# changelog

author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-200.74.27.el10uek]
changelog:
  - Revert "uek-rpm: update kABI for FIPS regarding crypto_user" (Saeed Mirzamohammadi)  [Orabug: 39033195]
  - Revert "fips: remove crypto_user from the FIPS module" (Saeed Mirzamohammadi)  [Orabug: 39033195]
  - Revert "crypto_user: use FIPS algorithm list when FIPS module is enabled" (Saeed Mirzamohammadi)  [Orabug: 39033195]
  - RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init() (Abhijit Gangurde)  [Orabug: 39006240]
  - uek-rpm: enable ionic rdma module build in UEK (Qing Huang)  [Orabug: 38331822]
  - RDMA/ionic: Fix memory leak of admin q_wr (Abhijit Gangurde)  [Orabug: 38331822]
  - RDMA/ionic: Use ether_addr_copy instead of memcpy (Abhijit Gangurde)  [Orabug: 38331822]
  - RDMA/ionic: Fix build failure on SPARC due to xchg() operand size (Abhijit Gangurde)  [Orabug: 38331822]
  - RDMA/ionic: Add Makefile/Kconfig to kernel build environment (Abhijit Gangurde)  [Orabug: 38331822]
  - RDMA/ionic: Implement device stats ops (Abhijit Gangurde)  [Orabug: 38331822]
  - RDMA/ionic: Register device ops for miscellaneous functionality (Abhijit Gangurde)  [Orabug: 38331822]
  - RDMA/ionic: Register device ops for datapath (Abhijit Gangurde)  [Orabug: 38331822]
  - RDMA/ionic: Register device ops for control path (Abhijit Gangurde)  [Orabug: 38331822]
  - RDMA/ionic: Create device queues to support admin operations (Abhijit Gangurde)  [Orabug: 38331822]
  - RDMA/ionic: Register auxiliary module for ionic ethernet adapter (Abhijit Gangurde)  [Orabug: 38331822]
  - RDMA: Add IONIC to rdma_driver_id definition (Abhijit Gangurde)  [Orabug: 38331822]
  - net: ionic: Provide doorbell and CMB region information (Abhijit Gangurde)  [Orabug: 38331822]
  - net: ionic: Provide interrupt allocation support for the RDMA driver (Abhijit Gangurde)  [Orabug: 38331822]
  - net: ionic: Provide RDMA reset support for the RDMA driver (Abhijit Gangurde)  [Orabug: 38331822]
  - net: ionic: Export the APIs from net driver to support device commands (Abhijit Gangurde)  [Orabug: 38331822]
  - net: ionic: Update LIF identity with additional RDMA capabilities (Abhijit Gangurde)  [Orabug: 38331822]
  - net: ionic: Create an auxiliary device for rdma driver (Abhijit Gangurde)  [Orabug: 38331822]


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-200.74.27.1.el10uek]
changelog:
  - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson)  [Orabug: 39071315]


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-200.74.27.el10uek]
changelog:
  - Revert "uek-rpm: update kABI for FIPS regarding crypto_user" (Saeed Mirzamohammadi) [Orabug: 39033195]
  - Revert "fips: remove crypto_user from the FIPS module" (Saeed Mirzamohammadi) [Orabug: 39033195]
  - Revert "crypto_user: use FIPS algorithm list when FIPS module is enabled" (Saeed Mirzamohammadi) [Orabug: 39033195]
  - RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init() (Abhijit Gangurde) [Orabug: 39006240]
  - uek-rpm: enable ionic rdma module build in UEK (Qing Huang) [Orabug: 38331822]
  - RDMA/ionic: Fix memory leak of admin q_wr (Abhijit Gangurde) [Orabug: 38331822]
  - RDMA/ionic: Use ether_addr_copy instead of memcpy (Abhijit Gangurde) [Orabug: 38331822]
  - RDMA/ionic: Fix build failure on SPARC due to xchg() operand size (Abhijit Gangurde) [Orabug: 38331822]
  - RDMA/ionic: Add Makefile/Kconfig to kernel build environment (Abhijit Gangurde) [Orabug: 38331822]
  - RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38331822]
  - RDMA/ionic: Register device ops for miscellaneous functionality (Abhijit Gangurde) [Orabug: 38331822]
  - RDMA/ionic: Register device ops for datapath (Abhijit Gangurde) [Orabug: 38331822]
  - RDMA/ionic: Register device ops for control path (Abhijit Gangurde) [Orabug: 38331822]
  - RDMA/ionic: Create device queues to support admin operations (Abhijit Gangurde) [Orabug: 38331822]
  - RDMA/ionic: Register auxiliary module for ionic ethernet adapter (Abhijit Gangurde) [Orabug: 38331822]
  - RDMA: Add IONIC to rdma_driver_id definition (Abhijit Gangurde) [Orabug: 38331822]
  - net: ionic: Provide doorbell and CMB region information (Abhijit Gangurde) [Orabug: 38331822]
  - net: ionic: Provide interrupt allocation support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
  - net: ionic: Provide RDMA reset support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
  - net: ionic: Export the APIs from net driver to support device commands (Abhijit Gangurde) [Orabug: 38331822]
  - net: ionic: Update LIF identity with additional RDMA capabilities (Abhijit Gangurde) [Orabug: 38331822]
  - net: ionic: Create an auxiliary device for rdma driver (Abhijit Gangurde) [Orabug: 38331822]


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-200.74.27.1.el10uek]
changelog:
  - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson)  [Orabug: 39071315] {CVE-2026-23401}


author: Sherry Yang <sherry.yang@oracle.com> [6.12.0-200.74.27.2.el10uek]
changelog:
  - ipv6: use RCU in ip6_xmit() (Eric Dumazet)  [Orabug: 39186444]  {CVE-2025-40135} 
  - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Inseo An)  [Orabug: 39181102]  {CVE-2026-23231} 
  - dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (Eric Dumazet)  [Orabug: 39181101]  {CVE-2026-23004}


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-200.74.27.el10uek]
changelog:
  - Revert "uek-rpm: update kABI for FIPS regarding crypto_user" (Saeed Mirzamohammadi)  [Orabug: 39033195]  
  - Revert "fips: remove crypto_user from the FIPS module" (Saeed Mirzamohammadi)  [Orabug: 39033195]  
  - Revert "crypto_user: use FIPS algorithm list when FIPS module is enabled" (Saeed Mirzamohammadi)  [Orabug: 39033195]  
  - RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init() (Abhijit Gangurde)  [Orabug: 39006240]  
  - uek-rpm: enable ionic rdma module build in UEK (Qing Huang)  [Orabug: 38331822]  
  - RDMA/ionic: Fix memory leak of admin q_wr (Abhijit Gangurde)  [Orabug: 38331822]  
  - RDMA/ionic: Use ether_addr_copy instead of memcpy (Abhijit Gangurde)  [Orabug: 38331822]  
  - RDMA/ionic: Fix build failure on SPARC due to xchg() operand size (Abhijit Gangurde)  [Orabug: 38331822]  
  - RDMA/ionic: Add Makefile/Kconfig to kernel build environment (Abhijit Gangurde)  [Orabug: 38331822]  
  - RDMA/ionic: Implement device stats ops (Abhijit Gangurde)  [Orabug: 38331822]  
  - RDMA/ionic: Register device ops for miscellaneous functionality (Abhijit Gangurde)  [Orabug: 38331822]  
  - RDMA/ionic: Register device ops for datapath (Abhijit Gangurde)  [Orabug: 38331822]  
  - RDMA/ionic: Register device ops for control path (Abhijit Gangurde)  [Orabug: 38331822]  
  - RDMA/ionic: Create device queues to support admin operations (Abhijit Gangurde)  [Orabug: 38331822]  
  - RDMA/ionic: Register auxiliary module for ionic ethernet adapter (Abhijit Gangurde)  [Orabug: 38331822]  
  - RDMA: Add IONIC to rdma_driver_id definition (Abhijit Gangurde)  [Orabug: 38331822]  
  - net: ionic: Provide doorbell and CMB region information (Abhijit Gangurde)  [Orabug: 38331822]  
  - net: ionic: Provide interrupt allocation support for the RDMA driver (Abhijit Gangurde)  [Orabug: 38331822]  
  - net: ionic: Provide RDMA reset support for the RDMA driver (Abhijit Gangurde)  [Orabug: 38331822]  
  - net: ionic: Export the APIs from net driver to support device commands (Abhijit Gangurde)  [Orabug: 38331822]  
  - net: ionic: Update LIF identity with additional RDMA capabilities (Abhijit Gangurde)  [Orabug: 38331822]  
  - net: ionic: Create an auxiliary device for rdma driver (Abhijit Gangurde)  [Orabug: 38331822]


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-201.74.1.el10uek]
changelog:
  - selftests/bpf: Add overwrite mode test for BPF ring buffer (Xu Kuohai)  [Orabug: 38717758]
  - bpf: Add overwrite mode for BPF ring buffer (Xu Kuohai)  [Orabug: 38717758]
  - uek-rpm: Ensure --with onosonly skips building container rpms (Vijay Kumar)  [Orabug: 38905604]
  - nvme-auth: use hkdf_expand_label() (Chris Leech)  [Orabug: 38993277]
  - nvme: spelling fixes (Yi Zhang)  [Orabug: 38993277]
  - nvme-auth: add hkdf_expand_label() (Chris Leech)  [Orabug: 38993277]
  - nvme-auth: update bi_directional flag (Martin George)  [Orabug: 38993277]
  - nvme-auth: update sc_c in host response (Martin George)  [Orabug: 38993277]
  - nvme-tcp: remove redundant check to ctrl->opts (Hannes Reinecke)  [Orabug: 38993277]
  - nvme-tcp: send only permitted commands for secure concat (Martin George)  [Orabug: 38993277]
  - nvme-fabrics: reset admin connection for secure concatenation (Hannes Reinecke)  [Orabug: 38993277]
  - nvme-tcp: request secure channel concatenation (Hannes Reinecke)  [Orabug: 38993277]
  - nvme-keyring: add nvme_tls_psk_refresh() (Hannes Reinecke)  [Orabug: 38993277]
  - nvme: add nvme_auth_derive_tls_psk() (Hannes Reinecke)  [Orabug: 38993277]
  - nvme: add nvme_auth_generate_digest() (Hannes Reinecke)  [Orabug: 38993277]
  - nvme: add nvme_auth_generate_psk() (Hannes Reinecke)  [Orabug: 38993277]
  - crypto,fs: Separate out hkdf_extract() and hkdf_expand() (Hannes Reinecke)  [Orabug: 38993277]
  - ONOS: Enable OPTOE EEPROM and ASF I2C modules (Vijay Kumar)  [Orabug: 39001522]
  - eeprom: optoe: drop i2c_device_id from probe() (Vijay Kumar)  [Orabug: 39001522]
  - ext4: show 'shutdown' hint when ext4 is forced to shutdown (Baokun Li)  [Orabug: 39002345]
  - ext4: show 'emergency_ro' when EXT4_FLAGS_EMERGENCY_RO is set (Baokun Li)  [Orabug: 39002345]
  - ext4: correct behavior under errors=remount-ro mode (Baokun Li)  [Orabug: 39002345]
  - ext4: add more ext4_emergency_state() checks around sb_rdonly() (Baokun Li)  [Orabug: 39002345]
  - ext4: add ext4_emergency_state() helper function (Baokun Li)  [Orabug: 39002345]
  - ext4: add EXT4_FLAGS_EMERGENCY_RO bit (Baokun Li)  [Orabug: 39002345]
  - ext4: convert EXT4_FLAGS_* defines to enum (Baokun Li)  [Orabug: 39002345]
  - PCI: Fix BUILD_BUG_ON usage for old gcc (Alex Williamson)  [Orabug: 39021289]
  - PCI: Batch BAR sizing operations (Alex Williamson)  [Orabug: 39021289]
  - uek-rpm: Turn USB_XHCI_PCI_RENESAS to a builtin option (Harshit Mogalapalli)  [Orabug: 39022939]
  - mm/page_alloc: ignore the exact initial compaction result (Vlastimil Babka)  [Orabug: 39037823]
  - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Vlastimil Babka)  [Orabug: 39037823]
  - ONOS: Replace strlcpy with strscpy in bcm-hsdk-gpl (Vijay Kumar)  [Orabug: 39042061]
  - ONOS: Build fix for bcm-hsdk-gpl drivers (Vijay Kumar)  [Orabug: 39042061]
  - uek-rpm/config-x86_64-onos: Add configs for Broadcom HSDK GPL drivers (Vijay Kumar)  [Orabug: 39042061]
  - bcm-hsdk-gpl: Build Broadcom HSDK GPL drivers (Vijay Kumar)  [Orabug: 39042061]
  - drivers/platform: Add Broadcom HSDK GPL drivers (Vijay Kumar)  [Orabug: 39042061]
  - minke-fan-cpld: support partial fan insertion (Divyarajsinh Jhala)  [Orabug: 39043148]
  - src: scale pwm to respect pali2 cpld min pwm req (arista-hpandya)  [Orabug: 39043148]
  - src: add support for FAN-7311H-RED (arista-hpandya)  [Orabug: 39043148]
  - minke-fan-cpld: support platform specific addresses (Divyarajsinh Jhala)  [Orabug: 39043148]
  - drivers: add rundle support to minke fan driver (arista-hpandya)  [Orabug: 39043148]
  - driver: fix rook fan present read in cpld_init and cpld_update (Calvin Laverty)  [Orabug: 39043148]
  - driver: fix scd gpio active low clear (Calvin Laverty)  [Orabug: 39043148]
  - driver: mask_green_red --> mask_red_led in scd-fan.h (Calvin Laverty)  [Orabug: 39043148]
  - leds: use Linux LED device classes as intended (Fraser Gordon)  [Orabug: 39043148]
  - amax31732: Fix error in setting primary threshold (arista-hpandya)  [Orabug: 39043148]
  - amax31732: Enable beta comp on all 4 channels (arista-hpandya)  [Orabug: 39043148]
  - rds: Drop rds conn in connect worker if not in down state. (Rohit Nair)  [Orabug: 39045033]
  - uek-rpm: Enable FPROBE and FPROBE_EVENTS in UEK (Harshit Mogalapalli)  [Orabug: 39050941]
  - uek-rpm: T93: disable CONFIG_CPU_FREQ and CONFIG_ARM_SCMI_CPUFREQ (Thomas Tai)  [Orabug: 39052955]
  - mailbox: mvl-mhu: Refactor MHU RX interrupt handling (George Cherian)  [Orabug: 39052955]
  - driver: mmc: ACPI support added for eMMC driver for T9x. (Piyush Malgujar)  [Orabug: 39052955]
  - driver: mmc: Resolve issues reported by static analysis (Wojciech Bartczak)  [Orabug: 39052955]
  - driver: marvell: mmc: Removes static variables in tuning code (Wojciech Bartczak)  [Orabug: 39052955]
  - mmc: cavium: Add MMC polling method to support kmsg panic/oops write (Bhaskara Budiredla)  [Orabug: 39052955]
  - drivers: mmc: cleanup mmc_oops driver (Bhaskara Budiredla)  [Orabug: 39052955]
  - driver: mmc: Adds CMD tuning for eMMC HS200 mode (Wojciech Bartczak)  [Orabug: 39052955]
  - driver: mmc: Cleans up mmc code and prepare it for HS200 tuning update (Wojciech Bartczak)  [Orabug: 39052955]
  - driver: mmc: Adds device tree entries to control eMMC input timings (Wojciech Bartczak)  [Orabug: 39052955]
  - driver: mmc: Adds a way to dynamically control eMMC bus input timings (Wojciech Bartczak)  [Orabug: 39052955]
  - driver: mmc: Adds new overrides for eMMC bus output timings (Wojciech Bartczak)  [Orabug: 39052955]
  - octeontx2: mmc: Adds mechanism to modify output timings for MMC bus (Wojciech Bartczak)  [Orabug: 39052955]
  - drivers: mmc: enables mmc polling for pstore path (Bhaskara Budiredla)  [Orabug: 39052955]
  - mmc: octeontx2: fix handling calibration glitch (Aaron Williams)  [Orabug: 39052955]
  - mmc: octeontx2: Configure flags for T96 pass B0 (Chandrakala Chavva)  [Orabug: 39052955]
  - mmc: octeontx2: Use flags for hardware differences (Aaron Williams)  [Orabug: 39052955]
  - mmc: octeontx2: Fix tuning for T96 C0 (Chandrakala Chavva)  [Orabug: 39052955]
  - mmc: octeontx2: Add tuning support for HS400 mode (Aaron Williams)  [Orabug: 39052955]
  - mmc: octeontx2: speed limit for tx2-c0 (Sujeet Baranwal)  [Orabug: 39052955]
  - mmc: cavium: use calibrated timing taps (Peter Swain)  [Orabug: 39052955]
  - mmc: cavium: do not drop bus lock in tuning (Peter Swain)  [Orabug: 39052955]
  - mmc: cavium: slot switch by vqmmc/gpio (Peter Swain)  [Orabug: 39052955]
  - mmc: cavium: reorganize before vqmmc switching (Peter Swain)  [Orabug: 39052955]
  - mmc: octeontx2: cmd and data out values fixture (Sujeet Baranwal)  [Orabug: 39052955]
  - mmc: cavium: amend hs400 tuning (Peter Swain)  [Orabug: 39052955]
  - mmc: cavium: correct clock divisor (Peter Swain)  [Orabug: 39052955]
  - mmc: cavium: fix swiotlb buffer is full (Peter Swain)  [Orabug: 39052955]
  - mmc: cavium: avoid single-slot startup issues (Peter Swain)  [Orabug: 39052955]
  - mmc: cavium: execute_tuning for octeontx2 (Peter Swain)  [Orabug: 39052955]
  - mmc: cavium: track & apply CMD6 bus changes ASAP (Peter Swain)  [Orabug: 39052955]
  - mmc: octeontx2: cn96xx HS200-8wide-100MHz (Peter Swain)  [Orabug: 39052955]
  - mmc: cavium: CMD19/21 type correction (Peter Swain)  [Orabug: 39052955]
  - mmc: cavium: skip unavailable slots (Peter Swain)  [Orabug: 39052955]
  - mmc: cavium: finish_dma_single() should teardown/unmap (Peter Swain)  [Orabug: 39052955]
  - mmc: octeontx2: use device tree entries (Sujeet Baranwal)  [Orabug: 39052955]
  - mmc: octeontx2: emmc tuning for delay (Sujeet Baranwal)  [Orabug: 39052955]
  - mmc: octeontx2: calibrate tap delay (Sujeet Baranwal)  [Orabug: 39052955]
  - mmc: octeontx2: incorporate hw interface io ctl params (Sujeet Baranwal)  [Orabug: 39052955]
  - mmc: octeontx2: interrupt addition for ncb fault (Sujeet Baranwal)  [Orabug: 39052955]
  - mmc: octeontx2: emmc operation limited to 100 MHz (Sujeet Baranwal)  [Orabug: 39052955]
  - mmc: cavium: Use proper register to clear interrupts (Chandrakala Chavva)  [Orabug: 39052955]
  - mmc: cavium: fix shutdown deadlock with active sd-card (Peter Swain)  [Orabug: 39052955]
  - mmc: cavium: Configure sample command and data directly (Sujeet Baranwal)  [Orabug: 39052955]
  - mmc: octeontx2: add check for 8/9xxx chips (Sujeet Baranwal)  [Orabug: 39052955]
  - uek-rpm: T93: Configure EDAC & GHES support (Dave Kleikamp)  [Orabug: 39052955]
  - efi/Marvell: Work-around for bootefi memmap errors (Henry Willard)  [Orabug: 39052955]
  - soc: marvell: Add BERT support for OTX2/CN10K (Szymon Balcerak)  [Orabug: 39052955]
  - EDAC/mc: Modify memory error reporting print (Jaiprakash Singh)  [Orabug: 39052955]
  - edac: octeontx_edac: Reduce the log level for ghes prints (George Cherian)  [Orabug: 39052955]
  - ras:cn10k:BCP issue fix where CE errors are read as UE in kernel (Ashwin Kumar Sundararamakrishnan)  [Orabug: 39052955]
  - EDAC/mc: Common print format for CE and UE error (Jaiprakash Singh)  [Orabug: 39052955]
  - ras:edac: Modify processor_arm structure (Jaiprakash Singh)  [Orabug: 39052955]
  - ras:cn10k: Add support for external abort(EA) work queue (Jaiprakash Singh)  [Orabug: 39052955]
  - driver: edac: octeontx: Add CRC support. (Szymon Balcerak)  [Orabug: 39052955]
  - drivers: octeontx-edac: Refactor work thread to have common handler (Vasyl Gomonovych)  [Orabug: 39052955]
  - drivers: octeontx-edac: Add gic error decoder (Jayanthi Annadurai)  [Orabug: 39052955]
  - driver: edac: octeontx: offline/poison page on fatal/UE (Wladislav Wiebe)  [Orabug: 39052955]
  - driver: edac: octeontx: Improvements to GIC RAS handler (Chandrakala Chavva)  [Orabug: 39052955]
  - edac: octeontx: Add support for GIC RAS reporting (Jayanthi Annadurai)  [Orabug: 39052955]
  - edac: octeontx: Add error syndrome (Jayanthi Annadurai)  [Orabug: 39052955]
  - driver: edac: octeontx: Init MC grain (Vasyl Gomonovych)  [Orabug: 39052955]
  - driver: edac: octeontx: Add revision check for new pass of the chip (Chandrakala Chavva)  [Orabug: 39052955]
  - EDAC: Octeon: Init SDEI (Vasyl Gomonovych)  [Orabug: 39052955]
  - EDAC: Octeon: Add Marvell's OcteonTx2 SoC and CN10KA SoC EDAC driver (Vasyl Gomonovych)  [Orabug: 39052955]
  - octeontx2-af: Fix PF driver crash with kexec kernel booting (Anshumali Gaur)  [Orabug: 39052955]
  - octeontx2-af: add max_vfs module param (Tom Saeger)  [Orabug: 39052955]
  - PCI: boot time optimization (Harman Kalra)  [Orabug: 39052955]
  - uek-rpm: T93: enable CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE (Dave Kleikamp)  [Orabug: 39052955]
  - hv_netvsc: Use VF's tso_max_size value when data path is VF (Shradha Gupta)  [Orabug: 39065406]
  - net: mana: Allow tso_max_size to go up-to GSO_MAX_SIZE (Shradha Gupta)  [Orabug: 39065406]
  - vfio/mlx5: Add REINIT support to VFIO_MIG_GET_PRECOPY_INFO (Yishai Hadas)  [Orabug: 39065602]
  - vfio/mlx5: consider inflight SAVE during PRE_COPY (Yishai Hadas)  [Orabug: 39065602]
  - net/mlx5: Add IFC bits for migration state (Yishai Hadas)  [Orabug: 39065602]
  - vfio: Adapt drivers to use the core helper vfio_check_precopy_ioctl (Yishai Hadas)  [Orabug: 39065602]
  - vfio: Add support for VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2 (Yishai Hadas)  [Orabug: 39065602]
  - vfio: Define uAPI for re-init initial bytes during the PRE_COPY phase (Yishai Hadas)  [Orabug: 39065602]
  - exadata: tools: perf: use comm_ignore_digit for report, top (Stephen Brennan)  [Orabug: 39071703]
  - tools: perf: add comm_ignore_digit column (Stephen Brennan)  [Orabug: 39071703]
  - uek: kabi: Only do size allignment check on kabi_use when in 64 bit environment. (Yifei Liu)  [Orabug: 39089297]
  - scsi: target: core: Add emulation for REPORT IDENTIFYING INFORMATION (Gulam Mohamed)  [Orabug: 39098803]


author: Sherry Yang <sherry.yang@oracle.com> [6.12.0-201.74.2.el10uek]
changelog:
  - kabi: update kABI files for FIPS (Saeed Mirzamohammadi)  [Orabug: 38667144]
  - RDMA/mlx5: Fix ucaps init error flow (Maher Sanalla)  [Orabug: 38667144]
  - eth: mlx4: Fix IS_ERR() vs NULL check bug in mlx4_en_create_rx_ring (Miaoqian Lin)  [Orabug: 38667144]
  - RDMA/ucaps: Avoid format-security warning (Arnd Bergmann)  [Orabug: 38667144]
  - net/mlx5: fs, fix UAF in flow counter release (Moshe Shemesh)  [Orabug: 38667144]
  - net/mlx5: Not returning mlx5_link_info table when speed is unknown (Li Tian)  [Orabug: 38667144]
  - net/mlx5: CT: Use the correct counter offset (Vlad Dogaru)  [Orabug: 38667144]
  - net/mlx5: Reset bw_share field when changing a node's parent (Carolina Jubran)  [Orabug: 38667144]
  - net/mlx5e: Fix number of lanes to UNKNOWN when using data_rate_oper (Shahar Shitrit)  [Orabug: 38667144]
  - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Carolina Jubran)  [Orabug: 38667144]
  - mlx5: Fix default values in create CQ (Akiva Goldberger)  [Orabug: 38667144]
  - net/mlx5e: Prepare for using different CQ doorbells (Cosmin Ratiu)  [Orabug: 38667144]
  - net/mlx5: Store the global doorbell in mlx5_priv (Cosmin Ratiu)  [Orabug: 38667144]
  - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Cosmin Ratiu)  [Orabug: 38667144]
  - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Yishai Hadas)  [Orabug: 38667144]
  - RDMA/mlx5: Fix compilation warning when USER_ACCESS isn't set (Mark Bloch)  [Orabug: 38667144]
  - eth: mlx4: select PAGE_POOL (Greg Thelen)  [Orabug: 38667144]
  - net/mlx5e: TC, Don't offload CT commit if it's the last action (Jianbo Liu)  [Orabug: 38667144]
  - net/mlx5e: CT: Filter legacy rules that are unrelated to nic (Paul Blakey)  [Orabug: 38667144]
  - net/mlx5: Update pfnum retrieval for devlink port attributes (Shay Drory)  [Orabug: 38667144]
  - net/mlx5: fw reset, check bridge accessibility at earlier stage (Amir Tzin)  [Orabug: 38667144]
  - net/mlx5: Lag, use port selection tables when available (Mark Bloch)  [Orabug: 38667144]
  - net/mlx5e: TX, Utilize WQ fragments edge for multi-packet WQEs (Tariq Toukan)  [Orabug: 38667144]
  - net/mlx5: Start health poll after enable hca (Moshe Shemesh)  [Orabug: 38667144]
  - net/mlx5: LAG, reload representors on LAG creation failure (Mark Bloch)  [Orabug: 38667144]
  - mlxsw: spectrum_acl_bloom_filter: Workaround for some LLVM versions (WangYuli)  [Orabug: 38667144]
  - mlxsw: Add VXLAN bridge ports to same hardware domain as physical bridge ports (Amit Cohen)  [Orabug: 38667144]
  - mlxsw: spectrum_switchdev: Move mlxsw_sp_bridge_vxlan_join() (Amit Cohen)  [Orabug: 38667144]
  - mlxsw: spectrum_switchdev: Add an internal API for VXLAN leave (Amit Cohen)  [Orabug: 38667144]
  - mlxsw: spectrum: Call mlxsw_sp_bridge_vxlan_{join, leave}() for VLAN-aware bridge (Amit Cohen)  [Orabug: 38667144]
  - mlxsw: Trap ARP packets at layer 2 instead of layer 3 (Amit Cohen)  [Orabug: 38667144]
  - net/mlx5e: Always select CONFIG_PAGE_POOL_STATS (Tariq Toukan)  [Orabug: 38667144]
  - net/mlx5e: Use right API to free bitmap memory (Mark Zhang)  [Orabug: 38667144]
  - net/mlx5: Remove NULL check before dev_{put, hold} (Gal Pressman)  [Orabug: 38667144]
  - net/mlx5e: Fix ethtool -N flow-type ip4 to RSS context (Maxim Mikityanskiy)  [Orabug: 38667144]
  - i2c: mlxbf: Use readl_poll_timeout_atomic() for polling (Andy Shevchenko)  [Orabug: 38667144]
  - net/mlx5e: Expose port reset cycle recovery counter via ethtool (Yael Chemla)  [Orabug: 38667144]
  - net/mlx5e: Get counter group size by FW capability (Yael Chemla)  [Orabug: 38667144]
  - net/mlx5e: Access PHY layer counter group as other counter groups (Yael Chemla)  [Orabug: 38667144]
  - net/mlx5e: Ensure each counter group uses its PCAM bit (Yael Chemla)  [Orabug: 38667144]
  - leds: mlxcpld: Remove unused ACPI header inclusion (Andy Shevchenko)  [Orabug: 38667144]
  - net/mlx5: HWS, log the unsupported mask in definer (Yevgeny Kliteynik)  [Orabug: 38667144]
  - net/mlx5: HWS, use list_move() instead of del/add (Yevgeny Kliteynik)  [Orabug: 38667144]
  - net/mlx5: HWS, remove unused code for alias flow tables (Yevgeny Kliteynik)  [Orabug: 38667144]
  - RDMA/mlx5: Drop access_flags from _mlx5_mr_cache_alloc() (Michael Guralnik)  [Orabug: 38667144]
  - RDMA/mlx5: Support optional-counters binding for QPs (Patrisious Haddad)  [Orabug: 38667144]
  - RDMA/mlx5: Compile fs.c regardless of INFINIBAND_USER_ACCESS config (Patrisious Haddad)  [Orabug: 38667144]
  - RDMA/ionic: Implement device stats ops (Abhijit Gangurde)  [Orabug: 38667144]
  - RDMA/core: Pass port to counter bind/unbind operations (Patrisious Haddad)  [Orabug: 38667144]
  - Revert "RDMA/ionic: Implement device stats ops" (Qing Huang)  [Orabug: 38667144]
  - RDMA/core: Add support to optional-counters binding configuration (Patrisious Haddad)  [Orabug: 38667144]
  - RDMA/core: Create and destroy rdma_counter using rdma_zalloc_drv_obj() (Patrisious Haddad)  [Orabug: 38667144]
  - RDMA/mlx5: Add optional counters for RDMA_TX/RX_packets/bytes (Patrisious Haddad)  [Orabug: 38667144]
  - net/mlx5: Add support for setting parent of nodes (Carolina Jubran)  [Orabug: 38667144]
  - net/mlx5: Preserve rate settings when creating a rate node (Carolina Jubran)  [Orabug: 38667144]
  - net/mlx5: Introduce hierarchy level tracking on scheduling nodes (Carolina Jubran)  [Orabug: 38667144]
  - net/mlx5: Rename devlink rate parent set function for leaf nodes (Carolina Jubran)  [Orabug: 38667144]
  - net/mlx5: fs, add support for dest flow sampler HWS action (Moshe Shemesh)  [Orabug: 38667144]
  - net/mlx5: fs, add support for flow meters HWS action (Moshe Shemesh)  [Orabug: 38667144]
  - net/mlx5: fs, add API for sharing HWS action by refcount (Moshe Shemesh)  [Orabug: 38667144]
  - netdevsim: 'support' multi-buf XDP (Jakub Kicinski)  [Orabug: 38667144]
  - net/mlx5: Avoid unnecessary use of comma operator (Simon Horman)  [Orabug: 38667144]
  - mmc: sdhci-of-dwcmshc: Change to dwcmshc_phy_init for reusing codes (Jaehoon Chung)  [Orabug: 38667144]
  - net/mlx5: Add IFC bits for PPCNT recovery counters group (Yael Chemla)  [Orabug: 38667144]
  - RDMA/mlx5: Expose RDMA TRANSPORT flow table types to userspace (Patrisious Haddad)  [Orabug: 38667144]
  - RDMA/mlx5: Check enabled UCAPs when creating ucontext (Chiara Meiohas)  [Orabug: 38667144]
  - RDMA/uverbs: Add support for UCAPs in context creation (Chiara Meiohas)  [Orabug: 38667144]
  - RDMA/mlx5: Create UCAP char devices for supported device capabilities (Chiara Meiohas)  [Orabug: 38667144]
  - RDMA/uverbs: Introduce UCAP (User CAPabilities) API (Chiara Meiohas)  [Orabug: 38667144]
  - net/mlx5: fs, add RDMA TRANSPORT steering domain support (Patrisious Haddad)  [Orabug: 38667144]
  - net/mlx5: Query ADV_RDMA capabilities (Patrisious Haddad)  [Orabug: 38667144]
  - net/mlx5: Limit non-privileged commands (Chiara Meiohas)  [Orabug: 38667144]
  - net/mlx5: Allow the throttle mechanism to be more dynamic (Chiara Meiohas)  [Orabug: 38667144]
  - net/mlx5: Add RDMA_CTRL HW capabilities (Chiara Meiohas)  [Orabug: 38667144]
  - net/mlx5e: Properly match IPsec subnet addresses (Leon Romanovsky)  [Orabug: 38667144]
  - net/mlx5e: Separate address related variables to be in struct (Leon Romanovsky)  [Orabug: 38667144]
  - net/mlx5: Lag, Enable Multiport E-Switch offloads on 8 ports LAG (Amir Tzin)  [Orabug: 38667144]
  - net/mlx5e: Enable lanes configuration when auto-negotiation is off (Shahar Shitrit)  [Orabug: 38667144]
  - net/mlx5: Refactor link speed handling with mlx5_link_info struct (Shahar Shitrit)  [Orabug: 38667144]
  - net: rename netns_local to netns_immutable (Nicolas Dichtel)  [Orabug: 38667144]
  - RDMA/mlx5: Reorder capability check last (Christian Göttsche)  [Orabug: 38667144]
  - net/mlx5: Add trust lockdown error to health syndrome print function (Shahar Shitrit)  [Orabug: 38667144]
  - net/mlx5: Expose crr in health buffer (Shahar Shitrit)  [Orabug: 38667144]
  - net/mlx5: Log health buffer data on any syndrome (Moshe Shemesh)  [Orabug: 38667144]
  - net/mlx5: Remove newline at the end of a netlink error message (Gal Pressman)  [Orabug: 38667144]
  - net/mlx5e: Avoid a hundred -Wflex-array-member-not-at-end warnings (Gustavo A. R. Silva)  [Orabug: 38667144]
  - net/mlx5e: Symmetric OR-XOR RSS hash control (Gal Pressman)  [Orabug: 38667144]
  - ethtool: Symmetric OR-XOR RSS hash (Gal Pressman)  [Orabug: 38667144]
  - net/mlx5: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum)  [Orabug: 38667144]
  - net/mlx5: Add new health syndrome error and crr bit offset (Shahar Shitrit)  [Orabug: 38667144]
  - xfrm: provide common xdo_dev_offload_ok callback implementation (Leon Romanovsky)  [Orabug: 38667144]
  - xfrm: rely on XFRM offload (Leon Romanovsky)  [Orabug: 38667144]
  - net/mlx5e: Separate extended link modes request from link modes type selection (Shahar Shitrit)  [Orabug: 38667144]
  - net/mlx5e: Change eth_proto parameter naming (Shahar Shitrit)  [Orabug: 38667144]
  - net/mlx5e: Introduce ptys2ethtool_process_link() (Shahar Shitrit)  [Orabug: 38667144]
  - net/mlx5e: Refactor ptys2ethtool_adver_link() (Shahar Shitrit)  [Orabug: 38667144]
  - net/mlx5: Bridge, correct config option description (Cosmin Ratiu)  [Orabug: 38667144]
  - netdevsim: call napi_schedule from a timer context (Breno Leitao)  [Orabug: 38667144]
  - eth: mlx4: use the page pool for Rx buffers (Jakub Kicinski)  [Orabug: 38667144]
  - eth: mlx4: remove the local XDP fast-recycling ring (Jakub Kicinski)  [Orabug: 38667144]
  - eth: mlx4: create a page pool for Rx (Jakub Kicinski)  [Orabug: 38667144]
  - net/mlx5: Add sensor name to temperature event message (Shahar Shitrit)  [Orabug: 38667144]
  - net/mlx5: Prefix temperature event bitmap with '0x' for clarity (Shahar Shitrit)  [Orabug: 38667144]
  - net/mlx5e: Expose RSS via devlink rx reporter diagnose (Amir Tzin)  [Orabug: 38667144]
  - net/mlx5e: Add direct TIRs to devlink rx reporter diagnose (Amir Tzin)  [Orabug: 38667144]
  - net/mlx5e: Move RQs diagnose to a dedicated function (Amir Tzin)  [Orabug: 38667144]
  - mlxsw: Enable Tx checksum offload (Ido Schimmel)  [Orabug: 38667144]
  - net/mlx5e: Remove unused mlx5e_tc_flow_action struct (Gal Pressman)  [Orabug: 38667144]
  - net/mlx5: Remove stray semicolon in LAG port selection table creation (Gal Pressman)  [Orabug: 38667144]
  - net/mlx5e: Support FEC settings for 200G per lane link modes (Jianbo Liu)  [Orabug: 38667144]
  - net/mlx5: Add support for 200Gbps per lane link modes (Jianbo Liu)  [Orabug: 38667144]
  - ethtool: Add support for 200Gbps per lane link modes (Jianbo Liu)  [Orabug: 38667144]
  - net/mlx5: Generate PPS IN event on new function for shared clock (Jianbo Liu)  [Orabug: 38667144]
  - net/mlx5: Support one PTP device per hardware clock (Jianbo Liu)  [Orabug: 38667144]
  - net/mlx5: Move PPS notifier and out_work to clock_state (Jianbo Liu)  [Orabug: 38667144]
  - net/mlx5: Add devcom component for the clock shared by functions (Jianbo Liu)  [Orabug: 38667144]
  - net/mlx5: Change clock in mlx5_core_dev to mlx5_clock pointer (Jianbo Liu)  [Orabug: 38667144]
  - net/mlx5: Add API to get mlx5_core_dev from mlx5_clock (Jianbo Liu)  [Orabug: 38667144]
  - net/mlx5: Add init and destruction functions for a single HW clock (Jianbo Liu)  [Orabug: 38667144]
  - net/mlx5: Change parameters for PTP internal functions (Jianbo Liu)  [Orabug: 38667144]
  - net/mlx5: Add helper functions for PTP callbacks (Jianbo Liu)  [Orabug: 38667144]
  - mlxsw: spectrum_router: Remove unused functions (Dr. David Alan Gilbert)  [Orabug: 38667144]
  - net/mlx5: Remove unused mlx5dr_domain_sync (Dr. David Alan Gilbert)  [Orabug: 38667144]
  - mlx4: Remove unused functions (Dr. David Alan Gilbert)  [Orabug: 38667144]
  - platform: mellanox: mlx-platform: Change register name (Vadim Pasternak)  [Orabug: 38667144]
  - platform: mellanox: mlx-platform: Cosmetic changes (Vadim Pasternak)  [Orabug: 38667144]
  - mellanox: Relocate mlx-platform driver (Vadim Pasternak)  [Orabug: 38667144]
  - jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Easwar Hariharan)  [Orabug: 38667144]
  - ktime: Add us_to_ktime() (David Howells)  [Orabug: 38667144]
  - Revert "mlx5: Fix default values in create CQ" (Qing Huang)  [Orabug: 38667144]
  - net/mlx5: poll mlx5 eq during irq migration (Praveen Kumar Kannoju)  [Orabug: 38915249]
  - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Inseo An)  [Orabug: 39044468]  {CVE-2026-23231}
  - scsi: core: Fix error handling for scsi_alloc_sdev() (Junxiao Bi)  [Orabug: 39104869]
  - scsi: core: Fix refcount leak for tagset_refcnt (Junxiao Bi)  [Orabug: 39104869]
  - scsi: core: Move two statements (Bart Van Assche)  [Orabug: 39104869]
  - vfio: Adapt to upstream uAPI for VFIO_PRECOPY_INFO_REINIT (Maciej S. Szmigiero)  [Orabug: 39121644]
  - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson)  [Orabug: 39153394]  {CVE-2026-23401}


author: Sherry Yang <sherry.yang@oracle.com> [6.12.0-201.74.2.1.el10uek]
changelog:
  - Revert "rds: Drop rds conn in connect worker if not in down state." (Vijayendra Suman)  [Orabug: 39200413]  
  - io_uring/kbuf: check if target buffer list is still legacy on recycle (Jens Axboe)  [Orabug: 39202438]  
  - ipv6: use RCU in ip6_xmit() (Eric Dumazet)  [Orabug: 39202432]  {CVE-2025-40135} 
  - dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (Eric Dumazet)  [Orabug: 39202431]  {CVE-2026-23004}


author: Sherry Yang <sherry.yang@oracle.com> [6.12.0-201.74.2.1.el10uek]
changelog:
  - Revert "rds: Drop rds conn in connect worker if not in down state." (Vijayendra Suman)  [Orabug: 39200413]
  - io_uring/kbuf: check if target buffer list is still legacy on recycle (Jens Axboe)  [Orabug: 39202438]
  - ipv6: use RCU in ip6_xmit() (Eric Dumazet)  [Orabug: 39202432]  {CVE-2025-40135}
  - dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (Eric Dumazet)  [Orabug: 39202431]  {CVE-2026-23004}


author: Sherry Yang <sherry.yang@oracle.com> [6.12.0-201.74.2.2.el10uek]
changelog:
  - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu)  [Orabug: 39292190]  
  - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu)  [Orabug: 39292190]  
  - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu)  [Orabug: 39292190]  
  - crypto: authenc - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39292190]  
  - crypto: algif_aead - snapshot IV for async AEAD requests (Douya Le)  [Orabug: 39292190]  
  - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu)  [Orabug: 39292190]  {CVE-2026-31431} 
  - crypto: algif_aead - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39292190]  
  - crypto: scatterwalk - Backport memcpy_sglist() (Eric Biggers)  [Orabug: 39292190]  
  - uek-rpm: Enable FWCTL modules for aarch64 (Dave Kleikamp)  [Orabug: 39292173]  
  - uek-rpm: CONFIG_INTEL_IOMMU_SCALABLE_MODE_DEFAULT_ON should be set (Dave Kleikamp)  [Orabug: 39292151]  
  - x86/CPU: Fix FPDSS on Zen1 (Borislav Petkov (AMD))  [Orabug: 39292145]


author: Sherry Yang <sherry.yang@oracle.com> [6.12.0-201.74.2.2.el10uek]
changelog:
  - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu)  [Orabug: 39292190]
  - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu)  [Orabug: 39292190]
  - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu)  [Orabug: 39292190]
  - crypto: authenc - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39292190]
  - crypto: algif_aead - snapshot IV for async AEAD requests (Douya Le)  [Orabug: 39292190]
  - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu)  [Orabug: 39292190]  {CVE-2026-31431}
  - crypto: algif_aead - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39292190]
  - crypto: scatterwalk - Backport memcpy_sglist() (Eric Biggers)  [Orabug: 39292190]
  - uek-rpm: Enable FWCTL modules for aarch64 (Dave Kleikamp)  [Orabug: 39292173]
  - uek-rpm: CONFIG_INTEL_IOMMU_SCALABLE_MODE_DEFAULT_ON should be set (Dave Kleikamp)  [Orabug: 39292151]
  - x86/CPU: Fix FPDSS on Zen1 (Borislav Petkov (AMD))  [Orabug: 39292145]


author: Samasth Norway Ananda <samasth.norway.ananda@oracle.com> [6.12.0-201.74.2.3.el10uek]
changelog:
  - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Hyunwoo Kim)  [Orabug: 39342689]  {CVE-2026-43500} 
  - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (David Howells)  [Orabug: 39342689]  
  - rxrpc: only handle RESPONSE during service challenge (Wang Jie)  [Orabug: 39342689]  
  - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (David Howells)  [Orabug: 39342689]  
  - rxrpc: Fix potential UAF after skb_unshare() failure (David Howells)  [Orabug: 39342689]  
  - rxrpc: Fix re-decryption of RESPONSE packets (David Howells)  [Orabug: 39342689]  
  - xfrm: esp: avoid in-place decrypt on shared skb frags (Kuan-Ting Chen)  [Orabug: 39342689]  {CVE-2026-43284}


