# changelog

author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-315.196.5.el9uek]
changelog:
  - uek-rpm: add "bpf" to CONFIG_LSM (Alan Maguire) [Orabug: 35653191]
  - Revert "cpufreq: Introduce an optional cpuinfo_avg_freq sysfs entry" (Samasth Norway Ananda) [Orabug: 38613264]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-315.196.5.1.el9uek]
changelog:
  - netfilter: nf_tables: reject duplicate device on updates (Pablo Neira Ayuso)  [Orabug: 38744086]  {CVE-2025-38678} 
  - Reapply "cpuidle: menu: Avoid discarding useful information" (Harshvardhan Jha)  [Orabug: 38744084]  
  - rtc: expose RTC_FEATURE_UPDATE_INTERRUPT (Alexandre Belloni)  [Orabug: 38744082]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-315.196.5.1.el9uek]
changelog:
  - netfilter: nf_tables: reject duplicate device on updates (Pablo Neira Ayuso)  [Orabug: 38744086]  {CVE-2025-38678}
  - Reapply "cpuidle: menu: Avoid discarding useful information" (Harshvardhan Jha)  [Orabug: 38744084]
  - rtc: expose RTC_FEATURE_UPDATE_INTERRUPT (Alexandre Belloni)  [Orabug: 38744082]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-315.196.5.2.el9uek]
changelog:
  - tipc: Fix use-after-free in tipc_mon_reinit_self(). (Kuniyuki Iwashima)  [Orabug: 38786195]  {CVE-2025-40280} 
  - fs/proc: fix uaf in proc_readdir_de() (Wei Yang)  [Orabug: 38786194]  {CVE-2025-40271} 
  - vsock: Ignore signal/timeout on connect() if already established (Michal Luczaj)  [Orabug: 38786193]  {CVE-2025-40248}


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-315.196.3.el9uek]
changelog:
  - KVM: VMX: Intercept reads to invalid and write-only x2APIC registers (Sean Christopherson) [Orabug: 38535186]
  - KVM: VMX: Always intercept accesses to unsupported "extended" x2APIC regs (Sean Christopherson) [Orabug: 38535186]
  - KVM: x86: Split out logic to generate "readable" APIC regs mask to helper (Sean Christopherson) [Orabug: 38535186]
  - KVM: x86: Mark x2APIC DFR reg as non-existent for x2APIC (Sean Christopherson) [Orabug: 38535186]
  - uek-rpm/ol9/config-mips64-emb: Enable NF_TABLES for MIPS64 (Vijay Kumar) [Orabug: 38578981]
  - LTS version: v5.15.196 (Vijayendra Suman)
  - PCI: rcar: Demote WARN() to dev_warn_ratelimited() in rcar_pcie_wakeup() (Marek Vasut) [Orabug: 38641258] {CVE-2024-43876}
  - net: rtnetlink: fix module reference count leak issue in rtnetlink_rcv_msg (Zhengchao Shao)
  - usb: gadget: f_acm: Refactor bind path to use __free() (Kuen-Han Tsai) [Orabug: 38601854] {CVE-2025-40094}
  - usb: gadget: f_ncm: Refactor bind path to use __free() (Kuen-Han Tsai) [Orabug: 38601837] {CVE-2025-40092}
  - usb: gadget: Introduce free_usb_request helper (Kuen-Han Tsai)
  - usb: gadget: Store endpoint pointer in usb_request (Kuen-Han Tsai)
  - arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() (Kaushlendra Kumar)
  - xfs: always warn about deprecated mount options (Darrick J. Wong)
  - devcoredump: Fix circular locking dependency with devcd->mutex. (Maarten Lankhorst)
  - PCI: tegra194: Reset BARs when running in PCIe endpoint mode (Niklas Cassel)
  - PCI: rcar-host: Drop PMSR spinlock (Marek Vasut)
  - PCI: rcar: Finish transition to L1 state in rcar_pcie_config_access() (Marek Vasut)
  - PCI: tegra194: Handle errors in BPMP response (Vidya Sagar)
  - f2fs: fix wrong block mapping for multi-devices (Jaegeuk Kim)
  - NFSD: Define a proc_layoutcommit for the FlexFiles layout type (Chuck Lever) [Orabug: 38601818] {CVE-2025-40087}
  - vfs: Don't leak disconnected dentries on umount (Jan Kara) [Orabug: 38601923] {CVE-2025-40105}
  - drm/amdgpu: use atomic functions with memory barriers for vm fault info (Gui-Dong Han)
  - PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock (Marek Vasut)
  - wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again (Muhammad Usama Anjum)
  - PCI: j721e: Fix programming sequence of "strap" settings (Siddharth Vadapalli)
  - PCI: j721e: Enable ACSPCIE Refclk if "ti,syscon-acspcie-proxy-ctrl" exists (Siddharth Vadapalli)
  - fuse: fix livelock in synchronous file put from fuseblk workers (Darrick J. Wong) [Orabug: 38730516] {CVE-2025-40220}
  - fuse: allocate ff->release_args only if release is needed (Amir Goldstein)
  - padata: Reset next CPU when reorder sequence wraps around (Xiao Liang)
  - iio: imu: inv_icm42600: Simplify pm_runtime setup (Sean Nyekjaer)
  - PM: runtime: Add new devm functions (Csókás Bence)
  - iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended (Sean Nyekjaer)
  - iio: imu: inv_icm42600: use = { } instead of memset() (David Lechner)
  - NFSD: Fix last write offset handling in layoutcommit (Sergey Bashirov)
  - NFSD: Minor cleanup in layoutcommit processing (Sergey Bashirov)
  - NFSD: Rework encoding and decoding of nfsd4_deviceid (Sergey Bashirov)
  - xfs: fix log CRC mismatches between i386 and other architectures (Christoph Hellwig)
  - xfs: rename the old_crc variable in xlog_recover_process (Christoph Hellwig)
  - s390/cio: Update purge function to unregister the unused subchannels (Vineeth Vijayan)
  - arm64: cputype: Add Neoverse-V3AE definitions (Mark Rutland)
  - serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018 (Florian Eckert)
  - most: usb: hdm_probe: Fix calling put_device() before device initialization (Victoria Votokina)
  - most: usb: Fix use-after-free in hdm_disconnect (Victoria Votokina)
  - mei: me: add wildcat lake P DID (Alexander Usyskin)
  - comedi: fix divide-by-zero in comedi_buf_munge() (Deepanshu Kartikey)
  - binder: remove "invalid inc weak" check (Alice Ryhl)
  - xhci: dbc: enable back DbC in resume if it was enabled before suspend (Mathias Nyman)
  - usb: raw-gadget: do not limit transfer length (Andrey Konovalov)
  - usb/core/quirks: Add Huawei ME906S to wakeup quirk (Tim Guttzeit)
  - USB: serial: option: add Telit FN920C04 ECM compositions (Li Qingwu)
  - USB: serial: option: add Quectel RG255C (Reinhard Speyerer)
  - USB: serial: option: add UNISOC UIS7720 (Renjun Wang)
  - net: ravb: Ensure memory write completes before ringing TX doorbell (Lad Prabhakar)
  - net: usb: rtl8150: Fix frame padding (Michał Pecio)
  - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [Orabug: 38730748] {CVE-2025-40231}
  - ocfs2: clear extent cache after moving/defragmenting extents (Deepanshu Kartikey) [Orabug: 38730546] {CVE-2025-40233}
  - MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering (Maciej W. Rozycki)
  - Revert "cpuidle: menu: Avoid discarding useful information" (Rafael J. Wysocki)
  - net: bonding: fix possible peer notify event loss or dup issue (Tonghao Zhang)
  - sctp: avoid NULL dereference when chunk data buffer is missing (Alexey Simakov) [Orabug: 38730566] {CVE-2025-40240}
  - arm64, mm: avoid always making PTE dirty in pte_mkwrite() (Huang, Ying)
  - dpaa2-eth: fix the pointer passed to PTR_ALIGN on Tx path (Ioana Ciornei)
  - net: enetc: correct the value of ENETC_RXB_TRUESIZE (Wei Fang)
  - rtnetlink: Allow deleting FDB entries in user namespace (Johannes Wiesboeck)
  - net: rtnetlink: add NLM_F_BULK support to rtnl_fdb_del (Nikolay Aleksandrov)
  - net: rtnetlink: add bulk delete support flag (Nikolay Aleksandrov)
