XanMod Kernel 6.18.47-rt-xanmod1

6.18.47-rt-xanmod1
Fixed 20
  • Fix GRO BIG TCP aggregation validation to properly check criteria
  • Prevent ptp vmclock read-only mappings from becoming writable
  • Fix private hash use-after-free on final put in futex
  • Validate Bluetooth firmware segment lengths in hci_aml
  • Reject HCI_CMD_SYNC with params_len above 255 in Bluetooth MGMT
  • Zero the sockaddr before returning it in Bluetooth ISO getname

From XanMod Kernel

  • 782e1ccebdad Linux 6.18.47-rt-xanmod1
  • 48fc777af830 Merge branch '6.18' into 6.18-rt
  • b260538251f0 Linux 6.18.47-xanmod1
  • 3cefea4ac89f Merge tag 'v6.18.47' into 6.18
  • 7519e95095c9 Linux 6.18.47
  • 3ce832e2bd43 net: gro: properly validate BIG TCP aggregation criteria
  • 5b4f2bec7bea ptp: vmclock: prevent read-only mappings from becoming writable
  • dba60d26e9dd futex: Avoid private hash use-after-free on final put
  • e1534d49a7b8 Bluetooth: hci_aml: validate firmware segment lengths
  • b7d9edcf9fe6 Bluetooth: MGMT: reject HCI_CMD_SYNC params_len above 255
  • 1f6d1f2611af Bluetooth: ISO: zero the sockaddr before returning it in getname
  • 753af97d8d42 Bluetooth: ISO: do not force BT_LISTEN after a failed BIG sync
  • fe93a697a7a9 Bluetooth: hci_sync: Fix accept list UAF during suspend
  • e3f82e8f2a59 Bluetooth: hci_event: validate LE Set CIG Parameters response
  • 39a3afb91be3 Bluetooth: hci_event: fix LE list UAF on reset
  • 608f8fd8c0f7 HID: hyperv: validate initial device info bounds
  • 849e537160bb HID: uclogic: fix use-after-free of inrange_timer on remove
  • 8406d4b69d48 HID: sensor: custom: Fix use-after-free in enable_sensor
  • 1fa1591efd41 HID: core: fix number/pointer type confusion on long items
  • 5efcd7bbfaae HID: nintendo: stop device IO before hid_hw_stop on probe failure
  • 268679f50138 HID: nintendo: register input device after capabilities are set
  • 51cfd1adbe7a HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler()
  • 942b89f7824f futex: Fix might_sleep() warning in futex_pivot_pending()
  • 86d12b34bafc futex: Fix race on the initial mm->futex.phash.ref allocation
  • fdf538b2e696 futex/pi: Plug private futex exec() race
  • 4da67def9efe futex: Sanitize and document task_struct::futex::state transitions
  • 2b92e5562653 futex/pi: Reject cross-mm private futex owners
  • f303f6a4c909 Input: atkbd - skip deactivate for HONOR ZQC-P
  • 936ea65543da Input: atkbd - skip deactivate for HONOR FMB-P's internal keyboard
  • 0ea8f0645401 xfrm: fix sk_dst_cache double-free in xfrm_user_policy()
  • 39fc615e355b net/ionic: avoid OOB TX partner lookup for hwstamp RXQ
  • 4529c03c3da8 HID: pidff: fix OOB write when hid->inputs is empty
  • 9a1d7c5f0d82 HID: core: fix OOB read of field->usage in hid_set_field()
  • ace7fc4d3879 HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID
  • 15b60ade825c HID: magicmouse: do not keep a stale msc->input if no input is claimed
  • 62ec3c591ee8 HID: magicmouse: re-enable multitouch after reset-resume
  • 02a88f8308ae HID: magicmouse: fix battery reporting for Bluetooth Magic Trackpad USB-C
  • b6baab796d11 ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses
  • 9fe5eebb664e mptcp: pm: fix memory leak from alloc-during-teardown race
  • 6fa2064761ec mptcp: pm: uniform announced addresses helpers
  • 714c6d11acea mptcp: pm: rename add_entry structure to add_addr
  • defc59e74c1b mptcp: pm: use for_each_subflow helper
  • f31650243c1a nvmet: pci-epf: put CQ ref on create_cq mapping failure
  • 20be486d1c22 nvmet: pci-epf: fix use-after-free in nvmet_pci_epf_exec_iod_work()
  • 9c95f7e66c62 nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations
  • 6d27199ebe8c nvmet-tcp: bound SGL data length before allocating command buffers
  • 8bce9cd08aae nvmet-fc: fix invalid free in LS IOD error path
  • b26189d28442 nvmet-auth: zero the AUTH_RECEIVE response buffer
  • 23a475ff24d2 dmaengine: fsl-edma: Add error handling for devm_kasprintf
  • 364edaedf412 mailbox: mchp-ipc-sbi: Add null check for devm_kasprintf()
  • 3dc98e5fe82d ipv6: fix use-after-free in ip6_finish_output2()
  • d9d1a676b033 ipv4: reject undersized MTUs in ip_do_fragment()
  • f03415030579 drm/xe: Fix DPT allocation paths.