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-200.74.26.el10uek]
changelog:
  - pds_core: init viftype default in declaration (Shannon Nelson) [Orabug: 38467343]
  - pds_core: smaller adminq poll starting interval (Shannon Nelson) [Orabug: 38467343]
  - pds_core: Allocate pdsc_viftype_defaults copy with ARRAY_SIZE() (Kees Cook) [Orabug: 38467343]
  - pds_fwctl: Fix type and endian complaints (Shannon Nelson) [Orabug: 38467343]
  - x86/kexec: add a sanity check on previous kernel's ima kexec buffer (Harshit Mogalapalli) [Orabug: 38608974]
  - of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() (Harshit Mogalapalli) [Orabug: 38608974]
  - ima: verify the previous kernel's IMA buffer lies in addressable RAM (Harshit Mogalapalli) [Orabug: 38608974]
  - rds: Add state field to RDS trace logs. (Rohit Nair) [Orabug: 38870356]
  - uek-rpm: set default kfence sampling interval to 0 (Imran Khan) [Orabug: 38913539]
  - Revert "NFS: Avoid changing nlink when file removes and attribute updates race" (Samasth Norway Ananda) [Orabug: 38925844]
  - crypto_user: use FIPS algorithm list when FIPS module is enabled (Saeed Mirzamohammadi) [Orabug: 38934207]
  - uek-rpm: update kABI for FIPS regarding crypto_user (Saeed Mirzamohammadi) [Orabug: 38934207]
  - fips: remove crypto_user from the FIPS module (Saeed Mirzamohammadi) [Orabug: 38934207]
  - alloc_tag: prevent enabling memory profiling if it was shut down (Suren Baghdasaryan) [Orabug: 38945943]
  - alloc_tag: avoid current->alloc_tag manipulations when profiling is disabled (Suren Baghdasaryan) [Orabug: 38945943]
  - mm/codetag: fix arg in pgalloc_tag_copy alloc_tag_sub (Sourav Panda) [Orabug: 38945943]
  - uek-rpm: fips: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38949665]
  - selftests/mm: skip pkey_sighandler_tests if support is missing (Harshit Mogalapalli) [Orabug: 38969139]
  - selftests/mm: rename pkey register macro (Harshit Mogalapalli) [Orabug: 38969139]
  - selftests/mm: use sys_pkey helpers consistently (Harshit Mogalapalli) [Orabug: 38969139]
  - selftests/mm: ensure non-global pkey symbols are marked static (Harshit Mogalapalli) [Orabug: 38969139]
  - selftests/mm: remove empty pkey helper definition (Harshit Mogalapalli) [Orabug: 38969139]
  - selftests/mm: ensure pkey-*.h define inline functions only (Harshit Mogalapalli) [Orabug: 38969139]
  - selftests/mm: define types using typedef in pkey-helpers.h (Harshit Mogalapalli) [Orabug: 38969139]
  - selftests/mm: remove unused pkey helpers (Harshit Mogalapalli) [Orabug: 38969139]
  - selftests/mm: fix -Warray-bounds warnings in pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
  - selftests/mm: Define PKEY_UNRESTRICTED for pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
  - selftests/mm: Use generic pkey register manipulation (Harshit Mogalapalli) [Orabug: 38969139]
  - ionic: Rate limit unknown xcvr type messages (Eric Joyner) [Orabug: 38977643]
  - Octeontx2-af: Add proper checks for fwdata (Hariprasad Kelam) [Orabug: 38988497]
  - genirq/cpuhotplug: Notify about affinity changes breaking the affinity mask (Imran Khan) [Orabug: 39001909]
  - LTS version: v6.12.74 (Jack Vogel)
  - USB: serial: option: add Telit FN920C04 RNDIS compositions (Fabio Porcedda)
  - f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes (Yongpeng Yang)
  - f2fs: fix to avoid UAF in f2fs_write_end_io() (Chao Yu)
  - iommu/arm-smmu-qcom: do not register driver in probe() (Danilo Krummrich)
  - f2fs: fix to avoid mapping wrong physical block for swapfile (Chao Yu)
  - f2fs: fix out-of-bounds access in sysfs attribute read/write (Yongpeng Yang)
  - f2fs: fix to check sysfs filename w/ gc_pin_file_thresh correctly (Chao Yu)
  - f2fs: fix to add gc count stat in f2fs_gc_range (Zhiguo Niu)
  - fbdev: smscufx: properly copy ioctl memory to kernelspace (Greg Kroah-Hartman)
  - fbdev: rivafb: fix divide error in nv3_arb() (Guangshuo Li) [Orabug: 39103202] {CVE-2026-23266}
  - cpuset: Fix missing adaptation for cpuset_is_populated (Chen Ridong)
  - Revert "wireguard: device: enable threaded NAPI" (Daniel Borkmann)
  - LoongArch: Rework KASAN initialization for PTW-enabled systems (Tiezhu Yang)
  - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (David Hildenbrand)
  - mm/hugetlb: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
  - mm/hugetlb: fix hugetlb_pmd_shared() (David Hildenbrand) [Orabug: 38931087] {CVE-2026-23100}
  - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Jane Chu)
  - gpiolib: acpi: Fix gpio count with string references (Alban Bedel)
  - ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
  - drm/amd/display: remove assert around dpp_base replacement (Melissa Wen)
  - drm/amd/display: extend delta clamping logic to CM3 LUT helper (Melissa Wen)
  - tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow (Deepanshu Kartikey) [Orabug: 39131086] {CVE-2026-23390}
  - ASoC: cs42l43: Correct handling of 3-pole jack load detection (Charles Keepax)
  - platform/x86: panasonic-laptop: Fix sysfs group leak in error path (Rafael J. Wysocki)
  - platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro (Gongqi)
  - ALSA: hda/realtek: Enable headset mic for Acer Nitro 5 (Breno Baptista)
  - ASoC: amd: yc: Add quirk for HP 200 G2a 16 (Dirk Su)
  - ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 (Tagir Garaev)
  - platform/x86: classmate-laptop: Add missing NULL pointer checks (Rafael J. Wysocki) [Orabug: 39044501] {CVE-2026-23237}
  - drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used (Brahmajit Das)
  - romfs: check sb_set_blocksize() return value (Deepanshu Kartikey)
  - ALSA: hda/realtek - fixed speaker no sound (Kailang Yang)
  - ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel (Ricardo Rivera-Matos)
  - ALSA: hda/realtek: Add quirk for Inspur S14-G1 (Zhang Heng)
  - gpio: sprd: Change sprd_gpio lock to raw_spin_lock (Xuewen Yan)
  - ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list (Anatolii Shirykalov)
  - ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
  - bus: fsl-mc: fix use-after-free in driver_override_show() (Gui-Dong Han)
  - bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions (Chelsy Ratnawat)
  - bnxt_en: hide CONFIG_DETECT_HUNG_TASK specific code (Arnd Bergmann)
  - bnxt_en: Change FW message timeout warning (Michael Chan)
  - scsi: qla2xxx: Fix bsg_done() causing double free (Anil Gurumurthy) [Orabug: 39044457] {CVE-2025-71238}
  - LTS version: v6.12.73 (Jack Vogel)
  - Revert "driver core: enforce device_lock for driver_match_device()" (Greg Kroah-Hartman)
  - LTS version: v6.12.72 (Jack Vogel)
  - gpio: omap: do not register driver in probe() (Danilo Krummrich)
  - wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add (Ali Tariq) [Orabug: 38997990] {CVE-2025-71234}
  - PCI: endpoint: Avoid creating sub-groups asynchronously (Liu Song)
  - xfs: fix UAF in xchk_btree_check_block_owner (Darrick J. Wong) [Orabug: 38998028] {CVE-2026-23223}
  - erofs: fix UAF issue for file-backed mounts w/ directio option (Chao Yu)
  - mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (Eric Dumazet)
  - bus: mhi: host: pci_generic: Add Telit FE990B40 modem support (Daniele Palmas)
  - scsi: qla2xxx: Query FW again before proceeding with login (Anil Gurumurthy)
  - scsi: qla2xxx: Free sp in error path to fix system crash (Anil Gurumurthy) [Orabug: 38997979] {CVE-2025-71232}
  - scsi: qla2xxx: Delay module unload while fabric scan in progress (Anil Gurumurthy) [Orabug: 38997992] {CVE-2025-71235}
  - scsi: qla2xxx: Allow recovery for tape devices (Shreyas Deodhar)
  - scsi: qla2xxx: Validate sp before freeing associated memory (Anil Gurumurthy) [Orabug: 38997998] {CVE-2025-71236}
  - wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() (Bitterblue Smith) [Orabug: 38997972] {CVE-2025-71229}
  - nilfs2: Fix potential block overflow that cause system hang (Edward Adam Davis)
  - crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req (Bibo Mao)
  - crypto: virtio - Add spinlock protection with virtqueue notification (Bibo Mao) [Orabug: 38998052] {CVE-2026-23229}
  - crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly (Kees Cook)
  - crypto: octeontx - Fix length check to avoid truncation in ucode_load_store (Thorsten Blum)
  - crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (Thorsten Blum) [Orabug: 38997976] {CVE-2025-71231}
  - Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB (Zenm Chen)
  - driver core: enforce device_lock for driver_match_device() (Gui-Dong Han)
  - smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() (Henrique Carvalho)
  - ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths (Namjae Jeon)
  - smb: client: split cached_fid bitfields to avoid shared-byte RMW races (Henrique Carvalho) [Orabug: 38998059] {CVE-2026-23230}
  - LTS version: v6.12.71 (Jack Vogel)
  - vsock/test: verify socket options after setting them (Konstantin Shkolnyy)
  - io_uring/rw: recycle buffers manually for non-mshot reads (Jens Axboe)
  - LTS version: v6.12.70 (Jack Vogel)
  - gpiolib-acpi: Update file references in the Documentation and MAINTAINERS (Andy Shevchenko)
  - ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU. (Werner Sembach)
  - spi: tegra114: Preserve SPI mode bits in def_command1_reg (Vishwaroop A)
  - spi: tegra: Fix a memory leak in tegra_slink_probe() (Felix Gu)
  - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Breno Leitao)
  - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Breno Leitao) [Orabug: 38970593] {CVE-2026-23202}
  - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Breno Leitao)
  - spi: tegra210-quad: Move curr_xfer read inside spinlock (Breno Leitao)
  - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Breno Leitao)
  - ASoC: amd: fix memory leak in acp3x pdm dma ops (Chris Bainbridge) [Orabug: 38970441] {CVE-2026-23190}
  - ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update() (Sergey Shtylyov)
  - ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF (Shigeru Yoshida) [Orabug: 38970598] {CVE-2026-23200}
  - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano) [Orabug: 38970170] {CVE-2026-23111}
  - hwmon: (occ) Mark occ_init_attribute() as __printf (Arnd Bergmann)
  - drm/xe/pm: Disable D3Cold for BMG only on specific platforms (Karthik Poosa)
  - drm/xe/pm: Also avoid missing outer rpm warning on system suspend (Rodrigo Vivi)
  - drm/xe/query: Fix topology query pointer advance (Shuicheng Lin)
  - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jacob Keller)
  - net: gro: fix outer network offset (Paolo Abeni) [Orabug: 39103144] {CVE-2026-23254}
  - net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi() (Chen Ni)
  - drm/amd/display: fix wrong color value mapping on MCM shaper LUT (Melissa Wen)
  - tipc: use kfree_sensitive() for session key material (Daniel Hodges)
  - net: don't touch dev->stats in BPF redirect paths (Jakub Kicinski)
  - net: usb: r8152: fix resume reset deadlock (Sergey Senozhatsky) [Orabug: 38970438] {CVE-2026-23188}
  - macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet) [Orabug: 38970508] {CVE-2026-23209}
  - net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module (Marek Behún)
  - net: sfp: convert sfp quirks to modify struct sfp_module_support (Russell King)
  - net: sfp: pre-parse the module support (Russell King)
  - net: phy: add phy_interface_copy() (Russell King)
  - net: phy: add phy_interface_weight() (Russell King)
  - dpaa2-switch: add bounds check for if_id in IRQ handler (Junrui Luo)
  - net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup (Zilin Guan)
  - net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup (Zilin Guan)
  - net: liquidio: Initialize netdev pointer before queue setup (Zilin Guan)
  - dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (Junrui Luo)
  - net/sched: cls_u32: use skb_header_pointer_careful() (Eric Dumazet) [Orabug: 38970487] {CVE-2026-23204}
  - net: add skb_header_pointer_careful() helper (Eric Dumazet)
  - smb/client: fix memory leak in smb2_open_file() (Chenxiaosong) [Orabug: 38970578] {CVE-2026-23205}
  - platform/x86/intel/tpmi/plr: Make the file domain<n>/status writeable (Ricardo Neri)
  - platform/x86: hp-bioscfg: Skip empty attribute names (Mario Limonciello)
  - platform/x86: intel_telemetry: Fix PSS event register mask (Kaushlendra Kumar)
  - platform/x86: toshiba_haps: Fix memory leaks in add/remove routines (Rafael J. Wysocki)
  - ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio (Martin Hamilton)
  - btrfs: reject new transactions if the fs is fully read-only (Qu Wenruo) [Orabug: 38985156] {CVE-2026-23214}
  - wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice (Miri Korenblit)
  - wifi: mac80211: correctly check if CSA is active (Miri Korenblit)
  - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi) [Orabug: 38985169] {CVE-2026-23216}
  - ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
  - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi) [Orabug: 38970453] {CVE-2026-23193}
  - wifi: cfg80211: Fix bitrate calculation overflow for HE rates (Veerendranath Jakkam)
  - regmap: maple: free entry on mas_store_gfp() failure (Kaushlendra Kumar) [Orabug: 39103173] {CVE-2026-23260}
  - spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization (Devyn Liu)
  - ASoC: tlv320adcx140: Propagate error codes during probe (Dimitrios Katsaros)
  - ASoC: amd: yc: Fix microphone on ASUS M6500RE (Radhi Bajahaw)
  - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (Hannes Reinecke) [Orabug: 38970416] {CVE-2026-23179}
  - nvme-fc: release admin tagset if init fails (Chaitanya Kulkarni) [Orabug: 39103180] {CVE-2026-23261}
  - ASoC: simple-card-utils: Check device node before overwrite direction (Shengjiu Wang)
  - ASoC: davinci-evm: Fix reference leak in davinci_evm_probe (Kery Qi)
  - wifi: mac80211: collect station statistics earlier when disconnect (Baochen Qiang)
  - HID: logitech: add HID++ support for Logitech MX Anywhere 3S (Dennis Marttinen)
  - ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free (Ma Wupeng)
  - drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (Perry Yuan) [Orabug: 38985149] {CVE-2026-23213}
  - HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) (Rodrigo Lugathe Da Conceição Alves)
  - HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() (Kwok Kin Ming) [Orabug: 38970413] {CVE-2026-23178}
  - HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list (Chris Chiu)
  - netfilter: replace -EEXIST with -EBUSY (Daniel Gomez)
  - PCI: qcom: Remove ASPM L0s support for MSM8996 SoC (Manivannan Sadhasivam)
  - ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk (Ruslan Krupitsa)
  - ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55 (Matouš Lánský)
  - HID: playstation: Center initial joystick axes to prevent spurious events (Siarhei Vishniakou)
  - HID: intel-ish-hid: Reset enum_devices_done before enumeration (Zhang Lixu)
  - riscv: Sanitize syscall table indexing under speculation (Lukas Gerlach)
  - btrfs: fix reservation leak in some error paths when inserting inline extent (Filipe Manana) [Orabug: 39103081] {CVE-2025-71268}
  - HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL (Daytoncl)
  - HID: intel-ish-hid: Update ishtp bus match to support device ID table (Zhang Lixu)
  - smb/server: fix refcount leak in parse_durable_handle_context() (Zhangguodong)
  - LoongArch: Enable exception fixup for specific ADE subcode (Duan Chenghao)
  - smb/server: fix refcount leak in smb2_open() (Zhangguodong)
  - md: suspend array while updating raid_disks via sysfs (Danny Shih) [Orabug: 38985108] {CVE-2025-71225}
  - LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED (Huacai Chen)
  - smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() (Zhangguodong)
  - block,bfq: fix aux stat accumulation destination (Shechenglong)
  - net: usb: sr9700: support devices with virtual driver CD (Ethan Nelson-Moore)
  - wifi: wlcore: ensure skb headroom before skb_push (Peter Astrand) [Orabug: 38970152] {CVE-2025-71222}
  - wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (Moon Hee Lee) [Orabug: 38970163] {CVE-2025-71224}
  - tracing: Fix ftrace event field alignments (Steven Rostedt)
  - procfs: avoid fetching build ID while holding VMA lock (Andrii Nakryiko) [Orabug: 38970476] {CVE-2026-23199}
  - KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures (Zhiquan Li)
  - binderfs: fix ida_alloc_max() upper bound (Carlos Llamas)
  - binder: fix BR_FROZEN_REPLY error log (Carlos Llamas)
  - hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Kang Chen)
  - ublk: fix deadlock when reading partition table (Ming Lei)
  - tools/power turbostat: fix GCC9 build regression (Todd Brandt)
  - PCI/ERR: Ensure error recoverability at all times (Lukas Wunner)
  - KVM: Don't clobber irqfd routing type when deassigning irqfd (Sean Christopherson) [Orabug: 38970465] {CVE-2026-23198}
  - Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" (Bert Karwatzki) [Orabug: 39103191] {CVE-2026-23264}
  - mm, shmem: prevent infinite loop on truncate race (Kairui Song) [Orabug: 38970409] {CVE-2026-23177}
  - gve: Correct ethtool rx_dropped calculation (Max Yuan)
  - gve: Fix stats report corruption on queue count change (Debarghya Kundu) [Orabug: 39103187] {CVE-2026-23262}
  - ceph: fix oops due to invalid pointer for kfree() in parse_longname() (Daniel Vogelbacher) [Orabug: 38970590] {CVE-2026-23201}
  - ARM: 9468/1: fix memset64() on big-endian (Thomas Weißschuh)
  - rbd: check for EOD after exclusive lock is ensured to be held (Ilya Dryomov)
  - ceph: fix NULL pointer dereference in ceph_mds_auth_match() (Viacheslav Dubeyko) [Orabug: 38970595] {CVE-2026-23189}
  - mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single (Hao Ge) [Orabug: 38985192] {CVE-2026-23219}
  - pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc->domains (Xu Yang)
  - pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup (Xu Yang)
  - pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset (Jacky Bai)
  - pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup (Xu Yang)
  - pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state (Gabor Juhos)
  - ALSA: aloop: Fix racy access at PCM trigger (Takashi Iwai) [Orabug: 38970445] {CVE-2026-23191}
  - platform/x86: intel_telemetry: Fix swapped arrays in PSS output (Kaushlendra Kumar)
  - x86/kfence: fix booting on 32bit non-PAE systems (Andrew Cooper)
  - x86/vmware: Fix hypercall clobbers (Josh Poimboeuf) [Orabug: 38985163] {CVE-2026-23215}
  - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (Yunje Shin) [Orabug: 38970176] {CVE-2026-23112}
  - LTS version: v6.12.69 (Jack Vogel)
  - bpf/selftests: test_select_reuseport_kern: Remove unused header (Alexis Lothoré)
  - RDMA/mana_ib: Handle net event for pointing to the current netdev (Long Li)
  - net: mana: Change the function signature of mana_get_primary_netdev_rcu (Long Li)
  - pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver (Bartosz Golaszewski)
  - drm/amdgpu/gfx11: adjust KGQ reset sequence (Alex Deucher)
  - writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 (Laveesh Bansal)
  - perf: sched: Fix perf crash with new is_user_task() helper (Steven Rostedt) [Orabug: 38970581] {CVE-2026-23159}
  - perf: Simplify get_perf_callchain() user logic (Josh Poimboeuf)
  - mptcp: avoid dup SUB_CLOSED events after disconnect (Matthieu Baerts)
  - pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins (Krzysztof Kozlowski)
  - net/sched: act_ife: convert comma to semicolon (Chen Ni)
  - btrfs: prevent use-after-free on folio private data in btrfs_subpage_clear_uptodate() (Jp Kobryn)
  - Revert "drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)" (John Ogness)
  - wifi: ath11k: add srng->lock for ath11k_hal_srng_* in monitor mode (Kang Yang) [Orabug: 37844126] {CVE-2024-58096}
  - mm/kfence: randomize the freelist on initialization (Pimyn Girgis)
  - libbpf: Fix -Wdiscarded-qualifiers under C23 (Mikhail Gavrilov)
  - ksmbd: smbd: fix dma_unmap_sg() nents (Thomas Fourier)
  - rxrpc: Fix data-race warning and potential load/store tearing (David Howells)
  - cgroup: Fix kernfs_node UAF in css_free_rwork_fn (T.J. Mercier)
  - rust: kbuild: support `-Cjump-tables=n` for Rust 1.93.0 (Miguel Ojeda)
  - gpiolib: acpi: Fix potential out-of-boundary left shift (Andy Shevchenko)
  - drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule() (Alex Deucher)
  - drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (Jon Doron) [Orabug: 38970348] {CVE-2026-23163}
  - drm/amdgpu/gfx12: fix wptr reset in KGQ init (Alex Deucher)
  - drm/amdgpu/gfx11: fix wptr reset in KGQ init (Alex Deucher)
  - drm/amdgpu/gfx10: fix wptr reset in KGQ init (Alex Deucher)
  - drm/amdgpu/soc21: fix xclk for APUs (Alex Deucher)
  - drm/imx/tve: fix probe device leak (Johan Hovold)
  - drm/msm/a6xx: fix bogus hwcg register updates (Johan Hovold)
  - scripts: generate_rust_analyzer: Add compiler_builtins -> core dep (Tamir Duberstein)
  - scripts: generate_rust_analyzer: compile sysroot with correct edition (Tamir Duberstein)
  - scripts: generate_rust_analyzer: remove sysroot assertion (Onur Özkan)
  - net: fix segmentation of forwarding fraglist GRO (Jibin Zhang) [Orabug: 38970318] {CVE-2026-23154}
  - mm/shmem, swap: fix race of truncate and swap entry split (Kairui Song) [Orabug: 38970345] {CVE-2026-23161}
  - flex_proportions: make fprop_new_period() hardirq safe (Jan Kara) [Orabug: 38970373] {CVE-2026-23168}
  - selftests: mptcp: join: fix local endp not being tracked (Matthieu Baerts)
  - selftests: mptcp: check subflow errors in close events (Matthieu Baerts)
  - selftests: mptcp: check no dup close events after error (Matthieu Baerts)
  - mptcp: only reset subflow errors when propagated (Matthieu Baerts)
  - gpio: rockchip: Stop calling pinctrl for set_direction (Robin Murphy)
  - nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference (Ming Lei) [Orabug: 38970608] {CVE-2026-23148}
  - efivarfs: fix error propagation in efivar_entry_get() (Kohei Enju) [Orabug: 38970325] {CVE-2026-23156}
  - scsi: qla2xxx: edif: Fix dma_free_coherent() size (Thomas Fourier)
  - gpio: pca953x: mask interrupts in irq shutdown (Martin Larsson)
  - ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO (Zhang Heng)
  - scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() (Haoxiang Li)
  - ASoC: fsl: imx-card: Do not force slot width to sample width (Fabio Estevam)
  - rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target (Miguel Ojeda)
  - rust: rbtree: fix documentation typo in CursorMut peek_next method (Hang Shu)
  - riscv: compat: fix COMPAT_UTS_MACHINE definition (Han Gao)
  - pinctrl: meson: mark the GPIO controller as sleeping (Bartosz Golaszewski)
  - sched/deadline: Fix 'stuck' dl_server (Peter Zijlstra)
  - sched/deadline: Document dl_server (Peter Zijlstra)
  - dma/pool: distinguish between missing and exhausted atomic pools (Sai Sree Kartheek Adivi)
  - bcache: fix I/O accounting leak in detached_dev_do_request (Shida Zhang)
  - bcache: use bio cloning for detached device requests (Shida Zhang)
  - bcache: fix improper use of bi_end_io (Shida Zhang)
  - gpio: virtuser: fix UAF in configfs release path (Yuhao Huang)
  - gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler (Denis Sergeev)
  - ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion (Tagir Garaev)
  - scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() (Kery Qi)
  - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Jianbo Liu)
  - net/mlx5: Fix vhca_id access call trace use before alloc (Parav Pandit)
  - net/mlx5: Initialize events outside devlink lock (Cosmin Ratiu)
  - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Shay Drory)
  - net: phy: micrel: fix clk warning when removing the driver (Wei Fang)
  - net: bridge: fix static key check (Martin Kaiser)
  - nfc: nci: Fix race between rfkill and nci_unregister_device(). (Kuniyuki Iwashima)
  - net/mlx5e: TC, delete flows only for existing peers (Mark Bloch) [Orabug: 38970397] {CVE-2026-23173}
  - ice: stop counting UDP csum mismatch as rx_errors (Jesse Brandeburg)
  - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Aaron Ma) [Orabug: 38970364] {CVE-2026-23166}
  - nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). (Kuniyuki Iwashima)
  - rocker: fix memory leak in rocker_world_port_post_fini() (Kery Qi) [Orabug: 38970351] {CVE-2026-23164}
  - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Kery Qi)
  - ipv6: use the right ifindex when replying to icmpv6 from localhost (Fernando Fernandez Mancera)
  - net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() (Zilin Guan)
  - bonding: annotate data-races around slave->last_rx (Eric Dumazet) [Orabug: 38985142] {CVE-2026-23212}
  - octeon_ep: Fix memory leak in octep_device_setup() (Zilin Guan)
  - net: bcmasp: fix early exit leak with fixed phy (Justin Chen)
  - can: gs_usb: gs_usb_receive_bulk_callback(): fix error message (Marc Kleine-Budde) [Orabug: 39084048] {CVE-2026-23155}
  - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Zilin Guan)
  - Bluetooth: MGMT: Fix memory leak in set_ssp_complete (Jianpeng Chang) [Orabug: 38970587] {CVE-2026-23151}
  - Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (Jia-Hong Su) [Orabug: 38970604] {CVE-2026-23146}
  - can: at91_can: Fix memory leak in at91_can_probe() (Zilin Guan)
  - LTS version: v6.12.68 (Jack Vogel)
  - vsock/virtio: Fix message iterator handling on transmit path (Will Deacon)
  - net: Introduce skb_copy_datagram_from_iter_full() (Will Deacon)
  - vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers (Will Deacon)
  - vhost/vsock: Allocate nonlinear SKBs for handling large receive buffers (Will Deacon)
  - vsock/virtio: Rename virtio_vsock_skb_rx_put() (Will Deacon)
  - vsock/virtio: Move SKB allocation lower-bound check to callers (Will Deacon)
  - vsock/virtio: Rename virtio_vsock_alloc_skb() (Will Deacon)
  - vsock/virtio: Move length check to callers of virtio_vsock_skb_rx_put() (Will Deacon)
  - wifi: ath11k: fix RCU stall while reaping monitor destination ring (P Praneesh) [Orabug: 37844129] {CVE-2024-58097}
  - btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (Boris Burkov) [Orabug: 38798802] {CVE-2025-68358}
  - accel/ivpu: Fix race condition when unbinding BOs (Tomasz Rusinowicz)
  - fs/ntfs3: Initialize allocated memory before use (Bartlomiej Kubik)
  - sched_ext: Fix possible deadlock in the deferred_irq_workfn() (Zqiang) [Orabug: 38792605] {CVE-2025-68333}
  - exfat: fix refcount leak in exfat_find (Shuhao Fu) [Orabug: 38798780] {CVE-2025-68351}
  - iio: adc: exynos_adc: fix OF populate on driver rebind (Johan Hovold)
  - iio: core: add separate lockdep class for info_exist_lock (Rasmus Villemoes)
  - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Andy Shevchenko)
  - iio: core: add missing mutex_destroy in iio_dev_release() (Andy Shevchenko)
  - arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s (Geraldo Nascimento)
  - bpf: Do not let BPF test infra emit invalid GSO types to stack (Daniel Borkmann) [Orabug: 38798881] {CVE-2025-68725}
  - selftests/bpf: Check for timeout in perf_link test (Ihor Solodrai)
  - can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
  - dmaengine: ti: k3-udma: Enable second resource range for BCDMA and PKTDMA (Siddharth Vadapalli)
  - migrate: correct lock ordering for hugetlb file folios (Matthew Wilcox) [Orabug: 38931066] {CVE-2026-23097}
  - gpio: cdev: Correct return code on memory allocation failure (Tzung-Bi Shih)
  - drm/amdgpu: remove frame cntl for gfx v12 (Likun Gao)
  - can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38931120] {CVE-2026-23108}
  - can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
  - can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930881] {CVE-2026-23061}
  - can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930859] {CVE-2026-23058}
  - net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ Stick (Hamza Mahfooz)
  - irqchip/gic-v3-its: Avoid truncating memory addresses (Arnd Bergmann) [Orabug: 38931001] {CVE-2026-23085}
  - perf/x86/intel: Do not enable BTS for guests (Fernand Sieber)
  - pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu (Ming Qian)
  - platform/x86: hp-bioscfg: Fix automatic module loading (Mario Limonciello)
  - netrom: fix double-free in nr_route_frame() (Jeongjun Park)
  - uacce: ensure safe queue release with state management (Chenghai Huang)
  - uacce: implement mremap in uacce_vm_ops to return -EPERM (Yang Shen)
  - uacce: fix isolate sysfs check condition (Chenghai Huang)
  - uacce: fix cdev handling in the cleanup path (Wenkai Lin)
  - s390/ap: Fix wrong APQN fill calculation (Harald Freudenberger)
  - mei: trace: treat reg parameter as string (Alexander Usyskin)
  - intel_th: fix device leak on output open() (Johan Hovold) [Orabug: 38931040] {CVE-2026-23091}
  - tracing: Fix crash on synthetic stacktrace field usage (Steven Rostedt) [Orabug: 38931024] {CVE-2026-23088}
  - slimbus: core: fix device reference leak on report present (Johan Hovold)
  - slimbus: core: fix runtime PM imbalance on report present (Johan Hovold)
  - octeontx2: Fix otx2_dma_map_page() error return code (Thomas Fourier)
  - arm64: Set __nocfi on swsusp_arch_resume() (Zhaoyang Huang) [Orabug: 38970241] {CVE-2026-23128}
  - arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (Mark Rutland) [Orabug: 38931118] {CVE-2026-23107}
  - wifi: rsi: Fix memory corruption due to not set vif driver data size (Marek Vasut) [Orabug: 38930939] {CVE-2026-23073}
  - wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (Dan Carpenter)
  - wifi: ath12k: fix dma_free_coherent() pointer (Thomas Fourier)
  - wifi: ath10k: fix dma_free_coherent() pointer (Thomas Fourier) [Orabug: 38970253] {CVE-2026-23133}
  - drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit) (Lyude Paul)
  - mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode (Shawn Lin)
  - mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function (Matthew Schwartz)
  - ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (Berk Cem Goksel) [Orabug: 38931029] {CVE-2026-23089}
  - ALSA: scarlett2: Fix buffer overflow in config retrieval (Samasth Norway Ananda) [Orabug: 38930973] {CVE-2026-23078}
  - ALSA: ctxfi: Fix potential OOB access in audio mixer handling (Takashi Iwai) [Orabug: 38930966] {CVE-2026-23076}
  - iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl (Andreas Kübrich)
  - iio: chemical: scd4x: fix reported channel endianness (Fiona Klute)
  - iio: adc: pac1934: Fix clamped value in pac1934_reg_snapshot (Thorsten Blum)
  - iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver (Pei Xiao)
  - iio: adc: ad9467: fix ad9434 vref mask (Tomas Melin)
  - iio: accel: iis328dq: fix gain values (Markus Koeniger)
  - iio: accel: adxl380: fix handling of unavailable "INT1" interrupt (Francesco Lavra)
  - of: platform: Use default match table for /firmware (Rob Herring)
  - of: fix reference count leak in of_alias_scan() (Weigang He)
  - leds: led-class: Only Add LED to leds_list when it is fully ready (Hans de Goede) [Orabug: 38931091] {CVE-2026-23101}
  - keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal (Srish Srinivasan)
  - tpm: Compare HMAC values in constant time (Eric Biggers)
  - x86: make page fault handling disable interrupts properly (Cedric Xing)
  - dpll: Prevent duplicate registrations (Ivan Vecera) [Orabug: 38970244] {CVE-2026-23129}
  - net/sched: act_ife: avoid possible NULL deref (Eric Dumazet)
  - vsock/virtio: cap TX credit to local buffer size (Melbin K Mathew) [Orabug: 38931008] {CVE-2026-23086}
  - vsock/test: fix seqpacket message bounds test (Stefano Garzarella)
  - vsock/virtio: fix potential underflow in virtio_transport_get_credit() (Melbin K Mathew) [Orabug: 38930919] {CVE-2026-23069}
  - net: openvswitch: fix data race in ovs_vport_get_upcall_stats (David Yang)
  - octeontx2-af: Fix error handling (Ratheesh Kannoth)
  - net: dsa: fix off-by-one in maximum bridge ID determination (Vladimir Oltean)
  - bonding: provide a net pointer to __skb_flow_dissect() (Eric Dumazet) [Orabug: 38970199] {CVE-2026-23119}
  - selftests: net: amt: wait longer for connection before sending packets (Taehee Yoo)
  - be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (Andrey Vatoropin) [Orabug: 38930992] {CVE-2026-23084}
  - drm/nouveau: implement missing DCB connector types; gracefully handle unknown connectors (Alex Ramírez)
  - drm/nouveau: add missing DCB connector types (Alex Ramírez)
  - drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) (Timur Kristóf)
  - drm/amd/pm: Don't clear SI SMC table when setting power limit (Timur Kristóf)
  - sched/fair: Fix pelt clock sync when entering idle (Vincent Guittot)
  - clocksource: Reduce watchdog readout delay limit to prevent false positives (Thomas Gleixner)
  - usbnet: limit max_mtu based on device's hard_mtu (Laurent Vivier)
  - ipv6: annotate data-race in ndisc_router_discovery() (Eric Dumazet) [Orabug: 38970222] {CVE-2026-23124}
  - mISDN: annotate data-race around dev->work (Eric Dumazet)
  - net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue (Jijie Shao)
  - net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M (Jijie Shao)
  - be2net: fix data race in be_get_new_eqd (David Yang)
  - net: hns3: fix data race in hns3_fetch_stats (David Yang)
  - ice: Fix persistent failure in ice_get_rxfh (Cody Haas)
  - netdevsim: fix a race issue related to the operation on bpf_bound_progs list (Yun Lu) [Orabug: 38970233] {CVE-2026-23126}
  - drm/imagination: Wait for FW trace update command completion (Brajesh Gupta)
  - ALSA: usb: Increase volume range that triggers a warning (Arun Raghavan)
  - scsi: qla2xxx: Sanitize payload size to prevent member overflow (Jiasheng Jiang) [Orabug: 38930867] {CVE-2026-23059}
  - scsi: core: Wake up the error handler when final completions race against each other (David Jeffery) [Orabug: 38931132] {CVE-2026-23110}
  - platform/x86/amd: Fix memory leak in wbrf_record() (Zilin Guan)
  - riscv: clocksource: Fix stimecmp update hazard on RV32 (Naohiko Shimizu)
  - kconfig: fix static linking of nconf (Arusekk)
  - regmap: Fix race condition in hwspinlock irqsave routine (Cheng-Yu Lee) [Orabug: 38930930] {CVE-2026-23071}
  - spi: spi-sprd-adi: Fix double free in probe error path (Felix Gu)
  - interconnect: debugfs: initialize src_node and dst_node to empty strings (Georgi Djakov) [Orabug: 38970218] {CVE-2026-23123}
  - iio: adc: ad7280a: handle spi_setup() errors in probe() (Pavel Zhigulin)
  - iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection (Francesco Lavra)
  - io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (Jens Axboe) [Orabug: 38970181] {CVE-2026-23113}
  - mm/rmap: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
  - platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro (Mario Limonciello) [Orabug: 38930890] {CVE-2026-23062}
  - platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names (Mario Limonciello) [Orabug: 38970247] {CVE-2026-23131}
  - comedi: Fix getting range information for subdevices 16 to 255 (Ian Abbott)
  - x86/kfence: avoid writing L1TF-vulnerable PTEs (Andrew Cooper)
  - arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro (Ondrej Jirman)
  - arm64: dts: rockchip: remove dangerous max-link-speed from helios64 (Geraldo Nascimento)
  - scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() (Abdun Nihaal) [Orabug: 38931014] {CVE-2026-23087}
  - scsi: storvsc: Process unsupported MODE_SENSE_10 (Long Li)
  - Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA (Feng)
  - Input: i8042 - add quirks for MECHREVO Wujie 15X Pro (Gongqi)
  - Revert "nfc/nci: Add the inconsistency check between the input data length and count" (Thadeu Lima de Souza Cascardo)
  - w1: fix redundant counter decrement in w1_attach_slave_device() (Haoxiang Li)
  - w1: therm: Fix off-by-one buffer overflow in alarms_store (Thorsten Blum) [Orabug: 38930796] {CVE-2025-71197}
  - comedi: dmm32at: serialize use of paged registers (Ian Abbott)
  - serial: 8250_pci: Fix broken RS485 for F81504/508/512 (Marnix Rijnart)
  - wifi: mac80211: don't perform DA check on S1G beacon (Lachlan Hodges)
  - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Taeyang Lee) [Orabug: 38930874] {CVE-2026-23060}
  - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (Jamal Hadi Salim) [Orabug: 38931110] {CVE-2026-23105}
  - net/sched: Enforce that teql can only be used as root qdisc (Jamal Hadi Salim) [Orabug: 38930948] {CVE-2026-23074}
  - octeontx2: cn10k: fix RX flowid TCAM mask handling (Alok Tiwari)
  - ipvlan: Make the addrs_lock be per port (Dmitry Skorodumov) [Orabug: 38931102] {CVE-2026-23103}
  - l2tp: avoid one data-race in l2tp_tunnel_del_work() (Eric Dumazet) [Orabug: 38970202] {CVE-2026-23120}
  - veth: fix data race in veth_get_ethtool_stats (David Yang)
  - fou: Don't allow 0 for FOU_ATTR_IPPROTO. (Kuniyuki Iwashima) [Orabug: 38930985] {CVE-2026-23083}
  - tools: ynl: Specify --no-line-number in ynl-regen.sh. (Kuniyuki Iwashima)
  - gue: Fix skb memleak with inner IP protocol 0. (Kuniyuki Iwashima) [Orabug: 38931057] {CVE-2026-23095}
  - amd-xgbe: avoid misleading per-packet error log (Raju Rangoju)
  - sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [Orabug: 38970225] {CVE-2026-23125}
  - can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (Marc Kleine-Budde) [Orabug: 38931184] {CVE-2026-23082}
  - selftests: net: fib-onlink-tests: Convert to use namespaces by default (Ricardo B. Marlière)
  - l2tp: Fix memleak in l2tp_udp_encap_recv(). (Kuniyuki Iwashima) [Orabug: 38930935] {CVE-2026-23072}
  - bonding: limit BOND_MODE_8023AD to Ethernet devices (Eric Dumazet) [Orabug: 38931079] {CVE-2026-23099}
  - net: usb: dm9601: remove broken SR9700 support (Ethan Nelson-Moore)
  - vsock/virtio: Coalesce only linear skb (Michal Luczaj) [Orabug: 38930857] {CVE-2026-23057}
  - igc: fix race condition in TX timestamp read for register 0 (Chwee Lin Choong)
  - igc: Restore default Qbv schedule when changing channels (Kurt Kanzenbach)
  - ice: Fix incorrect timeout ice_release_res() (Ding Hui)
  - ice: Avoid detrimental cleanup for bond during interface stop (Dave Ertman)
  - ice: initialize ring_stats->syncp (Jacob Keller)
  - ata: libata: Print features also for ATAPI devices (Niklas Cassel)
  - ata: libata: Call ata_dev_config_lpm() for ATAPI devices (Niklas Cassel)
  - ata: libata-core: Introduce ata_dev_config_lpm() (Damien Le Moal)
  - ata: libata: Add cpr_log to ata_dev_print_features() early return (Niklas Cassel)
  - ata: libata-sata: Improve link_power_management_supported sysfs attribute (Niklas Cassel)
  - ata: ahci: Do not read the per port area for unimplemented ports (Niklas Cassel)
  - btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE (Mark Harmstone)
  - Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump() (Michael Kelley)
  - arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links (Konrad Dybcio)
  - pmdomain: qcom: rpmhpd: Add MXC to SC8280XP (Konrad Dybcio)
  - dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO (Konrad Dybcio)
  - dt-bindings: power: qcom-rpmpd: split RPMh domains definitions (Dmitry Baryshkov)
  - dt-bindings: power: qcom,rpmpd: add Turbo L5 corner (Akhil P Oommen)
  - dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains (Taniya Das)
  - testptp: Add option to open PHC in readonly mode (Wojtek Wasko)
  - selftest/ptp: update ptp selftest to exercise the gettimex options (Mahesh Bandewar)
  - ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE. (Wojtek Wasko)
  - posix-clock: Store file pointer in struct posix_clock_context (Wojtek Wasko)


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-201.74.1.el10uek]
changelog:
  - selftests/bpf: Add overwrite mode test for BPF ring buffer (Xu Kuohai) [Orabug: 38717758]
  - bpf: Add overwrite mode for BPF ring buffer (Xu Kuohai) [Orabug: 38717758]
  - uek-rpm: Ensure --with onosonly skips building container rpms (Vijay Kumar) [Orabug: 38905604]
  - nvme-auth: use hkdf_expand_label() (Chris Leech) [Orabug: 38993277]
  - nvme: spelling fixes (Yi Zhang) [Orabug: 38993277]
  - nvme-auth: add hkdf_expand_label() (Chris Leech) [Orabug: 38993277]
  - nvme-auth: update bi_directional flag (Martin George) [Orabug: 38993277]
  - nvme-auth: update sc_c in host response (Martin George) [Orabug: 38993277]
  - nvme-tcp: remove redundant check to ctrl->opts (Hannes Reinecke) [Orabug: 38993277]
  - nvme-tcp: send only permitted commands for secure concat (Martin George) [Orabug: 38993277]
  - nvme-fabrics: reset admin connection for secure concatenation (Hannes Reinecke) [Orabug: 38993277]
  - nvme-tcp: request secure channel concatenation (Hannes Reinecke) [Orabug: 38993277]
  - nvme-keyring: add nvme_tls_psk_refresh() (Hannes Reinecke) [Orabug: 38993277]
  - nvme: add nvme_auth_derive_tls_psk() (Hannes Reinecke) [Orabug: 38993277]
  - nvme: add nvme_auth_generate_digest() (Hannes Reinecke) [Orabug: 38993277]
  - nvme: add nvme_auth_generate_psk() (Hannes Reinecke) [Orabug: 38993277]
  - crypto,fs: Separate out hkdf_extract() and hkdf_expand() (Hannes Reinecke) [Orabug: 38993277]
  - ONOS: Enable OPTOE EEPROM and ASF I2C modules (Vijay Kumar) [Orabug: 39001522]
  - eeprom: optoe: drop i2c_device_id from probe() (Vijay Kumar) [Orabug: 39001522]
  - ext4: show 'shutdown' hint when ext4 is forced to shutdown (Baokun Li) [Orabug: 39002345]
  - ext4: show 'emergency_ro' when EXT4_FLAGS_EMERGENCY_RO is set (Baokun Li) [Orabug: 39002345]
  - ext4: correct behavior under errors=remount-ro mode (Baokun Li) [Orabug: 39002345]
  - ext4: add more ext4_emergency_state() checks around sb_rdonly() (Baokun Li) [Orabug: 39002345]
  - ext4: add ext4_emergency_state() helper function (Baokun Li) [Orabug: 39002345]
  - ext4: add EXT4_FLAGS_EMERGENCY_RO bit (Baokun Li) [Orabug: 39002345]
  - ext4: convert EXT4_FLAGS_* defines to enum (Baokun Li) [Orabug: 39002345]
  - PCI: Fix BUILD_BUG_ON usage for old gcc (Alex Williamson) [Orabug: 39021289]
  - PCI: Batch BAR sizing operations (Alex Williamson) [Orabug: 39021289]
  - uek-rpm: Turn USB_XHCI_PCI_RENESAS to a builtin option (Harshit Mogalapalli) [Orabug: 39022939]
  - mm/page_alloc: ignore the exact initial compaction result (Vlastimil Babka) [Orabug: 39037823]
  - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Vlastimil Babka) [Orabug: 39037823]
  - ONOS: Replace strlcpy with strscpy in bcm-hsdk-gpl (Vijay Kumar) [Orabug: 39042061]
  - ONOS: Build fix for bcm-hsdk-gpl drivers (Vijay Kumar) [Orabug: 39042061]
  - uek-rpm/config-x86_64-onos: Add configs for Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
  - bcm-hsdk-gpl: Build Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
  - drivers/platform: Add Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
  - minke-fan-cpld: support partial fan insertion (Divyarajsinh Jhala) [Orabug: 39043148]
  - src: scale pwm to respect pali2 cpld min pwm req (Arista-Hpandya) [Orabug: 39043148]
  - src: add support for FAN-7311H-RED (Arista-Hpandya) [Orabug: 39043148]
  - minke-fan-cpld: support platform specific addresses (Divyarajsinh Jhala) [Orabug: 39043148]
  - drivers: add rundle support to minke fan driver (Arista-Hpandya) [Orabug: 39043148]
  - driver: fix rook fan present read in cpld_init and cpld_update (Calvin Laverty) [Orabug: 39043148]
  - driver: fix scd gpio active low clear (Calvin Laverty) [Orabug: 39043148]
  - driver: mask_green_red --> mask_red_led in scd-fan.h (Calvin Laverty) [Orabug: 39043148]
  - leds: use Linux LED device classes as intended (Fraser Gordon) [Orabug: 39043148]
  - amax31732: Fix error in setting primary threshold (Arista-Hpandya) [Orabug: 39043148]
  - amax31732: Enable beta comp on all 4 channels (Arista-Hpandya) [Orabug: 39043148]
  - rds: Drop rds conn in connect worker if not in down state. (Rohit Nair) [Orabug: 39045033]
  - uek-rpm: Enable FPROBE and FPROBE_EVENTS in UEK (Harshit Mogalapalli) [Orabug: 39050941]
  - uek-rpm: T93: disable CONFIG_CPU_FREQ and CONFIG_ARM_SCMI_CPUFREQ (Thomas Tai) [Orabug: 39052955]
  - mailbox: mvl-mhu: Refactor MHU RX interrupt handling (George Cherian) [Orabug: 39052955]
  - driver: mmc: ACPI support added for eMMC driver for T9x. (Piyush Malgujar) [Orabug: 39052955]
  - driver: mmc: Resolve issues reported by static analysis (Wojciech Bartczak) [Orabug: 39052955]
  - driver: marvell: mmc: Removes static variables in tuning code (Wojciech Bartczak) [Orabug: 39052955]
  - mmc: cavium: Add MMC polling method to support kmsg panic/oops write (Bhaskara Budiredla) [Orabug: 39052955]
  - drivers: mmc: cleanup mmc_oops driver (Bhaskara Budiredla) [Orabug: 39052955]
  - driver: mmc: Adds CMD tuning for eMMC HS200 mode (Wojciech Bartczak) [Orabug: 39052955]
  - driver: mmc: Cleans up mmc code and prepare it for HS200 tuning update (Wojciech Bartczak) [Orabug: 39052955]
  - driver: mmc: Adds device tree entries to control eMMC input timings (Wojciech Bartczak) [Orabug: 39052955]
  - driver: mmc: Adds a way to dynamically control eMMC bus input timings (Wojciech Bartczak) [Orabug: 39052955]
  - driver: mmc: Adds new overrides for eMMC bus output timings (Wojciech Bartczak) [Orabug: 39052955]
  - octeontx2: mmc: Adds mechanism to modify output timings for MMC bus (Wojciech Bartczak) [Orabug: 39052955]
  - drivers: mmc: enables mmc polling for pstore path (Bhaskara Budiredla) [Orabug: 39052955]
  - mmc: octeontx2: fix handling calibration glitch (Aaron Williams) [Orabug: 39052955]
  - mmc: octeontx2: Configure flags for T96 pass B0 (Chandrakala Chavva) [Orabug: 39052955]
  - mmc: octeontx2: Use flags for hardware differences (Aaron Williams) [Orabug: 39052955]
  - mmc: octeontx2: Fix tuning for T96 C0 (Chandrakala Chavva) [Orabug: 39052955]
  - mmc: octeontx2: Add tuning support for HS400 mode (Aaron Williams) [Orabug: 39052955]
  - mmc: octeontx2: speed limit for tx2-c0 (Sujeet Baranwal) [Orabug: 39052955]
  - mmc: cavium: use calibrated timing taps (Peter Swain) [Orabug: 39052955]
  - mmc: cavium: do not drop bus lock in tuning (Peter Swain) [Orabug: 39052955]
  - mmc: cavium: slot switch by vqmmc/gpio (Peter Swain) [Orabug: 39052955]
  - mmc: cavium: reorganize before vqmmc switching (Peter Swain) [Orabug: 39052955]
  - mmc: octeontx2: cmd and data out values fixture (Sujeet Baranwal) [Orabug: 39052955]
  - mmc: cavium: amend hs400 tuning (Peter Swain) [Orabug: 39052955]
  - mmc: cavium: correct clock divisor (Peter Swain) [Orabug: 39052955]
  - mmc: cavium: fix swiotlb buffer is full (Peter Swain) [Orabug: 39052955]
  - mmc: cavium: avoid single-slot startup issues (Peter Swain) [Orabug: 39052955]
  - mmc: cavium: execute_tuning for octeontx2 (Peter Swain) [Orabug: 39052955]
  - mmc: cavium: track & apply CMD6 bus changes ASAP (Peter Swain) [Orabug: 39052955]
  - mmc: octeontx2: cn96xx HS200-8wide-100MHz (Peter Swain) [Orabug: 39052955]
  - mmc: cavium: CMD19/21 type correction (Peter Swain) [Orabug: 39052955]
  - mmc: cavium: skip unavailable slots (Peter Swain) [Orabug: 39052955]
  - mmc: cavium: finish_dma_single() should teardown/unmap (Peter Swain) [Orabug: 39052955]
  - mmc: octeontx2: use device tree entries (Sujeet Baranwal) [Orabug: 39052955]
  - mmc: octeontx2: emmc tuning for delay (Sujeet Baranwal) [Orabug: 39052955]
  - mmc: octeontx2: calibrate tap delay (Sujeet Baranwal) [Orabug: 39052955]
  - mmc: octeontx2: incorporate hw interface io ctl params (Sujeet Baranwal) [Orabug: 39052955]
  - mmc: octeontx2: interrupt addition for ncb fault (Sujeet Baranwal) [Orabug: 39052955]
  - mmc: octeontx2: emmc operation limited to 100 MHz (Sujeet Baranwal) [Orabug: 39052955]
  - mmc: cavium: Use proper register to clear interrupts (Chandrakala Chavva) [Orabug: 39052955]
  - mmc: cavium: fix shutdown deadlock with active sd-card (Peter Swain) [Orabug: 39052955]
  - mmc: cavium: Configure sample command and data directly (Sujeet Baranwal) [Orabug: 39052955]
  - mmc: octeontx2: add check for 8/9xxx chips (Sujeet Baranwal) [Orabug: 39052955]
  - uek-rpm: T93: Configure EDAC & GHES support (Dave Kleikamp) [Orabug: 39052955]
  - efi/Marvell: Work-around for bootefi memmap errors (Henry Willard) [Orabug: 39052955]
  - soc: marvell: Add BERT support for OTX2/CN10K (Szymon Balcerak) [Orabug: 39052955]
  - EDAC/mc: Modify memory error reporting print (Jaiprakash Singh) [Orabug: 39052955]
  - edac: octeontx_edac: Reduce the log level for ghes prints (George Cherian) [Orabug: 39052955]
  - ras:cn10k:BCP issue fix where CE errors are read as UE in kernel (Ashwin Kumar Sundararamakrishnan) [Orabug: 39052955]
  - EDAC/mc: Common print format for CE and UE error (Jaiprakash Singh) [Orabug: 39052955]
  - ras:edac: Modify processor_arm structure (Jaiprakash Singh) [Orabug: 39052955]
  - ras:cn10k: Add support for external abort(EA) work queue (Jaiprakash Singh) [Orabug: 39052955]
  - driver: edac: octeontx: Add CRC support. (Szymon Balcerak) [Orabug: 39052955]
  - drivers: octeontx-edac: Refactor work thread to have common handler (Vasyl Gomonovych) [Orabug: 39052955]
  - drivers: octeontx-edac: Add gic error decoder (Jayanthi Annadurai) [Orabug: 39052955]
  - driver: edac: octeontx: offline/poison page on fatal/UE (Wladislav Wiebe) [Orabug: 39052955]
  - driver: edac: octeontx: Improvements to GIC RAS handler (Chandrakala Chavva) [Orabug: 39052955]
  - edac: octeontx: Add support for GIC RAS reporting (Jayanthi Annadurai) [Orabug: 39052955]
  - edac: octeontx: Add error syndrome (Jayanthi Annadurai) [Orabug: 39052955]
  - driver: edac: octeontx: Init MC grain (Vasyl Gomonovych) [Orabug: 39052955]
  - driver: edac: octeontx: Add revision check for new pass of the chip (Chandrakala Chavva) [Orabug: 39052955]
  - EDAC: Octeon: Init SDEI (Vasyl Gomonovych) [Orabug: 39052955]
  - EDAC: Octeon: Add Marvell's OcteonTx2 SoC and CN10KA SoC EDAC driver (Vasyl Gomonovych) [Orabug: 39052955]
  - octeontx2-af: Fix PF driver crash with kexec kernel booting (Anshumali Gaur) [Orabug: 39052955]
  - octeontx2-af: add max_vfs module param (Tom Saeger) [Orabug: 39052955]
  - PCI: boot time optimization (Harman Kalra) [Orabug: 39052955]
  - uek-rpm: T93: enable CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE (Dave Kleikamp) [Orabug: 39052955]
  - hv_netvsc: Use VF's tso_max_size value when data path is VF (Shradha Gupta) [Orabug: 39065406]
  - net: mana: Allow tso_max_size to go up-to GSO_MAX_SIZE (Shradha Gupta) [Orabug: 39065406]
  - vfio/mlx5: Add REINIT support to VFIO_MIG_GET_PRECOPY_INFO (Yishai Hadas) [Orabug: 39065602]
  - vfio/mlx5: consider inflight SAVE during PRE_COPY (Yishai Hadas) [Orabug: 39065602]
  - net/mlx5: Add IFC bits for migration state (Yishai Hadas) [Orabug: 39065602]
  - vfio: Adapt drivers to use the core helper vfio_check_precopy_ioctl (Yishai Hadas) [Orabug: 39065602]
  - vfio: Add support for VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2 (Yishai Hadas) [Orabug: 39065602]
  - vfio: Define uAPI for re-init initial bytes during the PRE_COPY phase (Yishai Hadas) [Orabug: 39065602]
  - exadata: tools: perf: use comm_ignore_digit for report, top (Stephen Brennan) [Orabug: 39071703]
  - tools: perf: add comm_ignore_digit column (Stephen Brennan) [Orabug: 39071703]
  - uek: kabi: Only do size allignment check on kabi_use when in 64 bit environment. (Yifei Liu) [Orabug: 39089297]
  - scsi: target: core: Add emulation for REPORT IDENTIFYING INFORMATION (Gulam Mohamed) [Orabug: 39098803]


author: Sherry Yang <sherry.yang@oracle.com> [6.12.0-201.74.2.el10uek]
changelog:
  - kabi: update kABI files for FIPS (Saeed Mirzamohammadi) [Orabug: 38667144]
  - RDMA/mlx5: Fix ucaps init error flow (Maher Sanalla) [Orabug: 38667144]
  - eth: mlx4: Fix IS_ERR() vs NULL check bug in mlx4_en_create_rx_ring (Miaoqian Lin) [Orabug: 38667144]
  - RDMA/ucaps: Avoid format-security warning (Arnd Bergmann) [Orabug: 38667144]
  - net/mlx5: fs, fix UAF in flow counter release (Moshe Shemesh) [Orabug: 38667144,39004176] {CVE-2025-39979}
  - net/mlx5: Not returning mlx5_link_info table when speed is unknown (Li Tian) [Orabug: 38667144]
  - net/mlx5: CT: Use the correct counter offset (Vlad Dogaru) [Orabug: 38667144]
  - net/mlx5: Reset bw_share field when changing a node's parent (Carolina Jubran) [Orabug: 38667144]
  - net/mlx5e: Fix number of lanes to UNKNOWN when using data_rate_oper (Shahar Shitrit) [Orabug: 38667144]
  - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Carolina Jubran) [Orabug: 38667144]
  - mlx5: Fix default values in create CQ (Akiva Goldberger) [Orabug: 38667144,38773368] {CVE-2025-68209}
  - net/mlx5e: Prepare for using different CQ doorbells (Cosmin Ratiu) [Orabug: 38667144]
  - net/mlx5: Store the global doorbell in mlx5_priv (Cosmin Ratiu) [Orabug: 38667144]
  - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Cosmin Ratiu) [Orabug: 38667144]
  - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Yishai Hadas) [Orabug: 38667144]
  - RDMA/mlx5: Fix compilation warning when USER_ACCESS isn't set (Mark Bloch) [Orabug: 38667144]
  - eth: mlx4: select PAGE_POOL (Greg Thelen) [Orabug: 38667144]
  - net/mlx5e: TC, Don't offload CT commit if it's the last action (Jianbo Liu) [Orabug: 38667144]
  - net/mlx5e: CT: Filter legacy rules that are unrelated to nic (Paul Blakey) [Orabug: 38667144]
  - net/mlx5: Update pfnum retrieval for devlink port attributes (Shay Drory) [Orabug: 38667144]
  - net/mlx5: fw reset, check bridge accessibility at earlier stage (Amir Tzin) [Orabug: 38667144]
  - net/mlx5: Lag, use port selection tables when available (Mark Bloch) [Orabug: 38667144]
  - net/mlx5e: TX, Utilize WQ fragments edge for multi-packet WQEs (Tariq Toukan) [Orabug: 38667144]
  - net/mlx5: Start health poll after enable hca (Moshe Shemesh) [Orabug: 38667144]
  - net/mlx5: LAG, reload representors on LAG creation failure (Mark Bloch) [Orabug: 38667144]
  - mlxsw: spectrum_acl_bloom_filter: Workaround for some LLVM versions (Yuli Wang) [Orabug: 38667144]
  - mlxsw: Add VXLAN bridge ports to same hardware domain as physical bridge ports (Amit Cohen) [Orabug: 38667144]
  - mlxsw: spectrum_switchdev: Move mlxsw_sp_bridge_vxlan_join() (Amit Cohen) [Orabug: 38667144]
  - mlxsw: spectrum_switchdev: Add an internal API for VXLAN leave (Amit Cohen) [Orabug: 38667144]
  - mlxsw: spectrum: Call mlxsw_sp_bridge_vxlan_{join, leave}() for VLAN-aware bridge (Amit Cohen) [Orabug: 38667144]
  - mlxsw: Trap ARP packets at layer 2 instead of layer 3 (Amit Cohen) [Orabug: 38667144]
  - net/mlx5e: Always select CONFIG_PAGE_POOL_STATS (Tariq Toukan) [Orabug: 38667144]
  - net/mlx5e: Use right API to free bitmap memory (Mark Zhang) [Orabug: 38667144]
  - net/mlx5: Remove NULL check before dev_{put, hold} (Gal Pressman) [Orabug: 38667144]
  - net/mlx5e: Fix ethtool -N flow-type ip4 to RSS context (Maxim Mikityanskiy) [Orabug: 38667144]
  - i2c: mlxbf: Use readl_poll_timeout_atomic() for polling (Andy Shevchenko) [Orabug: 38667144]
  - net/mlx5e: Expose port reset cycle recovery counter via ethtool (Yael Chemla) [Orabug: 38667144]
  - net/mlx5e: Get counter group size by FW capability (Yael Chemla) [Orabug: 38667144]
  - net/mlx5e: Access PHY layer counter group as other counter groups (Yael Chemla) [Orabug: 38667144]
  - net/mlx5e: Ensure each counter group uses its PCAM bit (Yael Chemla) [Orabug: 38667144]
  - leds: mlxcpld: Remove unused ACPI header inclusion (Andy Shevchenko) [Orabug: 38667144]
  - net/mlx5: HWS, log the unsupported mask in definer (Yevgeny Kliteynik) [Orabug: 38667144]
  - net/mlx5: HWS, use list_move() instead of del/add (Yevgeny Kliteynik) [Orabug: 38667144]
  - net/mlx5: HWS, remove unused code for alias flow tables (Yevgeny Kliteynik) [Orabug: 38667144]
  - RDMA/mlx5: Drop access_flags from _mlx5_mr_cache_alloc() (Michael Guralnik) [Orabug: 38667144]
  - RDMA/mlx5: Support optional-counters binding for QPs (Patrisious Haddad) [Orabug: 38667144]
  - RDMA/mlx5: Compile fs.c regardless of INFINIBAND_USER_ACCESS config (Patrisious Haddad) [Orabug: 38667144]
  - RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38667144]
  - RDMA/core: Pass port to counter bind/unbind operations (Patrisious Haddad) [Orabug: 38667144]
  - Revert "RDMA/ionic: Implement device stats ops" (Qing Huang) [Orabug: 38667144]
  - RDMA/core: Add support to optional-counters binding configuration (Patrisious Haddad) [Orabug: 38667144]
  - RDMA/core: Create and destroy rdma_counter using rdma_zalloc_drv_obj() (Patrisious Haddad) [Orabug: 38667144]
  - RDMA/mlx5: Add optional counters for RDMA_TX/RX_packets/bytes (Patrisious Haddad) [Orabug: 38667144]
  - net/mlx5: Add support for setting parent of nodes (Carolina Jubran) [Orabug: 38667144]
  - net/mlx5: Preserve rate settings when creating a rate node (Carolina Jubran) [Orabug: 38667144]
  - net/mlx5: Introduce hierarchy level tracking on scheduling nodes (Carolina Jubran) [Orabug: 38667144]
  - net/mlx5: Rename devlink rate parent set function for leaf nodes (Carolina Jubran) [Orabug: 38667144]
  - net/mlx5: fs, add support for dest flow sampler HWS action (Moshe Shemesh) [Orabug: 38667144]
  - net/mlx5: fs, add support for flow meters HWS action (Moshe Shemesh) [Orabug: 38667144]
  - net/mlx5: fs, add API for sharing HWS action by refcount (Moshe Shemesh) [Orabug: 38667144]
  - netdevsim: 'support' multi-buf XDP (Jakub Kicinski) [Orabug: 38667144]
  - net/mlx5: Avoid unnecessary use of comma operator (Simon Horman) [Orabug: 38667144]
  - mmc: sdhci-of-dwcmshc: Change to dwcmshc_phy_init for reusing codes (Jaehoon Chung) [Orabug: 38667144]
  - net/mlx5: Add IFC bits for PPCNT recovery counters group (Yael Chemla) [Orabug: 38667144]
  - RDMA/mlx5: Expose RDMA TRANSPORT flow table types to userspace (Patrisious Haddad) [Orabug: 38667144]
  - RDMA/mlx5: Check enabled UCAPs when creating ucontext (Chiara Meiohas) [Orabug: 38667144]
  - RDMA/uverbs: Add support for UCAPs in context creation (Chiara Meiohas) [Orabug: 38667144]
  - RDMA/mlx5: Create UCAP char devices for supported device capabilities (Chiara Meiohas) [Orabug: 38667144]
  - RDMA/uverbs: Introduce UCAP (User CAPabilities) API (Chiara Meiohas) [Orabug: 38667144]
  - net/mlx5: fs, add RDMA TRANSPORT steering domain support (Patrisious Haddad) [Orabug: 38667144]
  - net/mlx5: Query ADV_RDMA capabilities (Patrisious Haddad) [Orabug: 38667144]
  - net/mlx5: Limit non-privileged commands (Chiara Meiohas) [Orabug: 38667144]
  - net/mlx5: Allow the throttle mechanism to be more dynamic (Chiara Meiohas) [Orabug: 38667144]
  - net/mlx5: Add RDMA_CTRL HW capabilities (Chiara Meiohas) [Orabug: 38667144]
  - net/mlx5e: Properly match IPsec subnet addresses (Leon Romanovsky) [Orabug: 38667144]
  - net/mlx5e: Separate address related variables to be in struct (Leon Romanovsky) [Orabug: 38667144]
  - net/mlx5: Lag, Enable Multiport E-Switch offloads on 8 ports LAG (Amir Tzin) [Orabug: 38667144]
  - net/mlx5e: Enable lanes configuration when auto-negotiation is off (Shahar Shitrit) [Orabug: 38667144]
  - net/mlx5: Refactor link speed handling with mlx5_link_info struct (Shahar Shitrit) [Orabug: 38667144]
  - net: rename netns_local to netns_immutable (Nicolas Dichtel) [Orabug: 38667144]
  - RDMA/mlx5: Reorder capability check last (Christian Göttsche) [Orabug: 38667144]
  - net/mlx5: Add trust lockdown error to health syndrome print function (Shahar Shitrit) [Orabug: 38667144]
  - net/mlx5: Expose crr in health buffer (Shahar Shitrit) [Orabug: 38667144]
  - net/mlx5: Log health buffer data on any syndrome (Moshe Shemesh) [Orabug: 38667144]
  - net/mlx5: Remove newline at the end of a netlink error message (Gal Pressman) [Orabug: 38667144]
  - net/mlx5e: Avoid a hundred -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38667144]
  - net/mlx5e: Symmetric OR-XOR RSS hash control (Gal Pressman) [Orabug: 38667144]
  - ethtool: Symmetric OR-XOR RSS hash (Gal Pressman) [Orabug: 38667144]
  - net/mlx5: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38667144]
  - net/mlx5: Add new health syndrome error and crr bit offset (Shahar Shitrit) [Orabug: 38667144]
  - xfrm: provide common xdo_dev_offload_ok callback implementation (Leon Romanovsky) [Orabug: 38667144]
  - xfrm: rely on XFRM offload (Leon Romanovsky) [Orabug: 38667144]
  - net/mlx5e: Separate extended link modes request from link modes type selection (Shahar Shitrit) [Orabug: 38667144]
  - net/mlx5e: Change eth_proto parameter naming (Shahar Shitrit) [Orabug: 38667144]
  - net/mlx5e: Introduce ptys2ethtool_process_link() (Shahar Shitrit) [Orabug: 38667144]
  - net/mlx5e: Refactor ptys2ethtool_adver_link() (Shahar Shitrit) [Orabug: 38667144]
  - net/mlx5: Bridge, correct config option description (Cosmin Ratiu) [Orabug: 38667144]
  - netdevsim: call napi_schedule from a timer context (Breno Leitao) [Orabug: 38667144]
  - eth: mlx4: use the page pool for Rx buffers (Jakub Kicinski) [Orabug: 38667144]
  - eth: mlx4: remove the local XDP fast-recycling ring (Jakub Kicinski) [Orabug: 38667144]
  - eth: mlx4: create a page pool for Rx (Jakub Kicinski) [Orabug: 38667144]
  - net/mlx5: Add sensor name to temperature event message (Shahar Shitrit) [Orabug: 38667144]
  - net/mlx5: Prefix temperature event bitmap with '0x' for clarity (Shahar Shitrit) [Orabug: 38667144]
  - net/mlx5e: Expose RSS via devlink rx reporter diagnose (Amir Tzin) [Orabug: 38667144]
  - net/mlx5e: Add direct TIRs to devlink rx reporter diagnose (Amir Tzin) [Orabug: 38667144]
  - net/mlx5e: Move RQs diagnose to a dedicated function (Amir Tzin) [Orabug: 38667144]
  - mlxsw: Enable Tx checksum offload (Ido Schimmel) [Orabug: 38667144]
  - net/mlx5e: Remove unused mlx5e_tc_flow_action struct (Gal Pressman) [Orabug: 38667144]
  - net/mlx5: Remove stray semicolon in LAG port selection table creation (Gal Pressman) [Orabug: 38667144]
  - net/mlx5e: Support FEC settings for 200G per lane link modes (Jianbo Liu) [Orabug: 38667144]
  - net/mlx5: Add support for 200Gbps per lane link modes (Jianbo Liu) [Orabug: 38667144]
  - ethtool: Add support for 200Gbps per lane link modes (Jianbo Liu) [Orabug: 38667144]
  - net/mlx5: Generate PPS IN event on new function for shared clock (Jianbo Liu) [Orabug: 38667144]
  - net/mlx5: Support one PTP device per hardware clock (Jianbo Liu) [Orabug: 38667144]
  - net/mlx5: Move PPS notifier and out_work to clock_state (Jianbo Liu) [Orabug: 38667144]
  - net/mlx5: Add devcom component for the clock shared by functions (Jianbo Liu) [Orabug: 38667144]
  - net/mlx5: Change clock in mlx5_core_dev to mlx5_clock pointer (Jianbo Liu) [Orabug: 38667144]
  - net/mlx5: Add API to get mlx5_core_dev from mlx5_clock (Jianbo Liu) [Orabug: 38667144]
  - net/mlx5: Add init and destruction functions for a single HW clock (Jianbo Liu) [Orabug: 38667144]
  - net/mlx5: Change parameters for PTP internal functions (Jianbo Liu) [Orabug: 38667144]
  - net/mlx5: Add helper functions for PTP callbacks (Jianbo Liu) [Orabug: 38667144]
  - mlxsw: spectrum_router: Remove unused functions (Dr. David Alan Gilbert) [Orabug: 38667144]
  - net/mlx5: Remove unused mlx5dr_domain_sync (Dr. David Alan Gilbert) [Orabug: 38667144]
  - mlx4: Remove unused functions (Dr. David Alan Gilbert) [Orabug: 38667144]
  - platform: mellanox: mlx-platform: Change register name (Vadim Pasternak) [Orabug: 38667144]
  - platform: mellanox: mlx-platform: Cosmetic changes (Vadim Pasternak) [Orabug: 38667144]
  - mellanox: Relocate mlx-platform driver (Vadim Pasternak) [Orabug: 38667144]
  - jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Easwar Hariharan) [Orabug: 38667144]
  - ktime: Add us_to_ktime() (David Howells) [Orabug: 38667144]
  - Revert "mlx5: Fix default values in create CQ" (Qing Huang) [Orabug: 38667144]
  - net/mlx5: poll mlx5 eq during irq migration (Praveen Kumar Kannoju) [Orabug: 38915249]
  - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Inseo An) [Orabug: 39044468] {CVE-2026-23231}
  - scsi: core: Fix error handling for scsi_alloc_sdev() (Junxiao Bi) [Orabug: 39104869]
  - scsi: core: Fix refcount leak for tagset_refcnt (Junxiao Bi) [Orabug: 39104869,39130773] {CVE-2026-23296}
  - scsi: core: Move two statements (Bart Van Assche) [Orabug: 39104869]
  - vfio: Adapt to upstream uAPI for VFIO_PRECOPY_INFO_REINIT (Maciej S. Szmigiero) [Orabug: 39121644]
  - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson) [Orabug: 39153394,39159088] {CVE-2026-23401}


