# changelog

author: Brian Maly <brian.maly@oracle.com> [5.15.0-309.180.3.el9uek]
changelog:
  - net/mlx5: Reclaim max 50K pages at once (Anand Khoje) [Orabug: 36933755]
  - x86/sev: Fix position dependent variable references in startup code (Ard Biesheuvel) [Orabug: 37356711]
  - x86/PCI: Export find_cap() to be used in early PCI code (Rayan Dasoriya) [Orabug: 37356711]
  - x86/quirks: Scan all busses for early PCI quirks (Rayan Dasoriya) [Orabug: 37356711]
  - x86/quirks: Add parameter to clear MSIs early on boot (Rayan Dasoriya) [Orabug: 37356711]
  - iommu/amd: Add map/unmap_pages() iommu_domain_ops callback support (Vasant Hegde) [Orabug: 37356711]
  - iommu/amd/io-pgtable: Implement unmap_pages io_pgtable_ops callback (Vasant Hegde) [Orabug: 37356711]
  - iommu/amd/io-pgtable: Implement map_pages io_pgtable_ops callback (Vasant Hegde) [Orabug: 37356711]
  - iommu/amd: Use put_pages_list (Matthew Wilcox) [Orabug: 37356711]
  - x86/sev: Make enc_dec_hypercall() accept a size instead of npages (Steve Rutherford) [Orabug: 37356711]
  - iommu/amd: Simplify pagetable freeing (Robin Murphy) [Orabug: 37356711]
  - x86/kvm: Add kexec support for SEV Live Migration. (Ashish Kalra) [Orabug: 37356711]
  - nfsd: allow layout state to be admin-revoked. (Neil Brown) [Orabug: 37644985]
  - nfsd: allow delegation state ids to be revoked and then freed (Neil Brown) [Orabug: 37644985]
  - nfsd: allow open state ids to be revoked and then freed (Neil Brown) [Orabug: 37644985]
  - nfsd: allow lock state ids to be revoked and then freed (Neil Brown) [Orabug: 37644985]
  - nfsd: allow admin-revoked NFSv4.0 state to be freed. (Neil Brown) [Orabug: 37644985]
  - nfsd: report in /proc/fs/nfsd/clients/*/states when state is admin-revoke (Neil Brown) [Orabug: 37644985]
  - nfsd: allow state with no file to appear in /proc/fs/nfsd/clients/*/states (Neil Brown) [Orabug: 37644985]
  - nfsd: prepare for supporting admin-revocation of state (Neil Brown) [Orabug: 37644985]
  - nfsd: split sc_status out of sc_type (Neil Brown) [Orabug: 37644985]
  - nfsd: remove stale comment in nfs4_show_deleg() (Neil Brown) [Orabug: 37644985]
  - nfsd: avoid race after unhash_delegation_locked() (Neil Brown) [Orabug: 37644985]
  - nfsd: don't call functions with side-effecting inside WARN_ON() (Neil Brown) [Orabug: 37644985]
  - NFSD: Add nfsd_seq4_status trace event (Chuck Lever) [Orabug: 37644985]
  - NFSD: Clean up nfsd4_encode_layoutreturn() (Chuck Lever) [Orabug: 37644985]
  - NFSD: Make @lgp parameter of ->encode_layoutget a const pointer (Chuck Lever) [Orabug: 37644985]
  - NFSD: Clean up nfsd4_encode_stateid() (Chuck Lever) [Orabug: 37644985]
  - NFSD: Add simple u32, u64, and bool encoders (Chuck Lever) [Orabug: 37644985]
  - NFSD: Add encoders for NFSv4 clientids and verifiers (Chuck Lever) [Orabug: 37644985]
  - nfsd: add some kerneldoc comments for stateid preprocessing functions (Jeff Layton) [Orabug: 37644985]
  - nfsd: eliminate find_deleg_file_locked (Jeff Layton) [Orabug: 37644985]
  - nfsd: fix potential race in nfs4_find_file (Jeff Layton) [Orabug: 37644985]
  - vhost-scsi: Fix vhost_scsi_send_status() (Dongli Zhang) [Orabug: 37840544]
  - vhost-scsi: Fix vhost_scsi_send_bad_target() (Dongli Zhang) [Orabug: 37840544]
  - vhost-scsi: protect vq->log_used with vq->mutex (Dongli Zhang) [Orabug: 37840544,38095126] {CVE-2025-38074}
  - vhost-scsi: Reduce response iov mem use (Mike Christie) [Orabug: 37840544]
  - vhost-scsi: Allocate iov_iter used for unaligned copies when needed (Mike Christie) [Orabug: 37840544]
  - vhost-scsi: Stop duplicating se_cmd fields (Mike Christie) [Orabug: 37840544]
  - vhost-scsi: Dynamically allocate scatterlists (Mike Christie) [Orabug: 37840544]
  - vhost-scsi: Return queue full for page alloc failures during copy (Mike Christie) [Orabug: 37840544]
  - vhost-scsi: Add better resource allocation failure handling (Mike Christie) [Orabug: 37840544]
  - vhost-scsi: Allocate T10 PI structs only when enabled (Mike Christie) [Orabug: 37840544]
  - vhost-scsi: Reduce mem use by moving upages to per queue (Mike Christie) [Orabug: 37840544]
  - scsi: target: core: Use RCU helpers for INQUIRY t10_alua_tg_pt_gp (Mike Christie) [Orabug: 37840544]
  - scsi: target: Perform ALUA group changes in one step (Mike Christie) [Orabug: 37840544]
  - scsi: target: Replace lun_tg_pt_gp_lock with rcu in I/O path (Mike Christie) [Orabug: 37840544]
  - scsi: target: Fix write perf due to unneeded throttling (Mike Christie) [Orabug: 37840544]
  - vhost scsi: Allow user to control num virtqueues (Mike Christie) [Orabug: 37840544]
  - vhost-scsi: Rename vhost_scsi_iov_to_sgl (Mike Christie) [Orabug: 37840544]
  - vhost-scsi: unbreak any layout for response (Jason Wang) [Orabug: 37840544]
  - Revert "vhost-scsi: protect vq->log_base with vq->mutex" (Mike Christie) [Orabug: 37840544]
  - Revert "vhost_scsi: log write descriptors" (Mike Christie) [Orabug: 37840544]
  - x86/bugs: Enabling Retbleed and SRSO mitigation can taint the kernel (Alexandre Chartre) [Orabug: 37945824]
  - x86/bhi: Do not set BHI_DIS_S in 32-bit mode (Pawan Gupta) [Orabug: 37945831]
  - x86/bpf: Add IBHF call at end of classic BPF (Daniel Sneddon) [Orabug: 37945831]
  - x86/bpf: Call branch history clearing sequence on exit (Daniel Sneddon) [Orabug: 37945831]
  - selftest/x86/bugs: Add selftests for ITS (Pawan Gupta) [Orabug: 37945842] {CVE-2024-28956}
  - x86/its: Align RETs in BHB clear sequence to avoid thunking (Pawan Gupta) [Orabug: 37945842] {CVE-2024-28956}
  - x86/its: Add "vmexit" option to skip mitigation on some CPUs (Pawan Gupta) [Orabug: 37945842] {CVE-2024-28956}
  - x86/its: Enable Indirect Target Selection mitigation (Pawan Gupta) [Orabug: 37945842] {CVE-2024-28956}
  - x86/its: Add support for ITS-safe return thunk (Pawan Gupta) [Orabug: 37945842] {CVE-2024-28956}
  - x86/its: Add support for ITS-safe indirect thunk (Pawan Gupta) [Orabug: 37945842] {CVE-2024-28956}
  - x86/its: Enumerate Indirect Target Selection (ITS) bug (Pawan Gupta) [Orabug: 37945842] {CVE-2024-28956}
  - Documentation: x86/bugs/its: Add ITS documentation (Pawan Gupta) [Orabug: 37945842] {CVE-2024-28956}
  - x86/alternatives: Remove faulty optimization (Josh Poimboeuf) [Orabug: 37945842] {CVE-2024-28956}
  - x86/alternative: Optimize returns patching (Borislav Petkov) [Orabug: 37945842] {CVE-2024-28956}


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-309.180.4.el9uek]
changelog:
  - nvme: unblock ctrl state transition for firmware update (Daniel Wagner)
  - nfsd: decrease sc_count directly if fail to queue dl_recall (Li Lingfeng) [Orabug: 37938121] {CVE-2025-37871}
  - cpufreq/sched: Fix the usage of CPUFREQ_NEED_UPDATE_LIMITS (Rafael J. Wysocki)
  - ice: Check VF VSI Pointer Value in ice_vc_add_fdir_fltr() (Luoxuanqiang) [Orabug: 37976780] {CVE-2025-37912}
  - usb: chipidea: ci_hdrc_imx: fix usbmisc handling (Fedor Pchelkin) [Orabug: 37938106] {CVE-2025-37811}
  - Revert "PCI: Avoid reset when disabled via sysfs" (Alex Williamson)
  - uek-rpm: CONFIG_PTP_1588_CLOCK_OCP enable for OCI (Vijayendra Suman) [Orabug: 37777354]
  - ptp: ocp: let ptp core report driver name instead of the drivers (Vijayendra Suman) [Orabug: 37777354]
  - ptp: ocp: Add .getmaxphase ptp_clock_info callback (Rahul Rameshbabu) [Orabug: 37777354]
  - ptp: ocp: remove flash image header check fallback (Vadim Fedorenko) [Orabug: 37777354]
  - ptp: ocp: expose config and temperature for ART card (Vadim Fedorenko) [Orabug: 37777354]
  - ptp: ocp: add serial port of mRO50 MAC on ART card (Vadim Fedorenko) [Orabug: 37777354]
  - ptp: ocp: add Orolia timecard support (Vadim Fedorenko) [Orabug: 37777354]
  - ptp: ocp: upgrade serial line information (Vadim Fedorenko) [Orabug: 37777354]
  - ] ptp: ocp: remove symlink for second GNSS (Vadim Fedorenko) [Orabug: 37777354]
  - ptp_ocp: use device_find_any_child() instead of custom approach (Andy Shevchenko) [Orabug: 37777354]
  - ptp_ocp: replace kzalloc(x*y) by kcalloc(y, x) (Andy Shevchenko) [Orabug: 37777354]
  - ptp_ocp: do not call pci_set_drvdata(pdev, NULL) (Andy Shevchenko) [Orabug: 37777354]
  - ptp_ocp: drop duplicate NULL check in ptp_ocp_detach() (Andy Shevchenko) [Orabug: 37777354]
  - ptp_ocp: use bits.h macros for all masks (Andy Shevchenko) [Orabug: 37777354]
  - ptp: ocp: Add firmware header checks (Vadim Fedorenko) [Orabug: 37777354]
  - ptp: ocp: fix PPS source selector debugfs reporting (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: add .init function for sma_op vector (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: vectorize the sma accessor functions (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: constify selectors (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: parameterize input/output sma selectors (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: revise firmware display (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: add Celestica timecard PCI ids (Vadim Fedorenko) [Orabug: 37777354]
  - ptp: ocp: Remove #ifdefs around PCI IDs (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: 32-bit fixups for pci start address (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: change sysfs attr group handling (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: have adjtime handle negative delta_ns correctly (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: Use DIV64_U64_ROUND_UP for rounding. (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: handle error from nvmem_device_find (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: use snprintf() in ptp_ocp_verify() (Dan Carpenter) [Orabug: 37777354]
  - ptp: ocp: Make debugfs variables the correct bitwidth (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: Fix PTP_PF_* verification requests (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: Add 2 more timestampers (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: Add 4 frequency counters (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: Program the signal generators via PTP_CLK_REQ_PEROUT (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: Add signal generators and update sysfs nodes (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: Add firmware capability bits for feature gating (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: Add GND and VCC output selectors (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: Rename output selector 'GNSS' to 'GNSS1' (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: Add ability to disable input selectors. (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: Add support for selectable SMA directions. (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: add UPF_NO_THRE_TEST flag for serial ports (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: Update devlink firmware display path. (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: add nvmem interface for accessing eeprom (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: correct label for error path (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: off by in in ptp_ocp_tod_gnss_name() (Dan Carpenter) [Orabug: 37777354]
  - ptp: ocp: Add serial port information to the debug summary (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: adjust utc_tai_offset to TOD info (Vadim Fedorenko) [Orabug: 37777354]
  - ptp: ocp: add tod_correction attribute (Vadim Fedorenko) [Orabug: 37777354]
  - ptp: ocp: Expose clock status drift and offset (Vadim Fedorenko) [Orabug: 37777354]
  - ptp: ocp: add TOD debug information (Vadim Fedorenko) [Orabug: 37777354]
  - ptp: ocp: Add ptp_ocp_adjtime_coarse for large adjustments (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: Move devlink registration to be last devlink command (Leon Romanovsky) [Orabug: 37777354]
  - ptp: ocp: Avoid operator precedence warning in ptp_ocp_summary_show() (Nathan Chancellor) [Orabug: 37777354]
  - ptp: ocp: Add timestamp window adjustment (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: Have FPGA fold in ns adjustment for adjtime. (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: Enable 4th timestamper / PPS generator (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: Add second GNSS device (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: Add NMEA output (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: Add debugfs entry for timecard (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: Separate the init and info logic (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: Add sysfs attribute utc_tai_offset (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: Add IRIG-B output mode control (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: Add IRIG-B and DCF blocks (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: Add SMA selector and controls (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: Add third timestamper (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: Report error if resource registration fails. (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: Skip resources with out of range irqs (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: Skip I2C flash read when there is no controller. (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: Parameterize the TOD information display. (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: parameterize the i2c driver used (Jonathan Lemon) [Orabug: 37777354]
  - vhost-scsi: log event queue write descriptors (Dongli Zhang) [Orabug: 37884058]
  - vhost-scsi: log control queue write descriptors (Dongli Zhang) [Orabug: 37884058]
  - vhost-scsi: log I/O queue write descriptors (Dongli Zhang) [Orabug: 37884058]
  - vhost-scsi: adjust vhost_scsi_get_desc() to log vring descriptors (Dongli Zhang) [Orabug: 37884058]
  - vhost: modify vhost_log_write() for broader users (Dongli Zhang) [Orabug: 37884058]
  - mm: make page_mapped_in_vma() hugetlb walk aware (Jane Chu) [Orabug: 37956589]
  - mm/rmap: Fix handling of hugetlbfs pages in page_vma_mapped_walk (Zhenwei Pi) [Orabug: 37956589]
  - ext4: update the backup superblock's at the end of the online resize (Theodore Ts'O) [Orabug: 37356729]
  - gve: ignore nonrelevant GSO type bits when processing TSO headers (Joshua Washington) [Orabug: 37356729]
  - gve: update gve.rst (Rushil Gupta) [Orabug: 37356729]
  - gve: RX path for DQO-QPL (Rushil Gupta) [Orabug: 37356729]
  - gve: Tx path for DQO-QPL (Rushil Gupta) [Orabug: 37356729]
  - gve: Control path for DQO-QPL (Rushil Gupta) [Orabug: 37356729]
  - gve: Fix gve interrupt names (Praveen Kaligineedi) [Orabug: 37356729]
  - gve: Handle alternate miss completions (Jeroen de Borst) [Orabug: 37356729]
  - gve: Adding a new AdminQ command to verify driver (Jeroen de Borst) [Orabug: 37356729]
  - gve: Fix error return code in gve_prefill_rx_pages() (Yang Yingliang) [Orabug: 37356729]
  - gve: Reduce alloc and copy costs in the GQ rx path (Shailend Chand) [Orabug: 37356729]
  - google/gve:fix repeated words in comments (Jilin Yuan) [Orabug: 37356729]
  - gve: Fix spelling mistake "droping" -> "dropping" (Colin Ian King) [Orabug: 37356729]
  - gve: enhance no queue page list detection (Haiyue Wang) [Orabug: 37356729]
  - gve: Recording rx queue before sending to napi (Tao Liu) [Orabug: 37356729]
  - ext4: add ioctls to get/set the ext4 superblock uuid (Jeremy Bongio) [Orabug: 37356729]
  - ext4: implement support for get/set fs label (Lukas Czerner) [Orabug: 37356729]
  - gve: Add tx|rx-coalesce-usec for DQO (Tao Liu) [Orabug: 37356729]
  - gve: Add consumed counts to ethtool stats (Jordan Kim) [Orabug: 37356729]
  - gve: Implement suspend/resume/shutdown (Catherine Sullivan) [Orabug: 37356729]
  - gve: Add optional metadata descriptor type GVE_TXD_MTD (Willem de Bruijn) [Orabug: 37356729]
  - gve: remove memory barrier around seqno (Catherine Sullivan) [Orabug: 37356729]
  - gve: Update gve_free_queue_page_list signature (Catherine Sullivan) [Orabug: 37356729]
  - gve: Move the irq db indexes out of the ntfy block struct (Catherine Sullivan) [Orabug: 37356729]
  - gve: Correct order of processing device options (Jeroen de Borst) [Orabug: 37356729]
  - gve: fix for null pointer dereference. (Ameer Hamza) [Orabug: 37356729]
  - gve: fix unmatched u64_stats_update_end() (Dan Carpenter) [Orabug: 37356729]
  - gve: Add a jumbo-frame device option. (Shailend Chand) [Orabug: 37356729]
  - gve: Implement packet continuation for RX. (David Awogbemila) [Orabug: 37356729]
  - gve: Allow pageflips on larger pages (Jordan Kim) [Orabug: 37356729]
  - gve: Add netif_set_xps_queue call (Catherine Sullivan) [Orabug: 37356729]
  - gve: Do lazy cleanup in TX path (Tao Liu) [Orabug: 37356729]
  - gve: Add rx buffer pagecnt bias (Catherine Sullivan) [Orabug: 37356729]
  - gve: Switch to use napi_complete_done (Yanchun Fu) [Orabug: 37356729]
  - gve: Use kvcalloc() instead of kvzalloc() (Gustavo A R Silva) [Orabug: 37356729]
  - selftests/net: optmem_max became per netns (Eric Dumazet) [Orabug: 37356732]
  - tcp: derive delack_max with tcp_rto_min helper (Kevin Yang) [Orabug: 37356732]
  - tcp: derive delack_max from rto_min (Eric Dumazet) [Orabug: 37356732]
  - tcp: add sysctl_tcp_rto_min_us (Kevin Yang) [Orabug: 37356732]
  - tcp: constify tcp_rto_min() and tcp_rto_min_us() argument (Eric Dumazet) [Orabug: 37356732]
  - net: constify sk_dst_get() and __sk_dst_get() argument (Eric Dumazet) [Orabug: 37356732]
  - net: Namespace-ify sysctl_optmem_max (Eric Dumazet) [Orabug: 37356732]
  - net: increase optmem_max default value (Eric Dumazet) [Orabug: 37356732]
  - net: phy: dp83867: Fix SGMII FIFO depth for non OF devices (Michael Sit Wei Hong) [Orabug: 37670821]
  - net: phy: dp83867: fix get nvmem cell fail (Nikita Shubin) [Orabug: 37670821]
  - net: phy: dp83867: implement support for io_impedance_ctrl nvmem cell (Rasmus Villemoes) [Orabug: 37670821]
  - net: phy: constify netdev->dev_addr references (Jakub Kicinski) [Orabug: 37670821]
  - net: phy: dp83867: introduce critical chip default init for non-of platform (Lay, Kuan Loon) [Orabug: 37670821]
  - RDS: use pin_user_pages_fast() (Stephen Brennan) [Orabug: 37872748]
  - uek-rpm: Reduce the size of the Bluefield 3 kernel (Henry Willard) [Orabug: 37910874]
  - uek-rpm: Make sure dtb directory exists for emb3. (Henry Willard) [Orabug: 37910874]
  - uek-rpm: Move the gve kernel module from extra to kernel-uek-core (Samasth Norway Ananda) [Orabug: 37940898]
  - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (Shravan Kumar Ramani) [Orabug: 37955981]
  - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (David Thompson) [Orabug: 37955981,37989158] {CVE-2025-37866}
  - mlxbf-bootctl: Support sysfs entries for RTC battery status (Xiangrong Li) [Orabug: 37955981]
  - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37955981]
  - drivers/platform/mellanox: Convert snprintf to sysfs_emit (Li Zhijian) [Orabug: 37955981]
  - certs: Add new Oracle Linux Driver Signing (key 1) certificate (Sherry Yang) [Orabug: 37967553]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-310.180.1.el9uek]
changelog:
  - uek-rpm: Enable CONFIG_ACPI_THERMAL and other ACPI config for Bluefield 3 (Thomas Tai) [Orabug: 38007368]
  - dt-bindings: trivial-devices: add onnn,adt7462 (Chanh Nguyen) [Orabug: 38006900]
  - mailbox: pcc: Check before sending MCTP PCC response ACK (Adam Young) [Orabug: 38006900]
  - media: dt-bindings: Add OV5642 (Fabio Estevam) [Orabug: 38006900]
  - hwmon: (xgene) Migrate to use generic PCC shmem related macros (Sudeep Holla) [Orabug: 38006900]
  - i2c: xgene-slimpro: Migrate to use generic PCC shmem related macros (Sudeep Holla) [Orabug: 38006900]
  - ACPI: PCC: Add PCC shared memory region command and status bitfields (Sudeep Holla) [Orabug: 38006900]
  - mailbox: pcc: Support shared interrupt for multiple subspaces (Huisong Li) [Orabug: 38006900]
  - mailbox: pcc: Add support for platform notification handling (Huisong Li) [Orabug: 38006900]
  - mailbox: pcc: Use mbox_bind_client (Elliot Berman) [Orabug: 38006900]
  - mailbox: omap: Use mbox_bind_client (Elliot Berman) [Orabug: 38006900]
  - mailbox: Allow direct registration to a channel (Elliot Berman) [Orabug: 38006900]
  - mailbox: pcc: Reset pcc_chan_count to zero in case of PCC probe failure (Huisong Li) [Orabug: 38006900]
  - mailbox: pcc: Fix spelling mistake "Plaform" -> "Platform" (Colin Ian King) [Orabug: 38006900]
  - mailbox: pcc: Fix an invalid-load caught by the address sanitizer (Mario Limonciello) [Orabug: 38006900]
  - mailbox: pcc: Handle all PCC subtypes correctly in pcc_mbox_irq (Sudeep Holla) [Orabug: 38006900]
  - mailbox: pcc: Avoid using the uninitialized variable 'dev' (Sudeep Holla) [Orabug: 38006900]
  - ACPI/PCC: Add maintainer for PCC mailbox driver (Sudeep Holla) [Orabug: 38006900]
  - mailbox: pcc: Move bulk of PCCT parsing into pcc_mbox_probe (Sudeep Holla) [Orabug: 38006900]
  - mailbox: pcc: Add support for PCCT extended PCC subspaces(type 3/4) (Sudeep Holla) [Orabug: 38006900]
  - mailbox: pcc: Drop handling invalid bit-width in {read,write}_register (Sudeep Holla) [Orabug: 38006900]
  - mailbox: pcc: Avoid accessing PCCT table in pcc_send_data and pcc_mbox_irq (Sudeep Holla) [Orabug: 38006900]
  - mailbox: pcc: Add PCC register bundle and associated accessor functions (Sudeep Holla) [Orabug: 38006900]
  - mailbox: pcc: Rename doorbell ack to platform interrupt ack register (Sudeep Holla) [Orabug: 38006900]
  - uek-rpm: Enable CONFIG_VITESSE_PHY for Bluefield 3 (Thomas Tai) [Orabug: 37985802]
  - x86/its: Fix build errors when CONFIG_MODULES=n (Eric Biggers) [Orabug: 37970165]
  - x86/its: Use dynamic thunks for indirect branches (Peter Zijlstra) [Orabug: 37970165]
  - x86/modules: Set VM_FLUSH_RESET_PERMS in module_alloc() (Thomas Gleixner) [Orabug: 37970165]
  - uek-rpm/config-aarch64: Enable BT_HCIUART_BCM for RPi Bluetooth (Vijay Kumar) [Orabug: 37960844]
  - x86/its: its_native_only bug is not correctly reported (Alexandre Chartre) [Orabug: 37960160]
  - RDMA/mlx5: Fix CC counters query for MPV (Patrisious Haddad) [Orabug: 37358844]
  - amd_hsmp: Increase the SMU timeout to 500ms (Vijay Kumar) [Orabug: 37266677]
  - bpf/bpf_get,set_sockopt: add option to set TCP-BPF sock ops flags (Alan Maguire) [Orabug: 36699198]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-310.184.2.el9uek]
changelog:
  - LTS version: v5.15.184 (Vijayendra Suman)
  - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [Orabug: 38071844] {CVE-2024-56655}
  - netfilter: nf_tables: wait for rcu grace period on net_device removal (Pablo Neira Ayuso)
  - netfilter: nf_tables: pass nft_chain to destroy function, not nft_ctx (Florian Westphal)
  - btrfs: do not clean up repair bio if submit fails (Josef Bacik)
  - btrfs: don't BUG_ON() when 0 reference count at btrfs_lookup_extent_info() (Filipe Manana) [Orabug: 37074536] {CVE-2024-46751}
  - sctp: add mutual exclusion in proc_sctp_do_udp_port() (Eric Dumazet) [Orabug: 37844338] {CVE-2025-22062}
  - selftests/mm: compaction_test: support platform with huge mount of memory (Feng Tang)
  - usb: typec: fix pm usage counter imbalance in ucsi_ccg_sync_control() (Gong, Ruiqi)
  - usb: typec: fix potential array underflow in ucsi_ccg_sync_control() (Dan Carpenter) [Orabug: 37433551] {CVE-2024-53203}
  - usb: typec: altmodes/displayport: create sysfs nodes as driver's default device attribute group (Rd Babiera) [Orabug: 36642199] {CVE-2024-35790}
  - usb: typec: ucsi: displayport: Fix deadlock (Andrei Kuchynski) [Orabug: 37977019] {CVE-2025-37967}
  - clocksource/i8253: Use raw_spinlock_irqsave() in clockevent_i8253_disable() (Sebastian Andrzej Siewior)
  - block: fix direct io NOWAIT flag not work (Fengnan Chang)
  - dmaengine: idxd: fix memory leak in error handling path of idxd_setup_groups (Shuai Xue)
  - dmaengine: idxd: fix memory leak in error handling path of idxd_setup_engines (Shuai Xue)
  - dmaengine: ti: k3-udma: Use cap_mask directly from dma_device structure instead of a local copy (Yemike Abhilash Chandra)
  - dmaengine: ti: k3-udma: Add missing locking (Ronald Wahl) [Orabug: 38094757] {CVE-2025-38005}
  - wifi: mt76: disable napi on driver removal (Fedor Pchelkin) [Orabug: 38094771] {CVE-2025-38009}
  - phy: renesas: rcar-gen3-usb2: Set timing registers only once (Claudiu Beznea)
  - phy: Fix error handling in tegra_xusb_port_init (Ma Ke)
  - tracing: samples: Initialize trace_array_printk() with the correct function (Steven Rostedt)
  - ftrace: Fix preemption accounting for stacktrace filter command (Donglin Peng)
  - ftrace: Fix preemption accounting for stacktrace trigger command (Donglin Peng)
  - ALSA: usb-audio: Add sample rate quirk for Microdia JP001 USB Camera (Nicolas Chauvet)
  - ALSA: usb-audio: Add sample rate quirk for Audioengine D1 (Christian Heusel)
  - ALSA: es1968: Add error handling for snd_pcm_hw_constraint_pow2() (Xu Wang)
  - ACPI: PPTT: Fix processor subtable walk (Jeremy Linton)
  - btrfs: fix discard worker infinite loop after disabling discard (Filipe Manana)
  - dmaengine: Revert "dmaengine: dmatest: Fix dmatest waiting less when interrupted" (Nathan Lynch)
  - x86/its: FineIBT-paranoid vs ITS (Peter Zijlstra)
  - x86/speculation: Remove the extra #ifdef around CALL_NOSPEC (Pawan Gupta)
  - x86/speculation: Add a conditional CS prefix to CALL_NOSPEC (Pawan Gupta)
  - x86/speculation: Simplify and make CALL_NOSPEC consistent (Pawan Gupta)
  - x86,nospec: Simplify {JMP,CALL}_NOSPEC (Peter Zijlstra)
  - NFSv4/pnfs: Reset the layout state after a layoutreturn (Trond Myklebust)
  - qlcnic: fix memory leak in qlcnic_sriov_channel_cfg_cmd() (Abdun Nihaal)
  - ALSA: sh: SND_AICA should depend on SH_DMA_API (Geert Uytterhoeven)
  - net: dsa: sja1105: discard incoming frames in BR_STATE_LISTENING (Vladimir Oltean)
  - net: cadence: macb: Fix a possible deadlock in macb_halt_tx. (Mathieu Othacehe)
  - net_sched: Flush gso_skb list too during ->change() (Cong Wang) [Orabug: 37998129] {CVE-2025-37992}
  - spi: loopback-test: Do not split 1024-byte hexdumps (Geert Uytterhoeven)
  - nfs: handle failure of nfs_get_lock_context in unlock path (Li Lingfeng) [Orabug: 38094819] {CVE-2025-38023}
  - RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug (Zhu Yanjun) [Orabug: 38094828] {CVE-2025-38024}
  - iio: chemical: sps30: use aligned_s64 for timestamp (David Lechner)
  - iio: adc: ad7768-1: Fix insufficient alignment of timestamp. (Jonathan Cameron)
  - tracing: probes: Fix a possible race in trace_probe_log APIs (Masami Hiramatsu)
  - platform/x86: asus-wmi: Fix wlan_ctrl_by_user detection (Hans de Goede)
  - LTS version: v5.15.183 (Vijayendra Suman)
  - Revert "net: phy: microchip: force IRQ polling mode for lan88xx" (Greg Kroah-Hartman)
  - do_umount(): add missing barrier before refcount checks in sync case (Al Viro)
  - drm/panel: simple: Update timings for AUO G101EVN010 (Kevin Baker)
  - MIPS: Fix MAX_REG_OFFSET (Thorsten Blum)
  - iio: adc: dln2: Use aligned_s64 for timestamp (Jonathan Cameron)
  - types: Complement the aligned types with signed 64-bit one (Andy Shevchenko)
  - usb: usbtmc: Fix erroneous generic_read ioctl return (Dave Penkler)
  - usb: usbtmc: Fix erroneous wait_srq ioctl return (Dave Penkler)
  - usb: usbtmc: Fix erroneous get_stb ioctl error returns (Dave Penkler)
  - USB: usbtmc: use interruptible sleep in usbtmc_read (Oliver Neukum)
  - usb: typec: ucsi: displayport: Fix NULL pointer access (Andrei Kuchynski) [Orabug: 38015127] {CVE-2025-37994}
  - usb: typec: tcpm: delay SNK_TRY_WAIT_DEBOUNCE to SRC_TRYWAIT transition (Rd Babiera)
  - usb: host: tegra: Prevent host controller crash when OTG port is used (Jim Lin)
  - usb: gadget: tegra-xudc: ACK ST_RC after clearing CTRL_RUN (Wayne Chang)
  - usb: cdnsp: fix L1 resume issue for RTL_REVISION_NEW_LPM version (Pawel Laszczak)
  - usb: cdnsp: Fix issue with resuming from L1 (Pawel Laszczak)
  - ocfs2: stop quota recovery before disabling quotas (Jan Kara)
  - ocfs2: implement handshaking with ocfs2 recovery thread (Jan Kara)
  - ocfs2: switch osb->disable_recovery to enum (Jan Kara)
  - module: ensure that kobject_put() is safe for module type kobjects (Dmitry Antipov) [Orabug: 38015132] {CVE-2025-37995}
  - xenbus: Use kref to track req lifetime (Jason Andryuk) [Orabug: 37976935] {CVE-2025-37949}
  - usb: uhci-platform: Make the clock really optional (Alexey Charkov)
  - drm/amd/display: Fix wrong handling for AUX_DEFER case (Wayne Lin)
  - iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_tagged_fifo (Silvano Seva) [Orabug: 37977032] {CVE-2025-37969}
  - iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_fifo (Silvano Seva) [Orabug: 37977038] {CVE-2025-37970}
  - iio: adis16201: Correct inclinometer channel resolution (Gabriel)
  - iio: adc: ad7606: fix serial register access (Angelo Dureghello)
  - staging: axis-fifo: Correct handling of tx_fifo_depth for size validation (Gabriel)
  - staging: axis-fifo: Remove hardware resets for user errors (Gabriel)
  - staging: iio: adc: ad7816: Correct conditional logic for store mode (Gabriel)
  - Input: synaptics - enable InterTouch on TUXEDO InfinityBook Pro 14 v5 (Aditya Garg)
  - Input: synaptics - enable SMBus for HP Elitebook 850 G1 (Dmitry Torokhov)
  - Input: synaptics - enable InterTouch on Dell Precision M3800 (Aditya Garg)
  - Input: synaptics - enable InterTouch on Dynabook Portege X30L-G (Aditya Garg)
  - Input: synaptics - enable InterTouch on Dynabook Portege X30-D (Manuel Fombuena)
  - net: dsa: b53: fix learning on VLAN unaware bridges (Jonas Gorski)
  - net: dsa: b53: always rejoin default untagged VLAN on bridge leave (Jonas Gorski)
  - net: dsa: b53: fix VLAN ID for untagged vlan on bridge leave (Jonas Gorski)
  - net: dsa: b53: fix flushing old pvid VLAN on pvid change (Jonas Gorski)
  - net: dsa: b53: fix clearing PVID of a port (Jonas Gorski)
  - net: dsa: b53: allow leaky reserved multicast (Jonas Gorski)
  - netfilter: ipset: fix region locking in hash types (Jozsef Kadlecsik) [Orabug: 38015142] {CVE-2025-37997}
  - can: gw: fix RCU/BH usage in cgw_create_job() (Oliver Hartkopp)
  - can: gw: use call_rcu() instead of costly synchronize_rcu() (Eric Dumazet)
  - gre: Fix again IPv6 link-local address generation. (Guillaume Nault)
  - openvswitch: Fix unsafe attribute parsing in output_userspace() (Eelco Chaudron) [Orabug: 38015149] {CVE-2025-37998}
  - can: mcp251xfd: mcp251xfd_remove(): fix order of unregistration calls (Marc Kleine-Budde)
  - can: mcan: m_can_class_unregister(): fix order of unregistration calls (Marc Kleine-Budde)
  - LTS version: v5.15.182 (Vijayendra Suman)
  - dm: fix copying after src array boundaries (Tudor Ambarus)
  - iommu/arm-smmu-v3: Fix iommu_device_probe bug due to duplicated stream ids (Nicolin Chen)
  - iommu/arm-smmu-v3: Use the new rb tree helpers (Jason Gunthorpe)
  - irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode() (Suzuki K Poulose) [Orabug: 37930013] {CVE-2025-37819}
  - irqchip/gic-v2m: Mark a few functions __init (Thomas Gleixner)
  - irqchip/gic-v2m: Add const to of_device_id (Xiang Wangx)
  - Revert "drm/meson: vclk: fix calculation of 59.94 fractional rates" (Christian Hewitt)
  - net: phy: microchip: force IRQ polling mode for lan88xx (Fiona Klute)
  - ARM: dts: opos6ul: add ksz8081 phy properties (Sébastien Szymanski)
  - firmware: arm_scmi: Balance device refcount when destroying devices (Cristian Marussi) [Orabug: 37976753] {CVE-2025-37905}
  - net: hns3: fix deadlock issue when externel_lb and reset are executed together (Yonglong Liu)
  - of: module: add buffer overflow check in of_modalias() (Sergey Shtylyov) [Orabug: 36753381] {CVE-2024-38541}
  - PCI: imx6: Skip controller_id generation logic for i.MX7D (Richard Zhu)
  - net: hns3: defer calling ptp_clock_register() (Jian Shen)
  - net: hns3: fixed debugfs tm_qset size (Hao Lan)
  - net: hns3: fix an interrupt residual problem (Yonglong Liu)
  - net: hns3: add support for external loopback test (Yonglong Liu)
  - net: hns3: store rx VLAN tag offload state for VF (Jian Shen)
  - net: fec: ERR007885 Workaround for conventional TX (Mattias Barthel)
  - net: lan743x: Fix memleak issue when GSO enabled (Thangaraj Samynathan) [Orabug: 37976766] {CVE-2025-37909}
  - nvme-tcp: fix premature queue removal and I/O failover (Michael Liang)
  - bnxt_en: Fix ethtool -d byte order for 32-bit values (Michael Chan)
  - bnxt_en: Fix out-of-bound memcpy() during ethtool -w (Shruti Parab) [Orabug: 37976774] {CVE-2025-37911}
  - bnxt_en: Fix coredump logic to free allocated buffer (Shruti Parab)
  - net: ipv6: fix UDPv6 GSO segmentation with NAT (Felix Fietkau)
  - net: dlink: Correct endianness handling of led_mode (Simon Horman)
  - net_sched: qfq: Fix double list add in class with netem as child qdisc (Victor Nogueira) [Orabug: 37976784] {CVE-2025-37913}
  - net_sched: ets: Fix double list add in class with netem as child qdisc (Victor Nogueira) [Orabug: 37976789] {CVE-2025-37914}
  - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (Victor Nogueira) [Orabug: 37967411] {CVE-2025-37890}
  - net_sched: drr: Fix double list add in class with netem as child qdisc (Victor Nogueira) [Orabug: 37976793] {CVE-2025-37915}
  - net: ethernet: mtk-star-emac: rearm interrupts in rx_poll only when advised (Louis-Alexis Eyraud)
  - net: ethernet: mtk-star-emac: fix spinlock recursion issues on rx/tx poll (Louis-Alexis Eyraud)
  - net: ethernet: mtk-star-emac: separate tx/rx handling with two NAPIs (Biao Huang)
  - net/mlx5: E-switch, Fix error handling for enabling roce (Chris Mi)
  - net/mlx5: E-Switch, Initialize MAC Address for Default GID (Maor Gottlieb)
  - net/sched: act_mirred: don't override retval if we already lost the skb (Jakub Kicinski) [Orabug: 36530679] {CVE-2024-26739}
  - KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop (Sean Christopherson) [Orabug: 37685666] {CVE-2025-21839}
  - tracing: Fix oob write in trace_seq_to_buffer() (Jeongjun Park) [Orabug: 37976822] {CVE-2025-37923}
  - iommu/vt-d: Apply quirk_iommu_igfx for 8086:0044 (QM57/QS57) (Mingcong Bai)
  - iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid (Pavel Paklov) [Orabug: 37976837] {CVE-2025-37927}
  - dm: always update the array size in realloc_argv on success (Benjamin Marzinski)
  - dm-integrity: fix a warning on invalid table line (Mikulas Patocka)
  - wifi: brcm80211: fmac: Add error handling for brcmf_usb_dl_writeimage() (Xu Wang) [Orabug: 37977120] {CVE-2025-37990}
  - mmc: renesas_sdhi: Fix error handling in renesas_sdhi_probe (Ruslan Piasetskyi)
  - amd-xgbe: Fix to ensure dependent features are toggled with RX checksum offload (Vishal Badole)
  - parisc: Fix double SIGFPE crash (Helge Deller) [Orabug: 37977128] {CVE-2025-37991}
  - arm64: errata: Add missing sentinels to Spectre-BHB MIDR arrays (Will Deacon) [Orabug: 38071958] {CVE-2025-37929}
  - i2c: imx-lpi2c: Fix clock count when probe defers (Clark Wang)
  - EDAC/altera: Set DDR and SDMMC interrupt mask before registration (Niravkumar L Rabara)
  - EDAC/altera: Test the correct error reg offset (Niravkumar L Rabara)
  - drm/nouveau: Fix WARN_ON in nouveau_fence_context_kill() (Philipp Stanner) [Orabug: 37976851] {CVE-2025-37930}
  - ALSA: usb-audio: Add second USB ID for Jabra Evolve 65 headset (Joachim Priesner)
  - LTS version: v5.15.181 (Vijayendra Suman)
  - PCI: Release resource invalidated by coalescing (Ross Lagerwall)
  - PCI: Fix dropping valid root bus resources with .end = zero (Geert Uytterhoeven)
  - PCI: Fix use-after-free in pci_bus_release_domain_nr() (Rob Herring)
  - nvme: fixup scan failure for non-ANA multipath controllers (Hannes Reinecke)
  - MIPS: cm: Fix warning if MIPS_CM is disabled (Thomas Bogendoerfer)
  - xdp: Reset bpf_redirect_info before running a xdp's BPF prog. (Sebastian Andrzej Siewior)
  - drm/amd/display: fix double free issue during amdgpu module unload (Tim Huang) [Orabug: 37206238] {CVE-2024-49989}
  - net: dsa: mv88e6xxx: enable .port_set_policy() for 6320 family (Marek Behún)
  - net: dsa: mv88e6xxx: enable PVT for 6321 switch (Marek Behún)
  - net: dsa: mv88e6xxx: fix atu_move_port_mask for 6341 family (Marek Behún)
  - crypto: atmel-sha204a - Set hwrng quality to lowest possible (Marek Behún)
  - comedi: jr3_pci: Fix synchronous deletion of timer (Ian Abbott)
  - jfs: define xtree root and page independently (Dave Kleikamp)
  - md/raid1: Add check for missing source disk in process_checks() (Meir Elisha)
  - ubsan: Fix panic from test_ubsan_out_of_bounds (Mostafa Saleh)
  - loop: aio inherit the ioprio of original request (Yunlong Xing)
  - scsi: pm80xx: Set phy_attached to zero when device is gone (Igor Pylypiv)
  - scsi: hisi_sas: Fix I/O errors caused by hardware port ID changes (Xingui Yang)
  - ext4: make block validity check resistent to sb bh corruption (Ojaswin Mujoo)
  - nvmet-fc: put ref when assoc->del_work is already scheduled (Daniel Wagner)
  - nvmet-fc: take tgtport reference only once (Daniel Wagner)
  - x86/bugs: Don't fill RSB on context switch with eIBRS (Josh Poimboeuf)
  - x86/bugs: Don't fill RSB on VMEXIT with eIBRS+retpoline (Josh Poimboeuf)
  - x86/bugs: Use SBPB in write_ibpb() if applicable (Josh Poimboeuf)
  - selftests/mincore: Allow read-ahead pages to reach the end of the file (Qiuxu Zhuo)
  - objtool: Stop UNRET validation on UD2 (Josh Poimboeuf)
  - nvme: re-read ANA log page after ns scan completes (Hannes Reinecke)
  - ACPI PPTT: Fix coding mistakes in a couple of sizeof() calls (Jean-Marc Eurin)
  - nvme: requeue namespace scan on missed AENs (Hannes Reinecke)
  - xen: Change xen-acpi-processor dom0 dependency (Jason Andryuk)
  - selftests: ublk: fix test_stripe_04 (Ming Lei)
  - udmabuf: fix a buf size overflow issue during udmabuf creation (Xiaogang Chen) [Orabug: 37929938] {CVE-2025-37803}
  - KVM: s390: Don't use %pK through tracepoints (Thomas Weißschuh)
  - sched/isolation: Make CONFIG_CPU_ISOLATION depend on CONFIG_SMP (Oleg Nesterov)
  - ntb: reduce stack usage in idt_scan_mws (Arnd Bergmann)
  - qibfs: fix _another_ leak (Al Viro) [Orabug: 37977083] {CVE-2025-37983}
  - objtool, ASoC: codecs: wcd934x: Remove potential undefined behavior in wcd934x_slim_irq_handler() (Josh Poimboeuf)
  - usb: gadget: aspeed: Add NULL pointer check in ast_vhub_init_dev() (Chenyuan Yang) [Orabug: 37937503] {CVE-2025-37881}
  - usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running (Michał Pecio)
  - dmaengine: dmatest: Fix dmatest waiting less when interrupted (Vinicius Costa Gomes)
  - sound/virtio: Fix cancel_sync warnings on uninitialized work_structs (John Stultz) [Orabug: 37929953] {CVE-2025-37805}
  - usb: dwc3: gadget: Avoid using reserved endpoints on Intel Merrifield (Andy Shevchenko)
  - fs/ntfs3: Fix WARNING in ntfs_extend_initialized_size (Edward Adam Davis)
  - usb: host: max3421-hcd: Add missing spi_device_id table (Alexander Stein)
  - s390/tty: Fix a potential memory leak bug (Haoxiang Li)
  - s390/sclp: Add check for get_zeroed_page() (Haoxiang Li) [Orabug: 37937517] {CVE-2025-37883}
  - parisc: PDT: Fix missing prototype warning (Yu-Chun Lin)
  - clk: check for disabled clock-provider in of_clk_get_hw_from_clkspec() (Heiko Stuebner)
  - crypto: null - Use spin lock instead of mutex (Herbert Xu) [Orabug: 37929973] {CVE-2025-37808}
  - MIPS: cm: Detect CM quirks from device tree (Gregory Clement)
  - USB: wdm: add annotation (Oliver Neukum)
  - USB: wdm: wdm_wwan_port_tx_complete mutex in atomic context (Oliver Neukum)
  - USB: wdm: close race between wdm_open and wdm_wwan_port_stop (Oliver Neukum) [Orabug: 37977098] {CVE-2025-37985}
  - USB: wdm: handle IO errors in wdm_wwan_port_start (Oliver Neukum)
  - USB: VLI disk crashes if LPM is used (Oliver Neukum)
  - usb: quirks: Add delay init quirk for SanDisk 3.2Gen1 Flash Drive (Miao Li)
  - usb: quirks: add DELAY_INIT quirk for Silicon Motion Flash Drive (Miao Li)
  - usb: dwc3: gadget: check that event count does not exceed event buffer length (Frode Isaksen) [Orabug: 37929981] {CVE-2025-37810}
  - USB: OHCI: Add quirk for LS7A OHCI controller (rev 0x02) (Huacai Chen)
  - usb: chipidea: ci_hdrc_imx: implement usb_phy_init() error handling (Fedor Pchelkin)
  - usb: chipidea: ci_hdrc_imx: fix call balance of regulator routines (Fedor Pchelkin)
  - usb: cdns3: Fix deadlock when using NCM gadget (Ralph Siemsen) [Orabug: 37929988] {CVE-2025-37812}
  - USB: serial: simple: add OWON HDS200 series oscilloscope support (Craig Hesling)
  - USB: serial: option: add Sierra Wireless EM9291 (Adam Xue)
  - USB: serial: ftdi_sio: add support for Abacus Electrics Optical Probe (Michael Ehrenreich)
  - serial: sifive: lock port in startup()/shutdown() callbacks (Ryo Takakura)
  - KVM: x86: Reset IRTE to host control if *new* route isn't postable (Sean Christopherson) [Orabug: 37937535] {CVE-2025-37885}
  - mei: me: add panther lake H DID (Alexander Usyskin)
  - USB: storage: quirk for ADATA Portable HDD CH94 (Oliver Neukum)
  - mcb: fix a double free bug in chameleon_parse_gdd() (Haoxiang Li) [Orabug: 37930000] {CVE-2025-37817}
  - KVM: SVM: Allocate IR data using atomic allocation (Sean Christopherson)
  - drm/amd/display: Fix gpu reset in multidisplay config (Roman Li)
  - net: selftests: initialize TCP header and skb payload with zero (Oleksij Rempel)
  - virtio_console: fix missing byte order handling for cols and rows (Halil Pasic)
  - iommu/amd: Return an error if vCPU affinity is set for non-vCPU IRTE (Sean Christopherson)
  - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (Cong Wang) [Orabug: 37930028] {CVE-2025-37823}
  - net_sched: hfsc: Fix a UAF vulnerability in class handling (Cong Wang) [Orabug: 37908484] {CVE-2025-37797}
  - tipc: fix NULL pointer dereference in tipc_mon_reinit_self() (Tung Nguyen) [Orabug: 37930039] {CVE-2025-37824}
  - net: phy: leds: fix memory leak (Qingfang Deng) [Orabug: 37977112] {CVE-2025-37989}
  - cpufreq: cppc: Fix invalid return value in .get() callback (Marc Zyngier)
  - cpufreq: scpi: Fix null-ptr-deref in scpi_cpufreq_get_rate() (Henry Martin) [Orabug: 37930051] {CVE-2025-37829}
  - cpufreq: scmi: Fix null-ptr-deref in scmi_cpufreq_get_rate() (Henry Martin) [Orabug: 37930056] {CVE-2025-37830}
  - dma/contiguous: avoid warning about unused size_bytes (Arnd Bergmann)
  - drm/msm/a6xx: Fix stale rpmh votes from GPU (Akhil P Oommen)
  - drm/msm/a6xx: Avoid gx gbit halt during rpm suspend (Akhil P Oommen)
  - drm/msm/a6xx: Handle GMU prepare-slumber hfi failure (Akhil P Oommen)
  - drm/msm/a6xx: Improve gpu recovery sequence (Akhil P Oommen)
  - string: Add load_unaligned_zeropad() code path to sized_strscpy() (Peter Collingbourne)
  - kmsan: disable strscpy() optimization under KMSAN (Alexander Potapenko)
  - selftests/mm: generate a temporary mountpoint for cgroup filesystem (Mark Brown)
  - ksmbd: Prevent integer overflow in calculation of deadtime (Denis Arefev)
  - PCI: Fix reference leak in pci_register_host_bridge() (Ma Ke) [Orabug: 37937272] {CVE-2025-37836}
  - PCI: Assign PCI domain IDs by ida_alloc() (Pali Rohár)
  - PCI: Coalesce host bridge contiguous apertures (Kai-Heng Feng)
  - gpio: tegra186: fix resource handling in ACPI probe path (Guixin Liu)
  - cifs: fix integer overflow in match_server() (Roman Smirnov)
  - cifs: avoid NULL pointer dereference in dbg call (Alexandra Diupina) [Orabug: 37937310] {CVE-2025-37844}
  - cifs: print TIDs as hex (Enzo Matsumiya)
  - backlight: led_bl: Hold led_access lock when calling led_sysfs_disable() (Herve Codina) [Orabug: 37901610] {CVE-2025-23144}
  - backlight: led_bl: Convert to platform remove callback returning void (Uwe Kleine-König)
  - iio: adc: ad7768-1: Fix conversion result sign (Sergiu Cuciurean)
  - iio: adc: ad7768-1: Move setting of val a bit later to avoid unnecessary return value check (Jonathan Cameron)
  - soc: samsung: exynos-chipid: Add NULL pointer check in exynos_chipid_probe() (Chenyuan Yang) [Orabug: 37901625] {CVE-2025-23148}
  - soc: samsung: exynos-chipid: Pass revision reg offsets (Sam Protsenko)
  - soc: samsung: exynos-chipid: avoid soc_device_to_device() (Krzysztof Kozlowski)
  - net: dsa: mv88e6xxx: fix VTU methods for 6320 family (Marek Behún)
  - auxdisplay: hd44780: Fix an API misuse in hd44780.c (Haoxiang Li)
  - auxdisplay: hd44780: Convert to platform remove callback returning void (Uwe Kleine-König)
  - media: streamzap: fix race between device disconnection and urb callback (Murad Masimov) [Orabug: 37844171] {CVE-2025-22027}
  - media: streamzap: remove unused struct members (Sean Young)
  - media: streamzap: less chatter (Sean Young)
  - media: streamzap: no need for usb pid/vid in device name (Sean Young)
  - media: streamzap: remove unnecessary ir_raw_event_reset and handle (Sean Young)
  - module: sign with sha512 instead of sha1 by default (Thorsten Leemhuis)
  - Bluetooth: SCO: Fix UAF on sco_sock_timeout (Luiz Augusto von Dentz) [Orabug: 37252400] {CVE-2024-50125}
  - f2fs: Add inline to f2fs_build_fault_attr() stub (Nathan Chancellor)
  - pmdomain: ti: Add a null pointer check to the omap_prm_domain_init (Kunwu Chan) [Orabug: 36643315] {CVE-2024-35943}
  - f2fs: check validation of fault attrs in f2fs_build_fault_attr() (Chao Yu) [Orabug: 36897956] {CVE-2024-42160}
  - mm: fix apply_to_existing_page_range() (Kirill A. Shutemov)
  - fs/proc: do_task_stat: use sig->stats_lock to gather the threads/children stats (Oleg Nesterov) [Orabug: 36530401] {CVE-2024-26686}
  - drm/i915/gt: Cleanup partial engine discovery failures (Chris Wilson)
  - dm cache: fix flushing uninitialized delayed_work on cache_ctr error (Ming-Hung Tsai) [Orabug: 37298744] {CVE-2024-50280}
  - jfs: Fix shift-out-of-bounds in dbDiscardAG (Pei Li) [Orabug: 36993154] {CVE-2024-44938}
  - MIPS: ds1287: Match ds1287_set_base_clock() function types (Yuli Wang)
  - MIPS: cevt-ds1287: Add missing ds1287.h include (Yuli Wang)
  - MIPS: dec: Declare which_prom() as static (Yuli Wang)
  - net: defer final 'struct net' free in netns dismantle (Eric Dumazet) [Orabug: 37434229] {CVE-2024-56658}
  - scsi: ufs: bsg: Set bsg_queue to NULL after removal (Guixin Liu) [Orabug: 37649536] {CVE-2024-54458}
  - openvswitch: fix lockup on tx to unregistering netdev with carrier (Ilya Maximets) [Orabug: 38071902] {CVE-2025-21681}
  - net: openvswitch: fix race on port output (Felix Huettner)
  - ipvs: properly dereference pe in ip_vs_add_service (Chen Hanxiao) [Orabug: 36964418] {CVE-2024-42322}
  - ext4: fix timer use-after-free on failed mount (Xiaxi Shen) [Orabug: 37206114] {CVE-2024-49960}
  - blk-iocost: do not WARN if iocg was already offlined (Li Nan) [Orabug: 36683303] {CVE-2024-36908}
  - blk-cgroup: support to track if policy is online (Yu Kuai)
  - bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers (Hou Tao) [Orabug: 37283326] {CVE-2023-52621}
  - bpf: avoid holding freeze_mutex during mmap operation (Andrii Nakryiko) [Orabug: 37702062] {CVE-2025-21853}
  - sched/task_stack: fix object_is_on_stack() for KASAN tagged pointers (Qun-Wei Lin) [Orabug: 37388807] {CVE-2024-53128}
  - smb: client: fix potential UAF in cifs_stats_proc_show() (Paulo Alcantara) [Orabug: 36642549] {CVE-2024-35867}
  - smb: client: fix potential deadlock when releasing mids (Paulo Alcantara) [Orabug: 37283429] {CVE-2023-52757}
  - smb/server: fix potential null-ptr-deref of lease_ctx_info in smb2_open() (Chenxiaosong) [Orabug: 37074481] {CVE-2024-46742}
  - smb: client: fix NULL ptr deref in crypto_aead_setkey() (Paulo Alcantara) [Orabug: 38071970] {CVE-2024-53185}
  - smb: client: fix UAF in async decryption (Enzo Matsumiya) [Orabug: 37206489] {CVE-2024-50047}
  - cifs: Fix UAF in cifs_demultiplex_thread() (Zhang Xiaoxu) [Orabug: 36983926] {CVE-2023-52572}
  - smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (Paulo Alcantara)
  - ksmbd: fix potencial out-of-bounds when buffer offset is invalid (Namjae Jeon) [Orabug: 36596770] {CVE-2024-26952}
  - smb: client: fix potential UAF in cifs_dump_full_key() (Paulo Alcantara) [Orabug: 36642544] {CVE-2024-35866}
  - nvmet-fc: Remove unused functions (Yuli Wang)
  - landlock: Add the errata interface (Mickaël Salaün)
  - drm/amdgpu: fix usage slab after free (Vitaly Prosyak) [Orabug: 37433728] {CVE-2024-56551}
  - drm/amd/display: Add null checks for 'stream' and 'plane' before dereferencing (Srinivasan Shanmugam)
  - drm/amd/display: Fix out-of-bounds access in 'dcn21_link_encoder_create' (Srinivasan Shanmugam)
  - drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links (Hersen Wu) [Orabug: 37116370] {CVE-2024-46816}
  - wifi: ath10k: avoid NULL pointer error during sdio remove (Kang Yang) [Orabug: 37433947] {CVE-2024-56599}
  - phy: tegra: xusb: Fix return value of tegra_xusb_find_port_node function (Miaoqian Lin)
  - powerpc/rtas: Prevent Spectre v1 gadget construction in sys_rtas() (Nathan Lynch) [Orabug: 37074647] {CVE-2024-46774}
  - x86/pvh: Call C code via the kernel virtual mapping (Ard Biesheuvel)
  - net: mana: Fix error handling in mana_create_txq/rxq's NAPI cleanup (Souradeep Chakrabarti) [Orabug: 37074695] {CVE-2024-46784}
  - bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq (Michal Schmidt) [Orabug: 36753377] {CVE-2024-38540}
  - phonet/pep: fix racy skb_queue_empty() use (Remi Denis-Courmont) [Orabug: 36642006] {CVE-2024-27402}
  - filemap: Fix bounds checking in filemap_read() (Trond Myklebust) [Orabug: 37298710] {CVE-2024-50272}
  - net: fix crash when config small gso_max_size/gso_ipv4_max_size (Wang Liang) [Orabug: 37268692] {CVE-2024-50258}
  - ipv6: release nexthop on device removal (Paolo Abeni) [Orabug: 37434497] {CVE-2024-56751}
  - misc: pci_endpoint_test: Fix 'irq_type' to convey the correct type (Kunihiko Hayashi)
  - misc: pci_endpoint_test: Fix displaying 'irq_type' after 'request_irq' error (Kunihiko Hayashi)
  - misc: pci_endpoint_test: Avoid issue of interrupts remaining after request_irq error (Kunihiko Hayashi) [Orabug: 37901585] {CVE-2025-23140}
  - mptcp: sockopt: fix getting IPV6_V6ONLY (Matthieu Baerts)
  - kbuild: Add '-fno-builtin-wcslen' (Nathan Chancellor)
  - cpufreq: Reference count policy in cpufreq_update_limits() (Rafael J. Wysocki)
  - KVM: arm64: Eagerly switch ZCR_EL{1,2} (Mark Rutland)
  - KVM: arm64: Calculate cptr_el2 traps on activating traps (Fuad Tabba)
  - KVM: arm64: Remove VHE host restore of CPACR_EL1.ZEN (Mark Rutland)
  - KVM: arm64: Remove host FPSIMD saving for non-protected KVM (Mark Rutland)
  - KVM: arm64: Unconditionally save+flush host FPSIMD/SVE/SME state (Mark Rutland)
  - arm64/fpsimd: Stop using TIF_SVE to manage register saving in KVM (Mark Brown)
  - arm64/fpsimd: Have KVM explicitly say which FP registers to save (Mark Brown)
  - arm64/fpsimd: Track the saved FPSIMD state type separately to TIF_SVE (Mark Brown)
  - KVM: arm64: Discard any SVE state when entering KVM guests (Mark Brown)
  - KVM: arm64: Always start with clearing SVE flag on load (Marc Zyngier)
  - KVM: arm64: Get rid of host SVE tracking/saving (Mark Brown)
  - drm/sti: remove duplicate object names (Rolf Eike Beer)
  - drm/nouveau: prime: fix ttm_bo_delayed_delete oops (Chris Bainbridge) [Orabug: 37901817] {CVE-2025-37765}
  - drm/amdgpu/dma_buf: fix page_link check (Matthew Auld)
  - drm/amd/pm/powerplay/hwmgr/vega20_thermal: Prevent division by zero (Denis Arefev) [Orabug: 37901823,37901827,37901830,37901840,37901847] {CVE-2025-37766,CVE-2025-37767,CVE-2025-37768,CVE-2025-37770,CVE-2025-37771}
  - drm/amd/pm/swsmu/smu13/smu_v13_0: Prevent division by zero (Denis Arefev) [Orabug: 37901823,37901827,37901830,37901840,37901847] {CVE-2025-37766,CVE-2025-37767,CVE-2025-37768,CVE-2025-37770,CVE-2025-37771}
  - drm/amd/pm/powerplay/hwmgr/smu7_thermal: Prevent division by zero (Denis Arefev) [Orabug: 37901823,37901827,37901830,37901840,37901847] {CVE-2025-37766,CVE-2025-37767,CVE-2025-37768,CVE-2025-37770,CVE-2025-37771}
  - drm/amd/pm/powerplay: Prevent division by zero (Denis Arefev) [Orabug: 37901823,37901827,37901830,37901840,37901847] {CVE-2025-37766,CVE-2025-37767,CVE-2025-37768,CVE-2025-37770,CVE-2025-37771}
  - drm/amd/pm: Prevent division by zero (Denis Arefev) [Orabug: 37901823,37901827,37901830,37901840,37901847] {CVE-2025-37766,CVE-2025-37767,CVE-2025-37768,CVE-2025-37770,CVE-2025-37771}
  - drm/repaper: fix integer overflows in repeat functions (Nikita Zhandarovich)
  - perf/x86/intel/uncore: Fix the scale of IIO free running counters on SPR (Kan Liang)
  - perf/x86/intel/uncore: Fix the scale of IIO free running counters on ICX (Kan Liang)
  - perf/x86/intel/uncore: Fix the scale of IIO free running counters on SNR (Kan Liang)
  - perf/x86/intel: Allow to update user space GPRs from PEBS records (Dapeng Mi)
  - virtiofs: add filesystem context source name check (Xiangsheng Hou) [Orabug: 37901854] {CVE-2025-37773}
  - tracing: Fix filter string testing (Steven Rostedt)
  - riscv: Avoid fortify warning in syscall_get_arguments() (Nathan Chancellor)
  - mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Baoquan He)
  - loop: LOOP_SET_FD: send uevents for partitions (Thomas Weißschuh)
  - loop: properly send KOBJ_CHANGED uevent for disk device (Thomas Weißschuh)
  - isofs: Prevent the use of too small fid (Edward Adam Davis) [Orabug: 37901889] {CVE-2025-37780}
  - i2c: cros-ec-tunnel: defer probe if parent EC is not present (Thadeu Lima de Souza Cascardo) [Orabug: 37901896] {CVE-2025-37781}
  - hfs/hfsplus: fix slab-out-of-bounds in hfs_bnode_read_key (Vasiliy Kovalev)
  - crypto: caam/qi - Fix drv_ctx refcount bug (Herbert Xu)
  - btrfs: correctly escape subvol in btrfs_show_options() (Johannes Kimmel)
  - nfs: add missing selections of CONFIG_CRC32 (Eric Biggers)
  - nfs: move nfs_fhandle_hash to common include file (Jeff Layton)
  - asus-laptop: Fix an uninitialized variable (Denis Arefev)
  - ASoC: codecs:lpass-wsa-macro: Fix logic of enabling vi channels (Srinivas Kandagatla)
  - ASoC: codecs:lpass-wsa-macro: Fix vi feedback rate (Srinivas Kandagatla)
  - writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher)
  - riscv: KGDB: Remove ".option norvc/.option rvc" for kgdb_compiled_break (Yuli Wang)
  - riscv: KGDB: Do not inline arch_kgdb_breakpoint() (Yuli Wang)
  - riscv: Properly export reserved regions in /proc/iomem (Björn Töpel)
  - net: dsa: avoid refcount warnings when ds->ops->tag_8021q_vlan_del() fails (Vladimir Oltean)
  - net: dsa: mv88e6xxx: avoid unregistering devlink regions which were never registered (Vladimir Oltean) [Orabug: 37901916] {CVE-2025-37787}
  - net: b53: enable BPDU reception for management port (Jonas Gorski)
  - cxgb4: fix memory leak in cxgb4_init_ethtool_filters() error path (Abdun Nihaal) [Orabug: 37901919] {CVE-2025-37788}
  - net: openvswitch: fix nested key length validation in the set() action (Ilya Maximets) [Orabug: 37901922] {CVE-2025-37789}
  - net: mctp: Set SOCK_RCU_FREE (Matt Johnston) [Orabug: 37901929] {CVE-2025-37790}
  - igc: cleanup PTP module if probe fails (Christopher S Hall)
  - igc: handle the IGC_PTP_ENABLED flag correctly (Christopher S Hall)
  - igc: move ktime snapshot into PTM retry loop (Christopher S Hall)
  - igc: fix PTM cycle trigger logic (Christopher S Hall) [Orabug: 37937458] {CVE-2025-37875}
  - Revert "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" (Johannes Berg)
  - Bluetooth: l2cap: Check encryption key size on incoming connection (Frédéric Danis)
  - Bluetooth: btrtl: Prevent potential NULL dereference (Dan Carpenter) [Orabug: 37901933] {CVE-2025-37792}
  - Bluetooth: hci_event: Fix sending MGMT_EV_DEVICE_FOUND for invalid address (Luiz Augusto von Dentz)
  - RDMA/core: Silence oversized kvmalloc() warning (Shay Drory) [Orabug: 37937427] {CVE-2025-37867}
  - RDMA/hns: Fix wrong maximum DMA segment size (Chengchang Tang)
  - RDMA/usnic: Fix passing zero to PTR_ERR in usnic_ib_pci_probe() (Yue Haibing)
  - md/raid10: fix missing discard IO accounting (Yu Kuai)
  - scsi: iscsi: Fix missing scsi_host_put() in error path (Miaoqian Lin)
  - wifi: wl1251: fix memory leak in wl1251_tx_work (Abdun Nihaal) [Orabug: 37977075] {CVE-2025-37982}
  - wifi: mac80211: Purge vif txq in ieee80211_do_stop() (Remi Pommarel) [Orabug: 37901939] {CVE-2025-37794}
  - wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue() (Remi Pommarel)
  - wifi: at76c50x: fix use after free access in at76_disconnect (Abdun Nihaal) [Orabug: 37901952] {CVE-2025-37796}
  - scsi: hisi_sas: Enable force phy when SATA disk directly connected (Xingui Yang)
  - scsi: libsas: Add struct sas_tmf_task (John Garry)
  - scsi: libsas: Delete lldd_clear_aca callback (John Garry)
  - scsi: hisi_sas: Fix setting of hisi_sas_slot.is_internal (John Garry)
  - scsi: hisi_sas: Factor out task prep and delivery code (John Garry)
  - scsi: hisi_sas: Pass abort structure for internal abort (John Garry)
  - scsi: hisi_sas: Start delivery hisi_sas_task_exec() directly (John Garry)
  - Bluetooth: hci_uart: Fix another race during initialization (Arseniy Krasnov)
  - x86/e820: Fix handling of subpage regions when calculating nosave ranges in e820__register_nosave_regions() (Myrrh Periwinkle)
  - ACPI: platform-profile: Fix CFI violation when accessing sysfs files (Nathan Chancellor)
  - arm64: errata: Add newer ARM cores to the spectre_bhb_loop_affected() lists (Douglas Anderson)
  - HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition (Kaixin Wang) [Orabug: 37855340] {CVE-2025-37838}
  - pinctrl: qcom: Clear latched interrupt status when changing IRQ type (Stephan Gerhold)
  - PCI: Fix reference leak in pci_alloc_child_bus() (Ma Ke)
  - PCI: brcmstb: Fix missing of_node_put() in brcm_pcie_probe() (Stanimir Varbanov)
  - of/irq: Fix device node refcount leakages in of_irq_init() (Zijun Hu)
  - of/irq: Fix device node refcount leakage in API irq_of_parse_and_map() (Zijun Hu)
  - of/irq: Fix device node refcount leakages in of_irq_count() (Zijun Hu)
  - ntb: use 64-bit arithmetic for the MSI doorbell mask (Fedor Pchelkin)
  - gpio: zynq: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
  - ftrace: Add cond_resched() to ftrace_graph_set_hash() (Zhoumin) [Orabug: 37976892] {CVE-2025-37940}
  - dm-integrity: set ti->error on memory allocation failure (Mikulas Patocka)
  - crypto: ccp - Fix check for the primary ASP device (Tom Lendacky)
  - thermal/drivers/rockchip: Add missing rk3328 mapping entry (Trevor Woerner)
  - sctp: detect and prevent references to a freed transport in sendmsg (Ricardo Cañuelo Navarro) [Orabug: 37901596] {CVE-2025-23142}
  - mm/hwpoison: do not send SIGBUS to processes with recovered clean pages (Shuai Xue)
  - mm: add missing release barrier on PGDAT_RECLAIM_LOCKED unlock (Mathieu Desnoyers)
  - sparc/mm: disable preemption in lazy mmu mode (Ryan Roberts)
  - arm64: dts: mediatek: mt8173: Fix disp-pwm compatible string (Chen-Yu Tsai)
  - mtd: rawnand: Add status chack in r852_ready() (Xu Wang)
  - mtd: inftlcore: Add error check for inftl_read_oob() (Xu Wang) [Orabug: 37976719] {CVE-2025-37892}
  - mptcp: only inc MPJoinAckHMacFailure for HMAC failures (Matthieu Baerts)
  - mptcp: fix NULL pointer in can_accept_new_subflow (Gang Yan) [Orabug: 37901614] {CVE-2025-23145}
  - lib: scatterlist: fix sg_split_phys to preserve original scatterlist offsets (T Pratham)
  - locking/lockdep: Decrease nr_unused_locks if lock unused in zap_class() (Boqun Feng)
  - mfd: ene-kb3930: Fix a potential NULL pointer dereference (Chenyuan Yang) [Orabug: 37901617] {CVE-2025-23146}
  - jbd2: remove wrong sb->s_sequence check (Jan Kara) [Orabug: 37937282] {CVE-2025-37839}
  - i3c: Add NULL pointer check in i3c_master_queue_ibi() (Manjunatha Venkatesh) [Orabug: 37901621] {CVE-2025-23147}
  - i3c: master: svc: Use readsb helper for reading MDB (Stanley Chu)
  - vdpa/mlx5: Fix oversized null mkey longer than 32bit (Si-Wei Liu)
  - ext4: fix off-by-one error in do_split (Artem Sadovnikov) [Orabug: 37901630] {CVE-2025-23150}
  - bus: mhi: host: Fix race between unprepare and queue_buf (Jeffrey Hugo) [Orabug: 37901637] {CVE-2025-23151}
  - ASoC: qdsp6: q6asm-dai: fix q6asm_dai_compr_set_params error path (Alexey Klimov)
  - wifi: mac80211: fix integer overflow in hwmp_route_info_get() (Gavrilov Ilia)
  - wifi: mt76: Add check for devm_kstrdup() (Haoxiang Li)
  - clocksource/drivers/stm32-lptimer: Use wakeup capable instead of init wakeup (Alexandre Torgue)
  - mtd: Replace kcalloc() with devm_kcalloc() (Jiasheng Jiang)
  - net: dsa: mv88e6xxx: workaround RGMII transmit delay erratum for 6320 family (Marek Behún)
  - mtd: Add check for devm_kcalloc() (Jiasheng Jiang)
  - media: venus: hfi_parser: refactor hfi packet parsing logic (Vikash Garodia) [Orabug: 37901647] {CVE-2025-23156}
  - media: venus: hfi_parser: add check to avoid out of bound access (Vikash Garodia) [Orabug: 37901652] {CVE-2025-23157}
  - media: i2c: ov7251: Introduce 1 ms delay between regulators and en GPIO (Sakari Ailus)
  - media: i2c: ov7251: Set enable GPIO low in probe (Sakari Ailus)
  - media: i2c: ccs: Set the device's runtime PM status correctly in probe (Sakari Ailus)
  - media: i2c: ccs: Set the device's runtime PM status correctly in remove (Sakari Ailus)
  - media: v4l2-dv-timings: prevent possible overflow in v4l2_detect_gtf() (Karina Yankevich)
  - media: streamzap: prevent processing IR data on URB failure (Murad Masimov)
  - mtd: rawnand: brcmnand: fix PM resume warning (Kamal Dasu) [Orabug: 37937291] {CVE-2025-37840}
  - spi: cadence-qspi: Fix probe on AM62A LP SK (Miquel Raynal)
  - arm64: errata: Add KRYO 2XX/3XX/4XX silver cores to Spectre BHB safe list (Douglas Anderson)
  - arm64: errata: Assume that unknown CPUs _are_ vulnerable to Spectre BHB (Douglas Anderson)
  - arm64: errata: Add QCOM_KRYO_4XX_GOLD to the spectre_bhb_k24_list (Douglas Anderson)
  - arm64: cputype: Add MIDR_CORTEX_A76AE (Douglas Anderson)
  - xenfs/xensyms: respect hypervisor's "next" indication (Jan Beulich)
  - media: siano: Fix error handling in smsdvb_module_init() (Yuan Can)
  - media: vim2m: print device name after registering device (Matthew Majewski)
  - media: venus: hfi: add check to handle incorrect queue size (Vikash Garodia) [Orabug: 37901656] {CVE-2025-23158}
  - media: venus: hfi: add a check to handle OOB in sfr region (Vikash Garodia) [Orabug: 37901661] {CVE-2025-23159}
  - media: i2c: adv748x: Fix test pattern selection mask (Niklas Söderlund)
  - ext4: don't treat fhandle lookup of ea_inode as FS corruption (Jann Horn)
  - bpf: support SKF_NET_OFF and SKF_LL_OFF on skb frags (Willem de Bruijn)
  - bpf: Add endian modifiers to fix endian warnings (Ben Dooks)
  - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Uwe Kleine-König)
  - pwm: rcar: Improve register calculation (Uwe Kleine-König)
  - pwm: rcar: Simplify multiplication/shift logic (Geert Uytterhoeven)
  - pwm: mediatek: Prevent divide-by-zero in pwm_mediatek_config() (Josh Poimboeuf) [Orabug: 37937328] {CVE-2025-37850}
  - ktest: Fix Test Failures Due to Missing LOG_FILE Directories (Ayush Jain)
  - fbdev: omapfb: Add 'plane' value check (Leonid Arapov)
  - PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type (Ryo Takakura) [Orabug: 37901667] {CVE-2025-23161}
  - drm/mediatek: mtk_dpi: Explicitly manage TVD clock in power on/off (AngeloGioacchino Del Regno)
  - drm/amdkfd: Fix pqm_destroy_queue race with GPU reset (Philip Yang)
  - drm/amdkfd: clamp queue size to minimum (David Yat Sin)
  - drivers: base: devres: Allow to release group on device release (Lucas De Marchi)
  - drm/bridge: panel: forbid initializing a panel with unknown connector type (Luca Ceresoli)
  - drm: panel-orientation-quirks: Add new quirk for GPD Win 2 (Andrew Wyatt)
  - drm: panel-orientation-quirks: Add support for AYANEO 2S (Andrew Wyatt)
  - drm/amd/display: Update Cursor request mode to the beginning prefetch always (Zhikai Zhai)
  - drm: allow encoder mode_set even when connectors change for crtc (Abhinav Kumar)
  - Bluetooth: hci_uart: fix race during initialization (Arseniy Krasnov)
  - tracing: fix return value in __ftrace_event_enable_disable for TRACE_REG_UNREGISTER (Gabriele Paoloni)
  - net: vlan: don't propagate flags on open (Stanislav Fomichev) [Orabug: 37901683] {CVE-2025-23163}
  - wifi: mt76: mt76x2u: add TP-Link TL-WDN6200 ID to device table (Icenowy Zheng)
  - scsi: st: Fix array overflow in st_setup() (Kai Mäkisara) [Orabug: 37937378] {CVE-2025-37857}
  - ext4: ignore xattrs past end (Bhupesh) [Orabug: 37901690] {CVE-2025-37738}
  - ext4: protect ext4_release_dquot against freezing (Ojaswin Mujoo)
  - ahci: add PCI ID for Marvell 88SE9215 SATA Controller (Daniel Kral)
  - f2fs: fix to avoid out-of-bounds access in f2fs_truncate_inode_blocks() (Chao Yu) [Orabug: 37901700] {CVE-2025-37739}
  - ata: libata-eh: Do not use ATAPI DMA for a device limited to PIO mode (Niklas Cassel)
  - jfs: add sanity check for agwidth in dbMount (Edward Adam Davis) [Orabug: 37901706] {CVE-2025-37740}
  - jfs: Prevent copying of nlink with value 0 from disk inode (Edward Adam Davis) [Orabug: 37901715] {CVE-2025-37741}
  - fs/jfs: Prevent integer overflow in AG size calculation (Rand Deeb) [Orabug: 37937386] {CVE-2025-37858}
  - fs/jfs: cast inactags to s64 to prevent potential overflow (Rand Deeb)
  - jfs: Fix uninit-value access of imap allocated in the diMount() function (Zhongqiu Han) [Orabug: 37901723] {CVE-2025-37742}
  - page_pool: avoid infinite loop to schedule delayed worker (Jason Xing) [Orabug: 37937394] {CVE-2025-37859}
  - ALSA: usb-audio: Fix CME quirk for UF series keyboards (Ricard Wanderlof)
  - ASoC: fsl_audmix: register card device depends on 'dais' property (Shengjiu Wang)
  - ALSA: hda: intel: Fix Optimus when GPU has no sound (Maxim Mikityanskiy)
  - HID: pidff: Fix null pointer dereference in pidff_find_fields (Tomasz Pakuła) [Orabug: 37937409] {CVE-2025-37862}
  - HID: pidff: Do not send effect envelope if it's empty (Tomasz Pakuła)
  - HID: pidff: Convert infinite length from Linux API to PID standard (Tomasz Pakuła)
  - xen/mcelog: Add __nonstring annotations for unterminated strings (Kees Cook)
  - arm64: cputype: Add QCOM_CPU_PART_KRYO_3XX_GOLD (Douglas Anderson)
  - perf: arm_pmu: Don't disable counter in armpmu_add() (Mark Rutland)
  - x86/cpu: Don't clear X86_FEATURE_LAHF_LM flag in init_amd_k8() on AMD when running in a virtual machine (Max Grobecker)
  - pm: cpupower: bench: Prevent NULL dereference on malloc failure (Zhongqiu Han) [Orabug: 37937296] {CVE-2025-37841}
  - umount: Allow superblock owners to force umount (Trond Myklebust)
  - nft_set_pipapo: fix incorrect avx2 match of 5th field octet (Florian Westphal)
  - net: ppp: Add bound checking for skb data on ppp_sync_txmung (Arnaud Lecomte) [Orabug: 37901765] {CVE-2025-37749}
  - nvmet-fcloop: swap list_add_tail arguments (Daniel Wagner)
  - ata: sata_sx4: Add error handling in pdc20621_i2c_read() (Xu Wang)
  - ata: sata_sx4: Drop pointless VPRINTK() calls and convert the remaining ones (Hannes Reinecke)
  - net: ethtool: Don't call .cleanup_data when prepare_data fails (Maxime Chevallier)
  - net: tls: explicitly disallow disconnect (Jakub Kicinski) [Orabug: 37901782] {CVE-2025-37756}
  - tipc: fix memory leak in tipc_link_xmit (Tung Nguyen) [Orabug: 37901789] {CVE-2025-37757}
  - ata: pata_pxa: Fix potential NULL pointer dereference in pxa_ata_probe() (Henry Martin) [Orabug: 37901795] {CVE-2025-37758}