  • 20892d2923e4 nfc: nci: free destination parameters when closing a connection
  • 0d4b5cfab689 nfc: nci: fix uninit-value in the RF discover/activated NTF handlers
  • 2f08dbce3b37 nfc: nci: fix out-of-bounds write in nci_target_auto_activated()
  • 9620a91f8d64 nfc: nci: add data_len bound checks to activation parameter extractors
  • bfcca5f42c9a nfc: st21nfca: validate ATR_REQ length against the received frame
  • 2f5d093194ec nfc: pn533: purge fragmented skbs during cleanup
  • e969e9841005 nfc: llcp: reject PDUs shorter than the LLCP header
  • 2d239590d184 nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers
  • e87527b506c4 nfc: llcp: bound the connect_sn TLV walk to the skb
  • d0902a7c4543 nfc: microread: validate target discovery payload lengths
  • db7e464b3509 nfc: fdp: bound the device-reported read length and fix an skb leak
  • a56773e649ea nfc: digital: clamp SENSF_RES length to the destination buffer
  • cb8246e5846d libceph: fix OOB read in decode_watchers() via missing bounds check
  • 184c1a80421a xfs: validate attr entry pointer before field access
  • e0e7f464d6ce ext4: fix incorrect function call when initializing s_resgid
  • 458776af0061 ext4: don't enable DAX on new encrypted files
  • f3d2fa3a9933 ext4: propagate errors from fast commit range replay
  • 5f46f084f74b ext4: avoid tail write_begin walk for uptodate folios
  • fb5980fbe44f ext4: clear error before retrying inode xattr space fallback
  • e447f7edb99b nilfs2: reject invalid block index in GC ioctl
  • 4902a5cba21a ext4: stop retrying saturated xattr cache entries
  • e11f5b48c827 kcov: fix data corruption and race conditions on PREEMPT_RT
  • 164ca33cf536 null_blk: fix UBSAN shift-out-of-bounds when zone_size is 0 or overflows
  • 6176313622e3 ocfs2: fix missing metadata reservation for large xattrs
  • 15ccf5370985 io_uring/uring_cmd: don't skip completion for a synchronous multishot cmd
  • 45c945107e00 io_uring/rsrc: fix folio size overflow in io_vec_fill_bvec()
  • 4074ae2f1da9 io_uring/io-wq: fix worker accounting when canceling creation callbacks
  • b6a768aa975b io_uring/cmd: fix iovec leak when the async cmd is not recycled
  • f20c2c32ec1c ALSA: dummy: Check card index validity at probe
  • 3da64f2ed902 io_uring/futex: don't mark futex wake requests as inflight
  • 61dc1a37e04d nvmet: fix NULL pointer dereference in nvmet_execute_identify_nslist()
  • e971d956353d rndis_host: add overflow check in rndis_rx_fixup()
  • 4305e4b52acc ALSA: scarlett2: Use a private URB for the notification endpoint
  • 65aceb45ca91 ALSA: FCP: Use a private URB for the notification endpoint
  • 7596354148c5 iommu/iommufd: Fix NULL pointer deref in iommufd_ioas_change_process when racing with iopt_map_file_pages
  • d2ab08437e91 iommu/tegra241-cmdqv: Fix CMD_SYNC use-after-free on teardown
  • d4b1a13b1eff Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept
  • 0c55707bd5d0 PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems
  • 159d162fe80b xfs: don't livelock in scrub on a circular unlinked list
  • a05a1b663464 xfs: hoist per-bucket unlinked list check to helper
  • 8d678be8e58e xfs: rtsummary scrub should treat rtbitmap corruption errors as an xref error
  • 00e2baf0b5ea xfs: add a xchk_ip_set_corrupt helper
  • 755d0b7ee356 serial: sc16is7xx: enable THRI before filling TX FIFO
  • c5a12344a043 serial: sc16is7xx: use guards for simple mutex locks
  • 450fe8f6f1f8 serial: sc16is7xx: rename EFR mutex with generic name
  • d3fea146457b Linux 6.18.46-xanmod1
  • 8c0d3dba26dc Merge tag 'v6.18.46' into 6.18
  • 1f99e9ab748f Linux 6.18.46
  • b7ce4b3bc106 ALSA: hda/realtek: Enable headset mic on F+ FLAPTOP r
  • 192f44513a03 firewire: ohci: initialize page array to use alloc_pages_bulk() correctly
  • e5e6ce7009a6 drm/vmwgfx: Set surface-framebuffer GEM objects
  • 7e351209dc2f erofs: fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS on some UP platforms
  • 67ac7e01c26b spi: virtio: mark device ready before registering the controller
  • a7d172b27aa3 drm/log: Fix infinite loop when scale is too large for display
  • a6325e2807dc drm/client: Remove drm_client_framebuffer_delete()
  • 329731b3119f drm/client: Deprecate struct drm_client_buffer.gem
  • 0763282e689e drm/client: Inline drm_client_buffer_addfb() and _rmfb()
  • 60f1a2ecdf8b drm/client: Move dumb-buffer handling to drm_client_framebuffer_create()
  • 841bc853a2b1 drm/client: Remove pitch from struct drm_client_buffer
  • 16a2716910ec drm/log: Fix out-of-bounds read on empty message length
  • 948f346fe36e drm/xe/oa: Fix sync entry leak on OA config emit failure
  • ed5470771c7e firewire: ohci: fix NULL pointer dereference in ar_context_release
  • 384d9f04b38f firewire: ohci: split page allocation from dma mapping
  • adb3e7c26a51 net/sched: cls_bpf: reject dev-bound programs bound to a different device
  • 1f493c44a2f0 accel/amdxdna: Skip unmapped range in aie2_populate_range()
  • 72e4e3d7efc3 net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG
  • 6cf600b276a5 regmap: sdw-mbq: don't call an unset readable_reg callback
  • c27eed546ae2 m68k: Define NR_CPUS to 1
  • 31f26a95eeee net/sched: cls_u32: skip hash tables in u32_bind_class()
  • abceabc4408f net/sched: act_api: fix TOCTOU NULL deref on a->goto_chain
  • 98c5914d6b7b af_packet: Don't send zero-byte data in tpacket_snd().