author: Sherry Yang <sherry.yang@oracle.com> [6.12.0-202.76.1.el10uek]
changelog:
  - uek-rpm/config-x86_64-onos: Reduce unneeded options in config file for ONOS (Brian Utterback) [Orabug: 39029491]
  - Kconfig for ARISTA_SCD_DRIVER driver needs select REGMAP_I2C (Brian Utterback) [Orabug: 39095293]
  - memfd: move MFD_MF_KEEP_UE_MAPPED flag to higher bit (William Roche) [Orabug: 39109772]
  - uek-rpm: Enable CONFIG_NET_VRF in container kernel (Boris Ostrovsky) [Orabug: 39161478]
  - sched: idle: Make skipping governor callbacks more consistent (Rafael J. Wysocki)
  - dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler (Guenter Roeck)
  - soc: rockchip: grf: Add missing of_node_put() when returning (Shawn Lin)
  - tracing: Add NULL pointer check to trigger_data_free() (Guenter Roeck)
  - qmi_wwan: allow max_mtu above hard_mtu to control rx_urb_size (Laurent Vivier)
  - bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR (Daniel Wade) [Orabug: 39198231] {CVE-2026-31413}
  - ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload (Peter Ujfalusi)
  - Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req (Minseo Park)
  - Revert "arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on" (Sasha Levin)
  - erofs: set fileio bio failed in short read case (Sheng Yong)
  - ACPI: processor: Fix previous acpi_processor_errata_piix4() fix (Rafael J. Wysocki) [Orabug: 39198208] {CVE-2026-23443}
  - kbuild: Leave objtool binary around with 'make clean' (Nathan Chancellor)
  - wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom (Guenter Roeck)
  - net: macb: Reinitialize tx/rx queue pointer registers and rx ring during resume (Kevin Hao)
  - net: macb: Introduce gem_init_rx_ring() (Kevin Hao)
  - net: macb: Shuffle the tx ring before enabling tx (Kevin Hao)
  - remoteproc: mediatek: Unprepare SCP clock during system suspend (Tzung-Bi Shih)
  - LTS version: v6.12.76 (Sherry Yang)
  - Revert "x86/kexec: add a sanity check on previous kernel's ima kexec buffer" (Sasha Levin)
  - LTS version: v6.12.75 (Sherry Yang)
  - most: core: fix leak on early registration failure (Johan Hovold)
  - arm64: Fix sampling the "stable" virtual counter in preemptible section (Marc Zyngier)
  - xfs: fix copy-paste error in previous fix (Darrick J. Wong)
  - drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros (Jani Nikula)
  - ALSA: pcm: Revert bufs move in snd_pcm_xfern_frames_ioctl() (Nathan Chancellor)
  - NTB: ntb_transport: Fix too small buffer for debugfs_name (Koichiro Den)
  - tracing: Wake up poll waiters for hist files when removing an event (Petr Pavlu)
  - tracing: Fix checking of freed trace_event_file for hist files (Petr Pavlu)
  - fgraph: Do not call handlers direct when not using ftrace_ops (Steven Rostedt)
  - tracing: ring-buffer: Fix to check event length before using (Masami Hiramatsu)
  - net: nfc: nci: Fix parameter validation for packet data (Michael Thalmeier)
  - drm/amdgpu: keep vga memory on MacBooks with switchable graphics (Alex Deucher)
  - arm64: Force the use of CNTVCT_EL0 in __delay() (Marc Zyngier)
  - x86/kexec: Copy ACPI root pointer address from config table (Ard Biesheuvel)
  - net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() (Liu Ruitong)
  - net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle (Thomas Fourier)
  - ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR (Gustavo Salvini)
  - cifs: some missing initializations on replay (Shyam Prasad N)
  - fbcon: Remove struct fbcon_display.inverse (Thomas Zimmermann)
  - fbdev: ffb: fix corrupted video output on Sun FFB1 (René Rebe)
  - fbdev: of: display_timing: fix refcount leak in of_get_display_timings() (Weigang He)
  - fbdev: vt8500lcdfb: fix missing dma_free_coherent() (Thomas Fourier)
  - fbcon: check return value of con2fb_acquire_newinfo() (Andrey Vatoropin)
  - mm: numa_memblks: Identify the accurate NUMA ID of CFMW (Cui Chao)
  - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (Junxi Qian)
  - function_graph: Restore direct mode when callbacks drop to one (Shengming Hu)
  - atm: fore200e: fix use-after-free in tasklets during device removal (Duoming Zhou)
  - net: intel: fix PCI device ID conflict between i40e and ipw2200 (Ethan Nelson-Moore)
  - procfs: fix possible double mmput() in do_procmap_query() (Andrii Nakryiko)
  - drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify (Pierre-Eric Pelloux-Prayer)
  - drm/amd/display: Increase DCN35 SR enter/exit latency (Sun Peng Li)
  - io_uring/filetable: clamp alloc_hint to the configured alloc range (Jens Axboe)
  - tracing: Fix to set write permission to per-cpu buffer_size_kb (Masami Hiramatsu)
  - net: macb: Fix tx/rx malfunction after phy link down and up (Kevin Hao)
  - net: ti: icssg-prueth: Add optional dependency on HSR (Kevin Hao)
  - octeontx2-af: CGX: fix bitmap leaks (Bo Sun)
  - net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean() (Thomas Fourier)
  - net: ethernet: marvell: skge: remove incorrect conflicting PCI ID (Ethan Nelson-Moore)
  - LoongArch: Disable instrumentation for setup_ptwalker() (Tiezhu Yang)
  - LoongArch: Guard percpu handler under !CONFIG_PREEMPT_RT (Tiezhu Yang)
  - LoongArch: Use %px to print unmodified unwinding address (Tiezhu Yang)
  - LoongArch: Prefer top-down allocation after arch_mem_init() (Huacai Chen)
  - LoongArch: Make cpumask_of_node() robust against NUMA_NO_NODE (John Garry)
  - rust: kbuild: pass `-Zunstable-options` for Rust 1.95.0 (Miguel Ojeda)
  - ceph: supply snapshot context in ceph_zero_partial_object() (Ethanwu)
  - MIPS: rb532: Fix MMIO UART resource registration (Jiaxun Yang)
  - cifs: Fix locking usage for tcon fields (Shyam Prasad N)
  - watchdog/softlockup: fix sample ring index wrap in need_counting_irqs() (Shengming Hu)
  - kcsan, compiler_types: avoid duplicate type issues in BPF Type Format (Alan Maguire)
  - staging: rtl8723bs: fix null dereference in find_network (Ethan Tidmore)
  - parisc: kernel: replace kfree() with put_device() in create_tree_node() (Haoxiang Li)
  - PCI: Fix pci_slot_trylock() error handling (Jinhui Guo)
  - net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe() error path (Kevin Hao)
  - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (Sunday Clement)
  - tipc: fix RCU dereference race in tipc_aead_users_dec() (Daniel Hodges)
  - mtd: rawnand: pl353: Fix software ECC support (Andrea Scian)
  - usb: dwc2: fix resume failure if dr_mode is host (Jisheng Zhang)
  - usb: dwc3: gadget: Move vbus draw to workqueue context (Prashanth K)
  - PCI: dwc: Fix msg_atu_index assignment (Niklas Cassel)
  - mm/slab: use unsigned long for orig_size to ensure proper metadata align (Harry Yoo)
  - scsi: ufs: core: Flush exception handling work when RPM level is zero (Thomas Yen)
  - perf/arm-cmn: Reject unsupported hardware configurations (Robin Murphy)
  - remoteproc: imx_rproc: Fix invalid loaded resource table detection (Peng Fan)
  - btrfs: continue trimming remaining devices on failure (Jinbaohong)
  - clk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841 (Marek Vasut)
  - arm64: Fix non-atomic __READ_ONCE() with CONFIG_LTO=y (Marco Elver)
  - PCI/IOV: Fix race between SR-IOV enable/disable and hotplug (Niklas Schnelle)
  - Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" (Niklas Schnelle)
  - kexec: derive purgatory entry from symbol (Li Chen)
  - ocfs2: fix reflink preserve cleanup issue (Heming Zhao)
  - rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() (Haoxiang Li)
  - mm/highmem: fix __kmap_to_page() build error (William Tambe)
  - mtd: spinand: Disable continuous read during probe (David Laporte)
  - iio: gyro: itg3200: Fix unchecked return value in read_raw (Antoniu Miclaus)
  - powerpc/smp: Add check for kcalloc() failure in parse_thread_groups() (Guangshuo Li)
  - vhost: move vdpa group bound check to vhost_vdpa (Eugenio Pérez)
  - tools: Fix bitfield dependency failure (Leo Yan)
  - arm64: poe: fix stale POR_EL0 values for ptrace (Joey Gouly)
  - dm mpath: make pg_init_delay_msecs settable (Benjamin Marzinski)
  - bus: fsl-mc: fix an error handling in fsl_mc_device_add() (Haoxiang Li)
  - io_uring/net: don't continue send bundle if poll was required for retry (Jens Axboe)
  - usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN (Haotien Hsu)
  - mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node (Deepanshu Kartikey)
  - nvmem: Drop OF node reference on nvmem_add_one_cell() failure (Krzysztof Kozlowski)
  - nfsd: fix return error code for nfsd_map_name_to_[ug]id (Anthony Iliopoulos)
  - md/bitmap: fix GPF in write_page caused by resize race (Jack Wang)
  - xfs: check for deleted cursors when revalidating two btrees (Darrick J. Wong) [Orabug: 39103129] {CVE-2026-23249}
  - xfs: check return value of xchk_scrub_create_subord (Darrick J. Wong) [Orabug: 39103131] {CVE-2026-23250}
  - xfs: only call xf{array,blob}_destroy if we have a valid pointer (Darrick J. Wong) [Orabug: 39103133] {CVE-2026-23251}
  - pinctrl: intel: Add code name documentation (Raag Jadav)
  - PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions (Manikanta Maddireddy)
  - KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() (Vasiliy Kovalev)
  - xfs: fix remote xattr valuelblk check (Darrick J. Wong)
  - xfs: fix the xattr scrub to detect freemap/entries array collisions (Darrick J. Wong)
  - xfs: fix freemap adjustments when adding xattrs to leaf blocks (Darrick J. Wong)
  - xfs: delete attr leaf freemap entries when empty (Darrick J. Wong)
  - iio: accel: adxl380: Avoid reading more entries than present in FIFO (Francesco Lavra)
  - mfd: omap-usb-host: Fix OF populate on driver rebind (Johan Hovold)
  - mfd: qcom-pm8xxx: Fix OF populate on driver rebind (Johan Hovold)
  - mfd: core: Add locking around 'mfd_of_node_list' (Douglas Anderson)
  - iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (Jinhui Guo)
  - media: verisilicon: AV1: Fix tile info buffer size (Benjamin Gaignard)
  - xfs: remove xfs_attr_leaf_hasname (Christoph Hellwig)
  - xfs: mark data structures corrupt on EIO and ENODATA (Darrick J. Wong)
  - drm/bridge: anx7625: Fix invalid EDID size (Loic Poulain)
  - drm/buddy: Prevent BUG_ON by validating rounded allocation (Sanjay Yadav)
  - selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs (Li Wang)
  - drm: of: drm_of_panel_bridge_remove(): fix device_node leak (Luca Ceresoli)
  - media: venus: vdec: restrict EOS addr quirk to IRIS2 only (Dikshita Agarwal)
  - media: venus: vdec: fix error state assignment for zero bytesused (Renjiang Han)
  - arm64: dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro (Yan Jun)
  - dm-unstripe: fix mapping bug when there are multiple targets in a table (Matt Whitlock)
  - dm-integrity: fix recalculation in bitmap mode (Mikulas Patocka)
  - reset: gpio: suppress bind attributes in sysfs (Bartosz Golaszewski)
  - s390/pci: Handle futile config accesses of disabled devices directly (Niklas Schnelle)
  - clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc() (Haoxiang Li)
  - media: i2c: ov01a10: Fix digital gain range (Mehdi Djait)
  - media: stm32: dcmipp: bytecap: clear all interrupts upon stream stop (Alain Volmat)
  - soc: rockchip: grf: Support multiple grf to be handled (Shawn Lin)
  - soc: rockchip: grf: Fix wrong RK3576_IOCGRF_MISC_CON definition (Shawn Lin)
  - clk: clk-apple-nco: Add "apple,t8103-nco" compatible (Janne Grunau)
  - bus: omap-ocp2scp: fix OF populate on driver rebind (Johan Hovold)
  - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (Yosry Ahmed)
  - soc: ti: pruss: Fix double free in pruss_clk_mux_setup() (Xu Wang)
  - soc: ti: k3-socinfo: Fix regmap leak on probe failure (Johan Hovold)
  - dm: clear cloned request bio pointer when last clone bio completes (Michael Liang)
  - dm-integrity: fix a typo in the code for write/discard race (Mikulas Patocka)
  - platform/x86: ISST: Add missing write block check (Srinivas Pandruvada)
  - media: ipu6: Fix RPM reference leak in probe error paths (Bingbu Cao)
  - media: ipu6: Fix typo and wrong constant in ipu6-mmu.c (Bingbu Cao)
  - media: i2c: ov5647: use our own mutex for the ctrl lock (Xiaolei Wang)
  - media: ccs: Fix setting initial sub-device state (Sakari Ailus)
  - media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode (Jai Luthra)
  - media: i2c: ov5647: Sensor should report RAW color space (David Plowman)
  - media: i2c: ov5647: Correct minimum VBLANK value (David Plowman)
  - media: i2c: ov5647: Correct pixel array offset (David Plowman)
  - media: i2c: ov5647: Initialize subdev before controls (Jai Luthra)
  - media: ccs: Avoid possible division by zero (Sakari Ailus)
  - media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() (Alper Ak)
  - media: i2c: ov01a10: Fix test-pattern disabling (Hans de Goede)
  - media: i2c: ov01a10: Fix passing stream instead of pad to v4l2_subdev_state_get_format() (Hans de Goede)
  - media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() calls (Hans de Goede)
  - media: i2c: ov01a10: Fix analogue gain range (Hans de Goede)
  - media: i2c: ov01a10: Fix reported pixel-rate value (Hans de Goede)
  - media: i2c: ov01a10: Fix the horizontal flip control (Hans de Goede)
  - media: i2c/tw9906: Fix potential memory leak in tw9906_probe() (Abdun Nihaal)
  - media: i2c/tw9903: Fix potential memory leak in tw9903_probe() (Abdun Nihaal)
  - media: cx25821: Add missing unmap in snd_cx25821_hw_params() (Haoxiang Li)
  - media: cx23885: Add missing unmap in snd_cx23885_hw_params() (Haoxiang Li)
  - media: cx88: Add missing unmap in snd_cx88_hw_params() (Haoxiang Li)
  - media: radio-keene: fix memory leak in error path (Shaurya Rane)
  - media: verisilicon: AV1: Set IDR flag for intra_only frame type (Benjamin Gaignard)
  - media: rockchip: rga: Fix possible ERR_PTR dereference in rga_buf_init() (Alper Ak)
  - media: amphion: Drop min_queued_buffers assignment (Ming Qian)
  - arm64: dts: apple: t8112-j473: Keep the HDMI port powered on (Janne Grunau)
  - HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() (Günther Noack)
  - HID: prodikeys: Check presence of pm->input_ep82 (Günther Noack)
  - HID: magicmouse: Do not crash on missing msc->input (Günther Noack)
  - HID: hid-pl: handle probe errors (Oliver Neukum)
  - arm64: Disable branch profiling for all arm64 code (Breno Leitao)
  - KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding (Sean Christopherson)
  - KVM: x86: Return "unsupported" instead of "invalid" on access to unsupported PV MSR (Sean Christopherson)
  - ARM: omap2: Fix reference count leaks in omap_control_init() (Xu Wang)
  - arm64: dts: qcom: x1e80100: Add missing TCSR ref clock to the DP PHYs (Abel Vesa)
  - media: verisilicon: AV1: Fix tx mode bit setting (Benjamin Gaignard)
  - media: verisilicon: AV1: Fix enable cdef computation (Benjamin Gaignard)
  - media: chips-media: wave5: Fix device cleanup order to prevent kernel panic (Xulin Sun)
  - media: chips-media: wave5: Fix kthread worker destruction in polling mode (Xulin Sun)
  - media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove() (Haoxiang Li)
  - media: mtk-mdp: Fix error handling in probe function (Haoxiang Li)
  - media: mediatek: encoder: Fix uninitialized scalar variable issue (Irui Wang)
  - dm-verity: correctly handle dm_bufio_client_create() failure (Eric Biggers)
  - phy: qcom: edp: Make the number of clocks flexible (Abel Vesa)
  - Revert "PCI: qcom: Enable MSI interrupts together with Link up if 'Global IRQ' is supported" (Niklas Cassel)
  - drm/tests: shmem: Swap names of export tests (Thomas Zimmermann)
  - fpga: dfl: use subsys_initcall to allow built-in drivers to be added (Thadeu Lima de Souza Cascardo)
  - ASoC: SOF: ipc4-control: Keep the payload size up to date (Peter Ujfalusi)
  - ASoC: SOF: ipc4-control: Use the correct size for scontrol->ipc_control_data (Peter Ujfalusi)
  - ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls (Peter Ujfalusi)
  - ASoC: SOF: ipc4-control: If there is no data do not send bytes update (Peter Ujfalusi)
  - clk: renesas: rzg2l: Select correct div round macro (Chris Brandt)
  - clk: renesas: rzg2l: Fix intin variable size (Chris Brandt)
  - rpmsg: core: fix race in driver_override_show() and use core helper (Gui-Dong Han)
  - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Vahagn Vardanian)
  - dpaa2-switch: validate num_ifs to prevent out-of-bounds write (Junrui Luo)
  - net: consume xmit errors of GSO frames (Jakub Kicinski)
  - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Jianbo Liu)
  - net/mlx5e: Support routed networks during IPsec MACs initialization (Alexandre Cassen)
  - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Shay Drory)
  - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Shay Drory)
  - net/mlx5: DR, Fix circular locking dependency in dump (Shay Drory)
  - RDMA/umem: Fix double dma_buf_unpin in failure path (Jacob Moroni)
  - net: usb: pegasus: enable basic endpoint checking (Ziyi Guo)
  - RDMA/efa: Fix typo in efa_alloc_mr() (Jason Gunthorpe)
  - net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets (Duoming Zhou)
  - RDMA/core: Fix stale RoCE GIDs during netdev events at registration (Jiri Pirko)
  - tipc: fix duplicate publication key in tipc_service_insert_publ() (Tung Nguyen)
  - kcm: fix zero-frag skb in frag_list on partial sendmsg error (Jiayuan Chen)
  - tls: Fix race condition in tls_sw_cancel_work_tx() (Hyunwoo Kim) [Orabug: 39073883] {CVE-2026-23240}
  - Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ (Luiz Augusto von Dentz)
  - Bluetooth: L2CAP: Fix not checking output MTU is acceptable on L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz)
  - Bluetooth: L2CAP: Fix response to L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz)
  - Bluetooth: hci_qca: Cleanup on all setup failures (Jinwang Li)
  - Bluetooth: L2CAP: Fix result of L2CAP_ECRED_CONN_RSP when MTU is too short (Luiz Augusto von Dentz)
  - Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ (Luiz Augusto von Dentz)
  - Remove WARN_ALL_UNSEEDED_RANDOM kernel config option (Linus Torvalds)
  - wifi: cfg80211: wext: fix IGTK key ID off-by-one (Johannes Berg)
  - bnxt_en: Fix deleting of Ntuple filters (Pavan Chebbi)
  - bnxt_en: Fix RSS context delete logic (Pavan Chebbi)
  - net: ethernet: xscale: Check for PTP support properly (Linus Walleij)
  - net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() (Vladimir Oltean)
  - net: usb: lan78xx: scan all MDIO addresses on LAN7801 (Martin Pålsson)
  - net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode (Ziyi Guo)
  - espintcp: Fix race condition in espintcp_close() (Hyunwoo Kim)
  - xfrm: always flush state and policy upon NETDEV_UNREGISTER event (Tetsuo Handa)
  - ipmi: ipmb: initialise event handler read bytes (Matt Johnston)
  - xfrm: skip templates check for packet offload tunnel mode (Leon Romanovsky)
  - xfrm6: fix uninitialized saddr in xfrm6_get_saddr() (Jiayuan Chen)
  - ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut (Maciej Grochowski)
  - ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access (Maciej Grochowski)
  - rtc: zynqmp: correct frequency value (Tomas Melin)
  - drm/amd/display: Remove conditional for shaper 3DLUT power-on (Alex Hung)
  - arm64: hugetlbpage: avoid unused-but-set-parameter warning (gcc-16) (Arnd Bergmann)
  - btrfs: replace BUG() with error handling in __btrfs_balance() (Adarsh Das)
  - ALSA: usb-audio: Add sanity check for OOB writes at silencing (Takashi Iwai)
  - drm/radeon: Add HAINAN clock adjustment (Decce6)
  - spi: spidev: fix lock inversion between spi_lock and buf_lock (Fabian Godehardt)
  - drm/amd/display: bypass post csc for additional color spaces in dal (Clay King)
  - drm/amdgpu: Add HAINAN clock adjustment (Decce6)
  - ALSA: usb-audio: Update the number of packets properly at receiving (Takashi Iwai)
  - drm/amdgpu: Adjust usleep_range in fence wait (Ce Sun)
  - drm/amd/display: Avoid updating surface with the same surface under MPO (Wayne Lin)
  - drm/amd/display: Fix system resume lag issue (Tom Chung)
  - drm/amd/display: Fix writeback on DCN 3.2+ (Alex Hung)
  - ARM: 9467/1: mm: Don't use %pK through printk (Thomas Weißschuh)
  - include: uapi: netfilter_bridge.h: Cover for musl libc (Phil Sutter)
  - ACPI: x86: Force enabling of PWM2 on the Yogabook YB1-X90 (Yauhen Kharuzhy)
  - thermal: int340x: Fix sysfs group leak on DLVR registration failure (Kaushlendra Kumar)
  - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov)
  - ceph: supply snapshot context in ceph_uninline_data() (Ethanwu)
  - fs/ntfs3: avoid calling run_get_entry() when run == NULL in ntfs_read_run_nb_ra() (Konstantin Komarov)
  - fs/ntfs3: drop preallocated clusters for sparse and compressed files (Konstantin Komarov)
  - fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST (Jaehun Gou)
  - fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata (Jaehun Gou)
  - fs: ntfs3: check return value of indx_find to avoid infinite loop (Jaehun Gou)
  - MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE (John Garry)
  - iio: magnetometer: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
  - iio: Use IRQF_NO_THREAD (Sebastian Andrzej Siewior)
  - mfd: intel-lpss: Add Intel Nova Lake-S PCI IDs (Ilpo Järvinen)
  - Revert "mfd: da9052-spi: Change read-mask to write-mask" (Marcus Folkesson)
  - phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature (Xu Yang)
  - phy: mvebu-cp110-utmi: fix dr_mode property read from dts (Aleksandar Gerasimovski)
  - watchdog: imx7ulp_wdt: handle the nowayout option (Oleksandr Suvorov)
  - binder: don't use %pK through printk (Thomas Weißschuh)
  - fix it87_wdt early reboot by reporting running timer (René Rebe)
  - serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done (Moteen Shah)
  - serial: 8250: 8250_omap.c: Add support for handling UART error conditions (Moteen Shah)
  - staging: rtl8723bs: fix memory leak on failure path (Diksha Kumari)
  - usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke() (Mario Peter)
  - usb: gadget: f_fs: Fix ioctl error handling (Sam Day)
  - usb: gadget: f_fs: fix DMA-BUF OUT queues (Sam Day)
  - misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 (Markus Koch)
  - misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() (Tuo Li)
  - phy: cadence-torrent: restore parent clock for refclk during resume (Thomas Richard)
  - phy: ti: phy-j721e-wiz: restore mux selection during resume (Thomas Richard)
  - dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix warnings (Clément Le Goffic)
  - dmaengine: sun6i: Choose appropriate burst length under maxburst (Chen-Yu Tsai)
  - most: core: fix resource leak in most_register_interface error paths (Navaneeth K)
  - fpga: of-fpga-region: Fail if any bridge is missing (Romain Gantois)
  - usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs (Benson Leung)
  - serial: 8250_dw: handle clock enable errors in runtime_resume (Artem Shimko)
  - staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure (Liang Jie)
  - soundwire: intel_auxdevice: add cs42l45 codec to wake_capable_list (Maciej Strozek)
  - soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15) (Peter Ujfalusi)
  - dmaengine: stm32-dma3: use module_platform_driver (Amelie Delaunay)
  - 9p/xen: protect xen_9pfs_front_free against concurrent calls (Stefano Stabellini)
  - m68k: nommu: fix memmove() with differently aligned src and dest for 68000 (Daniel Palmer)
  - HID: i2c-hid: Add FocalTech FT8112 (Daniel Peng)
  - clk: microchip: core: correct return value on *_get_parent() (Brian Masney)
  - mailbox: sprd: clear delivery flag before handling TX done (Otto Pflüger)
  - remoteproc: mediatek: Break lock dependency to `prepare_lock` (Tzung-Bi Shih)
  - mailbox: sprd: mask interrupts that are not handled (Otto Pflüger)
  - mailbox: imx: Skip the suspend flag for i.MX7ULP (Jacky Bai)
  - mailbox: pcc: Remove spurious IRQF_ONESHOT usage (Mark Brown)
  - remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX channel is uninitialized (Iuliana Prodan)
  - tracing: Fix false sharing in hwlat get_sample() (Colin Lord)
  - riscv: vector: init vector context with proper vlenb (Sergey Matyukevich)
  - scsi: ufs: mediatek: Fix page faults in ufs_mtk_clk_scale() trace event (Keita Morisaki)
  - vhost: fix caching attributes of MMIO regions by setting them explicitly (Kommula Shiva Shankar)
  - scsi: buslogic: Reduce stack usage (Arnd Bergmann)
  - hisi_acc_vfio_pci: update status after RAS error (Longfang Liu)
  - ata: libata: avoid long timeouts on hot-unplugged SATA DAS (Henry Tseng)
  - RDMA/rtrs-clt: For conn rejection use actual err number (Md Haris Iqbal)
  - nfc: nxp-nci: remove interrupt trigger type (Carl Lee)
  - myri10ge: avoid uninitialized variable use (Arnd Bergmann)
  - PCI: Mark Nvidia GB10 to avoid bus reset (Johnny-Cc Chang)
  - PCI: Add ACS quirk for Qualcomm Hamoa & Glymur (Krishna Chaitanya Chundru)
  - PCI: Fix pci_slot_lock () device locking (Keith Busch)
  - PCI/AER: Clear stale errors on reporting agents upon probe (Lukas Wunner)
  - PCI: Mark ASM1164 SATA controller to avoid bus reset (Alex Williamson)
  - vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 (Arnd Bergmann)
  - net: usb: sr9700: remove code to drive nonexistent multicast filter (Ethan Nelson-Moore)
  - bnxt_en: Allow ntuple filters for drops (Joe Damato)
  - wifi: ath10k: fix lock protection in ath10k_wmi_event_peer_sta_ps_state_chg() (Ziyi Guo)
  - wifi: rtw89: pci: restore LDO setting after device resume (Dian-Syuan Yang)
  - net: sfp: add quirk for Lantech 8330-265D (Marek Behún)
  - octeontx2-af: Workaround SQM/PSE stalls by disabling sticky (Geetha Sowjanya)
  - Bluetooth: btusb: Add device ID for Realtek RTL8761BU (Jacopo Scannella)
  - Bluetooth: btusb: Add new VID/PID for RTL8852CE (Shell Chen)
  - Bluetooth: hci_conn: use mod_delayed_work for active mode timeout (Stefan Sørensen)
  - Bluetooth: hci_conn: Set link_policy on incoming ACL connections (Stefan Sørensen)
  - Bluetooth: btusb: Add support for MediaTek7920 0489:e158 (Andrew Elantsev)
  - ipv4: fib: Annotate access to struct fib_alias.fa_state. (Kuniyuki Iwashima)
  - wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() (Ziyi Guo)
  - wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() (Ziyi Guo)
  - net: hns3: extend HCLGE_FD_AD_QID to 11 bits (Jijie Shao)
  - ipv4: igmp: annotate data-races around idev->mr_maxdelay (Eric Dumazet)
  - gro: change the BUG_ON() in gro_pull_from_frag0() (Eric Dumazet)
  - ext4: propagate flags to convert_initialized_extent() (Ojaswin Mujoo)
  - wifi: rtw89: 8922a: add digital compensation for 2GHz (Po-Hao Huang)
  - wifi: rtw89: fix unable to receive probe responses under MLO connection (Po-Hao Huang)
  - wifi: iwlwifi: mvm: check the validity of noa_len (Miri Korenblit)
  - net: usb: r8152: fix transmit queue timeout (Mingj Ye)
  - openrisc: define arch-specific version of nop() (Brian Masney)
  - netfilter: xt_tcpmss: check remaining length before reading optlen (Florian Westphal)
  - netfilter: nf_conntrack: Add allow_clash to generic protocol handler (Yuto Hamaguchi)
  - ext4: use reserved metadata blocks when splitting extent on endio (Zhang Yi)
  - ext4: mark group extend fast-commit ineligible (Li Chen)
  - ext4: move ext4_percpu_param_init() before ext4_mb_init() (Baokun Li)
  - ext4: mark group add fast-commit ineligible (Li Chen)
  - ipv6: exthdrs: annotate data-race over multiple sysctl (Eric Dumazet)
  - ipv6: annotate data-races over sysctl.flowlabel_reflect (Eric Dumazet)
  - ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}() (Eric Dumazet)
  - wifi: cfg80211: allow only one NAN interface, also in multi radio (Miri Korenblit)
  - wifi: ath12k: fix preferred hardware mode calculation (Baochen Qiang)
  - wifi: ath11k: Fix failure to connect to a 6 GHz AP (Qian Zhang)
  - wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1 (Ross Vandegrift)
  - wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode (Chin-Yen Lee)
  - wifi: rtw89: mac: correct page number for CSI response (Ping-Ke Shih)
  - iommu/amd: move wait_on_sem() out of spinlock (Ankit Soni)
  - wifi: libertas: fix WARNING in usb_tx_block (Szymon Wilczek)
  - net: wwan: mhi: Add network support for Foxconn T99W760 (Slark Xiao)
  - iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency (Alexander Grest)
  - dm: remove fake timeout to avoid leak request (Ding Hui)
  - dm: replace -EEXIST with -EBUSY (Daniel Gomez)
  - wifi: rtw88: Fix inadvertent sharing of struct ieee80211_supported_band data (Bitterblue Smith)
  - wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() (Bitterblue Smith)
  - wifi: rtw89: ser: enable error IMR after recovering from L1 (Zong-Zhe Yang)
  - wifi: rtw89: 8922a: set random mac if efuse contains zeroes (Jose Ignacio Tornos Martinez)
  - wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H (Hsiu-Ming Chang)
  - wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() (Bitterblue Smith)
  - wifi: rtw88: fix DTIM period handling when conf->dtim_period is zero (Roman Peshkichev)
  - jfs: nlink overflow in jfs_rename (Jori Koolstra)
  - jfs: Add missing set_freezable() for freezable kthread (Xu Wang)
  - ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio (Lianqin Hu)
  - ALSA: mixer: oss: Add card disconnect checkpoints (Takashi Iwai)
  - ALSA: hda/realtek - Enable mute LEDs on HP ENVY x360 15-es0xxx (Illia Barbashyn)
  - ASoC: fsl: imx-rpmsg: use snd_soc_find_dai_with_mutex() in probe (Ziyi Guo)
  - spi: geni-qcom: Fix abort sequence execution for serial engine errors (Praveen Talari)
  - ASoC: SOF: Intel: hda: Fix NULL pointer dereference (Ranjani Sridharan)
  - power: sequencing: fix missing state_lock in pwrseq_power_on() error path (Ziyi Guo)
  - modpost: Amend ppc64 save/restfpr symnames for -Os build (René Rebe)
  - ASoC: es8328: Add error unwind in resume (Hsieh Hung-En)
  - HID: logitech-hidpp: Add support for Logitech K980 (Bastien Nocera)
  - hwmon: (f71882fg) Add F81968 support (Ji-Ze Hong)
  - hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE (Denis Pauk)
  - hwmon: (dell-smm) Add support for Dell OptiPlex 7080 (Armin Wolf)
  - ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in max98390_i2c_probe() (Chen Ni)
  - drm/amd/display: avoid dig reg access timeout on usb4 link training fail (Zhongwei)
  - drm/amd/display: Fix GFX12 family constant checks (Matthew Stewart)
  - spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end (Chin-Ting Kuo)
  - ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio (Chen Ni)
  - gpio: aspeed-sgpio: Change the macro to support deferred probe (Billy Tsai)
  - ALSA: hda/realtek: fix LG Gram Style 14 speakers (Damien Dagorn)
  - ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro (Gongqi)
  - HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK (David Phillips)
  - HID: multitouch: add eGalaxTouch EXC3188 support (Thorsten Schmelzer)
  - media: rkisp1: Fix filter mode register configuration (Rui Wang)
  - drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release (Ludovic Desroches)
  - drm/atmel-hlcdc: don't reject the commit if the src rect has fractional parts (Ludovic Desroches)
  - drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback (Ludovic Desroches)
  - drm/amd/display: Disable FEC when powering down encoders (Ovidiu Bunea)
  - PCI: Add Intel Nova Lake audio Device ID (Peter Ujfalusi)
  - ASoC: soc-acpi-intel-arl-match: change rt722 amp endpoint to aggregated (Bard Liao)
  - virt: vbox: uapi: Mark inner unions in packed structs as packed (Thomas Weißschuh)
  - hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed (Thomas Weißschuh)
  - drm: Account property blob allocations to memcg (Xiao Kan)
  - drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map() (Donet Tom)
  - drm/amdkfd: Relax size checking during queue buffer get (Donet Tom)
  - ALSA: hda/realtek: add HP Victus 16-e0xxx mute LED quirk (Bharat Dev Burman)
  - media: ipu6: Always close firmware stream (Sakari Ailus)
  - media: ipu6: Close firmware streams on streaming enable failure (Sakari Ailus)
  - media: ipu6: Ensure stream_mutex is acquired when dealing with node list (Sakari Ailus)
  - media: mt9m114: Return -EPROBE_DEFER if no endpoint is found (Hans de Goede)
  - media: mt9m114: Avoid a reset low spike during probe() (Hans de Goede)
  - media: v4l2-async: Fix error handling on steps after finding a match (Sakari Ailus)
  - media: cx25821: Fix a resource leak in cx25821_dev_setup() (Haoxiang Li)
  - media: solo6x10: Check for out of bounds chip_id (Kees Cook)
  - media: pvrusb2: fix URB leak in pvr2_send_request_ex (Szymon Wilczek)
  - media: adv7180: fix frame interval in progressive mode (Thorsten Schmelzer)
  - drm/panel: Fix a possible null-pointer dereference in jdi_panel_dsi_remove() (Tuo Li)
  - media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START (Ming Qian)
  - spi: spi-mem: Limit octal DTR constraints to octal DTR situations (Miquel Raynal)
  - ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug (Sebastian Krzyszkowiak)
  - ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask (Sebastian Krzyszkowiak)
  - drm/xe: Only toggle scheduling in TDR if GuC is running (Matthew Brost)
  - drm/amd/display: only power down dig on phy endpoints (Dmytro Laktyushkin)
  - drm/amdgpu: Skip loading SDMA_RS64 in VF (Yubiao Wang)
  - HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards (Joey Bednar)
  - drm/amd/display: Add signal type check for dcn401 get_phyd32clk_src (Dmytro Laktyushkin)
  - drm/amdgpu: avoid a warning in timedout job handler (Alex Deucher)
  - drm/amd/display: Fix dsc eDP issue (Charlene Liu)
  - drm/amdgpu: add support for HDP IP version 6.1.1 (Tim Huang)
  - media: mediatek: vcodec: Don't try to decode 422/444 VP9 (Nicolas Dufresne)
  - media: chips-media: wave5: Process ready frames when CMD_STOP sent to Encoder (Brandon Brnich)
  - media: chips-media: wave5: Fix conditional in start_streaming (Brandon Brnich)
  - media: omap3isp: set initial format (Hans Verkuil)
  - media: omap3isp: isppreview: always clamp in preview_try_format() (Hans Verkuil)
  - media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes (Hans Verkuil)
  - drm/v3d: Set DMA segment size to avoid debug warnings (Xiaolei Wang)
  - spi: stm32: fix Overrun issue at < 8bpw (Deepak Kumar)
  - media: dvb-core: dmxdevfilter must always flush bufs (Hans Verkuil)
  - ASoC: SOF: ipc4: Support for sending payload along with LARGE_CONFIG_GET (Peter Ujfalusi)
  - drm/amd/display: Add USB-C DP Alt Mode lane limitation in DCN32 (Lincheng Ku)
  - spi-geni-qcom: use xfer->bits_per_word for can_dma() (Jonathan Marek)
  - spi-geni-qcom: initialize mode related registers to 0 (Jonathan Marek)
  - drm/amdkfd: Handle GPU reset and drain retry fault race (Philip Yang)
  - drm/amdgpu: fix NULL pointer issue buffer funcs (Likun Gao)
  - gpu/panel-edp: add AUO panel entry for B140HAN06.4 (Alexey Klimov)
  - drm/display/dp_mst: Add protection against 0 vcpi (Suraj Kandpal)
  - parisc: Prevent interrupts during reboot (Helge Deller)
  - arm64: tegra: smaug: Add usb-role-switch support (Diogo Ivo)
  - Revert "arm64: zynqmp: Add an OP-TEE node to the device tree" (Tomas Melin)
  - firmware: arm_ffa: Unmap Rx/Tx buffers on init failure (Haoxiang Li)
  - pstore: ram_core: fix incorrect success return when vmap() fails (Ruipeng Qi)
  - sched/debug: Fix updating of ppos on server write ops (Joel Fernandes)
  - char: tpm: cr50: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
  - mailbox: bcm-ferxrm-mailbox: Use default primary handler (Sebastian Andrzej Siewior)
  - crypto: hisilicon/qm - move the barrier before writing to the mailbox register (Chenghai Huang)
  - PCI/MSI: Unmap MSI-X region on error (Haoxiang Li)
  - clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on OF (Bartosz Golaszewski)
  - clocksource/drivers/sh_tmu: Always leave device running after probe (Niklas Söderlund)
  - bpf: Recognize special arithmetic shift in the verifier (Alexei Starovoitov)
  - bpf: crypto: Use the correct destructor kfunc type (Sami Tolvanen)
  - perf/x86/cstate: Add Airmont NP (Martin Schiller)
  - perf/x86/msr: Add Airmont NP (Martin Schiller)
  - bpf: verifier improvement in 32bit shift sign extension pattern (Cupertino Miranda)
  - sparc: don't reference obsolete termio struct for TC* constants (Sam James)
  - sparc: Synchronize user stack on fork and clone (Andreas Larsson)
  - block: decouple secure erase size limit from discard size limit (Luke Wang)
  - blk-mq-debugfs: add missing debugfs_mutex in blk_mq_debugfs_register_hctxs() (Yu Kuai)
  - xenbus: Use .freeze/.thaw to handle xenbus devices (Jason Andryuk)
  - ACPI: battery: fix incorrect charging status when current is zero (Ata İLhan Köktürk)
  - ACPI: x86: s2idle: Invoke Microsoft _DSM Function 9 (Turn On Display) (Jakob Riemenschneider)
  - perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD (Sebastian Andrzej Siewior)
  - s390/perf: Disable register readout on sampling events (Thomas Richter)
  - cpufreq: dt-platdev: Block the driver from probing on more QC platforms (Konrad Dybcio)
  - md-cluster: fix NULL pointer dereference in process_metadata_update (Jiasheng Jiang)
  - alpha: fix user-space corruption during memory compaction (Magnus Lindholm)
  - powercap: intel_rapl: Add PL4 support for Ice Lake (Daniel Tang)
  - ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP (Armin Wolf)
  - ACPI: resource: Add JWIPC JVC9100 to irq1_level_low_skip_override[] (Ai Chao)
  - ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4() (Tuo Li)
  - EFI/CPER: don't go past the ARM processor CPER record buffer (Mauro Carvalho Chehab)
  - APEI/GHES: ARM processor Error: don't go past allocated memory (Mauro Carvalho Chehab)
  - APEI/GHES: ensure that won't go past CPER allocated record (Mauro Carvalho Chehab)
  - EFI/CPER: don't dump the entire memory region (Mauro Carvalho Chehab)
  - x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE is set (Hou Wenlong)
  - rnbd-srv: Zero the rsp buffer before using it (Md Haris Iqbal)
  - arm64: Add support for TSV110 Spectre-BHB mitigation (Jinqian Yang)
  - perf/arm-cmn: Support CMN-600AE (Robin Murphy)
  - s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS (Heiko Carstens)
  - tools/power cpupower: Reset errno before strtoull() (Kaushlendra Kumar)
  - smb: client: prevent races in ->query_interfaces() (Henrique Carvalho)
  - gfs2: fiemap page fault fix (Andreas Gruenbacher)
  - smb: client: add proper locking around ses->iface_last_update (Henrique Carvalho)
  - btrfs: handle user interrupt properly in btrfs_trim_fs() (Jinbaohong)
  - btrfs: fallback to buffered IO if the data profile has duplication (Qu Wenruo)
  - dlm: validate length in dlm_search_rsb_tree (Ziming Zhang)
  - minix: Add required sanity checking to minix_check_superblock() (Jori Koolstra)
  - i3c: mipi-i3c-hci: Reset RING_OPERATION1 fields during init (Adrian Hunter)
  - i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr() (Frank Li)
  - hfsplus: pretend special inodes as regular files (Tetsuo Handa)
  - audit: add missing syscalls to read class (Jeffrey Bencteux)
  - fs/buffer: add alert in try_to_free_buffers() for folios without buffers (Deepakkumar Karn)
  - hfsplus: fix volume corruption issue for generic/498 (Viacheslav Dubeyko)
  - audit: add fchmodat2() to change attributes class (Jeffrey Bencteux)
  - statmount: permission check should return EPERM (Bhavik Sachdev)
  - rtc: interface: Alarm race handling should not discard preceding error (Anthony Pighin)
  - libperf build: Always place libperf includes first (Ian Rogers)
  - libperf: Don't remove -g when EXTRA_CFLAGS are used (James Clark)
  - perf vendor events amd: Fix Zen 5 MAB allocation events (Sandipan Das)
  - perf annotate: Fix memcpy size in arch__grow_instructions() (Suchit Karunakaran)
  - perf maps: Fix reference count leak in maps__find_ams() (Ian Rogers)
  - libsubcmd: Fix null intersection case in exclude_cmds() (Sri Jayaramappa)
  - perf callchain: Fix srcline printing with inlines (Ian Rogers)
  - perf unwind-libdw: Fix invalid reference counts (Ian Rogers)
  - perf test stat tests: Fix for virtualized machines (Thomas Richter)
  - perf test stat: Update test expectations and events (Ian Rogers)
  - ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names (Shengjiu Wang)
  - ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names (Shengjiu Wang)
  - ASoC: dt-bindings: asahi-kasei,ak4458: set unevaluatedProperties:false (Shengjiu Wang)
  - dt-bindings: phy: qcom-edp: Add missing clock for X Elite (Abel Vesa)
  - SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path (Daniel Hodges)
  - SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths (Chuck Lever)
  - Drivers: hv: vmbus: Use kthread for vmbus interrupts on PREEMPT_RT (Jan Kiszka)
  - ata: libata-scsi: refactor ata_scsi_translate() (Damien Le Moal)
  - ata: pata_ftide010: Fix some DMA timings (Linus Walleij)
  - ext4: use optimized mballoc scanning regardless of inode format (Jan Kara)
  - ext4: fix dirtyclusters double decrement on fs shutdown (Brian Foster)
  - ext4: fix e4b bitmap inconsistency reports (Yongjian Sun)
  - ext4: fix memory leak in ext4_ext_shift_extents() (Zilin Guan)
  - ext4: drop extent cache when splitting extent fails (Zhang Yi)
  - ext4: drop extent cache after doing PARTIAL_VALID1 zeroout (Zhang Yi)
  - ext4: don't cache extent during splitting extent (Zhang Yi)
  - ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 (Zhang Yi)
  - ext4: subdivide EXT4_EXT_DATA_VALID1 (Zhang Yi)
  - MIPS: Work around LLVM bug when gp is used as global register variable (Yao Zi)
  - drm/amd/display: Use same max plane scaling limits for all 64 bpp formats (Mario Kleiner)
  - ASoC: rockchip: i2s-tdm: Use param rate if not provided by set_sysclk (Detlev Casanova)
  - x86/hyperv: Fix error pointer dereference (Ethan Tidmore)
  - btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found (Filipe Manana)
  - btrfs: use the correct type to initialize block reserve for delayed refs (Filipe Manana)
  - efi: Fix reservation of unaccepted memory table (Kiryl Shutsemau)
  - drm/xe/xe2_hpg: Fix handling of Wa_14019988906 & Wa_14019877138 (Matt Roper)
  - drm/xe/xe2_hpg: Add set of workarounds (Shekhar Chauhan)
  - drm/xe/ptl: Apply Wa_13011645652 (Vinay Belgaumkar)
  - drm/xe/mmio: Avoid double-adjust in 64-bit reads (Shuicheng Lin)
  - drm/xe: Switch MMIO interface to take xe_mmio instead of xe_gt (Matt Roper)
  - drm/xe: Adjust mmio code to pass VF substructure to SRIOV code (Matt Roper)
  - drm/xe: Add xe_tile backpointer to xe_mmio (Matt Roper)
  - drm/xe: Switch mmio_ext to use 'struct xe_mmio' (Matt Roper)
  - drm/xe: Populate GT's mmio iomap from tile during init (Matt Roper)
  - drm/xe: Move GSI offset adjustment fields into 'struct xe_mmio' (Matt Roper)
  - drm/xe: Clarify size of MMIO region (Matt Roper)
  - drm/xe: Create dedicated xe_mmio structure (Matt Roper)
  - drm/xe: Move forcewake to 'gt.pm' substructure (Matt Roper)
  - s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n (Alexander Egorenkov)
  - spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe() (Felix Gu)
  - drm/amd/display: Fix out-of-bounds stream encoder index v3 (Srinivasan Shanmugam)
  - drm/amd/display: Reject cursor plane on DCE when scaled differently than primary (Timur Kristóf)
  - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (Srinivasan Shanmugam)
  - ASoC: codecs: aw88261: Fix erroneous bitmask logic in Awinic init (Alexandre Ferrieux)
  - drm/i915/acpi: free _DSM package when no connectors (Kaushlendra Kumar)
  - ASoC: fsl_xcvr: Revert fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
  - drm/amdgpu: Fix memory leak in amdgpu_ras_init() (Zilin Guan)
  - drm/amdgpu: Use kvfree instead of kfree in amdgpu_gmc_get_nps_memranges() (Zilin Guan)
  - drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() (Zilin Guan)
  - apparmor: fix aa_label to return state from compount and component match (John Johansen)
  - apparmor: fix invalid deref of rawdata when export_binary is unset (Georgia Garcia)
  - apparmor: avoid per-cpu hold underflow in aa_get_buffer (Zhengmian Hu)
  - apparmor: make label_match return a consistent value (John Johansen)
  - apparmor: remove apply_modes_to_perms from label_match (John Johansen)
  - apparmor: fix rlimit for posix cpu timers (John Johansen)
  - apparmor: return -ENOMEM in unpack_perms_table upon alloc failure (Ryan Lee)
  - apparmor: Fix & Optimize table creation from possibly unaligned memory (Helge Deller)
  - AppArmor: Allow apparmor to handle unaligned dfa tables (Helge Deller)
  - apparmor: fix NULL sock in aa_sock_file_perm (John Johansen)
  - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Cosmin Ratiu)
  - net/mlx5: Fix multiport device check over light SFs (Shay Drory)
  - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (Hangbin Liu)
  - octeontx2-af: Fix default entries mcam entry action (Hariprasad Kelam)
  - icmp: prevent possible overflow in icmp_global_allow() (Eric Dumazet)
  - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Eric Dumazet) [Orabug: 39110677] {CVE-2026-23273}
  - ping: annotate data-races in ping_lookup() (Eric Dumazet)
  - bpftool: Fix truncated netlink dumps (Jakub Kicinski)
  - ipv6: fix a race in ip6_sock_set_v6only() (Eric Dumazet)
  - net: remove WARN_ON_ONCE when accessing forward path array (Pablo Neira Ayuso)
  - ipvs: do not keep dest_dst if dev is going down (Julian Anastasov)
  - netfilter: nf_conntrack_h323: don't pass uninitialised l3num value (Florian Westphal)
  - selftests: forwarding: vxlan_bridge_1d_ipv6: fix test failure with br_netfilter enabled (Aleksei Oladko)
  - selftests: forwarding: vxlan_bridge_1d: fix test failure with br_netfilter enabled (Aleksei Oladko)
  - net: bridge: mcast: always update mdb_n_entries for vlan contexts (Nikolay Aleksandrov)
  - xen-netback: reject zero-queue configuration from guest (Ziyi Guo)
  - net: usb: catc: enable basic endpoint checking (Ziyi Guo)
  - net: sparx5/lan969x: fix PTP clock max_adj value (Daniel Machon)
  - ipv6: Fix out-of-bound access in fib6_add_rt2node(). (Kuniyuki Iwashima)
  - net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj() (Ziyi Guo)
  - net: mscc: ocelot: split xmit into FDMA and register injection paths (Ziyi Guo)
  - net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (Ziyi Guo)
  - net: sparx5/lan969x: fix DWRR cost max to match hardware register width (Daniel Machon)
  - selftests: mlxsw: tc_restrictions: Fix test failure with new iproute2 (Ido Schimmel)
  - cpuidle: Skip governor when only one idle state is available (Aboorva Devarajan)
  - ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO (Zhai Can)
  - objpool: fix the overestimation of object pooling metadata size (Zhouwenhao)
  - selftests/memfd: use IPC semaphore instead of SIGSTOP/SIGCONT (Aristeu Rozanski)
  - kbuild: Add objtool to top-level clean target (Josh Poimboeuf)
  - powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check (Kuppuswamy Sathyanarayanan)
  - ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs (Sean V Kelley)
  - fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot (Jiasheng Jiang)
  - fs/ntfs3: prevent infinite loops caused by the next valid being the same (Edward Adam Davis)
  - fs/ntfs3: Initialize new folios before use (Bartlomiej Kubik)
  - io_uring/cancel: de-unionize file and user_data in struct io_cancel_data (Jens Axboe)
  - drbd: always set BLK_FEAT_STABLE_WRITES (Christoph Böhmwalder)
  - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Jared Kangas)
  - backlight: qcom-wled: Change PM8950 WLED configurations (Barnabás Czémán)
  - backlight: qcom-wled: Support ovp values for PMI8994 (Barnabás Czémán)
  - leds: qcom-lpg: Check the return value of regmap_bulk_write() (Xu Wang)
  - pinctrl: single: fix refcount leak in pcs_add_gpio_func() (Wei Li)
  - pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition (Luca Weiss)
  - iio: sca3000: Fix a resource leak in sca3000_probe() (Harshit Mogalapalli)
  - ovl: Fix uninit-value in ovl_fill_real (Qing Wang)
  - pinctrl: equilibrium: Fix device node reference leak in pinbank_init() (Felix Gu)
  - usb: bdc: fix sleep during atomic (Justin Chen)
  - drivers: iio: mpu3050: use dev_err_probe for regulator request (Svyatoslav Ryhel)
  - mfd: simple-mfd-i2c: Add Delta TN48M CPLD support (Robert Marko)
  - mfd: simple-mfd-i2c: Keep compatible strings in alphabetical order (Ioana Ciornei)
  - mfd: simple-mfd-i2c: Add SpacemiT P1 support (Alex Elder)
  - mfd: simple-mfd-i2c: Add compatible strings for Layerscape QIXIS FPGA (Ioana Ciornei)
  - mfd: simple-mfd-i2c: Add MAX77705 support (Dzmitry Sankouski)
  - mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure (Xu Wang)
  - Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms" (Greg Kroah-Hartman)
  - phy: freescale: imx8qm-hsio: fix NULL pointer dereference (Thomas Richard)
  - coresight: etm3x: Fix cpulocked warning on cpuhp (Antonio Borneo)
  - watchdog: starfive-wdt: Fix PM reference leak in probe error path (Kery Qi)
  - iio: pressure: mprls0025pa: fix pressure calculation (Petre Rodan)
  - iio: pressure: mprls0025pa: fix scan_type struct (Petre Rodan)
  - iio: pressure: mprls0025pa: fix interrupt flag (Petre Rodan)
  - iio: pressure: mprls0025pa: fix SPI CS delay violation (Petre Rodan)
  - iio: pressure: mprls0025pa: fix spi_transfer struct initialisation (Petre Rodan)
  - mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms (Matthew Schwartz)
  - serial: SH_SCI: improve "DMA support" prompt (Randy Dunlap)
  - serial: imx: change SERIAL_IMX_CONSOLE to bool (Randy Dunlap)
  - staging: greybus: lights: avoid NULL deref (Chaitanya Mishra)
  - iio: test: drop dangling symbol in gain-time-scale helpers (Randy Dunlap)
  - soundwire: intel_ace2x: add SND_HDA_CORE dependency (Arnd Bergmann)
  - dma: dma-axi-dmac: fix HW scatter-gather not looking at the queue (Nuno Sa)
  - dma: dma-axi-dmac: fix SW cyclic transfers (Nuno Sa)
  - dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX (AngeloGioacchino Del Regno)
  - interconnect: mediatek: Aggregate bandwidth with saturating add (Nicolas Frattaroli)
  - interconnect: mediatek: Don't hijack parent device (Nicolas Frattaroli)
  - clk: mediatek: Fix error handling in runtime PM setup (Xu Wang)
  - clk: qcom: gfx3d: add parent to parent request map (Dmitry Baryshkov)
  - clk: qcom: dispcc-sm7150: Fix dispcc_mdss_pclk1_clk_src (David Heidelberger)
  - clk: qcom: dispcc-sdm845: Enable parents for pixel clocks (Petr Hodina)
  - clk: Move clk_{save,restore}_context() to COMMON_CLK section (Geert Uytterhoeven)
  - clk: qcom: gcc-ipq5018: flag sleep clock as critical (George Moussalem)
  - clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc (Barnabás Czémán)
  - clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc (Barnabás Czémán)
  - clk: qcom: gcc-qdu1000: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
  - clk: qcom: gcc-x1e80100: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
  - clk: qcom: gcc-sdx75: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
  - clk: qcom: gcc-sm4450: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
  - clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
  - clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs (Martin Blumenstingl)
  - clk: qcom: rcg2: compute 2d using duty fraction directly (Taniya Das)
  - clk: qcom: gcc-sm8650: Use floor ops for SDCC RCGs (Vladimir Zapolskiy)
  - clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs (Vladimir Zapolskiy)
  - fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe() (Felix Gu)
  - fbdev: of_display_timing: Fix device node reference leak in of_get_display_timings() (Felix Gu)
  - tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros (Steven Rostedt)
  - tracing: Properly process error handling in event_hist_trigger_parse() (Miaoqian Lin)
  - fs/nfs: Fix readdir slow-start regression (Sagi Grimberg)
  - nvdimm: virtio_pmem: serialize flush requests (Li Chen)
  - scsi: csiostor: Fix dereference of null pointer rn (Colin Ian King)
  - scsi: ufs: host: mediatek: Require CONFIG_PM (Arnd Bergmann)
  - scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (Zilin Guan)
  - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia)
  - RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc (Liuyi)
  - power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer (Val Packett)
  - power: supply: pm8916_lbc: Fix use-after-free for extcon in IRQ handler (Waqar Hameed)
  - mtd: spinand: Fix kernel doc (Miquel Raynal)
  - mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions() (Weigang He)
  - cxl: Fix premature commit_end increment on decoder commit failure (Yuxiong Wang)
  - RDMA/core: add rdma_rw_max_sge() helper for SQ sizing (Chuck Lever)
  - RDMA/rxe: Fix race condition in QP timer handlers (Li Zhijian)
  - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Zilin Guan)
  - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (Liuyi)
  - NFS/localio: use GFP_NOIO and non-memreclaim workqueue in nfs_local_commit (Mike Snitzer)
  - nfs/localio: eliminate unnecessary kref in nfs_local_fsync_ctx (Mike Snitzer)
  - mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse() (Zilin Guan)
  - crypto: ccp - Send PSP_CMD_TEE_RING_DESTROY when PSP_CMD_TEE_RING_INIT fails (Mario Limonciello)
  - crypto: ccp - Factor out ring destroy handling to a helper (Mario Limonciello)
  - crypto: ccp - Add an S4 restore flow (Mario Limonciello)
  - crypto: ccp - Declare PSP dead if PSP_CMD_TEE_RING_INIT fails (Mario Limonciello)
  - platform/x86/amd/pmf: Prevent TEE errors after hibernate (Shyam Sundar S K)
  - vfio/pci: Lock upstream bridge for vfio_pci_core_disable() (Anthony Pighin)
  - mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper (Alok Tiwari)
  - IB/mlx5: Fix port speed query for representors (Or Har-Toov)
  - RDMA/mlx5: Fix UMR hang in LAG error state unload (Chiara Meiohas)
  - tools/power/x86/intel-speed-select: Fix file descriptor leak in isolate_cpus() (Malaya Kumar Rout)
  - RDMA/iwcm: Fix workqueue list corruption by removing work_list (Jacob Moroni)
  - RDMA/rxe: Fix double free in rxe_srq_from_init (Jiasheng Jiang)
  - RDMA/rtrs-srv: fix SG mapping (Roman Pen)
  - power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed() (Waqar Hameed)
  - power: supply: bq27xxx: fix wrong errno when bus ops are unsupported (Xu Wang)
  - power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write (Alexander Koskovich)
  - power: supply: sbs-battery: Fix use-after-free in power_supply_changed() (Waqar Hameed)
  - power: supply: rt9455: Fix use-after-free in power_supply_changed() (Waqar Hameed)
  - power: supply: pm8916_lbc: Fix use-after-free in power_supply_changed() (Waqar Hameed)
  - power: supply: pm8916_bms_vm: Fix use-after-free in power_supply_changed() (Waqar Hameed)
  - power: supply: goldfish: Fix use-after-free in power_supply_changed() (Waqar Hameed)
  - power: supply: cpcap-battery: Fix use-after-free in power_supply_changed() (Waqar Hameed)
  - power: supply: bq25980: Fix use-after-free in power_supply_changed() (Waqar Hameed)
  - power: supply: bq256xx: Fix use-after-free in power_supply_changed() (Waqar Hameed)
  - power: supply: act8945a: Fix use-after-free in power_supply_changed() (Waqar Hameed)
  - power: supply: ab8500: Fix use-after-free in power_supply_changed() (Waqar Hameed)
  - RDMA/hns: Notify ULP of remaining soft-WCs during reset (Chengchang Tang)
  - RDMA/hns: Fix RoCEv1 failure due to DSCP (Junxian Huang)
  - RDMA/hns: Fix WQ_MEM_RECLAIM warning (Chengchang Tang)
  - IB/cache: update gid cache on client reregister event (Etienne Aujames)
  - RDMA/rtrs: server: remove dead code (Lihonggang)
  - octeontx2-pf: Unregister devlink on probe failure (Hariprasad Kelam)
  - octeon_ep_vf: ensure dbell BADDR updation (Vimlesh Kumar)
  - octeon_ep: ensure dbell BADDR updation (Vimlesh Kumar)
  - octeon_ep: disable per ring interrupts (Vimlesh Kumar)
  - serial: caif: fix use-after-free in caif_serial ldisc_close() (Jiayuan Chen)
  - xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (Jiayuan Chen)
  - net: Switch to skb_dstref_steal/skb_dstref_restore for ip_route_input callers (Stanislav Fomichev)
  - net: Add skb_dstref_steal and skb_dstref_restore (Stanislav Fomichev)
  - net: sunhme: Fix sbus regression (René Rebe)
  - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (Jiayuan Chen) [Orabug: 39188476] {CVE-2026-31411}
  - smb: client: correct value for smbd_max_fragmented_recv_size (Stefan Metzmacher)
  - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (Jinliang Zheng)
  - net: hns3: fix double free issue for tx spare buffer (Jian Shen)
  - PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404] (Nicolas Cavallari)
  - netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (Pablo Neira Ayuso)
  - netfilter: nft_set_rbtree: fix bogus EEXIST with NLM_F_CREATE with null interval (Pablo Neira Ayuso)
  - netfilter: nft_counter: fix reset of counters on 32bit archs (Anders Grahn)
  - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal)
  - netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Florian Westphal)
  - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Scott Mitchell)
  - nfc: hci: shdlc: Stop timers and work before freeing context (Victoria Votokina)
  - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Eric Dumazet)
  - bonding: only set speed/duplex to unknown, if getting speed failed (Thomas Bogendoerfer)
  - mptcp: fix receive space timestamp initialization (Paolo Abeni)
  - of: unittest: fix possible null-pointer dereferences in of_unittest_property_copy() (Tuo Li)
  - ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit() (Ondrej Mosnacek)
  - ipc: don't audit capability check in ipc_permissions() (Ondrej Mosnacek)
  - selftests/mm: convert page_size to unsigned long (Siddarth G)
  - selftests/mm: pagemap_ioctl: Fix types mismatches shown by compiler options (Muhammad Usama Anjum)
  - PCI/ACPI: Restrict program_hpx_type2() to AER bits (Håkon Bugge)
  - PCI: Add defines for bridge window indexing (Ilpo Järvinen)
  - PCI: Initialize RCB from pci_configure_device() (Håkon Bugge)
  - wifi: ath10k: sdio: add missing lock protection in ath10k_sdio_fw_crashed_dump() (Ziyi Guo)
  - PCI: Check parent for NULL in of_pci_bus_release_domain_nr() (Sergey Shtylyov)
  - tcp: tcp_tx_timestamp() must look at the rtx queue (Eric Dumazet)
  - fat: avoid parent link count underflow in rmdir (Zhiyu Zhang)
  - nfsd: never defer requests during idmap lookup (Anthony Iliopoulos)
  - xdrgen: Initialize data pointer for zero-length items (Chuck Lever)
  - NFS: NFSERR_INVAL is not defined by NFSv2 (Chuck Lever)
  - xdrgen: Fix struct prefix for typedef types in program wrappers (Chuck Lever)
  - dm: use bio_clone_blkg_association (Mikulas Patocka)
  - iommu/vt-d: Clear Present bit before tearing down PASID entry (Lu Baolu)
  - iommu/vt-d: Avoid draining PRQ in sva mm release path (Lu Baolu)
  - iommu/vt-d: Drain PRQs when domain removed from RID (Lu Baolu)
  - iommu/vt-d: Separate page request queue from SVM (Joel Granados)
  - iommu/vt-d: Flush cache for PASID table before using it (Dmytro Maluka)
  - PCI: Mark 3ware-9650SA Root Port Extended Tags as broken (Jörg Wedekind)
  - kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup() (Petr Mladek)
  - module: add helper function for reading module_buildid() (Petr Mladek)
  - netfilter: nf_conncount: fix tracking of connections from localhost (Fernando Fernandez Mancera)
  - netfilter: nft_compat: add more restrictions on netlink attributes (Florian Westphal)
  - netfilter: nf_conncount: increase the connection clean up limit to 64 (Fernando Fernandez Mancera)
  - netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH (Fernando Fernandez Mancera)
  - netfilter: nf_tables: reset table validation state on abort (Florian Westphal)
  - wifi: cfg80211: stop NAN and P2P in cfg80211_leave (Miri Korenblit)
  - mctp i2c: initialise event handler read bytes (Matt Johnston)
  - net: mctp-i2c: fix duplicate reception of old data (Jian Zhang)
  - quota: fix livelock between quotactl and freeze_super (Abhishek Bapat)
  - dm: use READ_ONCE in dm_blk_report_zones (Mikulas Patocka)
  - dm: fix unlocked test for dm_suspended_md (Mikulas Patocka)
  - PCI/portdrv: Fix potential resource leak (Uwe Kleine-König)
  - PCI: Do not attempt to set ExtTag for VFs (Håkon Bugge)
  - Documentation: tracing: Add PCI tracepoint documentation (Shuai Xue)
  - Documentation: trace: Refactor toctree (Purva Yeshi)
  - docs: fix WARNING document not included in any toctree (Surajsonawane2415)
  - PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails (Hou Tao)
  - wifi: cfg80211: Fix use_for flag update on BSS refresh (Huang Chenming)
  - PCI/PM: Avoid redundant delays on D3hot->D3cold (Brian Norris)
  - Documentation: PCI: endpoint: Fix ntb/vntb copy & paste errors (Baruch Siach)
  - PCI: mediatek: Fix IRQ domain leak when MSI allocation fails (Xu Wang)
  - hwmon: (pmbus/mpq8785) fix VOUT_MODE mismatch during identification (Carl Lee)
  - hwmon: pmbus: mpq8785: Add support for MPM82504 (Pawel Dembicki)
  - hwmon: pmbus: mpq8785: Implement VOUT feedback resistor divider ratio configuration (Pawel Dembicki)
  - hwmon: pmbus: mpq8785: Prepare driver for multiple device support (Pawel Dembicki)
  - Revert "hwmon: (ibmpex) fix use-after-free in high/low store" (Guenter Roeck)
  - spi: tools: Add include folder to .gitignore (Francesco Lavra)
  - HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients (Ryan Lin)
  - platform/chrome: cros_ec_lightbar: Fix response size initialization (Tzung-Bi Shih)
  - drm/xe: Unregister drm device on probe error (Shuicheng Lin)
  - evm: Use ordered xattrs list to calculate HMAC in evm_init_hmac() (Roberto Sassu)
  - media: uvcvideo: Fix allocation for small frame sizes (Ricardo Ribalda)
  - platform/chrome: cros_typec_switch: Don't touch struct fwnode_handle::dev (Andy Shevchenko)
  - drm/buddy: release free_trees array on buddy mm teardown (Michał Grzelak)
  - drm/msm/a2xx: fix pixel shader start on A225 (Dmitry Baryshkov)
  - media: ccs: Accommodate C-PHY into the calculation (David Heidelberger)
  - drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x (Dmitry Baryshkov)
  - drm/msm/disp: set num_planes to 1 for interleaved YUV formats (Dmitry Baryshkov)
  - HID: playstation: Add missing check for input_ff_create_memless (Xu Wang)
  - regulator: core: move supply check earlier in set_machine_constraints() (André Draszik)
  - drm/msm/dpu: fix WD timer handling on DPU 8.x (Dmitry Baryshkov)
  - drm/msm/dpu: Set vsync source irrespective of mdp top support (Teguh Sobirin)
  - drm/msm/disp/dpu: add merge3d support for sc7280 (Mahadevan P)
  - drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init (Srinivasan Shanmugam)
  - drm/amdkfd: Fix signal_eviction_fence() bool return value (Srinivasan Shanmugam)
  - drm/amd: Drop "amdgpu kernel modesetting enabled" message (Mario Limonciello)
  - media: chips-media: wave5: Fix memory leak on codec_info allocation failure (Zilin Guan)
  - ASoC: nau8821: Fixup nau8821_enable_jack_detect() (Cristian Ciocaltea)
  - ASoC: nau8821: Avoid unnecessary blocking in IRQ handler (Cristian Ciocaltea)
  - ASoC: nau8821: Consistently clear interrupts before unmasking (Cristian Ciocaltea)
  - smack: /smack/doi: accept previously used values (Konstantin Andreev)
  - smack: /smack/doi must be > 0 (Konstantin Andreev)
  - drm/panthor: Evict groups before VM termination (Ketil Johnsen)
  - ALSA: vmaster: Relax __free() variable declarations (Takashi Iwai)
  - ALSA: pcm: Relax __free() variable declarations (Takashi Iwai)
  - ALSA: pcm: use new array-copying-wrapper (Chenyuan Yang)
  - drm/panel: sw43408: Remove manual invocation of unprepare at remove (David Heidelberger)
  - workqueue: Process rescuer work items one-by-one using a cursor (Lai Jiangshan)
  - workqueue: Only assign rescuer work when really needed (Lai Jiangshan)
  - workqueue: Factor out assign_rescuer_work() (Lai Jiangshan)
  - drm/panthor: Make sure we resume the tick when new jobs are submitted (Boris Brezillon)
  - drm/panthor: Fix the logic that decides when to stop ticking (Boris Brezillon)
  - drm/panthor: Fix immediate ticking on a disabled tick (Boris Brezillon)
  - drm/panthor: Fix the group priority rotation logic (Boris Brezillon)
  - drm/panthor: Fix the full_tick check (Boris Brezillon)
  - drm/panthor: Recover from panthor_gpu_flush_caches() failures (Boris Brezillon)
  - arm64: dts: qcom: sm6115: Add CX_MEM/DBGC GPU regions (Konrad Dybcio)
  - arm64: dts: qcom: agatti: Add CX_MEM/DBGC GPU regions (Konrad Dybcio)
  - arm64: dts: qcom: x1e: bus is 40-bits (fix 64GB models) (Jonathan Marek)
  - arm64: dts: qcom: sdm845-db845c: specify power for WiFi CH1 (Dmitry Baryshkov)
  - arm64: dts: qcom: sdm845-db845c: drop CS from SPIO0 (Dmitry Baryshkov)
  - arm64: dts: qcom: qrb4210-rb2: Fix UART3 wakeup IRQ storm (Dmitry Baryshkov)
  - arm64: dts: amlogic: g12: assign the MMC A signal clock (Jerome Brunet)
  - arm64: dts: amlogic: g12: assign the MMC B and C signal clocks (Jerome Brunet)
  - arm64: dts: amlogic: gx: assign the MMC signal clocks (Jerome Brunet)
  - arm64: dts: amlogic: axg: assign the MMC signal clocks (Jerome Brunet)
  - arm64: dts: amlogic: c3: assign the MMC signal clocks (Jerome Brunet)
  - hwspinlock: omap: Handle devm_pm_runtime_enable() errors (Xu Wang)
  - arm64: dts: ti: k3-j784s4-j742s2-main-common.dtsi: Refactor watchdog instances for j784s4 (Abhash Kumar Jha)
  - arm64: dts: ti: k3-j784s4-main.dtsi: Move c71_3 node to appropriate order (Abhash Kumar Jha)
  - arm64: dts: amlogic: s4: fix mmc clock assignment (Jerome Brunet)
  - arm64: dts: amlogic: s4: assign mmc b clock to 24MHz (Jerome Brunet)
  - arm64: dts: mediatek: mt8183-jacuzzi-pico6: Fix typo in pinmux node (AngeloGioacchino Del Regno)
  - arm: dts: lpc32xx: add clocks property to Motor Control PWM device tree node (Vladimir Zapolskiy)
  - ARM: dts: lpc32xx: Set motor PWM #pwm-cells property value to 3 cells (Vladimir Zapolskiy)
  - powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling (Narayana Murty N)
  - soc: mediatek: svs: Fix memory leak in svs_enable_debug_write() (Zilin Guan)
  - soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in cmd_db_dev_probe (Xu Wang)
  - powerpc/uaccess: Move barrier_nospec() out of allow_read_{from/write}_user() (Christophe Leroy)
  - ARM: dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property (Chen-Yu Tsai)
  - arm64: dts: qcom: msm8994-octagon: Fix Analog Devices vendor prefix of AD7147 (Vladimir Zapolskiy)
  - arm64: dts: qcom: x1e80100: Fix USB combo PHYs SS1 and SS2 ref clocks (Abel Vesa)
  - arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on (Casey Connolly)
  - arm64: dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on (Casey Connolly)
  - arm64: dts: qcom: sdm630: fix gpu_speed_bin size (Dmitry Baryshkov)
  - clk: qcom: Return correct error code in qcom_cc_probe_by_index() (Xu Wang)
  - arm64: dts: tqma8mpql-mba8mp-ras314: Fix HDMI CEC pad control settings (Alexander Stein)
  - arm64: dts: tqma8mpql-mba8mpxl: Fix HDMI CEC pad control settings (Alexander Stein)
  - firmware: arm_ffa: Correct 32-bit response handling in NOTIFICATION_INFO_GET (Sudeep Holla)
  - EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size() (Dan Carpenter)
  - EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size() (Dan Carpenter)
  - soc: qcom: smem: handle ENOMEM error during probe (Jorge Ramirez-Ortiz)
  - pstore/ram: fix buffer overflow in persistent_ram_save_old() (Pwnverse)
  - hwrng: core - use RCU and work_struct to fix race condition (Lianjie Wang)
  - hwrng: core - Allow runtime disabling of the HW RNG (Jonathan Mcdowell)
  - crypto: starfive - Fix memory leak in starfive_aes_aead_do_one_req() (Zilin Guan)
  - fs/tests: exec: drop duplicate bprm_stack_limits test vectors (Titouan Ameline de Cadeville)
  - sched/rt: Skip currently executing CPU in rto_next_cpu() (Chen Jinghuang)
  - sched/deadline: Clear the defer params (Joel Fernandes)
  - media: pci: mg4b: Use IRQF_NO_THREAD (Sebastian Andrzej Siewior)
  - mfd: wm8350-core: Use IRQF_ONESHOT (Sebastian Andrzej Siewior)
  - EDAC/altera: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
  - scsi: efct: Use IRQF_ONESHOT and default primary handler (Sebastian Andrzej Siewior)
  - Bluetooth: btintel_pcie: Use IRQF_ONESHOT and default primary handler (Sebastian Andrzej Siewior)
  - platform/x86: int0002: Remove IRQF_ONESHOT from request_irq() (Sebastian Andrzej Siewior)
  - genirq: Set IRQF_COND_ONESHOT in devm_request_irq(). (Sebastian Andrzej Siewior)
  - bpf: Fix bpf_xdp_store_bytes proto for read-only arg (Paul Chaignon)
  - crypto: caam - fix netdev memory leak in dpaa2_caam_probe (Jianpeng Chang)
  - crypto: hisilicon/trng - support tfms sharing the device (Weili Qian)
  - x86/fgraph,bpf: Switch kprobe_multi program stack unwind to hw_regs path (Jiri Olsa)
  - x86/fgraph,bpf: Fix stack ORC unwind from kprobe_multi return probe (Jiri Olsa)
  - tracing: Add ftrace_fill_perf_regs() for perf event (Masami Hiramatsu)
  - tracing: Add ftrace_partial_regs() for converting ftrace_regs to pt_regs (Masami Hiramatsu)
  - fgraph: Replace fgraph_ret_regs with ftrace_regs (Masami Hiramatsu)
  - ftrace: Rename ftrace_regs_return_value to ftrace_regs_get_return_value (Masami Hiramatsu)
  - ftrace: Use arch_ftrace_regs() for ftrace_regs_*() macros (Masami Hiramatsu)
  - ftrace: Consolidate ftrace_regs accessor functions for archs using pt_regs (Steven Rostedt)
  - ftrace: Make ftrace_regs abstract from direct use (Steven Rostedt)
  - tracing: Add a comment about ftrace_regs definition (Masami Hiramatsu)
  - bpf, sockmap: Fix FIONREAD for sockmap (Jiayuan Chen)
  - bpf, sockmap: Fix incorrect copied_seq calculation (Jiayuan Chen)
  - crypto: ccp - narrow scope of snp_range_list (Tycho Andersen)
  - crypto: ccp - Ensure implicit SEV/SNP init and shutdown in ioctls (Ashish Kalra)
  - hrtimer: Fix trace oddity (Thomas Gleixner)
  - selftests/bpf: Fix resource leak in serial_test_wq on attach failure (Kery Qi)
  - bpf: Preserve id of register in sync_linked_regs() (Puranjay Mohan)
  - crypto: hisilicon/sec2 - support skcipher/aead fallback for hardware queue unavailable (Qi Tao)
  - crypto: hisilicon/zip - adjust the way to obtain the req in the callback function (Chenghai Huang)
  - crypto: octeontx - fix dma_free_coherent() size (Thomas Fourier)
  - crypto: cavium - fix dma_free_coherent() size (Thomas Fourier)
  - ARM: VDSO: Patch out __vdso_clock_getres() if unavailable (Thomas Weißschuh)
  - libbpf: Fix OOB read in btf_dump_get_bitfield_value (Varun R Mallya)
  - selftests/bpf: veristat: fix printing order in output_stats() (Puranjay Mohan)
  - crypto: qat - fix warning on adf_pfvf_pf_proto.c (Giovanni Cabiddu)
  - perf/x86/core: Do not set bit width for unavailable counters (Sandipan Das)
  - s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (Salah Triki)
  - PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races (Gui-Dong Han)
  - cpufreq: intel_pstate: Enable asym capacity only when CPU SMT is not possible (Yaxiong Tian)
  - perf: arm_spe: Properly set hw.state on failures (Leo Yan)
  - PM: wakeup: Handle empty list in wakeup_sources_walk_start() (Sam Wu)
  - md/raid1: fix memory leak in raid1_run() (Zilin Guan)
  - md/raid1: fix memory leak in raid1_run() if no active rdev (Zheng Qixing)
  - Partial revert "x86/xen: fix balloon target initialization for PVH dom0" (Roger Pau Monné)
  - ublk: Validate SQE128 flag before accessing the cmd (Govindarajulu Varadarajan)
  - thermal/of: Fix reference leak in thermal_of_cm_lookup() (Felix Gu)
  - iomap: fix submission side handling of completion side errors (Christoph Hellwig)
  - cpufreq: scmi: Fix device_node reference leak in scmi_cpu_domain_id() (Felix Gu)
  - OPP: Return correct value in dev_pm_opp_get_level (Aleks Todorov)
  - md/raid10: fix any_working flag handling in raid10_sync_request (Li Nan)
  - md/raid5: fix raid5_run() to return error when log_init() fails (Yu Kuai)
  - thermal: intel: x86_pkg_temp_thermal: Handle invalid temperature (Rafael J. Wysocki)
  - cpuidle: governors: menu: Always check timers with tick stopped (Rafael J. Wysocki)
  - io_uring/sync: validate passed in offset (Jens Axboe)
  - ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() (Alexey Simakov)
  - io_uring: use release-acquire ordering for IORING_SETUP_R_DISABLED (Caleb Sander)
  - xen/virtio: Don't use grant-dma-ops when running as Dom0 (Teddy Astie)
  - rnbd-srv: Fix server side setting of bi_size for special IOs (Florian-Ewald Mueller)
  - rnbd-srv: use bio_add_virt_nofail (Christoph Hellwig)
  - block: add a bio_add_virt_nofail helper (Christoph Hellwig)
  - smb: client: fix potential UAF and double free in smb2_open_file() (Paulo Alcantara)
  - btrfs: fix block_group_tree dirty_list corruption (Boris Burkov)
  - btrfs: qgroup: return correct error when deleting qgroup relation item (Filipe Manana)
  - erofs: handle end of filesystem properly for file-backed mounts (Gao Xiang)
  - erofs: get rid of raw bi_end_io() usage (Gao Xiang)
  - tpm: st33zp24: Fix missing cleanup on get_burstcount() error (Alper Ak)
  - tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure (Alper Ak)
  - i3c: dw: Fix memory leak in dw_i3c_master_i2c_xfers() (Zilin Guan)
  - i3c: dw: Initialize spinlock to avoid upsetting lockdep (Fredrik Markstrom)
  - gfs2: Fix use-after-free in iomap inline data write path (Deepanshu Kartikey)
  - gfs2: Fix slab-use-after-free in qd_put (Andreas Gruenbacher)
  - gfs2: Retries missing in gfs2_{rename,exchange} (Andreas Gruenbacher)
  - i3c: master: Update hot-join flag only on success (Adrian Hunter)
  - fs: add <linux/init_task.h> for 'init_fs' (Ben Dooks)
  - i3c: Move device name assignment after i3c_bus_init (Billy Tsai)
  - audit: move the compat_xxx_class[] extern declarations to audit_arch.h (Ben Dooks)
  - rcu: Fix rcu_read_unlock() deadloop due to softirq (Yao Kai)
  - rcu: Remove local_irq_save/restore() in rcu_preempt_deferred_qs_handler() (Zqiang)
  - rcu: Refactor expedited handling check in rcu_read_unlock_special() (Joel Fernandes)
  - hfsplus: return error when node already exists in hfs_bnode_create (Shardul Bankar)
  - auxdisplay: arm-charlcd: fix release_mem_region() size (Thomas Fourier)
  - RDMA/umad: Reject negative data_len in ib_umad_write (Yunje Shin) [Orabug: 39103108] {CVE-2026-23243}
  - RDMA/siw: Fix potential NULL pointer dereference in header processing (Yunje Shin)