  - net: netlink: add NLM_F_BULK delete request modifier (Nikolay Aleksandrov)
  - net: rtnetlink: use BIT for flag values (Nikolay Aleksandrov)
  - net: rtnetlink: add helper to extract msg type's kind (Nikolay Aleksandrov)
  - m68k: bitops: Fix find_*_bit() signatures (Geert Uytterhoeven)
  - hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super() (Yangtao Li)
  - hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits() (Viacheslav Dubeyko)
  - dlm: check for defined force value in dlm_lockspace_release (Alexander Aring)
  - hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat() (Viacheslav Dubeyko)
  - hfs: validate record offset in hfsplus_bmap_alloc (Yang Chenzhi)
  - hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent() (Viacheslav Dubeyko)
  - hfs: make proper initalization of struct hfs_find_data (Viacheslav Dubeyko)
  - hfs: clear offset and space out of valid records in b-tree node (Viacheslav Dubeyko)
  - nios2: ensure that memblock.current_limit is set when setting pfn limits (Simon Schuster)
  - exec: Fix incorrect type for ret (Xichao Zhao)
  - PCI/sysfs: Ensure devices are powered for config reads (part 2) (Brian Norris)
  - hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() (Viacheslav Dubeyko)
  - ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card (Jiaming Zhang) [Orabug: 38597093] {CVE-2025-40085}
  - ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings (Randy Dunlap)
  - sched/fair: Fix pelt lost idle time detection (Vincent Guittot)
  - sched/balancing: Rename newidle_balance() => sched_balance_newidle() (Ingo Molnar)
  - drm/amd/powerplay: Fix CIK shutdown temperature (Timur Kristóf)
  - net: usb: lan78xx: fix use of improperly initialized dev->chipid in lan78xx_reset (I Viswanath)
  - net: usb: lan78xx: Add error handling to lan78xx_init_mac_address (Oleksij Rempel)
  - net: usb: use eth_hw_addr_set() instead of ether_addr_copy() (Jakub Kicinski)
  - tls: don't rely on tx_work during send() (Sabrina Dubroca)
  - tls: always set record_type in tls_process_cmsg (Sabrina Dubroca)
  - tls: wait for async encrypt in case of error during latter iterations of sendmsg (Sabrina Dubroca)
  - net: tls: wait for async completion on last message (Sascha Hauer)
  - tg3: prevent use of uninitialized remote_adv and local_adv variables (Alexey Simakov)
  - tcp: fix tcp_tso_should_defer() vs large RTT (Eric Dumazet)
  - amd-xgbe: Avoid spurious link down messages during interface toggle (Raju Rangoju)
  - net/ip6_tunnel: Prevent perpetual tunnel growth (Dmitry Safonov) [Orabug: 38649259] {CVE-2025-40173}
  - r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H (Linmao Li)
  - doc: fix seg6_flowlabel path (Nicolas Dichtel)
  - net: dlink: handle dma_map_single() failure properly (Moon Yeounsu)
  - can: m_can: m_can_plat_remove(): add missing pm_runtime_disable() (Marc Kleine-Budde)
  - dax: skip read lock assertion for read-only filesystems (Yuezhang Mo)
  - HID: multitouch: fix sticky fingers (Benjamin Tissoires)
  - cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay (Rafael J. Wysocki)
  - crypto: rockchip - Fix dma_unmap_sg() nents value (Thomas Fourier)
  - drm/exynos: exynos7_drm_decon: remove ctx->suspended (Kaustabh Chakraborty)
  - drm/exynos: exynos7_drm_decon: properly clear channels during bind (Kaustabh Chakraborty)
  - drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions (Kaustabh Chakraborty)
  - blk-crypto: fix missing blktrace bio split events (Yu Kuai)
  - media: lirc: Fix error handling in lirc_register() (Ma Ke)
  - media: rc: Directly use ida_free() (Keliu)
  - media: s5p-mfc: remove an unused/uninitialized variable (Arnd Bergmann)
  - btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running (Filipe Manana)
  - ext4: detect invalid INLINE_DATA + EXTENTS flag combination (Deepanshu Kartikey) [Orabug: 38649222] {CVE-2025-40167}
  - jbd2: ensure that all ongoing I/O complete before freeing blocks (Zhang Yi)
  - r8152: add error handling in rtl8152_driver_init (Yi Cong)
  - LTS version: v5.15.195 (Vijayendra Suman)
  - selftests: mptcp: join: validate C-flag + def limit (Matthieu Baerts)
  - mptcp: pm: in-kernel: usable client side with C-flag (Matthieu Baerts)
  - media: pci: ivtv: Add check for DMA map result (Mikhail Kobuk) [Orabug: 38641260] {CVE-2024-43877}
  - xen/events: Update virq_to_irq on migration (Jason Andryuk)
  - media: pci: ivtv: Add missing check after DMA map (Thomas Fourier)
  - media: pci/ivtv: switch from 'pci_' to 'dma_' API (Christophe Jaillet)
  - arm64: mte: Do not flag the zero page as PG_mte_tagged (Catalin Marinas)
  - media: cx18: Add missing check after DMA map (Thomas Fourier)
  - media: switch from 'pci_' to 'dma_' API (Christophe Jaillet)
  - writeback: Avoid excessively long inode switching times (Jan Kara)
  - writeback: Avoid softlockup when switching many inodes (Jan Kara)
  - cramfs: Verify inode mode when loading from disk (Tetsuo Handa)
  - fs: Add 'initramfs_options' to set initramfs mount options (Lichen Liu)
  - pid: Add a judgment for ns null in pid_nr_ns (Gaoxiang17) [Orabug: 38649275] {CVE-2025-40178}
  - minixfs: Verify inode mode when loading from disk (Tetsuo Handa)
  - minmax.h: remove some #defines that are only expanded once (David Laight)
  - minmax.h: simplify the variants of clamp() (David Laight)
  - minmax.h: move all the clamp() definitions after the min/max() ones (David Laight)
  - minmax.h: use BUILD_BUG_ON_MSG() for the lo < hi test in clamp() (David Laight)
  - minmax.h: reduce the #define expansion of min(), max() and clamp() (David Laight)
  - minmax.h: update some comments (David Laight)
  - minmax.h: add whitespace around operators and after commas (David Laight)
  - minmax: fix up min3() and max3() too (Linus Torvalds)
  - minmax: improve macro expansion and type checking (Linus Torvalds)
  - minmax: simplify min()/max()/clamp() implementation (Linus Torvalds)
  - minmax: don't use max() in situations that want a C constant expression (Linus Torvalds)
  - minmax: make generic MIN() and MAX() macros available everywhere (Linus Torvalds)
  - minmax: simplify and clarify min_t()/max_t() implementation (Linus Torvalds)
  - minmax: add a few more MIN_T/MAX_T users (Linus Torvalds)
  - minmax: avoid overly complicated constant expressions in VM code (Linus Torvalds)
  - minmax: fix indentation of __cmp_once() and __clamp_once() (David Laight)
  - minmax: deduplicate __unconst_integer_typeof() (Andy Shevchenko)
  - minmax: Introduce {min,max}_array() (Herve Codina)
  - arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees (Stephan Gerhold)
  - btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() (Qu Wenruo)
  - fscontext: do not consume log entries when returning -EMSGSIZE (Aleksa Sarai)
  - dm: fix NULL pointer dereference in __dm_suspend() (Zheng Qixing) [Orabug: 38649056] {CVE-2025-40134}
  - tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (Yuan Chen) [Orabug: 38592032] {CVE-2025-40042}
  - ksmbd: fix error code overwriting in smb2_get_info_filesystem() (Matvey Kovalev)
  - net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock (Oleksij Rempel) [Orabug: 38649002] {CVE-2025-40120}
  - mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag (Hans de Goede)
  - mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type (Andy Shevchenko)
  - mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value (Hans de Goede)
  - media: mc: Clear minor number before put device (Edward Adam Davis) [Orabug: 38649397] {CVE-2025-40197}
  - Squashfs: reject negative file sizes in squashfs_read_inode() (Phillip Lougher) [Orabug: 38649424] {CVE-2025-40200}
  - Squashfs: add additional inode sanity checking (Phillip Lougher)
  - ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() (Ma Ke)
  - ASoC: codecs: wcd934x: Simplify with dev_err_probe (Krzysztof Kozlowski)
  - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Sean Christopherson) [Orabug: 38591958] {CVE-2025-40026}
  - lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older (Nathan Chancellor)
  - ext4: free orphan info with kvfree (Jan Kara)
  - ext4: guard against EA inode refcount underflow in xattr update (Ahmet Eray Karadag) [Orabug: 38649329] {CVE-2025-40190}
  - ext4: correctly handle queries for metadata mappings (Ojaswin Mujoo)
  - ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() (Yongjian Sun)
  - ext4: verify orphan file size is not too big (Jan Kara) [Orabug: 38649284] {CVE-2025-40179}
  - nfsd: nfserr_jukebox in nlm_fopen should lead to a retry (Olga Kornievskaia)
  - NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() (Thorsten Blum)
  - mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations (Thadeu Lima de Souza Cascardo)
  - x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases) (Sean Christopherson)
  - x86/umip: Check that the instruction opcode is at least two bytes (Sean Christopherson)
  - spi: cadence-quadspi: Flush posted register writes before DAC access (Pratyush Yadav)
  - spi: cadence-quadspi: Flush posted register writes before INDAC access (Pratyush Yadav)
  - PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() (Niklas Cassel)
  - PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit (Siddharth Vadapalli)
  - PCI/AER: Support errors introduced by PCIe r6.0 (Lukas Wunner)
  - PCI/AER: Fix missing uevent on recovery when a reset is requested (Niklas Schnelle)
  - PCI/ERR: Fix uevent on failure to recover (Lukas Wunner)
  - PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV (Niklas Schnelle) [Orabug: 38730511] {CVE-2025-40219}
  - PCI/sysfs: Ensure devices are powered for config reads (Brian Norris)
  - rseq/selftests: Use weak symbol reference, not definition, to link with glibc (Sean Christopherson)
  - rtc: interface: Fix long-standing race when setting alarm (Esben Haabendal)
  - rtc: interface: Ensure alarm irq is enabled when UIE is enabled (Esben Haabendal)
  - memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe (Zhen Ni)
  - mmc: core: SPI mode remove cmd7 (Rex Chen)
  - mtd: rawnand: fsmc: Default to autodetect buswidth (Linus Walleij)
  - sparc: fix error handling in scan_one_device() (Ma Ke)
  - sparc64: fix hugetlb for sun4u (Anthony Yznaga)
  - sctp: Fix MAC comparison to be constant-time (Eric Biggers) [Orabug: 38649450] {CVE-2025-40204}
  - scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() (Thorsten Blum)
  - pwm: berlin: Fix wrong register in suspend/resume (Jisheng Zhang)
  - powerpc/pseries/msi: Fix potential underflow and leak issue (Nam Cao)
  - powerpc/powernv/pci: Fix underflow and leak issue (Nam Cao)
  - nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk (Georg Gottleuber)
  - parisc: don't reference obsolete termio struct for TC* constants (Sam James)
  - openat2: don't trigger automounts with RESOLVE_NO_XDEV (Askar Safin)
  - lib/genalloc: fix device leak in of_gen_pool_get() (Johan Hovold)
  - KEYS: trusted_tpm1: Compare HMAC values in constant time (Eric Biggers)
  - iommu/vt-d: PRS isn't usable if PDS isn't supported (Lu Baolu)
  - iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume (Sean Nyekjaer)
  - init: handle bootloader identifier in kernel parameters (Huacai Chen)
  - iio: frequency: adf4350: Fix prescaler usage. (Michael Hennerich)
  - iio: dac: ad5421: use int type to store negative error codes (Rong Qianfeng)
  - iio: dac: ad5360: use int type to store negative error codes (Rong Qianfeng)
  - fs/ntfs3: Fix a resource leak bug in wnd_extend() (Haoxiang Li)
  - crypto: atmel - Fix dma_unmap_sg() direction (Thomas Fourier)
  - cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() (Rafael J. Wysocki) [Orabug: 38649365] {CVE-2025-40194}
  - copy_sighand: Handle architectures where sizeof(unsigned long) < sizeof(u64) (Simon Schuster)
  - bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() (Adam Xue)
  - btrfs: avoid potential out-of-bounds in btrfs_encode_fh() (Anderson Nascimento) [Orabug: 38649461] {CVE-2025-40205}
  - drm/nouveau: fix bad ret code in nouveau_bo_move_prep (Shuhao Fu)
  - media: i2c: mt9v111: fix incorrect type for ret (Rong Qianfeng)
  - firmware: meson_sm: fix device leak at probe (Johan Hovold)
  - xen/manage: Fix suspend error path (Lukas Wunner)
  - xen/events: Cleanup find_virq() return codes (Jason Andryuk)
  - ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init (Miaoqian Lin)
  - arm64: dts: qcom: msm8916: Add missing MDSS reset (Stephan Gerhold)
  - ACPI: debug: fix signedness issues in read/write helpers (Amir Mohammad Jahangirzad)
  - ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT (Daniel Tang)
  - bpf: Avoid RCU context warning when unpinning htab with internal structs (Kafai Wan)
  - gpio: wcd934x: mark the GPIO controller as sleeping (Bartosz Golaszewski)
  - gpio: wcd934x: Remove duplicate assignment of of_gpio_n_cells (Andy Shevchenko)
  - tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single (Gunnar Kudrjavets)
  - crypto: essiv - Check ssize for decryption and in-place encryption (Herbert Xu) [Orabug: 38581454,38705933] {CVE-2025-40019}
  - bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() (Eric Woudstra)
  - drm/amd/display: Properly disable scaling on DCE6 (Timur Kristóf)
  - drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 (Timur Kristóf)
  - drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs (Timur Kristóf)
  - drm/amdgpu: Add additional DCE6 SCL registers (Alex Deucher)
  - bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} (Daniel Borkmann) [Orabug: 38649299] {CVE-2025-40183}
  - mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes (Harini T)
  - mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call (Harini T)
  - tools build: Align warning options with perf (Leo Yan)
  - net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe (Erick Karanja)
  - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Kuniyuki Iwashima) [Orabug: 38649578] {CVE-2025-40186}
  - net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (Alexandr Sapozhnikov) [Orabug: 38649311] {CVE-2025-40187}
  - drm/vmwgfx: Fix Use-after-free in validation (Ian Forbes) [Orabug: 38643545] {CVE-2025-40111}
  - drm/vmwgfx: Copy DRM hash-table code into driver (Thomas Zimmermann)