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-310.184.3.el9uek]
changelog:
  - x86/its: Fix undefined reference to cpu_wants_rethunk_at() (Pawan Gupta)
  - padata: do not leak refcount in reorder_work (Dominik Grzegorzek) [Orabug: 38094844] {CVE-2025-38031}
  - Revert "drm/amd: Keep display off while going into S4" (Mario Limonciello)
  - memcg: always call cond_resched() after fn() (Breno Leitao)
  - lib: cpu_rmap: Use allocator for rmap entries (Eli Cohen) [Orabug: 38037237]
  - uek-rpm: build the fwctl mlx5 driver on UEK (Qing Huang) [Orabug: 37810637]
  - fwctl: Adapt upstream code for UEK7 (Mikhael Goikhman) [Orabug: 37810637]
  - mlx5: Create an auxiliary device for fwctl_mlx5 (Saeed Mahameed) [Orabug: 37810637]
  - fwctl/mlx5: Support for communicating with mlx5 fw (Saeed Mahameed) [Orabug: 37810637]
  - fwctl: Add documentation (Jason Gunthorpe) [Orabug: 37810637]
  - fwctl: FWCTL_RPC to execute a Remote Procedure Call to device firmware (Jason Gunthorpe) [Orabug: 37810637]
  - taint: Add TAINT_FWCTL (Jason Gunthorpe) [Orabug: 37810637]
  - fwctl: FWCTL_INFO to return basic information about the device (Jason Gunthorpe) [Orabug: 37810637]
  - fwctl: Basic ioctl dispatch for the character device (Jason Gunthorpe) [Orabug: 37810637]
  - fwctl: Add basic structure for a class subsystem with a cdev (Jason Gunthorpe) [Orabug: 37810637]
  - net/mlx5: Add IFC related stuff for data direct (Yishai Hadas) [Orabug: 37810637]
  - Documentation: Add detailed explanation for 'N' taint flag (Benjamin Poirier) [Orabug: 37810637]
  - kernel/panic: initialize taint_flags[] using a macro (Jani Nikula) [Orabug: 37810637]
  - kernel/panic: return early from print_tainted() when not tainted (Jani Nikula) [Orabug: 37810637]
  - tools: Add new "test" taint to kernel-chktaint (Joe Fradley) [Orabug: 37810637]
  - panic: use error_report_end tracepoint on warnings (Marco Elver) [Orabug: 37810637]
  - Revert "fwctl: Add basic structure for a class subsystem with a cdev" (Qing Huang) [Orabug: 37810637]
  - Revert "fwctl: Basic ioctl dispatch for the character device" (Qing Huang) [Orabug: 37810637]
  - Revert "fwctl: FWCTL_INFO to return basic information about the device" (Qing Huang) [Orabug: 37810637]
  - Revert "fwctl: FWCTL_RPC to execute a Remote Procedure Call to device firmware" (Qing Huang) [Orabug: 37810637]
  - Revert "fwctl/mlx5: Support for communicating with mlx5 fw" (Qing Huang) [Orabug: 37810637]
  - Revert "mlx5: Create an auxiliary device for fwctl_mlx5" (Qing Huang) [Orabug: 37810637]
  - Revert "taint: Add TAINT_FWCTL" (Qing Huang) [Orabug: 37810637]
  - Revert "fwctl: Adapt code for UEK7" (Qing Huang) [Orabug: 37810637]
  - Revert "fwctl/mlx5: Add INTERNAL_DEV_RES uctx capability" (Qing Huang) [Orabug: 37810637]
  - Revert "fwctl: Allow up to 4k devices" (Qing Huang) [Orabug: 37810637]
  - Revert "fwctl: Expand adaption of code for UEK7" (Qing Huang) [Orabug: 37810637]
  - Revert "uek-rpm: build the fwctl mlx5 driver on UEK" (Qing Huang) [Orabug: 37810637]


author: Brian Maly <brian.maly@oracle.com> [5.15.0-310.184.4.el9uek]
changelog:
  - vhost-scsi: Fix log flooding with target does not exist errors (Mike Christie) [Orabug: 37424174]
  - mm: do not write protect COW mappings when preserving across exec (Anthony Yznaga) [Orabug: 37734242]
  - mm: hold the source mmap write lock when copying PTEs (Anthony Yznaga) [Orabug: 37734242]
  - uek-rpm: Bluefield 3: Enable CONFIG_CONTIG_ALLOC (Thomas Tai) [Orabug: 38067846]
  - mm: shmem: remove unnecessary warning in shmem_writepage() (Ricardo Cañuelo Navarro) [Orabug: 38091965]
  - shmem: add support to ignore swap (Luis Chamberlain) [Orabug: 38091965]
  - shmem: update documentation (Luis Chamberlain) [Orabug: 38091965]
  - shmem: skip page split if we're not reclaiming (Luis Chamberlain) [Orabug: 38091965]
  - shmem: move reclaim check early on writepages() (Luis Chamberlain) [Orabug: 38091965]
  - shmem: set shmem_writepage() variables early (Luis Chamberlain) [Orabug: 38091965]
  - shmem: remove check for folio lock on writepage() (Luis Chamberlain) [Orabug: 38091965]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-310.184.5.el9uek]
changelog:
  - sched/numa: skip VMA scanning on memory pinned to one NUMA node via cpuset.mems (Libo Chen)  [Orabug: 38070120]
  - bridge: netfilter: Fix forwarding of fragmented packets (Ido Schimmel)  [Orabug: 38069363]
  - Revert "net: bridge: IP defragmentation failing for jumboframes" (Venkat Venkatsubra)  [Orabug: 38069363]
  - vhost-scsi: Change def inline_sg_cnt and max_io_vqs for exadata (Mike Christie)  [Orabug: 38053186]
  - rds: ib: Add cm_id generation scheme in order to detect new ones (Håkon Bugge)  [Orabug: 37799170]
  - Revert "i2c: designware: Fix corrupted memory seen in the ISR" (Vijay Kumar)  [Orabug: 37771338]
  - ipmi:ssif: Improve detecting during probing (Corey Minyard)  [Orabug: 37771338]
  - ipmi: ssif: replace strlcpy with strscpy (Jason Wang)  [Orabug: 37771338]
  - uek-rpm: Enable CONFIG_SERIAL_RP2 as m (Samasth Norway Ananda)  [Orabug: 37459981]
  - serial: update the rp2 driver code (Samasth Norway Ananda)  [Orabug: 37459981]


author: Jack Vogel <jack.vogel@oracle.com> [5.15.0-310.184.5.1.el9uek]
changelog:
  - Add Zen34 clients (Borislav Petkov (AMD))  [Orabug: 38023240]  {CVE-2024-36350} {CVE-2024-36357}
  - x86/process: Move the buffer clearing before MONITOR (Kim Phillips)  [Orabug: 38023240]  {CVE-2024-36350} {CVE-2024-36357}
  - Add normal counters (Borislav Petkov (AMD))  [Orabug: 38023240]  {CVE-2024-36350} {CVE-2024-36357}
  - KVM: SVM: Advertize TSA CPUID bits to guests (Borislav Petkov (AMD))  [Orabug: 38023240]  {CVE-2024-36350} {CVE-2024-36357}
  - x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov (AMD))  [Orabug: 38023240]  {CVE-2024-36350} {CVE-2024-36357}
  - x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov (AMD))  [Orabug: 38023240]  {CVE-2024-36350} {CVE-2024-36357}
  - x86/CPU/AMD: Add ZenX generations flags (Borislav Petkov (AMD))  [Orabug: 38023240]  {CVE-2024-36350} {CVE-2024-36357}
  - x86/bugs: Free X86_BUG_AMD_APIC_C1E and X86_BUG_AMD_E400 bits (Boris Ostrovsky)  [Orabug: 38023240]  {CVE-2024-36350} {CVE-2024-36357}


author: Brian Maly <brian.maly@oracle.com> [5.15.0-310.184.5.2.el9uek]
changelog:
  - sunrpc: handle SVC_GARBAGE during svc auth processing as auth error (Jeff Layton)   {CVE-2025-38089} 
  - net_sched: sch_sfq: move the limit validation (Octavian Purdila)   {CVE-2025-37752} 
  - net_sched: sch_sfq: use a temporary work area for validating configuration (Octavian Purdila)   
  - net_sched: sch_sfq: don't allow 1 packet limit (Octavian Purdila)   
  - net_sched: sch_sfq: handle bigger packets (Eric Dumazet)   
  - net_sched: sch_sfq: annotate data-races around q->perturb_period (Eric Dumazet)   
  - block: assign bi_bdev for cloned bios in blk_rq_prep_clone (Christoph Hellwig)  [Orabug: 37931495]  
  - fs/proc: do_task_stat: use __for_each_thread() (Oleg Nesterov)  [Orabug: 38081922]


author: Brian Maly <brian.maly@oracle.com> [5.15.0-310.184.5.2.el9uek]
changelog:
  - sunrpc: handle SVC_GARBAGE during svc auth processing as auth error (Jeff Layton)   {CVE-2025-38089}
  - net_sched: sch_sfq: move the limit validation (Octavian Purdila)   {CVE-2025-37752}
  - net_sched: sch_sfq: use a temporary work area for validating configuration (Octavian Purdila)
  - net_sched: sch_sfq: don't allow 1 packet limit (Octavian Purdila)
  - net_sched: sch_sfq: handle bigger packets (Eric Dumazet)
  - net_sched: sch_sfq: annotate data-races around q->perturb_period (Eric Dumazet)
  - block: assign bi_bdev for cloned bios in blk_rq_prep_clone (Christoph Hellwig)  [Orabug: 37931495]
  - fs/proc: do_task_stat: use __for_each_thread() (Oleg Nesterov)  [Orabug: 38081922]


author: Brian Maly <brian.maly@oracle.com> [5.15.0-310.184.5.3.el9uek]
changelog:
  - nfs: clear SB_RDONLY before getting superblock (Li Lingfeng)   
  - nfs: ignore SB_RDONLY when remounting nfs (Li Lingfeng)  [Orabug: 38258810]  
  - net/rds: poll eq during user-reset (Praveen Kumar Kannoju)  [Orabug: 38258827]  
  - net/mlx5: Add poll-eq API to be used by ULP's (Praveen Kumar Kannoju)  [Orabug: 38258830]  
  - vhost-scsi: Fix vhost_scsi struct use after free (Mike Christie)  [Orabug: 38258837]  
  - net/mlx5: set graceful_period to 0 to allow multiple transmission queue recovery (Praveen Kumar Kannoju)  [Orabug: 38258844]  
  - x86: Pin task-stack in __get_wchan() (Peter Zijlstra)  [Orabug: 38258846]  
  - x86: Fix __get_wchan() for !STACKTRACE (Peter Zijlstra)  [Orabug: 38258846]  
  - sched: Add wrapper for get_wchan() to keep task blocked (Kees Cook)  [Orabug: 38258846]  
  - x86: Fix get_wchan() to support the ORC unwinder (Qi Zheng)  [Orabug: 38258846]  
  - mm: synchronise PGD in x86 when utilising dax vmemmap optimisation (Lorenzo Stoakes)  [Orabug: 38258866]  
  - rds: ib: Make sure a QP in INIT state is transitioned to ERR (Håkon Bugge)  [Orabug: 38258860]  
  - Reapply "rds: ib: Make sure receives are posted before connection is up" (Håkon Bugge)  [Orabug: 38258860]  
  - KVM: x86: revert APICV_INHIBIT_REASON_APIC_ID_MODIFIED clear path for uek=exadata (Dongli Zhang)  [Orabug: 38258871]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-311.184.1.el9uek]
changelog:
  - net/rds: tracepoints for rds_conn_kref_get and put (Sharath Srinivasan)  [Orabug: 38118655]
  - net/rds: Add krefs to struct rds_connection (Sharath Srinivasan)  [Orabug: 38118655]
  - net/rds: Add missing switch/break in rds_recv_worker() (Sharath Srinivasan)  [Orabug: 38118668]
  - net/mlx5: Expose ICM consumption per function (Akiva Goldberger)  [Orabug: 38063298]
  - net/mlx5: Rename and move mlx5_esw_query_vport_vhca_id (Akiva Goldberger)  [Orabug: 38063298]
  - net/mlx5: Add nic_cap_reg and vhca_icm_ctrl registers (Akiva Goldberger)  [Orabug: 38063298]
  - KVM: x86: revert APICV_INHIBIT_REASON_APIC_ID_MODIFIED clear path for uek=exadata (Dongli Zhang)  [Orabug: 37944981]
  - arm64: pensando: kpcimgr: Support PSCI and XEN (Rob Gardner)  [Orabug: 37911761]
  - arm64: pensando: Add PL011 serial to config for XEN (Rob Gardner)  [Orabug: 37911761]
  - net/rds: Merge uses of conn->c_destroy_in_prog & RDS_DESTROY_PENDING (Sharath Srinivasan)  [Orabug: 35519912]
  - net_sched: sch_sfq: don't allow 1 packet limit (Octavian Purdila)  [Orabug: 37649663]  {CVE-2024-57996}
  - net_sched: sch_sfq: handle bigger packets (Eric Dumazet)  [Orabug: 38139143]
  - net_sched: sch_sfq: annotate data-races around q->perturb_period (Eric Dumazet)  [Orabug: 38139143]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-311.185.2.el9uek]
changelog:
  - Revert "x86/bugs: Make spectre user default depend on MITIGATION_SPECTRE_V2" on v6.6 and older (Breno Leitao)
  - Revert "cpufreq: tegra186: Share policy per cluster" (Jon Hunter)
  - net: tipc: fix refcount warning in tipc_aead_encrypt (Charalampos Mitrodimas)
  - tracing: Fix compilation warning on arm32 (Pan Taixi)
  - PM: sleep: Fix power.is_suspended cleanup for direct-complete devices (Rafael J. Wysocki)
  - nfs: clear SB_RDONLY before getting superblock (Li Lingfeng)
  - usb: usbtmc: Fix read_stb function and get_stb ioctl (Dave Penkler)
  - acpi-cpufreq: Fix nominal_freq units to KHz in get_max_boost_ratio() (Gautham R. Shenoy)
  - LTS version: v5.15.185 (Vijayendra Suman)
  - perf/arm-cmn: Initialise cmn->cpu earlier (Robin Murphy)
  - platform/x86: thinkpad_acpi: Ignore battery threshold change event notification (Mark Pearson)
  - platform/x86: fujitsu-laptop: Support Lifebook S2110 hotkeys (Valtteri Koskivuori)
  - tpm: tis: Double the timeout B to 4s (Michal Suchanek)
  - nvme-pci: add NVME_QUIRK_NO_DEEPEST_PS quirk for SOLIDIGM P44 Pro (Ilya Guterman)
  - spi: spi-sun4i: fix early activation (Alessandro Grassi)
  - um: let 'make clean' properly clean underlying SUBARCH as well (Masahiro Yamada)
  - platform/x86: thinkpad_acpi: Support also NEC Lavie X1475JAS (John Chau)
  - nfs: don't share pNFS DS connections between net namespaces (Jeff Layton)
  - HID: quirks: Add ADATA XPG alpha wireless mouse support (Milton Barrera)
  - coredump: hand a pidfd to the usermode coredump helper (Christian Brauner)
  - fork: use pidfd_prepare() (Christian Brauner)
  - pid: add pidfd_prepare() (Christian Brauner)
  - coredump: fix error handling for replace_fd() (Christian Brauner)
  - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Pedro Tammela)
  - arm64: dts: qcom: sm8350: Fix typo in pil_camera_mem node (Alok Tiwari)
  - smb: client: Reset all search buffer pointers when releasing buffer (Wang Zhaolong)
  - smb: client: Fix use-after-free in cifs_fill_dirent (Wang Zhaolong)
  - drm/i915/gvt: fix unterminated-string-initialization warning (Jani Nikula)
  - xen/swiotlb: relax alignment requirements (Juergen Gross)
  - i3c: master: svc: Fix implicit fallthrough in svc_i3c_master_ibi_work() (Nathan Chancellor)
  - kbuild: Disable -Wdefault-const-init-unsafe (Nathan Chancellor)
  - spi: spi-fsl-dspi: Reset SR flags before sending a new message (Larisa Grigore)
  - spi: spi-fsl-dspi: Halt the module after a new message transfer (Bogdan-Gabriel Roman)
  - spi: spi-fsl-dspi: restrict register range for regmap access (Larisa Grigore)
  - Revert "arm64: dts: allwinner: h6: Use RSB for AXP805 PMIC connection" (Jernej Skrabec)
  - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Tianyang Zhang)
  - drm/edid: fixed the bug that hdr metadata was not reset (feijuan.li)
  - platform/x86: dell-wmi-sysman: Avoid buffer overflow in current_password_store() (Vladimir Moskovkin)
  - llc: fix data loss when reading from a socket in llc_ui_recvmsg() (Ilia Gavrilov)
  - ALSA: pcm: Fix race of buffer access at PCM OSS layer (Takashi Iwai)
  - can: bcm: add missing rcu read protection for procfs content (Oliver Hartkopp)
  - can: bcm: add locking for bcm_op runtime updates (Oliver Hartkopp)
  - crypto: algif_hash - fix double free in hash_accept (Ivan Pravdin)
  - octeontx2-af: Set LMT_ENA bit for APR table entries (Subbaraya Sundeep)
  - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (Wang Liang)
  - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (Cong Wang)
  - net: dwmac-sun8i: Use parsed internal PHY address instead of 1 (Paul Kocialkowski)
  - Bluetooth: L2CAP: Fix not checking l2cap_chan security level (Luiz Augusto von Dentz)
  - xfrm: Sanitize marks before insert (Paul Chaignon)
  - remoteproc: qcom_wcnss: Fix on platforms without fallback regulators (Matti Lehtimäki)
  - __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock (Al Viro)
  - xenbus: Allow PVH dom0 a non-local xenstore (Jason Andryuk)
  - btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref (Goldwyn Rodrigues)
  - nvmet-tcp: don't restore null sk_state_change (Alistair Francis)
  - ALSA: hda/realtek: Add quirk for HP Spectre x360 15-df1xxx (Takashi Iwai)
  - ASoC: Intel: bytcr_rt5640: Add DMI quirk for Acer Aspire SW3-013 (Takashi Iwai)
  - pinctrl: meson: define the pull up/down resistor value as 60 kOhm (Martin Blumenstingl)
  - ASoC: imx-card: Adjust over allocation of memory in imx_card_parse_of() (Chenyuan Yang)
  - drm: Add valid clones check (Jessica Zhang)
  - drm/atomic: clarify the rules around drm_atomic_state->allow_modeset (Simona Vetter)
  - wifi: ath9k: return by of_get_mac_address (Rosen Penev)
  - regulator: ad5398: Add device tree support (Isaac Scott)
  - spi: zynqmp-gqspi: Always acknowledge interrupts (Sean Anderson)
  - wifi: rtw88: Don't use static local variable in rtw8822b_set_tx_power_index_by_rate (Bitterblue Smith)
  - perf/amd/ibs: Fix perf_ibs_op.cnt_mask for CurCnt (Ravi Bangoria)
  - bpftool: Fix readlink usage in get_fd_type (Viktor Malik)
  - drm/ast: Find VBIOS mode from regular display size (Thomas Zimmermann)
  - HID: usbkbd: Fix the bit shift number for LED_KANA (junan)
  - scsi: st: Restore some drive settings after reset (Kai Mäkisara)
  - scsi: lpfc: Handle duplicate D_IDs in ndlp search-by D_ID routine (Justin Tee)
  - net/mana: fix warning in the writer of client oob (Konstantin Taranov)
  - rcu: fix header guard for rcu_all_qs() (Ankur Arora)
  - rcu: handle quiescent states for PREEMPT_RCU=n, PREEMPT_COUNT=y (Ankur Arora)
  - r8169: don't scan PHY addresses > 0 (Heiner Kallweit)
  - vxlan: Annotate FDB data races (Ido Schimmel)
  - media: qcom: camss: csid: Only add TPG v4l2 ctrl if TPG hardware is available (Depeng Shao)
  - hwmon: (xgene-hwmon) use appropriate type for the latency value (Andrey Vatoropin)
  - clk: qcom: camcc-sm8250: Use clk_rcg2_shared_ops for some RCGs (Jordan Crouse)
  - wifi: rtw88: Fix download_firmware_validate() for RTL8814AU (Bitterblue Smith)
  - r8152: add vendor/device ID pair for Dell Alienware AW1022z (Aleksander Jan Bajkowski)
  - ip: fib_rules: Fetch net from fib_rule in fib[46]_rule_configure(). (Kuniyuki Iwashima)
  - arch/powerpc/perf: Check the instruction type before creating sample with perf_mem_data_src (Athira Rajeev)
  - wifi: mac80211: remove misplaced drv_mgd_complete_tx() call (Johannes Berg)
  - wifi: mac80211: don't unconditionally call drv_mgd_complete_tx() (Johannes Berg)
  - net/mlx5e: reduce rep rxq depth to 256 for ECPF (William Tu)
  - net/mlx5e: set the tx_queue_len for pfifo_fast (William Tu)
  - net/mlx5: Extend Ethtool loopback selftest to support non-linear SKB (Alexei Lazar)
  - drm/amd/display: Initial psr_version with correct setting (Tom Chung)
  - drm/amdgpu: reset psp->cmd to NULL after releasing the buffer (Jiang Liu)
  - phy: core: don't require set_mode() callback for phy_get_mode() to work (Dmitry Baryshkov)
  - net/mlx4_core: Avoid impossible mlx4_db_alloc() order value (Kees Cook)
  - media: v4l: Memset argument to 0 before calling get_mbus_config pad op (Sakari Ailus)
  - smack: recognize ipv4 CIPSO w/o categories (Konstantin Andreev)
  - pinctrl: devicetree: do not goto err when probing hogs in pinctrl_dt_to_map (Valentin Caron)
  - ASoC: soc-dai: check return value at snd_soc_dai_set_tdm_slot() (Kuninori Morimoto)
  - ASoC: tas2764: Power up/down amp on mute ops (Hector Martin)
  - ASoC: ops: Enforce platform maximum on initial value (Martin Povišer)
  - net/mlx5: Apply rate-limiting to high temperature warning (Shahar Shitrit)
  - net/mlx5: Modify LSB bitmask in temperature event to include only the first bit (Shahar Shitrit)
  - ACPI: HED: Always initialize before evged (Xiaofei Tan)
  - PCI: Fix old_size lower bound in calculate_iosize() too (Ilpo Järvinen)
  - eth: mlx4: don't try to complete XDP frames in netpoll (Jakub Kicinski)
  - can: c_can: Use of_property_present() to test existence of DT property (Krzysztof Kozlowski)
  - RDMA/core: Fix best page size finding when it can cross SG entries (Michael Margolin)
  - EDAC/ie31200: work around false positive build warning (Arnd Bergmann)
  - net: pktgen: fix access outside of user given buffer in pktgen_thread_write() (Peter Seiderer)
  - wifi: rtw88: Fix rtw_desc_to_mcsrate() to handle MCS16-31 (Bitterblue Smith)
  - wifi: rtw88: Fix rtw_init_ht_cap() for RTL8814AU (Bitterblue Smith)
  - wifi: rtw88: Fix rtw_init_vht_cap() for RTL8814AU (Bitterblue Smith)
  - scsi: mpt3sas: Send a diag reset if target reset fails (Shivasharan S)
  - clocksource: mips-gic-timer: Enable counter when CPUs start (Paul Burton)
  - MIPS: pm-cps: Use per-CPU variables as per-CPU, not per-core (Paul Burton)
  - MIPS: Use arch specific syscall name match function (Bibo Mao)
  - x86/kaslr: Reduce KASLR entropy on most x86 systems (Balbir Singh)
  - libbpf: Fix out-of-bound read (Nandakumar Edamana)
  - cpuidle: menu: Avoid discarding useful information (Rafael J. Wysocki)
  - x86/nmi: Add an emergency handler in nmi_desc & use it in nmi_shootdown_cpus() (Waiman Long)
  - drm/amd/display: handle max_downscale_src_width fail check (Yihan Zhu)
  - x86/build: Fix broken copy command in genimage.sh when making isoimage (Nir Lichtman)
  - soc: ti: k3-socinfo: Do not use syscon helper to build regmap (Andrew Davis)
  - bonding: report duplicate MAC address in all situations (Hangbin Liu)
  - net: xgene-v2: remove incorrect ACPI_PTR annotation (Arnd Bergmann)
  - drm/amdkfd: KFD release_work possible circular locking (Philip Yang)
  - selftests/net: have `gro.sh -t` return a correct exit code (Kevin Krakauer)
  - net/mlx5: Avoid report two health errors on same syndrome (Moshe Shemesh)
  - firmware: arm_ffa: Set dma_mask for ffa devices (Viresh Kumar)
  - PCI: brcmstb: Add a softdep to MIP MSI-X driver (Stanimir Varbanov)
  - PCI: brcmstb: Expand inbound window size up to 64GB (Stanimir Varbanov)
  - fpga: altera-cvp: Increase credit timeout (Kuhanh Murugasen Krishnan)
  - drm/mediatek: mtk_dpi: Add checks for reg_h_fre_con existence (AngeloGioacchino Del Regno)
  - ARM: at91: pm: fix at91_suspend_finish for ZQ calibration (Li Bin)
  - hwmon: (gpio-fan) Add missing mutex locks (Alexander Stein)
  - x86/bugs: Make spectre user default depend on MITIGATION_SPECTRE_V2 (Breno Leitao)
  - clk: imx8mp: inform CCF of maximum frequency of clocks (Ahmad Fatoum)
  - media: uvcvideo: Add sanity check to uvc_ioctl_xu_ctrl_map (Ricardo Ribalda)
  - ipv4: fib: Move fib_valid_key_len() to rtm_to_fib_config(). (Kuniyuki Iwashima)
  - net: pktgen: fix mpls maximum labels list parsing (Peter Seiderer)
  - net: ethernet: ti: cpsw_new: populate netdev of_node (Alexander Sverdlin)
  - pinctrl: bcm281xx: Use "unsigned int" instead of bare "unsigned" (Artur Weber)
  - media: cx231xx: set device_caps for 417 (Hans Verkuil)
  - drm/amdgpu: Do not program AGP BAR regs under SRIOV in gfxhub_v1_0.c (Victor Lu)
  - remoteproc: qcom_wcnss: Handle platforms with only single power domain (Matti Lehtimäki)
  - orangefs: Do not truncate file size (Matthew Wilcox (Oracle))
  - dm cache: prevent BUG_ON by blocking retries on failed device resumes (Ming-Hung Tsai)
  - media: c8sectpfe: Call of_node_put(i2c_bus) only once in c8sectpfe_probe() (Markus Elfring)
  - ARM: tegra: Switch DSI-B clock parent to PLLD on Tegra114 (Svyatoslav Ryhel)
  - ieee802154: ca8210: Use proper setters and getters for bitwise types (Andy Shevchenko)
  - rtc: ds1307: stop disabling alarms on probe (Alexandre Belloni)
  - tcp: bring back NUMA dispersion in inet_ehash_locks_alloc() (Eric Dumazet)
  - powerpc/prom_init: Fixup missing #size-cells on PowerBook6,7 (Andreas Schwab)
  - arm64: tegra: p2597: Fix gpio for vdd-1v8-dis regulator (Diogo Ivo)
  - crypto: lzo - Fix compression buffer overrun (Herbert Xu)
  - cpufreq: tegra186: Share policy per cluster (Aaron Kling)
  - ASoC: qcom: sm8250: explicitly set format in sm8250_be_hw_params_fixup() (Alexey Klimov)
  - auxdisplay: charlcd: Partially revert "Move hwidth and bwidth to struct hd44780_common" (Andy Shevchenko)
  - ipv6: save dontfrag in cork (Willem de Bruijn)
  - mmc: sdhci: Disable SD card clock before changing parameters (Erick Shepherd)
  - arm64/mm: Check PUD_TYPE_TABLE in pud_bad() (Ryan Roberts)
  - netfilter: conntrack: Bound nf_conntrack sysctl writes (Nicolas Bouchinet)
  - timer_list: Don't use %pK through printk() (Thomas Weißschuh)
  - posix-timers: Add cond_resched() to posix_timer_add() search loop (Eric Dumazet)
  - RDMA/uverbs: Propagate errors from rdma_lookup_get_uobject() (Maher Sanalla)
  - xen: Add support for XenServer 6.1 platform device (Frediano Ziglio)
  - dm: restrict dm device size to 2^63-512 bytes (Mikulas Patocka)
  - crypto: octeontx2 - suppress auth failure screaming due to negative tests (Shashank Gupta)
  - kbuild: fix argument parsing in scripts/config (Seyediman Seyedarab)
  - ASoC: mediatek: mt6359: Add stub for mt6359_accdet_enable_jack_detect (Nícolas F. R. A. Prado)
  - rtc: rv3032: fix EERD location (Alexandre Belloni)
  - tcp: reorganize tcp_in_ack_event() and tcp_count_delivered() (Ilpo Järvinen)
  - vfio/pci: Handle INTx IRQ_NOTCONNECTED (Alex Williamson)
  - scsi: st: ERASE does not change tape location (Kai Mäkisara)
  - scsi: st: Tighten the page format heuristics with MODE SELECT (Kai Mäkisara)
  - ext4: reorder capability check last (Christian Göttsche)
  - um: Update min_low_pfn to match changes in uml_reserved (Tiwei Bie)
  - um: Store full CSGSFS and SS register from mcontext (Benjamin Berg)
  - dlm: make tcp still work in multi-link env (Heming Zhao)
  - i3c: master: svc: Fix missing STOP for master request (Stanley Chu)
  - btrfs: send: return -ENAMETOOLONG when attempting a path that is too long (Filipe Manana)
  - btrfs: get zone unusable bytes while holding lock at btrfs_reclaim_bgs_work() (Filipe Manana)
  - btrfs: avoid linker error in btrfs_find_create_tree_block() (Mark Harmstone)
  - btrfs: make btrfs_discard_workfn() block_group ref explicit (Boris Burkov)
  - i2c: pxa: fix call balance of i2c->clk handling routines (Vitalii Mordan)
  - i2c: qup: Vote for interconnect bandwidth to DRAM (Stephan Gerhold)
  - wifi: mt76: only mark tx-status-failed frames as ACKed on mt76x0/2 (Felix Fietkau)
  - mmc: host: Wait for Vdd to settle on card power off (Erick Shepherd)
  - libnvdimm/labels: Fix divide error in nd_label_data_init() (Robert Richter)
  - PCI: vmd: Disable MSI remapping bypass under Xen (Roger Pau Monne)
  - pNFS/flexfiles: Report ENETDOWN as a connection error (Trond Myklebust)
  - tools/build: Don't pass test log files to linker (Ian Rogers)
  - PCI: dwc: ep: Ensure proper iteration over outbound map windows (Frank Li)
  - lockdep: Fix wait context check on softirq for PREEMPT_RT (Ryo Takakura)
  - dql: Fix dql->limit value when reset. (Jing Su)
  - thermal/drivers/qoriq: Power down TMU on system suspend (Alice Guo)
  - SUNRPC: rpcbind should never reset the port to the value '0' (Trond Myklebust)
  - SUNRPC: rpc_clnt_set_transport() must not change the autobind setting (Trond Myklebust)
  - NFSv4: Treat ENETUNREACH errors as fatal for state recovery (Trond Myklebust)
  - fbdev: core: tileblit: Implement missing margin clearing for tileblit (Zsolt Kajtar)
  - fbcon: Use correct erase colour for clearing in fbcon (Zsolt Kajtar)
  - fbdev: fsl-diu-fb: add missing device_remove_file() (Shixiong Ou)
  - mailbox: use error ret code of of_parse_phandle_with_args() (Tudor Ambarus)
  - tracing: Mark binary printing functions with __printf() attribute (Andy Shevchenko)
  - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Trond Myklebust)
  - kconfig: merge_config: use an empty file as initfile (Daniel Gomez)
  - samples/bpf: Fix compilation failure for samples/bpf on LoongArch Fedora (Haoran Jiang)
  - bpf: fix possible endless loop in BPF map iteration (Brandon Kammerdiener)
  - net: enetc: refactor bulk flipping of RX buffers to separate function (Vladimir Oltean)
  - cgroup: Fix compilation issue due to cgroup_mutex not being exported (gaoxu)
  - dma-mapping: avoid potential unused data compilation warning (Marek Szyprowski)
  - virtio_ring: Fix data race by tagging event_triggered as racy for KCSAN (Zhongqiu Han)
  - scsi: target: iscsi: Fix timeout on deleted connection (Dmitry Bogdanov)


author: Brian Maly <brian.maly@oracle.com> [5.15.0-311.185.3.el9uek]
changelog:
  - net_sched: sch_sfq: move the limit validation (Octavian Purdila)  [Orabug: 38160459]  {CVE-2025-37752}
  - net_sched: sch_sfq: use a temporary work area for validating configuration (Octavian Purdila)
  - mm: synchronise PGD in x86 when utilising dax vmemmap optimisation (Lorenzo Stoakes)  [Orabug: 38055896]
  - rds: ib: Make sure a QP in INIT state is transitioned to ERR (Håkon Bugge)  [Orabug: 38119112]
  - Reapply "rds: ib: Make sure receives are posted before connection is up" (Håkon Bugge)  [Orabug: 38119112]
  - rds: Fix array index out of bounds in rds_message_purge() (Harshit Mogalapalli)  [Orabug: 38158026]
  - block: assign bi_bdev for cloned bios in blk_rq_prep_clone (Christoph Hellwig)  [Orabug: 38172722]
  - fs/proc: do_task_stat: use __for_each_thread() (Oleg Nesterov)  [Orabug: 38092818]
  - Add Zen34 clients (Borislav Petkov (AMD))  [Orabug: 38167060]  {CVE-2024-36350} {CVE-2024-36357}
  - x86/process: Move the buffer clearing before MONITOR (Kim Phillips)  [Orabug: 38167060]  {CVE-2024-36350} {CVE-2024-36357}
  - Add normal counters (Borislav Petkov (AMD))  [Orabug: 38167060]  {CVE-2024-36350} {CVE-2024-36357}
  - KVM: SVM: Advertize TSA CPUID bits to guests (Borislav Petkov (AMD))  [Orabug: 38167060]  {CVE-2024-36350} {CVE-2024-36357}
  - x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov (AMD))  [Orabug: 38167060]  {CVE-2024-36350} {CVE-2024-36357}
  - x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov (AMD))  [Orabug: 38167060]  {CVE-2024-36350} {CVE-2024-36357}
  - x86/CPU/AMD: Add ZenX generations flags (Borislav Petkov (AMD))  [Orabug: 38167060]  {CVE-2024-36350} {CVE-2024-36357}
  - x86/bugs: Free X86_BUG_AMD_APIC_C1E and X86_BUG_AMD_E400 bits (Boris Ostrovsky)  [Orabug: 38167060]  {CVE-2024-36350} {CVE-2024-36357}