author: Sherry Yang <sherry.yang@oracle.com> [6.12.0-202.76.2.el10uek]
changelog:
  - ipv6: use RCU in ip6_xmit() (Eric Dumazet)  [Orabug: 38649060]  {CVE-2025-40135}
  - dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (Eric Dumazet)  [Orabug: 38887740]  {CVE-2026-23004}
  - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled (Fernando Fernandez Mancera)  [Orabug: 39029337]
  - io_uring/kbuf: check if target buffer list is still legacy on recycle (Jens Axboe)  [Orabug: 39144150]
  - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Breno Leitao)  [Orabug: 39166116]
  - spi: tegra210-quad: Check hardware status on timeout (Vishwaroop A)  [Orabug: 39166116]
  - spi: tegra210-quad: Refactor error handling into helper functions (Vishwaroop A)  [Orabug: 39166116]
  - spi: tegra210-quad: Add support for internal DMA (Vishwaroop A)  [Orabug: 39166116]
  - spi: tegra210-quad: Update dummy sequence configuration (Vishwaroop A)  [Orabug: 39166116]
  - iommufd/device: Add helper to detect the first attach of a group (Yi Liu)  [Orabug: 39166116]
  - iommufd/device: Replace idev->igroup with local variable (Yi Liu)  [Orabug: 39166116]
  - iommufd/device: Only add reserved_iova in non-pasid path (Yi Liu)  [Orabug: 39166116]
  - iommufd: Pass @pasid through the device attach/replace path (Yi Liu)  [Orabug: 39166116]
  - iommu: Drop iommu_group_replace_domain() (Yi Liu)  [Orabug: 39166116]
  - arm64: contpte: fix set_access_flags() no-op check for SMMU/ATS faults (Piotr Jaroszynski)  [Orabug: 39166116]


author: Sherry Yang <sherry.yang@oracle.com> [6.12.0-202.76.3.el10uek]
changelog:
  - x86/CPU: Fix FPDSS on Zen1 (Borislav Petkov (AMD))  [Orabug: 39276931]
  - uek-rpm: CONFIG_INTEL_IOMMU_SCALABLE_MODE_DEFAULT_ON should be set (Dave Kleikamp)  [Orabug: 39276921]
  - Revert "rds: Drop rds conn in connect worker if not in down state." (Vijayendra Suman)  [Orabug: 39276912]


author: Sherry Yang <sherry.yang@oracle.com> [6.12.0-202.76.4.el10uek]
changelog:
  - uek-rpm: Enable FWCTL modules for aarch64 (Dave Kleikamp)  [Orabug: 39292218]
  - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu)  [Orabug: 39291972]
  - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu)  [Orabug: 39291972]
  - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu)  [Orabug: 39291972]
  - crypto: authenc - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39291972]
  - crypto: algif_aead - snapshot IV for async AEAD requests (Douya Le)  [Orabug: 39291972]
  - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu)  [Orabug: 39291972]  {CVE-2026-31431}
  - crypto: algif_aead - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39291972]
  - crypto: scatterwalk - Backport memcpy_sglist() (Eric Biggers)  [Orabug: 39291972]


author: Samasth Norway Ananda <samasth.norway.ananda@oracle.com> [6.12.0-202.76.4.1.el10uek]
changelog:
  - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Hyunwoo Kim)  [Orabug: 39344513]  {CVE-2026-43500} 
  - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (David Howells)  [Orabug: 39344513]  
  - rxrpc: only handle RESPONSE during service challenge (Wang Jie)  [Orabug: 39344513]  
  - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (David Howells)  [Orabug: 39344513]  
  - rxrpc: Fix potential UAF after skb_unshare() failure (David Howells)  [Orabug: 39344513]  
  - rxrpc: Fix re-decryption of RESPONSE packets (David Howells)  [Orabug: 39344513]  
  - xfrm: esp: avoid in-place decrypt on shared skb frags (Kuan-Ting Chen)  [Orabug: 39344513]  {CVE-2026-43284} 
  - x86/CPU/AMD: Add a fix for AMD-SB-7052 (Prathyushi Nangia)  [Orabug: 39344560]  {CVE-2025-54518}