  • 37c5ccaaacd4 regmap: sdw-mbq: Fix swap of timeout and retry times
  • f51a540b14ee ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers
  • 82d9269f01eb net/tls: Fail tls_sw_splice_read() after a failed async decrypt
  • cef4c5b9aca2 net: ngbe: fix NULL pointer dereference in non-MSI-X interrupt enabling
  • 5ffaa5d7f56a net: tap: fix wrong transport_header when sending VLAN-tagged frame
  • f9297abbcaba net: packet: fix wrong transport_header when sending VLAN-tagged frame
  • 0af3afd054e7 net: phy: realtek: fix EEE advertisement write on the internal PHY MMD path
  • 17e3181d740d tcp: fix icsk_ack.ato bitfield overflow
  • 73f8dd22b1e5 veth: fix queue index used to wake the peer txq in veth_poll
  • 96fa90b74385 macvlan: inherit needed_headroom and needed_tailroom from lowerdev
  • 5f33188457bb ipvlan: inherit needed_headroom and needed_tailroom from phy_dev
  • 1072f0f44282 eth: bnxt: keep the aRFS rmap updated when TPH is enabled
  • 394f1b16c5d1 eth: bnxt: cancel IRQ notifier before freeing affinity mask
  • a26a1be1b654 netfilter: ipset: let destroy callbacks adjust ext mem size
  • 29c011b3537d netfilter: ipset: fix list type element drift bug
  • d9d3050a70ef netfilter: flowtable: publish GC-visible tuple last
  • 4a923fe60939 netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path
  • cb20da33839f netfilter: ipset: fix refcount race between list:set GC and swap
  • 9e75e7da4374 ASoC: tas2781: fix clang build error for goto bypassing cleanup variable
  • 24d0f33f5415 gpio: ml-ioh: share the register lock across channels
  • 7a03413f31c1 perf: Reject exited events as group leaders
  • 6c85d169eeec riscv: ftrace: Fix ftrace_modify_call failure on kprobed functions
  • a3a676495c64 ovpn: finish crypto callback cleanup before peer release
  • a47a080d06ee ovpn: fix NULL dereference when killing missing key
  • 99a18e1d979e crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req()
  • 3e4bf50c9451 crypto: ccm - Set rfc4309 maxauthsize from child
  • d9ecc9787e11 arm64: tegra: Add EL2 virtual timer interrupt for Tegra194
  • a4e340971fe8 NTB: ntb_netdev: Preserve RX queue depth on allocation failure
  • 08437c5156b0 net: ntb_netdev: Introduce per-queue context
  • 2a7d8fc0fd50 ASoC: SOF: ipc4-topology: Refresh copier IPC payload before widget setup
  • 8c685df5c3b2 drm/amd/pm: fix pptable use-after-free
  • 2895aeb4327c drm/amd/pm: adjust the visibility of pp_table sysfs node
  • 7755be923e32 mm/page_table_check: skip special zero mappings
  • 4ae625d16eef ring-buffer: Prevent resizing of persistent ring buffer
  • 54fc67500ad1 ring-buffer: Store bpage pointers into subbuf_ids
  • 27d7fcaf237d ring-buffer: Add helper functions for allocations
  • 2ca6b43edf83 sched_ext: Take cgroup_lock() first in scx_cgroup_lock()
  • f786e6652b93 sched_ext: Reorganize enable/disable path for multi-scheduler support
  • 0907f81536f7 sched_ext: Update p->scx.disallow warning in scx_init_task()
  • 4a7e941ca29a futex: Fix race in futex_pivot_pending() during private hash resize
  • 870f8392b284 can: rcar_canfd: change the initializing flow for clocks and resets
  • 45bf067681ad can: rcar_canfd: Extract rcar_canfd_global_{,de}init()
  • e7a4ca927857 can: rcar_canfd: Use devm_clk_get_optional() for RAM clk
  • f8c8c81707d1 can: rcar_canfd: Invert global vs. channel teardown
  • 562d4befa935 can: rcar_canfd: Invert reset assert order
  • 867aed6a4848 binfmt_misc: don't leak the user namespace when the mount fails
  • 4c8d7595a10a ata: libata-scsi: terminate deferred commands on time out
  • db488d653d89 ASoC: tas2562: Validate values for volume writes
  • 5f0a99ea7212 KVM: x86: Cancel delayed I/O APIC EOI handling before destroying vCPUs
  • ef60eca789ee userfaultfd: wait on source PMD during UFFDIO_MOVE
  • ea563ed2b10a mm: replace pmd_to_swp_entry() with softleaf_from_pmd()
  • 54a09573eb44 fs/proc/task_mmu: refactor pagemap_pmd_range()
  • 549148d5aa4e btrfs: zoned: fix missing chunk metadata reservation
  • 58ae8b7e8dc8 btrfs: remove fs_info argument from btrfs_zoned_activate_one_bg()
  • d9e9753dfd43 ksmbd: validate minimum PDU size for transform requests
  • 15a2fedb5dff smb/server: fix minimum SMB2 PDU size
  • 23d34ce11885 smb/server: fix minimum SMB1 PDU size
  • 5649004f7161 ksmbd: rename smb2_get_msg to smb_get_msg
  • 29dbb4e29e1f ksmbd: Fix to handle removal of rfc1002 header from smb_hdr
  • df3cf61adbe6 smb/server: rename include guard in smb_common.h
  • 9d154c3c0f5d smb: move get_rfc1002_len() to common/smbglob.h
  • 8ddc2eb0d2da net/sched: serialize qdisc_rtab_list against concurrent get/put
  • 89df5d71f83f libceph: fix two unsafe bare decodes in decode_lockers()
  • 590b07ceea13 libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE
  • 89a50fb32d69 libceph: Amend checking to fix make W=1 build breakage
  • a3bc6b3e9ef3 ceph: fix hanging __ceph_get_caps() with stale mds_wanted
  • 79d95b43ca09 ceph: avoid fs reclaim while using current->journal_info
  • bb13785d5499 xfs: check v5 superblock features early
  • 04228b8ba196 xfs: check xfarray iteration errors when committing unlinked inode lists
  • 33b56c6c465a xfs: don't ignore runtime errors in xrep_iunlink_reload_next
  • 38a4dbe588bd xfs: don't swallow dquot recovery verification errors
  • 0f27b22343b6 xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN
  • cd1f876d1bc2 xfs: avoid UAF on sc->tempip in xrep_tempfile_create
  • e75150d494dc xfs: don't return EFSCORRUPTED when scrubbing corrupt parent pointers