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-311.185.4.el9uek]
changelog:
  - KVM: arm64: Sanitize PM{C,I}NTEN{SET,CLR}, PMOVS{SET,CLR} before first run (Raghavendra Rao Ananta)  [Orabug: 38178527]
  - KVM: arm64: PMU: Add a helper to read a vCPU's PMCR_EL0 (Reiji Watanabe)  [Orabug: 38178527]
  - vhost-scsi: Fix vhost_scsi struct use after free (Mike Christie)  [Orabug: 38178300]
  - sunrpc: handle SVC_GARBAGE during svc auth processing as auth error (Jeff Layton)  [Orabug: 38137450]  {CVE-2025-38089}
  - bnxt_en: Cap the size of HWRM_PORT_PHY_QCFG forwarded response (Michael Chan)  [Orabug: 35789734]


author: Brian Maly <brian.maly@oracle.com> [5.15.0-311.185.5.el9uek]
changelog:
  - KVM: x86: Remove VT-d mention in posted interrupt tracepoint (Alejandro Jimenez)  [Orabug: 38195091]
  - KVM: x86: Only set APICV_INHIBIT_REASON_ABSENT if APICv is enabled (Alejandro Jimenez)  [Orabug: 38195091]
  - KVM: x86: Print names of apicv inhibit reasons in traces (Alejandro Jimenez)  [Orabug: 38195091]
  - KVM: SVM: Always update local APIC on writes to logical dest register (Sean Christopherson)  [Orabug: 38195091]
  - x86: Pin task-stack in __get_wchan() (Peter Zijlstra)  [Orabug: 38161988]
  - x86: Fix __get_wchan() for !STACKTRACE (Peter Zijlstra)  [Orabug: 38161988]
  - sched: Add wrapper for get_wchan() to keep task blocked (Kees Cook)  [Orabug: 38161988]
  - x86: Fix get_wchan() to support the ORC unwinder (Qi Zheng)  [Orabug: 38161988]
  - nvme: tcp: avoid race between queue_lock lock and destroy (Hannes Reinecke)  [Orabug: 37331887]  {CVE-2024-53100}
  - PCI/AER: Add sysfs attributes for log ratelimits (Jon Pan-Doh)  [Orabug: 36952192]
  - PCI/AER: Ratelimit correctable and non-fatal error logging (Jon Pan-Doh)  [Orabug: 36952192]
  - PCI/AER: Simplify add_error_device() (Bjorn Helgaas)  [Orabug: 36952192]
  - PCI/AER: Convert aer_get_device_error_info(), aer_print_error() to index (Bjorn Helgaas)  [Orabug: 36952192]
  - PCI/AER: Reduce pci_print_aer() correctable error level to KERN_WARNING (Karolina Stolarek)  [Orabug: 36952192]
  - PCI/AER: Check log level once and remember it (Karolina Stolarek)  [Orabug: 36952192]
  - PCI/AER: Trace error event before ratelimiting (Bjorn Helgaas)  [Orabug: 36952192]
  - PCI/AER: Update statistics before ratelimiting (Bjorn Helgaas)  [Orabug: 36952192]
  - PCI/AER: Simplify pci_print_aer() (Bjorn Helgaas)  [Orabug: 36952192]
  - PCI/AER: Initialize aer_err_info before using it (Bjorn Helgaas)  [Orabug: 36952192]
  - PCI/AER: Move aer_print_source() earlier in file (Bjorn Helgaas)  [Orabug: 36952192]
  - PCI/AER: Rename aer_print_port_info() to aer_print_source() (Jon Pan-Doh)  [Orabug: 36952192]
  - PCI/AER: Extract bus/dev/fn in aer_print_port_info() with PCI_BUS_NUM(), etc (Bjorn Helgaas)  [Orabug: 36952192]
  - PCI/AER: Consolidate Error Source ID logging in aer_isr_one_error_type() (Bjorn Helgaas)  [Orabug: 36952192]
  - PCI/AER: Factor COR/UNCOR error handling out from aer_isr_one_error() (Bjorn Helgaas)  [Orabug: 36952192]
  - PCI/AER: Descope pci_printk() to aer_printk() (Ilpo Järvinen)  [Orabug: 36952192]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-311.185.6.el9uek]
changelog:
  - gre: Fix IPv6 multicast route creation. (Guillaume Nault)
  - pwm: mediatek: Ensure to disable clocks in error path (Uwe Kleine-König)
  - Revert "mmc: sdhci: Disable SD card clock before changing parameters" (Ulf Hansson)
  - net/sched: Always pass notifications when child class becomes empty (Lion Ackermann)
  - Revert "ipv6: save dontfrag in cork" (Brett A C Sheffield (Librecast))
  - net/mlx5: set graceful_period to 0 to allow multiple transmission queue recovery (Praveen Kumar Kannoju)  [Orabug: 38182990]
  - Revert "net/rds: Add krefs to struct rds_connection" (Håkon Bugge)  [Orabug: 38165949]
  - Revert "net/rds: tracepoints for rds_conn_kref_get and put" (Håkon Bugge)  [Orabug: 38165949]
  - sched: Change nr_uninterruptible type to unsigned long (Aruna Ramakrishna)  [Orabug: 37942383]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-311.185.7.el9uek]
changelog:
  - perf: Fix perf_event_validate_size() lockdep splat (Mark Rutland)  [Orabug: 36261485]  {CVE-2023-6931}
  - perf: Fix perf_event_validate_size() (Peter Zijlstra)  [Orabug: 36261485]  {CVE-2023-6931}


author: Brian Maly <brian.maly@oracle.com> [5.15.0-311.185.8.el9uek]
changelog:
  - net/mlx5: Add poll-eq API to be used by ULP's (Praveen Kumar Kannoju)  [Orabug: 38182400]
  - net/rds: poll eq during user-reset (Praveen Kumar Kannoju)  [Orabug: 38189328]


author: Brian Maly <brian.maly@oracle.com> [5.15.0-311.185.5.el9uek]
changelog:
  - KVM: x86: Remove VT-d mention in posted interrupt tracepoint (Alejandro Jimenez) [Orabug: 38195091]
  - KVM: x86: Only set APICV_INHIBIT_REASON_ABSENT if APICv is enabled (Alejandro Jimenez) [Orabug: 38195091]
  - KVM: x86: Print names of apicv inhibit reasons in traces (Alejandro Jimenez) [Orabug: 38195091]
  - KVM: SVM: Always update local APIC on writes to logical dest register (Sean Christopherson) [Orabug: 38195091]
  - x86: Pin task-stack in __get_wchan() (Peter Zijlstra) [Orabug: 38161988]
  - x86: Fix __get_wchan() for !STACKTRACE (Peter Zijlstra) [Orabug: 38161988]
  - sched: Add wrapper for get_wchan() to keep task blocked (Kees Cook) [Orabug: 38161988]
  - x86: Fix get_wchan() to support the ORC unwinder (Qi Zheng) [Orabug: 38161988]
  - nvme: tcp: avoid race between queue_lock lock and destroy (Hannes Reinecke) [Orabug: 37331887] {CVE-2024-53100}
  - PCI/AER: Add sysfs attributes for log ratelimits (Jon Pan-Doh) [Orabug: 36952192]
  - PCI/AER: Ratelimit correctable and non-fatal error logging (Jon Pan-Doh) [Orabug: 36952192]
  - PCI/AER: Simplify add_error_device() (Bjorn Helgaas) [Orabug: 36952192]
  - PCI/AER: Convert aer_get_device_error_info(), aer_print_error() to index (Bjorn Helgaas) [Orabug: 36952192]
  - PCI/AER: Reduce pci_print_aer() correctable error level to KERN_WARNING (Karolina Stolarek) [Orabug: 36952192]
  - PCI/AER: Check log level once and remember it (Karolina Stolarek) [Orabug: 36952192]
  - PCI/AER: Trace error event before ratelimiting (Bjorn Helgaas) [Orabug: 36952192]
  - PCI/AER: Update statistics before ratelimiting (Bjorn Helgaas) [Orabug: 36952192]
  - PCI/AER: Simplify pci_print_aer() (Bjorn Helgaas) [Orabug: 36952192]
  - PCI/AER: Initialize aer_err_info before using it (Bjorn Helgaas) [Orabug: 36952192]
  - PCI/AER: Move aer_print_source() earlier in file (Bjorn Helgaas) [Orabug: 36952192]
  - PCI/AER: Rename aer_print_port_info() to aer_print_source() (Jon Pan-Doh) [Orabug: 36952192]
  - PCI/AER: Extract bus/dev/fn in aer_print_port_info() with PCI_BUS_NUM(), etc (Bjorn Helgaas) [Orabug: 36952192]
  - PCI/AER: Consolidate Error Source ID logging in aer_isr_one_error_type() (Bjorn Helgaas) [Orabug: 36952192]
  - PCI/AER: Factor COR/UNCOR error handling out from aer_isr_one_error() (Bjorn Helgaas) [Orabug: 36952192]
  - PCI/AER: Descope pci_printk() to aer_printk() (Ilpo Järvinen) [Orabug: 36952192]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-311.185.6.el9uek]
changelog:
  - gre: Fix IPv6 multicast route creation. (Guillaume Nault)
  - pwm: mediatek: Ensure to disable clocks in error path (Uwe Kleine-König)
  - Revert "mmc: sdhci: Disable SD card clock before changing parameters" (Ulf Hansson)
  - net/sched: Always pass notifications when child class becomes empty (Lion Ackermann) [Orabug: 38217338] {CVE-2025-38350}
  - Revert "ipv6: save dontfrag in cork" (Brett A C Sheffield)
  - net/mlx5: set graceful_period to 0 to allow multiple transmission queue recovery (Praveen Kumar Kannoju) [Orabug: 38182990]
  - Revert "net/rds: Add krefs to struct rds_connection" (Håkon Bugge) [Orabug: 38165949]
  - Revert "net/rds: tracepoints for rds_conn_kref_get and put" (Håkon Bugge) [Orabug: 38165949]
  - sched: Change nr_uninterruptible type to unsigned long (Aruna Ramakrishna) [Orabug: 37942383]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-311.185.7.el9uek]
changelog:
  - perf: Fix perf_event_validate_size() lockdep splat (Mark Rutland) [Orabug: 36261485] {CVE-2023-6931}
  - perf: Fix perf_event_validate_size() (Peter Zijlstra) [Orabug: 36261485] {CVE-2023-6931}


author: Brian Maly <brian.maly@oracle.com> [5.15.0-311.185.8.el9uek]
changelog:
  - net/mlx5: Add poll-eq API to be used by ULP's (Praveen Kumar Kannoju) [Orabug: 38182400]
  - net/rds: poll eq during user-reset (Praveen Kumar Kannoju) [Orabug: 38189328]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-312.185.1.el9uek]
changelog:
  - uek-rpm: mips: Disable CONFIG_TRANSPARENT_HUGEPAGE (Dave Kleikamp) [Orabug: 38280961]
  - KVM: x86/MMU: Allow faulting at hugepages during dirty tracking (Joao Martins) [Orabug: 36409415]
  - KVM: x86/MMU: Dirty tracking without write-protection for shadow paging (Joao Martins) [Orabug: 36409415]
  - KVM: x86/MMU: Track rmap present pages (Joao Martins) [Orabug: 36409415]
  - nvme: check for valid nvme_identify_ns() before using it (Ewan D. Milne) [Orabug: 38207640]
  - nvme: bring back auto-removal of deleted namespaces during sequential scan (Christoph Hellwig) [Orabug: 38207640]
  - rds: tcp: block BH in TCP callbacks (Eric Dumazet) [Orabug: 38236843]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-312.187.2.el9uek]
changelog:
  - EDAC: Octeon: Fix compile error by replacing sdei_init() with acpi_sdei_init() (Vijayendra Suman) [Orabug: 38294908]
  - LTS version: v5.15.187 (Vijayendra Suman)
  - usb: typec: displayport: Fix potential deadlock (Andrei Kuchynski) [Orabug: 38309912] {CVE-2025-38404}
  - platform/x86: think-lmi: Create ksets consecutively (Kurt Borja)
  - Logitech C-270 even more broken (Oliver Neukum)
  - i2c/designware: Fix an initialization issue (Michael J. Ruhl) [Orabug: 38253850] {CVE-2025-38380}
  - usb: cdnsp: do not disable slot for disabled slot (Peter Chen)
  - xhci: dbc: Flush queued requests before stopping dbc (Mathias Nyman)
  - xhci: dbctty: disable ECHO flag by default (Łukasz Bartosik)
  - platform/x86: dell-wmi-sysman: Fix class device unregistration (Kurt Borja)
  - platform/x86: think-lmi: Fix class device unregistration (Kurt Borja)
  - dpaa2-eth: fix xdp_rxq_info leak (Wangfushuai)
  - net: dpaa2-eth: rearrange variable in dpaa2_eth_get_ethtool_stats (Ioana Ciornei)
  - dpaa2-eth: Update SINGLE_STEP register access (Radu Bulie)
  - dpaa2-eth: Update dpni_get_single_step_cfg command (Radu Bulie)
  - ethernet: atl1: Add missing DMA mapping error checks and count errors (Thomas Fourier)
  - NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Trond Myklebust)
  - drm/v3d: Disable interrupts before resetting the GPU (Maíra Canal) [Orabug: 38253820] {CVE-2025-38371}
  - regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods (Manivannan Sadhasivam) [Orabug: 38253906] {CVE-2025-38395}
  - regulator: gpio: Add input_supply support in gpio_regulator_config (Jerome Neanne)
  - mmc: core: sd: Apply BROKEN_SD_DISCARD quirk earlier (Avri Altman)
  - rcu: Return early if callback is not specified (Uladzislau Rezki)
  - mtd: spinand: fix memory leak of ECC engine conf (Pablo Martin-Gomez) [Orabug: 38253863] {CVE-2025-38384}
  - ACPICA: Refuse to evaluate a method if arguments are missing (Rafael J. Wysocki) [Orabug: 38253874] {CVE-2025-38386}
  - wifi: ath6kl: remove WARN on bad firmware input (Johannes Berg) [Orabug: 38253945] {CVE-2025-38406}
  - wifi: mac80211: drop invalid source address OCB frames (Johannes Berg)
  - scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() (Maurizio Lombardi) [Orabug: 38253914] {CVE-2025-38399}
  - powerpc: Fix struct termio related ioctl macros (Madhavan Srinivasan)
  - ata: pata_cs5536: fix build on 32-bit UML (Johannes Berg)
  - ALSA: sb: Force to disable DMAs once when DMA mode is changed (Takashi Iwai)
  - ALSA: sb: Don't allow changing the DMA mode during operations (Takashi Iwai)
  - drm/msm: Fix a fence leak in submit error path (Rob Clark) [Orabug: 38253967] {CVE-2025-38410}
  - nui: Fix dma_mapping_error() check (Thomas Fourier)
  - rose: fix dangling neighbour pointers in rose_rt_device_down() (Kohei Enju) [Orabug: 38253841] {CVE-2025-38377}
  - enic: fix incorrect MTU comparison in enic_change_mtu() (Alok Tiwari)
  - amd-xgbe: align CL37 AN sequence as per databook (Raju Rangoju)
  - lib: test_objagg: Set error message in check_expect_hints_stats() (Dan Carpenter)
  - igc: disable L1.2 PCI-E link substate to avoid performance issue (Vitaly Lifshits)
  - drm/i915/gt: Fix timeline left held on VMA alloc error (Janusz Krzysztofik) [Orabug: 38253886] {CVE-2025-38389}
  - platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks (Kurt Borja) [Orabug: 38253976] {CVE-2025-38412}
  - drm/i915/selftests: Change mock_request() to return error pointers (Dan Carpenter)
  - spi: spi-fsl-dspi: Clear completion counter before initiating transfer (James Clark)
  - drm/exynos: fimd: Guard display clock control with runtime PM calls (Marek Szyprowski)
  - btrfs: fix missing error handling when searching for inode refs during log replay (Filipe Manana)
  - scsi: ufs: core: Fix spelling of a sysfs attribute name (Bart Van Assche)
  - scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu() (Thomas Fourier)
  - scsi: qla2xxx: Fix DMA mapping test in qla24xx_get_port_database() (Thomas Fourier)
  - NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [Orabug: 38253900] {CVE-2025-38393}
  - nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. (Kuniyuki Iwashima) [Orabug: 38253922] {CVE-2025-38400}
  - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Mark Zhang) [Orabug: 38253880] {CVE-2025-38387}
  - platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment (David Thompson)
  - mtk-sd: reset host->mrq on prepare_data() error (Sergey Senozhatsky)
  - mtk-sd: Prevent memory corruption from DMA map failure (Masami Hiramatsu) [Orabug: 38253927] {CVE-2025-38401}
  - mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data (Masami Hiramatsu)
  - usb: typec: altmodes/displayport: do not index invalid pin_assignments (Rd Babiera) [Orabug: 38253893] {CVE-2025-38391}
  - mmc: sdhci: Add a helper function for dump register in dynamic debug mode (Victor Shih)
  - vsock/vmci: Clear the vmci transport packet properly when initializing it (Harshavardhana S A) [Orabug: 38253936] {CVE-2025-38403}
  - rtc: cmos: use spin_lock_irqsave in cmos_interrupt (Mateusz Jończyk)
  - ARM: 9354/1: ptrace: Use bitfield helpers (Geert Uytterhoeven)
  - btrfs: don't drop extent_map for free space inode on write error (Josef Bacik) [Orabug: 36530624] {CVE-2024-26726}
  - arm64: Restrict pagetable teardown to avoid false warning (Dev Jain)
  - s390: Add '-std=gnu11' to decompressor and purgatory CFLAGS (Nathan Chancellor)
  - s390/entry: Fix last breaking event handling in case of stack corruption (Heiko Carstens)
  - media: uvcvideo: Rollback non processed entities on error (Ricardo Ribalda)
  - PCI: hv: Do not set PCI_COMMAND_MEMORY to reduce VM boot time (Dexuan Cui)
  - drm/amd/display: Add null pointer check for get_first_active_display() (Xu Wang) [Orabug: 38253794] {CVE-2025-38362}
  - drm/bridge: cdns-dsi: Wait for Clk and Data Lanes to be ready (Aradhya Bhatia)
  - drm/bridge: cdns-dsi: Check return value when getting default PHY config (Aradhya Bhatia)
  - drm/bridge: cdns-dsi: Fix connecting to next bridge (Aradhya Bhatia)
  - drm/bridge: cdns-dsi: Fix the clock variable for mode_valid() (Aradhya Bhatia)
  - drm/amdkfd: Fix race in GWS queue scheduling (Jay Cornwall)
  - drm/udl: Unregister device before cleaning up on disconnect (Thomas Zimmermann)
  - drm/tegra: Fix a possible null pointer dereference (Qiu-Ji Chen) [Orabug: 38253800] {CVE-2025-38363}
  - drm/tegra: Assign plane type before registration (Thierry Reding)
  - HID: wacom: fix kobject reference count leak (Qasim Ijaz)
  - HID: wacom: fix memory leak on sysfs attribute creation failure (Qasim Ijaz)
  - HID: wacom: fix memory leak on kobject creation failure (Qasim Ijaz)
  - btrfs: update superblock's device bytes_used when dropping chunk (Mark Harmstone)
  - dm-raid: fix variable in journal device check (Heinz Mauelshagen)
  - Bluetooth: L2CAP: Fix L2CAP MTU negotiation (Frédéric Danis)
  - dt-bindings: serial: 8250: Make clocks and clock-frequency exclusive (Yao Zi)
  - staging: rtl8723bs: Avoid memset() in aes_cipher() and aes_decipher() (Nathan Chancellor)
  - net: selftests: fix TCP packet checksum (Jakub Kicinski)
  - atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister(). (Kuniyuki Iwashima) [Orabug: 38175043] {CVE-2025-38245}
  - net: enetc: Correct endianness handling in _enetc_rd_reg64 (Simon Horman)
  - um: ubd: Add missing error check in start_io_thread() (Tiwei Bie)
  - vsock/uapi: fix linux/vm_sockets.h userspace compilation errors (Stefano Garzarella)
  - af_unix: Don't set -ECONNRESET for consumed OOB skb. (Kuniyuki Iwashima)
  - wifi: mac80211: fix beacon interval calculation overflow (Lachlan Hodges)
  - libbpf: Fix null pointer dereference in btf_dump__free on allocation failure (Yuan Chen)
  - attach_recursive_mnt(): do not lock the covering tree when sliding something under it (Al Viro)
  - ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() (Youngjun Lee) [Orabug: 38175063] {CVE-2025-38249}
  - atm: clip: prevent NULL deref in clip_push() (Eric Dumazet) [Orabug: 38175077] {CVE-2025-38251}
  - s390/pkey: Prevent overflow in size calculation for memdup_user() (Fedor Pchelkin) [Orabug: 38175091] {CVE-2025-38257}
  - i2c: robotfuzz-osif: disable zero-length read messages (Wolfram Sang)
  - i2c: tiny-usb: disable zero-length read messages (Wolfram Sang)
  - platform/x86: ideapad-laptop: use usleep_range() for EC polling (Rongrong)
  - dummycon: Trigger redraw when switching consoles with deferred takeover (Thomas Zimmermann)
  - tty: vt: make consw::con_switch() return a bool (Jiri Slaby)
  - tty: vt: sanitize arguments of consw::con_clear() (Jiri Slaby)
  - tty: vt: make init parameter of consw::con_init() a bool (Jiri Slaby)
  - vgacon: remove unneeded forward declarations (Jiri Slaby)
  - vgacon: switch vgacon_scrolldelta() and vgacon_restore_screen() (Jiri Slaby)
  - tty/vt: consolemap: rename and document struct uni_pagedir (Jiri Slaby)
  - fbcon: delete a few unneeded forward decl (Daniel Vetter)
  - uio_hv_generic: Align ring size to system page (Long Li)
  - uio_hv_generic: Query the ringbuffer size for device (Saurabh Singh Sengar)
  - Drivers: hv: vmbus: Add utility function for querying ring size (Saurabh Singh Sengar)
  - Drivers: hv: Rename 'alloced' to 'allocated' (Vitaly Kuznetsov)
  - f2fs: don't over-report free space or inodes in statvfs (Chao Yu)
  - media: imx-jpeg: Drop the first error frames (Ming Qian)
  - clk: ti: am43xx: Add clkctrl data for am43xx ADC1 (Miquel Raynal)
  - media: omap3isp: use sgtable-based scatterlist wrappers (Marek Szyprowski)
  - media: davinci: vpif: Fix memory leak in probe error path (Dmitry Nikiforov)
  - jfs: validate AG parameters in dbMount() to prevent crashes (Vasiliy Kovalev) [Orabug: 38158700] {CVE-2025-38230}
  - fs/jfs: consolidate sanity checking in dbMount (Dave Kleikamp)
  - ovl: Check for NULL d_inode() in ovl_dentry_upper() (Kees Cook)
  - ceph: fix possible integer overflow in ceph_zero_objects() (Dmitry Kandybka)
  - ALSA: usb-audio: Add a quirk for Lenovo Thinkpad Thunderbolt 3 dock (Mario Limonciello)
  - ALSA: hda: Add new pci id for AMD GPU display HD audio controller (Vijendar Mukunda)
  - ALSA: hda: Ignore unsol events for cards being shut down (Cezary Rojewski)
  - usb: typec: displayport: Receive DP Status Update NAK request exit dp altmode (Jos Wang)
  - usb: cdc-wdm: avoid setting WDM_READ for ZLP-s (Robert Hodaszi)
  - usb: Add checks for snprintf() calls in usb_alloc_dev() (Andy Shevchenko)
  - usb: common: usb-conn-gpio: use a unique name for usb connector device (Chance Yang)
  - tty: serial: uartlite: register uart driver in init (Jakub Lewalski) [Orabug: 38175113] {CVE-2025-38262}
  - usb: potential integer overflow in usbg_make_tpg() (Chen Yufeng)
  - usb: dwc2: also exit clock_gating when stopping udc while suspended (Michael Grzeschik)
  - coresight: Only check bottom two claim bits (James Clark)
  - um: Add cmpxchg8b_emu and checksum functions to asm-prototypes.h (Sami Tolvanen)
  - iio: pressure: zpa2326: Use aligned_s64 for the timestamp (Jonathan Cameron)
  - bcache: fix NULL pointer in cache_set_flush() (Linggang Zeng) [Orabug: 38175119] {CVE-2025-38263}
  - md/md-bitmap: fix dm-raid max_write_behind setting (Yu Kuai)
  - dmaengine: xilinx_dma: Set dma_device directions (Thomas Gessler)
  - ksmbd: allow a filename to contain special characters on SMB3.1.1 posix extension (Namjae Jeon)
  - hwmon: (pmbus/max34440) Fix support for max34451 (Alexis Czezar Torreno)
  - leds: multicolor: Fix intensity setting while SW blinking (Sven Schwermer)
  - mfd: max14577: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
  - mailbox: Not protect module_put with spin_lock_irqsave (Peng Fan)
  - NFSv4.2: fix listxattr to return selinux security label (Olga Kornievskaia)
  - NFSv4: Always set NLINK even if the server doesn't support it (Han Young)
  - cifs: Fix cifs_query_path_info() for Windows NT servers (Pali Rohár)
  - LTS version: v5.15.186 (Vijayendra Suman)
  - scsi: qedf: Use designated initializer for struct qed_fcoe_cb_ops (Kees Cook)
  - scsi: elx: efct: Fix memory leak in efct_hw_parse_filter() (Vitaliy Shevtsov)
  - arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() (Tengda Wu) [Orabug: 38180595] {CVE-2025-38320}
  - perf: Fix sample vs do_exit() (Peter Zijlstra) [Orabug: 38254029] {CVE-2025-38424}
  - s390/pci: Fix __pcilg_mio_inuser() inline assembly (Heiko Carstens)
  - bpf: Fix L4 csum update on IPv6 in CHECKSUM_COMPLETE (Paul Chaignon)
  - net: Fix checksum update for ILA adj-transport (Paul Chaignon)
  - ext4: avoid remount errors with 'abort' mount option (Jan Kara)
  - ext4: make 'abort' mount option handling standard (Jan Kara)
  - mm/huge_memory: fix dereferencing invalid pmd migration entry (Gavin Guo) [Orabug: 37976983] {CVE-2025-37958}
  - net_sched: sch_sfq: reject invalid perturb period (Eric Dumazet) [Orabug: 38158476] {CVE-2025-38193}
  - arm64: proton-pack: Add new CPUs 'k' values for branch mitigation (James Morse)
  - arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users (James Morse) [Orabug: 37977005] {CVE-2025-37963}
  - arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs (James Morse) [Orabug: 37976929] {CVE-2025-37948}
  - arm64: spectre: increase parameters that can be used to turn off bhb mitigation individually (Liu Song)
  - arm64: proton-pack: Expose whether the branchy loop k value (James Morse)
  - arm64: proton-pack: Expose whether the platform is mitigated by firmware (James Morse)
  - arm64: insn: Add support for encoding DSB (James Morse)
  - arm64: insn: add encoders for atomic operations (Hou Tao)
  - arm64: move AARCH64_BREAK_FAULT into insn-def.h (Hou Tao)
  - serial: sh-sci: Increment the runtime usage counter for the earlycon device (Claudiu Beznea)
  - ARM: dts: am335x-bone-common: Increase MDIO reset deassert delay to 50ms (Geert Uytterhoeven)
  - ARM: dts: am335x-bone-common: Increase MDIO reset deassert time (Colin Foster)
  - ARM: dts: am335x-bone-common: Add GPIO PHY reset on revision C3 board (Shengyu Qu)
  - net: atm: fix /proc/net/atm/lec handling (Eric Dumazet) [Orabug: 38158405] {CVE-2025-38180}
  - net: atm: add lec_mutex (Eric Dumazet) [Orabug: 38180611] {CVE-2025-38323}
  - calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). (Kuniyuki Iwashima) [Orabug: 38158412] {CVE-2025-38181}
  - tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (Haixia Qu) [Orabug: 38158424] {CVE-2025-38184}
  - tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen() behavior (Neal Cardwell)
  - atm: atmtcp: Free invalid length skb in atmtcp_c_send(). (Kuniyuki Iwashima) [Orabug: 38158433] {CVE-2025-38185}
  - mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). (Kuniyuki Iwashima) [Orabug: 38180617] {CVE-2025-38324}
  - wifi: carl9170: do not ping device which has failed to load firmware (Dmitry Antipov) [Orabug: 38254010] {CVE-2025-38420}
  - ptp: fix breakage after ptp_vclock_in_use() rework (Vladimir Oltean)
  - net: ice: Perform accurate aRFS flow match (Krishna Kumar)
  - aoe: clean device rq_list in aoedev_downdev() (Justin Sanders) [Orabug: 38180627] {CVE-2025-38326}
  - pldmfw: Select CRC32 when PLDMFW is selected (Simon Horman)
  - hwmon: (occ) fix unaligned accesses (Arnd Bergmann)
  - hwmon: (occ) Rework attribute registration for stack usage (Arnd Bergmann)
  - hwmon: (occ) Add soft minimum power cap attribute (Eddie James)
  - drm/nouveau/bl: increase buffer size to avoid truncate warning (Jacob Keller)
  - drm/msm/dsi/dsi_phy_10nm: Fix missing initial VCO rate (Krzysztof Kozlowski)
  - erofs: remove unused trace event erofs_destroy_inode (Gao Xiang)
  - mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Jann Horn) [Orabug: 38132180] {CVE-2025-38085}
  - mm: hugetlb: independent PMD page table shared count (Liu Shixin) [Orabug: 37484959] {CVE-2024-57883}
  - mm/hugetlb: unshare page tables during VMA split, not before (Jann Horn) [Orabug: 38132171] {CVE-2025-38084}
  - iio: accel: fxls8962af: Fix temperature calculation (Sean Nyekjaer)
  - ALSA: hda/realtek: enable headset mic on Latitude 5420 Rugged (Jonathan Lane)
  - ALSA: hda/intel: Add Thinkpad E15 to PM deny list (Takashi Iwai)
  - ALSA: usb-audio: Rename ALSA kcontrol PCM and PCM1 for the KTMicro sound card (Wangdicheng)
  - Input: sparcspkr - avoid unannotated fall-through (Yuli Wang)
  - block: default BLOCK_LEGACY_AUTOLOAD to y (Christoph Hellwig)
  - HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() (Terry Junge) [Orabug: 38152876] {CVE-2025-38103}
  - atm: Revert atm_account_tx() if copy_from_iter_full() fails. (Kuniyuki Iwashima) [Orabug: 38158457] {CVE-2025-38190}
  - selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len (Stephen Smalley)
  - selftests/x86: Add a test to detect infinite SIGTRAP handler loop (Xin Li)
  - udmabuf: use sgtable-based scatterlist wrappers (Marek Szyprowski)
  - scsi: s390: zfcp: Ensure synchronous unit_add (Peter Oberparleiter)
  - scsi: storvsc: Increase the timeouts to storvsc_timeout (Dexuan Cui)
  - jffs2: check jffs2_prealloc_raw_node_refs() result in few other places (Fedor Pchelkin) [Orabug: 38180635] {CVE-2025-38328}
  - jffs2: check that raw node were preallocated before writing summary (Artem Sadovnikov) [Orabug: 38158483] {CVE-2025-38194}
  - drivers/rapidio/rio_cm.c: prevent possible heap overwrite (Andrew Morton) [Orabug: 38137453] {CVE-2025-38090}
  - powerpc/eeh: Fix missing PE bridge reconfiguration during VFIO EEH recovery (Narayana Murty N)
  - platform/x86: dell_rbu: Stop overwriting data buffer (Stuart Hayes)
  - platform/x86: dell_rbu: Fix list usage (Stuart Hayes) [Orabug: 38158494] {CVE-2025-38197}
  - Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first" (Alexander Sverdlin)
  - tee: Prevent size calculation wraparound on 32-bit kernels (Jann Horn)
  - ARM: OMAP2+: Fix l4ls clk domain handling in STANDBY (Sukrut Bellary)
  - bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value (Laurentiu Tudor)
  - watchdog: da9052_wdt: respect TWDMIN (Marcus Folkesson)
  - octeontx2-pf: Add error log forcn10k_map_unmap_rq_policer() (Xu Wang)
  - bpf, sockmap: Fix data lost during EAGAIN retries (Jiayuan Chen)
  - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Kyungwook Boo) [Orabug: 38158517] {CVE-2025-38200}
  - sock: Correct error checking condition for (assign|release)_proto_idx() (Zijun Hu)
  - scsi: lpfc: Use memcpy() for BIOS version (Daniel Wagner) [Orabug: 38180667] {CVE-2025-38332}
  - pinctrl: mcp23s08: Reset all pins to input at probe (Mike Looijmans)
  - software node: Correct a OOB check in software_node_get_reference_args() (Zijun Hu) [Orabug: 38180730] {CVE-2025-38342}
  - vxlan: Do not treat dst cache initialization errors as fatal (Ido Schimmel)
  - net: bridge: mcast: re-implement br_multicast_{enable, disable}_port functions (Yong Wang)
  - iommu/amd: Ensure GA log notifier callbacks finish running before module unload (Sean Christopherson)
  - scsi: lpfc: Fix lpfc_check_sli_ndlp() handling for GEN_REQUEST64 commands (Justin Tee)
  - libbpf: Add identical pointer detection to btf_dedup_is_equiv() (Alan Maguire)
  - clk: rockchip: rk3036: mark ddrphy as critical (Heiko Stuebner)
  - wifi: mac80211: do not offer a mesh path if forwarding is disabled (Benjamin Berg)
  - net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info (Jason Xing)
  - pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get() (Gabor Juhos)
  - pinctrl: armada-37xx: propagate error from armada_37xx_pmx_gpio_set_direction() (Gabor Juhos)
  - pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get_direction() (Gabor Juhos)
  - pinctrl: armada-37xx: propagate error from armada_37xx_pmx_set_by_name() (Gabor Juhos)
  - net: atlantic: generate software timestamp just before the doorbell (Jason Xing)
  - ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT (Sebastian Andrzej Siewior)
  - tcp: fix initial tp->rcvq_space.space value for passive TS enabled flows (Eric Dumazet)
  - tcp: always seek for minimal rtt in tcp_rcv_rtt_update() (Eric Dumazet)
  - net: dlink: add synchronization for stats update (Moon Yeounsu)
  - i2c: npcm: Add clock toggle recovery (Tali Perry)
  - cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs (Mike Tipton)
  - sctp: Do not wake readers in __sctp_write_space() (Petr Malat)
  - wifi: mt76: mt76x2: Add support for LiteOn WN4516R,WN4519R (Henk Vergonet)
  - emulex/benet: correct command version selection in be_cmd_get_stats() (Alok Tiwari)
  - i2c: designware: Invoke runtime suspend on quick slave re-registration (Tan En De)
  - tipc: use kfree_sensitive() for aead cleanup (Zilin Guan)
  - net: macb: Check return value of dma_set_mask_and_coherent() (Sergio Perez Gonzalez)
  - cpufreq: Force sync policy boost with global boost on sysfs update (Viresh Kumar)
  - thermal/drivers/qcom/tsens: Update conditions to strictly evaluate for IP v2+ (George Moussalem)
  - pmdomain: ti: Fix STANDBY handling of PER power domain (Sukrut Bellary)
  - nios2: force update_mmu_cache on spurious tlb-permission--related pagefaults (Simon Schuster)
  - media: i2c: imx334: update mode_3840x2160_regs array (Shravan Chippa)
  - media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode() (Xu Wang) [Orabug: 38175013] {CVE-2025-38237}
  - media: tc358743: ignore video while HPD is low (Hans Verkuil)
  - drm/amdkfd: Set SDMA_RLCx_IB_CNTL/SWITCH_INSIDE_IB (Amber Lin)
  - drm/msm/dpu: don't select single flush for active CTL blocks (Dmitry Baryshkov)
  - jfs: Fix null-ptr-deref in jfs_ioc_trim (Dylan Wolff) [Orabug: 38158545] {CVE-2025-38203}
  - drm/amdgpu/gfx9: fix CSIB handling (Alex Deucher)
  - drm/amdgpu/gfx8: fix CSIB handling (Alex Deucher)
  - ext4: prevent stale extent cache entries caused by concurrent get es_cache (Zhang Yi)
  - sunrpc: fix race in cache cleanup causing stale nextcheck time (Long Li)
  - media: rkvdec: Initialize the m2m context before the controls (Nicolas Dufresne)
  - media: ti: cal: Fix wrong goto on error path (Tomi Valkeinen)
  - jfs: fix array-index-out-of-bounds read in add_missing_indices (Aditya Dutt) [Orabug: 38158552] {CVE-2025-38204}
  - ext4: ext4: unify EXT4_EX_NOCACHE|NOFAIL flags in ext4_ext_remove_space() (Zhang Yi)
  - drm/amdgpu/gfx7: fix CSIB handling (Alex Deucher)
  - media: uapi: v4l: Change V4L2_TYPE_IS_CAPTURE condition (Nas Chung)
  - media: ccs-pll: Better validate VT PLL branch (Sakari Ailus)
  - drm/amdgpu/gfx10: fix CSIB handling (Alex Deucher)
  - media: i2c: imx334: Fix runtime PM handling in remove function (Tarang Raval)
  - drm/msm/a6xx: Increase HFI response timeout (Akhil P Oommen)
  - drm/amd/display: Add NULL pointer checks in dm_force_atomic_commit() (Srinivasan Shanmugam)
  - media: uapi: v4l: Fix V4L2_TYPE_IS_OUTPUT condition (Nas Chung)
  - drm/msm/hdmi: add runtime PM calls to DDC transfer function (Dmitry Baryshkov)
  - media: i2c: imx334: Enable runtime PM before sub-device registration (Tarang Raval)
  - drm/bridge: anx7625: change the gpiod_set_value API (Ayushi Makhija)
  - exfat: fix double free in delayed_free (Namjae Jeon) [Orabug: 38158566] {CVE-2025-38206}
  - drm/bridge: analogix_dp: Add irq flag IRQF_NO_AUTOEN instead of calling disable_irq() (Damon Ding)
  - sunrpc: update nextcheck time when adding new cache entries (Long Li)
  - drm/amdgpu/gfx6: fix CSIB handling (Alex Deucher)
  - ACPI: battery: negate current when discharging (Peter Marheine)
  - PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn() (Charan Teja Kalla)
  - ASoC: tegra210_ahub: Add check to of_device_get_match_data() (Yuanjun Gong)
  - ACPICA: utilities: Fix overflow check in vsnprintf() (Philip Redkin)
  - power: supply: bq27xxx: Retrieve again when busy (Jerry Lv)
  - ACPICA: fix acpi parse and parseext cache leaks (Seunghun Han) [Orabug: 38180747] {CVE-2025-38344}
  - ACPI: bus: Bail out if acpi_kobj registration fails (Armin Wolf)
  - ASoC: tas2770: Power cycle amp on ISENSE/VSENSE change (Hector Martin)
  - ACPICA: Avoid sequence overread in call to strncmp() (Ahmed Salem)
  - clocksource: Fix the CPUs' choice in the watchdog per CPU verification (Guilherme G. Piccoli)
  - ACPICA: fix acpi operand cache leak in dswstate.c (Seunghun Han) [Orabug: 38180755] {CVE-2025-38345}
  - iio: adc: ad7606_spi: fix reg write value mask (David Lechner)
  - iio: imu: inv_icm42600: Fix temperature calculation (Sean Nyekjaer)
  - iio: accel: fxls8962af: Fix temperature scan element sign (Sean Nyekjaer)
  - PCI: dw-rockchip: Fix PHY function call sequence in rockchip_pcie_phy_deinit() (Diederik de Haas)
  - PCI: Fix lock symmetry in pci_slot_unlock() (Ilpo Järvinen)
  - PCI: Add ACS quirk for Loongson PCIe (Huacai Chen)
  - PCI: cadence-ep: Correct PBA offset in .set_msix() callback (Niklas Cassel)
  - uio_hv_generic: Use correct size for interrupt and monitor pages (Long Li)
  - remoteproc: core: Release rproc->clean_table after rproc_attach() fails (Xiaolei Wang) [Orabug: 38254002] {CVE-2025-38418}
  - remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach() (Xiaolei Wang) [Orabug: 38254006] {CVE-2025-38419}
  - regulator: max14577: Add error check for max14577_read_reg() (Xu Wang)
  - mips: Add -std= flag specified in KBUILD_CFLAGS to vdso CFLAGS (Khem Raj)
  - staging: iio: ad5933: Correct settling cycles encoding per datasheet (Gabriel)
  - net: ch9200: fix uninitialised access during mii_nway_restart (Qasim Ijaz) [Orabug: 38132188] {CVE-2025-38086}
  - ftrace: Fix UAF when lookup kallsym after ftrace disabled (Ye Bin) [Orabug: 38180767] {CVE-2025-38346}
  - dm-mirror: fix a tiny race condition (Mikulas Patocka)
  - mtd: nand: sunxi: Add randomizer configuration before randomizer enable (Xu Wang)
  - mtd: rawnand: sunxi: Add randomizer configuration in sunxi_nfc_hw_ecc_write_chunk (Xu Wang)
  - mm: fix ratelimit_pages update error in dirty_ratio_handler() (Jinliang Zheng)
  - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Shin'Ichiro Kawasaki) [Orabug: 38158591] {CVE-2025-38211}
  - ipc: fix to protect IPCS lookups using RCU (Jeongjun Park) [Orabug: 38158597] {CVE-2025-38212}
  - clk: meson-g12a: add missing fclk_div2 to spicc (Da Xue)
  - parisc: fix building with gcc-15 (Arnd Bergmann)
  - vgacon: Add check for vc_origin address range in vgacon_scroll() (Gong, Ruiqi)
  - fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var (Murad Masimov) [Orabug: 38158614] {CVE-2025-38214}
  - EDAC/altera: Use correct write width with the INTTEST register (Niravkumar L Rabara)
  - NFC: nci: uart: Set tty->disc_data only in success path (Krzysztof Kozlowski) [Orabug: 38253991] {CVE-2025-38416}
  - f2fs: fix to do sanity check on sit_bitmap_size (Chao Yu) [Orabug: 38158639] {CVE-2025-38218}
  - f2fs: prevent kernel warning due to negative i_nlink from corrupted image (Jaegeuk Kim) [Orabug: 38158647] {CVE-2025-38219}
  - Input: ims-pcu - check record size in ims_pcu_flash_firmware() (Dan Carpenter) [Orabug: 38254053] {CVE-2025-38428}
  - ext4: ensure i_size is smaller than maxbytes (Zhang Yi)
  - ext4: factor out ext4_get_maxbytes() (Zhang Yi)
  - ext4: fix calculation of credits for extent tree modification (Jan Kara)
  - ext4: inline: fix len overflow in ext4_prepare_inline_data (Thadeu Lima de Souza Cascardo) [Orabug: 38158661] {CVE-2025-38222}
  - bus: fsl-mc: fix GET/SET_TAILDROP command ids (Wan Junjie)
  - bus: fsl-mc: do not add a device-link for the UAPI used DPMCP device (Ioana Ciornei)
  - ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330 (Tasos Sahanidis) [Orabug: 38180696] {CVE-2025-38336}
  - can: tcan4x5x: fix power regulator retrieval during probe (Brett Werling)
  - bus: mhi: host: Fix conflict between power_up and SYSERR (Jeffrey Hugo)
  - ARM: omap: pmic-cpcap: do not mess around without CPCAP or OMAP4 (Andreas Kemnade)
  - ARM: 9447/1: arm/memremap: fix arch_memremap_can_ram_remap() (Ross Stutterheim)
  - media: uvcvideo: Fix deferred probing error (Ricardo Ribalda)
  - media: uvcvideo: Send control events for partial succeeds (Ricardo Ribalda)
  - media: uvcvideo: Return the number of processed controls (Ricardo Ribalda)
  - media: vivid: Change the siize of the composing (Denis Arefev) [Orabug: 38158680] {CVE-2025-38226}
  - media: vidtv: Terminating the subsequent process of initialization failure (Edward Adam Davis) [Orabug: 38158685] {CVE-2025-38227}
  - media: videobuf2: use sgtable-based scatterlist wrappers (Marek Szyprowski)
  - media: venus: Fix probe error handling (Loic Poulain)
  - media: v4l2-dev: fix error handling in __video_register_device() (Ma Ke)
  - media: gspca: Add error handling for stv06xx_read_sensor() (Xu Wang)
  - media: cxusb: no longer judge rbuf when the write fails (Edward Adam Davis) [Orabug: 38158691] {CVE-2025-38229}
  - media: ccs-pll: Check for too high VT PLL multiplier in dual PLL case (Sakari Ailus)
  - media: ccs-pll: Correct the upper limit of maximum op_pre_pll_clk_div (Sakari Ailus)
  - media: ccs-pll: Start OP pre-PLL multiplier search from correct value (Sakari Ailus)
  - media: ccs-pll: Start VT pre-PLL multiplier search from correct value (Sakari Ailus)
  - media: ov8856: suppress probe deferral errors (Johan Hovold)
  - wifi: rtlwifi: disable ASPM for RTL8723BE with subsystem ID 11ad:1723 (Mingcong Bai)
  - jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() (Jeongjun Park) [Orabug: 38180706] {CVE-2025-38337}
  - nfsd: Initialize ssc before laundromat_work to prevent NULL dereference (Li Lingfeng) [Orabug: 38158706] {CVE-2025-38231}
  - nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request (Neil Brown) [Orabug: 38254061] {CVE-2025-38430}
  - wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback() (Christian Lamparter) [Orabug: 38180782] {CVE-2025-38348}
  - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Xu Wang)
  - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Xu Wang)
  - powerpc/pseries/msi: Avoid reading PCI device registers in reduced power states (Gautam Menghani)
  - ASoC: meson: meson-card-utils: use of_property_present() for DT parsing (Martin Blumenstingl)
  - ASoC: qcom: sdm845: Add error handling in sdm845_slim_snd_hw_params() (Xu Wang)
  - gfs2: move msleep to sleepable context (Alexander Aring)
  - crypto: marvell/cesa - Do not chain submitted requests (Herbert Xu)
  - configfs: Do not override creating attribute file failure in populate_attrs() (Zijun Hu)
  - xfs: allow inode inactivation during a ro mount log recovery (Darrick J. Wong)
  - kbuild: hdrcheck: fix cross build with clang (Arnd Bergmann)
  - kbuild: userprogs: fix bitsize and target detection on clang (Thomas Weißschuh)
  - drm/meson: Use 1000ULL when operating with mode->clock (I Hsin Cheng)
  - net: usb: aqc111: debug info before sanitation (Oliver Neukum)
  - calipso: unlock rcu before returning -EAFNOSUPPORT (Eric Dumazet)
  - x86/iopl: Cure TIF_IO_BITMAP inconsistencies (Thomas Gleixner) [Orabug: 38152863] {CVE-2025-38100}
  - xen/arm: call uaccess_ttbr0_enable for dm_op hypercall (Stefano Stabellini)
  - usb: typec: tcpm/tcpci_maxim: Fix bounds check in process_rx() (Amit Sunil Dhamne)
  - usb: Flush altsetting 0 endpoints before reinitializating them after reset. (Mathias Nyman)
  - usb: cdnsp: Fix issue with detecting USB 3.2 speed (Pawel Laszczak)
  - usb: cdnsp: Fix issue with detecting command completion event (Pawel Laszczak)
  - VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify (Ma Wupeng) [Orabug: 38152868] {CVE-2025-38102}
  - drm/amd/display: Do not add '-mhard-float' to dcn2{1,0}_resource.o for clang (Nathan Chancellor)
  - kbuild: Add KBUILD_CPPFLAGS to as-option invocation (Nathan Chancellor)
  - kbuild: add $(CLANG_FLAGS) to KBUILD_CPPFLAGS (Masahiro Yamada)
  - kbuild: Add CLANG_FLAGS to as-instr (Nathan Chancellor)
  - mips: Include KBUILD_CPPFLAGS in CHECKFLAGS invocation (Nathan Chancellor)
  - drm/amd/display: Do not add '-mhard-float' to dml_ccflags for clang (Nathan Chancellor)
  - kbuild: Update assembler calls to use proper flags and language target (Nick Desaulniers)
  - MIPS: Prefer cc-option for additions to cflags (Nathan Chancellor)
  - MIPS: Move '-Wa,-msoft-float' check from as-option to cc-option (Nathan Chancellor)
  - x86/boot/compressed: prefer cc-option for CFLAGS additions (Nick Desaulniers)
  - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [Orabug: 38223086] {CVE-2025-38352}
  - ALSA: usb-audio: Add implicit feedback quirk for RODE AI-1 (David Heimann)
  - perf: Ensure bpf_perf_link path is properly serialized (Peter Zijlstra)
  - nvmet-fcloop: access fcpreq only when holding reqlock (Daniel Wagner)
  - fs/filesystems: Fix potential unsigned integer underflow in fs_name() (Zijun Hu)
  - net_sched: ets: fix a race in ets_qdisc_change() (Eric Dumazet) [Orabug: 38152893] {CVE-2025-38107}
  - sch_ets: make est_qlen_notify() idempotent (Cong Wang)
  - net_sched: tbf: fix a race in tbf_change() (Eric Dumazet)
  - net_sched: red: fix a race in __red_change() (Eric Dumazet) [Orabug: 38152898] {CVE-2025-38108}
  - net_sched: prio: fix a race in prio_tune() (Eric Dumazet) [Orabug: 38105333] {CVE-2025-38083}
  - net/mlx5: Fix return value when searching for existing flow group (Patrisious Haddad)
  - net/mlx5: Ensure fw pages are always allocated on same NUMA (Moshe Shemesh)
  - net/mdiobus: Fix potential out-of-bounds read/write access (Jakub Raczynski) [Orabug: 38152911] {CVE-2025-38111}
  - net: mdio: C22 is now optional, EOPNOTSUPP if not provided (Andrew Lunn)
  - macsec: MACsec SCI assignment for ES = 0 (Carlos Fernandez)
  - net: Fix TOCTOU issue in sk_is_readable() (Michal Luczaj) [Orabug: 38152915] {CVE-2025-38112}
  - i40e: retry VFLR handling if there is ongoing VF reset (Robert Malz)
  - i40e: return false from i40e_reset_vf if reset is in progress (Robert Malz)
  - drm/meson: fix more rounding issues with 59.94Hz modes (Martin Blumenstingl)
  - drm/meson: use vclk_freq instead of pixel_freq in debug print (Martin Blumenstingl)
  - drm/meson: fix debug log statement when setting the HDMI clocks (Martin Blumenstingl)
  - drm/meson: use unsigned long long / Hz for frequency types (Martin Blumenstingl)
  - powerpc/vas: Return -EINVAL if the offset is non-zero in mmap() (Haren Myneni)
  - powerpc/powernv/memtrace: Fix out of bounds issue in memtrace mmap (Ritesh Harjani) [Orabug: 38137444] {CVE-2025-38088}
  - net_sched: sch_sfq: fix a potential crash on gso_skb handling (Eric Dumazet) [Orabug: 38152922] {CVE-2025-38115}
  - scsi: iscsi: Fix incorrect error path labels for flashnode operations (Alok Tiwari)
  - ath10k: snoc: fix unbalanced IRQ enable in crash recovery (Caleb Connolly)
  - ptp: remove ptp->n_vclocks check logic in ptp_vclock_in_use() (Jeongjun Park) [Orabug: 38180545] {CVE-2025-38305}
  - scsi: core: ufs: Fix a hang in the error handler (Sanjeev Yadav) [Orabug: 38152945] {CVE-2025-38119}
  - serial: sh-sci: Clean sci_ports[0] after at earlycon exit (Claudiu Beznea)
  - serial: sh-sci: Move runtime PM enable to sci_probe_single() (Claudiu Beznea)
  - serial: sh-sci: Check if TX data was written to device in .tx_empty() (Claudiu Beznea)
  - arm64: dts: ti: k3-am65-main: Add missing taps to sdhci0 (Judith Mendez)
  - arm64: dts: ti: k3-am65-main: Fix sdhci node properties (Judith Mendez)
  - arm64: dts: ti: k3-am65-main: Drop deprecated ti,otap-del-sel property (Nishanth Menon)
  - Input: synaptics-rmi - fix crash with unsupported versions of F34 (Dmitry Torokhov)
  - Input: synaptics-rmi4 - convert to use sysfs_emit() APIs (Zhang Songyi)
  - pmdomain: core: Fix error checking in genpd_dev_pm_attach_by_id() (Dan Carpenter)
  - do_change_type(): refuse to operate on unmounted/not ours mounts (Al Viro) [Orabug: 38256449] {CVE-2025-38498}
  - fix propagation graph breakage by MOVE_MOUNT_SET_GROUP move_mount(2) (Al Viro)
  - seg6: Fix validation of nexthop addresses (Ido Schimmel) [Orabug: 38180555] {CVE-2025-38310}
  - wireguard: device: enable threaded NAPI (Mirco Barone)
  - netfilter: nf_set_pipapo_avx2: fix initial map fill (Florian Westphal) [Orabug: 38152957] {CVE-2025-38120}
  - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Alok Tiwari) [Orabug: 38152965] {CVE-2025-38122}
  - vmxnet3: correctly report gso type for UDP tunnels (Ronak Doshi)
  - net: dsa: tag_brcm: legacy: fix pskb_may_pull length (Álvaro Fernández Rojas)
  - ice: create new Tx scheduler nodes for new queues only (Michal Kubiak)
  - Bluetooth: L2CAP: Fix not responding with L2CAP_CR_LE_ENCRYPTION (Luiz Augusto von Dentz)
  - spi: bcm63xx-hsspi: fix shared reset (Álvaro Fernández Rojas)
  - spi: bcm63xx-spi: fix shared reset (Álvaro Fernández Rojas)
  - net/mlx4_en: Prevent potential integer overflow calculating Hz (Dan Carpenter)
  - driver: net: ethernet: mtk_star_emac: fix suspend/resume issue (Yanqing Wang)
  - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Alok Tiwari)
  - net: stmmac: platform: guarantee uniqueness of bus_id (Quentin Schulz)
  - vt: remove VT_RESIZE and VT_RESIZEX from vt_compat_ioctl() (Nicolas Pitre)
  - MIPS: Loongson64: Add missing '#interrupt-cells' for loongson64c_ls7a (Yuli Wang)
  - iio: adc: ad7124: Fix 3dB filter frequency reading (Uwe Kleine-König)
  - serial: Fix potential null-ptr-deref in mlb_usio_probe() (Henry Martin) [Orabug: 38153011] {CVE-2025-38135}
  - usb: renesas_usbhs: Reorder clock handling and power management in probe (Lad Prabhakar) [Orabug: 38153016] {CVE-2025-38136}
  - PCI/DPC: Initialize aer_err_info before using it (Bjorn Helgaas)
  - dmaengine: ti: Add NULL check in udma_probe() (Henry Martin) [Orabug: 38153029] {CVE-2025-38138}
  - PCI: cadence: Fix runtime atomic count underflow (Hans Zhang)
  - rtc: sh: assign correct interrupts with DT (Wolfram Sang)
  - perf record: Fix incorrect --user-regs comments (Dapeng Mi)
  - perf tests switch-tracking: Fix timestamp comparison (Leo Yan)
  - mfd: stmpe-spi: Correct the name used in MODULE_DEVICE_TABLE (Alexey Gladkov)
  - mfd: exynos-lpass: Avoid calling exynos_lpass_disable() twice in exynos_lpass_remove() (Christophe Jaillet)
  - rpmsg: qcom_smd: Fix uninitialized return variable in __qcom_smd_send() (Dan Carpenter)
  - remoteproc: qcom_wcnss_iris: Add missing put_device() on error in probe (Dan Carpenter)
  - perf scripts python: exported-sql-viewer.py: Fix pattern matching with Python 3 (Adrian Hunter)
  - backlight: pm8941: Add NULL check in wled_configure() (Henry Martin) [Orabug: 38153050] {CVE-2025-38143}
  - perf ui browser hists: Set actions->thread before calling do_zoom_thread() (Arnaldo Carvalho de Melo)
  - perf build: Warn when libdebuginfod devel files are not available (Arnaldo Carvalho de Melo)
  - fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod() (Sergey Shtylyov) [Orabug: 38180565] {CVE-2025-38312}
  - soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop() (Henry Martin) [Orabug: 38153059] {CVE-2025-38145}
  - soc: aspeed: lpc: Fix impossible judgment condition (Su Hui)
  - arm64: dts: rockchip: disable unrouted USB controllers and PHY on RK3399 Puma with Haikou (Quentin Schulz)
  - ARM: dts: qcom: apq8064 merge hw splinlock into corresponding syscon device (Dmitry Baryshkov)
  - bus: fsl-mc: fix double-free on mc_dev (Ioana Ciornei) [Orabug: 38180572] {CVE-2025-38313}
  - nilfs2: do not propagate ENOENT error from nilfs_btree_propagate() (Ryusuke Konishi)
  - nilfs2: add pointer check for nilfs_direct_propagate() (Xu Wang)
  - ocfs2: fix possible memory leak in ocfs2_finish_quota_recovery (Murad Masimov)
  - Squashfs: check return result of sb_min_blocksize (Phillip Lougher) [Orabug: 38253984] {CVE-2025-38415}
  - arm64: dts: imx8mn-beacon: Fix RTC capacitive load (Adam Ford)
  - arm64: dts: imx8mm-beacon: Fix RTC capacitive load (Adam Ford)
  - ARM: dts: at91: at91sam9263: fix NAND chip selects (Wolfram Sang)
  - ARM: dts: at91: usb_a9263: fix GPIO for Dataflash chip select (Wolfram Sang)
  - f2fs: fix to correct check conditions in f2fs_cross_rename (Zhiguo Niu)
  - f2fs: use d_inode(dentry) cleanup dentry->d_inode (Zhiguo Niu)
  - net: phy: mscc: Stop clearing the the UDPv4 checksum for L2 frames (Horatiu Vultur)
  - net: openvswitch: Fix the dead loop of MPLS parse (Faicker Mo) [Orabug: 38153064] {CVE-2025-38146}
  - calipso: Don't call calipso functions for AF_INET sk. (Kuniyuki Iwashima) [Orabug: 38153069] {CVE-2025-38147}
  - net: lan743x: rename lan743x_reset_phy to lan743x_hw_reset_phy (Thangaraj Samynathan)
  - bpf: Avoid __bpf_prog_ret0_warn when jit fails (Kafai Wan) [Orabug: 38180470] {CVE-2025-38280}
  - net: usb: aqc111: fix error handling of usbnet read calls (Nikita Zhandarovich) [Orabug: 38153088] {CVE-2025-38153}
  - netfilter: nft_tunnel: fix geneve_opt dump (Fernando Fernandez Mancera)
  - bpf, sockmap: Avoid using sk_socket after free when sending (Jiayuan Chen) [Orabug: 38153094] {CVE-2025-38154}
  - vfio/type1: Fix error unwind in migration dirty bitmap allocation (Li Rongqing)
  - netfilter: nf_tables: nft_fib_ipv6: fix VRF ipv4/ipv6 result discrepancy (Florian Westphal)
  - wifi: ath9k_htc: Abort software beacon handling if disabled (Toke Høiland-Jørgensen) [Orabug: 38153109] {CVE-2025-38157}
  - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (Alexey Kodanev) [Orabug: 38153121] {CVE-2025-38159}
  - s390/bpf: Store backchain even for leaf progs (Ilya Leoshkevich)
  - clk: qcom: gcc-msm8939: Fix mclk0 & mclk1 for 24 MHz (Vincent Knecht)
  - bpf: Fix WARN() in get_bpf_raw_tp_regs (Tao Chen) [Orabug: 38180488] {CVE-2025-38285}
  - pinctrl: at91: Fix possible out-of-boundary access (Andy Shevchenko) [Orabug: 38180494] {CVE-2025-38286}
  - libbpf: Use proper errno value in nlattr (Anton Protopopov)
  - ktls, sockmap: Fix missing uncharge operation (Jiayuan Chen)
  - clk: bcm: rpi: Add NULL check in raspberrypi_clk_register() (Henry Martin) [Orabug: 38153131] {CVE-2025-38160}
  - clk: qcom: gcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
  - bpf: Fix uninitialized values in BPF_{CORE,PROBE}_READ (Anton Protopopov)
  - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Patrisious Haddad) [Orabug: 38153138] {CVE-2025-38161}
  - netfilter: nft_quota: match correctly when the quota just depleted (Zhongqiu Duan)
  - netfilter: bridge: Move specific fragmented packet to slow_path instead of dropping it (Huajian Yang)
  - libbpf: Use proper errno value in linker (Anton Protopopov)
  - f2fs: fix to detect gcing page in f2fs_is_cp_guaranteed() (Chao Yu)
  - f2fs: clean up w/ fscrypt_is_bounce_page() (Chao Yu)
  - iommu: Protect against overflow in iommu_pgsize() (Jason Gunthorpe)
  - RDMA/hns: Include hnae3.h in hns_roce_hw_v2.h (Junxian Huang)
  - wifi: rtw88: do not ignore hardware read error during DPK (Dmitry Antipov)
  - libbpf: Fix buffer overflow in bpf_object__init_prog (Viktor Malik)
  - net: ncsi: Fix GCPS 64-bit member variables (Hari Kalavakunta)
  - f2fs: fix to do sanity check on sbi->total_valid_block_count (Chao Yu) [Orabug: 38153149] {CVE-2025-38163}
  - bpf, sockmap: fix duplicated data transmission (Jiayuan Chen)
  - IB/cm: use rwlock for MAD agent lock (Jacob Moroni)
  - wifi: ath11k: fix node corruption in ar->arvifs list (Stone Zhang) [Orabug: 38180515] {CVE-2025-38293}
  - firmware: SDEI: Allow sdei initialization without ACPI_APEI_GHES (Huang Yiwei)
  - drm/tegra: rgb: Fix the unbound reference count (Biju Das)
  - drm/vkms: Adjust vkms_state->active_planes allocation type (Kees Cook)
  - drm: rcar-du: Fix memory leak in rcar_du_vsps_init() (Biju Das)
  - selftests/seccomp: fix syscall_restart test for arm compat (Neill Kapron)
  - firmware: psci: Fix refcount leak in psci_dt_init (Miaoqian Lin)
  - m68k: mac: Fix macintosh_config for Mac II (Finn Thain)
  - fs/ntfs3: handle hdr_first_de() return value (Andrey Vatoropin) [Orabug: 38153172] {CVE-2025-38167}
  - media: rkvdec: Fix frame size enumeration (Jonas Karlman)
  - drm/amd/pp: Fix potential NULL pointer dereference in atomctrl_initialize_mc_reg_table (Charles Han) [Orabug: 38180589] {CVE-2025-38319}
  - spi: sh-msiof: Fix maximum DMA transfer size (Geert Uytterhoeven)
  - ACPI: OSI: Stop advertising support for "3.0 _SCP Extensions" (Armin Wolf)
  - x86/mtrr: Check if fixed-range MTRRs exist in mtrr_save_fixed_ranges() (Jiaqing Zhao)
  - PM: wakeup: Delete space in the end of string shown by pm_show_wakelocks() (Zijun Hu)
  - power: reset: at91-reset: Optimize at91_reset() (Alexander Shiyan)
  - EDAC/skx_common: Fix general protection fault (Qiuxu Zhuo) [Orabug: 38180524] {CVE-2025-38298}
  - crypto: sun8i-ce - move fallback ahash_request to the end of the struct (Ovidiu Panait)
  - crypto: xts - Only add ecb if it is not already there (Herbert Xu)
  - crypto: lrw - Only add ecb if it is not already there (Herbert Xu)
  - crypto: marvell/cesa - Avoid empty transfer descriptor (Herbert Xu)
  - crypto: marvell/cesa - Handle zero-length skcipher requests (Herbert Xu) [Orabug: 38153188] {CVE-2025-38173}
  - x86/cpu: Sanitize CPUID(0x80000000) output (Ahmed S. Darwish)
  - crypto: sun8i-ss - do not use sg_dma_len before calling DMA functions (Corentin Labbe)
  - perf/core: Fix broken throttling when max_samples_per_tick=1 (Qing Wang)
  - gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher)
  - thunderbolt: Do not double dequeue a configuration request (Sergey Senozhatsky) [Orabug: 38158383] {CVE-2025-38174}
  - usb: usbtmc: Fix timeout value in get_stb (Dave Penkler)
  - USB: serial: pl2303: add new chip PL2303GC-Q20 and PL2303GT-2AB (Charles Yeh)
  - usb: storage: Ignore UAS driver for SanDisk 3.2 Gen2 storage device (Hongyu Xie)
  - usb: quirks: Add NO_LPM quirk for SanDisk Extreme 55AE (Jiayi Li)
  - rtc: Fix offset calculation for .start_secs < 0 (Alexandre Mergnat)
  - rtc: Make rtc_time64_to_tm() support dates before 1970 (Alexandre Mergnat)
  - pinctrl: armada-37xx: set GPIO output value before setting direction (Gabor Juhos)
  - pinctrl: armada-37xx: use correct OUTPUT_VAL register for GPIOs > 31 (Gabor Juhos)