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-200.74.26.el10uek]
changelog:
  - pds_core: init viftype default in declaration (Shannon Nelson) [Orabug: 38467343]
  - pds_core: smaller adminq poll starting interval (Shannon Nelson) [Orabug: 38467343]
  - pds_core: Allocate pdsc_viftype_defaults copy with ARRAY_SIZE() (Kees Cook) [Orabug: 38467343]
  - pds_fwctl: Fix type and endian complaints (Shannon Nelson) [Orabug: 38467343]
  - x86/kexec: add a sanity check on previous kernel's ima kexec buffer (Harshit Mogalapalli) [Orabug: 38608974]
  - of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() (Harshit Mogalapalli) [Orabug: 38608974]
  - ima: verify the previous kernel's IMA buffer lies in addressable RAM (Harshit Mogalapalli) [Orabug: 38608974] {CVE-2026-43129}
  - rds: Add state field to RDS trace logs. (Rohit Nair) [Orabug: 38870356]
  - uek-rpm: set default kfence sampling interval to 0 (Imran Khan) [Orabug: 38913539]
  - Revert "NFS: Avoid changing nlink when file removes and attribute updates race" (Samasth Norway Ananda) [Orabug: 38925844]
  - crypto_user: use FIPS algorithm list when FIPS module is enabled (Saeed Mirzamohammadi) [Orabug: 38934207]
  - uek-rpm: update kABI for FIPS regarding crypto_user (Saeed Mirzamohammadi) [Orabug: 38934207]
  - fips: remove crypto_user from the FIPS module (Saeed Mirzamohammadi) [Orabug: 38934207]
  - alloc_tag: prevent enabling memory profiling if it was shut down (Suren Baghdasaryan) [Orabug: 38945943]
  - alloc_tag: avoid current->alloc_tag manipulations when profiling is disabled (Suren Baghdasaryan) [Orabug: 38945943]
  - mm/codetag: fix arg in pgalloc_tag_copy alloc_tag_sub (Sourav Panda) [Orabug: 38945943]
  - uek-rpm: fips: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38949665]
  - selftests/mm: skip pkey_sighandler_tests if support is missing (Harshit Mogalapalli) [Orabug: 38969139]
  - selftests/mm: rename pkey register macro (Harshit Mogalapalli) [Orabug: 38969139]
  - selftests/mm: use sys_pkey helpers consistently (Harshit Mogalapalli) [Orabug: 38969139]
  - selftests/mm: ensure non-global pkey symbols are marked static (Harshit Mogalapalli) [Orabug: 38969139]
  - selftests/mm: remove empty pkey helper definition (Harshit Mogalapalli) [Orabug: 38969139]
  - selftests/mm: ensure pkey-*.h define inline functions only (Harshit Mogalapalli) [Orabug: 38969139]
  - selftests/mm: define types using typedef in pkey-helpers.h (Harshit Mogalapalli) [Orabug: 38969139]
  - selftests/mm: remove unused pkey helpers (Harshit Mogalapalli) [Orabug: 38969139]
  - selftests/mm: fix -Warray-bounds warnings in pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
  - selftests/mm: Define PKEY_UNRESTRICTED for pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
  - selftests/mm: Use generic pkey register manipulation (Harshit Mogalapalli) [Orabug: 38969139]
  - ionic: Rate limit unknown xcvr type messages (Eric Joyner) [Orabug: 38977643]
  - Octeontx2-af: Add proper checks for fwdata (Hariprasad Kelam) [Orabug: 38988497]
  - genirq/cpuhotplug: Notify about affinity changes breaking the affinity mask (Imran Khan) [Orabug: 39001909]
  - LTS version: v6.12.74 (Jack Vogel)
  - USB: serial: option: add Telit FN920C04 RNDIS compositions (Fabio Porcedda)
  - f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes (Yongpeng Yang)
  - f2fs: fix to avoid UAF in f2fs_write_end_io() (Chao Yu)
  - iommu/arm-smmu-qcom: do not register driver in probe() (Danilo Krummrich)
  - f2fs: fix to avoid mapping wrong physical block for swapfile (Chao Yu)
  - f2fs: fix out-of-bounds access in sysfs attribute read/write (Yongpeng Yang)
  - f2fs: fix to check sysfs filename w/ gc_pin_file_thresh correctly (Chao Yu)
  - f2fs: fix to add gc count stat in f2fs_gc_range (Zhiguo Niu)
  - fbdev: smscufx: properly copy ioctl memory to kernelspace (Greg Kroah-Hartman)
  - fbdev: rivafb: fix divide error in nv3_arb() (Guangshuo Li) [Orabug: 39103202] {CVE-2026-23266}
  - cpuset: Fix missing adaptation for cpuset_is_populated (Chen Ridong)
  - Revert "wireguard: device: enable threaded NAPI" (Daniel Borkmann)
  - LoongArch: Rework KASAN initialization for PTW-enabled systems (Tiezhu Yang)
  - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (David Hildenbrand)
  - mm/hugetlb: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
  - mm/hugetlb: fix hugetlb_pmd_shared() (David Hildenbrand) [Orabug: 38931087] {CVE-2026-23100}
  - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Jane Chu)
  - gpiolib: acpi: Fix gpio count with string references (Alban Bedel)
  - ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
  - drm/amd/display: remove assert around dpp_base replacement (Melissa Wen)
  - drm/amd/display: extend delta clamping logic to CM3 LUT helper (Melissa Wen)
  - tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow (Deepanshu Kartikey) [Orabug: 39131086] {CVE-2026-23390}
  - ASoC: cs42l43: Correct handling of 3-pole jack load detection (Charles Keepax)
  - platform/x86: panasonic-laptop: Fix sysfs group leak in error path (Rafael J. Wysocki)
  - platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro (Gongqi)
  - ALSA: hda/realtek: Enable headset mic for Acer Nitro 5 (Breno Baptista)
  - ASoC: amd: yc: Add quirk for HP 200 G2a 16 (Dirk Su)
  - ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 (Tagir Garaev)
  - platform/x86: classmate-laptop: Add missing NULL pointer checks (Rafael J. Wysocki) [Orabug: 39044501] {CVE-2026-23237}
  - drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used (Brahmajit Das)
  - romfs: check sb_set_blocksize() return value (Deepanshu Kartikey)
  - ALSA: hda/realtek - fixed speaker no sound (Kailang Yang)
  - ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel (Ricardo Rivera-Matos)
  - ALSA: hda/realtek: Add quirk for Inspur S14-G1 (Zhang Heng)
  - gpio: sprd: Change sprd_gpio lock to raw_spin_lock (Xuewen Yan)
  - ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list (Anatolii Shirykalov)
  - ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
  - bus: fsl-mc: fix use-after-free in driver_override_show() (Gui-Dong Han)
  - bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions (Chelsy Ratnawat)
  - bnxt_en: hide CONFIG_DETECT_HUNG_TASK specific code (Arnd Bergmann)
  - bnxt_en: Change FW message timeout warning (Michael Chan)
  - scsi: qla2xxx: Fix bsg_done() causing double free (Anil Gurumurthy) [Orabug: 39044457] {CVE-2025-71238}
  - LTS version: v6.12.73 (Jack Vogel)
  - Revert "driver core: enforce device_lock for driver_match_device()" (Greg Kroah-Hartman)
  - LTS version: v6.12.72 (Jack Vogel)
  - gpio: omap: do not register driver in probe() (Danilo Krummrich)
  - wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add (Ali Tariq) [Orabug: 38997990] {CVE-2025-71234}
  - PCI: endpoint: Avoid creating sub-groups asynchronously (Liu Song)
  - xfs: fix UAF in xchk_btree_check_block_owner (Darrick J. Wong) [Orabug: 38998028] {CVE-2026-23223}
  - erofs: fix UAF issue for file-backed mounts w/ directio option (Chao Yu)
  - mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (Eric Dumazet)
  - bus: mhi: host: pci_generic: Add Telit FE990B40 modem support (Daniele Palmas)
  - scsi: qla2xxx: Query FW again before proceeding with login (Anil Gurumurthy)
  - scsi: qla2xxx: Free sp in error path to fix system crash (Anil Gurumurthy) [Orabug: 38997979] {CVE-2025-71232}
  - scsi: qla2xxx: Delay module unload while fabric scan in progress (Anil Gurumurthy) [Orabug: 38997992] {CVE-2025-71235}
  - scsi: qla2xxx: Allow recovery for tape devices (Shreyas Deodhar)
  - scsi: qla2xxx: Validate sp before freeing associated memory (Anil Gurumurthy) [Orabug: 38997998] {CVE-2025-71236}
  - wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() (Bitterblue Smith) [Orabug: 38997972] {CVE-2025-71229}
  - nilfs2: Fix potential block overflow that cause system hang (Edward Adam Davis)
  - crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req (Bibo Mao)
  - crypto: virtio - Add spinlock protection with virtqueue notification (Bibo Mao) [Orabug: 38998052] {CVE-2026-23229}
  - crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly (Kees Cook)
  - crypto: octeontx - Fix length check to avoid truncation in ucode_load_store (Thorsten Blum)
  - crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (Thorsten Blum) [Orabug: 38997976] {CVE-2025-71231}
  - Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB (Zenm Chen)
  - driver core: enforce device_lock for driver_match_device() (Gui-Dong Han)
  - smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() (Henrique Carvalho)
  - ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths (Namjae Jeon)
  - smb: client: split cached_fid bitfields to avoid shared-byte RMW races (Henrique Carvalho) [Orabug: 38998059] {CVE-2026-23230}
  - LTS version: v6.12.71 (Jack Vogel)
  - vsock/test: verify socket options after setting them (Konstantin Shkolnyy)
  - io_uring/rw: recycle buffers manually for non-mshot reads (Jens Axboe)
  - LTS version: v6.12.70 (Jack Vogel)
  - gpiolib-acpi: Update file references in the Documentation and MAINTAINERS (Andy Shevchenko)
  - ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU. (Werner Sembach)
  - spi: tegra114: Preserve SPI mode bits in def_command1_reg (Vishwaroop A)
  - spi: tegra: Fix a memory leak in tegra_slink_probe() (Felix Gu)
  - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Breno Leitao)
  - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Breno Leitao) [Orabug: 38970593] {CVE-2026-23202}
  - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Breno Leitao)
  - spi: tegra210-quad: Move curr_xfer read inside spinlock (Breno Leitao)
  - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Breno Leitao)
  - ASoC: amd: fix memory leak in acp3x pdm dma ops (Chris Bainbridge) [Orabug: 38970441] {CVE-2026-23190}
  - ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update() (Sergey Shtylyov)
  - ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF (Shigeru Yoshida) [Orabug: 38970598] {CVE-2026-23200}
  - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano) [Orabug: 38970170] {CVE-2026-23111}
  - hwmon: (occ) Mark occ_init_attribute() as __printf (Arnd Bergmann)
  - drm/xe/pm: Disable D3Cold for BMG only on specific platforms (Karthik Poosa)
  - drm/xe/pm: Also avoid missing outer rpm warning on system suspend (Rodrigo Vivi)
  - drm/xe/query: Fix topology query pointer advance (Shuicheng Lin)
  - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jacob Keller)
  - net: gro: fix outer network offset (Paolo Abeni) [Orabug: 39103144] {CVE-2026-23254}
  - net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi() (Chen Ni)
  - drm/amd/display: fix wrong color value mapping on MCM shaper LUT (Melissa Wen)
  - tipc: use kfree_sensitive() for session key material (Daniel Hodges)
  - net: don't touch dev->stats in BPF redirect paths (Jakub Kicinski)
  - net: usb: r8152: fix resume reset deadlock (Sergey Senozhatsky) [Orabug: 38970438] {CVE-2026-23188}
  - macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet) [Orabug: 38970508] {CVE-2026-23209}
  - net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module (Marek Behún)
  - net: sfp: convert sfp quirks to modify struct sfp_module_support (Russell King)
  - net: sfp: pre-parse the module support (Russell King)
  - net: phy: add phy_interface_copy() (Russell King)
  - net: phy: add phy_interface_weight() (Russell King)
  - dpaa2-switch: add bounds check for if_id in IRQ handler (Junrui Luo)
  - net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup (Zilin Guan)
  - net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup (Zilin Guan)
  - net: liquidio: Initialize netdev pointer before queue setup (Zilin Guan)
  - dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (Junrui Luo)
  - net/sched: cls_u32: use skb_header_pointer_careful() (Eric Dumazet) [Orabug: 38970487] {CVE-2026-23204}
  - net: add skb_header_pointer_careful() helper (Eric Dumazet)
  - smb/client: fix memory leak in smb2_open_file() (Chenxiaosong) [Orabug: 38970578] {CVE-2026-23205}
  - platform/x86/intel/tpmi/plr: Make the file domain<n>/status writeable (Ricardo Neri)
  - platform/x86: hp-bioscfg: Skip empty attribute names (Mario Limonciello)
  - platform/x86: intel_telemetry: Fix PSS event register mask (Kaushlendra Kumar)
  - platform/x86: toshiba_haps: Fix memory leaks in add/remove routines (Rafael J. Wysocki)
  - ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio (Martin Hamilton)
  - btrfs: reject new transactions if the fs is fully read-only (Qu Wenruo) [Orabug: 38985156] {CVE-2026-23214}
  - wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice (Miri Korenblit)
  - wifi: mac80211: correctly check if CSA is active (Miri Korenblit)
  - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi) [Orabug: 38985169] {CVE-2026-23216}
  - ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
  - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi) [Orabug: 38970453] {CVE-2026-23193}
  - wifi: cfg80211: Fix bitrate calculation overflow for HE rates (Veerendranath Jakkam)
  - regmap: maple: free entry on mas_store_gfp() failure (Kaushlendra Kumar) [Orabug: 39103173] {CVE-2026-23260}
  - spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization (Devyn Liu)
  - ASoC: tlv320adcx140: Propagate error codes during probe (Dimitrios Katsaros)
  - ASoC: amd: yc: Fix microphone on ASUS M6500RE (Radhi Bajahaw)
  - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (Hannes Reinecke) [Orabug: 38970416] {CVE-2026-23179}
  - nvme-fc: release admin tagset if init fails (Chaitanya Kulkarni) [Orabug: 39103180] {CVE-2026-23261}
  - ASoC: simple-card-utils: Check device node before overwrite direction (Shengjiu Wang)
  - ASoC: davinci-evm: Fix reference leak in davinci_evm_probe (Kery Qi)
  - wifi: mac80211: collect station statistics earlier when disconnect (Baochen Qiang)
  - HID: logitech: add HID++ support for Logitech MX Anywhere 3S (Dennis Marttinen)
  - ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free (Ma Wupeng)
  - drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (Perry Yuan) [Orabug: 38985149] {CVE-2026-23213}
  - HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) (Rodrigo Lugathe Da Conceição Alves)
  - HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() (Kwok Kin Ming) [Orabug: 38970413] {CVE-2026-23178}
  - HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list (Chris Chiu)
  - netfilter: replace -EEXIST with -EBUSY (Daniel Gomez)
  - PCI: qcom: Remove ASPM L0s support for MSM8996 SoC (Manivannan Sadhasivam)
  - ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk (Ruslan Krupitsa)
  - ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55 (Matouš Lánský)
  - HID: playstation: Center initial joystick axes to prevent spurious events (Siarhei Vishniakou)
  - HID: intel-ish-hid: Reset enum_devices_done before enumeration (Zhang Lixu)
  - riscv: Sanitize syscall table indexing under speculation (Lukas Gerlach)
  - btrfs: fix reservation leak in some error paths when inserting inline extent (Filipe Manana) [Orabug: 39103081] {CVE-2025-71268}
  - HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL (Daytoncl)
  - HID: intel-ish-hid: Update ishtp bus match to support device ID table (Zhang Lixu)
  - smb/server: fix refcount leak in parse_durable_handle_context() (Zhangguodong)
  - LoongArch: Enable exception fixup for specific ADE subcode (Duan Chenghao)
  - smb/server: fix refcount leak in smb2_open() (Zhangguodong)
  - md: suspend array while updating raid_disks via sysfs (Danny Shih) [Orabug: 38985108] {CVE-2025-71225}
  - LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED (Huacai Chen)
  - smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() (Zhangguodong)
  - block,bfq: fix aux stat accumulation destination (Shechenglong)
  - net: usb: sr9700: support devices with virtual driver CD (Ethan Nelson-Moore)
  - wifi: wlcore: ensure skb headroom before skb_push (Peter Astrand) [Orabug: 38970152] {CVE-2025-71222}
  - wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (Moon Hee Lee) [Orabug: 38970163] {CVE-2025-71224}
  - tracing: Fix ftrace event field alignments (Steven Rostedt)
  - procfs: avoid fetching build ID while holding VMA lock (Andrii Nakryiko) [Orabug: 38970476] {CVE-2026-23199}
  - KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures (Zhiquan Li)
  - binderfs: fix ida_alloc_max() upper bound (Carlos Llamas)
  - binder: fix BR_FROZEN_REPLY error log (Carlos Llamas)
  - hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Kang Chen)
  - ublk: fix deadlock when reading partition table (Ming Lei)
  - tools/power turbostat: fix GCC9 build regression (Todd Brandt)
  - PCI/ERR: Ensure error recoverability at all times (Lukas Wunner)
  - KVM: Don't clobber irqfd routing type when deassigning irqfd (Sean Christopherson) [Orabug: 38970465] {CVE-2026-23198}
  - Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" (Bert Karwatzki) [Orabug: 39103191] {CVE-2026-23264}
  - mm, shmem: prevent infinite loop on truncate race (Kairui Song) [Orabug: 38970409] {CVE-2026-23177}
  - gve: Correct ethtool rx_dropped calculation (Max Yuan)
  - gve: Fix stats report corruption on queue count change (Debarghya Kundu) [Orabug: 39103187] {CVE-2026-23262}
  - ceph: fix oops due to invalid pointer for kfree() in parse_longname() (Daniel Vogelbacher) [Orabug: 38970590] {CVE-2026-23201}
  - ARM: 9468/1: fix memset64() on big-endian (Thomas Weißschuh)
  - rbd: check for EOD after exclusive lock is ensured to be held (Ilya Dryomov)
  - ceph: fix NULL pointer dereference in ceph_mds_auth_match() (Viacheslav Dubeyko) [Orabug: 38970595] {CVE-2026-23189}
  - mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single (Hao Ge) [Orabug: 38985192] {CVE-2026-23219}
  - pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc->domains (Xu Yang)
  - pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup (Xu Yang)
  - pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset (Jacky Bai)
  - pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup (Xu Yang)
  - pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state (Gabor Juhos)
  - ALSA: aloop: Fix racy access at PCM trigger (Takashi Iwai) [Orabug: 38970445] {CVE-2026-23191}
  - platform/x86: intel_telemetry: Fix swapped arrays in PSS output (Kaushlendra Kumar)
  - x86/kfence: fix booting on 32bit non-PAE systems (Andrew Cooper)
  - x86/vmware: Fix hypercall clobbers (Josh Poimboeuf) [Orabug: 38985163] {CVE-2026-23215}
  - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (Yunje Shin) [Orabug: 38970176] {CVE-2026-23112}
  - LTS version: v6.12.69 (Jack Vogel)
  - bpf/selftests: test_select_reuseport_kern: Remove unused header (Alexis Lothoré)
  - RDMA/mana_ib: Handle net event for pointing to the current netdev (Long Li)
  - net: mana: Change the function signature of mana_get_primary_netdev_rcu (Long Li)
  - pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver (Bartosz Golaszewski)
  - drm/amdgpu/gfx11: adjust KGQ reset sequence (Alex Deucher)
  - writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 (Laveesh Bansal)
  - perf: sched: Fix perf crash with new is_user_task() helper (Steven Rostedt) [Orabug: 38970581] {CVE-2026-23159}
  - perf: Simplify get_perf_callchain() user logic (Josh Poimboeuf)
  - mptcp: avoid dup SUB_CLOSED events after disconnect (Matthieu Baerts)
  - pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins (Krzysztof Kozlowski)
  - net/sched: act_ife: convert comma to semicolon (Chen Ni)
  - btrfs: prevent use-after-free on folio private data in btrfs_subpage_clear_uptodate() (Jp Kobryn)
  - Revert "drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)" (John Ogness)
  - wifi: ath11k: add srng->lock for ath11k_hal_srng_* in monitor mode (Kang Yang) [Orabug: 37844126] {CVE-2024-58096}
  - mm/kfence: randomize the freelist on initialization (Pimyn Girgis)
  - libbpf: Fix -Wdiscarded-qualifiers under C23 (Mikhail Gavrilov)
  - ksmbd: smbd: fix dma_unmap_sg() nents (Thomas Fourier)
  - rxrpc: Fix data-race warning and potential load/store tearing (David Howells)
  - cgroup: Fix kernfs_node UAF in css_free_rwork_fn (T.J. Mercier)
  - rust: kbuild: support `-Cjump-tables=n` for Rust 1.93.0 (Miguel Ojeda)
  - gpiolib: acpi: Fix potential out-of-boundary left shift (Andy Shevchenko)
  - drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule() (Alex Deucher)
  - drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (Jon Doron) [Orabug: 38970348] {CVE-2026-23163}
  - drm/amdgpu/gfx12: fix wptr reset in KGQ init (Alex Deucher)
  - drm/amdgpu/gfx11: fix wptr reset in KGQ init (Alex Deucher)
  - drm/amdgpu/gfx10: fix wptr reset in KGQ init (Alex Deucher)
  - drm/amdgpu/soc21: fix xclk for APUs (Alex Deucher)
  - drm/imx/tve: fix probe device leak (Johan Hovold)
  - drm/msm/a6xx: fix bogus hwcg register updates (Johan Hovold)
  - scripts: generate_rust_analyzer: Add compiler_builtins -> core dep (Tamir Duberstein)
  - scripts: generate_rust_analyzer: compile sysroot with correct edition (Tamir Duberstein)
  - scripts: generate_rust_analyzer: remove sysroot assertion (Onur Özkan)
  - net: fix segmentation of forwarding fraglist GRO (Jibin Zhang) [Orabug: 38970318] {CVE-2026-23154}
  - mm/shmem, swap: fix race of truncate and swap entry split (Kairui Song) [Orabug: 38970345] {CVE-2026-23161}
  - flex_proportions: make fprop_new_period() hardirq safe (Jan Kara) [Orabug: 38970373] {CVE-2026-23168}
  - selftests: mptcp: join: fix local endp not being tracked (Matthieu Baerts)
  - selftests: mptcp: check subflow errors in close events (Matthieu Baerts)
  - selftests: mptcp: check no dup close events after error (Matthieu Baerts)
  - mptcp: only reset subflow errors when propagated (Matthieu Baerts)
  - gpio: rockchip: Stop calling pinctrl for set_direction (Robin Murphy)
  - nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference (Ming Lei) [Orabug: 38970608] {CVE-2026-23148}
  - efivarfs: fix error propagation in efivar_entry_get() (Kohei Enju) [Orabug: 38970325] {CVE-2026-23156}
  - scsi: qla2xxx: edif: Fix dma_free_coherent() size (Thomas Fourier)
  - gpio: pca953x: mask interrupts in irq shutdown (Martin Larsson)
  - ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO (Zhang Heng)
  - scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() (Haoxiang Li)
  - ASoC: fsl: imx-card: Do not force slot width to sample width (Fabio Estevam)
  - rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target (Miguel Ojeda)
  - rust: rbtree: fix documentation typo in CursorMut peek_next method (Hang Shu)
  - riscv: compat: fix COMPAT_UTS_MACHINE definition (Han Gao)
  - pinctrl: meson: mark the GPIO controller as sleeping (Bartosz Golaszewski)
  - sched/deadline: Fix 'stuck' dl_server (Peter Zijlstra)
  - sched/deadline: Document dl_server (Peter Zijlstra)
  - dma/pool: distinguish between missing and exhausted atomic pools (Sai Sree Kartheek Adivi)
  - bcache: fix I/O accounting leak in detached_dev_do_request (Shida Zhang)
  - bcache: use bio cloning for detached device requests (Shida Zhang)
  - bcache: fix improper use of bi_end_io (Shida Zhang)
  - gpio: virtuser: fix UAF in configfs release path (Yuhao Huang)
  - gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler (Denis Sergeev)
  - ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion (Tagir Garaev)
  - scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() (Kery Qi)
  - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Jianbo Liu)
  - net/mlx5: Fix vhca_id access call trace use before alloc (Parav Pandit)
  - net/mlx5: Initialize events outside devlink lock (Cosmin Ratiu)
  - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Shay Drory)
  - net: phy: micrel: fix clk warning when removing the driver (Wei Fang)
  - net: bridge: fix static key check (Martin Kaiser)
  - nfc: nci: Fix race between rfkill and nci_unregister_device(). (Kuniyuki Iwashima)
  - net/mlx5e: TC, delete flows only for existing peers (Mark Bloch) [Orabug: 38970397] {CVE-2026-23173}
  - ice: stop counting UDP csum mismatch as rx_errors (Jesse Brandeburg)
  - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Aaron Ma) [Orabug: 38970364] {CVE-2026-23166}
  - nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). (Kuniyuki Iwashima)
  - rocker: fix memory leak in rocker_world_port_post_fini() (Kery Qi) [Orabug: 38970351] {CVE-2026-23164}
  - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Kery Qi)
  - ipv6: use the right ifindex when replying to icmpv6 from localhost (Fernando Fernandez Mancera)
  - net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() (Zilin Guan)
  - bonding: annotate data-races around slave->last_rx (Eric Dumazet) [Orabug: 38985142] {CVE-2026-23212}
  - octeon_ep: Fix memory leak in octep_device_setup() (Zilin Guan)
  - net: bcmasp: fix early exit leak with fixed phy (Justin Chen)
  - can: gs_usb: gs_usb_receive_bulk_callback(): fix error message (Marc Kleine-Budde) [Orabug: 39084048] {CVE-2026-23155}
  - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Zilin Guan)
  - Bluetooth: MGMT: Fix memory leak in set_ssp_complete (Jianpeng Chang) [Orabug: 38970587] {CVE-2026-23151}
  - Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (Jia-Hong Su) [Orabug: 38970604] {CVE-2026-23146}
  - can: at91_can: Fix memory leak in at91_can_probe() (Zilin Guan)
  - LTS version: v6.12.68 (Jack Vogel)
  - vsock/virtio: Fix message iterator handling on transmit path (Will Deacon)
  - net: Introduce skb_copy_datagram_from_iter_full() (Will Deacon)
  - vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers (Will Deacon)
  - vhost/vsock: Allocate nonlinear SKBs for handling large receive buffers (Will Deacon)
  - vsock/virtio: Rename virtio_vsock_skb_rx_put() (Will Deacon)
  - vsock/virtio: Move SKB allocation lower-bound check to callers (Will Deacon)
  - vsock/virtio: Rename virtio_vsock_alloc_skb() (Will Deacon)
  - vsock/virtio: Move length check to callers of virtio_vsock_skb_rx_put() (Will Deacon)
  - wifi: ath11k: fix RCU stall while reaping monitor destination ring (P Praneesh) [Orabug: 37844129] {CVE-2024-58097}
  - btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (Boris Burkov) [Orabug: 38798802] {CVE-2025-68358}
  - accel/ivpu: Fix race condition when unbinding BOs (Tomasz Rusinowicz)
  - fs/ntfs3: Initialize allocated memory before use (Bartlomiej Kubik)
  - sched_ext: Fix possible deadlock in the deferred_irq_workfn() (Zqiang) [Orabug: 38792605] {CVE-2025-68333}
  - exfat: fix refcount leak in exfat_find (Shuhao Fu) [Orabug: 38798780] {CVE-2025-68351}
  - iio: adc: exynos_adc: fix OF populate on driver rebind (Johan Hovold)
  - iio: core: add separate lockdep class for info_exist_lock (Rasmus Villemoes)
  - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Andy Shevchenko)
  - iio: core: add missing mutex_destroy in iio_dev_release() (Andy Shevchenko)
  - arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s (Geraldo Nascimento)
  - bpf: Do not let BPF test infra emit invalid GSO types to stack (Daniel Borkmann) [Orabug: 38798881] {CVE-2025-68725}
  - selftests/bpf: Check for timeout in perf_link test (Ihor Solodrai)
  - can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
  - dmaengine: ti: k3-udma: Enable second resource range for BCDMA and PKTDMA (Siddharth Vadapalli)
  - migrate: correct lock ordering for hugetlb file folios (Matthew Wilcox) [Orabug: 38931066] {CVE-2026-23097}
  - gpio: cdev: Correct return code on memory allocation failure (Tzung-Bi Shih)
  - drm/amdgpu: remove frame cntl for gfx v12 (Likun Gao)
  - can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38931120] {CVE-2026-23108}
  - can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
  - can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930881] {CVE-2026-23061}
  - can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930859] {CVE-2026-23058}
  - net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ Stick (Hamza Mahfooz)
  - irqchip/gic-v3-its: Avoid truncating memory addresses (Arnd Bergmann) [Orabug: 38931001] {CVE-2026-23085}
  - perf/x86/intel: Do not enable BTS for guests (Fernand Sieber)
  - pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu (Ming Qian)
  - platform/x86: hp-bioscfg: Fix automatic module loading (Mario Limonciello)
  - netrom: fix double-free in nr_route_frame() (Jeongjun Park)
  - uacce: ensure safe queue release with state management (Chenghai Huang)
  - uacce: implement mremap in uacce_vm_ops to return -EPERM (Yang Shen)
  - uacce: fix isolate sysfs check condition (Chenghai Huang)
  - uacce: fix cdev handling in the cleanup path (Wenkai Lin)
  - s390/ap: Fix wrong APQN fill calculation (Harald Freudenberger)
  - mei: trace: treat reg parameter as string (Alexander Usyskin)
  - intel_th: fix device leak on output open() (Johan Hovold) [Orabug: 38931040] {CVE-2026-23091}
  - tracing: Fix crash on synthetic stacktrace field usage (Steven Rostedt) [Orabug: 38931024] {CVE-2026-23088}
  - slimbus: core: fix device reference leak on report present (Johan Hovold)
  - slimbus: core: fix runtime PM imbalance on report present (Johan Hovold)
  - octeontx2: Fix otx2_dma_map_page() error return code (Thomas Fourier)
  - arm64: Set __nocfi on swsusp_arch_resume() (Zhaoyang Huang) [Orabug: 38970241] {CVE-2026-23128}
  - arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (Mark Rutland) [Orabug: 38931118] {CVE-2026-23107}
  - wifi: rsi: Fix memory corruption due to not set vif driver data size (Marek Vasut) [Orabug: 38930939] {CVE-2026-23073}
  - wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (Dan Carpenter)
  - wifi: ath12k: fix dma_free_coherent() pointer (Thomas Fourier)
  - wifi: ath10k: fix dma_free_coherent() pointer (Thomas Fourier) [Orabug: 38970253] {CVE-2026-23133}
  - drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit) (Lyude Paul)
  - mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode (Shawn Lin)
  - mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function (Matthew Schwartz)
  - ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (Berk Cem Goksel) [Orabug: 38931029] {CVE-2026-23089}
  - ALSA: scarlett2: Fix buffer overflow in config retrieval (Samasth Norway Ananda) [Orabug: 38930973] {CVE-2026-23078}
  - ALSA: ctxfi: Fix potential OOB access in audio mixer handling (Takashi Iwai) [Orabug: 38930966] {CVE-2026-23076}
  - iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl (Andreas Kübrich)
  - iio: chemical: scd4x: fix reported channel endianness (Fiona Klute)
  - iio: adc: pac1934: Fix clamped value in pac1934_reg_snapshot (Thorsten Blum)
  - iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver (Pei Xiao)
  - iio: adc: ad9467: fix ad9434 vref mask (Tomas Melin)
  - iio: accel: iis328dq: fix gain values (Markus Koeniger)
  - iio: accel: adxl380: fix handling of unavailable "INT1" interrupt (Francesco Lavra)
  - of: platform: Use default match table for /firmware (Rob Herring)
  - of: fix reference count leak in of_alias_scan() (Weigang He)
  - leds: led-class: Only Add LED to leds_list when it is fully ready (Hans de Goede) [Orabug: 38931091] {CVE-2026-23101}
  - keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal (Srish Srinivasan)
  - tpm: Compare HMAC values in constant time (Eric Biggers)
  - x86: make page fault handling disable interrupts properly (Cedric Xing)
  - dpll: Prevent duplicate registrations (Ivan Vecera) [Orabug: 38970244] {CVE-2026-23129}
  - net/sched: act_ife: avoid possible NULL deref (Eric Dumazet)
  - vsock/virtio: cap TX credit to local buffer size (Melbin K Mathew) [Orabug: 38931008] {CVE-2026-23086}
  - vsock/test: fix seqpacket message bounds test (Stefano Garzarella)
  - vsock/virtio: fix potential underflow in virtio_transport_get_credit() (Melbin K Mathew) [Orabug: 38930919] {CVE-2026-23069}
  - net: openvswitch: fix data race in ovs_vport_get_upcall_stats (David Yang)
  - octeontx2-af: Fix error handling (Ratheesh Kannoth)
  - net: dsa: fix off-by-one in maximum bridge ID determination (Vladimir Oltean)
  - bonding: provide a net pointer to __skb_flow_dissect() (Eric Dumazet) [Orabug: 38970199] {CVE-2026-23119}
  - selftests: net: amt: wait longer for connection before sending packets (Taehee Yoo)
  - be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (Andrey Vatoropin) [Orabug: 38930992] {CVE-2026-23084}
  - drm/nouveau: implement missing DCB connector types; gracefully handle unknown connectors (Alex Ramírez)
  - drm/nouveau: add missing DCB connector types (Alex Ramírez)
  - drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) (Timur Kristóf)
  - drm/amd/pm: Don't clear SI SMC table when setting power limit (Timur Kristóf)
  - sched/fair: Fix pelt clock sync when entering idle (Vincent Guittot)
  - clocksource: Reduce watchdog readout delay limit to prevent false positives (Thomas Gleixner)
  - usbnet: limit max_mtu based on device's hard_mtu (Laurent Vivier)
  - ipv6: annotate data-race in ndisc_router_discovery() (Eric Dumazet) [Orabug: 38970222] {CVE-2026-23124}
  - mISDN: annotate data-race around dev->work (Eric Dumazet)
  - net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue (Jijie Shao)
  - net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M (Jijie Shao)
  - be2net: fix data race in be_get_new_eqd (David Yang)
  - net: hns3: fix data race in hns3_fetch_stats (David Yang)
  - ice: Fix persistent failure in ice_get_rxfh (Cody Haas)
  - netdevsim: fix a race issue related to the operation on bpf_bound_progs list (Yun Lu) [Orabug: 38970233] {CVE-2026-23126}
  - drm/imagination: Wait for FW trace update command completion (Brajesh Gupta)
  - ALSA: usb: Increase volume range that triggers a warning (Arun Raghavan)
  - scsi: qla2xxx: Sanitize payload size to prevent member overflow (Jiasheng Jiang) [Orabug: 38930867] {CVE-2026-23059}
  - scsi: core: Wake up the error handler when final completions race against each other (David Jeffery) [Orabug: 38931132] {CVE-2026-23110}
  - platform/x86/amd: Fix memory leak in wbrf_record() (Zilin Guan)
  - riscv: clocksource: Fix stimecmp update hazard on RV32 (Naohiko Shimizu)
  - kconfig: fix static linking of nconf (Arusekk)
  - regmap: Fix race condition in hwspinlock irqsave routine (Cheng-Yu Lee) [Orabug: 38930930] {CVE-2026-23071}
  - spi: spi-sprd-adi: Fix double free in probe error path (Felix Gu)
  - interconnect: debugfs: initialize src_node and dst_node to empty strings (Georgi Djakov) [Orabug: 38970218] {CVE-2026-23123}
  - iio: adc: ad7280a: handle spi_setup() errors in probe() (Pavel Zhigulin)
  - iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection (Francesco Lavra)
  - io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (Jens Axboe) [Orabug: 38970181] {CVE-2026-23113}
  - mm/rmap: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
  - platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro (Mario Limonciello) [Orabug: 38930890] {CVE-2026-23062}
  - platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names (Mario Limonciello) [Orabug: 38970247] {CVE-2026-23131}
  - comedi: Fix getting range information for subdevices 16 to 255 (Ian Abbott)
  - x86/kfence: avoid writing L1TF-vulnerable PTEs (Andrew Cooper)
  - arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro (Ondrej Jirman)
  - arm64: dts: rockchip: remove dangerous max-link-speed from helios64 (Geraldo Nascimento)
  - scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() (Abdun Nihaal) [Orabug: 38931014] {CVE-2026-23087}
  - scsi: storvsc: Process unsupported MODE_SENSE_10 (Long Li)
  - Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA (Feng)
  - Input: i8042 - add quirks for MECHREVO Wujie 15X Pro (Gongqi)
  - Revert "nfc/nci: Add the inconsistency check between the input data length and count" (Thadeu Lima de Souza Cascardo)
  - w1: fix redundant counter decrement in w1_attach_slave_device() (Haoxiang Li)
  - w1: therm: Fix off-by-one buffer overflow in alarms_store (Thorsten Blum) [Orabug: 38930796] {CVE-2025-71197}
  - comedi: dmm32at: serialize use of paged registers (Ian Abbott)
  - serial: 8250_pci: Fix broken RS485 for F81504/508/512 (Marnix Rijnart)
  - wifi: mac80211: don't perform DA check on S1G beacon (Lachlan Hodges)
  - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Taeyang Lee) [Orabug: 38930874] {CVE-2026-23060}
  - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (Jamal Hadi Salim) [Orabug: 38931110] {CVE-2026-23105}
  - net/sched: Enforce that teql can only be used as root qdisc (Jamal Hadi Salim) [Orabug: 38930948] {CVE-2026-23074}
  - octeontx2: cn10k: fix RX flowid TCAM mask handling (Alok Tiwari)
  - ipvlan: Make the addrs_lock be per port (Dmitry Skorodumov) [Orabug: 38931102] {CVE-2026-23103}
  - l2tp: avoid one data-race in l2tp_tunnel_del_work() (Eric Dumazet) [Orabug: 38970202] {CVE-2026-23120}
  - veth: fix data race in veth_get_ethtool_stats (David Yang)
  - fou: Don't allow 0 for FOU_ATTR_IPPROTO. (Kuniyuki Iwashima) [Orabug: 38930985] {CVE-2026-23083}
  - tools: ynl: Specify --no-line-number in ynl-regen.sh. (Kuniyuki Iwashima)
  - gue: Fix skb memleak with inner IP protocol 0. (Kuniyuki Iwashima) [Orabug: 38931057] {CVE-2026-23095}
  - amd-xgbe: avoid misleading per-packet error log (Raju Rangoju)
  - sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [Orabug: 38970225] {CVE-2026-23125}
  - can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (Marc Kleine-Budde) [Orabug: 38931184] {CVE-2026-23082}
  - selftests: net: fib-onlink-tests: Convert to use namespaces by default (Ricardo B. Marlière)
  - l2tp: Fix memleak in l2tp_udp_encap_recv(). (Kuniyuki Iwashima) [Orabug: 38930935] {CVE-2026-23072}
  - bonding: limit BOND_MODE_8023AD to Ethernet devices (Eric Dumazet) [Orabug: 38931079] {CVE-2026-23099}
  - net: usb: dm9601: remove broken SR9700 support (Ethan Nelson-Moore)
  - vsock/virtio: Coalesce only linear skb (Michal Luczaj) [Orabug: 38930857] {CVE-2026-23057}
  - igc: fix race condition in TX timestamp read for register 0 (Chwee Lin Choong)
  - igc: Restore default Qbv schedule when changing channels (Kurt Kanzenbach)
  - ice: Fix incorrect timeout ice_release_res() (Ding Hui)
  - ice: Avoid detrimental cleanup for bond during interface stop (Dave Ertman)
  - ice: initialize ring_stats->syncp (Jacob Keller)
  - ata: libata: Print features also for ATAPI devices (Niklas Cassel)
  - ata: libata: Call ata_dev_config_lpm() for ATAPI devices (Niklas Cassel)
  - ata: libata-core: Introduce ata_dev_config_lpm() (Damien Le Moal)
  - ata: libata: Add cpr_log to ata_dev_print_features() early return (Niklas Cassel)
  - ata: libata-sata: Improve link_power_management_supported sysfs attribute (Niklas Cassel)
  - ata: ahci: Do not read the per port area for unimplemented ports (Niklas Cassel)
  - btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE (Mark Harmstone)
  - Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump() (Michael Kelley)
  - arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links (Konrad Dybcio)
  - pmdomain: qcom: rpmhpd: Add MXC to SC8280XP (Konrad Dybcio)
  - dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO (Konrad Dybcio)
  - dt-bindings: power: qcom-rpmpd: split RPMh domains definitions (Dmitry Baryshkov)
  - dt-bindings: power: qcom,rpmpd: add Turbo L5 corner (Akhil P Oommen)
  - dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains (Taniya Das)
  - testptp: Add option to open PHC in readonly mode (Wojtek Wasko)
  - selftest/ptp: update ptp selftest to exercise the gettimex options (Mahesh Bandewar)
  - ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE. (Wojtek Wasko)
  - posix-clock: Store file pointer in struct posix_clock_context (Wojtek Wasko)


author: Sherry Yang <sherry.yang@oracle.com> [6.12.0-201.74.2.el10uek]
changelog:
  - kabi: update kABI files for FIPS (Saeed Mirzamohammadi) [Orabug: 38667144]
  - RDMA/mlx5: Fix ucaps init error flow (Maher Sanalla) [Orabug: 38667144]
  - eth: mlx4: Fix IS_ERR() vs NULL check bug in mlx4_en_create_rx_ring (Miaoqian Lin) [Orabug: 38667144] {CVE-2025-39858}
  - RDMA/ucaps: Avoid format-security warning (Arnd Bergmann) [Orabug: 38667144]
  - net/mlx5: fs, fix UAF in flow counter release (Moshe Shemesh) [Orabug: 38667144,39004176] {CVE-2025-39979}
  - net/mlx5: Not returning mlx5_link_info table when speed is unknown (Li Tian) [Orabug: 38667144]
  - net/mlx5: CT: Use the correct counter offset (Vlad Dogaru) [Orabug: 38667144]
  - net/mlx5: Reset bw_share field when changing a node's parent (Carolina Jubran) [Orabug: 38667144]
  - net/mlx5e: Fix number of lanes to UNKNOWN when using data_rate_oper (Shahar Shitrit) [Orabug: 38667144]
  - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Carolina Jubran) [Orabug: 38667144]
  - mlx5: Fix default values in create CQ (Akiva Goldberger) [Orabug: 38667144,38773368] {CVE-2025-68209}
  - net/mlx5e: Prepare for using different CQ doorbells (Cosmin Ratiu) [Orabug: 38667144]
  - net/mlx5: Store the global doorbell in mlx5_priv (Cosmin Ratiu) [Orabug: 38667144]
  - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Cosmin Ratiu) [Orabug: 38667144]
  - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Yishai Hadas) [Orabug: 38667144]
  - RDMA/mlx5: Fix compilation warning when USER_ACCESS isn't set (Mark Bloch) [Orabug: 38667144]
  - eth: mlx4: select PAGE_POOL (Greg Thelen) [Orabug: 38667144]
  - net/mlx5e: TC, Don't offload CT commit if it's the last action (Jianbo Liu) [Orabug: 38667144]
  - net/mlx5e: CT: Filter legacy rules that are unrelated to nic (Paul Blakey) [Orabug: 38667144]
  - net/mlx5: Update pfnum retrieval for devlink port attributes (Shay Drory) [Orabug: 38667144]
  - net/mlx5: fw reset, check bridge accessibility at earlier stage (Amir Tzin) [Orabug: 38667144]
  - net/mlx5: Lag, use port selection tables when available (Mark Bloch) [Orabug: 38667144]
  - net/mlx5e: TX, Utilize WQ fragments edge for multi-packet WQEs (Tariq Toukan) [Orabug: 38667144]
  - net/mlx5: Start health poll after enable hca (Moshe Shemesh) [Orabug: 38667144]
  - net/mlx5: LAG, reload representors on LAG creation failure (Mark Bloch) [Orabug: 38667144]
  - mlxsw: spectrum_acl_bloom_filter: Workaround for some LLVM versions (Yuli Wang) [Orabug: 38667144]
  - mlxsw: Add VXLAN bridge ports to same hardware domain as physical bridge ports (Amit Cohen) [Orabug: 38667144]
  - mlxsw: spectrum_switchdev: Move mlxsw_sp_bridge_vxlan_join() (Amit Cohen) [Orabug: 38667144]
  - mlxsw: spectrum_switchdev: Add an internal API for VXLAN leave (Amit Cohen) [Orabug: 38667144]
  - mlxsw: spectrum: Call mlxsw_sp_bridge_vxlan_{join, leave}() for VLAN-aware bridge (Amit Cohen) [Orabug: 38667144]
  - mlxsw: Trap ARP packets at layer 2 instead of layer 3 (Amit Cohen) [Orabug: 38667144]
  - net/mlx5e: Always select CONFIG_PAGE_POOL_STATS (Tariq Toukan) [Orabug: 38667144]
  - net/mlx5e: Use right API to free bitmap memory (Mark Zhang) [Orabug: 38667144]
  - net/mlx5: Remove NULL check before dev_{put, hold} (Gal Pressman) [Orabug: 38667144]
  - net/mlx5e: Fix ethtool -N flow-type ip4 to RSS context (Maxim Mikityanskiy) [Orabug: 38667144]
  - i2c: mlxbf: Use readl_poll_timeout_atomic() for polling (Andy Shevchenko) [Orabug: 38667144]
  - net/mlx5e: Expose port reset cycle recovery counter via ethtool (Yael Chemla) [Orabug: 38667144]
  - net/mlx5e: Get counter group size by FW capability (Yael Chemla) [Orabug: 38667144]
  - net/mlx5e: Access PHY layer counter group as other counter groups (Yael Chemla) [Orabug: 38667144]
  - net/mlx5e: Ensure each counter group uses its PCAM bit (Yael Chemla) [Orabug: 38667144]
  - leds: mlxcpld: Remove unused ACPI header inclusion (Andy Shevchenko) [Orabug: 38667144]
  - net/mlx5: HWS, log the unsupported mask in definer (Yevgeny Kliteynik) [Orabug: 38667144]
  - net/mlx5: HWS, use list_move() instead of del/add (Yevgeny Kliteynik) [Orabug: 38667144]
  - net/mlx5: HWS, remove unused code for alias flow tables (Yevgeny Kliteynik) [Orabug: 38667144]
  - RDMA/mlx5: Drop access_flags from _mlx5_mr_cache_alloc() (Michael Guralnik) [Orabug: 38667144]
  - RDMA/mlx5: Support optional-counters binding for QPs (Patrisious Haddad) [Orabug: 38667144]
  - RDMA/mlx5: Compile fs.c regardless of INFINIBAND_USER_ACCESS config (Patrisious Haddad) [Orabug: 38667144]
  - RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38667144]
  - RDMA/core: Pass port to counter bind/unbind operations (Patrisious Haddad) [Orabug: 38667144]
  - Revert "RDMA/ionic: Implement device stats ops" (Qing Huang) [Orabug: 38667144]
  - RDMA/core: Add support to optional-counters binding configuration (Patrisious Haddad) [Orabug: 38667144]
  - RDMA/core: Create and destroy rdma_counter using rdma_zalloc_drv_obj() (Patrisious Haddad) [Orabug: 38667144]
  - RDMA/mlx5: Add optional counters for RDMA_TX/RX_packets/bytes (Patrisious Haddad) [Orabug: 38667144]
  - net/mlx5: Add support for setting parent of nodes (Carolina Jubran) [Orabug: 38667144]
  - net/mlx5: Preserve rate settings when creating a rate node (Carolina Jubran) [Orabug: 38667144]
  - net/mlx5: Introduce hierarchy level tracking on scheduling nodes (Carolina Jubran) [Orabug: 38667144]
  - net/mlx5: Rename devlink rate parent set function for leaf nodes (Carolina Jubran) [Orabug: 38667144]
  - net/mlx5: fs, add support for dest flow sampler HWS action (Moshe Shemesh) [Orabug: 38667144]
  - net/mlx5: fs, add support for flow meters HWS action (Moshe Shemesh) [Orabug: 38667144]
  - net/mlx5: fs, add API for sharing HWS action by refcount (Moshe Shemesh) [Orabug: 38667144]
  - netdevsim: 'support' multi-buf XDP (Jakub Kicinski) [Orabug: 38667144]
  - net/mlx5: Avoid unnecessary use of comma operator (Simon Horman) [Orabug: 38667144]
  - mmc: sdhci-of-dwcmshc: Change to dwcmshc_phy_init for reusing codes (Jaehoon Chung) [Orabug: 38667144]
  - net/mlx5: Add IFC bits for PPCNT recovery counters group (Yael Chemla) [Orabug: 38667144]
  - RDMA/mlx5: Expose RDMA TRANSPORT flow table types to userspace (Patrisious Haddad) [Orabug: 38667144]
  - RDMA/mlx5: Check enabled UCAPs when creating ucontext (Chiara Meiohas) [Orabug: 38667144]
  - RDMA/uverbs: Add support for UCAPs in context creation (Chiara Meiohas) [Orabug: 38667144]
  - RDMA/mlx5: Create UCAP char devices for supported device capabilities (Chiara Meiohas) [Orabug: 38667144]
  - RDMA/uverbs: Introduce UCAP (User CAPabilities) API (Chiara Meiohas) [Orabug: 38667144]
  - net/mlx5: fs, add RDMA TRANSPORT steering domain support (Patrisious Haddad) [Orabug: 38667144]
  - net/mlx5: Query ADV_RDMA capabilities (Patrisious Haddad) [Orabug: 38667144]
  - net/mlx5: Limit non-privileged commands (Chiara Meiohas) [Orabug: 38667144]
  - net/mlx5: Allow the throttle mechanism to be more dynamic (Chiara Meiohas) [Orabug: 38667144]
  - net/mlx5: Add RDMA_CTRL HW capabilities (Chiara Meiohas) [Orabug: 38667144]
  - net/mlx5e: Properly match IPsec subnet addresses (Leon Romanovsky) [Orabug: 38667144]
  - net/mlx5e: Separate address related variables to be in struct (Leon Romanovsky) [Orabug: 38667144]
  - net/mlx5: Lag, Enable Multiport E-Switch offloads on 8 ports LAG (Amir Tzin) [Orabug: 38667144]
  - net/mlx5e: Enable lanes configuration when auto-negotiation is off (Shahar Shitrit) [Orabug: 38667144]
  - net/mlx5: Refactor link speed handling with mlx5_link_info struct (Shahar Shitrit) [Orabug: 38667144]
  - net: rename netns_local to netns_immutable (Nicolas Dichtel) [Orabug: 38667144]
  - RDMA/mlx5: Reorder capability check last (Christian Göttsche) [Orabug: 38667144]
  - net/mlx5: Add trust lockdown error to health syndrome print function (Shahar Shitrit) [Orabug: 38667144]
  - net/mlx5: Expose crr in health buffer (Shahar Shitrit) [Orabug: 38667144]
  - net/mlx5: Log health buffer data on any syndrome (Moshe Shemesh) [Orabug: 38667144]
  - net/mlx5: Remove newline at the end of a netlink error message (Gal Pressman) [Orabug: 38667144]
  - net/mlx5e: Avoid a hundred -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38667144]
  - net/mlx5e: Symmetric OR-XOR RSS hash control (Gal Pressman) [Orabug: 38667144]
  - ethtool: Symmetric OR-XOR RSS hash (Gal Pressman) [Orabug: 38667144]
  - net/mlx5: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38667144]
  - net/mlx5: Add new health syndrome error and crr bit offset (Shahar Shitrit) [Orabug: 38667144]
  - xfrm: provide common xdo_dev_offload_ok callback implementation (Leon Romanovsky) [Orabug: 38667144]
  - xfrm: rely on XFRM offload (Leon Romanovsky) [Orabug: 38667144]
  - net/mlx5e: Separate extended link modes request from link modes type selection (Shahar Shitrit) [Orabug: 38667144]
  - net/mlx5e: Change eth_proto parameter naming (Shahar Shitrit) [Orabug: 38667144]
  - net/mlx5e: Introduce ptys2ethtool_process_link() (Shahar Shitrit) [Orabug: 38667144]
  - net/mlx5e: Refactor ptys2ethtool_adver_link() (Shahar Shitrit) [Orabug: 38667144]
  - net/mlx5: Bridge, correct config option description (Cosmin Ratiu) [Orabug: 38667144]
  - netdevsim: call napi_schedule from a timer context (Breno Leitao) [Orabug: 38667144]
  - eth: mlx4: use the page pool for Rx buffers (Jakub Kicinski) [Orabug: 38667144]
  - eth: mlx4: remove the local XDP fast-recycling ring (Jakub Kicinski) [Orabug: 38667144]
  - eth: mlx4: create a page pool for Rx (Jakub Kicinski) [Orabug: 38667144]
  - net/mlx5: Add sensor name to temperature event message (Shahar Shitrit) [Orabug: 38667144]
  - net/mlx5: Prefix temperature event bitmap with '0x' for clarity (Shahar Shitrit) [Orabug: 38667144]
  - net/mlx5e: Expose RSS via devlink rx reporter diagnose (Amir Tzin) [Orabug: 38667144]
  - net/mlx5e: Add direct TIRs to devlink rx reporter diagnose (Amir Tzin) [Orabug: 38667144]
  - net/mlx5e: Move RQs diagnose to a dedicated function (Amir Tzin) [Orabug: 38667144]
  - mlxsw: Enable Tx checksum offload (Ido Schimmel) [Orabug: 38667144]
  - net/mlx5e: Remove unused mlx5e_tc_flow_action struct (Gal Pressman) [Orabug: 38667144]
  - net/mlx5: Remove stray semicolon in LAG port selection table creation (Gal Pressman) [Orabug: 38667144]
  - net/mlx5e: Support FEC settings for 200G per lane link modes (Jianbo Liu) [Orabug: 38667144]
  - net/mlx5: Add support for 200Gbps per lane link modes (Jianbo Liu) [Orabug: 38667144]
  - ethtool: Add support for 200Gbps per lane link modes (Jianbo Liu) [Orabug: 38667144]
  - net/mlx5: Generate PPS IN event on new function for shared clock (Jianbo Liu) [Orabug: 38667144]
  - net/mlx5: Support one PTP device per hardware clock (Jianbo Liu) [Orabug: 38667144]
  - net/mlx5: Move PPS notifier and out_work to clock_state (Jianbo Liu) [Orabug: 38667144]
  - net/mlx5: Add devcom component for the clock shared by functions (Jianbo Liu) [Orabug: 38667144]
  - net/mlx5: Change clock in mlx5_core_dev to mlx5_clock pointer (Jianbo Liu) [Orabug: 38667144]
  - net/mlx5: Add API to get mlx5_core_dev from mlx5_clock (Jianbo Liu) [Orabug: 38667144]
  - net/mlx5: Add init and destruction functions for a single HW clock (Jianbo Liu) [Orabug: 38667144]
  - net/mlx5: Change parameters for PTP internal functions (Jianbo Liu) [Orabug: 38667144]
  - net/mlx5: Add helper functions for PTP callbacks (Jianbo Liu) [Orabug: 38667144]
  - mlxsw: spectrum_router: Remove unused functions (Dr. David Alan Gilbert) [Orabug: 38667144]
  - net/mlx5: Remove unused mlx5dr_domain_sync (Dr. David Alan Gilbert) [Orabug: 38667144]
  - mlx4: Remove unused functions (Dr. David Alan Gilbert) [Orabug: 38667144]
  - platform: mellanox: mlx-platform: Change register name (Vadim Pasternak) [Orabug: 38667144]
  - platform: mellanox: mlx-platform: Cosmetic changes (Vadim Pasternak) [Orabug: 38667144]
  - mellanox: Relocate mlx-platform driver (Vadim Pasternak) [Orabug: 38667144]
  - jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Easwar Hariharan) [Orabug: 38667144]
  - ktime: Add us_to_ktime() (David Howells) [Orabug: 38667144]
  - Revert "mlx5: Fix default values in create CQ" (Qing Huang) [Orabug: 38667144]
  - net/mlx5: poll mlx5 eq during irq migration (Praveen Kumar Kannoju) [Orabug: 38915249]
  - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Inseo An) [Orabug: 39044468] {CVE-2026-23231}
  - scsi: core: Fix error handling for scsi_alloc_sdev() (Junxiao Bi) [Orabug: 39104869]
  - scsi: core: Fix refcount leak for tagset_refcnt (Junxiao Bi) [Orabug: 39104869,39130773] {CVE-2026-23296}
  - scsi: core: Move two statements (Bart Van Assche) [Orabug: 39104869]
  - vfio: Adapt to upstream uAPI for VFIO_PRECOPY_INFO_REINIT (Maciej S. Szmigiero) [Orabug: 39121644]
  - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson) [Orabug: 39153394,39159088] {CVE-2026-23401}