  - s390/cio: unregister the subchannel while purging (Vineeth Vijayan)
  - net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() (Dan Carpenter)
  - scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (Duoming Zhou) [Orabug: 38557653] {CVE-2025-40001}
  - scsi: mvsas: Use sas_task_find_rq() for tagging (John Garry)
  - scsi: mvsas: Delete mvs_tag_init() (John Garry)
  - scsi: libsas: Add sas_task_find_rq() (John Garry)
  - cpufreq: tegra186: Set target frequency for all cpus in policy (Aaron Kling)
  - clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver (Alok Tiwari)
  - clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() (Brian Masney)
  - perf session: Fix handling when buffer exceeds 2 GiB (Leo Yan)
  - rtc: x1205: Fix Xicor X1205 vendor prefix (Rob Herring)
  - perf util: Fix compression checks returning -1 as bool (Yunseong Kim)
  - clk: at91: peripheral: fix return value (Brian Masney)
  - libperf event: Ensure tracing data is multiple of 8 sized (Ian Rogers)
  - perf evsel: Avoid container_of on a NULL leader (Ian Rogers)
  - iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE (Michael Hennerich)
  - clocksource/drivers/clps711x: Fix resource leaks in error paths (Zhen Ni)
  - fs: always return zero on success from replace_fd() (Thomas Weißschuh)
  - usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call (Miaoqian Lin)
  - bus: fsl-mc: Check return value of platform_get_resource() (Salah Triki)
  - pinctrl: check the return value of pinmux_ops::get_function_name() (Bartosz Golaszewski) [Orabug: 38591980] {CVE-2025-40030}
  - Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak (Zhen Ni) [Orabug: 38592000] {CVE-2025-40035}
  - Input: atmel_mxt_ts - allow reset GPIO to sleep (Marek Vasut)
  - nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() (Guangshuo Li)
  - mm: hugetlb: avoid soft lockup when mprotect to large memory area (Yang Shi) [Orabug: 38649149] {CVE-2025-40153}
  - ext4: fix checks for orphan inodes (Jan Kara)
  - mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() (Bartosz Golaszewski)
  - net: nfc: nci: Add parameter validation for packet data (Deepak Sharma)
  - fs: udf: fix OOB read in lengthAllocDescs handling (Larshin Sergey) [Orabug: 38592047] {CVE-2025-40044}
  - uio_hv_generic: Let userspace take care of interrupt mask (Naman Jain) [Orabug: 38592066] {CVE-2025-40048}
  - Squashfs: fix uninit-value in squashfs_get_parent (Phillip Lougher) [Orabug: 38592076] {CVE-2025-40049}
  - net: dlink: handle copy_thresh allocation failure (Moon Yeounsu) [Orabug: 38592097] {CVE-2025-40053}
  - net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable (Kohei Enju)
  - nfp: fix RSS hash key size when RSS is not supported (Kohei Enju)
  - drivers/base/node: fix double free in register_one_node() (Donet Tom)
  - ocfs2: fix double free in user_cluster_connect() (Dan Carpenter) [Orabug: 38592109] {CVE-2025-40055}
  - hwrng: ks-sa - fix division by zero in ks_sa_rng_init (Nishanth Menon)
  - Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO (Luiz Augusto von Dentz)
  - net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast (I Viswanath) [Orabug: 38649095] {CVE-2025-40140}
  - RDMA/siw: Always report immediate post SQ errors (Bernard Metzler)
  - usb: vhci-hcd: Prevent suspending virtually attached devices (Cristian Ciocaltea)
  - scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() (Ranjan Kumar) [Orabug: 38648980] {CVE-2025-40115}
  - ipvs: Defer ip_vs_ftp unregister during netns cleanup (Slavin Liu) [Orabug: 38581444] {CVE-2025-40018}
  - NFSv4.1: fix backchannel max_resp_sz verification check (Anthony Iliopoulos)
  - coresight: trbe: Return NULL pointer for allocation failures (Leo Yan)
  - remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice (Stephan Gerhold)
  - sparc: fix accurate exception reporting in copy_{from,to}_user for M7 (Michael Karcher)
  - sparc: fix accurate exception reporting in copy_to_user for Niagara 4 (Michael Karcher)
  - sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara (Michael Karcher)
  - sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III (Michael Karcher)
  - sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC (Michael Karcher)
  - wifi: ath10k: avoid unnecessary wait for service ready message (Baochen Qiang)
  - Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram (Bagas Sanjaya)
  - IB/sa: Fix sa_local_svc_timeout_ms read race (Vlad Dumitrescu)
  - RDMA/core: Resolve MAC of next-hop device without ARP support (Parav Pandit)
  - Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running" (Michał Pecio)
  - scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() (Rong Qianfeng)
  - scsi: qla2xxx: edif: Fix incorrect sign of error code (Rong Qianfeng)
  - ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message (Colin Ian King)
  - wifi: mt76: fix potential memory leak in mt76_wmac_probe() (Abdun Nihaal)
  - RDMA/cm: Rate limit destroy CM ID timeout error message (Håkon Bugge)
  - drivers/base/node: handle error properly in register_one_node() (Donet Tom)
  - watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog (Christophe Leroy)
  - netfilter: ipset: Remove unused htable_bits in macro ahash_region (Zhen Ni)
  - iio: consumers: Fix offset handling in iio_convert_raw_to_processed() (Hans de Goede)
  - fs: ntfs3: Fix integer overflow in run_unpack() (Vitaly Grigoryev)
  - ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping (Takashi Iwai) [Orabug: 38649006] {CVE-2025-40121}
  - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (Takashi Iwai) [Orabug: 38649156] {CVE-2025-40154}
  - ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping (Takashi Iwai)
  - pps: fix warning in pps_register_cdev when register device fail (Wang Liang) [Orabug: 38592169] {CVE-2025-40070}
  - misc: genwqe: Fix incorrect cmd field being reported in error (Colin Ian King)
  - usb: gadget: configfs: Correctly set use_os_string at bind (William Wu)
  - usb: phy: twl6030: Fix incorrect type for ret (Xichao Zhao)
  - drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() (Rong Qianfeng)
  - tcp: fix __tcp_close() to only send RST when required (Eric Dumazet)
  - PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation (Alok Tiwari)
  - wifi: mwifiex: send world regulatory domain to driver (Stefan Kerkmann)
  - drm/amdgpu: Power up UVD 3 for FW validation (v2) (Timur Kristóf)
  - ALSA: lx_core: use int type to store negative error codes (Rong Qianfeng)
  - media: rj54n1cb0c: Fix memleak in rj54n1_probe() (Zhang Shurong)
  - scsi: myrs: Fix dma_alloc_coherent() error check (Thomas Fourier)
  - scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod (Niklas Cassel) [Orabug: 38649566] {CVE-2025-40118}
  - usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup (Dan Carpenter)
  - drm/radeon/r600_cs: clean up of dead code in r600_cs (Brahmajit Das)
  - i2c: designware: Add disabling clocks when probe fails (Kunihiko Hayashi)
  - i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD (Leilk Liu)
  - thermal/drivers/qcom/lmh: Add missing IRQ includes (Dmitry Baryshkov)
  - thermal/drivers/qcom: Make LMH select QCOM_SCM (Dmitry Baryshkov)
  - tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers (Zhouyi Zhou)
  - smp: Fix up and expand the smp_call_function_many() kerneldoc (Rafael J. Wysocki)
  - bpf: Explicitly check accesses to bpf_sock_addr (Paul Chaignon) [Orabug: 38592204] {CVE-2025-40078}
  - selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported (Akhilesh Patil)
  - i3c: master: svc: Recycle unused IBI slot (Stanley Chu)
  - nvmet-fc: move lsop put work to nvmet_fc_ls_req_op (Daniel Wagner) [Orabug: 38649248] {CVE-2025-40171}
  - pwm: tiehrpwm: Fix corner case in clock divisor calculation (Uwe Kleine-König)
  - arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible (AngeloGioacchino Del Regno)
  - firmware: firmware: meson-sm: fix compile-test default (Johan Hovold)
  - pinctrl: renesas: Use int type to store negative error codes (Rong Qianfeng)
  - PM: sleep: core: Clear power.must_resume in noirq suspend error path (Rafael J. Wysocki)
  - block: use int to store blk_stack_limits() return value (Rong Qianfeng)
  - regulator: scmi: Use int type to store negative error codes (Rong Qianfeng)
  - ARM: at91: pm: fix MCKx restore routine (Nicolas Ferre)
  - blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx (Li Nan) [Orabug: 38649025] {CVE-2025-40125}
  - pinctrl: meson-gxl: add missing i2c_d pinmux (Da Xue)
  - soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS (Sneh Mankad)
  - ACPI: processor: idle: Fix memory leak when register cpuidle device failed (Huisong Li)
  - cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus() (Florian Fainelli)
  - libbpf: Fix reuse of DEVMAP (Yureka Lilian)
  - regmap: Remove superfluous check for !config in __regmap_init() (Geert Uytterhoeven)
  - x86/vdso: Fix output operand size of RDPID (Uros Bizjak)
  - perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (Leo Yan) [Orabug: 38592220] {CVE-2025-40081}
  - coresight: trbe: Prevent overflow in PERF_IDX2OFF() (Leo Yan)
  - selftests: arm64: Check fread return value in exec_target (Bala-Vignesh-Reddy)
  - filelock: add FL_RECLAIM to show_fl_flags() macro (Jeff Layton)
  - net/9p: fix double req put in p9_fd_cancelled (Nalivayko Sergey) [Orabug: 38591964] {CVE-2025-40027}
  - minmax: add in_range() macro (Matthew Wilcox)
  - crypto: rng - Ensure set_ent is always present (Herbert Xu) [Orabug: 38643530] {CVE-2025-40109}
  - platform/x86: int3472: Check for adev == NULL (Hans de Goede)
  - driver core/PM: Set power.no_callbacks along with power.no_pm (Rafael J. Wysocki)
  - staging: axis-fifo: flush RX FIFO on read errors (Ovidiu Panait)
  - staging: axis-fifo: fix maximum TX packet length check (Ovidiu Panait)
  - serial: stm32: allow selecting console when the driver is module (Raphaël Gallais-Pou)
  - hid: fix I2C read buffer overflow in raw_event() for mcp2221 (Arnaud Lecomte)
  - perf subcmd: avoid crash in exclude_cmds when excludes is empty (Hupu)
  - dm-integrity: limit MAX_TAG_SIZE to 255 (Mikulas Patocka)
  - wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
  - USB: serial: option: add SIMCom 8230C compositions (Xiaowei Li)
  - media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe (Duoming Zhou)
  - media: tuner: xc5000: Fix use-after-free in xc5000_release (Duoming Zhou) [Orabug: 38548036] {CVE-2025-39994}
  - media: tunner: xc5000: Refactor firmware load (Ricardo Ribalda)
  - udp: Fix memory accounting leak. (Kuniyuki Iwashima) [Orabug: 37844324] {CVE-2025-22058}
  - KVM: arm64: Fix softirq masking in FPSIMD register saving sequence (Will Deacon) [Orabug: 38513233]
  - media: rc: fix races with imon_disconnect() (Larshin Sergey) [Orabug: 38548026] {CVE-2025-39993}
  - media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove (Duoming Zhou) [Orabug: 38548050] {CVE-2025-39996}
  - scsi: target: target_core_configfs: Add length check to avoid buffer overflow (Wang Haoran) [Orabug: 38548058] {CVE-2025-39998}
  - LTS version: v5.15.194 (Vijayendra Suman)
  - drm/i915/backlight: Return immediately when scale() finds invalid parameters (Guenter Roeck)
  - i40e: add validation for ring_len param (Lukasz Czapnik) [Orabug: 38547951,38603025,38607608] {CVE-2025-39973}
  - i40e: increase max descriptors for XL710 (Justin Bronder)
  - i40e: fix idx validation in config queues msg (Lukasz Czapnik) [Orabug: 38547937] {CVE-2025-39971}
  - i40e: fix validation of VF state in get resources (Lukasz Czapnik) [Orabug: 38547928] {CVE-2025-39969}
  - mm/hugetlb: fix folio is still mapped when deleted (Tu Jinjiang) [Orabug: 38560480] {CVE-2025-40006}
  - mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize() (David Hildenbrand)
  - fbcon: Fix OOB access in font allocation (Thomas Zimmermann)
  - fbcon: fix integer overflow in fbcon_do_set_font (Samasth Norway Ananda) [Orabug: 38547912] {CVE-2025-39967}
  - tracing: dynevent: Add a missing lockdown check on dynevent (Masami Hiramatsu) [Orabug: 38581470] {CVE-2025-40021}
  - i40e: add mask to apply valid bits for itr_idx (Lukasz Czapnik)
  - i40e: add max boundary check for VF filters (Lukasz Czapnik) [Orabug: 38547922] {CVE-2025-39968}
  - i40e: fix input validation logic for action_meta (Lukasz Czapnik) [Orabug: 38547932] {CVE-2025-39970}
  - i40e: fix idx validation in i40e_validate_queue_map (Lukasz Czapnik) [Orabug: 38547945] {CVE-2025-39972}
  - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (Eric Biggers) [Orabug: 38641289] {CVE-2025-40022}
  - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (Herbert Xu) [Orabug: 38537468,38575792,38575804] {CVE-2025-39964}
  - drm/gma500: Fix null dereference in hdmi teardown (Zabelin Nikita) [Orabug: 38560495] {CVE-2025-40011}
  - net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port (Vladimir Oltean)
  - net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() (Vladimir Oltean)
  - net: dsa: lantiq_gswip: do also enable or disable cpu port (Martin Schiller)
  - selftests: fib_nexthops: Fix creation of non-FDB nexthops (Ido Schimmel)
  - nexthop: Forbid FDB status change while nexthop is in a group (Ido Schimmel) [Orabug: 38547971] {CVE-2025-39980}
  - bnxt_en: correct offset handling for IPv6 destination address (Alok Tiwari)
  - ethernet: rvu-af: Remove slash from the driver name (Petr Malat)
  - can: peak_usb: fix shift-out-of-bounds issue (Stephane Grosjean) [Orabug: 38581461] {CVE-2025-40020}
  - can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
  - can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
  - can: hi311x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
  - can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
  - can: etas_es58x: sort the includes by alphabetic order (Vincent Mailhol)
  - can: etas_es58x: advertise timestamping capabilities and add ioctl support (Vincent Mailhol)
  - can: dev: add generic function can_eth_ioctl_hwts() (Vincent Mailhol)
  - can: dev: add generic function can_ethtool_op_get_ts_info_hwts() (Vincent Mailhol)
  - can: bittiming: replace CAN units with the generic ones from linux/units.h (Vincent Mailhol)
  - can: bittiming: allow TDC{V,O} to be zero and add can_tdc_const::tdc{v,o,f}_min (Vincent Mailhol)