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-312.187.3.el9uek]
changelog:
  - TIOCSTI: Document CAP_SYS_ADMIN behaviour in Kconfig (Günther Noack) [Orabug: 38255504]
  - TIOCSTI: always enable for CAP_SYS_ADMIN (Samuel Thibault) [Orabug: 38255504]
  - tty: Fix typo in LEGACY_TIOCSTI Kconfig description (Hanno Böck) [Orabug: 38255504]
  - tty: Move TIOCSTI toggle variable before kerndoc (Kees Cook) [Orabug: 38255504]
  - tty: Allow TIOCSTI to be disabled (Kees Cook) [Orabug: 38255504]
  - tty: Move sysctl setup into "core" tty logic (Kees Cook) [Orabug: 38255504]
  - tty: reformat kernel-doc in tty_io.c (Jiri Slaby) [Orabug: 38255504]
  - tty: reformat kernel-doc in tty_ldisc.c (Jiri Slaby) [Orabug: 38255504]
  - net/mlx5: E-Switch, Fix switching to switchdev mode in MPV (Patrisious Haddad) [Orabug: 38236297]
  - net/mlx5: E-Switch, Fix switching to switchdev mode with IB device disabled (Patrisious Haddad) [Orabug: 38236297]
  - net/mlx5: E-switch, refactor eswitch mode change (Patrisious Haddad) [Orabug: 38236297]
  - IB/mlx5: Support querying eswitch functions from DEVX (Bodong Wang) [Orabug: 38236297]
  - RDMA/mlx5: Fix HW counters query for non-representor devices (Patrisious Haddad) [Orabug: 38161800]
  - RDMA/mlx5: Fix CC counters query for MPV (Patrisious Haddad) [Orabug: 38161800]
  - Revert "RDMA/mlx5: Fix CC counters query for MPV" (Qing Huang) [Orabug: 38161800]
  - RDMA/mlx5: Fix vport loopback for MPV device (Patrisious Haddad) [Orabug: 38118599]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-312.187.4.el9uek]
changelog:
  - rds: Fix NULL ptr deref in xas_start (Håkon Bugge)  [Orabug: 38166374]
  - KVM: x86: use array_index_nospec with indices that come from guest (Thijs Raymakers)  [Orabug: 38319943]
  - hugetlb: arm64: add mte support (Dave Kleikamp)  [Orabug: 38177800]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-312.187.5.el9uek]
changelog:
  - Revert "mm: hugetlb: independent PMD page table shared count" (Harshit Mogalapalli)  [Orabug: 38327655]


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-0.20.20.1.el9uek]
changelog:
  - rds: ib: Fix NULL ptr deref in rds_ib_cq_follow_affinity (Håkon Bugge)  [Orabug: 37702023]
  - scsi: mpi3mr: Task Abort EH Support (Chandrakanth Patil)  [Orabug: 37778472]
  - scsi: mpi3mr: Update driver version to 8.13.0.5.50 (Ranjan Kumar)  [Orabug: 37778472]
  - scsi: mpi3mr: Check admin reply queue from Watchdog (Ranjan Kumar)  [Orabug: 37778472]
  - scsi: mpi3mr: Update timestamp only for supervisor IOCs (Ranjan Kumar)  [Orabug: 37778472]
  - scsi: mpi3mr: Update MPI Headers to revision 35 (Ranjan Kumar)  [Orabug: 37778472]
  - scsi: mpi3mr: Fix locking in an error path (Bart Van Assche)  [Orabug: 37778472]
  - scsi: mpi3mr: Fix spelling mistake "skiping" -> "skipping" (Colin Ian King)  [Orabug: 37778472]
  - scsi: mpi3mr: Update driver version to 8.12.1.0.50 (Ranjan Kumar)  [Orabug: 37778472]
  - scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue (Ranjan Kumar)  [Orabug: 37778472]
  - scsi: mpi3mr: Support for Segmented Hardware Trace buffer (Ranjan Kumar)  [Orabug: 37778472]
  - scsi: mpi3mr: Avoid reply queue full condition (Ranjan Kumar)  [Orabug: 37778472]
  - scsi: mpi3mr: Update driver version to 8.12.0.3.50 (Ranjan Kumar)  [Orabug: 37778472]
  - uek-rpm: Enable Intel In Field Scan as a module in UEK8 (Harshit Mogalapalli)  [Orabug: 37778856]


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-1.23.1.el9uek]
changelog:
  - LTS version: v6.12.23 (Jack Vogel)
  - platform/x86/amd/pmf: fix cleanup in amd_pmf_init_smart_pc() (Dan Carpenter)
  - tracing: Do not use PERF enums when perf is not defined (Steven Rostedt)
  - ARM: 9443/1: Require linker to support KEEP within OVERLAY for DCE (Nathan Chancellor)
  - NFSD: Skip sending CB_RECALL_ANY when the backchannel isn't up (Chuck Lever)
  - NFSD: Never return NFS4ERR_FILE_OPEN when removing a directory (Chuck Lever)
  - NFSD: nfsd_unlink() clobbers non-zero status returned from fh_fill_pre_attrs() (Chuck Lever)
  - nfsd: fix management of listener transports (Olga Kornievskaia)
  - nfsd: put dl_stid if fail to queue dl_recall (Li Lingfeng)
  - nfsd: allow SC_STATUS_FREEABLE when searching via nfs4_lookup_stateid() (Jeff Layton)
  - media: streamzap: fix race between device disconnection and urb callback (Murad Masimov)
  - media: vimc: skip .s_stream() for stopped entities (Nikita Zhandarovich)
  - exec: fix the racy usage of fs_struct->in_exec (Oleg Nesterov)
  - mm: zswap: fix crypto_free_acomp() deadlock in zswap_cpu_comp_dead() (Yosry Ahmed)
  - jfs: add index corruption check to DT_GETPAGE() (Roman Smirnov)
  - jfs: fix slab-out-of-bounds read in ea_get() (Qasim Ijaz)
  - ext4: fix OOB read when checking dotdot dir (Acs, Jakub)
  - ext4: don't over-report free space or inodes in statvfs (Theodore Ts'o)
  - wifi: mt76: mt7921: fix kernel panic due to null pointer dereference (Ming Yen Hsieh)
  - arm64: Don't call NULL in do_compat_alignment_fixup() (Angelos Oikonomopoulos)
  - mm/gup: reject FOLL_SPLIT_PMD with hugetlb VMAs (David Hildenbrand)
  - tracing/osnoise: Fix possible recursive locking for cpus_read_lock() (Ran Xiaokai)
  - tracing: Fix synth event printk format for str fields (Douglas Raillard)
  - tracing: Ensure module defining synth event cannot be unloaded while tracing (Douglas Raillard)
  - tracing: Fix use-after-free in print_graph_function_flags during tracer switching (Tengda Wu)
  - exfat: fix potential wrong error return from get_block (Sungjong Seo)
  - exfat: fix random stack corruption after get_block (Sungjong Seo)
  - ksmbd: fix null pointer dereference in alloc_preauth_hash() (Namjae Jeon)
  - ksmbd: validate zero num_subauth before sub_auth is accessed (Norbert Szetei)
  - ksmbd: fix overflow in dacloffset bounds check (Norbert Szetei)
  - ksmbd: fix session use-after-free in multichannel connection (Namjae Jeon)
  - ksmbd: fix use-after-free in ksmbd_sessions_deregister() (Namjae Jeon)
  - ksmbd: add bounds check for create lease context (Norbert Szetei)
  - ksmbd: add bounds check for durable handle context (Namjae Jeon)
  - KVM: SVM: Don't change target vCPU state on AP Creation VMGEXIT error (Sean Christopherson)
  - mmc: sdhci-omap: Disable MMC_CAP_AGGRESSIVE_PM for eMMC/SD (Ulf Hansson)
  - mmc: sdhci-pxav3: set NEED_RSP_BUSY capability (Karel Balej)
  - mmc: omap: Fix memory leak in mmc_omap_new_slot (Miaoqian Lin)
  - Remove unnecessary firmware version check for gc v9_4_2 (Candice Li)
  - media: omap3isp: Handle ARM dma_iommu_mapping (Robin Murphy)
  - ARM: 9444/1: add KEEP() keyword to ARM_VECTORS (Christian Eggers)
  - ACPI: resource: Skip IRQ override on ASUS Vivobook 14 X1404VAP (Paul Menzel)
  - acpi: nfit: fix narrowing conversion in acpi_nfit_ctl (Murad Masimov)
  - wifi: mt76: mt7925: remove unused acpi function for clc (Ming Yen Hsieh)
  - x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (Jann Horn)
  - x86/tsc: Always save/restore TSC sched_clock() on suspend/resume (Guilherme G. Piccoli)
  - x86/Kconfig: Add cmpxchg8b support back to Geode CPUs (Arnd Bergmann)
  - uprobes/x86: Harden uretprobe syscall trampoline check (Jiri Olsa)
  - perf/x86/intel: Avoid disable PMU if !cpuc->enabled in sample read (Kan Liang)
  - perf/x86/intel: Apply static call for drain_pebs (Peter Zijlstra (Intel))
  - ntb_perf: Delete duplicate dmaengine_unmap_put() call in perf_copy_chunk() (Markus Elfring)
  - platform/x86: ISST: Correct command storage data length (Srinivas Pandruvada)
  - platform/x86: thinkpad_acpi: disable ACPI fan access for T495* and E560 (Eduard Christian Dumitrescu)
  - ACPI: x86: Extend Lenovo Yoga Tab 3 quirk with skip GPIO event-handlers (Hans de Goede)
  - x86/tdx: Fix arch_safe_halt() execution for TDX VMs (Vishal Annapurve)
  - x86/mce: use is_copy_from_user() to determine copy-from-user context (Shuai Xue)
  - x86/microcode/AMD: Fix __apply_microcode_amd()'s return value (Boris Ostrovsky)
  - KVM: x86: block KVM_CAP_SYNC_REGS if guest state is protected (Paolo Bonzini)
  - x86/hyperv: Fix check of return value from snp_set_vmsa() (Tianyu Lan)
  - LoongArch: BPF: Use move_addr() for BPF_PSEUDO_FUNC (Hengqi Chen)
  - LoongArch: BPF: Don't override subprog's return value (Hengqi Chen)
  - LoongArch: BPF: Fix off-by-one error in build_prologue() (Hengqi Chen)
  - LoongArch: Increase MAX_IO_PICS up to 8 (Huacai Chen)
  - LoongArch: Increase ARCH_DMA_MINALIGN up to 16 (Huacai Chen)
  - rust: Fix enabling Rust and building with GCC for LoongArch (WANG Rui)
  - usbnet:fix NPE during rx_complete (Ying Lu)
  - wifi: mac80211: Fix sparse warning for monitor_sdata (Alexander Wetzel)
  - tty: serial: lpuart: only disable CTS instead of overwriting the whole UARTMODIR register (Sherry Sun)
  - tty: serial: fsl_lpuart: Fix unused variable 'sport' build warning (Sherry Sun)
  - tty: serial: fsl_lpuart: use port struct directly to simply code (Sherry Sun)
  - tty: serial: fsl_lpuart: Use u32 and u8 for register variables (Sherry Sun)
  - cgroup/rstat: Fix forceidle time in cpu.stat (Abel Wu)
  - cgroup/rstat: Tracking cgroup-level niced CPU time (Joshua Hahn)
  - tracing: Correct the refcount if the hist/hist_debug file fails to open (Tengda Wu)
  - tracing/hist: Support POLLPRI event for poll on histogram (Masami Hiramatsu (Google))
  - tracing/hist: Add poll(POLLIN) support on hist file (Masami Hiramatsu (Google))
  - tracing: Switch trace_events_hist.c code over to use guard() (Steven Rostedt)
  - tools/power turbostat: report CoreThr per measurement interval (Len Brown)
  - perf/core: Fix child_total_time_enabled accounting bug at task exit (Yeoreum Yun)
  - drm/amdgpu/gfx12: fix num_mec (Alex Deucher)
  - drm/amdgpu/gfx11: fix num_mec (Alex Deucher)
  - kbuild: deb-pkg: don't set KBUILD_BUILD_VERSION unconditionally (Alexandru Gagniuc)
  - net: ibmveth: make veth_pool_store stop hanging (Dave Marquardt)
  - arcnet: Add NULL check in com20020pci_probe() (Henry Martin)
  - ipv6: Do not consider link down nexthops in path selection (Ido Schimmel)
  - ipv6: Start path selection from the first nexthop (Ido Schimmel)
  - net: fix geneve_opt length integer overflow (Lin Ma)
  - net: dsa: mv88e6xxx: propperly shutdown PPU re-enable timer on destroy (David Oberhollenzer)
  - ipv6: fix omitted netlink attributes when using RTEXT_FILTER_SKIP_STATS (Fernando Fernandez Mancera)
  - netfilter: nft_tunnel: fix geneve_opt type confusion addition (Lin Ma)
  - net: decrease cached dst counters in dst_release (Antoine Tenart)
  - tunnels: Accept PACKET_HOST in skb_tunnel_check_pmtu(). (Guillaume Nault)
  - vsock: avoid timeout during connect() if the socket is closing (Stefano Garzarella)
  - udp: Fix memory accounting leak. (Kuniyuki Iwashima)
  - udp: Fix multiple wraparounds of sk->sk_rmem_alloc. (Kuniyuki Iwashima)
  - net: mvpp2: Prevent parser TCAM memory corruption (Tobias Waldekranz)
  - sctp: add mutual exclusion in proc_sctp_do_udp_port() (Eric Dumazet)
  - net_sched: skbprio: Remove overly strict queue assertions (Cong Wang)
  - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (Debin Zhu)
  - netfilter: nf_tables: don't unregister hook when table is dormant (Florian Westphal)
  - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Pablo Neira Ayuso)
  - idpf: fix adapter NULL pointer dereference on reboot (Emil Tantilov)
  - e1000e: change k1 configuration on MTP and later platforms (Vitaly Lifshits)
  - spi: bcm2835: Restore native CS probing when pinctrl-bcm2835 is absent (Florian Fainelli)
  - ALSA: hda/realtek: Fix built-in mic on another ASUS VivoBook model (Takashi Iwai)
  - spi: bcm2835: Do not call gpiod_put() on invalid descriptor (Florian Fainelli)
  - ASoC: imx-card: Add NULL check in imx_card_probe() (Henry Martin)
  - nvme/ioctl: don't warn on vectorized uring_cmd with fixed buffer (Caleb Sander Mateos)
  - riscv/purgatory: 4B align purgatory_start (Björn Töpel)
  - riscv/kexec_file: Handle R_RISCV_64 in purgatory relocator (Yao Zi)
  - riscv: Fix hugetlb retrieval of number of ptes in case of !present pte (Alexandre Ghiti)
  - spi: cadence: Fix out-of-bounds array access in cdns_mrvl_xspi_setup_clock() (Josh Poimboeuf)
  - ASoC: codecs: rt5665: Fix some error handling paths in rt5665_probe() (Christophe JAILLET)
  - s390/entry: Fix setting _CIF_MCCK_GUEST with lowcore relocation (Sven Schnelle)
  - ublk: make sure ubq->canceling is set when queue is frozen (Ming Lei)
  - x86/uaccess: Improve performance by aligning writes to 8 bytes in copy_user_generic(), on non-FSRM/ERMS CPUs (Herton R. Krzesinski)
  - RISC-V: errata: Use medany for relocatable builds (Palmer Dabbelt)
  - ALSA: hda/realtek: Fix built-in mic breakage on ASUS VivoBook X515JA (Takashi Iwai)
  - firmware: cs_dsp: Ensure cs_dsp_load[_coeff]() returns 0 on success (Richard Fitzgerald)
  - ntb: intel: Fix using link status DB's (Nikita Shubin)
  - ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans (Yajun Deng)
  - riscv: ftrace: Add parentheses in macro definitions of make_call_t0 and make_call_ra (Juhan Jin)
  - fs/9p: fix NULL pointer dereference on mkdir (Christian Schoenebeck)
  - spufs: fix a leak in spufs_create_context() (Al Viro)
  - spufs: fix gang directory lifetimes (Al Viro)
  - spufs: fix a leak on spufs_new_file() failure (Al Viro)
  - netfs: Fix netfs_unbuffered_read() to return ssize_t rather than int (David Howells)
  - hwmon: (nct6775-core) Fix out of bounds access for NCT679{8,9} (Tasos Sahanidis)
  - memory: omap-gpmc: drop no compatible check (Roger Quadros)
  - can: statistics: use atomic access in hot path (Oliver Hartkopp)
  - ALSA: hda/realtek: Add mute LED quirk for HP Pavilion x360 14-dy1xxx (Navon John Lukose)
  - selftests: netfilter: skip br_netfilter queue tests if kernel is tainted (Florian Westphal)
  - net: devmem: do not WARN conditionally after netdev_rx_queue_restart() (Taehee Yoo)
  - drm/amd: Keep display off while going into S4 (Mario Limonciello)
  - nvme-pci: fix stuck reset on concurrent DPC and HP (Keith Busch)
  - x86/sgx: Warn explicitly if X86_FEATURE_SGX_LC is not enabled (Vladis Dronov)
  - x86/hyperv: Fix output argument to hypercall that changes page visibility (Michael Kelley)
  - locking/semaphore: Use wake_q to wake up processes outside lock critical section (Waiman Long)
  - wifi: mac80211: fix SA Query processing in MLO (Johannes Berg)
  - wifi: mac80211: flush the station before moving it to UN-AUTHORIZED state (Emmanuel Grumbach)
  - ASoC: rt1320: set wake_capable = 0 explicitly (Bard Liao)
  - ASoC: codecs: wsa884x: report temps to hwmon in millidegree of Celsius (Alexey Klimov)
  - x86/hyperv/vtl: Stop kernel from probing VTL0 low memory (Naman Jain)
  - sched/deadline: Use online cpus for validating runtime (Shrikanth Hegde)
  - ALSA: hda/realtek: Add support for ASUS Zenbook UM3406KA Laptops using CS35L41 HDA (Stefan Binding)
  - ALSA: hda/realtek: Add support for ASUS B5405 and B5605 Laptops using CS35L41 HDA (Stefan Binding)
  - ALSA: hda/realtek: Add support for ASUS B3405 and B3605 Laptops using CS35L41 HDA (Stefan Binding)
  - ALSA: hda/realtek: Add support for various ASUS Laptops using CS35L41 HDA (Stefan Binding)
  - ALSA: hda/realtek: Add support for ASUS ROG Strix G614 Laptops using CS35L41 HDA (Stefan Binding)
  - ALSA: hda/realtek: Add support for ASUS ROG Strix GA603 Laptops using CS35L41 HDA (Stefan Binding)
  - ALSA: hda/realtek: Add support for ASUS ROG Strix G814 Laptop using CS35L41 HDA (Stefan Binding)
  - exfat: add a check for invalid data size (Yuezhang Mo)
  - platform/x86/amd/pmf: Update PMF Driver for Compatibility with new PMF-TA (Shyam Sundar S K)
  - platform/x86/amd/pmf: Propagate PMF-TA return codes (Shyam Sundar S K)
  - HID: i2c-hid: improve i2c_hid_get_report error message (Wentao Guan)
  - net: dsa: rtl8366rb: don't prompt users for LED control (Jakub Kicinski)
  - platform/x86/intel/vsec: Add Diamond Rapids support (David E. Box)
  - platform/x86: intel-hid: fix volume buttons on Microsoft Surface Go 4 tablet (Dmitry Panchenko)
  - cifs: fix incorrect validation for num_aces field of smb_acl (Namjae Jeon)
  - smb: common: change the data type of num_aces to le16 (Namjae Jeon)
  - perf/core: Fix perf_pmu_register() vs. perf_init_event() (Peter Zijlstra)
  - ALSA: hda: Fix speakers on ASUS EXPERTBOOK P5405CSA 1.0 (Daniel Bárta)
  - ALSA: hda/realtek: Fix Asus Z13 2025 audio (Antheas Kapenekakis)
  - affs: don't write overlarge OFS data block size fields (Simon Tatham)
  - affs: generate OFS sequence numbers starting at 1 (Simon Tatham)
  - wifi: brcmfmac: keep power during suspend if board requires it (Matthias Proske)
  - nvme-pci: skip CMB blocks incompatible with PCI P2P DMA (Icenowy Zheng)
  - nvme-pci: clean up CMBMSC when registering CMB fails (Icenowy Zheng)
  - nvme-tcp: fix possible UAF in nvme_tcp_poll (Sagi Grimberg)
  - wifi: iwlwifi: mvm: use the right version of the rate API (Emmanuel Grumbach)
  - wifi: iwlwifi: fw: allocate chained SG tables for dump (Johannes Berg)
  - wifi: mac80211: remove debugfs dir for virtual monitor (Alexander Wetzel)
  - wifi: mac80211: Cleanup sta TXQs on flush (Alexander Wetzel)
  - nfs: Add missing release on error in nfs_lock_and_join_requests() (Dan Carpenter)
  - objtool/loongarch: Add unwind hints in prepare_frametrace() (Josh Poimboeuf)
  - rcu-tasks: Always inline rcu_irq_work_resched() (Josh Poimboeuf)
  - context_tracking: Always inline ct_{nmi,irq}_{enter,exit}() (Josh Poimboeuf)
  - sched/smt: Always inline sched_smt_active() (Josh Poimboeuf)
  - objtool: Fix verbose disassembly if CROSS_COMPILE isn't set (David Laight)
  - octeontx2-af: Free NIX_AF_INT_VEC_GEN irq (Geetha sowjanya)
  - octeontx2-af: Fix mbox INTR handler when num VFs > 64 (Geetha sowjanya)
  - net: phy: broadcom: Correct BCM5221 PHY model detection (Jim Liu)
  - ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (Giovanni Gherdovich)
  - LoongArch: Rework the arch_kgdb_breakpoint() implementation (Yuli Wang)
  - LoongArch: Fix device node refcount leak in fdt_cpu_clk_init() (Miaoqian Lin)
  - LoongArch: Fix help text of CMDLINE_EXTEND in Kconfig (谢致邦 (XIE Zhibang))
  - objtool: Fix segfault in ignore_unreachable_insn() (Josh Poimboeuf)
  - ring-buffer: Fix bytes_dropped calculation issue (Feng Yang)
  - net/mlx5e: SHAMPO, Make reserved size independent of page size (Lama Kayal)
  - ksmbd: fix r_count dec/increment mismatch (Namjae Jeon)
  - ksmbd: fix multichannel connection failure (Namjae Jeon)
  - ksmbd: use aead_request_free to match aead_request_alloc (Miaoqian Lin)
  - rndis_host: Flag RNDIS modems as WWAN devices (Lubomir Rintel)
  - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Mark Zhang)
  - exfat: fix missing shutdown check (Yuezhang Mo)
  - exfat: fix the infinite loop in exfat_find_last_cluster() (Yuezhang Mo)
  - smb: client: Fix netns refcount imbalance causing leaks and use-after-free (Wang Zhaolong)
  - NFS: Shut down the nfs_client only after all the superblocks (Trond Myklebust)
  - objtool, media: dib8000: Prevent divide-by-zero in dib8000_set_dds() (Josh Poimboeuf)
  - objtool, nvmet: Fix out-of-bounds stack access in nvmet_ctrl_state_show() (Josh Poimboeuf)
  - thermal: core: Remove duplicate struct declaration (xueqin Luo)
  - perf bpf-filter: Fix a parsing error with comma (Namhyung Kim)
  - perf tools: annotate asm_pure_loop.S (Marcus Meissner)
  - fs/procfs: fix the comment above proc_pid_wchan() (Bart Van Assche)
  - perf vendor events arm64 AmpereOneX: Fix frontend_bound calculation (Ilkka Koskinen)
  - tty: n_tty: use uint for space returned by tty_write_room() (Jiri Slaby (SUSE))
  - staging: vchiq_arm: Fix possible NPR of keep-alive thread (Stefan Wahren)
  - staging: vchiq_arm: Register debugfs after cdev (Stefan Wahren)
  - staging: rtl8723bs: select CONFIG_CRYPTO_LIB_AES (谢致邦 (XIE Zhibang))
  - perf: intel-tpebs: Fix incorrect usage of zfree() (James Clark)
  - perf python: Check if there is space to copy all the event (Arnaldo Carvalho de Melo)
  - perf python: Don't keep a raw_data pointer to consumed ring buffer space (Arnaldo Carvalho de Melo)
  - perf python: Decrement the refcount of just created event on failure (Arnaldo Carvalho de Melo)
  - perf python: Fixup description of sample.id event member (Arnaldo Carvalho de Melo)
  - i3c: master: svc: Fix missing the IBI rules (Stanley Chu)
  - um: hostfs: avoid issues on inode number reuse by host (Benjamin Berg)
  - um: remove copy_from_kernel_nofault_allowed (Benjamin Berg)
  - um: Pass the correct Rust target and options with gcc (David Gow)
  - selftests/mm/cow: fix the incorrect error handling (Cyan Yang)
  - fuse: fix dax truncate/punch_hole fault path (Alistair Popple)
  - NFS: fix open_owner_id_maxsz and related fields. (NeilBrown)
  - NFSv4: Avoid unnecessary scans of filesystems for delayed delegations (Trond Myklebust)
  - NFSv4: Avoid unnecessary scans of filesystems for expired delegations (Trond Myklebust)
  - NFSv4: Avoid unnecessary scans of filesystems for returning delegations (Trond Myklebust)
  - NFSv4: Don't trigger uneccessary scans for return-on-close delegations (Trond Myklebust)
  - arch/powerpc: drop GENERIC_PTDUMP from mpc885_ads_defconfig (Anshuman Khandual)
  - ocfs2: validate l_tree_depth to avoid out-of-bounds access (Vasiliy Kovalev)
  - kexec: initialize ELF lowest address to ULONG_MAX (Sourabh Jain)
  - kernel/events/uprobes: handle device-exclusive entries correctly in __replace_page() (David Hildenbrand)
  - perf units: Fix insufficient array space (Arnaldo Carvalho de Melo)
  - perf evlist: Add success path to evlist__create_syswide_maps (Ian Rogers)
  - perf debug: Avoid stack overflow in recursive error message (Ian Rogers)
  - iio: light: Add check for array bounds in veml6075_read_int_time_ms (Karan Sanghavi)
  - iio: adc: ad7768-1: set MOSI idle state to prevent accidental reset (Jonathan Santos)
  - iio: adc: ad7173: Fix comparison of channel configs (Uwe Kleine-König)
  - iio: adc: ad7124: Fix comparison of channel configs (Uwe Kleine-König)
  - iio: adc: ad4130: Fix comparison of channel setups (Uwe Kleine-König)
  - dmaengine: fsl-edma: free irq correctly in remove path (Peng Fan)
  - dmaengine: fsl-edma: cleanup chan after dma_async_device_unregister (Peng Fan)
  - fs/ntfs3: Prevent integer overflow in hdr_first_de() (Dan Carpenter)
  - fs/ntfs3: Fix a couple integer overflows on 32bit systems (Dan Carpenter)
  - usb: xhci: correct debug message page size calculation (Niklas Neronin)
  - perf bench: Fix perf bench syscall loop count (Thomas Richter)
  - perf arm-spe: Fix load-store operation checking (Leo Yan)
  - iio: backend: make sure to NULL terminate stack buffer (Nuno Sá)
  - iio: accel: msa311: Fix failure to release runtime pm if direct mode claim fails. (Jonathan Cameron)
  - iio: accel: mma8452: Ensure error return on failure to matching oversampling ratio (Jonathan Cameron)
  - ucsi_ccg: Don't show failed to get FW build information error (Mario Limonciello)
  - perf build: Fix in-tree build due to symbolic link (Luca Ceresoli)
  - tools/x86: Fix linux/unaligned.h include path in lib/insn.c (Ian Rogers)
  - perf pmu: Don't double count common sysfs and json events (James Clark)
  - coresight-etm4x: add isb() before reading the TRCSTATR (Yuanfang Zhang)
  - vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint (Mike Christie)
  - coresight: catu: Fix number of pages while using 64k pages (Ilkka Koskinen)
  - greybus: gb-beagleplay: Add error handling for gb_greybus_init (Wentao Liang)
  - perf report: Switch data file correctly in TUI (Namhyung Kim)
  - soundwire: slave: fix an OF node reference leak in soundwire slave device (Joe Hattori)
  - isofs: fix KMSAN uninit-value bug in do_isofs_readdir() (Qasim Ijaz)
  - phy: phy-rockchip-samsung-hdptx: Don't use dt aliases to determine phy-id (Heiko Stuebner)
  - fs/ntfs3: Update inode->i_mapping->a_ops on compression state (Konstantin Komarov)
  - w1: fix NULL pointer dereference in probe (Chenyuan Yang)
  - perf: Always feature test reallocarray (James Clark)
  - perf stat: Fix find_stat for mixed legacy/non-legacy events (Ian Rogers)
  - clk: qcom: mmcc-sdm660: fix stuck video_subcore0 clock (Barnabás Czémán)
  - pinctrl: intel: Fix wrong bypass assignment in intel_pinctrl_probe_pwm() (Andy Shevchenko)
  - crypto: hisilicon/sec2 - fix for aead auth key length (Wenkai Lin)
  - RDMA/core: Fix use-after-free when rename device name (Wang Liang)
  - x86/dumpstack: Fix inaccurate unwinding from exception stacks due to misplaced assignment (Jann Horn)
  - leds: Fix LED_OFF brightness race (Remi Pommarel)
  - mfd: sm501: Switch to BIT() to mitigate integer overflows (Nikita Zhandarovich)
  - pinctrl: renesas: rzv2m: Fix missing of_node_put() call (Fabrizio Castro)
  - RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow (Patrisious Haddad)
  - bpf: Fix array bounds error with may_goto (Jiayuan Chen)
  - clk: qcom: gcc-sm8650: Do not turn off USB GDSCs during gdsc_disable() (Neil Armstrong)
  - crypto: nx - Fix uninitialised hv_nxc on error (Herbert Xu)
  - power: supply: max77693: Fix wrong conversion of charge input threshold value (Artur Weber)
  - x86/entry: Fix ORC unwinder for PUSH_REGS with save_ret=1 (Jann Horn)
  - clk: amlogic: g12a: fix mmc A peripheral clock (Jerome Brunet)
  - clk: clk-imx8mp-audiomix: fix dsp/ocram_a clock parents (Laurentiu Mihalcea)
  - crypto: qat - remove access to parity register for QAT GEN4 (Bairavi Alagappan)
  - pinctrl: npcm8xx: Fix incorrect struct npcm8xx_pincfg assignment (Andy Shevchenko)
  - rust: fix signature of rust_fmt_argument (Alice Ryhl)
  - selftests/bpf: Select NUMA_NO_NODE to create map (Saket Kumar Bhaskar)
  - clk: amlogic: gxbb: drop non existing 32k clock parent (Jerome Brunet)
  - clk: amlogic: g12b: fix cluster A parent data (Jerome Brunet)
  - pinctrl: tegra: Set SFIO mode to Mux Register (Prathamesh Shete)
  - IB/mad: Check available slots before posting receive WRs (Maher Sanalla)
  - crypto: api - Fix larval relookup type and mask (Herbert Xu)
  - power: supply: bq27xxx_battery: do not update cached flags prematurely (Sicelo A. Mhlongo)
  - remoteproc: qcom_q6v5_mss: Handle platforms with one power domain (Luca Weiss)
  - RDMA/erdma: Prevent use-after-free in erdma_accept_newconn() (Cheng Xu)
  - RDMA/mlx5: Fix calculation of total invalidated pages (Chiara Meiohas)
  - RDMA/core: Don't expose hw_counters outside of init net namespace (Roman Gushchin)
  - clk: rockchip: rk3328: fix wrong clk_ref_usb3otg parent (Peter Geis)
  - selftests/bpf: Fix freplace_link segfault in tailcalls prog test (Tengda Wu)
  - RDMA/mlx5: Fix MR cache initialization error flow (Michael Guralnik)
  - pinctrl: renesas: rzg2l: Fix missing of_node_put() call (Fabrizio Castro)
  - pinctrl: renesas: rza2: Fix missing of_node_put() call (Fabrizio Castro)
  - lib: 842: Improve error handling in sw842_compress() (Tanya Agarwal)
  - bpf: Use preempt_count() directly in bpf_send_signal_common() (Hou Tao)
  - clk: qcom: gcc-x1e80100: Unregister GCC_GPU_CFG_AHB_CLK/GCC_DISP_XO_CLK (Konrad Dybcio)
  - remoteproc: qcom_q6v5_pas: Use resource with CX PD for MSM8226 (Luca Weiss)
  - crypto: tegra - Set IV to NULL explicitly for AES ECB (Akhil R)
  - RDMA/mana_ib: Ensure variable err is initialized (Kees Bakker)
  - s390: Remove ioremap_wt() and pgprot_writethrough() (Niklas Schnelle)
  - clk: qcom: gcc-msm8953: fix stuck venus0_core0 clock (Vladimir Lypak)
  - crypto: tegra - Fix CMAC intermediate result handling (Akhil R)
  - pinctrl: nuvoton: npcm8xx: Fix error handling in npcm8xx_gpio_fw() (Yue Haibing)
  - clk: samsung: Fix UBSAN panic in samsung_clk_init() (Will McVicker)
  - remoteproc: qcom: pas: add minidump_id to SC7280 WPSS (Luca Weiss)
  - clk: renesas: r8a08g045: Check the source of the CPU PLL settings (Claudiu Beznea)
  - x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range() (David Hildenbrand)
  - selftests/bpf: Fix string read in strncmp benchmark (Viktor Malik)
  - libbpf: Fix hypothetical STT_SECTION extern NULL deref case (Andrii Nakryiko)
  - remoteproc: qcom_q6v5_pas: Make single-PD handling more robust (Luca Weiss)
  - pinctrl: renesas: rzg2l: Suppress binding attributes (Claudiu Beznea)
  - of: property: Increase NR_FWNODE_REFERENCE_ARGS (Zijun Hu)
  - remoteproc: core: Clear table_sz when rproc_shutdown (Peng Fan)
  - RDMA/mlx5: Fix page_size variable overflow (Michael Guralnik)
  - crypto: hisilicon/sec2 - fix for sec spec check (Wenkai Lin)
  - crypto: hisilicon/sec2 - fix for aead authsize alignment (Wenkai Lin)
  - clk: amlogic: gxbb: drop incorrect flag on 32k clock (Jerome Brunet)
  - crypto: tegra - Use HMAC fallback when keyslots are full (Akhil R)
  - crypto: bpf - Add MODULE_DESCRIPTION for skcipher (Arnd Bergmann)
  - crypto: tegra - check return value for hash do_one_req (Akhil R)
  - crypto: tegra - Use separate buffer for setkey (Akhil R)
  - crypto: qat - set parity error mask for qat_420xx (Bairavi Alagappan)
  - crypto: iaa - Test the correct request flag (Herbert Xu)
  - fbdev: sm501fb: Add some geometry checks. (Danila Chernetsov)
  - mdacon: rework dependency list (Arnd Bergmann)
  - dummycon: fix default rows/cols (Arnd Bergmann)
  - fbdev: au1100fb: Move a variable assignment behind a null pointer check (Markus Elfring)
  - PCI: pciehp: Don't enable HPIE when resuming in poll mode (Ilpo Järvinen)
  - PCI: Fix BAR resizing when VF BARs are assigned (Ilpo Järvinen)
  - PCI: histb: Fix an error handling path in histb_pcie_probe() (Christophe JAILLET)
  - PCI: dwc: ep: Return -ENOMEM for allocation failures (Dan Carpenter)
  - drm/amd/display: avoid NPD when ASIC does not support DMUB (Thadeu Lima de Souza Cascardo)
  - drm/mediatek: dsi: fix error codes in mtk_dsi_host_transfer() (Dan Carpenter)
  - drm/mediatek: dp: drm_err => dev_err in HPD path to avoid NULL ptr (Douglas Anderson)
  - drm/mediatek: Fix config_updating flag never false when no mbox channel (Jason-JH Lin)
  - PCI: xilinx-cpm: Fix IRQ domain leak in error path of probe (Thippeswamy Havalige)
  - PCI: Remove stray put_device() in pci_register_host_bridge() (Dan Carpenter)
  - powerpc/kexec: fix physical address calculation in clear_utlb_entry() (Christophe Leroy)
  - crypto: powerpc: Mark ghashp8-ppc.o as an OBJECT_FILES_NON_STANDARD (Christophe Leroy)
  - drm/msm/a6xx: Fix a6xx indexed-regs in devcoreduump (Rob Clark)
  - drm/amd/display: fix type mismatch in CalculateDynamicMetadataParameters() (Vitaliy Shevtsov)
  - drm/panthor: Update CS_STATUS_ defines to correct values (Ashley Smith)
  - PCI: Avoid reset when disabled via sysfs (Nishanth Aravamudan)
  - PCI/portdrv: Only disable pciehp interrupts early when needed (Feng Tang)
  - PCI: brcmstb: Fix potential premature regulator disabling (Jim Quinlan)
  - PCI: brcmstb: Fix error path after a call to regulator_bulk_get() (Jim Quinlan)
  - PCI: brcmstb: Use internal register to change link capability (Jim Quinlan)
  - PCI: brcmstb: Set generation limit before PCIe link up (Jim Quinlan)
  - PCI: cadence-ep: Fix the driver to send MSG TLP for INTx without data payload (Hans Zhang)
  - drm/amdkfd: Fix Circular Locking Dependency in 'svm_range_cpu_invalidate_pagetables' (Srinivasan Shanmugam)
  - drm/msm/dsi: Set PHY usescase (and mode) before registering DSI host (Marijn Suijten)
  - drm/msm/dsi: Use existing per-interface slice count in DSC timing (Marijn Suijten)
  - drm/msm/dsi/phy: Program clock inverters in correct register (Krzysztof Kozlowski)
  - drm/msm/dpu: don't use active in atomic_check() (Dmitry Baryshkov)
  - drm/amd/display: fix an indent issue in DML21 (Aurabindo Pillai)
  - PCI/ACS: Fix 'pci=config_acs=' parameter (Tushar Dave)
  - drm/panel: ilitek-ili9882t: fix GPIO name in error message (John Keeping)
  - PCI/ASPM: Fix link state exit during switch upstream function removal (Daniel Stodden)
  - drm/mediatek: mtk_hdmi: Fix typo for aud_sampe_size member (AngeloGioacchino Del Regno)
  - drm/mediatek: mtk_hdmi: Unregister audio platform device on failure (AngeloGioacchino Del Regno)
  - PCI: Remove add_align overwrite unrelated to size0 (Ilpo Järvinen)
  - PCI: Use downstream bridges for distributing resources (Kai-Heng Feng)
  - drm/amdgpu/umsch: fix ucode check (Alex Deucher)
  - drm/amdgpu: refine smu send msg debug log format (Yang Wang)
  - gpu: cdns-mhdp8546: fix call balance of mhdp->clk handling routines (Vitalii Mordan)
  - drm/vkms: Fix use after free and double free on init error (José Expósito)
  - drm: xlnx: zynqmp: Fix max dma segment size (Tomi Valkeinen)
  - drm/bridge: it6505: fix HDCP V match check is not performed correctly (Hermes Wu)
  - drm/dp_mst: Fix drm RAD print (Wayne Lin)
  - drm/ssd130x: ensure ssd132x pitch is correct (John Keeping)
  - drm/ssd130x: fix ssd132x encoding (John Keeping)
  - drm/ssd130x: Set SPI .id_table to prevent an SPI core warning (Javier Martinez Canillas)
  - drm/bridge: ti-sn65dsi86: Fix multiple instances (Geert Uytterhoeven)
  - ALSA: timer: Don't take register_mutex with copy_from/to_user() (Takashi Iwai)
  - ASoC: ti: j721e-evm: Fix clock configuration for ti,j7200-cpb-audio compatible (Jayesh Choudhary)
  - ALSA: hda/realtek: Always honor no_shutup_pins (Takashi Iwai)
  - dt-bindings: vendor-prefixes: add GOcontroll (Maud Spierings)
  - HID: remove superfluous (and wrong) Makefile entry for CONFIG_INTEL_ISH_FIRMWARE_DOWNLOADER (Jiri Kosina)
  - ASoC: amd: acp: Fix for enabling DMIC on acp platforms via _DSD entry (Venkata Prasad Potturu)
  - ASoC: cs35l41: check the return value from spi_setup() (Vitaliy Shevtsov)
  - platform/x86: dell-ddv: Fix temperature calculation (Armin Wolf)
  - platform/x86: dell-uart-backlight: Make dell_uart_bl_serdev_driver static (Ilpo Järvinen)
  - platform/x86: lenovo-yoga-tab2-pro-1380-fastcharger: Make symbol static (Ilpo Järvinen)
  - auxdisplay: panel: Fix an API misuse in panel.c (Andy Shevchenko)
  - media: platform: allgro-dvt: unregister v4l2_device on the error path (Joe Hattori)
  - media: verisilicon: HEVC: Initialize start_bit field (Benjamin Gaignard)
  - auxdisplay: MAX6959 should select BITREVERSE (Geert Uytterhoeven)
  - regulator: pca9450: Fix enable register for LDO5 (Frieder Schrempf)
  - x86/entry: Add __init to ia32_emulation_override_cmdline() (Vitaly Kuznetsov)
  - x86/fpu/xstate: Fix inconsistencies in guest FPU xfeatures (Chao Gao)
  - x86/traps: Make exc_double_fault() consistently noreturn (Josh Poimboeuf)
  - perf/ring_buffer: Allow the EPOLLRDNORM flag for poll (Tao Chen)
  - lockdep: Don't disable interrupts on RT in disable_irq_nosync_lockdep.*() (Sebastian Andrzej Siewior)
  - PM: sleep: Fix handling devices with direct_complete set on errors (Rafael J. Wysocki)
  - thermal: int340x: Add NULL check for adev (Chenyuan Yang)
  - x86/resctrl: Fix allocation of cleanest CLOSID on platforms with no monitors (James Morse)
  - EDAC/ie31200: Fix the error path order of ie31200_init() (Qiuxu Zhuo)
  - EDAC/ie31200: Fix the DIMM size mask for several SoCs (Qiuxu Zhuo)
  - EDAC/ie31200: Fix the size of EDAC_MC_LAYER_CHIP_SELECT layer (Qiuxu Zhuo)
  - selinux: Chain up tool resolving errors in install_policy.sh (Tim Schumacher)
  - watchdog/hardlockup/perf: Fix perf_event memory leak (Li Huafei)
  - kunit/stackinit: Use fill byte different from Clang i386 pattern (Kees Cook)
  - RISC-V: KVM: Disable the kernel perf counter during configure (Atish Patra)
  - cpufreq: tegra194: Allow building for Tegra234 (Aaron Kling)
  - PM: sleep: Adjust check before setting power.must_resume (Rafael J. Wysocki)
  - lockdep/mm: Fix might_fault() lockdep check of current->mm->mmap_lock (Peter Zijlstra)
  - x86/sev: Add missing RIP_REL_REF() invocations during sme_enable() (Kevin Loughlin)
  - x86/platform: Only allow CONFIG_EISA for 32-bit (Arnd Bergmann)
  - x86/fpu: Avoid copying dynamic FP state from init_task in arch_dup_task_struct() (Benjamin Berg)
  - x86/fpu: Fix guest FPU state buffer allocation size (Stanislav Spassov)
  - EDAC/{skx_common,i10nm}: Fix some missing error reports on Emerald Rapids (Qiuxu Zhuo)
  - cpufreq: governor: Fix negative 'idle_time' handling in dbs_update() (Jie Zhan)
  - sched/eevdf: Force propagating min_slice of cfs_rq when {en,de}queue tasks (Tianchen Ding)
  - sched: Cancel the slice protection of the idle entity (zihan zhou)
  - smack: ipv4/ipv6: tcp/dccp/sctp: fix incorrect child socket label (Konstantin Andreev)
  - smack: dont compile ipv6 code unless ipv6 is configured (Konstantin Andreev)
  - cpufreq: scpi: compare kHz instead of Hz (zuoqian)
  - x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Mike Rapoport (Microsoft))
  - watch_queue: fix pipe accounting mismatch (Eric Sandeen)
  - LTS version: v6.12.22 (Jack Vogel)
  - bcachefs: bch2_ioctl_subvolume_destroy() fixes (Kent Overstreet)
  - serial: 8250_dma: terminate correct DMA in tx_dma_flush() (John Keeping)
  - serial: stm32: do not deassert RS485 RTS GPIO prematurely (Cheick Traore)
  - perf tools: Fix up some comments and code to properly use the event_source bus (Greg Kroah-Hartman)
  - memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (Luo Qiu)
  - usb: xhci: Apply the link chain quirk on NEC isoc endpoints (Michal Pecio)
  - usb: xhci: Don't skip on Stopped - Length Invalid (Michal Pecio)
  - net: usb: usbnet: restore usb%d name exception for local mac addresses (Dominique Martinet)
  - net: usb: qmi_wwan: add Telit Cinterion FE990B composition (Fabio Porcedda)
  - net: usb: qmi_wwan: add Telit Cinterion FN990B composition (Fabio Porcedda)
  - tty: serial: fsl_lpuart: disable transmitter before changing RS485 related registers (Sherry Sun)
  - tty: serial: 8250: Add Brainboxes XC devices (Cameron Williams)
  - tty: serial: 8250: Add some more device IDs (Cameron Williams)
  - counter: microchip-tcb-capture: Fix undefined counter channel state on probe (William Breathitt Gray)
  - counter: stm32-lptimer-cnt: fix error handling when enabling (Fabrice Gasnier)
  - ALSA: hda/realtek: Support mute LED on HP Laptop 15s-du3xxx (Dhruv Deshpande)
  - netfilter: socket: Lookup orig tuple for IPv6 SNAT (Maxim Mikityanskiy)
  - drm/amd/display: Don't write DP_MSTM_CTRL after LT (Wayne Lin)
  - atm: Fix NULL pointer dereference (Minjoong Kim)
  - HID: hid-plantronics: Add mic mute mapping and generalize quirks (Terry Junge)
  - ALSA: usb-audio: Add quirk for Plantronics headsets to fix control names (Terry Junge)
  - LTS version: v6.12.21 (Jack Vogel)
  - mptcp: Fix data stream corruption in the address announcement (Arthur Mongodin)
  - mm/huge_memory: drop beyond-EOF folios with the right number of refs (Zi Yan)
  - arm64: dts: rockchip: fix u2phy1_host status for NanoPi R4S (Justin Klaassen)
  - libsubcmd: Silence compiler warning (Eder Zulian)
  - Revert "sched/core: Reduce cost of sched_move_task when config autogroup" (Dietmar Eggemann)
  - KVM: arm64: Eagerly switch ZCR_EL{1,2} (Mark Rutland)
  - KVM: arm64: Mark some header functions as inline (Mark Rutland)
  - KVM: arm64: Refactor exit handlers (Mark Rutland)
  - KVM: arm64: Remove VHE host restore of CPACR_EL1.SMEN (Mark Rutland)
  - KVM: arm64: Remove VHE host restore of CPACR_EL1.ZEN (Mark Rutland)
  - KVM: arm64: Remove host FPSIMD saving for non-protected KVM (Mark Rutland)
  - KVM: arm64: Unconditionally save+flush host FPSIMD/SVE/SME state (Mark Rutland)
  - KVM: arm64: Calculate cptr_el2 traps on activating traps (Fuad Tabba)
  - io_uring/net: fix sendzc double notif flush (Pavel Begunkov)
  - ksmbd: fix incorrect validation for num_aces field of smb_acl (Namjae Jeon)
  - drm/amdkfd: Fix user queue validation on Gfx7/8 (Philip Yang)
  - drm/amdgpu: Fix JPEG video caps max size for navi1x and raven (David Rosca)
  - drm/amdgpu: Fix MPEG2, MPEG4 and VC1 video caps max size (David Rosca)
  - drm/amdgpu: Remove JPEG from vega and carrizo video caps (David Rosca)
  - drm/amdgpu/pm: wire up hwmon fan speed for smu 14.0.2 (Alex Deucher)
  - drm/amdgpu/pm: Handle SCLK offset correctly in overdrive for smu 14.0.2 (Tomasz Pakuła)
  - drm/amdgpu: Restore uncached behaviour on GFX12 (David Belanger)
  - drm/amd/pm: add unique_id for gfx12 (Harish Kasiviswanathan)
  - drm/amd/display: Use HW lock mgr for PSR1 when only one eDP (Mario Limonciello)
  - drm/amd/display: Fix message for support_edp0_on_dp1 (Yilin Chen)
  - drm/amdgpu/gfx12: correct cleanup of 'me' field with gfx_v12_0_me_fini() (Wentao Liang)
  - drm/sched: Fix fence reference count leak (qianyi liu)
  - drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse() (Nikita Zhandarovich)
  - pmdomain: amlogic: fix T7 ISP secpower (Xianwei Zhao)
  - soc: qcom: pdr: Fix the potential deadlock (Saranya R)
  - batman-adv: Ignore own maximum aggregation size during RX (Sven Eckelmann)
  - xsk: fix an integer overflow in xp_create_and_assign_umem() (Gavrilov Ilia)
  - keys: Fix UAF in key_put() (David Howells)
  - efi/libstub: Avoid physical address 0x0 when doing random allocation (Ard Biesheuvel)
  - firmware: qcom: uefisecapp: fix efivars registration race (Johan Hovold)
  - ARM: shmobile: smp: Enforce shmobile_smp_* alignment (Geert Uytterhoeven)
  - ARM: dts: imx6qdl-apalis: Fix poweroff on Apalis iMX6 (Stefan Eichenberger)
  - memcg: drain obj stock on cpu hotplug teardown (Shakeel Butt)
  - proc: fix UAF in proc_get_inode() (Ye Bin)
  - mm/page_alloc: fix memory accept before watermarks gets initialized (Kirill A. Shutemov)
  - mm/migrate: fix shmem xarray update during migration (Zi Yan)
  - mm: fix error handling in __filemap_get_folio() with FGP_NOWAIT (Raphael S. Carvalho)
  - selftests/mm: run_vmtests.sh: fix half_ufd_size_MB calculation (Rafael Aquini)
  - mmc: atmel-mci: Add missing clk_disable_unprepare() (Gu Bowen)
  - mmc: sdhci-brcmstb: add cqhci suspend/resume to PM ops (Kamal Dasu)
  - arm64: dts: rockchip: fix pinmux of UART5 for PX30 Ringneck on Haikou (Quentin Schulz)
  - arm64: dts: rockchip: fix pinmux of UART0 for PX30 Ringneck on Haikou (Quentin Schulz)
  - arm64: dts: freescale: imx8mm-verdin-dahlia: add Microphone Jack to sound card (Stefan Eichenberger)
  - arm64: dts: freescale: imx8mp-verdin-dahlia: add Microphone Jack to sound card (Stefan Eichenberger)
  - accel/qaic: Fix integer overflow in qaic_validate_req() (Dan Carpenter)
  - regulator: check that dummy regulator has been probed before using it (Christian Eggers)
  - regulator: dummy: force synchronous probing (Christian Eggers)
  - netfs: Call `invalidate_cache` only if implemented (Max Kellermann)
  - riscv: dts: starfive: Fix a typo in StarFive JH7110 pin function definitions (E Shattow)
  - io_uring/net: don't clear REQ_F_NEED_CLEANUP unconditionally (Jens Axboe)
  - drm/v3d: Don't run jobs that have errors flagged in its fence (Maíra Canal)
  - drm/xe: Fix exporting xe buffers multiple times (Tomasz Rusinowicz)
  - can: flexcan: disable transceiver during system PM (Haibo Chen)
  - can: flexcan: only change CAN state when link up in system PM (Haibo Chen)
  - can: ucan: fix out of bound read in strscpy() source (Vincent Mailhol)
  - can: rcar_canfd: Fix page entries in the AFL list (Biju Das)
  - dt-bindings: can: renesas,rcar-canfd: Fix typo in pattern properties for R-Car V4M (Biju Das)
  - net: mana: Support holes in device list reply msg (Haiyang Zhang)
  - i2c: omap: fix IRQ storms (Andreas Kemnade)
  - tracing: tprobe-events: Fix leakage of module refcount (Masami Hiramatsu (Google))
  - Revert "gre: Fix IPv6 link-local address generation." (Guillaume Nault)
  - net/neighbor: add missing policy for NDTPA_QUEUE_LENBYTES (Lin Ma)
  - libfs: Fix duplicate directory entry in offset_dir_lookup (Yongjian Sun)
  - net: ipv6: ioam6: fix lwtunnel_output() loop (Justin Iurman)
  - net: lwtunnel: fix recursion loops (Justin Iurman)
  - net: ti: icssg-prueth: Add lock to stats (MD Danish Anwar)
  - net: atm: fix use after free in lec_send() (Dan Carpenter)
  - gpu: host1x: Do not assume that a NULL domain means no DMA IOMMU (Jason Gunthorpe)
  - phy: fix xa_alloc_cyclic() error handling (Michal Swiatkowski)
  - dpll: fix xa_alloc_cyclic() error handling (Michal Swiatkowski)
  - devlink: fix xa_alloc_cyclic() error handling (Michal Swiatkowski)
  - ipv6: Set errno after ip_fib_metrics_init() in ip6_route_info_create(). (Kuniyuki Iwashima)
  - ipv6: Fix memleak of nhc_pcpu_rth_output in fib_check_nh_v6_gw(). (Kuniyuki Iwashima)
  - net: ipv6: fix TCP GSO segmentation with NAT (Felix Fietkau)
  - net: ethernet: ti: am65-cpsw: Fix NAPI registration sequence (Vignesh Raghavendra)
  - ata: libata-core: Add ATA_QUIRK_NO_LPM_ON_ATI for certain Samsung SSDs (Niklas Cassel)
  - tracing: tprobe-events: Fix to clean up tprobe correctly when module unload (Masami Hiramatsu (Google))
  - ARM: davinci: da850: fix selecting ARCH_DAVINCI_DA8XX (David Lechner)
  - accel/qaic: Fix possible data corruption in BOs > 2G (Jeffrey Hugo)
  - Bluetooth: hci_event: Fix connection regression between LE and non-LE adapters (Arkadiusz Bokowy)
  - Bluetooth: Fix error code in chan_alloc_skb_cb() (Dan Carpenter)
  - RDMA/hns: Fix wrong value of max_sge_rd (Junxian Huang)
  - RDMA/hns: Fix missing xa_destroy() (Junxian Huang)
  - RDMA/hns: Fix a missing rollback in error path of hns_roce_create_qp_common() (Junxian Huang)
  - RDMA/hns: Fix invalid sq params not being blocked (Junxian Huang)
  - RDMA/hns: Fix unmatched condition in error path of alloc_user_qp_db() (Junxian Huang)
  - RDMA/hns: Fix soft lockup during bt pages loop (Junxian Huang)
  - RDMA/bnxt_re: Avoid clearing VLAN_ID mask in modify qp path (Saravanan Vajravel)
  - dma-mapping: fix missing clear bdr in check_ram_in_range_map() (Baochen Qiang)
  - ARM: dts: BCM5301X: Fix switch port labels of ASUS RT-AC3200 (Chester A. Unal)
  - ARM: dts: BCM5301X: Fix switch port labels of ASUS RT-AC5300 (Chester A. Unal)
  - ARM: dts: bcm2711: Don't mark timer regs unconfigured (Phil Elwell)
  - ARM: OMAP1: select CONFIG_GENERIC_IRQ_CHIP (Arnd Bergmann)
  - RDMA/mlx5: Handle errors returned from mlx5r_ib_rate() (Qasim Ijaz)
  - RDMA/bnxt_re: Add missing paranthesis in map_qp_id_to_tbl_indx (Kashyap Desai)
  - RDMA/rxe: Fix the failure of ibv_query_device() and ibv_query_device_ex() tests (Zhu Yanjun)
  - arm64: dts: rockchip: Remove undocumented sdmmc property from lubancat-1 (Yao Zi)
  - arm64: dts: bcm2712: PL011 UARTs are actually r1p5 (Phil Elwell)
  - ARM: dts: bcm2711: PL011 UARTs are actually r1p5 (Phil Elwell)
  - ARM: dts: bcm2711: Fix xHCI power-domain (Stefan Wahren)
  - soc: imx8m: Unregister cpufreq and soc dev in cleanup path (Peng Fan)
  - soc: imx8m: Use devm_* to simplify probe failure handling (Marek Vasut)
  - soc: imx8m: Remove global soc_uid (Marek Vasut)
  - xfrm_output: Force software GSO only in tunnel mode (Cosmin Ratiu)
  - xfrm: fix tunnel mode TX datapath in packet offload mode (Alexandre Cassen)
  - arm64: dts: rockchip: remove supports-cqe from rk3588 tiger (Heiko Stuebner)
  - arm64: dts: rockchip: remove supports-cqe from rk3588 jaguar (Heiko Stuebner)
  - arm64: dts: freescale: tqma8mpql: Fix vqmmc-supply (Alexander Stein)
  - firmware: imx-scu: fix OF node leak in .probe() (Joe Hattori)
  - firmware: qcom: scm: Fix error code in probe() (Dan Carpenter)
  - rds: Tear down the copy-from-user cache before destroying rds_wq (Håkon Bugge)  [Orabug: 37379052]
  - uek-rpm: Set uek_release variable in UEK 8 spec file (Harshit Mogalapalli)  [Orabug: 37801392]


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-1.23.2.el9uek]
changelog:
  - vhost_scsi: log write descriptors (Dongli Zhang)  [Orabug: 37393517]
  - vhost-scsi: protect vq->log_base with vq->mutex (Dongli Zhang)  [Orabug: 37393517]
  - RDS: avoid queueing delayed work on an offlined cpu (Praveen Kumar Kannoju)  [Orabug: 37260584] [Orabug: 37551308]
  - Revert "x86/simplefb: simplefb was broken on UEFI mode Oracle and HP system, skip VIDEO_TYPE_EFI" (Harshit Mogalapalli)  [Orabug: 37638881]
  - uek-rpm: Replace legacy FBDEV drivers with simpledrm and fbdev emulation layer (Harshit Mogalapalli)  [Orabug: 37638881]
  - uek-rpm/kernel-uek.spec: Set DEFAULTKERNEL correctly during %postun (Vijay Kumar)
  - uek-rpm: Enable gcov build (Sherry Yang)  [Orabug: 37734677]
  - uek-rpm: remove .el9 from shim version (Samasth Norway Ananda)  [Orabug: 37820202]
  - drm/mgag200: Added support for the new device G200eH5 (Gwenael Georgeault)  [Orabug: 37835185]