author: Sherry Yang <sherry.yang@oracle.com> [6.12.0-202.76.1.el10uek]
changelog:
  - uek-rpm/config-x86_64-onos: Reduce unneeded options in config file for ONOS (Brian Utterback) [Orabug: 39029491]
  - Kconfig for ARISTA_SCD_DRIVER driver needs select REGMAP_I2C (Brian Utterback) [Orabug: 39095293]
  - memfd: move MFD_MF_KEEP_UE_MAPPED flag to higher bit (William Roche) [Orabug: 39109772]
  - uek-rpm: Enable CONFIG_NET_VRF in container kernel (Boris Ostrovsky) [Orabug: 39161478]
  - sched: idle: Make skipping governor callbacks more consistent (Rafael J. Wysocki)
  - dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler (Guenter Roeck)
  - soc: rockchip: grf: Add missing of_node_put() when returning (Shawn Lin)
  - tracing: Add NULL pointer check to trigger_data_free() (Guenter Roeck) {CVE-2026-23309}
  - qmi_wwan: allow max_mtu above hard_mtu to control rx_urb_size (Laurent Vivier)
  - bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR (Daniel Wade) [Orabug: 39198231] {CVE-2026-31413}
  - ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload (Peter Ujfalusi)
  - Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req (Minseo Park) {CVE-2026-31513}
  - Revert "arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on" (Sasha Levin)
  - erofs: set fileio bio failed in short read case (Sheng Yong) {CVE-2026-31514}
  - ACPI: processor: Fix previous acpi_processor_errata_piix4() fix (Rafael J. Wysocki) [Orabug: 39198208] {CVE-2026-23443}
  - kbuild: Leave objtool binary around with 'make clean' (Nathan Chancellor)
  - wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom (Guenter Roeck) {CVE-2026-31552}
  - net: macb: Reinitialize tx/rx queue pointer registers and rx ring during resume (Kevin Hao)
  - net: macb: Introduce gem_init_rx_ring() (Kevin Hao)
  - net: macb: Shuffle the tx ring before enabling tx (Kevin Hao)
  - remoteproc: mediatek: Unprepare SCP clock during system suspend (Tzung-Bi Shih)
  - LTS version: v6.12.76 (Sherry Yang)
  - Revert "x86/kexec: add a sanity check on previous kernel's ima kexec buffer" (Sasha Levin)
  - LTS version: v6.12.75 (Sherry Yang)
  - most: core: fix leak on early registration failure (Johan Hovold)
  - arm64: Fix sampling the "stable" virtual counter in preemptible section (Marc Zyngier)
  - xfs: fix copy-paste error in previous fix (Darrick J. Wong)
  - drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros (Jani Nikula)
  - ALSA: pcm: Revert bufs move in snd_pcm_xfern_frames_ioctl() (Nathan Chancellor)
  - NTB: ntb_transport: Fix too small buffer for debugfs_name (Koichiro Den)
  - tracing: Wake up poll waiters for hist files when removing an event (Petr Pavlu)
  - tracing: Fix checking of freed trace_event_file for hist files (Petr Pavlu)
  - fgraph: Do not call handlers direct when not using ftrace_ops (Steven Rostedt)
  - tracing: ring-buffer: Fix to check event length before using (Masami Hiramatsu) {CVE-2026-43210}
  - net: nfc: nci: Fix parameter validation for packet data (Michael Thalmeier)
  - drm/amdgpu: keep vga memory on MacBooks with switchable graphics (Alex Deucher)
  - arm64: Force the use of CNTVCT_EL0 in __delay() (Marc Zyngier)
  - x86/kexec: Copy ACPI root pointer address from config table (Ard Biesheuvel)
  - net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() (Liu Ruitong) {CVE-2026-43238}
  - net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle (Thomas Fourier)
  - ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR (Gustavo Salvini)
  - cifs: some missing initializations on replay (Shyam Prasad N) {CVE-2026-31693}
  - fbcon: Remove struct fbcon_display.inverse (Thomas Zimmermann)
  - fbdev: ffb: fix corrupted video output on Sun FFB1 (René Rebe)
  - fbdev: of: display_timing: fix refcount leak in of_get_display_timings() (Weigang He) {CVE-2026-43264}
  - fbdev: vt8500lcdfb: fix missing dma_free_coherent() (Thomas Fourier)
  - fbcon: check return value of con2fb_acquire_newinfo() (Andrey Vatoropin) {CVE-2026-43123}
  - mm: numa_memblks: Identify the accurate NUMA ID of CFMW (Cui Chao)
  - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (Junxi Qian) {CVE-2026-43186}
  - function_graph: Restore direct mode when callbacks drop to one (Shengming Hu)
  - atm: fore200e: fix use-after-free in tasklets during device removal (Duoming Zhou)
  - net: intel: fix PCI device ID conflict between i40e and ipw2200 (Ethan Nelson-Moore)
  - procfs: fix possible double mmput() in do_procmap_query() (Andrii Nakryiko) {CVE-2026-43178}
  - drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify (Pierre-Eric Pelloux-Prayer) {CVE-2026-43318}
  - drm/amd/display: Increase DCN35 SR enter/exit latency (Sun Peng Li)
  - io_uring/filetable: clamp alloc_hint to the configured alloc range (Jens Axboe)
  - tracing: Fix to set write permission to per-cpu buffer_size_kb (Masami Hiramatsu)
  - net: macb: Fix tx/rx malfunction after phy link down and up (Kevin Hao)
  - net: ti: icssg-prueth: Add optional dependency on HSR (Kevin Hao)
  - octeontx2-af: CGX: fix bitmap leaks (Bo Sun)
  - net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean() (Thomas Fourier)
  - net: ethernet: marvell: skge: remove incorrect conflicting PCI ID (Ethan Nelson-Moore)
  - LoongArch: Disable instrumentation for setup_ptwalker() (Tiezhu Yang)
  - LoongArch: Guard percpu handler under !CONFIG_PREEMPT_RT (Tiezhu Yang)
  - LoongArch: Use %px to print unmodified unwinding address (Tiezhu Yang)
  - LoongArch: Prefer top-down allocation after arch_mem_init() (Huacai Chen)
  - LoongArch: Make cpumask_of_node() robust against NUMA_NO_NODE (John Garry)
  - rust: kbuild: pass `-Zunstable-options` for Rust 1.95.0 (Miguel Ojeda)
  - ceph: supply snapshot context in ceph_zero_partial_object() (Ethanwu) {CVE-2026-43273}
  - MIPS: rb532: Fix MMIO UART resource registration (Jiaxun Yang)
  - cifs: Fix locking usage for tcon fields (Shyam Prasad N) {CVE-2026-43215}
  - watchdog/softlockup: fix sample ring index wrap in need_counting_irqs() (Shengming Hu)
  - kcsan, compiler_types: avoid duplicate type issues in BPF Type Format (Alan Maguire)
  - staging: rtl8723bs: fix null dereference in find_network (Ethan Tidmore)
  - parisc: kernel: replace kfree() with put_device() in create_tree_node() (Haoxiang Li)
  - PCI: Fix pci_slot_trylock() error handling (Jinhui Guo) {CVE-2026-43211}
  - net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe() error path (Kevin Hao)
  - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (Sunday Clement) {CVE-2026-43206}
  - tipc: fix RCU dereference race in tipc_aead_users_dec() (Daniel Hodges)
  - mtd: rawnand: pl353: Fix software ECC support (Andrea Scian)
  - usb: dwc2: fix resume failure if dr_mode is host (Jisheng Zhang)
  - usb: dwc3: gadget: Move vbus draw to workqueue context (Prashanth K) {CVE-2026-43170}
  - PCI: dwc: Fix msg_atu_index assignment (Niklas Cassel)
  - mm/slab: use unsigned long for orig_size to ensure proper metadata align (Harry Yoo)
  - scsi: ufs: core: Flush exception handling work when RPM level is zero (Thomas Yen) {CVE-2026-43275}
  - perf/arm-cmn: Reject unsupported hardware configurations (Robin Murphy) {CVE-2026-43150}
  - remoteproc: imx_rproc: Fix invalid loaded resource table detection (Peng Fan)
  - btrfs: continue trimming remaining devices on failure (Jinbaohong)
  - clk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841 (Marek Vasut)
  - arm64: Fix non-atomic __READ_ONCE() with CONFIG_LTO=y (Marco Elver)
  - PCI/IOV: Fix race between SR-IOV enable/disable and hotplug (Niklas Schnelle) {CVE-2025-40219}
  - Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" (Niklas Schnelle) {CVE-2026-43147}
  - kexec: derive purgatory entry from symbol (Li Chen) {CVE-2026-43289}
  - ocfs2: fix reflink preserve cleanup issue (Heming Zhao) {CVE-2026-43168}
  - rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() (Haoxiang Li)
  - mm/highmem: fix __kmap_to_page() build error (William Tambe)
  - mtd: spinand: Disable continuous read during probe (David Laporte)
  - iio: gyro: itg3200: Fix unchecked return value in read_raw (Antoniu Miclaus)
  - powerpc/smp: Add check for kcalloc() failure in parse_thread_groups() (Guangshuo Li)
  - vhost: move vdpa group bound check to vhost_vdpa (Eugenio Pérez) {CVE-2026-43248}
  - tools: Fix bitfield dependency failure (Leo Yan)
  - arm64: poe: fix stale POR_EL0 values for ptrace (Joey Gouly)
  - dm mpath: make pg_init_delay_msecs settable (Benjamin Marzinski)
  - bus: fsl-mc: fix an error handling in fsl_mc_device_add() (Haoxiang Li)
  - io_uring/net: don't continue send bundle if poll was required for retry (Jens Axboe)
  - usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN (Haotien Hsu)
  - mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node (Deepanshu Kartikey) {CVE-2026-43292}
  - nvmem: Drop OF node reference on nvmem_add_one_cell() failure (Krzysztof Kozlowski)
  - nfsd: fix return error code for nfsd_map_name_to_[ug]id (Anthony Iliopoulos)
  - md/bitmap: fix GPF in write_page caused by resize race (Jack Wang) {CVE-2026-43163}
  - xfs: check for deleted cursors when revalidating two btrees (Darrick J. Wong) [Orabug: 39103129] {CVE-2026-23249}
  - xfs: check return value of xchk_scrub_create_subord (Darrick J. Wong) [Orabug: 39103131] {CVE-2026-23250}
  - xfs: only call xf{array,blob}_destroy if we have a valid pointer (Darrick J. Wong) [Orabug: 39103133] {CVE-2026-23251}
  - pinctrl: intel: Add code name documentation (Raag Jadav)
  - PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions (Manikanta Maddireddy)
  - KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() (Vasiliy Kovalev) {CVE-2026-43214}
  - xfs: fix remote xattr valuelblk check (Darrick J. Wong)
  - xfs: fix the xattr scrub to detect freemap/entries array collisions (Darrick J. Wong)
  - xfs: fix freemap adjustments when adding xattrs to leaf blocks (Darrick J. Wong) {CVE-2026-43158}
  - xfs: delete attr leaf freemap entries when empty (Darrick J. Wong) {CVE-2026-43187}
  - iio: accel: adxl380: Avoid reading more entries than present in FIFO (Francesco Lavra)
  - mfd: omap-usb-host: Fix OF populate on driver rebind (Johan Hovold)
  - mfd: qcom-pm8xxx: Fix OF populate on driver rebind (Johan Hovold)
  - mfd: core: Add locking around 'mfd_of_node_list' (Douglas Anderson) {CVE-2026-43143}
  - iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (Jinhui Guo) {CVE-2026-43130}
  - media: verisilicon: AV1: Fix tile info buffer size (Benjamin Gaignard)
  - xfs: remove xfs_attr_leaf_hasname (Christoph Hellwig) {CVE-2026-43153}
  - xfs: mark data structures corrupt on EIO and ENODATA (Darrick J. Wong)
  - drm/bridge: anx7625: Fix invalid EDID size (Loic Poulain)
  - drm/buddy: Prevent BUG_ON by validating rounded allocation (Sanjay Yadav) {CVE-2026-43169}
  - selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs (Li Wang)
  - drm: of: drm_of_panel_bridge_remove(): fix device_node leak (Luca Ceresoli)
  - media: venus: vdec: restrict EOS addr quirk to IRIS2 only (Dikshita Agarwal)
  - media: venus: vdec: fix error state assignment for zero bytesused (Renjiang Han)
  - arm64: dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro (Yan Jun)
  - dm-unstripe: fix mapping bug when there are multiple targets in a table (Matt Whitlock)
  - dm-integrity: fix recalculation in bitmap mode (Mikulas Patocka)
  - reset: gpio: suppress bind attributes in sysfs (Bartosz Golaszewski)
  - s390/pci: Handle futile config accesses of disabled devices directly (Niklas Schnelle)
  - clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc() (Haoxiang Li)
  - media: i2c: ov01a10: Fix digital gain range (Mehdi Djait)
  - media: stm32: dcmipp: bytecap: clear all interrupts upon stream stop (Alain Volmat)
  - soc: rockchip: grf: Support multiple grf to be handled (Shawn Lin)
  - soc: rockchip: grf: Fix wrong RK3576_IOCGRF_MISC_CON definition (Shawn Lin)
  - clk: clk-apple-nco: Add "apple,t8103-nco" compatible (Janne Grunau)
  - bus: omap-ocp2scp: fix OF populate on driver rebind (Johan Hovold)
  - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (Yosry Ahmed) {CVE-2026-43133}
  - soc: ti: pruss: Fix double free in pruss_clk_mux_setup() (Xu Wang)
  - soc: ti: k3-socinfo: Fix regmap leak on probe failure (Johan Hovold)
  - dm: clear cloned request bio pointer when last clone bio completes (Michael Liang) {CVE-2026-43278}
  - dm-integrity: fix a typo in the code for write/discard race (Mikulas Patocka)
  - platform/x86: ISST: Add missing write block check (Srinivas Pandruvada)
  - media: ipu6: Fix RPM reference leak in probe error paths (Bingbu Cao) {CVE-2026-43177}
  - media: ipu6: Fix typo and wrong constant in ipu6-mmu.c (Bingbu Cao)
  - media: i2c: ov5647: use our own mutex for the ctrl lock (Xiaolei Wang)
  - media: ccs: Fix setting initial sub-device state (Sakari Ailus)
  - media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode (Jai Luthra)
  - media: i2c: ov5647: Sensor should report RAW color space (David Plowman)
  - media: i2c: ov5647: Correct minimum VBLANK value (David Plowman)
  - media: i2c: ov5647: Correct pixel array offset (David Plowman)
  - media: i2c: ov5647: Initialize subdev before controls (Jai Luthra)
  - media: ccs: Avoid possible division by zero (Sakari Ailus)
  - media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() (Alper Ak)
  - media: i2c: ov01a10: Fix test-pattern disabling (Hans de Goede)
  - media: i2c: ov01a10: Fix passing stream instead of pad to v4l2_subdev_state_get_format() (Hans de Goede)
  - media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() calls (Hans de Goede)
  - media: i2c: ov01a10: Fix analogue gain range (Hans de Goede)
  - media: i2c: ov01a10: Fix reported pixel-rate value (Hans de Goede)
  - media: i2c: ov01a10: Fix the horizontal flip control (Hans de Goede)
  - media: i2c/tw9906: Fix potential memory leak in tw9906_probe() (Abdun Nihaal) {CVE-2026-43246}
  - media: i2c/tw9903: Fix potential memory leak in tw9903_probe() (Abdun Nihaal) {CVE-2026-43218}
  - media: cx25821: Add missing unmap in snd_cx25821_hw_params() (Haoxiang Li)
  - media: cx23885: Add missing unmap in snd_cx23885_hw_params() (Haoxiang Li) {CVE-2026-43135}
  - media: cx88: Add missing unmap in snd_cx88_hw_params() (Haoxiang Li) {CVE-2026-43257}
  - media: radio-keene: fix memory leak in error path (Shaurya Rane) {CVE-2026-43231}
  - media: verisilicon: AV1: Set IDR flag for intra_only frame type (Benjamin Gaignard)
  - media: rockchip: rga: Fix possible ERR_PTR dereference in rga_buf_init() (Alper Ak)
  - media: amphion: Drop min_queued_buffers assignment (Ming Qian)
  - arm64: dts: apple: t8112-j473: Keep the HDMI port powered on (Janne Grunau)
  - HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() (Günther Noack) {CVE-2026-43136}
  - HID: prodikeys: Check presence of pm->input_ep82 (Günther Noack) {CVE-2026-43251}
  - HID: magicmouse: Do not crash on missing msc->input (Günther Noack) {CVE-2026-43140}
  - HID: hid-pl: handle probe errors (Oliver Neukum) {CVE-2026-43152}
  - arm64: Disable branch profiling for all arm64 code (Breno Leitao)
  - KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding (Sean Christopherson) {CVE-2026-43315}
  - KVM: x86: Return "unsupported" instead of "invalid" on access to unsupported PV MSR (Sean Christopherson)
  - ARM: omap2: Fix reference count leaks in omap_control_init() (Xu Wang)
  - arm64: dts: qcom: x1e80100: Add missing TCSR ref clock to the DP PHYs (Abel Vesa)
  - media: verisilicon: AV1: Fix tx mode bit setting (Benjamin Gaignard)
  - media: verisilicon: AV1: Fix enable cdef computation (Benjamin Gaignard)
  - media: chips-media: wave5: Fix device cleanup order to prevent kernel panic (Xulin Sun)
  - media: chips-media: wave5: Fix kthread worker destruction in polling mode (Xulin Sun)
  - media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove() (Haoxiang Li)
  - media: mtk-mdp: Fix error handling in probe function (Haoxiang Li)
  - media: mediatek: encoder: Fix uninitialized scalar variable issue (Irui Wang)
  - dm-verity: correctly handle dm_bufio_client_create() failure (Eric Biggers) {CVE-2026-43132}
  - phy: qcom: edp: Make the number of clocks flexible (Abel Vesa)
  - Revert "PCI: qcom: Enable MSI interrupts together with Link up if 'Global IRQ' is supported" (Niklas Cassel)
  - drm/tests: shmem: Swap names of export tests (Thomas Zimmermann)
  - fpga: dfl: use subsys_initcall to allow built-in drivers to be added (Thadeu Lima de Souza Cascardo)
  - ASoC: SOF: ipc4-control: Keep the payload size up to date (Peter Ujfalusi)
  - ASoC: SOF: ipc4-control: Use the correct size for scontrol->ipc_control_data (Peter Ujfalusi)
  - ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls (Peter Ujfalusi) {CVE-2025-71286}
  - ASoC: SOF: ipc4-control: If there is no data do not send bytes update (Peter Ujfalusi)
  - clk: renesas: rzg2l: Select correct div round macro (Chris Brandt)
  - clk: renesas: rzg2l: Fix intin variable size (Chris Brandt)
  - rpmsg: core: fix race in driver_override_show() and use core helper (Gui-Dong Han) {CVE-2025-71274}
  - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Vahagn Vardanian) {CVE-2026-43233}
  - dpaa2-switch: validate num_ifs to prevent out-of-bounds write (Junrui Luo)
  - net: consume xmit errors of GSO frames (Jakub Kicinski) {CVE-2026-43194}
  - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Jianbo Liu) {CVE-2026-43199}
  - net/mlx5e: Support routed networks during IPsec MACs initialization (Alexandre Cassen)
  - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Shay Drory)
  - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Shay Drory)
  - net/mlx5: DR, Fix circular locking dependency in dump (Shay Drory)
  - RDMA/umem: Fix double dma_buf_unpin in failure path (Jacob Moroni) {CVE-2026-43128}
  - net: usb: pegasus: enable basic endpoint checking (Ziyi Guo) {CVE-2026-43156}
  - RDMA/efa: Fix typo in efa_alloc_mr() (Jason Gunthorpe)
  - net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets (Duoming Zhou)
  - RDMA/core: Fix stale RoCE GIDs during netdev events at registration (Jiri Pirko)
  - tipc: fix duplicate publication key in tipc_service_insert_publ() (Tung Nguyen)
  - kcm: fix zero-frag skb in frag_list on partial sendmsg error (Jiayuan Chen)
  - tls: Fix race condition in tls_sw_cancel_work_tx() (Hyunwoo Kim) [Orabug: 39073883] {CVE-2026-23240}
  - Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ (Luiz Augusto von Dentz) {CVE-2026-43134}
  - Bluetooth: L2CAP: Fix not checking output MTU is acceptable on L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz)
  - Bluetooth: L2CAP: Fix response to L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz)
  - Bluetooth: hci_qca: Cleanup on all setup failures (Jinwang Li)
  - Bluetooth: L2CAP: Fix result of L2CAP_ECRED_CONN_RSP when MTU is too short (Luiz Augusto von Dentz)
  - Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ (Luiz Augusto von Dentz)
  - Remove WARN_ALL_UNSEEDED_RANDOM kernel config option (Linus Torvalds)
  - wifi: cfg80211: wext: fix IGTK key ID off-by-one (Johannes Berg)
  - bnxt_en: Fix deleting of Ntuple filters (Pavan Chebbi)
  - bnxt_en: Fix RSS context delete logic (Pavan Chebbi) {CVE-2026-43260}
  - net: ethernet: xscale: Check for PTP support properly (Linus Walleij)
  - net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() (Vladimir Oltean)
  - net: usb: lan78xx: scan all MDIO addresses on LAN7801 (Martin Pålsson)
  - net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode (Ziyi Guo) {CVE-2026-43180}
  - espintcp: Fix race condition in espintcp_close() (Hyunwoo Kim)
  - xfrm: always flush state and policy upon NETDEV_UNREGISTER event (Tetsuo Handa) {CVE-2026-43167}
  - ipmi: ipmb: initialise event handler read bytes (Matt Johnston)
  - xfrm: skip templates check for packet offload tunnel mode (Leon Romanovsky)
  - xfrm6: fix uninitialized saddr in xfrm6_get_saddr() (Jiayuan Chen) {CVE-2026-43139}
  - ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut (Maciej Grochowski)
  - ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access (Maciej Grochowski)
  - rtc: zynqmp: correct frequency value (Tomas Melin)
  - drm/amd/display: Remove conditional for shaper 3DLUT power-on (Alex Hung)
  - arm64: hugetlbpage: avoid unused-but-set-parameter warning (gcc-16) (Arnd Bergmann)
  - btrfs: replace BUG() with error handling in __btrfs_balance() (Adarsh Das)
  - ALSA: usb-audio: Add sanity check for OOB writes at silencing (Takashi Iwai) {CVE-2026-43279}
  - drm/radeon: Add HAINAN clock adjustment (Decce6)
  - spi: spidev: fix lock inversion between spi_lock and buf_lock (Fabian Godehardt) {CVE-2026-43319}
  - drm/amd/display: bypass post csc for additional color spaces in dal (Clay King)
  - drm/amdgpu: Add HAINAN clock adjustment (Decce6)
  - ALSA: usb-audio: Update the number of packets properly at receiving (Takashi Iwai)
  - drm/amdgpu: Adjust usleep_range in fence wait (Ce Sun)
  - drm/amd/display: Avoid updating surface with the same surface under MPO (Wayne Lin)
  - drm/amd/display: Fix system resume lag issue (Tom Chung)
  - drm/amd/display: Fix writeback on DCN 3.2+ (Alex Hung)
  - ARM: 9467/1: mm: Don't use %pK through printk (Thomas Weißschuh)
  - include: uapi: netfilter_bridge.h: Cover for musl libc (Phil Sutter)
  - ACPI: x86: Force enabling of PWM2 on the Yogabook YB1-X90 (Yauhen Kharuzhy)
  - thermal: int340x: Fix sysfs group leak on DLVR registration failure (Kaushlendra Kumar)
  - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) {CVE-2026-43304}
  - ceph: supply snapshot context in ceph_uninline_data() (Ethanwu)
  - fs/ntfs3: avoid calling run_get_entry() when run == NULL in ntfs_read_run_nb_ra() (Konstantin Komarov)
  - fs/ntfs3: drop preallocated clusters for sparse and compressed files (Konstantin Komarov)
  - fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST (Jaehun Gou)
  - fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata (Jaehun Gou)
  - fs: ntfs3: check return value of indx_find to avoid infinite loop (Jaehun Gou)
  - MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE (John Garry)
  - iio: magnetometer: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
  - iio: Use IRQF_NO_THREAD (Sebastian Andrzej Siewior)
  - mfd: intel-lpss: Add Intel Nova Lake-S PCI IDs (Ilpo Järvinen)
  - Revert "mfd: da9052-spi: Change read-mask to write-mask" (Marcus Folkesson)
  - phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature (Xu Yang)
  - phy: mvebu-cp110-utmi: fix dr_mode property read from dts (Aleksandar Gerasimovski)
  - watchdog: imx7ulp_wdt: handle the nowayout option (Oleksandr Suvorov)
  - binder: don't use %pK through printk (Thomas Weißschuh)
  - fix it87_wdt early reboot by reporting running timer (René Rebe)
  - serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done (Moteen Shah)
  - serial: 8250: 8250_omap.c: Add support for handling UART error conditions (Moteen Shah)
  - staging: rtl8723bs: fix memory leak on failure path (Diksha Kumari)
  - usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke() (Mario Peter)
  - usb: gadget: f_fs: Fix ioctl error handling (Sam Day)
  - usb: gadget: f_fs: fix DMA-BUF OUT queues (Sam Day)
  - misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 (Markus Koch)
  - misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() (Tuo Li)
  - phy: cadence-torrent: restore parent clock for refclk during resume (Thomas Richard)
  - phy: ti: phy-j721e-wiz: restore mux selection during resume (Thomas Richard)
  - dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix warnings (Clément Le Goffic)
  - dmaengine: sun6i: Choose appropriate burst length under maxburst (Chen-Yu Tsai)
  - most: core: fix resource leak in most_register_interface error paths (Navaneeth K)
  - fpga: of-fpga-region: Fail if any bridge is missing (Romain Gantois)
  - usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs (Benson Leung)
  - serial: 8250_dw: handle clock enable errors in runtime_resume (Artem Shimko)
  - staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure (Liang Jie)
  - soundwire: intel_auxdevice: add cs42l45 codec to wake_capable_list (Maciej Strozek)
  - soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15) (Peter Ujfalusi)
  - dmaengine: stm32-dma3: use module_platform_driver (Amelie Delaunay)
  - 9p/xen: protect xen_9pfs_front_free against concurrent calls (Stefano Stabellini)
  - m68k: nommu: fix memmove() with differently aligned src and dest for 68000 (Daniel Palmer)
  - HID: i2c-hid: Add FocalTech FT8112 (Daniel Peng)
  - clk: microchip: core: correct return value on *_get_parent() (Brian Masney)
  - mailbox: sprd: clear delivery flag before handling TX done (Otto Pflüger)
  - remoteproc: mediatek: Break lock dependency to `prepare_lock` (Tzung-Bi Shih)
  - mailbox: sprd: mask interrupts that are not handled (Otto Pflüger)
  - mailbox: imx: Skip the suspend flag for i.MX7ULP (Jacky Bai)
  - mailbox: pcc: Remove spurious IRQF_ONESHOT usage (Mark Brown)
  - remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX channel is uninitialized (Iuliana Prodan)
  - tracing: Fix false sharing in hwlat get_sample() (Colin Lord)
  - riscv: vector: init vector context with proper vlenb (Sergey Matyukevich)
  - scsi: ufs: mediatek: Fix page faults in ufs_mtk_clk_scale() trace event (Keita Morisaki)
  - vhost: fix caching attributes of MMIO regions by setting them explicitly (Kommula Shiva Shankar)
  - scsi: buslogic: Reduce stack usage (Arnd Bergmann)
  - hisi_acc_vfio_pci: update status after RAS error (Longfang Liu)
  - ata: libata: avoid long timeouts on hot-unplugged SATA DAS (Henry Tseng)
  - RDMA/rtrs-clt: For conn rejection use actual err number (Md Haris Iqbal)
  - nfc: nxp-nci: remove interrupt trigger type (Carl Lee)
  - myri10ge: avoid uninitialized variable use (Arnd Bergmann)
  - PCI: Mark Nvidia GB10 to avoid bus reset (Johnny-Cc Chang)
  - PCI: Add ACS quirk for Qualcomm Hamoa & Glymur (Krishna Chaitanya Chundru)
  - PCI: Fix pci_slot_lock () device locking (Keith Busch)
  - PCI/AER: Clear stale errors on reporting agents upon probe (Lukas Wunner)
  - PCI: Mark ASM1164 SATA controller to avoid bus reset (Alex Williamson)
  - vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 (Arnd Bergmann)
  - net: usb: sr9700: remove code to drive nonexistent multicast filter (Ethan Nelson-Moore)
  - bnxt_en: Allow ntuple filters for drops (Joe Damato)
  - wifi: ath10k: fix lock protection in ath10k_wmi_event_peer_sta_ps_state_chg() (Ziyi Guo)
  - wifi: rtw89: pci: restore LDO setting after device resume (Dian-Syuan Yang)
  - net: sfp: add quirk for Lantech 8330-265D (Marek Behún)
  - octeontx2-af: Workaround SQM/PSE stalls by disabling sticky (Geetha Sowjanya)
  - Bluetooth: btusb: Add device ID for Realtek RTL8761BU (Jacopo Scannella)
  - Bluetooth: btusb: Add new VID/PID for RTL8852CE (Shell Chen)
  - Bluetooth: hci_conn: use mod_delayed_work for active mode timeout (Stefan Sørensen)
  - Bluetooth: hci_conn: Set link_policy on incoming ACL connections (Stefan Sørensen)
  - Bluetooth: btusb: Add support for MediaTek7920 0489:e158 (Andrew Elantsev)
  - ipv4: fib: Annotate access to struct fib_alias.fa_state. (Kuniyuki Iwashima)
  - wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() (Ziyi Guo)
  - wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() (Ziyi Guo)
  - net: hns3: extend HCLGE_FD_AD_QID to 11 bits (Jijie Shao)
  - ipv4: igmp: annotate data-races around idev->mr_maxdelay (Eric Dumazet)
  - gro: change the BUG_ON() in gro_pull_from_frag0() (Eric Dumazet)
  - ext4: propagate flags to convert_initialized_extent() (Ojaswin Mujoo)
  - wifi: rtw89: 8922a: add digital compensation for 2GHz (Po-Hao Huang)
  - wifi: rtw89: fix unable to receive probe responses under MLO connection (Po-Hao Huang)
  - wifi: iwlwifi: mvm: check the validity of noa_len (Miri Korenblit)
  - net: usb: r8152: fix transmit queue timeout (Mingj Ye)
  - openrisc: define arch-specific version of nop() (Brian Masney)
  - netfilter: xt_tcpmss: check remaining length before reading optlen (Florian Westphal) {CVE-2026-43190}
  - netfilter: nf_conntrack: Add allow_clash to generic protocol handler (Yuto Hamaguchi)
  - ext4: use reserved metadata blocks when splitting extent on endio (Zhang Yi)
  - ext4: mark group extend fast-commit ineligible (Li Chen)
  - ext4: move ext4_percpu_param_init() before ext4_mb_init() (Baokun Li) {CVE-2026-43288}
  - ext4: mark group add fast-commit ineligible (Li Chen)
  - ipv6: exthdrs: annotate data-race over multiple sysctl (Eric Dumazet)
  - ipv6: annotate data-races over sysctl.flowlabel_reflect (Eric Dumazet)
  - ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}() (Eric Dumazet)
  - wifi: cfg80211: allow only one NAN interface, also in multi radio (Miri Korenblit)
  - wifi: ath12k: fix preferred hardware mode calculation (Baochen Qiang)
  - wifi: ath11k: Fix failure to connect to a 6 GHz AP (Qian Zhang)
  - wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1 (Ross Vandegrift)
  - wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode (Chin-Yen Lee)
  - wifi: rtw89: mac: correct page number for CSI response (Ping-Ke Shih)
  - iommu/amd: move wait_on_sem() out of spinlock (Ankit Soni) {CVE-2026-43253}
  - wifi: libertas: fix WARNING in usb_tx_block (Szymon Wilczek) {CVE-2026-43255}
  - net: wwan: mhi: Add network support for Foxconn T99W760 (Slark Xiao)
  - iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency (Alexander Grest)
  - dm: remove fake timeout to avoid leak request (Ding Hui) {CVE-2026-43314}
  - dm: replace -EEXIST with -EBUSY (Daniel Gomez)
  - wifi: rtw88: Fix inadvertent sharing of struct ieee80211_supported_band data (Bitterblue Smith)
  - wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() (Bitterblue Smith) {CVE-2025-71273}
  - wifi: rtw89: ser: enable error IMR after recovering from L1 (Zong-Zhe Yang)
  - wifi: rtw89: 8922a: set random mac if efuse contains zeroes (Jose Ignacio Tornos Martinez)
  - wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H (Hsiu-Ming Chang)
  - wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() (Bitterblue Smith) {CVE-2025-71297}
  - wifi: rtw88: fix DTIM period handling when conf->dtim_period is zero (Roman Peshkichev)
  - jfs: nlink overflow in jfs_rename (Jori Koolstra)
  - jfs: Add missing set_freezable() for freezable kthread (Xu Wang)
  - ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio (Lianqin Hu)
  - ALSA: mixer: oss: Add card disconnect checkpoints (Takashi Iwai) {CVE-2026-43126}
  - ALSA: hda/realtek - Enable mute LEDs on HP ENVY x360 15-es0xxx (Illia Barbashyn)
  - ASoC: fsl: imx-rpmsg: use snd_soc_find_dai_with_mutex() in probe (Ziyi Guo)
  - spi: geni-qcom: Fix abort sequence execution for serial engine errors (Praveen Talari)
  - ASoC: SOF: Intel: hda: Fix NULL pointer dereference (Ranjani Sridharan) {CVE-2026-43137}
  - power: sequencing: fix missing state_lock in pwrseq_power_on() error path (Ziyi Guo)
  - modpost: Amend ppc64 save/restfpr symnames for -Os build (René Rebe)
  - ASoC: es8328: Add error unwind in resume (Hsieh Hung-En)
  - HID: logitech-hidpp: Add support for Logitech K980 (Bastien Nocera)
  - hwmon: (f71882fg) Add F81968 support (Ji-Ze Hong)
  - hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE (Denis Pauk)
  - hwmon: (dell-smm) Add support for Dell OptiPlex 7080 (Armin Wolf)
  - ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in max98390_i2c_probe() (Chen Ni)
  - drm/amd/display: avoid dig reg access timeout on usb4 link training fail (Zhongwei)
  - drm/amd/display: Fix GFX12 family constant checks (Matthew Stewart)
  - spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end (Chin-Ting Kuo)
  - ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio (Chen Ni)
  - gpio: aspeed-sgpio: Change the macro to support deferred probe (Billy Tsai)
  - ALSA: hda/realtek: fix LG Gram Style 14 speakers (Damien Dagorn)
  - ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro (Gongqi)
  - HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK (David Phillips)
  - HID: multitouch: add eGalaxTouch EXC3188 support (Thorsten Schmelzer)
  - media: rkisp1: Fix filter mode register configuration (Rui Wang)
  - drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release (Ludovic Desroches)
  - drm/atmel-hlcdc: don't reject the commit if the src rect has fractional parts (Ludovic Desroches)
  - drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback (Ludovic Desroches)
  - drm/amd/display: Disable FEC when powering down encoders (Ovidiu Bunea)
  - PCI: Add Intel Nova Lake audio Device ID (Peter Ujfalusi)
  - ASoC: soc-acpi-intel-arl-match: change rt722 amp endpoint to aggregated (Bard Liao)
  - virt: vbox: uapi: Mark inner unions in packed structs as packed (Thomas Weißschuh)
  - hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed (Thomas Weißschuh)
  - drm: Account property blob allocations to memcg (Xiao Kan) {CVE-2026-43287}
  - drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map() (Donet Tom)
  - drm/amdkfd: Relax size checking during queue buffer get (Donet Tom)
  - ALSA: hda/realtek: add HP Victus 16-e0xxx mute LED quirk (Bharat Dev Burman)
  - media: ipu6: Always close firmware stream (Sakari Ailus)
  - media: ipu6: Close firmware streams on streaming enable failure (Sakari Ailus)
  - media: ipu6: Ensure stream_mutex is acquired when dealing with node list (Sakari Ailus)
  - media: mt9m114: Return -EPROBE_DEFER if no endpoint is found (Hans de Goede)
  - media: mt9m114: Avoid a reset low spike during probe() (Hans de Goede)
  - media: v4l2-async: Fix error handling on steps after finding a match (Sakari Ailus) {CVE-2026-43189}
  - media: cx25821: Fix a resource leak in cx25821_dev_setup() (Haoxiang Li)
  - media: solo6x10: Check for out of bounds chip_id (Kees Cook) {CVE-2026-43316}
  - media: pvrusb2: fix URB leak in pvr2_send_request_ex (Szymon Wilczek) {CVE-2026-43223}
  - media: adv7180: fix frame interval in progressive mode (Thorsten Schmelzer)
  - drm/panel: Fix a possible null-pointer dereference in jdi_panel_dsi_remove() (Tuo Li)
  - media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START (Ming Qian)
  - spi: spi-mem: Limit octal DTR constraints to octal DTR situations (Miquel Raynal)
  - ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug (Sebastian Krzyszkowiak)
  - ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask (Sebastian Krzyszkowiak)
  - drm/xe: Only toggle scheduling in TDR if GuC is running (Matthew Brost)
  - drm/amd/display: only power down dig on phy endpoints (Dmytro Laktyushkin)
  - drm/amdgpu: Skip loading SDMA_RS64 in VF (Yubiao Wang)
  - HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards (Joey Bednar)
  - drm/amd/display: Add signal type check for dcn401 get_phyd32clk_src (Dmytro Laktyushkin) {CVE-2026-43243}
  - drm/amdgpu: avoid a warning in timedout job handler (Alex Deucher)
  - drm/amd/display: Fix dsc eDP issue (Charlene Liu) {CVE-2026-43320}
  - drm/amdgpu: add support for HDP IP version 6.1.1 (Tim Huang)
  - media: mediatek: vcodec: Don't try to decode 422/444 VP9 (Nicolas Dufresne)
  - media: chips-media: wave5: Process ready frames when CMD_STOP sent to Encoder (Brandon Brnich)
  - media: chips-media: wave5: Fix conditional in start_streaming (Brandon Brnich)
  - media: omap3isp: set initial format (Hans Verkuil)
  - media: omap3isp: isppreview: always clamp in preview_try_format() (Hans Verkuil)
  - media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes (Hans Verkuil)
  - drm/v3d: Set DMA segment size to avoid debug warnings (Xiaolei Wang)
  - spi: stm32: fix Overrun issue at < 8bpw (Deepak Kumar)
  - media: dvb-core: dmxdevfilter must always flush bufs (Hans Verkuil)
  - ASoC: SOF: ipc4: Support for sending payload along with LARGE_CONFIG_GET (Peter Ujfalusi)
  - drm/amd/display: Add USB-C DP Alt Mode lane limitation in DCN32 (Lincheng Ku)
  - spi-geni-qcom: use xfer->bits_per_word for can_dma() (Jonathan Marek)
  - spi-geni-qcom: initialize mode related registers to 0 (Jonathan Marek)
  - drm/amdkfd: Handle GPU reset and drain retry fault race (Philip Yang)
  - drm/amdgpu: fix NULL pointer issue buffer funcs (Likun Gao) {CVE-2025-71294}
  - gpu/panel-edp: add AUO panel entry for B140HAN06.4 (Alexey Klimov)
  - drm/display/dp_mst: Add protection against 0 vcpi (Suraj Kandpal)
  - parisc: Prevent interrupts during reboot (Helge Deller)
  - arm64: tegra: smaug: Add usb-role-switch support (Diogo Ivo)
  - Revert "arm64: zynqmp: Add an OP-TEE node to the device tree" (Tomas Melin)
  - firmware: arm_ffa: Unmap Rx/Tx buffers on init failure (Haoxiang Li)
  - pstore: ram_core: fix incorrect success return when vmap() fails (Ruipeng Qi) {CVE-2026-43124}
  - sched/debug: Fix updating of ppos on server write ops (Joel Fernandes)
  - char: tpm: cr50: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
  - mailbox: bcm-ferxrm-mailbox: Use default primary handler (Sebastian Andrzej Siewior)
  - crypto: hisilicon/qm - move the barrier before writing to the mailbox register (Chenghai Huang)
  - PCI/MSI: Unmap MSI-X region on error (Haoxiang Li)
  - clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on OF (Bartosz Golaszewski)
  - clocksource/drivers/sh_tmu: Always leave device running after probe (Niklas Söderlund)
  - bpf: Recognize special arithmetic shift in the verifier (Alexei Starovoitov)
  - bpf: crypto: Use the correct destructor kfunc type (Sami Tolvanen) {CVE-2026-43306}
  - perf/x86/cstate: Add Airmont NP (Martin Schiller)
  - perf/x86/msr: Add Airmont NP (Martin Schiller)
  - bpf: verifier improvement in 32bit shift sign extension pattern (Cupertino Miranda)
  - sparc: don't reference obsolete termio struct for TC* constants (Sam James)
  - sparc: Synchronize user stack on fork and clone (Andreas Larsson)
  - block: decouple secure erase size limit from discard size limit (Luke Wang)
  - blk-mq-debugfs: add missing debugfs_mutex in blk_mq_debugfs_register_hctxs() (Yu Kuai)
  - xenbus: Use .freeze/.thaw to handle xenbus devices (Jason Andryuk)
  - ACPI: battery: fix incorrect charging status when current is zero (Ata İLhan Köktürk)
  - ACPI: x86: s2idle: Invoke Microsoft _DSM Function 9 (Turn On Display) (Jakob Riemenschneider)
  - perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD (Sebastian Andrzej Siewior)
  - s390/perf: Disable register readout on sampling events (Thomas Richter)
  - cpufreq: dt-platdev: Block the driver from probing on more QC platforms (Konrad Dybcio)
  - md-cluster: fix NULL pointer dereference in process_metadata_update (Jiasheng Jiang) {CVE-2026-43271}
  - alpha: fix user-space corruption during memory compaction (Magnus Lindholm)
  - powercap: intel_rapl: Add PL4 support for Ice Lake (Daniel Tang)
  - ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP (Armin Wolf)
  - ACPI: resource: Add JWIPC JVC9100 to irq1_level_low_skip_override[] (Ai Chao)
  - ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4() (Tuo Li) {CVE-2026-43313}
  - EFI/CPER: don't go past the ARM processor CPER record buffer (Mauro Carvalho Chehab) {CVE-2026-43266}
  - APEI/GHES: ARM processor Error: don't go past allocated memory (Mauro Carvalho Chehab) {CVE-2026-43201}
  - APEI/GHES: ensure that won't go past CPER allocated record (Mauro Carvalho Chehab) {CVE-2026-43277}
  - EFI/CPER: don't dump the entire memory region (Mauro Carvalho Chehab) {CVE-2026-43171}
  - x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE is set (Hou Wenlong)
  - rnbd-srv: Zero the rsp buffer before using it (Md Haris Iqbal)
  - arm64: Add support for TSV110 Spectre-BHB mitigation (Jinqian Yang) {CVE-2026-43261}
  - perf/arm-cmn: Support CMN-600AE (Robin Murphy)
  - s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS (Heiko Carstens)
  - tools/power cpupower: Reset errno before strtoull() (Kaushlendra Kumar)
  - smb: client: prevent races in ->query_interfaces() (Henrique Carvalho) {CVE-2026-43239}
  - gfs2: fiemap page fault fix (Andreas Gruenbacher) {CVE-2026-43262}
  - smb: client: add proper locking around ses->iface_last_update (Henrique Carvalho)
  - btrfs: handle user interrupt properly in btrfs_trim_fs() (Jinbaohong)
  - btrfs: fallback to buffered IO if the data profile has duplication (Qu Wenruo)
  - dlm: validate length in dlm_search_rsb_tree (Ziming Zhang) {CVE-2026-43125}
  - minix: Add required sanity checking to minix_check_superblock() (Jori Koolstra)
  - i3c: mipi-i3c-hci: Reset RING_OPERATION1 fields during init (Adrian Hunter)
  - i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr() (Frank Li)
  - hfsplus: pretend special inodes as regular files (Tetsuo Handa)
  - audit: add missing syscalls to read class (Jeffrey Bencteux)
  - fs/buffer: add alert in try_to_free_buffers() for folios without buffers (Deepakkumar Karn) {CVE-2025-71295}
  - hfsplus: fix volume corruption issue for generic/498 (Viacheslav Dubeyko)
  - audit: add fchmodat2() to change attributes class (Jeffrey Bencteux)
  - statmount: permission check should return EPERM (Bhavik Sachdev)
  - rtc: interface: Alarm race handling should not discard preceding error (Anthony Pighin)
  - libperf build: Always place libperf includes first (Ian Rogers)
  - libperf: Don't remove -g when EXTRA_CFLAGS are used (James Clark)
  - perf vendor events amd: Fix Zen 5 MAB allocation events (Sandipan Das)
  - perf annotate: Fix memcpy size in arch__grow_instructions() (Suchit Karunakaran)
  - perf maps: Fix reference count leak in maps__find_ams() (Ian Rogers)
  - libsubcmd: Fix null intersection case in exclude_cmds() (Sri Jayaramappa)
  - perf callchain: Fix srcline printing with inlines (Ian Rogers)
  - perf unwind-libdw: Fix invalid reference counts (Ian Rogers)
  - perf test stat tests: Fix for virtualized machines (Thomas Richter)
  - perf test stat: Update test expectations and events (Ian Rogers)
  - ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names (Shengjiu Wang)
  - ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names (Shengjiu Wang)
  - ASoC: dt-bindings: asahi-kasei,ak4458: set unevaluatedProperties:false (Shengjiu Wang)
  - dt-bindings: phy: qcom-edp: Add missing clock for X Elite (Abel Vesa)
  - SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path (Daniel Hodges)
  - SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths (Chuck Lever)
  - Drivers: hv: vmbus: Use kthread for vmbus interrupts on PREEMPT_RT (Jan Kiszka)
  - ata: libata-scsi: refactor ata_scsi_translate() (Damien Le Moal)
  - ata: pata_ftide010: Fix some DMA timings (Linus Walleij)
  - ext4: use optimized mballoc scanning regardless of inode format (Jan Kara)
  - ext4: fix dirtyclusters double decrement on fs shutdown (Brian Foster)
  - ext4: fix e4b bitmap inconsistency reports (Yongjian Sun)
  - ext4: fix memory leak in ext4_ext_shift_extents() (Zilin Guan)
  - ext4: drop extent cache when splitting extent fails (Zhang Yi)
  - ext4: drop extent cache after doing PARTIAL_VALID1 zeroout (Zhang Yi)
  - ext4: don't cache extent during splitting extent (Zhang Yi)
  - ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 (Zhang Yi)
  - ext4: subdivide EXT4_EXT_DATA_VALID1 (Zhang Yi)
  - MIPS: Work around LLVM bug when gp is used as global register variable (Yao Zi)
  - drm/amd/display: Use same max plane scaling limits for all 64 bpp formats (Mario Kleiner)
  - ASoC: rockchip: i2s-tdm: Use param rate if not provided by set_sysclk (Detlev Casanova)
  - x86/hyperv: Fix error pointer dereference (Ethan Tidmore)
  - btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found (Filipe Manana)
  - btrfs: use the correct type to initialize block reserve for delayed refs (Filipe Manana)
  - efi: Fix reservation of unaccepted memory table (Kiryl Shutsemau)
  - drm/xe/xe2_hpg: Fix handling of Wa_14019988906 & Wa_14019877138 (Matt Roper)
  - drm/xe/xe2_hpg: Add set of workarounds (Shekhar Chauhan)
  - drm/xe/ptl: Apply Wa_13011645652 (Vinay Belgaumkar)
  - drm/xe/mmio: Avoid double-adjust in 64-bit reads (Shuicheng Lin)
  - drm/xe: Switch MMIO interface to take xe_mmio instead of xe_gt (Matt Roper)
  - drm/xe: Adjust mmio code to pass VF substructure to SRIOV code (Matt Roper)
  - drm/xe: Add xe_tile backpointer to xe_mmio (Matt Roper)
  - drm/xe: Switch mmio_ext to use 'struct xe_mmio' (Matt Roper)
  - drm/xe: Populate GT's mmio iomap from tile during init (Matt Roper)
  - drm/xe: Move GSI offset adjustment fields into 'struct xe_mmio' (Matt Roper)
  - drm/xe: Clarify size of MMIO region (Matt Roper)
  - drm/xe: Create dedicated xe_mmio structure (Matt Roper)
  - drm/xe: Move forcewake to 'gt.pm' substructure (Matt Roper)
  - s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n (Alexander Egorenkov)
  - spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe() (Felix Gu)
  - drm/amd/display: Fix out-of-bounds stream encoder index v3 (Srinivasan Shanmugam)
  - drm/amd/display: Reject cursor plane on DCE when scaled differently than primary (Timur Kristóf)
  - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (Srinivasan Shanmugam)
  - ASoC: codecs: aw88261: Fix erroneous bitmask logic in Awinic init (Alexandre Ferrieux)
  - drm/i915/acpi: free _DSM package when no connectors (Kaushlendra Kumar)
  - ASoC: fsl_xcvr: Revert fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
  - drm/amdgpu: Fix memory leak in amdgpu_ras_init() (Zilin Guan)
  - drm/amdgpu: Use kvfree instead of kfree in amdgpu_gmc_get_nps_memranges() (Zilin Guan)
  - drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() (Zilin Guan)
  - apparmor: fix aa_label to return state from compount and component match (John Johansen)
  - apparmor: fix invalid deref of rawdata when export_binary is unset (Georgia Garcia)
  - apparmor: avoid per-cpu hold underflow in aa_get_buffer (Zhengmian Hu)
  - apparmor: make label_match return a consistent value (John Johansen)
  - apparmor: remove apply_modes_to_perms from label_match (John Johansen)
  - apparmor: fix rlimit for posix cpu timers (John Johansen)
  - apparmor: return -ENOMEM in unpack_perms_table upon alloc failure (Ryan Lee)
  - apparmor: Fix & Optimize table creation from possibly unaligned memory (Helge Deller)
  - AppArmor: Allow apparmor to handle unaligned dfa tables (Helge Deller)
  - apparmor: fix NULL sock in aa_sock_file_perm (John Johansen)
  - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Cosmin Ratiu)
  - net/mlx5: Fix multiport device check over light SFs (Shay Drory)
  - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (Hangbin Liu)
  - octeontx2-af: Fix default entries mcam entry action (Hariprasad Kelam)
  - icmp: prevent possible overflow in icmp_global_allow() (Eric Dumazet)
  - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Eric Dumazet) [Orabug: 39110677] {CVE-2026-23273}
  - ping: annotate data-races in ping_lookup() (Eric Dumazet)
  - bpftool: Fix truncated netlink dumps (Jakub Kicinski)
  - ipv6: fix a race in ip6_sock_set_v6only() (Eric Dumazet)
  - net: remove WARN_ON_ONCE when accessing forward path array (Pablo Neira Ayuso)
  - ipvs: do not keep dest_dst if dev is going down (Julian Anastasov)
  - netfilter: nf_conntrack_h323: don't pass uninitialised l3num value (Florian Westphal)
  - selftests: forwarding: vxlan_bridge_1d_ipv6: fix test failure with br_netfilter enabled (Aleksei Oladko)
  - selftests: forwarding: vxlan_bridge_1d: fix test failure with br_netfilter enabled (Aleksei Oladko)
  - net: bridge: mcast: always update mdb_n_entries for vlan contexts (Nikolay Aleksandrov)
  - xen-netback: reject zero-queue configuration from guest (Ziyi Guo)
  - net: usb: catc: enable basic endpoint checking (Ziyi Guo)
  - net: sparx5/lan969x: fix PTP clock max_adj value (Daniel Machon)
  - ipv6: Fix out-of-bound access in fib6_add_rt2node(). (Kuniyuki Iwashima)
  - net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj() (Ziyi Guo)
  - net: mscc: ocelot: split xmit into FDMA and register injection paths (Ziyi Guo)
  - net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (Ziyi Guo)
  - net: sparx5/lan969x: fix DWRR cost max to match hardware register width (Daniel Machon)
  - selftests: mlxsw: tc_restrictions: Fix test failure with new iproute2 (Ido Schimmel)
  - cpuidle: Skip governor when only one idle state is available (Aboorva Devarajan)
  - ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO (Zhai Can)
  - objpool: fix the overestimation of object pooling metadata size (Zhouwenhao)
  - selftests/memfd: use IPC semaphore instead of SIGSTOP/SIGCONT (Aristeu Rozanski)
  - kbuild: Add objtool to top-level clean target (Josh Poimboeuf)
  - powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check (Kuppuswamy Sathyanarayanan)
  - ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs (Sean V Kelley)
  - fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot (Jiasheng Jiang)
  - fs/ntfs3: prevent infinite loops caused by the next valid being the same (Edward Adam Davis)
  - fs/ntfs3: Initialize new folios before use (Bartlomiej Kubik)
  - io_uring/cancel: de-unionize file and user_data in struct io_cancel_data (Jens Axboe)
  - drbd: always set BLK_FEAT_STABLE_WRITES (Christoph Böhmwalder)
  - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Jared Kangas)
  - backlight: qcom-wled: Change PM8950 WLED configurations (Barnabás Czémán)
  - backlight: qcom-wled: Support ovp values for PMI8994 (Barnabás Czémán)
  - leds: qcom-lpg: Check the return value of regmap_bulk_write() (Xu Wang)
  - pinctrl: single: fix refcount leak in pcs_add_gpio_func() (Wei Li)
  - pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition (Luca Weiss)
  - iio: sca3000: Fix a resource leak in sca3000_probe() (Harshit Mogalapalli)
  - ovl: Fix uninit-value in ovl_fill_real (Qing Wang)
  - pinctrl: equilibrium: Fix device node reference leak in pinbank_init() (Felix Gu)
  - usb: bdc: fix sleep during atomic (Justin Chen)
  - drivers: iio: mpu3050: use dev_err_probe for regulator request (Svyatoslav Ryhel)
  - mfd: simple-mfd-i2c: Add Delta TN48M CPLD support (Robert Marko)
  - mfd: simple-mfd-i2c: Keep compatible strings in alphabetical order (Ioana Ciornei)
  - mfd: simple-mfd-i2c: Add SpacemiT P1 support (Alex Elder)
  - mfd: simple-mfd-i2c: Add compatible strings for Layerscape QIXIS FPGA (Ioana Ciornei)
  - mfd: simple-mfd-i2c: Add MAX77705 support (Dzmitry Sankouski)
  - mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure (Xu Wang)
  - Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms" (Greg Kroah-Hartman)
  - phy: freescale: imx8qm-hsio: fix NULL pointer dereference (Thomas Richard)
  - coresight: etm3x: Fix cpulocked warning on cpuhp (Antonio Borneo)
  - watchdog: starfive-wdt: Fix PM reference leak in probe error path (Kery Qi)
  - iio: pressure: mprls0025pa: fix pressure calculation (Petre Rodan)
  - iio: pressure: mprls0025pa: fix scan_type struct (Petre Rodan)
  - iio: pressure: mprls0025pa: fix interrupt flag (Petre Rodan)
  - iio: pressure: mprls0025pa: fix SPI CS delay violation (Petre Rodan)
  - iio: pressure: mprls0025pa: fix spi_transfer struct initialisation (Petre Rodan)
  - mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms (Matthew Schwartz)
  - serial: SH_SCI: improve "DMA support" prompt (Randy Dunlap)
  - serial: imx: change SERIAL_IMX_CONSOLE to bool (Randy Dunlap)
  - staging: greybus: lights: avoid NULL deref (Chaitanya Mishra)
  - iio: test: drop dangling symbol in gain-time-scale helpers (Randy Dunlap)
  - soundwire: intel_ace2x: add SND_HDA_CORE dependency (Arnd Bergmann)
  - dma: dma-axi-dmac: fix HW scatter-gather not looking at the queue (Nuno Sa)
  - dma: dma-axi-dmac: fix SW cyclic transfers (Nuno Sa)
  - dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX (AngeloGioacchino Del Regno)
  - interconnect: mediatek: Aggregate bandwidth with saturating add (Nicolas Frattaroli)
  - interconnect: mediatek: Don't hijack parent device (Nicolas Frattaroli)
  - clk: mediatek: Fix error handling in runtime PM setup (Xu Wang)
  - clk: qcom: gfx3d: add parent to parent request map (Dmitry Baryshkov)
  - clk: qcom: dispcc-sm7150: Fix dispcc_mdss_pclk1_clk_src (David Heidelberger)
  - clk: qcom: dispcc-sdm845: Enable parents for pixel clocks (Petr Hodina)
  - clk: Move clk_{save,restore}_context() to COMMON_CLK section (Geert Uytterhoeven)
  - clk: qcom: gcc-ipq5018: flag sleep clock as critical (George Moussalem)
  - clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc (Barnabás Czémán)
  - clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc (Barnabás Czémán)
  - clk: qcom: gcc-qdu1000: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
  - clk: qcom: gcc-x1e80100: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
  - clk: qcom: gcc-sdx75: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
  - clk: qcom: gcc-sm4450: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
  - clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
  - clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs (Martin Blumenstingl)
  - clk: qcom: rcg2: compute 2d using duty fraction directly (Taniya Das)
  - clk: qcom: gcc-sm8650: Use floor ops for SDCC RCGs (Vladimir Zapolskiy)
  - clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs (Vladimir Zapolskiy)
  - fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe() (Felix Gu)
  - fbdev: of_display_timing: Fix device node reference leak in of_get_display_timings() (Felix Gu)
  - tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros (Steven Rostedt)
  - tracing: Properly process error handling in event_hist_trigger_parse() (Miaoqian Lin)
  - fs/nfs: Fix readdir slow-start regression (Sagi Grimberg)
  - nvdimm: virtio_pmem: serialize flush requests (Li Chen)
  - scsi: csiostor: Fix dereference of null pointer rn (Colin Ian King)
  - scsi: ufs: host: mediatek: Require CONFIG_PM (Arnd Bergmann)
  - scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (Zilin Guan)
  - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia)
  - RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc (Liuyi)
  - power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer (Val Packett)
  - power: supply: pm8916_lbc: Fix use-after-free for extcon in IRQ handler (Waqar Hameed)
  - mtd: spinand: Fix kernel doc (Miquel Raynal)
  - mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions() (Weigang He)
  - cxl: Fix premature commit_end increment on decoder commit failure (Yuxiong Wang)
  - RDMA/core: add rdma_rw_max_sge() helper for SQ sizing (Chuck Lever)
  - RDMA/rxe: Fix race condition in QP timer handlers (Li Zhijian)
  - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Zilin Guan)
  - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (Liuyi)
  - NFS/localio: use GFP_NOIO and non-memreclaim workqueue in nfs_local_commit (Mike Snitzer)
  - nfs/localio: eliminate unnecessary kref in nfs_local_fsync_ctx (Mike Snitzer)
  - mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse() (Zilin Guan)
  - crypto: ccp - Send PSP_CMD_TEE_RING_DESTROY when PSP_CMD_TEE_RING_INIT fails (Mario Limonciello)
  - crypto: ccp - Factor out ring destroy handling to a helper (Mario Limonciello)
  - crypto: ccp - Add an S4 restore flow (Mario Limonciello)
  - crypto: ccp - Declare PSP dead if PSP_CMD_TEE_RING_INIT fails (Mario Limonciello)
  - platform/x86/amd/pmf: Prevent TEE errors after hibernate (Shyam Sundar S K)
  - vfio/pci: Lock upstream bridge for vfio_pci_core_disable() (Anthony Pighin)
  - mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper (Alok Tiwari)
  - IB/mlx5: Fix port speed query for representors (Or Har-Toov)
  - RDMA/mlx5: Fix UMR hang in LAG error state unload (Chiara Meiohas)
  - tools/power/x86/intel-speed-select: Fix file descriptor leak in isolate_cpus() (Malaya Kumar Rout)
  - RDMA/iwcm: Fix workqueue list corruption by removing work_list (Jacob Moroni)
  - RDMA/rxe: Fix double free in rxe_srq_from_init (Jiasheng Jiang)
  - RDMA/rtrs-srv: fix SG mapping (Roman Pen)
  - power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed() (Waqar Hameed)
  - power: supply: bq27xxx: fix wrong errno when bus ops are unsupported (Xu Wang)
  - power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write (Alexander Koskovich)
  - power: supply: sbs-battery: Fix use-after-free in power_supply_changed() (Waqar Hameed)
  - power: supply: rt9455: Fix use-after-free in power_supply_changed() (Waqar Hameed)
  - power: supply: pm8916_lbc: Fix use-after-free in power_supply_changed() (Waqar Hameed)
  - power: supply: pm8916_bms_vm: Fix use-after-free in power_supply_changed() (Waqar Hameed)
  - power: supply: goldfish: Fix use-after-free in power_supply_changed() (Waqar Hameed)
  - power: supply: cpcap-battery: Fix use-after-free in power_supply_changed() (Waqar Hameed)
  - power: supply: bq25980: Fix use-after-free in power_supply_changed() (Waqar Hameed)
  - power: supply: bq256xx: Fix use-after-free in power_supply_changed() (Waqar Hameed)
  - power: supply: act8945a: Fix use-after-free in power_supply_changed() (Waqar Hameed)
  - power: supply: ab8500: Fix use-after-free in power_supply_changed() (Waqar Hameed)
  - RDMA/hns: Notify ULP of remaining soft-WCs during reset (Chengchang Tang)
  - RDMA/hns: Fix RoCEv1 failure due to DSCP (Junxian Huang)
  - RDMA/hns: Fix WQ_MEM_RECLAIM warning (Chengchang Tang)
  - IB/cache: update gid cache on client reregister event (Etienne Aujames)
  - RDMA/rtrs: server: remove dead code (Lihonggang)
  - octeontx2-pf: Unregister devlink on probe failure (Hariprasad Kelam)
  - octeon_ep_vf: ensure dbell BADDR updation (Vimlesh Kumar)
  - octeon_ep: ensure dbell BADDR updation (Vimlesh Kumar)
  - octeon_ep: disable per ring interrupts (Vimlesh Kumar)
  - serial: caif: fix use-after-free in caif_serial ldisc_close() (Jiayuan Chen)
  - xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (Jiayuan Chen)
  - net: Switch to skb_dstref_steal/skb_dstref_restore for ip_route_input callers (Stanislav Fomichev)
  - net: Add skb_dstref_steal and skb_dstref_restore (Stanislav Fomichev)
  - net: sunhme: Fix sbus regression (René Rebe)
  - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (Jiayuan Chen) [Orabug: 39188476] {CVE-2026-31411}
  - smb: client: correct value for smbd_max_fragmented_recv_size (Stefan Metzmacher)
  - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (Jinliang Zheng)
  - net: hns3: fix double free issue for tx spare buffer (Jian Shen)
  - PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404] (Nicolas Cavallari)
  - netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (Pablo Neira Ayuso)
  - netfilter: nft_set_rbtree: fix bogus EEXIST with NLM_F_CREATE with null interval (Pablo Neira Ayuso)
  - netfilter: nft_counter: fix reset of counters on 32bit archs (Anders Grahn)
  - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal)
  - netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Florian Westphal)
  - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Scott Mitchell)
  - nfc: hci: shdlc: Stop timers and work before freeing context (Victoria Votokina)
  - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Eric Dumazet)
  - bonding: only set speed/duplex to unknown, if getting speed failed (Thomas Bogendoerfer)
  - mptcp: fix receive space timestamp initialization (Paolo Abeni)
  - of: unittest: fix possible null-pointer dereferences in of_unittest_property_copy() (Tuo Li)
  - ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit() (Ondrej Mosnacek)
  - ipc: don't audit capability check in ipc_permissions() (Ondrej Mosnacek)
  - selftests/mm: convert page_size to unsigned long (Siddarth G)
  - selftests/mm: pagemap_ioctl: Fix types mismatches shown by compiler options (Muhammad Usama Anjum)
  - PCI/ACPI: Restrict program_hpx_type2() to AER bits (Håkon Bugge)
  - PCI: Add defines for bridge window indexing (Ilpo Järvinen)
  - PCI: Initialize RCB from pci_configure_device() (Håkon Bugge)
  - wifi: ath10k: sdio: add missing lock protection in ath10k_sdio_fw_crashed_dump() (Ziyi Guo)
  - PCI: Check parent for NULL in of_pci_bus_release_domain_nr() (Sergey Shtylyov)
  - tcp: tcp_tx_timestamp() must look at the rtx queue (Eric Dumazet)
  - fat: avoid parent link count underflow in rmdir (Zhiyu Zhang)
  - nfsd: never defer requests during idmap lookup (Anthony Iliopoulos)
  - xdrgen: Initialize data pointer for zero-length items (Chuck Lever)
  - NFS: NFSERR_INVAL is not defined by NFSv2 (Chuck Lever)
  - xdrgen: Fix struct prefix for typedef types in program wrappers (Chuck Lever)
  - dm: use bio_clone_blkg_association (Mikulas Patocka)
  - iommu/vt-d: Clear Present bit before tearing down PASID entry (Lu Baolu)
  - iommu/vt-d: Avoid draining PRQ in sva mm release path (Lu Baolu)
  - iommu/vt-d: Drain PRQs when domain removed from RID (Lu Baolu)
  - iommu/vt-d: Separate page request queue from SVM (Joel Granados)
  - iommu/vt-d: Flush cache for PASID table before using it (Dmytro Maluka)
  - PCI: Mark 3ware-9650SA Root Port Extended Tags as broken (Jörg Wedekind)
  - kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup() (Petr Mladek)
  - module: add helper function for reading module_buildid() (Petr Mladek)
  - netfilter: nf_conncount: fix tracking of connections from localhost (Fernando Fernandez Mancera)
  - netfilter: nft_compat: add more restrictions on netlink attributes (Florian Westphal)
  - netfilter: nf_conncount: increase the connection clean up limit to 64 (Fernando Fernandez Mancera)
  - netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH (Fernando Fernandez Mancera)
  - netfilter: nf_tables: reset table validation state on abort (Florian Westphal)
  - wifi: cfg80211: stop NAN and P2P in cfg80211_leave (Miri Korenblit)
  - mctp i2c: initialise event handler read bytes (Matt Johnston)
  - net: mctp-i2c: fix duplicate reception of old data (Jian Zhang)
  - quota: fix livelock between quotactl and freeze_super (Abhishek Bapat)
  - dm: use READ_ONCE in dm_blk_report_zones (Mikulas Patocka)
  - dm: fix unlocked test for dm_suspended_md (Mikulas Patocka)
  - PCI/portdrv: Fix potential resource leak (Uwe Kleine-König)
  - PCI: Do not attempt to set ExtTag for VFs (Håkon Bugge)
  - Documentation: tracing: Add PCI tracepoint documentation (Shuai Xue)
  - Documentation: trace: Refactor toctree (Purva Yeshi)
  - docs: fix WARNING document not included in any toctree (Surajsonawane2415)
  - PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails (Hou Tao)
  - wifi: cfg80211: Fix use_for flag update on BSS refresh (Huang Chenming)
  - PCI/PM: Avoid redundant delays on D3hot->D3cold (Brian Norris)
  - Documentation: PCI: endpoint: Fix ntb/vntb copy & paste errors (Baruch Siach)
  - PCI: mediatek: Fix IRQ domain leak when MSI allocation fails (Xu Wang)
  - hwmon: (pmbus/mpq8785) fix VOUT_MODE mismatch during identification (Carl Lee)
  - hwmon: pmbus: mpq8785: Add support for MPM82504 (Pawel Dembicki)
  - hwmon: pmbus: mpq8785: Implement VOUT feedback resistor divider ratio configuration (Pawel Dembicki)
  - hwmon: pmbus: mpq8785: Prepare driver for multiple device support (Pawel Dembicki)
  - Revert "hwmon: (ibmpex) fix use-after-free in high/low store" (Guenter Roeck)
  - spi: tools: Add include folder to .gitignore (Francesco Lavra)
  - HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients (Ryan Lin)
  - platform/chrome: cros_ec_lightbar: Fix response size initialization (Tzung-Bi Shih)
  - drm/xe: Unregister drm device on probe error (Shuicheng Lin)
  - evm: Use ordered xattrs list to calculate HMAC in evm_init_hmac() (Roberto Sassu)
  - media: uvcvideo: Fix allocation for small frame sizes (Ricardo Ribalda)
  - platform/chrome: cros_typec_switch: Don't touch struct fwnode_handle::dev (Andy Shevchenko)
  - drm/buddy: release free_trees array on buddy mm teardown (Michał Grzelak)
  - drm/msm/a2xx: fix pixel shader start on A225 (Dmitry Baryshkov)
  - media: ccs: Accommodate C-PHY into the calculation (David Heidelberger)
  - drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x (Dmitry Baryshkov)
  - drm/msm/disp: set num_planes to 1 for interleaved YUV formats (Dmitry Baryshkov)
  - HID: playstation: Add missing check for input_ff_create_memless (Xu Wang)
  - regulator: core: move supply check earlier in set_machine_constraints() (André Draszik)
  - drm/msm/dpu: fix WD timer handling on DPU 8.x (Dmitry Baryshkov)
  - drm/msm/dpu: Set vsync source irrespective of mdp top support (Teguh Sobirin)
  - drm/msm/disp/dpu: add merge3d support for sc7280 (Mahadevan P)
  - drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init (Srinivasan Shanmugam)
  - drm/amdkfd: Fix signal_eviction_fence() bool return value (Srinivasan Shanmugam)
  - drm/amd: Drop "amdgpu kernel modesetting enabled" message (Mario Limonciello)
  - media: chips-media: wave5: Fix memory leak on codec_info allocation failure (Zilin Guan)
  - ASoC: nau8821: Fixup nau8821_enable_jack_detect() (Cristian Ciocaltea)
  - ASoC: nau8821: Avoid unnecessary blocking in IRQ handler (Cristian Ciocaltea)
  - ASoC: nau8821: Consistently clear interrupts before unmasking (Cristian Ciocaltea)
  - smack: /smack/doi: accept previously used values (Konstantin Andreev)
  - smack: /smack/doi must be > 0 (Konstantin Andreev)
  - drm/panthor: Evict groups before VM termination (Ketil Johnsen)
  - ALSA: vmaster: Relax __free() variable declarations (Takashi Iwai)
  - ALSA: pcm: Relax __free() variable declarations (Takashi Iwai)
  - ALSA: pcm: use new array-copying-wrapper (Chenyuan Yang)
  - drm/panel: sw43408: Remove manual invocation of unprepare at remove (David Heidelberger)
  - workqueue: Process rescuer work items one-by-one using a cursor (Lai Jiangshan)
  - workqueue: Only assign rescuer work when really needed (Lai Jiangshan)
  - workqueue: Factor out assign_rescuer_work() (Lai Jiangshan)
  - drm/panthor: Make sure we resume the tick when new jobs are submitted (Boris Brezillon)
  - drm/panthor: Fix the logic that decides when to stop ticking (Boris Brezillon)
  - drm/panthor: Fix immediate ticking on a disabled tick (Boris Brezillon)
  - drm/panthor: Fix the group priority rotation logic (Boris Brezillon)
  - drm/panthor: Fix the full_tick check (Boris Brezillon)
  - drm/panthor: Recover from panthor_gpu_flush_caches() failures (Boris Brezillon)
  - arm64: dts: qcom: sm6115: Add CX_MEM/DBGC GPU regions (Konrad Dybcio)
  - arm64: dts: qcom: agatti: Add CX_MEM/DBGC GPU regions (Konrad Dybcio)
  - arm64: dts: qcom: x1e: bus is 40-bits (fix 64GB models) (Jonathan Marek)
  - arm64: dts: qcom: sdm845-db845c: specify power for WiFi CH1 (Dmitry Baryshkov)
  - arm64: dts: qcom: sdm845-db845c: drop CS from SPIO0 (Dmitry Baryshkov)
  - arm64: dts: qcom: qrb4210-rb2: Fix UART3 wakeup IRQ storm (Dmitry Baryshkov)
  - arm64: dts: amlogic: g12: assign the MMC A signal clock (Jerome Brunet)
  - arm64: dts: amlogic: g12: assign the MMC B and C signal clocks (Jerome Brunet)
  - arm64: dts: amlogic: gx: assign the MMC signal clocks (Jerome Brunet)
  - arm64: dts: amlogic: axg: assign the MMC signal clocks (Jerome Brunet)
  - arm64: dts: amlogic: c3: assign the MMC signal clocks (Jerome Brunet)
  - hwspinlock: omap: Handle devm_pm_runtime_enable() errors (Xu Wang)
  - arm64: dts: ti: k3-j784s4-j742s2-main-common.dtsi: Refactor watchdog instances for j784s4 (Abhash Kumar Jha)
  - arm64: dts: ti: k3-j784s4-main.dtsi: Move c71_3 node to appropriate order (Abhash Kumar Jha)
  - arm64: dts: amlogic: s4: fix mmc clock assignment (Jerome Brunet)
  - arm64: dts: amlogic: s4: assign mmc b clock to 24MHz (Jerome Brunet)
  - arm64: dts: mediatek: mt8183-jacuzzi-pico6: Fix typo in pinmux node (AngeloGioacchino Del Regno)
  - arm: dts: lpc32xx: add clocks property to Motor Control PWM device tree node (Vladimir Zapolskiy)
  - ARM: dts: lpc32xx: Set motor PWM #pwm-cells property value to 3 cells (Vladimir Zapolskiy)
  - powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling (Narayana Murty N)
  - soc: mediatek: svs: Fix memory leak in svs_enable_debug_write() (Zilin Guan)
  - soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in cmd_db_dev_probe (Xu Wang)
  - powerpc/uaccess: Move barrier_nospec() out of allow_read_{from/write}_user() (Christophe Leroy)
  - ARM: dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property (Chen-Yu Tsai)
  - arm64: dts: qcom: msm8994-octagon: Fix Analog Devices vendor prefix of AD7147 (Vladimir Zapolskiy)
  - arm64: dts: qcom: x1e80100: Fix USB combo PHYs SS1 and SS2 ref clocks (Abel Vesa)
  - arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on (Casey Connolly)
  - arm64: dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on (Casey Connolly)
  - arm64: dts: qcom: sdm630: fix gpu_speed_bin size (Dmitry Baryshkov)
  - clk: qcom: Return correct error code in qcom_cc_probe_by_index() (Xu Wang)
  - arm64: dts: tqma8mpql-mba8mp-ras314: Fix HDMI CEC pad control settings (Alexander Stein)
  - arm64: dts: tqma8mpql-mba8mpxl: Fix HDMI CEC pad control settings (Alexander Stein)
  - firmware: arm_ffa: Correct 32-bit response handling in NOTIFICATION_INFO_GET (Sudeep Holla)
  - EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size() (Dan Carpenter)
  - EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size() (Dan Carpenter)
  - soc: qcom: smem: handle ENOMEM error during probe (Jorge Ramirez-Ortiz)
  - pstore/ram: fix buffer overflow in persistent_ram_save_old() (Pwnverse)
  - hwrng: core - use RCU and work_struct to fix race condition (Lianjie Wang)
  - hwrng: core - Allow runtime disabling of the HW RNG (Jonathan Mcdowell)
  - crypto: starfive - Fix memory leak in starfive_aes_aead_do_one_req() (Zilin Guan)
  - fs/tests: exec: drop duplicate bprm_stack_limits test vectors (Titouan Ameline de Cadeville)
  - sched/rt: Skip currently executing CPU in rto_next_cpu() (Chen Jinghuang)
  - sched/deadline: Clear the defer params (Joel Fernandes)
  - media: pci: mg4b: Use IRQF_NO_THREAD (Sebastian Andrzej Siewior)
  - mfd: wm8350-core: Use IRQF_ONESHOT (Sebastian Andrzej Siewior)
  - EDAC/altera: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
  - scsi: efct: Use IRQF_ONESHOT and default primary handler (Sebastian Andrzej Siewior)
  - Bluetooth: btintel_pcie: Use IRQF_ONESHOT and default primary handler (Sebastian Andrzej Siewior)
  - platform/x86: int0002: Remove IRQF_ONESHOT from request_irq() (Sebastian Andrzej Siewior)
  - genirq: Set IRQF_COND_ONESHOT in devm_request_irq(). (Sebastian Andrzej Siewior)
  - bpf: Fix bpf_xdp_store_bytes proto for read-only arg (Paul Chaignon)
  - crypto: caam - fix netdev memory leak in dpaa2_caam_probe (Jianpeng Chang)
  - crypto: hisilicon/trng - support tfms sharing the device (Weili Qian)
  - x86/fgraph,bpf: Switch kprobe_multi program stack unwind to hw_regs path (Jiri Olsa)
  - x86/fgraph,bpf: Fix stack ORC unwind from kprobe_multi return probe (Jiri Olsa)
  - tracing: Add ftrace_fill_perf_regs() for perf event (Masami Hiramatsu)
  - tracing: Add ftrace_partial_regs() for converting ftrace_regs to pt_regs (Masami Hiramatsu)
  - fgraph: Replace fgraph_ret_regs with ftrace_regs (Masami Hiramatsu)
  - ftrace: Rename ftrace_regs_return_value to ftrace_regs_get_return_value (Masami Hiramatsu)
  - ftrace: Use arch_ftrace_regs() for ftrace_regs_*() macros (Masami Hiramatsu)
  - ftrace: Consolidate ftrace_regs accessor functions for archs using pt_regs (Steven Rostedt)
  - ftrace: Make ftrace_regs abstract from direct use (Steven Rostedt)
  - tracing: Add a comment about ftrace_regs definition (Masami Hiramatsu)
  - bpf, sockmap: Fix FIONREAD for sockmap (Jiayuan Chen)
  - bpf, sockmap: Fix incorrect copied_seq calculation (Jiayuan Chen)
  - crypto: ccp - narrow scope of snp_range_list (Tycho Andersen)
  - crypto: ccp - Ensure implicit SEV/SNP init and shutdown in ioctls (Ashish Kalra)
  - hrtimer: Fix trace oddity (Thomas Gleixner)
  - selftests/bpf: Fix resource leak in serial_test_wq on attach failure (Kery Qi)
  - bpf: Preserve id of register in sync_linked_regs() (Puranjay Mohan)
  - crypto: hisilicon/sec2 - support skcipher/aead fallback for hardware queue unavailable (Qi Tao)
  - crypto: hisilicon/zip - adjust the way to obtain the req in the callback function (Chenghai Huang)
  - crypto: octeontx - fix dma_free_coherent() size (Thomas Fourier)
  - crypto: cavium - fix dma_free_coherent() size (Thomas Fourier)
  - ARM: VDSO: Patch out __vdso_clock_getres() if unavailable (Thomas Weißschuh)
  - libbpf: Fix OOB read in btf_dump_get_bitfield_value (Varun R Mallya)
  - selftests/bpf: veristat: fix printing order in output_stats() (Puranjay Mohan)
  - crypto: qat - fix warning on adf_pfvf_pf_proto.c (Giovanni Cabiddu)
  - perf/x86/core: Do not set bit width for unavailable counters (Sandipan Das)
  - s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (Salah Triki)
  - PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races (Gui-Dong Han)
  - cpufreq: intel_pstate: Enable asym capacity only when CPU SMT is not possible (Yaxiong Tian)
  - perf: arm_spe: Properly set hw.state on failures (Leo Yan)
  - PM: wakeup: Handle empty list in wakeup_sources_walk_start() (Sam Wu)
  - md/raid1: fix memory leak in raid1_run() (Zilin Guan)
  - md/raid1: fix memory leak in raid1_run() if no active rdev (Zheng Qixing)
  - Partial revert "x86/xen: fix balloon target initialization for PVH dom0" (Roger Pau Monné)
  - ublk: Validate SQE128 flag before accessing the cmd (Govindarajulu Varadarajan)
  - thermal/of: Fix reference leak in thermal_of_cm_lookup() (Felix Gu)
  - iomap: fix submission side handling of completion side errors (Christoph Hellwig)
  - cpufreq: scmi: Fix device_node reference leak in scmi_cpu_domain_id() (Felix Gu)
  - OPP: Return correct value in dev_pm_opp_get_level (Aleks Todorov)
  - md/raid10: fix any_working flag handling in raid10_sync_request (Li Nan)
  - md/raid5: fix raid5_run() to return error when log_init() fails (Yu Kuai)
  - thermal: intel: x86_pkg_temp_thermal: Handle invalid temperature (Rafael J. Wysocki)
  - cpuidle: governors: menu: Always check timers with tick stopped (Rafael J. Wysocki)
  - io_uring/sync: validate passed in offset (Jens Axboe)
  - ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() (Alexey Simakov)
  - io_uring: use release-acquire ordering for IORING_SETUP_R_DISABLED (Caleb Sander)
  - xen/virtio: Don't use grant-dma-ops when running as Dom0 (Teddy Astie)
  - rnbd-srv: Fix server side setting of bi_size for special IOs (Florian-Ewald Mueller)
  - rnbd-srv: use bio_add_virt_nofail (Christoph Hellwig)
  - block: add a bio_add_virt_nofail helper (Christoph Hellwig)
  - smb: client: fix potential UAF and double free in smb2_open_file() (Paulo Alcantara)
  - btrfs: fix block_group_tree dirty_list corruption (Boris Burkov)
  - btrfs: qgroup: return correct error when deleting qgroup relation item (Filipe Manana)
  - erofs: handle end of filesystem properly for file-backed mounts (Gao Xiang)
  - erofs: get rid of raw bi_end_io() usage (Gao Xiang)
  - tpm: st33zp24: Fix missing cleanup on get_burstcount() error (Alper Ak)
  - tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure (Alper Ak)
  - i3c: dw: Fix memory leak in dw_i3c_master_i2c_xfers() (Zilin Guan)
  - i3c: dw: Initialize spinlock to avoid upsetting lockdep (Fredrik Markstrom)
  - gfs2: Fix use-after-free in iomap inline data write path (Deepanshu Kartikey)
  - gfs2: Fix slab-use-after-free in qd_put (Andreas Gruenbacher)
  - gfs2: Retries missing in gfs2_{rename,exchange} (Andreas Gruenbacher)
  - i3c: master: Update hot-join flag only on success (Adrian Hunter)
  - fs: add <linux/init_task.h> for 'init_fs' (Ben Dooks)
  - i3c: Move device name assignment after i3c_bus_init (Billy Tsai)
  - audit: move the compat_xxx_class[] extern declarations to audit_arch.h (Ben Dooks)
  - rcu: Fix rcu_read_unlock() deadloop due to softirq (Yao Kai)
  - rcu: Remove local_irq_save/restore() in rcu_preempt_deferred_qs_handler() (Zqiang)
  - rcu: Refactor expedited handling check in rcu_read_unlock_special() (Joel Fernandes)
  - hfsplus: return error when node already exists in hfs_bnode_create (Shardul Bankar)
  - auxdisplay: arm-charlcd: fix release_mem_region() size (Thomas Fourier)
  - RDMA/umad: Reject negative data_len in ib_umad_write (Yunje Shin) [Orabug: 39103108] {CVE-2026-23243}
  - RDMA/siw: Fix potential NULL pointer dereference in header processing (Yunje Shin)


