Handle invalid event type in CRIU event restore
  • 6dc0b4b39ed4 drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment
  • 5f0f2ddeac73 drm/amdkfd: fix QID bit leak in pqm_create_queue()
  • 9e52212aff8e drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE
  • 02647d983407 drm/amd/display: use proper context for logging
  • 3c2ae9509717 drm/amd/display: Increase HDMI AV mute wait from 2 to 3 frames
  • 1860818feb4d drm/amd/pm: fix torn gpu metrics reads
  • 45ba7f091abf drm/amdgpu: cap GTT size to physical RAM on APUs
  • d330ac90d85f drm/amdgpu: restore UMD profile pstate after runtime resume
  • 18d21c9d04b0 drm/amdgpu: move debug_vm handling to amdgpu_cs_parser_fini
  • 0f1ff05c58e1 drm/mediatek: ovl_adaptor: balance component registrations
  • c835f2b0b716 drm/panthor: validate firmware interface structure sizes
  • 2a761b9be586 drm/panthor: reject firmware sections with oversized data
  • da898bb6faf3 drm/bridge: display-connector: Fix I2C adapter resource leak
  • 57667eb7548f drm/vc4: Zero the tile state data array before each BIN job
  • 6cd5acf6f87c drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size
  • 58d2bb394e88 drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs
  • e8b797940536 can: ctucanfd: mark error-active controller status valid
  • 7d1619f56a75 can: ctucanfd: handle bus error interrupts
  • 46fc5aecde5c can: ctucanfd: unmap BAR0 using base address
  • cae2880f8ffa can: ctucanfd: use self-test mode for PRESUME_ACK
  • aa5e790bf185 can: ctucanfd: add missing MODULE_DEVICE_TABLE()
  • 2427ef427bdd can: peak_usb: validate uCAN receive record lengths
  • 92d0de80ca22 can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error
  • 1acab790b7ce can: peak_usb: add bounds check for USB channel index
  • 2ee477e541a6 can: softing: fw_parse(): validate firmware record spans
  • 185cb1fa3814 can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents
  • 2e90b2b40607 can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams()
  • 54258ea8d61f can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking
  • 8604a3b81b9d can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer
  • 996eb21acdc9 can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure
  • c311f17c261f can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure
  • 0b23144c59c1 can: ems_usb: validate CPC message lengths
  • 26cf99713a96 can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured
  • affd62f5719a i2c: imx: Cancel hrtimer before clearing slave pointer
  • 12a4f0950a15 i2c: imx: Fix slave registration race and error handling
  • 7a5db225ab5a i2c: imx: mark I2C adapter when hardware is powered down
  • 82233ff0e36d i2c: iproc: reset bus after timeout if START_BUSY is stuck
  • 19b783335d62 i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock
  • 40dd71744599 i2c: qcom-cci: drop custom suspend/resume and rely on runtime PM helpers
  • d9b5419df065 i2c: spacemit: request IRQ after controller initialization
  • 6a5cc2b4e6fa ice: fix memory leak in ice_lbtest_prepare_rings()
  • 326c89ea2685 ice: fix VF interrupts cleanup
  • 7e8789f5b5d8 ice: wait for reset completion in ice_resume()
  • e0ba8eaef2a0 net: openvswitch: fix skb leak on flow key update failure during ct
  • 9c7246cc509f net: openvswitch: fix skb leak on flow key update failure during recirculation
  • 90623c949962 net: openvswitch: fix potential UAF on meter attach failure
  • 74b30e7ef461 phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB
  • 79a312664118 phy: zynqmp: use read-modify-write for SERDES scrambler bypass
  • 4211450f0fec phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask
  • 013a4484f061 s390/zcrypt: Validate length for CCA ECC private key requests
  • ad93a1f1a456 s390/zcrypt: Validate length for CCA AES cipher key requests
  • fbb0410986e8 s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey()
  • a57fd7fcdb63 s390/zcrypt: Fix buffer over-read in cca_cipher2protkey
  • 672b12940e3f s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs
  • e16e0fc54120 s390/dasd: Fix undersized format-check buffer
  • 86cdfd061509 s390/dasd: Fix potential NULL pointer dereference
  • bd63c7879eaa s390/qeth: Check CAP_NET_ADMIN for private ioctls
  • ef1aa7cfb8c6 s390/pci: Fix s390_pci_mmio_write syscall error return without MIO
  • b039f13e095d power: supply: max17040: handle missing status supplier
  • 6d89f33a6467 power: supply: bq25890: fix the -10 C NTC lookup entry
  • 63d6c855b27d cpufreq: schedutil: Publish util hooks only after all sg_cpu are initialized
  • 437b38a08c0a cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init()
  • efbcecdecefc cifs: add fscache_resize_cookie() to cifs_setsize()
  • 466ab0c41d5f gpio: pch: use raw_spinlock_t for the register lock
  • 2e4bc8422cde gpio: pca953x: fix cache_only and IRQ state on restore_context() failure
  • 1883a09a37fe i2c: amd-mp2: Unregister callback on adapter add failure
  • 7a91d07939e0 hwmon: (pmbus/core) notify on the hwmon device, not the i2c client
  • 30ae66374637 hwmon: (npcm750-pwm-fan): stop fan timer on device detach
  • 4ba5bf7ed50f sctp: prevent peer transport count overflow
  • a0d1693923f4 sctp: reject stale cookies with mismatched verification tags
  • 2047ed09bf13 scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write
  • 5b4d4d5a29f9 selftests/clone3: fix wild pointer access of getline due to missing init
  • a0bc578641d7 selftests/mm: fix potential wild pointer access of getline due to missing init
  • 2e047b4171de spi: qcom-qspi: Correct max DMA length to avoid 64K boundary failure
  • 581e5166f078 spi: spi-qpic-snand: write the feature value before executing SET_FEATURE
  • c26a6477e149 tracing/filters: Fix false positive match in regex_match_full()
  • cbb5ed3be9ca tracing: Check return value of __register_event() in trace_module_add_events()
  • 205feb72e5be ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev()
  • ee799977d794 vxlan: use pskb_network_may_pull() in route_shortcircuit()
  • 94dee751aad6 vxlan: use pskb_network_may_pull() for transmit path header pulls
  • ff89415d34c3 vxlan: use neigh_ha_snapshot() in route_shortcircuit()
  • adeed09eeb3b vxlan: unclone skb head before modifying eth header in route_shortcircuit()
  • 1235e017aa11 vxlan: re-fetch eth header after route_shortcircuit()
  • b24ba0bbffe3 veth: convert frag_list skbs before running XDP
  • 3bd35a5e272a uprobes: Fix NULL pointer dereference in hprobe_expire()
  • 180ff4c81faf um: vector: fix use-after-free in vector_mmsg_rx()
  • e4b98f9778df powerpc/ps3: Fix map failure path in dma_ioc0_map_pages()
  • 4ef801b838d8 net: pktgen: fix proc entry use-after-free
  • dc3ab0422066 net: ipv6: clear suppressed fib6 rule result
  • 0309ebbc5700 net: bridge: stop fast-leave after deleting a port group
  • 332a546b4ee5 mm: memcg: initialize *locked in memcg1_oom_prepare() stub
  • b11907c905fa mm/page_reporting: use system_freezable_wq to fix UAF during suspend
  • 63b361f22886 io_uring/net: initialize mshot_len for send
  • 4dad8ca637d4 binfmt_misc: don't let an 'F' entry pin its own instance
  • 840bb9c49c3e binfmt_misc: reject a flag character as the field delimiter
  • 255a758697da binfmt_misc: use exe_file_deny_write_access() for the interpreter clone
  • fdc1d702bf30 binfmt_misc: restore write access when removing an entry
  • c9dcfe6b8b71 wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames
  • bed792737b5f tipc: avoid use-after-free in poll trace queue dumps
  • 88752b811f72 of/address: Fix NULL bus dereference in of_pci_range_parser_one()
  • 4ae701848e4b netfilter: ipset: do not update comments from kernel-side hash adds
  • f807a63d0d95 net/smc: fix socket use-after-free during link group termination
  • 2060764e0f46 mshv: fix hv_input_get_system_property struct
  • a60b5da05e31 ksmbd: reject repeated SMB2 NEGOTIATE requests
  • b5ee5b266f83 ipvs: do not propagate one-packet flag to synced conns
  • 3b5aee6fcbf6 igc: remove napi_synchronize() in igc_down()
  • 845a9cdd9b03 igbvf: Fix leak in TX DMA error cleanup
  • b10bb77e91e9 e1000: fix memory leak in e1000_probe()
  • b0bdca3a49cf dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+
  • 2db4535d6af7 ALSA: usb-audio: Clamp frame size in implicit-feedback mode
  • 04595233e560 ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set
  • b5305a0d0bb8 ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output()
  • 7ba01e0d3539 ALSA: usb-audio: fix stack info leak in RME Digiface status
  • cc014ebf8031 ALSA: usb-audio: fix use-after-free in ump_to_endpoint()
  • 79f8720029f2 ata: libata-sata: fix ata_scsi_lpm_supported() iteration
  • 9562ddbc6ed8 ata: libata-eh: Increase STANDBY IMMEDIATE timeout
  • 0a02b0c87807 ASoC: tas2562: fix broken entries in the volume lookup table
  • 35d5f1852e39 ASoC: tas2562: fix DVC coefficient write order
  • cac7d2066b2f ASoC: fsl_easrc: fix m2m_init error path to use goto instead of bare return
  • 6df5b3288160 ASoC: fsl_asrc: fix m2m_init error path to use goto instead of bare return
  • 032746c2dd9a ALSA: ump: fix double free of out_cvts on rawmidi error
  • a26a2e52736f ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes
  • 5260e195c53e ALSA: seq: Fix division by zero in initialize_timer()
  • 2940cc3cf43c ALSA: pcm: wake linked drain waiters on unlink
  • 4969533a1b95 ALSA: lx6464es: fix period byte count for 16-bit streams
  • 7484669d1fba ALSA: hda/realtek: Add quirk for TongFang X6SP45xU
  • 11e2953d9f4c ALSA: 6fire: Fix UAF at error handling during probe
  • c0d3b81f703b afs: Fix UAF when sending a message
  • d703f022a28a afs: Fix afs_fs_fetch_data() to subtract transferred from len
  • b53face003b4 afs: Fix afs_fs_fetch_data() to set call->async
  • 5c7fdcbecbab bpf: lwt: Fix dst reference leak on reroute failure
  • 27cc0e603355 Bluetooth: HIDP: validate numbered report payloads
  • 2ebf63aa557a Bluetooth: HIDP: reject frames without a transaction header
  • eb1d8318764d Bluetooth: hci_sync: Fix advertising data UAFs
  • c569def320aa Bluetooth: mgmt: fix UAF in pair command cancellation
  • a33bc07b4730 Bluetooth: SCO: give the socket its own sco_conn reference