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-2.24.1.el9uek]
changelog:
  - x86/microcode/AMD: Clean the cache if update did not load microcode (Boris Ostrovsky)  [Orabug: 37800727]
  - LTS version: v6.12.24 (Jack Vogel)
  - HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition (Kaixin Wang)
  - s390/cpumf: Fix double free on error in cpumf_pmu_event_init() (Thomas Richter)
  - Bluetooth: hci_uart: Fix another race during initialization (Arseniy Krasnov)
  - media: mediatek: vcodec: mark vdec_vp9_slice_map_counts_eob_coef noinline (Arnd Bergmann)
  - kbuild: Add '-fno-builtin-wcslen' (Nathan Chancellor)
  - libbpf: Prevent compiler warnings/errors (Eder Zulian)
  - x86/e820: Fix handling of subpage regions when calculating nosave ranges in e820__register_nosave_regions() (Myrrh Periwinkle)
  - nfsd: don't ignore the return code of svc_proc_register() (Jeff Layton)
  - NFSD: Fix CB_GETATTR status fix (Chuck Lever)
  - NFSD: fix decoding in nfs4_xdr_dec_cb_getattr (Olga Kornievskaia)
  - ACPI: platform-profile: Fix CFI violation when accessing sysfs files (Nathan Chancellor)
  - iommufd: Fail replace if device has not been attached (Yi Liu)
  - iommufd: Make attach_handle generic than fault specific (Nicolin Chen)
  - arm64: errata: Add newer ARM cores to the spectre_bhb_loop_affected() lists (Douglas Anderson)
  - thermal/drivers/mediatek/lvts: Disable Stage 3 thermal threshold (Nícolas F. R. A. Prado)
  - thermal/drivers/mediatek/lvts: Disable monitor mode during suspend (Nícolas F. R. A. Prado)
  - selftests: mptcp: fix incorrect fd checks in main_loop (Cong Liu)
  - selftests: mptcp: close fd_in before returning in main_loop (Geliang Tang)
  - sched_ext: create_dsq: Return -EEXIST on duplicate request (Jake Hillion)
  - s390: Fix linker error when -no-pie option is unavailable (Sumanth Korikkar)
  - s390/virtio_ccw: Don't allocate/assign airqs for non-existing queues (David Hildenbrand)
  - s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs (Niklas Schnelle)
  - ring-buffer: Use flush_kernel_vmap_range() over flush_dcache_folio() (Steven Rostedt)
  - pinctrl: samsung: add support for eint_fltcon_offset (Peter Griffin)
  - pinctrl: qcom: Clear latched interrupt status when changing IRQ type (Stephan Gerhold)
  - phy: freescale: imx8m-pcie: assert phy reset and perst in power off (Stefan Eichenberger)
  - PCI: Fix wrong length of devres array (Philipp Stanner)
  - PCI: Fix reference leak in pci_register_host_bridge() (Ma Ke)
  - PCI: Fix reference leak in pci_alloc_child_bus() (Ma Ke)
  - PCI: pciehp: Avoid unnecessary device replacement check (Lukas Wunner)
  - PCI: j721e: Fix the value of .linkdown_irq_regfield for J784S4 (Siddharth Vadapalli)
  - PCI: brcmstb: Fix missing of_node_put() in brcm_pcie_probe() (Stanimir Varbanov)
  - of/irq: Fix device node refcount leakages in of_irq_init() (Zijun Hu)
  - of/irq: Fix device node refcount leakage in API irq_of_parse_and_map() (Zijun Hu)
  - of/irq: Fix device node refcount leakages in of_irq_count() (Zijun Hu)
  - of/irq: Fix device node refcount leakage in API of_irq_parse_raw() (Zijun Hu)
  - of/irq: Fix device node refcount leakage in API of_irq_parse_one() (Zijun Hu)
  - ntb: use 64-bit arithmetic for the MSI doorbell mask (Fedor Pchelkin)
  - net: mana: Switch to page pool for jumbo frames (Haiyang Zhang)
  - misc: pci_endpoint_test: Fix displaying 'irq_type' after 'request_irq' error (Kunihiko Hayashi)
  - selftests/landlock: Add a new test for setuid() (Mickaël Salaün)
  - selftests/landlock: Split signal_scoping_threads tests (Mickaël Salaün)
  - landlock: Prepare to add second errata (Mickaël Salaün)
  - landlock: Always allow signals between threads of the same process (Mickaël Salaün)
  - landlock: Add erratum for TCP fix (Mickaël Salaün)
  - landlock: Add the errata interface (Mickaël Salaün)
  - landlock: Move code to ease future backports (Mickaël Salaün)
  - KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses (Sean Christopherson)
  - KVM: x86: Explicitly zero-initialize on-stack CPUID unions (Sean Christopherson)
  - KVM: PPC: Enable CAP_SPAPR_TCE_VFIO on pSeries KVM guests (Amit Machhiwal)
  - gve: handle overflow when reporting TX consumed descriptors (Joshua Washington)
  - gpio: zynq: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
  - gpio: tegra186: fix resource handling in ACPI probe path (Guixin Liu)
  - ftrace: Properly merge notrace hashes (Andy Chiu)
  - ftrace: Add cond_resched() to ftrace_graph_set_hash() (zhoumin)
  - dt-bindings: coresight: qcom,coresight-tpdm: Fix too many 'reg' (Krzysztof Kozlowski)
  - dt-bindings: coresight: qcom,coresight-tpda: Fix too many 'reg' (Krzysztof Kozlowski)
  - dm-verity: fix prefetch-vs-suspend race (Mikulas Patocka)
  - dm-integrity: fix non-constant-time tag verification (Jo Van Bulck)
  - dm-integrity: set ti->error on memory allocation failure (Mikulas Patocka)
  - dm-ebs: fix prefetch-vs-suspend race (Mikulas Patocka)
  - dlm: fix error if active rsb is not hashed (Alexander Aring)
  - dlm: fix error if inactive rsb is not hashed (Alexander Aring)
  - crypto: ccp - Fix uAPI definitions of PSP errors (Dionna Glaze)
  - crypto: ccp - Fix check for the primary ASP device (Tom Lendacky)
  - clk: qcom: gdsc: Set retain_ff before moving to HW CTRL (Taniya Das)
  - clk: qcom: gdsc: Capture pm_genpd_add_subdomain result code (Bryan O'Donoghue)
  - clk: qcom: gdsc: Release pm subdomains in reverse add order (Bryan O'Donoghue)
  - clk: qcom: clk-branch: Fix invert halt status bit check for votable clocks (Ajit Pandey)
  - clk: renesas: r9a07g043: Fix HP clock source for RZ/Five (Lad Prabhakar)
  - cifs: Ensure that all non-client-specific reparse points are processed by the server (Pali Rohár)
  - cifs: fix integer overflow in match_server() (Roman Smirnov)
  - cifs: avoid NULL pointer dereference in dbg call (Alexandra Diupina)
  - CIFS: Propagate min offload along with other parameters from primary to secondary channels. (Aman)
  - thermal/drivers/rockchip: Add missing rk3328 mapping entry (Trevor Woerner)
  - tracing: Do not add length to print format in synthetic events (Steven Rostedt)
  - tracing: fprobe events: Fix possible UAF on modules (Masami Hiramatsu (Google))
  - x86/xen: fix balloon target initialization for PVH dom0 (Roger Pau Monne)
  - sctp: detect and prevent references to a freed transport in sendmsg (Ricardo Cañuelo Navarro)
  - mm/hwpoison: introduce folio_contain_hwpoisoned_page() helper (Jinjiang Tu)
  - mm/hugetlb: move hugetlb_sysctl_init() to the __init section (Marc Herbert)
  - mm/hwpoison: do not send SIGBUS to processes with recovered clean pages (Shuai Xue)
  - mm/userfaultfd: fix release hang over concurrent GUP (Peter Xu)
  - mm: add missing release barrier on PGDAT_RECLAIM_LOCKED unlock (Mathieu Desnoyers)
  - mm/mremap: correctly handle partial mremap() of VMA starting at 0 (Lorenzo Stoakes)
  - mm: fix lazy mmu docs and usage (Ryan Roberts)
  - mm: make page_mapped_in_vma() hugetlb walk aware (Jane Chu)
  - mm/rmap: reject hugetlb folios in folio_make_device_exclusive() (David Hildenbrand)
  - mm/damon/ops: have damon_get_folio return folio even for tail pages (Usama Arif)
  - sparc/mm: avoid calling arch_enter/leave_lazy_mmu() in set_ptes (Ryan Roberts)
  - sparc/mm: disable preemption in lazy mmu mode (Ryan Roberts)
  - iommu/vt-d: Wire up irq_ack() to irq_move_irq() for posted MSIs (Sean Christopherson)
  - iommu/vt-d: Fix possible circular locking dependency (Lu Baolu)
  - iommu/vt-d: Don't clobber posted vCPU IRTE when host IRQ affinity changes (Sean Christopherson)
  - iommu/vt-d: Put IRTE back into posted MSI mode if vCPU posting is disabled (Sean Christopherson)
  - iommu/tegra241-cmdqv: Fix warnings due to dmam_free_coherent() (Nicolin Chen)
  - iommufd: Fix uninitialized rc in iommufd_access_rw() (Nicolin Chen)
  - btrfs: zoned: fix zone finishing with missing devices (Johannes Thumshirn)
  - btrfs: zoned: fix zone activation with missing devices (Johannes Thumshirn)
  - btrfs: tests: fix chunk map leak after failure to add it to the tree (Filipe Manana)
  - btrfs: fix non-empty delayed iputs list on unmount due to compressed write workers (Filipe Manana)
  - backlight: led_bl: Hold led_access lock when calling led_sysfs_disable() (Herve Codina)
  - arm64: dts: exynos: gs101: disable pinctrl_gsacore node (Peter Griffin)
  - arm64: dts: mediatek: mt8173: Fix disp-pwm compatible string (Chen-Yu Tsai)
  - arm64: mm: Correct the update of max_pfn (Zhenhua Huang)
  - arm64: tegra: Remove the Orin NX/Nano suspend key (Ninad Malwade)
  - arm64: mops: Do not dereference src reg for a set operation (Keir Fraser)
  - mtd: rawnand: Add status chack in r852_ready() (Wentao Liang)
  - mtd: inftlcore: Add error check for inftl_read_oob() (Wentao Liang)
  - mptcp: only inc MPJoinAckHMacFailure for HMAC failures (Matthieu Baerts (NGI0))
  - mptcp: fix NULL pointer in can_accept_new_subflow (Gang Yan)
  - lib: scatterlist: fix sg_split_phys to preserve original scatterlist offsets (T Pratham)
  - locking/lockdep: Decrease nr_unused_locks if lock unused in zap_class() (Boqun Feng)
  - mailbox: tegra-hsp: Define dimensioning masks in SoC data (Kartik Rajput)
  - mfd: ene-kb3930: Fix a potential NULL pointer dereference (Chenyuan Yang)
  - leds: rgb: leds-qcom-lpg: Fix calculation of best period Hi-Res PWMs (Abel Vesa)
  - leds: rgb: leds-qcom-lpg: Fix pwm resolution max for Hi-Res PWMs (Abel Vesa)
  - jbd2: remove wrong sb->s_sequence check (Jan Kara)
  - i3c: Add NULL pointer check in i3c_master_queue_ibi() (Manjunatha Venkatesh)
  - i3c: master: svc: Use readsb helper for reading MDB (Stanley Chu)
  - ima: limit the number of ToMToU integrity violations (Mimi Zohar)
  - ima: limit the number of open-writers integrity violations (Mimi Zohar)
  - smb311 client: fix missing tcon check when mounting with linux/posix extensions (Steve French)
  - soc: samsung: exynos-chipid: Add NULL pointer check in exynos_chipid_probe() (Chenyuan Yang)
  - svcrdma: do not unregister device for listeners (Olga Kornievskaia)
  - tpm: do not start chip while suspended (Thadeu Lima de Souza Cascardo)
  - udf: Fix inode_getblk() return value (Jan Kara)
  - vdpa/mlx5: Fix oversized null mkey longer than 32bit (Si-Wei Liu)
  - f2fs: fix to avoid atomicity corruption of atomic file (Yeongjin Gil)
  - ext4: fix off-by-one error in do_split (Artem Sadovnikov)
  - bus: mhi: host: Fix race between unprepare and queue_buf (Jeff Hugo)
  - accel/ivpu: Fix deadlock in ivpu_ms_cleanup() (Jacek Lawrynowicz)
  - accel/ivpu: Fix warning in ivpu_ipc_send_receive_internal() (Jacek Lawrynowicz)
  - ALSA: hda/realtek: Enable Mute LED on HP OMEN 16 Laptop xd000xx (Sharan Kumar M)
  - ASoC: qdsp6: q6asm-dai: fix q6asm_dai_compr_set_params error path (Alexey Klimov)
  - ASoC: qdsp6: q6apm-dai: fix capture pipeline overruns. (Srinivas Kandagatla)
  - ASoC: qdsp6: q6apm-dai: set 10 ms period and buffer alignment. (Srinivas Kandagatla)
  - ASoC: q6apm-dai: make use of q6apm_get_hw_pointer (Srinivas Kandagatla)
  - ASoC: q6apm-dai: schedule all available frames to avoid dsp under-runs (Srinivas Kandagatla)
  - ASoC: q6apm: add q6apm_get_hw_pointer helper (Srinivas Kandagatla)
  - ASoC: codecs: wcd937x: fix a potential memory leak in wcd937x_soc_codec_probe() (Haoxiang Li)
  - io_uring/kbuf: reject zero sized provided buffers (Jens Axboe)
  - io_uring/net: fix io_req_post_cqe abuse by send bundle (Pavel Begunkov)
  - io_uring/net: fix accept multishot handling (Pavel Begunkov)
  - wifi: mt76: mt7925: fix the wrong simultaneous cap for MLO (Ming Yen Hsieh)
  - wifi: mt76: mt7925: fix the wrong link_idx when a p2p_device is present (Ming Yen Hsieh)
  - wifi: mt76: mt7925: fix country count limitation for CLC (Ming Yen Hsieh)
  - wifi: mt76: mt7925: ensure wow pattern command align fw format (Ming Yen Hsieh)
  - wifi: mac80211: fix integer overflow in hwmp_route_info_get() (Gavrilov Ilia)
  - wifi: mt76: Add check for devm_kstrdup() (Haoxiang Li)
  - clocksource/drivers/stm32-lptimer: Use wakeup capable instead of init wakeup (Alexandre Torgue)
  - mtd: Replace kcalloc() with devm_kcalloc() (Jiasheng Jiang)
  - net: dsa: mv88e6xxx: fix internal PHYs for 6320 family (Marek Behún)
  - net: dsa: mv88e6xxx: workaround RGMII transmit delay erratum for 6320 family (Marek Behún)
  - mtd: Add check for devm_kcalloc() (Jiasheng Jiang)
  - mptcp: sockopt: fix getting freebind & transparent (Matthieu Baerts (NGI0))
  - mptcp: sockopt: fix getting IPV6_V6ONLY (Matthieu Baerts (NGI0))
  - media: chips-media: wave5: Fix timeout while testing 10bit hevc fluster (Jackson.lee)
  - media: chips-media: wave5: Fix a hang after seeking (Jackson.lee)
  - media: chips-media: wave5: Avoid race condition in the interrupt handler (Jackson.lee)
  - media: chips-media: wave5: Fix gray color on screen (Jackson.lee)
  - media: i2c: imx214: Rectify probe error handling related to runtime PM (Sakari Ailus)
  - media: i2c: imx219: Rectify runtime PM handling in probe and remove (Sakari Ailus)
  - media: i2c: imx319: Rectify runtime PM handling probe and remove (Sakari Ailus)
  - media: venus: hfi_parser: refactor hfi packet parsing logic (Vikash Garodia)
  - media: venus: hfi_parser: add check to avoid out of bound access (Vikash Garodia)
  - media: nuvoton: Fix reference handling of ece_pdev (Ricardo Ribalda)
  - media: nuvoton: Fix reference handling of ece_node (Ricardo Ribalda)
  - media: i2c: ov7251: Introduce 1 ms delay between regulators and en GPIO (Sakari Ailus)
  - media: i2c: ov7251: Set enable GPIO low in probe (Sakari Ailus)
  - media: i2c: ccs: Set the device's runtime PM status correctly in probe (Sakari Ailus)
  - media: i2c: ccs: Set the device's runtime PM status correctly in remove (Sakari Ailus)
  - Revert "media: imx214: Fix the error handling in imx214_probe()" (Sakari Ailus)
  - media: v4l2-dv-timings: prevent possible overflow in v4l2_detect_gtf() (Karina Yankevich)
  - media: imx219: Adjust PLL settings based on the number of MIPI lanes (Dave Stevenson)
  - media: platform: stm32: Add check for clk_enable() (Jiasheng Jiang)
  - media: visl: Fix ERANGE error when setting enum controls (Nicolas Dufresne)
  - media: hi556: Fix memory leak (on error) in hi556_check_hwcfg() (Hans de Goede)
  - media: streamzap: prevent processing IR data on URB failure (Murad Masimov)
  - accel/ivpu: Fix PM related deadlocks in MS IOCTLs (Jacek Lawrynowicz)
  - tpm, tpm_tis: Fix timeout handling when waiting for TPM status (Jonathan McDowell)
  - mtd: rawnand: brcmnand: fix PM resume warning (Kamal Dasu)
  - spi: cadence-qspi: Fix probe on AM62A LP SK (Miquel Raynal)
  - KVM: arm64: Tear down vGIC on failed vCPU creation (Will Deacon)
  - arm64: errata: Add KRYO 2XX/3XX/4XX silver cores to Spectre BHB safe list (Douglas Anderson)
  - arm64: errata: Assume that unknown CPUs _are_ vulnerable to Spectre BHB (Douglas Anderson)
  - arm64: errata: Add QCOM_KRYO_4XX_GOLD to the spectre_bhb_k24_list (Douglas Anderson)
  - arm64: cputype: Add MIDR_CORTEX_A76AE (Douglas Anderson)
  - xenfs/xensyms: respect hypervisor's "next" indication (Jan Beulich)
  - media: rockchip: rga: fix rga offset lookup (John Keeping)
  - media: siano: Fix error handling in smsdvb_module_init() (Yuan Can)
  - media: vim2m: print device name after registering device (Matthew Majewski)
  - media: venus: hfi: add check to handle incorrect queue size (Vikash Garodia)
  - media: venus: hfi: add a check to handle OOB in sfr region (Vikash Garodia)
  - media: intel/ipu6: set the dev_parent of video device to pdev (Bingbu Cao)
  - media: mgb4: Fix switched CMT frequency range "magic values" sets (Martin Tůma)
  - media: i2c: adv748x: Fix test pattern selection mask (Niklas Söderlund)
  - media: mgb4: Fix CMT registers update logic (Martin Tůma)
  - media: uapi: rkisp1-config: Fix typo in extensible params example (Niklas Söderlund)
  - media: mtk-vcodec: venc: avoid -Wenum-compare-conditional warning (Arnd Bergmann)
  - media: mediatek: vcodec: Fix a resource leak related to the scp device in FW initialization (Jiasheng Jiang)
  - dt-bindings: media: st,stmipid02: correct lane-polarities maxItems (Alain Volmat)
  - auxdisplay: hd44780: Fix an API misuse in hd44780.c (Haoxiang Li)
  - HID: pidff: Fix set_device_control() (Tomasz Pakuła)
  - HID: pidff: Fix 90 degrees direction name North -> East (Tomasz Pakuła)
  - HID: pidff: Compute INFINITE value instead of using hardcoded 0xffff (Tomasz Pakuła)
  - HID: pidff: Clamp effect playback LOOP_COUNT value (Tomasz Pakuła)
  - HID: pidff: Rename two functions to align them with naming convention (Tomasz Pakuła)
  - HID: pidff: Remove redundant call to pidff_find_special_keys (Tomasz Pakuła)
  - HID: pidff: Support device error response from PID_BLOCK_LOAD (Tomasz Pakuła)
  - HID: pidff: Comment and code style update (Tomasz Pakuła)
  - HID: hid-universal-pidff: Add Asetek wheelbases support (Tomasz Pakuła)
  - HID: pidff: Make sure to fetch pool before checking SIMULTANEOUS_MAX (Tomasz Pakuła)
  - HID: pidff: Factor out pool report fetch and remove excess declaration (Tomasz Pakuła)
  - HID: pidff: Use macros instead of hardcoded min/max values for shorts (Tomasz Pakuła)
  - HID: pidff: Simplify pidff_rescale_signed (Tomasz Pakuła)
  - HID: pidff: Move all hid-pidff definitions to a dedicated header (Tomasz Pakuła)
  - HID: pidff: Factor out code for setting gain (Tomasz Pakuła)
  - HID: pidff: Rescale time values to match field units (Tomasz Pakuła)
  - HID: pidff: Define values used in pidff_find_special_fields (Tomasz Pakuła)
  - HID: pidff: Simplify pidff_upload_effect function (Tomasz Pakuła)
  - HID: pidff: Completely rework and fix pidff_reset function (Tomasz Pakuła)
  - HID: pidff: Stop all effects before enabling actuators (Tomasz Pakuła)
  - HID: pidff: Clamp PERIODIC effect period to device's logical range (Tomasz Pakuła)
  - s390/pci: Fix s390_mmio_read/write syscall page fault handling (Niklas Schnelle)
  - ext4: don't treat fhandle lookup of ea_inode as FS corruption (Jann Horn)
  - bpf: support SKF_NET_OFF and SKF_LL_OFF on skb frags (Willem de Bruijn)
  - erofs: set error to bio if file-backed IO fails (Sheng Yong)
  - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Uwe Kleine-König)
  - pwm: rcar: Improve register calculation (Uwe Kleine-König)
  - pwm: mediatek: Prevent divide-by-zero in pwm_mediatek_config() (Josh Poimboeuf)
  - tpm: End any active auth session before shutdown (Jonathan McDowell)
  - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Jonathan McDowell)
  - ktest: Fix Test Failures Due to Missing LOG_FILE Directories (Ayush Jain)
  - tracing: probe-events: Add comments about entry data storing code (Masami Hiramatsu (Google))
  - fbdev: omapfb: Add 'plane' value check (Leonid Arapov)
  - drm/amdgpu: grab an additional reference on the gang fence v2 (Christian König)
  - drm/amdgpu: Fix the race condition for draining retry fault (Emily Deng)
  - PCI: Enable Configuration RRS SV early (Bjorn Helgaas)
  - drm/amdgpu: handle amdgpu_cgs_create_device() errors in amd_powerplay_create() (Wentao Liang)
  - PCI: Add Rockchip Vendor ID (Shawn Lin)
  - drm/mediatek: mtk_dpi: Explicitly manage TVD clock in power on/off (AngeloGioacchino Del Regno)
  - drm/mediatek: mtk_dpi: Move the input_2p_en bit to platform data (AngeloGioacchino Del Regno)
  - drm/xe/xelp: Move Wa_16011163337 from tunings to workarounds (Tvrtko Ursulin)
  - drm/amdkfd: debugfs hang_hws skip GPU with MES (Philip Yang)
  - drm/amdkfd: Fix pqm_destroy_queue race with GPU reset (Philip Yang)
  - drm/amdkfd: Fix mode1 reset crash issue (Philip Yang)
  - drm/amdkfd: clamp queue size to minimum (David Yat Sin)
  - drivers: base: devres: Allow to release group on device release (Lucas De Marchi)
  - drm/amd/display: stop DML2 from removing pipes based on planes (Mike Katsnelson)
  - drm/bridge: panel: forbid initializing a panel with unknown connector type (Luca Ceresoli)
  - drm/debugfs: fix printk format for bridge index (Luca Ceresoli)
  - drm: panel-orientation-quirks: Add quirk for OneXPlayer Mini (Intel) (Andrew Wyatt)
  - drm: panel-orientation-quirks: Add new quirk for GPD Win 2 (Andrew Wyatt)
  - drm: panel-orientation-quirks: Add quirk for AYA NEO Slide (Andrew Wyatt)
  - drm: panel-orientation-quirks: Add quirks for AYA NEO Flip DS and KB (Andrew Wyatt)
  - drm: panel-orientation-quirks: Add support for AYANEO 2S (Andrew Wyatt)
  - drm/amdgpu: Unlocked unmap only clear page table leaves (Philip Yang)
  - drm/amd/display: Update Cursor request mode to the beginning prefetch always (Zhikai Zhai)
  - drm/xe/vf: Don't try to trigger a full GT reset if VF (Michal Wajdeczko)
  - drm/xe/bmg: Add new PCI IDs (Shekhar Chauhan)
  - drm: allow encoder mode_set even when connectors change for crtc (Abhinav Kumar)
  - Bluetooth: Add quirk for broken READ_PAGE_SCAN_TYPE (Pedro Nishiyama)
  - Bluetooth: Add quirk for broken READ_VOICE_SETTING (Pedro Nishiyama)
  - Bluetooth: qca: simplify WCN399x NVM loading (Dmitry Baryshkov)
  - Bluetooth: hci_qca: use the power sequencer for wcn6750 (Janaki Ramaiah Thota)
  - Bluetooth: btusb: Add 2 HWIDs for MT7922 (Jiande Lu)
  - Bluetooth: hci_uart: fix race during initialization (Arseniy Krasnov)
  - Bluetooth: btintel_pcie: Add device id of Whale Peak (Kiran K)
  - tracing: fix return value in __ftrace_event_enable_disable for TRACE_REG_UNREGISTER (Gabriele Paoloni)
  - net: vlan: don't propagate flags on open (Stanislav Fomichev)
  - wifi: mt76: mt76x2u: add TP-Link TL-WDN6200 ID to device table (Icenowy Zheng)
  - btrfs: harden block_group::bg_list against list_del() races (Boris Burkov)
  - ahci: Marvell 88SE9215 controllers prefer DMA for ATAPI (Huacai Chen)
  - scsi: st: Fix array overflow in st_setup() (Kai Mäkisara)
  - cdc_ether|r8152: ThinkPad Hybrid USB-C/A Dock quirk (Philipp Hahn)
  - ext4: ignore xattrs past end (Bhupesh)
  - Revert "f2fs: rebuild nat_bits during umount" (Chao Yu)
  - ext4: protect ext4_release_dquot against freezing (Ojaswin Mujoo)
  - ahci: add PCI ID for Marvell 88SE9215 SATA Controller (Daniel Kral)
  - net: sfp: add quirk for FS SFP-10GM-T copper SFP+ module (Martin Schiller)
  - f2fs: fix to avoid out-of-bounds access in f2fs_truncate_inode_blocks() (Chao Yu)
  - wifi: ath12k: Fix invalid data access in ath12k_dp_rx_h_undecap_nwifi (Manish Dharanenthiran)
  - net: sfp: add quirk for 2.5G OEM BX SFP (Birger Koblitz)
  - ata: libata-eh: Do not use ATAPI DMA for a device limited to PIO mode (Niklas Cassel)
  - jfs: add sanity check for agwidth in dbMount (Edward Adam Davis)
  - jfs: Prevent copying of nlink with value 0 from disk inode (Edward Adam Davis)
  - fs/jfs: Prevent integer overflow in AG size calculation (Rand Deeb)
  - fs/jfs: cast inactags to s64 to prevent potential overflow (Rand Deeb)
  - jfs: Fix uninit-value access of imap allocated in the diMount() function (Zhongqiu Han)
  - can: flexcan: add NXP S32G2/S32G3 SoC support (Ciprian Marian Costea)
  - can: flexcan: Add quirk to handle separate interrupt lines for mailboxes (Ciprian Marian Costea)
  - page_pool: avoid infinite loop to schedule delayed worker (Jason Xing)
  - net: usb: asix_devices: add FiberGecko DeviceID (Max Schulze)
  - scsi: target: spc: Fix RSOC parameter data header size (Chaohai Chen)
  - wifi: mac80211: ensure sdata->work is canceled before initialized. (Miri Korenblit)
  - wifi: mac80211: add strict mode disabling workarounds (Johannes Berg)
  - f2fs: don't retry IO for corrupted data scenario (Chao Yu)
  - net: page_pool: don't cast mp param to devmem (Pavel Begunkov)
  - ata: libata-core: Add 'external' to the libata.force kernel parameter (Niklas Cassel)
  - wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process (P Praneesh)
  - wifi: ath12k: fix memory leak in ath12k_pci_remove() (Miaoqing Pan)
  - wifi: ath11k: fix memory leak in ath11k_xxx_remove() (Miaoqing Pan)
  - wifi: ath11k: Fix DMA buffer allocation to resolve SWIOTLB issues (P Praneesh)
  - platform/x86: x86-android-tablets: Add select POWER_SUPPLY to Kconfig (Hans de Goede)
  - ASoC: amd: yc: update quirk data for new Lenovo model (Syed Saba kareem)
  - ASoC: amd: Add DMI quirk for ACP6X mic support (keenplify)
  - ALSA: usb-audio: Fix CME quirk for UF series keyboards (Ricard Wanderlof)
  - mmc: dw_mmc: add a quirk for accessing 64-bit FIFOs in two halves (Kaustabh Chakraborty)
  - media: s5p-mfc: Corrected NV12M/NV21M plane-sizes (Aakarsh Jain)
  - media: uvcvideo: Add quirk for Actions UVC05 (Ricardo Ribalda)
  - ASoC: fsl_audmix: register card device depends on 'dais' property (Shengjiu Wang)
  - ALSA: hda: intel: Add Lenovo IdeaPad Z570 to probe denylist (Maxim Mikityanskiy)
  - ALSA: hda: intel: Fix Optimus when GPU has no sound (Maxim Mikityanskiy)
  - ASoC: amd: ps: use macro for ACP6.3 pci revision id (Vijendar Mukunda)
  - HID: pidff: Fix null pointer dereference in pidff_find_fields (Tomasz Pakuła)
  - HID: pidff: Add PERIODIC_SINE_ONLY quirk (Tomasz Pakuła)
  - HID: Add hid-universal-pidff driver and supported device ids (Tomasz Pakuła)
  - HID: pidff: Add FIX_WHEEL_DIRECTION quirk (Tomasz Pakuła)
  - HID: pidff: Add hid_pidff_init_with_quirks and export as GPL symbol (Tomasz Pakuła)
  - HID: pidff: Add PERMISSIVE_CONTROL quirk (Tomasz Pakuła)
  - HID: pidff: Add MISSING_PBO quirk and its detection (Tomasz Pakuła)
  - HID: pidff: Add MISSING_DELAY quirk and its detection (Tomasz Pakuła)
  - HID: pidff: Do not send effect envelope if it's empty (Tomasz Pakuła)
  - HID: pidff: Convert infinite length from Linux API to PID standard (Tomasz Pakuła)
  - ASoC: SOF: topology: Use krealloc_array() to replace krealloc() (Zhang Heng)
  - platform/chrome: cros_ec_lpc: Match on Framework ACPI device (Daniel Schaefer)
  - zstd: Increase DYNAMIC_BMI2 GCC version cutoff from 4.8 to 11.0 to work around compiler segfault (Ingo Molnar)
  - xen/mcelog: Add __nonstring annotations for unterminated strings (Kees Cook)
  - arm64: cputype: Add QCOM_CPU_PART_KRYO_3XX_GOLD (Douglas Anderson)
  - Flush console log from kernel_power_off() (Paul E. McKenney)
  - PM: hibernate: Avoid deadlock in hibernate_compressor_param_set() (Lizhi Xu)
  - perf/dwc_pcie: fix some unreleased resources (Yunhui Cui)
  - perf: arm_pmu: Don't disable counter in armpmu_add() (Mark Rutland)
  - x86/cpu: Don't clear X86_FEATURE_LAHF_LM flag in init_amd_k8() on AMD when running in a virtual machine (Max Grobecker)
  - x86/ia32: Leave NULL selector values 0~3 unchanged (Xin Li (Intel))
  - x86/percpu: Disable named address spaces for UBSAN_BOOL with KASAN for GCC < 14.2 (Uros Bizjak)
  - x86/mm: Clear _PAGE_DIRTY for kernel mappings when we clear _PAGE_RW (Matthew Wilcox (Oracle))
  - pm: cpupower: bench: Prevent NULL dereference on malloc failure (Zhongqiu Han)
  - umount: Allow superblock owners to force umount (Trond Myklebust)
  - fs: consistently deref the files table with rcu_dereference_raw() (Mateusz Guzik)
  - iommu/mediatek: Fix NULL pointer deference in mtk_iommu_device_group (Louis-Alexis Eyraud)
  - iommu/exynos: Fix suspend/resume with IDENTITY domain (Marek Szyprowski)
  - nft_set_pipapo: fix incorrect avx2 match of 5th field octet (Florian Westphal)
  - net: ppp: Add bound checking for skb data on ppp_sync_txmung (Arnaud Lecomte)
  - ipv6: Align behavior across nexthops during path selection (Ido Schimmel)
  - net: phy: allow MDIO bus PM ops to start/stop state machine for phylink-controlled PHY (Vladimir Oltean)
  - net: phy: move phy_link_change() prior to mdio_bus_phy_may_suspend() (Vladimir Oltean)
  - smb: client: fix UAF in decryption with multichannel (Paulo Alcantara)
  - net_sched: sch_sfq: move the limit validation (Octavian Purdila)
  - net_sched: sch_sfq: use a temporary work area for validating configuration (Octavian Purdila)
  - nvmet-fcloop: swap list_add_tail arguments (Daniel Wagner)
  - drm/i915/huc: Fix fence not released on early probe errors (Janusz Krzysztofik)
  - ata: sata_sx4: Add error handling in pdc20621_i2c_read() (Wentao Liang)
  - net: libwx: handle page_pool_dev_alloc_pages error (Chenyuan Yang)
  - drm/tests: probe-helper: Fix drm_display_mode memory leak (Maxime Ripard)
  - drm/tests: modes: Fix drm_display_mode memory leak (Maxime Ripard)
  - drm/tests: cmdline: Fix drm_display_mode memory leak (Maxime Ripard)
  - drm/tests: helpers: Create kunit helper to destroy a drm_display_mode (Maxime Ripard)
  - drm/tests: modeset: Fix drm_display_mode memory leak (Maxime Ripard)
  - net: ethtool: Don't call .cleanup_data when prepare_data fails (Maxime Chevallier)
  - tc: Ensure we have enough buffer space when sending filter netlink notifications (Toke Høiland-Jørgensen)
  - octeontx2-pf: qos: fix VF root node parent queue index (Hariprasad Kelam)
  - net: tls: explicitly disallow disconnect (Jakub Kicinski)
  - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Cong Wang)
  - tipc: fix memory leak in tipc_link_xmit (Tung Nguyen)
  - objtool: Fix INSN_CONTEXT_SWITCH handling in validate_unret() (Josh Poimboeuf)
  - ata: pata_pxa: Fix potential NULL pointer dereference in pxa_ata_probe() (Henry Martin)
  - drm/xe/hw_engine: define sysfs_ops on all directories (Tejas Upadhyay)
  - x86/acpi: Don't limit CPUs to 1 for Xen PV guests due to disabled ACPI (Petr Vaněk)
  - drm/i915: Disable RPG during live selftest (Badal Nilawar)
  - ublk: fix handling recovery & reissue in ublk_abort_queue() (Ming Lei)
  - ublk: refactor recovery configuration flag helpers (Uday Shankar)
  - selftests/futex: futex_waitv wouldblock test should fail (Edward Liaw)
  - gpiolib: of: Fix the choice for Ingenic NAND quirk (Andy Shevchenko)
  - cgroup/cpuset: Further optimize code if CONFIG_CPUSETS_V1 not set (Waiman Long)
  - cgroup/cpuset: Enforce at most one rebuild_sched_domains_locked() call per operation (Waiman Long)
  - cgroup/cpuset: Revert "Allow suppression of sched domain rebuild in update_cpumasks_hier()" (Waiman Long)
  - cgroup/cpuset: Fix error handling in remote_partition_disable() (Waiman Long)
  - cgroup/cpuset: Fix incorrect isolated_cpus update in update_parent_effective_cpumask() (Waiman Long)
  - ASoC: Intel: adl: add 2xrt1316 audio configuration (Bard Liao)


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-2.27.2.el9uek]
changelog:
  - LTS version: v6.12.27 (Jack Vogel)
  - bpf: Fix BPF_INTERNAL namespace import (Xi Ruoyao)
  - LTS version: v6.12.26 (Jack Vogel)
  - mq-deadline: don't call req_get_ioprio from the I/O completion handler (Christoph Hellwig)
  - arm64: dts: ti: k3-j784s4-j742s2-main-common: Correct the GICD size (Keerthy)
  - crypto: Kconfig - Select LIB generic option (Herbert Xu)
  - usb: typec: class: Unlocked on error in typec_register_partner() (Dan Carpenter)
  - objtool: Silence more KCOV warnings, part 2 (Josh Poimboeuf)
  - objtool: Ignore end-of-section jumps for KCOV/GCOV (Josh Poimboeuf)
  - usb: xhci: Fix Short Packet handling rework ignoring errors (Michal Pecio)
  - nvme: fixup scan failure for non-ANA multipath controllers (Hannes Reinecke)
  - MIPS: cm: Fix warning if MIPS_CM is disabled (Thomas Bogendoerfer)
  - media: i2c: imx214: Fix uninitialized variable in imx214_set_ctrl() (Dan Carpenter)
  - crypto: lib/Kconfig - Hide arch options from user (Herbert Xu)
  - iommu: Handle race with default domain setup (Robin Murphy)
  - net: dsa: mv88e6xxx: enable STU methods for 6320 family (Marek Behún)
  - net: dsa: mv88e6xxx: enable .port_set_policy() for 6320 family (Marek Behún)
  - net: dsa: mv88e6xxx: enable PVT for 6321 switch (Marek Behún)
  - net: dsa: mv88e6xxx: fix atu_move_port_mask for 6341 family (Marek Behún)
  - Revert "net: dsa: mv88e6xxx: fix internal PHYs for 6320 family" (Marek Behún)
  - usb: typec: class: Invalidate USB device pointers on partner unregistration (Andrei Kuchynski)
  - ext4: goto right label 'out_mmap_sem' in ext4_setattr() (Baokun Li)
  - comedi: jr3_pci: Fix synchronous deletion of timer (Ian Abbott)
  - vmxnet3: Fix malformed packet sizing in vmxnet3_process_xdp (Daniel Borkmann)
  - usb: typec: class: Fix NULL pointer access (Andrei Kuchynski)
  - selftests/bpf: Adjust data size to have ETH_HLEN (Shigeru Yoshida)
  - selftests/bpf: check program redirect in xdp_cpumap_attach (Alexis Lothoré (eBPF Foundation))
  - selftests/bpf: make xdp_cpumap_attach keep redirect prog attached (Alexis Lothoré (eBPF Foundation))
  - selftests/bpf: fix bpf_map_redirect call for cpu map test (Alexis Lothoré (eBPF Foundation))
  - xfs: flush inodegc before swapon (Christoph Hellwig)
  - xfs: rename xfs_iomap_swapfile_activate to xfs_vm_swap_activate (Christoph Hellwig)
  - xfs: Do not allow norecovery mount with quotacheck (Carlos Maiolino)
  - xfs: do not check NEEDSREPAIR if ro,norecovery mount. (Lukas Herbolt)
  - driver core: fix potential NULL pointer dereference in dev_uevent() (Dmitry Torokhov)
  - driver core: introduce device_set_driver() helper (Dmitry Torokhov)
  - Revert "drivers: core: synchronize really_probe() and dev_uevent()" (Dmitry Torokhov)
  - spi: spi-imx: Add check for spi_imx_setupxfer() (Tamura Dai)
  - drm/amdgpu: Use the right function for hdp flush (Lijo Lazar)
  - drm/amdgpu: use a dummy owner for sysfs triggered cleaner shaders v4 (Christian König)
  - md/raid1: Add check for missing source disk in process_checks() (Meir Elisha)
  - x86/cpu: Add CPU model number for Bartlett Lake CPUs with Raptor Cove cores (Pi Xiange)
  - ubsan: Fix panic from test_ubsan_out_of_bounds (Mostafa Saleh)
  - spi: tegra210-quad: add rate limiting and simplify timeout error message (Breno Leitao)
  - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Breno Leitao)
  - ksmbd: fix WARNING "do not call blocking ops when !TASK_RUNNING" (Namjae Jeon)
  - riscv: Provide all alternative macros all the time (Andrew Jones)
  - iomap: skip unnecessary ifs_block_is_uptodate check (Gou Hao)
  - netfs: Only create /proc/fs/netfs with CONFIG_PROC_FS (Song Liu)
  - x86/i8253: Call clockevent_i8253_disable() with interrupts disabled (Fernando Fernandez Mancera)
  - ASoC: fsl_asrc_dma: get codec or cpu dai from backend (Shengjiu Wang)
  - scsi: pm80xx: Set phy_attached to zero when device is gone (Igor Pylypiv)
  - scsi: ufs: exynos: gs101: Put UFS device in reset on .suspend() (Peter Griffin)
  - scsi: ufs: exynos: Move phy calls to .exit() callback (Peter Griffin)
  - scsi: ufs: exynos: Enable PRDT pre-fetching with UFSHCD_CAP_CRYPTO (Peter Griffin)
  - scsi: ufs: exynos: Ensure pre_link() executes before exynos_ufs_phy_init() (Peter Griffin)
  - scsi: hisi_sas: Fix I/O errors caused by hardware port ID changes (Xingui Yang)
  - ext4: make block validity check resistent to sb bh corruption (Ojaswin Mujoo)
  - iommu: Clear iommu-dma ops on cleanup (Robin Murphy)
  - cifs: Fix querying of WSL CHR and BLK reparse points over SMB1 (Pali Rohár)
  - timekeeping: Add a lockdep override in tick_freeze() (Sebastian Andrzej Siewior)
  - cifs: Fix encoding of SMB1 Session Setup Kerberos Request in non-UNICODE mode (Pali Rohár)
  - nvmet-fc: put ref when assoc->del_work is already scheduled (Daniel Wagner)
  - nvmet-fc: take tgtport reference only once (Daniel Wagner)
  - x86/bugs: Don't fill RSB on context switch with eIBRS (Josh Poimboeuf)
  - x86/bugs: Don't fill RSB on VMEXIT with eIBRS+retpoline (Josh Poimboeuf)
  - x86/bugs: Use SBPB in write_ibpb() if applicable (Josh Poimboeuf)
  - selftests/mincore: Allow read-ahead pages to reach the end of the file (Qiuxu Zhuo)
  - x86/xen: disable CPU idle and frequency drivers for PVH dom0 (Roger Pau Monne)
  - gpiolib: of: Move Atmel HSMCI quirk up out of the regulator comment (Andy Shevchenko)
  - objtool: Stop UNRET validation on UD2 (Josh Poimboeuf)
  - nvme: multipath: fix return value of nvme_available_path (Uday Shankar)
  - nvme: re-read ANA log page after ns scan completes (Hannes Reinecke)
  - drm/xe/xe3lpg: Apply Wa_14022293748, Wa_22019794406 (Julia Filipchuk)
  - drm/amdgpu: Increase KIQ invalidate_tlbs timeout (Jay Cornwall)
  - ACPI PPTT: Fix coding mistakes in a couple of sizeof() calls (Jean-Marc Eurin)
  - ACPI: EC: Set ec_no_wakeup for Lenovo Go S (Mario Limonciello)
  - nvme: requeue namespace scan on missed AENs (Hannes Reinecke)
  - xen: Change xen-acpi-processor dom0 dependency (Jason Andryuk)
  - perf/core: Fix WARN_ON(!ctx) in __free_event() for partial init (Gabriel Shahrouzi)
  - selftests: ublk: fix test_stripe_04 (Ming Lei)
  - cgroup/cpuset: Don't allow creation of local partition over a remote one (Waiman Long)
  - KVM: s390: Don't use %pK through debug printing (Thomas Weißschuh)
  - KVM: s390: Don't use %pK through tracepoints (Thomas Weißschuh)
  - sched/isolation: Make CONFIG_CPU_ISOLATION depend on CONFIG_SMP (Oleg Nesterov)
  - kbuild: add dependency from vmlinux to sorttable (Xi Ruoyao)
  - io_uring: always do atomic put from iowq (Pavel Begunkov)
  - rtc: pcf85063: do a SW reset if POR failed (Lukas Stockmann)
  - 9p/trans_fd: mark concurrent read and writes to p9_conn->err (Ignacio Encinas)
  - 9p/net: fix improper handling of bogus negative read/write replies (Dominique Martinet)
  - ntb_hw_amd: Add NTB PCI ID for new gen CPU (Basavaraj Natikar)
  - ntb: reduce stack usage in idt_scan_mws (Arnd Bergmann)
  - qibfs: fix _another_ leak (Al Viro)
  - objtool, lkdtm: Obfuscate the do_nothing() pointer (Josh Poimboeuf)
  - objtool, regulator: rk808: Remove potential undefined behavior in rk806_set_mode_dcdc() (Josh Poimboeuf)
  - objtool, ASoC: codecs: wcd934x: Remove potential undefined behavior in wcd934x_slim_irq_handler() (Josh Poimboeuf)
  - objtool, panic: Disable SMAP in __stack_chk_fail() (Josh Poimboeuf)
  - objtool: Silence more KCOV warnings (Josh Poimboeuf)
  - um: work around sched_yield not yielding in time-travel mode (Benjamin Berg)
  - thunderbolt: Scan retimers after device router has been enumerated (Mika Westerberg)
  - usb: host: xhci-plat: mvebu: use ->quirks instead of ->init_quirk() func (Théo Lebrun)
  - usb: gadget: aspeed: Add NULL pointer check in ast_vhub_init_dev() (Chenyuan Yang)
  - phy: rockchip: usbdp: Avoid call hpd_event_trigger in dp_phy_init (Andy Yan)
  - usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running (Michal Pecio)
  - dmaengine: dmatest: Fix dmatest waiting less when interrupted (Vinicius Costa Gomes)
  - i3c: master: svc: Add support for Nuvoton npcm845 i3c (Stanley Chu)
  - xhci: Handle spurious events on Etron host isoc enpoints (Mathias Nyman)
  - usb: xhci: Fix isochronous Ring Underrun/Overrun event handling (Michal Pecio)
  - usb: xhci: Complete 'error mid TD' transfers when handling Missed Service (Michal Pecio)
  - sound/virtio: Fix cancel_sync warnings on uninitialized work_structs (John Stultz)
  - usb: dwc3: gadget: Avoid using reserved endpoints on Intel Merrifield (Andy Shevchenko)
  - usb: dwc3: gadget: Refactor loop to avoid NULL endpoints (Andy Shevchenko)
  - fs/ntfs3: Fix WARNING in ntfs_extend_initialized_size (Edward Adam Davis)
  - fs/ntfs3: Keep write operations atomic (Lizhi Xu)
  - usb: host: max3421-hcd: Add missing spi_device_id table (Alexander Stein)
  - mailbox: pcc: Always clear the platform ack interrupt first (Sudeep Holla)
  - mailbox: pcc: Fix the possible race in updation of chan_in_use flag (Huisong Li)
  - bpf: Reject attaching fexit/fmod_ret to __noreturn functions (Yafang Shao)
  - bpf: Only fails the busy counter check in bpf_cgrp_storage_get if it creates storage (Martin KaFai Lau)
  - bpf: bpftool: Setting error code in do_loader() (Sewon Nam)
  - s390/tty: Fix a potential memory leak bug (Haoxiang Li)
  - s390/sclp: Add check for get_zeroed_page() (Haoxiang Li)
  - parisc: PDT: Fix missing prototype warning (Yu-Chun Lin)
  - clk: check for disabled clock-provider in of_clk_get_hw_from_clkspec() (Heiko Stuebner)
  - bpf: Fix deadlock between rcu_tasks_trace and event_mutex. (Alexei Starovoitov)
  - bpf: Fix kmemleak warning for percpu hashmap (Yonghong Song)
  - crypto: null - Use spin lock instead of mutex (Herbert Xu)
  - crypto: lib/Kconfig - Fix lib built-in failure when arch is modular (Herbert Xu)
  - crypto: ccp - Add support for PCI device 0x1134 (Devaraj Rangasamy)
  - MIPS: cm: Detect CM quirks from device tree (Gregory CLEMENT)
  - pinctrl: mcp23s08: Get rid of spurious level interrupts (Dmitry Mastykin)
  - pinctrl: renesas: rza2: Fix potential NULL pointer dereference (Chenyuan Yang)
  - selftests/bpf: Fix stdout race condition in traffic monitor (Amery Hung)
  - USB: wdm: add annotation (Oliver Neukum)
  - USB: wdm: wdm_wwan_port_tx_complete mutex in atomic context (Oliver Neukum)
  - USB: wdm: close race between wdm_open and wdm_wwan_port_stop (Oliver Neukum)
  - USB: wdm: handle IO errors in wdm_wwan_port_start (Oliver Neukum)
  - USB: VLI disk crashes if LPM is used (Oliver Neukum)
  - usb: quirks: Add delay init quirk for SanDisk 3.2Gen1 Flash Drive (Miao Li)
  - usb: quirks: add DELAY_INIT quirk for Silicon Motion Flash Drive (Miao Li)
  - usb: dwc3: xilinx: Prevent spike in reset signal (Mike Looijmans)
  - usb: dwc3: gadget: check that event count does not exceed event buffer length (Frode Isaksen)
  - USB: OHCI: Add quirk for LS7A OHCI controller (rev 0x02) (Huacai Chen)
  - usb: chipidea: ci_hdrc_imx: implement usb_phy_init() error handling (Fedor Pchelkin)
  - usb: chipidea: ci_hdrc_imx: fix call balance of regulator routines (Fedor Pchelkin)
  - usb: chipidea: ci_hdrc_imx: fix usbmisc handling (Fedor Pchelkin)
  - usb: cdns3: Fix deadlock when using NCM gadget (Ralph Siemsen)
  - usb: xhci: Fix invalid pointer dereference in Etron workaround (Michal Pecio)
  - xhci: Limit time spent with xHC interrupts disabled during bus resume (Mathias Nyman)
  - USB: serial: simple: add OWON HDS200 series oscilloscope support (Craig Hesling)
  - USB: serial: option: add Sierra Wireless EM9291 (Adam Xue)
  - USB: serial: ftdi_sio: add support for Abacus Electrics Optical Probe (Michael Ehrenreich)
  - serial: sifive: lock port in startup()/shutdown() callbacks (Ryo Takakura)
  - serial: msm: Configure correct working mode before starting earlycon (Stephan Gerhold)
  - tty: Require CAP_SYS_ADMIN for all usages of TIOCL_SELMOUSEREPORT (Günther Noack)
  - firmware: stratix10-svc: Add of_platform_default_populate() (Mahesh Rao)
  - misc: microchip: pci1xxxx: Fix incorrect IRQ status handling during ack (Rengarajan S)
  - misc: microchip: pci1xxxx: Fix Kernel panic during IRQ handler registration (Rengarajan S)
  - char: misc: register chrdev region with all possible minors (Thadeu Lima de Souza Cascardo)
  - KVM: x86: Take irqfds.lock when adding/deleting IRQ bypass producer (Sean Christopherson)
  - KVM: x86: Reset IRTE to host control if *new* route isn't postable (Sean Christopherson)
  - KVM: x86: Explicitly treat routing entry type changes as changes (Sean Christopherson)
  - mei: vsc: Fix fortify-panic caused by invalid counted_by() use (Hans de Goede)
  - mei: me: add panther lake H DID (Alexander Usyskin)
  - scsi: Improve CDL control (Damien Le Moal)
  - USB: storage: quirk for ADATA Portable HDD CH94 (Oliver Neukum)
  - ata: libata-scsi: Fix ata_msense_control_ata_feature() (Damien Le Moal)
  - ata: libata-scsi: Fix ata_mselect_control_ata_feature() return type (Damien Le Moal)
  - ata: libata-scsi: Improve CDL control (Damien Le Moal)
  - mcb: fix a double free bug in chameleon_parse_gdd() (Haoxiang Li)
  - cxl/core/regs.c: Skip Memory Space Enable check for RCD and RCH Ports (Smita Koralahalli)
  - KVM: SVM: Allocate IR data using atomic allocation (Sean Christopherson)
  - io_uring: fix 'sync' handling of io_fallback_tw() (Jens Axboe)
  - LoongArch: KVM: Fix PMU pass-through issue if VM exits to host finally (Bibo Mao)
  - LoongArch: KVM: Fully clear some CSRs when VM reboot (Bibo Mao)
  - LoongArch: Remove a bogus reference to ZONE_DMA (Petr Tesarik)
  - LoongArch: Return NULL from huge_pte_offset() for invalid PMD (Ming Wang)
  - LoongArch: Handle fp, lsx, lasx and lbt assembly symbols (Tiezhu Yang)
  - irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode() (Suzuki K Poulose)
  - x86/insn: Fix CTEST instruction decoding (Kirill A. Shutemov)
  - drm/amd/display: Force full update in gpu reset (Roman Li)
  - drm/amd/display: Fix gpu reset in multidisplay config (Roman Li)
  - drm: panel: jd9365da: fix reset signal polarity in unprepare (Hugo Villeneuve)
  - rust: firmware: Use `ffi::c_char` type in `FwFunc` (Christian Schrefl)
  - net: phy: microchip: force IRQ polling mode for lan88xx (Fiona Klute)
  - net: selftests: initialize TCP header and skb payload with zero (Oleksij Rempel)
  - xen-netfront: handle NULL returned by xdp_convert_buff_to_frame() (Alexey Nepomnyashih)
  - crypto: atmel-sha204a - Set hwrng quality to lowest possible (Marek Behún)
  - sched_ext: Use kvzalloc for large exit_dump allocation (Breno Leitao)
  - virtio_console: fix missing byte order handling for cols and rows (Halil Pasic)
  - netfilter: fib: avoid lookup if socket is available (Florian Westphal)
  - LoongArch: Make do_xyz() exception handlers more robust (Tiezhu Yang)
  - LoongArch: Make regs_irqs_disabled() more clear (Tiezhu Yang)
  - LoongArch: Select ARCH_USE_MEMTEST (Yuli Wang)
  - perf/x86: Fix non-sampling (counting) events on certain x86 platforms (Luo Gengkun)
  - bpf: Add namespace to BPF internal symbols (Alexei Starovoitov)
  - splice: remove duplicate noinline from pipe_clear_nowait (T.J. Mercier)
  - riscv: uprobes: Add missing fence.i after building the XOL buffer (Björn Töpel)
  - riscv: Replace function-like macro by static inline function (Björn Töpel)
  - iommu/amd: Return an error if vCPU affinity is set for non-vCPU IRTE (Sean Christopherson)
  - block: never reduce ra_pages in blk_apply_bdi_limits (Christoph Hellwig)
  - pds_core: make wait_context part of q_info (Shannon Nelson)
  - pds_core: Remove unnecessary check in pds_client_adminq_cmd() (Brett Creeley)
  - pds_core: handle unsupported PDS_CORE_CMD_FW_CONTROL result (Brett Creeley)
  - pds_core: Prevent possible adminq overflow/stuck condition (Brett Creeley)
  - net: dsa: mt7530: sync driver-specific behavior of MT7531 variants (Daniel Golle)
  - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (Cong Wang)
  - net_sched: hfsc: Fix a UAF vulnerability in class handling (Cong Wang)
  - fix a couple of races in MNT_TREE_BENEATH handling by do_move_mount() (Al Viro)
  - net: ethernet: mtk_eth_soc: net: revise NETSYSv3 hardware configuration (Bo-Cun Chen)
  - tipc: fix NULL pointer dereference in tipc_mon_reinit_self() (Tung Nguyen)
  - net: phy: leds: fix memory leak (Qingfang Deng)
  - net: lwtunnel: disable BHs when required (Justin Iurman)
  - scsi: ufs: core: Add NULL check in ufshcd_mcq_compl_pending_transfer() (Chenyuan Yang)
  - scsi: core: Clear flags for scsi_cmnd that did not complete (Anastasia Kovaleva)
  - net/mlx5: Move ttc allocation after switch case to prevent leaks (Henry Martin)
  - net/mlx5: Fix null-ptr-deref in mlx5_create_{inner_,}ttc_table() (Henry Martin)
  - cgroup/cpuset-v1: Add missing support for cpuset_v2_mode (T.J. Mercier)
  - btrfs: zoned: return EIO on RAID1 block group write pointer mismatch (Johannes Thumshirn)
  - btrfs: avoid page_lockend underflow in btrfs_punch_hole_lock_range() (Qu Wenruo)
  - cpufreq: fix compile-test defaults (Johan Hovold)
  - cpufreq: Do not enable by default during compile testing (Krzysztof Kozlowski)
  - cpufreq: cppc: Fix invalid return value in .get() callback (Marc Zyngier)
  - scsi: ufs: mcq: Add NULL check in ufshcd_mcq_abort() (Chenyuan Yang)
  - cpufreq: scpi: Fix null-ptr-deref in scpi_cpufreq_get_rate() (Henry Martin)
  - cpufreq: scmi: Fix null-ptr-deref in scmi_cpufreq_get_rate() (Henry Martin)
  - cpufreq: apple-soc: Fix null-ptr-deref in apple_soc_cpufreq_get_rate() (Henry Martin)
  - dma/contiguous: avoid warning about unused size_bytes (Arnd Bergmann)
  - cpufreq: sun50i: prevent out-of-bounds access (Andre Przywara)
  - ceph: Fix incorrect flush end position calculation (David Howells)
  - lib/Kconfig.ubsan: Remove 'default UBSAN' from UBSAN_INTEGER_WRAP (Nathan Chancellor)
  - drm/amd/display/dml2: use vzalloc rather than kzalloc (Alex Deucher)
  - drm/amd/display: Fix unnecessary cast warnings from checkpatch (Rohit Chavan)
  - drm/xe/bmg: Add one additional PCI ID (Matt Roper)
  - net/niu: Niu requires MSIX ENTRY_DATA fields touch before entry reads (Jonathan Currier)
  - scsi: ufs: exynos: Disable iocc if dma-coherent property isn't set (Peter Griffin)
  - scsi: ufs: exynos: Move UFS shareability value to drvdata (Peter Griffin)
  - scsi: ufs: exynos: Add gs101_ufs_drv_init() hook and enable WriteBooster (Peter Griffin)
  - scsi: ufs: exynos: Remove superfluous function parameter (Tudor Ambarus)
  - scsi: ufs: exynos: Remove empty drv_init method (Tudor Ambarus)
  - ksmbd: fix use-after-free in __smb2_lease_break_noti() (Namjae Jeon)
  - ksmbd: browse interfaces list on FSCTL_QUERY_INTERFACE_INFO IOCTL (Namjae Jeon)
  - ksmbd: add netdev-up/down event debug print (Namjae Jeon)
  - ksmbd: use __GFP_RETRY_MAYFAIL (Namjae Jeon)
  - accel/ivpu: Fix the NPU's DPU frequency calculation (Andrzej Kacprowski)
  - accel/ivpu: Add auto selection logic for job scheduler (Jacek Lawrynowicz)
  - PCI/MSI: Add an option to write MSIX ENTRY_DATA before any reads (Jonathan Currier)
  - PCI/MSI: Handle the NOMASK flag correctly for all PCI/MSI backends (Thomas Gleixner)
  - PCI/MSI: Convert pci_msi_ignore_mask to per MSI domain flag (Roger Pau Monne)
  - scsi: ufs: qcom: fix dev reference leaked through of_qcom_ice_get (Tudor Ambarus)
  - of: resolver: Fix device node refcount leakage in of_resolve_phandles() (Zijun Hu)
  - of: resolver: Simplify of_resolve_phandles() using __free() (Rob Herring (Arm))
  - arm64: dts: ti: k3-j784s4-j742s2-main-common: Fix serdes_ln_ctrl reg-masks (Siddharth Vadapalli)
  - arm64: dts: ti: Refactor J784s4 SoC files to a common file (Manorit Chawdhry)
  - iio: adc: ad7768-1: Fix conversion result sign (Sergiu Cuciurean)
  - iio: adc: ad7768-1: Move setting of val a bit later to avoid unnecessary return value check (Jonathan Cameron)
  - net: dsa: mv88e6xxx: fix VTU methods for 6320 family (Marek Behún)
  - media: ov08x40: Add missing ov08x40_identify_module() call on stream-start (Hans de Goede)
  - media: ov08x40: Move ov08x40_identify_module() function up (Hans de Goede)
  - media: i2c: imx214: Fix link frequency validation (André Apitzsch)
  - media: i2c: imx214: Check number of lanes from device tree (André Apitzsch)
  - media: i2c: imx214: Replace register addresses with macros (André Apitzsch)
  - media: i2c: imx214: Convert to CCI register access helpers (André Apitzsch)
  - media: i2c: imx214: Simplify with dev_err_probe() (André Apitzsch)
  - media: i2c: imx214: Use subdev active state (André Apitzsch)
  - PM: EM: Address RCU-related sparse warnings (Rafael J. Wysocki)
  - PM: EM: use kfree_rcu() to simplify the code (Li RongQing)
  - mmc: sdhci-msm: fix dev reference leaked through of_qcom_ice_get (Tudor Ambarus)
  - soc: qcom: ice: introduce devm_of_qcom_ice_get (Tudor Ambarus)
  - mm/vmscan: don't try to reclaim hwpoison folio (Jinjiang Tu)
  - tracing: Verify event formats that have "%*p.." (Steven Rostedt)
  - tracing: Add __print_dynamic_array() helper (Steven Rostedt)
  - module: sign with sha512 instead of sha1 by default (Thorsten Leemhuis)
  - LTS version: v6.12.25 (Jack Vogel)
  - selftests/bpf: extend changes_pkt_data with cases w/o subprograms (Eduard Zingerman)
  - bpf: fix null dereference when computing changes_pkt_data of prog w/o subprogs (Eduard Zingerman)
  - selftests/bpf: validate that tail call invalidates packet pointers (Eduard Zingerman)
  - selftests/bpf: freplace tests for tracking of changes_packet_data (Eduard Zingerman)
  - bpf: check changes_pkt_data property for extension programs (Eduard Zingerman)
  - selftests/bpf: test for changing packet data from global functions (Eduard Zingerman)
  - bpf: track changes_pkt_data property for global functions (Eduard Zingerman)
  - bpf: add find_containing_subprog() utility function (Eduard Zingerman)
  - wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process (P Praneesh)
  - MIPS: ds1287: Match ds1287_set_base_clock() function types (WangYuli)
  - MIPS: cevt-ds1287: Add missing ds1287.h include (WangYuli)
  - MIPS: dec: Declare which_prom() as static (WangYuli)
  - Revert "wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process" (Alexander Tsoy)
  - mm/vma: add give_up_on_oom option on modify/merge, use in uffd release (Lorenzo Stoakes)
  - nvmet-fc: Remove unused functions (WangYuli)
  - drm/amd/display: Temporarily disable hostvm on DCN31 (Aurabindo Pillai)
  - LoongArch: Eliminate superfluous get_numa_distances_cnt() (Yuli Wang)
  - efi/libstub: Bump up EFI_MMAP_NR_SLACK_SLOTS to 32 (Hamza Mahfooz)
  - misc: pci_endpoint_test: Fix 'irq_type' to convey the correct type (Kunihiko Hayashi)
  - misc: pci_endpoint_test: Avoid issue of interrupts remaining after request_irq error (Kunihiko Hayashi)
  - selftests/bpf: Fix raw_tp null handling test (Shung-Hsi Yu)
  - md: fix mddev uaf while iterating all_mddevs list (Yu Kuai)
  - platform/x86: msi-wmi-platform: Workaround a ACPI firmware bug (Armin Wolf)
  - platform/x86: msi-wmi-platform: Rename "data" variable (Armin Wolf)
  - kbuild: Add '-fno-builtin-wcslen' (Nathan Chancellor)
  - scripts: generate_rust_analyzer: Add ffi crate (Lukas Fischer)
  - cpufreq: Reference count policy in cpufreq_update_limits() (Rafael J. Wysocki)
  - arm64/boot: Enable EL2 requirements for FEAT_PMUv3p9 (Anshuman Khandual)
  - arm64/sysreg: Add register fields for HFGWTR2_EL2 (Anshuman Khandual)
  - arm64/sysreg: Add register fields for HFGRTR2_EL2 (Anshuman Khandual)
  - arm64/sysreg: Add register fields for HFGITR2_EL2 (Anshuman Khandual)
  - arm64/sysreg: Add register fields for HDFGWTR2_EL2 (Anshuman Khandual)
  - arm64/sysreg: Add register fields for HDFGRTR2_EL2 (Anshuman Khandual)
  - arm64/sysreg: Update register fields for ID_AA64MMFR0_EL1 (Anshuman Khandual)
  - drm/mgag200: Fix value in <VBLKSTR> register (Thomas Zimmermann)
  - drm/amdgpu: fix warning of drm_mm_clean (ZhenGuo Yin)
  - drm/xe: Set LRC addresses before guc load (Lucas De Marchi)
  - drm/xe/userptr: fix notifier vs folio deadlock (Matthew Auld)
  - drm/xe/dma_buf: stop relying on placement in unmap (Matthew Auld)
  - drm/amd/display: Add HP Probook 445 and 465 to the quirk list for eDP on DP1 (Mario Limonciello)
  - drm/amd/display: Protect FPU in dml2_init()/dml21_init() (Huacai Chen)
  - drm/amd/display: Do not enable Replay and PSR while VRR is on in amdgpu_dm_commit_planes() (Tom Chung)
  - drm/amdgpu: immediately use GTT for new allocations (Christian König)
  - drm/i915/gvt: fix unterminated-string-initialization warning (Jani Nikula)
  - drm/xe: Fix an out-of-bounds shift when invalidating TLB (Thomas Hellström)
  - drm/sti: remove duplicate object names (Rolf Eike Beer)
  - drm/imagination: take paired job reference (Brendan King)
  - drm/imagination: fix firmware memory leaks (Brendan King)
  - drm/nouveau: prime: fix ttm_bo_delayed_delete oops (Chris Bainbridge)
  - drm/amdgpu/dma_buf: fix page_link check (Matthew Auld)
  - drm/amdgpu/mes11: optimize MES pipe FW version fetching (Alex Deucher)
  - drm/amd/display: Protect FPU in dml21_copy() (Huacai Chen)
  - drm/amd/display: Protect FPU in dml2_validate()/dml21_validate() (Huacai Chen)
  - drm/amd/display: Add HP Elitebook 645 to the quirk list for eDP on DP1 (Mario Limonciello)
  - drm/xe: Use local fence in error path of xe_migrate_clear (Matthew Brost)
  - drm/i915/vrr: Add vrr.vsync_{start, end} in vrr_params_changed (Ankit Nautiyal)
  - drm/amdgpu/mes12: optimize MES pipe FW version fetching (Alex Deucher)
  - drm/amd/pm/powerplay/hwmgr/vega20_thermal: Prevent division by zero (Denis Arefev)
  - drm/amd/pm/swsmu/smu13/smu_v13_0: Prevent division by zero (Denis Arefev)
  - drm/amd/pm/powerplay/hwmgr/smu7_thermal: Prevent division by zero (Denis Arefev)
  - drm/amd/pm/smu11: Prevent division by zero (Denis Arefev)
  - drm/amd/pm/powerplay: Prevent division by zero (Denis Arefev)
  - drm/amd/pm: Prevent division by zero (Denis Arefev)
  - drm/amd/display: Increase vblank offdelay for PSR panels (Leo Li)
  - drm/amd/display: Actually do immediate vblank disable (Leo Li)
  - drm/amd: Handle being compiled without SI or CIK support better (Mario Limonciello)
  - drm/amd/display: prevent hang on link training fail (Brendan Tam)
  - drm/amdgpu: Prefer shadow rom when available (Lijo Lazar)
  - drm/msm/a6xx: Fix stale rpmh votes from GPU (Akhil P Oommen)
  - drm/msm/dsi: Add check for devm_kstrdup() (Haoxiang Li)
  - drm/ast: Fix ast_dp connection status (Jocelyn Falempe)
  - drm/repaper: fix integer overflows in repeat functions (Nikita Zhandarovich)
  - perf/x86/intel/uncore: Fix the scale of IIO free running counters on SPR (Kan Liang)
  - perf/x86/intel/uncore: Fix the scale of IIO free running counters on ICX (Kan Liang)
  - perf/x86/intel/uncore: Fix the scale of IIO free running counters on SNR (Kan Liang)
  - perf/x86/intel: Allow to update user space GPRs from PEBS records (Dapeng Mi)
  - platform/x86: amd: pmf: Fix STT limits (Mario Limonciello)
  - RAS/AMD/FMPM: Get masked address (Yazen Ghannam)
  - RAS/AMD/ATL: Include row[13] bit in row retirement (Yazen Ghannam)
  - scsi: ufs: exynos: Ensure consistent phy reference counts (Peter Griffin)
  - scsi: megaraid_sas: Block zero-length ATA VPD inquiry (Chandrakanth Patil)
  - x86/boot/sev: Avoid shared GHCB page for early memory acceptance (Ard Biesheuvel)
  - x86/cpu/amd: Fix workaround for erratum 1054 (Sandipan Das)
  - x86/microcode/AMD: Extend the SHA check to Zen5, block loading of any unreleased standalone Zen5 microcode patches (Borislav Petkov (AMD))
  - virtiofs: add filesystem context source name check (Xiangsheng Hou)
  - tracing: Fix filter string testing (Steven Rostedt)
  - string: Add load_unaligned_zeropad() code path to sized_strscpy() (Peter Collingbourne)
  - smb3 client: fix open hardlink on deferred close file error (Chunjie Zhu)
  - slab: ensure slab->obj_exts is clear in a newly allocated slab page (Suren Baghdasaryan)
  - selftests/mm: generate a temporary mountpoint for cgroup filesystem (Mark Brown)
  - riscv: Avoid fortify warning in syscall_get_arguments() (Nathan Chancellor)
  - Revert "smb: client: fix TCP timers deadlock after rmmod" (Kuniyuki Iwashima)
  - Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free" (Kuniyuki Iwashima)
  - ksmbd: fix the warning from __kernel_write_iter (Namjae Jeon)
  - ksmbd: Prevent integer overflow in calculation of deadtime (Denis Arefev)
  - ksmbd: fix use-after-free in smb_break_all_levII_oplock() (Namjae Jeon)
  - ksmbd: Fix dangling pointer in krb_authenticate (Sean Heelan)
  - ovl: don't allow datadir only (Miklos Szeredi)
  - mm: fix apply_to_existing_page_range() (Kirill A. Shutemov)
  - mm: fix filemap_get_folios_contig returning batches of identical folios (Vishal Moola (Oracle))
  - mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Baoquan He)
  - mm/compaction: fix bug in hugetlb handling pathway (Vishal Moola (Oracle))
  - loop: LOOP_SET_FD: send uevents for partitions (Thomas Weißschuh)
  - loop: properly send KOBJ_CHANGED uevent for disk device (Thomas Weißschuh)
  - isofs: Prevent the use of too small fid (Edward Adam Davis)
  - i2c: cros-ec-tunnel: defer probe if parent EC is not present (Thadeu Lima de Souza Cascardo)
  - hfs/hfsplus: fix slab-out-of-bounds in hfs_bnode_read_key (Vasiliy Kovalev)
  - crypto: caam/qi - Fix drv_ctx refcount bug (Herbert Xu)
  - cpufreq/sched: Explicitly synchronize limits_changed flag handling (Rafael J. Wysocki)
  - btrfs: correctly escape subvol in btrfs_show_options() (Johannes Kimmel)
  - Bluetooth: vhci: Avoid needless snprintf() calls (Kees Cook)
  - Bluetooth: l2cap: Process valid commands in too long frame (Frédéric Danis)
  - drm/msm/a6xx+: Don't let IB_SIZE overflow (Rob Clark)
  - ftrace: fix incorrect hash size in register_ftrace_direct() (Menglong Dong)
  - i2c: atr: Fix wrong include (Andy Shevchenko)
  - nfsd: decrease sc_count directly if fail to queue dl_recall (Li Lingfeng)
  - nfs: add missing selections of CONFIG_CRC32 (Eric Biggers)
  - dma-buf/sw_sync: Decrement refcount on error in sw_sync_ioctl_get_deadline() (Dan Carpenter)
  - drm/v3d: Fix Indirect Dispatch configuration for V3D 7.1.6 and later (Maíra Canal)
  - block: integrity: Do not call set_page_dirty_lock() (Martin K. Petersen)
  - asus-laptop: Fix an uninitialized variable (Denis Arefev)
  - ASoC: qcom: Fix sc7280 lpass potential buffer overflow (Evgeny Pimenov)
  - ASoC: Intel: sof_sdw: Add quirk for Asus Zenbook S16 (Peter Ujfalusi)
  - ASoC: codecs:lpass-wsa-macro: Fix logic of enabling vi channels (Srinivas Kandagatla)
  - ASoC: codecs:lpass-wsa-macro: Fix vi feedback rate (Srinivas Kandagatla)
  - ASoC: fsl: fsl_qmc_audio: Reset audio data pointers on TRIGGER_START event (Herve Codina)
  - Revert "PCI: Avoid reset when disabled via sysfs" (Alex Williamson)
  - writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher)
  - rust: kbuild: use `pound` to support GNU Make < 4.3 (Miguel Ojeda)
  - rust: disable `clippy::needless_continue` (Miguel Ojeda)
  - rust: kasan/kbuild: fix missing flags on first build (Miguel Ojeda)
  - objtool/rust: add one more `noreturn` Rust function for Rust 1.86.0 (Miguel Ojeda)
  - cpufreq/sched: Fix the usage of CPUFREQ_NEED_UPDATE_LIMITS (Rafael J. Wysocki)
  - riscv: KGDB: Remove ".option norvc/.option rvc" for kgdb_compiled_break (WangYuli)
  - riscv: KGDB: Do not inline arch_kgdb_breakpoint() (WangYuli)
  - kunit: qemu_configs: SH: Respect kunit cmdline (Thomas Weißschuh)
  - riscv: module: Allocate PLT entries for R_RISCV_PLT32 (Samuel Holland)
  - riscv: module: Fix out-of-bounds relocation access (Samuel Holland)
  - riscv: Properly export reserved regions in /proc/iomem (Björn Töpel)
  - riscv: Use kvmalloc_array on relocation_hashtable (Will Pierce)
  - net: ethernet: mtk_eth_soc: revise QDMA packet scheduler settings (Bo-Cun Chen)
  - net: ethernet: mtk_eth_soc: correct the max weight of the queue limit for 100Mbps (Bo-Cun Chen)
  - net: ethernet: mtk_eth_soc: reapply mdc divider on reset (Bo-Cun Chen)
  - net: ti: icss-iep: Fix possible NULL pointer dereference for perout request (Meghana Malladi)
  - net: ti: icss-iep: Add phase offset configuration for perout signal (Meghana Malladi)
  - net: ti: icss-iep: Add pwidth configuration for perout signal (Meghana Malladi)
  - ptp: ocp: fix start time alignment in ptp_ocp_signal_set (Sagi Maimon)
  - net: dsa: avoid refcount warnings when ds->ops->tag_8021q_vlan_del() fails (Vladimir Oltean)
  - net: dsa: free routing table on probe failure (Vladimir Oltean)
  - net: dsa: clean up FDB, MDB, VLAN entries on unbind (Vladimir Oltean)
  - net: dsa: mv88e6xxx: fix -ENOENT when deleting VLANs and MST is unsupported (Vladimir Oltean)
  - net: dsa: mv88e6xxx: avoid unregistering devlink regions which were never registered (Vladimir Oltean)
  - net: txgbe: fix memory leak in txgbe_probe() error path (Abdun Nihaal)
  - net: bridge: switchdev: do not notify new brentries as changed (Jonas Gorski)
  - net: b53: enable BPDU reception for management port (Jonas Gorski)
  - netlink: specs: rt-link: adjust mctp attribute naming (Jakub Kicinski)
  - netlink: specs: rt-link: add an attr layer around alt-ifname (Jakub Kicinski)
  - cxgb4: fix memory leak in cxgb4_init_ethtool_filters() error path (Abdun Nihaal)
  - ata: libata-sata: Save all fields from sense data descriptor (Niklas Cassel)
  - loop: stop using vfs_iter_{read,write} for buffered I/O (Christoph Hellwig)
  - loop: aio inherit the ioprio of original request (Yunlong Xing)
  - eth: bnxt: fix missing ring index trim on error path (Jakub Kicinski)
  - net: ethernet: ti: am65-cpsw: fix port_np reference counting (Michael Walle)
  - net: ngbe: fix memory leak in ngbe_probe() error path (Abdun Nihaal)
  - can: rockchip_canfd: fix broken quirks checks (Weizhao Ouyang)
  - net: openvswitch: fix nested key length validation in the set() action (Ilya Maximets)
  - netlink: specs: ovs_vport: align with C codegen capabilities (Jakub Kicinski)
  - block: fix resource leak in blk_register_queue() error path (Zheng Qixing)
  - net: mctp: Set SOCK_RCU_FREE (Matt Johnston)
  - ethtool: cmis_cdb: use correct rpl size in ethtool_cmis_module_poll() (Damodharam Ammepalli)
  - pds_core: fix memory leak in pdsc_debugfs_add_qcq() (Abdun Nihaal)
  - test suite: use %zu to print size_t (Matthew Wilcox (Oracle))
  - smc: Fix lockdep false-positive for IPPROTO_SMC. (Kuniyuki Iwashima)
  - dt-bindings: soc: fsl: fsl,ls1028a-reset: Fix maintainer entry (Geert Uytterhoeven)
  - igc: add lock preventing multiple simultaneous PTM transactions (Christopher S M Hall)
  - igc: cleanup PTP module if probe fails (Christopher S M Hall)
  - igc: handle the IGC_PTP_ENABLED flag correctly (Christopher S M Hall)
  - igc: move ktime snapshot into PTM retry loop (Christopher S M Hall)
  - igc: increase wait time before retrying PTM (Christopher S M Hall)
  - igc: fix PTM cycle trigger logic (Christopher S M Hall)
  - Revert "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" (Johannes Berg)
  - xen: fix multicall debug feature (Juergen Gross)
  - ipv6: add exception routes to GC list in rt6_insert_exception (Xin Long)
  - Bluetooth: l2cap: Check encryption key size on incoming connection (Frédéric Danis)
  - Bluetooth: btrtl: Prevent potential NULL dereference (Dan Carpenter)
  - Bluetooth: hci_event: Fix sending MGMT_EV_DEVICE_FOUND for invalid address (Luiz Augusto von Dentz)
  - RDMA/core: Silence oversized kvmalloc() warning (Shay Drory)
  - ASoC: cs42l43: Reset clamp override on jack removal (Charles Keepax)
  - ALSA: hda/realtek - Fixed ASUS platform headset Mic issue (Kailang Yang)
  - ALSA: hda/realtek: Workaround for resume on Dell Venue 11 Pro 7130 (Takashi Iwai)
  - ALSA: hda: improve bass speaker support for ASUS Zenbook UM5606WA (Jaroslav Kysela)
  - ALSA: hda/cirrus_scodec_test: Don't select dependencies (Richard Fitzgerald)
  - RDMA/hns: Fix wrong maximum DMA segment size (Chengchang Tang)
  - RDMA/usnic: Fix passing zero to PTR_ERR in usnic_ib_pci_probe() (Yue Haibing)
  - ovl: remove unused forward declaration (Giuseppe Scrivano)
  - crypto: tegra - Fix IV usage for AES ECB (Akhil R)
  - crypto: tegra - Do not use fixed size buffers (Akhil R)
  - crypto: tegra - remove redundant error check on ret (Colin Ian King)
  - ASoC: Intel: avs: Fix null-ptr-deref in avs_component_probe() (Henry Martin)
  - ASoC: dwc: always enable/disable i2s irqs (Brady Norander)
  - md/md-bitmap: fix stats collection for external bitmaps (Zheng Qixing)
  - md/raid10: fix missing discard IO accounting (Yu Kuai)
  - scsi: iscsi: Fix missing scsi_host_put() in error path (Miaoqian Lin)
  - wifi: wl1251: fix memory leak in wl1251_tx_work (Abdun Nihaal)
  - wifi: mac80211: Purge vif txq in ieee80211_do_stop() (Remi Pommarel)
  - wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue() (Remi Pommarel)
  - wifi: at76c50x: fix use after free access in at76_disconnect (Abdun Nihaal)
  - scsi: hisi_sas: Enable force phy when SATA disk directly connected (Xingui Yang)
  - aarch64: increase DEFAULT_CRASH_KERNEL_LOW_SIZE for kdump (Brian Maly)  [Orabug: 37446372]
  - vhost-scsi: Fix vhost_scsi_send_status() (Dongli Zhang)  [Orabug: 37840543]
  - vhost-scsi: Fix vhost_scsi_send_bad_target() (Dongli Zhang)  [Orabug: 37840543]
  - vhost-scsi: protect vq->log_used with vq->mutex (Dongli Zhang)  [Orabug: 37840543]
  - vhost-scsi: Reduce response iov mem use (Mike Christie)  [Orabug: 37840543]
  - vhost-scsi: Allocate iov_iter used for unaligned copies when needed (Mike Christie)  [Orabug: 37840543]
  - vhost-scsi: Stop duplicating se_cmd fields (Mike Christie)  [Orabug: 37840543]
  - vhost-scsi: Dynamically allocate scatterlists (Mike Christie)  [Orabug: 37840543]
  - vhost-scsi: Return queue full for page alloc failures during copy (Mike Christie)  [Orabug: 37840543]
  - vhost-scsi: Add better resource allocation failure handling (Mike Christie)  [Orabug: 37840543]
  - vhost-scsi: Allocate T10 PI structs only when enabled (Mike Christie)  [Orabug: 37840543]
  - vhost-scsi: Reduce mem use by moving upages to per queue (Mike Christie)  [Orabug: 37840543]
  - Revert "vhost-scsi: protect vq->log_base with vq->mutex" (Mike Christie)  [Orabug: 37840543]
  - Revert "vhost_scsi: log write descriptors" (Mike Christie)  [Orabug: 37840543]
  - scsi: mpi3mr: Event processing debug improvement (Ranjan Kumar)  [Orabug: 37878021]
  - scsi: mpi3mr: Add level check to control event logging (Ranjan Kumar)  [Orabug: 37878021]
  - scsi: mpi3mr: Reset the pending interrupt flag (Ranjan Kumar)  [Orabug: 37878021]
  - scsi: mpi3mr: Fix pending I/O counter (Ranjan Kumar)  [Orabug: 37878021]