author: Sherry Yang <sherry.yang@oracle.com> [6.12.0-202.76.2.el10uek]
changelog:
  - ipv6: use RCU in ip6_xmit() (Eric Dumazet)  [Orabug: 38649060]  {CVE-2025-40135}
  - dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (Eric Dumazet)  [Orabug: 38887740]  {CVE-2026-23004}
  - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled (Fernando Fernandez Mancera)  [Orabug: 39029337] {CVE-2026-23381}
  - io_uring/kbuf: check if target buffer list is still legacy on recycle (Jens Axboe)  [Orabug: 39144150] {CVE-2026-43366}
  - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Breno Leitao)  [Orabug: 39166116] {CVE-2026-23207}
  - spi: tegra210-quad: Check hardware status on timeout (Vishwaroop A)  [Orabug: 39166116]
  - spi: tegra210-quad: Refactor error handling into helper functions (Vishwaroop A)  [Orabug: 39166116]
  - spi: tegra210-quad: Add support for internal DMA (Vishwaroop A)  [Orabug: 39166116]
  - spi: tegra210-quad: Update dummy sequence configuration (Vishwaroop A)  [Orabug: 39166116]
  - iommufd/device: Add helper to detect the first attach of a group (Yi Liu)  [Orabug: 39166116]
  - iommufd/device: Replace idev->igroup with local variable (Yi Liu)  [Orabug: 39166116]
  - iommufd/device: Only add reserved_iova in non-pasid path (Yi Liu)  [Orabug: 39166116]
  - iommufd: Pass @pasid through the device attach/replace path (Yi Liu)  [Orabug: 39166116]
  - iommu: Drop iommu_group_replace_domain() (Yi Liu)  [Orabug: 39166116]
  - arm64: contpte: fix set_access_flags() no-op check for SMMU/ATS faults (Piotr Jaroszynski)  [Orabug: 39166116]


author: Sherry Yang <sherry.yang@oracle.com> [6.12.0-202.76.4.el10uek]
changelog:
  - uek-rpm: Enable FWCTL modules for aarch64 (Dave Kleikamp)  [Orabug: 39292218]
  - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu)  [Orabug: 39291972] {CVE-2026-43078}
  - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu)  [Orabug: 39291972]
  - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu)  [Orabug: 39291972] {CVE-2026-43033}
  - crypto: authenc - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39291972]
  - crypto: algif_aead - snapshot IV for async AEAD requests (Douya Le)  [Orabug: 39291972]
  - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu)  [Orabug: 39291972]  {CVE-2026-31431}
  - crypto: algif_aead - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39291972]
  - crypto: scatterwalk - Backport memcpy_sglist() (Eric Biggers)  [Orabug: 39291972]


author: Samasth Norway Ananda <samasth.norway.ananda@oracle.com> [6.12.0-202.76.4.1.el10uek]
changelog:
  - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Hyunwoo Kim)  [Orabug: 39344513]  {CVE-2026-43500}
  - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (David Howells)  [Orabug: 39344513]
  - rxrpc: only handle RESPONSE during service challenge (Wang Jie)  [Orabug: 39344513] {CVE-2026-31676}
  - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (David Howells)  [Orabug: 39344513]
  - rxrpc: Fix potential UAF after skb_unshare() failure (David Howells)  [Orabug: 39344513]
  - rxrpc: Fix re-decryption of RESPONSE packets (David Howells)  [Orabug: 39344513]
  - xfrm: esp: avoid in-place decrypt on shared skb frags (Kuan-Ting Chen)  [Orabug: 39344513]  {CVE-2026-43284}
  - x86/CPU/AMD: Add a fix for AMD-SB-7052 (Prathyushi Nangia)  [Orabug: 39344560]  {CVE-2025-54518}


author: Sherry Yang <sherry.yang@oracle.com> [6.12.0-202.76.4.2.el10uek]
changelog:
  - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (Victor Nogueira)  [Orabug: 39361451]  {CVE-2026-23270} 
  - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal)  [Orabug: 39361449]  {CVE-2026-23278} 
  - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Jeff Layton)  [Orabug: 39361444]  {CVE-2026-31402}


author: Sherry Yang <sherry.yang@oracle.com> [6.12.0-202.76.4.2.el10uek]
changelog:
  - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (Victor Nogueira)  [Orabug: 39361451]  {CVE-2026-23270}
  - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal)  [Orabug: 39361449]  {CVE-2026-23278}
  - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Jeff Layton)  [Orabug: 39361444]  {CVE-2026-31402}


author: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com> [6.12.0-202.76.4.3.el10uek]
changelog:
  - ptrace: slightly saner 'get_dumpable()' logic (Linus Torvalds)  [Orabug: 39391434]  {CVE-2026-46333}


author: Samasth Norway Ananda <samasth.norway.ananda@oracle.com> [6.12.0-202.76.4.4.el10uek]
changelog:
  - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Hyunwoo Kim)  [Orabug: 39420559]  {CVE-2026-46300} 
  - net: skbuff: preserve shared-frag marker during coalescing (William Bowling)  [Orabug: 39420559]


