kernel-6.6-rosa-flow-abi-6.6.148-1> )lp 3b32bfb007c7bf71afd2b964422f6c4a1bea4fa2b94b80aac11398cf86879c760fbfcf65a0a9eb6b0803f2325ee22514c5a0a2e1 uX0]; >B?d# % ndhtx}       L\(89$:GxH|IXY\]^bcdefltuvwxy),8>Ckernel-6.6-rosa-flow-abi6.6.1481Directory to install third-party binary kernel modules for kernels 6.6.xThis package contains a directory to install third-party binary kernel modules for kernels 6.6.x. Some vendors provide binary-only kernel modules. They can put them into /lib/modules/6.6-rosa-flow-abi. kmod tools will find them for kernels 5.4.x of "generic" and "nickel" flavours but there is no guarantee that these modules will load and work correctly on newer or older kernels then the ones they were build against. We call this "flow ABI" because most ABIs are not changed between 6.6.x releases, but there are no specific guarantees. ABI may evolve and change. We highly recommend to use DKMS and build third-party kernel modules from source for every kernel! This package does nothing, just owns a directory for third-party binary kernel modules.jlocalhostROSAROSAGPLv2System/Kernel and hardwarehttps://www.kernel.orglinuxx86_64Aj#rootrootkernel-6.6-desktop-6.6.148-1.src.rpmkernel-6.6-rosa-flow-abikernel-6.6-rosa-flow-abi(x86-64)    rpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsXz)3.0.4-14.6.0-14.0-15.2-14.17.0jtw@jgH@jL@jL@jj9j Pj Pj Pj Pi@iD@iii@h/Mikhail Novosyolov BiteDasher BiteDasher 6.6.144-1BiteDasher BiteDasher 6.6.126-8BiteDasher 6.6.126-7Mikhail Novosyolov 6.6.126-6Mikhail Novosyolov 6.6.126-5Mikhail Novosyolov Mikhail Novosyolov Mikhail Novosyolov 6.6.126-3Mikhail Novosyolov 6.6.126-2Mikhail Novosyolov 6.6.126-1Mikhail Novosyolov Mikhail Novosyolov 6.6.106-3Mikhail Novosyolov - [bot] upd: 6.6.145 -> 6.6.148 - Changelog: - accel/ivpu: Reject firmware log with size smaller than header - afs: Annotate struct afs_addr_list with __counted_by - afs: Turn the afs_addr_list address array into an array of structs - ALSA: hda: conexant: Remove mic bias threshold override - ALSA: hda: Fix cached processing coefficient verbs - ALSA: seq: close a re-opened queue timer in the destructor - ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC - amd-xgbe: fix MAC_AUTO_SW handling in CL37 AN - amt: make the head writable before rewriting the L2 header - amt: re-read skb header pointers after every pull - arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates - arm64: tegra: Fix CPU compatible string to cortex-a78ae on Tegra234 - ASoC: amd: ps: fix wrong ACP version string in pci_request_regions() - ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI - ASoC: cs35l56: Don't use devres to unregister component - ASoC: cs35l56: Fix potential probe() deadlock - ASoC: cs35l56: Use complete_all() to signal init_completion - ASoC: cs42l43: Correct report for forced microphone jack - ASoC: mediatek: mt8183: Check runtime resume during probe - ASoC: mediatek: mt8192-afe-pcm: Convert to devm_pm_runtime_enable() - ASoC: mediatek: mt8192-afe-pcm: Simplify probe() with local dev variable - ASoC: mediatek: mt8192-afe-pcm: Simplify with dev_err_probe() - ASoC: mediatek: mt8192: Check runtime resume during probe - ASoC: mediatek: mt8195: Add platform entry for ETDM1_OUT_BE dai link - ASoC: mediatek: mt8195: Remove afe-dai component and rework codec link - ASoC: mediatek: mt8195: Set ETDM1/2 IN/OUT to COMP_DUMMY() - ASoC: mediatek: Use common mtk_afe_pcm_platform with common probe cb - ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop - ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup - ASoC: tas2781: bound firmware description string parsing - ata: libata-core: Reject an invalid concurrent positioning ranges count - ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered - ata: sata_dwc_460ex: fix clear_interrupt_bit() clearing all pending interrupts - ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning - ata: sata_dwc_460ex: use platform_get_irq() - audit: fix recursive locking deadlock in audit_dupe_exe() - audit: use 'unsigned int' instead of 'unsigned' - audit: widen ino fields to u64 - binfmt_elf_fdpic: only honour the first PT_INTERP - binfmt_misc: set have_execfd only once the interpreter is opened - Bluetooth: btusb: validate Realtek vendor event length - Bluetooth: hci_qca: Clear memdump state on invalid dump size - Bluetooth: hci_sync: Protect UUID list traversal - Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds - Bluetooth: qca: fix NVM tag length underflow in TLV parser - Bluetooth: RFCOMM: Fix session UAF in set_termios - bonding: fix devconf_all NULL dereference when IPv6 is disabled - bootconfig: do not put quotes on cmdline items unless necessary - bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline() - bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c - bpf: drop bpf_lsm_getselfattr from hook list - bpf: Fix ld_{abs,ind} failure path analysis in subprogs - bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized - bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() - bpf, sockmap: Reject unhashed UDP sockets on sockmap update - btrfs: declare btrfs_ioctl_search_args_v2::buf as __u8 - btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() - btrfs: free mapping node on duplicate reloc root insert - btrfs: reject free space cache with more entries than pages - can: bcm: add locking when updating filter and timer values - can: bcm: add missing device refcount for CAN filter removal - can: bcm: extend bcm_tx_lock usage for data and timer updates - can: bcm: fix CAN frame rx/tx statistics - can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler() - can: bcm: fix stale rx/tx ops after device removal - can: bcm: track a single source interface for ANYDEV timeout/throttle ops - can: bcm: validate frame length in bcm_rx_setup() for RTR replies - can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER - can: isotp: serialize TX state transitions under so->rx_lock - can: j1939: fix lockless local-destination check - cdrom: fix stack out-of-bounds read in CDROMVOLCTRL - ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() - comedi: comedi_parport: deal with premature interrupt - coredump: fix pidfs file refcount leak in umh_coredump_setup - crypto: rsa-pkcs1pad: Don't WARN on an empty digest - dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning - dma: dw-edma: Fix build warning in dw_edma_pcie_probe() - dmaengine: dw-edma: Fix confusing cleanup.h syntax - dmaengine: dw-edma-pcie: Reject devices without driver data - dmaengine: sh: rz-dmac: Move interrupt request after everything is set up - dm-verity: avoid double increment of &use_bh_wq_enabled - dm-verity: make error counter atomic - dpaa2-eth: put MAC endpoint device on disconnect - dpaa2-switch: put MAC endpoint device on disconnect - drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink reference - drm/amd/display: Fix dcn32 DTB DTO update breaking live pixel rate sources - drm/amd/display: Handle struct drm_plane_state.ignore_damage_clips - drm/amd/display: set new_stream to NULL after release - drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT - drm/amdgpu: fix aperture mapping leak - drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved - drm/amdgpu: fix division by zero with invalid uvd dimensions - drm/amdgpu: Fix VFCT bus number matching with soft filter - drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx11: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx8: drop unecessary BUG_ON() - drm/amdgpu/gfx9.4.3: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON() - drm/amdgpu: invoke pm_genpd_remove() before freeing genpd - drm/amdgpu/sdma4.4.2: replace BUG_ON() with WARN_ON() - drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON() - drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON() - drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON() - drm/amdgpu/uvd: Fix forcing MSG, FB BOs into VCPU segment when it isn't at 0 (v2) - drm/amdgpu/uvd: Place VCPU BO only in VRAM for UVD 4.x and older - drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1 - drm/amdgpu/vce: fix integer overflow in image size - drm/amdgpu/vcn4: avoid rereading IB param length - drm/amdkfd: Check bounds in allocate_event_notification_slot - drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X) - drm/amd/pm: make pp_features read-only when scpm is enabled - drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS() - drm/dp/mst: fix buffer overflows in sideband chunk accumulation - drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers - drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers - drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe() - drm/i915/gem: Add missing nospec on parallel submit slot - drm/i915/gem: Do not leak siblings[] on proto context error - drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU - drm/i915/gt: use correct selftest config symbol - drm/i915: Return NULL on error in active_instance - drm/i915/selftests: Fix GT PM sort comparators - drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit() - drm/nouveau: fix reversed error cleanup order in ucopy functions - drm/radeon: fix r100_copy_blit for large BOs - drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video() - drm/vc4: Prevent shader BO mappings from becoming writable - drm/virtio: bound EDID block reads to the response buffer - drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker - drm/vmwgfx: Validate vmw_surface_metadata::array_size - exec: fix unsigned loop counter wrap in transfer_args_to_stack() - exfat: validate cluster allocation bits of the allocation bitmap - fbcon: Rename struct fbcon_ops to struct fbcon_par - fbcon: Use correct type for vc_resize() return value - fbdev: efifb: fix memory leak in efifb_probe() - fbdev/efifb: Replace references to global screen_info by local pointer - firewire: net: Fix fragmented datagram reassembly - firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() - firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context - firmware_loader: introduce __free() cleanup hanler - fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() - fscrypt: Add missing superblock check in find_or_insert_direct_key() - fscrypt: Avoid dynamic allocation in fscrypt_get_devices() - fs: preserve ACL_DONT_CACHE state in forget_cached_acl() - fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list - ftrace: Add global mutex to serialize trace_parser access - geneve: require CAP_NET_ADMIN in the device netns for changelink - gpio: mt7621: avoid corruption of shared interrupt trigger state - gpio: tegra: do not call pinctrl for GPIO direction - gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings - gtp: check skb_pull_data() return in gtp1u_send_echo_resp() - hinic: remove unused ethtool RSS user configuration buffers - hwmon: (asus-ec-sensors) add missed handle for ENOMEM - hwmon: (asus-ec-sensors) fix EC read intervals - hwmon: (asus-ec-sensors) fix looping over banks while reading from EC - hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop - hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop - hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop - hwmon: occ: validate poll response sensor blocks - i2c: davinci: Unregister cpufreq notifier on probe failure - i2c: i801: fix hardware state machine corruption in error path - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) - i2c: imx: separate atomic, dma and non-dma use case - i40e: remove read access to debugfs files - IB/mad: Drop unmatched RMPP responses before reassembly - ice: fix LAG recipe to profile association - ice: use READ_ONCE() to access cached PHC time - ila: reload IPv6 header after pskb_may_pull in checksum adjust - Input: ims-pcu - fix firmware leak in async update - Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() - Input: ims-pcu - fix logic error in packet reset - intel_th: fix MSC output device reference leak - iomap: correct the range of a partial dirty clear - iommu/amd: Bound the early ACPI HID map - iommu/amd: Don't split flush for amd_iommu_domain_flush_all() - iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() - iommu/intel: Fix out-of-bounds memset in dmar_latency_disable() - iommu/vt-d: Disallow SVA if page walk is not coherent - io_uring/rw: fix missing ERESTARTSYS conversion in read paths - ipmi: fix refcount leak in i_ipmi_request() - ipv4: fib: free fib_alias with kfree_rcu() on insert error path - ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup - ipv6: ndisc: fix NULL deref in accept_untracked_na() - ksmbd: bound DACL dedup walk to copied ACEs - ksmbd: defer destroy_previous_session() until after NTLM authentication - ksmbd: pin conn during async oplock break notification - ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL - ksmbd: validate ACE size against SID sub-authorities - ksmbd: validate compound request size before reading StructureSize2 - ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl - KVM: Introduce vcpu->wants_to_run - KVM: nVMX: Hide shadow VMCS right after VMCLEAR - KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available - KVM: x86/mmu: Fix use-after-free on vendor module reload - KVM: x86: Only reset TSC Deadline Timer in apic_timer_expired on KVM_RUN - libceph: bound get_version reply decode to front len - libceph: Fix multiplication overflow in decode_new_up_state_weight() - libceph: guard missing CRUSH type name lookup - libceph: refresh auth->authorizer_buf{,_len} after authorizer update - libceph: Reject monmaps advertising zero monitors - libceph: reject zero bucket types in crush_decode - libceph: remove debugfs files before client teardown - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() - LoongArch: Fix oops during single-step debugging - lsm: infrastructure management of the sock security - mac802154: hold an interface reference across the scan worker - mac802154: llsec: reject frames shorter than the authentication tag - mctp: serial: handle zero-length frames to prevent rx buffer overflow - media: airspy: Return queued buffers on start_streaming() failure - media: aspeed: fix missing of_reserved_mem_device_release() on probe failure - media: cec: seco: unregister adapter on IR probe failure - media: cedrus: clean up media device on probe failure - media: cedrus: Fix missing cleanup in error path - media: cedrus: skip invalid H.264 reference list entries - media: cx231xx: fix devres lifetime - media: cx23885: add ioremap return check and cleanup - media: marvell-cam: fix missing pci_disable_device() on remove - media: meson: vdec: Fix memory leak in error path of vdec_open - media: msi2500: Return queued buffers on start_streaming() failure - media: nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and pipe - media: nxp: imx8-isi: Clean up already-initialized pipes on probe failure - media: nxp: imx8-isi: Fix missing v4l2_subdev_cleanup() in pipe init error path - media: nxp: imx8-isi: Fix potential out-of-bounds issues - media: nxp: imx8-isi: Fix scale factor calculation for hardware rounding - media: pci: dm1105: Free allocated workqueue - media: pwc: Drain fill_buf on start_streaming() failure - media: pwc: Return queued buffers on start_streaming() failure - media: radio-si476x: Unregister v4l2_device on probe failure - media: rtl2832: fix use-after-free in rtl2832_remove() - media: rtl2832_sdr: Return queued buffers on start_streaming() failure - media: saa7134: Fix a possible memory leak in saa7134_video_init1 - media: stm32: dcmi: unregister notifier on probe failure - media: sun4i-csi: Return queued buffers on start_streaming() failure - media: tegra-video: vi: fix invalid u32 return value in format lookup - media: ti: vpe: unwind v4l2 device registration on probe error - media: v4l2-ctrls-request: add NULL check in v4l2_ctrl_request_complete() - media: v4l2-ctrls: validate HEVC active reference counts - media: vb2: use ssize_t for vb2_read/vb2_write - media: vidtv: fix reference leak on failed device registration - media: vimc: fix reference leak on failed device registration - media: vivid: add vivid_update_reduced_fps() - media: vivid: check for vb2_is_busy() when toggling caps - media: vpif_capture: fix OF node reference imbalance - mei: bus: access mei_device under device_lock on cleanup - mm/damon/core: disallow overlapping input ranges for damon_set_regions() - mm/damon/core: validate ranges in damon_set_regions() - mm/mm_init: fix pageblock migratetype for ZONE_DEVICE compound pages - mm: refactor mm_access() to not return NULL - mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n - mptcp: decrement subflows counter on failed passive join - mptcp: only set DATA_FIN when a mapping is present - mtd: fix double free and WARN_ON in add_mtd_device() error paths - mtd: mtdswap: remove debugfs stats file on teardown - mtd: nand: mtk-ecc: stop on ECC idle timeouts - mtd: rawnand: Add a helper for calculating a page index - mtd: rawnand: Ensure all continuous terms are always in sync - mtd: rawnand: Pause continuous reads at block boundaries - net/af_iucv: fix NULL deref in afiucv_hs_callback_syn() - net: bridge: vlan: fix vlan range dumps starting with pvid - net: dpaa: fix mode setting - netfilter: nf_conntrack_sip: remove net variable shadowing - netfilter: nf_conntrack_sip: validate skb_dst() before accessing it - netfilter: nf_tables: remove register tracking infrastructure - netfilter: nf_tables: Remove unused nft_reduce_is_readonly() - netfilter: nft_fib: reject fib expression on the netdev egress hook - netfilter: nft_set_pipapo: don't leak bad clone into future transaction - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL - netfilter: nft_set_pipapo: merge deactivate helper into caller - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path - netfilter: nft_set_pipapo: move prove_locking helper around - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone - netfilter: nft_set_pipapo: prepare walk function for on-demand clone - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions - net: hip04: fix RX buffer leak on build_skb failure - net: hsr: fix memory leak on slave unregistration by removing synced VLANs - net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink - net: ipa: fix SMEM state handle leaks in SMP2P init - net: ipv6: fix dif and sdif mismatch in raw6_icmp_error - net/iucv: fix use-after-free of a severed iucv_path - net/iucv: take a reference on the socket found in afiucv_hs_rcv() - net: macb: drop in-flight Tx SKBs on close - net: mana: Validate the packet length reported by the NIC - net/mlx5e: Reject unsupported CB Shaper TSA in ETS validation - net/mlx5e: Report zero bandwidth for non-ETS traffic classes - net/mlx5: E-Switch, fix zero num_dest in prio_tag egress vlan rule - net/packet: avoid fanout hook re-registration after unregister - net: pcs: xpcs: fix SGMII state reading - net: qrtr: ns: Raise node count limit to 512 - net: qrtr: restrict socket creation to the initial network namespace - net/sched: act_tunnel_key: Defer dst_release to RCU callback - net: slip: serialize receive against buffer reallocation - net: stmmac: enable the MAC on link up for all supported speeds - net: stmmac: fix l3l4 filter rejecting unsupported offload requests - net: stmmac: reset residual action in L3L4 filters on delete - net/x25: fix use-after-free in x25_kill_by_neigh() - nexthop: initialize extack in nh_res_bucket_migrate() - nfp: Check resource mutex allocation - NFS: Charge unstable writes by request size, not folio size - NFSD: pass nfsd_file to nfsd_iter_read() - nfs: remove dead code for the old swap over NFS implementation - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF - octeontx2: Annotate mmio regions as __iomem - octeontx2-pf: clear stale mailbox IRQ state before request_irq() - octeontx2-pf: fix SQB pointer leak on init failure - octeontx2-vf: clear stale mailbox IRQ state before request_irq() - octeontx2-vf: set TC flower flag on MCAM entry allocation - openvswitch: fix GSO userspace truncation underflow - ovl: use linked upper dentry in copy-up tmpfile - pds_core: check for workqueue allocation failure - pds_core: fix auxiliary device add/del races - pds_core: order completion reads after the ownership check - pds_core: reject component parameter in legacy firmware update - pds_core: yield the CPU while waiting for the adminq to drain - phonet: pep: fix use-after-free in pep_get_sb() - pinctrl: remove pinctrl_gpio_direction_output() - platform/loongarch: laptop: Explicitly reset bl_powered state when suspend - platform/x86/amd/pmc: Avoid logging "(null)" for DMI values - platform/x86/amd/pmc: Don't log during intermediate wakeups - platform/x86: dell-laptop: fix missing cleanups in init error path - platform/x86: dell-smbios: Move request functions for reuse - platform/x86/intel-uncore-freq: Fix current_freq_khz after CPU hotplug - posix-cpu-timers: Prevent UAF caused by non-leader exec() race - powerpc/time: Prepare to stop elapsing in dynticks-idle - powerpc/vtime: Initialize starttime at boot for native accounting - ppp: annotate data races in ppp_generic - ppp: convert to percpu netstats - ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF - ppp: enable TX scatter-gather - pppoe: reload header pointer after dev_hard_header() - ppp: use IFF_NO_QUEUE in virtual interfaces - proc: Fix broken error paths for namespace links - rbd: Reset positive result codes to zero in object map update path - RDMA/cma: Fix hardware address comparison length in netevent callback - RDMA/erdma: initialize ret for empty receive WR lists - RDMA/hns: Fix potential integer overflow in mhop hem cleanup - RDMA/irdma: Prevent overflows in memory contiguity checks - RDMA/irdma: Prevent rereg_mr for non-mem regions - RDMA/siw: Only check attrs->cap.max_send_wr in siw_create_qp - RDMA/siw: publish QP after initialization - RDMA/umem: Add helpers for umem dmabuf revoke lock - RDMA/umem: Add ib_umem_dmabuf_get_pinned_and_lock helper - RDMA/umem: Add pinned revocable dmabuf import interface - RDMA/umem: Add support for creating pinned DMABUF umem with a given dma device - RDMA/umem: Introduce an option to revoke DMABUF umem - RDMA/umem: Move umem dmabuf revoke logic into helper function - rds: drop incoming messages that cross network namespace boundaries - Revert "arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates" - Revert "drm/amd/display: Add missing kdoc for ALLM parameters" - RISC-V: KVM: Serialize virtual interrupt pending state updates - rxrpc: Disable IRQ, not BH, to take the lock for ->attend_link - rxrpc: Don't need barrier for ->tx_bottom and ->acks_hard_ack - rxrpc: Fix notification vs call-release vs recvmsg - rxrpc: Fix socket notification race - rxrpc: Pull out certain app callback funcs into an ops table - rxrpc: serialize kernel accept preallocation with socket teardown - rxrpc: Use irq-disabling spinlocks between app and I/O thread - sched/vtime: Get rid of generic vtime_task_switch() implementation - sctp: auth: verify auth requirement when auth_chunk is NULL - sctp: don't free the ASCONF's own transport in DEL-IP processing - sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid - sctp: fix auth_hmacs array size in struct sctp_cookie - sctp: validate stream count in sctp_process_strreset_inreq() - selftest: af_unix: Add Kconfig file. - selftests: af_unix: add USER_NS config - selftests/alsa: Fix memory leak in find_controls error path - selftests/bpf: Add tests for ld_{abs,ind} failure path in subprogs - selftests: openvswitch: add config file - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() - seqlock: Allow KASAN to fail optimizing - seqlock: Allow UBSAN_ALIGNMENT to fail optimizing - seqlock: Cure some more scoped_seqlock() optimization fails - serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms - serial: max310x: implement gpio_chip::get_direction() - serial: max310x: replace bare use of 'unsigned' with 'unsigned int' (checkpatch) - serial: sc16is7xx: implement gpio get_direction() callback - smb/client: handle overlapping allocated ranges in fallocate - smb: client: validate DFS referral PathConsumed - staging: rtl8723bs: fix inverted HT40 secondary channel offset - staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie() - SUNRPC: Add helpers to convert xdr_buf byte ranges to scatterlists - sunrpc: allocate a separate bvec array for socket sends - SUNRPC: Return an error from xdr_buf_to_bvec() on overflow - taskstats: fill_stats_for_tgid: use for_each_thread() - taskstats: retain dead thread stats in TGID queries - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() - tipc: fix infinite loop in __tipc_nl_compat_dumpit - tipc: fix u16 MTU truncation in media and bearer MTU validation - tipc: restrict socket queue dumps in enqueue tracepoints - tls: device: push pending open record on splice EOF - tracing/eprobe: Fix exact system name matching in eprobe_dyn_event_match() - tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev - tracing: Fix resource leak on mmiotrace trace_pipe close - tracing/probes: Avoid temporary buffer truncation in trace_probe_match_command_args() - tracing/probes: Fix potential underflow in LEN_OR_ZERO macro - tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err() - tracing/user_events: Fix use-after-free in user_event_mm_dup() - udmabuf: Do not create malformed scatterlists - udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf() - usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect - usb: chipidea: fix usage_count leak when autosuspend_delay is negative - usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback - usb: gadget: f_midi: cancel pending IN work before freeing the midi object - usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() - USB: gadget: fsl-udc: fix device name leak on probe failure - usb: gadget: printer: fix infinite loop in printer_read() - USB: gadget: snps-udc: fix device name leak on probe failure - usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown - usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer - USB: serial: ftdi_sio: add support for E+H FXA291 - USB: serial: io_edgeport: cap received transmit credits - USB: serial: keyspan_pda: fix data loss on receive throttling - USB: serial: option: add TDTECH MT5710-CN - USB: storage: add NO_ATA_1X quirk for Longmai USB Key - usb: xhci-pci: Limit VIA VL805 DMA addressing to 36 bits - VDUSE: avoid leaking information to userspace - vduse: remove unused vaddr parameter of vduse_domain_free_coherent - vduse: take out allocations from vduse_dev_alloc_coherent - vduse: Use fixed 4KB bounce pages for non-4KB page size - VFS/audit: introduce kern_path_parent() for audit - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets - vxlan: mdb: Fix source list corruption on a failed replace - vxlan: require CAP_NET_ADMIN in the device netns for changelink - wan: wanxl: Only reset hardware after BAR mapping - watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() - wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() - wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin - wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() - wifi: ath11k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET - wifi: ath12k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET - wifi: ath6kl: fix OOB access from firmware ADDBA window size - wifi: ath6kl: fix OOB read from firmware IE lengths in connect event - wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request - wifi: brcmfmac: fix 802.1X-SHA256 call trace warning - wifi: brcmfmac: initialize SDIO data work before cleanup - wifi: brcmfmac: make release_scratchbuffers idempotent - wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read - wifi: carl9170: fix buffer overflow in rx_stream failover path - wifi: carl9170: fix OOB read from off-by-two in TX status handler - wifi: cfg80211: bound element ID read when checking non-inheritance - wifi: cfg80211: cancel sched scan results work on unregister - wifi: cfg80211: reject unsupported PMSR FTM location requests - wifi: cfg80211: validate PMSR FTM preamble range - wifi: cfg80211: validate PMSR measurement type data - wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one() - wifi: iwlwifi: mvm: fix read in wake packet notification handler - wifi: iwlwifi: mvm: validate SAR GEO response payload size - wifi: libertas: fix memory leak in helper_firmware_cb() - wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() - wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock - wifi: mac80211_hwsim: clamp virtio RX length before skb_put - wifi: mac80211: recalculate TIM when a station enters power save - wifi: mac80211: tear down new links on vif update error path - wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv() - wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses - wifi: mt76: mt7915: guard HE capability lookups - wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses - wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap() - wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht() - wifi: mwifiex: bound uAP association event IEs to the event buffer - wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper - wifi: nl80211: free RNR data on MBSSID mismatch - wifi: nl80211: validate nested MBSSID IE blobs - wifi: p54: validate RX frame length in p54_rx_eeprom_readback() - wifi: wilc1000: validate assoc response length before subtracting header - workqueue: Add system_percpu_wq and system_dfl_wq - workqueue: Factor out init_cpu_worker_pool() - x86/boot/compressed: Disable jump tables - xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() - xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert - xprtrdma: Clear receive-side ownership pointers on release - Updated by kernel-updater-bot (https://abf.io/mikhailnov/kernel-updater-bot)- [bot] upd: 6.6.144 -> 6.6.145 - Changelog: - 6lowpan: fix NHC entry use-after-free on error path - 9p: skip nlink update in cacheless mode to fix WARN_ON - ACPI: bus: Introduce devm_acpi_install_notify_handler() - ACPI: CPPC: Suppress UBSAN warning caused by field misuse - ACPI: driver: Check ACPI_COMPANION() against NULL during probe - ACPI: IPMI: Fix inverted interface check in ipmi_bmc_gone() - ACPI: IPMI: Fix message kref handling on dead device - ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup - ACPI: NFIT: core: Fix possible deadlock and missing notifications - ACPI: NFIT: core: Fix possible NULL pointer dereference - ACPI: NFIT: core: Use devm_acpi_install_notify_handler() - ACPI: resource: Amend kernel-doc style - afs: Fix callback service message parsers to pass through -EAGAIN - afs: Fix error code in afs_extract_vl_addrs() - afs: Fix further netns teardown to cancel the preallocation charger - afs: Fix netns teardown to cancel the preallocation charger - afs: fix NULL pointer dereference in afs_get_tree() - afs: Fix the volume AFS_VOLUME_RM_TREE is set on - afs: Fix unchecked-length string display in debug statement - afs: Fix vllist leak - afs: use kvfree() to free memory allocated by kvcalloc() - alpha/PCI: Add security_locked_down() check to pci_mmap_resource() - alpha/PCI: Fix __pci_mmap_fits() overflow for zero-length BARs - ALSA: aoa: check snd_ctl_new1() return value - ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser - ALSA: cmipci: check snd_ctl_new1() return value - ALSA: core: Fix unintuitive behavior of snd_power_ref_and_wait() - ALSA: es1938: check snd_ctl_new1() return value - ALSA: firewire: isight: bound the sample count to the packet payload - ALSA: gus: check snd_ctl_new1() return value - ALSA: ice1712: check snd_ctl_new1() return value - ALSA: seq: Clear variable event pointer on read - ALSA: seq: Fix partial userptr event expansion - ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup() - ALSA: seq: midi: Serialize output teardown with event_input - ALSA: usb-audio: avoid kobject path lookup in DualSense match - ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints - ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put() - ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks - ALSA: usb-audio: Roll back quirk control caches on write errors - ALSA: usb-audio: Update Babyface Pro control caches only after successful writes - ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes - ALSA: virtio: Add missing 384 kHz PCM rate mapping - ALSA: ymfpci: check snd_ctl_new1() return value - amt: fix size calculation in amt_get_size() - apparmor: aa_getprocattr free procattr leak on format failure - apparmor: aa_label_alloc use aa_label_free on alloc failure - apparmor: advertise the tcp fast open fix is applied - apparmor: check label build before no_new_privs test - apparmor: fix label can not be immediately before a declaration - apparmor: fix potential UAF in aa_replace_profiles - apparmor: fix rawdata_f_data implicit flex array - apparmor: grab ns lock and refresh when looking up changehat child profiles - apparmor: put secmark label after secid lookup - arm64: dts: imx8x-colibri: Correct SODIMM PAD settings - arm64: dts: mediatek: mt8192-asurada: Move PCIe DMA bounce buffer to host - arm64: dts: qcom: sdm630: describe adsp_mem region properly - arm64: dts: qcom: sdm845-mezzanine: Fix camss ports unit_address_vs_reg warning - arm64: dts: qcom: sm8450: Add power-domain and iface clk for ice node - arm64: dts: qcom: sm8450: Fix ICE reg size - arm64: dts: rockchip: Fix gmac0 reset pin for NanoPi R5S - arm64: dts: rockchip: fix rk809 interrupt pin on rk3566-roc-pc - arm64: dts: tqma8mpql-mba8mpxl: configure sai clock in audio codec as well - arm64: Fix early handling of FEAT_E2H0 not being implemented - arm64: fpsimd: Fix type mismatch in sme_{save,load}_state() - arm64: fpsimd: Fix type mismatch in sve_{save,load}_state() - arm64/hw_breakpoint: reject unaligned watchpoints that would truncate BAS - arm64/mm: convert ptep_clear() to ptep_get_and_clear() - arm64/mm: convert READ_ONCE(*ptep) to ptep_get(ptep) - arm64/mm: convert set_pte_at() to set_ptes(..., 1) - arm64/mm: Optimize TLB flush in unmap_hotplug_[pmd|pud]_range() - arm64: Revamp HCR_EL2.E2H RES1 detection - arm64: sysreg: Add layout for ID_AA64MMFR4_EL1 - arm64: sysreg: Correct sign definitions for EIESB and DoubleLock - arm64: tegra: Fix Tegra234 MGBE PTP clock - arm64: Treat HCR_EL2.E2H as RES1 when ID_AA64MMFR4_EL1.E2H0 is negative - ARM: dts: am335x-sl50: Fix audio bitclock and frame master endpoint - ARM: imx31: Fix IIM mapping leak in revision check - ARM: imx3: Fix CCM node reference leak - ASoC: adau1372: Clear PLL_EN on failed PLL lock without reset GPIO - ASoC: codecs: aw88261: fix incorrect masks for boost regs - ASoC: codecs: hdac_hdmi: Validate written enum value - ASoC: cs35l56: Don't leave parent IRQ disabled if system_suspend fails - ASoC: cs35l56: Fix missing calls to wm_adsp2_remove() - ASoC: fsl_asrc_dma: fix eDMA maxburst misalignment with channel count - ASoC: fsl: fsl_audmix: Validate written enum values - ASoC: mediatek: mt8183: Release reserved memory on cleanup - ASoC: mediatek: mt8192: Release reserved memory on cleanup - ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback - ASoC: rsnd: Fix RSND_SOC_MASK width to single nibble - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get - ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get - ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control - ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put - ASoC: SOF: topology: validate vendor array size before parsing - ASoC: tegra: tegra210_ahub: Validate written enum value - ASoC: tlv320aic3x: restrict CLKDIV bypass Q values in dual-rate mode - ata: libata: Fix ata_exec_internal() - ata: pata_pxa: Fix DMA channel leak on probe error - ata: sata_gemini: unwind clocks on IDE pinctrl errors - audit: add audit_log_nf_skb helper function - audit: Fix data races of skb_queue_len() readers on audit_queue - audit: fix potential integer overflow in audit_log_n_hex() - batman-adv: access unicast_ttvn skb->data only after skb realloc - batman-adv: bla: reacquire gw address after skb realloc - batman-adv: clean untagged VLAN on netdev registration failure - batman-adv: dat: acquire ARP hw source only after skb realloc - batman-adv: dat: ensure accessible eth_hdr proto field - batman-adv: dat: fix tie-break for candidate selection - batman-adv: ensure minimal ethernet header on TX - batman-adv: fix VLAN priority offset - batman-adv: frag: fix primary_if leak on failed linearization - batman-adv: frag: free unfragmentable packet - batman-adv: gw: acquire ethernet header only after skb realloc - batman-adv: retrieve ethhdr after potential skb realloc on RX - batman-adv: tt: avoid request storms during pending request - batman-adv: tt: prevent TVLV OOB check overflow - binder: fix UAF in binder_free_transaction() - binder: fix UAF in binder_thread_release() - bitops: make BYTES_TO_BITS() treewide-available - bitops: use common function parameter names - block: Avoid mounting the bdev pseudo-filesystem in userspace - block: skip sync_blockdev() on surprise removal in bdev_mark_dead() - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister - Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev - Bluetooth: 6lowpan: hold L2CAP conn across debugfs control - Bluetooth: bnep: pin L2CAP connection during netdev registration - Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup() - Bluetooth: btmtk: apply the common btmtk_fw_get_filename - Bluetooth: btmtk: Fix btmtk.c undefined reference build error - Bluetooth: btmtk: Fix btmtk.c undefined reference build error harder - Bluetooth: btmtk: Fix failed to send func ctrl for MediaTek devices. - Bluetooth: btmtk: Fix wait_on_bit_timeout interruption during shutdown - Bluetooth: btmtk: move btusb_mtk_[setup, shutdown] to btmtk.c - Bluetooth: btmtk: remove #ifdef around declarations - Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work() - Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3() - Bluetooth: btrtl: validate firmware patch bounds - Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB - Bluetooth: btusb: fix use-after-free on marvell probe failure - Bluetooth: btusb: fix use-after-free on registration failure - Bluetooth: btusb: fix wakeup source leak on probe failure - Bluetooth: btusb: mediatek: add MT7922 subsystem reset - Bluetooth: btusb: mediatek: remove the unnecessary goto tag - Bluetooth: btusb: mediatek: reset the controller before downloading the fw - Bluetooth: btusb: mediatek: return error for failed reg access - Bluetooth: fix UAF in bt_accept_dequeue() - Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn() - Bluetooth: hci_core: Enable buffer flow control for SCO/eSCO - Bluetooth: hci_core: Remove check of BDADDR_ANY in hci_conn_hash_lookup_big_state - Bluetooth: hci_qca: fix NULL pointer dereference in qca_dmp_hdr() for non-serdev device - Bluetooth: hci_sync: annotate data-races around hdev->req_status - Bluetooth: hci_sync: Fix attempting to send HCI_Disconnect to BIS handle - Bluetooth: hci: validate codec capability element length - Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID - Bluetooth: ISO: exclude RFU bits from ISO_SDU_Length - Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock - Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() - Bluetooth: L2CAP: validate option length before reading conf opt value - Bluetooth: MGMT: Fix adv monitor add failure cleanup - Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete - Bluetooth: SCO: fix sleeping under spinlock in sco_conn_ready - Bluetooth: SCO: hold sk properly in sco_conn_ready - Bluetooth: separate CIS_LINK and BIS_LINK link types - Bluetooth: vhci: validate devcoredump state before side effects - bnx2x: fix potential memory leak in bnx2x_alloc_mem_bp() - bonding: 3ad: fix mux port state on oper down - bonding: add ESP offload features when slaves support - bonding: Correctly support GSO ESP offload - bonding: Fix initial {vlan,mpls}_feature set in bond_compute_features - bonding: fix type confusion in bond_setup_by_slave() - bonding: fix xfrm offload feature setup on active-backup mode - bonding: prevent potential infinite loop in bond_header_parse() - bonding: use common function to compute the features - bpf: Add missing access_ok call to copy_user_syms - bpf: Allow LPM map access from sleepable BPF programs - bpf, arm64: Reject out-of-range B.cond targets - bpf: Check tail zero of bpf_prog_info - bpf: Consistently use bpf_rcu_lock_held() everywhere - bpf: Disable xfrm_decode_session hook attachment - bpf: Fix bpf_get/setsockopt to tos for ipv4-mapped ipv6 socket - bpf: Fix effective prog array index with BPF_F_PREORDER - bpf: Fix stack slot index in nospec checks - bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs - bpf,fork: wipe ->bpf_storage before bailouts that access it - bpf, lsm: Add disabled BPF LSM hook list - bpf: Prefer dirty packs for eBPF allocations - bpf: Prefer packs that won't trigger an IBPB flush on allocation - bpf: Reject fragmented frames in devmap - bpf: Restore sysctl new-value from 1 to 0 - bpf: Restrict JIT predictor flush to cBPF - bpf: Run generic devmap egress prog on private skb - bpf: Skip redundant IBPB in pack allocator - bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check - bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() - bpf: Support for hardening against JIT spraying - bpf: Tighten cgroup storage cookie checks for prog arrays - bpftool: Use libbpf error code for flow dissector query - bpf: Update transport_header when encapsulating UDP tunnel in lwt - bpf: zero-initialize the fib lookup flow struct - bridge: cfm: reject invalid CCM interval at configuration time - bridge: stp: Fix a potential use-after-free when deleting a bridge - btrfs: check and set EXTENT_DELALLOC_NEW before clearing EXTENT_DELALLOC - btrfs: do not trim a device which is not writeable - btrfs: fix false IO failure after falling back to buffered write - btrfs: fix incorrect buffered IO fallback for append direct writes - btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs() - btrfs: zoned: don't account data relocation space-info in statfs free space - bus: mhi: ep: Fix potential deadlock in mhi_ep_reset_worker() - bus: mhi: ep: Protect mhi_ep_handle_syserr() in the error path - bus: sunxi-rsb: Always check register address validity - can: bcm: add missing rcu list annotations and operations - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF - can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure - can: esd_usb: kill anchored URBs before freeing netdevs - can: isotp: use unconditional synchronize_rcu() in isotp_release() - cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed - char: tlclk: fix use-after-free in tlclk_cleanup() - cifs: invalidate cfid on unlink/rename/rmdir - cifs: remove all cifs files before kill super - cifs: validate DFS referral string offsets - clk: at91: keep securam node alive while mapping it - clk: qcom: a53: Corrected frequency multiplier for 1152MHz - clk: scmi: Fix clock rate rounding - clk: scpi: Unregister child clock providers on remove - clocksource/drivers/sun5i: Handle error returns from devm_reset_control_get_optional_exclusive() - clocksource/drivers/timer-tegra186: Fix support for multiple watchdog instances - configfs: fix lockless traversals of ->s_children - configfs_lookup(): don't leave ->s_dentry dangling on failure - coresight: cti: Fix DT filter signals silently ignored - coresight: etb10: restore atomic_t for shared reading state - coresight: etm4x: Correct TRCVMIDCCTLR1 save and restore - coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() - cpufreq: conservative: Simplify frequency limit handling - cpufreq: Documentation: fix conservative governor freq_step description - cpufreq: Documentation: fix sampling_down_factor range - cpufreq: Fix hotplug-suspend race during reboot - cpufreq: intel_pstate: Sync policy->cur during CPU offline - cpufreq: pcc: fix use-after-free and double free in _OSC evaluation - cpu: hotplug: Bound hotplug states sysfs output - cpu: hotplug: Preserve per instance callback errors - crypto: af_alg - Remove zero-copy support from skcipher and aead - crypto: algif_skcipher - force synchronous processing on trees without ctx->state - crypto: amlogic - avoid double cleanup in meson_crypto_probe() - crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents - crypto: atmel - Drop explicit initialization of struct i2c_device_id::driver_data to 0 - crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A - crypto: atmel-sha204a - fix blocking and non-blocking rng logic - crypto: caam - use print_hex_dump_devel to guard key hex dumps - crypto: caam - use print_hex_dump_devel to guard key hex dumps again - crypto: cavium/cpt - fix DMA cleanup using wrong loop index - crypto: ccp - Treat zero-length cert chain as query for blob lengths - crypto: crypto4xx - Remove ahash-related code - crypto: crypto4xx - Remove insecure and unused rng_alg - crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels - crypto: drbg - Fix returning success on failure in CTR_DRBG - crypto: drbg - Fix the fips_enabled priority boost - crypto: ecc - Fix carry overflow in vli multiplication - crypto: ecrdsa - fix unknown OID check in ecrdsa_param_curve - crypto: hisilicon/qm - disable error report before flr - crypto: hisi-trng - Remove crypto_rng interface - crypto: marvell/octeontx - fix DMA cleanup using wrong loop index - crypto: pcrypt - restore callback for non-parallel fallback - crypto: qat - fix restarting state leak on allocation failure - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() - crypto: qat - validate RSA CRT component lengths - crypto: rng - Free default RNG on module exit - crypto: sun4i-ss - Remove insecure and unused rng_alg - crypto: talitos - add chaining of arbitrary number of descriptor for the SEC1 - crypto: talitos - fix SEC1 32k ahash request limitation - crypto: talitos/hash - drop workqueue mechanism for SEC1 - crypto: talitos/hash - fix SEC2 64k - 1 ahash request limitation - crypto: talitos/hash - prepare SEC1 descriptor chaining, remove additional descriptor - crypto: talitos/hash - remove useless wrapper - crypto: talitos/hash - rename first_desc/last_desc to first_request/last_request - crypto: talitos/hash - use descriptor chaining for SEC1 instead of workqueue - crypto: talitos - move code in current_desc_hdr() into a standalone function - crypto: talitos - move dma mapping code in talitos_submit() into a standalone dma_map_request() function - crypto: talitos - move dma unmapping code in flush_channel() into a standalone dma_unmap_request() function - crypto: talitos - rename first/last to first_desc/last_desc - crypto: talitos - stop using crypto_ahash::init - crypto: talitos - use dma_sync_single_for_cpu() before reading descriptor header - cxgb4: Fix decode strings dump for T6 adapters - cxl/test: Add check after kzalloc() memory in alloc_mock_res() - cxl/test: Fix integer overflow in mock LSA bounds checks - cxl/test: Zero out LSA backing memory to avoid leaking to user - dax/kmem: account for partial discontiguous resource upon removal - debugobjects: Plug race against a concurrent OOM disable - device property: fix fwnode reference leak in fwnode_graph_get_endpoint_by_id() - device property: initialize the remaining fields of fwnode_handle in fwnode_init() - devlink: Fix parent ref leak in devl_rate_node_create() - dlm: fix add msg handle in send_queue ordered - dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK - dmaengine: Fix possible use after free - dmaengine: imx-sdma: Refine spba bus searching in probe - dmaengine: qcom: gpi: set DMA_PRIVATE capability - dmaengine: tegra: Fix burst size calculation - dm-bufio: fix wrong count calculation in dm_bufio_issue_discard - dm_early_create: fix freeing used table on dm_resume failure - dm era: fix NULL pointer dereference in metadata_open() - dm era: fix out-of-bounds memory access for non-zero start sector - dm-integrity: don't increment hash_offset twice - dm-ioctl: fix a possible overflow in list_version_get_info - dm-ioctl: report an error if a device has no table - dm-log: fix a bitset_size overflow on 32bit machines - dm-stats: fix dm_jiffies_to_msec64 - dm-stats: fix merge accounting - dm thin metadata: fix metadata snapshot consistency on commit failure - dm thin metadata: fix superblock refcount leak on snapshot shadow failure - dm-verity: fix a possible NULL pointer dereference - dm-verity: increase sprintf buffer size - Documentation: proc: fix section numbering in table of contents - dpaa2-switch: fix VLAN upper check not rejecting bridge join - drbd: reject data replies with an out-of-range payload size - driver core: Fix missing jiffies conversion in deferred_probe_extend_timeout() - driver core: Guard deferred probe timeout extension with delayed_work_pending() - driver core: Use mod_delayed_work to prevent lost deferred probe work - driver core: use READ_ONCE() for dev->driver in dev_has_sync_state() - drm/amd/display: Add missing kdoc for ALLM parameters - drm/amd: Fix set but not used warnings - drm/amdgpu: fix integer overflow in amdgpu_gem_align_pitch() - drm/amdgpu: initialize irq.lock spinlock earlier - drm/amdgpu: set sub_block_index for mca ras sub-blocks - drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free - drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm - drm/amdkfd: Validate CRIU-restored IDs before idr_alloc - drm/edid: fix OOB read in drm_parse_tiled_block() - drm/hisilicon/hibmc: move display contrl config to hibmc_probe() - drm/hisilicon/hibmc: use clock to look up the PLL value - drm/msm/dp: fix HPD state status bit shift value - drm/msm/dp: Fix the ISR_* enum values - drm/nouveau/bios: specify correct display fuse register for Ampere and Ada - drm/radeon: fix integer overflow in radeon_align_pitch() - drm/radeon: fix memory leak in radeon_ring_restore() on lock failure - drm/rockchip: Test for imported buffers with drm_gem_is_imported() - drm/tegra: dc: Fix device node reference leak in tegra_dc_has_output() - drm/tegra: Fix iommu_map_sgtable() return value check - drm/tegra: gr2d/gr3d: Contain PM in the gr*d_probe/gr*d_remove - drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered - drm/tidss: Drop extra drm_mode_config_reset() call - dt-bindings: media: sun4i-a10-video-engine: Add interconnect properties - dt-bindings: net: renesas,ether: Drop example "ethernet-phy-ieee802.3-c22" fallback - dt-bindings: pinctrl: nvidia,tegra234: Add missing required block - dt-bindings: power: imx93: Add MIPI PHY power domain - EDAC/i10nm: Don't fail probing if ADXL is missing - EDAC/{skx_common,skx}: Fix UBSAN shift-out-of-bounds in skx_get_dimm_info - espintcp: use sk_msg_free_partial to fix partial send - evm: terminate and bound the evm_xattrs read buffer - exfat: add exfat_get_dentry_set_by_ei() helper - exfat: bound uniname advance in exfat_find_dir_entry() - exfat: move exfat_chain_set() out of __exfat_resolve_path() - exfat: move free cluster out of exfat_init_ext_entry() - exfat: preserve benign secondary entries during rename and move - exfat: remove unnecessary read entry in __exfat_rename() - exfat: rename argument name for exfat_move_file and exfat_rename_file - ext2: fix ignored return value of generic_write_sync() - ext4: fix kernel BUG in ext4_write_inline_data_end - ext4: fix LOGFLUSH shutdown ordering to allow ordered-mode data writeback - ext4: get rid of ppath in get_ext_path() - f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode - f2fs: bound i_inline_xattr_size for non-inline-xattr inodes - f2fs: fix listxattr handling of corrupted xattr entries - f2fs: fix potential deadlock in f2fs_balance_fs() - f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs() - f2fs: validate orphan inode entry count - fbcon: fix NULL pointer dereference for a console without vc_data - fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe() - fbdev: carminefb: fix potential memory leak in alloc_carmine_fb() - fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font() - fbdev: hecubafb: fix potential memory leak in hecubafb_probe() - fbdev: i740fb: fix potential memory leak in i740fb_probe() - fbdev: metronomefb: fix potential memory leak in metronomefb_probe() - fbdev: nvidia: fix potential memory leak in nvidiafb_probe() - fbdev: radeon: fix potential memory leak in radeonfb_pci_register() - fbdev: s3fb: fix potential memory leak in s3_pci_probe() - fbdev: sm501fb: Fix buffer errors in OF binding code - fbdev: sm712: Fix operator precedence in big_swap macro - fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe() - fbdev: tridentfb: fix potential memory leak in trident_pci_probe() - fbdev: uvesafb: fix potential memory leak in uvesafb_probe() - fbdev: vesafb: fix memory leak in vesafb_probe() - firmware: arm_scmi: Fix OOB in scmi_power_name_get() - firmware: arm_scmi: Read sensor config as 32-bit value - firmware_loader: fix device reference leak in firmware_upload_register() - firmware_loader: Fix recursive lock in device_cache_fw_images() - flow_dissector: check device type before reading ETH_ADDRS - fpga: dfl: add bounds check in dfh_get_param_size() - fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header() - fs: efs: remove unneeded debug prints - fsl/fman: Free init resources on KeyGen failure in fman_init() - fs/ntfs3: add bounds check to run_get_highest_vcn() - fs/ntfs3: add depth limit to indx_find_buffer to prevent stack overflow - fs/ntfs3: bound attr_off in UpdateResidentValue against data_off - fs/ntfs3: bound copy_lcns dp->page_lcns[] index in analysis pass - fs/ntfs3: bound DeleteIndexEntryAllocation memmove length - fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation} - fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked() - fs/ntfs3: fix mount failure on 64K page-size kernels - fs/ntfs3: fix syncing wrong inode on DIRSYNC cross-directory rename - fs/ntfs3: fsync files by syncing parent inodes - fs/ntfs3: handle attr_set_size() errors when truncating files - fs/ntfs3: resize log->one_page_buf when adopting on-disk page size - fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns - fs/ntfs3: validate lcns_follow in log_replay conversion - fs/ntfs3: zero-fill folios beyond i_valid in ntfs_read_folio() - fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid - fuse: fix device node leak in cuse_process_init_reply() - fuse: re-lock request before returning from fuse_ref_folio() - gpio: eic-sprd: use raw_spinlock_t in the irq startup path - gpio-f7188x: Add support for NCT6126D version B - gpio: htc-egpio: use managed gpiochip registration - gpio: mlxbf3: fail probe if gpiochip registration fails - gpio: mvebu: fail probe if gpiochip registration fails - gpio: sch: use raw_spinlock_t in the irq startup path - gpios: palmas: add .get_direction() op - gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe - gpu: host1x: Allow entries in BO caches to be freed - gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path - gpu: host1x: Fix iommu_map_sgtable() return value check - gue: validate REMCSUM private option length - handshake: Require admin permission for DONE command - hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length - hfs/hfsplus: prevent getting negative values of offset/length - hfs/hfsplus: zero-initialize buffer in hfs_bnode_read - HID: add haptics page defines - HID: appleir: fix UAF on pending key_up_timer in remove() - HID: core: Fix OOB read in hid_get_report for numbered reports - HID: letsketch: fix UAF on inrange_timer at driver unbind - HID: lg-g15: cancel pending work on remove to fix a use-after-free - HID: logitech-hidpp: remove excess kernel-doc member in hidpp_scroll_counter - HID: multitouch: fix out-of-bounds bit access on mt_io_flags - HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait() - HID: playstation: validate num_touch_reports in DualShock 4 reports - HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte reads - HID: wacom: stop hardware after post-start probe failures - HID: wiimote: Fix table layout and whitespace errors - hwmon: adm1275: Prevent reading uninitialized stack - hwmon: (asus_atk0110) Check package count before accessing element - hwmon: (it87) Clamp negative values to zero in set_fan() - hwmon: (ltc2992) add missing 'select REGMAP_I2C' to Kconfig - hwmon: (occ) unregister sysfs devices outside occ lock - hwmon: (pmbus) Fix passing events to regulator core - hwmon: (w83627hf) remove VID sysfs files on error and remove - hwmon: (w83793) remove vrm sysfs file on probe failure - hwrng: jh7110 - fix refcount leak in starfive_trng_read() - hwrng: virtio: clamp device-reported used.len at copy_data() - hwspinlock: qcom: avoid uninitialized struct members - i2c: core: fix adapter debugfs creation - i2c: core: fix adapter deregistration race - i2c: core: fix adapter registration race - i2c: core: fix hang on adapter registration failure - i2c: core: fix irq domain leak on adapter registration failure - i2c: core: fix NULL-deref on adapter registration failure - i2c: mediatek: fix WRRD for SoCs without auto_restart option - i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource() - i2c: mpc: Fix timeout calculations - i2c: stm32f7: truncate clock period instead of rounding it - i3c: master: Prevent reuse of dynamic address on device add failure - i40e: Fix i40e_debug() to use struct i40e_hw argument - ia64: Make acpi_cpufreq_cpu_exit return void - IB/cm: Fix av cm device leak on an error path in cm_init_av_by_path() - IB/mlx4: Fill in the access_flags if IB_MR_REREG_ACCESS is not specified - IB/mlx4: Fix refcount leak in add_port() error path - IB/mlx5: Don't take the rereg_mr fallback without a new translation - IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier - IB/mlx5: Properly support implicit ODP rereg_mr - ice: fix AQ error code comparison in ice_set_pauseparam() - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() - ice: fix ice_init_link() error return preventing probe - ieee802154: admin-gate legacy LLSEC dump operations - ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation - ieee802154: ca8210: fix cas_ctl leak on spi_async failure - ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit - ieee802154: fix kernel-infoleak in dgram_recvmsg() - ieee802154: Remove WARN_ON() in cfg802154_pernet_exit() - iio: accel: bmc150: clamp the device-reported FIFO frame count - iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error - iio: accel: mma8452: handle I2C read error(s) in mma8452_read() - iio: adc: lpc32xx: Initialize completion before requesting IRQ - iio: adc: spear: Initialize completion before requesting IRQ - iio: adc: ti-ads124s08: Return reset GPIO lookup errors - iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling - iio: chemical: scd30: Cleanup initializations and fix sign-extension bug - iio: common: st_sensors: honour channel endianness in read_axis_data - iio: event: Fix event FIFO reset race - iio: gyro: bmg160: bail out when bandwidth/filter is not in table - iio: gyro: bmg160: wait full startup time after mode change at probe - iio: hid-sensor-rotation: Fix stale or zero output when reading raw values - iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ - iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ - iio: imu: inv_icm42600: fix timestamp clock period by using lower value - iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading - iio: imu: inv_icm42600: stabilized timestamp in interrupt - iio: imu: st_lsm6dsx: deselect shub page before reading whoami - iio: invensense: fix timestamp glitches when switching frequency - iio: invensense: remove redundant initialization of variable period - iio: light: al3010: fix incorrect scale for the highest gain range - iio: light: gp2ap002: fix runtime PM leak on read error - iio: light: opt3001: fix missing state reset on timeout - iio: light: si1133: prevent race condition on timeout - iio: light: si1133: reset counter to prevent race condition - iio: light: tsl2591: return actual error from probe IRQ failure - iio: light: veml6030: fix channel type when pushing events - iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call - iio: magnetometer: ak8975: fix potential kernel stack memory leak - iio: pressure: mpl115: fix runtime PM leak on read error - iio: tcs3472: power down chip on probe failure - iio: temperature: ltc2983: Fix n_wires default bypassing rotation check - iio: temperature: ltc2983: Fix reinit_completion() called after conversion start - Input: elan_i2c - prevent