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-2.28.3.el9uek]
changelog:
  - LTS version: v6.12.28 (Jack Vogel)
  - dm: fix copying after src array boundaries (Tudor Ambarus)
  - drm/amd/display: Fix slab-use-after-free in hdcp (Chris Bainbridge)
  - drm/amd/display: Add scoped mutexes for amdgpu_dm_dhcp (Mario Limonciello)
  - drivers: base: handle module_kobject creation (Shyam Saini)
  - kernel: globalize lookup_or_create_module_kobject() (Shyam Saini)
  - kernel: param: rename locate_module_kobject (Shyam Saini)
  - Revert "drm/meson: vclk: fix calculation of 59.94 fractional rates" (Christian Hewitt)
  - arm64: dts: st: Use 128kB size for aliased GIC400 register access on stm32mp25 SoCs (Christian Bruel)
  - arm64: dts: st: Adjust interrupt-controller for stm32mp25 SoCs (Christian Bruel)
  - ARM: dts: opos6ul: add ksz8081 phy properties (Sébastien Szymanski)
  - arm64: dts: imx95: Correct the range of PCIe app-reg region (Richard Zhu)
  - firmware: arm_ffa: Skip Rx buffer ownership release if not acquired (Sudeep Holla)
  - firmware: arm_scmi: Balance device refcount when destroying devices (Cristian Marussi)
  - drm/xe: Ensure fixed_slice_mode gets set after ccs_mode change (Niranjana Vishwanathapura)
  - sch_ets: make est_qlen_notify() idempotent (Cong Wang)
  - sch_qfq: make qfq_qlen_notify() idempotent (Cong Wang)
  - sch_hfsc: make hfsc_qlen_notify() idempotent (Cong Wang)
  - sch_drr: make drr_qlen_notify() idempotent (Cong Wang)
  - sch_htb: make htb_qlen_notify() idempotent (Cong Wang)
  - accel/ivpu: Add handling of VPU_JSM_STATUS_MVNCI_CONTEXT_VIOLATION_HW (Karol Wachowski)
  - accel/ivpu: Fix locking order in ivpu_job_submit (Karol Wachowski)
  - accel/ivpu: Abort all jobs after command queue unregister (Karol Wachowski)
  - accel/ivpu: Update VPU FW API headers (Andrzej Kacprowski)
  - accel/ivpu: Fix a typo (Andrew Kreimer)
  - accel/ivpu: Use xa_alloc_cyclic() instead of custom function (Karol Wachowski)
  - accel/ivpu: Make DB_ID and JOB_ID allocations incremental (Tomasz Rusinowicz)
  - net: Fix the devmem sock opts and msgs for parisc (Pranjal Shrivastava)
  - bcachefs: Remove incorrect __counted_by annotation (Alan Huang)
  - mm, slab: clean up slab->obj_exts always (Zhenhua Huang)
  - net: vertexcom: mse102x: Fix RX error handling (Stefan Wahren)
  - net: vertexcom: mse102x: Add range check for CMD_RTS (Stefan Wahren)
  - net: vertexcom: mse102x: Fix LEN_MASK (Stefan Wahren)
  - net: vertexcom: mse102x: Fix possible stuck of SPI interrupt (Stefan Wahren)
  - net: hns3: defer calling ptp_clock_register() (Jian Shen)
  - net: hns3: fixed debugfs tm_qset size (Hao Lan)
  - net: hns3: fix an interrupt residual problem (Yonglong Liu)
  - net: hns3: store rx VLAN tag offload state for VF (Jian Shen)
  - octeon_ep: Fix host hang issue during device reboot (Sathesh B Edara)
  - net: fec: ERR007885 Workaround for conventional TX (Mattias Barthel)
  - net: lan743x: Fix memleak issue when GSO enabled (Thangaraj Samynathan)
  - ptp: ocp: Fix NULL dereference in Adva board SMA sysfs operations (Sagi Maimon)
  - net: use sock_gen_put() when sk_state is TCP_TIME_WAIT (Jibin Zhang)
  - bnxt_en: fix module unload sequence (Vadim Fedorenko)
  - ASoC: simple-card-utils: Fix pointer check in graph_util_parse_link_direction (Alexander Stein)
  - nvmet-tcp: select CONFIG_TLS from CONFIG_NVME_TARGET_TCP_TLS (Alistair Francis)
  - nvme-tcp: select CONFIG_TLS from CONFIG_NVME_TCP_TLS (Alistair Francis)
  - nvme-tcp: fix premature queue removal and I/O failover (Michael Liang)
  - bnxt_en: Fix ethtool -d byte order for 32-bit values (Michael Chan)
  - bnxt_en: Fix out-of-bound memcpy() during ethtool -w (Shruti Parab)
  - bnxt_en: Fix coredump logic to free allocated buffer (Shruti Parab)
  - bnxt_en: call pci_alloc_irq_vectors() after bnxt_reserve_rings() (Kashyap Desai)
  - bnxt_en: Add missing skb_mark_for_recycle() in bnxt_rx_vlan() (Somnath Kotur)
  - bnxt_en: Fix ethtool selftest output in one of the failure cases (Kalesh AP)
  - bnxt_en: Fix error handling path in bnxt_init_chip() (Shravya KN)
  - ALSA: hda/realtek: Fix built-mic regression on other ASUS models (Takashi Iwai)
  - net: ipv6: fix UDPv6 GSO segmentation with NAT (Felix Fietkau)
  - net: dsa: felix: fix broken taprio gate states after clock jump (Vladimir Oltean)
  - net: ethernet: mtk_eth_soc: fix SER panic with 4GB+ RAM (Chad Monroe)
  - igc: fix lock order in igc_ptp_reset (Jacob Keller)
  - idpf: protect shutdown from reset (Larysa Zaremba)
  - idpf: fix potential memory leak on kcalloc() failure (Michal Swiatkowski)
  - net: mdio: mux-meson-gxl: set reversed bit when using internal phy (Da Xue)
  - net: dlink: Correct endianness handling of led_mode (Simon Horman)
  - drm/mipi-dbi: Fix blanking for non-16 bit formats (Russell Cloran)
  - drm/tests: shmem: Fix memleak (Maxime Ripard)
  - nvme-pci: fix queue unquiesce check on slot_reset (Keith Busch)
  - ALSA: ump: Fix buffer overflow at UMP SysEx message conversion (Takashi Iwai)
  - scsi: ufs: core: Remove redundant query_complete trace (Keoseong Park)
  - idpf: fix offloads support for encapsulated packets (Madhu Chittim)
  - ice: Check VF VSI Pointer Value in ice_vc_add_fdir_fltr() (Xuanqiang Luo)
  - net_sched: qfq: Fix double list add in class with netem as child qdisc (Victor Nogueira)
  - net_sched: ets: Fix double list add in class with netem as child qdisc (Victor Nogueira)
  - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (Victor Nogueira)
  - net_sched: drr: Fix double list add in class with netem as child qdisc (Victor Nogueira)
  - pds_core: remove write-after-free of client_id (Shannon Nelson)
  - pds_core: specify auxiliary_device to be created (Shannon Nelson)
  - pds_core: make pdsc_auxbus_dev_del() void (Shannon Nelson)
  - net: ethernet: mtk_eth_soc: sync mtk_clks_source_name array (Daniel Golle)
  - net: ethernet: mtk-star-emac: rearm interrupts in rx_poll only when advised (Louis-Alexis Eyraud)
  - net: ethernet: mtk-star-emac: fix spinlock recursion issues on rx/tx poll (Louis-Alexis Eyraud)
  - rtase: Modify the condition used to detect overflow in rtase_calc_time_mitigation (Justin Lai)
  - bnxt_en: improve TX timestamping FIFO configuration (Vadim Fedorenko)
  - octeon_ep_vf: Resolve netdevice usage count issue (Sathesh B Edara)
  - net: mscc: ocelot: delete PVID VLAN when readding it as non-PVID (Vladimir Oltean)
  - Bluetooth: L2CAP: copy RX timestamp to new fragments (Pauli Virtanen)
  - Bluetooth: btintel_pcie: Add additional to checks to clear TX/RX paths (Kiran K)
  - Bluetooth: btusb: avoid NULL pointer dereference in skb_dequeue() (En-Wei Wu)
  - Bluetooth: btintel_pcie: Avoid redundant buffer allocation (Kiran K)
  - Bluetooth: hci_conn: Fix not setting timeout for BIG Create Sync (Luiz Augusto von Dentz)
  - Bluetooth: hci_conn: Fix not setting conn_timeout for Broadcast Receiver (Luiz Augusto von Dentz)
  - Bluetooth: hci_conn: Remove alloc from critical section (Iulia Tanasescu)
  - ASoC: amd: acp: Fix NULL pointer deref in acp_i2s_set_tdm_slot (Venkata Prasad Potturu)
  - accel/ivpu: Correct DCT interrupt handling (Karol Wachowski)
  - net/mlx5: E-switch, Fix error handling for enabling roce (Chris Mi)
  - net/mlx5e: Fix lock order in mlx5e_tx_reporter_ptpsq_unhealthy_recover (Cosmin Ratiu)
  - net/mlx5e: TC, Continue the attr process even if encap entry is invalid (Jianbo Liu)
  - net/mlx5: E-Switch, Initialize MAC Address for Default GID (Maor Gottlieb)
  - net/mlx5e: Use custom tunnel header for vxlan gbp (Vlad Dogaru)
  - xsk: Fix race condition in AF_XDP generic RX path (e.kubanski)
  - vxlan: vnifilter: Fix unlocked deletion of default FDB entry (Ido Schimmel)
  - powerpc/boot: Fix dash warning (Madhavan Srinivasan)
  - wifi: plfxlc: Remove erroneous assert in plfxlc_mac_release (Murad Masimov)
  - wifi: iwlwifi: fix the check for the SCRATCH register upon resume (Emmanuel Grumbach)
  - wifi: iwlwifi: don't warn if the NIC is gone in resume (Emmanuel Grumbach)
  - drm/i915/pxp: fix undefined reference to `intel_pxp_gsccs_is_ready_for_sessions' (Chen Linxuan)
  - ALSA: hda/realtek - Enable speaker for HP platform (Kailang Yang)
  - ASoC: Intel: sof_sdw: Add NULL check in asoc_sdw_rt_dmic_rtd_init() (Chenyuan Yang)
  - powerpc/boot: Check for ld-option support (Madhavan Srinivasan)
  - pinctrl: imx: Return NULL if no group is matched and found (Hui Wang)
  - book3s64/radix : Align section vmemmap start address to PAGE_SIZE (Donet Tom)
  - ASoC: soc-pcm: Fix hw_params() and DAPM widget sequence (Sheetal)
  - ASoC: cs-amp-lib-test: Don't select SND_SOC_CS_AMP_LIB (Richard Fitzgerald)
  - ASoC: soc-core: Stop using of_property_read_bool() for non-boolean properties (Geert Uytterhoeven)
  - drm/amd/display: Default IPS to RCG_IN_ACTIVE_IPS2_IN_OFF (Leo Li)
  - tracing: Fix oob write in trace_seq_to_buffer() (Jeongjun Park)
  - cpufreq: Fix setting policy limits when frequency tables are used (Rafael J. Wysocki)
  - cpufreq: Avoid using inconsistent policy->min and policy->max (Rafael J. Wysocki)
  - smb: client: fix zero length for mkdir POSIX create context (Jethro Donaldson)
  - ksmbd: fix use-after-free in session logoff (Sean Heelan)
  - ksmbd: fix use-after-free in kerberos authentication (Sean Heelan)
  - ksmbd: fix use-after-free in ksmbd_session_rpc_open (Namjae Jeon)
  - platform/x86/intel-uncore-freq: Fix missing uncore sysfs during CPU hotplug (Shouye Liu)
  - platform/x86/amd: pmc: Require at least 2.5 seconds between HW sleep cycles (Mario Limonciello)
  - iommu: Fix two issues in iommu_copy_struct_from_user() (Nicolin Chen)
  - iommu/vt-d: Apply quirk_iommu_igfx for 8086:0044 (QM57/QS57) (Mingcong Bai)
  - iommu/arm-smmu-v3: Fix pgsize_bit for sva domains (Balbir Singh)
  - iommu/arm-smmu-v3: Fix iommu_device_probe bug due to duplicated stream ids (Nicolin Chen)
  - iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid (Pavel Paklov)
  - drm: Select DRM_KMS_HELPER from DRM_DEBUG_DP_MST_TOPOLOGY_REFS (Janne Grunau)
  - drm/amdgpu: Fix offset for HDP remap in nbio v7.11 (Lijo Lazar)
  - dm: always update the array size in realloc_argv on success (Benjamin Marzinski)
  - dm-integrity: fix a warning on invalid table line (Mikulas Patocka)
  - dm-bufio: don't schedule in atomic context (LongPing Wei)
  - x86/boot/sev: Support memory acceptance in the EFI stub under SVSM (Ard Biesheuvel)
  - wifi: brcm80211: fmac: Add error handling for brcmf_usb_dl_writeimage() (Wentao Liang)
  - tracing: Do not take trace_event_sem in print_event_fields() (Steven Rostedt)
  - spi: tegra114: Don't fail set_cs_timing when delays are zero (Aaron Kling)
  - mmc: renesas_sdhi: Fix error handling in renesas_sdhi_probe (Ruslan Piasetskyi)
  - mm/memblock: repeat setting reserved region nid if array is doubled (Wei Yang)
  - mm/memblock: pass size instead of end to memblock_set_node() (Wei Yang)
  - irqchip/qcom-mpm: Prevent crash when trying to handle non-wake GPIOs (Stephan Gerhold)
  - amd-xgbe: Fix to ensure dependent features are toggled with RX checksum offload (Vishal Badole)
  - perf/x86/intel: KVM: Mask PEBS_ENABLE loaded for guest with vCPU's value. (Sean Christopherson)
  - perf/x86/intel: Only check the group flag for X86 leader (Kan Liang)
  - parisc: Fix double SIGFPE crash (Helge Deller)
  - arm64: errata: Add missing sentinels to Spectre-BHB MIDR arrays (Will Deacon)
  - i2c: imx-lpi2c: Fix clock count when probe defers (Clark Wang)
  - EDAC/altera: Set DDR and SDMMC interrupt mask before registration (Niravkumar L Rabara)
  - EDAC/altera: Test the correct error reg offset (Niravkumar L Rabara)
  - drm/nouveau: Fix WARN_ON in nouveau_fence_context_kill() (Philipp Stanner)
  - drm/fdinfo: Protect against driver unbind (Tvrtko Ursulin)
  - cpufreq: intel_pstate: Unchecked MSR aceess in legacy mode (Srinivas Pandruvada)
  - btrfs: fix COW handling in run_delalloc_nocow() (Dave Chen)
  - btrfs: adjust subpage bit start based on sectorsize (Josef Bacik)
  - binder: fix offset calculation in debug log (Carlos Llamas)
  - ALSA: usb-audio: Add second USB ID for Jabra Evolve 65 headset (Joachim Priesner)
  - ALSA: usb-audio: Add retry on -EPROTO from usb_set_interface() (Geoffrey D. Bennett)
  - Revert "rndis_host: Flag RNDIS modems as WWAN devices" (Christian Heusel)
  - Bluetooth: btusb: Add 13 USB device IDs for Qualcomm WCN785x (Zijun Hu)
  - Bluetooth: btusb: Add new VID/PID for WCN785x (Dorian Cruveiller)
  - Bluetooth: btusb: Add ID 0x2c7c:0x0130 for Qualcomm WCN785x (Mark Dietzer)
  - Bluetooth: btusb: Add one more ID 0x13d3:0x3623 for Qualcomm WCN785x (Zijun Hu)
  - Bluetooth: btusb: Add one more ID 0x0489:0xe0f3 for Qualcomm WCN785x (Zijun Hu)
  - Bluetooth: btusb: add Foxconn 0xe0fc for Qualcomm WCN785x (Aaron Ma)
  - x86/PCI: Export find_cap() to be used in early PCI code (Rayan Dasoriya)  [Orabug: 37383447]
  - x86/quirks: Scan all busses for early PCI quirks (Rayan Dasoriya)  [Orabug: 37383447]
  - x86/quirks: Add parameter to clear MSIs early on boot (Rayan Dasoriya)  [Orabug: 37383447]
  - scsi: megaraid_sas: Driver version update to 07.734.00.00-rc1 (Chandrakanth Patil)  [Orabug: 37877985]
  - scsi: megaraid_sas: Make most module parameters static (Dr. David Alan Gilbert)  [Orabug: 37877985]
  - scsi: mpt3sas: Fix buffer overflow in mpt3sas_send_mctp_passthru_req() (Dan Carpenter)  [Orabug: 37878012]
  - scsi: mpt3sas: Fix spelling mistake "receveid" -> "received" (Colin Ian King)  [Orabug: 37878012]
  - scsi: mpt3sas: update driver version to 52.100.00.00 (Shivasharan S)  [Orabug: 37878012]
  - scsi: mpt3sas: Send a diag reset if target reset fails (Shivasharan S)  [Orabug: 37878012]
  - scsi: mpt3sas: Report driver capability as part of IOCINFO command (Shivasharan S)  [Orabug: 37878012]
  - scsi: mpt3sas: Add support for MCTP Passthrough commands (Shivasharan S)  [Orabug: 37878012]
  - scsi: mpt3sas: Update MPI headers to 02.00.62 version (Shivasharan S)  [Orabug: 37878012]
  - scsi: mpt3sas: Fix a locking bug in an error path (Bart Van Assche)  [Orabug: 37878012]
  - scsi: mpt3sas: Reduce log level of ignore_delay_remove message to KERN_INFO (Paul Menzel)  [Orabug: 37878012]
  - scsi: mpt3sas: Remove unused config functions (Dr. David Alan Gilbert)  [Orabug: 37878012]
  - scsi: mpt3sas: Add details to EEDPTagMode error message (Paul Menzel)  [Orabug: 37878012]
  - scsi: mpt3sas: Update driver version to 51.100.00.00 (Ranjan Kumar)  [Orabug: 37878012]
  - vhost-scsi: log event queue write descriptors (Dongli Zhang)  [Orabug: 37883837]
  - vhost-scsi: log control queue write descriptors (Dongli Zhang)  [Orabug: 37883837]
  - vhost-scsi: log I/O queue write descriptors (Dongli Zhang)  [Orabug: 37883837]
  - vhost-scsi: adjust vhost_scsi_get_desc() to log vring descriptors (Dongli Zhang)  [Orabug: 37883837]
  - vhost: modify vhost_log_write() for broader users (Dongli Zhang)  [Orabug: 37883837]
  - uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu)  [Orabug: 37899161]
  - uek-rpm: Move vmxnet3 to module-core in UEK8 (Harshit Mogalapalli)  [Orabug: 37908279]
  - x86/bugs: Enabling Retbleed and SRSO mitigation can taint the kernel (Alexandre Chartre)  [Orabug: 37936569]
  - x86/bhi: Do not set BHI_DIS_S in 32-bit mode (Pawan Gupta)  [Orabug: 37920673]
  - x86/bpf: Add IBHF call at end of classic BPF (Daniel Sneddon)  [Orabug: 37920673]
  - x86/bpf: Call branch history clearing sequence on exit (Daniel Sneddon)  [Orabug: 37920673]
  - selftest/x86/bugs: Add selftests for ITS (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
  - x86/its: Align RETs in BHB clear sequence to avoid thunking (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
  - x86/its: Add support for RSB stuffing mitigation (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
  - x86/its: Add "vmexit" option to skip mitigation on some CPUs (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
  - x86/its: Enable Indirect Target Selection mitigation (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
  - x86/its: Add support for ITS-safe return thunk (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
  - x86/its: Add support for ITS-safe indirect thunk (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
  - x86/its: Enumerate Indirect Target Selection (ITS) bug (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
  - Documentation: x86/bugs/its: Add ITS documentation (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-100.28.1.el9uek]
changelog:
  - KVM: SEV: Add KVM_SEV_SNP_ENABLE_REQ_CERTS command (Michael Roth)  [Orabug: 37894105]
  - KVM: Introduce KVM_EXIT_SNP_REQ_CERTS for SNP certificate-fetching (Michael Roth)  [Orabug: 37894105]
  - Revert "KVM: Introduce KVM_EXIT_SNP_REQ_CERTS for SNP certificate-fetching" (Liam Merwick)  [Orabug: 37894105]
  - uek-rpm: Enable SECURITY_DMESG_RESTRICT in UEK8 (Harshit Mogalapalli)  [Orabug: 37867042]


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-100.28.2.el9uek]
changelog:
  - sched/eevdf: Fix se->slice being set to U64_MAX and resulting crash (Omar Sandoval)
  - certs: Add new Oracle Linux Driver Signing (key 1) certificate (Sherry Yang)  [Orabug: 37967533]
  - Revert "block: sysfs option to change ioticks granularity" (Gulam Mohamed)  [Orabug: 37921776]
  - RDS: use pin_user_pages_fast() (Stephen Brennan)  [Orabug: 37968545]


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-100.28.2.2.el9uek]
changelog:
  - Add Zen34 clients (Borislav Petkov (AMD))  [Orabug: 38129827]  {CVE-2024-36350} {CVE-2024-36357} 
  - x86/process: Move the buffer clearing before MONITOR (Kim Phillips)  [Orabug: 38129827]  {CVE-2024-36350} {CVE-2024-36357} 
  - Add normal counters (Borislav Petkov (AMD))  [Orabug: 38129827]  {CVE-2024-36350} {CVE-2024-36357} 
  - KVM: SVM: Advertize TSA CPUID bits to guests (Borislav Petkov (AMD))  [Orabug: 38129827]  {CVE-2024-36350} {CVE-2024-36357} 
  - x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov (AMD))  [Orabug: 38129827]  {CVE-2024-36350} {CVE-2024-36357} 
  - x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov (AMD))  [Orabug: 38129827]  {CVE-2024-36350} {CVE-2024-36357}


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-0.20.20.el9uek]
changelog:
  - block: prevent calls to should_fail_bio() optimized by gcc (Prasad Singamsetty)  [Orabug: 37782458]


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-100.28.2.el9uek]
changelog:
  - sched/eevdf: Fix se->slice being set to U64_MAX and resulting crash (Omar Sandoval)   
  - certs: Add new Oracle Linux Driver Signing (key 1) certificate (Sherry Yang)  [Orabug: 37967533]  
  - Revert "block: sysfs option to change ioticks granularity" (Gulam Mohamed)  [Orabug: 37921776]  
  - RDS: use pin_user_pages_fast() (Stephen Brennan)  [Orabug: 37968545]


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-2.28.3.el9uek]
changelog:
  - LTS version: v6.12.28 (Jack Vogel)
  - dm: fix copying after src array boundaries (Tudor Ambarus)
  - drm/amd/display: Fix slab-use-after-free in hdcp (Chris Bainbridge) [Orabug: 37976747] {CVE-2025-37903}
  - drm/amd/display: Add scoped mutexes for amdgpu_dm_dhcp (Mario Limonciello)
  - drivers: base: handle module_kobject creation (Shyam Saini)
  - kernel: globalize lookup_or_create_module_kobject() (Shyam Saini)
  - kernel: param: rename locate_module_kobject (Shyam Saini)
  - Revert "drm/meson: vclk: fix calculation of 59.94 fractional rates" (Christian Hewitt)
  - arm64: dts: st: Use 128kB size for aliased GIC400 register access on stm32mp25 SoCs (Christian Bruel)
  - arm64: dts: st: Adjust interrupt-controller for stm32mp25 SoCs (Christian Bruel)
  - ARM: dts: opos6ul: add ksz8081 phy properties (Sébastien Szymanski)
  - arm64: dts: imx95: Correct the range of PCIe app-reg region (Richard Zhu)
  - firmware: arm_ffa: Skip Rx buffer ownership release if not acquired (Sudeep Holla)
  - firmware: arm_scmi: Balance device refcount when destroying devices (Cristian Marussi) [Orabug: 37976752] {CVE-2025-37905}
  - drm/xe: Ensure fixed_slice_mode gets set after ccs_mode change (Niranjana Vishwanathapura)
  - sch_ets: make est_qlen_notify() idempotent (Cong Wang)
  - sch_qfq: make qfq_qlen_notify() idempotent (Cong Wang)
  - sch_hfsc: make hfsc_qlen_notify() idempotent (Cong Wang)
  - sch_drr: make drr_qlen_notify() idempotent (Cong Wang)
  - sch_htb: make htb_qlen_notify() idempotent (Cong Wang) [Orabug: 37976858] {CVE-2025-37932}
  - accel/ivpu: Add handling of VPU_JSM_STATUS_MVNCI_CONTEXT_VIOLATION_HW (Karol Wachowski)
  - accel/ivpu: Fix locking order in ivpu_job_submit (Karol Wachowski) [Orabug: 37976760] {CVE-2025-37907}
  - accel/ivpu: Abort all jobs after command queue unregister (Karol Wachowski)
  - accel/ivpu: Update VPU FW API headers (Andrzej Kacprowski)
  - accel/ivpu: Fix a typo (Andrew Kreimer)
  - accel/ivpu: Use xa_alloc_cyclic() instead of custom function (Karol Wachowski)
  - accel/ivpu: Make DB_ID and JOB_ID allocations incremental (Tomasz Rusinowicz)
  - net: Fix the devmem sock opts and msgs for parisc (Pranjal Shrivastava)
  - bcachefs: Remove incorrect __counted_by annotation (Alan Huang)
  - mm, slab: clean up slab->obj_exts always (Zhenhua Huang) [Orabug: 37976762] {CVE-2025-37908}
  - net: vertexcom: mse102x: Fix RX error handling (Stefan Wahren)
  - net: vertexcom: mse102x: Add range check for CMD_RTS (Stefan Wahren)
  - net: vertexcom: mse102x: Fix LEN_MASK (Stefan Wahren)
  - net: vertexcom: mse102x: Fix possible stuck of SPI interrupt (Stefan Wahren)
  - net: hns3: defer calling ptp_clock_register() (Jian Shen)
  - net: hns3: fixed debugfs tm_qset size (Hao Lan)
  - net: hns3: fix an interrupt residual problem (Yonglong Liu)
  - net: hns3: store rx VLAN tag offload state for VF (Jian Shen)
  - octeon_ep: Fix host hang issue during device reboot (Sathesh Edara) [Orabug: 37976864] {CVE-2025-37933}
  - net: fec: ERR007885 Workaround for conventional TX (Mattias Barthel)
  - net: lan743x: Fix memleak issue when GSO enabled (Thangaraj Samynathan) [Orabug: 37976765] {CVE-2025-37909}
  - ptp: ocp: Fix NULL dereference in Adva board SMA sysfs operations (Sagi Maimon) [Orabug: 37976771] {CVE-2025-37910}
  - net: use sock_gen_put() when sk_state is TCP_TIME_WAIT (Jibin Zhang) [Orabug: 37976728] {CVE-2025-37894}
  - bnxt_en: fix module unload sequence (Vadim Fedorenko)
  - ASoC: simple-card-utils: Fix pointer check in graph_util_parse_link_direction (Alexander Stein) [Orabug: 37976869] {CVE-2025-37934}
  - nvmet-tcp: select CONFIG_TLS from CONFIG_NVME_TARGET_TCP_TLS (Alistair Francis)
  - nvme-tcp: select CONFIG_TLS from CONFIG_NVME_TCP_TLS (Alistair Francis)
  - nvme-tcp: fix premature queue removal and I/O failover (Michael Liang)
  - bnxt_en: Fix ethtool -d byte order for 32-bit values (Michael Chan)
  - bnxt_en: Fix out-of-bound memcpy() during ethtool -w (Shruti Parab) [Orabug: 37976773] {CVE-2025-37911}
  - bnxt_en: Fix coredump logic to free allocated buffer (Shruti Parab)
  - bnxt_en: call pci_alloc_irq_vectors() after bnxt_reserve_rings() (Kashyap Desai)
  - bnxt_en: Add missing skb_mark_for_recycle() in bnxt_rx_vlan() (Somnath Kotur)
  - bnxt_en: Fix ethtool selftest output in one of the failure cases (Kalesh Ap)
  - bnxt_en: Fix error handling path in bnxt_init_chip() (Shravya Kn) [Orabug: 37976731] {CVE-2025-37895}
  - ALSA: hda/realtek: Fix built-mic regression on other ASUS models (Takashi Iwai)
  - net: ipv6: fix UDPv6 GSO segmentation with NAT (Felix Fietkau)
  - net: dsa: felix: fix broken taprio gate states after clock jump (Vladimir Oltean)
  - net: ethernet: mtk_eth_soc: fix SER panic with 4GB+ RAM (Chad Monroe) [Orabug: 37976872] {CVE-2025-37935}
  - igc: fix lock order in igc_ptp_reset (Jacob Keller)
  - idpf: protect shutdown from reset (Larysa Zaremba)
  - idpf: fix potential memory leak on kcalloc() failure (Michal Swiatkowski)
  - net: mdio: mux-meson-gxl: set reversed bit when using internal phy (Da Xue)
  - net: dlink: Correct endianness handling of led_mode (Simon Horman)
  - drm/mipi-dbi: Fix blanking for non-16 bit formats (Russell Cloran)
  - drm/tests: shmem: Fix memleak (Maxime Ripard)
  - nvme-pci: fix queue unquiesce check on slot_reset (Keith Busch)
  - ALSA: ump: Fix buffer overflow at UMP SysEx message conversion (Takashi Iwai) [Orabug: 37970918] {CVE-2025-37891}
  - scsi: ufs: core: Remove redundant query_complete trace (Keoseong Park)
  - idpf: fix offloads support for encapsulated packets (Madhu Chittim)
  - ice: Check VF VSI Pointer Value in ice_vc_add_fdir_fltr() (Luoxuanqiang) [Orabug: 37976779] {CVE-2025-37912}
  - net_sched: qfq: Fix double list add in class with netem as child qdisc (Victor Nogueira) [Orabug: 37976783] {CVE-2025-37913}
  - net_sched: ets: Fix double list add in class with netem as child qdisc (Victor Nogueira) [Orabug: 37976788] {CVE-2025-37914}
  - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (Victor Nogueira) [Orabug: 37970915] {CVE-2025-37890}
  - net_sched: drr: Fix double list add in class with netem as child qdisc (Victor Nogueira) [Orabug: 37976792] {CVE-2025-37915}
  - pds_core: remove write-after-free of client_id (Shannon Nelson) [Orabug: 37976797] {CVE-2025-37916}
  - pds_core: specify auxiliary_device to be created (Shannon Nelson)
  - pds_core: make pdsc_auxbus_dev_del() void (Shannon Nelson)
  - net: ethernet: mtk_eth_soc: sync mtk_clks_source_name array (Daniel Golle)
  - net: ethernet: mtk-star-emac: rearm interrupts in rx_poll only when advised (Louis-Alexis Eyraud)
  - net: ethernet: mtk-star-emac: fix spinlock recursion issues on rx/tx poll (Louis-Alexis Eyraud) [Orabug: 37976802] {CVE-2025-37917}
  - rtase: Modify the condition used to detect overflow in rtase_calc_time_mitigation (Justin Lai)
  - bnxt_en: improve TX timestamping FIFO configuration (Vadim Fedorenko)
  - octeon_ep_vf: Resolve netdevice usage count issue (Sathesh Edara)
  - net: mscc: ocelot: delete PVID VLAN when readding it as non-PVID (Vladimir Oltean)
  - Bluetooth: L2CAP: copy RX timestamp to new fragments (Pauli Virtanen)
  - Bluetooth: btintel_pcie: Add additional to checks to clear TX/RX paths (Kiran K)
  - Bluetooth: btusb: avoid NULL pointer dereference in skb_dequeue() (En-Wei Wu) [Orabug: 37976804] {CVE-2025-37918}
  - Bluetooth: btintel_pcie: Avoid redundant buffer allocation (Kiran K)
  - Bluetooth: hci_conn: Fix not setting timeout for BIG Create Sync (Luiz Augusto von Dentz)
  - Bluetooth: hci_conn: Fix not setting conn_timeout for Broadcast Receiver (Luiz Augusto von Dentz)
  - Bluetooth: hci_conn: Remove alloc from critical section (Iulia Tanasescu)
  - ASoC: amd: acp: Fix NULL pointer deref in acp_i2s_set_tdm_slot (Venkata Prasad Potturu) [Orabug: 37976806] {CVE-2025-37919}
  - accel/ivpu: Correct DCT interrupt handling (Karol Wachowski)
  - net/mlx5: E-switch, Fix error handling for enabling roce (Chris Mi)
  - net/mlx5e: Fix lock order in mlx5e_tx_reporter_ptpsq_unhealthy_recover (Cosmin Ratiu)
  - net/mlx5e: TC, Continue the attr process even if encap entry is invalid (Jianbo Liu)
  - net/mlx5: E-Switch, Initialize MAC Address for Default GID (Maor Gottlieb)
  - net/mlx5e: Use custom tunnel header for vxlan gbp (Vlad Dogaru)
  - xsk: Fix race condition in AF_XDP generic RX path (Eryk Kubanski) [Orabug: 37976809] {CVE-2025-37920}
  - vxlan: vnifilter: Fix unlocked deletion of default FDB entry (Ido Schimmel) [Orabug: 37976815] {CVE-2025-37921}
  - powerpc/boot: Fix dash warning (Madhavan Srinivasan)
  - wifi: plfxlc: Remove erroneous assert in plfxlc_mac_release (Murad Masimov) [Orabug: 37976734] {CVE-2025-37897}
  - wifi: iwlwifi: fix the check for the SCRATCH register upon resume (Emmanuel Grumbach)
  - wifi: iwlwifi: don't warn if the NIC is gone in resume (Emmanuel Grumbach)
  - drm/i915/pxp: fix undefined reference to `intel_pxp_gsccs_is_ready_for_sessions' (Chen Linxuan)
  - ALSA: hda/realtek - Enable speaker for HP platform (Kailang Yang)
  - ASoC: Intel: sof_sdw: Add NULL check in asoc_sdw_rt_dmic_rtd_init() (Chenyuan Yang)
  - powerpc/boot: Check for ld-option support (Madhavan Srinivasan)
  - pinctrl: imx: Return NULL if no group is matched and found (Hui Wang)
  - book3s64/radix : Align section vmemmap start address to PAGE_SIZE (Donet Tom) [Orabug: 37976819] {CVE-2025-37922}
  - ASoC: soc-pcm: Fix hw_params() and DAPM widget sequence (Sheetal)
  - ASoC: cs-amp-lib-test: Don't select SND_SOC_CS_AMP_LIB (Richard Fitzgerald)
  - ASoC: soc-core: Stop using of_property_read_bool() for non-boolean properties (Geert Uytterhoeven)
  - drm/amd/display: Default IPS to RCG_IN_ACTIVE_IPS2_IN_OFF (Sun Peng Li)
  - tracing: Fix oob write in trace_seq_to_buffer() (Jeongjun Park) [Orabug: 37976821] {CVE-2025-37923}
  - cpufreq: Fix setting policy limits when frequency tables are used (Rafael J. Wysocki)
  - cpufreq: Avoid using inconsistent policy->min and policy->max (Rafael J. Wysocki)
  - smb: client: fix zero length for mkdir POSIX create context (Jethro Donaldson)
  - ksmbd: fix use-after-free in session logoff (Sean Heelan) [Orabug: 37976738] {CVE-2025-37899}
  - ksmbd: fix use-after-free in kerberos authentication (Sean Heelan) [Orabug: 37976828] {CVE-2025-37924}
  - ksmbd: fix use-after-free in ksmbd_session_rpc_open (Namjae Jeon) [Orabug: 37976832] {CVE-2025-37926}
  - platform/x86/intel-uncore-freq: Fix missing uncore sysfs during CPU hotplug (Shouye Liu)
  - platform/x86/amd: pmc: Require at least 2.5 seconds between HW sleep cycles (Mario Limonciello)
  - iommu: Fix two issues in iommu_copy_struct_from_user() (Nicolin Chen) [Orabug: 37976741] {CVE-2025-37900}
  - iommu/vt-d: Apply quirk_iommu_igfx for 8086:0044 (QM57/QS57) (Mingcong Bai)
  - iommu/arm-smmu-v3: Fix pgsize_bit for sva domains (Balbir Singh)
  - iommu/arm-smmu-v3: Fix iommu_device_probe bug due to duplicated stream ids (Nicolin Chen)
  - iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid (Pavel Paklov) [Orabug: 37976836] {CVE-2025-37927}
  - drm: Select DRM_KMS_HELPER from DRM_DEBUG_DP_MST_TOPOLOGY_REFS (Janne Grunau)
  - drm/amdgpu: Fix offset for HDP remap in nbio v7.11 (Lijo Lazar)
  - dm: always update the array size in realloc_argv on success (Benjamin Marzinski)
  - dm-integrity: fix a warning on invalid table line (Mikulas Patocka)
  - dm-bufio: don't schedule in atomic context (Longping Wei) [Orabug: 37976844] {CVE-2025-37928}
  - x86/boot/sev: Support memory acceptance in the EFI stub under SVSM (Ard Biesheuvel)
  - wifi: brcm80211: fmac: Add error handling for brcmf_usb_dl_writeimage() (Xu Wang) [Orabug: 37977118] {CVE-2025-37990}
  - tracing: Do not take trace_event_sem in print_event_fields() (Steven Rostedt)
  - spi: tegra114: Don't fail set_cs_timing when delays are zero (Aaron Kling)
  - mmc: renesas_sdhi: Fix error handling in renesas_sdhi_probe (Ruslan Piasetskyi)
  - mm/memblock: repeat setting reserved region nid if array is doubled (Wei Yang)
  - mm/memblock: pass size instead of end to memblock_set_node() (Wei Yang)
  - irqchip/qcom-mpm: Prevent crash when trying to handle non-wake GPIOs (Stephan Gerhold) [Orabug: 37976744] {CVE-2025-37901}
  - amd-xgbe: Fix to ensure dependent features are toggled with RX checksum offload (Vishal Badole)
  - perf/x86/intel: KVM: Mask PEBS_ENABLE loaded for guest with vCPU's value. (Sean Christopherson) [Orabug: 37976874] {CVE-2025-37936}
  - perf/x86/intel: Only check the group flag for X86 leader (Kan Liang)
  - parisc: Fix double SIGFPE crash (Helge Deller) [Orabug: 37977127] {CVE-2025-37991}
  - arm64: errata: Add missing sentinels to Spectre-BHB MIDR arrays (Will Deacon) [Orabug: 37977182] {CVE-2025-37929}
  - i2c: imx-lpi2c: Fix clock count when probe defers (Clark Wang)
  - EDAC/altera: Set DDR and SDMMC interrupt mask before registration (Niravkumar L Rabara)
  - EDAC/altera: Test the correct error reg offset (Niravkumar L Rabara)
  - drm/nouveau: Fix WARN_ON in nouveau_fence_context_kill() (Philipp Stanner) [Orabug: 37976850] {CVE-2025-37930}
  - drm/fdinfo: Protect against driver unbind (Tvrtko Ursulin)
  - cpufreq: intel_pstate: Unchecked MSR aceess in legacy mode (Srinivas Pandruvada)
  - btrfs: fix COW handling in run_delalloc_nocow() (Dave Chen)
  - btrfs: adjust subpage bit start based on sectorsize (Josef Bacik) [Orabug: 37976853] {CVE-2025-37931}
  - binder: fix offset calculation in debug log (Carlos Llamas)
  - ALSA: usb-audio: Add second USB ID for Jabra Evolve 65 headset (Joachim Priesner)
  - ALSA: usb-audio: Add retry on -EPROTO from usb_set_interface() (Geoffrey D. Bennett)
  - Revert "rndis_host: Flag RNDIS modems as WWAN devices" (Christian Heusel)
  - Bluetooth: btusb: Add 13 USB device IDs for Qualcomm WCN785x (Zijun Hu)
  - Bluetooth: btusb: Add new VID/PID for WCN785x (Dorian Cruveiller)
  - Bluetooth: btusb: Add ID 0x2c7c:0x0130 for Qualcomm WCN785x (Mark Dietzer)
  - Bluetooth: btusb: Add one more ID 0x13d3:0x3623 for Qualcomm WCN785x (Zijun Hu)
  - Bluetooth: btusb: Add one more ID 0x0489:0xe0f3 for Qualcomm WCN785x (Zijun Hu)
  - Bluetooth: btusb: add Foxconn 0xe0fc for Qualcomm WCN785x (Aaron Ma)
  - x86/PCI: Export find_cap() to be used in early PCI code (Rayan Dasoriya) [Orabug: 37383447]
  - x86/quirks: Scan all busses for early PCI quirks (Rayan Dasoriya) [Orabug: 37383447]
  - x86/quirks: Add parameter to clear MSIs early on boot (Rayan Dasoriya) [Orabug: 37383447]
  - scsi: megaraid_sas: Driver version update to 07.734.00.00-rc1 (Chandrakanth Patil) [Orabug: 37877985]
  - scsi: megaraid_sas: Make most module parameters static (Dr. David Alan Gilbert) [Orabug: 37877985]
  - scsi: mpt3sas: Fix buffer overflow in mpt3sas_send_mctp_passthru_req() (Dan Carpenter) [Orabug: 37878012]
  - scsi: mpt3sas: Fix spelling mistake "receveid" -> "received" (Colin Ian King) [Orabug: 37878012]
  - scsi: mpt3sas: update driver version to 52.100.00.00 (Shivasharan S) [Orabug: 37878012]
  - scsi: mpt3sas: Send a diag reset if target reset fails (Shivasharan S) [Orabug: 37878012]
  - scsi: mpt3sas: Report driver capability as part of IOCINFO command (Shivasharan S) [Orabug: 37878012]
  - scsi: mpt3sas: Add support for MCTP Passthrough commands (Shivasharan S) [Orabug: 37878012]
  - scsi: mpt3sas: Update MPI headers to 02.00.62 version (Shivasharan S) [Orabug: 37878012]
  - scsi: mpt3sas: Fix a locking bug in an error path (Bart Van Assche) [Orabug: 37878012]
  - scsi: mpt3sas: Reduce log level of ignore_delay_remove message to KERN_INFO (Paul Menzel) [Orabug: 37878012]
  - scsi: mpt3sas: Remove unused config functions (Dr. David Alan Gilbert) [Orabug: 37878012]
  - scsi: mpt3sas: Add details to EEDPTagMode error message (Paul Menzel) [Orabug: 37878012]
  - scsi: mpt3sas: Update driver version to 51.100.00.00 (Ranjan Kumar) [Orabug: 37878012]
  - vhost-scsi: log event queue write descriptors (Dongli Zhang) [Orabug: 37883837]
  - vhost-scsi: log control queue write descriptors (Dongli Zhang) [Orabug: 37883837]
  - vhost-scsi: log I/O queue write descriptors (Dongli Zhang) [Orabug: 37883837]
  - vhost-scsi: adjust vhost_scsi_get_desc() to log vring descriptors (Dongli Zhang) [Orabug: 37883837]
  - vhost: modify vhost_log_write() for broader users (Dongli Zhang) [Orabug: 37883837]
  - uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu) [Orabug: 37899161]
  - uek-rpm: Move vmxnet3 to module-core in UEK8 (Harshit Mogalapalli) [Orabug: 37908279]
  - x86/bugs: Enabling Retbleed and SRSO mitigation can taint the kernel (Alexandre Chartre) [Orabug: 37936569]
  - x86/bhi: Do not set BHI_DIS_S in 32-bit mode (Pawan Gupta) [Orabug: 37920673]
  - x86/bpf: Add IBHF call at end of classic BPF (Daniel Sneddon) [Orabug: 37920673]
  - x86/bpf: Call branch history clearing sequence on exit (Daniel Sneddon) [Orabug: 37920673]
  - selftest/x86/bugs: Add selftests for ITS (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
  - x86/its: Align RETs in BHB clear sequence to avoid thunking (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
  - x86/its: Add support for RSB stuffing mitigation (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
  - x86/its: Add "vmexit" option to skip mitigation on some CPUs (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
  - x86/its: Enable Indirect Target Selection mitigation (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
  - x86/its: Add support for ITS-safe return thunk (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
  - x86/its: Add support for ITS-safe indirect thunk (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
  - x86/its: Enumerate Indirect Target Selection (ITS) bug (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
  - Documentation: x86/bugs/its: Add ITS documentation (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-100.28.1.el9uek]
changelog:
  - KVM: SEV: Add KVM_SEV_SNP_ENABLE_REQ_CERTS command (Michael Roth) [Orabug: 37894105]
  - KVM: Introduce KVM_EXIT_SNP_REQ_CERTS for SNP certificate-fetching (Michael Roth) [Orabug: 37894105]
  - Revert "KVM: Introduce KVM_EXIT_SNP_REQ_CERTS for SNP certificate-fetching" (Liam Merwick) [Orabug: 37894105]
  - uek-rpm: Enable SECURITY_DMESG_RESTRICT in UEK8 (Harshit Mogalapalli) [Orabug: 37867042]