  • 814f82f432dc Bluetooth: mgmt: fix pending command UAF in EIR updates
  • 6936b367ee6d Bluetooth: btmtk: Fix short read errors in btmtk_usb_uhw_reg_read()
  • f14d41dbc2fd Bluetooth: btusb: Fix short read errors in btusb_qca_send_vendor_req()
  • cae0dfed5d30 audit: fix potential use-after-free in audit_del_rule()
  • 185c784c9809 audit: fix potential integer overflow in audit_log_n_string()
  • 17b412468c7a sctp: validate Adaptation Indication parameter length
  • c0837aeace96 dibs: fix use-after-free of dmb_node in loopback attach/detach/unregister
  • b878ba7e2814 KVM: s390: pci: Validate AIBV and AISB before pinning guest pages
  • e137d082325b KVM: s390: pci: Fix NULL dereference on AIBV allocation failure
  • 1abf9ce39a86 KVM: s390: pci: Fix missing error codes and memory unaccounting
  • 70871b121f81 KVM: s390: pci: Fix memory accounting for pinned/unpinned pages
  • 6837f0ae85fd KVM: s390: pci: Reject adapter interrupt forwarding if already enabled
  • 7668c58dcf46 KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active
  • 5acc92947baa KVM: VMX: add memory clobber to asm for VMX instructions
  • e768ea3a422d tracing/fprobe: Roll back on enable_trace_fprobe() failure
  • 3b2e08e0ede7 tracing/probes: Reject $arg0 in meta argument expansion
  • e0fa737783b5 mm/vmstat: fold stranded per-cpu node stats when a node comes online
  • 126a70bf1a08 mm/hugetlb: fix list corruption in allocate_file_region_entries()
  • 32134cf9211b mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk()
  • 7d3e1d3a0dce fs/proc/task_mmu: fix PAGEMAP_SCAN written state for PMD holes
  • c091462e46f7 selftest: fix headers in fclog.c
  • 9668ffe0e2a5 mm/util: don't read __page_2 for order-1 folios in snapshot_page()
  • 2be94d6b2078 mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE
  • 2205263b1e01 fortify: Disable -Wstringop-overread in tests
  • 96b0aa79b0e1 pinctrl: bm1880: add missing select GENERIC_PINCONF
  • 5aaa06dfc10f erofs: cap LZMA stream pool size
  • ad0ad3c228b6 pinctrl: devicetree: don't free uninitialized dev_name on error path
  • 93d934668047 pinctrl: microchip-sgpio: add missing select REGMAP_MMIO
  • 6da8f37419dd iommu/iommufd: Fix IOPF group ownership UAF
  • 564ac339c0f8 iommufd: Fix wrong hwpt passed to iommufd_auto_response_faults on replace
  • ee2212b48232 iommufd/viommu: Publish a vDEVICE only after vdevice_init() succeeds
  • 294b464b2be7 iommufd/viommu: Release the igroup lock on the vdevice_size error path
  • 062aa5dcc49a mshv: Order pt_vp_array publish against irqfd assertion path
  • f50f5d3972da mshv: Fix level-triggered check on uninitialized data
  • fc362bfcb060 mshv: adjust interrupt control structure for ARM64
  • 72a90ce4918b mshv: Fix race in mshv_irqfd_deassign
  • cfc686a1174a iomap: add a separate bio_set for iomap_split_ioend
  • 9be4a66f019e ksmbd: fix use-after-free in __close_file_table_ids()
  • 213b4568f6e5 ksmbd: return success for deferred final close
  • cebba11df714 drm/i915/hdmi: Poll for 200 msec for TMDS_Scrambler_Status
  • e51becb8f337 qede: sync udp_tunnel ports outside qede_lock in the recovery path
  • 51c52e493346 spi: spi-nxp-fspi: add per-SoC SDR/DTR clock rate limits for all supported SoCs
  • caeaaf23f7c3 sched/deadline: Use revised wakeup rule only for running dl_server
  • 5a73e8c632c3 octeontx2-pf: Set correct sequence for carrier off and tx queue stop
  • b90916156b47 net: libwx: fix FDIR ATR queue mismatch for software VLAN packets
  • 6bf322ab0741 ptp: netc: fix potential interrupt storm caused by incorrect unbind order
  • 1e0dfb7e7a5d net: dsa: mt7530: error out on failed reads in MT7531 PHY polling
  • fd9586881d47 net: dsa: mt7530: check bus->read() errors in the MDIO regmap backend
  • 54e07a158f7a riscv: mm: Fix out-of-bounds page-table walk during memory hot-remove
  • b297559dc2f2 accel/qaic: use sizeof(*trans_hdr) for transaction length check
  • 01bd01b61ad9 riscv: drop __init from vec_check_unaligned_access_speed_all_cpus
  • a20a0010eb64 tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions
  • 9b604041f100 tracing/mmiotrace: Reset dropped_count in mmio_reset_data()
  • fc97dcb42fb4 fprobe: Fix module reference count leak on error in register_fprobe()
  • 84b5aa55de7c drm/i915/dp: Ignore the sink's DSC max FRL rate without a PCON DSC encoder
  • 50edffd0854f can: isotp: check register_netdevice_notifier() error in module init
  • b4f8c33593f2 net: sxgbe: check descriptor ring allocation failures
  • 42b87cfd9666 net: sxgbe: free TX rings on RX allocation failure
  • 69a258a5a322 scsi: target: Clear cmd_cnt when initial counter enrollment fails
  • 54c6fb24c602 scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req
  • ff333def3147 scsi: ufs: core: Revert "Delegate the interrupt service routine to a threaded IRQ handler"
  • c249cfe1d8df scsi: ufs: core: Avoid IRQ thread wakeup during active UIC command
  • e50420448999 scsi: ufs: core: Cancel RTC work in active-active suspend
  • bdd8a1297ef1 scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE
  • 613aaeeaf8cb net: phylink: put link_gpio if phylink_create fails
  • 5ea70ad040c1 x86/boot: Add volatile, clobbers and zero-length test in memcmp()
  • 5576afebf726 Bluetooth: hci_sync: fix hci_conn_del() use in hci_le_create_conn_sync
  • e8f9fef362ba Bluetooth: hci_conn: hold conn reference in abort_conn_sync()
  • de17305393ec Bluetooth: hci_sync: make hci_cmd_sync_run_once return -EEXIST if exists
  • c618a9a5b08e Bluetooth: btintel: Validate length before parsing diagnostics TLV
  • 3b921533e8aa Bluetooth: ISO: fix refcounting of iso_conn
  • e941799c31f6 Bluetooth: ISO: ensure no dangling hcon references in iso_conn
  • 82e982f54f96 Bluetooth: ISO: avoid deadlocks in iso_sock_timeout
  • e76a0ae6542a Bluetooth: ISO: fix leaking sk after socket release
  • 4e9b5e8669b3 Bluetooth: ISO: hold sk properly in iso_conn_ready
  • 09a69828ae59 Bluetooth: ISO: fix CONNECTED -> CLOSED transition on shutdown/release
  • cde36776cfe6 Bluetooth: ISO: Fix not updating BIS sender source address
  • dfce8d30fc5b Bluetooth: ISO: validate sockaddr_iso first in iso_sock_rebind_bis()
  • 1fc2132950c2 Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos
  • e8e9cff6d80e Bluetooth: ISO: lock sk in iso_connect_ind
  • 3120664aa333 Bluetooth: ISO: Fix data-race on iso_pi(sk) in socket and HCI event paths
  • f1f167991a68 Bluetooth: HCI: Add initial support for PAST
  • 72d5bb1d77d7 Bluetooth: ISO: lock sk in iso_sock_getname
  • 58e3c5289ad2 Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp
  • 63c0f396a18b Bluetooth: ISO: clear iso_data always when detaching conn from hcon
  • 4e1f45de5b31 ice: suppress DPLL errors during reset recovery
  • 6ebbf198e76c idpf: Fix mailbox IRQ name leak on request failure
  • d44081c61dc9 idpf: adjust TxQ ring count minimum
  • ae7120102e1b hwmon: (pmbus) Fix return value from pmbus_update_byte_data()
  • 276f1f180f55 net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller
  • 2c148a31ca01 netfs: release readahead folios on iterator preparation failure
  • 291ebecdf315 netfs: handle single writeback rolling buffer allocation failure
  • 627826ef4208 netfs: clear PG_private_2 on copy-to-cache append failure
  • b558e07708d8 wifi: mac80211: validate individual TWT params before driver setup
  • f82a2ded3d7a net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister()
  • acbf711a2066 powerpc/boot: Fix treeboot-akebono CPU node lookup check
  • b407b98cf665 powerpc/boot: Fix treeboot-currituck CPU node lookup check
  • 3d24f2e5641b powerpc/boot: Fix simpleboot CPU node lookup check
  • db986098f308 rtase: fix double free of multi-frag skb on DMA map failure
  • 5a6b0ccb8b01 hwmon: (adt7470) Fix PWM auto temp state array and bounds check
  • 96ad57d31763 hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read
  • ddd689bd7226 hwmon: (adt7470) Use cached PWM frequency value
  • 1d6b54dbe885 hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks
  • d5d4034bb6f6 hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read()
  • 82d65f7ef11e hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread
  • 3e06ff0c79ea hwmon: (adt7470) Fix cache updated before hardware write on I2C error
  • 28548ecc2b45 hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors
  • ae20a8a4de06 forcedeth: fix UAF of txrx_stats in nv_remove
  • 2e0c6761c055 net: bridge: mrp: fix Option TLV length in MRP_Test frames
  • 1b722740ac5c hwmon: (nct6775-core) Prevent access to unsupported weight registers
  • 5ec5f00fc606 net: do not send ICMP/NDISC Redirects when peer allocation fails
  • 2332d35aaf20 hwmon: (nzxt-smart2) DMA-align output buffer
  • 075fce376cf8 hwmon: (lm90) Only report alarms if driver is ready
  • c498adfd4c3e hwmon: (sht3x) Fix unaligned accesses
  • 08aee6d45eef hwmon: (ltc4282) Fix reading the minimum alarm voltage
  • b60e8486c04d hwmon: (ina2xx) Fix various overflow issues
  • e627f4ad9eea hwmon: (ina2xx) Shift INA234 shunt and current registers
  • fdfde077e025 hwmon: (ina2xx) Add support for INA234
  • 8da94361f9ae hwmon: (ina2xx) Make it easier to add more devices
  • a42d727dae57 hwmon: (nct6775-core) Fix number of temperature registers for NCT6116
  • e28d478c003d spi: spi-cadence: Move TX FIFO full busy-wait into FIFO
  • d3337eefab62 spi: spi-cadence: supports transmission with bits_per_word of 16 and 32
  • fcc3d77fef02 ASoC: tas2781: Use correct calibration data for SINEGAIN2 register
  • b2851429afc5 smb: client: fix buffer leaks in SMB1 read and write
  • 9e24b47ef81d scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race
  • 72815741715b scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer
  • 3ef209ca0b4b scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer
  • 8e0996418590 pinctrl-amd: Don't clear S4 wake bits at probe
  • ceb00cb87a22 xsk: drain continuation descs after overflow in xsk_build_skb()
  • 411554cb868b xsk: use a smaller new lock for shared pool case
  • 05e283466b86 xsk: fix buffer leak in xsk_drop_skb() for AF_XDP multi-buffer Tx
  • 814c5b159003 selftests/net/af_unix: test listen() rejects wrong socket states
  • 643ec3e24a49 selftest: af_unix: Create its own .gitignore.