division by zero and arithmetic underflow - Input: goodix - clamp the device-reported contact count - Input: iforce - bound the device-reported force-feedback effect index - Input: ims-pcu - add response length checks - Input: ims-pcu - fix DMA mapping violation in line setup - Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging - Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing - Input: ims-pcu - fix race condition in reset_device sysfs callback - Input: ims-pcu - fix type confusion in CDC union descriptor parsing - Input: ims-pcu - fix use-after-free and double-free in disconnect - Input: ims-pcu - release data interface on disconnect - Input: ims-pcu - validate control endpoint type - Input: maplecontrol - set driver data before registering input device - Input: maple_keyb - set driver data before registering input device - Input: maplemouse - fix NULL pointer dereference in open() - Input: maplemouse - set driver data before registering input device - Input: mms114 - fix multi-touch slot corruption - Input: mms114 - fix touch indexing for MMS134S and MMS136 - Input: mms114 - reject an oversized device packet size - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count - Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure - Input: touchwin - reset the packet index on every complete packet - iommu/amd: Fix a stale comment about which legacy mode is user visible - ionic: Fix check in ionic_get_link_ext_stats - io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item - ipv4: fib: Don't ignore error route in local/main tables. - ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() - ipv4: igmp: remove multicast group from hash table on device destruction - ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD - ipv6: fix error handling in disable_ipv6 sysctl - ipv6: fix error handling in disable_policy sysctl - ipv6: fix error handling in forwarding sysctl - ipv6: fix error handling in ignore_routes_with_linkdown sysctl - ipv6: Fix null-ptr-deref in fib6_nh_mtu_change(). - ipv6: guard against possible NULL deref in __in6_dev_stats_get() - ipv6: mcast: Fix potential UAF in MLD delayed work - ipv6: mcast: Replace locking comments with lockdep annotations. - ipvs: ensure inner headers in ICMP errors are in headroom - ipvs: fix more places with wrong ipv6 transport offsets - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors - ipvs: pass parsed transport offset to state handlers - ipvs: reload ip header after head reallocation - ipvs: reset full ip_vs_seq structs in ip_vs_conn_new - ipvs: use parsed transport offset in SCTP state lookup - ipvs: use parsed transport offset in TCP state lookup - irqchip/crossbar: Fix parent domain resource leak - irqchip/crossbar: Use correct index in crossbar_domain_free() - irqchip/gic-v3-its: Fix OF node reference leak - irqchip/ts4800: Fix missing chained handler cleanup on remove - isofs: bound Rock Ridge symlink components to the SL record - jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit() - jiffies: Cast to unsigned long in secs_to_jiffies() conversion - jiffies: Define secs_to_jiffies() - kcm: use WRITE_ONCE() when changing lower socket callbacks - kconfig: fix potential NULL pointer dereference in conf_askvalue - KEYS: Use acquire when reading state in keyring search - ksmbd: add a permission check for FSCTL_SET_ZERO_DATA - ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY - ksmbd: add per-handle permission check to FILE_LINK_INFORMATION - ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE - ksmbd: centralize ksmbd_conn final release to plug transport leak - ksmbd: enforce FILE_READ_ATTRIBUTES on SMB_FIND_FILE_POSIX_INFORMATION - ksmbd: fix durable reconnect double-bind race in ksmbd_reopen_durable_fd - ksmbd: fix integer overflow in set_file_allocation_info() - ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation - ksmbd: fix use-after-free in same_client_has_lease() - ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL - ksmbd: fix use-after-free of conn->preauth_info in concurrent SMB2 NEGOTIATE - ksmbd: fix use-after-free of fp->owner.name in durable handle owner check - ksmbd: reject undersized DACLs before parsing ACEs - ksmbd: require source read access for duplicate extents - ksmbd: run set info with opener credentials - ksmbd: serialize QUERY_DIRECTORY requests per file - ksmbd: track the connection owning a byte-range lock - ksmbd: use opener credentials for delete-on-close - ksmbd: use opener credentials for FSCTL mutations - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU - KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU - KVM: arm64: Initialize HCR_EL2.E2H early - KVM: arm64: Initialize SCTLR_EL1 in __kvm_hyp_init_cpu() - KVM: arm64: vgic: Check the interrupt is still ours before migrating it - KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers - KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() - KVM: s390: pci: Fix GISC refcount leak on AIF enable failure - KVM: s390: pci: Fix handling of AIF enable without AISB - KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode - KVM: VMX: Refresh GUEST_PENDING_DBG_EXCEPTIONS.BS on all injected #DBs - KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs - leds: uleds: Fix potential buffer overread - libbpf: Fix UAF in strset__add_str() - libbpf: Harden parse_vma_segs() path parsing - libbpf: Report error when a negative kprobe offset is specified - lib/test_meminit: use && for bools - llc: fix SAP refcount leak in llc_ui_autobind() - llc: fix SAP refcount leak when creating incoming sockets - lockd: Plug nlm_file leak when nlm_do_fopen() fails - lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure - LoongArch: Add PIO for early access before ACPI PCI root register - LoongArch: Fix missing dirty page tracking in {pte,pmd}_wrprotect() - LoongArch: Report dying CPU to RCU in stop_this_cpu() - mac802154: remove interfaces with RCU list deletion - macsec: don't read an unset MAC header in macsec_encrypt() - macsec: fix promiscuity refcount leak in macsec_dev_open() - mailbox: mtk-adsp: fix UAF during device teardown - md/raid10: reset read_slot when reusing r10bio for discard - md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry - media: atomisp: Fix memory leak in atomisp_fixed_pattern_table() - media: cedrus: Fix failure to clean up hardware on probe failure - media: mtk-jpeg: cancel workqueue on release for supported platforms only - media: nxp: imx8-isi: Convert to platform remove callback returning void - media: nxp: imx8-isi: Fix use-after-free on remove - media: nxp: imx8-isi: use devm_pm_runtime_enable() to simplify code - media: qcom: venus: drop extra padding in NV12 raw size calculation - media: qcom: venus: relax encoder frame/blur dimension steps on v4 - media: qcom: venus: relax encoder frame/blur step size on v6 - media: rockchip: rga: fix too small buffer size - media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe - media: uvcvideo: Avoid partial metadata buffers - media: uvcvideo: Fix buffer sequence in frame gaps - media: uvcvideo: Fix sequence number when no EOF - media: v4l2-common: Add YUV24 format info - memstick: ms_block: reject a card that reports too many blocks - mfd: cros_ec: Delay dev_set_drvdata() until probe success - mfd: cs42l43: Sanity check firmware size - mfd: sm501: Fix reference leak on failed device registration - mfd: tps6586x: Fix OF node refcount - minix: avoid overflow in bitmap block count calculation - MIPS: DEC: Ensure 32-bit stack location for o32 prom_printf() - MIPS: DEC: Ensure RTC platform device deregistration upon failure - MIPS: DEC: Remove do_IRQ() call indirection - MIPS: Fix big-endian stack argument fetching in o32 wrapper - MIPS: ip22-gio: fix device reference leak in probe - MIPS: ip22-gio: fix gio device memory leak - MIPS: ip22-gio: fix kfree() of static object - MIPS: mm: Fix out-of-bounds write in maar_res_walk() - mips: n64: add __iomem for writel call - mips: ralink: mt7621: add missing __iomem - mips: sched: Fix CPUMASK_OFFSTACK memory corruption - MIPS: smp: report dying CPU to RCU in stop_this_cpu() - mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() - mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace() - mmc: vub300: defer reset until cmd_mutex is unlocked - mm/damon/core: make charge_addr_from aware of end-address exclusivity - mm/damon/ops-common: handle extreme intervals in damon_hot_score() - mm/damon/sysfs-schemes: fix dir put orders in access_pattern_add_dirs() - mm/damon/sysfs-schemes: put stats for scheme_add_dirs() internal error - mm: do file ownership checks with the proper mount idmap - mm/fake-numa: fix under-allocation detection in uniform split - mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE - mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show() - mm: shrinker: fix NULL pointer dereference in debugfs - mm: shrinker: remove redundant shrinker_rwsem in debugfs operations - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled - mm/vmscan: flush deferred TLB before freeing large folios - module: decompress: check return value of module_extend_max_pages() - mtd: maps: vmu-flash: fix NULL pointer dereference in initialization - mtd: mchp23k256: use SPI match data for chip caps - mtd: onenand: samsung: report DMA completion timeouts - mtd: rawnand: fix condition in 'nand_select_target()' - mtd: rawnand: fsl_ifc: return errors for failed page reads - mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout - mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout - mtd: rawnand: pl353: fix probe resource allocation - mtd: slram: remove failed entries from the device list - mtd: spi-nor: Drop duplicate Kconfig dependency - mtd: spi-nor: swp: Improve locking user experience - net/9p: fix infinite loop in p9_client_rpc on fatal signal - net/9p: fix race condition on rdma->state in trans_rdma.c - net: add a common function to compute features for upper devices - net: af_key: initialize alg_key_len for IPComp states - net: atm: reject out-of-range traffic classes in QoS validation - net: bcmgenet: Use weighted round-robin TX DMA arbitration - net, bpf: check master for NULL in xdp_master_redirect() - net: Drop the lock in skb_may_tx_timestamp() - net: dsa: sja1105: round up PTP perout pin duration - net: ena: clean up XDP TX queues when regular TX setup fails - net: enetc: check the number of BDs needed for xdp_frame - net: ethernet: mtk_ppe: Fix rhashtable leak in mtk_ppe_init error paths - net: ethernet: sunplus: spl2sw: fix phy_node refcount leak in remove - net: fib_rules: Don't dump dying fib_rule in fib_rules_dump(). - netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() - netfilter: conntrack: call nf_ct_gre_keymap_destroy() if master helper is pptp - netfilter: conntrack: revert ct extension genid infrastructure - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump - netfilter: ebtables: module names must be null-terminated - netfilter: ebtables: terminate table name before find_table_lock() - netfilter: ebtables: Use vmalloc_array() to improve code - netfilter: ebtables: zero chainstack array - netfilter: ecache: fix inverted time_after() check - netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop - netfilter: ipset: annotate "pos" for concurrent readers/writers - netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types - netfilter: ipset: Fix data race between add and dump in all hash types - netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer() - netfilter: ipset: fix race between dump and ip_set_list resize - netfilter: nf_conncount: callers must hold rcu read lock - netfilter: nf_conncount: fix zone comparison in tuple dedup - netfilter: nf_conncount: prevent connlimit drops for early confirmed ct - netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read - netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag - netfilter: nf_nat: avoid invalid nat_net pointer use on failed nf_nat_init() - netfilter: nf_nat_sip: reload possible stale data pointer - netfilter: nfnetlink_osf: fix mss parsing on big-endian architectures - netfilter: nfnl_cthelper: apply per-class values when updating policies - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst - netfilter: nf_reject: skip iphdr options when looking for icmp header - netfilter: nft_compat: ebtables emulation must reject non-bridge targets - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak - netfilter: nft_synproxy: stop bypassing the priv->info snapshot - netfilter: synproxy: protect nf_ct_seqadj_init() with conntrack lock - netfilter: xt_cluster: reject template conntracks in hash match - netfilter: xt_connmark: reject invalid shift parameters - netfilter: xt_nat: reject unsupported target families - netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt() - netfilter: xt_u32: reject invalid shift counts - net: gianfar: dispose irq mappings on probe failure and device removal - net: ife: require ETH_HLEN to be pullable in ife_decode() - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink - net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink - net: ipip: require CAP_NET_ADMIN in the device netns for changelink - net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes - net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink - net: ixp4xx_hss: fix duplicate HDLC netdev allocation - net: lan743x: Initialize eth_syslock spinlock before use - net: liquidio: fix BAR resource leak on PF number failure - net: mana: guard TX wq object destroy with INVALID_MANA_HANDLE check - net: mana: initialize gdma queue id to INVALID_QUEUE_ID - net: marvell: prestera: initialize err in prestera_port_sfp_bind - net: microchip: vcap: fix races on the shared Super VCAP block - net/mlx5: Check max_macs devlink param value against max capability - net/mlx5e: Fix HV VHCA stats agent registration race - net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete - net/mlx5: Fix L3 tunnel entropy refcount leak - net: mvneta: re-enable percpu interrupt on resume - net: openvswitch: reject oversized nested action attrs - net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy - net: psample: fix info leak in PSAMPLE_ATTR_DATA - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() - net: qualcomm: rmnet: validate MAP frame length before ingress parsing - net/sched: act_bpf: use rcu_dereference_bh() to read the filter - net/sched: act_ct: preserve tc_skb_cb across defragmentation - net/sched: act_pedit: fix TOCTOU heap OOB write in tc offload - net/sched: cake: reject overhead values that underflow length - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle - net/sched: cls_bpf: prevent unbounded recursion in offload rollback - net/sched: cls_flow: Dont expose folded kernel pointers - net/sched: hhf: clear heavy-hitter state on reset - net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen - net/sched: sch_drr: annotate data-races around cl->deficit - net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen - net/sched: sch_hfsc: annotate data-races in hfsc_dump_class_stats() - net/sched: sch_hfsc: Don't make class passive twice - net/sched: sch_htb: annotate data-races (I) - net/sched: sch_htb: do not change sch->flags in htb_dump() - net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF - net/sched: sch_teql: move rcu_read_lock()/spin_lock() from _bh variants - net: sit: require CAP_NET_ADMIN in the device netns for changelink - net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket - net: sparx5: unregister blocking notifier on init failure - net: sungem: fix probe error cleanup - net, team, bonding: Add netdev_base_features helper - net: team: rename team to team_core for linking - net: thunderbolt: Fix frags[] overflow by bounding frame_count - net/tls: Consume empty data records in tls_sw_read_sock() - net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() - net: usb: lan78xx: disable VLAN filter in promiscuous mode - net: usb: lan78xx: move functions to avoid forward definitions - net: usb: net1080: validate packet_len before pad-byte access in rx_fixup - net: wwan: iosm: bound device offsets in the MUX downlink decoder - net: wwan: t7xx: check skb_clone in control TX - net: wwan: t7xx: destroy DMA pool on CLDMA late init failure - nfsd: change nfs4_client_to_reclaim() to allocate data - nfsd: Don't reset the write verifier on a commit EAGAIN - nfsd: move name lookup out of nfsd4_list_rec_dir() - nfsd: release layout stid on setlease failure - nfsd: reset write verifier on deferred writeback errors - nfs: keep PG_UPTODATE clear after read errors in page groups - NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS in pg_get_mirror_count_write - NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS on fatal DS connect errors - NFSv4/flexfiles: reject zero filehandle version count - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC - NFSv4/pnfs: defer return_range callbacks until after inode unlock - nilfs2: fix backing_dev_info reference leak - nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers - NTB: epf: Avoid calling pci_irq_vector() from hardirq context - NTB: epf: Fix doorbell bitmask and IRQ vector handling - NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr() - NTB: epf: Make db_valid_mask cover only real doorbell bits - NTB: epf: Report 0-based doorbell vector via ntb_db_event() - ntfs3: bound to_move in indx_insert_into_root before hdr_insert_head - ntfs3: cap RESTART_TABLE free-chain walker at rt->used - ntfs3: fix out-of-bounds read in decompress_lznt - ntfs3: validate split-point offset in indx_insert_into_buffer - nvdimm/btt: Free arenas on btt_init() error paths - nvdimm/btt: Free arena sub-allocations on discover_arenas() error path - nvdimm/btt: Handle preemption in BTT lane acquisition - nvme-multipath: fix flex array size in struct nvme_ns_head - nvme-multipath: set BIO_REMAPPED on bios remapped to per-path namespace disks - nvmet-auth: validate reply message payload bounds against transfer length - nvmet-rdma: handle inline data with a nonzero offset - nvmet: remove superfluous initialization - nvmet: return DHCHAP status codes from nvmet_setup_auth() - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path - nvmet-tcp: Fix potential UAF when ddgst mismatch - ocfs2: add journal NULL check in ocfs2_checkpoint_inode() - ocfs2: avoid moving extents to occupied clusters - ocfs2/dlm: require a ref for locking_state debugfs open - ocfs2: don't BUG_ON an invalid journal dinode - ocfs2: fix buffer head management in ocfs2_read_blocks() - ocfs2: fix circular locking dependency in ocfs2_dio_end_io_write - ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits - ocfs2: fix race between ocfs2_control_install_private() and ocfs2_control_release() - ocfs2: kill osb->system_file_mutex lock - ocfs2: rebase copied fsdlm LVB pointers in locking_state - ocfs2: reject dinodes whose i_rdev disagrees with the file type - ocfs2: reject dinodes with non-canonical i_mode type - ocfs2: reject FITRIM ranges shorter than a cluster - ocfs2: reject non-inline dinodes with i_size and zero i_clusters - ocfs2: use kzalloc for quota recovery bitmap allocation - octeontx2-af: fix VF bringup affecting PF promiscuous state - octeontx2-af: mcs: Fix unsupported secy stats read - octeontx2-pf: check DMAC extraction support before filtering - octeontx2-pf: Clear stats of all resources when freeing resources - octeontx2-pf: Fix leak of SQ timestamp buffer on teardown - octeontx2-pf: mcs: Fix mcs resources free on PF shutdown - of: cpu: add check in __of_find_n_match_cpu_property() - OPP: of: Fix potential memory leak in opp_parse_supplies() - orangefs: keep the readdir entry size 64-bit in fill_from_part() - partitions: aix: bound the pp_count scan to the ppe array - PCI: Add kerneldoc for pci_resize_resource() - PCI: altera: Do not dispose parent IRQ mapping - PCI: altera: Fix resource leaks on probe failure - PCI: Always lift 2.5GT/s restriction in PCIe failed link retraining - PCI/ASPM: Don't reconfigure ASPM entering low-power state - PCI: Check ROM header and data structure addr before accessing - PCI: controller: Use dev_fwnode() instead of of_fwnode_handle() - PCI: endpoint: pci-epf-ntb: Add check to detect 'db_count' value of 0 - PCI: endpoint: pci-epf-vntb: Add check to detect 'db_count' value of 0 - PCI: Fix restoring BARs on BAR resize rollback path - PCI: Free saved list without holding pci_bus_sem - PCI: host-common: Request bus reassignment when not probe-only - PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling - PCI: Introduce named defines for PCI ROM - PCI: iproc: Restore .map_irq() for the platform bus driver - PCI: loongson: Do not ignore downstream devices on external bridges - PCI: mediatek: Convert bool to single quirks entry and bitmap - PCI: mediatek: Fix IRQ domain leak when port fails to enable - PCI: mediatek: Fix operator precedence in PCIE_FTS_NUM_L0 macro - PCI: mediatek: Fix possible truncation in mtk_pcie_parse_port() - PCI: mediatek: Use actual physical address instead of virt_to_phys() - PCI: mediatek: Use generic MACRO for TPVPERL delay - PCI: meson: Propagate devm_add_action_or_reset() failure - PCI: Move Resizable BAR code to rebar.c - PCI: Prevent resource tree corruption when BAR resize fails - PCI: rcar-host: Remove unused LIST_HEAD(res) - PCI: Skip Resizable BAR restore on read error - perf/core: Detach event groups during remove_on_exec - perf: Fix dangling cgroup pointer in cpuctx backport - perf: Fix off-by-one stack buffer overflow in kallsyms__parse() - perf trace beauty fcntl: Fix build with older kernel headers - perf/x86/amd/brs: Fix kernel address leakage - perf/x86/amd/core: Always use the NMI latency mitigation - perf/x86/amd/lbr: Fix kernel address leakage - perf/x86/intel/uncore: Defer ADL global PMON enable to enable_box() - phy: phy-can-transceiver: Check driver match and driver data against NULL - pinctrl: cs42l43: Fix polarity on debounce - pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins 34-39 - pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39 - pinctrl: meson: restore non-sleeping GPIO access - pinctrl: sunxi: fix regulator leak in sunxi_pmx_request() error path - platform/x86/amd/pmc: Add delay_suspend module parameter - platform/x86/amd/pmc: Check for intermediate wakeup in function - platform/x86/amd/pmc: Delay suspend for some Lenovo Laptops - platform/x86: xo15-ebook: Fix wakeup source and GPE handling - pmdomain: imx: Fix i.MX8MP power notifier - pmdomain: imx: Fix i.MX8MP VC8000E power up sequence - PM: sleep: Use complete() in device_pm_sleep_init() - pNFS/filelayout: fix cheking if a layout is striped - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path - posix-cpu-timers: Use u64 multiplication in update_rlimit_cpu() - powerpc/kexec: fix double get_cpu() imbalance in kexec_prepare_cpus - powerpc/perf: fix preempt count underflow in fsl_emb_pmu_del - powerpc/powernv: fix preempt count leak in pnv_kexec_wait_secondaries_down - powerpc/pseries: fix memory leak on krealloc failure in papr_init - powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access() - power: supply: charger-manager: fix refcount leak in is_full_charged() - power: supply: core: fix supplied_from allocations - power: supply: cpcap-battery: Fix missing nvmem_device_put() causing reference leak - proc: only bump parent nlink when registering directories - proc: protect ptrace_may_access() with exec_update_lock (FD links) - proc: protect ptrace_may_access() with exec_update_lock (part 1) - proc: rename proc_setattr to proc_nochmod_setattr - pwm: imx27: Fix variable truncation in .apply() - qede: fix off-by-one in BD ring consumption on build_skb failure - qede: fix out-of-bounds check for cqe->len_list[] - rapidio/tsi721: prevent a bad dereference in tsi721_db_dpc() - RDMA/counter: Fix incorrect port index in rdma_counter_init() error cleanup - RDMA/hns: Fix arithmetic overflow in calc_hem_config() - RDMA/hns: Fix warning in poll cq direct mode - RDMA/irdma: Fix OOB read during CQ MR registration - RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs - RDMA/irdma: Initialize iwmr->access during MR registration - RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference - RDMA/mlx5: Fix undefined shift of user RQ WQE size - RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one - RDMA/mlx5: Remove raw RSS QP restrack tracking - RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg - RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path - RDMA/rxe: Fix a use-after-free problem in rxe_mmap - RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe - RDMA/siw: bound Read Response placement to the RREAD length - RDMA/srpt: fix integer overflow in immediate data length check - regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK - regulator: dt-bindings: mt6359: Drop regulator-name pattern restrictions - regulator: ltc3676: Fix incorrect IRQSTAT bit offsets - regulator: scmi: fix of_node refcount leak in scmi_regulator_probe() - regulator: scmi: Simplify with scoped for each OF child loop - remoteproc: qcom: Fix leak when custom dump_segments addition fails - reset: sunxi: fix memory region leak on ioremap failure - Revert "crypto: talitos - fix SEC1 32k ahash request limitation" - Revert "crypto: talitos - rename first/last to first_desc/last_desc" - Revert "PCI/MSI: Unmap MSI-X region on error" - Revert "treewide: Fix probing of devices in DT overlays" - ring-buffer: Fix event length with forced 8-byte alignment - riscv: cacheinfo: Fix node reference leak in populate_cache_leaves - riscv: Prevent NULL pointer dereference in machine_kexec_prepare() - riscv: probes: save original sp in rethook trampoline - riscv: stacktrace: Remove bogus -0x4 offset in non-FP walk_stackframe - rpmsg: use generic driver_override infrastructure - rtc: abx80x: fix the RTC_VL_CLR clearing all status flags - rtc: cmos: unregister HPET IRQ handler on probe failure - rtc: ds1307: Fix off-by-one issue with wday for rx8130 - rtc: ds1307: handle oscillator stop flag for ds1337/ds1339/ds3231 - rtc: mpfs: fix counter upload completion condition - rtc: msc313: fix NULL deref in shared IRQ handler at probe - rxrpc: Fix leak of released call in recvmsg(MSG_PEEK) - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc - s390/monwriter: Reject buffer reuse with different data length - s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init() - s390/process: Fix kernel thread function pointer type - s390/zcrypt: Remove the empty file - sched/fair: Fix cpu_util runnable_avg arithmetic - sched/fair: Only update stats for allowed CPUs when looking for dst group - sched: restore timer_slack_ns when resetting RT policy on fork - sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT - scsi: elx: efct: Fix I/O leak on unsupported additional CDB - scsi: elx: efct: Fix refcount leak in efct_hw_io_abort() - scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path - scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup() - scsi: pm8001: Fix error code in non_fatal_log_show() - scsi: Revert "scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans" - scsi: sas: Skip opt_sectors when DMA reports no real optimization hint - scsi: sg: Report request-table problems when any status is set - scsi: smartpqi: Use shost_to_hba() in pqi_scan_finished() - scsi: target: Bound PR-OUT TransportID parsing to the received buffer - scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE - scsi: target: Fix hexadecimal CHAP_I handling - scsi: target: Remove tcm_loop target reset handling - scsi: ufs: Fix wrong value printed in unexpected UPIU response case - scsi: xen: scsiback: Free the command tag on the TMR submit-failure path - scsi: xen: scsiback: Free unsubmitted command instead of double-putting it - sctp: fix SCTP_RESET_STREAMS stream list length limit - sctp: hold socket lock when dumping endpoints in sctp_diag - sctp: validate embedded address parameter length - sctp: validate STALE_COOKIE cause length before reading staleness - security/apparmor/apparmorfs.c: conditionally compile get_loaddata_common_ref() - seg6: validate SRH length before reading fixed fields - selftests/bpf: Add simple strscpy() implementation - selftests/bpf: Fix bpf_iter/task_vma test - selftests/bpf: Initialize operation name before use - selftests/hid: convert the hid_bpf selftests with struct_ops - selftests/hid: Cover hid_bpf_get_data() size overflow - selftests/hid: do not manually call headers_install - selftests/hid: ensure CKI can compile our new tests on old kernels - selftests/hid: ensure we can compile the tests on kernels pre-6.3 - selftests/hid: force using our compiled libbpf headers - selftests/mm: allow PUD-level entries in compound testcase of hmm tests - selftests/mm: clarify alternate unmapping in compaction_test - selftests/mm: fix exclusive_cow test fork() handling - selftests/net: fix EVP_MD_CTX leak in tcp_mmap - selinux: check connect-related permissions on TCP Fast Open - selinux: fix incorrect execmem checks on overlayfs - seqlock: Change do_task_stat() to use scoped_seqlock_read() - seqlock: fix scoped_seqlock_read kernel-doc - seqlock: Introduce scoped_seqlock_read() - serial: 8250_mid: Disable DMA for selected platforms - serial: 8250_mid: Remove 8250_pci usage - serial: 8250_omap: clear rx_running on zero-length DMA completes - serial: msm: Disable DMA for kernel console UART - slimbus: Convert to platform remove callback returning void - slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership - slimbus: qcom-ngd-ctrl: Fix probe error path ordering - slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd - smb/client: always return a value for FS_IOC_GETFLAGS - smb: client: fix change notify replay double-free - smb: client: fix double-free in SMB2_close() replay - smb: client: fix double-free in SMB2_flush() replay - smb: client: fix double-free in SMB2_ioctl() replay - smb: client: fix double-free in SMB2_open() replay - smb/client: Fix error code in smb2_aead_req_alloc() - smb: client: Fix next buffer leak in receive_encrypted_standard() - smb: client: fix overflow in passthrough ioctl bounds check - smb: client: fix query directory replay double-free - smb: client: fix query_info() replay double-free - smb: client: harden POSIX SID length parsing - smb: client: Improve unlocking of a mutex in cifs_get_swn_reg() - smb: client: mask server-provided mode to 07777 in modefromsid - smb/client: preserve errors from smb2_set_sparse() - smb: client: reject overlapping data areas in SMB2 responses - smb: client: resolve SWN tcon from live registrations - smb: client: restrict implied bcc[0] exemption to responses without data area - smb: client: use kvzalloc() for megabyte buffer in simple fallocate - smb: client: use unaligned reads in parse_posix_ctxt() - smb: move some duplicate definitions to common/cifsglob.h - smb/server: do not require delete access for non-replacing links - soc: fsl: qe: panic on ioremap() failure in qe_reset() - soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy - sparc: led: avoid trimming a newline from empty writes - spi: dw: fix wrong BAUDR setting after resume - spi: ep93xx: fix double-free of zeropage on DMA setup failure - spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync() - spi: fsl-lpspi: terminate the RX channel on TX prepare failure path - spi: hisi-kunpeng: Use dev_err_probe() for host registration failure - spi: meson-spifc: fix runtime PM leak on remove - spi: rpc-if: Use correct device for hardware reinitialization on resume - spi: sh-msiof: abort transfers when reset times out - spi: uniphier: Fix completion initialization order before devm_request_irq() - spi: xilinx: use FIFO occupancy register to determine buffer size - staging: media: atomisp: reduce load_primary_binaries() stack usage - staging: most: video: avoid double free on video register failure - staging: nvec: fix use-after-free in nvec_rx_completed() - staging: rtl8723bs: core: move constants to right side in comparison - staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() - staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop - staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop - staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() - staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop - staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr() - staging: rtl8723bs: fix OOB write in HT_caps_handler() - staging: rtl8723bs: fix spaces around binary operators - staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() - staging: vme_user: bound slave read/write to the kern_buf size - staging: vme_user: fix location monitor leak in fake bridge - staging: vme_user: fix location monitor leak in tsi148 bridge - SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing - sunrpc: pin svc_xprt across the asynchronous TLS handshake callback - SUNRPC: pin upper rpc_clnt across the TLS connect_worker - SUNRPC: release lower rpc_clnt if killed waiting for XPRT_LOCKED - sunrpc: wait for in-flight TLS handshake callback when cancel loses race - sysfs: clamp show() return value in sysfs_kf_read() - tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF) - team: fix header_ops type confusion with non-Ethernet ports - thermal: hwmon: Fix critical temperature attribute removal - thermal: intel: Fix dangling resources on thermal_throttle_online() failure - time: Fix off-by-one in compat settimeofday() usec validation - tipc: fix out-of-bounds read in broadcast Gap ACK blocks - tipc: fix UAF in tipc_l2_send_msg() - tipc: fix use-after-free of the discoverer in tipc_disc_rcv() - tipc: prevent snt_unacked underflow on CONN_ACK - tipc: reject inverted service ranges from peer bindings - tipc: require net admin for TIPCv2 netlink mutators - tools lib api: Fix filename__write_int() writing uninitialized stack data - tools lib api: Fix missing null termination in filename__read_int/ull() - tools lib api: Fix mount_overload() snprintf truncation and toupper range - tools/mm/slabinfo: fix total_objects attribute name - tools/mm/slabinfo: Fix trace disable logic inversion - tools/power/x86/intel-speed-select: Harden daemon pidfile open - tools/testing: add linux/args.h header and fix radix, VMA tests - tools/virtio: check mmap return value in vringh_test - tpm: fix event_size output in tpm1_binary_bios_measurements_show - tpm: Make the TPM character devices non-seekable - tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat() - tracing: Bound synthetic-field strings with seq_buf - tracing: eprobe: read the complete FILTER_PTR_STRING pointer - tracing/events: Fix to check the simple_tsk_fn creation - tracing/osnoise: Call synchronize_rcu() when unregistering - tracing: Prevent out-of-bounds read in glob matching - tracing/probes: Fix double addition of offset for @+FOFFSET - tracing: probes: fix typo in a log message - treewide: Switch/rename to timer_delete[_sync]() - udf: validate free block extents against the partition length - udf: validate sparing table length as an entry count, not a byte count - udf: validate VAT header length against the VAT inode size - udmabuf: fix DMA direction mismatch in release_udmabuf() - usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect() - usb: cdc_acm: Add quirk for Uniden BC125AT scanner - usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info() - USB: chaoskey: Fix slab-use-after-free in chaoskey_release() - USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub - usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume() - usb: dwc3: run gadget disconnect from sleepable suspend context - usb: free iso schedules on failed submit - usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler - usb: gadget: f_fs: initialize reset_work at allocation time - usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile - usb: gadget: f_printer: take kref only for successful open - usb: gadget: function: rndis: add length check for header - usb: gadget: function: rndis: add length check to response query - usb: gadget: udc: Fix use-after-free in gadget_match_driver - usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control() - usb: host: max3421: Reject hub port requests for non-existent ports - USB: idmouse: fix use-after-free on disconnect race - USB: iowarrior: fix use-after-free on disconnect - usb: iowarrior: remove inherent race with minor number - usbip: tools: support SuperSpeedPlus devices - usbip: vudc: fix NULL deref in vep_dequeue() - USB: ldusb: fix use-after-free on disconnect race - USB: legousbtower: fix use-after-free on disconnect race - USB: misc: uss720: unregister parport on probe failure - usb: mtu3: unmap request DMA on queue failure - usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup() - USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD - USB: serial: digi_acceleport: fix broken rx after throttle - USB: serial: digi_acceleport: fix hard lockup on disconnect - USB: serial: digi_acceleport: fix write buffer corruption - USB: serial: keyspan_pda: fix information leak - USB: serial: option: add Telit Cinterion FE990D50 compositions - usb: sl811-hcd: disable controller wakeup on remove - USB: storage: include US_FL_NO_SAME in quirks mask - usb: typec: anx7411: use devm_pm_runtime_enable() - usb: typec: class: drop PD lookup reference - usb: typec: tcpci_rt1711h: unregister TCPCI port with devres - usb: typec: tcpm: Fix VDM type for Enter Mode commands - usb: typec: tcpm: Validate SVID index in svdm_consume_modes() - usb: typec: ucsi: cancel pending work on system suspend - usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove - usb: typec: ucsi: Invert DisplayPort role assignment - usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode - USB: ulpi: fix memory leak on registration failure - USB: usb-storage: ene_ub6250: restore media-ready check - usb: xhci: Fix sleep in atomic context in xhci_free_streams() - userfaultfd: gate must_wait writability check on pte_present() - vduse: Fix race in vduse_dev_msg_sync and vduse_dev_read_iter - vduse: hold vduse_lock across IDR lookup in open path - vduse: Requeue failed read to send_list head - veth: fix NAPI leak in XDP enable error path - vfio/mlx5: Fix racy bitfields and tighten struct layout - vfio/pci: Fix racy bitfields and tighten struct layout - vfio/pci: Latch disable_idle_d3 per device - vfio/pci: Release the VGA arbiter client on register_device() failure - vfio/pci: Use a private flag to prevent power state change with VFs - vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc - vhost/net: complete zerocopy ubufs only once - vhost/vdpa: validate virtqueue index in mmap and fault paths - virtio-mmio: fix device release warning on module unload - virtio_net: disable cb when NAPI is busy-polled - virtio-net: fix len check in receive_big() - virtio_net: Support dynamic rss indirection table size - vmalloc: fix NULL pointer dereference in is_vm_area_hugepages() - vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive(). - watchdog: apple: Add "apple,t8103-wdt" compatible - watchdog: sama5d4_wdt: Fix WDDIS detection on SAM9X60 and SAMA7G5 - watchdog: sp5100_tco: Use EFCH MMIO for newer Hygon FCH - watchdog: sprd_wdt: Remove redundant sprd_wdt_disable() on register failure - watchdog: unregister PM notifier on watchdog unregister - wifi: ath9k: fix OOB access from firmware tx status queue ID - wifi: cfg80211: fix grammar in MLO group key error message - wifi: mac80211: fix memory leak in ieee80211_register_hw() - wifi: mac80211: free ack status frame on TX header build failure - wifi: mt76: fix argument to ieee80211_is_first_frag() - wifi: mt76: mt7915: fix potential tx_retries underflow - wifi: mt76: mt7921: fix potential tx_retries underflow - wifi: mwifiex: fix permanently busy scans after multiple roam iterations - wifi: rt2x00: avoid full teardown before work setup in probe - wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer - wifi: rtw89: Correct data type for scan index to avoid infinite loop - wifi: wcn36xx: fix heap overflow from oversized firmware HAL response - wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication - wifi: wcn36xx: fix OOB read from short trigger BA firmware response - workqueue: drop spurious '*' from print_worker_info() fn declaration - writeback: Avoid contention on wb->list_lock when switching inodes - writeback: drop now-unnecessary rcu_barrier() in cgroup_writeback_umount() - writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() - writeback: Fix use after free in inode_switch_wbs_work_fn() - X.509: Fix validation of ASN.1 certificate header - x86/boot: Reject too long acpi_rsdp= values - x86/boot: Validate console=uart8250 baud rate to fix early boot hang - x86/bugs: Enable IBPB flush on BPF JIT allocation - x86/mm: Fix check/use ordering in switch_mm_irqs_off() - x86/platform/olpc: xo15: Drop wakeup source on driver removal - xen/gntdev: fix error handling in ioctl - xfrm: annotate data-races around xfrm_policy_count[] and xfrm_policy_default[] - xfrm: Support crypto offload for inbound IPv6 ESP packets not in GRO path - xfrm: use compat translator only for u64 alignment mismatch - xfrm: Use the XFRM_GRO to indicate a GRO call on input - xfrm: validate selector family and prefixlen during match - xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink - xfs: dump the recovered xattri log item if corruption happens - xfs: fail recovery on a committed log item with no regions - xfs: fix stupid compiler warning - xfs: fix unreachable BIGTIME check in dquot flush validation - xfs: move ->iop_recover to xfs_defer_op_type - xfs: recreate work items when recovering intent items - xfs: resample the data fork mapping after cycling ILOCK - xfs: use null daddr for unset first bad log block - xfs: use xfs_defer_finish_one to finish recovered work items - xprtrdma: Avoid 250 ms delay on backlog wakeup - xprtrdma: Check frwr_wp_create() during connect - xprtrdma: Close lost-wakeup race in xprt_rdma_alloc_slot - xprtrdma: Decouple req recycling from RPC completion - xprtrdma: Document and assert reply-handler invariants - xprtrdma: Fix bcall rep leak and unbounded peek - xprtrdma: Post receive buffers after RPC completion - xprtrdma: Remove temp allocation of rpcrdma_rep objects - xprtrdma: Repost Receive buffers for malformed replies - xprtrdma: Resize reply buffers before reposting receives - xprtrdma: Return sendctx slot after Send preparation failure - xprtrdma: Sanitize the reply credit grant after parsing - xprtrdma: Use sendctx DMA state for Send signaling - Updated by kernel-updater-bot (https://abf.io/mikhailnov/kernel-updater-bot)- Remove rudiment CVE patches- [bot] upd: 6.6.126 -> 6.6.144 - Changelog: - 6lowpan: fix off-by-one in multicast context address compression - 6pack: propagage new tty types - 9p: avoid putting oldfid in p9_client_walk() error path - accel/qaic: Add overflow check to remap_pfn_range during mmap - accel/qaic: Handle DBC deactivation if the owner went away - ACPI: AGDI: fix missing newline in error message - ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP - ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() - ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug - ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs - ACPI: EC: clean up handlers on probe failure in acpi_ec_setup() - ACPI: OSI: Add DMI quirk for Acer Aspire One D255 - ACPI: OSL: fix __iomem type on return from acpi_os_map_generic_address() - ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO - ACPI: PM: Save NVS memory on Lenovo G70-35 - ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4() - ACPI: processor: Fix previous acpi_processor_errata_piix4() fix - ACPI: scan: Use acpi_dev_put() in object add error paths - ACPI: video: force native backlight on HP OMEN 16 (8A44) - ACPI: x86: cmos_rtc: Clean up address space handler driver - ACPI: x86: cmos_rtc: Improve coordination with ACPI TAD driver - af_key: validate families in pfkey_send_migrate() - af_unix: Cache state->msg in unix_stream_read_generic(). - af_unix: Fix UAF read of tail->len in unix_stream_data_wait() - af_unix: Give up GC if MSG_PEEK intervened. - af_unix: read UNIX_DIAG_VFS data under unix_state_lock - af_unix: Reject SIOCATMARK on non-stream sockets - af_unix: Set gc_in_progress to true in unix_gc(). - agp/amd64: Fix broken error propagation in agp_amd64_probe() - alarmtimer: Fix argument order in alarm_timer_forward() - ALSA: 6fire: Fix input volume change detection - ALSA: 6fire: fix use-after-free on disconnect - ALSA: aoa: i2sbus: clear stale prepared state - ALSA: aoa: i2sbus: fix OF node lifetime handling - ALSA: aoa: Skip devices with no codecs in i2sbus_resume() - ALSA: aoa: Use guard() for mutex locks - ALSA: asihpi: avoid write overflow check warning - ALSA: asihpi: Fix potential OOB array access at reading cache - ALSA: caiaq: Don't abort when no input device is available - ALSA: caiaq: Fix control_put() result and cache rollback - ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path - ALSA: caiaq: fix stack out-of-bounds read in init_card - ALSA: caiaq: fix usb_dev refcount leak on probe failure - ALSA: caiaq: Handle probe errors properly - ALSA: caiaq: take a reference on the USB device in create_card() - ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() - ALSA: core: Fix potential data race at fasync handling - ALSA: core: Serialize deferred fasync state checks - ALSA: core: Validate compress device numbers without dynamic minors - ALSA: ctxfi: Add fallback to default RSR for S/PDIF - ALSA: ctxfi: Fix missing SPDIFI1 index handling - ALSA: ctxfi: Limit PTP to a single page - ALSA: firewire-lib: fix uninitialized local variable - ALSA: firewire-motu: Protect register DSP event queue positions - ALSA: firewire-tascam: Do not drop unread control events - ALSA: fireworks: bound device-supplied status before string array lookup - ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro - ALSA: hda/conexant: Add quirk for HP ZBook Studio G4 - ALSA: hda/conexant: Fix headphone jack handling on Acer Swift SF314 - ALSA: hda/conexant: Fix missing error check for jack detection - ALSA: hda/conexant: fix some typos - ALSA: hda/conexant: Renaming the codec with device ID 0x1f86 and 0x1f87 - ALSA: hda: cs35l56: Fix signedness error in cs35l56_hda_posture_put() - ALSA: hda: cs35l56: Propagate ASP TX source control errors - ALSA: hda: cs35l56: Put ACPI device after setting companion - ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 - ALSA: hda/realtek: Add headset jack quirk for Thinkpad X390 - ALSA: hda/realtek: Add HP ENVY Laptop 13-ba0xxx quirk - ALSA: hda/realtek: add HP Laptop 14s-dr5xxx mute LED quirk - ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg0xxx - ALSA: hda/realtek: Add quirk for ASUS ROG Flow Z13-KJP GZ302EAC - ALSA: hda/realtek: add quirk for Framework F111:000F - ALSA: hda/realtek: Add quirk for Inspur S14-G1 - ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IAH10 - ALSA: hda/realtek: fix code style (ERROR: else should follow close brace '}') - ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU - ALSA: misc: Use guard() for spin locks - ALSA: pci: hda: use snd_kcontrol_chip() - ALSA: pcm: Don't setup bogus iov_iter for silencing - ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain() - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams - ALSA: pcmtest: fix reference leak on failed device registration - ALSA: pcmtest: Fix resource leaks in module init error paths - ALSA: sc6000: Keep the programmed board state in card-private data - ALSA: sc6000: Use standard print API - ALSA: scarlett2: Add missing sentinel initializer field - ALSA: seq: Fix UMP group 16 filtering - ALSA: seq: Notify client and port info changes - ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes - ALSA: seq: Serialize UMP output teardown with event_input - ALSA: seq: ump: Use guard() for locking - ALSA: timer: Fix UAF at snd_timer_user_params() - ALSA: ua101: Reject too-short USB descriptors - ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio - ALSA: usb-audio: Add sanity check for OOB writes at silencing - ALSA: usb-audio: apply quirk for MOONDROP JU Jiu - ALSA: usb-audio: Avoid false E-MU sample-rate notifications - ALSA: usb-audio: Avoid implicit feedback mode on DIYINHK USB Audio 2.0 - ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() - ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans - ALSA: usb-audio: Bound MIDI endpoint descriptor scans - ALSA: usb-audio: Cap the packet size pre-calculations - ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer interfaces - ALSA: usb-audio: Check max frame size for implicit feedback mode, too - ALSA: usb-audio: Evaluate packsize caps at the right place - ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch - ALSA: usb-audio: Fix potential leak of pd at parsing UAC3 streams - ALSA: usb-audio: Fix quirk flags for NeuralDSP Quad Cortex - ALSA: usb-audio: Fix UAC3 cluster descriptor size check - ALSA: usb-audio: Improve Focusrite sample rate filtering - ALSA: usb-audio: midi2: Restart output URBs on resume - ALSA: usb-audio: Remove VALIDATE_RATES quirk for Focusrite devices - ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES - ALSA: usb-audio: Update the number of packets properly at receiving - ALSA: usb-audio: Use correct version for UAC3 header validation - ALSA: usb-audio: Use inclusive terms - amd-xgbe: fix link status handling in xgbe_rx_adaptation - amd-xgbe: fix MAC_TCR_SS register width for 2.5G and 10M speeds - amd-xgbe: fix sleep while atomic on suspend/resume - amd-xgbe: prevent CRC errors during RX adaptation with AN disabled - APEI/GHES: ensure that won't go past CPER allocated record - apparmor: fix aa_label to return state from compount and component match - apparmor: fix differential encoding verification - apparmor: Fix double free of ns_name in aa_replace_profiles() - apparmor: fix invalid deref of rawdata when export_binary is unset - apparmor: fix: limit the number of levels of policy namespaces - apparmor: fix memory leak in verify_header - apparmor: fix missing bounds check on DEFAULT table in verify_dfa() - apparmor: fix NULL sock in aa_sock_file_perm - apparmor: fix race between freeing data and fs accessing it - apparmor: fix race on rawdata dereference - apparmor: fix rlimit for posix cpu timers - apparmor: fix side-effect bug in match_char() macro usage - apparmor: fix unprivileged local user can do privileged policy management - apparmor: fix use-after-free in rawdata dedup loop - apparmor: make label_match return a consistent value - apparmor: mediate the implicit connect of TCP fast open sendmsg - apparmor: provide separate audit messages for file and policy checks - apparmor: refcount the pdb - apparmor: remove apply_modes_to_perms from label_match - apparmor: replace recursive profile removal with iterative approach - apparmor: return -ENOMEM in unpack_perms_table upon alloc failure - apparmor: use passed in gfp flags in aa_alloc_null() - apparmor: validate DFA start states are in bounds in unpack_pdb - arm64: Add support for TSV110 Spectre-BHB mitigation - arm64: cpufeature: Make PMUVer and PerfMon unsigned - arm64: cputype: Add C1-Premium definitions - arm64: cputype: Add C1-Ultra definitions - arm64: cputype: Add NVIDIA Olympus definitions - arm64: Disable branch profiling for all arm64 code - arm64: dts: amlogic: axg: assign the MMC signal clocks - arm64: dts: amlogic: g12: assign the MMC A signal clock - arm64: dts: amlogic: g12: assign the MMC B and C signal clocks - arm64: dts: amlogic: gx: assign the MMC signal clocks - arm64: dts: apple: t8112-j473: Keep the HDMI port powered on - arm64: dts: hisilicon: hi3798cv200: Add missing dma-ranges - arm64: dts: hisilicon: poplar: Correct PCIe reset GPIO polarity - arm64: dts: imx8-apalis: Fix LEDs name collision - arm64: dts: imx8mm-emtop-som: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mm-tqma8mqml: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mn-tqma8mqnl: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mn-tqma8mqnl: fix LDO5 power off - arm64: dts: imx8mp-data-modul-edm-sbc: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-debix-model-a: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-debix-som-a: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-dhcom-som: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-evk: Enable pull select bit for PCIe regulator GPIO (M.2 W_DISABLE1) - arm64: dts: imx8mp-icore-mx8mp: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mq-librem5: Bump BUCK1 suspend voltage up to 0.85V - arm64: dts: imx8mq: Set the correct gpu_ahb clock frequency - arm64: dts: imx8qxp-mek: switch Type-C connector power-role to dual - arm64: dts: mediatek: mt6795: Fix gpio-ranges pin count - arm64: dts: mediatek: mt7986a: Fix gpio-ranges pin count - arm64: dts: meson-gxl-p230: fix ethernet PHY interrupt number - arm64: dts: qcom: msm8953-xiaomi-daisy: fix backlight - arm64: dts: qcom: msm8953-xiaomi-vince: correct wled ovp value - arm64: dts: qcom: sdm630: fix gpu_speed_bin size - arm64: dts: qcom: sdm845-db845c: drop CS from SPIO0 - arm64: dts: qcom: sdm845-db845c: specify power for WiFi CH1 - arm64: dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on - arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on - arm64: dts: qcom: sdm845-xiaomi-beryllium: Mark l1a regulator as powered during boot - arm64: dts: qcom: sm6115: Add CX_MEM/DBGC GPU regions - arm64: dts: qcom: sm7225-fairphone-fp4: Fix conflicting bias pinctrl - arm64: dts: qcom: sm8250: Add missing CPU7 3.09GHz OPP - arm64: dts: qcom: sm8450: Enable UHS-I SDR50 and SDR104 SD card modes - arm64: dts: qcom: sm8450: Fix GIC_ITS range length - arm64: dts: qcom: sm8550: Enable UHS-I SDR50 and SDR104 SD card modes - arm64: dts: qcom: sm8550: Fix GIC_ITS range length - arm64: dts: qcom: sm8550: Fix xo clock supply of platform SD host controller - arm64: dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro - arm64: dts: rockchip: Fix rk356x PCIe range mappings - arm64: dts: ti: am62-verdin: Enable pullup for eMMC data pins - arm64: dts: tqma8mpql-mba8mpxl: Fix HDMI CEC pad control settings - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU - arm64: errata: Mitigate TLBI errata on various Arm CPUs - arm64: Fix non-atomic __READ_ONCE() with CONFIG_LTO=y - arm64: Fix sampling the "stable" virtual counter in preemptible section - arm64: Force the use of CNTVCT_EL0 in __delay() - arm64: io: Extract user memory type in ioremap_prot() - arm64: io: Rename ioremap_prot() to __ioremap_prot() - arm64: kexec: Remove duplicate allocation for trans_pgd - arm64: mm: Add PTE_DIRTY back to PAGE_KERNEL* to fix kexec/hibernation - arm64: mm: Batch dsb and isb when populating pgtables - arm64: mm: Don't remap pgtables for allocate vs populate - arm64: mm: Don't remap pgtables per-cont(pte|pmd) block - arm64/mm: Enable batched TLB flush in unmap_hotplug_range() - arm64: probes: Handle probes on hinted conditional branch instructions - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 - arm64/scs: Fix handling of advance_loc4 - arm64/scs: Fix potential sign extension issue of advance_loc4 - arm64: tegra: smaug: Add usb-role-switch support - arm64: tlb: Allow XZR argument to TLBI ops - arm64: tlb: Flush walk cache when unsharing PMD tables - arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI - arm64/xor: fix conflicting attributes for xor_block_template - ARM: 9467/1: mm: Don't use %pK through printk - ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O - ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow - ARM: allow __do_kernel_fault() to report execution of memory faults - ARM: clean up the memset64() C wrapper - ARM: dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property - ARM: dts: imx27-eukrea: replace interrupts with interrupts-extended - arm: dts: lpc32xx: add clocks property to Motor Control PWM device tree node - ARM: dts: lpc32xx: Set motor PWM #pwm-cells property value to 3 cells - ARM: dts: mediatek: mt7623: fix efuse fallback compatible - ARM: fix branch predictor hardening - ARM: fix hash_name() fault - ARM: group is_permission_fault() with is_translation_fault() - ARM: integrator: Fix early initialization - ARM: OMAP1: Fix DEBUG_LL and earlyprintk on OMAP16XX - ARM: omap2: Fix reference count leaks in omap_control_init() - ARM: socfpga: Fix OF node refcount leak in SMP setup - ARM: VDSO: Patch out __vdso_clock_getres() if unavailable - ASoC: adau1372: Fix clock leak on PLL lock failure - ASoC: adau1372: Fix unchecked clk_prepare_enable() return value - ASoC: amd: acp3x-rt5682-max9836: Add missing error check for clock acquisition - ASoC: amd: yc: Add ASUS EXPERTBOOK BM1503CDA to quirk table - ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list - ASoC: amd: yc: Add DMI entry for HP Laptop 15-fc0xxx - ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK BM1403CDA - ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK PM1503CDA - ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR - ASoC: amd: yc: Add DMI quirk for Thin A15 B7VF - ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table - ASoC: amd: yc: Add quirk for HP 200 G2a 16 - ASoC: codecs: ab8500: Fix casting of private data - ASoC: codecs: aw88261: Fix erroneous bitmask logic in Awinic init - ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in max98390_i2c_probe() - ASoC: codecs: simple-mux: Fix enum control bounds check - ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel - ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove() - ASoC: cs42l43: Correct handling of 3-pole jack load detection - ASoC: cs42l43: Report insert for exotic peripherals - ASoC: detect empty DMI strings - ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names - ASoC: dt-bindings: asahi-kasei,ak4458: set unevaluatedProperties:false - ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names - ASoC: ep93xx: Fix unchecked clk_prepare_enable() and add rollback on failure - ASoC: es8328: Add error unwind in resume - ASoC: fsl_easrc: Change the type for iec958 channel status controls - ASoC: fsl_easrc: Check the variable range in fsl_easrc_iec958_put_bits() - ASoC: fsl_easrc: fix comment typo - ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_put_bits() - ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_set_reg() - ASoC: fsl_easrc: Fix value type in fsl_easrc_iec958_get_bits() - ASoC: fsl_micfil: Add access property for "VAD Detected" - ASoC: fsl_micfil: Fix event generation in hwvad_put_enable() - ASoC: fsl_micfil: Fix event generation in hwvad_put_init_mode() - ASoC: fsl_micfil: Fix event generation in micfil_put_dc_remover_state() - ASoC: fsl_micfil: Fix event generation in micfil_quality_set() - ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write - ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_arc_mode_put() - ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_mode_put() - ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() - ASoC: fsl_xcvr: Revert fix missing lock in fsl_xcvr_mode_put() - ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors - ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error - ASoC: Intel: catpt: Fix the device initialization - ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 - ASoC: nau8821: Avoid unnecessary blocking in IRQ handler - ASoC: nau8821: Consistently clear interrupts before unmasking - ASoC: nau8821: Fixup nau8821_enable_jack_detect() - ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop - ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens - ASoC: qcom: q6apm: move component registration to unmanaged version - ASoC: qcom: q6apm: remove child devices when apm is removed - ASoC: qcom: q6asm-dai: close stream only when running - ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks - ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params - ASoC: qcom: qdsp6: Fix q6apm remove ordering during ADSP stop and start - ASoC: qcom: qdsp6: topology: check widget type before accessing data - ASoC: rockchip: i2s-tdm: Use param rate if not provided by set_sysclk - ASoC: rsnd: Fix potential out-of-bounds access of component_dais[] - ASoC: simple-card-utils: Don't use __free(device_node) at graph_util_parse_dai() - ASoC: simple-card-utils: fix graph_util_is_ports0() for DT overlays - ASoC: simple-card-utils: use __free(device_node) for device node - ASoC: soc-core: call missing INIT_LIST_HEAD() for card_aux_list - ASoC: soc-core: drop delayed_work_pending() check before flush - ASoC: soc-core: flush delayed work before removing DAIs and widgets - ASoC: SOF: compress: return the configured codec from get_params - ASoC: SOF: Don't allow pointer operations on unconfigured streams - ASoC: SOF: Intel: hda-dai: add support for dspless mode beyond HDAudio - ASoC: SOF: Intel: hda-dai: remove dspless special case - ASoC: SOF: Intel: hda: Fix NULL pointer dereference - ASoC: SOF: Intel: hda: Place check before dereference - ASoC: SOF: ipc4-control: If there is no data do not send bytes update - ASoC: SOF: ipc4-control: Keep the payload size up to date - ASoC: SOF: ipc4-control: Use the correct size for scontrol->ipc_control_data - ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload - ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls - ASoC: SOF: topology: reject invalid vendor array size in token parser - ASoC: sti: Return errors from regmap_field_alloc() - ASoC: sti: use managed regmap_field allocations - ASoC: stm32_sai: fix incorrect BCLK polarity for DSP_A/B, LEFT_J - ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio - ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask - ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug - ASoC: wm_adsp: Fix NULL dereference when removing firmware controls - ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585 - ata: libata: avoid long timeouts on hot-unplugged SATA DAS - ata: libata-scsi: refactor ata_scsi_translate() - ata: pata_ftide010: Fix some DMA timings - atm: fore200e: fix use-after-free in tasklets during device removal - atm: lec: fix null-ptr-deref in lec_arp_clear_vccs - atm: lec: fix use-after-free in sock_def_readable() - audit: add fchmodat2() to change attributes class - audit: add missing syscalls to read class - audit: enforce AUDIT_LOCKED for AUDIT_TRIM and AUDIT_MAKE_EQUIV - audit: fix incorrect inheritable capability in CAPSET records - audit: move the compat_xxx_class[] extern declarations to audit_arch.h - auxdisplay: arm-charlcd: fix release_mem_region() size - auxdisplay: line-display: fix OOB read on zero-length message_store() - backlight: qcom-wled: Change PM8950 WLED configurations - backlight: qcom-wled: Support ovp values for PMI8994 - backlight: sky81452-backlight: Check return value of devm_gpiod_get_optional() in sky81452_bl_parse_dt() - bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() - batman-adv: Avoid double-rtnl_lock ELP metric worker - batman-adv: avoid OGM aggregation when skb tailroom is insufficient - batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE - batman-adv: bla: avoid double decrement of bla.num_requests - batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface - batman-adv: bla: fix report_work leak on backbone_gw purge - batman-adv: bla: only purge non-released claims - batman-adv: bla: prevent use-after-free when deleting claims - batman-adv: bla: put backbone reference on failed claim hash insert - batman-adv: clear current gateway during teardown - batman-adv: dat: handle forward allocation error - batman-adv: dat: prevent false sharing between VLANs - batman-adv: ensure bcast is writable before modifying TTL - batman-adv: fix fragment reassembly length accounting - batman-adv: fix integer overflow on buff_pos - batman-adv: fix (m|b)cast csum after decrementing TTL - batman-adv: fix tp_meter counter underflow during shutdown - batman-adv: frag: avoid underflow of TTL - batman-adv: frag: disallow unicast fragment in fragment - batman-adv: frag: ensure fragment is writable before modifying TTL - batman-adv: hold claim backbone gateways by reference - batman-adv: iv: recover OGM scheduling after forward packet error - batman-adv: mcast: fix use-after-free in orig_node RCU release - batman-adv: prevent ELP transmission interval underflow - batman-adv: reject new tp_meter sessions during teardown - batman-adv: reject oversized global TT response buffers - batman-adv: stop caching unowned originator pointers in BAT IV - batman-adv: stop tp_meter sessions during mesh teardown - batman-adv: tp_meter: add only finished tp_vars to lists - batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE - batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd - batman-adv: tp_meter: avoid role confusion in tp_list - batman-adv: tp_meter: avoid use of uninit sender vars - batman-adv: tp_meter: avoid window underflow - batman-adv: tp_meter: directly shut down timer on cleanup - batman-adv: tp_meter: fix fast recovery precondition - batman-adv: tp_meter: fix race condition in send error reporting - batman-adv: tp_meter: fix tp_num leak on kmalloc failure - batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown - batman-adv: tp_meter: handle overlapping packets - batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection - batman-adv: tp_meter: initialize dec_cwnd explicitly - batman-adv: tp_meter: initialize dup_acks explicitly - batman-adv: tp_meter: initialize last_recv_time during init - batman-adv: tp_meter: keep unacked list in ascending ordered - batman-adv: tp_meter: prevent parallel modifications of last_recv - batman-adv: tp_meter: restrict number of unacked list entries - batman-adv: tt: avoid empty VLAN responses - batman-adv: tt: don't merge change entries with different VIDs - batman-adv: tt: fix negative last_changeset_len - batman-adv: tt: fix negative tt_buff_len - batman-adv: tt: fix TOCTOU race for reported vlans - batman-adv: tt: prevent TVLV entry number overflow - batman-adv: tt: reject oversized local TVLV buffers - batman-adv: tt: track roam count per VID - batman-adv: tvlv: abort OGM send on tvlv append failure - batman-adv: tvlv: avoid race of cifsnotfound handler state - batman-adv: tvlv: enforce 2-byte alignment - batman-adv: tvlv: reject oversized TVLV packets - batman-adv: v: prevent OGM aggregation on disabled hardif - batman-adv: v: stop OGMv2 on disabled interface - bcache: fix cached_dev.sb_bio use-after-free and crash - bcache: fix uninitialized closure object - binder: don't use %pK through printk - binfmt_misc: restore write access before closing files opened by open_exec() - blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current() - blk-cgroup: fix UAF in __blkcg_rstat_flush() - blk-cgroup: wait for blkcg cleanup before initializing new disk - blk-mq-debugfs: add missing debugfs_mutex in blk_mq_debugfs_register_hctxs() - blktrace: fix __this_cpu_read/write in preemptible context - block: add pgmap check to biovec_phys_mergeable - block: relax pgmap check in bio_add_page for compatible zone device pages - Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() - Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling - Bluetooth: bnep: Fix UAF read of dev->name - Bluetooth: bnep: reject short frames before parsing - Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock - Bluetooth: btmtk: accept too short WMT FUNC_CTRL events - Bluetooth: btmtk: add the function to get the fw name - Bluetooth: btmtk: fix urb->setup_packet leak in error paths - Bluetooth: btmtk: move btusb_mtk_hci_wmt_sync to btmtk.c - Bluetooth: btmtk: rename btmediatek_data - Bluetooth: btmtk: validate WMT event SKB length before struct access - Bluetooth: btusb: Add device ID for Realtek RTL8761BU - Bluetooth: btusb: Add new VID/PID for RTL8852CE - Bluetooth: btusb: Allow firmware re-download when version matches - Bluetooth: btusb: clamp SCO altsetting table indices - Bluetooth: btusb: mediatek: refactor the function btusb_mtk_reset - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER - Bluetooth: fix memory leak in error path of hci_alloc_dev() - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() - Bluetooth: hci_conn: fix potential UAF in create_big_sync - Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync - Bluetooth: hci_conn: Set link_policy on incoming ACL connections - Bluetooth: hci_conn: use mod_delayed_work for active mode timeout - Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt - Bluetooth: hci_event: fix potential UAF in hci_le_remote_conn_param_req_evt - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error - Bluetooth: hci_ll: Fix firmware leak on error path - Bluetooth: hci_qca: Cleanup on all setup failures - Bluetooth: hci_qca: Convert timeout from jiffies to ms - Bluetooth: hci_qca: Migrate to serdev specific shutdown function - Bluetooth: hci_sync: call destroy in hci_cmd_sync_run if immediate - Bluetooth: hci_sync: Fix hci_le_create_conn_sync - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend - Bluetooth: hci_sync: Remove remaining dependencies of hci_request - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths - Bluetooth: HIDP: fix missing length checks in hidp_input_report() - Bluetooth: HIDP: Fix possible UAF - Bluetooth: ISO: drop ISO_END frames received without prior ISO_START - Bluetooth: ISO: Fix defer tests being unstable - Bluetooth: ISO: fix UAF in iso_recv_frame - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp - Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success - Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ - Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn - Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop - Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ - Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ - Bluetooth: L2CAP: Fix not checking output MTU is acceptable on L2CAP_ECRED_CONN_REQ - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb() - Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp - Bluetooth: L2CAP: Fix printing wrong information if SDU length exceeds MTU - Bluetooth: L2CAP: Fix response to L2CAP_ECRED_CONN_REQ - Bluetooth: L2CAP: Fix send LE flow credits in ACL link - Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp() - Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user - Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() - Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access - Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv() - Bluetooth: LE L2CAP: Disconnect if received packet's SDU exceeds IMTU - Bluetooth: LE L2CAP: Disconnect if sum of payload sizes exceed SDU - Bluetooth: MGMT: Fix backward compatibility with userspace - Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete - Bluetooth: MGMT: Fix memory leak in set_ssp_complete - Bluetooth: MGMT: Fix possible UAFs - Bluetooth: MGMT: validate Add Extended Advertising Data length - Bluetooth: MGMT: validate advertising TLV before type checks - Bluetooth: MGMT: validate LTK enc_size on load - Bluetooth: MGMT: validate mesh send advertising payload length - Bluetooth: qca: fix ROM version reading on WCN3998 chips - Bluetooth: Remove 3 repeated macro definitions - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() - Bluetooth: RFCOMM: validate skb length in MCC handlers - Bluetooth: SCO: fix race conditions in sco_sock_connect() - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold - Bluetooth: serialize accept_q access - Bluetooth: SMP: derive legacy responder STK authentication from MITM state - Bluetooth: SMP: force responder MITM requirements before building the pairing response - Bluetooth: SMP: make SM/PER/KDU/BI-04-C happy - Bluetooth: virtio_bt: clamp rx length before skb_put - Bluetooth: virtio_bt: validate rx pkt_type header length - bnxt_en: Fix NULL pointer dereference - bonding: 3ad: implement proper RCU rules for port->aggregator - bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner - bonding: add support for per-port LACP actor priority - bonding: alb: fix UAF in rlb_arp_recv during bond up/down - bonding: fix NULL pointer dereference in actor_port_prio setting - bonding: fix use-after-free due to enslave fail after slave array update - bonding: handle BOND_LINK_FAIL, BOND_LINK_BACK as valid link states - bonding: only set speed/duplex to unknown, if getting speed failed - bonding: print churn state via netlink - bonding: refuse to enslave CAN devices - bpf: Add CHECKSUM_COMPLETE to bpf test progs - bpf: allow UTF-8 literals in bpf_bprintf_prepare() - bpf, arm32: Reject BPF-to-BPF calls and callbacks in the JIT - bpf, arm64: Fix off-by-one in check_imm signed range check - bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded - bpf, devmap: Remove unnecessary if check in for loop - bpf: Don't mark STACK_INVALID as STACK_MISC in mark_stack_slot_misc - bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks - bpf: export bpf_link_inc_not_zero. - bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim - bpf: Fix bpf_xdp_store_bytes proto for read-only arg - bpf: fix end-of-list detection in cgroup_storage_get_next_key() - bpf: Fix NULL deref in map_kptr_match_type for scalar regs - bpf: Fix OOB in pcpu_init_value - bpf: Fix precedence bug in convert_bpf_ld_abs alignment check - bpf: Fix RCU stall in bpf_fd_array_map_clear() - bpf: Fix regsafe() for pointers to packet - bpf: Fix stack-out-of-bounds write in devmap - bpf: Fix stale offload->prog pointer after constant blinding - bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN - bpf: Forget ranges when refining tnum after JSET - bpf: Free reuseport cBPF prog after RCU grace period. - bpf: handle fake register spill to stack with BPF_ST_MEM instruction - bpf: preserve constant zero when doing partial register restore - bpf: preserve STACK_ZERO slots on partial reg spills - bpf: reject direct access to nullable PTR_TO_BUF pointers - bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() - bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb - bpf: Reject sleepable kprobe_multi programs at attach time - bpf: Release module BTF IDR before module unload - bpf: Remove mark_precise_scalar_ids() - bpf, skmsg: fix verdict sk_data_ready racing with ktls rx - bpf, sockmap: Fix af_unix iter deadlock - bpf, sockmap: Fix af_unix null-ptr-deref in proto update - bpf, sockmap: Fix FIONREAD for sockmap - bpf, sockmap: Fix incorrect copied_seq calculation - bpf: sockmap: fix tail fragment offset in bpf_msg_push_data - bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready(). - bpf, sockmap: Take state lock for af_unix iter - bpf: support non-r10 register spill/fill to/from stack in precision tracking - bpf: test_run: Fix the null pointer dereference issue in bpf_lwt_xmit_push_encap - bpftool: Fix truncated netlink dumps - bpf: track aligned STACK_ZERO cases as imprecise spilled registers - bpf: Track equal scalars history on per-instruction level - bpf: use kvfree() for replaced sysctl write buffer - bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path - bpf: verifier improvement in 32bit shift sign extension pattern - bridge: br_nd_send: linearize skb before parsing ND options - bridge: br_nd_send: validate ND option lengths - bridge: mcast: Fix a possible use-after-free when removing a bridge port - btrfs: abort transaction on failure to update root in the received subvol ioctl - btrfs: add raid stripe tree definitions - btrfs: add support for inserting raid stripe extents - btrfs: always fallback to buffered write if the inode requires checksum - btrfs: continue trimming remaining devices on failure - btrfs: do not free data reservation in fallback from inline due to -ENOSPC - btrfs: do not strictly require dirty metadata threshold for metadata writepages - btrfs: don't take device_list_mutex when querying zone info - btrfs: fix block_group_tree dirty_list corruption - btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak - btrfs: fix compat mask in error messages in btrfs_check_features() - btrfs: fix double-decrement of bytes_may_use in submit_one_async_extent() - btrfs: fix double free in create_space_info() error path - btrfs: fix double free in create_space_info_sub_group() error path - btrfs: fix incorrect key offset in error message in check_dev_extent_item() - btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found - btrfs: fix leak of kobject name for sub-group space_info - btrfs: fix lost error when running device stats on multiple devices fs - btrfs: fix missing last_unlink_trans update when removing a directory - btrfs: fix NULL dereference on root when tracing inode eviction - btrfs: fix objectid value in error message in check_extent_data_ref() - btrfs: fix super block offset in error message in btrfs_validate_super() - btrfs: fix the qgroup data free range for inline data extents - btrfs: fix transaction abort on file creation due to name hash collision - btrfs: fix transaction abort on set received ioctl due to item overflow - btrfs: fix transaction abort when snapshotting received subvolumes - btrfs: fix warning in scrub_verify_one_metadata() - btrfs: handle user interrupt properly in btrfs_trim_fs() - btrfs: log new dentries when logging parent dir of a conflicting inode - btrfs: merge btrfs_orig_bbio_end_io() into btrfs_bio_end_io() - btrfs: move btrfs_crc32c_final into free-space-cache.c - btrfs: move btrfs_extref_hash into inode-item.h - btrfs: qgroup: return correct error when deleting qgroup relation item - btrfs: read raid stripe tree from disk - btrfs: reject root items with drop_progress and zero drop_level - btrfs: remove btrfs_crc32c wrapper - btrfs: remove fs_info argument from btrfs_sysfs_add_space_info_type() - btrfs: replace BUG() with error handling in __btrfs_balance() - btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create - btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file() - btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file() - btrfs: tree-checker: fix misleading root drop_level error message - btrfs: use btrfs inodes in btrfs_rmdir() to avoid so much usage of BTRFS_I() - btrfs: use inode already stored in local variable at btrfs_rmdir() - Buffer overflow in drivers/xen/sys-hypervisor.c - bus: fsl-mc: fix an error handling in fsl_mc_device_add() - bus: fsl-mc: fix use-after-free in driver_override_show() - bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions - bus: omap-ocp2scp: Convert to platform remove callback returning void - bus: omap-ocp2scp: fix OF populate on driver rebind - cache: add __cacheline_group_{begin, end}_aligned() (+ couple more) - cache: ax45mp: Fix device node reference leak in ax45mp_cache_init() - cache: enforce cache groups - can: bcm: fix locking for bcm_op runtime updates - can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message - can: gs_usb: gs_can_open(): always configure bitrates before starting device - can: gw: fix OOB heap access in cgw_csum_crc8_rel() - can: hi311x: hi3110_open(): add check for hi3110_power_enable() return value - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() - can: mcp251x: add error handling for power enable in open and resume - can: mcp251x: fix deadlock in error path of mcp251x_open - can: raw: fix ro->uniq use-after-free in raw_rcv() - can: statistics: add missing atomic access in hot path - can: ucan: fix devres lifetime - can: ucan: Fix infinite loop from zero-length messages - can: usb: etas_es58x: correctly anchor the urb in the read bulk callback - can: usb: f81604: correctly anchor the urb in the read bulk callback - can: usb: f81604: handle bulk write errors properly - can: usb: f81604: handle short interrupt urb messages properly - cdc-acm: new quirk for EPSON HMD - cdrom, scsi: sr: propagate read-only status to block layer via set_disk_ro() - ceph: fix a buffer leak in __ceph_setxattr() - ceph: fix i_nlink underrun during async unlink - ceph: fix memory leaks in ceph_mdsc_build_path() - ceph: only d_add() negative dentries when they are unhashed - ceph: supply snapshot context in ceph_uninline_data() - ceph: supply snapshot context in ceph_zero_partial_object() - cgroup/cpuset: Reset DL migration state on can_attach() failure - cgroup: fix race between task migration and iteration - cgroup/rdma: fix integer overflow in rdmacg_try_charge() - char: tpm: cr50: Remove IRQF_ONESHOT - checkpatch: add support for Assisted-by tag - cifs: abort open_cached_dir if we don't request leases - cifs: change_conf needs to be called for session setup - cifs: Fix busy dentry used after unmounting - cifs: Fix locking usage for tcon fields - cifs: make default value of retrans as zero - cifs: open files should not hold ref on superblock - cifs: some missing initializations on replay - clk: clk-apple-nco: Add "apple,t8103-nco" compatible - clk: imx8mq: Correct the CSI PHY sels - clk: imx: imx6q: Fix device node reference leak in of_assigned_ldb_sels() - clk: imx: imx6q: Fix device node reference leak in pll6_bypassed() - clk: imx: imx8-acm: fix flags for acm clocks - clk: mediatek: Fix error handling in runtime PM setup - clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs - clk: microchip: core: correct return value on *_get_parent() - clk: microchip: mpfs-ccc: fix out of bounds access during output registration - clk: Move clk_{save,restore}_context() to COMMON_CLK section - clk: qcom: dispcc-sc7180: Add missing MDSS resets - clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time - clk: qcom: dispcc-sc8280xp: remove CLK_SET_RATE_PARENT from byte_div_clk_src dividers - clk: qcom: dispcc-sdm845: Enable parents for pixel clocks - clk: qcom: dispcc-sm8250: Enable parents for pixel clocks - clk: qcom: dispcc-sm8250: Use shared ops on the mdss vsync clk - clk: qcom: dispcc-sm8450: use RCG2 ops for DPTX1 AUX clock source - clk: qcom: gcc-ipq5018: flag sleep clock as critical - clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc - clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc - clk: qcom: gcc-qdu1000: Update the SDCC RCGs to use shared_floor_ops - clk: qcom: gcc-sc8180x: Add missing GDSCs - clk: qcom: gcc-sc8180x: Use retention for PCIe power domains - clk: qcom: gcc-sc8180x: Use retention for USB power domains - clk: qcom: gcc-sdx75: Update the SDCC RCGs to use shared_floor_ops - clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops - clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs - clk: qcom: gfx3d: add parent to parent request map - clk: qcom: rcg2: compute 2d using duty fraction directly - clk: qcom: Return correct error code in qcom_cc_probe_by_index() - clk: qoriq: avoid format string warning - clk: renesas: rzg2l: Fix intin variable size - clk: renesas: rzg2l: Select correct div round macro - clk: rk808: fix OF node reference imbalance - clk: tegra: tegra124-emc: fix device leak on set_rate() - clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc() - clk: visconti: pll: initialize clk_init_data to zero - clk: xgene: Fix mapping leak in xgene_pllclk_init() - clocksource/drivers/sh_tmu: Always leave device running after probe - clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on OF - clsact: Fix use-after-free in init/destroy rollback asymmetry - comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() - comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() - comedi: dt2815: add hardware detection to prevent crash - comedi: me4000: Fix potential overrun of firmware buffer - comedi: me_daq: Fix potential overrun of firmware buffer - comedi: ni_atmio16d: Fix invalid clean-up after failed attach - comedi: Reinit dev->spinlock between attachments to low-level drivers - coresight: etm3x: Fix cpulocked warning on cpuhp - counter: Fix refcount leak in counter_alloc() error path - counter: rz-mtu3-cnt: do not use struct rz_mtu3_channel's dev member - counter: rz-mtu3-cnt: prevent counter from being toggled multiple times - cpufreq: conservative: Reset requested_freq on limits change - cpufreq: dt-platdev: Block the driver from probing on more QC platforms - cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path - cpuidle: governors: menu: Always check timers with tick stopped - cpuidle: menu: Cleanup after loadavg removal - cpuidle: powerpc: avoid double clear when breaking snooze - cpuidle: Skip governor when only one idle state is available - cpuset: Fix missing adaptation for cpuset_is_populated - crypto: af_alg - Cap AEAD AD length to 0x80000000 - crypto: af-alg - fix NULL pointer dereference in scatterwalk - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - crypto: algif_aead - Fix minimum RX size check for decryption - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: arm64/aes - Fix 32-bit aes_mac_update() arg treated as 64-bit - crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup - crypto: atmel-aes - guard unregister on error in atmel_aes_register_algs - crypto: atmel-ecc - Release client on allocation failure - crypto: atmel - Remove cfb and ofb - crypto: atmel-sha204a - Fix OOM ->tfm_count leak - crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path - crypto: atmel-tdes - fix DMA sync direction - crypto: atmel - Use unregister_{aeads,ahashes,skciphers} - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: authencesn - reject short ahash digests during instance creation - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: caam - fix DMA corruption on long hmac keys - crypto: caam - fix overflow on long hmac keys - crypto: caam - guard HMAC key hex dumps in hash_digest_key - crypto: cavium - fix dma_free_coherent() size - crypto: ccp - Add an S4 restore flow - crypto: ccp - copy IV using skcipher ivsize - crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed - crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed - crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed - crypto: ccp - Factor out ring destroy handling to a helper - crypto: ccp - Move direct access to some PSP registers out of TEE - crypto: ccp - Send PSP_CMD_TEE_RING_DESTROY when PSP_CMD_TEE_RING_INIT fails - crypto: ccree - fix a memory leak in cc_mac_digest() - crypto: hisilicon - Fix dma_unmap_single() direction - crypto: hisilicon/qm - move the barrier before writing to the mailbox register - crypto: hisilicon/sec2 - support skcipher/aead fallback for hardware queue unavailable - crypto: hisilicon/trng - modifying the order of header files - crypto: hisilicon/trng - support tfms sharing the device - crypto: hisilicon/zip - adjust the way to obtain the req in the callback function - crypto: hisilicon/zip - remove zlib and gzip - crypto: hisilicon/zip - support deflate algorithm - crypto: jitterentropy - replace long-held spinlock with mutex - crypto: nx - Avoid -Wflex-array-member-not-at-end warning - crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx - crypto: nx - fix context leak in nx842_crypto_free_ctx - crypto: nx - Migrate to scomp API - crypto: octeontx - fix dma_free_coherent() size - crypto: pcrypt - Fix handling of MAY_BACKLOG requests - crypto: qat - fix warning on adf_pfvf_pf_proto.c - crypto: qat - remove unused character device and IOCTLs - crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() - crypto: qat - Return pointer directly in adf_ctl_alloc_resources - crypto: qat - use swab32 macro - crypto: sa2ul - Fix AEAD fallback algorithm names - crypto: scatterwalk - Backport memcpy_sglist() - crypto: talitos - fix SEC1 32k ahash request limitation - crypto: talitos - rename first/last to first_desc/last_desc - crypto: testmgr - Hide ENOENT errors - crypto: testmgr - Hide ENOENT errors better - cxl: Fix premature commit_end increment on decoder commit failure - cxl/hdm: Avoid incorrect DVSEC fallback when HDM decoders are enabled - dcache: Limit the minimal number of bucket to two - debugfs: check for NULL pointer in debugfs_create_str() - debugfs: fix placement of EXPORT_SYMBOL_GPL for debugfs_create_str() - debugobjects: Allow to refill the pool before SYSTEM_SCHEDULING - debugobjects: Do not fill_pool() if pi_blocked_on - debugobjects: Dont call fill_pool() in early boot hardirq context - debugobjects: Use LD_WAIT_CONFIG instead of LD_WAIT_SLEEP - device property: Allow secondary lookup in fwnode_get_next_child_node() - device property: Make modifications of fwnode "flags" thread safe - device property: set fwnode->secondary to NULL in fwnode_init() - dev_printk: add new dev_err_probe() helpers - devres: fix missing node debug info in devm_krealloc() - Disable -Wattribute-alias for clang-23 and newer - dlm: prevent NPD when writing a positive value to event_done - dma-buf: Include ioctl.h in UAPI header - dma: dma-axi-dmac: fix SW cyclic transfers - dmaengine: dw-axi-dmac: Remove unnecessary return statement from void function - dmaengine: dw-edma: Fix multiple times setting of the CYCLE_STATE and CYCLE_BIT bits for HDMA. - dmaengine: fsl-edma: change to guard(mutex) within fsl_edma3_xlate() - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests - dmaengine: fsl-edma-main: Convert to platform remove callback returning void - dmaengine: idxd: Fix crash when the event log is disabled - dmaengine: idxd: Fix freeing the allocated ida too late - dmaengine: idxd: Fix leaking event log memory - dmaengine: idxd: Fix memory leak when a wq is reset - dmaengine: idxd: Fix not releasing workqueue on .release() - dmaengine: idxd: Remove usage of the deprecated ida_simple_xx() API - dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX - dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() - dmaengine: mxs-dma: Fix missing return value from of_dma_controller_register() - dmaengine: sh: rz-dmac: Move CHCTRL updates under spinlock - dmaengine: sh: rz-dmac: Protect the driver specific lists - dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix warnings - dmaengine: sun6i: Choose appropriate burst length under maxburst - dmaengine: xilinx_dma: Fix reset related timeout with two-channel AXIDMA - dmaengine: xilinx: xdma: Fix regmap init error handling - dmaengine: xilinx: xilinx_dma: Fix dma_device directions - dmaengine: xilinx: xilinx_dma: Fix residue calculation for cyclic DMA - dmaengine: xilinx: xilinx_dma: Fix unmasked residue subtraction - dma-mapping: add missing `inline` for `dma_free_attrs` - dma: swiotlb: add KMSAN annotations to swiotlb_bounce() - dm cache: fix concurrent write failure in passthrough mode - dm cache: fix dirty mapping checking in passthrough mode switching - dm cache: fix missing return in invalidate_committed's error path - dm cache: fix null-deref with concurrent writes in passthrough mode - dm cache: fix write hang in passthrough mode - dm cache: fix write path cache coherency in passthrough mode - dm cache metadata: fix memory leak on metadata abort retry - dm cache policy smq: check allocation under invalidate lock - dm cache policy smq: fix missing locks in invalidating cache blocks - dm cache: support shrinking the origin device - dm: clear cloned request bio pointer when last clone bio completes - dm: don't report warning when doing deferred remove - dm: fix a buffer overflow in ioctl processing - dm init: ensure device probing has finished in dm-mod.waitfor= - dm-integrity: fix a typo in the code for write/discard race - dm-integrity: fix recalculation in bitmap mode - dm log: fix out-of-bounds write due to region_count overflow - dm mirror: fix integer overflow in create_dirty_log() - dm mpath: make pg_init_delay_msecs settable - dm: remove fake timeout to avoid leak request - dm: replace -EEXIST with -EBUSY - dm-thin: fix metadata refcount underflow - dm-unstripe: fix mapping bug when there are multiple targets in a table - dm: use bio_clone_blkg_association - dm-verity: correctly handle dm_bufio_client_create() failure - dm-verity: disable recursive forward error correction - dm-verity-fec: correctly reject too-small FEC devices - dm-verity-fec: correctly reject too-small hash devices - Docs/admin-guide/mm/damon/reclaim: warn commit_inputs vs param updates race - docs: fix WARNING document not included in any toctree - Documentation: fix a hugetlbfs reservation statement - Documentation: ioctl-number: Extend "Include File" column width - Documentation: PCI: endpoint: Fix ntb/vntb copy & paste errors - Documentation: trace: Refactor toctree - Documentation: tracing: Add PCI tracepoint documentation - Documentation: tracing: Add ring-buffer mapping - dpaa2: add independent dependencies for FSL_DPAA2_SWITCH - dpaa2: compile dpaa2 even CONFIG_FSL_DPAA2_ETH=n - dpaa2-switch: do not clear any interrupts automatically - dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler - dpaa2-switch: validate num_ifs to prevent out-of-bounds write - drbd: Balance RCU calls in drbd_adm_dump_devices() - drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock() - drbd: fix null-pointer dereference on local read error - driver core: Add kernel-doc for DEV_FLAG_COUNT enum value - driver core: Don't let a device probe until it's ready - driver core: generalize driver_override in struct device - driver core: platform: use generic driver_override infrastructure - driver core: reject devices with unregistered buses - drivers/base/memory: fix memory block reference leak in poison accounting - drivers/base/memory: set mem->altmap after successful device registration - Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs - drivers: iio: mpu3050: use dev_err_probe for regulator request - drm: Account property blob allocations to memcg - drm/amd/display: Add pixel_clock to amd_pp_display_configuration - drm/amd/display: Allow DCE link encoder without AUX registers - drm/amd/display: Avoid updating surface with the same surface under MPO - drm/amd/display: Bound VBIOS record-chain walk loops - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size - drm/amd/display: Do not skip unrelated mode changes in DSC validation - drm/amd/display: Fix DisplayID not-found handling in parse_edid_displayid_vrr() - drm/amd/display: Fix integer overflow in bios_get_image() - drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs - drm/amd/display: Read EDID from VBIOS embedded panel info - drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info() - drm/amd/display: Remove conditional for shaper 3DLUT power-on - drm/amd/display: Use GFP_ATOMIC in dc_create_stream_for_sink - drm/amd/display: Use krealloc_array() in dal_vector_reserve() - drm/amd/display: Use same max plane scaling limits for all 64 bpp formats - drm/amd/display: Validate GPIO pin LUT table size before iterating - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async - drm/amd/display: Wrap dcn32_override_min_req_memclk() in DC_FP_{START, END} - drm/amd: Drop special case for yellow carp without discovery - drm/amd: Fix hang on amdgpu unload by using pci_dev_is_disconnected() - drm/amdgpu: Add basic validation for RAS header - drm/amdgpu: Add bounds checking to ib_{get,set}_value - drm/amdgpu: Add default case in DVI mode validation - drm/amdgpu: Add HAINAN clock adjustment - drm/amdgpu: add support for HDP IP version 6.1.1 - drm/amdgpu: Adjust usleep_range in fence wait - drm/amdgpu: apply state adjust rules to some additional HAINAN vairants - drm/amdgpu: avoid a warning in timedout job handler - drm/amdgpu: fix AMDGPU_INFO_READ_MMR_REG - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib - drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() - drm/amdgpu: Fix memory leak in amdgpu_ras_init() - drm/amdgpu: fix spelling typos - drm/amdgpu: Fix use-after-free race in VM acquire - drm/amdgpu: fix zero-size GDS range init on RDNA4 - drm/amdgpu/gfx10: look at the right prop for gfx queue priority - drm/amdgpu/gfx6: Support harvested SI chips with disabled TCCs (v2) - drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ - drm/amdgpu/gmc9.0: add bounds checking for cid - drm/amdgpu/jpeg: set no_user_fence for JPEG v2.0 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v2.5 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v3.0 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.3 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0 ring - drm/amdgpu: keep vga memory on MacBooks with switchable graphics - drm/amdgpu: Limit BO list entry count to prevent resource exhaustion - drm/amdgpu/mmhub2.0: add bounds checking for cid - drm/amdgpu/mmhub2.3: add bounds checking for cid - drm/amdgpu/mmhub3.0.1: add bounds checking for cid - drm/amdgpu/mmhub3.0.2: add bounds checking for cid - drm/amdgpu/mmhub3.0: add bounds checking for cid - drm/amdgpu/pm: add missing revision check for CI - drm/amdgpu/pm: align Hawaii mclk workaround with radeon - drm/amdgpu: restart the CS if some parts of the VM are still invalidated - drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission - drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init - drm/amdgpu: Use vmemdup_array_user in amdgpu_bo_create_list_entry_array - drm/amdgpu/uvd3.1: Don't validate the firmware when already validated - drm/amdgpu/vce: Prevent partial address patches - drm/amdgpu/vcn3: Avoid overflow on msg bound check - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg - drm/amdgpu/vcn4: Avoid overflow on msg bound check - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB - drm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec rings - drm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec rings - drm/amdgpu/vcn: set no_user_fence for VCN v3.0 enc/dec rings - drm/amdgpu/vcn: set no_user_fence for VCN v4.0.3 enc ring - drm/amdgpu: zero-initialize GART table on allocation - drm/amdkfd: Add upper bound check for num_of_nodes - drm/amdkfd: Check for pdd drm file first in CRIU restore path - drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure - drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 - drm/amdkfd: fix debug watchpoints for logical devices - drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map() - drm/amdkfd: fix NULL dereference in get_queue_ids() - drm/amdkfd: fix NULL pointer bug in svm_range_set_attr - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 - drm/amdkfd: validate SVM ioctl nattr against buffer size - drm/amd/pm/ci: Clear EnabledForActivity field for memory levels - drm/amd/pm/ci: Disable MCLK DPM on problematic CI ASICs - drm/amd/pm/ci: Fill DW8 fields from SMC - drm/amd/pm/ci: Fix powertune defaults for Hawaii 0x67B0 - drm/amd/pm/ci: Use highest MCLK on CI when MCLK DPM is disabled - drm/amd/pm/si: Disregard vblank time when no displays are connected - drm/amd/pm/smu7: Add SCLK cap for quirky Hawaii board - drm/amd/pm/smu7: Fix SMU7 voltage dependency on display clock - drm/amd/pm: Use pm_display_cfg in legacy DPM (v2) - drm/amd: Set num IP blocks to 0 if discovery fails - drm/arcpgu: fix device node leak - drm/ast: dp501: Fix initialization of SCU2C - drm/atmel-hlcdc: don't reject the commit if the src rect has fractional parts - drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback - drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release - drm/bridge: cadence: cdns-mhdp8546-core: Add mode_valid hook to drm_bridge_funcs - drm/bridge: cadence: cdns-mhdp8546-core: Handle HDCP state in bridge atomic check - drm/bridge: cadence: cdns-mhdp8546-core: Set the mhdp connector earlier in atomic_enable() - drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe - drm/bridge: it66121: acquire reset GPIO in probe - drm/bridge: megachips: remove bridge when irq request fails - drm/bridge: samsung-dsim: Fix memory leak in error path - drm/bridge: ti-sn65dsi83: fix CHA_DSI_CLK_RANGE rounding - drm/bridge: ti-sn65dsi83: halve horizontal syncs for dual LVDS output - drm/bridge: ti-sn65dsi86: Add support for DisplayPort mode with HPD - drm/bridge: ti-sn65dsi86: Enable HPD polling if IRQ is not used - drm/display/dp_mst: Add protection against 0 vcpi - drm/dp: Add eDP 1.5 bit definition - drm/exynos: vidi: fix to avoid directly dereferencing user pointer - drm/exynos: vidi: use ctx->lock to protect struct vidi_context member variables related to memory alloc/free - drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl() - drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup - drm/fbdev-helper: Set and clear VGA switcheroo client from fb_info - drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() - drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup - drm/gma500/oaktrail_lvds: fix hang on init failure - drm/gma500/oaktrail_lvds: fix i2c adapter leaks on init - drm/hyperv: validate resolution_count and fix WIN8 fallback - drm/hyperv: validate VMBus packet size in receive callback - drm/i915/acpi: free _DSM package when no connectors - drm/i915: Constify watermark state checker - drm/i915/dp: Fix VSC dynamic range signaling for RGB formats - drm/i915/dp: Use crtc_state->enhanced_framing properly on ivb/hsw CPU eDP - drm/i915: Extract intel_dbuf_mdclk_cdclk_ratio_update() - drm/i915: Fix potential overflow of shmem scatterlist length - drm/i915: Fix potential UAF in TTM object purge - drm/i915/gem: Fix phys BO pread/pwrite with offset - drm/i915/gmbus: fix spurious timeout on 512-byte burst reads - drm/i915/gt: Check set_default_submission() before deferencing - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat - drm/i915: Loop over all active pipes in intel_mbus_dbox_update - drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register - drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used - drm/i915/psr: Do not use pipe_src as borders for SU area - drm/i915/psr: Read Intel DPCD workaround register - drm/i915: Simplify watermark state checker calling convention - drm/i915: skip __i915_request_skip() for already signaled requests - drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros - drm/i915/wm: Verify the correct plane DDB entry - drm/imx: Fix three kernel-doc warnings in dcss-scaler.c - drm/ioc32: stop speculation on the drm_compat_ioctl path - drm/komeda: fix integer overflow in AFBC framebuffer size check - drm/logicvc: Fix device node reference leak in logicvc_drm_config_parse() - drm/msm/a2xx: fix pixel shader start on A225 - drm/msm/a6xx: Fix HLSQ register dumping - drm/msm/a6xx: Use barriers while updating HFI Q headers - drm/msm/disp/dpu: add merge3d support for sc7280 - drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x - drm/msm/dpu: fix mismatch between power and frequency - drm/msm/dsi: add the missing parameter description - drm/msm/dsi: Document DSC related pclk_rate and hdisplay calculations - drm/msm/dsi: don't dump registers past the mapped region - drm/msm/dsi: fix pclk rate calculation for bonded dsi - drm/msm/dsi: rename MSM8998 DSI version from V2_2_0 to V2_0_0 - drm/msm: Fix dma_free_attrs() buffer size - drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN - drm/msm/shrinker: Fix can_block() logic - drm/msm/snapshot: fix dumping of the unaligned regions - drm/nouveau: fix u32 overflow in pushbuf reloc bounds check - drm: of: drm_of_panel_bridge_remove(): fix device_node leak - drm/panel: sharp-ls043t1le01: make use of prepare_prev_first - drm/panel: simple: Correct G190EAN01 prepare timing - drm/panfrost: Fix wait_bo ioctl leaking positive return from dma_resv_wait_timeout() - drm/radeon: Add HAINAN clock adjustment - drm/radeon: add missing revision check for CI - drm/radeon: apply state adjust rules to some additional HAINAN vairants - drm: Remove plane hsub/vsub alignment requirement for core helpers - drm/sched: Fix kernel-doc warning for drm_sched_job_done() - drm/solomon: Fix page start when updating rectangle in page addressing mode - drm/ssd130x: Replace .page_height field in device info with a constant - drm/ssd130x: Store the HW buffer in the driver-private CRTC state - drm/ssd130x: Use bool for ssd130x_deviceinfo flags - drm/sun4i: backend: fix error pointer dereference - drm/sun4i: Fix resource leaks - drm/sysfb: ofdrm: fix PCI device reference leaks - drm/tegra: dsi: fix device leak on probe - drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used - drm/v3d: Reject empty multisync extension to prevent infinite loop - drm/v3d: Set DMA segment size to avoid debug warnings - drm/v3d: Skip CSD when it has zeroed workgroups - drm/v3d: Store the active job inside the queue's state - drm/vc4: Fix a memory leak in hang state error path - drm/vc4: fix krealloc() memory leak - drm/vc4: Fix memory leak of BO array in hang state - drm/vc4: platform_get_irq_byname() returns an int - drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock - drm/vc4: Release runtime PM reference after binding V3D - drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() - drm/virtio: Fix driver removal with disabled KMS - drm/virtio: use uninterruptible resv lock for plane updates - drm/vmwgfx: Fix invalid kref_put callback in vmw_bo_dirty_release - drm/vmwgfx: Return the correct value in vmw_translate_ptr functions - dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() - dt-bindings: auxdisplay: ht16k33: Use unevaluatedProperties to fix common property warning - dt-bindings: clock: qcom,dispcc-sc7180: Define MDSS resets - dt-bindings: clock: qcom,gcc-sc8180x: Add missing GDSCs - dt-bindings: connector: add pd-disable dependency - dt-bindings: gpio: fix microchip #interrupt-cells - dt-bindings: interrupt-controller: arm,gic-v3: Fix EPPI range - dt-bindings: net: dsa: nxp,sja1105: make spi-cpol optional for sja1110 - dt-bindings: net: Fix Tegra234 MGBE PTP clock - e1000: check return value of e1000_read_eeprom - e1000/e1000e: Fix leak in DMA error cleanup - e1000e: clear DPG_EN after reset to avoid autonomous power-gating - e1000e: Unroll PTP in probe error handling - EDAC/altera: Remove IRQF_ONESHOT - EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size() - EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size() - EDAC/mc: Fix error path ordering in edac_mc_alloc() - efi: Allocate runtime workqueue before ACPI init - efi/capsule-loader: fix incorrect sizeof in phys array reallocation - EFI/CPER: don't dump the entire memory region - EFI/CPER: don't go past the ARM processor CPER record buffer - efi: Fix reservation of unaccepted memory table - erofs: add GFP_NOIO in the bio completion if needed - erofs: fix "BUG: Bad page state in z_erofs_do_read_page" - erofs: fix the out-of-bounds nameoff handling for trailing dirents - erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap() - err.h: use __always_inline on all error pointer helpers - esp: fix skb leak with espintcp and async crypto - eth: bnxt: always recalculate features after XDP clearing, fix null-deref - ethtool: eeprom: add missing ethnl_ops_begin() / _complete() during fallback - ethtool: eeprom: add more safeties to EEPROM Netlink fallback - ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics - eventfs: Hold eventfs_mutex and SRCU when remount walks events - eventfs: Use list_add_tail_rcu() for SRCU-protected children list - eventpoll: defer struct eventpoll free to RCU grace period - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() - eventpoll: fix ep_remove struct eventpoll / struct file UAF - eventpoll: Fix integer overflow in ep_loop_check_proc() - eventpoll: kill __ep_remove() - eventpoll: move epi_fget() up - eventpoll: rename ep_remove_safe() back to ep_remove() - eventpoll: split __ep_remove() - eventpoll: use hlist_is_singular_node() in __ep_remove() - exfat: fix potential use-after-free in exfat_find_dir_entry() - exit: prevent preemption of oopsing TASK_DEAD task - exit: Sleep at TASK_IDLE when waiting for application core dump - ext2: reject inodes with zero i_nlink and valid mode in ext2_iget() - ext4: always allocate blocks only from groups inode can use - ext4: always drain queued discard work in ext4_mb_release() - ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() - ext4: avoid infinite loops caused by residual data - ext4: convert bd_bitmap_page to bd_bitmap_folio - ext4: convert bd_buddy_page to bd_buddy_folio - ext4: convert inline data to extents when truncate exceeds inline size - ext4: correct the comments place for EXT4_EXT_MAY_ZEROOUT - ext4: delete redundant calculations in ext4_mb_get_buddy_page_lock() - ext4: don't cache extent during splitting extent - ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O - ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 - ext4: drop extent cache after doing PARTIAL_VALID1 zeroout - ext4: drop extent cache when splitting extent fails - ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access - ext4: fix dirtyclusters double decrement on fs shutdown - ext4: fix e4b bitmap inconsistency reports - ext4: fix fsync(2) for nojournal mode - ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths - ext4: fix journal credit check when setting fscrypt context - ext4: fix memory leak in ext4_ext_shift_extents() - ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() - ext4: fix stale xarray tags after writeback - ext4: fix the might_sleep() warnings in kvfree() - ext4: fix use-after-free in update_super_work when racing with umount - ext4: get rid of ppath in ext4_convert_unwritten_extents_endio() - ext4: get rid of ppath in ext4_ext_convert_to_initialized() - ext4: get rid of ppath in ext4_ext_create_new_leaf() - ext4: get rid of ppath in ext4_ext_handle_unwritten_extents() - ext4: get rid of ppath in ext4_ext_insert_extent() - ext4: get rid of ppath in ext4_find_extent() - ext4: get rid of ppath in ext4_split_convert_extents() - ext4: get rid of ppath in ext4_split_extent() - ext4: get rid of ppath in ext4_split_extent_at() - ext4: handle wraparound when searching for blocks for indirect mapped blocks - ext4: make recently_deleted() properly work with lazy itable initialization - ext4: mark group add fast-commit ineligible - ext4: mark group extend fast-commit ineligible - ext4: move ext4_percpu_param_init() before ext4_mb_init() - ext4: publish jinode after initialization - ext4: reject mount if bigalloc with s_first_data_block != 0 - ext4: replace BUG_ON with proper error handling in ext4_read_inline_folio - ext4: subdivide EXT4_EXT_DATA_VALID1 - ext4: use optimized mballoc scanning regardless of inode format - ext4: validate p_idx bounds in ext4_ext_correct_indexes - extcon: ptn5150: handle pending IRQ events during system resume - extract-cert: Wrap key_pass with '#ifdef USE_PKCS11_ENGINE' - f2fs: add READ_ONCE() for i_blocks in f2fs_update_inode() - f2fs: fix false alarm of lockdep on cp_global_sem lock - f2fs: fix fiemap boundary handling when read extent cache is incomplete - f2fs: fix incorrect file address mapping when inline inode is unwritten - f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node() - f2fs: fix incorrect multidevice info in trace_f2fs_map_blocks() - f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes - f2fs: fix node_cnt race between extent node destroy and writeback - f2fs: fix out-of-bounds access in sysfs attribute read/write - f2fs: fix to add gc count stat in f2fs_gc_range - f2fs: fix to avoid mapping wrong physical block for swapfile - f2fs: fix to avoid memory leak in f2fs_rename() - f2fs: fix to avoid migrating empty section - f2fs: fix to avoid UAF in f2fs_write_end_io() - f2fs: fix to detect potential corrupted nid in free_nid_list - f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally - f2fs: fix to round down start offset of fallocate for pin file - f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io() - f2fs: fix use-after-free of sbi in f2fs_compress_write_end_io() - f2fs: fix zoned block device information initialization - f2fs: keep atomic write retry from zeroing original data - f2fs: protect extension_list reading with sb_lock in f2fs_sbi_show() - f2fs: Use sysfs_emit_at() to simplify code - f2fs: validate ACL entry sizes in f2fs_acl_from_disk() - f2fs: validate compress cache inode only when enabled - f2fs: zone: fix to avoid inconsistence in between SIT and SSA - fanotify: fix false positive on permission events - fat: avoid parent link count underflow in rmdir - fbcon: Avoid OOB font access if console rotation fails - fbcon: check return value of con2fb_acquire_newinfo() - fbcon: Remove struct fbcon_display.inverse - fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe() - fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info - fbdev: ffb: fix corrupted video output on Sun FFB1 - fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var - fbdev: fix use-after-free in store_modes() - fbdev: matroxfb: Mark variable with __maybe_unused to avoid W=1 build break - fbdev: modedb: fix a possible UAF in fb_find_mode() - fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode - fbdev: of_display_timing: Fix device node reference leak in of_get_display_timings() - fbdev: of: display_timing: fix refcount leak in of_get_display_timings() - fbdev: offb: fix PCI device reference leak on probe failure - fbdev: rivafb: fix divide error in nv3_arb() - fbdev: smscufx: properly copy ioctl memory to kernelspace - fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO - fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free - fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO - fbdev: vt8500lcdfb: fix missing dma_free_coherent() - fbdev/vt8500lcdfb: Initialize fb_ops with fbdev macros - file: add fput() cleanup helper - firmware: arm_ffa: Check for NULL FF-A ID table while driver registration - firmware: arm_ffa: Skip free_pages on RX buffer alloc failure - firmware: arm_scpi: Fix device_node reference leak in probe path - firmware: dmi: Correct an indexing error in dmi.h - firmware: google: framebuffer: Do not mark framebuffer as busy - firmware: google: framebuffer: Do not unregister platform device - fix it87_wdt early reboot by reporting running timer - flow_dissector: do not dissect PPPoE PFC frames - fork: defer linking file vma until vma is fully initialized - fpga: dfl: use subsys_initcall to allow built-in drivers to be added - fpga: of-fpga-region: Fail if any bridge is missing - fpga: region: fix use-after-free in child_regions_with_firmware() - fs: add for 'init_fs' - fs/adfs: validate nzones in adfs_validate_bblk() - fs/buffer: add alert in try_to_free_buffers() for folios without buffers - fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling - fs/nfs: Fix readdir slow-start regression - fs/ntfs3: avoid calling run_get_entry() when run == NULL in ntfs_read_run_nb_ra() - fs: ntfs3: check return value of indx_find to avoid infinite loop - fs/ntfs3: drop preallocated clusters for sparse and compressed files - fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata - fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST - fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot - fs/ntfs3: prevent infinite loops caused by the next valid being the same - fs/ntfs3: terminate the cached volume label after UTF-8 conversion - fs/ntfs3: validate rec->used in journal-replay file record check - fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START - fs: prepare for adding LSM blob to backing_file - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath - ftrace: Check against is_kernel_text() instead of kaslr_offset() - ftrace: Do not over-allocate ftrace memory - ftrace: Have ftrace pages output reflect freed pages - ftrace: Test mcount_loc addr before calling ftrace_call_addr() - ftrace: Update the mcount_loc check of skipped entries - fuse: Check for large folio with SPLICE_F_MOVE - fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios - fuse: quiet down complaints in fuse_conn_limit_write - fuse: reject fuse_notify() pagecache ops on directories - fuse: reject oversized dirents in page cache - fuse: re-lock request before replacing page cache folio - futex: Clear stale exiting pointer in futex_lock_pi() retry path - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup - genetlink: Use internal flags for multicast groups - gfs2: Add metapath_dibh helper - gfs2: add some missing log locking - gfs2: Call unlock_new_inode before d_instantiate - gfs2: fiemap page fault fix - gfs2: Fix unlikely race in gdlm_put_lock - gfs2: fix use-after-free in gfs2_qd_dealloc - gfs2: Fix use-after-free in iomap inline data write path - gfs2: Improve gfs2_consist_inode() usage - gfs2: prevent NULL pointer dereference during unmount - gfs2: Retries missing in gfs2_{rename,exchange} - gfs2: Validate i_depth for exhash directories - gpio: aspeed-sgpio: Change the macro to support deferred probe - gpio: cdev: check if uAPI v2 config attributes are correctly zeroed - gpiolib: acpi: Fix gpio count with string references - gpiolib: cdev: use !mem_is_zero() instead of memchr_inv(s, 0, n) - gpio: mvebu: fix NULL pointer dereference in suspend/resume - gpio: mxc: fix irq_high handling - gpio: mxc: map Both Edge pad wakeup to Rising Edge - gpio: of: clear OF_POPULATED on hog nodes in remove path - gpio: rockchip: convert bank->clk to devm_clk_get_enabled() - gpio: sprd: Change sprd_gpio lock to raw_spin_lock - gpio: tegra: fix irq_release_resources calling enable instead of disable - gro: change the BUG_ON() in gro_pull_from_frag0() - gve: defer interrupt enabling until NAPI registration - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL - hdlc_ppp: sync per-proto timers before freeing hdlc state - hfsplus: fix held lock freed on hfsplus_fill_super() - hfsplus: fix uninit-value by validating catalog record size - hfsplus: fix volume corruption issue for generic/498 - hfsplus: pretend special inodes as regular files - hfsplus: return error when node already exists in hfs_bnode_create - HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them - HID: alps: fix NULL pointer dereference in alps_raw_event() - HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards - HID: apple: avoid memory leak in apple_report_fixup() - HID: asus: add xg mobile 2023 external hardware support - HID: asus: avoid memory leak in asus_report_fixup() - HID: asus: do not abort probe when not necessary - HID: asus: make asus_resume adhere to linux kernel coding standards - HID: core: Add printk_ratelimited variants to hid_warn() etc - HID: core: clamp report_size in s32ton() to avoid undefined shift - HID: core: Fix size_t specifier in hid_report_raw_event() - HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK - HID: hid-pl: handle probe errors - HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() - HID: magicmouse: avoid memory leak in magicmouse_report_fixup() - HID: magicmouse: Do not crash on missing msc->input - HID: magicmouse: fix battery reporting for Apple Magic Trackpad 2 - HID: mcp2221: cancel last I2C command on read error - HID: multitouch: add eGalaxTouch EXC3188 support - HID: multitouch: Check to ensure report responses match the request - HID: pass the buffer size to hid_report_raw_event - HID: playstation: Add missing check for input_ff_create_memless - HID: playstation: Clamp num_touch_reports - HID: prodikeys: Check presence of pm->input_ep82 - HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse - HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3 - HID: quirks: really enable the intended work around for appledisplay - HID: roccat: fix use-after-free in roccat_report_event - HID: uclogic: Fix regression of input name assignment - HID: usbhid: fix deadlock in hid_post_reset() - HID: wacom: Fix OOB write in wacom_hid_set_device_mode() - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq - hisi_acc_vfio_pci: update status after RAS error - hpfs: fix a crash if hpfs_map_dnode_bitmap fails - hrtimer: Avoid pointless reprogramming in __hrtimer_start_range_ns() - hrtimer: Fix trace oddity - hrtimer: Reduce trace noise in hrtimer_start() - hrtimers: Update the return type of enqueue_hrtimer() - hsr: Remove WARN_ONCE() in hsr_addr_is_self(). - hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf - hv_sock: fix ARM64 support - hv: utils: handle and propagate errors in kvp_register - hwmon: (adm1177) fix sysfs ABI violation and current unit conversion - hwmon: (aht10) Add support for dht20 - hwmon: (aht10) Fix initialization commands for AHT20 - hwmon: (axi-fan-control) Make use of dev_err_probe() - hwmon: (axi-fan-control) Use device firmware agnostic API - hwmon: axi-fan: don't use driver_override as IRQ name - hwmon: (corsair-psu) Close HID device on probe errors - hwmon: (f71882fg) Add F81968 support - hwmon: (it87) Check the it87_lock() return value - hwmon: (ltc2992) Clamp threshold writes to hardware range - hwmon: (ltc2992) Fix u32 overflow in power read path - hwmon: (max16065) Use READ/WRITE_ONCE to avoid compiler optimization induced race - hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE - hwmon: (occ) Fix division by zero in occ_show_power_1() - hwmon: (occ) Fix missing newline in occ_show_extended() - hwmon: (peci/cputemp) Fix crit_hyst returning delta instead of absolute temperature - hwmon: (peci/cputemp) Fix off-by-one in cputemp_is_visible() - hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer - hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR - hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in get_multiple - hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer - hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe() - hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe() - hwmon: (pmbus/adm1266) reject implausible blackbox record_count - hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors - hwmon: (pmbus/adm1266) seed timestamp from the real-time clock - hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock - hwmon: (pmbus/adm1266) serialize NVMEM blackbox read with pmbus_lock - hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX - hwmon: (pmbus/core) Protect regulator operations with mutex - hwmon: (pmbus/isl68137) Add mutex protection for AVS enable sysfs attributes - hwmon: (pmbus/isl68137) Fix unchecked return value and use sysfs_emit() - hwmon: (pmbus/mp2975) Add error check for pmbus_read_word_data() return value - hwmon: (pmbus/q54sj108a2) fix stack overflow in debugfs read - hwmon: (pxe1610) Check return value of page-select write in probe - hwmon: (tps53679) Fix device ID comparison and printing in tps53676_identify() - hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed - i2c: cp2615: fix serial string NULL-deref at probe - i2c: cp2615: replace deprecated strncpy with strscpy - i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl - i2c: fsi: Fix a potential leak in fsi_i2c_probe() - i2c: pxa: defer reset on Armada 3700 when recovery is used - i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() - i2c: s3c24xx: check the size of the SMBUS message before using it - i2c: stm32f7: fix timing computation ignoring i2c-analog-filter - i2c: stub: Reject I2C block transfers with invalid length - i2c: tegra: Don't mark devices with pins as IRQ safe - i2c: tegra: Fix NOIRQ suspend/resume - i3c: dw-i3c-master: Set SIR_REJECT in DAT on device attach and reattach - i3c: dw: Initialize spinlock to avoid upsetting lockdep - i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr() - i3c: master: Update hot-join flag only on success - i3c: mipi-i3c-hci: Add missing TID field to no-op command descriptor - i3c: mipi-i3c-hci: fix IBI payload length calculation for final status - i3c: mipi-i3c-hci: Restart DMA ring correctly after dequeue abort - i3c: mipi-i3c-hci: Use ETIMEDOUT instead of ETIME for timeout errors - i3c: Move device name assignment after i3c_bus_init - i40e: Cleanup PTP pins on probe failure - i40e: don't advertise IFF_SUPP_NOFCS - i40e: Fix preempt count leak in napi poll tracepoint - i40e: fix registering XDP RxQ info - i40e: fix src IP mask checks and memcpy argument names in cloud filter - i40e: use xdp.frame_sz as XDP RxQ info frag_size - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler - iavf: fix VLAN filter lost on add/delete race - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING - iavf: stop removing VLAN filters from PF on interface down - iavf: wait for PF confirmation before removing VLAN filters - IB/cache: update gid cache on client reregister event - IB/core: Fix zero dmac race in neighbor resolution - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN - ibmasm: fix heap over-read in ibmasm_send_i2o_message() - ibmasm: fix OOB reads in command_file_write due to missing size checks - IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq() - ibmveth: Disable GSO for packets with small MSS - ice: fix double-free of tx_buf skb - ice: fix locking in ice_dcb_rebuild() - ice: Fix memory leak in ice_set_ringparam() - ice: fix NULL pointer dereference in ice_reset_all_vfs() - ice: fix retry for AQ command 0x06EE - ice: fix setting promisc mode while adding VID filter - ice: fix VF queue configuration with low MTU values - ice: reintroduce retry mechanism for indirect AQ - ice: Remove jumbo_remove step from TX path - ice: use ice_update_eth_stats() for representor stats - icmp: fix NULL pointer dereference in icmp_tag_validation() - icmp: icmp_msgs_per_sec and icmp_msgs_burst sysctls become per netns - icmp: move icmp_global.credit and icmp_global.stamp to per netns storage - icmp: prevent possible overflow in icmp_global_allow() - ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() - igc: fix missing update of skb->tail in igc_xmit_frame() - iio: accel: fix ADXL355 temperature signature value - iio: adc: ad7768-1: fix one-shot mode data acquisition - iio: adc: npcm: Convert to platform remove callback returning void - iio: adc: npcm: fix unbalanced clk_disable_unprepare() - iio: adc: ti-adc161s626: fix buffer read on big-endian - iio: adc: ti-adc161s626: use DMA-safe memory for spi_read() - iio: adc: ti-ads7950: use iio_push_to_buffers_with_ts_unaligned() - iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw - iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux - iio: buffer: Fix wait_queue not being removed - iio: buffer: hw-consumer: fix use-after-free in error path - iio: chemical: bme680: Fix measurement wait duration calculation - iio: chemical: scd30: fix division by zero in write_raw - iio: chemical: scd30: Use guard(mutex) to allow early returns - iio: chemical: sps30_i2c: fix buffer size in sps30_i2c_read_meas() - iio: chemical: sps30_serial: fix buffer size in sps30_serial_read_meas() - iio: common: st_sensors: Fix use of uninitialize device structs - iio: dac: ad5686: acquire lock when doing powerdown control - iio: dac: ad5686: fix input raw value check - iio: dac: ad5686: fix ref bit initialization for single-channel parts - iio: dac: ad5770r: fix error return in ad5770r_read_raw() - iio: dac: ds4424: reject -128 RAW value - iio: dac: max5821: fix return value check in powerdown sync - iio: frequency: adf4377: Fix duplicated soft reset mask - iio: gyro: adis16260: fix division by zero in write_raw - iio: gyro: itg3200: fix i2c read into the wrong stack location - iio: gyro: itg3200: Fix unchecked return value in read_raw - iio: gyro: mpu3050-core: fix pm_runtime error handling - iio: gyro: mpu3050: Fix incorrect free_irq() variable - iio: gyro: mpu3050: Fix irq resource leak - iio: gyro: mpu3050: Fix out-of-sequence free_irq() - iio: gyro: mpu3050-i2c: fix pm_runtime error handling - iio: gyro: mpu3050: Move iio_device_register() to correct location - iio: imu: bmi160: Remove potential undefined behavior in bmi160_config_pin() - iio: imu: bno055: fix BNO055_SCAN_CH_COUNT off by one - iio: imu: inv_icm42600: fix odr switch to the same value - iio: imu: inv_icm42600: fix odr switch when turning buffer off - iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer - iio: imu: st_lsm6dsx: Set FIFO ODR for accelerometer and gyroscope only - iio: light: bh1780: fix PM runtime leak on error path - iio: light: cm3323: fix reg_conf not being initialized correctly - iio: light: vcnl4035: fix scan buffer on big-endian - iio: magnetometer: Remove IRQF_ONESHOT - iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL - iio: potentiometer: mcp4131: fix double application of wiper shift - iio: pressure: mprls0025pa: fix scan_type struct - iio: sca3000: Fix a resource leak in sca3000_probe() - iio: ssp_sensors: cancel delayed work_refresh on remove - iio: temperature: tsys01: fix broken PROM checksum validation - iio: Use IRQF_NO_THREAD - ima: check return value of crypto_shash_final() in boot aggregate - ima: verify the previous kernel's IMA buffer lies in addressable RAM - include: uapi: netfilter_bridge.h: Cover for musl libc - indirect_call_wrapper: do not reevaluate function pointer - inet: add indirect call wrapper for getfrag() calls - inet: frags: add inet_frag_queue_flush() - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush - inet: frags: flush pending skbs in fqdir_pre_exit() - inet: move icmp_global_{credit,stamp} to a separate cache line - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP - inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails - Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK) - Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard - Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem - Input: elan_i2c - validate firmware size before use - Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk table - Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() - Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 - Input: synaptics-rmi4 - fix a locking bug in an error path - Input: uinput - fix circular locking dependency with ff-core - Input: uinput - take event lock when submitting FF request "event" - Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size - Input: xpad - add "Nova 2 Lite" from GameSir - Input: xpad - add support for ASUS ROG RAIKIRI II - Input: xpad - add support for BETOP BTP-KP50B/C controller's wireless mode - Input: xpad - add support for Razer Wolverine V3 Pro - Input: xpad - fix out-of-bounds access for Share button - iomap: allocate s_dio_done_wq for async reads as well - iomap: don't revert iov_iter on partially completed buffered writes - iomap: fix submission side handling of completion side errors - iomap: reject delalloc mappings during writeback - iommu/amd: move wait_on_sem() out of spinlock - iommu/amd: serialize sequence allocation under concurrent TLB invalidations - iommu/amd: Use atomic64_inc_return() in iommu.c - iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency - iommu, debugobjects: avoid gcc-16.1 section mismatch warnings - iommufd: Fix a race with concurrent allocation and unmap - iommufd: vfio compatibility extension check for noiommu mode - iommu/vt-d: Disable DMAR for Intel Q35 IGFX - iommu/vt-d: Fix intel iommu iotlb sync hardlockup and retry - iommu/vt-d: Flush cache for PASID table before using it - iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode - ionic: fix persistent MAC address override on PF - ionic: Rate limit unknown xcvr type messages - io_uring/cancel: de-unionize file and user_data in struct io_cancel_data - io_uring/filetable: clamp alloc_hint to the configured alloc range - io_uring/kbuf: check if target buffer list is still legacy on recycle - io_uring/poll: ensure EPOLL_ONESHOT is propagated for EPOLL_URING_WAKE - io_uring/poll: fix multishot recv missing EOF on wakeup race - io_uring/poll: fix signed comparison in io_poll_get_ownership() - io_uring/sync: validate passed in offset - io_uring/timeout: check unused sqe fields - io-wq: check that the predecessor is hashed in io_wq_remove_pending() - ip6_gre: Use cached t->net in ip6erspan_changelink(). - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() - ip6_vti: set netns_immutable on the fallback device. - ip6: vti: Use ip6_tnl.net in vti6_changelink(). - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). - ipc: don't audit capability check in ipc_permissions() - ipc: limit next_id allocation to the valid ID range - ipc/shm: serialize orphan cleanup with shm_nattch updates - ipmi: Add limits to event and receive message requests - ipmi: Check event message buffer response for bad data - ipmi: Fix rcu_read_unlock to srcu_read_unlock in handle_read_event_rsp - ipmi: ipmb: initialise event handler read bytes - ipmi:si: Return state to normal if message allocation fails - ipmi: ssif_bmc: change log level to dbg in irq callback - ipmi: ssif_bmc: fix message desynchronization after truncated response - ipmi: ssif_bmc: fix missing check for copy_to_user() partial failure - ipmi:ssif: Clean up kthread on errors - ipmi:ssif: Fix a shutdown race - ipmi:ssif: NULL thread on error - ipmi:ssif: Remove unnecessary indention - ipv4: account for fraggap on the paged allocation path - ipv4: add new arguments to udp_tunnel_dst_lookup() - ipv4: fib: Annotate access to struct fib_alias.fa_state. - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() - ipv4: icmp: fix null-ptr-deref in icmp_build_probe() - ipv4: icmp: validate reply type before using icmp_pointers - ipv4: igmp: annotate data-races around idev->mr_maxdelay - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 - ipv4: remove "proto" argument from udp_tunnel_dst_lookup() - ipv4: rename and move ip_route_output_tunnel() - ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options - ipv6: account for fraggap on the paged allocation path - ipv6: add NULL checks for idev in SRv6 paths - ipv6/addrconf: annotate data-races around devconf fields (II) - ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}() - ipv6: avoid overflows in ip6_datagram_send_ctl() - ipv6: Don't remove permanent routes with exceptions from tb6_gc_hlist. - ipv6: exthdrs: annotate data-race over multiple sysctl - ipv6: exthdrs: refresh nh after handling HAO option - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() - ipv6: Fix a potential NPD in cleanup_prefix_route() - ipv6: fix a race in ip6_sock_set_v6only() - ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() - ipv6: Fix out-of-bound access in fib6_add_rt2node(). - ipv6: fix possible infinite loop in fib6_select_path() - ipv6: fix possible infinite loop in rt6_fill_node() - ipv6: fix possible UAF in icmpv6_rcv() - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() - ipv6: ioam: add NULL check for idev in ipv6_hop_ioam() - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() - ipv6: mcast: Fix use-after-free when processing MLD queries - ipv6: prevent possible UaF in addrconf_permanent_addr() - ipv6: Remove permanent routes from tb6_gc_hlist when all exceptions expire. - ipv6: rename and move ip6_dst_lookup_tunnel() - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows - ipv6: sit: reload inner IPv6 header after GSO offloads - ipv6: use RCU in ip6_xmit() - ipv6: validate extension header length before copying to cmsg - ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() - ipvs: clear the svc scheduler ptr early on edit - ipvs: fix MTU check for GSO packets in tunnel mode - ipvs: fix NULL deref in ip_vs_add_service error path - ipvs: skip ipv6 extension headers for csum checks - irqchip/ath79-cpu: Remove unused function - irqchip/gic-v3-its: Limit number of per-device MSIs to the range the ITS supports - irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove - irqchip/irq-pic32-evic: Address warning related to wrong printf() formatter - irqchip/qcom-mpm: Add missing mailbox TX done acknowledgment - irqchip/sifive-plic: Fix frozen interrupt due to affinity setting - irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT - isofs: validate block number from NFS file handle in isofs_export_iget - isofs: validate Rock Ridge CE continuation extent against volume size - ixgbevf: add missing negotiate_features op to Hyper-V ops table - ixgbevf: fix link setup issue - ixgbevf: fix use-after-free in VEPA multicast source pruning - jbd2: gracefully abort on checkpointing state corruptions - jfs: Add missing set_freezable() for freezable kthread - jfs: nlink overflow in jfs_rename - kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup() - kbuild: Add objtool to top-level clean target - kbuild: Leave objtool binary around with 'make clean' - kexec: derive purgatory entry from symbol - KEYS: fix overflow in keyctl_pkey_params_get_2() - keys: Pin request_key_auth payload in instantiate paths - kprobes: avoid crash when rmmod/insmod after ftrace killed - kprobes: Remove unneeded goto - kprobes: Remove unneeded warnings from __arm_kprobe_ftrace() - kprobes: skip non-symbol addresses in kprobe_add_ksym_blacklist() - ksmbd: add durable scavenger timer - ksmbd: add support for supplementary groups - ksmbd: avoid reclaiming expired durable opens by the client - ksmbd: call ksmbd_vfs_kern_path_end_removing() on some error paths - ksmbd: close durable scavenger races against m_fp_list lookups - ksmbd: Compare MACs in constant time - ksmbd: destroy async_ida in ksmbd_conn_free() - ksmbd: destroy tree_conn_ida in ksmbd_session_destroy() - ksmbd: do not expire session on binding failure - ksmbd: Don't log keys in SMB3 signing and encryption key generation - ksmbd: fix durable fd leak on ClientGUID mismatch in durable v2 open - ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE - ksmbd: fix mechToken leak when SPNEGO decode fails after token alloc - ksmbd: fix memory leaks and NULL deref in smb2_lock() - ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers - ksmbd: fix null pointer dereference in compare_guid_key() - ksmbd: fix OOB write in QUERY_INFO for compound requests - ksmbd: fix out-of-bounds read in smb_check_perm_dacl() - ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment - ksmbd: fix potencial OOB in get_file_all_info() for compound requests - ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow - ksmbd: fix use-after-free and NULL deref in smb_grant_oplock() - ksmbd: fix use-after-free by using call_rcu() for oplock_info - ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine - ksmbd: fix use-after-free in durable v2 replay of active file handles - ksmbd: fix use-after-free in __ksmbd_close_fd() via durable scavenger - ksmbd: fix use-after-free in smb_lazy_parent_lease_break_close() - ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL - ksmbd: fix use-after-free of share_conf in compound request - ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops - ksmbd: reject non-VALID session in compound request branch - ksmbd: replace connection list with hash table - ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len() - ksmbd: require 3 sub-authorities before reading sub_auth[2] - ksmbd: require minimum ACE size in smb_check_perm_dacl() - ksmbd: reset rcount per connection in ksmbd_conn_wait_idle_sess_id() - ksmbd: scope conn->binding slowpath to bound sessions only - ksmbd: unset conn->binding on failed binding request - ksmbd: use check_add_overflow() to prevent u16 DACL size overflow - ksmbd: use msleep instaed of schedule_timeout_interruptible() - ksmbd: Use struct_size() to improve smb_direct_rdma_xmit() - ksmbd: validate EaNameLength in smb2_get_ea() - ksmbd: validate inherited ACE SID length - ksmbd: validate owner of durable handle on reconnect - ksmbd: validate response sizes in ipc_validate_msg() - ktest: Avoid undef warning when WARNINGS_FILE is unset - ktest: Fix the month in the name of the failure directory - ktest: Honor empty per-test option overrides - ktest: Run POST_KTEST hooks on failure and cancellation - kunit: config: Enable KUNIT_DEBUGFS by default - kunit: config: KUNIT_DEBUGFS should depend on DEBUG_FS - kunit: tool: copy caller args in run_kernel to prevent mutation - KVM: arm64: Discard PC update state on vcpu reset - KVM: arm64: Fix initialisation order in __pkvm_init_finalise() - KVM: arm64: PMU: Preserve AArch32 counter low bits - KVM: arm64: Remove VPIPT I-cache handling - KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value - KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits - KVM: arm64: Wake-up from WFI when iqrchip is in userspace - KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying - KVM: nSVM: Add missing consistency check for EFER, CR0, CR4, and CS - KVM: nSVM: Add missing consistency check for nCR3 validity - KVM: nSVM: Always inject a #GP if mapping VMCB12 fails on nested VMRUN - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation - KVM: nSVM: Clear EVENTINJ fields in vmcb12 on nested #VMEXIT - KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID) - KVM: nSVM: Clear tracking of L1->L2 NMI and soft IRQ on nested #VMEXIT - KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode - KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state - KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding - KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 - KVM: nSVM: Sync NextRIP to cached vmcb12 after VMRUN of L2 - KVM: nSVM: Use vcpu->arch.cr2 when updating vmcb12 on nested #VMEXIT - KVM: nVMX: Fold requested virtual interrupt check into has_nested_events() - KVM: Reject wrapped offset in kvm_reset_dirty_gfn() - KVM: s390: pci: fix GAIT table indexing due to double-scaling pointer arithmetic - KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION - KVM: SVM: Add a helper to look up the max physical ID for AVIC - KVM: SVM: check validity of VMCB controls when returning from SMM - KVM: SVM: Explicitly mark vmcb01 dirty after modifying VMCB intercepts - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path - KVM: SVM: Flush the current TLB when transitioning from xAVIC => x2AVIC - KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with in-kernel APIC - KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated - KVM: VMX: Update SVI during runtime APICv activation - KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() - KVM: x86: check for nEPT/nNPT in slow flush hypercalls - KVM: x86: Defer non-architectural deliver of exception payload to userspace read - KVM: x86: Fix KVM_GET_MSRS stack info leak - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN - KVM: x86: Fix shadow paging use-after-free due to unexpected role - KVM: x86: Fix Xen hypercall tracepoint argument assignment - KVM: x86: hyper-v: Bound the bank index when querying sparse banks - KVM: x86: Ignore -EBUSY when checking nested events from vcpu_block() - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level - KVM: x86: Rename KVM_MSR_RET_INVALID to KVM_MSR_RET_UNSUPPORTED - KVM: x86: Return "unsupported" instead of "invalid" on access to unsupported PV MSR - KVM: x86: Use __DECLARE_FLEX_ARRAY() for UAPI structures with VLAs - KVM: x86: Use scratch field in MMIO fragment to hold small write values - KVM: x86: WARN if a vCPU gets a valid wakeup that KVM can't yet inject - l2tp: do not use sock_hold() in pppol2tp_session_get_sock() - l2tp: Drop large packets with UDP encap - landlock: Fix handling of disconnected directories - leds: lgm-sso: Remove duplicate assignments for priv->mmap - leds: qcom-lpg: Check for array overflow when selecting the high resolution - leds: qcom-lpg: Check the return value of regmap_bulk_write() - lib/bootconfig: check bounds before writing in __xbc_open_brace() - lib/bootconfig: check xbc_init_node() return in override path - lib/bootconfig: fix off-by-one in xbc_verify_tree() unclosed brace error - lib/bootconfig: fix snprintf truncation check in xbc_node_compose_key_after() - libbpf: Fix OOB read in btf_dump_get_bitfield_value - libbpf: Fix -Wdiscarded-qualifiers under C23 - libceph: admit message frames only in CEPH_CON_S_OPEN state - libceph: define and enforce CEPH_MAX_KEY_LEN - libceph: Fix potential null-ptr-deref in decode_choose_args() - libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() - libceph: Fix potential out-of-bounds access in crush_decode() - libceph: Fix potential out-of-bounds access in osdmap_decode() - libceph: Fix slab-out-of-bounds access in auth message processing - libceph: handle rbtree insertion error in decode_choose_args() - libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() - libceph: prevent potential out-of-bounds reads in process_message_header() - libceph: reject preamble if control segment is empty - libceph: Use u32 for non-negative values in ceph_monmap_decode() - lib/crypto: chacha: Zeroize permuted_state before it leaves scope - lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() - lib/hexdump: print_hex_dump_bytes() calls print_hex_dump_debug() - libperf build: Always place libperf includes first - libperf: Don't remove -g when EXTRA_CFLAGS are used - lib/scatterlist: fix length calculations in extract_kvec_to_sg - lib/scatterlist: fix temp buffer in extract_user_to_sg() - libsubcmd: Fix null intersection case in exclude_cmds() - lib: test_hmm: evict device pages on file close to avoid use-after-free - lib/ts_kmp: fix integer overflow in pattern length calculation - locking: Fix rwlock support in - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued - LoongArch: Add spectre boundry for syscall dispatch table - LoongArch: Add WriteCombine shadow mapping in KASAN - LoongArch: Add writecombine support for DMW-based ioremap() - LoongArch: Disable instrumentation for setup_ptwalker() - LoongArch: Fix potential ADE in loongson_gpu_fixup_dma_hang() - LoongArch: Give more information if kmem access failed - LoongArch: Guard percpu handler under !CONFIG_PREEMPT_RT - LoongArch: kprobes: Fix handling of fatal unrecoverable recursions - LoongArch: Make cpumask_of_node() robust against NUMA_NO_NODE - LoongArch: Prefer top-down allocation after arch_mem_init() - LoongArch: Remove unused code to avoid build warning - LoongArch: Rework KASAN initialization for PTW-enabled systems - LoongArch: Show CPU vulnerabilites correctly - LoongArch: Use per-root-bridge PCIH flag to skip mem resource fixup - LoongArch: vDSO: Emit GNU_EH_FRAME correctly - LoongArch: Workaround LS2K/LS7A GPU DMA hang bug - loop: fix partition scan race between udev and loop_reread_partitions() - lsm: add backing_file LSM hooks - m68k: nommu: fix memmove() with differently aligned src and dest for 68000 - mac802154: llsec: add skb_cow_data() before in-place crypto - macsec: fix replay protection at XPN lower-PN wrap - macvlan: annotate data-races around port->bc_queue_len_used - macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF - macvlan: observe an RCU grace period in macvlan_common_newlink() error path - mailbox: add sanity check for channel array - mailbox: Allow controller specific mapping using fwnode - mailbox: bcm-ferxrm-mailbox: Use default primary handler - mailbox: don't protect of_parse_phandle_with_args with con_mutex - mailbox: imx: Skip the suspend flag for i.MX7ULP - mailbox: mailbox-test: don't free the reused channel - mailbox: mailbox-test: free channels on probe error - mailbox: mailbox-test: initialize struct earlier - mailbox: mailbox-test: make data_ready a per-instance variable - mailbox: pcc: Remove spurious IRQF_ONESHOT usage - mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() - mailbox: remove unused header files - mailbox: sort headers alphabetically - mailbox: sprd: clear delivery flag before handling TX done - mailbox: sprd: mask interrupts that are not handled - mailbox: Use dev_err when there is error - mailbox: Use guard/scoped_guard for con_mutex - mailbox: Use of_property_match_string() instead of open-coding - mctp: i2c: fix skb memory leak in receive path - mctp i2c: initialise event handler read bytes - mctp: route: hold key->lock in mctp_flow_prepare_output() - md/bitmap: fix GPF in write_page caused by resize race - md-cluster: fix NULL pointer dereference in process_metadata_update - md/raid10: fix any_working flag handling in raid10_sync_request - md/raid10: fix deadlock with check operation and nowait requests - md/raid10: fix divide-by-zero in setup_geo() with zero far_copies - md/raid1: fix data lost for writemostly rdev - md/raid1,raid10: don't ignore IO flags - md/raid5: fix soft lockup in retry_aligned_read() - md/raid5: validate payload size before accessing journal metadata - media: adv7180: fix frame interval in progressive mode - media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START - media: amphion: Fix race between m2m job_abort and device_run - media: as102: fix to not free memory after the device is registered in as102_usb_probe() - media: ccs: Accommodate C-PHY into the calculation - media: ccs: Avoid possible division by zero - media: cx23885: Add missing unmap in snd_cx23885_hw_params() - media: cx25821: Add missing unmap in snd_cx25821_hw_params() - media: cx25821: Fix a resource leak in cx25821_dev_setup() - media: cx88: Add missing unmap in snd_cx88_hw_params() - media: dib8000: avoid division by 0 in dib8000_set_dds() - media: dvb-core: dmxdevfilter must always flush bufs - media: dvb-core: fix wrong reinitialization of ringbuffer on reopen - media: dvb-net: fix OOB access in ULE extension header tables - media: em28xx: fix use-after-free in em28xx_v4l2_open() - media: hackrf: fix to not free memory after the device is registered in hackrf_probe() - media: i2c: imx219: Check return value of devm_gpiod_get_optional() in imx219_probe() - media: i2c: imx412: Assert reset GPIO during probe - media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() calls - media: i2c: ov01a10: Fix analogue gain range - media: i2c: ov01a10: Fix digital gain range - media: i2c: ov01a10: Fix reported pixel-rate value - media: i2c: ov01a10: Fix test-pattern disabling - media: i2c: ov01a10: Fix the horizontal flip control - media: i2c: ov08d10: fix image vertical start setting - media: i2c: ov5647: Correct minimum VBLANK value - media: i2c: ov5647: Correct pixel array offset - media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode - media: i2c: ov5647: Initialize subdev before controls - media: i2c: ov5647: Sensor should report RAW color space - media: i2c: ov5647: use our own mutex for the ctrl lock - media: i2c: ov8856: free control handler on error in ov8856_init_controls() - media: i2c/tw9903: Fix potential memory leak in tw9903_probe() - media: i2c/tw9906: Fix potential memory leak in tw9906_probe() - media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex - media: mediatek: encoder: Fix uninitialized scalar variable issue - media: mediatek: vcodec: Don't try to decode 422/444 VP9 - media: mediatek: vcodec: fix use-after-free in encoder release path - media: mtk-jpeg: fix use-after-free in release path due to uncancelled work - media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove() - media: mtk-mdp: Fix error handling in probe function - media: nxp: imx8-isi: Reduce minimum queued buffers from 2 to 0 - media: omap3isp: drop the use count of v4l2 pipeline - media: omap3isp: isppreview: always clamp in preview_try_format() - media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes - media: omap3isp: set initial format - media: pci: zoran: fix potential memory leak in zoran_probe() - media: pvrusb2: fix URB leak in pvr2_send_request_ex - media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() - media: radio-keene: fix memory leak in error path - media: rc: fix race between unregister and urb/irq callbacks - media: rc: igorplugusb: fix control request setup packet - media: rc: igorplugusb: heed coherency rules - media: rc: streamzap: Error handling in probe - media: rc: ttusbir: fix inverted error logic - media: rc: ttusbir: respect DMA coherency rules - media: rc: xbox_remote: heed DMA restrictions - media: rkisp1: Fix filter mode register configuration - media: rkvdec: reduce stack usage in rkvdec_init_v4l2_vp9_count_tbl() - media: saa7164: add ioremap return checks and cleanups - media: solo6x10: Check for out of bounds chip_id - media: staging: imx: request mbus_config in csi_start - media: tegra-video: Fix memory leak in __tegra_channel_try_format() - media: tegra-video: Use accessors for pad config 'try_*' fields - media: uvcvideo: Enable VB2_DMABUF for metadata stream - media: uvcvideo: Fix allocation for small frame sizes - media: v4l2-async: Fix error handling on steps after finding a match - media: venus: vdec: fix error state assignment for zero bytesused - media: venus: vdec: restrict EOS addr quirk to IRIS2 only - media: verisilicon: AV1: Fix enable cdef computation - media: verisilicon: AV1: Fix tile info buffer size - media: verisilicon: AV1: Fix tx mode bit setting - media: verisilicon: AV1: Set IDR flag for intra_only frame type - media: videobuf2: Set vma_flags in vb2_dma_sg_mmap - media: vidtv: fix nfeeds state corruption on start_streaming failure - media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections - media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si - media: vidtv: fix pass-by-value structs causing MSAN warnings - memfd: deny writeable mappings when implying SEAL_WRITE - memory: mtk-smi: Convert to platform remove callback returning void - memory: mtk-smi: fix device leak on larb probe - memory: mtk-smi: fix device leaks on common probe - memory: tegra124-emc: Fix dll_change check - memory: tegra30-emc: Fix dll_change check - mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure - mfd: core: Add locking around 'mfd_of_node_list' - mfd: mc13xxx-core: Fix memory leak in mc13xxx_add_subdevice_pdata() - mfd: omap-usb-host: Convert to platform remove callback returning void - mfd: omap-usb-host: Fix OF populate on driver rebind - mfd: qcom-pm8xxx: Convert to platform remove callback returning void - mfd: qcom-pm8xxx: Fix OF populate on driver rebind - mfd: simple-mfd-i2c: Add compatible strings for Layerscape QIXIS FPGA - mfd: simple-mfd-i2c: Add Delta TN48M CPLD support - mfd: simple-mfd-i2c: Add MAX77705 support - mfd: simple-mfd-i2c: Add SpacemiT P1 support - mfd: simple-mfd-i2c: Keep compatible strings in alphabetical order - mfd: stpmic1: Attempt system shutdown twice in case PMIC is confused - mfd: wm8350-core: Use IRQF_ONESHOT - minix: Add required sanity checking to minix_check_superblock() - MIPS: Always record SEGBITS in cpu_data.vmbits - MIPS: DEC: Prevent initial console buffer from landing in XKPHYS - MIPS: Fix the GCC version check for `__multi3' workaround - MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE - mips: mm: Allocate tlb_vpn array atomically - MIPS: mm: Rewrite TLB uniquification for the hidden bit feature - MIPS: mm: Suppress TLB uniquification on EHINV hardware - mips: ralink: update CPU clock index - MIPS: rb532: Fix MMIO UART resource registration - MIPS: Work around LLVM bug when gp is used as global register variable - misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() - misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 - misc: fastrpc: fix DMA address corruption due to find_vma misuse - misc: fastrpc: Fix NULL pointer dereference in rpmsg callback - misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context - misc: fastrpc: fix use-after-free race in fastrpc_map_create - misc: fastrpc: possible double-free of cctx->remote_heap - misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt() - mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() - mmc: block: use single block write in retry - mmc: core: Avoid bitfield RMW for claim/retune flags - mmc: core: Fix host controller programming for fixed driver type - mmc: core: Optimize time for secure erase/trim for some Kingston eMMCs - mmc: litex_mmc: Set mandatory idle clocks before CMD0 - mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation - mmc: mmci: Fix device_node reference leak in of_get_dml_pipe_index() - mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC - mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms - mmc: sdhci: add signal voltage switch in sdhci_resume_host - mmc: sdhci: fix timing selection for 1-bit bus width - mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration - mmc: sdhci-pci-gli: fix GL9750 DMA write corruption - mmc: vub300: fix NULL-deref on disconnect - mm/damon/core: disallow time-quota setting zero esz - mm/damon/core: implement damon_kdamond_pid() - mm/damon/core: use time_in_range_open() for damos quota window start - mm/damon/lru_sort: detect and use fresh enabled and kdamond_pid values - mm/damon/ops-common: call folio_test_lru() after folio_get() - mm/damon/reclaim: detect and use fresh enabled and kdamond_pid values - mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0] - mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break() - mm/damon/sysfs-schemes: delete tried region in regions_rmdirs() - mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock - mm: filemap: fix nr_pages calculation overflow in filemap_map_pages() - mm/highmem: fix __kmap_to_page() build error - mm/huge_memory: fix folio isn't locked in softleaf_to_folio() - mm/huge_memory: update file PMD counter before folio_put() - mm/hugetlb: avoid false positive lockdep assertion - mm/hugetlb_cma: round up per_node before logging it - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather - mm/hugetlb: fix hugetlb_pmd_shared() - mm/hugetlb: fix two comments related to huge_pmd_unshare() - mm/hugetlb: rename folio_putback_active_hugetlb() to folio_putback_hugetlb() - mm/hugetlb: rename isolate_hugetlb() to folio_isolate_hugetlb() - mm/hugetlb: restore reservation on error in hugetlb folio copy paths - mm/kasan: fix double free for kasan pXds - mm/kfence: disable KFENCE upon KASAN HW tags enablement - mm/kfence: fix KASAN hardware tag faults during late enablement - mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison - mm/memory-failure: fix missing ->mf_stats count in hugetlb poison - mm/memory: fix spurious warning when unmapping device-private/exclusive pages - mm/mempolicy: fix wrong mmap_read_unlock() in migrate_to_node() - mm/migrate: don't call folio_putback_active_hugetlb() on dst hugetlb folio - mm/page_alloc: clear page->private in free_pages_prepare() - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations - mm/tracing: rss_stat: ensure curr is false from kthread context - modpost: Amend ppc64 save/restfpr symnames for -Os build - module: add helper function for reading module_buildid() - module: Fix freeing of charp module parameters when CONFIG_SYSFS=n - module: Fix kernel panic when a symbol st_shndx is out of bounds - mpls: add missing unregister_netdevice_notifier to mpls_init - mptcp: add-addr: always drop other suboptions - mptcp: allow subflow rcv wnd to shrink - mptcp: cleanup fallback dummy mapping generation - mptcp: close TOCTOU race while computing rcv_wnd - mptcp: do not drop partial packets - mptcp: drop __mptcp_fastopen_gen_msk_ackseq() - mptcp: fastclose msk when linger time is 0 - MPTCP: fix lock class name family in pm_nl_create_listen_socket - mptcp: fix missing wakeups in edge scenarios - mptcp: fix receive space timestamp initialization - mptcp: fix retransmission loop when csum is enabled - mptcp: fix rx timestamp corruption on fastopen - mptcp: fix scheduling with atomic in timestamp sockopt - mptcp: fix slab-use-after-free in __inet_lookup_established - mptcp: handle first subflow closing consistently - mptcp: introduce the mptcp_init_skb helper - mptcp: pm: ADD_ADDR rtx: allow ID 0 - mptcp: pm: ADD_ADDR rtx: always decrease sk refcount - mptcp: pm: ADD_ADDR rtx: fix potential data-race - mptcp: pm: ADD_ADDR rtx: free sk if last - mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker - mptcp: pm: avoid sending RM_ADDR over same subflow - mptcp: pm: fix ADD_ADDR timer infinite retry on option space insufficient - mptcp: pm: fix extra_subflows underflow on userspace PM subflow creation - mptcp: pm: in-kernel: always mark signal+subflow endp as used - mptcp: pm: in-kernel: always set ID as avail when rm endp - mptcp: pm: kernel: correctly retransmit ADD_ADDR ID 0 - mptcp: pm: prio: skip closed subflows - mptcp: reset rcv wnd on disconnect - mptcp: sockopt: check timestamping ret value - mptcp: sockopt: set timestamp flags on subflow socket, not msk - mptcp: sync the msk->sndbuf at accept() time - mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure - mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure - mptcp: use plain bool instead of custom binary enum - mtd: Avoid boot crash in RedBoot partition table parser - mtd: docg3: Convert to platform remove callback returning void - mtd: docg3: fix use-after-free in docg3_release() - mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse() - mtd: parsers: ofpart: call of_node_get() for dedicated subpartitions - mtd: parsers: ofpart: call of_node_put() only in ofpart_fail path - mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions() - mtd: physmap_of_gemini: Fix disabled pinctrl state check - mtd: rawnand: brcmnand: skip DMA during panic write - mtd: rawnand: cadence: Fix error check for dma_alloc_coherent() in cadence_nand_init() - mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper - mtd: rawnand: pl353: Fix software ECC support - mtd: rawnand: pl353: make sure optimal timings are applied - mtd: rawnand: serialize lock/unlock against other NAND operations - mtd: rawnand: sunxi: fix sunxi_nfc_hw_ecc_read_extra_oob - mtd: spinand: Fix kernel doc - mtd: spi-nor: core: avoid odd length/address reads on 8D-8D-8D mode - mtd: spi-nor: core: avoid odd length/address writes in 8D-8D-8D mode - mtd: spi-nor: core: correct the op.dummy.nbytes when check read operations - mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show() - mtd: spi-nor: sfdp: introduce smpt_map_id fixup hook - mtd: spi-nor: sfdp: introduce smpt_read_dummy fixup hook - mtd: spi-nor: sst: Factor out common write operation to `sst_nor_write_data()` - mtd: spi-nor: sst: Fix SST write failure - mtd: spi-nor: sst: Fix write enable before AAI sequence - mtd: spi-nor: swp: check SR_TB flag when getting tb_mask - mtd: spi-nor: update spi_nor_fixups::post_sfdp() documentation - myri10ge: avoid uninitialized variable use - neighbour: add RCU protection to neigh_tables[] - neigh: let neigh_xmit take skb ownership - net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr - net: add proper RCU protection to /proc/net/ptype - net: Add skb_dstref_steal and skb_dstref_restore - net: add support for segmenting TCP fraglist GSO packets - net: af_key: zero aligned sockaddr tail in PF_KEY exports - net: ag71xx: check error for platform_get_irq - net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit() - net: annotate data-races around sk->sk_{data_ready,write_space} - net: Annotate sk->sk_write_space() for UDP SOCKMAP. - net: arcnet: com20020-pci: fix support for 2.5Mbit cards - net: atlantic: preserve PCI wake-from-D3 on shutdown when WOL enabled - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() - net: bcmgenet: add bcmgenet_has_* helpers - net: bcmgenet: fix leaking free_bds - net: bcmgenet: fix off-by-one in bcmgenet_put_txcb - net: bcmgenet: fix racing timeout handler - net: bcmgenet: increase WoL poll timeout - net: bcmgenet: Initialize u64 stats seq counter - net: bcmgenet: keep RBUF EEE/PM disabled - net: bcmgenet: move DESC_INDEX flow to ring 0 - net: bcmgenet: Remove custom ndo_poll_controller() - net: bcmgenet: support reclaiming unsent Tx packets - net: bcmgenet: switch to use 64bit statistics - net: bonding: add broadcast_neighbor option for 802.3ad - net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled - net: bonding: fix NULL deref in bond_debug_rlb_hash_show - net: bonding: fix NULL pointer dereference in bond_do_ioctl() - net: bonding: fix use-after-free in bond_xmit_broadcast() - net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled - net: bridge: Flush multicast groups when snooping is disabled - net: bridge: mcast: always update mdb_n_entries for vlan contexts - net: bridge: use a stable FDB dst snapshot in RCU readers - net: caif: clear client service pointer on teardown - netconsole: avoid out-of-bounds access on empty string in trim_newline() - netconsole: propagate device name truncation in dev_name_store() - net: consume xmit errors of GSO frames - net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback - net: cpsw_new: Fix potential unregister of netdev that has not been registered yet - net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe() error path - netdevsim: zero initialize struct iphdr in dummy sk_buff - net: dsa: bcm_sf2: fix missing clk_disable_unprepare() in error paths - net: dsa: microchip: Fix error path in PTP IRQ setup - net: dsa: mt7530: fix FDB entries not aging out with short timeout - net: dsa: mt7530: preserve VLAN tags on trapped link-local frames - net: dsa: mt7530: rename mt753x_bpdu_port_fw enum to mt753x_to_cpu_fw - net: dsa: properly keep track of conduit reference - net: dsa: realtek: rtl8365mb: fix mode mask calculation - net: dsa: realtek: rtl8365mb: fix rtl8365mb_phy_ocp_write return value - net: dsa: realtek: rtl8365mb: remove ifOutDiscards from rx_packets - net: enetc: fix the output issue of 'ethtool --show-ring' - net: ethernet: arc: emac: quiesce interrupts before requesting IRQ - net: ethernet: cortina: Carry over frag counter - net: ethernet: cortina: Drop half-assembled SKB - net: ethernet: cortina: Make RX SKB per-port - net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS reference - net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle - net: ethernet: marvell: skge: remove incorrect conflicting PCI ID - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown - net: ethernet: mtk_eth_soc: initialize PPE per-tag-layer MTU registers - net: ethernet: mtk_eth_soc: Reset prog ptr to old_prog in case of error in mtk_xdp_setup() - net: ethernet: ti: am65-cpsw-nuss/cpsw-ale: Fix multicast entry handling in ALE table - net: ethernet: xscale: Check for PTP support properly - net: fec: fix pinctrl default state restore order on resume - net: fec: fix the PTP periodic output sysfs interface - netfilter: arp_tables: fix IEEE1394 ARP payload parsing - netfilter: bitwise: add support for doing AND, OR and XOR directly - netfilter: bitwise: rename some boolean operation functions - netfilter: bpf: defer hook memory release until rcu readers are done - netfilter: bridge: make ebt_snat ARP rewrite writable - netfilter: conntrack: add missing netlink policy validations - netfilter: conntrack_irc: fix possible out-of-bounds read - netfilter: conntrack: remove sprintf usage - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check - netfilter: ctnetlink: ensure safe access to master conntrack - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() - netfilter: ctnetlink: ignore explicit helper on new expectations - netfilter: ctnetlink: remove refcounting in expectation dumpers - netfilter: ctnetlink: use netlink policy range checks - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent - netfilter: ebtables: fix OOB read in compat_mtw_from_user - netfilter: flowtable: strictly check for maximum number of actions - netfilter: ip6t_eui64: reject invalid MAC header for all packets - netfilter: ip6t_hbh: reject oversized option lists - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() - netfilter: ipset: drop logically empty buckets in mtype_del - netfilter: ipset: stop hash:* range iteration at end - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr - netfilter: nf_conncount: fix tracking of connections from localhost - netfilter: nf_conncount: increase the connection clean up limit to 64 - netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH - netfilter: nf_conntrack: Add allow_clash to generic protocol handler - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister - netfilter: nf_conntrack_expect: honor expectation helper field - netfilter: nf_conntrack_expect: skip expectations in other netns via proc - netfilter: nf_conntrack_expect: store netns and zone in expectation - netfilter: nf_conntrack_expect: use expect->helper - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() - netfilter: nf_conntrack_h323: don't pass uninitialised l3num value - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case - netfilter: nf_conntrack_helper: pass helper to expect cleanup - netfilter: nf_conntrack_sip: don't use simple_strtoul - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() - netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp - netfilter: nf_conntrack_sip: get helper before allocating expectation - netfilter: nf_log: validate MAC header was set before dumping it - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() - netfilter: nfnetlink_log: account for netlink header size - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path - netfilter: nf_queue: hold bridge skb->dev while queued - netfilter: nf_tables: always walk all pending catchall elements - netfilter: nf_tables: fix dst corruption in same register operation - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() - netfilter: nf_tables: reject immediate NF_QUEUE verdict - netfilter: nf_tables: release flowtable after rcu grace period on error - netfilter: nf_tables: reset table validation state on abort - netfilter: nf_tables: unconditionally bump set->nelems before insertion - netfilter: nft_compat: add more restrictions on netlink attributes - netfilter: nft_counter: fix reset of counters on 32bit archs - netfilter: nft_ct: add seqadj extension for natted connections - netfilter: nft_ct: bail out on template ct in get eval - netfilter: nft_ct: drop pending enqueued packets on removal - netfilter: nft_ct: fix missing expect put in obj eval - netfilter: nft_ct: fix use-after-free in timeout object destroy - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag - netfilter: nft_fib: fix stale stack leak via the OIFNAME register - netfilter: nft_fwd_netdev: check ttl/hl before forwarding - netfilter: nft_inner: Fix IPv6 inner_thoff desync - netfilter: nft_osf: restrict it to ipv4 - netfilter: nft_set_hash: fix get operation on big endian - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry - netfilter: nft_set_pipapo: do not rely on ZERO_SIZE_PTR - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase - netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets - netfilter: nft_tunnel: fix use-after-free on object destroy - netfilter: reject zero shift in nft_bitwise - netfilter: require Ethernet MAC header before using eth_hdr() - netfilter: skip recording stale or retransmitted INIT - netfilter: synproxy: add mutex to guard hook reference counting - netfilter: synproxy: refresh tcphdr after skb_ensure_writable - netfilter: x_tables: avoid leaking percpu counter pointers - netfilter: x_tables: ensure names are nul-terminated - netfilter: x_tables: guard option walkers against 1-byte tail reads - netfilter: xtables: restrict several matches to inet family - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP - netfilter: x_tables: unregister the templates first - netfilter: xt_cpu: prefer raw_smp_processor_id - netfilter: xt_CT: drop pending enqueued packets on template removal - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels - netfilter: xt_multiport: validate range encoding in checkentry - netfilter: xt_NFQUEUE: prefer raw_smp_processor_id - netfilter: xt_policy: fix strict mode inbound policy matching - netfilter: xt_socket: enable defrag after all other checks - netfilter: xt_tcpmss: check remaining length before reading optlen - netfilter: xt_time: use unsigned int for monthday bit shift - net: fix fanout UAF in packet_release() via NETDEV_UP race - net: Fix icmp host relookup triggering ip_rt_bug - net: fix segmentation of forwarding fraglist GRO - netfs: fix error handling in netfs_extract_user_iter() - netfs: Fix overrun check in netfs_extract_user_iter() - netfs: Fix potential uninitialised var in netfs_extract_user_iter() - net: ftgmac100: fix ring allocation unwind on open failure - net: garp: fix unsigned integer underflow in garp_pdu_parse_attr - net: gro: don't merge zcopy skbs - net: gso: fix tcp fraglist segmentation after pull from frag_list - net: guard timestamp cmsgs to real error queue skbs - net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf - net: hns3: extend HCLGE_FD_AD_QID to 11 bits - net: hns3: fix double free issue for tx spare buffer - net: hsr: defer node table free until after RCU readers - net: hsr: fix potential OOB access in supervision frame handling - net: hsr: fix VLAN add unwind on slave errors - net: ifb: report ethtool stats over num_tx_queues - net: intel: fix PCI device ID conflict between i40e and ipw2200 - net: ipa: Fix decoding EV_PER_EE for IPA v5.0+ - net: ipa: fix event ring index not programmed for IPA v5.0+ - net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+ - net: ipa: Fix programming of QTIME_TIMESTAMP_CFG - net: ipv4: stop checking crypto_ahash_alignmask - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels - net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop - net: ipv6: flowlabel: defer exclusive option free until RCU teardown - net/ipv6: ioam6: prevent schema length wraparound in trace fill - net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak - net: ipv6: stop checking crypto_ahash_alignmask - net/iucv: fix locking in .getsockopt - net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() - net: ks8851: Avoid excess softirq scheduling - net: ks8851: Reinstate disabling of BHs around IRQ handler - netlabel: validate unlabeled address and mask attribute lengths - net: lan743x: permit VLAN-tagged packets up to configured MTU - net: lan966x: avoid unregistering netdev on register failure - net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool() - net: lapbether: handle NETDEV_PRE_TYPE_CHANGE - net: libwx: fix VF illegal register access - net: macb: fix clk handling on PCI glue driver removal - net: macb: Fix tx/rx malfunction after phy link down and up - net: macb: fix uninitialized rx_fs_lock - net: macb: fix use-after-free access to PTP clock - net: macb: Introduce gem_init_rx_ring() - net: macb: Move devm_{free,request}_irq() out of spin lock area - net: macb: properly unregister fixed rate clocks - net: macb: queue tie-off or disable during WOL suspend - net: macb: Reinitialize tx/rx queue pointer registers and rx ring during resume - net: macb: Shuffle the tx ring before enabling tx - net: macb: Use dev_consume_skb_any() to free TX SKBs - net: macb: use the current queue number for stats - net: mana: Add NULL guards in teardown path to prevent panic on attach failure - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer - net: mana: fix use-after-free in add_adev() error path - net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown - net: mana: Ring doorbell at 4 CQ wraparounds - net: mana: validate rx_req_idx to prevent out-of-bounds array access - net: mctp: ensure our nlmsg responses are initialised - net: mctp: fix don't require received header reserved bits to be zero - net: mctp i2c: check length before marking flow active - net: mctp-i2c: fix duplicate reception of old data - net/mlx4: avoid GCC 10 __bad_copy_from() false positive - net/mlx5: Avoid "No data available" when FW version queries fail - net/mlx5: Do not restore destination-less TC rules - net/mlx5: DR, Fix circular locking dependency in dump - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery - net/mlx5e: Fix features not applied during netdev registration - net/mlx5e: Fix race condition during IPSec ESN update - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() - net/mlx5e: Prevent concurrent access to IPSec ASO context - net/mlx5: Fix deadlock between devlink lock and esw->wq - net/mlx5: Fix missing devlink lock in SRIOV enable error path - net/mlx5: Fix multiport device check over light SFs - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list - net/mlx5: IFC updates for disabled host PF - net/mlx5: lag: Check for LAG device before creating debugfs - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle - net/mlx5: Query to see if host PF is disabled - net/mlx5: Reorder completion before putting command entry in cmd_work_handler - net/mlx5: Update the list of the PCI supported devices - net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj() - net: mscc: ocelot: extract ocelot_xmit_timestamp() helper - net: mscc: ocelot: split xmit into FDMA and register injection paths - net: mv643xx: fix OF node refcount - net: mvpp2: Add metadata support for xdp mode - net: mvpp2: build skb from XDP-adjusted data on XDP_PASS - net: mvpp2: guard flow control update with global_tx_fc in buffer switching - net: mvpp2: limit XDP frame size to the RX buffer - net: mvpp2: refill RX buffers before XDP or skb use - net: mvpp2: sync RX data at the hardware packet offset - net: ncsi: fix skb leak in error paths - net: netconsole: move newline trimming to function - net: netlink: don't set nsid on local notifications - net: netlink: fix sending unassigned nsid after assigned one - net: nfc: nci: Fix parameter validation for packet data - net: nfc: nci: Fix zero-length proprietary notifications - netns-ipv4: reorganize netns_ipv4 fast path variables - net: openvswitch: Avoid releasing netdev before teardown completes - net: openvswitch: fix possible kfree_skb of ERR_PTR - net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() - net: phonet: free phonet_device after RCU grace period - net: phy: add Rust Asix PHY driver - net: phy: aquantia: move to separate directory - net: phy: c45: add genphy_c45_pma_read_ext_abilities() function - net: phy: clean the sfp upstream if phy probing fails - net: phy: dp83869: fix setting CLK_O_SEL field. - net: phy: DP83TC811: add reading of abilities - net: phy: move at803x PHY driver to dedicated directory - net: phy: qcom: at803x: Use the correct bit to disable extended next page - net: phy: register phy led_triggers during probe to avoid AB-BA deadlock - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove - net: qrtr: ns: Fix use-after-free in driver remove() - net: qrtr: ns: Free the node during ctrl_cmd_bye() - net: qrtr: ns: Limit the maximum number of lookups - net: qrtr: ns: Limit the maximum server registration per node - net: qrtr: ns: Limit the total number of nodes - net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak - net: qualcomm: qca_uart: report the consumed byte on RX skb allocation failure - net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() - net: rds: clear i_sends on setup unwind - net/rds: Clear reconnect pending bit - net/rds: Fix circular locking dependency in rds_tcp_tune - net: rds: fix MR cleanup on copy error - net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion - net/rds: handle zerocopy send cleanup before the message is queued - net/rds: No shortcut out of RDS_CONN_ERROR - net/rds: Optimize rds_ib_laddr_check - net/rds: rds_sendmsg should not discard payload_len - net/rds: reset op_nents when zerocopy page pin fails - net/rds: Restrict use of RDS/IB to the initial network namespace - net/rds: zero per-item info buffer before handing it to visitors - net: remove WARN_ON_ONCE when accessing forward path array - net: rfkill: prevent unlimited numbers of rfkill events from being created - net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect - net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo - net/sched: act_api: use RCU with deferred freeing for action lifecycle - net: sched: act_csum: validate nested VLAN headers - net/sched: act_ct: Only release RCU read lock after ct_ft - net/sched: act_gate: snapshot parameters with RCU on replace - net/sched: act_ife: Fix metalist update behavior - net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() - net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs - net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak - net/sched: cls_flower: revert unintended changes - net/sched: cls_flow: fix NULL pointer dereference on shared blocks - net/sched: cls_fw: fix NULL dereference of "old" filters before change() - net/sched: cls_fw: fix NULL pointer dereference on shared blocks - net/sched: ets: fix divide by zero in the offload path - net/sched: fix pedit partial COW leading to page cache corruption - net: sched: fix TCF_LAYER_TRANSPORT handling in tcf_get_base_ptr() - net/sched: netem: check for negative latency and jitter - net/sched: netem: fix probability gaps in 4-state loss model - net/sched: netem: fix queue limit check to include reordered packets - net/sched: netem: fix slot delay calculation overflow - net/sched: netem: only reseed PRNG when seed is explicitly provided - net/sched: netem: validate slot configuration - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks - net/sched: sch_cake: annotate data-races in cake_dump_stats() (V) - net/sched: sch_cake: fix NAT destination port not being updated in cake_update_flowkeys - net/sched: sch_choke: annotate data-races in choke_dump_stats() - net/sched: sch_fq_codel: remove data-races from fq_codel_dump_stats() - net/sched: sch_fq_pie: annotate data-races in fq_pie_dump_stats() - net/sched: sch_hfsc: fix divide-by-zero in rtsc_min() - net_sched: sch_hhf: annotate data-races in hhf_dump_stats() - net/sched: sch_netem: fix out-of-bounds access in packet corruption - net/sched: sch_pie: annotate data-races in pie_dump_stats() - net/sched: sch_pie: annotate more data-races in pie_dump_stats() - net/sched: sch_red: annotate data-races in red_dump_stats() - net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net/sched: sch_sfb: annotate data-races in sfb_dump_stats() - net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net/sched: taprio: fix NULL pointer dereference in class dump - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch - net/sched: teql: Fix double-free in teql_master_xmit - net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit - net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick - net: sfp: Fix Ubiquiti U-Fiber Instant SFP module on mvneta - net: sfp: improve Huawei MA5671a fixup - net: sfp: improve Nokia GPON sfp fixup - net: sfp: re-implement ignoring the hardware TX_FAULT signal - net: skb: fix cross-cache free of KFENCE-allocated skb head - net: skbuff: fix missing zerocopy reference in pskb_carve helpers - net: skbuff: fix pskb_carve leaking zcopy pages - net: skbuff: preserve shared-frag marker during coalescing - net: skbuff: propagate shared-frag marker through frag-transfer helpers - net: skmsg: preserve sg.copy across SG transforms - net/smc: avoid early lgr access in smc_clc_wait_msg - net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint - net/smc: Do not re-initialize smc hashtables - net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() - net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot - net: sparx5/lan969x: fix DWRR cost max to match hardware register width - net: sparx5/lan969x: fix PTP clock max_adj value - net: stmmac: avoid shadowing global buf_sz - net: stmmac: dwmac-loongson: Set clk_csr_i to 100-150MHz - net: stmmac: Fix error handling in VLAN add and delete paths - net: stmmac: fix integer underflow in chain mode - net: stmmac: Fix PTP ref clock for Tegra234 - net: stmmac: Prevent NULL deref when RX memory exhausted - net: stmmac: remove support for lpi_intr_o - net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY() - net: strparser: fix skb_head leak in strp_abort_strp() - net: sunhme: Fix sbus regression - net: Switch to skb_dstref_steal/skb_dstref_restore for ip_route_input callers - net: tcp: accept old ack during closing - net/tcp-md5: Fix MAC comparison to be constant-time - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring - net: tls: fix strparser anchor skb leak on offload RX setup failure - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption - net: tls: prevent chain-after-chain in plain text SG - net: tunnel: make skb_vlan_inet_prepare() return drop reasons - net: txgbe: fix firmware version check - net: txgbe: fix RTNL assertion warning when remove module - net: txgbe: leave space for null terminators on property_entry - net: usb: aqc111: Do not perform PM inside suspend callback - net: usb: catc: enable basic endpoint checking - net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check - net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check - net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete() - net: usb: kalmia: validate USB endpoints - net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode - net: usb: kaweth: validate USB endpoints - net: usb: lan78xx: fix silent drop of packets with checksum errors - net: usb: lan78xx: fix TX byte statistics for small packets - net: usb: lan78xx: scan all MDIO addresses on LAN7801 - net: usb: lan78xx: skip LTM configuration for LAN7850 - net: usb: pegasus: enable basic endpoint checking - net: usb: pegasus: validate USB endpoints - net: usb: r8152: add TRENDnet TUC-ET2G - net: usb: r8152: fix transmit queue timeout - net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit() - net: usb: rtl8150: free skb on usb_submit_urb() failure in xmit - net: usb: sr9700: remove code to drive nonexistent multicast filter - net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled - net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets - net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean() - net: wwan: iosm: fix potential memory leaks in ipc_imem_init() - net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler - net/x25: Fix overflow when accumulating packets - net/x25: Fix potential double free of skb - net: xilinx: axienet: Correct BD length masks to match AXIDMA IP spec - nexthop: fix IPv6 route referencing IPv4 nexthop - NFC: digital: Bounds check NFC-A cascade depth in SDD response handler - nfc: hci: fix out-of-bounds read in HCP header parsing - nfc: hci: shdlc: Stop timers and work before freeing context - nfc: llcp: add missing return after LLCP_CLOSED checks - nfc: llcp: Fix use-after-free in llcp_sock_release() - nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() - nfc: nci: clear NCI_DATA_EXCHANGE before calling completion callback - nfc: nci: complete pending data exchange on device close - nfc: nci: fix circular locking dependency in nci_close_device - nfc: nci: free skb on nci_transceive early error paths - NFC: nxp-nci: allow GPIOs to sleep - nfc: nxp-nci: i2c: use rising-edge IRQ on ACPI systems - nfc: nxp-nci: remove interrupt trigger type - nfc: pn533: allocate rx skb before consuming bytes - NFC: pn533: bound the UART receive buffer - nfc: pn533: properly drop the usb interface reference on disconnect - nfc: rawsock: cancel tx_work before socket teardown - nfc: s3fwrn5: allocate rx skb before consuming bytes - NFC: trf7970a: Ignore antenna noise when checking for RF field - nfnetlink_osf: validate individual option lengths in fingerprints - nfp: fix swapped arguments in nfp_encode_basic_qdr() calls - nfs/blocklayout: Fix compilation error (`make W=1`) in bl_write_pagelist() - nfsd: check get_user() return when reading princhashlen - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache - nfsd: fix posix_acl leak on SETACL decode failure - nfsd: fix return error code for nfsd_map_name_to_[ug]id - NFSD: Fix SECINFO_NO_NAME decode error cleanup - NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd - nfsd: never defer requests during idmap lookup - NFS: Fix a deadlock involving nfs_release_folio() - nfs: pass explicit offset/count to trace events - NFS: Prevent resource leak in nfs_alloc_server() - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr - nf_tables: nft_dynset: fix possible stateful expression memleak in error path - nilfs2: fix NULL i_assoc_inode dereference in nilfs_mdt_save_to_shadow_map - nilfs2: reject zero bd_oblocknr in nilfs_ioctl_mark_blocks_dirty() - nouveau/dpcd: return EBUSY for aux xfer if the device is asleep - NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR - ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access - ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut - NTB: ntb_transport: Fix too small buffer for debugfs_name - ntfs3: add buffer boundary checks to run_unpack() - ntfs3: fix integer overflow in run_unpack() volume boundary check - ntfs3: reject direct userspace writes to reserved $LX* xattrs - ntfs: ->d_compare() must not block - nvdimm/bus: Fix potential use after free in asynchronous initialization - nvdimm: virtio_pmem: serialize flush requests - nvme-apple: drop invalid put of admin queue reference count - nvme-fabrics: use kfree_sensitive() for DHCHAP secrets - nvme: fix admin queue leak on controller reset - nvme: fix memory allocation in nvme_pr_read_keys() - nvmem: Drop OF node reference on nvmem_add_one_cell() failure - nvmem: imx: assign nvmem_cell_info::raw_len - nvmem: layouts: onie-tlv: fix hang on unknown types - nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston OM3SGP4 - nvme-pci: cap queue creation to used queues - nvme-pci: ensure we're polling a polled queue - nvme-pci: fix missed admin queue sq doorbell write - nvme-pci: Fix race bug in nvme_poll_irqdisable() - nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set - nvme: reject invalid pr_read_keys() num_keys values - nvme: respect NVME_QUIRK_DISABLE_WRITE_ZEROES when wzsl is set - nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free - nvmet-tcp: fix race between ICReq handling and queue teardown - nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers - objtool: Fix Clang jump table detection - objtool: Handle Clang RSP musical chairs - objtool: Remove max symbol name length limitation - ocfs2: add inline inode consistency check to ocfs2_validate_inode_block() - ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison - ocfs2/dlm: validate qr_numregions in dlm_match_regions() - ocfs2: fix listxattr handling when the buffer is full - ocfs2: fix out-of-bounds write in ocfs2_write_end_inline - ocfs2: fix possible deadlock between unlink and dio_end_io_write - ocfs2: fix reflink preserve cleanup issue - ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY - ocfs2: handle invalid dinode in ocfs2_group_extend - ocfs2: reject oversized group bitmap descriptors - ocfs2: split transactions in dio completion to avoid credit exhaustion - ocfs2: validate bg_bits during freefrag scan - ocfs2: validate group add input before caching - ocfs2: validate inline data i_size during inode read - octeon_ep: avoid compiler and IQ/OQ reordering - octeon_ep: disable per ring interrupts - octeon_ep: ensure dbell BADDR updation - octeon_ep: Relocate counter updates before NAPI - octeon_ep: restructured interrupt handlers - octeon_ep: set backpressure watermark for RX queues - octeon_ep: support Octeon CN10K devices - octeon_ep: support to fetch firmware info - octeontx2-af: CGX: add bounds check to cgx_speed_mbps index - octeontx2-af: CGX: fix bitmap leaks - octeontx2-af: devlink: fix NIX RAS reporter recovery condition - octeontx2-af: devlink: fix NIX RAS reporter to use RAS interrupt status - octeontx2-af: devlink health: use retained error fmsg API - octeontx2-af: Fix default entries mcam entry action - octeontx2-af: fix memory leak in rvu_setup_hw_resources() - octeontx2-af: Fix PF driver crash with kexec kernel booting - octeontx2-af: npc: Fix CPT channel mask in npc_install_flow - octeontx2-af: replace deprecated strncpy with strscpy - octeontx2-af: Workaround SQM/PSE stalls by disabling sticky - octeontx2-pf: avoid double free of pool->stack on AQ init failure - octeontx2-pf: Unregister devlink on probe failure - of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() - of: unittest: fix possible null-pointer dereferences in of_unittest_property_copy() - of: unittest: fix use-after-free in testdrv_probe() - openrisc: define arch-specific version of nop() - openvswitch: cap upcall PID array size and pre-size vport replies - openvswitch: defer tunnel netdev_put to RCU release - openvswitch: validate MPLS set/set_masked payload length - openvswitch: vport: fix self-deadlock on release of tunnel ports - ovl: Fix uninit-value in ovl_fill_real - padata: Fix pd UAF once and for all - padata: Put CPU offline callback in ONLINE section to allow failure - padata: Remove comment for reorder_work - padata: Remove cpu online check from cpu add and removal - params: Replace __modinit with __init_or_module - parisc: Check kernel mapping earlier at bootup - parisc: Fix initial page table creation for boot - parisc: Fix IRQ leak in LASI driver - parisc: Flush correct cache in cacheflush() syscall - parisc: Increase initial mapping to 64 MB with KALLSYMS - parisc: kernel: replace kfree() with put_device() in create_tree_node() - parisc: _llseek syscall is only available for 32-bit userspace - parisc: Prevent interrupts during reboot - parport: Fix race between port and client registration - Partial revert "x86/xen: fix balloon target initialization for PVH dom0" - PCI/ACPI: Restrict program_hpx_type2() to AER bits - PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404] - PCI: Add ACS quirk for Qualcomm Hamoa & Glymur - PCI: Add defines for bridge window indexing - PCI: Add PCIE_MSG_CODE_ASSERT_INTx message macros - PCI/AER: Clear only error bits in PCIe Device Status - PCI/AER: Stop ruling out unbound devices as error source - PCI: Correct PCI_CAP_EXP_ENDPOINT_SIZEOF_V2 value - PCI: Do not attempt to set ExtTag for VFs - PCI: dwc: Apply ECRC workaround to DesignWare 5.00a as well - PCI: dw-rockchip: Disable BAR 0 and BAR 1 for Root Port - PCI: Enable ACS after configuring IOMMU for OF platforms - PCI: Enable AtomicOps only if Root Port supports them - PCI: endpoint: Avoid creating sub-groups asynchronously - PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions - PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown - PCI: endpoint: pci-epf-vntb: Remove duplicate resource teardown - PCI: endpoint: pci-epf-vntb: Stop cmd_handler work in epf_ntb_epc_cleanup - PCI: endpoint: Remove unused field in struct pci_epf_group - PCI: epf-mhi: Return 0, not remaining timeout, when eDMA ops complete - PCI: Fix pci_slot_lock () device locking - PCI: Fix pci_slot_trylock() error handling - PCI: hv: Set default NUMA node to 0 for devices without affinity info - PCI: Initialize RCB from pci_configure_device() - PCI/IOV: Fix race between SR-IOV enable/disable and hotplug - PCI: Log bridge info when first enumerating bridge - PCI: Log bridge windows conditionally - PCI: Mark 3ware-9650SA Root Port Extended Tags as broken - PCI: Mark ASM1164 SATA controller to avoid bus reset - PCI: Mark Nvidia GB10 to avoid bus reset - PCI: mediatek: Fix IRQ domain leak when MSI allocation fails - PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found - PCI: Move pci_read_bridge_windows() below individual window accessors - PCI/MSI: Unmap MSI-X region on error - PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails - PCI/PM: Avoid redundant delays on D3hot->D3cold - PCI/portdrv: Fix potential resource leak - PCI: Supply bridge device, not secondary bus, to read window details - PCI: tegra194: Allow system suspend when the Endpoint link is not up - PCI: tegra194: Disable direct speed change for Endpoint mode - PCI: tegra194: Disable LTSSM after transition to Detect on surprise link down - PCI: tegra194: Disable PERST# IRQ only in Endpoint mode - PCI: tegra194: Don't force the device into the D0 state before L2 - PCI: tegra194: Fix polling delay for L2 state - PCI: tegra194: Increase LTSSM poll time on surprise link down - PCI: tegra194: Rename 'root_bus' to 'root_port_bus' in tegra_pcie_downstream_dev_to_D0() - PCI: tegra194: Use devm_gpiod_get_optional() to parse "nvidia,refclk-select" - PCI: tegra194: Use DWC IP core version - PCI: Update BAR # and window messages - PCI: Use resource names in PCI log messages - PCI: Use resource_set_range() that correctly sets ->end - PCMCIA: Fix garbled log messages for KERN_CONT - pcnet32: stop holding device spin lock during napi_complete_done - pds_core: add an error code check in pdsc_dl_info_get - pds_core: ensure null-termination for firmware version strings - pds_core: fix debugfs_lookup dentry leak and error handling - pds_core: fix error handling in pdsc_devcmd_wait - perf/arm-cmn: Reject unsupported hardware configurations - perf/arm-cmn: Support CMN-600AE - perf: arm_spe: Properly set hw.state on failures - perf branch: Avoid incrementing NULL - perf callchain: Fix srcline printing with inlines - perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD - perf expr: Return -EINVAL for syntax error in expr__find_ids() - perf: Extract a few helpers - perf: Fix dangling cgroup pointer in cpuctx - perf: Fix __perf_event_overflow() vs perf_remove_from_context() race - perf lock: Fix option value type in parse_max_stack - perf: Make sure to use pmu_ctx->pmu for groups - perf test stat tests: Fix for virtualized machines - perf test stat: Update test expectations and events - perf: tools: cs-etm: Fix print issue for Coresight debug in ETE/TRBE trace - perf unwind-libdw: Fix invalid reference counts - perf util: Kill die() prototype, dead for a long time - perf/x86/intel/uncore: Skip discovery table for offline dies - phonet: Pass ifindex to fill_addr(). - phonet: Pass net and ifindex to phonet_address_notify(). - phonet/pep: disable BH around forwarded sk_receive_skb() - phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature - phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access - phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X - phy: mvebu-cp110-utmi: fix dr_mode property read from dts - phy: tegra: xusb: Fix per-pad high-speed termination calibration - phy: ti: j721e-wiz: Fix device node reference leak in wiz_get_lane_phy_types() - pidfd: refuse access to tasks that have started exiting harder - pinctrl: abx500: Fix type of 'argument' variable - pinctrl: cirrus: cs42l43: Fix double-put in cs42l43_pin_probe() - pinctrl: cy8c95x0: Avoid returning positive values to user space - pinctrl: cy8c95x0: remove duplicate error message - pinctrl: cy8c95x0: Unify messages with help of dev_err_probe() - pinctrl: equilibrium: Fix device node reference leak in pinbank_init() - pinctrl: equilibrium: fix warning trace on load - pinctrl: equilibrium: rename irq_chip function callbacks - pinctrl: intel: Fix the revision for new features (1kOhm PD, HW debouncer) - pinctrl: mediatek: common: Fix probe failure for devices without EINT - pinctrl: pinctrl-pic32: Fix resource leak - pinctrl: qcom: Fix wakeirq map by removing disconnected irqs for sm8150 - pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition - pinctrl: single: fix refcount leak in pcs_add_gpio_func() - ping: annotate data-races in ping_lookup() - platform/chrome: chromeos_tbmc: Drop wakeup source on remove - platform/chrome: cros_ec_lightbar: Fix response size initialization - platform/chrome: cros_typec_switch: Don't touch struct fwnode_handle::dev - platform/olpc: olpc-xo175-ec: Fix overflow error message to print inlen - platform/surface: surfacepro3_button: Drop wakeup source on remove - platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL - platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro - platform/x86/amd/pmc: Add support for Van Gogh SoC - platform/x86/amd: pmc: Add Thinkpad L14 Gen3 to quirk_s2idle_bug - platform/x86: classmate-laptop: Add missing NULL pointer checks - platform/x86: dell_rbu: avoid uninit value usage in packet_size_write() - platform/x86: dell-wmi: Add audio/mic mute key codes - platform/x86: dell-wmi-sysman: bound enumeration string aggregation - platform/x86: dell-wmi-sysman: Don't hex dump plaintext password data - platform/x86: hp_accel: Check ACPI_COMPANION() against NULL - platform/x86: hp-bioscfg: Support allocations of larger data - platform/x86: hp-wmi: Ignore backlight and FnLock events - platform/x86: intel-hid: Add Dell 14 Plus 2-in-1 to dmi_vgbs_allow_list - platform/x86: intel-hid: Check ACPI_HANDLE() against NULL - platform/x86: intel-hid: Enable 5-button array on ThinkPad X1 Fold 16 Gen 1 - platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL - platform/x86/intel/vsec: Fix enable_cnt imbalance on PCIe error recovery - platform/x86: ISST: Correct locked bit width - platform/x86: panasonic-laptop: Fix OPTD notifier registration and cleanup - platform/x86: panasonic-laptop: Fix sysfs group leak in error path - platform/x86: thinkpad_acpi: Fix errors reading battery thresholds - platform/x86: touchscreen_dmi: Add quirk for y-inverted Goodix touchscreen on SUPI S10 - pmdomain: bcm: bcm2835-power: Fix broken reset status read - pmdomain: bcm: bcm2835-power: Increase ASB control timeout - pmdomain: core: Fix detach procedure for virtual devices in genpd - pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled - pmdomain: imx: scu-pd: Fix device_node reference leak during ->probe() - pmdomain: ti: omap_prm: Fix a reference leak on device node - PM: hibernate: Don't ignore return from set_memory_ro() - PM: hibernate: Drain trailing zero pages on userspace restore - PM: runtime: Fix a race condition related to device removal - PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races - PM: wakeup: Handle empty list in wakeup_sources_walk_start() - pNFS: Fix a deadlock when returning a delegation during open() - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN - pNFS: Fix use-after-free in pnfs_update_layout() - powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check - powerpc64/bpf: do not increment tailcall count when prog is NULL - powerpc: 83xx: km83xx: Fix keymile vendor prefix - powerpc/crash: fix backup region offset update to elfcorehdr - powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling - powerpc/kdump: fix KASAN sanitization flag for core_$(BITS).o - powerpc/smp: Add check for kcalloc() failure in parse_thread_groups() - powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise() - powerpc/uaccess: Fix inline assembly for clang build on PPC32 - powerpc/uaccess: Move barrier_nospec() out of allow_read_{from/write}_user() - powerpc/warp: Fix error handling in pika_dtm_thread - power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() - power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write - power: supply: ab8500: Fix use-after-free in power_supply_changed() - power: supply: act8945a: Fix use-after-free in power_supply_changed() - power: supply: axp288_charger: Do not cancel work before initializing it - power: supply: bq256xx: Fix use-after-free in power_supply_changed() - power: supply: bq25980: Fix use-after-free in power_supply_changed() - power: supply: bq27xxx: fix wrong errno when bus ops are unsupported - power: supply: cpcap-battery: Fix use-after-free in power_supply_changed() - power: supply: goldfish: Fix use-after-free in power_supply_changed() - power: supply: max17042: avoid overflow when determining health - power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer - power: supply: rt9455: Fix use-after-free in power_supply_changed() - power: supply: sbs-battery: Fix use-after-free in power_supply_changed() - power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed() - pppoe: drop PFC frames - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls - printk: add print_hex_dump_devel() - procfs: fix missing RCU protection when reading real_parent in do_task_stat() - pstore: ram_core: fix incorrect success return when vmap() fails - pstore/ram: fix buffer overflow in persistent_ram_save_old() - pstore/ram: fix resource leak when ioremap() fails - ptp: vclock: Switch from RCU to SRCU - ptrace: Convert ptrace_attach() to use lock guards - ptrace: slightly saner 'get_dumpable()' logic - pwm: imx-tpm: Count the number of enabled channels in probe - qed: fix double free in qed_cxt_tables_alloc() - quota: fix livelock between quotactl and freeze_super - quota: Fix race of dquot_scan_active() with quota deactivation - r8152: fix incorrect register write to USB_UPHY_XTAL - r8152: handle the return value of usb_reset_device() - randomize_kstack: Maintain kstack_offset per task - rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() - rbd: fix null-ptr-deref when device_add_disk() fails - rcu/exp: Move expedited kthread worker creation functions above rcutree_prepare_cpu() - rcu: Fix rcu_read_unlock() deadloop due to softirq - rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer access - rcu: Refactor expedited handling check in rcu_read_unlock_special() - rcu: Remove local_irq_save/restore() in rcu_preempt_deferred_qs_handler() - rcu: s/boost_kthread_mutex/kthread_mutex - RDMA/bnxt_re: zero shared page before exposing to userspace - RDMA/core: add rdma_rw_max_sge() helper for SQ sizing - RDMA/core: Fix a couple of obvious typos in comments - RDMA/core: Fix stale RoCE GIDs during netdev events at registration - RDMA/core: Prefer NLA_NUL_STRING - RDMA: During rereg_mr ensure that REREG_ACCESS is compatible - RDMA/efa: Fix typo in efa_alloc_mr() - RDMA/hns: Fix unlocked call to hns_roce_qp_remove() - RDMA/hns: Fix WQ_MEM_RECLAIM warning - RDMA/hns: Notify ULP of remaining soft-WCs during reset - RDMA/irdma: Clean up unnecessary dereference of event->cm_node - RDMA/irdma: Fix deadlock during netdev reset with active connections - RDMA/irdma: Fix double free related to rereg_user_mr - RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() - RDMA/irdma: Initialize free_qp completion before using it - RDMA/irdma: Remove a NOP wait_event() in irdma_modify_qp_roce() - RDMA/irdma: Remove reset check from irdma_modify_qp_to_err() - RDMA/irdma: Return EINVAL for invalid arp index error - RDMA/irdma: Update ibqp state to error if QP is already in error state - RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() - RDMA/mana_ib: Disable RX steering on RSS QP destroy - RDMA/mana: Validate rx_hash_key_len - RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq() - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() - RDMA: Move DMA block iterator logic into dedicated files - RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() - RDMA/rtrs-clt: For conn rejection use actual err number - RDMA/rtrs: Fix use-after-free in path file creation cleanup - RDMA/rtrs: server: remove dead code - RDMA/rtrs-srv: fix SG mapping - RDMA/rw: Fall back to direct SGE on MR pool exhaustion - RDMA/rxe: Fix double free in rxe_srq_from_init - RDMA/rxe: Fix race condition in QP timer handlers - RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads - RDMA/rxe: Reject unknown opcodes before ICRC processing - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv - RDMA/siw: Fix potential NULL pointer dereference in header processing - RDMA/siw: Reject MPA FPDU length underflow before signed receive math - RDMA/srp: bound SRP_RSP sense copy by the received length - RDMA/umad: Reject negative data_len in ib_umad_write - RDMA/umem: Fix double dma_buf_unpin in failure path - RDMA/umem: fix kernel-doc warnings - RDMA/umem: Fix truncation for block sizes >= 4G - RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path - rds: ib: reject FRMR registration before IB connection is established - rds: mark snapshot pages dirty in rds_info_getsockopt() - regmap: Synchronize cache for the page selector - regset: use kvzalloc() for regset_get_alloc() - regulator: act8945a: fix OF node reference imbalance - regulator: bd9571mwv: fix OF node reference imbalance - regulator: core: fix locking in regulator_resolve_supply() error path - regulator: core: move supply check earlier in set_machine_constraints() - regulator: max77650: fix OF node reference imbalance - regulator: mt6357: fix OF node reference imbalance - regulator: pca9450: Correct interrupt type - regulator: pca9450: Make IRQ optional - regulator: rk808: fix OF node reference imbalance - remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX channel is uninitialized - remoteproc: imx_rproc: Fix invalid loaded resource table detection - remoteproc: mediatek: Break lock dependency to `prepare_lock` - remoteproc: mediatek: Unprepare SCP clock during system suspend - remoteproc: sysmon: Correct subsys_name_len type in QMI request - remoteproc: xlnx: Only access buffer information if IPI is buffered - Remove WARN_ALL_UNSEEDED_RANDOM kernel config option - resource: Add resource set range and size helpers - Revert "af_unix: Reject SIOCATMARK on non-stream sockets" - Revert "ALSA: usb: Increase volume range that triggers a warning" - Revert "arm64: dts: imx8mq-librem5: Set the DVS voltages lower" - Revert "arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on" - Revert "crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx" - Revert "crypto: nx - fix context leak in nx842_crypto_free_ctx" - Revert "crypto: nx - Migrate to scomp API" - Revert "drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug" - Revert "hwmon: (ibmpex) fix use-after-free in high/low store" - Revert "ice: fix double-free of tx_buf skb" - Revert "ice: Remove jumbo_remove step from TX path" - Revert "mfd: da9052-spi: Change read-mask to write-mask" - Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms" - Revert "mptcp: add needs_id for netlink appending addr" - Revert "PCI: Enable ACS after configuring IOMMU for OF platforms" - Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" - Revert "perf unwind-libdw: Fix invalid reference counts" - Revert "ptp: add testptp mask test" - Revert "rust: pin-init: add references to previously initialized fields" - Revert "rust: pin-init: internal: init: document load-bearing fact of field accessors" - Revert "s390/cio: Update purge function to unregister the unused subchannels" - Revert "selftest/ptp: update ptp selftest to exercise the gettimex options" - Revert "tcpm: allow looking for role_sw device in the main node" - Revert "wifi: cfg80211: stop NAN and P2P in cfg80211_leave" - Revert "wireguard: device: enable threaded NAPI" - Revert "x86/kexec: add a sanity check on previous kernel's ima kexec buffer" - Revert "x86/vdso: Fix output operand size of RDPID" - Revert "xattr: switch to CLASS(fd)" - ring-buffer: Fix reporting of missed events in iterator - ring-buffer: Remove ring_buffer_read_prepare_sync() - riscv: kgdb: fix several debug register assignment bugs - riscv: Sanitize syscall table indexing under speculation - rnbd-srv: Zero the rsp buffer before using it - romfs: check sb_set_blocksize() return value - rpmsg: char: Fix use-after-free on probe error path - rpmsg: core: fix race in driver_override_show() and use core helper - rseq: Clarify rseq registration rseq_size bound check comment - rtc: abx80x: Disable alarm feature if no interrupt attached - rtc: interface: Alarm race handling should not discard preceding error - rtc: ntxec: fix OF node reference imbalance - rtc: zynqmp: correct frequency value - rtmutex: Use waiter::task instead of current in remove_waiter() - rtnetlink: count IFLA_INFO_SLAVE_KIND in if_nlmsg_size - rust: kunit: fix warning when !CONFIG_PRINTK - rust: pin-init: add references to previously initialized fields - rust: pin-init: internal: init: document load-bearing fact of field accessors - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present - rxrpc: Fix anonymous key handling - rxrpc: Fix call removal to use RCU safe deletion - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg - rxrpc: Fix data-race warning and potential load/store tearing - rxrpc: Fix key/keyring checks in setsockopt(RXRPC_SECURITY_KEY/KEYRING) - rxrpc: Fix key quota calculation for multitoken keys - rxrpc: Fix key reference count leak from call->key - rxrpc: Fix memory leaks in rxkad_verify_response() - rxrpc: Fix missing error checks for rxkad encryption/decryption failure - rxrpc: Fix missing validation of ticket length in non-XDR key preparsing - rxrpc: Fix potential UAF after skb_unshare() failure - rxrpc: Fix recvmsg() unconditional requeue - rxrpc: Fix re-decryption of RESPONSE packets - rxrpc: fix reference count leak in rxrpc_server_keyring() - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer - rxrpc: Fix rxkad crypto unalignment handling - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets - rxrpc: Fix the ACK parser to extract the SACK table for parsing - rxrpc: only handle RESPONSE during service challenge - rxrpc: Only put the call ref if one was acquired - rxrpc: reject undecryptable rxkad response tickets - s390/barrier: Make array_index_mask_nospec() __always_inline - s390/bpf: Zero-extend bpf prog return values and kfunc arguments - s390/cio: convert sprintf()/snprintf() to sysfs_emit() - s390/cio: Fix device lifecycle handling in css_alloc_subchannel() - s390/cio: make sch->lock spinlock pointer a member - s390/cio: use generic driver_override infrastructure - s390/dasd: Copy detected format information to secondary device - s390/dasd: Move quiesce state with pprc swap - s390/debug: Reject zero-length input before trimming a newline - s390/debug: Reject zero-length input in debug_input_flush_fn() - s390/entry: Scrub r12 register on kernel entry - s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n - s390/pci: Handle futile config accesses of disabled devices directly - s390/perf: Disable register readout on sampling events - s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS - s390/stackleak: Fix __stackleak_poison() inline assembly constraint - s390/syscalls: Add spectre boundary for syscall dispatch table - s390/xor: Fix xor_xc_2() inline assembly constraints - s390/zcrypt: Enable AUTOSEL_DOM for CCA serialnr sysfs attribute - sched/fair: Fix pelt clock sync when entering idle - sched: idle: Consolidate the handling of two special cases - sched: idle: Make skipping governor callbacks more consistent - sched/rt: Skip currently executing CPU in rto_next_cpu() - sched: Use u64 for bandwidth ratio calculations - scripts/dtc: Remove unused dts_version in dtc-lexer.l - scripts: generate_rust_analyzer.py: avoid FD leak - scripts: generate_rust_analyzer.py: define scripts - scripts/sorttable: Add helper functions for Elf_Ehdr - scripts/sorttable: Add helper functions for Elf_Shdr - scripts/sorttable: Add helper functions for Elf_Sym - scripts/sorttable: Allow matches to functions before function entry - scripts/sorttable: Always use an array for the mcount_loc sorting - scripts/sorttable: Convert Elf_Ehdr to union - scripts/sorttable: Convert Elf_Sym MACRO over to a union - scripts/sorttable: Fix endianness handling in build-time mcount sort - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly - scripts/sorttable: Have mcount rela sort use direct values - scripts/sorttable: Have the ORC code use the _r() functions to read - scripts/sorttable: Make compare_extable() into two functions - scripts/sorttable: Move code from sorttable.h into sorttable.c - scripts/sorttable: Remove unneeded Elf_Rel - scripts/sorttable: Remove unused macro defines - scripts/sorttable: Remove unused write functions - scripts/sorttable: Replace Elf_Shdr Macro with a union - scripts/sorttable: Use a structure of function pointers for elf helpers - scripts/sorttable: Use normal sort if theres no relocs in the mcount section - scripts/sorttable: Use uint64_t for mcount sorting - scripts/sorttable: Zero out weak functions in mcount_loc table - scsi: buslogic: Reduce stack usage - scsi: core: Fix error handling for scsi_alloc_sdev() - scsi: core: Fix refcount leak for tagset_refcnt - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues - scsi: csiostor: Fix dereference of null pointer rn - scsi: efct: Use IRQF_ONESHOT and default primary handler - scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker - scsi: hisi_sas: Add time interval between two H2D FIS following soft reset spec - scsi: hisi_sas: Fix NULL pointer exception during user_scan() - scsi: hisi_sas: Use macro instead of magic number - scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() - scsi: isci: Fix use-after-free in device removal path - scsi: lpfc: Properly set WC for DPP mapping - scsi: mpi3mr: Add NULL checks when resetting request and reply queues - scsi: pm8001: Fix use-after-free in pm8001_queue_command() - scsi: qla2xxx: Fix bsg_done() causing double free - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 - scsi: scsi_transport_sas: Fix the maximum channel scanning issue - scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails - scsi: ses: Fix devices attaching to different hosts - scsi: ses: Handle positive SCSI error from ses_recv_diag() - scsi: sg: Fix sysctl sg-big-buff register during sg_init() - scsi: sg: Make sg_sysfs_class constant - scsi: sg: Resolve soft lockup issue when opening /dev/sgX - scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() - scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() - scsi: target: core: Fix integer overflow in UNMAP bounds check - scsi: target: Fix recursive locking in __configfs_open_file() - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() - scsi: target: iscsi: Validate CHAP_R length before base64 decode - scsi: target: tcm_loop: Drain commands in target_reset handler - scsi: ufs: core: Fix possible NULL pointer dereference in ufshcd_add_command_trace() - scsi: ufs: core: Fix SError in ufshcd_rtc_work() during UFS suspend - scsi: ufs: core: Fix shift out of bounds when MAXQ=32 - scsi: ufs: core: Fix use-after free in init error and remove paths - scsi: ufs: core: Flush exception handling work when RPM level is zero - scsi: ufs: core: Move link recovery for hibern8 exit failure to wl_resume - scsi: ufs: host: mediatek: Require CONFIG_PM - sctp: diag: reject stale associations in dump_one path - sctp: discard stale INIT after handshake completion - sctp: fix missing encap_port propagation for GSO fragments - sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks - sctp: fix race between sctp_wait_for_connect and peeloff - sctp: fix uninit-value in __sctp_rcv_asconf_lookup() - sctp: purge outqueue on stale COOKIE-ECHO handling - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL - sctp: stream: fully roll back denied add-stream state - security/keys: fix missed RCU read section on lookup - seg6: fix seg6 lwtunnel output redirect for L2 reduced encap mode - seg6: separate dst_cache for input and output paths in seg6 lwtunnel - selftest/arm64: Fix sve2p1_sigill() to hwcap test - selftest: memcg: skip memcg_sock test if address family not supported - selftests/bpf: add stack access precision test - selftests/bpf: Add test to ensure kprobe_multi is not sleepable - selftests/bpf: Tests for per-insn sync_linked_regs() precision tracking - selftests/bpf: Update comments find_equal_scalars->sync_linked_regs - selftests/bpf: validate fake register spill/fill precision backtracking logic - selftests/bpf: validate precision logic in partial_stack_load_preserves_zeros - selftests/bpf: validate STACK_ZERO is preserved on subreg spill - selftests/bpf: validate zero preservation for sub-slot loads - selftests/bpf: veristat: fix printing order in output_stats() - selftests: forwarding: vxlan_bridge_1d: fix test failure with br_netfilter enabled - selftests: forwarding: vxlan_bridge_1d_ipv6: fix test failure with br_netfilter enabled - selftests/memfd: delete unused declarations - selftests/memfd: use IPC semaphore instead of SIGSTOP/SIGCONT - selftests: mlxsw: tc_restrictions: Fix test failure with new iproute2 - selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs - selftests/mm: skip migration tests if NUMA is unavailable - selftests: mptcp: add a check for 'add_addr_accepted' - selftests: mptcp: add test for extra_subflows underflow on userspace PM - selftests: mptcp: drop nanoseconds width specifier - selftests: mptcp: join: check removing signal+subflow endp - selftests: mptcp: join: check RM_ADDR not sent over same subflow - selftests: mptcp: more stable simult_flows tests - selftests/mqueue: Fix incorrectly named file - selftests: net: bridge_vlan_mcast: wait for h1 before querier check - selftests/powerpc: Re-order *FLAGS to follow lib.mk - selftests/powerpc: Suppress -Wmaybe-uninitialized with GCC 15 - selinux: don't reserve xattr slot when we won't fill it - selinux: fix overlayfs mmap() and mprotect() access checks - selinux: prune /sys/fs/selinux/disable - selinux: shrink critical section in sel_write_load() - serdev: make serdev_bus_type const - serdev: Provide a bustype shutdown function - serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done - serial: 8250: Add late synchronize_irq() to shutdown to handle DW UART BUSY - serial: 8250_dw: handle clock enable errors in runtime_resume - serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails - serial: 8250: Fix TX deadlock when using DMA - serial: 8250_pci: add support for the AX99100 - serial: altera_jtaguart: handle uart_add_one_port() failures - serial: caif: fix use-after-free in caif_serial ldisc_close() - serial: caif: hold tty->link reference in ldisc_open and ser_release - serial: dz: Convert to use a platform device - serial: dz: Fix bootconsole handover lockup - serial: dz: Fix bootconsole message clobbering at chip reset - serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma - serial: imx: change SERIAL_IMX_CONSOLE to bool - serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ - serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero - serial: qcom-geni: fix UART_RX_PAR_EN bit position - serial: samsung_tty: Use port lock wrappers - serial: sh-sci: fix memory region release in error path - serial: SH_SCI: improve "DMA support" prompt - serial: uartlite: fix PM runtime usage count underflow on probe - serial: zs: Convert to use a platform device - serial: zs: Fix bootconsole handover lockup - serial: zs: Fix swapped RI/DSR modem line transition counting - serial: zs: Switch to using channel reset - sfc: fix error code in efx_devlink_info_running_versions() - sh: platform_early: remove pdev->driver_override check - signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads() - slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock - slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD - slimbus: qcom-ngd-ctrl: fix OF node refcount - slimbus: qcom-ngd-ctrl: Fix up platform_driver registration - slip: bound decode() reads against the compressed packet length - slip: reject VJ receive packets on instances with no rstate array - smack: /smack/doi: accept previously used values - smack: /smack/doi must be > 0 - smb: client: add proper locking around ses->iface_last_update - smb: client: Compare MACs in constant time - smb: client: correctly handle ErrorContextData as a flexible array - smb: client: correct value for smbd_max_fragmented_recv_size - smb: client: Don't log plaintext credentials in cifs_set_cifscreds - smb: client: fix atomic open with O_DIRECT & O_SYNC - smb: client: fix broken multichannel with krb5+signing - smb/client: fix buffer size for smb311_posix_qinfo in smb2_compound_op() - smb/client: fix buffer size for smb311_posix_qinfo in SMB311_posix_query_info() - smb: client: fix cifs_pick_channel when channels are equally loaded - smb: client: fix iface port assignment in parse_server_interfaces - smb: client: fix in-place encryption corruption in SMB2_write() - smb: client: fix krb5 mount with username option - smb: client: fix off-by-8 bounds check in check_wsl_eas() - smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path - smb: client: fix OOB reads parsing symlink error response - smb/client: fix out-of-bounds read in smb2_compound_op() - smb/client: fix out-of-bounds read in symlink_data() - smb/client: fix possible infinite loop and oob read in symlink_data() - smb: client: fix potential UAF and double free in smb2_open_file() - smb: client: prevent races in ->query_interfaces() - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() - smb: client: reject userspace cifs.spnego descriptions - smb: client: require a full NFS mode SID before reading mode bits - smb: client: require net admin for CIFS SWN netlink - smb: client: Use FullSessionKey for AES-256 encryption key derivation - smb: client: use kzalloc to zero-initialize security descriptor buffer - smb: client: validate dacloffset before building DACL pointers - smb: client: validate the whole DACL before rewriting it in cifsacl - smb: common: change the data type of num_aces to le16 - smb: move some duplicate definitions to common/smbacl.h - smb: server: fix active_num_conn leak on transport allocation failure - smb/server: Fix another refcount leak in smb2_open() - smb: server: fix max_connections off-by-one in tcp accept path - smb: server: fix use-after-free in smb2_open() - smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close - soc: aspeed: socinfo: Mask table entries for accurate SoC ID matching - soc: fsl: qbman: fix race condition in qman_destroy_fq - soc: mediatek: svs: Fix memory leak in svs_enable_debug_write() - soc: qcom: aoss: compare against normalized cooling state - soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in cmd_db_dev_probe - soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get() - soc: qcom: llcc: fix v1 SB syndrome register offset - soc: qcom: ocmem: make the core clock optional - soc: qcom: ocmem: register reasons for probe deferrals - soc: qcom: ocmem: return -EPROBE_DEFER is ocmem is not available - soc: qcom: ocmem: use scoped device node handling to simplify error paths - soc: qcom: smem: handle ENOMEM error during probe - soc/tegra: cbb: Set ERD on resume for err interrupt - soc/tegra: pmc: Fix unsafe generic_handle_irq() call - soc: ti: k3-socinfo: Fix regmap leak on probe failure - soc: ti: pruss: Fix double free in pruss_clk_mux_setup() - sound: ua101: fix division by zero at probe - soundwire: bus: demote UNATTACHED state warnings to dev_dbg() - soundwire: cadence: Clear message complete before signaling waiting thread - soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15) - sparc: don't reference obsolete termio struct for TC* constants - sparc: Synchronize user stack on fork and clone - spi: at91-usart: fix controller deregistration - spi: atmel: fix controller deregistration - spi: bcm63xx: fix controller deregistration - spi: bcmbca-hsspi: fix controller deregistration - spi: cadence: fix controller deregistration - spi: cadence: fix unclocked access on unbind - spi: coldfire-qspi: fix controller deregistration - spi: dln2: fix controller deregistration - spi: fix resource leaks on device setup failure - spi: fix statistics allocation - spi: fix use-after-free on controller registration failure - spi: fsl-espi: fix controller deregistration - spi: fsl: fix controller deregistration - spi: fsl-qspi: Use reinit_completion() for repeated operations - spi: geni-qcom: Check DMA interrupts early in ISR - spi-geni-qcom: initialize mode related registers to 0 - spi-geni-qcom: use xfer->bits_per_word for can_dma() - spi: hisi-kunpeng: prevent infinite while() loop in hisi_spi_flush_fifo - spi: img-spfi: fix controller deregistration - spi: imx: fix runtime pm leak on probe deferral - spi: imx: fix use-after-free on unbind - spi: intel-pci: Add support for Nova Lake mobile SPI flash - spi: lantiq-ssc: fix controller deregistration - spi: meson-spicc: Fix double-put in remove path - spi: microchip-core-qspi: fix controller deregistration - spi: microchip-core-qspi: Use helper function devm_clk_get_enabled() - spi: mpc52xx: fix use-after-free on unbind - spi: mtk-nor: fix controller deregistration - spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache() - spi: mtk-snfi: unregister ECC engine on probe failure and remove() callback - spi: omap2-mcspi: fix controller deregistration - spi: orion: fix clock imbalance on registration failure - spi: orion: fix runtime pm leak on unbind - spi: qup: fix controller deregistration - spi: qup: fix error pointer deref after DMA setup failure - spi: rockchip: fix controller deregistration - spi: rockchip: Read ISR, not IMR, to detect cs-inactive IRQ - spi: rspi: fix controller deregistration - spi: s3c64xx: fix controller deregistration - spi: s3c64xx: fix NULL-deref on driver unbind - spi: sh-hspi: fix controller deregistration - spi: sifive: fix controller deregistration - spi: sifive: Simplify clock handling with devm_clk_get_enabled() - spi: sn-f-ospi: Fix resource leak in f_ospi_probe() - spi: spidev: fix lock inversion between spi_lock and buf_lock - spi: spi-fsl-lpspi: fix teardown order issue (UAF) - spi: spi-mem: Limit octal DTR constraints to octal DTR situations - spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end - spi: spi-ti-qspi: Convert to platform remove callback returning void - spi: spi-ti-qspi: switch to use modern name - spi: sprd: fix controller deregistration - spi: sprd: fix error pointer deref after DMA setup failure - spi: stm32: fix Overrun issue at < 8bpw - spi: st-ssc4: fix controller deregistration - spi: st-ssc4: switch to use modern name - spi: sun4i: fix controller deregistration - spi: sun4i: switch to use modern name - spi: sun6i: fix controller deregistration - spi: sun6i: switch to use modern name - spi: syncuacer: fix controller deregistration - spi: synquacer: switch to use modern name - spi: tegra114: fix controller deregistration - spi: tegra20-sflash: fix controller deregistration - spi: ti-qspi: fix controller deregistration - spi: ti-qspi: fix use-after-free after DMA setup failure - spi: tools: Add include folder to .gitignore - spi: topcliff-pch: fix use-after-free on unbind - spi: uniphier: fix controller deregistration - spi: uniphier: Simplify clock handling with devm_clk_get_enabled() - spi: uniphier: switch to use modern name - spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe() - spi: wpcm-fiu: Fix uninitialized res - spi: wpcm-fiu: Simplify with dev_err_probe() - spi: wpcm-fiu: Use devm_platform_ioremap_resource_byname() - spi: zynqmp-gqspi: fix controller deregistration - spi: zynq-qspi: fix controller deregistration - spi: zynq-qspi: Simplify clock handling with devm_clk_get_enabled() - spi: zynq-qspi: switch to use modern name - Squashfs: check metadata block offset is within range - staging: greybus: lights: avoid NULL deref - staging: media: atomisp: Disallow all private IOCTLs - staging: rtl8723bs: fix memory leak on failure path - staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure - staging: rtl8723bs: fix null dereference in find_network - staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie - staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify() - staging: rtl8723bs: properly validate the data in rtw_get_ie_ex() - staging: sm750fb: fix division by zero in ps_to_hz() - staging: vme_user: fix root device leak on init failure - string: add mem_is_zero() helper to check if memory area is all zeros - SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths - sunrpc: fix cache_request leak in cache_release - SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path - svcrdma: Clean up comment in svc_rdma_accept() - svcrdma: Increase the per-transport rw_ctx count - svcrdma: Reduce the number of rdma_rw contexts per-QP - svcrdma: Remove queue-shortening warnings - sysctl: fix uninitialized variable in proc_do_large_bitmap - sysfs: don't remove existing directory on update failure - tap: free page on error paths in tap_get_user_xdp() - taskstats: set version in TGID exit notifications - tcp: add data-race annotations around tp->data_segs_out and tp->total_retrans - tcp: annotate data-races around tp->bytes_retrans - tcp: annotate data-races around tp->bytes_sent - tcp: annotate data-races around tp->dsack_dups - tcp: annotate data-races around tp->plb_rehash - tcp: annotate data-races around (tp->write_seq - tp->snd_nxt) - tcp: call sk_data_ready() after listener migration - tcp: defer regular ACK while processing socket backlog - tcp: Fix bind() regression for v6-only wildcard and v4-mapped-v6 non-wildcard addresses. - tcp: Fix imbalanced icsk_accept_queue count. - tcp: optimize inet_use_bhash2_on_bind() - tcp: Rearrange tests in inet_csk_bind_conflict(). - tcp: restrict SO_ATTACH_FILTER to priv users - tcp: Set pingpong threshold via sysctl - tcp: tcp_tx_timestamp() must look at the rtx queue - tcp: Use bhash2 for v4-mapped-v6 non-wildcard address. - tee: optee: prevent use-after-free when the client exits before the supplicant - test_kprobes: clear kprobes between test runs - tg3: Fix race for querying speed/duplex - tg3: replace placeholder MAC address with device property - thermal: core: Fix thermal zone device registration error path - thermal: core: Fix thermal zone governor cleanup issues - thermal/drivers/spear: Fix error condition for reading st,thermal-flags - thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp - thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata - thermal: int340x: Fix sysfs group leak on DLVR registration failure - thunderbolt: Bound root directory content to block size - thunderbolt: Clamp XDomain response data copy to allocation size - thunderbolt: Fix property read in nhi_wake_supported() - thunderbolt: Limit XDomain response copy to actual frame size - thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() - thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow - thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() - thunderbolt: Reject zero-length property entries in validator - thunderbolt: Validate XDomain request packet size before type cast - time: Fix off-by-one in settimeofday() usec validation - time/jiffies: Mark jiffies_64_to_clock_t() notrace - tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG - tipc: fix divide-by-zero in tipc_sk_filter_connect() - tipc: fix double-free in tipc_buf_append() - tipc: fix duplicate publication key in tipc_service_insert_publ() - tipc: fix RCU dereference race in tipc_aead_users_dec() - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done - tls: Preserve sk_err across recvmsg() when data has been copied - tls: Purge async_hold in tls_decrypt_async_wait() - tools/accounting: handle truncated taskstats netlink messages - tools/bootconfig: fix fd leak in load_xbc_file() on fstat failure - tools: Fix bitfield dependency failure - tools/power cpupower: Reset errno before strtoull() - tools/power/x86/intel-speed-select: Fix file descriptor leak in isolate_cpus() - tools/rv: Fix cleanup after failed trace setup - tpm: avoid -Wunused-but-set-variable - tpm: st33zp24: Fix missing cleanup on get_burstcount() error - tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure - tpm: tpm_tis: add error logging for data transfer - tpm: tpm_tis: stop transmit if retries are exhausted - tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() - tracing: Add NULL pointer check to trigger_data_free() - tracing: Add recursion protection in kernel stack trace recording - tracing: Avoid NULL return from hist_field_name() on truncation - tracing: branch: Fix inverted check on stat tracer registration - tracing: Do not call map->ops->elt_free() if elt_alloc() fails - tracing: Fix checking of freed trace_event_file for hist files - tracing: Fix false sharing in hwlat get_sample() - tracing: Fix potential deadlock in cpu hotplug with osnoise - tracing: Fix syscall events activation by ensuring refcount hits zero - tracing: Fix to set write permission to per-cpu buffer_size_kb - tracing: Fix trace_buf_size= cmdline parameter with sizes >= 2G - tracing/probe: reject non-closed empty immediate strings - tracing/probes: Limit size of event probe to 3K - tracing/probes: Point the error offset correctly for eprobe argument error - tracing: Properly process error handling in event_hist_trigger_parse() - tracing: Rebuild full_name on each hist_field_name() call - tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros - tracing: Switch trace_osnoise.c code over to use guard() and __free() - tracing: Wake up poll waiters for hist files when removing an event - tty: hvc_iucv: fix off-by-one in number of supported devices - tty: serial: pch_uart: add check for dma_alloc_coherent() - tty: serial: samsung: Remove redundant port lock acquisition in rx helpers - tty: serial: samsung: use u32 for register interactions - tun: free page on build_skb failure in tun_xdp_one() - tun: free page on short-frame rejection in tun_xdp_one() - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() - ublk: Validate SQE128 flag before accessing the cmd - ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit() - udf: fix partition descriptor append bookkeeping - udf: reject descriptors with oversized CRC length - udp: clear skb->dev before running a sockmap verdict - udp: Fix wildcard bind conflict check when using hash2 - udp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6=n - um: drivers: call kernel_strrchr() explicitly in cow_user.c - unshare: fix nsproxy leak in ksys_unshare() on set_cred_ucounts() failure - unshare: fix unshare_fs() handling - USB: add QUIRK_NO_BOS for video capture several devices - usb: bdc: fix sleep during atomic - USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen - USB: cdc-acm: Fix bit overlap and move quirk definitions to header - usb: cdc-acm: Restore CAP_BRK functionnality to CH343 - usb: cdns3: call cdns_power_is_lost() only once in cdns_resume() - usb: cdns3: fix role switching during resume - usb: cdns3: gadget: fix NULL pointer dereference in ep_queue - usb: cdns3: gadget: fix request skipping after clearing halt - usb: cdns3: gadget: fix state inconsistency on gadget init failure - usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure - usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles - usb: cdns3: remove redundant if branch - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change - usb: chipidea: core: convert ci_role_switch to local variable - usb: chipidea: otg: not wait vbus drop if use role_switch - usb: class: cdc-wdm: fix reordering issue in read code path - USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam - usb: core: don't power off roothub PHYs if phy_set_mode() fails - usb: core: Fix SuperSpeed root hub wMaxPacketSize - usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval - USB: core: Limit the length of unkillable synchronous timeouts - usb: core: new quirk to handle devices with zero configurations - usb/core/quirks: Add Huawei ME906S-device to wakeup quirk - USB: dummy-hcd: Fix interrupt synchronization error - USB: dummy-hcd: Fix locking/synchronization error - usb: dwc2: fix resume failure if dr_mode is host - usb: dwc2: Fix use after free in debug code - usb: dwc2: gadget: Fix spin_lock/unlock mismatch in dwc2_hsotg_udc_stop() - usb: dwc3: gadget: Move vbus draw to workqueue context - usb: dwc3: Move GUID programming after PHY initialization - usb: dwc3: pci: add support for the Intel Nova Lake -H - usb: dwc3: xilinx: fix error handling in zynqmp init error paths - usb: ehci-brcm: fix sleep during atomic - USB: ezcap401 needs USB_QUIRK_NO_BOS to function on 10gbs usb speed - usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling - usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows partial transfer - usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports - usb: gadget: f_fs: copy only received bytes on short ep0 read - usb: gadget: f_hid: fix device reference leak in hidg_alloc() - usb: gadget: f_hid: move list and spinlock inits from bind to alloc - usb: gadget: f_mass_storage: Fix potential integer overflow in check_command_size_in_blocks() - usb: gadget: f_ncm: Fix net_device lifecycle with device_move - usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb() - usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete() - usb: gadget: f_rndis: Protect RNDIS options with mutex - usb: gadget: f_subset: Fix unbalanced refcnt in geth_free - usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling - usb: gadget: f_uac1_legacy: validate control request size - usb: gadget: net2280: Fix double free in probe error path - usb: gadget: renesas_usb3: validate endpoint index in standard request handlers - usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN - usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo - usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop - usb: gadget: uvc: fix NULL pointer dereference during unbind race - usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind - usb: image: mdc800: kill download URB on timeout - usbip: validate number_of_packets in usbip_pack_ret_submit() - usbip: vudc: Fix use after free bug in vudc_remove due to race condition - usb: mdc800: handle signal and read racing - usb: misc: uss720: properly clean up reference in uss720_probe() - usb: musb: omap2430: Fix use-after-free in omap2430_probe() - USB: omap_udc: DMA: Don't enable burst 4 mode - usb: port: add delay after usb_hub_set_port_power() - usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive - USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers - usb: renesas_usbhs: fix use-after-free in ISR during device removal - usb: roles: get usb role switch from parent only for usb-b-connector - USB: serial: belkin_sa: validate interrupt status length - USB: serial: cypress_m8: fix memory corruption with small endpoint - USB: serial: cypress_m8: validate interrupt packet headers - USB: serial: digi_acceleport: fix memory corruption with small endpoints - USB: serial: f81232: fix incomplete serial port generation - USB: serial: io_edgeport: add support for Blackbox IC135A - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() - USB: serial: io_ti: fix heap overflow in get_manuf_info() - USB: serial: keyspan: fix missing indat transfer sanity check - USB: serial: kl5kusb105: fix bulk-out buffer overflow - USB: serial: mct_u232: fix memory corruption with small endpoint - USB: serial: mct_u232: fix missing interrupt-in transfer sanity check - USB: serial: mxuport: fix memory corruption with small endpoint - USB: serial: omninet: fix memory corruption with small endpoint - USB: serial: option: add MeiG Smart SRM825WN - USB: serial: option: add MeiG SRM813Q - USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL - USB: serial: option: add support for Rolling Wireless RW135R-GL - USB: serial: option: add Telit Cinterion FN990A MBIM composition - USB: serial: option: add Telit Cinterion LE910Cx compositions - USB: serial: option: add Telit FN920C04 RNDIS compositions - USB: serial: option: add usb-id for Dell Wireless DW5826e-m - USB: serial: safe_serial: fix memory corruption with small endpoint - usb: storage: Add quirks for PNY Elite Portable SSD - usb: storage: Expand range of matched versions for VL817 quirks entry - usb: typec: altmodes/displayport: validate count before reading Status Update VDO - usb: typec: tcpm: reset internal port states on soft reset AMS - usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT - usb: typec: ucsi: ccg: reject firmware images without a ':' record header - usb: typec: ucsi: Check if power role change actually happened before handling - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO - usb: typec: ucsi: Don't update power_supply on power role change if not connected - usb: typec: ucsi: Move unregister out of atomic section - usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs - usb: typec: ucsi: validate connector number in ucsi_connector_change() - usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() - usb: ulpi: fix double free in ulpi_register_interface() error path - usb: ulpi: fix memory leak on ulpi_register() error paths - USB: usbcore: Introduce usb_bulk_msg_killable() - usb: usblp: fix heap leak in IEEE 1284 device ID via short response - usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl - usb: usbtmc: check URB actual_length for interrupt-IN notifications - usb: usbtmc: Flush anchored URBs in usbtmc_release - usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize - USB: usbtmc: Use usb_bulk_msg_killable() with user-specified timeouts - usb: xhci: Fix memory leak in xhci_disable_slot() - usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable() - usb: xhci: Prevent interrupt storm on host controller error (HCE) - usb: yurex: fix race in probe - userfaultfd: allow registration of ranges below mmap_min_addr - vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write - vfio: Create vfio_fs_type with inode per device - vfio/pci: Insert full vma on mmap'd MMIO fault - vfio/pci: Use unmap_mapping_range() - vhost: fix caching attributes of MMIO regions by setting them explicitly - vhost_net: fix sleeping with preempt-disabled in vhost_net_busy_poll() - virtiofs: fix UAF on submount umount - virtio_net: clamp rss_max_key_size to NETDEV_RSS_KEY_LEN - virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false - virt: vbox: uapi: Mark inner unions in packed structs as packed - vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 - vrf: Fix a potential NPD when removing a port from a VRF - vsock: fix buffer size clamping order - vsock: keep poll shutdown state consistent - vsock/virtio: fix accept queue count leak on transport mismatch - vsock/virtio: fix length and offset in tap skb for split packets - vsock/virtio: reset connection on receiving queue overflow - vsock/vmci: fix sk_ack_backlog leak on failed handshake - vsock/vmci: fix UAF when peer resets connection during handshake - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() - vxlan: validate ND option lengths in vxlan_na_create - vxlan: vnifilter: fix spurious notification on VNI update - vxlan: vnifilter: send notification on VNI add - watchdog: imx7ulp_wdt: handle the nowayout option - watchdog: starfive-wdt: Fix PM reference leak in probe error path - wifi: ath10k: fix lock protection in ath10k_wmi_event_peer_sta_ps_state_chg() - wifi: ath10k: sdio: add missing lock protection in ath10k_sdio_fw_crashed_dump() - wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1 - wifi: ath11k: clear shared SRNG pointer state on restart - wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm() - wifi: ath11k: fix error path leaks in some WMI WOW calls - wifi: ath11k: fix peer resolution on rx path when peer_id=0 - wifi: ath11k: fix warning when unbinding - wifi: ath11k: Pass the correct value of each TID during a stop AMPDU session - wifi: ath11k: skip status ring entry processing - wifi: ath11k: Use dma_alloc_noncoherent for rx_tid buffer allocation - wifi: ath12k: fix preferred hardware mode calculation - wifi: ath5k: do not access array OOB - wifi: b43: enforce bounds check on firmware key index in b43_rx() - wifi: b43legacy: enforce bounds check on firmware key index in RX path - wifi: brcmfmac: Fix error pointer dereference - wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task - wifi: brcmfmac: validate bsscfg indices in IF events - wifi: brcmsmac: Fix dma_free_coherent() size - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down - wifi: cfg80211: cancel rfkill_block work in wiphy_unregister() - wifi: cfg80211: stop NAN and P2P in cfg80211_leave - wifi: cfg80211: wext: fix IGTK key ID off-by-one - wifi: cw1200: Fix locking in error paths - wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() - wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() - wifi: iwlwifi: mvm: check the validity of noa_len - wifi: iwlwifi: mvm: fix potential out-of-bounds read in iwl_mvm_nd_match_info_handler() - wifi: iwlwifi: mvm: fix race condition in PTP removal - wifi: libertas: fix use-after-free in lbs_free_adapter() - wifi: libertas: fix WARNING in usb_tx_block - wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure - wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration - wifi: mac80211: check tdls flag in ieee80211_tdls_oper - wifi: mac80211: drop stray 'static' from fast-RX rx_result - wifi: mac80211: fix NULL deref in mesh_matches_local() - wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame() - wifi: mac80211: Fix static_branch_dec() underflow for aql_disable. - wifi: mac80211: remove station if connection prep fails - wifi: mac80211: set default WMM parameters on all links - wifi: mt76: connac: introduce helper for mt7925 chipset - wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211() - wifi: mt76: mt7615: fix use_cts_prot support - wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S - wifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work() - wifi: mt76: mt7915: fix use_cts_prot support - wifi: mt76: mt7921: fix a potential clc buffer length underflow - wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work - wifi: mt76: mt7921: Reset ampdu_state state in case of failure in mt76_connac2_tx_check_aggr() - wifi: mt76: mt792x: describe USB WFSYS reset with a descriptor - wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling - wifi: mt76: mt7996: fix FCS error flag check in RX descriptor - wifi: mt76: mt7996: Fix possible oob access in mt7996_mac_write_txwi_80211() - wifi: mt76: mt7996: fix struct mt7996_mcu_uni_event - wifi: mwifiex: Fix memory leak in mwifiex_11n_aggregate_pkt() - wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() - wifi: nl80211: reject oversized EMA RNR lists - wifi: radiotap: reject radiotap with unknown bits - wifi: rsi: fix kthread lifetime race between self-exit and external-stop - wifi: rt2x00usb: fix devres lifetime - wifi: rtl8xxxu: fix potential use of uninitialized value - wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet - wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor - wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() - wifi: rtw88: check for PCI upstream bridge existence - wifi: rtw88: fix device leak on probe failure - wifi: rtw88: fix DTIM period handling when conf->dtim_period is zero - wifi: rtw88: increase TX report timeout to fix race condition - wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H - wifi: rtw88: usb: fix memory leaks on USB write failures - wifi: rtw89: pci: restore LDO setting after device resume - wifi: rtw89: phy: fix uninitialized variable access in rtw89_phy_cfo_set_crystal_cap() - wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode - wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free - wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation - wifi: wl1251: validate packet IDs before indexing tx_frames - wifi: wlcore: Fix a locking bug - wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom - wireguard: send: append trailer after expanding head - workqueue: Factor out assign_rescuer_work() - workqueue: Fix wq->cpu_pwq leak in alloc_and_link_pwqs() WQ_UNBOUND path - workqueue: Only assign rescuer work when really needed - workqueue: Process rescuer work items one-by-one using a cursor - X.509: Fix out-of-bounds access when parsing extensions - x86/apic: Disable x2apic on resume if the kernel expects so - x86/CPU/AMD: Call the spectral chicken in the Zen2 init function - x86/CPU/AMD: Move the Zen3 BTC_NO detection to the Zen3 init function - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache - x86/CPU/AMD: Rename init_amd_zn() to init_amd_zen_common() - x86/cpu: Enable FSGSBASE early in cpu_init_exception_handling() - x86/CPU: Fix FPDSS on Zen1 - x86/efi: defer freeing of boot services memory - x86/efi: efi_unmap_boot_services: fix calculation of ranges_to_free size - x86/hyperv: Fix error pointer dereference - x86/kexec: add a sanity check on previous kernel's ima kexec buffer - x86/kexec: Copy ACPI root pointer address from config table - x86/kexec: Disable KCOV instrumentation after load_segments() - x86/platform/uv: Handle deconfigured sockets - x86/sev: Allow IBPB-on-Entry feature for SNP guests - x86/sev: Check for MWAITX and MONITORX opcodes in the #VC handler - x86/sev: Harden #VC instruction emulation somewhat - x86: shadow stacks: proper error handling for mmap lock - x86/shstk: Prevent deadlock during shstk sigreturn - x86/uprobes: Fix XOL allocation failure for 32-bit tasks - x86/xen: Fix xen_e820_swap_entry_with_ram() - x86/xen: make some functions static - x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE is set - xattr: switch to CLASS(fd) - xdp: produce a warning when calculated tailroom is negative - xdp: use modulo operation to calculate XDP frag tailroom - xen/acpi-processor: fix _CST detection using undersized evaluation buffer - xenbus: Use .freeze/.thaw to handle xenbus devices - xen-netback: reject zero-queue configuration from guest - xen/privcmd: add boot control for restricted usage in domU - xen/privcmd: fix double free via VMA splitting - xen/privcmd: restrict usage in unprivileged domU - xen/virtio: Don't use grant-dma-ops when running as Dom0 - xfrm6: fix uninitialized saddr in xfrm6_get_saddr() - xfrm: ah: account for ESN high bits in async callbacks - xfrm: ah: use skb_to_full_sk in async output callbacks - xfrm: always flush state and policy upon NETDEV_UNREGISTER event - xfrm: call xdo_dev_state_delete during state update - xfrm: Check for underflow in xfrm_state_mtu - xfrm: clear trailing padding in build_polexpire() - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete - xfrm: esp: avoid in-place decrypt on shared skb frags - xfrm: espintcp: do not reuse an in-progress partial send - xfrm: esp: restore combined single-frag length gate - xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path - xfrm: Fix the usage of skb->sk - xfrm: input: hold netns during deferred transport reinjection - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() - xfrm: provide message size for XFRM_MSG_MAPPING - xfrm: route MIGRATE notifications to caller's netns - xfrm: skip templates check for packet offload tunnel mode - xfrm_user: fix info leak in build_mapping() - xfrm_user: fix info leak in build_report() - xfrm: Wait for RCU readers during policy netns exit - xfs: avoid dereferencing log items after push callbacks - xfs: delete attr leaf freemap entries when empty - xfs: ensure dquot item is deleted from AIL only after log shutdown - xfs: fix a resource leak in xfs_alloc_buftarg() - xfs: fix freemap adjustments when adding xattrs to leaf blocks - xfs: fix integer overflow in bmap intent sort comparator - xfs: fix remote xattr valuelblk check - xfs: fix ri_total validation in xlog_recover_attri_commit_pass2 - xfs: fix undersized l_iclog_roundoff values - xfs: mark data structures corrupt on EIO and ENODATA - xfs: save ailp before dropping the AIL lock in push callbacks - xfs: stop reclaim before pushing AIL during unmount - xhci: tegra: Fix ghost USB device on dual-role port unplug - xprtrdma: Decrement re_receiving on the early exit paths - xsk: Fix fragment node deletion to prevent buffer leak - xsk: fix XDP_UMEM_SG_FLAG issues - xsk: Fix zero-copy AF_XDP fragment drop - xsk: Get rid of xdp_buff_xsk::xskb_list_node - xsk: introduce helper to determine rxq->frag_size - xsk: respect tailroom for ZC setups - xsk: s/free_list_node/list_node/ - xsk: tighten UMEM headroom validation to account for tailroom and min frame - xsk: validate MTU against usable frame size on bind - zonefs: handle integer overflow in zonefs_fname_to_fno - zram: do not forget to endio for partial discard requests - zram: fix use-after-free in zram_bvec_write_partial() - Updated by kernel-updater-bot (https://abf.io/mikhailnov/kernel-updater-bot)- Fix CIFSwitch vulnerability- FIX GPO Frag vulnerability- Fix PinTheft- Fix memory leak in AFS code- Fix CVE-2026-46300, CVE-2026-46333, CVE-2025-54518- Remove dead, not used patches- Fix Dirtyfrag- Fix CVE-2026-31431 (Copyfail)- Fix regression with touchpad on notebook Positron Proxima 15 and probably others (bz#19950) - https://bugzilla.rosa.ru/show_bug.cgi?id=19950- [bot] upd: 6.6.106 -> 6.6.126 - Changelog: - 6pack: drop redundant locking and refcounting - 9p: fix cache/debug options printing in v9fs_show_options - 9p: fix /sys/fs/9p/caches overwriting itself - 9p: sysfs_init: don't hardcode error to ENOMEM - accel/habanalabs/gaudi2: fix BMON disable configuration - accel/habanalabs/gaudi2: read preboot status after recovering from dirty state - accel/habanalabs: return ENOMEM if less than requested pages were pinned - accel/habanalabs: support mapping cb with vmalloc-backed coherent memory - accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages() - ACPI: battery: Add synchronization between interface updates - ACPI: battery: allocate driver data through devm_ APIs - ACPI: battery: Check for error code from devm_mutex_init() call - ACPI: battery: initialize mutexes through devm_ APIs - acpi: Break out nesting for hmat_parse_locality() - ACPI: button: Call input_free_device() on failing input device registration - ACPICA: Allow to skip Global Lock initialization - ACPICA: Avoid walking the Namespace if start_node is NULL - ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() - ACPICA: Fix largest possible resource descriptor index - ACPICA: Update dsmethod.c to get rid of unused variable warning - ACPICA: Work around bogus -Wstringop-overread warning since GCC 11 - ACPI: CPPC: Check _CPC validity for only the online CPUs - ACPI: CPPC: Fix missing PCC check for guaranteed_perf - ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs - ACPI: CPPC: Perform fast check switch only for online CPUs - ACPI: debug: fix signedness issues in read/write helpers - acpi, hmat: calculate abstract distance with HMAT - acpi/hmat: Fix lockdep warning for hmem_register_resource() - acpi, hmat: refactor hmat_register_target_initiators() - ACPI: HMAT: Remove register of memory node for generic target - ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message - acpi: numa: Add genport target allocation to the HMAT parsing - acpi: numa: Add setting of generic port system locality attributes - acpi: numa: Create enum for memory_target access coordinates indexing - ACPI: PCC: Fix race condition by removing static qualifier - ACPI: PRM: Skip handlers with NULL handler_address or NULL VA - ACPI: processor_core: fix map_x2apic_id for amd-pstate on am4 - ACPI: processor: idle: Fix memory leak when register cpuidle device failed - ACPI: property: Add code comments explaining what is going on - ACPI: property: Disregard references in data-only subnode lists - ACPI: property: Do not pass NULL handles to acpi_attach_data() - ACPI: property: Fix buffer properties extraction for subnodes - ACPI: property: Fix fwnode refcount leak in acpi_fwnode_graph_parse_endpoint() - ACPI: property: Return present device nodes only on fwnode interface - ACPI: property: Use ACPI functions in acpi_graph_get_next_endpoint() only - ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[] - acpi,srat: Fix incorrect device handle check for Generic Initiator - ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT - ACPI: video: Fix use-after-free in acpi_video_switch_brightness() - afs: Fix potential null pointer dereference in afs_put_server - af_unix: Initialise scc_index in unix_add_edge(). - allow finish_no_open(file, ERR_PTR(-E...)) - alpha: don't reference obsolete termio struct for TC* constants - ALSA: ac97bus: Use guard() for mutex locks - ALSA: ac97: fix a double free in snd_ac97_controller_register() - ALSA: ctxfi: Fix potential OOB access in audio mixer handling - ALSA: dice: fix buffer overflow in detect_stream_formats() - ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings - ALSA: firewire-motu: add bounds check in put_user loop for DSP events - ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported - ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events - ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_hda_read_acpi() - ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk - ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again - ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU - ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx - ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU. - ALSA: lx_core: use int type to store negative error codes - ALSA: pcmcia: Fix resource leak in snd_pdacf_probe error path - ALSA: pcm: Improve the fix for race of buffer access at PCM OSS layer - ALSA: scarlett2: Fix buffer overflow in config retrieval - ALSA: serial-generic: remove shared static buffer - ALSA: uapi: Fix typo in asound.h comment - ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 - ALSA: usb-audio: Add DSD support for Comtrue USB Audio device - ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 - ALSA: usb-audio: add mono main switch to Presonus S1824c - ALSA: usb-audio: Add mute TLV for playback volumes on more devices - ALSA: usb-audio: Add native DSD quirks for PureAudio DAC series - ALSA: usb-audio: Add validation of UAC2/UAC3 effect units - ALSA: usb-audio: apply quirk for MOONDROP Quark2 - ALSA: usb-audio: Avoid multiple assignments in mixer_quirks - ALSA: usb-audio: Convert comma to semicolon - ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks - ALSA: usb-audio: Fix block comments in mixer_quirks - ALSA: usb-audio: Fix build with CONFIG_INPUT=n - ALSA: usb-audio: fix control pipe direction - ALSA: usb-audio: Fix missing unlock at error path of maxpacksize check - ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card - ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer - ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free - ALSA: usb-audio: fix uac2 clock source at terminal parser - ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() - ALSA: usb-audio: Kill timer properly at removal - ALSA: usb-audio: move mixer_quirks' min_mute into common quirk - ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks - ALSA: usb-audio: Simplify NULL comparison in mixer_quirks - ALSA: usb-audio: Update for native DSD support quirks - ALSA: usb: Increase volume range that triggers a warning - ALSA: usb-mixer: us16x08: validate meter packet indices - ALSA: vxpocket: Fix resource leak in vxpocket_probe error path - ALSA: wavefront: Clear substream pointers on close - ALSA: wavefront: Fix integer overflow in sample size validation - ALSA: wavefront: Use guard() for spin locks - ALSA: wavefront: Use standard print API - amba: tegra-ahb: Fix device leak on SMMU enable - amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw - amd-xgbe: avoid misleading per-packet error log - amd-xgbe: Avoid spurious link down messages during interface toggle - amd-xgbe: reset retries and mode on RX adapt failures - arc: Fix __fls() const-foldability via __builtin_clzl() - arch: Add the macro COMPILE_OFFSETS to all the asm-offsets.c - arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() - arm64: cputype: Add Neoverse-V3AE definitions - arm64: dts: add off-on-delay-us for usdhc2 regulator - arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map - arm64: dts: freescale: imx8mp-venice-gw7905-2x: remove duplicate usdhc1 props - arm64: dts: imx8mm-venice-gw72xx: remove unused sdhc1 pinctrl - arm64: dts: imx8mp: Correct thermal sensor index - arm64: dts: imx8mp: Fix LAN8740Ai PHY reference clock on DH electronics i.MX8M Plus DHCOM - arm64: dts: imx8mp-venice-gw702x: remove off-board sdhc1 - arm64: dts: imx8mp-venice-gw702x: remove off-board uart - arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names - arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value - arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 - arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible - arm64: dts: qcom: msm8916: Add missing MDSS reset - arm64: dts: qcom: msm8939: Add missing MDSS reset - arm64: dts: qcom: msm8996: add interconnect paths to USB2 controller - arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode - arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links - arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees - arm64: dts: qcom: sdm845-oneplus: Correct gpio used for slider - arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 - arm64: dts: rockchip: Add eeprom vcc-supply for Radxa ROCK 5A - arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro - arm64: dts: rockchip: Move the EEPROM to correct I2C bus on Radxa ROCK 5A - arm64: dts: rockchip: remove dangerous max-link-speed from helios64 - arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s - arm64: dts: rockchip: Set correct pinctrl for I2S1 8ch TX on odroid-m1 - arm64: dts: ti: k3-am62a-main: Fix main padcfg length - arm64: dts: ti: k3-am62p: Fix memory ranges for GPU - arm64: dts: ti: k3-j721e-sk: Fix pinmux for pin Y1 used by power regulator - arm64: errata: Apply workarounds for Neoverse-V3AE - arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA - arm64/fpsimd: signal: Consistently read FPSIMD context - arm64/fpsimd: signal: Fix restoration of SVE context - arm64/fpsimd: signal: Mandate SVE payload for streaming-mode state - arm64: kprobes: call set_memory_rox() for kprobe page - arm64, mm: avoid always making PTE dirty in pte_mkwrite() - arm64: mte: Do not flag the zero page as PG_mte_tagged - arm64: Set __nocfi on swsusp_arch_resume() - arm64: zynqmp: Revert usb node drive strength and slew rate for zcu106 - ARM: 9461/1: Disable HIGHPTE on PREEMPT_RT kernels - ARM: 9464/1: fix input-only operand modification in load_unaligned_zeropad() - ARM: 9468/1: fix memset64() on big-endian - ARM: at91: pm: fix MCKx restore routine - ARM: at91: pm: save and restore ACR during PLL disable/enable - ARM: bcm: Select ARM_GIC_V3 for ARCH_BRCMSTB - ARM: dts: am335x-netcom-plus-2xx: add missing GPIO labels - ARM: dts: BCM53573: Fix address of Luxul XAP-1440's Ethernet PHY - ARM: dts: imx51-zii-rdu1: Fix audmux node names - ARM: dts: imx6q-ba16: fix RTC interrupt level - ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients - ARM: dts: microchip: sama5d2: fix spi flexcom fifo size to 32 - ARM: dts: microchip: sama7g5: fix uart fifo size to 32 - ARM: dts: nxp: imx6ul: correct SAI3 interrupt line - ARM: dts: omap3: beagle-xm: Correct obsolete TWL4030 power compatible - ARM: dts: omap3: n900: Correct obsolete TWL4030 power compatible - ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property - ARM: dts: renesas: gose: Remove superfluous port property - ARM: dts: renesas: porter: Fix CAN pin group - ARM: dts: renesas: r9a06g032-rzn1d400-db: Drop invalid #cells properties - ARM: dts: samsung: exynos4210-i9100: turn off SDIO WLAN chip during system suspend - ARM: dts: samsung: exynos4210-trats: turn off SDIO WLAN chip during system suspend - ARM: dts: samsung: exynos4412-midas: turn off SDIO WLAN chip during system suspend - ARM: dts: samsung: universal_c210: turn off SDIO WLAN chip during system suspend - ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address - ARM: dts: stm32: stm32mp157c-phycore: Fix STMPE811 touchscreen node properties - ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax - ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS - ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init - ARM: tegra: transformer-20: add missing magnetometer interrupt - ARM: tegra: transformer-20: fix audio-codec interrupt - arp: do not assume dev_hard_header() does not change skb->head - asm-generic/io.h: Skip trace helpers if rwmmio events are disabled - ASoC: ak4458: Disable regulator when error happens - ASoC: ak5558: Disable regulator when error happens - ASoC: amd: acp: Adjust pdm gain value - ASoC: amd: fix memory leak in acp3x pdm dma ops - ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO - ASoC: amd: yc: Add quirk for Honor MagicBook X16 2025 - ASoC: amd: yc: Fix microphone on ASUS M6500RE - ASoC: bcm: bcm63xx-pcm-whistler: Check return value of of_dma_configure() - ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec - ASoC: codecs: va-macro: fix resource leak in probe error path - ASoC: codecs: wsa881x: Drop unused version readout - ASoC: codecs: wsa881x: fix unnecessary initialisation - ASoC: codecs: wsa883x: fix unnecessary initialisation - ASoC: codecs: wsa884x: fix codec initialisation - ASoC: cs4271: Fix regulator leak on probe failure - ASoC: davinci-evm: Fix reference leak in davinci_evm_probe - ASoC: fsl: imx-card: Do not force slot width to sample width - ASoC: fsl_sai: Add missing registers to cache default - ASoC: fsl_sai: fix bit order for DSD format - ASoC: fsl_xcvr: clear the channel status control memory - ASoC: Intel: avs: Unprepare a stream when XRUN occurs - ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping - ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping - ASoC: Intel: catpt: Fix error path in hw_params() - ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion - ASoC: max98090/91: fixed max98091 ALSA widget powering up/down - ASoC: meson: aiu-encoder-i2s: fix bit clock polarity - ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit - ASoC: nau8821: Cancel jdet_work before handling jack ejection - ASoC: nau8821: Generalize helper to clear IRQ status - ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface - ASoC: qcom: audioreach: fix potential null pointer dereference - ASoC: qcom: q6adm: the the copp device only during last instance - ASoC: qcom: q6apm-dai: set flags to reflect correct operation of appl_ptr - ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S - ASoC: qcom: q6apm-lpass-dais: Fix NULL pointer dereference if source graph failed - ASoC: qcom: q6asm-dai: perform correct state check before closing - ASoC: qcom: qdsp6: q6asm-dai: set 10 ms period and buffer alignment. - ASoC: qcom: sc8280xp: explicitly set S16LE format in sc8280xp_be_hw_params_fixup() - ASoC: qdsp6: q6asm: do not sleep while atomic - ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue - ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message - ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down - ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size - ASoC: stm32: sai: fix clk prepare imbalance on probe failure - ASoC: stm32: sai: fix device leak on probe - ASoC: stm32: sai: fix OF node leak on probe - ASoC: stm32: sai: manage context in set_sysclk callback - ASoC: tas2781: fix getting the wrong device number - ASoC: tlv320adcx140: fix null pointer - ASoC: tlv320adcx140: fix word length - ASoC: tlv320adcx140: Propagate error codes during probe - ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007 - ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() - ASoC: wm8940: Correct PLL rate rounding - ASoC: wm8940: Correct typo in control name - ASoC: wm8974: Correct PLL rate rounding - ata: libata: Add cpr_log to ata_dev_print_features() early return - ata: libata: Call ata_dev_config_lpm() for ATAPI devices - ata: libata-core: Introduce ata_dev_config_lpm() - ata: libata: Print features also for ATAPI devices - ata: libata-scsi: Add missing scsi_device_put() in ata_scsi_dev_rescan() - ata: libata-scsi: Fix system suspend for a security locked drive - atm: Fix dma_free_coherent() size - atm/fore200e: Fix possible data race in fore200e_open() - audit: record fanotify event regardless of presence of rules - backlight: led-bl: Add devlink to supplier LEDs - backlight: lp855x: Fix lp855x.h kernel-doc warnings - base/node / acpi: Change 'node_hmem_attrs' to 'access_coordinates' - base/node / ACPI: Enumerate node access class for 'struct access_coordinate' - bcma: don't register devices disabled in OF - be2net: fix data race in be_get_new_eqd - be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list - be2net: pass wrb_params in case of OS2BMC - bfs: Reconstruct file type when loading from disk - binder: fix BR_FROZEN_REPLY error log - binderfs: fix ida_alloc_max() upper bound - binder: remove "invalid inc weak" check - bits: add comments and newlines to #if, #else and #endif directives - bits: introduce fixed-type GENMASK_U*() - blk-cgroup: fix possible deadlock while configuring policy - blk-crypto: fix missing blktrace bio split events - blk-mq: Abort suspend when wakeup events are pending - blk-mq: add helper for checking if one CPU is mapped to specified hctx - blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx - blk-mq: don't schedule block kworker on isolated CPUs - blk-mq: setup queue ->tag_set before initializing hctx - blk-mq: skip CPU offline notify on unmapped hctx - block,bfq: fix aux stat accumulation destination - block: fix comment for op_is_zone_mgmt() to include RESET_ALL - block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL - block: fix race between set_blocksize and read paths - block: make REQ_OP_ZONE_OPEN a write operation - block: rate-limit capacity change info log - block: rnbd-clt: Fix leaked ID in init_dev() - block: rnbd-clt: Fix signedness bug in init_dev() - block: use int to store blk_stack_limits() return value - block: Use RCU in blk_mq_[un]quiesce_tagset() instead of set->tag_list_lock - Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions - Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion - Bluetooth: 6lowpan: reset link-local header on ipv6 recv path - Bluetooth: bcsp: receive data only if registered - Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during reset - Bluetooth: btrtl: Avoid loading the config file on security chips - Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2() - Bluetooth: btusb: Add new VID/PID 13d3/3533 for RTL8821CE - Bluetooth: btusb: Add new VID/PID 2b89/6275 for RTL8761BUV - Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1 - Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB - Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames - Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF - Bluetooth: btusb: revert use of devm_kzalloc in btusb - Bluetooth: hci_core: Fix tracking of periodic advertisement - Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync - Bluetooth: hci_event: validate skb length for unknown CC opcode - Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 - Bluetooth: hci_sock: Prevent race in socket write iter and sock bind - Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()' - Bluetooth: hci_sync: Fix hci_resume_advertising_sync - Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once - Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements - Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work - Bluetooth: ISO: don't leak skb in ISO_CONT RX - Bluetooth: ISO: Fix another instance of dst_type handling - Bluetooth: ISO: Fix possible UAF on iso_conn_free - Bluetooth: L2CAP: export l2cap_chan_hold for modules - Bluetooth: MGMT: cancel mesh send timer when hdev removed - Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO - Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern() - Bluetooth: rfcomm: fix modem control handling - Bluetooth: SCO: Fix UAF on sco_conn_free - Bluetooth: SMP: Fix not generating mackey and ltk when repairing - bnxt_en: correct offset handling for IPv6 destination address - bnxt_en: Fix a possible memory leak in bnxt_ptp_init - bnxt_en: Fix potential data corruption with HW GRO/LRO - bonding: annotate data-races around slave->last_rx - bonding: check xdp prog when set bond mode - bonding: don't set oif to bond dev when getting NS target destination - bonding: limit BOND_MODE_8023AD to Ethernet devices - bonding: provide a net pointer to __skb_flow_dissect() - bonding: return detailed error when loading native XDP fails - bonding: set random address only when slaves already exist - bpf: account for current allocated stack depth in widen_imprecise_scalars() - bpf: Add bpf_prog_run_data_pointers() - bpf, arm64: Do not audit capability check in do_jit() - bpf: Avoid RCU context warning when unpinning htab with internal structs - bpf: Check skb->transport_header is set in bpf_skb_check_mtu - bpf: Clear pfmemalloc flag when freeing all fragments - bpf: Do not audit capability check in do_jit() - bpf: Do not let BPF test infra emit invalid GSO types to stack - bpf: Do not limit bpf_cgroup_from_id to current's namespace - bpf: Don't use %pK through printk - bpf: Enforce expected_attach_type for tailcall compatibility - bpf: Explicitly check accesses to bpf_sock_addr - bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K - bpf: Fix invalid prog->stats access when update_effective_progs fails - bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} - bpf: Fix reference count leak in bpf_prog_test_run_xdp() - bpf: Free special fields when update [lru_,]percpu_hash maps - bpf: Handle return value of ftrace_set_filter_ip in register_fentry - bpf: Improve program stats run-time calculation - bpf: Make variables in bpf_prog_test_run_xdp less confusing - bpf: Reject bpf_timer for PREEMPT_RT - bpf: Reject negative offsets for ALU ops - bpf: Remove migrate_disable in kprobe_multi_link_prog_run - bpf/selftests: Fix test_tcpnotify_user - bpf/selftests: test_select_reuseport_kern: Remove unused header - bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN - bpf: Sync pending IRQ work before freeing ring buffer - bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init() - bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path - bpf, test_run: Subtract size of xdp_frame from allowed metadata size - bpftool: Fix -Wuninitialized-const-pointer warnings with clang >= 21 - bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() - bridge: fix C-VLAN preservation in 802.1ad vlan_tunnel egress - bridge: mcast: Fix use-after-free during router port configuration - bridge: Redirect to backup port when port is administratively down - broadcom: b44: prevent uninitialized value usage - btrfs: always detect conflicting inodes when logging inode refs - btrfs: always drop log root tree reference in btrfs_replay_log() - btrfs: avoid potential out-of-bounds in btrfs_encode_fh() - btrfs: do not assert we found block group item when creating free space tree - btrfs: do not skip logging new dentries when logging a new name - btrfs: do not update last_log_commit when logging inode due to a new name - btrfs: don't log conflicting inode if it's a dir moved in the current transaction - btrfs: don't rewrite ret from inode_permission - btrfs: ensure no dirty metadata is written back for an fs with errors - btrfs: factor out check_removing_space_info() from btrfs_free_block_groups() - btrfs: factor out init_space_info() from create_space_info() - btrfs: fix a potential path leak in print_data_reloc_error() - btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running - btrfs: fix corruption reading compressed range when block size is smaller than page size - btrfs: fix deadlock in wait_current_trans() due to ignored transaction type - btrfs: fix incorrect readahead expansion length - btrfs: fix invalid extref key setup when replaying dentry - btrfs: fix leaf leak in an error path in btrfs_del_items() - btrfs: fix memory leak of fs_devices in degraded seed device path - btrfs: fix memory leaks in create_space_info() error paths - btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE - btrfs: fix racy bitfield write in btrfs_clear_space_info_full() - btrfs: fix reservation leak in some error paths when inserting inline extent - btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() - btrfs: introduce btrfs_space_info sub-group - btrfs: mark dirty extent range for out of bound prealloc extents - btrfs: prevent use-after-free on page private data in btrfs_subpage_clear_uptodate() - btrfs: ref-verify: handle damaged extent root tree - btrfs: scrub: always update btrfs_scrub_progress::last_physical - btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe() - btrfs: scrub: replace max_t()/min_t() with clamp() in scrub_throttle_dev_io() - btrfs: send: check for inline extents in range_is_hole_in_parent() - btrfs: store fs_info in space_info - btrfs: tree-checker: fix the incorrect inode ref size check - btrfs: use level argument in log tree walk callback replay_one_buffer() - btrfs: use readahead_expand() on compressed extents - btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() - btrfs: zoned: refine extent allocator hint selection - btrfs: zoned: return error from btrfs_zone_finish_endio() - bus: fsl-mc: Check return value of platform_get_resource() - bus: mhi: ep: Fix chained transfer handling in read path - bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() - cachestat: do not flush stats in recency check - caif: fix integer underflow in cffrml_receive() - can: bxcan: bxcan_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() - can: ctucanfd: fix SSP_SRC in cases when bit-rate is higher than 1 MBit. - can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak - can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak - can: etas_es58x: allow partial RX URB allocation to succeed - can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow - can: gs_usb: gs_can_open(): fix error handling - can: gs_usb: gs_make_candev(): populate net_device->dev_port - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header - can: gs_usb: gs_usb_receive_bulk_callback(): fix error message - can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak - can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error - can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs - can: gs_usb: increase max interface to U8_MAX - can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled - can: hi311x: populate ndo_change_mtu() to prevent buffer overflow - can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails - can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed - can: j1939: make j1939_session_activate() fail if device is no longer registered - can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak - can: kvaser_usb: leaf: Fix potential infinite loop in command parsers - can: m_can: m_can_plat_remove(): add missing pm_runtime_disable() - can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak - can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow - can: netlink: can_changelink(): allow disabling of automatic restart - can: peak_usb: fix shift-out-of-bounds issue - can: rcar_canfd: Fix CAN-FD mode as default - can: rcar_canfd: Fix controller mode setting - can: rcar_can: rcar_can_resume(): fix s2ram with PSCI - can: sja1000: fix max irq loop handling - can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow - can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling - can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak - can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB - ceph: add checking of wait_for_completion_killable() return value - ceph: fix crash in process_v2_sparse_read() for encrypted directories - ceph: refactor wake_up_bit() pattern of calling - cgroup: split cgroup_destroy_wq into 3 workqueues - char: applicom: fix NULL pointer dereference in ac_ioctl - char: misc: Does not request module for miscdevice with dynamic minor - char: misc: Make misc_register() reentry for miscdevice who wants dynamic minor - char: misc: restrict the dynamic range to exclude reserved minors - char: Use list_del_init() in misc_deregister() to reinitialize list pointer - cifs: client: fix memory leak in smb3_fs_context_parse_param - cifs: Fix memory and information leak in smb3_reconfigure() - cifs: fix memory leak in smb3_fs_context_parse_param error path - cifs: fix pagecache leak when do writepages - cifs: Fix TCP_Server_Info::credits to be signed - cifs: fix typo in enable_gcm_256 module parameter - cifs: Fix uncached read into ITER_KVEC iterator - cifs: parse_dfs_referrals: prevent oob on malformed input - cifs: Query EA $LXMOD in cifs_query_path_info() for WSL reparse points - cifs: stop writeback extension when change of size is detected - clk: at91: clk-master: Add check for divide by 3 - clk: at91: clk-sam9x60-pll: force write to PLL_UPDT register - clk: at91: peripheral: fix return value - clk: keystone: fix compile testing - clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() - clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m - clk: mvebu: cp110 add CLK_IGNORE_UNUSED to pcie_x10, pcie_x11 & pcie_x4 - clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver - clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() - clk: qcom: camcc-sm6350: Fix PLL config of PLL2 - clk: qcom: camcc-sm6350: Specify Titan GDSC power domain as a parent to other - clk: renesas: cpg-mssr: Add missing 1ms delay into reset toggle callback - clk: renesas: cpg-mssr: Read back reset registers to assure values latched - clk: renesas: Pass sub struct of cpg_mssr_priv to cpg_clk_register - clk: renesas: r9a06g032: Fix memory leak in error path - clk: renesas: rzg2l: Remove critical area - clk: renesas: rzg2l: Simplify the logic in rzg2l_mod_clock_endisable() - clk: renesas: rzg2l: Use %x format specifier to print CLK_ON_R() - clk: renesas: Use str_on_off() helper - clk: samsung: exynos-clkout: Assign .num before accessing .hws - clk: sunxi-ng: sun6i-rtc: Add A523 specifics - clk: tegra: do not overallocate memory for bpmp clocks - clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled - clocksource/drivers/clps711x: Fix resource leaks in error paths - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel - cnic: Fix use-after-free bugs in cnic_delete_task - comedi: c6xdigio: Fix invalid PNP driver unregistration - comedi: check device's attached status in compat ioctls - comedi: dmm32at: serialize use of paged registers - comedi: fix divide-by-zero in comedi_buf_munge() - comedi: Fix getting range information for subdevices 16 to 255 - comedi: multiq3: sanitize config options in multiq3_attach() - comedi: pcl818: fix null-ptr-deref in pcl818_ai_cancel() - compiler-clang.h: define __SANITIZE_*__ macros only when undefined - compiler_types.h: add "auto" as a macro for "__auto_type" - compiler_types: Move unused static inline functions warning to W=2 - copy_sighand: Handle architectures where sizeof(unsigned long) < sizeof(u64) - coresight: etm4x: Add context synchronization before enabling trace - coresight-etm4x: Conditionally access register TRCEXTINSELR - coresight: etm4x: Correct polling IDLE bit - coresight: etm4x: Extract the trace unit controlling - coresight: etm4x: Support atclk - coresight: Only register perf symlink for sinks with alloc_buffer - coresight: trbe: Prevent overflow in PERF_IDX2OFF() - coresight: trbe: Return NULL pointer for allocation failures - counter: 104-quad-8: Fix incorrect return value in IRQ handler - counter: interrupt-cnt: Drop IRQF_NO_THREAD flag - cpufreq/amd-pstate: Call cppc_set_auto_sel() only for online CPUs - cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay - cpufreq: dt-platdev: Add JH7110S SOC to the allowlist - cpufreq: Initialize cpufreq-based invariance before subsys - cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() - cpufreq/longhaul: handle NULL policy in longhaul_exit - cpufreq: nforce2: fix reference count leak in nforce2 - cpufreq: s5pv210: fix refcount leak - cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus() - cpufreq: tegra186: Initialize all cores to max frequencies - cpufreq: tegra186: Set target frequency for all cpus in policy - cpuidle: Fail cpuidle device registration if there is one already - cpuidle: governors: menu: Rearrange main loop in menu_select() - cpuidle: governors: menu: Select polling state in some more cases - cpuidle: governors: teo: Drop misguided target residency check - cpuidle: menu: Use residency threshold in polling state override decisions - cpuidle: qcom-spm: fix device and OF node leaks at probe - cpuset: Treat cpusets in attaching as populated - cramfs: Verify inode mode when loading from disk - crash: fix crashkernel resource shrink - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx - crypto: af_alg - Set merge to zero early in af_alg_sendmsg - crypto: af_alg - zero initialize memory allocated via sock_kmalloc - crypto: aspeed-acry - Convert to platform remove callback returning void - crypto: aspeed - Fix dma_unmap_sg() direction - crypto: aspeed - fix double free caused by devm - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id - crypto: atmel - Fix dma_unmap_sg() direction - crypto: authenc - Correctly pass EINPROGRESS back up to the caller - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: caam - Add check for kcalloc() in test_len() - crypto: caam - double the entropy delay interval for retry - crypto: ccree - Correctly handle return of sg_nents_for_len - crypto: essiv - Check ssize for decryption and in-place encryption - crypto: hisilicon/qm - check whether the input function and PF are on the same device - crypto: hisilicon/qm - Fix device reference leak in qm_get_qos_value - crypto: hisilicon/qm - restore original qos values - crypto: hisilicon/qm - set NULL to qm->debug.qm_diff_regs - crypto: hisilicon - re-enable address prefetch after device resuming - crypto: hisilicon/zip - remove unnecessary validation for high-performance mode configurations - crypto: keembay - Add missing check after sg_nents_for_len() - crypto: octeontx - Fix length check to avoid truncation in ucode_load_store - crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly - crypto: qat - use kcalloc() in qat_uclo_map_objs_from_mof() - crypto: rng - Ensure set_ent is always present - crypto: rockchip - Fix dma_unmap_sg() nents value - crypto: seqiv - Do not use req->iv after crypto_aead_encrypt - crypto: sha256 - fix crash at kexec - crypto: starfive - Correctly handle return of sg_nents_for_len - crypto: sun8i-ce - remove channel timeout field - crypto: virtio - Add spinlock protection with virtqueue notification - crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req - csky: fix csky_cmpxchg_fixup not working - dax: skip read lock assertion for read-only filesystems - devcoredump: Fix circular locking dependency with devcd->mutex. - devlink: rate: Unset parent pointer in devl_rate_nodes_destroy - Disable SLUB_TINY for build testing - dlm: check for defined force value in dlm_lockspace_release - dma-debug: don't report false positives with DMA_BOUNCE_UNALIGNED_KMALLOC - dmaengine: apple-admac: Add "apple,t8103-admac" compatible - dmaengine: at_hdmac: fix device leak on of_dma_xlate() - dmaengine: bcm-sba-raid: fix device leak on probe - dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate - dmaengine: dw: dmamux: fix OF node leak on route allocation failure - dmaengine: dw-edma: Set status for callback_result - dmaengine: idxd: fix device leaks on compat bind and unbind - dmaengine: idxd: Fix double free in idxd_setup_wqs() - dmaengine: idxd: Fix refcount underflow on module unload - dmaengine: idxd: Remove improper idxd_free - dmaengine: lpc18xx-dmamux: fix device leak on route allocation - dmaengine: mv_xor: match alloc_wc and free_wc - dmaengine: omap-dma: fix dma_pool resource leak in error paths - dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees - dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config() - dmaengine: sh: rz-dmac: Fix rz_dmac_terminate_all() - dmaengine: sh: setup_xref error handling - dmaengine: stm32: dmamux: fix device leak on route allocation - dmaengine: stm32: dmamux: fix OF node leak on route allocation failure - dmaengine: tegra-adma: Fix use-after-free - dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation - dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation - dmaengine: ti: edma: Fix memory allocation size for queue_priority_map - dmaengine: ti: k3-udma: fix device leak on udma lookup - dmaengine: xilinx_dma: Fix uninitialized addr_width when "xlnx,addrwidth" property is missing - dmaengine: xilinx: xdma: Fix regmap max_register - dma-mapping: benchmark: Restore padding to ensure uABI remained consistent - dma/pool: distinguish between missing and exhausted atomic pools - dma/pool: eliminate alloc_pages warning in atomic_pool_expand - dm-bufio: align write boundary on physical block size - dm-ebs: Mark full buffer dirty even on partial write - dm: fix NULL pointer dereference in __dm_suspend() - dm: fix queue start/stop imbalance under suspend/load/resume races - dm-integrity: limit MAX_TAG_SIZE to 255 - dm log-writes: Add missing set_freezable() for freezable kthread - dm-raid: fix possible NULL dereference with undefined raid type - dm-snapshot: fix 'scheduling while atomic' on real-time kernels - dm-verity: fix unreliable memory allocation - doc: fix seg6_flowlabel path - docs: networking: can: change bcm_msg_head frames member to support flexible array - Documentation: process: Also mention Sasha Levin as stable tree maintainer - Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram - dpaa2-eth: fix the pointer passed to PTR_ALIGN on Tx path - dpaa2-switch: add bounds check for if_id in IRQ handler - dpaa2-switch: fix buffer pool seeding for control traffic - dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero - driver core: enforce device_lock for driver_match_device() - driver core/PM: Set power.no_callbacks along with power.no_pm - drivers/base/node: fix double free in register_one_node() - drivers/base/node: handle error properly in register_one_node() - Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump() - drivers/perf: hisi: Relax the event ID check in the framework - drivers/usb/dwc3: fix PCI parent check - drm/amd: add more cyan skillfish PCI ids - drm/amd: Avoid evicting resources at S5 - drm/amd: Check whether secure display TA loaded successfully - drm/amd: Clean up kfd node on surprise disconnect - drm/amd/display: Add AVI infoframe copy in copy_stream_update_to_stream - drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs - drm/amd/display: add more cyan skillfish devices - drm/amd/display: Bump the HDMI clock to 340MHz - drm/amd/display: Check dce_hwseq before dereferencing it - drm/amd/display: Check NULL before accessing - drm/amd/display: Disable VRR on DCE 6 - drm/amd/display: Enable mst when it's detected but yet to be initialized - drm/amd/display: ensure committing streams is seamless - drm/amd/display: Fix black screen with HDMI outputs - drm/amd/display: Fix DP no audio issue - drm/amd/display: Fix DVI-D/HDMI adapters - drm/amd/display: Fix logical vs bitwise bug in get_embedded_panel_info_v2_1() - drm/amd/display: Fix null pointer deref in dcn20_resource.c - drm/amd/display: Increase AUX Intra-Hop Done Max Wait Duration - drm/amd/display: Increase DPCD read retries - drm/amd/display: Move sleep into each retry for retrieve_link_cap() - drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 - drm/amd/display: Properly disable scaling on DCE6 - drm/amd/display: Remove redundant semicolons - drm/amd/display: update dpp/disp clock from smu clock table - drm/amd/display: Use GFP_ATOMIC in dc_create_plane_state() - drm/amd/display: use udelay rather than fsleep - drm/amd: Fix suspend failure with secure display TA - drm/amdgpu: Add additional DCE6 SCL registers - drm/amdgpu: add missing lock to amdgpu_ttm_access_memory_sdma - drm/amdgpu: add support for cyan skillfish gpu_info - drm/amdgpu: Allow kfd CRIU with no buffer objects - drm/amdgpu: csa unmap use uninterruptible lock - drm/amdgpu: don't enable SMU on cyan skillfish - drm/amdgpu: fix a memory leak in fence cleanup when unloading - drm/amdgpu: fix cyan_skillfish2 gpu info fw handling - drm/amdgpu: Fix function header names in amdgpu_connectors.c - drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove - drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices - drm/amdgpu: Forward VMID reservation errors - drm/amdgpu/gfx10: fix wptr reset in KGQ init - drm/amdgpu/gfx11: fix wptr reset in KGQ init - drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff - drm/amdgpu: Power up UVD 3 for FW validation (v2) - drm/amdgpu: reject gang submissions under SRIOV - drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid Priority Inversion in SRIOV - drm/amdgpu: Respect max pixel clock for HDMI and DVI-D (v2) - drm/amdgpu: Skip emit de meta data on gfx11 with rs64 enabled - drm/amdgpu/soc21: fix xclk for APUs - drm/amdgpu: use atomic functions with memory barriers for vm fault info - drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages - drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time - drm/amdkfd: Don't use sw fault filter if retry cam enabled - drm/amdkfd: fix a memory leak in device_queue_manager_init() - drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() - drm/amdkfd: fix vram allocation failure for a special case - drm/amdkfd: Handle lack of READ permissions in SVM mapping - drm/amdkfd: return -ENOTTY for unsupported IOCTLs - drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption - drm/amd/pm: Adjust si_upload_smc_data register programming (v3) - drm/amd/pm: Disable MCLK switching on SI at high pixel clocks - drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) - drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) - drm/amd/pm: Disable ULV even if unsupported (v3) - drm/amd/pm: Don't clear SI SMC table when setting power limit - drm/amd/pm: Fix si_upload_smc_data (v3) - drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland - drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) - drm/amd/pm: Use cached metrics data on aldebaran - drm/amd/pm: Use cached metrics data on arcturus - drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) - drm/amd/powerplay: Fix CIK shutdown temperature - drm/ast: Use msleep instead of mdelay for edid read - drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ - drm/bridge: cdns-dsi: Don't fail on MIPI_DSI_MODE_VIDEO_BURST - drm/bridge: cdns-dsi: Fix REG_WAKEUP_TIME value - drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path - drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts - drm/bridge: it6505: select REGMAP_I2C - drm/bridge: lt9211: Drop check for last nibble of version register - drm/etnaviv: fix flush sequence logic - drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions - drm/exynos: exynos7_drm_decon: properly clear channels during bind - drm/exynos: exynos7_drm_decon: remove ctx->suspended - drm/gma500: Fix null dereference in hdmi teardown - drm/gma500: Remove unused helper psb_fbdev_fb_setcolreg() - drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD - drm/i915/backlight: Return immediately when scale() finds invalid parameters - drm/i915: Fix conversion between clock ticks and nanoseconds - drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer - drm/i915/guc: Skip communication warning on reset in progress - drm/i915/power: fix size for for_each_set_bit() in abox iteration - drm/imx/tve: fix probe device leak - drm/mediatek: Disable AFBC support on Mediatek DRM driver - drm/mediatek: Fix CCORR mtk_ctm_s31_32_to_s1_n function issue - drm/mediatek: Fix device node reference leak in mtk_dp_dt_parse() - drm/mediatek: Fix device use-after-free on unbind - drm/mediatek: fix potential OF node use-after-free - drm/mediatek: Fix probe memory leak - drm/mediatek: Fix probe resource leaks - drm/mgag200: Fix big-endian support - drm/mgag200: fix mgag200_bmc_stop_scanout() - drm/msm/a2xx: stop over-complaining about the legacy firmware - drm/msm/a6xx: fix bogus hwcg register updates - drm/msm/a6xx: Fix GMU firmware parser - drm/msm/a6xx: Fix out of bound IO access in a6xx_get_gmu_registers - drm/msm/a6xx: Fix PDC sleep sequence - drm/msm/adreno: De-spaghettify the use of memory barriers - drm/msm/dpu: Add missing NULL pointer check for pingpong interface - drm/msm/dpu: fix incorrect type for ret - drm/msm/dsi/phy_7nm: Fix missing initial VCO rate - drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL - drm/msm: make sure to not queue up recovery more than once - drm/nouveau/dispnv50: Don't call drm_atomic_get_crtc_state() in prepare_fb - drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare - drm/nouveau: fix bad ret code in nouveau_bo_move_prep - drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() - drm/nouveau: restrict the flush page to a 32-bit address - drm/panel: novatek-nt35560: Fix invalid return value - drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel - drm/panel: sony-td4353-jdi: Enable prepare_prev_first - drm/panel: visionox-rm69299: Don't clear all mode flags - drm/pl111: Fix error handling in pl111_amba_probe - drm/radeon: delete radeon_fence_process in is_signaled, no deadlock - drm/radeon/r600_cs: clean up of dead code in r600_cs - drm/radeon: Remove __counted_by from ClockInfoArray.clockInfo[] - drm/rcar-du: dsi: Fix 1/2/3 lane support - drm/rockchip: vop2: use correct destination rectangle height check - drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb - drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies - drm/sched: Fix race in drm_sched_entity_select_rq() - drm: sti: fix device leaks at component probe - drm/sysfb: Do not dereference NULL pointer in plane reset - drm/tegra: Add call to put_pid() - drm/tegra: dc: Fix reference leak in tegra_dc_couple() - drm/tidss: Set crtc modesetting parameters with adjusted mode - drm/tidss: Use the crtc_* timings when programming the HW - drm/tilcdc: Fix removal actions in case of failed probe - drm/tilcdc: request and mapp iomem with devres - drm/ttm: Avoid NULL pointer deref for evicted BOs - drm/vgem-fence: Fix potential deadlock on release - drm/vmwgfx: Fix an error return check in vmw_compat_shader_add() - drm/vmwgfx: Fix a null-ptr access in the cursor snooper - drm/vmwgfx: Fix copy-paste typo in validation - drm/vmwgfx: Fix Use-after-free in validation - drm/vmwgfx: Use kref in vmw_bo_dirty - drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE - dt-bindings: mmc: sdhci-of-aspeed: Switch ref to sdhci-common.yaml - dt-bindings: PCI: amlogic: Fix the register name of the DBI region - dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required - dt-bindings: pinctrl: toshiba,visconti: Fix number of items in groups - dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO - dt-bindings: power: qcom,rpmpd: Add SM7150 - dt-bindings: power: qcom,rpmpd: add Turbo L5 corner - dt-bindings: power: qcom,rpmpd: document the SM8650 RPMh Power Domains - dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains - dt-bindings: power: qcom-rpmpd: split RPMh domains definitions - dt-bindings: power: rpmpd: Add MSM8917, MSM8937 and QM215 - dt-bindings: power: rpmpd: Update part number to X1E80100 - dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks - dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp - e1000: fix OOB in e1000_tbi_should_accept() - EDAC/altera: Delete an inappropriate dma_free_coherent() call - EDAC/altera: Handle OCRAM ECC enable after warm reset - EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection - EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller - EDAC/i3200: Fix a resource leak in i3200_probe1() - EDAC/mc_sysfs: Increase legacy channel support to 16 - EDAC/x38: Fix a resource leak in x38_probe1() - efi/cper: Add a new helper function to print bitmasks - efi/cper: Adjust infopfx size to accept an extra space - efi/cper: align ARM CPER type with UEFI 2.9A/2.10 specs - efi/cper: Fix cper_bits_to_str buffer handling and return value - efi/libstub: Fix page table access in 5-level to 4-level paging transition - efivarfs: fix error propagation in efivar_entry_get() - epoll: Remove ep_scan_ready_list() in comments - espintcp: fix skb leaks - eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP - ethernet: Extend device_get_mac_address() to use NVMEM - ethernet: rvu-af: Remove slash from the driver name - ethtool: Avoid overflowing userspace buffer on stats query - eventpoll: Replace rwlock with spinlock - exec: Fix incorrect type for ret - exfat: check return value of sb_min_blocksize in exfat_read_boot_sector - exfat: fix remount failure in different process environments - exfat: limit log print for IO error - Expand the type of nfs_fattr->valid - ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() - ext4: align max orphan file size with e2fsprogs limit - ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() - ext4: clear i_state_flags when alloc inode - ext4: correctly handle queries for metadata mappings - ext4: correct the checking of quota files before moving extents - ext4: detect invalid INLINE_DATA + EXTENTS flag combination - ext4: filesystems without casefold feature cannot be mounted with siphash - ext4: fix an off-by-one issue during moving extents - ext4: fix checks for orphan inodes - ext4: fix error message when rejecting the default hash - ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref - ext4: fix incorrect group number assertion in mb_check_buddy - ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() - ext4: fix string copying in parse_apply_sb_mount_options() - ext4: free orphan info with kvfree - ext4: guard against EA inode refcount underflow in xattr update - ext4: improve integrity checking in __mb_check_buddy by enhancing order-0 validation - ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() - ext4: increase IO priority of fastcommit - ext4: introduce ITAIL helper - ext4: refresh inline data size before write operations - ext4: remove unused return value of __mb_check_buddy - ext4: validate ea_ino and size in check_xattrs - ext4: verify orphan file size is not too big - ext4: wait for ongoing I/O to complete before freeing blocks - ext4: xattr: fix null pointer deref in ext4_raw_inode() - extcon: adc-jack: Cleanup wakeup source only if it was enabled - extcon: adc-jack: Fix wakeup source leaks on device unbind - f2fs: compress: change the first parameter of page_array_{alloc,free} to sbi - f2fs: compress: fix UAF of f2fs_inode_info in f2fs_free_dic - f2fs: drop inode from the donation list when the last file is closed - f2fs: ensure node page reads complete before f2fs_put_super() finishes - f2fs: fix age extent cache insertion skip on counter overflow - f2fs: fix condition in __allow_reserved_blocks() - f2fs: fix infinite loop in __insert_extent_tree() - f2fs: fix return value of f2fs_recover_fsync_data() - f2fs: fix to avoid overflow while left shift operation - f2fs: fix to avoid potential deadlock - f2fs: fix to avoid updating compression context during writeback - f2fs: fix to avoid updating zero-sized extent in extent cache - f2fs: fix to detect recoverable inode during dryrun of find_fsync_dnodes() - f2fs: fix to mitigate overhead of f2fs_zero_post_eof_page() - f2fs: fix to propagate error from f2fs_enable_checkpoint() - f2fs: fix to truncate first page in error path of f2fs_truncate() - f2fs: fix to update map->m_next_extent correctly in f2fs_map_blocks() - f2fs: fix wrong block mapping for multi-devices - f2fs: fix zero-sized extent for precache extents - f2fs: invalidate dentry cache on failed whiteout creation - f2fs: keep POSIX_FADV_NOREUSE ranges - f2fs: remove unused GC_FAILURE_PIN - f2fs: use f2fs_err_ratelimited() to avoid redundant logs - f2fs: use global inline_xattr_slab instead of per-sb slab cache - fbcon: fix integer overflow in fbcon_do_set_font - fbcon: Fix OOB access in font allocation - fbcon: Set fb_display[i]->mode to NULL when the mode is released - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds - fbdev: atyfb: Check if pll_ops->init_pll failed - fbdev: bitblit: bound-check glyph index in bit_putcs* - fbdev: Fix logic error in "offb" name match - fbdev: gbefb: fix to use physical address instead of dma address - fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS - fbdev: pxafb: Fix multiple clamped values in pxafb_adjust_timing - fbdev: ssd1307fb: fix potential page leak in ssd1307fb_probe() - fbdev: tcx.c fix mem_map to correct smem_start offset - fbdev: valkyriefb: Fix reference count leak in valkyriefb_init - filelock: add FL_RECLAIM to show_fl_flags() macro - filemap: cap PTE range to be created to allowed zero fill in folio_map_range() - firewire: core: fix overlooked update of subsystem ABI version - firewire: nosy: Fix dma_free_coherent() size - firmware: arm_scmi: Account for failed debug initialization - firmware: arm_scmi: Fix premature SCMI_XFER_FLAG_IS_RAW clearing in raw mode - firmware: arm_scmi: Fix unused notifier-block in unregister - firmware: firmware: meson-sm: fix compile-test default - firmware: imx: scu-irq: fix OF node leak in - firmware: imx: scu-irq: Init workqueue before request mbox channel - firmware: imx: scu-irq: Set mu_resource_id before get handle - firmware: meson_sm: fix device leak at probe - firmware: stratix10-svc: Add mutex in stratix10 memory management - firmware: stratix10-svc: fix bug in saving controller data - firmware: stratix10-svc: fix make htmldocs warning for stratix10_svc - Fix memory leak in posix_clock_open() - fjes: Add missing iounmap in fjes_hw_init() - flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read - flex_proportions: make fprop_new_period() hardirq safe - floppy: fix for PAGE_SIZE != 4KB - fou: Don't allow 0 for FOU_ATTR_IPPROTO. - fs/9p: Don't open remote file with APPEND mode when writeback cache is used - fs: Add 'initramfs_options' to set initramfs mount options - fs: always return zero on success from replace_fd() - fscontext: do not consume log entries when returning -EMSGSIZE - fs: ext4: change GFP_KERNEL to GFP_NOFS to avoid deadlock - fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink - fs/nfs/io: make nfs_start_io_*() killable - fs/nls: Fix inconsistency between utf8_to_utf32() and utf32_to_utf8() - fs/nls: Fix utf16 to utf8 conversion - fs/notify: call exportfs_encode_fid with s_umount - fsnotify: do not generate ACCESS/MODIFY events on child for special files - fs/ntfs3: Fix a resource leak bug in wnd_extend() - fs: ntfs3: Fix integer overflow in run_unpack() - fs/ntfs3: fix mount failure for sparse runs in run_unpack() - fs/ntfs3: Initialize allocated memory before use - fs/ntfs3: out1 also needs to put mi - fs/ntfs3: Prevent memory leaks in add sub record - fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist - fs/ntfs3: Support timestamps prior to epoch - fs/proc: fix uaf in proc_readdir_de() - fs: quota: create dedicated workqueue for quota_release_work - fs: udf: fix OOB read in lengthAllocDescs handling - ftrace: bpf: Fix IPMODIFY + DIRECT in modify_ftrace_direct() - ftrace: Fix BPF fexit with livepatch - ftrace: Fix softlockup in ftrace_module_enable - ftrace/samples: Fix function size computation - fuse: allocate ff->release_args only if release is needed - fuse: Always flush the page cache before FOPEN_DIRECT_IO write - fuse: check if copy_file_range() returns larger than requested size - fuse: fix livelock in synchronous file put from fuseblk workers - fuse: fix readahead reclaim deadlock - fuse: Invalidate the page cache after FOPEN_DIRECT_IO write - fuse: prevent overflow in copy_file_range return value - fuse: zero initialize inode private data - futex: Don't leak robust_list pointer on exec race - futex: Prevent use-after-free during requeue-PI - gcc-plugins: Remove TODO_verify_il for GCC >= 16 - gcov: add support for GCC 15 - genalloc.h: fix htmldocs warning - genirq/irq_sim: Initialize work context pointers properly - gfs2: fix freeze error handling - gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote - gfs2: fix remote evict for read-only filesystems - gfs2: Fix use of bio_chain - gpio: 104-idio-16: Define maximum valid register address offset - gpio: idio-16: Define fixed direction of the GPIO lines - gpiolib: acpi: Add quirk for Dell Precision 7780 - gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler - gpiolib: Extend software-node support to support secondary software-nodes - gpio: ljca: Fix duplicated IRQ mapping - gpio: ljca: Initialize num before accessing item in ljca_gpio_config - gpio: omap: do not register driver in probe() - gpio: pca953x: Add support for level-triggered interrupts - gpio: pca953x: fix wrong error probe return value - gpio: pca953x: handle short interrupt pulses on PCAL devices - gpio: pca953x: mask interrupts in irq shutdown - gpio: pca953x: Utilise dev_err_probe() where it makes sense - gpio: pca953x: Utilise temporary variable for struct device - gpio: pci-idio-16: Define maximum valid register address offset - gpio: regmap: add the .fixed_direction_output configuration parameter - gpio: regmap: Allow to allocate regmap-irq device - gpio: regmap: Fix memleak in error path in gpio_regmap_register() - gpio: rockchip: mark the GPIO controller as sleeping - gpio: rockchip: Stop calling pinctrl for set_direction - gpio: update Intel LJCA USB GPIO driver - gpio: wcd934x: mark the GPIO controller as sleeping - gpu: host1x: Fix race in syncpt alloc/free - gue: Fix skb memleak with inner IP protocol 0. - gve: Correct ethtool rx_dropped calculation - gve: Fix stats report corruption on queue count change - hfs: clear offset and space out of valid records in b-tree node - hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits() - hfs: make proper initalization of struct hfs_find_data - hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat() - hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent() - hfsplus: fix missing hfs_bnode_get() in __hfs_bnode_create - hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() - hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() - hfsplus: fix volume corruption issue for generic/070 - hfsplus: fix volume corruption issue for generic/073 - hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super() - hfsplus: Verify inode mode when loading from disk - hfs: validate record offset in hfsplus_bmap_alloc - HID: amd_sfh: Stop sensor before starting - HID: apple: Add SONiX AK870 PRO to non_apple_keyboards quirk list - HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) - HID: asus: add support for missing PX series fn keys - HID: asus: add Z13 folio to generic group for multitouch to work - HID: core: Harden s32ton() against conversion to 0 bits - HID: elecom: Add support for ELECOM M-XT3URBK (018F) - hid: fix I2C read buffer overflow in raw_event() for mcp2221 - HID: hid-input: Extend Elan ignore battery quirk to USB - HID: hid-input: only ignore 0 battery events for digitizers - HID: hid-ntrig: Prevent memory leak in ntrig_report_version() - HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() - HID: i2c-hid: Resolve touchpad issues on Dell systems during S4 - HID: input: map HID_GD_Z to ABS_DISTANCE for stylus/pen - HID: intel-ish-hid: Reset enum_devices_done before enumeration - HID: intel-ish-hid: Update ishtp bus match to support device ID table - HID: logitech-dj: Remove duplicate error logging - HID: logitech-hidpp: Do not assume FAP in hidpp_send_message_sync() - HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL - HID: multitouch: fix name of Stylus input devices - HID: multitouch: fix sticky fingers - HID: playstation: Center initial joystick axes to prevent spurious events - HID: quirks: Add ALWAYS_POLL quirk for VRS R295 steering wheel - HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list - HID: quirks: avoid Cooler Master MM712 dongle wakeup bug - HID: quirks: work around VID/PID conflict for 0x4c4a/0x4155 - HID: quirks: work around VID/PID conflict for appledisplay - HID: uclogic: Fix potential memory leak in error path - HID: usbhid: paper over wrong bNumDescriptor field - hrtimer: Fix softirq base check in update_needs_ipi() - hrtimer: Remove unused function - hrtimer: Rename __hrtimer_hres_active() to hrtimer_hres_active() - hrtimers: Unconditionally update target CPU base after offline timer migration - hsr: Fix supervision frame sending on HSRv0 - hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr - hsr: use rtnl lock when iterating over ports - hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex - hwmon: (dell-smm) Add support for Dell OptiPlex 7040 - hwmon: (ibmpex) fix use-after-free in high/low store - hwmon: (k10temp) Add device ID for Strix Halo - hwmon: (k10temp) Add thermal support for AMD Family 1Ah-based models - hwmon: (max16065) Use local variable to avoid TOCTOU - hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems - hwmon: (occ) Mark occ_init_attribute() as __printf - hwmon: (sbtsi_temp) AMD CPU extended temperature range support - hwmon: (sht3x) Fix error handling - hwmon: sy7636a: add alias - hwmon: sy7636a: Fix regulator_enable resource leak on error path - hwmon: (tmp401) fix overflow caused by default conversion rate value - hwmon: (w83791d) Convert macros to functions to avoid TOCTOU - hwmon: (w83l786ng) Convert macros to functions to avoid TOCTOU - hwrng: ks-sa - fix division by zero in ks_sa_rng_init - hwrng: nomadik - add ARM_AMBA dependency - hyperv-tlfs: Change prefix of generic HV_REGISTER_* MSRs to HV_MSR_* - i2c: amd-mp2: fix reference leak in MP2 PCI device - i2c: designware: Add disabling clocks when probe fails - i2c: designware: Add quirk for Intel Xe - i2c: designware: Disable SMBus interrupts to prevent storms from mis-configured firmware - i2c: designware: Fix clock issue when PM is disabled - i2c: i801: Hide Intel Birch Stream SoC TCO WDT - i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD - i2c: qcom-geni: make sure I2C hub controllers can't use SE DMA - i3c: fix refcount inconsistency in i3c_master_register - i3c: master: Inherit DMA masks and parameters from parent device - i3c: master: svc: Prevent incomplete IBI transaction - i3c: master: svc: Recycle unused IBI slot - i3c: master: svc: Use manual response for IBI events - i40e: add mask to apply valid bits for itr_idx - i40e: add max boundary check for VF filters - i40e: add validation for ring_len param - i40e: fix idx validation in config queues msg - i40e: fix idx validation in i40e_validate_queue_map - i40e: fix input validation logic for action_meta - i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path - i40e: fix scheduling in set_rx_mode - i40e: fix validation of VF state in get resources - i40e: improve VF MAC filters accounting - i40e: increase max descriptors for XL710 - i40e: remove redundant memory barrier when cleaning Tx descs - iavf: fix off-by-one issues in iavf_config_rss_reg() - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions - IB/sa: Fix sa_local_svc_timeout_ms read race - ice: Avoid detrimental cleanup for bond during interface stop - ice: Don't use %pK through printk or tracepoints - ice: initialize ring_stats->syncp - ice: stop counting UDP csum mismatch as rx_errors - idr: fix idr_alloc() returning an ID out of range - igb: fix link test skipping when interface is admin down - igc: fix race condition in TX timestamp read for register 0 - iio: accel: bmc150: Fix irq assumption regression - iio: accel: fix ADXL355 startup race condition - iio: accel: iis328dq: fix gain values - iio: adc: ad7280a: fix ad7280_store_balance_timer() - iio: adc: ad7280a: handle spi_setup() errors in probe() - iio: adc: ad9467: fix ad9434 vref mask - iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver - iio: adc: exynos_adc: fix OF populate on driver rebind - iio: adc: imx93_adc: load calibrated values even calibration failed - iio: adc: rtq6056: Correct the sign bit index - iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register - iio: adc: ti_am335x_adc: Limit step_avg to valid range for gcc complains - iio: chemical: scd4x: fix reported channel endianness - iio:common:ssp_sensors: Fix an error handling path ssp_probe() - iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() - iio: consumers: Fix offset handling in iio_convert_raw_to_processed() - iio: core: add missing mutex_destroy in iio_dev_release() - iio: core: add separate lockdep class for info_exist_lock - iio: dac: ad5360: use int type to store negative error codes - iio: dac: ad5421: use int type to store negative error codes - iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl - iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE - iio: frequency: adf4350: Fix prescaler usage. - iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended - iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume - iio: imu: inv_icm42600: reorganize DMA aligned buffers in structure - iio: imu: inv_icm42600: Simplify pm_runtime setup - iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields - iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection - iio: imu: st_lsm6dsx: Fix measurement unit for odr struct member - iio: st_lsm6dsx: Fixed calibrated timestamp calculation - iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK - iio: xilinx-ams: Unmask interrupts after updating alarms - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr - ima: Handle error code returned by ima_filter_rule_match() - ima: limit the number of ToMToU integrity violations - inet: Avoid ehash lookup race in inet_ehash_insert() - inet: ping: check sock_net() in ping_get_port() and ping_lookup() - inet: ping: Fix icmp out counting - init: handle bootloader identifier in kernel parameters - init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD - Input: atmel_mxt_ts - allow reset GPIO to sleep - Input: cros_ec_keyb - fix an invalid memory access - Input: goodix - add support for ACPI ID GDIX1003 - Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA - Input: i8042 - add quirks for MECHREVO Wujie 15X Pro - Input: i8042 - add TUXEDO InfinityBook Max Gen10 AMD to i8042 quirk table - Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table - Input: imx_sc_key - fix memory corruption on unload - Input: iqs7222 - avoid enabling unused interrupts - Input: pegasus-notetaker - fix potential out-of-bounds access - Input: ti_am335x_tsc - fix off-by-one error in wire_order validation - Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak - intel_th: fix device leak on output open() - intel_th: Fix error handling in intel_th_output_open - interconnect: debugfs: Fix incorrect error handling for NULL path - interconnect: debugfs: initialize src_node and dst_node to empty strings - interconnect: qcom: msm8996: add missing link to SLAVE_USB_HS - iomap: account for unaligned end offsets when truncating read range - iomap: adjust read range correctly for non-block-aligned positions - iomap: always run error completions in user context - iomap: factor out a iomap_dio_done helper - iommu/amd: Fix pci_segment memleak in alloc_pci_segment() - iommu/amd/pgtbl: Fix possible race while increase page table level - iommu/amd: Skip enabling command/event buffers for kdump - iommu/apple-dart: Clear stream error indicator bits for T8110 DARTs - iommu/apple-dart: fix device leak on of_xlate() - iommu/arm-smmu-qcom: Enable use of all SMR groups when running bare-metal - iommu: disable SVA when CONFIG_X86 is set - iommu/exynos: fix device leak on of_xlate() - iommufd: Don't overflow during division for dirty tracking - iommufd: Make vfio_compat's unmap succeed if the range is already empty - iommufd/selftest: Check for overflow in IOMMU_TEST_OP_ADD_RESERVED - iommu/ipmmu-vmsa: fix device leak on of_xlate() - iommu/mediatek: fix device leak on of_xlate() - iommu/mediatek: fix use-after-free on probe deferral - iommu/mediatek-v1: fix device leak on probe_device() - iommu/mediatek-v1: fix device leaks on probe() - iommu/omap: fix device leaks on probe_device() - iommu/qcom: fix device leak on of_xlate() - iommu/sun50i: fix device leak on of_xlate() - iommu/tegra: fix device leak on probe_device() - iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page() - iommu/vt-d: PRS isn't usable if PDS isn't supported - iommu/vt-d: Replace snprintf with scnprintf in dmar_latency_snapshot() - io_uring: backport io_should_terminate_tw() - io_uring: correct __must_hold annotation in io_install_fixed_file - io_uring: fix filename leak in __io_openat_prep() - io_uring: include dying ring in task_work "should cancel" state - io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop - io_uring: move local task_work in exit cancel loop - io_uring/poll: correctly handle io_poll_add() return value on update - ip6_gre: make ip6gre_header() robust - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() - ipmi: Fix handling of messages with provided receive message pointer - ipmi: Fix __scan_channels() failing to rescan channels - ipmi: Fix the race between __scan_channels() and deliver_response() - ipmi: Rework user message limit handling - ipv4: Fix reference count leak when using error routes with nexthop objects - ipv4: ip_gre: make ipgre_header() robust - ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe - ipv6: add exception routes to GC list in rt6_insert_exception - ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled - ipv6: annotate data-race in ndisc_router_discovery() - ipv6: avoid possible NULL deref in modify_prefix_route() - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() - ipv6: clear RA flags when adding a static route - ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF - ipv6: Fix use-after-free in inet6_addr_del(). - ipv6: np->rxpmtu race annotation - ipv6: use the right ifindex when replying to icmpv6 from localhost - ipvlan: Ignore PACKET_LOOPBACK in handle_mode_l2() - ipvlan: Make the addrs_lock be per port - ipvs: Defer ip_vs_ftp unregister during netns cleanup - ipvs: fix ipv4 null-ptr-deref in route error path - ipvs: Use READ_ONCE/WRITE_ONCE for ipvs->enable - irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment - irqchip/gic-v3-its: Avoid truncating memory addresses - irqchip/imx-mu-msi: Fix section mismatch - irqchip/irq-bcm7038-l1: Fix section mismatch - irqchip/irq-bcm7120-l2: Fix section mismatch - irqchip/irq-brcmstb-l2: Fix section mismatch - irqchip/loongson-pch-lpc: Use legacy domain for PCH-LPC IRQ controller - irqchip/mchp-eic: Fix error code in mchp_eic_domain_alloc() - irqchip/qcom-irq-combiner: Fix section mismatch - irqchip/riscv-intc: Add missing free() callback in riscv_intc_domain_ops - irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume - irqchip/sifive-plic: Make use of __assign_bit() - irqchip/sifive-plic: Respect mask state when setting affinity - isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe() - ixgbevf: Add support for Intel(R) E610 device - ixgbevf: fix getting link speed data for E610 devices - ixgbevf: fix mailbox API compatibility by negotiating supported features - jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted - jbd2: ensure that all ongoing I/O complete before freeing blocks - jbd2: fix the inconsistency between checksum and data in memory for journal sb - jbd2: use a per-journal lock_class_key for jbd2_trans_commit_key - jbd2: use a weaker annotation in journal handling - jfs: fix uninitialized waitqueue in transaction manager - jfs: Verify inode mode when loading from disk - kallsyms: Fix wrong "big" kernel symbol type read from procfs - kasan: fix GCC mem-intrinsic prefix with sw tags - kasan: refactor pcpu kasan vmalloc unpoison - kbuild: uapi: Strip comments before size type check - kbuild: Use objtree for module signing key path - kconfig: fix static linking of nconf - kconfig/mconf: Initialize the default locale at startup - kconfig/nconf: Initialize the default locale at startup - kernel.h: Move ARRAY_SIZE() to a separate header - kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in sys_prlimit64() paths - kernfs: Fix UAF in polling when open file is released - KEYS: trusted: Fix a memory leak in tpm2_load_cmd - KEYS: trusted_tpm1: Compare HMAC values in constant time - KEYS: X.509: Fix Basic Constraints CA flag parsing - kmsan: fix out-of-bounds access to shadow memory - ksmbd: add max ip connections parameter - ksmbd: browse interfaces list on FSCTL_QUERY_INTERFACE_INFO IOCTL - ksmbd: close accepted socket when per-IP limit rejects connection - ksmbd: fix buffer validation by including null terminator size in EA length - ksmbd: fix error code overwriting in smb2_get_info_filesystem() - ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths - ksmbd: Fix memory leak in get_file_all_info() - ksmbd: fix null pointer dereference in alloc_preauth_hash() - ksmbd: Fix race condition in RPC handle list access - ksmbd: fix recursive locking in RPC handle list access - ksmbd: Fix refcount leak when invalid session is found on session lookup - ksmbd: fix use-after-free in ksmbd_session_rpc_open - ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency - ksmbd: fix use-after-free in session logoff - ksmbd: ipc: fix use-after-free in ipc_msg_send_request - ksmbd: skip lock-range check on equal size to avoid size==0 underflow - ksmbd: smbd: fix dma_unmap_sg() nents - ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer - ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size - ksmbd: transport_ipc: validate payload size before reading handle - ksmbd: use sock_create_kern interface to create kernel socket - ksmbd: vfs: fix race on m_flags in vfs_cache - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item - ktest.pl: Fix uninitialized var in config-bisect.pl - kunit: kasan_test: disable fortify string checker on kasan_strings() test - KVM: arm64: Check the untrusted offset in FF-A memory share - KVM: arm64: Fix softirq masking in FPSIMD register saving sequence - KVM: Don't clobber irqfd routing type when deassigning irqfd - KVM: nSVM: Always recalculate LBR MSR intercepts in svm_update_lbrv() - KVM: nSVM: Avoid incorrect injection of SVM_EXIT_CR0_SEL_WRITE - KVM: nSVM: Clear exit_code_hi in VMCB when synthesizing nested VM-Exits - KVM: nSVM: Fix and simplify LBR virtualization handling with nested - KVM: nSVM: Propagate SVM_EXIT_CR0_SEL_WRITE correctly for LMSW emulation - KVM: nSVM: Set exit_code_hi to -1 when synthesizing SVM_EXIT_ERR (failed VMRUN) - KVM: nVMX: Immediately refresh APICv controls as needed on nested VM-Exit - KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures - KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced - KVM: SVM: Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2 - KVM: SVM: Fix redundant updates of LBR MSR intercepts - KVM: SVM: Introduce svm_recalc_lbr_msr_intercepts() - KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated - KVM: SVM: Mark VMCB_NPT as dirty on nested VMRUN - KVM: SVM: Mark VMCB_PERM_MAP as dirty on nested VMRUN - KVM: SVM: Set synthesized TSA CPUID flags - KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid - KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active - KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O - KVM: x86: Explicitly set new periodic hrtimer expiration in apic_timer_fn() - KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer - KVM: x86: WARN if hrtimer callback for periodic APIC timer fires with period=0 - l2tp: avoid one data-race in l2tp_tunnel_del_work() - lan966x: Fix sleeping in atomic context - leds: flash: leds-qcom-flash: Update torch current clamp setting - leds: led-class: Only Add LED to leds_list when it is fully ready - leds: leds-lp50xx: Allow LED 0 to be added to module bank - leds: leds-lp50xx: Enable chip before any communication - leds: leds-lp50xx: LP5009 supports 3 modules for a total of 9 LEDs - leds: netxbig: Fix GPIO descriptor leak in error paths - leds: spi-byte: Use devm_led_classdev_register_ext() - libbpf: Fix powerpc's stack register definition in bpf_tracing.h - libbpf: Fix reuse of DEVMAP - libceph: fix invalid accesses to ceph_connection_v1_info - libceph: fix potential use-after-free in have_mon_and_osd_map() - libceph: make calc_target() set t->paused, not just clear it - libceph: make decode_pool() more resilient against corrupted osdmaps - libceph: make free_choose_arg_map() resilient to partial allocation - libceph: prevent potential out-of-bounds reads in handle_auth_done() - libceph: prevent potential out-of-bounds writes in handle_auth_session_key() - libceph: replace BUG_ON with bounds check for map->max_osd - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() - libceph: reset sparse-read state in osd_fault() - libceph: return the handler error from mon_handle_auth_done() - lib/crypto: aes: Fix missing MMU protection for AES S-box - lib/crypto: arm/curve25519: Disable on CPU_BIG_ENDIAN - lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older - lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC - lib/crypto: x86/blake2s: Fix 32-bit arg treated as 64-bit - lib/genalloc: fix device leak in of_gen_pool_get() - libperf cpumap: Fix perf_cpu_map__max for an empty/NULL map - libperf event: Ensure tracing data is multiple of 8 sized - lib/vsprintf: Check pointer before dereferencing in time_and_date() - livepatch: Match old_sympos 0 and 1 in klp_find_func() - lkdtm: fortify: Fix potential NULL dereference on kmalloc failure - lockd: fix vfs_test_lock() calls - locking/spinlock/debug: Fix data-race in do_raw_write_lock - LoongArch: Add machine_kexec_mask_interrupts() implementation - LoongArch: Add more instruction opcodes and emit_* helpers - LoongArch: Add new PCI ID for pci_fixup_vgadev() - LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled - LoongArch: Automatically disable kaslr if boot from kexec_file - LoongArch: BPF: Sign extend kfunc call arguments - LoongArch: BPF: Zero-extend bpf_tail_call() index - LoongArch: Check the return value when creating kobj - LoongArch: Correct the calculation logic of thread_count - LoongArch: Don't panic if no valid cache info for PCI - LoongArch: Enable exception fixup for specific ADE subcode - LoongArch: Fix build errors for CONFIG_RANDSTRUCT - LoongArch: Fix PMU counter allocation for mixed-type event groups - LoongArch: Init acpi_gbl_use_global_lock to false - LoongArch: Let {pte,pmd}_modify() record the status of _PAGE_DIRTY - LoongArch: Mask all interrupts during kexec/kdump - LoongArch: Refactor register restoration in ftrace_common_return - LoongArch: Remove CONFIG_ACPI_TABLE_UPGRADE in platform_init() - LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED - LoongArch: Update help info of ARCH_STRICT_ALIGN - LoongArch: Use correct accessor to read FWPC/MWPC - LoongArch: Use physical addresses for CSR_MERRENTRY/CSR_TLBRENTRY - LoongArch: Use __pmd()/__pte() for swap entry conversions - LoongArch: Use UAPI types in ptrace UAPI header - LoongArch: Use unsigned long for _end and _text - loop: Avoid updating block size under exclusive owner - m68k: bitops: Fix find_*_bit() signatures - macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse - macvlan: fix error recovery in macvlan_common_newlink() - macvlan: fix possible UAF in macvlan_forward_source() - mailbox: mailbox-test: Fix debugfs_create_dir error checking - mailbox: pcc: don't zero error register - mailbox: pcc: Refactor error handling in irq handler into separate function - mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes - mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call - maple_tree: fix tracepoint string pointers - md/raid5: fix IO hang when array is broken with IO inflight - media: adv7180: Add missing lock in suspend callback - media: adv7180: Do not write format to device in set_fmt - media: adv7180: Only validate format in querystd - media: adv7842: Avoid possible out-of-bounds array accesses in adv7842_cp_log_status() - media: amphion: Add a frame flush mode for decoder - media: amphion: Cancel message work before releasing the VPU core - media: amphion: Delete v4l2_fh synchronously in .release() - media: amphion: Make some vpu_v4l2 functions static - media: amphion: Remove vpu_vb_is_codecconfig - media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove - media: cec: Fix debugfs leak on bus_register() failure - media: cx18: Add missing check after DMA map - media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg() - media: fix uninitialized symbol warnings - media: i2c: ADV7604: Remove redundant cancel_delayed_work in probe - media: i2c: adv7842: Remove redundant cancel_delayed_work in probe - media: i2c: imx214: Fix link frequency validation - media: i2c: Kconfig: Ensure a dependency on HAVE_CLK for VIDEO_CAMERA_SENSOR - media: i2c: mt9v111: fix incorrect type for ret - media: i2c: og01a1b: Specify monochrome media bus format instead of Bayer - media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe - media: imon: make send_packet() more robust - media: lirc: Fix error handling in lirc_register() - media: mc: Clear minor number before put device - media: mc: Fix MUST_CONNECT handling for pads with no links - media: mediatek: vcodec: Fix a reference leak in mtk_vcodec_fw_vpu_init() - media: mediatek: vcodec: Use spinlock for context list protection lock - media: msp3400: Avoid possible out-of-bounds array accesses in msp3400c_thread() - media: nxp: imx8-isi: Drop unused argument to mxc_isi_channel_chain() - media: nxp: imx8-isi: m2m: Fix streaming cleanup on release - media: ov08x40: Fix the horizontal flip control - media: pci: ivtv: Add missing check after DMA map - media: pci: ivtv: Don't create fake v4l2_fh - media: pvrusb2: Fix incorrect variable used in trace message - media: rc: fix races with imon_disconnect() - media: rc: st_rc: Fix reset control resource leak - media: redrat3: use int type to store negative error codes - media: renesas: rcar_drif: fix device node reference leak in rcar_drif_bond_enabled - media: rj54n1cb0c: Fix memleak in rj54n1_probe() - media: samsung: exynos4-is: fix potential ABBA deadlock on init - media: st-delta: avoid excessive stack usage - media: TDA1997x: Remove redundant cancel_delayed_work in probe - media: tuner: xc5000: Fix use-after-free in xc5000_release - media: tunner: xc5000: Refactor firmware load - media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID - media: uvcvideo: Use heuristic to find stream entity - media: v4l2-mem2mem: Fix outdated documentation - media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try() - media: venus: firmware: Use correct reset sequence for IRIS2 - media: verisilicon: Explicitly disable selection api ioctls for decoders - media: verisilicon: Fix CPU stalls on G2 bus error - media: verisilicon: g2: Use common helpers to compute chroma and mv offsets - media: verisilicon: Protect G2 HEVC decoder against invalid DPB index - media: verisilicon: Store chroma and motion vectors offset - media: videobuf2: Fix device reference leak in vb2_dc_alloc error path - media: vidtv: initialize local pointers upon transfer of memory ownership - media: vpif_capture: fix section mismatch - media: vpif_display: fix section mismatch - media: zoran: Remove zoran_fh structure - mei: me: add nova lake point S DID - mei: me: add wildcat lake P DID - mei: trace: treat reg parameter as string - memcg: fix data-race KCSAN bug in rstats - memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe - memory tiering: add abstract distance calculation algorithms management - memory tiers: use default_dram_perf_ref_source in log message - memstick: Add timeout to prevent indefinite waiting - mfd: altera-sysmgr: Fix device leak on sysmgr regmap lookup - mfd: da9055: Fix missing regmap_del_irq_chip() in error path - mfd: da9063: Split chip variant reading in two bus transactions - mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type - mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value - mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag - mfd: madera: Work around false-positive -Wininitialized warning - mfd: max77620: Fix potential IRQ chip conflict when probing two devices - mfd: mt6358-irq: Fix missing irq_domain_remove() in error path - mfd: mt6397-irq: Fix missing irq_domain_remove() in error path - mfd: rz-mtu3: Fix MTU5 NFCR register offset - mfd: stmpe-i2c: Add missing MODULE_LICENSE - mfd: stmpe: Remove IRQ domain upon removal - mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() - migrate: correct lock ordering for hugetlb file folios - minixfs: Verify inode mode when loading from disk - minmax: add a few more MIN_T/MAX_T users - minmax: avoid overly complicated constant expressions in VM code - minmax: don't use max() in situations that want a C constant expression - minmax: fix up min3() and max3() too - minmax.h: add whitespace around operators and after commas - minmax.h: move all the clamp() definitions after the min/max() ones - minmax.h: reduce the #define expansion of min(), max() and clamp() - minmax.h: remove some #defines that are only expanded once - minmax.h: simplify the variants of clamp() - minmax.h: update some comments - minmax.h: use BUILD_BUG_ON_MSG() for the lo < hi test in clamp() - minmax: improve macro expansion and type checking - minmax: make generic MIN() and MAX() macros available everywhere - minmax: simplify and clarify min_t()/max_t() implementation - minmax: simplify min()/max()/clamp() implementation - MIPS: Fix a reference leak bug in ip22_check_gio() - mips: lantiq: danube: add missing device_type in pci node - mips: lantiq: danube: add missing properties to cpu node - mips: lantiq: danube: add model to EASY50712 dts - mips: lantiq: danube: rename stp node on EASY50712 reference board - mips: lantiq: xway: sysctrl: rename stp clock - MIPS: Malta: Fix !EVA SOC-it PCI MMIO - MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering - MIPS: mm: kmalloc tlb_vpn array to avoid stack overflow - MIPS: mm: Prevent a TLB shutdown on initial uniquification - misc: fastrpc: Add missing dev_err newlines - misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup - misc: fastrpc: Fix fastrpc_map_lookup operation - misc: fastrpc: fix possible map leak in fastrpc_put_args - misc: fastrpc: Save actual DMA size in fastrpc_map structure - misc: fastrpc: Skip reference for DMA handles - misc: genwqe: Fix incorrect cmd field being reported in error - mISDN: annotate data-race around dev->work - mlxsw: spectrum: Fix memory leak in mlxsw_sp_flower_stats() - mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats - mlxsw: spectrum_router: Fix neighbour use-after-free - mlxsw: spectrum_router: Fix possible neighbour reference count leak - mm: add folio_expected_ref_count() for reference count calculation - mm/balloon_compaction: convert balloon_page_delete() to balloon_page_finalize() - mm/balloon_compaction: we cannot have isolated pages in the balloon list - mmc: core: SPI mode remove cmd7 - mmc: host: renesas_sdhi: Fix the actual clock - mmc: mvsdio: Fix dma_unmap_sg() nents value - mm: consider non-anon swap cache folios in folio_expected_ref_count() - mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function - mmc: sdhci-cadence: add Mobileye eyeQ support - mmc: sdhci-esdhc-imx: add alternate ARCH_S32 dependency to Kconfig - mmc: sdhci-msm: Avoid early clock doubling during HS400 transition - mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card - mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4 - mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode - mm/damon/core: set quota->charged_from to jiffies at first charge window - mm/damon/lru_sort: avoid divide-by-zero in damon_lru_sort_apply_parameters() - mm/damon/reclaim: avoid divide-by-zero in damon_reclaim_apply_parameters() - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure - mm/damon/sysfs: fix use-after-free in state_show() - mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup failure - mm/damon/sysfs-scheme: cleanup quotas subdirs on scheme dir setup failure - mm/damon/tests/core-kunit: handle allocation failures in damon_test_regions() - mm/damon/tests/core-kunit: handle alloc failres in damon_test_new_filter() - mm/damon/tests/core-kunit: handle alloc failure on damon_test_set_attrs() - mm/damon/tests/core-kunit: handle alloc failures in damon_test_ops_registration() - mm/damon/tests/core-kunit: handle alloc failures in damon_test_set_regions() - mm/damon/tests/core-kunit: handle alloc failures in damon_test_update_monitoring_result() - mm/damon/tests/core-kunit: handle alloc failures on damon_test_merge_two() - mm/damon/tests/core-kunit: handle alloc failures on damon_test_split_at() - mm/damon/tests/core-kunit: handle alloc failures on damon_test_split_regions_of() - mm/damon/tests/core-kunit: handle alloc failures on damos_test_filter_out() - mm/damon/tests/core-kunit: handle alloc failures on dasmon_test_merge_regions_of() - mm/damon/tests/core-kunit: handle memory alloc failure from damon_test_aggregate() - mm/damon/tests/core-kunit: handle memory failure from damon_test_target() - mm/damon/tests/vaddr-kunit: handle alloc failures in damon_test_split_evenly_fail() - mm/damon/tests/vaddr-kunit: handle alloc failures on damon_do_test_apply_three_regions() - mm/damon/tests/vaddr-kunit: handle alloc failures on damon_test_split_evenly_succ() - mm/damon/vaddr: do not repeat pte_offset_map_lock() until success - mm: fix arithmetic for bdi min_ratio - mm: fix arithmetic for max_prop_frac when setting max_ratio - mm: folio_may_be_lru_cached() unless folio_test_large() - mm/gup: check ref_count instead of lru before migration - mm/gup: local lru_add_drain() to avoid lru_add_drain_all() - mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked" - mm: hugetlb: avoid soft lockup when mprotect to large memory area - mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 - mm/hugetlb: fix folio is still mapped when deleted - mm: introduce and use {pgd,p4d}_populate_kernel() - mm, kfence: describe @slab parameter in __kfence_obj_info() - mm/kfence: randomize the freelist on initialization - mm/khugepaged: convert hpage_collapse_scan_pmd() to use folios - mm/khugepaged: fix the address passed to notifier on testing young - mm: kmsan: fix poisoning of high-order non-compound pages - mm/ksm: fix exec/fork inheritance support for prctl - mm/ksm: fix flag-dropping behavior in ksm_madvise - mm/ksm: fix incorrect KSM counter handling in mm_struct during fork - mm: memcg: add per-memcg zswap writeback stat - mm: memcg: add THP swap out info for anonymous reclaim - mm: memcg: change flush_next_time to flush_last_time - mm: memcg: make stats flushing threshold per-memcg - mm: memcg: move vmstats structs definition above flushing code - mm: memcg: optimize parent iteration in memcg_rstat_updated() - mm: memcg: restore subtree stats flushing - mm/memory: do not populate page table entries beyond i_size - mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory - mm/memory-tier: fix abstract distance calculation overflow - mm/mempool: fix poisoning order>0 pages with HIGHMEM - mm/mempool: replace kmap_atomic() with kmap_local_page() - mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize() - mm: migrate_device: use more folio in migrate_device_finalize() - mm/mm_init: fix hash table order logging in alloc_large_system_hash() - mm/page_alloc: make percpu_pagelist_high_fraction reads lock-free - mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations - mm/page_alloc: prevent pcp corruption with SMP=n - mm, percpu: do not consider sleepable allocations atomic - mm/rmap: fix two comments related to huge_pmd_unshare() - mm/secretmem: fix use-after-free race in fault handler - mm: simplify folio_expected_ref_count() - mm/truncate: unmap large folio on split failure - mm: workingset: move the stats flush into workingset_test_recent() - most: usb: fix double free on late probe failure - most: usb: Fix use-after-free in hdm_disconnect - most: usb: hdm_probe: Fix calling put_device() before device initialization - mptcp: avoid deadlock on fallback while reinjecting - mptcp: avoid dup SUB_CLOSED events after disconnect - mptcp: avoid unneeded subflow-level drops - mptcp: clear scheduled subflows on retransmit - mptcp: decouple mptcp fastclose from tcp close - mptcp: Disallow MPTCP subflows from sockmap - mptcp: do not fallback when OoO is present - mptcp: drop bogus optimization in __mptcp_check_push() - mptcp: ensure context reset on disconnect() - mptcp: fallback earlier on simult connection - mptcp: fix ack generation for fallback msk - mptcp: fix a race in mptcp_pm_del_add_timer() - mptcp: fix duplicate reset on fastclose - mptcp: fix MSG_PEEK stream corruption - mptcp: fix premature close in case of fallback - mptcp: Fix proto fallback detection with BPF - mptcp: fix race condition in mptcp_schedule_work() - mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() - mptcp: Initialise rcv_mss before calling tcp_send_active_reset() in mptcp_do_fastclose(). - mptcp: only reset subflow errors when propagated - mptcp: pm: ignore unknown endpoint flags - mptcp: pm: in-kernel: C-flag: handle late ADD_ADDR - mptcp: pm: in-kernel: usable client side with C-flag - mptcp: pm: nl: announce deny-join-id0 flag - mptcp: propagate shutdown to subflows when possible - mptcp: restore window probe - mptcp: schedule rtx timer only after pushing data - mptcp: set remote_deny_join_id0 on SYN recv - mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN - mptcp: tfo: record 'deny join id0' info - mt76: mt7615: Fix memory leak in mt7615_mcu_wtbl_sta_add() - mtdchar: fix integer overflow in read/write ioctls - mtd: lpddr_cmds: fix signed shifts in lpddr_cmds - mtd: nand: raw: atmel: Fix comment in timings preparation - mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing - mtd: nand: relax ECC parameter validation check - mtd: onenand: Pass correct pointer to IRQ handler - mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands - mtd: rawnand: cadence: fix DMA device NULL pointer dereference - mtd: rawnand: fsmc: Default to autodetect buswidth - mtd: rawnand: lpc32xx_slc: fix GPIO descriptor leak on probe error and remove - mtd: rawnand: renesas: Handle devm_pm_runtime_enable() errors - mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer - mtd: rawnand: stm32_fmc2: fix ECC overwrite - nbd: defer config put in recv_work - nbd: defer config unlock in nbd_genl_connect - nbd: restrict sockets to TCP and UDP - net: 3com: 3c59x: fix possible null dereference in vortex_probe1() - net/9p: fix double req put in p9_fd_cancelled - net: Add locking to protect skb->dev access in ip_output - net: add skb_header_pointer_careful() helper - net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS - net: allow small head cache usage with large MAX_SKB_FRAGS values - net: Allow to use SMP threads for backlog NAPI. - net: aquantia: Add missing descriptor cache invalidation on ATL2 - net: atlantic: fix fragment overflow handling in RX path - net: bcmasp: fix early exit leak with fixed phy - net: bonding: fix possible peer notify event loss or dup issue - net: bridge: annotate data-races around fdb->{updated,used} - net: bridge: Bounce invalid boolopts - net: bridge: Describe @tunnel_hash member in net_bridge_vlan_group struct - net: bridge: fix MST static key usage - net: bridge: fix static key check - net: bridge: fix use-after-free due to MST port state bypass - net: bridge: Install FDB for bridge MAC on VLAN 0 - net: bridge: Set BR_FDB_ADDED_BY_USER early in fdb_add_entry - net: call cond_resched() less often in __release_sock() - net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV. - net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts - net/cls_cgroup: Fix task_get_classid() during qdisc run - netdev: preserve NETIF_F_ALL_FOR_ALL across TSO updates - netdevsim: add Makefile for selftests - netdevsim: fix a race issue related to the operation on bpf_bound_progs list - net: dlink: handle copy_thresh allocation failure - net: dlink: handle dma_map_single() failure properly - net: don't touch dev->stats in BPF redirect paths - net: dsa: b53: fix enabling ip multicast - net: dsa: b53: fix resetting speed and pause on forced link - net: dsa: b53: skip multicast entries for fdb_dump() - net: dsa: b53: stop reading ARL entries if search is done - net: dsa: fix off-by-one in maximum bridge ID determination - net: dsa: hellcreek: fix missing error handling in LED registration - net: dsa: improve shutdown sequence - net: dsa: lantiq_gswip: do also enable or disable cpu port - net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() - net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port - net: dsa: microchip: common: Fix checks on irq_find_mapping() - net: dsa: microchip: Fix reserved multicast address table programming - net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}() - net: dsa: microchip: Free previously initialized ports on init failures - net: dsa: microchip: lan937x: Fix RGMII delay tuning - net: dsa: microchip: ptp: Fix checks on irq_find_mapping() - net: dsa: sja1105: fix kasan out-of-bounds warning in sja1105_table_delete_entry() - net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic - net: dsa: sja1105: simplify static configuration reload - net: dsa: tag_brcm: legacy: fix untagged rx on unbridged ports for bcm63xx - net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable - net: enetc: correct the value of ENETC_RXB_TRUESIZE - net: enetc: do not transmit redirected XDP frames when the link is down - net: enetc: fix build warning when PAGE_SIZE is greater than 128K - net: enetc: fix the deadlock of enetc_mdio_lock - net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi() - net: ethernet: microchip: sparx5: make it selectable for ARCH_LAN969X - net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error - net: fec: cancel perout_timer when PEROUT is disabled - net: fec: correct rx_bytes statistic for the case SHIFT16 is set - net: fec: do not allow enabling PPS and PEROUT simultaneously - net: fec: do not register PPS event for PEROUT - net: fec: do not update PEROUT if it is enabled - net: fec: ERR007885 Workaround for XDP TX path - net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() - netfilter: flowtable: check for maximum number of encapsulations in bridge vlan - netfilter: ipset: Remove unused htable_bits in macro ahash_region - netfilter: nf_conncount: fix leaked ct in error paths - netfilter: nf_conncount: rework API to use sk_buff directly - netfilter: nf_conncount: update last_gc only when GC has been performed - netfilter: nf_reject: don't reply to icmp error messages - netfilter: nf_tables: allow loads only when register is initialized - netfilter: nf_tables: avoid chain re-validation if possible - netfilter: nf_tables: drop unused 3rd argument from validate callback ops - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() - netfilter: nf_tables: fix memory leak in nf_tables_newrule() - netfilter: nf_tables: missing objects with no memcg accounting - netfilter: nf_tables: pass context structure to nft_parse_register_load - netfilter: nf_tables: reject duplicate device on updates - netfilter: nf_tables: remove redundant chain validation on register store - netfilter: nft_connlimit: update the count if add was skipped - netfilter: nft_objref: validate objref and objrefmap expressions - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation - netfilter: nft_synproxy: avoid possible data-race on update operation - netfilter: replace -EEXIST with -EBUSY - net: fix memory leak in skb_segment_list for GRO packets - net: fix NULL pointer dereference in l3mdev_l3_rcv - net: Fix null-ptr-deref by sock_lock_init_class_and_name() and rmmod. - net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe - net: gro: fix outer network offset - net/handshake: duplicate handshake cancellations leak socket - net/handshake: Fix memory leak in tls_handshake_accept() - net/handshake: restore destructor on submit failure - net: hns3: add VLAN id validation before using - net: hns3: fix data race in hns3_fetch_stats - net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue - net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M - net: hns3: return error code when function fails - net: hns3: using the num_tqps in the vf driver to apply for resources - net: hns3: using the num_tqps to check whether tqp_index is out of range when vf get ring info from mbx - net: hsr: Add support for MC filtering at the slave device - net: hsr: Add VLAN CTAG filter support - net/hsr: fix NULL pointer dereference in prp_get_untagged_frame() - net: hv_netvsc: reject RSS hash key programming without RX indirection table - net: intel: fm10k: Fix parameter idx set but not used - net/ip6_tunnel: Prevent perpetual tunnel growth - net: ipv6: fix field-spanning memcpy warning in AH output - net/ipv6: Remove expired routes with a separated list of routes. - net: lan743x: Allocate rings outside ZONE_DMA - net: lan966x: Fix the initialization of taprio - net: libwx: fix device bus LAN ID - net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup - net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup - net: liquidio: fix overflow in octeon_init_instr_queue() - net: liquidio: Initialize netdev pointer before queue setup - net: macb: avoid dealing with endianness in macb_set_hwaddr() - net: macb: fix unregister_netdev call order in macb_remove() - net: macb: Relocate mog_init_rings() callback from macb_mac_link_up() to macb_open() - net: marvell: prestera: fix NULL dereference on devlink_alloc() failure - net: mdio: aspeed: add dummy read to avoid read-after-write issue - net: mdiobus: release reset_gpio in mdiobus_unregister_device() - net: mdio: fix resource leak in mdiobus_register_device() - net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() - net/mlx5: Clean up only new IRQ glue on request_irq() failure - net/mlx5: Drain firmware reset in shutdown callback - net/mlx5e: Account for netdev stats in ndo_get_stats64 - net/mlx5e: Consider aggregated port speed during rate configuration - net/mlx5e: Don't print error message due to invalid module - net/mlx5e: Don't query FEC statistics when FEC is disabled - net/mlx5e: Fix maxrate wraparound in threshold between units - net/mlx5e: Fix potentially misleading debug message - net/mlx5e: Fix return value in case of module EEPROM read error - net/mlx5e: Fix validation logic in rate limiting - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps - net/mlx5e: Harden uplink netdev access against device unbind - net/mlx5e: Report rx_discards_phy via rx_dropped - net/mlx5e: Restore destroying state bit after profile cleanup - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() - net/mlx5e: Reuse per-RQ XDP buffer to avoid stack zeroing overhead - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ - net/mlx5e: SHAMPO, Fix skb size check for 64K pages - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload - net/mlx5e: TC, delete flows only for existing peers - net/mlx5e: Use extack in get module eeprom by page callback - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() - net/mlx5: fw reset, add reset timeout work - net/mlx5: fw reset, clear reset requested on drain_fw_reset - net/mlx5: fw_tracer, Handle escaped percent properly - net/mlx5: fw_tracer, Validate format string parameters - net/mlx5: pagealloc: Fix reclaim race during command interface teardown - net/mlx5: Serialize firmware reset with devlink - net/mlx5: Skip HotPlug check on sync reset using hot reset - net/mlx5: Stop polling for command response if interface goes down - net: mlxsw: linecards: fix missing error check in mlxsw_linecard_devlink_info_get() - net: mscc: ocelot: Fix crash when adding interface under a lag - net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() - net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure - net: netpoll: ensure skb_pool list is always initialized - net: netpoll: fix incorrect refcount handling causing incorrect cleanup - net: netpoll: flush skb pool during cleanup - net: netpoll: Individualize the skb pool - net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write - net: nfc: nci: Add parameter validation for packet data - net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms - net: openvswitch: Avoid needlessly taking the RTNL on vport destroy - net: openvswitch: fix data race in ovs_vport_get_upcall_stats - net: openvswitch: fix middle attribute validation in push_nsh() action - net: openvswitch: remove never-working support for setting nsh fields - net: phy: adin1100: Fix software power-down ready condition - net: phy: allow MDIO bus PM ops to start/stop state machine for phylink-controlled PHY - net: phy: clear link parameters on admin link down - net: phy: dp83867: Disable EEE support as not implemented - net: phy: fixed_phy: let fixed_phy_unregister free the phy_device - net: phy: fix phy_uses_state_machine() - net: phy: marvell: Fix 88e1510 downshift counter errata - net: phy: mediatek: fix nvmem cell reference leak in mt798x_phy_calibration - net: phy: move phy_link_change() prior to mdio_bus_phy_may_suspend() - net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY - netpoll: remove netpoll_srcu - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() - net: ravb: Enforce descriptor type ordering - net: ravb: Ensure memory write completes before ringing TX doorbell - net: Remove conditional threaded-NAPI wakeup based on task state. - net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF. - net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer - netrom: fix double-free in nr_route_frame() - netrom: Fix memory leak in nr_sendmsg() - net: rose: fix invalid array index in rose_kill_by_device() - net: sched: act_connmark: initialize struct tc_ife to fix kernel leak - net_sched: act_connmark: use RCU in tcf_connmark_dump() - net/sched: act_ife: avoid possible NULL deref - net/sched: act_ife: convert comma to semicolon - net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak - net/sched: cls_u32: use skb_header_pointer_careful() - net/sched: Enforce that teql can only be used as root qdisc - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change - net/sched: ets: Remove drr class from the active list if it changes to strict - net_sched: limit try_bulk_dequeue_skb() batches - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop - net/sched: sch_qfq: do not free existing class in qfq_change_class() - net/sched: sch_qfq: Fix null-deref in agg_dequeue - net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset - net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() - net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module - net: sh_eth: Disable WoL if system can not suspend - net/smc: fix mismatch between CLC header and proposal - net: sock: fix hardened usercopy panic in sock_recv_errqueue - net: stmmac: Check stmmac_hw_setup() in stmmac_resume() - net: stmmac: Correctly handle Rx checksum offload errors - net: stmmac: dwmac-rk: Fix disabling set_clock_selection - net: stmmac: Fix accessing freed irq affinity_hint - net: stmmac: fix rx limit check in stmmac_rx_zc() - net: stmmac: fix the crash issue for zero copy XDP_TX action - net: stmmac: make sure that ptp_rate is not 0 before configuring EST - net: sxgbe: fix potential NULL dereference in sxgbe_rx() - net: tls: Cancel RX async resync request on rcd_delta overflow - net: tls: wait for async completion on last message - net: Tree wide: Replace xdp_do_flush_map() with xdp_do_flush(). - net: update netdev_lock_{type,name} - net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups - net: usb: asix_devices: Check return value of usbnet_get_endpoints - net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock - net: usb: asix: validate PHY address before use - net: usb: dm9601: remove broken SR9700 support - net: usb: lan78xx: Add error handling to lan78xx_init_mac_address - net: usb: lan78xx: fix use of improperly initialized dev->chipid in lan78xx_reset - net: usb: pegasus: fix memory leak in update_eth_regs_async() - net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup - net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast - net: usb: rtl8150: Fix frame padding - net: usb: rtl8150: fix memory leak on usb_submit_urb() failure - net: usb: sr9700: fix incorrect command used to write single register - net: usb: sr9700: support devices with virtual driver CD - net: vlan: sync VLAN features with lower device - net: When removing nexthops, don't call synchronize_net if it is not necessary - net: wwan: iosm: Fix memory leak in ipc_mux_deinit() - net: wwan: t7xx: fix potential skb->frags overflow in RX path - nexthop: Forbid FDB status change while nexthop is in a group - nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). - nfc: nci: Fix race between rfkill and nci_unregister_device(). - nfc: pn533: Fix error code in pn533_acr122_poweron_rdr() - nfp: fix RSS hash key size when RSS is not supported - NFS4: Fix state renewals missing after boot - nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode dereferencing - NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags - NFS: Avoid changing nlink when file removes and attribute updates race - NFS: check if suid/sgid was cleared after a write as needed - nfs_common: factor out nfs_errtbl and nfs_stat_to_errno - NFSD/blocklayout: Fix minlength check in proc_layoutget - NFSD: Clear SECLABEL in the