  • b6baf0db357f xfs: fix another iunlink infinite loop bug in online fsck
  • fc7d8a5c5fcc xfs: fix allocated inodes that show up in the unlinked list
  • c36d7f68f1c2 xfs: don't walk off the end of a null sc->sa.agi_bp in AGI repair
  • 73ffd2620df3 xfs: don't zap the attr fork on repair when there are queued pptr updates
  • 514a5d42d418 xfs: fix ilock leak on error in xfs_dq_get_next_id
  • 9680b1929d89 xfs: load next_agino from the correct xfarray in xrep_iunlink_relink_prev
  • 8b52fa8fb3ab xfs: nlink scrub must take IOLOCK before determining ILOCK state
  • 7d1d82c463e2 xfs: pass runtime errors from xrep_iunlink_mark_ondisk_rec up to callers
  • ab4e13337076 xfs: set the prev pointer when reinserting an inode on the unlinked list
  • ce2a7006ec5e xfs: don't double-lock when deleting a self-referential directory
  • 983588e756a3 xfs: only check mergeability of bnobt records
  • 62c0b1435dfe xfs: zero i_nlink before repair puts inode on unlinked list
  • a9114c6d4ec2 xfs: fix transaction block reservation in xrep_rtbitmap
  • 90a49b8fcf82 xfs: check cowextsize in xrep_inode_cowextsize
  • 069c0eadc8df xfs: clear zapped attr fork state when bmap repair finds no attr fork
  • aeadf3fd2dc3 xfs: mark nonzero sb_gquotino as corrupt on metadir filesystems
  • f8288214459e xfs: bounds-check buffer log item's dirty bitmap
  • 8a0ecae2ecda xfs: fix off-by-one in rtrefcount btree root level validation
  • ec19cea4ef1c xfs: propagate errors from xfs_rtginode_load
  • 71aa45f7bfe4 drm/amdgpu: disallow multiple FENCE chunks in one submit
  • 25ee120f3803 drm/amdgpu: Fix UVD decode image min size calculation
  • 38914cb2c6af drm/amdgpu: Fix UVD dpb min size calculation for H264
  • c76e5cca0675 drm/amdgpu: Fix UVD min buffer sizes
  • 86a5cb020322 drm/amdgpu: Implement insert_end for VCE 3
  • 339deb76ee48 drm/amdgpu: Reject UVD message with dimensions above 4096
  • 220aa2589d73 drm/amdgpu: validate GEM_CREATE domain combinations
  • a082bd76c5f2 drm/amdgpu: check ASPM on the dGPU host link
  • 916e8a1550be drm/amdgpu: fix nbif 6.3.1 l1 low power not functional
  • e304c3e0d9ce drm/amdgpu: Reject UVD message with invalid number of h265 refs
  • e3e6a631dcb1 drm/amd/display: fix BT.2020 YCbCr output CSC matrices for DCE
  • cd99fa1cbaf5 drm/amd/display: fix BT.2020 YCbCr limited output CSC matrix
  • 5045fb4c70bf drm/amd/display: Fix NULL pointer dereference in amdgpu_dm_crtc_set_vblank()
  • 95c1de6923b0 s390/zcrypt: Fix CPRB memory allocation in zcrypt misc code
  • 7902be374cbf s390/vfio_ccw: Implement a crw lock
  • 3b224d3c50a3 s390/vfio_ccw: Calculate idal length based on idaw type
  • b6aecea4b2b2 s390/vfio_ccw: Selectively expand io_mutex
  • af1759d8e6e6 s390/vfio_ccw: Move cp cleanup out of not operational
  • 4c2e1d359d7a s390/vfio_ccw: Fix out of bounds check on CCW array
  • 08ef2a821156 s390/vfio_ccw: Ensure first IDAW remains constant
  • 649badf3a2fd s390/vfio_ccw: Ensure index for read/write regions are within range
  • b7ae0f799386 s390/vfio_ccw: Cancel existing workqueues
  • 06f4d6e5a8af s390/vfio_ccw: Limit the number of channel program segments
  • 32e3d364a7b8 s390/vfio_ccw: Free all memory if cp_init() fails
  • 45aa38567c79 eth: bnxt: make sure we populate the qcfg defaults on old FW/HW
  • 0382ed41c664 eth: bnxt: always set the queue mgmt ops
  • 31ef57083e78 drm/radeon: fix autosuspend cleanup during teardown
  • 361114857813 drm/xe: Fix xe_device_probe() failure
  • 7b90db6f024b drm/xe: Order ring writes before ring tail updates
  • 198b4a89b903 pmdomain: mediatek: Fix mt8183 hang on boot
  • 8f7f7a6d5aed mmc: loongson2: Fix sg iteration in data reorder functions
  • e5b527804a1e drm/connector/hdmi: Fix out of bounds memory read
  • b5060ff2f546 mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition
  • 78e59ab34337 pmdomains: mediatek: Avoid setting RTFF's CLK_DIS before NRESTORE
  • 7c0d1767ce46 mmc: sdhci: make tuning_err a signed int
  • 970b9c83a07c pmdomain: mediatek: fix remaining %pOF after of_node_put()
  • 36d1b69c5c69 mmc: sdhci: unmap the bounce buffer before device release
  • 0418b7ed2c1c mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit
  • b37e84280045 libceph: tolerate addrvecs with multiple entries of the same type
  • 4490fad7992a ceph: fix MDS random selection readiness predicate
  • 4f392fec0755 libceph: Avoid using invalid osd indices from primary_temp
  • f3854719fba9 Input: sur40 - fix V4L error path cleanup
  • 5c1c5227c93f Input: sur40 - fix input device registration ordering
  • a88d688be8d7 openrisc: signal: do not restore privileged SR bits on sigreturn
  • f634598e8fb7 ftrace: Fix off-by-one fentry site disable in ftrace_free_mem()
  • f8fe843a9634 ftrace: Protect direct_functions in ftrace_find_rec_direct
  • d1bba38574d0 libceph: fix multiple unsafe decodes in decode_locker()
  • ebdecef6fd84 pmdomain: arm: Fix -EINVAL from scmi_pd_set_perf_state() on state 0
  • bc7934d0acd4 gpio: ml-ioh: use raw_spinlock_t for the register lock
  • 9e678cffc11c gve: fix zero-length skb frag with header-split
  • bd4e5a97edf8 selftests/ftrace: Convert ELF entry point to file offset in uprobe test
  • 23e9f32c0c7d gpio: sloppy-logic-analyzer: fix use-after-free via debugfs trigger on unbind
  • e9482feeed66 gve: fix NULL dereference due to missing ptp adjfine
  • a134e4b8102c crypto: qce - fix error path in devm_qce_register_algs
  • ef92c0ad0268 crypto: starfive - use scatterlist length before DMA mapping