  - bpf: Reject bpf_timer for PREEMPT_RT (Leon Hwang)
  - can: rcar_can: rcar_can_resume(): fix s2ram with PSCI (Geert Uytterhoeven)
  - arm64: dts: imx8mp: Correct thermal sensor index (Peng Fan)
  - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Or Har-Toov)
  - usb: core: Add 0x prefix to quirks debug output (Jiayi Li)
  - ALSA: usb-audio: Fix build with CONFIG_INPUT=n (Takashi Iwai)
  - ALSA: usb-audio: Convert comma to semicolon (Chen Ni)
  - ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 (Cristian Ciocaltea)
  - ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks (Cristian Ciocaltea)
  - ALSA: usb-audio: Simplify NULL comparison in mixer_quirks (Cristian Ciocaltea)
  - ALSA: usb-audio: Avoid multiple assignments in mixer_quirks (Cristian Ciocaltea)
  - ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks (Cristian Ciocaltea)
  - ALSA: usb-audio: Fix block comments in mixer_quirks (Cristian Ciocaltea)
  - net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer (Hans de Goede)
  - net: rfkill: gpio: add DT support (Philipp Zabel)
  - mptcp: propagate shutdown to subflows when possible (Matthieu Baerts)
  - ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer (Namjae Jeon)
  - mptcp: set remote_deny_join_id0 on SYN recv (Matthieu Baerts)
  - phy: ti: omap-usb2: fix device leak at unbind (Johan Hovold)
  - phy: Use device_get_match_data() (Rob Herring)
  - phy: broadcom: ns-usb3: fix Wvoid-pointer-to-enum-cast warning (Krzysztof Kozlowski)
  - USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels (Alan Stern)
  - usb: gadget: dummy_hcd: remove usage of list iterator past the loop body (Jakob Koschel)
  - xhci: dbc: Fix full DbC transfer ring after several reconnects (Mathias Nyman)
  - xhci: dbc: decouple endpoint allocation from initialization (Mathias Nyman)
  - serial: sc16is7xx: fix bug in flow control levels init (Hugo Villeneuve)
  - drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path (Qi Xi)
  - drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ (Loic Poulain)
  - ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message (Colin Ian King)
  - ASoC: wm8974: Correct PLL rate rounding (Charles Keepax)
  - ASoC: wm8940: Correct typo in control name (Charles Keepax)
  - mmc: mvsdio: Fix dma_unmap_sg() nents value (Thomas Fourier)
  - btrfs: tree-checker: fix the incorrect inode ref size check (Qu Wenruo)
  - power: supply: bq27xxx: restrict no-battery detection to bq27000 (H. Nikolaus Schaller)
  - power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery (H. Nikolaus Schaller)
  - nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* (Nathan Chancellor)
  - cnic: Fix use-after-free bugs in cnic_delete_task (Duoming Zhou) [Orabug: 38503848] {CVE-2025-39945}
  - net: liquidio: fix overflow in octeon_init_instr_queue() (Alexey Nepomnyashih)
  - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). (Kuniyuki Iwashima) [Orabug: 38526387] {CVE-2025-39955}
  - i40e: remove redundant memory barrier when cleaning Tx descs (Maciej Fijalkowski)
  - net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure (Moon Yeounsu)
  - qed: Don't collect too many protection override GRC elements (Jamie Bainbridge) [Orabug: 38503869] {CVE-2025-39949}
  - dpaa2-switch: fix buffer pool seeding for control traffic (Ioana Ciornei)
  - um: virtio_uml: Fix use-after-free after put_device in probe (Miaoqian Lin)
  - cgroup: split cgroup_destroy_wq into 3 workqueues (Chen Ridong) [Orabug: 38503891] {CVE-2025-39953}
  - pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch (Geert Uytterhoeven)
  - wifi: mac80211: fix incorrect type for ret (Liao Yuanhong)
  - ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported (Takashi Sakamoto)
  - net: hsr: hsr_slave: Fix the promiscuous mode in offload mode (Ravi Gunasekaran)
  - mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Miaohe Lin) [Orabug: 38461847] {CVE-2025-39883}
  - drm/i915/power: fix size for for_each_set_bit() in abox iteration (Jani Nikula)
  - phy: ti-pipe3: fix device leak at unbind (Johan Hovold)
  - phy: tegra: xusb: fix device and OF node leak at probe (Johan Hovold)
  - dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees (Stephan Gerhold) [Orabug: 38494821] {CVE-2025-39923}
  - regulator: sy7636a: fix lifecycle of power good gpio (Andreas Kemnade)
  - dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (Anders Roxell)
  - hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr (Hangbin Liu)
  - hsr: use rtnl lock when iterating over ports (Hangbin Liu)
  - net: hsr: Add VLAN CTAG filter support (Murali Karicheri)
  - net: hsr: Add support for MC filtering at the slave device (Murali Karicheri)
  - net: hsr: Disable promiscuous mode in offload mode (Ravi Gunasekaran)
  - can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB (Anssi Hannula)
  - can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails (Tetsuo Handa)
  - can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed (Tetsuo Handa)
  - i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path (Michal Schmidt) [Orabug: 38494786] {CVE-2025-39911}
  - i40e: Use irq_update_affinity_hint() (Nitesh Narayan Lal)
  - igb: fix link test skipping when interface is admin down (Kohei Enju)
  - tunnels: reset the GSO metadata before reusing the skb (Antoine Tenart)
  - net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() (Stefan Wahren)
  - USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
  - USB: serial: option: add Telit Cinterion FN990A w/audio compositions (Fabio Porcedda)
  - dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks (Krzysztof Kozlowski)
  - tty: hvc_console: Call hvc_kick in hvc_write unconditionally (Fabian Vogt)
  - Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table (Christoffer Sandberg)
  - mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer (Christophe Kerello)
  - mtd: rawnand: stm32_fmc2: Fix dma_map_sg error check (Jack Wang)
  - mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing (Alexander Sverdlin)
  - mtd: nand: raw: atmel: Fix comment in timings preparation (Alexander Dahl)
  - mm/khugepaged: fix the address passed to notifier on testing young (Wei Yang)
  - libceph: fix invalid accesses to ceph_connection_v1_info (Ilya Dryomov) [Orabug: 38461836] {CVE-2025-39880}
  - fuse: prevent overflow in copy_file_range return value (Miklos Szeredi)
  - fuse: check if copy_file_range() returns larger than requested size (Miklos Szeredi)
  - mtd: rawnand: stm32_fmc2: fix ECC overwrite (Christophe Kerello)
  - ocfs2: fix recursive semaphore deadlock in fiemap call (Mark Tinguely) [Orabug: 38461858] {CVE-2025-39885}
  - mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN (Krister Johansen)
  - compiler-clang.h: define __SANITIZE_*__ macros only when undefined (Nathan Chancellor)
  - EDAC/altera: Delete an inappropriate dma_free_coherent() call (Salah Triki)
  - tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. (Kuniyuki Iwashima) [Orabug: 38494796] {CVE-2025-39913}
  - NFSv4/flexfiles: Fix layout merge mirror check. (Jonathan Curley)
  - tracing: Fix tracing_marker may trigger page fault during preempt_disable (Luo Gengkun)
  - NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server (Trond Myklebust)
  - NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set (Trond Myklebust)
  - mm/rmap: reject hugetlb folios in folio_make_device_exclusive() (David Hildenbrand)
  - net: Fix null-ptr-deref by sock_lock_init_class_and_name() and rmmod. (Kuniyuki Iwashima) [Orabug: 37901603] {CVE-2025-23143}
  - media: i2c: imx214: Fix link frequency validation (André Apitzsch)
  - media: mtk-vcodec: venc: avoid -Wenum-compare-conditional warning (Arnd Bergmann)
  - mm: introduce and use {pgd,p4d}_populate_kernel() (Harry Yoo)
  - kunit: kasan_test: disable fortify string checker on kasan_strings() test (Levi Yun)
  - xfs: short circuit xfs_growfs_data_private() if delta is zero (Eric Sandeen)
  - Revert "fbdev: Disable sysfb device registration when removing conflicting FBs" (Brett A C Sheffield)


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-316.196.1.el9uek]
changelog:
  - uek-rpm: kabi: Remove the kabi protection for debug kernels (Yifei Liu) [Orabug: 38609547]
  - bnxt_en: Fix memory corruption when FW resources change during ifdown (Sreekanth Reddy) [Orabug: 38440240] {CVE-2025-39810}
  - selftests/proc: add PROCMAP_QUERY ioctl tests (Andrii Nakryiko) [Orabug: 38410775]
  - tools: sync uapi/linux/fs.h header into tools subdir (Andrii Nakryiko) [Orabug: 38410775]
  - docs/procfs: call out ioctl()-based PROCMAP_QUERY command existence (Andrii Nakryiko) [Orabug: 38410775]
  - fs/procfs: add build ID fetching to PROCMAP_QUERY API (Andrii Nakryiko) [Orabug: 38410775]
  - fs/procfs: implement efficient VMA querying API for /proc/<pid>/maps (Andrii Nakryiko) [Orabug: 38410775]
  - fs/procfs: extract logic for getting VMA name constituents (Andrii Nakryiko) [Orabug: 38410775]
  - fs: create helper file_user_path() for user displayed mapped file path (Amir Goldstein) [Orabug: 38410775]
  - mm: factor out VMA stack and heap checks (Kefeng Wang) [Orabug: 38410775]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-316.196.2.el9uek]
changelog:
  - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Pradyumn Rahar) [Orabug: 37961220,38730620] {CVE-2025-40250}


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-316.196.3.el9uek]
changelog:
  - rds: Add smp_rmb before reading c_destroy_in_prog (Håkon Bugge) [Orabug: 38352484]
  - Revert "block: don't add or resize partition on the disk with GENHD_FL_NO_PART" (Gulam Mohamed) [Orabug: 38652797]
  - Revert "block: Move checking GENHD_FL_NO_PART to bdev_add_partition()" (Gulam Mohamed) [Orabug: 38652797]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-316.196.4.el9uek]
changelog:
  - vhost_scsi: Sync up cmd completion locking with upstream (Mike Christie)  [Orabug: 38545946]
  - vhost_scsi: add support for worker ioctls (Mike Christie)  [Orabug: 38545946]
  - vhost: Limit access to vhost worker ioctls (Mike Christie)  [Orabug: 38545946]
  - vhost: allow userspace to create workers (Mike Christie)  [Orabug: 38545946]
  - vhost: replace single worker pointer with xarray (Mike Christie)  [Orabug: 38545946]
  - vhost: add helper to parse userspace vring state/file (Mike Christie)  [Orabug: 38545946]
  - vhost: remove vhost_work_queue (Mike Christie)  [Orabug: 38545946]
  - vhost_scsi: flush IO vqs then send TMF rsp (Mike Christie)  [Orabug: 38545946]
  - vhost_scsi: convert to vhost_vq_work_queue (Mike Christie)  [Orabug: 38545946]
  - vhost_scsi: make SCSI cmd completion per vq (Mike Christie)  [Orabug: 38545946]
  - vhost_sock: convert to vhost_vq_work_queue (Mike Christie)  [Orabug: 38545946]
  - vhost: convert poll work to be vq based (Mike Christie)  [Orabug: 38545946]
  - vhost: take worker or vq for flushing (Mike Christie)  [Orabug: 38545946]
  - vhost: take worker or vq instead of dev for queueing (Mike Christie)  [Orabug: 38545946]
  - vhost, vhost_net: add helper to check if vq has work (Mike Christie)  [Orabug: 38545946]
  - vhost: add vhost_worker pointer to vhost_virtqueue (Mike Christie)  [Orabug: 38545946]
  - vhost: dynamically allocate vhost_worker (Mike Christie)  [Orabug: 38545946]
  - vhost: create worker at end of vhost_dev_set_owner (Mike Christie)  [Orabug: 38545946]
  - vhost-scsi: Fix crash during LUN unmapping (Mike Christie)  [Orabug: 38545946]
  - vhost: move worker thread fields to new struct (Mike Christie)  [Orabug: 38545946]
  - vhost: Fix livepatch timeouts in vhost_worker() (Josh Poimboeuf)  [Orabug: 38545946]
  - vhost: rename vhost_work_dev_flush (Mike Christie)  [Orabug: 38545946]
  - vhost-test: drop flush after vhost_dev_cleanup (Mike Christie)  [Orabug: 38545946]
  - vhost/test: fix memory leak of vhost virtqueues (Xianting Tian)  [Orabug: 38545946]
  - vhost-scsi: drop flush after vhost_dev_cleanup (Mike Christie)  [Orabug: 38545946]
  - vhost_vsock: simplify vhost_vsock_flush() (Andrey Ryabinin)  [Orabug: 38545946]
  - vhost_test: remove vhost_test_flush_vq() (Andrey Ryabinin)  [Orabug: 38545946]
  - vhost_net: get rid of vhost_net_flush_vq() and extra flush calls (Andrey Ryabinin)  [Orabug: 38545946]
  - vhost: flush dev once during vhost_dev_stop (Mike Christie)  [Orabug: 38545946]
  - vhost: get rid of vhost_poll_flush() wrapper (Andrey Ryabinin)  [Orabug: 38545946]
  - net/mlx5e: Add a miss level for ipsec crypto offload (Lama Kayal)  [Orabug: 38600056]
  - net/mlx5e: Add new prio for promiscuous mode (Jianbo Liu)  [Orabug: 38600056]
  - mm/hugetlb: add option to allows disabling CVE-2025-38085 mitigation (Joe Jin)  [Orabug: 38728358]
  - uek-rpm: Replace check-kabi tool with kabi (Yifei Liu)  [Orabug: 38673381]
  - uek-rpm: Introduce check function for uek-rpm/tools/kabi (Yifei Liu)  [Orabug: 38673381]
  - rtc: expose RTC_FEATURE_UPDATE_INTERRUPT (Alexandre Belloni)  [Orabug: 38708842]
  - Reapply "cpuidle: menu: Avoid discarding useful information" (Harshvardhan Jha)  [Orabug: 38710346]
  - netfilter: nf_tables: reject duplicate device on updates (Pablo Neira Ayuso)  [Orabug: 38389767]  {CVE-2025-38678}
  - HID: quirks: work around VID/PID conflict for 0x4c4a/0x4155 (Zhang Heng)
  - mptcp: pm: in-kernel: C-flag: handle late ADD_ADDR (Matthieu Baerts (NGI0))
  - USB: storage: Remove subclass and protocol overrides from Novatek quirk (Alan Stern)
  - most: usb: fix double free on late probe failure (Johan Hovold)
  - uio_hv_generic: Set event for all channels on the device (Long Li)
  - regmap: slimbus: fix bus_context pointer in regmap init calls (Alexey Klimov)
  - usb: typec: ucsi: psy: Set max current to zero when disconnected (Jameson Thies)
  - ata: libata-scsi: Fix system suspend for a security locked drive (Niklas Cassel)
  - MIPS: mm: Prevent a TLB shutdown on initial uniquification (Maciej W. Rozycki)


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-316.196.4.1.el9uek]
changelog:
  - tipc: Fix use-after-free in tipc_mon_reinit_self(). (Kuniyuki Iwashima)  [Orabug: 38788585]  {CVE-2025-40280} 
  - fs/proc: fix uaf in proc_readdir_de() (Wei Yang)  [Orabug: 38788587]  {CVE-2025-40271} 
  - vsock: Ignore signal/timeout on connect() if already established (Michal Luczaj)  [Orabug: 38788594]  {CVE-2025-40248}