author: Sherry Yang <sherry.yang@oracle.com> [6.12.0-202.76.1.el10uek]
changelog:
  - uek-rpm/config-x86_64-onos: Reduce unneeded options in config file for ONOS (Brian Utterback) [Orabug: 39029491]
  - Kconfig for ARISTA_SCD_DRIVER driver needs select REGMAP_I2C (Brian Utterback) [Orabug: 39095293]
  - memfd: move MFD_MF_KEEP_UE_MAPPED flag to higher bit (William Roche) [Orabug: 39109772]
  - uek-rpm: Enable CONFIG_NET_VRF in container kernel (Boris Ostrovsky) [Orabug: 39161478]
  - sched: idle: Make skipping governor callbacks more consistent (Rafael J. Wysocki)
  - dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler (Guenter Roeck)
  - soc: rockchip: grf: Add missing of_node_put() when returning (Shawn Lin)
  - tracing: Add NULL pointer check to trigger_data_free() (Guenter Roeck) [Orabug: 39227772] {CVE-2026-23309}
  - qmi_wwan: allow max_mtu above hard_mtu to control rx_urb_size (Laurent Vivier)
  - bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR (Daniel Wade) [Orabug: 39198231] {CVE-2026-31413}
  - ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload (Peter Ujfalusi)
  - Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req (Minseo Park) [Orabug: 39251164] {CVE-2026-31513}
  - Revert "arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on" (Sasha Levin)
  - erofs: set fileio bio failed in short read case (Sheng Yong) [Orabug: 39251169] {CVE-2026-31514}
  - ACPI: processor: Fix previous acpi_processor_errata_piix4() fix (Rafael J. Wysocki) [Orabug: 39198208] {CVE-2026-23443}
  - kbuild: Leave objtool binary around with 'make clean' (Nathan Chancellor)
  - wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom (Guenter Roeck) [Orabug: 39262447] {CVE-2026-31552}
  - net: macb: Reinitialize tx/rx queue pointer registers and rx ring during resume (Kevin Hao)
  - net: macb: Introduce gem_init_rx_ring() (Kevin Hao)
  - net: macb: Shuffle the tx ring before enabling tx (Kevin Hao)
  - remoteproc: mediatek: Unprepare SCP clock during system suspend (Tzung-Bi Shih)
  - LTS version: v6.12.76 (Sherry Yang)
  - Revert "x86/kexec: add a sanity check on previous kernel's ima kexec buffer" (Sasha Levin)
  - LTS version: v6.12.75 (Sherry Yang)
  - most: core: fix leak on early registration failure (Johan Hovold)
  - arm64: Fix sampling the "stable" virtual counter in preemptible section (Marc Zyngier)
  - xfs: fix copy-paste error in previous fix (Darrick J. Wong)
  - drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros (Jani Nikula)
  - ALSA: pcm: Revert bufs move in snd_pcm_xfern_frames_ioctl() (Nathan Chancellor)
  - NTB: ntb_transport: Fix too small buffer for debugfs_name (Koichiro Den)
  - tracing: Wake up poll waiters for hist files when removing an event (Petr Pavlu)
  - tracing: Fix checking of freed trace_event_file for hist files (Petr Pavlu)
  - fgraph: Do not call handlers direct when not using ftrace_ops (Steven Rostedt)
  - tracing: ring-buffer: Fix to check event length before using (Masami Hiramatsu) [Orabug: 39331678] {CVE-2026-43210}
  - net: nfc: nci: Fix parameter validation for packet data (Michael Thalmeier)
  - drm/amdgpu: keep vga memory on MacBooks with switchable graphics (Alex Deucher)
  - arm64: Force the use of CNTVCT_EL0 in __delay() (Marc Zyngier)
  - x86/kexec: Copy ACPI root pointer address from config table (Ard Biesheuvel)
  - net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() (Liu Ruitong) [Orabug: 39331784] {CVE-2026-43238}
  - net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle (Thomas Fourier)
  - ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR (Gustavo Salvini)
  - cifs: some missing initializations on replay (Shyam Prasad N) [Orabug: 39300554] {CVE-2026-31693}
  - fbcon: Remove struct fbcon_display.inverse (Thomas Zimmermann)
  - fbdev: ffb: fix corrupted video output on Sun FFB1 (René Rebe)
  - fbdev: of: display_timing: fix refcount leak in of_get_display_timings() (Weigang He) [Orabug: 39331889] {CVE-2026-43264}
  - fbdev: vt8500lcdfb: fix missing dma_free_coherent() (Thomas Fourier)
  - fbcon: check return value of con2fb_acquire_newinfo() (Andrey Vatoropin) [Orabug: 39331303] {CVE-2026-43123}
  - mm: numa_memblks: Identify the accurate NUMA ID of CFMW (Cui Chao)
  - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (Junxi Qian) [Orabug: 39331577] {CVE-2026-43186}
  - function_graph: Restore direct mode when callbacks drop to one (Shengming Hu)
  - atm: fore200e: fix use-after-free in tasklets during device removal (Duoming Zhou)
  - net: intel: fix PCI device ID conflict between i40e and ipw2200 (Ethan Nelson-Moore)
  - procfs: fix possible double mmput() in do_procmap_query() (Andrii Nakryiko) [Orabug: 39339241] {CVE-2026-43178}
  - drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify (Pierre-Eric Pelloux-Prayer) [Orabug: 39343623] {CVE-2026-43318}
  - drm/amd/display: Increase DCN35 SR enter/exit latency (Sun Peng Li)
  - io_uring/filetable: clamp alloc_hint to the configured alloc range (Jens Axboe)
  - tracing: Fix to set write permission to per-cpu buffer_size_kb (Masami Hiramatsu)
  - net: macb: Fix tx/rx malfunction after phy link down and up (Kevin Hao)
  - net: ti: icssg-prueth: Add optional dependency on HSR (Kevin Hao)
  - octeontx2-af: CGX: fix bitmap leaks (Bo Sun)
  - net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean() (Thomas Fourier)
  - net: ethernet: marvell: skge: remove incorrect conflicting PCI ID (Ethan Nelson-Moore)
  - LoongArch: Disable instrumentation for setup_ptwalker() (Tiezhu Yang)
  - LoongArch: Guard percpu handler under !CONFIG_PREEMPT_RT (Tiezhu Yang)
  - LoongArch: Use %px to print unmodified unwinding address (Tiezhu Yang)
  - LoongArch: Prefer top-down allocation after arch_mem_init() (Huacai Chen)
  - LoongArch: Make cpumask_of_node() robust against NUMA_NO_NODE (John Garry)
  - rust: kbuild: pass `-Zunstable-options` for Rust 1.95.0 (Miguel Ojeda)
  - ceph: supply snapshot context in ceph_zero_partial_object() (Ethanwu) [Orabug: 39331924] {CVE-2026-43273}
  - MIPS: rb532: Fix MMIO UART resource registration (Jiaxun Yang)
  - cifs: Fix locking usage for tcon fields (Shyam Prasad N) [Orabug: 39331696] {CVE-2026-43215}
  - watchdog/softlockup: fix sample ring index wrap in need_counting_irqs() (Shengming Hu)
  - kcsan, compiler_types: avoid duplicate type issues in BPF Type Format (Alan Maguire)
  - staging: rtl8723bs: fix null dereference in find_network (Ethan Tidmore)
  - parisc: kernel: replace kfree() with put_device() in create_tree_node() (Haoxiang Li)
  - PCI: Fix pci_slot_trylock() error handling (Jinhui Guo) [Orabug: 39331680] {CVE-2026-43211}
  - net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe() error path (Kevin Hao)
  - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (Sunday Clement) [Orabug: 39331661] {CVE-2026-43206}
  - tipc: fix RCU dereference race in tipc_aead_users_dec() (Daniel Hodges)
  - mtd: rawnand: pl353: Fix software ECC support (Andrea Scian)
  - usb: dwc2: fix resume failure if dr_mode is host (Jisheng Zhang)
  - usb: dwc3: gadget: Move vbus draw to workqueue context (Prashanth K) [Orabug: 39331512] {CVE-2026-43170}
  - PCI: dwc: Fix msg_atu_index assignment (Niklas Cassel)
  - mm/slab: use unsigned long for orig_size to ensure proper metadata align (Harry Yoo)
  - scsi: ufs: core: Flush exception handling work when RPM level is zero (Thomas Yen) [Orabug: 39331937] {CVE-2026-43275}
  - perf/arm-cmn: Reject unsupported hardware configurations (Robin Murphy) [Orabug: 39331435] {CVE-2026-43150}
  - remoteproc: imx_rproc: Fix invalid loaded resource table detection (Peng Fan)
  - btrfs: continue trimming remaining devices on failure (Jinbaohong)
  - clk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841 (Marek Vasut)
  - arm64: Fix non-atomic __READ_ONCE() with CONFIG_LTO=y (Marco Elver)
  - PCI/IOV: Fix race between SR-IOV enable/disable and hotplug (Niklas Schnelle)
  - Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" (Niklas Schnelle) [Orabug: 39331422] {CVE-2026-43147}
  - kexec: derive purgatory entry from symbol (Li Chen) [Orabug: 39343538] {CVE-2026-43289}
  - ocfs2: fix reflink preserve cleanup issue (Heming Zhao) [Orabug: 39331504] {CVE-2026-43168}
  - rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() (Haoxiang Li)
  - mm/highmem: fix __kmap_to_page() build error (William Tambe)
  - mtd: spinand: Disable continuous read during probe (David Laporte)
  - iio: gyro: itg3200: Fix unchecked return value in read_raw (Antoniu Miclaus)
  - powerpc/smp: Add check for kcalloc() failure in parse_thread_groups() (Guangshuo Li)
  - vhost: move vdpa group bound check to vhost_vdpa (Eugenio Pérez) [Orabug: 39331827] {CVE-2026-43248}
  - tools: Fix bitfield dependency failure (Leo Yan)
  - arm64: poe: fix stale POR_EL0 values for ptrace (Joey Gouly)
  - dm mpath: make pg_init_delay_msecs settable (Benjamin Marzinski)
  - bus: fsl-mc: fix an error handling in fsl_mc_device_add() (Haoxiang Li)
  - io_uring/net: don't continue send bundle if poll was required for retry (Jens Axboe)
  - usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN (Haotien Hsu)
  - mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node (Deepanshu Kartikey) [Orabug: 39343546] {CVE-2026-43292}
  - nvmem: Drop OF node reference on nvmem_add_one_cell() failure (Krzysztof Kozlowski)
  - nfsd: fix return error code for nfsd_map_name_to_[ug]id (Anthony Iliopoulos)
  - md/bitmap: fix GPF in write_page caused by resize race (Jack Wang) [Orabug: 39331482] {CVE-2026-43163}
  - xfs: check for deleted cursors when revalidating two btrees (Darrick J. Wong) [Orabug: 39103129] {CVE-2026-23249}
  - xfs: check return value of xchk_scrub_create_subord (Darrick J. Wong) [Orabug: 39103131] {CVE-2026-23250}
  - xfs: only call xf{array,blob}_destroy if we have a valid pointer (Darrick J. Wong) [Orabug: 39103133] {CVE-2026-23251}
  - pinctrl: intel: Add code name documentation (Raag Jadav)
  - PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions (Manikanta Maddireddy)
  - KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() (Vasiliy Kovalev) [Orabug: 39331693] {CVE-2026-43214}
  - xfs: fix remote xattr valuelblk check (Darrick J. Wong)
  - xfs: fix the xattr scrub to detect freemap/entries array collisions (Darrick J. Wong)
  - xfs: fix freemap adjustments when adding xattrs to leaf blocks (Darrick J. Wong) [Orabug: 39331458] {CVE-2026-43158}
  - xfs: delete attr leaf freemap entries when empty (Darrick J. Wong) [Orabug: 39331580] {CVE-2026-43187}
  - iio: accel: adxl380: Avoid reading more entries than present in FIFO (Francesco Lavra)
  - mfd: omap-usb-host: Fix OF populate on driver rebind (Johan Hovold)
  - mfd: qcom-pm8xxx: Fix OF populate on driver rebind (Johan Hovold)
  - mfd: core: Add locking around 'mfd_of_node_list' (Douglas Anderson) [Orabug: 39331409] {CVE-2026-43143}
  - iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (Jinhui Guo) [Orabug: 39331341] {CVE-2026-43130}
  - media: verisilicon: AV1: Fix tile info buffer size (Benjamin Gaignard)
  - xfs: remove xfs_attr_leaf_hasname (Christoph Hellwig) [Orabug: 39331444] {CVE-2026-43153}
  - xfs: mark data structures corrupt on EIO and ENODATA (Darrick J. Wong)
  - drm/bridge: anx7625: Fix invalid EDID size (Loic Poulain)
  - drm/buddy: Prevent BUG_ON by validating rounded allocation (Sanjay Yadav) [Orabug: 39331510] {CVE-2026-43169}
  - selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs (Li Wang)
  - drm: of: drm_of_panel_bridge_remove(): fix device_node leak (Luca Ceresoli)
  - media: venus: vdec: restrict EOS addr quirk to IRIS2 only (Dikshita Agarwal)
  - media: venus: vdec: fix error state assignment for zero bytesused (Renjiang Han)
  - arm64: dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro (Yan Jun)
  - dm-unstripe: fix mapping bug when there are multiple targets in a table (Matt Whitlock)
  - dm-integrity: fix recalculation in bitmap mode (Mikulas Patocka)
  - reset: gpio: suppress bind attributes in sysfs (Bartosz Golaszewski)
  - s390/pci: Handle futile config accesses of disabled devices directly (Niklas Schnelle)
  - clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc() (Haoxiang Li)
  - media: i2c: ov01a10: Fix digital gain range (Mehdi Djait)
  - media: stm32: dcmipp: bytecap: clear all interrupts upon stream stop (Alain Volmat)
  - soc: rockchip: grf: Support multiple grf to be handled (Shawn Lin)
  - soc: rockchip: grf: Fix wrong RK3576_IOCGRF_MISC_CON definition (Shawn Lin)
  - clk: clk-apple-nco: Add "apple,t8103-nco" compatible (Janne Grunau)
  - bus: omap-ocp2scp: fix OF populate on driver rebind (Johan Hovold)
  - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (Yosry Ahmed) [Orabug: 39331358] {CVE-2026-43133}
  - soc: ti: pruss: Fix double free in pruss_clk_mux_setup() (Xu Wang)
  - soc: ti: k3-socinfo: Fix regmap leak on probe failure (Johan Hovold)
  - dm: clear cloned request bio pointer when last clone bio completes (Michael Liang) [Orabug: 39331954] {CVE-2026-43278}
  - dm-integrity: fix a typo in the code for write/discard race (Mikulas Patocka)
  - platform/x86: ISST: Add missing write block check (Srinivas Pandruvada)
  - media: ipu6: Fix RPM reference leak in probe error paths (Bingbu Cao) [Orabug: 39331545] {CVE-2026-43177}
  - media: ipu6: Fix typo and wrong constant in ipu6-mmu.c (Bingbu Cao)
  - media: i2c: ov5647: use our own mutex for the ctrl lock (Xiaolei Wang)
  - media: ccs: Fix setting initial sub-device state (Sakari Ailus)
  - media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode (Jai Luthra)
  - media: i2c: ov5647: Sensor should report RAW color space (David Plowman)
  - media: i2c: ov5647: Correct minimum VBLANK value (David Plowman)
  - media: i2c: ov5647: Correct pixel array offset (David Plowman)
  - media: i2c: ov5647: Initialize subdev before controls (Jai Luthra)
  - media: ccs: Avoid possible division by zero (Sakari Ailus)
  - media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() (Alper Ak)
  - media: i2c: ov01a10: Fix test-pattern disabling (Hans de Goede)
  - media: i2c: ov01a10: Fix passing stream instead of pad to v4l2_subdev_state_get_format() (Hans de Goede)
  - media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() calls (Hans de Goede)
  - media: i2c: ov01a10: Fix analogue gain range (Hans de Goede)
  - media: i2c: ov01a10: Fix reported pixel-rate value (Hans de Goede)
  - media: i2c: ov01a10: Fix the horizontal flip control (Hans de Goede)
  - media: i2c/tw9906: Fix potential memory leak in tw9906_probe() (Abdun Nihaal) [Orabug: 39331821] {CVE-2026-43246}
  - media: i2c/tw9903: Fix potential memory leak in tw9903_probe() (Abdun Nihaal) [Orabug: 39331705] {CVE-2026-43218}
  - media: cx25821: Add missing unmap in snd_cx25821_hw_params() (Haoxiang Li)
  - media: cx23885: Add missing unmap in snd_cx23885_hw_params() (Haoxiang Li) [Orabug: 39331366] {CVE-2026-43135}
  - media: cx88: Add missing unmap in snd_cx88_hw_params() (Haoxiang Li) [Orabug: 39331866] {CVE-2026-43257}
  - media: radio-keene: fix memory leak in error path (Shaurya Rane) [Orabug: 39331752] {CVE-2026-43231}
  - media: verisilicon: AV1: Set IDR flag for intra_only frame type (Benjamin Gaignard)
  - media: rockchip: rga: Fix possible ERR_PTR dereference in rga_buf_init() (Alper Ak)
  - media: amphion: Drop min_queued_buffers assignment (Ming Qian)
  - arm64: dts: apple: t8112-j473: Keep the HDMI port powered on (Janne Grunau)
  - HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() (Günther Noack) [Orabug: 39331370] {CVE-2026-43136}
  - HID: prodikeys: Check presence of pm->input_ep82 (Günther Noack) [Orabug: 39331846] {CVE-2026-43251}
  - HID: magicmouse: Do not crash on missing msc->input (Günther Noack) [Orabug: 39331389] {CVE-2026-43140}
  - HID: hid-pl: handle probe errors (Oliver Neukum) [Orabug: 39331440] {CVE-2026-43152}
  - arm64: Disable branch profiling for all arm64 code (Breno Leitao)
  - KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding (Sean Christopherson) [Orabug: 39343613] {CVE-2026-43315}
  - KVM: x86: Return "unsupported" instead of "invalid" on access to unsupported PV MSR (Sean Christopherson)
  - ARM: omap2: Fix reference count leaks in omap_control_init() (Xu Wang)
  - arm64: dts: qcom: x1e80100: Add missing TCSR ref clock to the DP PHYs (Abel Vesa)
  - media: verisilicon: AV1: Fix tx mode bit setting (Benjamin Gaignard)
  - media: verisilicon: AV1: Fix enable cdef computation (Benjamin Gaignard)
  - media: chips-media: wave5: Fix device cleanup order to prevent kernel panic (Xulin Sun)
  - media: chips-media: wave5: Fix kthread worker destruction in polling mode (Xulin Sun)
  - media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove() (Haoxiang Li)
  - media: mtk-mdp: Fix error handling in probe function (Haoxiang Li)
  - media: mediatek: encoder: Fix uninitialized scalar variable issue (Irui Wang)
  - dm-verity: correctly handle dm_bufio_client_create() failure (Eric Biggers) [Orabug: 39331353] {CVE-2026-43132}
  - phy: qcom: edp: Make the number of clocks flexible (Abel Vesa)
  - Revert "PCI: qcom: Enable MSI interrupts together with Link up if 'Global IRQ' is supported" (Niklas Cassel)
  - drm/tests: shmem: Swap names of export tests (Thomas Zimmermann)
  - fpga: dfl: use subsys_initcall to allow built-in drivers to be added (Thadeu Lima de Souza Cascardo)
  - ASoC: SOF: ipc4-control: Keep the payload size up to date (Peter Ujfalusi)
  - ASoC: SOF: ipc4-control: Use the correct size for scontrol->ipc_control_data (Peter Ujfalusi)
  - ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls (Peter Ujfalusi) [Orabug: 39331023] {CVE-2025-71286}
  - ASoC: SOF: ipc4-control: If there is no data do not send bytes update (Peter Ujfalusi)
  - clk: renesas: rzg2l: Select correct div round macro (Chris Brandt)
  - clk: renesas: rzg2l: Fix intin variable size (Chris Brandt)
  - rpmsg: core: fix race in driver_override_show() and use core helper (Gui-Dong Han) [Orabug: 39331012] {CVE-2025-71274}
  - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Vahagn Vardanian) [Orabug: 39331761] {CVE-2026-43233}
  - dpaa2-switch: validate num_ifs to prevent out-of-bounds write (Junrui Luo)
  - net: consume xmit errors of GSO frames (Jakub Kicinski) [Orabug: 39331606] {CVE-2026-43194}
  - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Jianbo Liu) [Orabug: 39331628] {CVE-2026-43199}
  - net/mlx5e: Support routed networks during IPsec MACs initialization (Alexandre Cassen)
  - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Shay Drory)
  - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Shay Drory)
  - net/mlx5: DR, Fix circular locking dependency in dump (Shay Drory)
  - RDMA/umem: Fix double dma_buf_unpin in failure path (Jacob Moroni) [Orabug: 39331331] {CVE-2026-43128}
  - net: usb: pegasus: enable basic endpoint checking (Ziyi Guo) [Orabug: 39331449] {CVE-2026-43156}
  - RDMA/efa: Fix typo in efa_alloc_mr() (Jason Gunthorpe)
  - net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets (Duoming Zhou)
  - RDMA/core: Fix stale RoCE GIDs during netdev events at registration (Jiri Pirko)
  - tipc: fix duplicate publication key in tipc_service_insert_publ() (Tung Nguyen)
  - kcm: fix zero-frag skb in frag_list on partial sendmsg error (Jiayuan Chen)
  - tls: Fix race condition in tls_sw_cancel_work_tx() (Hyunwoo Kim) [Orabug: 39073883] {CVE-2026-23240}
  - Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ (Luiz Augusto von Dentz) [Orabug: 39331361] {CVE-2026-43134}
  - Bluetooth: L2CAP: Fix not checking output MTU is acceptable on L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz)
  - Bluetooth: L2CAP: Fix response to L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz)
  - Bluetooth: hci_qca: Cleanup on all setup failures (Jinwang Li)
  - Bluetooth: L2CAP: Fix result of L2CAP_ECRED_CONN_RSP when MTU is too short (Luiz Augusto von Dentz)
  - Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ (Luiz Augusto von Dentz)
  - Remove WARN_ALL_UNSEEDED_RANDOM kernel config option (Linus Torvalds)
  - wifi: cfg80211: wext: fix IGTK key ID off-by-one (Johannes Berg)
  - bnxt_en: Fix deleting of Ntuple filters (Pavan Chebbi)
  - bnxt_en: Fix RSS context delete logic (Pavan Chebbi) [Orabug: 39331875] {CVE-2026-43260}
  - net: ethernet: xscale: Check for PTP support properly (Linus Walleij)
  - net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() (Vladimir Oltean)
  - net: usb: lan78xx: scan all MDIO addresses on LAN7801 (Martin Pålsson)
  - net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode (Ziyi Guo) [Orabug: 39331549] {CVE-2026-43180}
  - espintcp: Fix race condition in espintcp_close() (Hyunwoo Kim)
  - xfrm: always flush state and policy upon NETDEV_UNREGISTER event (Tetsuo Handa) [Orabug: 39331496] {CVE-2026-43167}
  - ipmi: ipmb: initialise event handler read bytes (Matt Johnston)
  - xfrm: skip templates check for packet offload tunnel mode (Leon Romanovsky)
  - xfrm6: fix uninitialized saddr in xfrm6_get_saddr() (Jiayuan Chen) [Orabug: 39331383] {CVE-2026-43139}
  - ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut (Maciej Grochowski)
  - ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access (Maciej Grochowski)
  - rtc: zynqmp: correct frequency value (Tomas Melin)
  - drm/amd/display: Remove conditional for shaper 3DLUT power-on (Alex Hung)
  - arm64: hugetlbpage: avoid unused-but-set-parameter warning (gcc-16) (Arnd Bergmann)
  - btrfs: replace BUG() with error handling in __btrfs_balance() (Adarsh Das)
  - ALSA: usb-audio: Add sanity check for OOB writes at silencing (Takashi Iwai) [Orabug: 39331959] {CVE-2026-43279}
  - drm/radeon: Add HAINAN clock adjustment (Decce6)
  - spi: spidev: fix lock inversion between spi_lock and buf_lock (Fabian Godehardt) [Orabug: 39343626] {CVE-2026-43319}
  - drm/amd/display: bypass post csc for additional color spaces in dal (Clay King)
  - drm/amdgpu: Add HAINAN clock adjustment (Decce6)
  - ALSA: usb-audio: Update the number of packets properly at receiving (Takashi Iwai)
  - drm/amdgpu: Adjust usleep_range in fence wait (Ce Sun)
  - drm/amd/display: Avoid updating surface with the same surface under MPO (Wayne Lin)
  - drm/amd/display: Fix system resume lag issue (Tom Chung)
  - drm/amd/display: Fix writeback on DCN 3.2+ (Alex Hung)
  - ARM: 9467/1: mm: Don't use %pK through printk (Thomas Weißschuh)
  - include: uapi: netfilter_bridge.h: Cover for musl libc (Phil Sutter)
  - ACPI: x86: Force enabling of PWM2 on the Yogabook YB1-X90 (Yauhen Kharuzhy)
  - thermal: int340x: Fix sysfs group leak on DLVR registration failure (Kaushlendra Kumar)
  - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [Orabug: 39343577] {CVE-2026-43304}
  - ceph: supply snapshot context in ceph_uninline_data() (Ethanwu)
  - fs/ntfs3: avoid calling run_get_entry() when run == NULL in ntfs_read_run_nb_ra() (Konstantin Komarov)
  - fs/ntfs3: drop preallocated clusters for sparse and compressed files (Konstantin Komarov)
  - fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST (Jaehun Gou)
  - fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata (Jaehun Gou)
  - fs: ntfs3: check return value of indx_find to avoid infinite loop (Jaehun Gou)
  - MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE (John Garry)
  - iio: magnetometer: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
  - iio: Use IRQF_NO_THREAD (Sebastian Andrzej Siewior)
  - mfd: intel-lpss: Add Intel Nova Lake-S PCI IDs (Ilpo Järvinen)
  - Revert "mfd: da9052-spi: Change read-mask to write-mask" (Marcus Folkesson)
  - phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature (Xu Yang)
  - phy: mvebu-cp110-utmi: fix dr_mode property read from dts (Aleksandar Gerasimovski)
  - watchdog: imx7ulp_wdt: handle the nowayout option (Oleksandr Suvorov)
  - binder: don't use %pK through printk (Thomas Weißschuh)
  - fix it87_wdt early reboot by reporting running timer (René Rebe)
  - serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done (Moteen Shah)
  - serial: 8250: 8250_omap.c: Add support for handling UART error conditions (Moteen Shah)
  - staging: rtl8723bs: fix memory leak on failure path (Diksha Kumari)
  - usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke() (Mario Peter)
  - usb: gadget: f_fs: Fix ioctl error handling (Sam Day)
  - usb: gadget: f_fs: fix DMA-BUF OUT queues (Sam Day)
  - misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 (Markus Koch)
  - misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() (Tuo Li)
  - phy: cadence-torrent: restore parent clock for refclk during resume (Thomas Richard)
  - phy: ti: phy-j721e-wiz: restore mux selection during resume (Thomas Richard)
  - dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix warnings (Clément Le Goffic)
  - dmaengine: sun6i: Choose appropriate burst length under maxburst (Chen-Yu Tsai)
  - most: core: fix resource leak in most_register_interface error paths (Navaneeth K)
  - fpga: of-fpga-region: Fail if any bridge is missing (Romain Gantois)
  - usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs (Benson Leung)
  - serial: 8250_dw: handle clock enable errors in runtime_resume (Artem Shimko)
  - staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure (Liang Jie)
  - soundwire: intel_auxdevice: add cs42l45 codec to wake_capable_list (Maciej Strozek)
  - soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15) (Peter Ujfalusi)
  - dmaengine: stm32-dma3: use module_platform_driver (Amelie Delaunay)
  - 9p/xen: protect xen_9pfs_front_free against concurrent calls (Stefano Stabellini)
  - m68k: nommu: fix memmove() with differently aligned src and dest for 68000 (Daniel Palmer)
  - HID: i2c-hid: Add FocalTech FT8112 (Daniel Peng)
  - clk: microchip: core: correct return value on *_get_parent() (Brian Masney)
  - mailbox: sprd: clear delivery flag before handling TX done (Otto Pflüger)
  - remoteproc: mediatek: Break lock dependency to `prepare_lock` (Tzung-Bi Shih)
  - mailbox: sprd: mask interrupts that are not handled (Otto Pflüger)
  - mailbox: imx: Skip the suspend flag for i.MX7ULP (Jacky Bai)
  - mailbox: pcc: Remove spurious IRQF_ONESHOT usage (Mark Brown)
  - remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX channel is uninitialized (Iuliana Prodan)
  - tracing: Fix false sharing in hwlat get_sample() (Colin Lord)
  - riscv: vector: init vector context with proper vlenb (Sergey Matyukevich)
  - scsi: ufs: mediatek: Fix page faults in ufs_mtk_clk_scale() trace event (Keita Morisaki)
  - vhost: fix caching attributes of MMIO regions by setting them explicitly (Kommula Shiva Shankar)
  - scsi: buslogic: Reduce stack usage (Arnd Bergmann)
  - hisi_acc_vfio_pci: update status after RAS error (Longfang Liu)
  - ata: libata: avoid long timeouts on hot-unplugged SATA DAS (Henry Tseng)
  - RDMA/rtrs-clt: For conn rejection use actual err number (Md Haris Iqbal)
  - nfc: nxp-nci: remove interrupt trigger type (Carl Lee)
  - myri10ge: avoid uninitialized variable use (Arnd Bergmann)
  - PCI: Mark Nvidia GB10 to avoid bus reset (Johnny-Cc Chang)
  - PCI: Add ACS quirk for Qualcomm Hamoa & Glymur (Krishna Chaitanya Chundru)
  - PCI: Fix pci_slot_lock () device locking (Keith Busch)
  - PCI/AER: Clear stale errors on reporting agents upon probe (Lukas Wunner)
  - PCI: Mark ASM1164 SATA controller to avoid bus reset (Alex Williamson)
  - vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 (Arnd Bergmann)
  - net: usb: sr9700: remove code to drive nonexistent multicast filter (Ethan Nelson-Moore)
  - bnxt_en: Allow ntuple filters for drops (Joe Damato)
  - wifi: ath10k: fix lock protection in ath10k_wmi_event_peer_sta_ps_state_chg() (Ziyi Guo)
  - wifi: rtw89: pci: restore LDO setting after device resume (Dian-Syuan Yang)
  - net: sfp: add quirk for Lantech 8330-265D (Marek Behún)
  - octeontx2-af: Workaround SQM/PSE stalls by disabling sticky (Geetha Sowjanya)
  - Bluetooth: btusb: Add device ID for Realtek RTL8761BU (Jacopo Scannella)
  - Bluetooth: btusb: Add new VID/PID for RTL8852CE (Shell Chen)
  - Bluetooth: hci_conn: use mod_delayed_work for active mode timeout (Stefan Sørensen)
  - Bluetooth: hci_conn: Set link_policy on incoming ACL connections (Stefan Sørensen)
  - Bluetooth: btusb: Add support for MediaTek7920 0489:e158 (Andrew Elantsev)
  - ipv4: fib: Annotate access to struct fib_alias.fa_state. (Kuniyuki Iwashima)
  - wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() (Ziyi Guo)
  - wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() (Ziyi Guo)
  - net: hns3: extend HCLGE_FD_AD_QID to 11 bits (Jijie Shao)
  - ipv4: igmp: annotate data-races around idev->mr_maxdelay (Eric Dumazet)
  - gro: change the BUG_ON() in gro_pull_from_frag0() (Eric Dumazet)
  - ext4: propagate flags to convert_initialized_extent() (Ojaswin Mujoo)
  - wifi: rtw89: 8922a: add digital compensation for 2GHz (Po-Hao Huang)
  - wifi: rtw89: fix unable to receive probe responses under MLO connection (Po-Hao Huang)
  - wifi: iwlwifi: mvm: check the validity of noa_len (Miri Korenblit)
  - net: usb: r8152: fix transmit queue timeout (Mingj Ye)
  - openrisc: define arch-specific version of nop() (Brian Masney)
  - netfilter: xt_tcpmss: check remaining length before reading optlen (Florian Westphal) [Orabug: 39331591] {CVE-2026-43190}
  - netfilter: nf_conntrack: Add allow_clash to generic protocol handler (Yuto Hamaguchi)
  - ext4: use reserved metadata blocks when splitting extent on endio (Zhang Yi)
  - ext4: mark group extend fast-commit ineligible (Li Chen)
  - ext4: move ext4_percpu_param_init() before ext4_mb_init() (Baokun Li) [Orabug: 39343531] {CVE-2026-43288}
  - ext4: mark group add fast-commit ineligible (Li Chen)
  - ipv6: exthdrs: annotate data-race over multiple sysctl (Eric Dumazet)
  - ipv6: annotate data-races over sysctl.flowlabel_reflect (Eric Dumazet)
  - ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}() (Eric Dumazet)
  - wifi: cfg80211: allow only one NAN interface, also in multi radio (Miri Korenblit)
  - wifi: ath12k: fix preferred hardware mode calculation (Baochen Qiang)
  - wifi: ath11k: Fix failure to connect to a 6 GHz AP (Qian Zhang)
  - wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1 (Ross Vandegrift)
  - wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode (Chin-Yen Lee)
  - wifi: rtw89: mac: correct page number for CSI response (Ping-Ke Shih)
  - iommu/amd: move wait_on_sem() out of spinlock (Ankit Soni) [Orabug: 39331853] {CVE-2026-43253}
  - wifi: libertas: fix WARNING in usb_tx_block (Szymon Wilczek) [Orabug: 39331859] {CVE-2026-43255}
  - net: wwan: mhi: Add network support for Foxconn T99W760 (Slark Xiao)
  - iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency (Alexander Grest)
  - dm: remove fake timeout to avoid leak request (Ding Hui) [Orabug: 39343609] {CVE-2026-43314}
  - dm: replace -EEXIST with -EBUSY (Daniel Gomez)
  - wifi: rtw88: Fix inadvertent sharing of struct ieee80211_supported_band data (Bitterblue Smith)
  - wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() (Bitterblue Smith) [Orabug: 39331003] {CVE-2025-71273}
  - wifi: rtw89: ser: enable error IMR after recovering from L1 (Zong-Zhe Yang)
  - wifi: rtw89: 8922a: set random mac if efuse contains zeroes (Jose Ignacio Tornos Martinez)
  - wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H (Hsiu-Ming Chang)
  - wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() (Bitterblue Smith) [Orabug: 39343515] {CVE-2025-71297}
  - wifi: rtw88: fix DTIM period handling when conf->dtim_period is zero (Roman Peshkichev)
  - jfs: nlink overflow in jfs_rename (Jori Koolstra)
  - jfs: Add missing set_freezable() for freezable kthread (Xu Wang)
  - ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio (Lianqin Hu)
  - ALSA: mixer: oss: Add card disconnect checkpoints (Takashi Iwai) [Orabug: 39331318] {CVE-2026-43126}
  - ALSA: hda/realtek - Enable mute LEDs on HP ENVY x360 15-es0xxx (Illia Barbashyn)
  - ASoC: fsl: imx-rpmsg: use snd_soc_find_dai_with_mutex() in probe (Ziyi Guo)
  - spi: geni-qcom: Fix abort sequence execution for serial engine errors (Praveen Talari)
  - ASoC: SOF: Intel: hda: Fix NULL pointer dereference (Ranjani Sridharan) [Orabug: 39331375] {CVE-2026-43137}
  - power: sequencing: fix missing state_lock in pwrseq_power_on() error path (Ziyi Guo)
  - modpost: Amend ppc64 save/restfpr symnames for -Os build (René Rebe)
  - ASoC: es8328: Add error unwind in resume (Hsieh Hung-En)
  - HID: logitech-hidpp: Add support for Logitech K980 (Bastien Nocera)
  - hwmon: (f71882fg) Add F81968 support (Ji-Ze Hong)
  - hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE (Denis Pauk)
  - hwmon: (dell-smm) Add support for Dell OptiPlex 7080 (Armin Wolf)
  - ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in max98390_i2c_probe() (Chen Ni)
  - drm/amd/display: avoid dig reg access timeout on usb4 link training fail (Zhongwei)
  - drm/amd/display: Fix GFX12 family constant checks (Matthew Stewart)
  - spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end (Chin-Ting Kuo)
  - ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio (Chen Ni)
  - gpio: aspeed-sgpio: Change the macro to support deferred probe (Billy Tsai)
  - ALSA: hda/realtek: fix LG Gram Style 14 speakers (Damien Dagorn)
  - ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro (Gongqi)
  - HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK (David Phillips)
  - HID: multitouch: add eGalaxTouch EXC3188 support (Thorsten Schmelzer)
  - media: rkisp1: Fix filter mode register configuration (Rui Wang)
  - drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release (Ludovic Desroches)
  - drm/atmel-hlcdc: don't reject the commit if the src rect has fractional parts (Ludovic Desroches)
  - drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback (Ludovic Desroches)
  - drm/amd/display: Disable FEC when powering down encoders (Ovidiu Bunea)
  - PCI: Add Intel Nova Lake audio Device ID (Peter Ujfalusi)
  - ASoC: soc-acpi-intel-arl-match: change rt722 amp endpoint to aggregated (Bard Liao)
  - virt: vbox: uapi: Mark inner unions in packed structs as packed (Thomas Weißschuh)
  - hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed (Thomas Weißschuh)
  - drm: Account property blob allocations to memcg (Xiao Kan) [Orabug: 39343527] {CVE-2026-43287}
  - drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map() (Donet Tom)
  - drm/amdkfd: Relax size checking during queue buffer get (Donet Tom)
  - ALSA: hda/realtek: add HP Victus 16-e0xxx mute LED quirk (Bharat Dev Burman)
  - media: ipu6: Always close firmware stream (Sakari Ailus)
  - media: ipu6: Close firmware streams on streaming enable failure (Sakari Ailus)
  - media: ipu6: Ensure stream_mutex is acquired when dealing with node list (Sakari Ailus)
  - media: mt9m114: Return -EPROBE_DEFER if no endpoint is found (Hans de Goede)
  - media: mt9m114: Avoid a reset low spike during probe() (Hans de Goede)
  - media: v4l2-async: Fix error handling on steps after finding a match (Sakari Ailus) [Orabug: 39331585] {CVE-2026-43189}
  - media: cx25821: Fix a resource leak in cx25821_dev_setup() (Haoxiang Li)
  - media: solo6x10: Check for out of bounds chip_id (Kees Cook) [Orabug: 39343616] {CVE-2026-43316}
  - media: pvrusb2: fix URB leak in pvr2_send_request_ex (Szymon Wilczek) [Orabug: 39331719] {CVE-2026-43223}
  - media: adv7180: fix frame interval in progressive mode (Thorsten Schmelzer)
  - drm/panel: Fix a possible null-pointer dereference in jdi_panel_dsi_remove() (Tuo Li)
  - media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START (Ming Qian)
  - spi: spi-mem: Limit octal DTR constraints to octal DTR situations (Miquel Raynal)
  - ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug (Sebastian Krzyszkowiak)
  - ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask (Sebastian Krzyszkowiak)
  - drm/xe: Only toggle scheduling in TDR if GuC is running (Matthew Brost)
  - drm/amd/display: only power down dig on phy endpoints (Dmytro Laktyushkin)
  - drm/amdgpu: Skip loading SDMA_RS64 in VF (Yubiao Wang)
  - HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards (Joey Bednar)
  - drm/amd/display: Add signal type check for dcn401 get_phyd32clk_src (Dmytro Laktyushkin) [Orabug: 39331807] {CVE-2026-43243}
  - drm/amdgpu: avoid a warning in timedout job handler (Alex Deucher)
  - drm/amd/display: Fix dsc eDP issue (Charlene Liu) [Orabug: 39343628] {CVE-2026-43320}
  - drm/amdgpu: add support for HDP IP version 6.1.1 (Tim Huang)
  - media: mediatek: vcodec: Don't try to decode 422/444 VP9 (Nicolas Dufresne)
  - media: chips-media: wave5: Process ready frames when CMD_STOP sent to Encoder (Brandon Brnich)
  - media: chips-media: wave5: Fix conditional in start_streaming (Brandon Brnich)
  - media: omap3isp: set initial format (Hans Verkuil)
  - media: omap3isp: isppreview: always clamp in preview_try_format() (Hans Verkuil)
  - media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes (Hans Verkuil)
  - drm/v3d: Set DMA segment size to avoid debug warnings (Xiaolei Wang)
  - spi: stm32: fix Overrun issue at < 8bpw (Deepak Kumar)
  - media: dvb-core: dmxdevfilter must always flush bufs (Hans Verkuil)
  - ASoC: SOF: ipc4: Support for sending payload along with LARGE_CONFIG_GET (Peter Ujfalusi)
  - drm/amd/display: Add USB-C DP Alt Mode lane limitation in DCN32 (Lincheng Ku)
  - spi-geni-qcom: use xfer->bits_per_word for can_dma() (Jonathan Marek)
  - spi-geni-qcom: initialize mode related registers to 0 (Jonathan Marek)
  - drm/amdkfd: Handle GPU reset and drain retry fault race (Philip Yang)
  - drm/amdgpu: fix NULL pointer issue buffer funcs (Likun Gao) [Orabug: 39331070] {CVE-2025-71294}
  - gpu/panel-edp: add AUO panel entry for B140HAN06.4 (Alexey Klimov)
  - drm/display/dp_mst: Add protection against 0 vcpi (Suraj Kandpal)
  - parisc: Prevent interrupts during reboot (Helge Deller)
  - arm64: tegra: smaug: Add usb-role-switch support (Diogo Ivo)
  - Revert "arm64: zynqmp: Add an OP-TEE node to the device tree" (Tomas Melin)
  - firmware: arm_ffa: Unmap Rx/Tx buffers on init failure (Haoxiang Li)
  - pstore: ram_core: fix incorrect success return when vmap() fails (Ruipeng Qi) [Orabug: 39331308] {CVE-2026-43124}
  - sched/debug: Fix updating of ppos on server write ops (Joel Fernandes)
  - char: tpm: cr50: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
  - mailbox: bcm-ferxrm-mailbox: Use default primary handler (Sebastian Andrzej Siewior)
  - crypto: hisilicon/qm - move the barrier before writing to the mailbox register (Chenghai Huang)
  - PCI/MSI: Unmap MSI-X region on error (Haoxiang Li)
  - clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on OF (Bartosz Golaszewski)
  - clocksource/drivers/sh_tmu: Always leave device running after probe (Niklas Söderlund)
  - bpf: Recognize special arithmetic shift in the verifier (Alexei Starovoitov)
  - bpf: crypto: Use the correct destructor kfunc type (Sami Tolvanen) [Orabug: 39343581] {CVE-2026-43306}
  - perf/x86/cstate: Add Airmont NP (Martin Schiller)
  - perf/x86/msr: Add Airmont NP (Martin Schiller)
  - bpf: verifier improvement in 32bit shift sign extension pattern (Cupertino Miranda)
  - sparc: don't reference obsolete termio struct for TC* constants (Sam James)
  - sparc: Synchronize user stack on fork and clone (Andreas Larsson)
  - block: decouple secure erase size limit from discard size limit (Luke Wang)
  - blk-mq-debugfs: add missing debugfs_mutex in blk_mq_debugfs_register_hctxs() (Yu Kuai)
  - xenbus: Use .freeze/.thaw to handle xenbus devices (Jason Andryuk)
  - ACPI: battery: fix incorrect charging status when current is zero (Ata İLhan Köktürk)
  - ACPI: x86: s2idle: Invoke Microsoft _DSM Function 9 (Turn On Display) (Jakob Riemenschneider)
  - perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD (Sebastian Andrzej Siewior)
  - s390/perf: Disable register readout on sampling events (Thomas Richter)
  - cpufreq: dt-platdev: Block the driver from probing on more QC platforms (Konrad Dybcio)
  - md-cluster: fix NULL pointer dereference in process_metadata_update (Jiasheng Jiang) [Orabug: 39331918] {CVE-2026-43271}
  - alpha: fix user-space corruption during memory compaction (Magnus Lindholm)
  - powercap: intel_rapl: Add PL4 support for Ice Lake (Daniel Tang)
  - ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP (Armin Wolf)
  - ACPI: resource: Add JWIPC JVC9100 to irq1_level_low_skip_override[] (Ai Chao)
  - ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4() (Tuo Li) [Orabug: 39343603] {CVE-2026-43313}
  - EFI/CPER: don't go past the ARM processor CPER record buffer (Mauro Carvalho Chehab) [Orabug: 39331896] {CVE-2026-43266}
  - APEI/GHES: ARM processor Error: don't go past allocated memory (Mauro Carvalho Chehab) [Orabug: 39331636] {CVE-2026-43201}
  - APEI/GHES: ensure that won't go past CPER allocated record (Mauro Carvalho Chehab) [Orabug: 39331947] {CVE-2026-43277}
  - EFI/CPER: don't dump the entire memory region (Mauro Carvalho Chehab) [Orabug: 39331518] {CVE-2026-43171}
  - x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE is set (Hou Wenlong)
  - rnbd-srv: Zero the rsp buffer before using it (Md Haris Iqbal)
  - arm64: Add support for TSV110 Spectre-BHB mitigation (Jinqian Yang) [Orabug: 39331877] {CVE-2026-43261}
  - perf/arm-cmn: Support CMN-600AE (Robin Murphy)
  - s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS (Heiko Carstens)
  - tools/power cpupower: Reset errno before strtoull() (Kaushlendra Kumar)
  - smb: client: prevent races in ->query_interfaces() (Henrique Carvalho) [Orabug: 39331789] {CVE-2026-43239}
  - gfs2: fiemap page fault fix (Andreas Gruenbacher) [Orabug: 39331882] {CVE-2026-43262}
  - smb: client: add proper locking around ses->iface_last_update (Henrique Carvalho)
  - btrfs: handle user interrupt properly in btrfs_trim_fs() (Jinbaohong)
  - btrfs: fallback to buffered IO if the data profile has duplication (Qu Wenruo)
  - dlm: validate length in dlm_search_rsb_tree (Ziming Zhang) [Orabug: 39331312] {CVE-2026-43125}
  - minix: Add required sanity checking to minix_check_superblock() (Jori Koolstra)
  - i3c: mipi-i3c-hci: Reset RING_OPERATION1 fields during init (Adrian Hunter)
  - i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr() (Frank Li)
  - hfsplus: pretend special inodes as regular files (Tetsuo Handa)
  - audit: add missing syscalls to read class (Jeffrey Bencteux)
  - fs/buffer: add alert in try_to_free_buffers() for folios without buffers (Deepakkumar Karn) [Orabug: 39331077] {CVE-2025-71295}
  - hfsplus: fix volume corruption issue for generic/498 (Viacheslav Dubeyko)
  - audit: add fchmodat2() to change attributes class (Jeffrey Bencteux)
  - statmount: permission check should return EPERM (Bhavik Sachdev)
  - rtc: interface: Alarm race handling should not discard preceding error (Anthony Pighin)
  - libperf build: Always place libperf includes first (Ian Rogers)
  - libperf: Don't remove -g when EXTRA_CFLAGS are used (James Clark)
  - perf vendor events amd: Fix Zen 5 MAB allocation events (Sandipan Das)
  - perf annotate: Fix memcpy size in arch__grow_instructions() (Suchit Karunakaran)
  - perf maps: Fix reference count leak in maps__find_ams() (Ian Rogers)
  - libsubcmd: Fix null intersection case in exclude_cmds() (Sri Jayaramappa)
  - perf callchain: Fix srcline printing with inlines (Ian Rogers)
  - perf unwind-libdw: Fix invalid reference counts (Ian Rogers)
  - perf test stat tests: Fix for virtualized machines (Thomas Richter)
  - perf test stat: Update test expectations and events (Ian Rogers)
  - ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names (Shengjiu Wang)
  - ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names (Shengjiu Wang)
  - ASoC: dt-bindings: asahi-kasei,ak4458: set unevaluatedProperties:false (Shengjiu Wang)
  - dt-bindings: phy: qcom-edp: Add missing clock for X Elite (Abel Vesa)
  - SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path (Daniel Hodges)
  - SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths (Chuck Lever)
  - Drivers: hv: vmbus: Use kthread for vmbus interrupts on PREEMPT_RT (Jan Kiszka)
  - ata: libata-scsi: refactor ata_scsi_translate() (Damien Le Moal)
  - ata: pata_ftide010: Fix some DMA timings (Linus Walleij)
  - ext4: use optimized mballoc scanning regardless of inode format (Jan Kara)
  - ext4: fix dirtyclusters double decrement on fs shutdown (Brian Foster)
  - ext4: fix e4b bitmap inconsistency reports (Yongjian Sun)
  - ext4: fix memory leak in ext4_ext_shift_extents() (Zilin Guan)
  - ext4: drop extent cache when splitting extent fails (Zhang Yi)
  - ext4: drop extent cache after doing PARTIAL_VALID1 zeroout (Zhang Yi)
  - ext4: don't cache extent during splitting extent (Zhang Yi)
  - ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 (Zhang Yi)
  - ext4: subdivide EXT4_EXT_DATA_VALID1 (Zhang Yi)
  - MIPS: Work around LLVM bug when gp is used as global register variable (Yao Zi)
  - drm/amd/display: Use same max plane scaling limits for all 64 bpp formats (Mario Kleiner)
  - ASoC: rockchip: i2s-tdm: Use param rate if not provided by set_sysclk (Detlev Casanova)
  - x86/hyperv: Fix error pointer dereference (Ethan Tidmore)
  - btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found (Filipe Manana)
  - btrfs: use the correct type to initialize block reserve for delayed refs (Filipe Manana)
  - efi: Fix reservation of unaccepted memory table (Kiryl Shutsemau)
  - drm/xe/xe2_hpg: Fix handling of Wa_14019988906 & Wa_14019877138 (Matt Roper)
  - drm/xe/xe2_hpg: Add set of workarounds (Shekhar Chauhan)
  - drm/xe/ptl: Apply Wa_13011645652 (Vinay Belgaumkar)
  - drm/xe/mmio: Avoid double-adjust in 64-bit reads (Shuicheng Lin)
  - drm/xe: Switch MMIO interface to take xe_mmio instead of xe_gt (Matt Roper)
  - drm/xe: Adjust mmio code to pass VF substructure to SRIOV code (Matt Roper)
  - drm/xe: Add xe_tile backpointer to xe_mmio (Matt Roper)
  - drm/xe: Switch mmio_ext to use 'struct xe_mmio' (Matt Roper)
  - drm/xe: Populate GT's mmio iomap from tile during init (Matt Roper)
  - drm/xe: Move GSI offset adjustment fields into 'struct xe_mmio' (Matt Roper)
  - drm/xe: Clarify size of MMIO region (Matt Roper)
  - drm/xe: Create dedicated xe_mmio structure (Matt Roper)
  - drm/xe: Move forcewake to 'gt.pm' substructure (Matt Roper)
  - s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n (Alexander Egorenkov)
  - spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe() (Felix Gu)
  - drm/amd/display: Fix out-of-bounds stream encoder index v3 (Srinivasan Shanmugam)
  - drm/amd/display: Reject cursor plane on DCE when scaled differently than primary (Timur Kristóf)
  - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (Srinivasan Shanmugam)
  - ASoC: codecs: aw88261: Fix erroneous bitmask logic in Awinic init (Alexandre Ferrieux)
  - drm/i915/acpi: free _DSM package when no connectors (Kaushlendra Kumar)
  - ASoC: fsl_xcvr: Revert fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
  - drm/amdgpu: Fix memory leak in amdgpu_ras_init() (Zilin Guan)
  - drm/amdgpu: Use kvfree instead of kfree in amdgpu_gmc_get_nps_memranges() (Zilin Guan)
  - drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() (Zilin Guan)
  - apparmor: fix aa_label to return state from compount and component match (John Johansen)
  - apparmor: fix invalid deref of rawdata when export_binary is unset (Georgia Garcia)
  - apparmor: avoid per-cpu hold underflow in aa_get_buffer (Zhengmian Hu)
  - apparmor: make label_match return a consistent value (John Johansen)
  - apparmor: remove apply_modes_to_perms from label_match (John Johansen)
  - apparmor: fix rlimit for posix cpu timers (John Johansen)
  - apparmor: return -ENOMEM in unpack_perms_table upon alloc failure (Ryan Lee)
  - apparmor: Fix & Optimize table creation from possibly unaligned memory (Helge Deller)
  - AppArmor: Allow apparmor to handle unaligned dfa tables (Helge Deller)
  - apparmor: fix NULL sock in aa_sock_file_perm (John Johansen)
  - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Cosmin Ratiu)
  - net/mlx5: Fix multiport device check over light SFs (Shay Drory)
  - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (Hangbin Liu)
  - octeontx2-af: Fix default entries mcam entry action (Hariprasad Kelam)
  - icmp: prevent possible overflow in icmp_global_allow() (Eric Dumazet)
  - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Eric Dumazet) [Orabug: 39110677] {CVE-2026-23273}
  - ping: annotate data-races in ping_lookup() (Eric Dumazet)
  - bpftool: Fix truncated netlink dumps (Jakub Kicinski)
  - ipv6: fix a race in ip6_sock_set_v6only() (Eric Dumazet)
  - net: remove WARN_ON_ONCE when accessing forward path array (Pablo Neira Ayuso)
  - ipvs: do not keep dest_dst if dev is going down (Julian Anastasov)
  - netfilter: nf_conntrack_h323: don't pass uninitialised l3num value (Florian Westphal)
  - selftests: forwarding: vxlan_bridge_1d_ipv6: fix test failure with br_netfilter enabled (Aleksei Oladko)
  - selftests: forwarding: vxlan_bridge_1d: fix test failure with br_netfilter enabled (Aleksei Oladko)
  - net: bridge: mcast: always update mdb_n_entries for vlan contexts (Nikolay Aleksandrov)
  - xen-netback: reject zero-queue configuration from guest (Ziyi Guo)
  - net: usb: catc: enable basic endpoint checking (Ziyi Guo)
  - net: sparx5/lan969x: fix PTP clock max_adj value (Daniel Machon)
  - ipv6: Fix out-of-bound access in fib6_add_rt2node(). (Kuniyuki Iwashima)
  - net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj() (Ziyi Guo)
  - net: mscc: ocelot: split xmit into FDMA and register injection paths (Ziyi Guo)
  - net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (Ziyi Guo)
  - net: sparx5/lan969x: fix DWRR cost max to match hardware register width (Daniel Machon)
  - selftests: mlxsw: tc_restrictions: Fix test failure with new iproute2 (Ido Schimmel)
  - cpuidle: Skip governor when only one idle state is available (Aboorva Devarajan)
  - ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO (Zhai Can)
  - objpool: fix the overestimation of object pooling metadata size (Zhouwenhao)
  - selftests/memfd: use IPC semaphore instead of SIGSTOP/SIGCONT (Aristeu Rozanski)
  - kbuild: Add objtool to top-level clean target (Josh Poimboeuf)
  - powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check (Kuppuswamy Sathyanarayanan)
  - ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs (Sean V Kelley)
  - fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot (Jiasheng Jiang)
  - fs/ntfs3: prevent infinite loops caused by the next valid being the same (Edward Adam Davis)
  - fs/ntfs3: Initialize new folios before use (Bartlomiej Kubik)
  - io_uring/cancel: de-unionize file and user_data in struct io_cancel_data (Jens Axboe)
  - drbd: always set BLK_FEAT_STABLE_WRITES (Christoph Böhmwalder)
  - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Jared Kangas)
  - backlight: qcom-wled: Change PM8950 WLED configurations (Barnabás Czémán)
  - backlight: qcom-wled: Support ovp values for PMI8994 (Barnabás Czémán)
  - leds: qcom-lpg: Check the return value of regmap_bulk_write() (Xu Wang)
  - pinctrl: single: fix refcount leak in pcs_add_gpio_func() (Wei Li)
  - pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition (Luca Weiss)
  - iio: sca3000: Fix a resource leak in sca3000_probe() (Harshit Mogalapalli)
  - ovl: Fix uninit-value in ovl_fill_real (Qing Wang)
  - pinctrl: equilibrium: Fix device node reference leak in pinbank_init() (Felix Gu)
  - usb: bdc: fix sleep during atomic (Justin Chen)
  - drivers: iio: mpu3050: use dev_err_probe for regulator request (Svyatoslav Ryhel)
  - mfd: simple-mfd-i2c: Add Delta TN48M CPLD support (Robert Marko)
  - mfd: simple-mfd-i2c: Keep compatible strings in alphabetical order (Ioana Ciornei)
  - mfd: simple-mfd-i2c: Add SpacemiT P1 support (Alex Elder)
  - mfd: simple-mfd-i2c: Add compatible strings for Layerscape QIXIS FPGA (Ioana Ciornei)
  - mfd: simple-mfd-i2c: Add MAX77705 support (Dzmitry Sankouski)
  - mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure (Xu Wang)
  - Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms" (Greg Kroah-Hartman)
  - phy: freescale: imx8qm-hsio: fix NULL pointer dereference (Thomas Richard)
  - coresight: etm3x: Fix cpulocked warning on cpuhp (Antonio Borneo)
  - watchdog: starfive-wdt: Fix PM reference leak in probe error path (Kery Qi)
  - iio: pressure: mprls0025pa: fix pressure calculation (Petre Rodan)
  - iio: pressure: mprls0025pa: fix scan_type struct (Petre Rodan)
  - iio: pressure: mprls0025pa: fix interrupt flag (Petre Rodan)
  - iio: pressure: mprls0025pa: fix SPI CS delay violation (Petre Rodan)
  - iio: pressure: mprls0025pa: fix spi_transfer struct initialisation (Petre Rodan)
  - mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms (Matthew Schwartz)
  - serial: SH_SCI: improve "DMA support" prompt (Randy Dunlap)
  - serial: imx: change SERIAL_IMX_CONSOLE to bool (Randy Dunlap)
  - staging: greybus: lights: avoid NULL deref (Chaitanya Mishra)
  - iio: test: drop dangling symbol in gain-time-scale helpers (Randy Dunlap)
  - soundwire: intel_ace2x: add SND_HDA_CORE dependency (Arnd Bergmann)
  - dma: dma-axi-dmac: fix HW scatter-gather not looking at the queue (Nuno Sa)
  - dma: dma-axi-dmac: fix SW cyclic transfers (Nuno Sa)
  - dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX (AngeloGioacchino Del Regno)
  - interconnect: mediatek: Aggregate bandwidth with saturating add (Nicolas Frattaroli)
  - interconnect: mediatek: Don't hijack parent device (Nicolas Frattaroli)
  - clk: mediatek: Fix error handling in runtime PM setup (Xu Wang)
  - clk: qcom: gfx3d: add parent to parent request map (Dmitry Baryshkov)
  - clk: qcom: dispcc-sm7150: Fix dispcc_mdss_pclk1_clk_src (David Heidelberger)
  - clk: qcom: dispcc-sdm845: Enable parents for pixel clocks (Petr Hodina)
  - clk: Move clk_{save,restore}_context() to COMMON_CLK section (Geert Uytterhoeven)
  - clk: qcom: gcc-ipq5018: flag sleep clock as critical (George Moussalem)
  - clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc (Barnabás Czémán)
  - clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc (Barnabás Czémán)
  - clk: qcom: gcc-qdu1000: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
  - clk: qcom: gcc-x1e80100: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
  - clk: qcom: gcc-sdx75: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
  - clk: qcom: gcc-sm4450: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
  - clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
  - clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs (Martin Blumenstingl)
  - clk: qcom: rcg2: compute 2d using duty fraction directly (Taniya Das)
  - clk: qcom: gcc-sm8650: Use floor ops for SDCC RCGs (Vladimir Zapolskiy)
  - clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs (Vladimir Zapolskiy)
  - fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe() (Felix Gu)
  - fbdev: of_display_timing: Fix device node reference leak in of_get_display_timings() (Felix Gu)
  - tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros (Steven Rostedt)
  - tracing: Properly process error handling in event_hist_trigger_parse() (Miaoqian Lin)
  - fs/nfs: Fix readdir slow-start regression (Sagi Grimberg)
  - nvdimm: virtio_pmem: serialize flush requests (Li Chen)
  - scsi: csiostor: Fix dereference of null pointer rn (Colin Ian King)
  - scsi: ufs: host: mediatek: Require CONFIG_PM (Arnd Bergmann)
  - scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (Zilin Guan)
  - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia)
  - RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc (Liuyi)
  - power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer (Val Packett)
  - power: supply: pm8916_lbc: Fix use-after-free for extcon in IRQ handler (Waqar Hameed)
  - mtd: spinand: Fix kernel doc (Miquel Raynal)
  - mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions() (Weigang He)
  - cxl: Fix premature commit_end increment on decoder commit failure (Yuxiong Wang)
  - RDMA/core: add rdma_rw_max_sge() helper for SQ sizing (Chuck Lever)
  - RDMA/rxe: Fix race condition in QP timer handlers (Li Zhijian)
  - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Zilin Guan)
  - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (Liuyi)
  - NFS/localio: use GFP_NOIO and non-memreclaim workqueue in nfs_local_commit (Mike Snitzer)
  - nfs/localio: eliminate unnecessary kref in nfs_local_fsync_ctx (Mike Snitzer)
  - mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse() (Zilin Guan)
  - crypto: ccp - Send PSP_CMD_TEE_RING_DESTROY when PSP_CMD_TEE_RING_INIT fails (Mario Limonciello)
  - crypto: ccp - Factor out ring destroy handling to a helper (Mario Limonciello)
  - crypto: ccp - Add an S4 restore flow (Mario Limonciello)
  - crypto: ccp - Declare PSP dead if PSP_CMD_TEE_RING_INIT fails (Mario Limonciello)
  - platform/x86/amd/pmf: Prevent TEE errors after hibernate (Shyam Sundar S K)
  - vfio/pci: Lock upstream bridge for vfio_pci_core_disable() (Anthony Pighin)
  - mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper (Alok Tiwari)
  - IB/mlx5: Fix port speed query for representors (Or Har-Toov)
  - RDMA/mlx5: Fix UMR hang in LAG error state unload (Chiara Meiohas)
  - tools/power/x86/intel-speed-select: Fix file descriptor leak in isolate_cpus() (Malaya Kumar Rout)
  - RDMA/iwcm: Fix workqueue list corruption by removing work_list (Jacob Moroni)
  - RDMA/rxe: Fix double free in rxe_srq_from_init (Jiasheng Jiang)
  - RDMA/rtrs-srv: fix SG mapping (Roman Pen)
  - power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed() (Waqar Hameed)
  - power: supply: bq27xxx: fix wrong errno when bus ops are unsupported (Xu Wang)
  - power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write (Alexander Koskovich)
  - power: supply: sbs-battery: Fix use-after-free in power_supply_changed() (Waqar Hameed)
  - power: supply: rt9455: Fix use-after-free in power_supply_changed() (Waqar Hameed)
  - power: supply: pm8916_lbc: Fix use-after-free in power_supply_changed() (Waqar Hameed)
  - power: supply: pm8916_bms_vm: Fix use-after-free in power_supply_changed() (Waqar Hameed)
  - power: supply: goldfish: Fix use-after-free in power_supply_changed() (Waqar Hameed)
  - power: supply: cpcap-battery: Fix use-after-free in power_supply_changed() (Waqar Hameed)
  - power: supply: bq25980: Fix use-after-free in power_supply_changed() (Waqar Hameed)
  - power: supply: bq256xx: Fix use-after-free in power_supply_changed() (Waqar Hameed)
  - power: supply: act8945a: Fix use-after-free in power_supply_changed() (Waqar Hameed)
  - power: supply: ab8500: Fix use-after-free in power_supply_changed() (Waqar Hameed)
  - RDMA/hns: Notify ULP of remaining soft-WCs during reset (Chengchang Tang)
  - RDMA/hns: Fix RoCEv1 failure due to DSCP (Junxian Huang)
  - RDMA/hns: Fix WQ_MEM_RECLAIM warning (Chengchang Tang)
  - IB/cache: update gid cache on client reregister event (Etienne Aujames)
  - RDMA/rtrs: server: remove dead code (Lihonggang)
  - octeontx2-pf: Unregister devlink on probe failure (Hariprasad Kelam)
  - octeon_ep_vf: ensure dbell BADDR updation (Vimlesh Kumar)
  - octeon_ep: ensure dbell BADDR updation (Vimlesh Kumar)
  - octeon_ep: disable per ring interrupts (Vimlesh Kumar)
  - serial: caif: fix use-after-free in caif_serial ldisc_close() (Jiayuan Chen)
  - xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (Jiayuan Chen)
  - net: Switch to skb_dstref_steal/skb_dstref_restore for ip_route_input callers (Stanislav Fomichev)
  - net: Add skb_dstref_steal and skb_dstref_restore (Stanislav Fomichev)
  - net: sunhme: Fix sbus regression (René Rebe)
  - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (Jiayuan Chen) [Orabug: 39188476] {CVE-2026-31411}
  - smb: client: correct value for smbd_max_fragmented_recv_size (Stefan Metzmacher)
  - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (Jinliang Zheng)
  - net: hns3: fix double free issue for tx spare buffer (Jian Shen)
  - PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404] (Nicolas Cavallari)
  - netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (Pablo Neira Ayuso)
  - netfilter: nft_set_rbtree: fix bogus EEXIST with NLM_F_CREATE with null interval (Pablo Neira Ayuso)
  - netfilter: nft_counter: fix reset of counters on 32bit archs (Anders Grahn)
  - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal)
  - netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Florian Westphal)
  - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Scott Mitchell)
  - nfc: hci: shdlc: Stop timers and work before freeing context (Victoria Votokina)
  - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Eric Dumazet)
  - bonding: only set speed/duplex to unknown, if getting speed failed (Thomas Bogendoerfer)
  - mptcp: fix receive space timestamp initialization (Paolo Abeni)
  - of: unittest: fix possible null-pointer dereferences in of_unittest_property_copy() (Tuo Li)
  - ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit() (Ondrej Mosnacek)
  - ipc: don't audit capability check in ipc_permissions() (Ondrej Mosnacek)
  - selftests/mm: convert page_size to unsigned long (Siddarth G)
  - selftests/mm: pagemap_ioctl: Fix types mismatches shown by compiler options (Muhammad Usama Anjum)
  - PCI/ACPI: Restrict program_hpx_type2() to AER bits (Håkon Bugge)
  - PCI: Add defines for bridge window indexing (Ilpo Järvinen)
  - PCI: Initialize RCB from pci_configure_device() (Håkon Bugge)
  - wifi: ath10k: sdio: add missing lock protection in ath10k_sdio_fw_crashed_dump() (Ziyi Guo)
  - PCI: Check parent for NULL in of_pci_bus_release_domain_nr() (Sergey Shtylyov)
  - tcp: tcp_tx_timestamp() must look at the rtx queue (Eric Dumazet)
  - fat: avoid parent link count underflow in rmdir (Zhiyu Zhang)
  - nfsd: never defer requests during idmap lookup (Anthony Iliopoulos)
  - xdrgen: Initialize data pointer for zero-length items (Chuck Lever)
  - NFS: NFSERR_INVAL is not defined by NFSv2 (Chuck Lever)
  - xdrgen: Fix struct prefix for typedef types in program wrappers (Chuck Lever)
  - dm: use bio_clone_blkg_association (Mikulas Patocka)
  - iommu/vt-d: Clear Present bit before tearing down PASID entry (Lu Baolu)
  - iommu/vt-d: Avoid draining PRQ in sva mm release path (Lu Baolu)
  - iommu/vt-d: Drain PRQs when domain removed from RID (Lu Baolu)
  - iommu/vt-d: Separate page request queue from SVM (Joel Granados)
  - iommu/vt-d: Flush cache for PASID table before using it (Dmytro Maluka)
  - PCI: Mark 3ware-9650SA Root Port Extended Tags as broken (Jörg Wedekind)
  - kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup() (Petr Mladek)
  - module: add helper function for reading module_buildid() (Petr Mladek)
  - netfilter: nf_conncount: fix tracking of connections from localhost (Fernando Fernandez Mancera)
  - netfilter: nft_compat: add more restrictions on netlink attributes (Florian Westphal)
  - netfilter: nf_conncount: increase the connection clean up limit to 64 (Fernando Fernandez Mancera)
  - netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH (Fernando Fernandez Mancera)
  - netfilter: nf_tables: reset table validation state on abort (Florian Westphal)
  - wifi: cfg80211: stop NAN and P2P in cfg80211_leave (Miri Korenblit)
  - mctp i2c: initialise event handler read bytes (Matt Johnston)
  - net: mctp-i2c: fix duplicate reception of old data (Jian Zhang)
  - quota: fix livelock between quotactl and freeze_super (Abhishek Bapat)
  - dm: use READ_ONCE in dm_blk_report_zones (Mikulas Patocka)
  - dm: fix unlocked test for dm_suspended_md (Mikulas Patocka)
  - PCI/portdrv: Fix potential resource leak (Uwe Kleine-König)
  - PCI: Do not attempt to set ExtTag for VFs (Håkon Bugge)
  - Documentation: tracing: Add PCI tracepoint documentation (Shuai Xue)
  - Documentation: trace: Refactor toctree (Purva Yeshi)
  - docs: fix WARNING document not included in any toctree (Surajsonawane2415)
  - PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails (Hou Tao)
  - wifi: cfg80211: Fix use_for flag update on BSS refresh (Huang Chenming)
  - PCI/PM: Avoid redundant delays on D3hot->D3cold (Brian Norris)
  - Documentation: PCI: endpoint: Fix ntb/vntb copy & paste errors (Baruch Siach)
  - PCI: mediatek: Fix IRQ domain leak when MSI allocation fails (Xu Wang)
  - hwmon: (pmbus/mpq8785) fix VOUT_MODE mismatch during identification (Carl Lee)
  - hwmon: pmbus: mpq8785: Add support for MPM82504 (Pawel Dembicki)
  - hwmon: pmbus: mpq8785: Implement VOUT feedback resistor divider ratio configuration (Pawel Dembicki)
  - hwmon: pmbus: mpq8785: Prepare driver for multiple device support (Pawel Dembicki)
  - Revert "hwmon: (ibmpex) fix use-after-free in high/low store" (Guenter Roeck)
  - spi: tools: Add include folder to .gitignore (Francesco Lavra)
  - HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients (Ryan Lin)
  - platform/chrome: cros_ec_lightbar: Fix response size initialization (Tzung-Bi Shih)
  - drm/xe: Unregister drm device on probe error (Shuicheng Lin)
  - evm: Use ordered xattrs list to calculate HMAC in evm_init_hmac() (Roberto Sassu)
  - media: uvcvideo: Fix allocation for small frame sizes (Ricardo Ribalda)
  - platform/chrome: cros_typec_switch: Don't touch struct fwnode_handle::dev (Andy Shevchenko)
  - drm/buddy: release free_trees array on buddy mm teardown (Michał Grzelak)
  - drm/msm/a2xx: fix pixel shader start on A225 (Dmitry Baryshkov)
  - media: ccs: Accommodate C-PHY into the calculation (David Heidelberger)
  - drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x (Dmitry Baryshkov)
  - drm/msm/disp: set num_planes to 1 for interleaved YUV formats (Dmitry Baryshkov)
  - HID: playstation: Add missing check for input_ff_create_memless (Xu Wang)
  - regulator: core: move supply check earlier in set_machine_constraints() (André Draszik)
  - drm/msm/dpu: fix WD timer handling on DPU 8.x (Dmitry Baryshkov)
  - drm/msm/dpu: Set vsync source irrespective of mdp top support (Teguh Sobirin)
  - drm/msm/disp/dpu: add merge3d support for sc7280 (Mahadevan P)
  - drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init (Srinivasan Shanmugam)
  - drm/amdkfd: Fix signal_eviction_fence() bool return value (Srinivasan Shanmugam)
  - drm/amd: Drop "amdgpu kernel modesetting enabled" message (Mario Limonciello)
  - media: chips-media: wave5: Fix memory leak on codec_info allocation failure (Zilin Guan)
  - ASoC: nau8821: Fixup nau8821_enable_jack_detect() (Cristian Ciocaltea)
  - ASoC: nau8821: Avoid unnecessary blocking in IRQ handler (Cristian Ciocaltea)
  - ASoC: nau8821: Consistently clear interrupts before unmasking (Cristian Ciocaltea)
  - smack: /smack/doi: accept previously used values (Konstantin Andreev)
  - smack: /smack/doi must be > 0 (Konstantin Andreev)
  - drm/panthor: Evict groups before VM termination (Ketil Johnsen)
  - ALSA: vmaster: Relax __free() variable declarations (Takashi Iwai)
  - ALSA: pcm: Relax __free() variable declarations (Takashi Iwai)
  - ALSA: pcm: use new array-copying-wrapper (Chenyuan Yang)
  - drm/panel: sw43408: Remove manual invocation of unprepare at remove (David Heidelberger)
  - workqueue: Process rescuer work items one-by-one using a cursor (Lai Jiangshan)
  - workqueue: Only assign rescuer work when really needed (Lai Jiangshan)
  - workqueue: Factor out assign_rescuer_work() (Lai Jiangshan)
  - drm/panthor: Make sure we resume the tick when new jobs are submitted (Boris Brezillon)
  - drm/panthor: Fix the logic that decides when to stop ticking (Boris Brezillon)
  - drm/panthor: Fix immediate ticking on a disabled tick (Boris Brezillon)
  - drm/panthor: Fix the group priority rotation logic (Boris Brezillon)
  - drm/panthor: Fix the full_tick check (Boris Brezillon)
  - drm/panthor: Recover from panthor_gpu_flush_caches() failures (Boris Brezillon)
  - arm64: dts: qcom: sm6115: Add CX_MEM/DBGC GPU regions (Konrad Dybcio)
  - arm64: dts: qcom: agatti: Add CX_MEM/DBGC GPU regions (Konrad Dybcio)
  - arm64: dts: qcom: x1e: bus is 40-bits (fix 64GB models) (Jonathan Marek)
  - arm64: dts: qcom: sdm845-db845c: specify power for WiFi CH1 (Dmitry Baryshkov)
  - arm64: dts: qcom: sdm845-db845c: drop CS from SPIO0 (Dmitry Baryshkov)
  - arm64: dts: qcom: qrb4210-rb2: Fix UART3 wakeup IRQ storm (Dmitry Baryshkov)
  - arm64: dts: amlogic: g12: assign the MMC A signal clock (Jerome Brunet)
  - arm64: dts: amlogic: g12: assign the MMC B and C signal clocks (Jerome Brunet)
  - arm64: dts: amlogic: gx: assign the MMC signal clocks (Jerome Brunet)
  - arm64: dts: amlogic: axg: assign the MMC signal clocks (Jerome Brunet)
  - arm64: dts: amlogic: c3: assign the MMC signal clocks (Jerome Brunet)
  - hwspinlock: omap: Handle devm_pm_runtime_enable() errors (Xu Wang)
  - arm64: dts: ti: k3-j784s4-j742s2-main-common.dtsi: Refactor watchdog instances for j784s4 (Abhash Kumar Jha)
  - arm64: dts: ti: k3-j784s4-main.dtsi: Move c71_3 node to appropriate order (Abhash Kumar Jha)
  - arm64: dts: amlogic: s4: fix mmc clock assignment (Jerome Brunet)
  - arm64: dts: amlogic: s4: assign mmc b clock to 24MHz (Jerome Brunet)
  - arm64: dts: mediatek: mt8183-jacuzzi-pico6: Fix typo in pinmux node (AngeloGioacchino Del Regno)
  - arm: dts: lpc32xx: add clocks property to Motor Control PWM device tree node (Vladimir Zapolskiy)
  - ARM: dts: lpc32xx: Set motor PWM #pwm-cells property value to 3 cells (Vladimir Zapolskiy)
  - powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling (Narayana Murty N)
  - soc: mediatek: svs: Fix memory leak in svs_enable_debug_write() (Zilin Guan)
  - soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in cmd_db_dev_probe (Xu Wang)
  - powerpc/uaccess: Move barrier_nospec() out of allow_read_{from/write}_user() (Christophe Leroy)
  - ARM: dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property (Chen-Yu Tsai)
  - arm64: dts: qcom: msm8994-octagon: Fix Analog Devices vendor prefix of AD7147 (Vladimir Zapolskiy)
  - arm64: dts: qcom: x1e80100: Fix USB combo PHYs SS1 and SS2 ref clocks (Abel Vesa)
  - arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on (Casey Connolly)
  - arm64: dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on (Casey Connolly)
  - arm64: dts: qcom: sdm630: fix gpu_speed_bin size (Dmitry Baryshkov)
  - clk: qcom: Return correct error code in qcom_cc_probe_by_index() (Xu Wang)
  - arm64: dts: tqma8mpql-mba8mp-ras314: Fix HDMI CEC pad control settings (Alexander Stein)
  - arm64: dts: tqma8mpql-mba8mpxl: Fix HDMI CEC pad control settings (Alexander Stein)
  - firmware: arm_ffa: Correct 32-bit response handling in NOTIFICATION_INFO_GET (Sudeep Holla)
  - EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size() (Dan Carpenter)
  - EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size() (Dan Carpenter)
  - soc: qcom: smem: handle ENOMEM error during probe (Jorge Ramirez-Ortiz)
  - pstore/ram: fix buffer overflow in persistent_ram_save_old() (Pwnverse)
  - hwrng: core - use RCU and work_struct to fix race condition (Lianjie Wang)
  - hwrng: core - Allow runtime disabling of the HW RNG (Jonathan Mcdowell)
  - crypto: starfive - Fix memory leak in starfive_aes_aead_do_one_req() (Zilin Guan)
  - fs/tests: exec: drop duplicate bprm_stack_limits test vectors (Titouan Ameline de Cadeville)
  - sched/rt: Skip currently executing CPU in rto_next_cpu() (Chen Jinghuang)
  - sched/deadline: Clear the defer params (Joel Fernandes)
  - media: pci: mg4b: Use IRQF_NO_THREAD (Sebastian Andrzej Siewior)
  - mfd: wm8350-core: Use IRQF_ONESHOT (Sebastian Andrzej Siewior)
  - EDAC/altera: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
  - scsi: efct: Use IRQF_ONESHOT and default primary handler (Sebastian Andrzej Siewior)
  - Bluetooth: btintel_pcie: Use IRQF_ONESHOT and default primary handler (Sebastian Andrzej Siewior)
  - platform/x86: int0002: Remove IRQF_ONESHOT from request_irq() (Sebastian Andrzej Siewior)
  - genirq: Set IRQF_COND_ONESHOT in devm_request_irq(). (Sebastian Andrzej Siewior)
  - bpf: Fix bpf_xdp_store_bytes proto for read-only arg (Paul Chaignon)
  - crypto: caam - fix netdev memory leak in dpaa2_caam_probe (Jianpeng Chang)
  - crypto: hisilicon/trng - support tfms sharing the device (Weili Qian)
  - x86/fgraph,bpf: Switch kprobe_multi program stack unwind to hw_regs path (Jiri Olsa)
  - x86/fgraph,bpf: Fix stack ORC unwind from kprobe_multi return probe (Jiri Olsa)
  - tracing: Add ftrace_fill_perf_regs() for perf event (Masami Hiramatsu)
  - tracing: Add ftrace_partial_regs() for converting ftrace_regs to pt_regs (Masami Hiramatsu)
  - fgraph: Replace fgraph_ret_regs with ftrace_regs (Masami Hiramatsu)
  - ftrace: Rename ftrace_regs_return_value to ftrace_regs_get_return_value (Masami Hiramatsu)
  - ftrace: Use arch_ftrace_regs() for ftrace_regs_*() macros (Masami Hiramatsu)
  - ftrace: Consolidate ftrace_regs accessor functions for archs using pt_regs (Steven Rostedt)
  - ftrace: Make ftrace_regs abstract from direct use (Steven Rostedt)
  - tracing: Add a comment about ftrace_regs definition (Masami Hiramatsu)
  - bpf, sockmap: Fix FIONREAD for sockmap (Jiayuan Chen)
  - bpf, sockmap: Fix incorrect copied_seq calculation (Jiayuan Chen)
  - crypto: ccp - narrow scope of snp_range_list (Tycho Andersen)
  - crypto: ccp - Ensure implicit SEV/SNP init and shutdown in ioctls (Ashish Kalra)
  - hrtimer: Fix trace oddity (Thomas Gleixner)
  - selftests/bpf: Fix resource leak in serial_test_wq on attach failure (Kery Qi)
  - bpf: Preserve id of register in sync_linked_regs() (Puranjay Mohan)
  - crypto: hisilicon/sec2 - support skcipher/aead fallback for hardware queue unavailable (Qi Tao)
  - crypto: hisilicon/zip - adjust the way to obtain the req in the callback function (Chenghai Huang)
  - crypto: octeontx - fix dma_free_coherent() size (Thomas Fourier)
  - crypto: cavium - fix dma_free_coherent() size (Thomas Fourier)
  - ARM: VDSO: Patch out __vdso_clock_getres() if unavailable (Thomas Weißschuh)
  - libbpf: Fix OOB read in btf_dump_get_bitfield_value (Varun R Mallya)
  - selftests/bpf: veristat: fix printing order in output_stats() (Puranjay Mohan)
  - crypto: qat - fix warning on adf_pfvf_pf_proto.c (Giovanni Cabiddu)
  - perf/x86/core: Do not set bit width for unavailable counters (Sandipan Das)
  - s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (Salah Triki)
  - PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races (Gui-Dong Han)
  - cpufreq: intel_pstate: Enable asym capacity only when CPU SMT is not possible (Yaxiong Tian)
  - perf: arm_spe: Properly set hw.state on failures (Leo Yan)
  - PM: wakeup: Handle empty list in wakeup_sources_walk_start() (Sam Wu)
  - md/raid1: fix memory leak in raid1_run() (Zilin Guan)
  - md/raid1: fix memory leak in raid1_run() if no active rdev (Zheng Qixing)
  - Partial revert "x86/xen: fix balloon target initialization for PVH dom0" (Roger Pau Monné)
  - ublk: Validate SQE128 flag before accessing the cmd (Govindarajulu Varadarajan)
  - thermal/of: Fix reference leak in thermal_of_cm_lookup() (Felix Gu)
  - iomap: fix submission side handling of completion side errors (Christoph Hellwig)
  - cpufreq: scmi: Fix device_node reference leak in scmi_cpu_domain_id() (Felix Gu)
  - OPP: Return correct value in dev_pm_opp_get_level (Aleks Todorov)
  - md/raid10: fix any_working flag handling in raid10_sync_request (Li Nan)
  - md/raid5: fix raid5_run() to return error when log_init() fails (Yu Kuai)
  - thermal: intel: x86_pkg_temp_thermal: Handle invalid temperature (Rafael J. Wysocki)
  - cpuidle: governors: menu: Always check timers with tick stopped (Rafael J. Wysocki)
  - io_uring/sync: validate passed in offset (Jens Axboe)
  - ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() (Alexey Simakov)
  - io_uring: use release-acquire ordering for IORING_SETUP_R_DISABLED (Caleb Sander)
  - xen/virtio: Don't use grant-dma-ops when running as Dom0 (Teddy Astie)
  - rnbd-srv: Fix server side setting of bi_size for special IOs (Florian-Ewald Mueller)
  - rnbd-srv: use bio_add_virt_nofail (Christoph Hellwig)
  - block: add a bio_add_virt_nofail helper (Christoph Hellwig)
  - smb: client: fix potential UAF and double free in smb2_open_file() (Paulo Alcantara)
  - btrfs: fix block_group_tree dirty_list corruption (Boris Burkov)
  - btrfs: qgroup: return correct error when deleting qgroup relation item (Filipe Manana)
  - erofs: handle end of filesystem properly for file-backed mounts (Gao Xiang)
  - erofs: get rid of raw bi_end_io() usage (Gao Xiang)
  - tpm: st33zp24: Fix missing cleanup on get_burstcount() error (Alper Ak)
  - tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure (Alper Ak)
  - i3c: dw: Fix memory leak in dw_i3c_master_i2c_xfers() (Zilin Guan)
  - i3c: dw: Initialize spinlock to avoid upsetting lockdep (Fredrik Markstrom)
  - gfs2: Fix use-after-free in iomap inline data write path (Deepanshu Kartikey)
  - gfs2: Fix slab-use-after-free in qd_put (Andreas Gruenbacher)
  - gfs2: Retries missing in gfs2_{rename,exchange} (Andreas Gruenbacher)
  - i3c: master: Update hot-join flag only on success (Adrian Hunter)
  - fs: add <linux/init_task.h> for 'init_fs' (Ben Dooks)
  - i3c: Move device name assignment after i3c_bus_init (Billy Tsai)
  - audit: move the compat_xxx_class[] extern declarations to audit_arch.h (Ben Dooks)
  - rcu: Fix rcu_read_unlock() deadloop due to softirq (Yao Kai)
  - rcu: Remove local_irq_save/restore() in rcu_preempt_deferred_qs_handler() (Zqiang)
  - rcu: Refactor expedited handling check in rcu_read_unlock_special() (Joel Fernandes)
  - hfsplus: return error when node already exists in hfs_bnode_create (Shardul Bankar)
  - auxdisplay: arm-charlcd: fix release_mem_region() size (Thomas Fourier)
  - RDMA/umad: Reject negative data_len in ib_umad_write (Yunje Shin) [Orabug: 39103108] {CVE-2026-23243}
  - RDMA/siw: Fix potential NULL pointer dereference in header processing (Yunje Shin)