  • 0372a5219112 selftests: af_unix: Add tests for ECONNRESET and EOF semantics
  • 5c170577049f af_unix: fix listen() succeeding on sockets in the wrong state
  • b1d480fce05f rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check()
  • f6787fdffcae rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled
  • 4147866087fb ASoC: SDCA: Ensure that Control Range is large enough for header
  • 16b553c46e34 netfilter: nft_payload: fix mask build for partial field offload
  • e6f4b4b40db8 ipvs: do not mangle ICMP replies for non-first fragments
  • ce96c40a049b ipvs: fix places with wrong packet offsets
  • 00eb23829fd0 ipvs: fix the checksum validations
  • d186f77d18bd netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH
  • 63ba12b664a2 netfilter: nf_tables: make nft_object rhltable per table
  • adf1a3ba27ad assoc_array: trim the final shortcut word using the current chunk end
  • 3d9f16c0b643 keys: make keyring key-chunk byte order agree with keyring_diff_objects()
  • e9417d21a22a keys: fix out-of-bounds read in keyring_get_key_chunk()
  • 6469ad300508 KEYS: trusted: dcp: fix key_len validation and calc_blob_len() return type
  • 31d491f9da94 KVM: arm64: Reject guest_memfd memslots when the VM has MTE
  • db1c4a8e9080 mshv: Fix sleeping under spinlock in mshv_portid_alloc
  • a920ead0bc2f mshv: Fix duplicate GSI detection for GSI 0
  • b215cb70e14c Drivers: hv: vmbus: Replace lockdep_hardirq_threaded() with lockdep annotation
  • d397787dbc4b Drivers: hv: Allocate the paravisor SynIC pages when required
  • 74d20e3cf88e Drivers: hv: Rename fields for SynIC message and event pages
  • 82cdbb6155a2 arch/x86: mshyperv: Discover Confidential VMBus availability
  • 6e70eba930a2 drm/mediatek: Check CRTC state before freeing
  • f74554e67ccf netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()
  • ec81ecd2ac09 phy: zynqmp: fix runtime PM leak on probe allocation failure
  • 86fb88ac8c91 phy: zynqmp: fix clock error handling in xpsgtr_phy_init()
  • dff474e723ed btrfs: raid56: fix an incorrect csum skip during scrub
  • 4d4ef6627304 btrfs: zoned: reset meta_write_pointer on zone reset
  • deddd28fd83c btrfs: zoned: fix deadlock between metadata writeback and transaction commit
  • 762561c43859 btrfs: fix leaking BTRFS_FS_STATE_REMOUNTING flag
  • cfa7e2734877 of: reserved_mem: prevent OOB when too many dynamic regions are defined
  • f5edba9bc69d ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup
  • 3cbfb9b886dc ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup
  • 3fd94b9ffe99 phy: qcom: m31-eusb2: Fix return value of init call
  • 9355f526c821 ata: ahci_ceva: fix error paths in ceva_ahci_platform_enable_resources()
  • a0f288ebe6d8 ata: sata_mv: accept 1 or 2 resources in platform probe
  • 8229a5388854 selftests/seccomp: Fix pointer type mismatch build error
  • 99dc2c143dfc selftests/lkdtm: rename STACKLEAK_ERASING to KSTACK_ERASE
  • 094145989b31 gpio: sloppy-logic-analyzer: Fix memory leak in gpio_la_poll_probe()
  • 3808bab5d95a iommu/arm-smmu-v3-iommufd: Require exactly one Stream ID for a vDEVICE
  • 0679c0c189d2 dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open()
  • 9086b488f273 dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA
  • 2ef9bb422dd6 pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151
  • 3e55d2809547 pinctrl: qcom: Unconditionally mark gpio as wakeup enable
  • 54a62153c765 thunderbolt: Prevent XDomain delayed work use-after-free on disconnect
  • d01e88d421a6 mm/slab: prevent unbounded recursion in free path with new kmalloc type
  • 3e957c9b160c lib/alloc_tag: introduce mem_alloc_profiling_permanently_disabled()
  • 98f57011e6cd HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report
  • bc3bba4656ad HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write
  • df0f33293c0a HID: logitech-dj: Standardise hid_report_enum variable nomenclature
  • 302eb8765132 ALSA: hda/realtek: add quirk for HP Dragonfly Folio G3 2-in-1
  • e8362523fd1b drm/gpusvm: publish dpagemap early to avoid device mapping leak on error
  • a5cdd2407dd8 net: mpls: initialize rtm_tos in mpls_getroute()
  • 85b94a74a0b8 netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge()
  • 9bb3714e0998 kunit: tool: Terminate kernel under test on SIGINT
  • d36086cd1826 kunit: tool: skip stty when stdin is not a tty
  • 285641eb82f0 netfilter: nf_conntrack_expect: restore helper propagation via expectation
  • 7b923c78b50d Linux 6.18.43
  • bfe7f9993467 x86/bugs: Make Safe-RET robust against interrupt injection
  • 054f69ce6232 Linux 6.18.42-xanmod1
  • 764d67d28fa6 Merge tag 'v6.18.42' into 6.18
  • 856a9b51680c Linux 6.18.42
  • 0f33b1c457c2 KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug
  • 846ed916cfa0 gpu: Fix uninitialized buddy for built-in drivers
  • bcb29986bbba net: stmmac: fix dwmac4 transmit performance regression
  • a0d1a11b90a5 net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query
  • f282242906c1 usb: gadget: f_tcm: synchronize delayed set_alt with teardown
  • aeebcfa8237c rust: device: avoid trailing ; in printing macros
  • e94e820df37d rust: allow suspicious_runtime_symbol_definitions lint for Rust >= 1.98
  • 6ce0db97fb37 mm/damon/core: disallow overlapping input ranges for damon_set_regions()
  • 4b6f1d6d5d07 mm/damon/core: validate ranges in damon_set_regions()
  • deead12d2e65 i3c: mipi-i3c-hci: Fix handling of shared IRQs during early initialization
  • 811b581fae65 i3c: mipi-i3c-hci: Fix Hot-Join NACK
  • 4fd5b33faf09 pmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI
  • c389893bb403 pmdomain: imx93-blk-ctrl: convert to devm_* only
  • dc8347f263b2 net: ipa: fix SMEM state handle leaks in SMP2P init
  • 4c1e8ccd8655 ata: libata-core: Reject an invalid concurrent positioning ranges count
  • 9466dc5e377f bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline()
  • a88c2a70ea0a bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c
  • c73b8795b45f octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF
  • 4467fa514482 octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify
  • ae5ae3d5bfaa net: mana: Optimize irq affinity for low vcpu configs
  • 6d13eaa13341 net: mana: Validate the packet length reported by the NIC
  • 7b7bb07efe41 fs/resctrl: Fix use-after-free during unmount
  • d48cf914c739 fs/resctrl: Move RMID initialization to first mount
  • 682d3c2cd20e fs/resctrl: Move allocation/free of closid_num_dirty_rmid[]
  • 8c5925f0fa12 x86,fs/resctrl: Rename some L3 specific functions
  • 696c34a1964f x86,fs/resctrl: Rename struct rdt_mon_domain and rdt_hw_mon_domain
  • ad4ea2a169a4 fs/resctrl: Split L3 dependent parts out of __mon_event_count()
  • 5b82af744e06 mmc: vub300: fix use-after-free on probe failure
  • 73d397ab54f2 mmc: vub300: rename probe error labels
  • 8ced1d242c34 dm: avoid leaking the caller's thread keyring via the table device file
  • dd73cc92a55d cred: add kernel_cred() helper
  • af7a4c2caa7a accel/amdxdna: reject command submission on devices without a submit op
  • 62dae36be7a6 ovl: use linked upper dentry in copy-up tmpfile
  • 043acb00e4ed dmaengine: dw-edma-pcie: Reject devices without driver data
  • 277a035cda47 dmaengine: dw-edma: Fix confusing cleanup.h syntax
  • 19360c25135f mtd: maps: vmu-flash: fix fault in unaligned fixup
  • b8271be34bce kho: make sure scratch size is always aligned by CMA_MIN_ALIGNMENT_BYTES
  • 3d561f46fa78 mm/sparse-vmemmap: fix vmemmap accounting underflow
  • 8af652cd9946 remoteproc: xlnx: Check remote core state
  • 6fc1919a6f2e cxl: Fix CXL_HEADERLOG_SIZE to match RAS Capability size
  • 89b2ae039d18 cxl/pci: Remove CXL VH handling in CONFIG_PCIEAER_CXL conditional blocks from core/pci.c
  • eeab77506992 cxl/pci: Remove unnecessary CXL RCH handling helper functions
  • a64661dccb2e cxl/pci: Remove unnecessary CXL Endpoint handling helper functions
  • 5d964cb2b7bc SUNRPC: Return an error from xdr_buf_to_bvec() on overflow
  • b50b2cb87e7a SUNRPC: Add helpers to convert xdr_buf byte ranges to scatterlists
  • a112b91dd634 sunrpc: allocate a separate bvec array for socket sends
  • 3120f21df3fb NFSD: pass nfsd_file to nfsd_iter_read()
  • 6876f767b049 pinctrl: renesas: rzg2l: Use -ENOTSUPP instead of -EOPNOTSUPP
  • 7185c5262435 gpu/buddy: bail out of try_harder when alignment cannot be honoured
  • 9634fd144cdc drm: drop lib from header search path.