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-100.28.2.el9uek]
changelog:
  - sched/eevdf: Fix se->slice being set to U64_MAX and resulting crash (Omar Sandoval) [Orabug: 37930100] {CVE-2025-37821}
  - certs: Add new Oracle Linux Driver Signing (key 1) certificate (Sherry Yang) [Orabug: 37967533]
  - Revert "block: sysfs option to change ioticks granularity" (Gulam Mohamed) [Orabug: 37921776]
  - RDS: use pin_user_pages_fast() (Stephen Brennan) [Orabug: 37968545]


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-101.31.1.el9uek]
changelog:
  - LTS version: v6.12.31 (Jack Vogel)
  - drm/gem: Internally test import_attach for imported objects (Thomas Zimmermann)
  - x86/mm/init: Handle the special case of device private pages in add_pages(), to not increase max_pfn and trigger dma_addressing_limited() bounce buffers bounce buffers (Balbir Singh)
  - i3c: master: svc: Fix implicit fallthrough in svc_i3c_master_ibi_work() (Nathan Chancellor)
  - pinctrl: tegra: Fix off by one in tegra_pinctrl_get_group() (Dan Carpenter)
  - watchdog: aspeed: fix 64-bit division (Arnd Bergmann)
  - drm/amdkfd: Correct F8_MODE for gfx950 (Amber Lin)
  - serial: sh-sci: Save and restore more registers (Geert Uytterhoeven)
  - bpf: abort verification if env->cur_state->loop_entry != NULL (Eduard Zingerman)
  - drm/amd/display: Exit idle optimizations before accessing PHY (Ovidiu Bunea)
  - kbuild: Properly disable -Wunterminated-string-initialization for clang (Nathan Chancellor)
  - Fix mis-uses of 'cc-option' for warning disablement (Linus Torvalds)
  - gcc-15: disable '-Wunterminated-string-initialization' entirely for now (Linus Torvalds)
  - gcc-15: make 'unterminated string initialization' just a warning (Linus Torvalds)
  - err.h: move IOMEM_ERR_PTR() to err.h (Raag Jadav)
  - spi: spi-fsl-dspi: Reset SR flags before sending a new message (Larisa Grigore)
  - spi: spi-fsl-dspi: Halt the module after a new message transfer (Bogdan-Gabriel Roman)
  - spi: spi-fsl-dspi: restrict register range for regmap access (Larisa Grigore)
  - spi: use container_of_cont() for to_spi_device() (Greg Kroah-Hartman)
  - platform/x86: think-lmi: Fix attribute name usage for non-compliant items (Mark Pearson)
  - ksmbd: fix stream write failure (Namjae Jeon)
  - Revert "arm64: dts: allwinner: h6: Use RSB for AXP805 PMIC connection" (Jernej Skrabec)
  - Bluetooth: btmtksdio: Do close if SDIO card removed without close (Chris Lu)
  - Bluetooth: btmtksdio: Check function enabled before doing close (Chris Lu)
  - nilfs2: fix deadlock warnings caused by lock dependency in init_nilfs() (Ryusuke Konishi)
  - mm: mmap: map MAP_STACK to VM_NOHUGEPAGE only if THP is enabled (Ignacio Moreno Gonzalez)
  - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Tianyang Zhang)
  - memcg: always call cond_resched() after fn() (Breno Leitao)
  - highmem: add folio_test_partial_kmap() (Matthew Wilcox)
  - Input: xpad - add more controllers (Vicki Pfau)
  - Revert "drm/amd: Keep display off while going into S4" (Mario Limonciello)
  - smb: client: Reset all search buffer pointers when releasing buffer (Zhaolong Wang)
  - arm64: dts: marvell: uDPU: define pinctrl state for alarm LEDs (Gabor Juhos)
  - smb: client: Fix use-after-free in cifs_fill_dirent (Zhaolong Wang) [Orabug: 38094970] {CVE-2025-38051}
  - drm/edid: fixed the bug that hdr metadata was not reset (Feijuan Li)
  - thermal: intel: x86_pkg_temp_thermal: Fix bogus trip temperature (Zhang Rui)
  - platform/x86: dell-wmi-sysman: Avoid buffer overflow in current_password_store() (Vladimir Moskovkin) [Orabug: 38095141] {CVE-2025-38077}
  - pmdomain: core: Fix error checking in genpd_dev_pm_attach_by_id() (Dan Carpenter)
  - pmdomain: renesas: rcar: Remove obsolete nullify checks (Geert Uytterhoeven)
  - vmxnet3: update MTU after device quiesce (Ronak Doshi)
  - net: dsa: microchip: linearize skb for tail-tagging switches (Jakob Unterwurzacher)
  - can: kvaser_pciefd: Fix echo_skb race (Axel Forsman)
  - can: kvaser_pciefd: Continue parsing DMA buf after dropped RX (Axel Forsman)
  - llc: fix data loss when reading from a socket in llc_ui_recvmsg() (Gavrilov Ilia)
  - ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14ASP10 (Ed Burcher)
  - ALSA: pcm: Fix race of buffer access at PCM OSS layer (Takashi Iwai) [Orabug: 38095145] {CVE-2025-38078}
  - ASoC: SOF: ipc4-pcm: Delay reporting is only supported for playback direction (Peter Ujfalusi)
  - ASoc: SOF: topology: connect DAI to a single DAI link (Kai Vehmanen)
  - ASoC: SOF: Intel: hda-bus: Use PIO mode on ACE2+ platforms (Peter Ujfalusi)
  - ASoC: SOF: ipc4-control: Use SOF_CTRL_CMD_BINARY as numid for bytes_ext (Peter Ujfalusi)
  - can: bcm: add missing rcu read protection for procfs content (Oliver Hartkopp) [Orabug: 38049369] {CVE-2025-38003}
  - can: bcm: add locking for bcm_op runtime updates (Oliver Hartkopp) [Orabug: 38049374] {CVE-2025-38004}
  - can: slcan: allow reception of short error messages (Carlos Sanchez)
  - padata: do not leak refcount in reorder_work (Dominik Grzegorzek) [Orabug: 38094842] {CVE-2025-38031}
  - crypto: algif_hash - fix double free in hash_accept (Ivan Pravdin) [Orabug: 38095153] {CVE-2025-38079}
  - clk: s2mps11: initialise clk_hw_onecell_data::num before accessing ::hws[] in probe() (André Draszik)
  - octeontx2-af: Fix APR entry mapping based on APR_LMT_CFG (Geetha Sowjanya)
  - octeontx2-af: Set LMT_ENA bit for APR table entries (Subbaraya Sundeep)
  - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (Wang Liang) [Orabug: 38094978] {CVE-2025-38052}
  - octeontx2-pf: Add AF_XDP non-zero copy support (Suman Ghosh)
  - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (Cong Wang) [Orabug: 38049357] {CVE-2025-38000}
  - idpf: fix idpf_vport_splitq_napi_poll() (Eric Dumazet)
  - io_uring: fix overflow resched cqe reordering (Pavel Begunkov)
  - net: lan743x: Restore SGMII CTRL register on resume (Thangaraj Samynathan)
  - net: dwmac-sun8i: Use parsed internal PHY address instead of 1 (Paul Kocialkowski)
  - pinctrl: qcom: switch to devm_register_sys_off_handler() (Dmitry Baryshkov)
  - loop: don't require ->write_iter for writable files in loop_configure (Christoph Hellwig)
  - idpf: fix null-ptr-deref in idpf_features_check (Pavan Kumar Linga) [Orabug: 38094982] {CVE-2025-38053}
  - ice: Fix LACP bonds without SRIOV environment (Dave Ertman)
  - ice: fix vf->num_mac count with port representors (Jacob Keller)
  - bridge: netfilter: Fix forwarding of fragmented packets (Ido Schimmel)
  - ptp: ocp: Limit signal/freq counts in summary output functions (Sagi Maimon) [Orabug: 38094984] {CVE-2025-38054}
  - Bluetooth: btusb: use skb_pull to avoid unsafe access in QCA dump handling (En-Wei Wu)
  - Bluetooth: L2CAP: Fix not checking l2cap_chan security level (Luiz Augusto von Dentz)
  - perf/x86/intel: Fix segfault with PEBS-via-PT with sample_freq (Adrian Hunter) [Orabug: 38094988] {CVE-2025-38055}
  - irqchip/riscv-imsic: Start local sync timer on correct CPU (Andrew Bresticker)
  - ASoC: SOF: Intel: hda: Fix UAF when reloading module (Tavian Barnes) [Orabug: 38094991] {CVE-2025-38056}
  - devres: Introduce devm_kmemdup_array() (Raag Jadav)
  - driver core: Split devres APIs to device/devres.h (Andy Shevchenko)
  - dmaengine: fsl-edma: Fix return code for unhandled interrupts (Stefan Wahren)
  - dmaengine: idxd: Fix ->poll() return value (Dave Jiang)
  - xfrm: Sanitize marks before insert (Paul Chaignon)
  - clk: sunxi-ng: d1: Add missing divider for MMC mod clocks (Andre Przywara)
  - remoteproc: qcom_wcnss: Fix on platforms without fallback regulators (Matti Lehtimäki)
  - kernel/fork: only call untrack_pfn_clear() on VMAs duplicated for fork() (David Hildenbrand)
  - x86/sev: Fix operator precedence in GHCB_MSR_VMPL_REQ_LEVEL macro (Seongman Lee)
  - dmaengine: idxd: Fix allowing write() from different address spaces (Vinicius Costa Gomes)
  - xfrm: Fix UDP GRO handling for some corner cases (Tobias Brunner)
  - espintcp: remove encap socket caching to avoid reference leak (Sabrina Dubroca)
  - espintcp: fix skb leaks (Sabrina Dubroca) [Orabug: 38094993] {CVE-2025-38057}
  - soundwire: bus: Fix race on the creation of the IRQ domain (Charles Keepax)
  - __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock (Al Viro) [Orabug: 38095000] {CVE-2025-38058}
  - drm/amd/display: Call FP Protect Before Mode Programming/Mode Support (Austin Zheng)
  - xenbus: Allow PVH dom0 a non-local xenstore (Jason Andryuk)
  - x86/Kconfig: make CFI_AUTO_DEFAULT depend on !RUST or Rust >= 1.88 (Paweł Anikiel) [Orabug: 38094847] {CVE-2025-38033}
  - wifi: iwlwifi: add support for Killer on MTL (Johannes Berg)
  - block: only update request sector if needed (Johannes Thumshirn)
  - tools: ynl-gen: validate 0 len strings from kernel (David Wei)
  - btrfs: avoid NULL pointer dereference if no valid csum tree (Qu Wenruo) [Orabug: 38095010] {CVE-2025-38059}
  - btrfs: handle empty eb->folios in num_extent_folios() (Boris Burkov)
  - btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref (Goldwyn Rodrigues) [Orabug: 38094856] {CVE-2025-38034}
  - btrfs: compression: adjust cb->compressed_folios allocation type (Kees Cook)
  - ASoC: intel/sdw_utils: Add volume limit to cs42l43 speakers (Stefan Binding)
  - cifs: Fix changing times and read-only attr over SMB1 smb_set_file_info() function (Pali Rohár)
  - cifs: Fix and improve cifs_query_path_info() and cifs_query_file_info() (Pali Rohár)
  - io_uring/fdinfo: annotate racy sq/cq head/tail reads (Jens Axboe)
  - nvmet-tcp: don't restore null sk_state_change (Alistair Francis) [Orabug: 38094863] {CVE-2025-38035}
  - ALSA: usb-audio: Fix duplicated name in MIDI substream names (Takashi Iwai)
  - nvme-pci: add quirks for WDC Blue SN550 15b7:5009 (Guan Wentao)
  - nvme-pci: add quirks for device 126f:1001 (Guan Wentao)
  - ALSA: hda/realtek: Add quirk for HP Spectre x360 15-df1xxx (Takashi Iwai)
  - ASoC: Intel: bytcr_rt5640: Add DMI quirk for Acer Aspire SW3-013 (Takashi Iwai)
  - ASoC: cs42l43: Disable headphone clamps during type detection (Charles Keepax)
  - platform/x86: ideapad-laptop: add support for some new buttons (Gašper Nemgar)
  - platform/x86: asus-wmi: Disable OOBE state after resume from hibernation (Pavel Nikulin)
  - platform/x86/intel: hid: Add Pantherlake support (Saranya Gopal)
  - smb: server: smb2pdu: check return value of xa_store() (Salah Triki)
  - pinctrl: meson: define the pull up/down resistor value as 60 kOhm (Martin Blumenstingl)
  - book3s64/radix: Fix compile errors when CONFIG_ARCH_WANT_OPTIMIZE_DAX_VMEMMAP=n (Ritesh Harjani)
  - ASoC: imx-card: Adjust over allocation of memory in imx_card_parse_of() (Chenyuan Yang)
  - drm: Add valid clones check (Jessica Zhang)
  - drm/panel-edp: Add Starry 116KHD024006 (Douglas Anderson)
  - drm/buddy: fix issue that force_merge cannot free all roots (Lin Cao)
  - drm/atomic: clarify the rules around drm_atomic_state->allow_modeset (Simona Vetter)
  - drm/xe: Reject BO eviction if BO is bound to current VM (Oak Zeng)
  - drm/xe/sa: Always call drm_suballoc_manager_fini() (Michal Wajdeczko)
  - wifi: rtw89: coex: Separated Wi-Fi connecting event from Wi-Fi scan event (Ching-Te Ku)
  - drm/xe: Do not attempt to bootstrap VF in execlists mode (Maarten Lankhorst)
  - drm/xe: Move suballocator init to after display init (Maarten Lankhorst)
  - wifi: ath11k: Use dma_alloc_noncoherent for rx_tid buffer allocation (P Praneesh)
  - drm/nouveau: fix the broken marco GSP_MSG_MAX_SIZE (Zhi Wang)
  - drm: bridge: adv7511: fill stream capabilities (Olivier Moysan)
  - wifi: ath12k: Fix end offset bit definition in monitor ring descriptor (P Praneesh)
  - wifi: ath12k: Fetch regdb.bin file from board-2.bin (Aaradhana Sahu)
  - wifi: ath9k: return by of_get_mac_address (Rosen Penev)
  - drm/xe/pf: Reset GuC VF config when unprovisioning critical resource (Michal Wajdeczko)
  - accel/qaic: Mask out SR-IOV PCI resources (Youssef Samir)
  - wifi: ath12k: fix ath12k_hal_tx_cmd_ext_desc_setup() info1 override (Nicolas Escande)
  - regulator: ad5398: Add device tree support (Isaac Scott)
  - spi: zynqmp-gqspi: Always acknowledge interrupts (Sean Anderson)
  - wifi: rtw89: add wiphy_lock() to work that isn't held wiphy_lock() yet (Ping-Ke Shih)
  - wifi: rtw88: Don't use static local variable in rtw8822b_set_tx_power_index_by_rate (Bitterblue Smith)
  - wifi: rtl8xxxu: retry firmware download on error (Soeren Moch)
  - clk: renesas: rzg2l-cpg: Refactor Runtime PM clock validation (Lad Prabhakar)
  - perf/amd/ibs: Fix ->config to sample period calculation for OP PMU (Ravi Bangoria)
  - perf/amd/ibs: Fix perf_ibs_op.cnt_mask for CurCnt (Ravi Bangoria)
  - firmware: arm_scmi: Relax duplicate name constraint across protocol ids (Sudeep Holla)
  - bpftool: Fix readlink usage in get_fd_type (Viktor Malik)
  - bpf: Use kallsyms to find the function name of a struct_ops's stub function (Martin Kafai Lau)
  - drm/ast: Find VBIOS mode from regular display size (Thomas Zimmermann)
  - dm vdo: use a short static string for thread name prefix (Matthew Sakai)
  - dm vdo indexer: prevent unterminated string warning (Chung Chung)
  - irqchip/riscv-aplic: Add support for hart indexes (Vladimir Kondratiev)
  - ASoC: rt722-sdca: Add some missing readable registers (Charles Keepax)
  - ASoC: codecs: pcm3168a: Allow for 24-bit in provider mode (Cezary Rojewski)
  - arm64: zynqmp: add clock-output-names property in clock nodes (Naman Trivedi Manojbhai)
  - HID: usbkbd: Fix the bit shift number for LED_KANA (Junan)
  - wifi: ath12k: Avoid napi_sync() before napi_enable() (Avula Sri Charan)
  - scsi: st: Restore some drive settings after reset (Kai Mäkisara)
  - net/mana: fix warning in the writer of client oob (Konstantin Taranov)
  - drm/xe/relay: Don't use GFP_KERNEL for new transactions (Michal Wajdeczko)
  - ice: count combined queues using Rx/Tx count (Michal Swiatkowski)
  - perf: Avoid the read if the count is already updated (Peter Zijlstra)
  - rcu: fix header guard for rcu_all_qs() (Ankur Arora)
  - rcu: handle unstable rdp in rcu_read_unlock_strict() (Ankur Arora)
  - rcu: handle quiescent states for PREEMPT_RCU=n, PREEMPT_COUNT=y (Ankur Arora)
  - ice: treat dyn_allowed only as suggestion (Michal Swiatkowski)
  - ice: init flow director before RDMA (Michal Swiatkowski)
  - bridge: mdb: Allow replace of a host-joined group (Petr Machata)
  - net: flush_backlog() small changes (Eric Dumazet)
  - r8169: don't scan PHY addresses > 0 (Heiner Kallweit)
  - ipv4: ip_gre: Fix set but not used warning in ipgre_err() if IPv4-only (Geert Uytterhoeven)
  - vxlan: Annotate FDB data races (Ido Schimmel) [Orabug: 38094879] {CVE-2025-38037}
  - cpufreq: amd-pstate: Remove unnecessary driver_lock in set_boost (Dhananjay Ugwekar) [Orabug: 38094888] {CVE-2025-38038}
  - tools: ynl-gen: don't output external constants (Jakub Kicinski)
  - eth: fbnic: set IFF_UNICAST_FLT to avoid enabling promiscuous mode when adding unicast addrs (Alexander Duyck)
  - drm/rockchip: vop2: Improve display modes handling on RK3588 HDMI0 (Cristian Ciocaltea)
  - media: qcom: camss: Add default case in vfe_src_pad_code (Depeng Shao)
  - media: qcom: camss: csid: Only add TPG v4l2 ctrl if TPG hardware is available (Depeng Shao)
  - f2fs: introduce f2fs_base_attr for global sysfs entries (Jaegeuk Kim)
  - hwmon: (xgene-hwmon) use appropriate type for the latency value (Andrey Vatoropin)
  - tools/power turbostat: Clustered Uncore MHz counters should honor show/hide options (Len Brown)
  - net: page_pool: avoid false positive warning if NAPI was never added (Jakub Kicinski)
  - clk: qcom: camcc-sm8250: Use clk_rcg2_shared_ops for some RCGs (Jordan Crouse)
  - wifi: rtw89: call power_on ahead before selecting firmware (Ping-Ke Shih)
  - wifi: rtw89: fw: validate multi-firmware header before accessing (Ping-Ke Shih)
  - wifi: rtw89: fw: validate multi-firmware header before getting its size (Ping-Ke Shih)
  - wifi: rtw89: coex: Assign value over than 0 to avoid firmware timer hang (Ching-Te Ku)
  - wifi: rtw88: Fix __rtw_download_firmware() for RTL8814AU (Bitterblue Smith)
  - wifi: rtw88: Fix download_firmware_validate() for RTL8814AU (Bitterblue Smith)
  - ext4: remove writable userspace mappings before truncating page cache (Zhang Yi)
  - ext4: don't write back data before punch hole in nojournal mode (Zhang Yi)
  - leds: trigger: netdev: Configure LED blink interval for HW offload (Marek Vasut)
  - pstore: Change kmsg_bytes storage size to u32 (Kees Cook)
  - iio: adc: ad7944: don't use storagebits for sizing (David Lechner)
  - r8152: add vendor/device ID pair for Dell Alienware AW1022z (Aleksander Jan Bajkowski)
  - ip: fib_rules: Fetch net from fib_rule in fib[46]_rule_configure(). (Kuniyuki Iwashima)
  - arch/powerpc/perf: Check the instruction type before creating sample with perf_mem_data_src (Athira Rajeev)
  - powerpc/pseries/iommu: create DDW for devices with DMA mask less than 64-bits (Gaurav Batra)
  - powerpc/pseries/iommu: memory notifier incorrectly adds TCEs for pmemory (Gaurav Batra)
  - net: fec: Refactor MAC reset to function (Csókás Bence)
  - wifi: mac80211: set ieee80211_prep_tx_info::link_id upon Auth Rx (Emmanuel Grumbach)
  - wifi: mac80211: remove misplaced drv_mgd_complete_tx() call (Johannes Berg)
  - wifi: mac80211: don't unconditionally call drv_mgd_complete_tx() (Johannes Berg)
  - wifi: iwlwifi: don't warn during reprobe (Miri Korenblit)
  - wifi: iwlwifi: use correct IMR dump variable (Johannes Berg)
  - mptcp: pm: userspace: flags: clearer msg if no remote addr (Matthieu Baerts)
  - wifi: ath12k: fix the ampdu id fetch in the HAL_RX_MPDU_START TLV (P Praneesh)
  - xfrm: prevent high SEQ input in non-ESN mode (Leon Romanovsky)
  - drm/v3d: Add clock handling (Stefan Wahren)
  - net/mlx5e: reduce the max log mpwrq sz for ECPF and reps (William Tu)
  - net/mlx5e: reduce rep rxq depth to 256 for ECPF (William Tu)
  - net/mlx5e: set the tx_queue_len for pfifo_fast (William Tu)
  - net/mlx5: Extend Ethtool loopback selftest to support non-linear SKB (Alexei Lazar)
  - net/mlx5: XDP, Enable TX side XDP multi-buffer support (Alexei Lazar)
  - scsi: target: spc: Fix loop traversal in spc_rsoc_get_descr() (Chaohai Chen)
  - drm/amd/display/dm: drop hw_support check in amdgpu_dm_i2c_xfer() (Alex Deucher)
  - drm/amdgpu: enlarge the VBIOS binary size limit (Morris Zhang)
  - drm/amdgpu: Use active umc info from discovery (Lijo Lazar)
  - drm/amd/display: Populate register address for dentist for dcn401 (Dillon Varone)
  - drm/amd/display: Use Nominal vBlank If Provided Instead Of Capping It (Austin Zheng)
  - drm/amd/display: Increase block_sequence array size (Joshua Aberback) [Orabug: 38095164] {CVE-2025-38080}
  - drm/amd/display: Initial psr_version with correct setting (Tom Chung)
  - drm/amd/display: Update CR AUX RD interval interpretation (George Shen)
  - Revert "drm/amd/display: Exit idle optimizations before attempt to access PHY" (Brandon Syu)
  - drm/amd/display: Support multiple options during psr entry. (Martin Tsai)
  - drm/amd/pm: Skip P2S load for SMU v13.0.12 (Asad Kamal)
  - drm/amdgpu: reset psp->cmd to NULL after releasing the buffer (Jiang Liu)
  - drm/amd/display: Don't try AUX transactions on disconnected link (Ilya Bakoulin)
  - drm/amd/display: pass calculated dram_speed_mts to dml2 (Charlene Liu)
  - drm/amdgpu: Set snoop bit for SDMA for MI series (Harish Kasiviswanathan)
  - drm/amdkfd: fix missing L2 cache info in topology (Eric Huang)
  - drm/amdgpu/mes11: fix set_hw_resources_1 calculation (Alex Deucher)
  - net: stmmac: dwmac-loongson: Set correct {tx,rx}_fifo_size (Huacai Chen)
  - soundwire: cadence_master: set frame shape and divider based on actual clk freq (Bard Liao)
  - soundwire: amd: change the soundwire wake enable/disable sequence (Vijendar Mukunda)
  - phy: exynos5-usbdrd: fix EDS distribution tuning (gs101) (André Draszik)
  - phy: core: don't require set_mode() callback for phy_get_mode() to work (Dmitry Baryshkov)
  - phy: phy-rockchip-samsung-hdptx: Swap the definitions of LCPLL_REF and ROPLL_REF (Damon Ding)
  - pinctrl: renesas: rzg2l: Add suspend/resume support for pull up/down (Claudiu Beznea)
  - serial: sh-sci: Update the suspend/resume support (Claudiu Beznea)
  - sched: Reduce the default slice to avoid tasks getting an extra tick (Zihan Zhou)
  - x86/traps: Cleanup and robustify decode_bug() (Peter Zijlstra)
  - x86/ibt: Handle FineIBT in handle_cfi_failure() (Peter Zijlstra)
  - drm/xe/debugfs: Add missing xe_pm_runtime_put in wedge_mode_set (Shuicheng Lin)
  - drm/xe/debugfs: fixed the return value of wedged_mode_set (Xin Wang)
  - clk: qcom: clk-alpha-pll: Do not use random stack value for recalc rate (Krzysztof Kozlowski)
  - clk: qcom: ipq5018: allow it to be bulid on arm32 (Karl Chan)
  - drm/xe: Fix xe_tile_init_noalloc() error propagation (Lucas De Marchi)
  - drm/xe: Stop ignoring errors from xe_ttm_stolen_mgr_init() (Lucas De Marchi)
  - net/mlx4_core: Avoid impossible mlx4_db_alloc() order value (Kees Cook)
  - media: v4l: Memset argument to 0 before calling get_mbus_config pad op (Sakari Ailus)
  - media: i2c: imx219: Correct the minimum vblanking value (David Plowman)
  - kunit: tool: Use qboot on QEMU x86_64 (Brendan Jackman)
  - smack: Revert "smackfs: Added check catlen" (Konstantin Andreev)
  - smack: recognize ipv4 CIPSO w/o categories (Konstantin Andreev)
  - pinctrl: devicetree: do not goto err when probing hogs in pinctrl_dt_to_map (Valentin Caron)
  - ASoC: soc-dai: check return value at snd_soc_dai_set_tdm_slot() (Kuninori Morimoto)
  - ASoC: tas2764: Power up/down amp on mute ops (Hector Martin)
  - ASoC: tas2764: Mark SW_RESET as volatile (Hector Martin)
  - ASoC: tas2764: Add reg defaults for TAS2764_INT_CLK_CFG (Hector Martin)
  - ASoC: ops: Enforce platform maximum on initial value (Martin Povišer)
  - firmware: xilinx: Dont send linux address to get fpga config get status (Siva Durga Prasad Paladugu)
  - firmware: arm_ffa: Handle the presence of host partition in the partition info (Sudeep Holla)
  - firmware: arm_ffa: Reject higher major version as incompatible (Sudeep Holla)
  - net/mlx5: Apply rate-limiting to high temperature warning (Shahar Shitrit)
  - net/mlx5: Modify LSB bitmask in temperature event to include only the first bit (Shahar Shitrit)
  - media: test-drivers: vivid: don't call schedule in loop (Hans Verkuil)
  - irqchip/riscv-imsic: Set irq_set_affinity() for IMSIC base (Andrew Jones)
  - hrtimers: Replace hrtimer_clock_to_base_table with switch-case (Andy Shevchenko)
  - vxlan: Join / leave MC group after remote changes (Petr Machata)
  - ACPI: HED: Always initialize before evged (Xiaofei Tan)
  - PCI: Fix old_size lower bound in calculate_iosize() too (Ilpo Järvinen)
  - eth: mlx4: don't try to complete XDP frames in netpoll (Jakub Kicinski)
  - bpf: copy_verifier_state() should copy 'loop_entry' field (Eduard Zingerman) [Orabug: 38095018] {CVE-2025-38060}
  - bpf: don't do clean_live_states when state->loop_entry->branches > 0 (Eduard Zingerman)
  - can: c_can: Use of_property_present() to test existence of DT property (Krzysztof Kozlowski)
  - pmdomain: imx: gpcv2: use proper helper for property detection (Ahmad Fatoum)
  - RDMA/core: Fix best page size finding when it can cross SG entries (Michael Margolin)
  - serial: mctrl_gpio: split disable_ms into sync and no_sync APIs (Alexis Lothoré) [Orabug: 38094901] {CVE-2025-38040}
  - drm/amd/display: Don't treat wb connector as physical in create_validate_stream_for_sink (Harry Wentland)
  - Revert "drm/amd/display: Request HW cursor on DCN3.2 with SubVP" (Leo Zeng)
  - drm/amd/display: Read LTTPR ALPM caps during link cap retrieval (George Shen)
  - drm/amd/display: Fix BT2020 YCbCr limited/full range input (Ilya Bakoulin)
  - drm/amd/display: Guard against setting dispclk low when active (Nicholas Kazlauskas)
  - drm/amd/display: Add support for disconnected eDP streams (Harry Vanzylldejong)
  - drm/amd/pm: Fetch current power limit from PMFW (Lijo Lazar)
  - irqchip/riscv-imsic: Separate next and previous pointers in IMSIC vector (Anup Patel)
  - eeprom: ee1004: Check chip before probing (Eddie James)
  - mfd: axp20x: AXP717: Add AXP717_TS_PIN_CFG to writeable regs (Chris Morgan)
  - i3c: master: svc: Flush FIFO before sending Dynamic Address Assignment(DAA) (Frank Li)
  - EDAC/ie31200: work around false positive build warning (Arnd Bergmann)
  - power: supply: axp20x_battery: Update temp sensor for AXP717 from device tree (Chris Morgan)
  - net: pktgen: fix access outside of user given buffer in pktgen_thread_write() (Peter Seiderer) [Orabug: 38095024] {CVE-2025-38061}
  - wifi: rtw89: 8922a: fix incorrect STA-ID in EHT MU PPDU (Kuan-Chung Chen)
  - wifi: rtw89: fw: add blacklist to avoid obsolete secure firmware (Ping-Ke Shih)
  - wifi: rtw89: fw: get sb_sel_ver via get_unaligned_le32() (Ping-Ke Shih)
  - wifi: rtw89: fw: propagate error code from rtw89_h2c_tx() (Ping-Ke Shih)
  - wifi: rtw88: Fix rtw_desc_to_mcsrate() to handle MCS16-31 (Bitterblue Smith)
  - wifi: rtw88: Fix rtw_init_ht_cap() for RTL8814AU (Bitterblue Smith)
  - wifi: rtw88: Fix rtw_init_vht_cap() for RTL8814AU (Bitterblue Smith)
  - PCI: epf-mhi: Update device ID for SA8775P (Mrinmay Sarkar)
  - clocksource: mips-gic-timer: Enable counter when CPUs start (Paul Burton)
  - MIPS: pm-cps: Use per-CPU variables as per-CPU, not per-core (Paul Burton)
  - genirq/msi: Store the IOMMU IOVA directly in msi_desc instead of iommu_cookie (Jason Gunthorpe) [Orabug: 38095031] {CVE-2025-38062}
  - x86/locking: Use ALT_OUTPUT_SP() for percpu_{,try_}cmpxchg{64,128}_op() (Uros Bizjak)
  - drm/amdgpu: remove all KFD fences from the BO on release (Christian König)
  - MIPS: Use arch specific syscall name match function (Bibo Mao)
  - drm/xe/oa: Ensure that polled read returns latest data (Umesh Nerlige Ramappa)
  - net: ipv6: Init tunnel link-netns before registering dev (Xiao Liang)
  - crypto: skcipher - Zap type in crypto_alloc_sync_skcipher (Herbert Xu)
  - crypto: ahash - Set default reqsize from ahash_alg (Herbert Xu)
  - x86/kaslr: Reduce KASLR entropy on most x86 systems (Balbir Singh)
  - net/mlx5: Change POOL_NEXT_SIZE define value and make it global (Patrisious Haddad)
  - scsi: scsi_debug: First fixes for tapes (Kai Mäkisara)
  - dm: fix unconditional IO throttle caused by REQ_PREFLUSH (Jinliang Zheng) [Orabug: 38095038] {CVE-2025-38063}
  - libbpf: Fix out-of-bound read (Nandakumar Edamana)
  - loop: check in LO_FLAGS_DIRECT_IO in loop_default_blocksize (Christoph Hellwig)
  - net/mlx5e: Add correct match to check IPSec syndromes for switchdev mode (Jianbo Liu)
  - media: tc358746: improve calculation of the D-PHY timing registers (Matthias Fend)
  - media: adv7180: Disable test-pattern control on adv7180 (Niklas Söderlund)
  - cpuidle: menu: Avoid discarding useful information (Rafael J. Wysocki)
  - vdpa/mlx5: Fix mlx5_vdpa_get_config() endianness on big-endian machines (Konstantin Shkolnyy)
  - x86/nmi: Add an emergency handler in nmi_desc & use it in nmi_shootdown_cpus() (Waiman Long)
  - ASoC: mediatek: mt8188: Add reference for dmic clocks (Nícolas F R A Prado)
  - ASoC: mediatek: mt8188: Treat DMIC_GAINx_CUR as non-volatile (Nícolas F R A Prado)
  - drm/amd/display: Fix mismatch type comparison (Navid Assadian)
  - drm/amd/display: fix dcn4x init failed (Charlene Liu)
  - drm/amd/display: handle max_downscale_src_width fail check (Yihan Zhu)
  - x86/build: Fix broken copy command in genimage.sh when making isoimage (Nir Lichtman)
  - Octeontx2-af: RPM: Register driver with PCI subsys IDs (Hariprasad Kelam)
  - bpf: Search and add kfuncs in struct_ops prologue and epilogue (Amery Hung)
  - soc: ti: k3-socinfo: Do not use syscon helper to build regmap (Andrew Davis)
  - wifi: ath12k: Improve BSS discovery with hidden SSID in 6 GHz band (Ramasamy Kaliappan)
  - bonding: report duplicate MAC address in all situations (Hangbin Liu)
  - net: xgene-v2: remove incorrect ACPI_PTR annotation (Arnd Bergmann)
  - net: ethernet: mtk_ppe_offload: Allow QinQ, double ETH_P_8021Q only (Eric Woudstra)
  - leds: pwm-multicolor: Add check for fwnode_property_read_u32 (Yuanjun Gong)
  - drm/xe: xe_gen_wa_oob: replace program_invocation_short_name (Daniel Gomez)
  - drm/amdkfd: KFD release_work possible circular locking (Philip Yang)
  - pinctrl: sophgo: avoid to modify untouched bit when setting cv1800 pinconf (Inochi Amaoto)
  - selftests/net: have `gro.sh -t` return a correct exit code (Kevin Krakauer)
  - net/mlx5: Avoid report two health errors on same syndrome (Moshe Shemesh)
  - drm/xe/pf: Create a link between PF and VF devices (K V P Satyanarayana)
  - drm/xe/vf: Retry sending MMIO request to GUC on timeout error (K V P Satyanarayana)
  - firmware: arm_ffa: Set dma_mask for ffa devices (Viresh Kumar) [Orabug: 38094925] {CVE-2025-38043}
  - PCI: brcmstb: Add a softdep to MIP MSI-X driver (Stanimir Varbanov)
  - PCI: brcmstb: Expand inbound window size up to 64GB (Stanimir Varbanov)
  - wifi: ath12k: Report proper tx completion status to mac80211 (Vinith Kumar R)
  - soc: apple: rtkit: Implement OSLog buffers properly (Hector Martin)
  - soc: apple: rtkit: Use high prio work queue (Janne Grunau)
  - perf: arm_pmuv3: Call kvm_vcpu_pmu_resync_el0() before enabling counters (Rob Herring)
  - fpga: altera-cvp: Increase credit timeout (Kuhanh Murugasen Krishnan)
  - drm/mediatek: mtk_dpi: Add checks for reg_h_fre_con existence (AngeloGioacchino Del Regno)
  - ARM: at91: pm: fix at91_suspend_finish for ZQ calibration (Li Bin)
  - hwmon: (gpio-fan) Add missing mutex locks (Alexander Stein)
  - x86/bugs: Make spectre user default depend on MITIGATION_SPECTRE_V2 (Breno Leitao)
  - clk: imx8mp: inform CCF of maximum frequency of clocks (Ahmad Fatoum)
  - media: uvcvideo: Handle uvc menu translation inside uvc_get_le_value (Ricardo Ribalda)
  - media: uvcvideo: Add sanity check to uvc_ioctl_xu_ctrl_map (Ricardo Ribalda)
  - ublk: complete command synchronously on error (Caleb Sander)
  - block: mark bounce buffering as incompatible with integrity (Christoph Hellwig)
  - drm/rockchip: vop2: Add uv swap for cluster window (Andy Yan)
  - ipv4: fib: Move fib_valid_key_len() to rtm_to_fib_config(). (Kuniyuki Iwashima)
  - scsi: logging: Fix scsi_logging_level bounds (Nicolas Bouchinet)
  - ALSA: hda/realtek: Enable PC beep passthrough for HP EliteBook 855 G7 (Maciej S. Szmigiero)
  - perf/hw_breakpoint: Return EOPNOTSUPP for unsupported breakpoint type (Saket Kumar Bhaskar)
  - net: pktgen: fix mpls maximum labels list parsing (Peter Seiderer)
  - media: imx335: Set vblank immediately (Paul Elder)
  - iommufd: Disallow allocating nested parent domain with fault ID (Yi Liu)
  - ublk: enforce ublks_max only for unprivileged devices (Uday Shankar)
  - dpll: Add an assertion to check freq_supported_num (Jiasheng Jiang)
  - net: phy: nxp-c45-tja11xx: add match_phy_device to TJA1103/TJA1104 (Andrei Botila)
  - net: ethernet: ti: cpsw_new: populate netdev of_node (Alexander Sverdlin)
  - rcu: Fix get_state_synchronize_rcu_full() GP-start detection (Paul E. McKenney)
  - pinctrl: bcm281xx: Use "unsigned int" instead of bare "unsigned" (Artur Weber)
  - media: cx231xx: set device_caps for 417 (Hans Verkuil) [Orabug: 38094934] {CVE-2025-38044}
  - perf/core: Clean up perf_try_init_event() (Peter Zijlstra)
  - drm/amd/display: Request HW cursor on DCN3.2 with SubVP (Aric Cyr)
  - drm/amd/display: Fix p-state type when p-state is unsupported (Dillon Varone)
  - drm/amd/display: Fix DMUB reset sequence for DCN401 (Dillon Varone)
  - drm/amd/display: Skip checking FRL_MODE bit for PCON BW determination (George Shen)
  - drm/amd/display: Ensure DMCUB idle before reset on DCN31/DCN35 (Nicholas Kazlauskas)
  - drm/amdgpu: Do not program AGP BAR regs under SRIOV in gfxhub_v1_0.c (Victor Lu)
  - remoteproc: qcom_wcnss: Handle platforms with only single power domain (Matti Lehtimäki)
  - blk-throttle: don't take carryover for prioritized processing of metadata (Ming Lei)
  - net: phylink: use pl->link_interface in phylink_expects_phy() (Choong Yong Liang)
  - drm/gem: Test for imported GEM buffers with helper (Thomas Zimmermann)
  - orangefs: Do not truncate file size (Matthew Wilcox) [Orabug: 38095056] {CVE-2025-38065}
  - soc: mediatek: mtk-mutex: Add DPI1 SOF/EOF to MT8188 mutex tables (AngeloGioacchino Del Regno)
  - dm cache: prevent BUG_ON by blocking retries on failed device resumes (Ming-Hung Tsai) [Orabug: 38095063] {CVE-2025-38066}
  - usb: xhci: set page size to the xHCI-supported size (Niklas Neronin)
  - media: c8sectpfe: Call of_node_put(i2c_bus) only once in c8sectpfe_probe() (Markus Elfring)
  - ARM: tegra: Switch DSI-B clock parent to PLLD on Tegra114 (Svyatoslav Ryhel)
  - soc: samsung: include linux/array_size.h where needed (Arnd Bergmann)
  - drm/xe: Retry BO allocation (Matthew Brost)
  - drm/xe: Nuke VM's mapping upon close (Matthew Brost)
  - ieee802154: ca8210: Use proper setters and getters for bitwise types (Andy Shevchenko)
  - rtc: ds1307: stop disabling alarms on probe (Alexandre Belloni)
  - tcp: bring back NUMA dispersion in inet_ehash_locks_alloc() (Eric Dumazet)
  - ALSA: seq: Improve data consistency at polling (Takashi Iwai)
  - powerpc/prom_init: Fixup missing #size-cells on PowerBook6,7 (Andreas Schwab)
  - arm64: tegra: Resize aperture for the IGX PCIe C5 slot (Jonathan Hunter)
  - arm64: tegra: p2597: Fix gpio for vdd-1v8-dis regulator (Diogo Ivo)
  - drm/amdgpu: Fix missing drain retry fault the last entry (Emily Deng)
  - drm/amdkfd: Set per-process flags only once cik/vi (Harish Kasiviswanathan)
  - drm/amdkfd: Set per-process flags only once for gfx9/10/11/12 (Harish Kasiviswanathan)
  - crypto: mxs-dcp - Only set OTP_KEY bit for OTP key (Sven Schwermer)
  - crypto: lzo - Fix compression buffer overrun (Herbert Xu) [Orabug: 38095079] {CVE-2025-38068}
  - misc: pci_endpoint_test: Give disabled BARs a distinct error code (Niklas Cassel)
  - PCI: endpoint: pci-epf-test: Fix double free that causes kernel to oops (Christian Bruel) [Orabug: 38095087] {CVE-2025-38069}
  - watchdog: aspeed: Update bootstatus handling (Chin-Ting Kuo)
  - cpufreq: tegra186: Share policy per cluster (Aaron Kling)
  - iommu/amd/pgtbl_v2: Improve error handling (Vasant Hegde)
  - coresight-etb10: change etb_drvdata spinlock's type to raw_spinlock_t (Levi Yun)
  - badblocks: Fix a nonsense WARN_ON() which checks whether a u64 variable < 0 (Coly Li)
  - ASoC: qcom: sm8250: explicitly set format in sm8250_be_hw_params_fixup() (Alexey Klimov)
  - auxdisplay: charlcd: Partially revert "Move hwidth and bwidth to struct hd44780_common" (Andy Shevchenko)
  - gfs2: Check for empty queue in run_queue (Andreas Gruenbacher)
  - drm/amd/display: Fix incorrect DPCD configs while Replay/PSR switch (Leon Huang)
  - drm/amd/display: not abort link train when bw is low (Peichen Huang)
  - drm/amd/display: calculate the remain segments for all pipes (Zhikai Zhai)
  - drm/amd/display: remove minimum Dispclk and apply oem panel timing. (Charlene Liu)
  - ipv6: save dontfrag in cork (Willem de Bruijn)
  - wifi: cfg80211: allow IR in 20 MHz configurations (Anjaneyulu)
  - wifi: mac80211_hwsim: Fix MLD address translation (Ilan Peer)
  - wifi: mac80211: fix warning on disconnect during failed ML reconf (Johannes Berg)
  - wifi: iwlwifi: fix the ECKV UEFI variable name (Emmanuel Grumbach)
  - wifi: iwlwifi: mark Br device not integrated (Johannes Berg)
  - wifi: iwlwifi: fix debug actions order (Johannes Berg) [Orabug: 38094942] {CVE-2025-38045}
  - wifi: iwlwifi: w/a FW SMPS mode selection (Daniel Gabay)
  - wifi: iwlwifi: don't warn when if there is a FW error (Miri Korenblit)
  - printk: Check CON_SUSPEND when unblanking a console (Marcos Paulo de Souza)
  - iommu: Keep dev->iommu state consistent (Robin Murphy)
  - hwmon: (dell-smm) Increment the number of fans (Kurt Borja)
  - wifi: iwlwifi: mvm: fix setting the TK when associated (Avraham Stern)
  - usb: xhci: Don't change the status of stalled TDs on failed Stop EP (Michał Pecio)
  - mmc: sdhci: Disable SD card clock before changing parameters (Erick Shepherd)
  - mmc: dw_mmc: add exynos7870 DW MMC support (Kaustabh Chakraborty)
  - arm64/mm: Check PUD_TYPE_TABLE in pud_bad() (Ryan Roberts)
  - arm64/mm: Check pmd_table() in pmd_trans_huge() (Ryan Roberts)
  - phy: rockchip: usbdp: Only verify link rates/lanes/voltage when the corresponding set flags are set (Andy Yan)
  - PNP: Expand length of fixup id string (Kees Cook)
  - netfilter: conntrack: Bound nf_conntrack sysctl writes (Nicolas Bouchinet)
  - wifi: rtw89: set force HE TB mode when connecting to 11ax AP (Dian-Syuan Yang)
  - timer_list: Don't use %pK through printk() (Thomas Weißschuh)
  - net: hsr: Fix PRP duplicate detection (Jaakko Karrenpalo)
  - net: stmmac: dwmac-rk: Validate GRF and peripheral GRF during probe (Jonas Karlman)
  - posix-timers: Ensure that timer initialization is fully visible (Thomas Gleixner)
  - posix-timers: Add cond_resched() to posix_timer_add() search loop (Eric Dumazet)
  - RDMA/uverbs: Propagate errors from rdma_lookup_get_uobject() (Maher Sanalla)
  - ext4: do not convert the unwritten extents if data writeback fails (Baokun Li)
  - ext4: reject the 'data_err=abort' option in nojournal mode (Baokun Li)
  - clk: qcom: lpassaudiocc-sc7280: Add support for LPASS resets for QCM6490 (Taniya Das)
  - ASoC: sun4i-codec: support hp-det-gpios property (Ryan Walklin)
  - drm/amdgpu: Update SRIOV video codec caps (David Rosca)
  - drm/amdgpu/gfx11: don't read registers in mqd init (Alex Deucher)
  - drm/amdgpu/gfx12: don't read registers in mqd init (Alex Deucher)
  - mfd: tps65219: Remove TPS65219_REG_TI_DEV_ID check (Shree Ramamoorthy)
  - pinctrl-tegra: Restore SFSEL bit when freeing pins (Prathamesh Shete)
  - xen: Add support for XenServer 6.1 platform device (Frediano Ziglio)
  - net/smc: use the correct ndev to find pnetid by pnetid table (Guangguan Wang)
  - dm: restrict dm device size to 2^63-512 bytes (Mikulas Patocka)
  - crypto: octeontx2 - suppress auth failure screaming due to negative tests (Shashank Gupta)
  - kconfig: do not clear SYMBOL_VALID when reading include/config/auto.conf (Masahiro Yamada)
  - kbuild: fix argument parsing in scripts/config (Seyediman Seyedarab)
  - bpf: Allow pre-ordering for bpf cgroup progs (Yonghong Song)
  - ASoC: mediatek: mt6359: Add stub for mt6359_accdet_enable_jack_detect (Nícolas F R A Prado)
  - ASoC: pcm6240: Drop bogus code handling IRQ as GPIO (Linus Walleij)
  - spi: spi-mux: Fix coverity issue, unchecked return value (Sergio Perez Gonzalez)
  - erofs: initialize decompression early (Gao Xiang)
  - thunderbolt: Do not add non-active NVM if NVM upgrade is disabled for retimer (Mika Westerberg)
  - objtool: Fix error handling inconsistencies in check() (Josh Poimboeuf)
  - rtc: rv3032: fix EERD location (Alexandre Belloni)
  - tcp: reorganize tcp_in_ack_event() and tcp_count_delivered() (Ilpo Järvinen)
  - jbd2: do not try to recover wiped journal (Jan Kara)
  - PCI: dwc: Use resource start as ioremap() input in dw_pcie_pme_turn_off() (Frank Li)
  - bpf: Return prog btf_id without capable check (Mykyta Yatsenko)
  - vfio/pci: Handle INTx IRQ_NOTCONNECTED (Alex Williamson)
  - scsi: st: ERASE does not change tape location (Kai Mäkisara)
  - scsi: st: Tighten the page format heuristics with MODE SELECT (Kai Mäkisara)
  - hypfs_create_cpu_files(): add missing check for hypfs_mkdir() failure (Al Viro)
  - ext4: reorder capability check last (Christian Göttsche)
  - riscv: Call secondary mmu notifier when flushing the tlb (Alexandre Ghiti)
  - bnxt_en: Query FW parameters when the CAPS_CHANGE bit is set (Shantiprasad Shettar)
  - wifi: mwifiex: Fix HT40 bandwidth issue. (Jeff Chen)
  - um: Update min_low_pfn to match changes in uml_reserved (Tiwei Bie)
  - um: Store full CSGSFS and SS register from mcontext (Benjamin Berg)
  - clocksource/drivers/timer-riscv: Stop stimecmp when cpu hotplug (Nick Hu)
  - dlm: make tcp still work in multi-link env (Heming Zhao)
  - s390/tlb: Use mm_has_pgste() instead of mm_alloc_pgste() (Heiko Carstens)
  - i3c: master: svc: Fix missing STOP for master request (Stanley Chu)
  - drm/amdgpu: adjust drm_firmware_drivers_only() handling (Alex Deucher)
  - drm/amd/display: Guard against setting dispclk low for dcn31x (Jing Zhou)
  - drm/amdgpu: release xcp_mgr on exit (Flora Cui)
  - blk-cgroup: improve policy registration error handling (Chen Linxuan)
  - btrfs: send: return -ENAMETOOLONG when attempting a path that is too long (Filipe Manana)
  - btrfs: get zone unusable bytes while holding lock at btrfs_reclaim_bgs_work() (Filipe Manana)
  - btrfs: fix non-empty delayed iputs list on unmount due to async workers (Filipe Manana)
  - btrfs: run btrfs_error_commit_super() early (Qu Wenruo)
  - btrfs: avoid linker error in btrfs_find_create_tree_block() (Mark Harmstone)
  - btrfs: make btrfs_discard_workfn() block_group ref explicit (Boris Burkov)
  - i2c: pxa: fix call balance of i2c->clk handling routines (Vitalii Mordan)
  - i2c: qup: Vote for interconnect bandwidth to DRAM (Stephan Gerhold)
  - x86/mm: Check return value from memblock_phys_alloc_range() (Philip Redkin) [Orabug: 38095101] {CVE-2025-38071}
  - x86/microcode: Update the Intel processor flag scan check (Sohil Mehta)
  - x86/smpboot: Fix INIT delay assignment for extended Intel Families (Sohil Mehta)
  - x86/stackprotector/64: Only export __ref_stack_chk_guard on CONFIG_SMP (Ingo Molnar)
  - x86/headers: Replace __ASSEMBLY__ with __ASSEMBLER__ in UAPI headers (Thomas Huth)
  - wifi: mt76: mt7925: fix fails to enter low power mode in suspend state (Quan Zhou)
  - wifi: mt76: mt7925: load the appropriate CLC data based on hardware type (Ming Yen Hsieh)
  - wifi: mt76: mt7996: revise TXS size (Benjamin Lin)
  - wifi: mt76: mt7996: fix SER reset trigger on WED reset (Rex Lu)
  - wifi: mt76: only mark tx-status-failed frames as ACKed on mt76x0/2 (Felix Fietkau)
  - cgroup/rstat: avoid disabling irqs for O(num_cpu) (Eric Dumazet)
  - drm/amdgpu: Skip pcie_replay_count sysfs creation for VF (Victor Skvortsov)
  - mmc: host: Wait for Vdd to settle on card power off (Erick Shepherd)
  - staging: vchiq_arm: Create keep-alive thread during probe (Stefan Wahren)
  - pidfs: improve multi-threaded exec and premature thread-group leader exit polling (Christian Brauner)
  - libnvdimm/labels: Fix divide error in nd_label_data_init() (Robert Richter) [Orabug: 38095109] {CVE-2025-38072}
  - ext4: on a remount, only log the ro or r/w state when it has changed (Nicolas Bretz)
  - xen/pci: Do not register devices with segments >= 0x10000 (Roger Pau Monné)
  - PCI: vmd: Disable MSI remapping bypass under Xen (Roger Pau Monné)
  - drm/amdkfd: set precise mem ops caps to disabled for gfx 11 and 12 (Jonathan Kim)
  - drm/amdgpu/discovery: check ip_discovery fw file available (Flora Cui)
  - pNFS/flexfiles: Report ENETDOWN as a connection error (Trond Myklebust)
  - tools/build: Don't pass test log files to linker (Ian Rogers)
  - r8169: disable RTL8126 ZRX-DC timeout (Chunhao Lin)
  - PCI: dwc: ep: Ensure proper iteration over outbound map windows (Frank Li)
  - objtool: Properly disable uaccess validation (Josh Poimboeuf)
  - lockdep: Fix wait context check on softirq for PREEMPT_RT (Ryo Takakura)
  - dql: Fix dql->limit value when reset. (Jing Su)
  - Bluetooth: Disable SCO support if READ_VOICE_SETTING is unsupported/broken (Pedro Nishiyama)
  - Bluetooth: btmtksdio: Prevent enabling interrupts after IRQ handler removal (Sean Wang)
  - thermal/drivers/qoriq: Power down TMU on system suspend (Alice Guo)
  - thermal/drivers/mediatek/lvts: Start sensor interrupts disabled (Nícolas F R A Prado)
  - net: tn40xx: create swnode for mdio and aqr105 phy and add to mdiobus (Hans-Frieder Vogt)
  - net: tn40xx: add pci-id of the aqr105-based Tehuti TN4010 cards (Hans-Frieder Vogt)
  - mctp: Fix incorrect tx flow invalidation condition in mctp-i2c (Daniel Hsu)
  - ASoC: codecs: wsa883x: Correct VI sense channel mask (Krzysztof Kozlowski)
  - ASoC: codecs: wsa884x: Correct VI sense channel mask (Krzysztof Kozlowski)
  - spi-rockchip: Fix register out of bounds access (Luis de Arquer) [Orabug: 38095173] {CVE-2025-38081}
  - SUNRPC: rpcbind should never reset the port to the value '0' (Trond Myklebust)
  - SUNRPC: rpc_clnt_set_transport() must not change the autobind setting (Trond Myklebust)
  - NFSv4: Treat ENETUNREACH errors as fatal for state recovery (Trond Myklebust)
  - cifs: Fix establishing NetBIOS session for SMB2+ connection (Pali Rohár)
  - cifs: add validation check for the fields in smb_aces (Namjae Jeon)
  - cifs: Set default Netbios RFC1001 server name to hostname in UNC (Pali Rohár)
  - fbdev: core: tileblit: Implement missing margin clearing for tileblit (Zsolt Kajtar)
  - fbcon: Use correct erase colour for clearing in fbcon (Zsolt Kajtar)
  - fbdev: fsl-diu-fb: add missing device_remove_file() (Shixiong Ou)
  - riscv: Allow NOMMU kernels to access all of RAM (Samuel Holland)
  - mailbox: use error ret code of of_parse_phandle_with_args() (Tudor Ambarus)
  - mailbox: pcc: Use acpi_os_ioremap() instead of ioremap() (Sudeep Holla)
  - tpm: Convert warn to dbg in tpm2_start_auth_session() (Jonathan Mcdowell)
  - ACPI: PNP: Add Intel OC Watchdog IDs to non-PNP device list (Diogo Ivo)
  - tracing: Mark binary printing functions with __printf() attribute (Andy Shevchenko)
  - iommufd: Extend IOMMU_GET_HW_INFO to report PASID capability (Yi Liu)
  - arm64: Add support for HIP09 Spectre-BHB mitigation (Jinqian Yang)
  - SUNRPC: Don't allow waiting for exiting tasks (Trond Myklebust)
  - NFS: Don't allow waiting for exiting tasks (Trond Myklebust)
  - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Trond Myklebust)
  - io_uring/msg: initialise msg request opcode (Pavel Begunkov)
  - exfat: call bh_read in get_block only when necessary (Sungjong Seo)
  - fuse: Return EPERM rather than ENOSYS from link() (Matt Johnston)
  - smb: client: Store original IO parameters and prevent zero IO sizes (Zhaolong Wang)
  - cifs: Fix negotiate retry functionality (Pali Rohár)
  - cifs: Fix querying and creating MF symlinks over SMB1 (Pali Rohár)
  - cifs: Add fallback for SMB2 CREATE without FILE_READ_ATTRIBUTES (Pali Rohár)
  - s390/vfio-ap: Fix no AP queue sharing allowed message written to kernel log (Tony Krowiak)
  - x86/fred: Fix system hang during S4 resume with FRED enabled (Xin Li) [Orabug: 38094951] {CVE-2025-38047}
  - kconfig: merge_config: use an empty file as initfile (Daniel Gomez)
  - samples/bpf: Fix compilation failure for samples/bpf on LoongArch Fedora (Haoran Jiang)
  - bpf: fix possible endless loop in BPF map iteration (Brandon Kammerdiener)
  - io_uring: don't duplicate flushing in io_req_post_cqe (Pavel Begunkov)
  - block: fix race between set_blocksize and read paths (Darrick J. Wong) [Orabug: 38095117] {CVE-2025-38073}
  - selftests/bpf: Mitigate sockmap_ktls disconnect_after_delete failure (Ihor Solodrai)
  - drm/amdgpu: Allow P2P access through XGMI (Felix Kuehling)
  - drm/amd/display: Enable urgent latency adjustment on DCN35 (Nicholas Susanto)
  - fs/ext4: use sleeping version of sb_find_get_block() (Davidlohr Bueso)
  - fs/jbd2: use sleeping version of __find_get_block() (Davidlohr Bueso)
  - fs/ocfs2: use sleeping version of __find_get_block() (Davidlohr Bueso)
  - fs/buffer: use sleeping version of __find_get_block() (Davidlohr Bueso)
  - fs/buffer: introduce sleeping flavors for pagecache lookups (Davidlohr Bueso)
  - fs/buffer: split locking for pagecache lookups (Davidlohr Bueso)
  - ima: process_measurement() needlessly takes inode_lock() on MAY_READ (Frederick Lawler)
  - dma-mapping: Fix warning reported for missing prototype (Balbir Singh)
  - net: enetc: refactor bulk flipping of RX buffers to separate function (Vladimir Oltean)
  - vhost_task: fix vhost_task_create() documentation (Stefano Garzarella)
  - cgroup: Fix compilation issue due to cgroup_mutex not being exported (Gao Xu)
  - dma-mapping: avoid potential unused data compilation warning (Marek Szyprowski)
  - mei: vsc: Use struct vsc_tp_packet as vsc-tp tx_buf and rx_buf type (Hans de Goede)
  - intel_th: avoid using deprecated page->mapping, index fields (Lorenzo Stoakes)
  - dma/mapping.c: dev_dbg support for dma_addressing_limited (Balbir Singh)
  - virtio_ring: Fix data race by tagging event_triggered as racy for KCSAN (Zhongqiu Han) [Orabug: 38094958] {CVE-2025-38048}
  - scsi: ufs: Introduce quirk to extend PA_HIBERN8TIME for UFS devices (Manish Pandey)
  - scsi: target: iscsi: Fix timeout on deleted connection (Dmitry Bogdanov) [Orabug: 38095134] {CVE-2025-38075}
  - nvmem: qfprom: switch to 4-byte aligned reads (Dmitry Baryshkov)
  - nvmem: core: update raw_len if the bit reading is required (Dmitry Baryshkov)
  - nvmem: core: verify cell's raw_len (Dmitry Baryshkov)
  - nvmem: core: fix bit offsets of more than one byte (Dmitry Baryshkov)
  - nvmem: rockchip-otp: add rk3576 variant data (Heiko Stuebner)
  - nvmem: rockchip-otp: Move read-offset into variant-data (Heiko Stuebner)
  - cpufreq: Add SM8650 to cpufreq-dt-platdev blocklist (Pengyu Luo)
  - phy: renesas: rcar-gen3-usb2: Assert PLL reset on PHY power off (Claudiu Beznea)
  - phy: renesas: rcar-gen3-usb2: Lock around hardware registers and driver data (Claudiu Beznea)
  - phy: renesas: rcar-gen3-usb2: Move IRQ request in probe (Claudiu Beznea)
  - i2c: designware: Fix an error handling path in i2c_dw_pci_probe() (Christophe Jaillet)
  - i2c: designware: Use temporary variable for struct device (Andy Shevchenko)
  - drm/amd/display: Defer BW-optimization-blocked DRR adjustments (John Olender)
  - drm/amd/display: Correct timing_adjust_pending flag setting. (Zhongwei)
  - drm/amd/display: Do not enable replay when vtotal update is pending. (Sung-Huai Wang)
  - drm/amd/display: Configure DTBCLK_P with OPTC only for dcn401 (Dillon Varone)
  - LTS version: v6.12.30 (Jack Vogel)
  - drm/amdgpu: fix pm notifier handling (Alex Deucher)
  - phy: tegra: xusb: remove a stray unlock (Dan Carpenter)
  - usb: typec: ucsi: displayport: Fix deadlock (Andrei Kuchynski) [Orabug: 37977018] {CVE-2025-37967}
  - drm/tiny: panel-mipi-dbi: Use drm_client_setup_with_fourcc() (Fabio Estevam)
  - drm/panel-mipi-dbi: Run DRM default client setup (Thomas Zimmermann)
  - drm/fbdev-dma: Support struct drm_driver.fbdev_probe (Thomas Zimmermann)
  - Bluetooth: btnxpuart: Fix kernel panic during FW release (Neeraj Sanjay Kale) [Orabug: 37844459] {CVE-2025-22102}
  - iio: light: opt3001: fix deadlock due to concurrent flag access (Luca Ceresoli) [Orabug: 37977026] {CVE-2025-37968}
  - accel/ivpu: Fix fw log printing (Jacek Lawrynowicz)
  - accel/ivpu: Refactor functions in ivpu_fw_log.c (Jacek Lawrynowicz)
  - accel/ivpu: Reset fw log on cold boot (Tomasz Rusinowicz)
  - accel/ivpu: Rename ivpu_log_level to fw_log_level (Jacek Lawrynowicz)
  - mm/page_alloc: fix race condition in unaccepted memory handling (Kirill A. Shutemov) [Orabug: 38094767] {CVE-2025-38008}
  - drm/xe/gsc: do not flush the GSC worker from the reset path (Daniele Ceraolo Spurio)
  - CIFS: New mount option for cifs.upcall namespace resolution (Ritvik Budhiraja)
  - dmaengine: idxd: Refactor remove call with idxd_cleanup() helper (Shuai Xue) [Orabug: 38094790] {CVE-2025-38014}
  - dmaengine: idxd: fix memory leak in error handling path of idxd_pci_probe (Shuai Xue)
  - dmaengine: idxd: fix memory leak in error handling path of idxd_alloc (Shuai Xue) [Orabug: 38094793] {CVE-2025-38015}
  - dmaengine: idxd: Add missing idxd cleanup to fix memory leak in remove call (Shuai Xue)
  - dmaengine: idxd: Add missing cleanups in cleanup internals (Shuai Xue)
  - dmaengine: idxd: Add missing cleanup for early error out in idxd_setup_internals (Shuai Xue)
  - dmaengine: idxd: fix memory leak in error handling path of idxd_setup_groups (Shuai Xue)
  - dmaengine: idxd: fix memory leak in error handling path of idxd_setup_engines (Shuai Xue)
  - dmaengine: idxd: fix memory leak in error handling path of idxd_setup_wqs (Shuai Xue)
  - dmaengine: ti: k3-udma: Use cap_mask directly from dma_device structure instead of a local copy (Yemike Abhilash Chandra)
  - dmaengine: ti: k3-udma: Add missing locking (Ronald Wahl) [Orabug: 38094756] {CVE-2025-38005}
  - mm: userfaultfd: correct dirty flags set for both present and swap pte (Barry Song)
  - net: qede: Initialize qede_ll_ops with designated initializer (Nathan Chancellor)
  - ring-buffer: Fix persistent buffer when commit page is the reader page (Steven Rostedt)
  - wifi: mt76: disable napi on driver removal (Fedor Pchelkin) [Orabug: 38094770] {CVE-2025-38009}
  - tpm: Mask TPM RC in tpm2_start_auth_session() (Jarkko Sakkinen)
  - spi: tegra114: Use value to check for invalid delays (Aaron Kling)
  - smb: client: fix memory leak during error handling for POSIX mkdir (Jethro Donaldson)
  - scsi: sd_zbc: block: Respect bio vector limits for REPORT ZONES buffer (Steve Siwinski)
  - phy: renesas: rcar-gen3-usb2: Set timing registers only once (Claudiu Beznea)
  - phy: renesas: rcar-gen3-usb2: Fix role detection on unbind/bind (Claudiu Beznea)
  - phy: Fix error handling in tegra_xusb_port_init (Ma Ke)
  - phy: tegra: xusb: Use a bitmask for UTMI pad power state tracking (Wayne Chang) [Orabug: 38094777] {CVE-2025-38010}
  - tracing: samples: Initialize trace_array_printk() with the correct function (Steven Rostedt)
  - ftrace: Fix preemption accounting for stacktrace filter command (Donglin Peng)
  - ftrace: Fix preemption accounting for stacktrace trigger command (Donglin Peng)
  - kbuild: Disable -Wdefault-const-init-unsafe (Nathan Chancellor)
  - Drivers: hv: vmbus: Remove vmbus_sendpacket_pagebuffer() (Michael Kelley)
  - Drivers: hv: Allow vmbus_sendpacket_mpb_desc() to create multiple ranges (Michael Kelley)
  - arm64: dts: rockchip: Remove overdrive-mode OPPs from RK3588J SoC dtsi (Dragan Simic)
  - arm64: dts: amlogic: dreambox: fix missing clkc_audio node (Christian Hewitt)
  - hv_netvsc: Remove rmsg_pgcnt (Michael Kelley)
  - hv_netvsc: Preserve contiguous PFN grouping in the page buffer array (Michael Kelley)
  - hv_netvsc: Use vmbus_sendpacket_mpb_desc() to send VMBus messages (Michael Kelley)
  - dma-buf: insert memory barrier before updating num_fences (Hyejeong Choi)
  - ALSA: usb-audio: Add sample rate quirk for Microdia JP001 USB Camera (Nicolas Chauvet)
  - ALSA: usb-audio: Add sample rate quirk for Audioengine D1 (Christian Heusel)
  - ALSA: es1968: Add error handling for snd_pcm_hw_constraint_pow2() (Xu Wang)
  - ACPI: PPTT: Fix processor subtable walk (Jeremy Linton)
  - gpio: pca953x: fix IRQ storm on system wake up (Emanuele Ghidoli)
  - MAINTAINERS: Update Alexey Makhalov's email address (Alexey Makhalov)
  - drm/amd/display: Avoid flooding unnecessary info messages (Wayne Lin)
  - drm/amd/display: Correct the reply value when AUX write incomplete (Wayne Lin)
  - drm/amdgpu: csa unmap use uninterruptible lock (Philip Yang) [Orabug: 38094779] {CVE-2025-38011}
  - drm/amdgpu: fix incorrect MALL size for GFX1151 (Tim Huang)
  - Revert "drm/amd/display: Hardware cursor changes color when switched to software cursor" (Melissa Wen)
  - btrfs: add back warning for mount option commit values exceeding 300 (Kyoji Ogasawara)
  - btrfs: fix folio leak in submit_one_async_extent() (Boris Burkov)
  - btrfs: fix discard worker infinite loop after disabling discard (Filipe Manana)
  - LoongArch: uprobes: Remove redundant code about resume_era (Tiezhu Yang)
  - LoongArch: uprobes: Remove user_{en,dis}able_single_step() (Tiezhu Yang)
  - LoongArch: Fix MAX_REG_OFFSET calculation (Huacai Chen)
  - LoongArch: Save and restore CSR.CNTC for hibernation (Huacai Chen)
  - LoongArch: Move __arch_cpu_idle() to .cpuidle.text section (Huacai Chen)
  - LoongArch: Prevent cond_resched() occurring within kernel-fpu (Tianyang Zhang)
  - HID: bpf: abort dispatch if device destroyed (Rongrong) [Orabug: 38094796] {CVE-2025-38016}
  - udf: Make sure i_lenExtents is uptodate on inode eviction (Jan Kara)
  - sched_ext: bpf_iter_scx_dsq_new() should always initialize iterator (Tejun Heo) [Orabug: 38094786] {CVE-2025-38012}
  - dmaengine: Revert "dmaengine: dmatest: Fix dmatest waiting less when interrupted" (Nathan Lynch)
  - NFSv4/pnfs: Reset the layout state after a layoutreturn (Trond Myklebust)
  - tsnep: fix timestamping with a stacked DSA driver (Gerhard Engleder)
  - net/tls: fix kernel panic when alloc_page failed (Pengtao He) [Orabug: 38094802] {CVE-2025-38018}
  - mlxsw: spectrum_router: Fix use-after-free when deleting GRE net devices (Ido Schimmel) [Orabug: 38094804] {CVE-2025-38019}
  - wifi: mac80211: Set n_channels after allocating struct cfg80211_scan_request (Kees Cook) [Orabug: 38094788] {CVE-2025-38013}
  - octeontx2-pf: Do not reallocate all ntuple filters (Subbaraya Sundeep)
  - octeontx2-af: Fix CGX Receive counters (Hariprasad Kelam)
  - net: ethernet: mtk_eth_soc: fix typo for declaration MT7988 ESW capability (Bc-Bocun Chen)
  - octeontx2-pf: macsec: Fix incorrect max transmit size in TX secy (Subbaraya Sundeep)
  - netlink: specs: tc: all actions are indexed arrays (Jakub Kicinski)
  - netlink: specs: tc: fix a couple of attribute names (Jakub Kicinski)
  - drm/xe: Save CTX_TIMESTAMP mmio value instead of LRC value (Umesh Nerlige Ramappa)
  - regulator: max20086: fix invalid memory access (Cosmin Tanislav) [Orabug: 38094833] {CVE-2025-38027}
  - qlcnic: fix memory leak in qlcnic_sriov_channel_cfg_cmd() (Abdun Nihaal)
  - net/mlx5e: Disable MACsec offload for uplink representor profile (Carolina Jubran) [Orabug: 38094808] {CVE-2025-38020}
  - vsock/test: Fix occasional failure in SIOCOUTQ tests (Konstantin Shkolnyy)
  - net: dsa: b53: prevent standalone from trying to forward to other ports (Jonas Gorski)
  - ALSA: sh: SND_AICA should depend on SH_DMA_API (Geert Uytterhoeven)
  - nvme-pci: acquire cq_poll_lock in nvme_poll_irqdisable (Keith Busch)
  - nvme-pci: make nvme_pci_npages_prp() __always_inline (Kees Cook)
  - net: dsa: sja1105: discard incoming frames in BR_STATE_LISTENING (Vladimir Oltean)
  - net: cadence: macb: Fix a possible deadlock in macb_halt_tx. (Mathieu Othacehe)
  - ALSA: ump: Fix a typo of snd_ump_stream_msg_device_info (Takashi Iwai)
  - ALSA: seq: Fix delivery of UMP events to group ports (Takashi Iwai)
  - net: mctp: Ensure keys maintain only one ref to corresponding dev (Andrew Jeffery)
  - tests/ncdevmem: Fix double-free of queue array (Cosmin Ratiu)
  - selftests: ncdevmem: Switch to AF_INET6 (Stanislav Fomichev)
  - selftests: ncdevmem: Make client_ip optional (Stanislav Fomichev)
  - selftests: ncdevmem: Unify error handling (Stanislav Fomichev)
  - selftests: ncdevmem: Separate out dmabuf provider (Stanislav Fomichev)
  - selftests: ncdevmem: Redirect all non-payload output to stderr (Stanislav Fomichev)
  - net: mctp: Don't access ifa_index when missing (Matt Johnston)
  - mctp: no longer rely on net->dev_index_head[] (Eric Dumazet)
  - tools/net/ynl: ethtool: fix crash when Hardware Clock info is missing (Hangbin Liu)
  - net_sched: Flush gso_skb list too during ->change() (Cong Wang) [Orabug: 37998128] {CVE-2025-37992}
  - Bluetooth: MGMT: Fix MGMT_OP_ADD_DEVICE invalid device flags (Luiz Augusto von Dentz)
  - RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem (Zhu Yanjun) [Orabug: 38094813] {CVE-2025-38022}
  - spi: loopback-test: Do not split 1024-byte hexdumps (Geert Uytterhoeven)
  - nfs: handle failure of nfs_get_lock_context in unlock path (Li Lingfeng) [Orabug: 38094818] {CVE-2025-38023}
  - HID: uclogic: Add NULL check in uclogic_input_configured() (Henry Martin) [Orabug: 38094764] {CVE-2025-38007}
  - HID: thrustmaster: fix memory leak in thrustmaster_interrupts() (Qasim Ijaz)
  - RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug (Zhu Yanjun) [Orabug: 38094827] {CVE-2025-38024}
  - virtio_net: ensure netdev_tx_reset_queue is called on bind xsk for tx (Koichiro Den)
  - virtio_ring: add a func argument 'recycle_done' to virtqueue_reset() (Koichiro Den)
  - iio: chemical: sps30: use aligned_s64 for timestamp (David Lechner)
  - iio: adc: ad7768-1: Fix insufficient alignment of timestamp. (Jonathan Cameron)
  - xhci: dbc: Avoid event polling busyloop if pending rx transfers are inactive. (Mathias Nyman)
  - xhci: dbc: Improve performance by removing delay in transfer event polling. (Mathias Nyman)
  - Revert "drm/amd: Stop evicting resources on APUs in suspend" (Alex Deucher)
  - drm/amd: Add Suspend/Hibernate notification callback support (Mario Limonciello)
  - iio: pressure: mprls0025pa: use aligned_s64 for timestamp (David Lechner)
  - iio: chemical: pms7003: use aligned_s64 for timestamp (David Lechner)
  - iio: adc: ad7266: Fix potential timestamp alignment issue. (Jonathan Cameron)
  - KVM: x86/mmu: Prevent installing hugepages when mem attributes are changing (Sean Christopherson)
  - KVM: Add member to struct kvm_gfn_range to indicate private/shared (Isaku Yamahata)
  - uio_hv_generic: Fix sysfs creation path for ring buffer (Naman Jain)
  - tpm: tis: Double the timeout B to 4s (Michal Suchanek)
  - tracing: probes: Fix a possible race in trace_probe_log APIs (Masami Hiramatsu)
  - cgroup/cpuset: Extend kthread_is_per_cpu() check to all PF_NO_SETAFFINITY tasks (Waiman Long)
  - arm64: dts: imx8mp-var-som: Fix LDO5 shutdown causing SD card timeout (Himanshu Bhavani)
  - platform/x86: asus-wmi: Fix wlan_ctrl_by_user detection (Hans de Goede)
  - platform/x86/amd/pmc: Declare quirk_spurious_8042 for MECHREVO Wujie 14XA (GX4HRXL) (Runhua He)
  - binfmt_elf: Move brk for static PIE even if ASLR disabled (Kees Cook)
  - riscv: dts: sophgo: fix DMA data-width configuration for CV18xx (Ze Huang)
  - drivers/platform/x86/amd: pmf: Check for invalid Smart PC Policies (Mario Limonciello)
  - drivers/platform/x86/amd: pmf: Check for invalid sideloaded Smart PC Policies (Mario Limonciello)
  - fs/xattr.c: fix simple_xattr_list to always include security.* xattrs (Stephen Smalley)
  - arm64: dts: rockchip: Assign RT5616 MCLK rate on rk3588-friendlyelec-cm3588 (Tom Vincent)
  - LTS version: v6.12.29 (Jack Vogel)
  - arm64: proton-pack: Add new CPUs 'k' values for branch mitigation (James Morse)
  - arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users (James Morse) [Orabug: 37977004] {CVE-2025-37963}
  - arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs (James Morse) [Orabug: 37976926] {CVE-2025-37948}
  - arm64: proton-pack: Expose whether the branchy loop k value (James Morse)
  - arm64: proton-pack: Expose whether the platform is mitigated by firmware (James Morse)
  - arm64: insn: Add support for encoding DSB (James Morse)
  - mm: page_alloc: speed up fallbacks in rmqueue_bulk() (Johannes Weiner)
  - mm: page_alloc: don't steal single pages from biggest buddy (Johannes Weiner)
  - Bluetooth: btmtk: Remove the resetting step before downloading the fw (Hao Qin)
  - Bluetooth: btmtk: Remove resetting mt7921 before downloading the fw (Hao Qin)
  - io_uring: always arm linked timeouts prior to issue (Jens Axboe)
  - rust: clean Rust 1.88.0's `clippy::uninlined_format_args` lint (Miguel Ojeda)
  - rust: allow Rust 1.87.0's `clippy::ptr_eq` lint (Miguel Ojeda)
  - Revert "um: work around sched_yield not yielding in time-travel mode" (Christian Lamparter)
  - do_umount(): add missing barrier before refcount checks in sync case (Al Viro)
  - io_uring/sqpoll: Increase task_work submission batch size (Gabriel Krisman Bertazi)
  - drm/xe/tests/mocs: Hold XE_FORCEWAKE_ALL for LNCF regs (Tejas Upadhyay)
  - drm/xe/tests/mocs: Update xe_force_wake_get() return handling (Himal Prasad Ghimiray)
  - riscv: misaligned: enable IRQs while handling misaligned accesses (Clément Léger)
  - riscv: misaligned: factorize trap handling (Clément Léger)
  - nvme: unblock ctrl state transition for firmware update (Daniel Wagner)
  - drm/panel: simple: Update timings for AUO G101EVN010 (Kevin Baker)
  - loop: Add sanity check for read/write_iter (Lizhi Xu)
  - loop: factor out a loop_assign_backing_file helper (Christoph Hellwig)
  - loop: refactor queue limits updates (Christoph Hellwig)
  - loop: Fix ABBA locking race (Ogawa Hirofumi)
  - loop: Simplify discard granularity calc (John Garry)
  - loop: Use bdev limit helpers for configuring discard (John Garry)
  - riscv: misaligned: Add handling for ZCB instructions (Nylon Chen)
  - MIPS: Fix MAX_REG_OFFSET (Thorsten Blum)
  - iio: adc: dln2: Use aligned_s64 for timestamp (Jonathan Cameron)
  - iio: accel: adxl355: Make timestamp 64-bit aligned using aligned_s64 (Jonathan Cameron)
  - types: Complement the aligned types with signed 64-bit one (Andy Shevchenko)
  - iio: temp: maxim-thermocouple: Fix potential lack of DMA safe buffer. (Jonathan Cameron)
  - iio: accel: adxl367: fix setting odr for activity time update (Lothar Rubusch)
  - usb: usbtmc: Fix erroneous generic_read ioctl return (Dave Penkler)
  - usb: usbtmc: Fix erroneous wait_srq ioctl return (Dave Penkler)
  - usb: usbtmc: Fix erroneous get_stb ioctl error returns (Dave Penkler)
  - USB: usbtmc: use interruptible sleep in usbtmc_read (Oliver Neukum)
  - usb: typec: ucsi: displayport: Fix NULL pointer access (Andrei Kuchynski) [Orabug: 38015126] {CVE-2025-37994}
  - usb: typec: tcpm: delay SNK_TRY_WAIT_DEBOUNCE to SRC_TRYWAIT transition (Rd Babiera)
  - usb: misc: onboard_usb_dev: fix support for Cypress HX3 hubs (Lukasz Czechowski)
  - usb: host: tegra: Prevent host controller crash when OTG port is used (Jim Lin)
  - usb: gadget: Use get_status callback to set remote wakeup capability (Prashanth K)
  - usb: gadget: tegra-xudc: ACK ST_RC after clearing CTRL_RUN (Wayne Chang)
  - usb: gadget: f_ecm: Add get_status callback (Prashanth K)
  - usb: cdnsp: fix L1 resume issue for RTL_REVISION_NEW_LPM version (Pawel Laszczak)
  - usb: cdnsp: Fix issue with resuming from L1 (Pawel Laszczak)
  - usb: dwc3: gadget: Make gadget_wakeup asynchronous (Prashanth K)
  - x86/microcode: Consolidate the loader enablement checking (Borislav Petkov)
  - module: ensure that kobject_put() is safe for module type kobjects (Dmitry Antipov) [Orabug: 38015131] {CVE-2025-37995}
  - memblock: Accept allocated memory before use in memblock_double_array() (Tom Lendacky) [Orabug: 37976994] {CVE-2025-37960}
  - clocksource/i8253: Use raw_spinlock_irqsave() in clockevent_i8253_disable() (Sebastian Andrzej Siewior)
  - arm64: cpufeature: Move arm64_use_ng_mappings to the .data section to prevent wrong idmap generation (Levi Yun)
  - accel/ivpu: Increase state dump msg timeout (Jacek Lawrynowicz)
  - xenbus: Use kref to track req lifetime (Jason Andryuk) [Orabug: 37976934] {CVE-2025-37949}
  - xen: swiotlb: Use swiotlb bouncing if kmalloc allocation demands it (John Ernberg)
  - smb: client: Avoid race in open_cached_dir with lease breaks (Paul Aurich) [Orabug: 37976959] {CVE-2025-37954}
  - usb: uhci-platform: Make the clock really optional (Alexey Charkov)
  - drm/amdgpu/hdp7: use memcfg register to post the write for HDP flush (Alex Deucher)
  - drm/amdgpu/hdp6: use memcfg register to post the write for HDP flush (Alex Deucher)
  - drm/amdgpu/hdp5: use memcfg register to post the write for HDP flush (Alex Deucher)
  - drm/amdgpu/hdp5.2: use memcfg register to post the write for HDP flush (Alex Deucher)
  - drm/amdgpu/hdp4: use memcfg register to post the write for HDP flush (Alex Deucher)
  - drm/amd/display: Copy AUX read reply data whenever length > 0 (Wayne Lin)
  - drm/amd/display: Fix wrong handling for AUX_DEFER case (Wayne Lin)
  - drm/amd/display: Remove incorrect checking in dmub aux handler (Wayne Lin)
  - drm/amd/display: Fix the checking condition in dmub aux handling (Wayne Lin)
  - drm/amd/display: more liberal vmin/vmax update for freesync (Aurabindo Pillai)
  - drm/amd/display: Fix invalid context error in dml helper (Roman Li) [Orabug: 37977185] {CVE-2025-37965}
  - drm/amdgpu/vcn: using separate VCN1_AON_SOC offset (Ruijing Dong)
  - drm/xe: Add page queue multiplier (Matthew Brost)
  - drm/v3d: Add job to pending list if the reset was skipped (Maíra Canal) [Orabug: 37976942] {CVE-2025-37951}
  - iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_tagged_fifo (Silvano Seva) [Orabug: 37977031] {CVE-2025-37969}
  - iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_fifo (Silvano Seva) [Orabug: 37977037] {CVE-2025-37970}
  - iio: imu: inv_mpu6050: align buffer for timestamp (David Lechner)
  - iio: adis16201: Correct inclinometer channel resolution (Gabriel)
  - iio: adc: rockchip: Fix clock initialization sequence (Simon Xue)
  - iio: adc: ad7606: fix serial register access (Angelo Dureghello)
  - io_uring: ensure deferred completions are flushed for multishot (Jens Axboe)
  - drm/amd/display: Shift DMUB AUX reply command if necessary (Wayne Lin)
  - KVM: SVM: Forcibly leave SMM mode on SHUTDOWN interception (Mikhail Lobanov) [Orabug: 37976977] {CVE-2025-37957}
  - selftests/mm: fix a build failure on powerpc (Nysal Jan K.A.)
  - selftests/mm: compaction_test: support platform with huge mount of memory (Feng Tang)
  - mm/userfaultfd: fix uninitialized output field for -EAGAIN race (Peter Xu)
  - mm/huge_memory: fix dereferencing invalid pmd migration entry (Gavin Guo) [Orabug: 37976982] {CVE-2025-37958}
  - mm: fix folio_pte_batch() on XEN PV (Petr Vaněk)
  - x86/mm: Eliminate window where TLB flushes may be inadvertently skipped (Dave Hansen) [Orabug: 37977013] {CVE-2025-37964}
  - staging: axis-fifo: Correct handling of tx_fifo_depth for size validation (Gabriel)
  - staging: axis-fifo: Remove hardware resets for user errors (Gabriel)
  - staging: bcm2835-camera: Initialise dev in v4l2_dev (Dave Stevenson) [Orabug: 37977042] {CVE-2025-37971}
  - staging: iio: adc: ad7816: Correct conditional logic for store mode (Gabriel)
  - rust: clean Rust 1.88.0's warning about `clippy::disallowed_macros` configuration (Miguel Ojeda)
  - objtool/rust: add one more `noreturn` Rust function for Rust 1.87.0 (Miguel Ojeda)
  - rust: clean Rust 1.88.0's `unnecessary_transmutes` lint (Miguel Ojeda)
  - Input: synaptics - enable InterTouch on TUXEDO InfinityBook Pro 14 v5 (Aditya Garg)
  - Input: synaptics - enable SMBus for HP Elitebook 850 G1 (Dmitry Torokhov)
  - Input: synaptics - enable InterTouch on Dell Precision M3800 (Aditya Garg)
  - Input: synaptics - enable InterTouch on Dynabook Portege X30L-G (Aditya Garg)
  - Input: synaptics - enable InterTouch on Dynabook Portege X30-D (Manuel Fombuena)
  - Input: xpad - fix two controller table values (Vicki Pfau)
  - Input: xpad - add support for 8BitDo Ultimate 2 Wireless Controller (Lode Willems)
  - Input: xpad - fix Share button on Xbox One controllers (Vicki Pfau)
  - Input: mtk-pmic-keys - fix possible null pointer dereference (Gary Bisson) [Orabug: 37977044] {CVE-2025-37972}
  - Input: cyttsp5 - fix power control issue on wakeup (Mikael Gonella-Bolduc)
  - Input: cyttsp5 - ensure minimum reset pulse width (Hugo Villeneuve)
  - virtio-net: fix total qstat values (Jakub Kicinski)
  - net: export a helper for adding up queue stats (Jakub Kicinski)
  - fbnic: Do not allow mailbox to toggle to ready outside fbnic_mbx_poll_tx_ready (Alexander Duyck)
  - fbnic: Pull fbnic_fw_xmit_cap_msg use out of interrupt context (Alexander Duyck)
  - fbnic: Improve responsiveness of fbnic_mbx_poll_tx_ready (Alexander Duyck)
  - fbnic: Actually flush_tx instead of stalling out (Alexander Duyck)
  - fbnic: Gate AXI read/write enabling on FW mailbox (Alexander Duyck)
  - fbnic: Fix initialization of mailbox descriptor rings (Alexander Duyck)
  - net: dsa: b53: do not set learning and unicast/multicast on up (Jonas Gorski)
  - net: dsa: b53: fix learning on VLAN unaware bridges (Jonas Gorski)
  - net: dsa: b53: fix toggling vlan_filtering (Jonas Gorski)
  - net: dsa: b53: do not program vlans when vlan filtering is off (Jonas Gorski)
  - net: dsa: b53: do not allow to configure VLAN 0 (Jonas Gorski)
  - net: dsa: b53: always rejoin default untagged VLAN on bridge leave (Jonas Gorski)
  - net: dsa: b53: fix VLAN ID for untagged vlan on bridge leave (Jonas Gorski)
  - net: dsa: b53: fix flushing old pvid VLAN on pvid change (Jonas Gorski)
  - net: dsa: b53: fix clearing PVID of a port (Jonas Gorski)
  - net: dsa: b53: keep CPU port always tagged again (Jonas Gorski)
  - net: dsa: b53: allow leaky reserved multicast (Jonas Gorski)
  - bpf: Scrub packet on bpf_redirect_peer (Paul Chaignon) [Orabug: 37976990] {CVE-2025-37959}
  - netfilter: ipset: fix region locking in hash types (Jozsef Kadlecsik) [Orabug: 38015141] {CVE-2025-37997}
  - ipvs: fix uninit-value for saddr in do_output_route4 (Julian Anastasov) [Orabug: 37976996] {CVE-2025-37961}
  - erofs: ensure the extra temporary copy is valid for shortened bvecs (Gao Xiang)
  - ice: use DSN instead of PCI BDF for ice_adapter index (Przemek Kitszel)
  - ice: Initial support for E825C hardware in ice_adapter (Sergey Temerkhanov)
  - wifi: mac80211: fix the type of status_code for negotiated TID to Link Mapping (Michael-Cy Lee)
  - can: gw: fix RCU/BH usage in cgw_create_job() (Oliver Hartkopp)
  - can: mcp251xfd: fix TDC setting for low data bit rates (Kelsey Maes)
  - can: m_can: m_can_class_allocate_dev(): initialize spin lock on device probe (Antonios Salios) [Orabug: 38015123] {CVE-2025-37993}
  - net: ethernet: mtk_eth_soc: do not reset PSE when setting FE (Frank Wunderlich)
  - net: ethernet: mtk_eth_soc: reset all TX queues on DMA free (Daniel Golle)
  - gre: Fix again IPv6 link-local address generation. (Guillaume Nault)
  - virtio-net: free xsk_buffs on error in virtnet_xsk_pool_enable() (Jakub Kicinski) [Orabug: 37976969] {CVE-2025-37955}
  - virtio_net: xsk: bind/unbind xsk for tx (Xuan Zhuo)
  - sch_htb: make htb_deactivate() idempotent (Cong Wang) [Orabug: 37977176] {CVE-2025-37953}
  - s390/entry: Fix last breaking event handling in case of stack corruption (Heiko Carstens)
  - ksmbd: fix memory leak in parse_lease_state() (Zhaolong Wang) [Orabug: 37977180] {CVE-2025-37962}
  - openvswitch: Fix unsafe attribute parsing in output_userspace() (Eelco Chaudron) [Orabug: 38015148] {CVE-2025-37998}
  - ksmbd: Fix UAF in __close_file_table_ids (Sean Heelan) [Orabug: 37976951] {CVE-2025-37952}
  - ksmbd: prevent out-of-bounds stream writes by validating *pos (Norbert Szetei) [Orabug: 37976923] {CVE-2025-37947}
  - ksmbd: prevent rename with empty string (Namjae Jeon) [Orabug: 37976972] {CVE-2025-37956}
  - can: rockchip_canfd: rkcanfd_remove(): fix order of unregistration calls (Marc Kleine-Budde)
  - can: mcp251xfd: mcp251xfd_remove(): fix order of unregistration calls (Marc Kleine-Budde)
  - s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFs (Niklas Schnelle) [Orabug: 37976920] {CVE-2025-37946}
  - vfio/pci: Align huge faults to order (Alex Williamson)
  - wifi: cfg80211: fix out-of-bounds access during multi-link element defragmentation (Veerendranath Jakkam) [Orabug: 37977046] {CVE-2025-37973}
  - s390/pci: Fix missing check for zpci_create_device() error return (Niklas Schnelle) [Orabug: 37977050] {CVE-2025-37974}
  - can: mcan: m_can_class_unregister(): fix order of unregistration calls (Marc Kleine-Budde)
  - firmware: arm_scmi: Fix timeout checks on polling path (Cristian Marussi)
  - arm64: dts: imx8mm-verdin: Link reg_usdhc2_vqmmc to usdhc2 (Wojciech Dubowik)
  - Revert "btrfs: canonicalize the device path before adding it" (Qu Wenruo)
  - fs/erofs/fileio: call erofs_onlinefolio_split() after bio_add_folio() (Max Kellermann) [Orabug: 38015155] {CVE-2025-37999}
  - dm: add missing unlock on in dm_keyslot_evict() (Dan Carpenter)
  - mm/vmscan: wake up flushers conditionally to avoid cgroup OOM (Zeng Jingxiang) [Orabug: 37480932]
  - dmaengine: idxd: Narrow the restriction on BATCH to ver. 1 only (Vinicius Costa Gomes) [Orabug: 37801355]
  - uek-rpm: build the fwctl mlx5 driver on UEK (Qing Huang) [Orabug: 37810636]
  - fwctl: Adapt upstream code for UEK8 (Mikhael Goikhman) [Orabug: 37810636]
  - mlx5: Create an auxiliary device for fwctl_mlx5 (Saeed Mahameed) [Orabug: 37810636]
  - fwctl/mlx5: Support for communicating with mlx5 fw (Saeed Mahameed) [Orabug: 37810636]
  - fwctl: Add documentation (Jason Gunthorpe) [Orabug: 37810636]
  - fwctl: FWCTL_RPC to execute a Remote Procedure Call to device firmware (Jason Gunthorpe) [Orabug: 37810636]
  - taint: Add TAINT_FWCTL (Jason Gunthorpe) [Orabug: 37810636]
  - fwctl: FWCTL_INFO to return basic information about the device (Jason Gunthorpe) [Orabug: 37810636]
  - fwctl: Basic ioctl dispatch for the character device (Jason Gunthorpe) [Orabug: 37810636]
  - fwctl: Add basic structure for a class subsystem with a cdev (Jason Gunthorpe) [Orabug: 37810636]
  - Revert "fwctl: Add basic structure for a class subsystem with a cdev" (Qing Huang) [Orabug: 37810636]
  - Revert "fwctl: Basic ioctl dispatch for the character device" (Qing Huang) [Orabug: 37810636]
  - Revert "fwctl: FWCTL_INFO to return basic information about the device" (Qing Huang) [Orabug: 37810636]
  - Revert "fwctl: FWCTL_RPC to execute a Remote Procedure Call to device firmware" (Qing Huang) [Orabug: 37810636]
  - Revert "fwctl/mlx5: Support for communicating with mlx5 fw" (Qing Huang) [Orabug: 37810636]
  - Revert "mlx5: Create an auxiliary device for fwctl_mlx5" (Qing Huang) [Orabug: 37810636]
  - Revert "taint: Add TAINT_FWCTL" (Qing Huang) [Orabug: 37810636]
  - Revert "fwctl: Adapt code for UEK-NEXT" (Qing Huang) [Orabug: 37810636]
  - Revert "fwctl/mlx5: Add INTERNAL_DEV_RES uctx capability" (Qing Huang) [Orabug: 37810636]
  - Revert "fwctl: Allow up to 4k devices" (Qing Huang) [Orabug: 37810636]
  - Revert "uek-rpm: build the fwctl mlx5 driver on UEK" (Qing Huang) [Orabug: 37810636]
  - dmaengine: idxd: Change err messages to dbg (Jack Vogel) [Orabug: 37841831]
  - PCI: Add PCI_VDEVICE_SUB helper macro (Piotr Kwapulinski) [Orabug: 37889575]
  - ixgbevf: Add support for Intel(R) E610 device (Piotr Kwapulinski) [Orabug: 37889575]
  - ixgbe: Enable link management in E610 device (Piotr Kwapulinski) [Orabug: 37889575]
  - ixgbe: Clean up the E610 link management related code (Piotr Kwapulinski) [Orabug: 37889575]
  - ixgbe: Add ixgbe_x540 multiple header inclusion protection (Piotr Kwapulinski) [Orabug: 37889575]
  - ixgbe: Add support for EEPROM dump in E610 device (Piotr Kwapulinski) [Orabug: 37889575]
  - ixgbe: Add support for NVM handling in E610 device (Piotr Kwapulinski) [Orabug: 37889575]
  - ixgbe: Add link management support for E610 device (Piotr Kwapulinski) [Orabug: 37889575]
  - ixgbe: Add support for E610 device capabilities detection (Piotr Kwapulinski) [Orabug: 37889575]
  - ixgbe: Add support for E610 FW Admin Command Interface (Piotr Kwapulinski) [Orabug: 37889575]
  - uek-rpm: Move the gve kernel module from extra to kernel-uek-core (Samasth Norway Ananda) [Orabug: 37940897]
  - uek-rpm/config-aarch64: Enable BT_HCIUART_BCM for RPi Bluetooth (Vijay Kumar) [Orabug: 37961540]
  - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (Shravan Kumar Ramani) [Orabug: 37964051]
  - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (David Thompson) [Orabug: 37964051,38037120] {CVE-2025-37866}
  - mlxbf-bootctl: Support sysfs entries for RTC battery status (Xiangrong Li) [Orabug: 37964051]
  - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37964051]
  - uek-rpm: CONFIG_PTP_1588_CLOCK_OCP enable for OCI (Vijayendra Suman) [Orabug: 37966384]
  - x86/its: Fix build errors when CONFIG_MODULES=n (Eric Biggers) [Orabug: 37970148]
  - x86/its: Use dynamic thunks for indirect branches (Peter Zijlstra) [Orabug: 37970148]
  - x86/ibt: Keep IBT disabled during alternative patching (Pawan Gupta) [Orabug: 37970148]
  - RDMA/mlx5: Fix CC counters query for MPV (Patrisious Haddad) [Orabug: 37989268]
  - amd_hsmp: Increase the SMU timeout to 500ms (Vijay Kumar) [Orabug: 38000074]