  • 38e7d5c1ade0 Input: hynitron_cstxxx - validate touch count and finger IDs
  • 70f9aad39435 Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue
  • ff0849705d29 Input: synaptics-rmi4 - block s_input when F54 queue is busy
  • 6b06aab79ff1 Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer
  • b28593a05afd Input: synaptics-rmi4 - zero report size on F54 work error
  • 828a8d1a9107 powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak
  • 2bdec532202b powerpc/pseries: lparcfg - fix kbuf[] underflow
  • 8dbfd8e32a13 Input: byd - synchronize timer deletion before freeing private data
  • a64a8b6b31cd Input: iforce - validate input packet lengths
  • e7b8a107ecad Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard
  • 8d622c58205a Input: psxpad-spi - set driver data before use
  • 83c265bfc084 Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet
  • 9b184c8337c6 Input: synaptics-rmi4 - fix F55 transmitter electrode count typo
  • 652e952850d9 powerpc/pseries: pci - logic bug
  • 52a818c586ae Input: cs40l50-vibra - validate custom data from user space
  • 455dbb5bdd81 Input: xpad - add support for ZENAIM LEVERLESS
  • 6635d544bd6b ASoC: SOF: topology: Use acpi mach from the machine driver
  • bcc66461f574 drm/amdgpu: fix aperture iounmap skipped on device removal
  • dffacbe8118f drm/amdgpu: fix JPEG v4.0.5 queue reset failure in DPG mode
  • e45356f6adae drm/amdgpu: fix JPEG v5.0.0 queue reset failure in DPG mode
  • 4550b90bd2e6 drm/amdgpu: read TRUNCATE_COORD_MODE on gfx12
  • 1474f3970d1a drm/amdgpu: reject oversized IBs with per-ring packet limits
  • 25556a46ae6e drm/panthor: skip zero-sized firmware sections
  • 7ff87a01ae3a fbdev: core: Fix pointer desynchronization in fb_io_read()
  • 2fe7a89b2b5b ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses
  • cc61f0fa2c71 ASoC: cs35l41: sort the register default table
  • 3298f13d1f12 ASoC: cs35l45: sort the register default table
  • d7bd683b0d90 ASoC: cs4265: sort the register default table
  • f2435a46dfa1 ASoC: SOF: ipc4-pcm: Continue the pipeline trigger in case of IPC timeout
  • 8cba53b862e1 ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked()
  • a30836477479 s390/qeth: validate user buffer length in SNMP and ARP query ioctls
  • 75e564b2ced1 mptcp: fastopen: only mark MPTFO subflows with SYN data
  • 3f8e5eb0c499 mptcp: pm: fix data race in add_addr timer callback
  • 1fade1b2ac5b mptcp: options: reset DSS fields in case of unexpected size
  • a04dcc784959 mptcp: avoid combining some incoming suboptions
  • 0cb3846c26c1 selftests: mptcp: join: mark tests with data corruption as failed
  • 473f1a5ab2ab mptcp: reclaim forward-allocated memory on RX path errors
  • 9b46fba7528f selinux: reject a permission value exceeding the class permission count
  • 841aea4d5a25 selinux: reject an unclaimed class value in security_get_classes()
  • 1b4ff94ae7c5 selinux: do not cancel a policy conversion that never started
  • acd5b09be98f selinux: reject a class permission count below its inherited common
  • 42a7107f99d8 selinux: require every boolean value to be defined
  • 1a4c3ffe2a48 ipvs: separate destination availability state
  • 9ff46bf75bfa ubi: fastmap: fix ubi->fm memory leak
  • 075036cea14a mtd: ubi: skip programming unused bits in ubi headers
  • bb03b56d1d75 block: stop the timeout timer when releasing a never added disk
  • e2c3337c2238 ALSA: hda/realtek: Add quirk for HP Dragonfly Folio G3 2-in-1 (103c:8a05)
  • e1e49f488a1c Linux 6.18.45-xanmod1
  • 474774fc02c5 Merge tag 'v6.18.45' into 6.18
  • bf3be28f6721 Linux 6.18.45
  • 1eb0dc458b6e netfilter: flowtable: ensure sufficient headroom in xmit path
  • 99ec511f258e netfilter: always set route tuple out ifindex
  • 9977321835c7 thunderbolt: Fix bandwidth group reservation indexing
  • 40d2ffb74094 thunderbolt: Bound the DROM dual link port number before indexing sw->ports
  • ca33df36aa01 sctp: clear new_transport when removing a peer
  • 07daf4f97501 sctp: fix use-after-free of cached ASCONF chunk
  • 2b3b5eec8b2c sctp: keep chunk->transport in step with the list it is queued on
  • 3bd46d33e3fd scsi: scsi_debug: Negate wrapped memcmp() result
  • a14e4ef1d90c bpf, sockmap: Fix sk_redir use-after-free in send verdict
  • 3c6d4ffa0c6d fsverity: Fix silent truncation in bpf_get_fsverity_digest()
  • 2a5cfcad1d56 fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions
  • 4917e3ebcab5 mm/filemap: __filemap_add_folio() restore index before retrying
  • dd21c96a71e8 ima: Instantiate file_truncate and path_truncate hooks
  • 102fb2dacf45 sched/psi: Create the psimon kthread outside of cgroup_mutex
  • 8037c5b2b2a4 sched/psi: Shut down rtpoll_timer in psi_cgroup_free()
  • 653e888a24c8 fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy()
  • 4eb15c465337 ip6_tunnel: clear skb2->cb[] in ip6ip6_err()
  • 3b2231e358d2 ipv6: fix Route Information option length validation
  • 7f740664aec1 mm/ptdump: always stabilise against page table freeing using init_mm
  • 5b926fb04cb9 ring-buffer: Use current_context for safe per-CPU buffer swap
  • 2e37f2bf1114 ring-buffer: Initialise reader page order in rb_allocate_cpu_buffer()
  • 5fd91dd4a143 ptp: ocp: Fix board ID over-read
  • 8d34019d1413 Revert "thermal/drivers/hwmon: Cleanup coding style a bit"
  • 5635211b4496 eventfs: Fix use-after-free in eventfs_remove_rec()
  • 66bc868a33cf KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page
  • 47976eaaf0a4 KVM: SVM: Serialize accesses to the owner and mirror list with separate lock