  • 65677f7a20c4 gpu: Move DRM buddy allocator one level up (part two)
  • 09755dc62b02 netfilter: nf_conntrack_sip: validate skb_dst() before accessing it
  • a1a94a00b884 netfilter: nf_conntrack_sip: remove net variable shadowing
  • d01c913febea netfilter: nft_fib: reject fib expression on the netdev egress hook
  • beeda5bf7857 netfilter: nf_tables: remove register tracking infrastructure
  • 1de827e24d0a arm64: dts: qcom: hamoa: Fix OPP tables for all DisplayPort controllers
  • 0d810ff7a6f6 arm64: dts: qcom: correct RBR opp entry
  • 690fb82c4122 VDUSE: avoid leaking information to userspace
  • 7764e9c727d5 vduse: take out allocations from vduse_dev_alloc_coherent
  • db5c554b36d5 vduse: remove unused vaddr parameter of vduse_domain_free_coherent
  • 82e48ad2a132 vduse: return internal vq group struct as map token
  • b1f38c3ec620 xfs: don't replace the wrong part of the cow fork
  • 3bca70235a70 fuse-uring: fix race between registration and connection abortion
  • 40879c39d674 audit: fix recursive locking deadlock in audit_dupe_exe()
  • 91b64f0be416 audit: use 'unsigned int' instead of 'unsigned'
  • eef6914f2b45 audit: widen ino fields to u64
  • c5772ced573e landlock: Account all audit data allocations to user space
  • a95b62759f3b landlock: Fix formatting
  • 682a0066dde0 drm/amd/display: Fix DTB DTO updates breaking live pixel rate sources
  • 81ea8e822185 fscrypt: Avoid dynamic allocation in fscrypt_get_devices()
  • 337022d9dfac ksmbd: validate ACE size against SID sub-authorities
  • f1eba60db813 ksmbd: bound DACL dedup walk to copied ACEs
  • 847ecd4eb3c1 ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL
  • b6d3cc6a5244 ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl
  • 17e6b8c4319f net: qrtr: ns: Raise node count limit to 512
  • 7dd26adf7e7d ublk: wait on ublk_dev_ready() instead of ub->completion
  • 5a15eaa50f92 drm/xe/uapi: Reject coh_none PAT index for CPU_ADDR_MIRROR
  • 5488d3a69d20 dm-verity: fix buffer overflow in FEC calculation
  • 3f31bde63f9a dm-verity-fec: replace {MAX,MIN}_RSN with {MIN,MAX}_ROOTS
  • d47281b9a447 dm-verity-fec: fix reading parity bytes split across blocks (take 3)
  • a556189c0675 dm-verity-fec: fix the size of dm_verity_fec_io::erasures
  • 22400725de07 bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops
  • 15a7cb71a574 drm/amdgpu: fix check in amdgpu_hmm_invalidate_gfx
  • ab7b40c638e0 drm/amd/pm: fix smu13 power limit range calculation
  • 6405c4e75b3b drm/amdgpu: fix aperture mapping leak
  • 08fee493e026 drm/amdgpu: invoke pm_genpd_remove() before freeing genpd
  • 68eab5a64ddb drm/amdgpu: fix resource leak on ACP reset timeout
  • ffb33d466a68 drm/amdgpu: fix division by zero with invalid uvd dimensions
  • 8c6d84a54823 drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe()
  • bd868c077f67 drm/amdgpu/vcn4: avoid rereading IB param length
  • 7eebef042c12 drm/amdgpu/vce: fix integer overflow in image size
  • f7e9eeaccca5 drm/amdgpu/soc24: reset dGPU if suspend got aborted
  • dc3f5da1ba8e drm/amdgpu/sdma4.4.2: replace BUG_ON() with WARN_ON()
  • 76c977d396f1 drm/amdgpu/jpeg: fix jpeg_v5_0_1_is_idle detection
  • 058373af5955 drm/amdgpu/jpeg: fix jpeg_v4_0_3_is_idle detection
  • 042c047e8bc9 drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON()
  • 05aea3344c42 drm/amdgpu/gfx9.4.3: replace BUG_ON() with WARN_ON()
  • f70bd5235d9e drm/amdgpu/gfx8: drop unecessary BUG_ON()
  • 987bedd3ea89 drm/amdgpu/gfx12: replace BUG_ON() with WARN_ON()
  • dfd9bf09fd8f drm/amdgpu/gfx11: replace BUG_ON() with WARN_ON()
  • 7e22de67e545 drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON()
  • e75f71143b68 drm/amd/pm: make pp_features read-only when scpm is enabled
  • ada47af5c215 drm/amd/pm: fix amdgpu_pm_info power display units
  • 7b263cf1dd4c watchdog: s32g_wdt: remove incorrect options in watchdog_info struct
  • 79370b573e92 vxlan: mdb: Fix source list corruption on a failed replace
  • f60bac115d8d vsock/virtio: collapse receive queue under memory pressure
  • 5f5a41a48dbf tipc: clear sock->sk on the failed-insert path in tipc_sk_create()
  • 234f9ffbd9b2 tcp: challenge ACK for non-exact RST in SYN-RECEIVED
  • fadaff3f66e1 tcp: initialize standalone TCP-AO response padding
  • 4a4f3aa6af20 rtase: Workaround for TX hang caused by hardware packet parsing
  • 6866abf59976 pppoe: reload header pointer after dev_hard_header()
  • 460b9f0609d2 ovpn: hold peer before scheduling keepalive work
  • b08526bf0bbf ovpn: fix peer refcount leak in TCP error paths
  • 100a23b1613e openvswitch: fix GSO userspace truncation underflow
  • f80ba170d7b3 mctp: serial: handle zero-length frames to prevent rx buffer overflow
  • f20dedce0429 mac802154: llsec: reject frames shorter than the authentication tag
  • 59c1d5463b7b mac802154: hold an interface reference across the scan worker
  • 472aba2603ca ila: reload IPv6 header after pskb_may_pull in checksum adjust
  • 919d0accf260 ice: use READ_ONCE() to access cached PHC time
  • 5e496f2b615c ice: reject out-of-range ptype in ice_parser_profile_init
  • 91e0249f3ef6 gve: fix Rx queue stall on alloc failure
  • 18705cace061 ksmbd: defer destroy_previous_session() until after NTLM authentication
  • 6098b55f6a0c smb: client: handle STATUS_STOPPED_ON_SYMLINK responses without a symlink target
  • 34f2a2f32af5 rbd: Reset positive result codes to zero in object map update path
  • 63d78b546eef super: fix emergency thaw deadlock on frozen block devices
  • e4406cbdd915 ice: fix PTP Call Trace during PTP release
  • b3efb4744abf ptp: ptp_s390: Add missing facility check
  • 9a8a247f0f17 s390/ptff: Export ptff_function_mask[]
  • 4afc58ea75b9 proc: Fix broken error paths for namespace links
  • 4056cc19071a net: pcs: xpcs: fix SGMII state reading
  • 80d977f280b4 net: hip04: fix RX buffer leak on build_skb failure
  • a4dfd46cc8f0 net: gro: fix double aggregation of flush-marked skbs
  • ec6d91a1bf2e net/x25: fix use-after-free in x25_kill_by_neigh()
  • 40f9a124ebbe net/mlx5e: Use sender devcom for MPV master-up
  • 900cd6d8119b net/iucv: fix use-after-free of a severed iucv_path
  • 33736ff5e7c9 net/af_iucv: fix NULL deref in afiucv_hs_callback_syn()
  • f8c498585d2a geneve: require CAP_NET_ADMIN in the device netns for changelink
  • 5d07b178bef5 net: slip: serialize receive against buffer reallocation
  • 730c7e5fea7f vxlan: require CAP_NET_ADMIN in the device netns for changelink
  • a48a889b60f7 phonet: pep: fix use-after-free in pep_get_sb()
  • 03157872da5e net: stmmac: intel: skip SerDes reconfig when rate is unchanged
  • 1b44a5f584bf iommu/vt-d: Disallow SVA if page walk is not coherent
  • 7037e7bdcd26 iomap: fix out-of-bounds bitmap_set() with zero-length range
  • f139498c5ebd io_uring/rw: fix missing ERESTARTSYS conversion in read paths
  • 65bf73bee1a4 ftrace: Add global mutex to serialize trace_parser access
  • 95376fe9c145 fscrypt: Add missing superblock check in find_or_insert_direct_key()
  • a019b074903b fs: preserve ACL_DONT_CACHE state in forget_cached_acl()
  • c78e38745ff1 fs/super: fix emergency thaw double-unlock of s_umount
  • 89b9121c3b01 binfmt_elf_fdpic: only honour the first PT_INTERP
  • d309f8b52b34 ASoC: fsl_sai: Fix spurious BCLK on resume by clearing BYP
  • c4d77740eca2 ASoC: fsl: imx-card: Skip sysclk reset for active DAIs in shutdown
  • 1a644db2cf59 amt: fix use-after-free in AMT delayed works
  • 8f5a3abc54ba libceph: remove debugfs files before client teardown
  • 3b2f1937f5fc libceph: reject zero bucket types in crush_decode
  • e67e8b694872 libceph: Reject monmaps advertising zero monitors
  • 0060ec912292 libceph: refresh auth->authorizer_buf{,_len} after authorizer update
  • 4716a64b7cc2 libceph: guard missing CRUSH type name lookup
  • 1732d89dfcd7 libceph: Fix multiplication overflow in decode_new_up_state_weight()
  • 4e7ebfaa0d14 libceph: bound get_version reply decode to front len
  • 7d03e08b763f ceph: fix writeback_count leak in write_folio_nounlock()
  • a7c2dfa610a1 ceph: fix refcount leak in ceph_readdir()
  • a4228b93706f ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps()
  • 3bf0e349cbb4 sctp: close UDP tunnel sockets during netns teardown
  • be6aae9d1b91 sctp: avoid auth_enable sysctl UAF during netns teardown
  • 85aca407c560 sctp: don't free the ASCONF's own transport in DEL-IP processing
  • 3db217a4c2bd mm/huge_memory: set PG_has_hwpoisoned only after new folio head is established
  • ac7a6f61f56f mm/kmemleak: fix checksum computation for per-cpu objects
  • f2b293359924 afs: Fix afs_edit_dir_remove() to get, not find, block 0
  • d64f6c02495f mptcp: pm: userspace: fix use-after-free in get_local_id
  • 6cd3c3d63155 mptcp: only set DATA_FIN when a mapping is present
  • 6c936b5ad557 mptcp: decrement subflows counter on failed passive join
  • 35c4b274d4cc Revert "arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates"
  • 64ab0964c7db arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates
  • 9cd4b1a52eff arm64: make huge_ptep_get handled unaligned addresses
  • 9025946adec9 tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err()
  • 3b3be8653c59 tracing/probes: Fix potential underflow in LEN_OR_ZERO macro
  • 949ac1aeb37b tracing/probes: Avoid temporary buffer truncation in trace_probe_match_command_args()
  • 6b5098d74581 tracing/eprobe: Fix exact system name matching in eprobe_dyn_event_match()
  • b6a4575f2292 tracing: Fix union collision of module and refcnt for dynamic events
  • cf5a82bef623 tracing: Fix resource leak on mmiotrace trace_pipe close
  • 8464427e1c17 tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev
  • 1f2e7cd0ff97 tracing: Fix context switch counter truncation
  • 1da310b94504 misc: nsm: pin the module while the device is open
  • 8f068342096b misc: nsm: only unlock nsm_dev on post-lock error paths
  • caba30eb8bd3 intel_th: fix MSC output device reference leak
  • 59dd34854202 mei: bus: access mei_device under device_lock on cleanup
  • 511887235727 selftests: ntsync: correct CONFIG_NTSYNC name
  • b2a3eeb57ba2 serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms
  • 4fae473b856b serial: sc16is7xx: implement gpio get_direction() callback
  • 635be8b097f0 uio_hv_generic: Bind to FCopy device by default
  • cf26dd2d8415 comedi: comedi_parport: deal with premature interrupt
  • 9bb71b59e0aa x86/boot/compressed: Disable jump tables
  • 4f2db41a09eb firmware: stratix10-svc: fix memory leaks and list corruption bugs
  • 3ff7c1dbf722 rhashtable: clear stale iter->p on table restart
  • d43c5c0c9355 cdrom: fix stack out-of-bounds read in CDROMVOLCTRL
  • 4427a33faabb LoongArch: Retrieve CPU package ID from PPTT when available
  • 38b025fcdc45 LoongArch: Move jump_label_init() before parse_early_param()
  • 6ab0abb5a2e0 LoongArch: Fix oops during single-step debugging
  • a94d6726ec86 LoongArch: Fix address space mismatch in kexec command line lookup
  • c404b1f30b25 objtool/rust: add one more noreturn Rust function for Rust 1.99.0
  • 8ccfb3b315a0 rust: allow clippy::unwrap_or_default globally
  • 6db0c42c87c4 rust: time: fix as_micros_ceil() to round correctly for negative Delta
  • 12be1d75e9b2 rust_binder: only print failure if error has source
  • cc3bbff10b1a platform/loongarch: laptop: Explicitly reset bl_powered state when suspend
  • 1cd4e9b7967d binfmt_misc: set have_execfd only once the interpreter is opened
  • 2bc6bf70d410 exec: fix unsigned loop counter wrap in transfer_args_to_stack()
  • 780b04d09c94 Bluetooth: RFCOMM: Fix session UAF in set_termios
  • a42f5536ea9c Bluetooth: hci_sync: Protect UUID list traversal
  • 91eff666c907 staging: rtl8723bs: fix inverted HT40 secondary channel offset
  • 875479f18835 staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie()
  • 0dbaff14fd6a wifi: ath11k: fix refcount leak in ath11k_ahb_fw_resources_init()
  • efe9de178e4b wifi: brcmfmac: set F2 blocksize to 256 for BCM43752
  • 044fca8f45ba wifi: brcmfmac: make release_scratchbuffers idempotent
  • 9cb72f67e150 wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses
  • 263816e92e8d wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses
  • ab4d213393e8 wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses
  • e511e93abd6e wifi: wilc1000: validate assoc response length before subtracting header
  • 9375a4ea4121 wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper
  • 18965470d41e wifi: ath6kl: fix use-after-free in aggr_reset_state()
  • 58c6c8dc2e02 wifi: ath6kl: fix OOB access from firmware ADDBA window size
  • 1395327a9661 ALSA: timer: don't re-enter an instance callback that is still running
  • 426c0ff1c433 ALSA: timer: drain a slave's callback before its master detaches it
  • 3bc4de57fc7d ALSA: hda: codecs: hdmi: disable keep-alive before audio format change
  • 6a10025c7fd0 ALSA: seq: close a re-opened queue timer in the destructor
  • 2ec8f95a08fe ALSA: hda/realtek: Fix speakers on Lunnen Ground 14
  • 4091b216d11b media: vpif_capture: fix OF node reference imbalance
  • 1349af7f87df media: vivid: fix cleanup bugs in vivid_init()
  • 492c97cb50fe media: vivid: check for vb2_is_busy() when toggling caps
  • 26e7a8ac286f media: vivid: add vivid_update_reduced_fps()
  • 3780ad381071 media: vimc: fix reference leak on failed device registration
  • 86ece01fba2d media: vidtv: fix reference leak on failed device registration
  • 16ae8c166e78 media: verisilicon: Export only needed pixels formats
  • b88c929188e3 media: vb2: use ssize_t for vb2_read/vb2_write
  • 072a883061a4 media: v4l2-subdev: Fail {enable,disable}_streams and s_streaming nicely
  • cf9732fd6c4f media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor()
  • 3068ab802fc9 media: v4l2-ctrls: validate HEVC active reference counts
  • 836cfffb2ddb media: v4l2-ctrls-request: add NULL check in v4l2_ctrl_request_complete()
  • 7e6521dd747e media: ti: vpe: unwind v4l2 device registration on probe error
  • 127fc44e8325 media: tegra-video: vi: fix invalid u32 return value in format lookup
  • 118c2f5d1d36 media: synopsys: hdmirx: Fix HPD lane hold time
  • b5184b3f0e9d media: sun4i-csi: Return queued buffers on start_streaming() failure
  • 931abe1deb65 media: stm32: dcmi: unregister notifier on probe failure
  • ed342a86bb2f media: stm32-dcmipp: Return queued buffers on start_streaming() failure
  • b7936e8cbec1 media: saa7134: Fix a possible memory leak in saa7134_video_init1
  • a7a141e4e93c media: rzg2l-cru: Skip ICnMC configuration when ICnSVC is used
  • 894e83509c66 media: rtl2832_sdr: Return queued buffers on start_streaming() failure
  • 2c71bda6edc6 media: rtl2832: fix use-after-free in rtl2832_remove()
  • 64cb15878b35 media: radio-si476x: Unregister v4l2_device on probe failure
  • a58d01a0ed39 media: qcom: camss: Fix RDI streaming for CSID GEN3
  • c39a1d9fde82 media: qcom: camss: Fix RDI streaming for CSID GEN2
  • 4e451100b35e media: qcom: camss: Fix RDI streaming for CSID 680
  • cb16b79a2be2 media: pwc: Return queued buffers on start_streaming() failure
  • 9afd605dcd96 media: pwc: Drain fill_buf on start_streaming() failure
  • 08ddfd628a2d media: pci: dm1105: Free allocated workqueue
  • 4e077bcb5e1f media: nxp: imx8-isi: Fix scale factor calculation for hardware rounding
  • 28ae75dba701 media: nxp: imx8-isi: Fix potential out-of-bounds issues
  • 659a7cea0be8 media: nxp: imx8-isi: Fix missing v4l2_subdev_cleanup() in pipe init error path
  • 4702afbd56f1 media: nxp: imx8-isi: Clean up already-initialized pipes on probe failure
  • 9e61258fbc3c media: nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and pipe
  • 181a0aeefd56 media: nuvoton: npcm-video: fix memory leaks in probe and remove
  • 2147acb948a9 media: nuvoton: npcm-video: fix error handling in npcm_video_init()
  • 264b5380c4f8 media: msi2500: Return queued buffers on start_streaming() failure
  • 1391b75bf011 media: meson: vdec: Fix memory leak in error path of vdec_open
  • 18e3b838e09d media: marvell-cam: fix missing pci_disable_device() on remove
  • cf48e9db8565 media: iris: Fix use IRQF_NO_AUTOEN when requesting the IRQ
  • d56044558a75 media: intel/ipu6: Improve DWC PHY HSFREQRANGE band selection for overlapping ranges
  • 00a98fb2a6fb media: imx219: Fix maximum frame length in lines
  • 7337c88205ed media: i2c: alvium: fix critical pointer access in alvium_ctrl_init
  • c68c4ce72feb media: cx23885: add ioremap return check and cleanup
  • f468b7ee5d63 media: cx231xx: fix devres lifetime
  • f24ca8b53fe1 media: chips-media: wave5: Move src_buf Removal to finish_encode
  • 9924cb548ee7 media: cedrus: skip invalid H.264 reference list entries
  • 000e51afb606 media: cedrus: Fix missing cleanup in error path
  • 73504935e436 media: cedrus: clean up media device on probe failure
  • 6efe665356ec media: cec: seco: unregister adapter on IR probe failure
  • 0459a4304cff media: aspeed: fix missing of_reserved_mem_device_release() on probe failure
  • 391fe3e36e59 media: amlogic-c3: Add validations for ae and awb config
  • 73bd27798653 media: airspy: Return queued buffers on start_streaming() failure
  • a096a6aba601 drm/v3d: Reach the GMP through the hub registers on V3D 7.x
  • a2212fef8e18 drm/gpusvm: Fix MM reference leak in drm_gpusvm_range_evict
  • 6deaa3172018 drm/vc4: Prevent shader BO mappings from becoming writable
  • b1379f0c42b8 drm/vmwgfx: Validate vmw_surface_metadata::array_size
  • 2b85e19792be drm/amd/display: Fix missing DCE check in dm_gpureset_toggle_interrupts()
  • a38f2724eb93 drm/vc4: Shut down BO cache timer before teardown
  • ee44ea4f7e30 drm/amd/display: Fix flip-done timeouts on mode1 reset
  • ba7b6444097a drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved
  • fd2de80f28a0 drm/amdgpu: Disable PCIe dynamic speed switching on Ryzen Pinnacle Ridge
  • 490ceacd2162 drm/amd/display: Fix backlight max_brightness to match exported range
  • 9c0432044d34 drm/amd/display: Force PWM backlight on Lenovo Legion 5 15ARH05
  • 51ea665c30c4 drm/amd/display: dce100: skip non-DP stream encoders for DP MST
  • 0b9fa4272e24 drm/amd/display: consolidate DCN vblank/flip handling onto vupdate_no_lock
  • 679f23f0a360 drm/amd/display: set new_stream to NULL after release
  • 123692ebc1ea drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X)
  • d8dc3a9e815d drm/amdgpu: Fix VFCT bus number matching with soft filter
  • 312278b30919 drm/amdgpu: Release VFCT ACPI table reference
  • e64b2f1e826a drm/panthor: return error on truncated firmware
  • 22aa7fb4e7d0 drm/ttm: Account for NULL and handle pages in ttm_pool_backup
  • b2d8b66c6739 drm/virtio: Don't detach GEM from a non-created context
  • a4a1866d50c4 drm/gfx10: Program DB_RING_CONTROL
  • e163c5a0946d drm/amd/pm: fix smu14 power limit range calculation
  • e3bcd3bf7eec drm/i915/mst: limit DP MST ESI service loop
  • 726f27bca93e drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU
  • 37951ce1567c drm/i915/gem: Do not leak siblings[] on proto context error
  • 1173190412fb drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid()
  • 5df5a59c32b4 drm/amd/amdgpu: disable ASPM on VI if pcie dpm is disabled
  • 8b2da44446f9 drm/i915/bios: range check LFP Data Block panel_type2
  • cbec6a57959a drm/i915: Return NULL on error in active_instance