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-101.33.2.el9uek]
changelog:
  - net: mana: Add support for Multi Vports on Bare metal (Haiyang Zhang) [Orabug: 38052741]
  - tools: hv: Enable debug logs for hv_kvp_daemon (Shradha Gupta) [Orabug: 38052759]
  - LTS version: v6.12.33 (Jack Vogel)
  - Revert "drm/amd/display: more liberal vmin/vmax update for freesync" (Aurabindo Pillai)
  - dt-bindings: phy: imx8mq-usb: fix fsl,phy-tx-vboost-level-microvolt property (Xu Yang)
  - dt-bindings: usb: cypress,hx3: Add support for all variants (Lukasz Czechowski)
  - thunderbolt: Do not double dequeue a configuration request (Sergey Senozhatsky)
  - usb: usbtmc: Fix timeout value in get_stb (Dave Penkler)
  - serial: jsm: fix NPE during jsm_uart_port_init (Dustin Lundquist)
  - Bluetooth: hci_qca: move the SoC type check to the right place (Bartosz Golaszewski)
  - usb: typec: ucsi: fix Clang -Wsign-conversion warning (Qasim Ijaz)
  - USB: serial: pl2303: add new chip PL2303GC-Q20 and PL2303GT-2AB (Charles Yeh)
  - usb: storage: Ignore UAS driver for SanDisk 3.2 Gen2 storage device (Hongyu Xie)
  - usb: quirks: Add NO_LPM quirk for SanDisk Extreme 55AE (Jiayi Li)
  - Revert "cpufreq: tegra186: Share policy per cluster" (Jonathan Hunter)
  - block: fix adding folio to bio (Ming Lei) [Orabug: 37844657] {CVE-2025-22122}
  - PCI/ASPM: Disable L1 before disabling L1 PM Substates (Ajay Agarwal)
  - accel/ivpu: Update power island delays (Karol Wachowski)
  - accel/ivpu: Add initial Panther Lake support (Maciej Falkowski)
  - rtc: Fix offset calculation for .start_secs < 0 (Alexandre Mergnat)
  - rtc: Make rtc_time64_to_tm() support dates before 1970 (Alexandre Mergnat)
  - Documentation: ACPI: Use all-string data node references (Sakari Ailus)
  - acpi-cpufreq: Fix nominal_freq units to KHz in get_max_boost_ratio() (Gautham R. Shenoy)
  - pinctrl: armada-37xx: set GPIO output value before setting direction (Gabor Juhos)
  - pinctrl: armada-37xx: use correct OUTPUT_VAL register for GPIOs > 31 (Gabor Juhos)
  - f2fs: fix to avoid accessing uninitialized curseg (Chao Yu) [Orabug: 37844644] {CVE-2025-22123}
  - tracing: Fix compilation warning on arm32 (Pan Taixi)
  - LTS version: v6.12.32 (Jack Vogel)
  - ksmbd: use list_first_entry_or_null for opinfo_get_list() (Namjae Jeon)
  - net: ethernet: ti: am65-cpsw: Lower random mac address error print to info (Nishanth Menon)
  - platform/x86: thinkpad_acpi: Ignore battery threshold change event notification (Mark Pearson)
  - ALSA: hda/realtek - restore auto-mute mode for Dell Chrome platform (Kailang Yang)
  - platform/x86: fujitsu-laptop: Support Lifebook S2110 hotkeys (Valtteri Koskivuori)
  - NFS: Avoid flushing data while holding directory locks in nfs_rename() (Trond Myklebust)
  - char: tpm: tpm-buf: Add sanity check fallback in read helpers (Purva Yeshi)
  - drm/xe: Save the gt pointer in lrc and drop the tile (Umesh Nerlige Ramappa)
  - drm/xe/xe2hpg: Add Wa_22021007897 (Aradhya Bhatia)
  - nvme-pci: add NVME_QUIRK_NO_DEEPEST_PS quirk for SOLIDIGM P44 Pro (Ilya Guterman)
  - spi: spi-sun4i: fix early activation (Alessandro Grassi)
  - phy: phy-rockchip-samsung-hdptx: Fix PHY PLL output 50.25MHz error (Algea Cao)
  - phy: starfive: jh7110-usb: Fix USB 2.0 host occasional detection failure (Hal Feng)
  - drm/amd/display: check stream id dml21 wrapper to get plane_id (Aurabindo Pillai)
  - drm/amd/display: fix link_set_dpms_off multi-display MST corner case (George Shen)
  - gpio: virtuser: fix potential out-of-bound write (Markus Burri) [Orabug: 38095181] {CVE-2025-38082}
  - um: let 'make clean' properly clean underlying SUBARCH as well (Masahiro Yamada)
  - platform/x86: thinkpad_acpi: Support also NEC Lavie X1475JAS (John Chau)
  - nfs: don't share pNFS DS connections between net namespaces (Jeff Layton)
  - HID: quirks: Add ADATA XPG alpha wireless mouse support (Milton Barrera)
  - dmaengine: idxd: cdev: Fix uninitialized use of sva in idxd_cdev_open (Purva Yeshi)
  - coredump: hand a pidfd to the usermode coredump helper (Christian Brauner)
  - coredump: fix error handling for replace_fd() (Christian Brauner)
  - perf/arm-cmn: Add CMN S3 ACPI binding (Robin Murphy)
  - perf/arm-cmn: Initialise cmn->cpu earlier (Robin Murphy)
  - perf/arm-cmn: Fix REQ2/SNP2 mixup (Robin Murphy)
  - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Pedro Tammela) [Orabug: 38049363] {CVE-2025-38001}
  - arm64: dts: ti: k3-j784s4-j742s2-main-common: Fix length of serdes_ln_ctrl (Siddharth Vadapalli)
  - arm64: dts: ti: k3-j722s-main: Disable "serdes_wiz0" and "serdes_wiz1" (Siddharth Vadapalli)
  - arm64: dts: ti: k3-j722s-evm: Enable "serdes_wiz0" and "serdes_wiz1" (Siddharth Vadapalli)
  - arm64: dts: ti: k3-j721e-sk: Add requiried voltage supplies for IMX219 (Yemike Abhilash Chandra)
  - arm64: dts: ti: k3-j721e-sk: Remove clock-names property from IMX219 overlay (Yemike Abhilash Chandra)
  - arm64: dts: ti: k3-j721e-sk: Add DT nodes for power regulators (Yemike Abhilash Chandra)
  - arm64: dts: ti: k3-am68-sk: Fix regulator hierarchy (Yemike Abhilash Chandra)
  - arm64: dts: ti: k3-am65-main: Add missing taps to sdhci0 (Judith Mendez)
  - arm64: dts: ti: k3-am62x: Rename I2C switch to I2C mux in OV5640 overlay (Yemike Abhilash Chandra)
  - arm64: dts: ti: k3-am62x: Rename I2C switch to I2C mux in IMX219 overlay (Yemike Abhilash Chandra)
  - arm64: dts: ti: k3-am62x: Remove clock-names property from IMX219 overlay (Yemike Abhilash Chandra)
  - arm64: dts: ti: k3-am62p-j722s-common-main: Set eMMC clock parent to default (Judith Mendez)
  - arm64: dts: ti: k3-am62a-main: Set eMMC clock parent to default (Judith Mendez)
  - arm64: dts: ti: k3-am62-main: Set eMMC clock parent to default (Judith Mendez)
  - arm64: dts: qcom: x1e80100: Fix video thermal zone (Stephan Gerhold)
  - arm64: dts: qcom: x1e80100-yoga-slim7x: mark l12b and l15b always-on (Johan Hovold)
  - arm64: dts: qcom: x1e80100-qcp: mark l12b and l15b always-on (Johan Hovold)
  - arm64: dts: qcom: x1e80100-qcp: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
  - arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
  - arm64: dts: qcom: x1e80100-asus-vivobook-s15: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
  - arm64: dts: qcom: sm8650: Add missing properties for cryptobam (Stephan Gerhold)
  - arm64: dts: qcom: sm8550: Add missing properties for cryptobam (Stephan Gerhold)
  - arm64: dts: qcom: sm8450: Add missing properties for cryptobam (Stephan Gerhold)
  - arm64: dts: qcom: sm8350: Fix typo in pil_camera_mem node (Alok Tiwari)
  - arm64: dts: qcom: sa8775p: Remove cdsp compute-cb@10 (Karthik Sanagavarapu)
  - arm64: dts: qcom: sa8775p: Remove extra entries from the iommus property (Ling Xu)
  - arm64: dts: qcom: ipq9574: Add missing properties for cryptobam (Stephan Gerhold)
  - can: kvaser_pciefd: Force IRQ edge in case of nested IRQ (Axel Forsman)
  - RDMA/bnxt_re: Remove unusable nq variable (Leon Romanovsky) [Orabug: 37822348]
  - RDMA/bnxt_re: Fix budget handling of notification queue (Kashyap Desai) [Orabug: 37822348]
  - bnxt_en: Add FW trace coredump segments to the coredump (Shruti Parab) [Orabug: 37822348]
  - bnxt_en: Add a new ethtool -W dump flag (Michael Chan) [Orabug: 37822348]
  - bnxt_en: Add 2 parameters to bnxt_fill_coredump_seg_hdr() (Shruti Parab) [Orabug: 37822348]
  - bnxt_en: Add functions to copy host context memory (Sreekanth Reddy) [Orabug: 37822348]
  - bnxt_en: Do not free FW log context memory (Hongguang Gao) [Orabug: 37822348]
  - bnxt_en: Manage the FW trace context memory (Shruti Parab) [Orabug: 37822348]
  - bnxt_en: Allocate backing store memory for FW trace logs (Shruti Parab) [Orabug: 37822348]
  - bnxt_en: Add a 'force' parameter to bnxt_free_ctx_mem() (Hongguang Gao) [Orabug: 37822348]
  - bnxt_en: Refactor bnxt_free_ctx_mem() (Hongguang Gao) [Orabug: 37822348]
  - bnxt_en: Add mem_valid bit to struct bnxt_ctx_mem_type (Shruti Parab) [Orabug: 37822348]
  - bnxt_en: refactor bnxt_alloc_rx_rings() to call bnxt_alloc_rx_agg_bmap() (David Wei) [Orabug: 37822348]
  - bnxt_en: ethtool: Support unset l4proto on ip4/ip6 ntuple rules (Daniel Xu) [Orabug: 37822348]
  - bnxt_en: ethtool: Remove ip4/ip6 ntuple support for IPPROTO_RAW (Daniel Xu) [Orabug: 37822348]
  - bnxt_en: use irq_update_affinity_hint() (Mohammad Heib) [Orabug: 37822348]
  - bnxt_en: add unlocked version of bnxt_refclk_read (Vadim Fedorenko) [Orabug: 37822348]
  - bnxt_en: replace PTP spinlock with seqlock (Vadim Fedorenko) [Orabug: 37822348]
  - bnxt_en: cache only 24 bits of hw counter (Vadim Fedorenko) [Orabug: 37822348]
  - bnxt_en: Update firmware interface spec to 1.10.3.85 (Michael Chan) [Orabug: 37822348]
  - bnxt_en: Skip reading PXP registers during ethtool -d if unsupported (Michael Chan) [Orabug: 37822348]
  - bnxt_en: Skip MAC loopback selftest if it is unsupported by FW (Michael Chan) [Orabug: 37822348]
  - bnxt_en: Skip PHY loopback ethtool selftest if unsupported by FW (Michael Chan) [Orabug: 37822348]
  - bnxt_en: Do not allow ethtool -m on an untrusted VF (Michael Chan) [Orabug: 37822348]
  - RDMA/bnxt_re: Fix reporting maximum SRQs on P7 chips (Preethi G) [Orabug: 37822348]
  - RDMA/bnxt_re: Fix allocation of QP table (Kashyap Desai) [Orabug: 37822348]
  - RDMA/bnxt_re: Remove deliver net device event (Yuyu Li) [Orabug: 37822348]
  - RDMA/bnxt_re: Remove unnecessary goto in bnxt_re_netdev_event (Kalesh Ap) [Orabug: 37822348]
  - RDMA/bnxt_re: Remove extra new line in bnxt_re_netdev_event (Kalesh Ap) [Orabug: 37822348]
  - RDMA/bnxt_re: Optimize error handling in bnxt_re_probe (Kalesh Ap) [Orabug: 37822348]
  - RDMA/bnxt_re: Fix an issue in bnxt_re_async_notifier (Kalesh Ap) [Orabug: 37822348]
  - RDMA/bnxt_re: Pass the context for ulp_irq_stop (Kalesh Ap) [Orabug: 37822348]
  - RDMA/bnxt_re: Add support to handle DCB_CONFIG_CHANGE event (Kalesh Ap) [Orabug: 37822348]
  - RDMA/bnxt_re: Query firmware defaults of CC params during probe (Kalesh Ap) [Orabug: 37822348]
  - RDMA/bnxt_re: Add Async event handling support (Kalesh Ap) [Orabug: 37822348]
  - RDMA/bnxt_re: Remove unnecessary header file inclusion (Kalesh Ap) [Orabug: 37822348]
  - RDMA/bnxt_re: Eliminate need for some forward declarations (Kalesh Ap) [Orabug: 37822348]
  - bnxt_en: Add ULP call to notify async events (Michael Chan) [Orabug: 37822348]
  - RDMA/bnxt_re: Fix issue in the unload path (Kalesh Ap) [Orabug: 37822348]
  - RDMA/bnxt_re: Fix setting mandatory attributes for modify_qp (Damodharam Ammepalli) [Orabug: 37822348]
  - RDMA/bnxt_re: Don't fail destroy QP and cleanup debugfs earlier (Kalesh Ap) [Orabug: 37822348]
  - RDMA/bnxt_re: Use the default mode of congestion control (Kalesh Ap) [Orabug: 37822348]
  - RDMA/bnxt_re: Support different traffic class (Chandramohan Akula) [Orabug: 37822348]
  - RDMA/bnxt_re: Refurbish CQ to NQ hash calculation (Kalesh Ap) [Orabug: 37822348]
  - RDMA/bnxt_re: Enhance RoCE SRIOV resource configuration design (Bhargava Chenna Marreddy) [Orabug: 37822348]
  - bnxt_en: Add support for RoCE sriov configuration (Vikas Gupta) [Orabug: 37822348]
  - RDMA/bnxt_re: Add debugfs hook in the driver (Kalesh Ap) [Orabug: 37822348]
  - RDMA/bnxt_re: Support raw data query for each resources (Kashyap Desai) [Orabug: 37822348]
  - RDMA/bnxt_re: Add support for querying HW contexts (Kashyap Desai) [Orabug: 37822348]
  - RDMA/bnxt_re: Support driver specific data collection using rdma tool (Kashyap Desai) [Orabug: 37822348]
  - RDMA/bnxt_re: Fix access flags for MR and QP modify (Hongguang Gao) [Orabug: 37822348]
  - RDMA/bnxt_re: Add support for CQ rx coalescing (Chandramohan Akula) [Orabug: 37822348]
  - RDMA/bnxt_re: Add support for optimized modify QP (Kalesh Ap) [Orabug: 37822348]
  - mm/memcontrol: Fix LRU reparenting logic when !MGLRU (Kamalesh Babulal) [Orabug: 37920452]
  - mm: multi-gen LRU: skip rotation of offlined memcgs (Harry Yoo) [Orabug: 37997501]
  - mm: lru: move VM_WARN_ON_ONCE_FOLIO before MGLRU functions (Harry Yoo) [Orabug: 37997580]
  - mm: thp: replace folio_memcg() with folio_memcg_charged() (Muchun Song) [Orabug: 37997580]
  - mm: zswap: prevent lruvec release in zswap_folio_swapin() (Muchun Song) [Orabug: 37997580]
  - mm: workingset: prevent lruvec release in workingset_refault() (Muchun Song) [Orabug: 37997580]
  - mm: page_io: prevent memory cgroup release in page_io module (Muchun Song) [Orabug: 37997580]
  - mm: workingset: prevent memory cgroup release in lru_gen_eviction() (Muchun Song) [Orabug: 37997580]
  - writeback: prevent memory cgroup release in writeback module (Muchun Song) [Orabug: 37997580]
  - mm: memcontrol: protect lruvec critical section with the RCU read lock (Harry Yoo) [Orabug: 37997580]
  - mm: vmscan: disable IRQ before __mod_lruvec_state() (Harry Yoo) [Orabug: 37997618]
  - mm: multi-gen LRU: fix two warnings in evict_folios() (Harry Yoo) [Orabug: 37997618]
  - mm: multi-gen LRU: update lrugen->nr_pages during lruvec reparenting (Harry Yoo) [Orabug: 37997618]
  - ocfs2: fix the issue with discontiguous allocation in the global_bitmap (Heming Zhao) [Orabug: 38041352]
  - Reapply "ocfs2: fix sparse warnings" (Gautham Ananthakrishna) [Orabug: 38041352]
  - Reapply "ocfs2: speed up chain-list searching" (Gautham Ananthakrishna) [Orabug: 38041352]
  - Reapply "ocfs2: adjust enabling place for la window" (Gautham Ananthakrishna) [Orabug: 38041352]
  - Reapply "ocfs2: improve write IO performance when fragmentation is high" (Gautham Ananthakrishna) [Orabug: 38041352]