  • 1ffacbadc145 smb: client: Fix use-after-free in cifs_try_adding_channels()
  • c3f2347a4775 tipc: read le->link under the node lock in tipc_node_link_down()
  • 3fc5044796dd tls: don't leave a full plaintext sk_msg ring unpushed
  • 68787940274e tls: rx: restore msg_iter before TLS 1.3 optimistic retry
  • f1e21108e3dd vhost: reset the vring metadata cache on vring reconfiguration
  • cdf745b7a777 veth: fix skb length accounting after XDP frag adjustment
  • 38c7763fdc53 vsock/virtio: avoid refilling the RX queue after teardown
  • bd43a7ec668b vsock/virtio: read virtqueues under worker locks
  • 46bb297ad776 vxlan: do not arm the ageing timer on a device that is down
  • fab820f1691a xdp: reject clones that overrun skb_shared_info tailroom
  • e708fc1566eb x86/mce: Set up the polling timer before CMCI discovery
  • 846b92e26c8a x86/CPU: Add a tlbi= cmdline switch
  • 69298af46f39 arm64: remove redundant concurrent ptdump UAF mitigation
  • fe79571f4043 dibs: initialise dibs->lock in dibs_dev_alloc()
  • a2e326c52c4b Revert "drm/amdgpu: fix aperture mapping leak"
  • 24e95a24f151 binfmt_misc: don't warn when the mount is completed from another user namespace
  • be161fa31e3e ovl: don't warn when the mount is completed from another user namespace
  • 92f00f1d4d20 net/sched: act_gact, act_police: range check the fallback control action
  • b47bb899e04b net/sched: act_ct: fix sk_buff leak when the header checks reject a packet
  • 782cc40b7ade net: atlantic: free RX pages of consumed but not refilled buffers
  • b13202d401e1 net: atlantic: free stranded TX buffers on ring deinit
  • 0424186d570a netfilter: nf_conntrack: defer invalid log until after unlock
  • c58d34fe8b7e netfilter: bridge: release template ct on non-IP path
  • e9bfe12b1d04 net: devmem: prevent net-iov / page mixing
  • 4bc522b33438 net/x25: fix use-after-free of the socket by its timers
  • ece6426b6124 net/dibs: Correct freeing of dmb_clientid_arr
  • 680fbd794218 ipv6: prevent in6_dev_get() from resurrecting inet6_dev
  • 0b7d54cedea5 net: smc: fix splice entry lifetime imbalance in smc_rx_splice
  • b65c11bc6221 net: phy: mediatek: fix TX blink masks using the RX bits
  • 105d04edbec8 mm/huge_memory: fix huge_zero_pfn race
  • 152a00440dc6 tracing: Fix NULL pointer dereference in module event cache removal
  • 62978cf63479 ring-buffer: Prevent subbuf order change when resizing is disabled
  • bc9db0d879c6 fbdev: bitblit: bound-check glyph index in bit_cursor()
  • ed49684e69f8 tracing: Fix race between update_event_fields and, event_define_fields
  • a979a642402d perf/core: Fix group leader use-after-free after sibling detach
  • 5884851a096d drm/v3d: Serialize the scheduler timeout handlers
  • 7779249561d1 ALSA: us144mkii: re-anchor capture URBs on resubmission
  • a6b79dff1cc1 ALSA: hda/tas2781: fix ACPI reference handling
  • bb30e35c36ed ALSA: FCP: fix OOB write in fcp_meter_ctl_get()
  • f75d6f61f0d9 ALSA: usx2y: bound the hwdep mmap fault offset
  • d217d723c5e4 ALSA: usb: Fix UAF at delayed release of MIDI2 EPs
  • 976da5475472 mm/damon: adjust isolated pages stat for DAMOS_MIGRATE_{HOT,COLD}
  • e16b8d640ec9 samples/damon/mtier: error out for zero quota goal target values
  • 460181e4bb47 mm/damon/ops-common: putback folios on invalid migrate nid
  • 6dd7a06894d6 ring-buffer: Fix crash passing ERR_PTR to kthread_stop()
  • 688c71bed685 misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free
  • af6345159abc misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke
  • 9bf22a7d950c misc: fastrpc: Remove buffer from list prior to unmap operation
  • c5a03c2cadd2 misc: fastrpc: fix channel ctx ref leak when session alloc fails
  • cd02b9386315 misc: fastrpc: Fix initial memory allocation for Audio PD memory pool
  • 8b3e4ed9c35d staging: rtl8723bs: validate monitor transmit frame lengths
  • a28a4b0592e4 staging: rtl8723bs: fix missing shared-key auth challenge length check
  • e5b7610008f4 staging: rtl8723bs: fix OOB read in WMM_param_handler()
  • e167a38a8a8f staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie()
  • 5974cb66681e serial: amba-pl011: synchronize DMA teardown
  • 759ead98a39f serial: amba-pl011: cancel RS485 hrtimers after freeing IRQ
  • 2a0ee25f75cd serial: amba-pl011: fix indefinite RS485 post-send delay
  • 3ce24bc4d115 serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx
  • ae05d9e50b6b serial: 8250_dma: Clear stale RX state on shutdown
  • 1c31e2377f4c serial: qcom-geni: fix TX DMA buffer flush
  • dd6946a70ddb rust_binder: do not query current thread for all ioctls
  • 9dbe1d011189 nvmem: layouts: Add fixed-layout driver
  • da59844f561d nvmem: apple-spmi-nvmem: wrap regmap calls to satisfy CFI
  • 104c2e8b8e38 mei: pull kvfree out of spinlock
  • 63996ffc594d ipv4: fix use-after-free in fib_nhc_update_mtu()
  • a59edda6eda1 ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops
  • 94166072975a selftests/bpf: Adapt sockmap update error handling
  • edee58a9c460 selftests/bpf: Ensure UDP sockets are bound
  • dc0c462fa838 Bluetooth: btusb: Add TP-Link UB600 for Realtek 8761BUV
  • 373d425f7638 Bluetooth: btrtl: fix RTL8761B/BU broken LE extended scan
  • 8545f4ef9eae netfilter: nf_tables: avoid softlockup warnings in nft_chain_validate
  • 7b8c53263f88 futex: Prevent robust futex exit race some more
  • cf8a9672fc25 iommu/vt-d: Gather the unmapped range before freeing its page tables