  • d20b5c139b29 drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON()
  • 09da54636bac drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON()
  • 51fd52087165 drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON()
  • 4c0948332536 drm/amdgpu/sdma7.0: replace BUG_ON() with WARN_ON()
  • 3d2ef8d38949 drm/i915/hdcp: check streams[] bounds before overflow
  • 1f876bd8adc7 drm/i915/hdcp: require monotonically increasing seq_num_v
  • 35be0e2c6862 drm/virtio: bound EDID block reads to the response buffer
  • 4ee77643e619 drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink reference
  • 8a77ccf9cb99 drm/amd/display: Handle struct drm_plane_state.ignore_damage_clips
  • abce3276c57e drm/amdkfd: fix 32-bit overflow in CWSR total size calculation
  • fd1691ec6270 drm/amdkfd: Check bounds on CRIU restore queue type and mqd size
  • 50319efb865f drm/amdkfd: Check bounds in allocate_event_notification_slot
  • 14a631dca9df drm/amdkfd: Use kvcalloc to allocate arrays
  • 6253bb56bb2e drm/imagination: acquire vm_ctx->lock before mapping memory to GPU VM
  • c45fafa69fe3 drm/imagination: fix error checking of pvr_vm_context_lookup()
  • b983a35dad37 drm/imagination: Fix user array stride in pvr_set_uobj_array()
  • c88fdbf3da26 drm/imagination: Fix double call to drm_sched_entity_fini()
  • c1954c66662d drm/xe: Hold a dma-buf reference for imported BOs
  • 038d0b80ab77 drm/xe: Fix PTE index in xe_vm_populate_pgtable() for chunked binds
  • 90a8a938e0ca drm/xe: Return error on non-migratable faults requiring devmem
  • 3e1f909556aa drm/radeon: fix r100_copy_blit for large BOs
  • fbb9effc8168 drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit()
  • 45db277b2e1e drm/i915/gem: Add missing nospec on parallel submit slot
  • 748d425e53c3 drm/displayid: fix Tiled Display Topology ID size
  • 5452eb5c1663 drm/sysfb: Return errno code from drm_sysfb_get_visible_size()
  • 154795885e8f drm/sysfb: Avoid possible truncation with calculating visible size
  • 4e109faa9ea2 drm/nouveau: fix reversed error cleanup order in ucopy functions
  • 315d2e5741a8 drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1
  • 3fb10ec43c25 drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT
  • 9c2b01508831 drm/amdgpu/gfx9: Fix Ring and IB test fail after mode2
  • f835eda74cf6 drm/sysfb: Avoid truncating maximum stride
  • 7daefc6d5195 drm/sysfb: Do not page-align visible size of the framebuffer
  • ddba17b3dfa0 drm/amdgpu: check amdgpu_vm_bo_find() result in GET_MAPPING_INFO
  • d068a2f53afc drm/amdgpu/uvd: Place VCPU BO only in VRAM for UVD 4.x and older
  • b3a01cda0ae1 drm/amdgpu/uvd: Fix forcing MSG, FB BOs into VCPU segment when it isn't at 0 (v2)
  • e28420e36542 drm/amdgpu/gfx: fix cleaner shader IB buffer overflow
  • d5c70523cafa drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers
  • e2c29d51c0f6 drm/imagination: Fit paired fragment job in the correct CCCB
  • 1e5827839ad0 drm/dp/mst: fix buffer overflows in sideband chunk accumulation
  • 533d9e2bede4 drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers
  • c0384d6872f4 drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS()
  • 943fa73ea0ef drm/imagination: Count paired job fence as dependency in prepare_job()
  • 6ab29a868357 drm/rockchip: analogix_dp: Add missing error check for platform_get_resource()
  • 50cd8a7e98dd drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video()
  • 86ab4d93b3d4 drm/tidss: Fix missing drm_bridge_add() call
  • 300a2d970a53 drm: renesas: rzg2l_mipi_dsi: Move rzg2l_mipi_dsi_set_display_timing()
  • aa8ad3e0d1fe drm: renesas: rzg2l_mipi_dsi: Increase reset deassertion delay
  • 786d690257ec bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg()
  • 3a924139cf52 net: airoha: fix ETS channel derivation in airoha_tc_setup_qdisc_ets()
  • 391a23c50385 mctp: check register_netdevice_notifier() error in mctp_device_init()
  • 74ecebfbf155 ptp: netc: explicitly clear TMR_OFF during initialization
  • 16df2d154ec8 rds: tcp: unregister sysctl before tearing down listen socket
  • 1db34097998c ipv6: Change allocation flags to match rcu_read_lock section requirements
  • 684d4d0bda95 ice: prevent tstamp ring allocation for non-PF VSI types
  • a32604e8d9e2 ice: fix LAG recipe to profile association
  • 3a8134546767 ice: allow creating VFs when !CONFIG_ICE_SWITCHDEV
  • 5d54d603cf3e net: ipv6: fix dif and sdif mismatch in raw6_icmp_error
  • e60e6009d3ba octeontx2-pf: tc: fix egress ratelimiting
  • d612754a515c net/mlx5e: Reject unsupported CB Shaper TSA in ETS validation
  • a7e430349fc5 net/mlx5e: Report zero bandwidth for non-ETS traffic classes
  • cdddc8188db4 net/mlx5: E-Switch, fix zero num_dest in prio_tag egress vlan rule
  • 87b39a8c875c net/mlx5: Fix MCIA register buffer overflow on 32 dword reads
  • 5f2ef3d53d37 net/mlx5: Refactor EEPROM query error handling to return status separately
  • 953d47cfe529 raw: annotate lockless match fields in raw_v4_match()
  • 8150c48fb978 net: qrtr: restrict socket creation to the initial network namespace
  • 0d57d43d7c4c hinic: remove unused ethtool RSS user configuration buffers
  • 8fc45a2a7cc2 ppp: annotate data races in ppp_generic
  • 19fe119dfa93 ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup
  • e037a41938c6 octeontx2-vf: set TC flower flag on MCAM entry allocation
  • 15a1c5f2ed2e net: gre: fix lltx regression for GRE tunnels with SEQ/CSUM
  • 55515c1b1285 net: stmmac: enable the MAC on link up for all supported speeds
  • 1bcb737fb884 net: stmmac: reset residual action in L3L4 filters on delete
  • 370dde2b70e5 net: stmmac: fix l3l4 filter rejecting unsupported offload requests
  • 55d2a8d184e2 net: stmmac: xgmac: fix l4 filter port overwrite on register update
  • 40413da85036 net: stmmac: cores: remove many xxx_SHIFT definitions
  • 4a3eea468a04 net: stmmac: socfpga: Add hardware supported cross-timestamp
  • 01d45e6b2c50 net: stmmac: socfpga: Enable TBS support for Agilex5
  • dac8c2ab943a net: stmmac: socfpga: Agilex5 EMAC platform configuration
  • d67136a931e5 net: stmmac: remove xstats.pcs_* members
  • 9f27c4f0ae35 bpf: tcp: fix double sock release on batch realloc
  • b43bb9ab6003 drm/tests: shmem: Set DMA mask to 64-bit in drm_gem_shmem
  • 1b8fb5a20508 tipc: fix u16 MTU truncation in media and bearer MTU validation
  • c8e4b2a567ef iomap: correct the range of a partial dirty clear
  • 279339aa8bdc drm/xe/vm: Fix SVM leak on resv obj alloc failure in xe_vm_create()
  • d18d9b2c29a1 drm/xe/i2c: Allow per domain unique id
  • 4fdb0f162ccd vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets
  • 18957373920c sctp: auth: verify auth requirement when auth_chunk is NULL
  • ae0ec759865e net: dpaa: fix mode setting
  • b5ded444621b net: hsr: fix memory leak on slave unregistration by removing synced VLANs
  • 17bb59682b8e net: bridge: vlan: fix vlan range dumps starting with pvid
  • 0a347ca1d6a2 amt: make the head writable before rewriting the L2 header
  • ca0e8b661957 amt: re-read skb header pointers after every pull
  • 9ec22c8113d8 ovl: check access to copy_file_range source with src mounter creds
  • 31f5f7c959c3 ovl: port ovl_copyfile() to cred guard
  • cde234a493f6 ovl: add override_creds cleanup guard extension for overlayfs
  • 35f0b504394e cred: add scoped_with_kernel_creds()
  • 3139b806923b drm/panel: s6e3ha8: fix unmet dependency on DRM_DISPLAY_HELPER
  • 790da254031c ovl: fix trusted xattr escape prefix matching
  • 00ebbf030d8c wifi: brcmfmac: fix 802.1X-SHA256 call trace warning
  • d5628f39fccc wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht()
  • 95b0cf02731c wifi: mt76: mt7925: fix crash in reset link replay
  • d14238523ca4 wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap()
  • 313343ab8cab wifi: mt76: mt7925: fix possible NULL-pointer deref in mt7925_mcu_bss_he_tlv()
  • c058786b09cf wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv()
  • 871549814eb4 wifi: mt76: mt7915: guard HE capability lookups
  • f1ee53e08fdd wifi: mt76: mt7925: guard link STA in decap offload
  • cc4d2f8b984c ppp: annotate concurrent dev->stats accesses
  • b52ff80948d1 ppp: don't store tx skb in the fastpath
  • cb9d3e0b5569 ppp: enable TX scatter-gather
  • e740e90ca8e7 tipc: fix infinite loop in __tipc_nl_compat_dumpit
  • d536bf205c71 nexthop: initialize extack in nh_res_bucket_migrate()
  • 961e9b1e3344 gtp: check skb_pull_data() return in gtp1u_send_echo_resp()
  • 023c5e0d0294 selftests: drv-net: increase timeout
  • fa065685c8a9 selftests: ovpn: increase timeout
  • e2b3d426c7ee selftests: ovpn: add IPV6 and VETH configs
  • 69eab5c4d9aa selftests: openvswitch: add config file
  • 340c389fd3d5 selftests: af_unix: add USER_NS config
  • fbd91910c502 tls: device: push pending open record on splice EOF
  • a8bd8c109da5 net: mctp i3c: clean up notifier and buses if driver register fails
  • 1a10fe1aa9c0 sctp: validate stream count in sctp_process_strreset_inreq()
  • c984a4184f81 pds_core: check for workqueue allocation failure
  • cf0ed2ba202f pds_core: fix auxiliary device add/del races
  • 0e87fe52b560 pds_core: order completion reads after the ownership check
  • 3a831f40e88d pds_core: yield the CPU while waiting for the adminq to drain
  • 9e0f80fac50a pds_core: fix use-after-free on workqueue during remove
  • 19ef775c91c6 pds_core: fix deadlock between reset thread and remove
  • 11092d79eb2b sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid
  • 2d34421bfa26 net: txgbe: fix FDIR filter leak on remove
  • 245bfe72a5ad net: Call net_enable_timestamp() before failure in sk_clone().