suppattr_exclcreat bitmap - nfsd: convert to new timestamp accessors - nfsd: decouple the xprtsec policy check from check_nfsd_access() - NFSD: Define a proc_layoutcommit for the FlexFiles layout type - nfsd: don't ignore the return code of svc_proc_register() - nfsd: Drop the client reference in client_states_open() - nfsd: Fix a regression in nfsd_setattr() - NFSD: Fix crash in nfsd4_read_release() - NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() - NFSD: Fix last write offset handling in layoutcommit - nfsd: Fix NFSv3 atomicity bugs in nfsd_setattr() - NFSD: Fix permission check for read access to executable-only files - NFSD: fix race between nfsd registration and exports_proc - NFSD: free copynotify stateid in nfs4_free_ol_stateid() - nfsd: Mark variable __maybe_unused to avoid W=1 build break - NFSD: Minor cleanup in layoutcommit processing - NFSD: nfsd_unlink() clobbers non-zero status returned from fh_fill_pre_attrs() - nfsd: nfserr_jukebox in nlm_fopen should lead to a retry - NFSD: NFSv4 file creation neglects setting ACL - nfsd: provide locking for v4_end_grace - NFSD: Remove NFSERR_EAGAIN - nfsd: Replace clamp_t in nfsd4_get_drc_mem() - NFSD: Rework encoding and decoding of nfsd4_deviceid - nfsd: set security label during create operations - NFSD: use correct reservation type in nfsd4_scsi_fence_client - NFS: enable nconnect for RDMA - NFS: Fix inheritance of the block sizes when automounting - NFS: Fix up the automount fs_context to use the correct cred - NFS: Initialise verifiers for visible dentries in nfs_atomic_open() - NFS: Initialise verifiers for visible dentries in readdir and lookup - NFS: Serialise O_DIRECT i/o and truncate() - NFS: sysfs: fix leak when nfs_client kobject add fails - NFS: trace: show TIMEDOUT instead of 0x6e - NFSv4.1: fix backchannel max_resp_sz verification check - NFSv4.1: fix mount hang after CREATE_SESSION failure - NFSv4.2: Serialise O_DIRECT i/o and clone range - NFSv4.2: Serialise O_DIRECT i/o and copy range - NFSv4.2: Serialise O_DIRECT i/o and fallocate() - NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set - NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server - NFSv4: Don't clear capabilities that won't be reset - NFSv4: ensure the open stateid seqid doesn't go backwards - NFSv4: Fix an incorrect parameter when calling nfs4_call_sync() - NFSv4/flexfiles: Fix layout merge mirror check. - NFSv4: handle ERR_GRACE on delegation recalls - NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid - nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* - nilfs2: fix deadlock warnings caused by lock dependency in init_nilfs() - nilfs2: Fix potential block overflow that cause system hang - nios2: ensure that memblock.current_limit is set when setting pfn limits - nouveau/firmware: Add missing kfree() of nvkm_falcon_fw::boot - NTB: epf: Allow arbitrary BAR mapping - ntfs3: Fix uninit buffer allocated by __getname() - ntfs3: fix uninit memory after failed mi_read in mi_format_new - ntfs3: init run lock for extend inode - ntfs3: pretend $Extend records as regular files - ntfs: Do not overwrite uptodate pages - ntfs: set dummy blocksize to read boot_block when mounting - null_blk: fix kmemleak by releasing references to fault configfs items - null_blk: Fix the description of the cache_size module argument - nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() - nvme-auth: use kvfree() for memory allocated with kvcalloc() - nvme-fc: don't hold rport lock when putting ctrl - nvme-fc: release admin tagset if init fails - nvme-fc: rename free_ctrl callback to match name pattern - nvme-fc: use lock accessing port_state and rport state - nvme: fix admin request_queue lifetime - nvme: fix PCIe subsystem reset controller state transition - nvme-multipath: fix lockdep WARN due to partition scan work - nvme-multipath: Skip nr_active increments in RETRY disposition - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() - nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk - nvme-pci: disable secondary temp for Wodposit WPBSNM8 - nvme-pci: do not directly handle subsys reset fallout - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec - nvmet-fc: avoid scheduling association deletion twice - nvmet-fc: move lsop put work to nvmet_fc_ls_req_op - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() - nvmet-tcp: remove boilerplate code - nvme: Use non zero KATO for persistent discovery connections - objtool: Fix standalone --hacks=jump_label - objtool: Fix weak symbol detection - ocfs2: clear extent cache after moving/defragmenting extents - ocfs2: fix double free in user_cluster_connect() - ocfs2: fix kernel BUG in ocfs2_find_victim_chain - ocfs2: fix memory leak in ocfs2_merge_rec_left() - ocfs2: fix recursive semaphore deadlock in fiemap call - ocfs2: relax BUG() to ocfs2_error() in __ocfs2_move_extent() - octeon_ep: Fix memory leak in octep_device_setup() - octeontx2-af: Fix error handling - octeontx2: cn10k: fix RX flowid TCAM mask handling - octeontx2: Fix otx2_dma_map_page() error return code - octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() - octeontx2-pf: fix "UBSAN: shift-out-of-bounds error" - octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() - of: fix reference count leak in of_alias_scan() - of: platform: Use default match table for /firmware - of: unittest: Fix device reference count leak in of_unittest_pci_node_verify - once: fix race by moving DO_ONCE to separate section - openat2: don't trigger automounts with RESOLVE_NO_XDEV - orangefs: fix xattr related buffer overflow... - padata: Reset next CPU when reorder sequence wraps around - page_pool: always add GFP_NOWARN for ATOMIC allocations - page_pool: Clamp pool size to max 16K pages - page_pool: Fix use-after-free in page_pool_recycle_in_ring - parisc: Do not reprogram affinitiy on ASP chip - parisc: don't reference obsolete termio struct for TC* constants - parisc: entry: set W bit for !compat tasks in syscall_restore_rfi() - parisc: entry.S: fix space adjustment on interruption for 64-bit userspace - parisc: Remove spurious if statement from raw_copy_from_user() - PCI: Add PCI_VDEVICE_SUB helper macro - PCI/AER: Fix missing uevent on recovery when a reset is requested - PCI/AER: Support errors introduced by PCIe r6.0 - PCI: brcmstb: Fix disabling L0s capability - PCI: cadence: Check for the existence of cdns_pcie::ops before using it - PCI: Disable MSI on RDC PCI to PCIe bridges - PCI: dwc: Fix wrong PORT_LOGIC_LTSSM_STATE_MASK definition - PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify() - PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release - PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() - PCI/ERR: Fix uevent on failure to recover - PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV - PCI: j721e: Enable ACSPCIE Refclk if "ti,syscon-acspcie-proxy-ctrl" exists - PCI: j721e: Fix programming sequence of "strap" settings - PCI: keystone: Exit ks_pcie_probe() for invalid mode - PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit - PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call - PCI/PM: Reinstate clearing state_saved in legacy and !PM codepaths - PCI/PM: Skip resuming to D0 if device is disconnected - PCI: rcar-gen2: Drop ARM dependency from PCI_RCAR_GEN2 - PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock - PCI: rcar-host: Drop PMSR spinlock - PCI/sysfs: Ensure devices are powered for config reads - PCI/sysfs: Ensure devices are powered for config reads (part 2) - PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() - PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() - PCI: tegra194: Handle errors in BPMP response - PCI: tegra194: Reset BARs when running in PCIe endpoint mode - PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock - PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation - pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch - perf arm_spe: Correct memory level for remote access - perf arm_spe: Correct setting remote access - perf arm-spe: Extend branch operations - perf arm_spe: Fix memset subclass in operation - perf: arm_spe: Prevent overflow in PERF_IDX2OFF() - perf arm-spe: Rename the common data source encoding - perf evsel: Avoid container_of on a NULL leader - perf evsel: Ensure the fallback message is always written to - perf: Have get_perf_callchain() return NULL if crosstask and user are set - perf lock contention: Load kernel map before lookup - perf maps: Add maps__load_first() - perf python: split Clang options when invoking Popen - perf record: skip synthesize event when open evsel failed - perf: sched: Fix perf crash with new is_user_task() helper - perf session: Fix handling when buffer exceeds 2 GiB - perf: Skip user unwind if the task is a kernel thread - perf subcmd: avoid crash in exclude_cmds when excludes is empty - perf test: Add a test for default perf stat command - perf test: Don't leak workload gopipe in PERF_RECORD_* - perf test stat: Avoid hybrid assumption when virtualized - perf tools: Add fallback for exclude_guest - perf tools: Fix split kallsyms DSO counting - perf: Use current->flags & PF_KTHREAD|PF_USER_WORKER instead of current->mm == NULL - perf util: Fix compression checks returning -1 as bool - perf/x86/amd: Check event before enable to avoid GPF - perf/x86/intel: Correct large PEBS flag check - perf/x86/intel: Do not enable BTS for guests - phy: broadcom: bcm63xx-usbh: fix section mismatches - phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again) - phy: cadence: cdns-dphy: Enable lower resolutions in dphy - phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling - phy: cadence: cdns-dphy: Update calibration wait time for startup state machine - phy: cdns-dphy: Store hs_clk_rate and return it - phy: drop probe registration printks - phy: freescale: imx8m-pcie: assert phy reset during power on - phy: fsl-imx8mq-usb: Clear the PCS_TX_SWING_FULL field before using it - phy: mscc: Fix PTP for VSC8574 and VSC8572 - phy: phy-rockchip-inno-usb2: Use dev_err_probe() in the probe path - phy: phy-snps-eusb2: refactor constructs names - phy: qcom-qusb2: Fix NULL pointer dereference on early suspend - phy: renesas: r8a779f0-ether-serdes: add new step added to latest datasheet - phy: renesas: rcar-gen3-usb2: Fix an error handling path in rcar_gen3_phy_usb2_probe() - phy: rockchip: inno-usb2: Fix a double free bug in rockchip_usb2phy_probe() - phy: rockchip: inno-usb2: fix communication disruption in gadget mode - phy: rockchip: inno-usb2: fix disconnection in gadget mode - phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 - phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0 - phy: stm32-usphyc: Fix off by one in probe() - phy: tegra: xusb: Explicitly configure HS_DISCON_LEVEL to 0x7 - phy: tegra: xusb: fix device and OF node leak at probe - phy: ti: omap-usb2: fix device leak at unbind - phy: ti-pipe3: fix device leak at unbind - phy: Use device_get_match_data() - pid: Add a judgment for ns null in pid_nr_ns - pinctrl: check the return value of pinmux_ops::get_function_name() - pinctrl: cirrus: Fix fwnode leak in cs42l43_pin_probe() - pinctrl: keembay: release allocated memory in detach path - pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver - pinctrl: meson-gxl: add missing i2c_d pinmux - pinctrl: meson: mark the GPIO controller as sleeping - pinctrl: qcom: lpass-lpi: mark the GPIO controller as sleeping - pinctrl: qcom: msm: Fix deadlock in pinmux configuration - pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins - pinctrl: renesas: Use int type to store negative error codes - pinctrl: s32cc: fix uninitialized memory in s32_pinctrl_desc - pinctrl: s32cc: initialize gpio_pin_config::list after kmalloc() - pinctrl: samsung: Drop unused S3C24xx driver data - pinctrl: single: fix bias pull up/down handling in pin_config_set - pinctrl: single: Fix incorrect type for error return variable - pinctrl: single: Fix PIN_CONFIG_BIAS_DISABLE handling - pinctrl: stm32: fix hwspinlock resource leak in probe function - platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver - platform/x86: acer-wmi: Ignore backlight event - platform/x86/amd: pmc: Add Lenovo Legion Go 2 to pmc quirk list - platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list - platform/x86/amd/pmc: Add spurious_8042 to Xbox Ally - platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list - platform/x86: asus-wmi: use brightness_set_blocking() for kbd led - platform/x86: hp-bioscfg: Fix automatic module loading - platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro - platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names - platform/x86: hp-bioscfg: Fix out-of-bounds array access in ACPI package parsing - platform/x86: hp-bioscfg: Skip empty attribute names - platform/x86: huawei-wmi: add keys for HONOR models - platform/x86: ibm_rtl: fix EBDA signature search pointer arithmetic - platform/x86: intel: chtwc_int33fe: don't dereference swnode args - platform/x86/intel/hid: Add Dell Pro Rugged 10/12 tablet to VGBS DMI quirks - platform/x86: intel: punit_ipc: fix memory corruption - platform/x86/intel/speed_select_if: Convert PCIBIOS_* return codes to errnos - platform/x86: intel_telemetry: Fix PSS event register mask - platform/x86: intel_telemetry: Fix swapped arrays in PSS output - platform/x86: msi-laptop: add missing sysfs_remove_group() - platform/x86: toshiba_haps: Fix memory leaks in add/remove routines - PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() - pmdomain: apple: Add "apple,t8103-pmgr-pwrstate" - pmdomain: arm: scmi: Fix genpd leak on provider registration failure - pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc->domains - pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu - pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup - pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup - pmdomain: imx: Fix reference count leak in imx_gpc_probe() - pmdomain: imx: Fix reference count leak in imx_gpc_remove - pmdomain: imx-gpc: Convert to platform remove callback returning void - pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset - pmdomain: qcom: rpmhpd: Add MXC to SC8280XP - pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state - pmdomain: samsung: plug potential memleak during probe - pmdomain: Use device_get_match_data() - PM: runtime: Add new devm functions - PM: runtime: Do not clear needs_force_resume with enabled runtime PM - PM: sleep: core: Clear power.must_resume in noirq suspend error path - pnfs: Fix TLS logic in _nfs4_pnfs_v4_ds_connect() - pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() - pnfs: Set transport security policy to RPC_XPRTSEC_NONE unless using TLS - posix-clock: introduce posix_clock_context concept - posix-clock: Store file pointer in struct posix_clock_context - powercap: fix race condition in register_control_type() - powercap: fix sscanf() error return value handling - powerpc/32: Fix unpaired stwcx. on interrupt exit - powerpc/32: Remove PAGE_KERNEL_TEXT to fix startup failure - powerpc/64s/hash: Restrict stress_hpt_struct memblock region to within RMA limit - powerpc/64s/ptdump: Fix kernel_hash_pagetable dump for ISA v3.00 HPTE format - powerpc/64s/radix/kfence: map __kfence_pool at page granularity - powerpc/64s/slb: Fix SLB multihit issue during SLB preload - powerpc/addnote: Fix overflow on 32-bit builds - powerpc/eeh: Use result of error_detected() in uevent - powerpc/kexec: Enable SMT before waking offline CPUs - powerpc, mm: Fix mprotect on book3s 32-bit - powerpc/powernv/pci: Fix underflow and leak issue - powerpc/pseries/cmm: adjust BALLOON_MIGRATE when migrating pages - powerpc/pseries/cmm: call balloon_devinfo_init() also without CONFIG_BALLOON_COMPACTION - powerpc/pseries/msi: Fix potential underflow and leak issue - power: supply: apm_power: only unset own apm_get_power_status - power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery - power: supply: bq27xxx: restrict no-battery detection to bq27000 - power: supply: cw2015: Check devm_delayed_work_autocancel() return code - power: supply: cw2015: Fix a alignment coding style issue - power: supply: max77976_charger: fix constant current reporting - power: supply: qcom_battmgr: add OOI chemistry - power: supply: qcom_battmgr: handle charging state change notifications - power: supply: rt9467: Prevent using uninitialized local variable in rt9467_set_value_from_ranges() - power: supply: rt9467: Return error on failure in rt9467_set_value_from_ranges() - power: supply: sbs-charger: Support multiple devices - power: supply: wm831x: Check wm831x_set_bits() return value - pps: fix warning in pps_register_cdev when register device fail - proc: fix type confusion in pde_set_flags() - ps3disk: use memcpy_{from,to}_bvec index - ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE. - ptp: add testptp mask test - ptp: Limit time setting of PTP clocks - ptr_ring: do not block hard interrupts in ptr_ring_resize_multiple() - pwm: bcm2835: Make sure the channel is enabled after pwm_request() - pwm: berlin: Fix wrong register in suspend/resume - pwm: stm32: Always program polarity - pwm: tiehrpwm: Fix corner case in clock divisor calculation - qed: Don't collect too many protection override GRC elements - quota: remove unneeded return value of register_quota_format - r8152: add error handling in rtl8152_driver_init - r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H - r8169: fix RTL8117 Wake-on-Lan in DASH mode - r8169: set EEE speed down ratio to 1 - rbd: check for EOD after exclusive lock is ensured to be held - rculist: Add hlist_nulls_replace_rcu() and hlist_nulls_replace_init_rcu() - rcu-tasks: Eliminate deadlocks involving do_exit() and RCU tasks - rcu-tasks: Maintain lists to eliminate RCU-tasks/do_exit() deadlocks - rcu-tasks: Maintain real-time response in rcu_tasks_postscan() - RDMA/bnxt_re: fix dma_free_coherent() pointer - RDMA/bnxt_re: Fix IB_SEND_IP_CSUM handling in post_send - RDMA/bnxt_re: Fix incorrect BAR check in bnxt_qplib_map_creq_db() - RDMA/bnxt_re: Fix the inline size for GenP7 devices - RDMA/bnxt_re: Fix to use correct page size for PDE table - RDMA/cm: Fix leaking the multicast GID table reference - RDMA/cm: Rate limit destroy CM ID timeout error message - RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly - RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem - RDMA/core: Fix logic error in ib_get_gids_from_rdma_hdr() - RDMA/core: Resolve MAC of next-hop device without ARP support - RDMA/efa: Remove possible negative shift - RDMA/hns: Fix the modification of max_send_sge - RDMA/hns: Fix wrong WQE data when QP wraps around - RDMA/irdma: Add support to re-register a memory region - RDMA/irdma: avoid invalid read in irdma_net_event - RDMA/irdma: Do not directly rely on IB_PD_UNSAFE_GLOBAL_RKEY - RDMA/irdma: Fix data race in irdma_free_pble - RDMA/irdma: Fix data race in irdma_sc_ccq_arm - RDMA/irdma: Fix SD index calculation - RDMA/irdma: Remove unused struct irdma_cq fields - RDMA/irdma: Set irdma_cq cq_num field during CQ create - RDMA/mlx5: Fix vport loopback forcing for MPV device - RDMA/rtrs: Fix clt_path::max_pages_per_mr calculation - RDMA/rtrs: server: Fix error handling in get_or_create_srv - RDMA/rxe: Fix null deref on srq->rq.queue after resize failure - RDMA/rxe: Fix race in do_task() when draining - RDMA/rxe: Fix the failure of ibv_query_device() and ibv_query_device_ex() tests - RDMA/rxe: Remove the direct link to net_device - RDMA/siw: Always report immediate post SQ errors - rds: Fix endianness annotation for RDS_MPATH_HASH - rds: ib: Increment i_fastreg_wrs before bailing out - regmap: Fix race condition in hwspinlock irqsave routine - regmap: maple: free entry on mas_store_gfp() failure - regmap: Remove superfluous check for !config in __regmap_init() - regmap: slimbus: fix bus_context pointer in regmap init calls - regulator: core: disable supply if enabling main regulator fails - regulator: core: Protect regulator_supply_alias_list with regulator_list_mutex - regulator: fixed: fix GPIO descriptor leak on register failure - regulator: scmi: Use int type to store negative error codes - regulator: sy7636a: fix lifecycle of power good gpio - Reinstate "resource: avoid unnecessary lookups in find_next_iomem_res()" - remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() - remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice - remoteproc: qcom: q6v5: Avoid handling handover twice - remoteproc: qcom_q6v5_wcss: fix parsing of qcom,halt-regs - remoteproc: wkup_m3: Use devm_pm_runtime_enable() helper - reset: fix BIT macro reference - resource: introduce is_type_match() helper and use it - resource: replace open coded resource_intersection() - resource: Reuse for_each_resource() macro - Revert "cpuidle: menu: Avoid discarding useful information" - Revert "driver core: enforce device_lock for driver_match_device()" - Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" - Revert "drm/tegra: dsi: Clear enable register if powered by bootloader" - Revert "gfs2: Fix use of bio_chain" - Revert "iommu/amd: Skip enabling command/event buffers for kdump" - Revert "ipmi: fix msg stack when IPMI is disconnected" - Revert "loop: Avoid updating block size under exclusive owner" - Revert "mtd: rawnand: marvell: fix layouts" - Revert "net: Allow to use SMP threads for backlog NAPI." - Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" - Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set" - Revert "net: Remove conditional threaded-NAPI wakeup based on task state." - Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups" - Revert "nfc/nci: Add the inconsistency check between the input data length and count" - Revert "nfs: clear SB_RDONLY before getting superblock" - Revert "nfs: ignore SB_RDONLY when mounting nfs" - Revert "nfs: ignore SB_RDONLY when remounting nfs" - Revert "perf dso: Add missed dso__put to dso__load_kcore" - Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()" - Revert "SUNRPC: Don't allow waiting for exiting tasks" - Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running" - Revert "wifi: ath10k: avoid unnecessary wait for service ready message" - Revert "xfrm: destroy xfrm_state synchronously on net exit path" - ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free - riscv: acpi: avoid errors caused by probing DT devices when ACPI is used - riscv: bpf: Fix uninitialized symbol 'retval_off' - RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid rfence errors - riscv: clocksource: Fix stimecmp update hazard on RV32 - riscv: compat: fix COMPAT_UTS_MACHINE definition - RISC-V: Define pgprot_dmacoherent() for non-coherent devices - RISC-V: Don't print details of CPUs disabled in DT - riscv: Improve exception and system call latency - riscv: kprobes: Fix probe address validation - RISC-V: KVM: Fix guest page fault within HLV* instructions - riscv: mm: Do not restrict mmap address based on hint - riscv: mm: Use hint address in mmap if available - riscv: ptdump: use seq_puts() in pt_dump_seq_puts() macro - RISC-V: Remove unnecessary include from compat.h - riscv: Replace function-like macro by static inline function - riscv: stacktrace: Disable KASAN checks for non-current tasks - riscv: stacktrace: fix backtracing through exceptions - riscv: uprobes: Add missing fence.i after building the XOL buffer - rocker: fix memory leak in rocker_world_port_post_fini() - rpmsg: glink: fix rpmsg device leak - rseq: Protect event mask against membarrier IPI - rseq/selftests: Use weak symbol reference, not definition, to link with glibc - rtc: gamecube: Check the return value of ioremap() - rtc: interface: Ensure alarm irq is enabled when UIE is enabled - rtc: interface: Fix long-standing race when setting alarm - rtc: optee: fix memory leak on driver removal - rtc: pcf2127: clear minute/second interrupt - rtc: pcf2127: fix SPI command byte for PCF2131 backport - rtc: pcf2127: fix watchdog interrupt mask on pcf2131 - rtc: rx8025: fix incorrect register reference - rtc: x1205: Fix Xicor X1205 vendor prefix - rtnetlink: Allow deleting FDB entries in user namespace - rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target - s390/ap: Don't leak debug feature files if AP instructions are not available - s390/bpf: Centralize frame offset calculations - s390/bpf: Change seen_reg to a mask - s390/bpf: Describe the frame using a struct instead of constants - s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL - s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG - s390/cio: Update purge function to unregister the unused subchannels - s390/cpum_cf: Deny all sampling events by counter PMU - s390/cpum_cf: Fix uninitialized warning after backport of ce971233242b - s390/ctcm: Fix double-kfree - s390/dasd: Fix gendisk parent after copy pair swap - s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP - s390/ipl: Clear SBP flag when bootprog is set - s390/mm: Fix __ptep_rdp() inline assembly - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump - s390/pci: Restore IRQ unconditionally for the zPCI device - s390/pci: Use pci_uevent_ers() in PCI recovery - s390/smp: Fix fallback CPU detection - samples/ftrace: Adjust LoongArch register restore order in direct calls - samples: work around glibc redefining some of our defines wrong - sched/balancing: Rename newidle_balance() => sched_balance_newidle() - sched/deadline: Fix race in push_dl_task() - sched/deadline: only set free_cpus for online runqueues - sched/fair: Fix pelt lost idle time detection - sched/fair: Forfeit vruntime on yield - sched/fair: Proportional newidle balance - sched/fair: Revert max_newidle_lb_cost bump - sched/fair: Small cleanup to sched_balance_newidle() - sched/fair: Small cleanup to update_newidle_cost() - sched/fair: Use all little CPUs for CPU-bound workloads - sched/pelt: Avoid underestimation of task utilization - sched: Remove never used code in mm_cid_get() - sched/rt: Fix race in push_rt_task - scripts: generate_rust_analyzer: Add compiler_builtins -> core dep - scs: fix a wrong parameter in __scs_magic - scsi: aic94xx: fix use-after-free in device removal path - scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() - scsi: core: Fix a regression triggered by scsi_host_busy() - scsi: core: Fix error handler encryption support - scsi: core: Wake up the error handler when final completions race against each other - scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() - scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() - scsi: ipr: Enable/disable IRQD_NO_BALANCING during reset - scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill() - scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET - scsi: lpfc: Define size of debugfs entry for xri rebalancing - scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup - scsi: mpi3mr: Fix controller init failure on fault during queue creation - scsi: mpt3sas: Add support for 22.5 Gbps SAS link rate - scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() - scsi: mvsas: Fix use-after-free bugs in mvs_work_queue - scsi: myrs: Fix dma_alloc_coherent() error check - scsi: pm8001: Use int instead of u32 to store error codes - scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod - scsi: pm80xx: Fix race condition caused by static variables - scsi: qla2xxx: Allow recovery for tape devices - scsi: qla2xxx: Delay module unload while fabric scan in progress - scsi: qla2xxx: edif: Fix dma_free_coherent() size - scsi: qla2xxx: edif: Fix incorrect sign of error code - scsi: qla2xxx: Fix improper freeing of purex item - scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() - scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() - scsi: qla2xxx: Fix initiator mode with qlini_mode=exclusive - scsi: qla2xxx: Fix lost interrupts with qlini_mode=disabled - scsi: qla2xxx: Free sp in error path to fix system crash - scsi: qla2xxx: Query FW again before proceeding with login - scsi: qla2xxx: Sanitize payload size to prevent member overflow - scsi: qla2xxx: Use reinit_completion on mbx_intr_comp - scsi: qla2xxx: Validate sp before freeing associated memory - scsi: Revert "scsi: libsas: Fix exp-attached device scan after probe failure scanned in again after probe failed" - scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" - scsi: sg: Do not sleep in atomic context - scsi: sg: Fix occasional bogus elapsed time that exceeds timeout - scsi: sim710: Fix resource leak by adding missing ioport_unmap() calls - scsi: smartpqi: Fix device resources accessed after device removal - scsi: stex: Fix reboot_notifier leak in probe error path - scsi: storvsc: Process unsupported MODE_SENSE_10 - scsi: target: Do not write NUL characters into ASCII configfs output - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() - scsi: target: Reset t_task_cdb pointer in error case - scsi: target: target_core_configfs: Add length check to avoid buffer overflow - scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show() - scsi: ufs: core: Add a quirk for handling broken LSDBS field in controller capabilities register - scsi: ufs: core: Add a quirk to suppress link_startup_again - scsi: ufs: core: Add fill_crypto_prdt variant op - scsi: ufs: core: Add UFSHCD_QUIRK_BROKEN_CRYPTO_ENABLE - scsi: ufs: core: Add UFSHCD_QUIRK_CUSTOM_CRYPTO_PROFILE - scsi: ufs: core: Add UFSHCD_QUIRK_KEYS_IN_PRDT - scsi: ufs: core: Add ufshcd_update_evt_hist() for UFS suspend error - scsi: ufs: core: Disable timestamp functionality if not supported - scsi: ufs: core: Fix EH failure after W-LUN resume error - scsi: ufs: core: fix incorrect buffer duplication in ufshcd_read_string_desc() - scsi: ufs: core: fold ufshcd_clear_keyslot() into its caller - scsi: ufs: core: Include UTP error in INT_FATAL_ERRORS - scsi: ufs: core: Initialize value of an attribute returned by uic cmd - scsi: ufs: host: mediatek: Assign power mode userdata before FASTAUTO mode change - scsi: ufs: host: mediatek: Change reset sequence for improved stability - scsi: ufs: host: mediatek: Disable auto-hibern8 during power mode changes - scsi: ufs: host: mediatek: Enhance recovery on hibernation exit failure - scsi: ufs: host: mediatek: Enhance recovery on resume failure - scsi: ufs: host: mediatek: Fix auto-hibern8 timer configuration - scsi: ufs: host: mediatek: Fix invalid access in vccqx handling - scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE - scsi: ufs: ufs-pci: Fix S0ix/S3 for Intel controllers - scsi: ufs: ufs-pci: Set UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE for Intel ADL - scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() - sctp: avoid NULL dereference when chunk data buffer is missing - sctp: Defer SCTP_DBG_OBJCNT_DEC() to sctp_destroy_sock(). - sctp: Fix MAC comparison to be constant-time - sctp: Hold RCU read lock while iterating over address list - sctp: Hold sock lock while iterating over address list - sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT - sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto - sctp: Prevent TOCTOU out-of-bounds write - seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast - selftest/ptp: update ptp selftest to exercise the gettimex options - selftests: arg_parsing: Ensure data is flushed to disk before reading. - selftests: arm64: Check fread return value in exec_target - selftests: bonding: add delay before each xvlan_over_bond connectivity check - selftests: bonding: add ipvlan over bond testing - selftests: bonding: add missing build configs - selftests: bonding: Add more missing config options - selftests/bpf: Check for timeout in perf_link test - selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2 - selftests/bpf: Fix failure paths in send_signal test - selftests/bpf: Improve reliability of test_perf_branches_no_hw() - selftests/bpf: make arg_parsing.c more robust to crashes - selftests/bpf: skip test_perf_branches_hw() on unsupported platforms - selftests/bpf: Upon failures, exit with code 1 in test_xsk.sh - selftests: Disable dad for ipv6 in fcnal-test.sh - selftests: drv-net: fix RPS mask handling for high CPU numbers - selftests: fib_nexthops: Fix creation of non-FDB nexthops - selftests/ftrace: traceonoff_triggers: strip off names - selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency - selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled - selftests: mptcp: avoid spurious errors on TCP disconnect - selftests: mptcp: check no dup close events after error - selftests: mptcp: check subflow errors in close events - selftests: mptcp: connect: catch IO errors on listen side - selftests: mptcp: connect: fix fallback note due to OoO - selftests: mptcp: connect: trunc: read all recv data - selftests: mptcp: disable add_addr retrans in endpoint_tests - selftests: mptcp: join: endpoints: longer transfer - selftests: mptcp: join: fix local endp not being tracked - selftests: mptcp: join: mark 'delete re-add signal' as skipped if not supported - selftests: mptcp: join: mark 'flush re-add' as skipped if not supported - selftests: mptcp: join: mark implicit tests as skipped if not supported - selftests: mptcp: join: properly kill background tasks - selftests: mptcp: join: rm: set backup flag - selftests: mptcp: join: validate C-flag + def limit - selftests: mptcp: pm: ensure unknown flags are ignored - selftests: mptcp: sockopt: fix error messages - selftests: mptcp: userspace pm: validate deny-join-id0 flag - selftests: net: amt: wait longer for connection before sending packets - selftests/net: convert fib-onlink-tests.sh to run it in unique namespace - selftests/net: convert sctp_vrf.sh to run it in unique namespace - selftests: netdevsim: Fix ethtool-coalesce.sh fail by installing ethtool-common.sh - selftests: netdevsim: set test timeout to 10 minutes - selftests/net: Ensure assert() triggers in psock_tpacket.c - selftests: net: fib-onlink-tests: Convert to use namespaces by default - selftests: net: fix "buffer overflow detected" for tap.c - selftests/net: fix GRO coalesce test and add ext header coalesce tests - selftests/net: fix out-of-order delivery of FIN in gro:tcp test - selftests: net: fix server bind failure in sctp_vrf.sh - selftests: net: local_termination: Wait for interfaces to come up - selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8 - selftests: net: replace sleeps in fcnal-test with waits - selftests: net: use BASH for bareudp testing - selftests/net: use destination options instead of hop-by-hop - selftests/nolibc: fix EXPECT_NZ macro - selftests: openvswitch: Fix escape chars in regexp. - selftests: Replace sleep with slowwait - selftests: traceroute: Use require_command() - selftests/tracing: Run sample events to clear page cache events - selftests/user_events: fix type cast for write_index packed member in perf_test - selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported - serial: 8250_dw: handle reset control deassert error - serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018 - serial: 8250_mtk: Enable baud clock and manage in runtime PM - serial: 8250_pci: Fix broken RS485 for F81504/508/512 - serial: add support of CPCI cards - serial: amba-pl011: prefer dma_mapping_error() over explicit address checking - serial: max310x: Add error checking in probe() - serial: sc16is7xx: fix bug in flow control levels init - serial: sc16is7xx: refactor EFR lock - serial: sc16is7xx: remove unused to_sc16is7xx_port macro - serial: sc16is7xx: remove useless enable of enhanced features - serial: sc16is7xx: reorder code to remove prototype declarations - serial: sprd: Return -EPROBE_DEFER when uart clock is not ready - serial: stm32: allow selecting console when the driver is module - sfc: fix potential memory leak in efx_mae_process_mport() - shmem: fix tmpfs reconfiguration (remount) when noswap is set - slimbus: core: fix device reference leak on report present - slimbus: core: fix runtime PM imbalance on report present - slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves - smack: fix bug: unprivileged task can create labels - smb: client: fix cifs_pick_channel when channel needs reconnect - smb: client: fix crypto buffers in non-linear memory - smb: client: fix incomplete backport in cfids_invalidation_worker() - smb: client: fix memory leak in cifs_construct_tcon() - smb/client: fix memory leak in smb2_open_file() - smb: client: fix missing timestamp updates after utime(2) - smb/client: fix NT_STATUS_DEVICE_DOOR_OPEN value - smb/client: fix NT_STATUS_NO_DATA_DETECTED value - smb/client: fix NT_STATUS_UNABLE_TO_FREE_VM value - smb: client: fix potential cfid UAF in smb2_query_info_compound - smb: client: fix potential UAF in smb2_close_cached_fid() - smb: client: Fix refcount leak for cifs_sb_tlink - smb: client: fix refcount leak in smb2_set_path_attr - smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path - smb: client: fix wrong index reference in smb2_compound_op() - smb: client: introduce close_cached_dir_locked() - smb: client: split cached_fid bitfields to avoid shared-byte RMW races - smb: client: transport: avoid reconnects triggered by pending task work - smb: client: validate change notify buffer before copy - smb: fix invalid username check in smb3_fs_context_parse_param() - smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() - smb: server: don't use delayed_work for post_recv_credits_work - smb: server: fix IRD/ORD negotiation with the client - smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() - smb/server: fix possible memory leak in smb2_read() - smb/server: fix possible refcount leak in smb2_sess_setup() - smb/server: fix refcount leak in parse_durable_handle_context() - smb/server: fix refcount leak in smb2_open() - smb/server: fix return value of smb2_ioctl() - smb: server: let smb_direct_flush_send_list() invalidate a remote key first - smc91x: fix broken irq-context in PREEMPT_RT - smp: Fix up and expand the smp_call_function_many() kerneldoc - smsc911x: add second read of EEPROM mac when possible corruption seen - soc: amlogic: canvas: fix device leak on lookup - soc: aspeed: socinfo: Add AST27xx silicon IDs - soc: qcom: ocmem: fix device leak on lookup - soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS - soc: qcom: smem: Fix endian-unaware access of num_entries - soc: qcom: smem: fix hwspinlock resource leak in probe error paths - soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups - sparc64: fix hugetlb for sun4u - sparc64: fix prototypes of reads[bwl]() - sparc: fix accurate exception reporting in copy_{from,to}_user for M7 - sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara - sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC - sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III - sparc: fix accurate exception reporting in copy_to_user for Niagara 4 - sparc: fix error handling in scan_one_device() - sparc/module: Add R_SPARC_UA64 relocation handling - spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors - spi: bcm63xx: fix premature CS deassertion on RX-only transactions - spi: cadence-quadspi: Fix clock disable on probe failure path - spi: cadence-quadspi: Flush posted register writes before DAC access - spi: cadence-quadspi: Flush posted register writes before INDAC access - spi: cadence-quadspi: Implement refcount to handle unbind during busy - spi: fsl-cpm: Check length parity before switching to 16 bit mode - spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization - spi: imx: keep dma request disabled before dma transfer setup - spi: loopback-test: Don't use %pK through printk - spi: nxp-fspi: Propagate fwnode in ACPI case as well - spi: nxp-fspi: Support per spi-mem operation frequency switches - spi: rpc-if: Add resume support for RZ/G3E - spi: spi-mem: Add a new controller capability - spi: spi-mem: Allow specifying the byte order in Octal DTR mode - spi: spi-mem: Extend spi-mem operations with a per-operation maximum frequency - spi: spi-nxp-fspi: add extra delay after dll locked - spi: spi-sprd-adi: Fix double free in probe error path - spi: sprd-adi: switch to use spi_alloc_host() - spi: sprd: adi: Use devm_register_restart_handler() - spi: tegra114: Preserve SPI mode bits in def_command1_reg - spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA - spi: tegra210-quad: Fix timeout handling - spi: tegra210-quad: Move curr_xfer read inside spinlock - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer - spi: tegra: Fix a memory leak in tegra_slink_probe() - spi: Try to get ACPI GPIO IRQ earlier - spi: xilinx: increase number of retries before declaring stall - Squashfs: add additional inode sanity checking - Squashfs: fix uninit-value in squashfs_get_parent - Squashfs: reject negative file sizes in squashfs_read_inode() - staging: axis-fifo: fix maximum TX packet length check - staging: axis-fifo: fix TX handling on copy_from_user() failure - staging: axis-fifo: flush RX FIFO on read errors - staging: fbtft: core: fix potential memory leak in fbtft_probe_common() - staging: most: i2c: Drop explicit initialization of struct i2c_device_id::driver_data to 0 - staging: most: remove broken i2c driver - staging: rtl8712: Remove driver using deprecated API wext - staging: rtl8723bs: fix out-of-bounds read in OnBeacon ESR IE parsing - staging: rtl8723bs: fix out-of-bounds read in rtw_get_ie() parser - staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing - strparser: Fix signed/unsigned mismatch bug - SUNRPC: call xs_sock_process_cmsg for all cmsg - sunrpc: fix null pointer dereference on zero-length checksum - SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf - svcrdma: bound check rq_pages index in inline path - svcrdma: return 0 on success from svc_rdma_copy_inline_range - task_work: Fix NMI race condition - tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). - tcp: fix __tcp_close() to only send RST when required - tcp: fix tcp_tso_should_defer() vs large RTT - tcpm: allow looking for role_sw device in the main node - tcpm: switch check for role_sw device with fw_node - tcp: take care of zero tp->window_clamp in tcp_set_rcvlowat() - team: fix check for port enabled in team_queue_override_port_prio_changed() - team: Move team device type change at the end of team_port_add - tee: allow a driver to allocate a tee_device without a pool - testptp: Add option to open PHC in readonly mode - textsearch: describe @list member in ts_ops search - tg3: prevent use of uninitialized remote_adv and local_adv variables - thermal/drivers/qcom/lmh: Add missing IRQ includes - thermal/drivers/qcom: Make LMH select QCOM_SCM - thunderbolt: Add support for Intel Wildcat Lake - thunderbolt: Use is_pciehp instead of is_hotplug_bridge - timers: Fix NULL function pointer race in timer_shutdown_sync() - tipc: Fix use-after-free in tipc_mon_reinit_self(). - tipc: use kfree_sensitive() for session key material - ti-sysc: allow OMAP2 and OMAP4 timers to be reserved on AM33xx - tls: always set record_type in tls_process_cmsg - tls: don't rely on tx_work during send() - tls: make sure to abort the stream if headers are bogus - tls: trim encrypted message to match the plaintext on short splice - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). - tls: wait for async encrypt in case of error during latter iterations of sendmsg - tls: wait for pending async decryptions if tls_strp_msg_hold fails - tools bitmap: Add missing asm-generic/bitsperlong.h include - tools build: Align warning options with perf - tools/cpupower: fix error return value in cpupower_write_sysfs() - tools/cpupower: Fix incorrect size in cpuidle_state_disable() - tools: lib: thermal: don't preserve owner in install - tools: lib: thermal: use pkg-config to locate libnl3 - tools/mm/page_owner_sort: fix timestamp comparison for stable sorting - tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers - tools/nolibc/stdio: let perror work when NOLIBC_IGNORE_ERRNO is set - tools/power x86_energy_perf_policy: Enhance HWP enable - tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage - tools/power x86_energy_perf_policy: Prefer driver HWP limits - tools/testing/nvdimm: Use per-DIMM device handle - tools: ynl: Specify --no-line-number in ynl-regen.sh. - tpm: Cap the number of PCR banks - tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single - tracefs: fix a leak in eventfs_create_events_dir() - tracing: Do not register unsupported perf events - tracing: dynevent: Add a missing lockdown check on dynevent - tracing: Fix crash on synthetic stacktrace field usage - tracing: Fix fixed array of synthetic event - tracing: Fix ftrace event field alignments - tracing: Fix memory leaks in create_field_var() - tracing: Fix race condition in kprobe initialization causing NULL pointer dereference - tracing: Fix tracing_marker may trigger page fault during preempt_disable - tracing: Silence warning when chunk allocation fails in trace_pid_write - tracing/tools: Fix incorrcet short option in usage text for --threads - tty: fix tty_port_tty_*hangup() kernel-doc - tty: hvc_console: Call hvc_kick in hvc_write unconditionally - tty: introduce and use tty_port_tty_vhangup() helper - tty: n_gsm: Don't block input queue by waiting MSC - tunnels: reset the GSO metadata before reusing the skb - uacce: ensure safe queue release with state management - uacce: fix cdev handling in the cleanup path - uacce: fix isolate sysfs check condition - uacce: implement mremap in uacce_vm_ops to return -EPERM - ublk: complete command synchronously on error - ublk: fix deadlock when reading partition table - ublk: make sure io cmd handled in submitter task context - ublk: prevent invalid access with DEBUG - udp_tunnel: use netdev_warn() instead of netdev_WARN() - uio_hv_generic: Let userspace take care of interrupt mask - uio_hv_generic: Set event for all channels on the device - uio: uio_fsl_elbc_gpcm:: Add null pointer check to uio_fsl_elbc_gpcm_probe - um: Fix help message for ssl-non-raw - um: virtio_uml: Fix use-after-free after put_device in probe - Unbreak 'make tools/*' for user-space targets - uprobe: Do not emulate/sstep original instruction when ip is changed - usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call - usb: cdns3: Fix double resource release in cdns3_pci_probe - usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget - usb: chaoskey: fix locking for O_NONBLOCK - usb: core: Add 0x prefix to quirks debug output - usb: core: add USB_QUIRK_NO_BOS for devices that hang on BOS descriptor - usb/core/quirks: Add Huawei ME906S to wakeup quirk - usb: dwc2: disable platform lowlevel hw resources during shutdown - usb: dwc2: fix hang during shutdown if set as peripheral - usb: dwc2: fix hang during suspend if set as peripheral - usb: dwc3: Check for USB4 IP_NAME - usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths - usb: dwc3: keep susphy enabled during exit to avoid controller faults - usb: dwc3: of-simple: fix clock resource leak in dwc3_of_simple_probe - usb: dwc3: pci: add support for the Intel Nova Lake -S - usb: dwc3: pci: Sort out the Intel device IDs - USB: Fix descriptor count when handling invalid MBIM extended descriptor - usb: gadget: configfs: Correctly set use_os_string at bind - USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels - usb: gadget: f_acm: Refactor bind path to use __free() - usb: gadget: f_ecm: Refactor bind path to use __free() - usb: gadget: f_eem: Fix memory leak in eem_unwrap - usb: gadget: f_fs: Fix epfile null pointer access after ep enable. - usb: gadget: f_hid: Fix zero length packet transfer - usb: gadget: f_ncm: Fix MAC assignment NCM ethernet - usb: gadget: f_ncm: Refactor bind path to use __free() - usb: gadget: f_rndis: Refactor bind path to use __free() - usb: gadget: Introduce free_usb_request helper - usb: gadget: lpc32xx_udc: fix clock imbalance in error path - usb: gadget: midi2: Fix MIDI2 IN EP max packet size - usb: gadget: midi2: Fix missing UMP group attributes initialization - usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors - usb: gadget: Store endpoint pointer in usb_request - usb: gadget: tegra-xudc: Always reinitialize data toggle when clear halt - usb: gadget: udc: fix use-after-free in usb_gadget_state_work - usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup - usbip: Fix locking bug in RT-enabled kernels - USB: lpc32xx_udc: Fix error handling in probe - usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls - usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs - usbnet: Fix using smp_processor_id() in preemptible code warnings - usbnet: limit max_mtu based on device's hard_mtu - usbnet: Prevents free active kevent - usb: ohci-nxp: fix device leak on probe failure - usb: ohci-nxp: Use helper function devm_clk_get_enabled() - USB: OHCI/UHCI: Add soft dependencies on ehci_platform - usb: phy: fsl-usb: Fix use-after-free in delayed work during device removal - usb: phy: Initialize struct usb_phy list_head - usb: phy: isp1301: fix non-OF device reference imbalance - usb: phy: twl6030: Fix incorrect type for ret - usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE - usb: raw-gadget: do not limit transfer length - usb: renesas_usbhs: Fix a resource leak in usbhs_pipe_malloc() - usb: renesas_usbhs: Fix synchronous external abort on unbind - USB: serial: belkin_sa: fix TIOCMBIS and TIOCMBIC - USB: serial: ftdi_sio: add support for PICAXE AXE027 cable - USB: serial: ftdi_sio: add support for u-blox EVK-M101 - USB: serial: ftdi_sio: match on interface number for jtag - USB: serial: kobil_sct: fix TIOCMBIS and TIOCMBIC - USB: serial: option: add Foxconn T99W760 - USB: serial: option: add Quectel RG255C - USB: serial: option: add SIMCom 8230C compositions - USB: serial: option: add support for Rolling RW101R-GL - USB: serial: option: add Telit Cinterion FE910C04 new compositions - USB: serial: option: add Telit Cinterion FN990A w/audio compositions - USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions - USB: serial: option: add Telit FN920C04 ECM compositions - USB: serial: option: add Telit LE910 MBIM composition - USB: serial: option: add UNISOC UIS7720 - USB: serial: option: move Telit 0x10c7 composition in the right place - usb: storage: Fix memory leak in USB bulk transport - USB: storage: Remove subclass and protocol overrides from Novatek quirk - usb: storage: sddr55: Reject out-of-bound new_pba - usb: typec: tipd: Clear interrupts first - usb: typec: ucsi: Handle incorrect num_connectors capability - usb: typec: ucsi: psy: Set max current to zero when disconnected - usb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer - usb: udc: Add trace event for usb_gadget_set_state - usb: usb-storage: Maintain minimal modifications to the bcdDevice range. - usb: usb-storage: No additional quirks need to be added to the EL-R12 optical drive. - usb: vhci-hcd: Prevent suspending virtually attached devices - usb: xhci: Apply the link chain quirk on NEC isoc endpoints - usb: xhci: limit run_graceperiod for only usb 3.0 devices - usb: xhci: move link chain bit quirk checks into one helper function. - usb: xhci: plat: Facilitate using autosuspend for xhci plat devices - vdpa/pds: use %pe for ERR_PTR() in event handler registration - veth: fix data race in veth_get_ethtool_stats - vfio/pds: replace bitmap_free with vfree - vfio: return -ENOTTY for unsupported device feature - vfs: Don't leak disconnected dentries on umount - vhost: Take a reference on the task in struct vhost_task. - vhost: vringh: Fix copy_to_iter return value check - vhost: vringh: Modify the return value check - vhost/vsock: improve RCU read sections around vhost_vsock_get() - via_wdt: fix critical boot hang due to unnamed resource allocation - video: backlight: lp855x_bl: Set correct EPROM start for LP8556 - virtio_console: fix order of fields cols and rows - virtio: fix typo in virtio_device_ready() comment - virtio: fix virtqueue_set_affinity() docs - virtio: fix whitespace in virtio_config_ops - virtio-net: fix incorrect flags recording in big mode - virtio-net: fix received length check in big packets - virtio_vdpa: fix misleading return in void function - vmxnet3: unregister xdp rxq info in the reset path - vsock: fix lock inversion in vsock_assign_transport() - vsock: Ignore signal/timeout on connect() if already established - vsock/test: add a final full barrier after run all tests - vsock/test: fix seqpacket message bounds test - vsock/test: verify socket options after setting them - vsock/virtio: cap TX credit to local buffer size - vsock/virtio: fix potential underflow in virtio_transport_get_credit() - w1: fix redundant counter decrement in w1_attach_slave_device() - w1: therm: Fix off-by-one buffer overflow in alarms_store - watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog - watchdog: s3c2410_wdt: Fix max_timeout being calculated larger - watchdog: starfive: Fix resource leak in probe error path - watchdog: wdat_wdt: Fix ACPI table leak in probe function - wifi: ath10k: avoid unnecessary wait for service ready message - wifi: ath10k: Fix connection after GTK rekeying - wifi: ath10k: fix dma_free_coherent() pointer - wifi: ath10k: Fix memory leak on unsupported WMI command - wifi: ath11k: Add missing platform IDs for quirk table - wifi: ath11k: add srng->lock for ath11k_hal_srng_* in monitor mode - wifi: ath11k: fix peer HE MCS assignment - wifi: ath11k: fix RCU stall while reaping monitor destination ring - wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again - wifi: ath11k: zero init info->status in wmi_process_mgmt_tx_comp() - wifi: ath12k: fix dma_free_coherent() pointer - wifi: ath12k: free skb during idr cleanup callback - wifi: ath12k: Increase DP_REO_CMD_RING_SIZE to 256 - wifi: avoid kernel-infoleak from struct iw_point - wifi: brcmfmac: Add DMI nvram filename quirk for Acer A1 840 tablet - wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode - wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() - wifi: cfg80211: Fix bitrate calculation overflow for HE rates - wifi: cfg80211: sme: store capped length in __cfg80211_connect_result() - wifi: cw1200: Fix potential memory leak in cw1200_bh_rx_helper() - wifi: ieee80211: correct FILS status codes - wifi: mac80211: collect station statistics earlier when disconnect - wifi: mac80211: correctly check if CSA is active - wifi: mac80211: Discard Beacon frames to non-broadcast address - wifi: mac80211: do not use old MBSSID elements - wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice - wifi: mac80211: fix CMAC functions not handling errors - wifi: mac80211: Fix HE capabilities element check - wifi: mac80211: fix incorrect type for ret - wifi: mac80211: fix Rx packet handling when pubsta information is not available - wifi: mac80211_hwsim: Limit destroy_on_close radio removal to netgroup - wifi: mac80211: increase scan_ies_len for S1G - wifi: mac80211: move TDLS work to wiphy work - wifi: mac80211: ocb: skip rx_no_sta when interface is not joined - wifi: mac80211: reject address change while connecting - wifi: mac80211: remove RX_DROP_UNUSABLE - wifi: mac80211: skip rate verification for not captured PSDUs - wifi: mt76: Fix DTS power-limits on little endian systems - wifi: mt76: fix potential memory leak in mt76_wmac_probe() - wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922 device - wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 - wifi: mt76: mt7996: Temporarily disable EPCS - wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() - wifi: mwifiex: send world regulatory domain to driver - wifi: rsi: Fix memory corruption due to not set vif driver data size - wifi: rtl818x: Fix potential memory leaks in rtl8180_init_rx_ring() - wifi: rtl818x: rtl8187: Fix potential buffer underflow in rtl8187_rx_cb() - wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 - wifi: rtw88: Add USB ID 2001:3329 for D-Link AC13U rev. A1 - wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() - wifi: rtw88: limit indirect IO under powered off for RTL8822CS - wifi: rtw88: sdio: use indirect IO for device registers before power-on - wifi: rtw89: avoid circular locking dependency in ser_state_run() - wifi: virt_wifi: Fix page fault on connect - wifi: wilc1000: avoid buffer overflow in WID string configuration - wifi: wlcore: ensure skb headroom before skb_push - writeback: Avoid excessively long inode switching times - writeback: Avoid softlockup when switching many inodes - writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 - x86/boot: Fix page table access in 5-level to 4-level paging transition - x86/bugs: Fix reporting of LFENCE retpoline - x86/bugs: Report correct retbleed mitigation status - x86: disable image size check for test builds - x86/dumpstack: Prevent KASAN false positive warnings in __show_regs() - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 - x86/fpu: Ensure XFD state on signal delivery - x86/kaslr: Recognize all ZONE_DEVICE users as physaddr consumers - x86/kfence: avoid writing L1TF-vulnerable PTEs - x86/kfence: fix booting on 32bit non-PAE systems - x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of PV_UNHALT - x86: make page fault handling disable interrupts properly - x86/microcode/AMD: Add more known models to entry sign checking - x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev - x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo - x86/microcode/AMD: Limit Entrysign signature checking to known generations - x86/microcode/AMD: Select which microcode patch to load - x86/microcode: Fix Entrysign revision check for Zen1/Naples - x86/ptrace: Always inline trivial accessors - x86/resctrl: Add missing resctrl initialization for Hygon - x86/resctrl: Fix memory bandwidth counter width for Hygon - x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID - x86/umip: Check that the instruction opcode is at least two bytes - x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases) - x86/vdso: Fix output operand size of RDPID - x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall - x86/xen: Fix sparse warning in enlighten_pv.c - x86/xen: Move Xen upcall handler - xen/events: Cleanup find_virq() return codes - xen/events: Return -EEXIST for bound VIRQs - xen/events: Update virq_to_irq on migration - xen/manage: Fix suspend error path - xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added - xfrm: delete x->tunnel as we delete x - xfrm: Determine inner GSO type from packet inner protocol - xfrm: Fix inner mode lookup in tunnel mode GSO segmentation - xfrm: flush all states in xfrm_state_fini - xfrm: Prevent locally generated packets from direct output in tunnel mode - xfrm: state: fix out-of-bounds read during lookup - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI - xfs: always warn about deprecated mount options - xfs: fix a memory leak in xfs_buf_item_init() - xfs: fix log CRC mismatches between i386 and other architectures - xfs: rename the old_crc variable in xlog_recover_process - xfs: use deferred intent items for reaping crosslinked blocks - xhci: dbc: Allow users to modify DbC poll interval via sysfs - xhci: dbc: Avoid event polling busyloop if pending rx transfers are inactive. - xhci: dbc: decouple endpoint allocation from initialization - xhci: dbc: enable back DbC in resume if it was enabled before suspend - xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event - xhci: dbc: Fix full DbC transfer ring after several reconnects - xhci: dbc: Improve performance by removing delay in transfer event polling. - xhci: dbc: poll at different rate depending on data transfer activity - xhci: dbgtty: Fix data corruption when transmitting data form DbC to host - xhci: dbgtty: fix device unregister - xhci: dbgtty: fix device unregister: fixup - xhci: fix memory leak regression when freeing xhci vdev devices depth first - xsk: Fix race condition in AF_XDP generic RX path - xtensa: simdisk: add input size check in proc_write_simdisk - Updated by kernel-updater-bot (https://abf.io/mikhailnov/kernel-updater-bot)- Patch from Hans to fix SYNA3602 touchpads- Update initrd size (kb#456)6.6.148-16.6.148-16.6-rosa-flow-abi/lib/modules/-O2 -fomit-frame-pointer -gdwarf-4 -Wstrict-aliasing=2 -pipe -Wformat -Werror=format-security -D_FORTIFY_SOURCE=2 -fPIC -fstack-protector-strong --param=ssp-buffer-size=4 -m64 -mtune=generichttps://rosa.rucpioxz6Tx86_64-rosa-linux-gnudirectoryooorosa2021https://bugzilla.rosa.rubasesystem-minimalfilesystemsetup@@@utf-8e4bed47c7947002d0f5f55ee775622336fb7312657348bca4e8dcab5a50fa7ffca449161150d8e7e75207078060d9b001f013ecc7ff947b4059b7c0c0f8b12ae?7zXZ _!l W] crt:bLL*GrJnl GX+r?3JU9Y6(c={XH3{C$p5+ B'~^ΩDa ~u px >G| mD YZ