  • 643b410bdfa4 dt-bindings: crypto: qcom,ice: Fix missing power-domain and iface clk
  • 8d817ef1aa4e KVM: s390: pci: Fix aisb calculation
  • cf895cd72e40 blk-mq: reinsert cached request to the list
  • 97e2d08de282 blk-mq: pop cached request if it is usable
  • 59b07ccca4c0 Revert "drm/amd/display: Fix backlight max_brightness to match exported range"
  • 5912cf1822fb net: bridge: mrp: fix uninitialised bytes on the wire
  • 47a119ec8a7e netfilter: ebt_nflog: pin the NFLOG backend
  • a0e76de6a2f2 igc: fix netdev not re-attached after resume if interface is down
  • e6cd416a899e mac802154: fix netdev use-after-free in beacon worker
  • 9f904dd3e455 inet: frags: publish queues before arming timer
  • dbb30dc943a9 net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header
  • 99ae2239069e net: octeontx2-pf: Fix UB in shift operation
  • a4b14a4df29d net/sched: reject overly deep qdisc hierarchies
  • 23716dd9d8d4 net: openvswitch: reallocate update replies for mismatched IDs
  • 5f30f9c302ce net: fix skb length accounting after generic XDP frag adjustment
  • 2c7b5eb87b2b packet: synchronize pressure clearing with ring reconfiguration
  • 971aa7d99242 net/packet: reset the MAC header on the packet-socket transmit path
  • 27e068d1b35d packet: use consistent hard_header_len in TX_RING send path
  • 5bb10753d428 packet: use consistent hard_header_len in non-ring send paths
  • 75eec935444d ipvs: clear IPv4 options after rebasing tunnel ICMP errors
  • 0f88fe0552be ipvs: properly update the overload flag on dest edit
  • 59b90c17bec5 ipvs: add totalconns for dest
  • e7f34f29b330 ipvs: stop estimator after disabled calc phase
  • 27f392406159 ima: fix out-of-bounds read in xattr_verify()
  • c5bf8cd148cf mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF
  • bd3c4108a56d Input: evdev - fix information leak in evdev_pass_values()
  • b664592e9ba8 vt: stabilize tty reference in kbd_keycode with tty_port_tty_get
  • a1c31e026c93 vt: add permission check for KDSKBMETA ioctl
  • 2c7496124e94 net: usb: ipheth: fix carrier_work UAF on disconnect
  • 58733b1dd46b net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup()
  • d328fdc607fa usb: gadget: f_ncm: Use unsigned int for ndp_index
  • 2dfefdd498ab usb: cdnsp: fix incorrect endian conversions for APB timeout register
  • 6e4c09bea8e9 thunderbolt: icm: Preserve USB4 proxy data-valid bit
  • 2f73a065791d usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm()
  • ebfd1e82ab0a usb: misc: usbio: check ibuf_len against rxbuf_len in bulk msg
  • 04b71290fb41 usb: quirks: Add ShanWan gamepad to quirk list
  • 1740fd2aaa8f usb: core: Add quirk for 255-bytes initial config read
  • 0a235379825e ALSA: usb-audio: fix OOB write on Type II inbound URBs
  • 4034ef247a9d Input: evdev - sanitize event type index when fetching event masks
  • 8b444b126cd8 net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp()
  • fad7cecb5c2c net: fec: do not release NULL pages when RX buffer allocation fails
  • c768fb2e43c8 hwmon: (ltc4282) Fix parsing adi,current-limit-sense-microvolt
  • de58b90a4d14 hwmon: (ltc4282) Clamp negative current limits
  • 124bd4b00619 hwmon: (ltc4282) Avoid overflow in maximum power calculation
  • 678a76c8fd33 hwmon: (ads7828) Fix external VREF regulator handling
  • 5ee1f603a64b hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination
  • 29fe74c9aa69 watchdog: at91sam9_wdt: prevent timer rearm during teardown
  • 6d1d3ca6c8f4 tls: don't abort the connection on signal-interrupted sends
  • 18d704bdd809 sctp: clear control chunk transport if it is being removed
  • 9f77c1ab3821 net/atm: fix slab-out-of-bounds read in vcc_setsockopt()
  • fc3021284050 s390/ism: Fix UAF of sba and ieq during ism_dev_exit()
  • 8fa684db8709 bnge: Fix resource leak in bnge_init_nic() error path
  • a837deeaa37c ata: pata_sl82c105: fix bridge revision use-after-free
  • 4dd71cb0d23d net: thunderbolt: Tear down DMA paths before stopping the rings
  • 78e5ebcd1c10 net/smc: fix TOCTOU race between smc_listen_out() and listener close
  • c8f256dc8492 net: remove WARN_ON_ONCE() from sk_mc_loop()
  • 363e048a9d0a net: prestera: validate firmware header length
  • 02226af69362 net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length
  • 12afa450a6a6 netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref()
  • 25d40cf9dab1 netfilter: flowtable: consolidate xmit path
  • a66e869cf0c9 tcp: fix TFO max_qlen accounting across reuseport migration
  • 6c24ec01fb76 sctp: fix addip_serial increment on ASCONF_ACK allocation failure
  • 1e8f24b1e3fe bnxt_en: Fix PTP PPS setting bug
  • aab3b5f4d8ec bnxt_en: Disable EOP for TPA on all chips to prevent data corruption
  • 6a2e50924e57 bnxt_en: Refresh VNIC default ring on queue restart if needed
  • f1a4e95e296b bnxt_en: Determine and store default RX ring in vnic structure
  • 965c45be24e1 bnxt_en: Move RSS table fill outside __bnxt_hwrm_vnic_set_rss()
  • 88664c48d7d1 net/mlx5e: fix BQL reset on SQ re-activation
  • beb47092fe8f bnge: use int for bnge_fix_rings_count() return value
  • 4901b23b5ca7 net: stmmac: resume PHY before hardware setup when opening the interface
  • 99b7bcee0158 selftests/ftrace: refactor eprobes test to fix argument checks
  • a7a00ecf5424 hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations
  • 2e5ea8272cea hwmon: (nzxt-smart2) Check return value of init_device() in probe
  • 9fccf43f0531 drm/xe/uc: Apply RCS/CCS yield policy to SR-IOV VFs
  • d6222af7274f net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers
  • a8139285c892 net/openvswitch: check Ethernet header length in key_extract()
  • a06e4611d455 vhost-scsi: reject feature changes after endpoint
  • 2417a498cf3f vhost-scsi: Validate T10 PI scatterlist counts
  • cd2f1d9fe8a5 net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter
  • 64d322c28857 udp: fix potential use-after-free in tunnel segmentation
  • 5fd121971912 xsk: validate metadata when processing requests
  • 1a1534cc3b41 xsk: move xsk_tx_metadata_request() to xdp_sock_drv.h
  • af511afa1d29 xsk: validate launch-time metadata size
  • 0ba2e1eb07a8 xsk: clear metadata pointer when no timestamp is requested
  • 5ec4f525373b xsk: pass TX metadata pointer by reference
  • 642c6e73fce1 xsk: require at least 16 bytes of TX metadata
  • b0b7202f751b bnxt: fix memory leak in bnxt_queue_mem_alloc error cases
  • ad9ffc61fafe eth: bnxt: support qcfg provided rx page size
  • cd5485a702ef eth: bnxt: store rx buffer size per queue
  • 9c1406e2ecd2 net: pass queue rx page size from memory provider
  • b3fecb888e94 net: add bare bone queue configs
  • 96197286b0ac net: reduce indent of struct netdev_queue_mgmt_ops members
  • 34debe05685d bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips
  • 5ba1a458c5e2 tcp: do not change rcv_ssthresh in tcp_measure_rcv_mss()
  • 821f6416e697 hwmon: (pmbus) Fix type confusion in notification logic
  • 11720d869be1 hwmon: (pmbus_core) Use guard() for mutex protection
  • cde8931a2539 vdpa/mlx5: Fix buffer length in create_direct_keys()
  • a1c236b385d8 vhost/vdpa: reject overflowing PA map page counts on 32-bit
  • cefcbbe20846 bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()
  • 846ce792b6dd counter: microchip-tcb-capture: Fix DT channel validation
  • 80094352bd40 net/mlx5: fw_tracer, return NULL on create error
  • 7b02c6d2a3cd devlink: fix net namespace reference leak in reload
  • 1efcc7114009 net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete
  • 0e7a8cf8895b net/sched: cls_route: fix fastmap use-after-free on filter
  • 10cb31b2b74c net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler()
  • d8a6f7993520 bpf: Propagate untrusted pointer state in commuted arithmetic
  • c2da73a1f715 bpf: split check_reg_sane_offset() in two parts
  • db6382ed3361 bpf: Preserve pointer state for commuted arithmetic
  • 24a8f2c29aeb btrfs: fix memory leak in btrfs_do_encoded_write()
  • 26e968526eb5 watchdog: bd96801_wdt: Fix timeout for enabled WDG
  • b3ff48c4ea8b ipvs: return the csum validation for forward hook
  • a69a4b3fff58 ipvs: avoid out-of-bounds write in ip_vs_nat_icmp
  • 1e8a5467a7a7 netfilter: ipset: switch ext_size to atomic64_t
  • 970e9494f44a pds_core: cancel pending PCI reset work on AER recovery
  • ef8e37ac448d pds_core: keep the health thread stopped during reset
  • ff9e7d5e3500 net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock
  • e506e704b747 enic: fix tx_hang_reset use-after-free on device removal
  • 2faf75a8a065 bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor
  • 35ddcc856b5b Revert "net: thunderbolt: Enable end-to-end flow control also in transmit"
  • d512823059af net: hns3: fix speed configuration residue after driver reload
  • 8701a643db23 drm/bridge: ps8640: propagate AUX transfer register errors
  • d47212d86690 ovpn: fix incorrect use of rcu_access_pointer()
  • 54dd83f24b91 ovpn: ensure TCP vars are initialized first
  • f34949d63cbb ovpn: disable IPv4 redirects on MP interfaces
  • e774f7d8fc73 ovpn: hash floated peer by transport identity only
  • 9a776388ef8d ovpn: zero-initialize sockaddr before learning a floated endpoint
  • 61fb3cca40ff ovpn: ensure socket is owned by ovpn before deref sk_user_data
  • 157164812a0c ovpn: rehash peer in by_transp_addr table on CMD_PEER_SET
  • d20c18108898 ovpn: skip rehash for peers already removed from by_id
  • 9e5e88fbfc87 ARM: dts: BCM5301X: fix PCIe controller 2 second interrupt
  • 92b9d92a35a0 ovpn: add missing rtnl_link_ops->get_size callback
  • d740dea9e255 pinctrl: qcom: ipq806x: mark pci reset as a GPIO pin function
  • 23c94a468efe pinctrl: qcom: ipq806x: mark gpio as a GPIO pin function
  • 913d2295b772 selftests/sched_ext: Handle sleeping task affinity changes in numa test
  • ce0212d230bd ARM: npcm: Fix OF node refcount leaks in SMP setup
  • ccf6738adcaf xfs: handle NULL b_addr in xfs_buf_free
  • d90599a42f6c arm64: dts: broadcom: bcm2712: Remove non-functional EL2 virtual timer
  • d71dfffa512e NFS: Pin the 'struct nfs_server' during a FREE_STATEID call
  • bd45b89d7346 arm64: dts: qcom: sdm850-lenovo-yoga-c630: lower PSCI cluster idle
  • df9d22383d7c arm64: dts: qcom: purwa: Fix GPU IOMMU property
  • 7a6e90afb696 arm64: dts: qcom: rename x1p42100 to purwa
  • 1e2b408c1a76 arm64: dts: qcom: Rework X1-based Asus Zenbook A14's displays
  • 387edbe4706b arm64: dts: qcom: rename x1e80100 to hamoa
  • d089f32d34f8 drm/amd/display: Check for tg ops in dce110_set_avmute
  • 8aba384bfc8a drm/amd/display: Add AV mute wait frames to dce110_set_avmute
  • 50359c42e0eb selftests/bpf: Fail unbound UDP on sockmap update
  • 62fefb817bb3 sched/fair: Revert 6d71a9c61604 ("sched/fair: Fix EEVDF entity placement bug causing scheduling lag")
  • 4043e196dc88 sched/fair: Separate se->vlag from se->vprot
  • 9a3eef676cd8 mount: honour SB_NOUSER in the new mount API
  • 79a45d44323b KVM: s390: pci: Fix resource leak on IRQ registration failure
View original

Upgraded? How did it go?

Discussion