  • 412279292331 soreuseport: Clear sk_reuseport_cb before failure in sk_clone().
  • f97d19928768 amd-xgbe: fix MAC_AUTO_SW handling in CL37 AN
  • e695cb9becbb arm64: Correct value returned by ESR_ELx_FSC_ADDRSZ_nL()
  • f5b8b8ccf9a4 pds_core: reject component parameter in legacy firmware update
  • b5fcd1da0562 wifi: mac80211: recalculate TIM when a station enters power save
  • d06fea9b85f0 iommu/intel: Fix out-of-bounds memset in dmar_latency_disable()
  • e5ebe8544df1 iommu/amd: Bound the early ACPI HID map
  • d21464d93f8b wifi: mwifiex: bound uAP association event IEs to the event buffer
  • a0980682d84d vhost-net: fix TX stall when vhost owns virtio-net header
  • 59cbe6cfa0fa wan: wanxl: Only reset hardware after BAR mapping
  • 3b1d4fc3b73e nfp: Check resource mutex allocation
  • 0f7eaeb950ad wifi: mac80211: tear down new links on vif update error path
  • d053eb7e09e1 iommu/amd: Wait for completion instead of returning early in iommu_completion_wait()
  • 76fc5604308a net: airoha: Fix DMA direction for NPU mailbox buffer
  • f112df0744e2 dpaa2-eth: put MAC endpoint device on disconnect
  • 46e3bed4b071 net: airoha: Fix potential use-after-free in airoha_ppe_deinit()
  • 26ac2d360234 dpaa2-switch: put MAC endpoint device on disconnect
  • c9165e199f56 rxrpc: fix io_thread race in rxrpc_wake_up_io_thread()
  • b78547914bee gtp: parse extension headers before reading inner protocol
  • 959104253314 rds: drop incoming messages that cross network namespace boundaries
  • 992dce02bdab bonding: fix devconf_all NULL dereference when IPv6 is disabled
  • 1bc55c29cd85 net/packet: avoid fanout hook re-registration after unregister
  • 9f4f75df77c8 netlink: specs: rt-link: convert bridge port flag attributes to u8
  • 4264dbc84ca0 net: phy: marvell: fix return code
  • 8881daaafadb Bluetooth: btusb: validate Realtek vendor event length
  • 9d208de7a8f6 regulator: mt6358: use regmap helper to read fixed LDO calibration
  • 538d862cc0db hwmon: occ: validate poll response sensor blocks
  • 2f0f66199894 ovpn: use monotonic clock for peer keepalive timeouts
  • 5b96227c0e8b ovpn: fix use after free in unlock_ovpn()
  • 47cd68e050a6 selftests/net: ovpn: fix getaddrinfo memory leak in ovpn_parse_remote()
  • c5bf6b39be23 ovpn: avoid putting unrelated P2P peer on socket release
  • 2fdd6d196c65 smb: client: validate DFS referral PathConsumed
  • d6959dd79088 hwmon: (asus-ec-sensors) add missed handle for ENOMEM
  • dd6f730be95b hwmon: (asus-ec-sensors) fix EC read intervals
  • 22e449c1dd54 hwmon: (asus-ec-sensors) fix looping over banks while reading from EC
  • d5913f97b5b6 drivers/virt: pkvm: Fix end calculation in mmio_guard_ioremap_hook()
  • d0a57f19fe28 usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect
  • 2d5dec517b53 wifi: iwlwifi: mvm: fix read in wake packet notification handler
  • eae7fdf7d446 wifi: iwlwifi: validate payload length in iwl_pnvm_complete_fn
  • 70a6de303c9b wifi: iwlwifi: fix pointer arithmetic in iwl_add_mcc_to_tas_block_list
  • a076b0c457c7 wifi: iwlwifi: mvm: validate SAR GEO response payload size
  • cdf895bfd803 ASoC: cs35l56: Use complete_all() to signal init_completion
  • 3c26e8bb14cc ASoC: cs35l56: Fix potential probe() deadlock
  • 1ddb3e0e502a ASoC: cs35l56: Don't use devres to unregister component
  • 9153fa1ee99b ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI
  • 08433c71f159 ALSA: hda: cs35l41: validate and free ACPI mute object
  • eca9fcf9f5d8 ASoC: sun4i-codec: Set quirks.playback_only for H616 codec
  • 41ae2b7d37c3 ASoC: tas2781: bound firmware description string parsing
  • 797dc567146c btrfs: free mapping node on duplicate reloc root insert
  • 9304713b70e7 btrfs: don't propagate EXTENT_FLAG_LOGGING to split extent maps
  • 39f196f64bd3 btrfs: fix u32 to s64 type conversion in dirty_metadata_bytes accounting
  • f49ff44831d5 btrfs: declare btrfs_ioctl_search_args_v2::buf as __u8
  • 450382984335 wifi: carl9170: fix buffer overflow in rx_stream failover path
  • fab6ff91d5b8 wifi: carl9170: fix OOB read from off-by-two in TX status handler
  • 9aee949c68dc wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read
  • 33b5342d2080 wifi: ath6kl: fix OOB read from firmware IE lengths in connect event
  • eb636fbc4431 wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler
  • 0177e578d7a8 firewire: net: Fix fragmented datagram reassembly
  • 51516fda914c wifi: ath12k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET
  • 9a9b0ea72d8b wifi: ath11k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET
  • a154ca3c441a wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get()
  • 8681e5addf71 watchdog: airoha: Prevent division by zero when clock frequency is zero
  • 7d1658b066de watchdog: pretimeout: Fix UAF in watchdog_unregister_governor()
  • 305c23993e43 hwmon: (nzxt-kraken3) Stop device IO before calling hid_hw_stop
  • 205cff797a94 hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop
  • f36e12cc8cfe hwmon: (gigabyte_waterforce) Stop device IO before calling hid_hw_stop
  • 56d2deb64483 hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop
  • ec477af3a7e8 hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop
  • e5394605f9a9 wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin
  • 48a69cedde73 wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request
  • 593072aae7fc selftests/bpf: Keep verifier_map_ptr exercising ops pointer access
  • 938bcf99f53e selftests/bpf: Adjust verifier_map_ptr for the map's excl field
  • fe7892d46921 usb: xhci-pci: Limit VIA VL805 DMA addressing to 36 bits
  • 958624d63860 Revert "drm/amd/display: Add missing kdoc for ALLM parameters"
  • 03eb7a809947 RISC-V: KVM: Serialize virtual interrupt pending state updates
  • 731acda5ba77 wifi: mwifiex: fix freeze for 60 seconds caused by request_firmware
  • 0905b3ce1deb usb: typec: ucsi: Add duplicate detection to nvidia registration path
  • fe8cde072293 usb: typec: ucsi: Detect and skip duplicate altmodes from buggy firmware
  • 67d2626827e3 USB: serial: option: add TDTECH MT5710-CN
  • 601f75671b8f USB: serial: keyspan_pda: fix data loss on receive throttling
  • cbe00048b69d USB: serial: io_edgeport: cap received transmit credits
  • c1611c6744e3 USB: serial: ftdi_sio: add support for E+H FXA291
  • 1f03658f3e9b usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer
  • dcf3e2f16443 usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown
  • 40c706a0224b usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb()
  • 12b3edca90d4 USB: gadget: fsl-udc: fix dev_printk() device
  • 66956a5a4258 USB: gadget: fsl-udc: fix device name leak on probe failure
  • e5ecfb776752 USB: gadget: snps-udc: fix device name leak on probe failure
  • 4cde0b38cc0c usb: gadget: printer: fix infinite loop in printer_read()
  • f45089eaad0a usb: gadget: f_midi: cancel pending IN work before freeing the midi object
  • e239ea91b481 usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback
  • ace1a0adfc78 usb: chipidea: fix usage_count leak when autosuspend_delay is negative
  • 8eca14198c20 USB: storage: add NO_ATA_1X quirk for Longmai USB Key
  • 0950ac52426b usb: musb: omap2430: Do not put borrowed of_node in probe
  • 7714fb896ed3 usb: core: port: Deattach Type-C connector on component unbind
  • fb1b50ab6992 wifi: at76c50x-usb: avoid length underflow in at76_guess_freq()
  • 217774e143d7 usb: core: sysfs: add lock to bos_descriptors_read()
  • 5f6e7b32bd1f mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n
  • a8d20ba0ab51 sctp: fix auth_hmacs array size in struct sctp_cookie
  • fed1b1ddab41 net/sched: act_tunnel_key: Defer dst_release to RCU callback
  • 51c2fcc4cd2e dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync()
  • e666af5dcc90 tcp: fix TIME_WAIT socket reference leak on PSP policy failure
  • 6875ee2bef48 accel/amdxdna: Fix use-after-free of mm_struct in job scheduler
  • f6b522033bc8 drm/i915/selftests: Fix GT PM sort comparators
  • c23abdb922c3 drm/i915/wm: clear the plane ddb_y entries on plane disable
  • f0e337e7db67 ksmbd: validate compound request size before reading StructureSize2
  • 6ecb252efa0b ksmbd: pin conn during async oplock break notification
  • 5e5f298d0af6 drm/xe/wopcm: fix WOPCM size for LNL+
  • 35ba43b54111 drm/xe/vf: Fix VF CCS attach/detach race with in-flight BO moves
  • c1b19d855626 drm/xe/vf: Shadow buffer management for CCS read/write operations
  • bf293b5bcff4 drm/xe/sa: Shadow buffer support in the sub-allocator pool
  • 65129a03a801 drm/xe: Allow the caller to pass guc_buf_cache size
  • cfb66ad4aa8e can: j1939: fix lockless local-destination check
  • 3f398d45f3c7 riscv: hwprobe: Avoid uninitialized read in hwprobe_get_cpus()
  • 1d9a2f01b3c4 s390/checksum: Fix csum_partial() without vector facility
  • 5b06cf93341f drm/panthor: Check debugfs GEM lock initialization
  • 250474c69bc3 bpf, sockmap: Reject unhashed UDP sockets on sockmap update
  • c3e61df6fabc powerpc/vtime: Initialize starttime at boot for native accounting
  • 5c3a1cede86f powerpc/time: Prepare to stop elapsing in dynticks-idle
  • c1bbd0a6906b powerpc/85xx: Add fsl,ifc to common device ids
  • 00ba4bf87982 can: raw: add locking for raw flags bitfield
  • 479425744b21 drm/i915/gt: use correct selftest config symbol
  • 7e08ab7a061b smb/client: handle overlapping allocated ranges in fallocate
  • cefb44c367b2 Bluetooth: hci_qca: Clear memdump state on invalid dump size
  • d5b3b484b62b Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds
  • ca58ad287bfc Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync
  • 83b7e67698d0 Bluetooth: hci_sync: extend conn_hash lookup critical sections
  • 57059ff14d81 Bluetooth: MGMT: revalidate LOAD_CONN_PARAM queued update
  • a087ed960fce Bluetooth: qca: fix NVM tag length underflow in TLV parser
  • f4e23e661a25 ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC
  • b133f007ba02 accel/ivpu: Fix wrong register read in LNL failure diagnostics
  • 1842d45f461a ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning
  • d28920db5696 ata: sata_dwc_460ex: fix clear_interrupt_bit() clearing all pending interrupts
  • 678d874e6ae1 ata: sata_dwc_460ex: use platform_get_irq()
  • daa80b422ed9 ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered
  • c7a150912372 scsi: core: wake eh reliably when using scsi_schedule_eh
  • 2c77ed279c4b udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf()
  • c75a950e7735 net/iucv: take a reference on the socket found in afiucv_hs_rcv()
  • cb8be318b443 ipv4: fib: free fib_alias with kfree_rcu() on insert error path
  • c9574b8a8ede ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF
  • 88f87cb4b52e cpufreq: Make cpufreq_update_pressure() fall back to cpuinfo.max_freq
  • 640a33e77f91 firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context
  • fb343716fad4 ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup
  • 7f2cb99eaf53 ASoC: cs42l43: Correct report for forced microphone jack
  • 9f393d816043 ASoC: amd: ps: replace bitwise OR with logical OR in IRQ return check
  • 3b2d32f52815 ASoC: amd: ps: fix wrong ACP version string in pci_request_regions()
  • f33ad19e3e3d ASoC: amd: ps: disable MSI on resume in ACP PCI driver
  • 4801f6690f98 ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop
  • b39b08e6bee8 firmware: arm_ffa: Fix Endpoint Memory Access Descriptor offset calculation
  • cf5708c9d78c firmware: arm_ffa: Fix out-of-bound writes in ffa_setup_and_transmit()
  • 11ac7a5e75f5 wifi: cfg80211: bound element ID read when checking non-inheritance
  • 5c342437ea44 wifi: brcmfmac: initialize SDIO data work before cleanup
  • a424985c3ef2 wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock
  • 44eda4a8d1dc wifi: mac80211: avoid non-S1G AID fallback for S1G assoc
  • fbaa8c31ef94 wifi: cfg80211: reject unsupported PMSR FTM location requests
  • cfbda103aeae wifi: cfg80211: validate PMSR FTM preamble range
  • 0caf6416bfbb wifi: cfg80211: validate PMSR measurement type data
  • 0b6efde0ed97 wifi: nl80211: constrain MBSSID TX link ID range
  • f8c547e543e1 wifi: nl80211: validate nested MBSSID IE blobs
  • f649dc9c5e65 wifi: cfg80211: derive S1G beacon TSF from S1G fields
  • fb052a6e2fa8 wifi: nl80211: free RNR data on MBSSID mismatch
  • 133684982dd0 wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock
  • d38f5d868a0a wifi: p54: validate RX frame length in p54_rx_eeprom_readback()
  • 2aa1789880fa wifi: mac80211: defer link RX stats percpu free to RCU
  • 6cda91bbb8dc wifi: libertas: fix memory leak in helper_firmware_cb()
  • 5baaa1042f71 wifi: mac80211: fix fils_discovery double free on alloc failure
  • d62b55b7c7dc wifi: mac80211: fix unsol_bcast_probe_resp double free on alloc failure
  • 6dc76371a9a3 wifi: mac80211_hwsim: clamp virtio RX length before skb_put
  • e67dc2b8d5ac wifi: cfg80211: Fix an error handling path in cfg80211_wext_siwscan()
  • f442e581a889 wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one()
  • 9293574ac208 wifi: cfg80211: cancel sched scan results work on unregister
  • 7acc5ed2f336 xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert
  • ff636d7b7cba xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst()
  • d8aaf06b29f5 xfrm: iptfs: propagate SKBFL_SHARED_FRAG in iptfs_skb_add_frags()
  • 9845a35986a6 xfrm: clear mode callbacks after failed mode setup
  • 9e632a70f204 RDMA/irdma: Prevent overflows in memory contiguity checks
  • 124382a2a975 selftests/alsa: Fix memory leak in find_controls error path
  • f98ae09c727d mtd: fix double free and WARN_ON in add_mtd_device() error paths
  • fcc9d50022bc RDMA/siw: publish QP after initialization
  • e221dde026af RDMA/hns: Fix potential integer overflow in mhop hem cleanup
  • d842ef03d914 RDMA/mana_ib: initialize err for empty send WR lists
  • 14e519f93a48 RDMA/erdma: initialize ret for empty receive WR lists
  • ec675b4cdfd3 RDMA/irdma: Prevent user-triggered null deref on QP create
  • 1cd56258fe1a RDMA/irdma: Remove redundant legacy_mode checks
  • ca1c29f05274 RDMA/irdma: Prevent rereg_mr for non-mem regions
  • dbb945b80a3a RDMA/umem: Add pinned revocable dmabuf import interface
  • c4ef25de94d7 RDMA/cma: Fix hardware address comparison length in netevent callback
  • d7fc6f351c47 xfrm: reject optional IPTFS templates in outbound policies
  • 2907e9d0f05b sched_ext: Don't warn on core-sched forced idle in put_prev_task_scx()
  • 57acd5192833 sched/ext: Avoid null ptr traversal when ->put_prev_task() is called with NULL next
  • 996c5c19d5b5 firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get()
  • 8edc92525178 btrfs: fallback to transaction csum tree on a commit root csum miss
  • a84ca16ce07e btrfs: use bool type for btrfs_path members used as booleans
  • 60a23d4ea169 btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots()
  • 5e1b2ca6b349 btrfs: reject free space cache with more entries than pages
  • 0ac9c7d9ccfd mtd: nand: mtk-ecc: stop on ECC idle timeouts
  • fdb53a9b2607 mtd: mtdswap: remove debugfs stats file on teardown
  • 98d2d468b4fa IB/mad: Drop unmatched RMPP responses before reassembly
  • 59114e0ff6e3 firmware: arm_ffa: Respect firmware advertised RX/TX buffer size limits
  • 33e1b0d25ca0 xfrm: fix stale skb->prev after async crypto steals a GSO segment
  • eae16fbc7ce2 xfrm: propagate -EINPROGRESS from validate_xmit_xfrm()
  • 23bbb9eafec7 net: plumb drop reasons to __dev_queue_xmit()
  • 4cc4d6fb08e7 net: dropreason: add SKB_DROP_REASON_RECURSION_LIMIT
  • 4c22b4e3ff50 arm64: tegra: Fix CPU compatible string to cortex-a78ae on Tegra234
  • 0b9858484d09 arm64: tegra: Remove fallback compatible for GPCDMA
  • 903f2edc0477 fuse: fix writeback array overflow when max_pages is one
  • afe9cda0862a Input: ims-pcu - fix logic error in packet reset
  • d03a740e087d Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data()
  • 6cbed4be9a6c xprtrdma: Clear receive-side ownership pointers on release
  • 0892b427c4b8 crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin
  • 5f4de3c717d3 gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings
  • ec9f66c91bff dmaengine: sh: rz-dmac: Move interrupt request after everything is set up
  • eca8b44d51fc can: bcm: track a single source interface for ANYDEV timeout/throttle ops
  • 136de17f3863 can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler()
  • 6be3e1fedf03 can: bcm: fix stale rx/tx ops after device removal
  • b024c21c9066 can: bcm: add missing device refcount for CAN filter removal
  • deb6a697cce3 can: bcm: validate frame length in bcm_rx_setup() for RTR replies
  • bd46f55dec60 can: bcm: extend bcm_tx_lock usage for data and timer updates
  • 8104bcdb2612 can: bcm: fix CAN frame rx/tx statistics
  • 19b1994069dd can: bcm: add locking when updating filter and timer values
  • ec9daa8fd1b6 KVM: x86/mmu: Fix use-after-free on vendor module reload
  • 8001d2ce9d9b KVM: nVMX: Hide shadow VMCS right after VMCLEAR
  • dd50ad7935d5 KVM: x86: Only reset TSC Deadline Timer in apic_timer_expired on KVM_RUN
  • f3477a6a4164 KVM: x86: Check for invalid/obsolete root after making MMU pages available
  • 865dfe76c150 seqlock: Allow UBSAN_ALIGNMENT to fail optimizing
  • 3958b1aeef43 seqlock: Allow KASAN to fail optimizing
  • ec46baf83082 seqlock: Cure some more scoped_seqlock() optimization fails
  • 8e39ed92d7c5 fs/proc/task_mmu: fix make_uffd_wp_huge_pte() prot-update race
  • 89890a5fcefa drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker
  • f6410d18c1e2 netfilter: nf_tables: revert commit_mutex usage in reset path
  • 0c8a9022f4c5 netfilter: nft_quota: use atomic64_xchg for reset
  • cd968dcdec6a netfilter: nft_counter: serialize reset with spinlock
  • 55904f1a4689 selftests/bpf: Add tests for ld_{abs,ind} failure path in subprogs
  • ce01a4e5cfac bpf: Fix ld_{abs,ind} failure path analysis in subprogs
  • bffc0b27e457 platform/x86/intel-uncore-freq: Fix current_freq_khz after CPU hotplug
View original

Upgraded? How did it go?

Discussion