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-0.20.20.1.el9uek]
changelog:
  - rds: ib: Fix NULL ptr deref in rds_ib_cq_follow_affinity (Håkon Bugge)  [Orabug: 37702023]
  - scsi: mpi3mr: Task Abort EH Support (Chandrakanth Patil)  [Orabug: 37778472]
  - scsi: mpi3mr: Update driver version to 8.13.0.5.50 (Ranjan Kumar)  [Orabug: 37778472]
  - scsi: mpi3mr: Check admin reply queue from Watchdog (Ranjan Kumar)  [Orabug: 37778472]
  - scsi: mpi3mr: Update timestamp only for supervisor IOCs (Ranjan Kumar)  [Orabug: 37778472]
  - scsi: mpi3mr: Update MPI Headers to revision 35 (Ranjan Kumar)  [Orabug: 37778472]
  - scsi: mpi3mr: Fix locking in an error path (Bart Van Assche)  [Orabug: 37778472]
  - scsi: mpi3mr: Fix spelling mistake "skiping" -> "skipping" (Colin Ian King)  [Orabug: 37778472]
  - scsi: mpi3mr: Update driver version to 8.12.1.0.50 (Ranjan Kumar)  [Orabug: 37778472]
  - scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue (Ranjan Kumar)  [Orabug: 37778472]
  - scsi: mpi3mr: Support for Segmented Hardware Trace buffer (Ranjan Kumar)  [Orabug: 37778472]
  - scsi: mpi3mr: Avoid reply queue full condition (Ranjan Kumar)  [Orabug: 37778472]
  - scsi: mpi3mr: Update driver version to 8.12.0.3.50 (Ranjan Kumar)  [Orabug: 37778472]
  - uek-rpm: Enable Intel In Field Scan as a module in UEK8 (Harshit Mogalapalli)  [Orabug: 37778856]


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-1.23.1.el9uek]
changelog:
  - LTS version: v6.12.23 (Jack Vogel)
  - platform/x86/amd/pmf: fix cleanup in amd_pmf_init_smart_pc() (Dan Carpenter)
  - tracing: Do not use PERF enums when perf is not defined (Steven Rostedt)
  - ARM: 9443/1: Require linker to support KEEP within OVERLAY for DCE (Nathan Chancellor)
  - NFSD: Skip sending CB_RECALL_ANY when the backchannel isn't up (Chuck Lever)
  - NFSD: Never return NFS4ERR_FILE_OPEN when removing a directory (Chuck Lever)
  - NFSD: nfsd_unlink() clobbers non-zero status returned from fh_fill_pre_attrs() (Chuck Lever)
  - nfsd: fix management of listener transports (Olga Kornievskaia)
  - nfsd: put dl_stid if fail to queue dl_recall (Li Lingfeng)
  - nfsd: allow SC_STATUS_FREEABLE when searching via nfs4_lookup_stateid() (Jeff Layton)
  - media: streamzap: fix race between device disconnection and urb callback (Murad Masimov)
  - media: vimc: skip .s_stream() for stopped entities (Nikita Zhandarovich)
  - exec: fix the racy usage of fs_struct->in_exec (Oleg Nesterov)
  - mm: zswap: fix crypto_free_acomp() deadlock in zswap_cpu_comp_dead() (Yosry Ahmed)
  - jfs: add index corruption check to DT_GETPAGE() (Roman Smirnov)
  - jfs: fix slab-out-of-bounds read in ea_get() (Qasim Ijaz)
  - ext4: fix OOB read when checking dotdot dir (Acs, Jakub)
  - ext4: don't over-report free space or inodes in statvfs (Theodore Ts'o)
  - wifi: mt76: mt7921: fix kernel panic due to null pointer dereference (Ming Yen Hsieh)
  - arm64: Don't call NULL in do_compat_alignment_fixup() (Angelos Oikonomopoulos)
  - mm/gup: reject FOLL_SPLIT_PMD with hugetlb VMAs (David Hildenbrand)
  - tracing/osnoise: Fix possible recursive locking for cpus_read_lock() (Ran Xiaokai)
  - tracing: Fix synth event printk format for str fields (Douglas Raillard)
  - tracing: Ensure module defining synth event cannot be unloaded while tracing (Douglas Raillard)
  - tracing: Fix use-after-free in print_graph_function_flags during tracer switching (Tengda Wu)
  - exfat: fix potential wrong error return from get_block (Sungjong Seo)
  - exfat: fix random stack corruption after get_block (Sungjong Seo)
  - ksmbd: fix null pointer dereference in alloc_preauth_hash() (Namjae Jeon)
  - ksmbd: validate zero num_subauth before sub_auth is accessed (Norbert Szetei)
  - ksmbd: fix overflow in dacloffset bounds check (Norbert Szetei)
  - ksmbd: fix session use-after-free in multichannel connection (Namjae Jeon)
  - ksmbd: fix use-after-free in ksmbd_sessions_deregister() (Namjae Jeon)
  - ksmbd: add bounds check for create lease context (Norbert Szetei)
  - ksmbd: add bounds check for durable handle context (Namjae Jeon)
  - KVM: SVM: Don't change target vCPU state on AP Creation VMGEXIT error (Sean Christopherson)
  - mmc: sdhci-omap: Disable MMC_CAP_AGGRESSIVE_PM for eMMC/SD (Ulf Hansson)
  - mmc: sdhci-pxav3: set NEED_RSP_BUSY capability (Karel Balej)
  - mmc: omap: Fix memory leak in mmc_omap_new_slot (Miaoqian Lin)
  - Remove unnecessary firmware version check for gc v9_4_2 (Candice Li)
  - media: omap3isp: Handle ARM dma_iommu_mapping (Robin Murphy)
  - ARM: 9444/1: add KEEP() keyword to ARM_VECTORS (Christian Eggers)
  - ACPI: resource: Skip IRQ override on ASUS Vivobook 14 X1404VAP (Paul Menzel)
  - acpi: nfit: fix narrowing conversion in acpi_nfit_ctl (Murad Masimov)
  - wifi: mt76: mt7925: remove unused acpi function for clc (Ming Yen Hsieh)
  - x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (Jann Horn)
  - x86/tsc: Always save/restore TSC sched_clock() on suspend/resume (Guilherme G. Piccoli)
  - x86/Kconfig: Add cmpxchg8b support back to Geode CPUs (Arnd Bergmann)
  - uprobes/x86: Harden uretprobe syscall trampoline check (Jiri Olsa)
  - perf/x86/intel: Avoid disable PMU if !cpuc->enabled in sample read (Kan Liang)
  - perf/x86/intel: Apply static call for drain_pebs (Peter Zijlstra (Intel))
  - ntb_perf: Delete duplicate dmaengine_unmap_put() call in perf_copy_chunk() (Markus Elfring)
  - platform/x86: ISST: Correct command storage data length (Srinivas Pandruvada)
  - platform/x86: thinkpad_acpi: disable ACPI fan access for T495* and E560 (Eduard Christian Dumitrescu)
  - ACPI: x86: Extend Lenovo Yoga Tab 3 quirk with skip GPIO event-handlers (Hans de Goede)
  - x86/tdx: Fix arch_safe_halt() execution for TDX VMs (Vishal Annapurve)
  - x86/mce: use is_copy_from_user() to determine copy-from-user context (Shuai Xue)
  - x86/microcode/AMD: Fix __apply_microcode_amd()'s return value (Boris Ostrovsky)
  - KVM: x86: block KVM_CAP_SYNC_REGS if guest state is protected (Paolo Bonzini)
  - x86/hyperv: Fix check of return value from snp_set_vmsa() (Tianyu Lan)
  - LoongArch: BPF: Use move_addr() for BPF_PSEUDO_FUNC (Hengqi Chen)
  - LoongArch: BPF: Don't override subprog's return value (Hengqi Chen)
  - LoongArch: BPF: Fix off-by-one error in build_prologue() (Hengqi Chen)
  - LoongArch: Increase MAX_IO_PICS up to 8 (Huacai Chen)
  - LoongArch: Increase ARCH_DMA_MINALIGN up to 16 (Huacai Chen)
  - rust: Fix enabling Rust and building with GCC for LoongArch (WANG Rui)
  - usbnet:fix NPE during rx_complete (Ying Lu)
  - wifi: mac80211: Fix sparse warning for monitor_sdata (Alexander Wetzel)
  - tty: serial: lpuart: only disable CTS instead of overwriting the whole UARTMODIR register (Sherry Sun)
  - tty: serial: fsl_lpuart: Fix unused variable 'sport' build warning (Sherry Sun)
  - tty: serial: fsl_lpuart: use port struct directly to simply code (Sherry Sun)
  - tty: serial: fsl_lpuart: Use u32 and u8 for register variables (Sherry Sun)
  - cgroup/rstat: Fix forceidle time in cpu.stat (Abel Wu)
  - cgroup/rstat: Tracking cgroup-level niced CPU time (Joshua Hahn)
  - tracing: Correct the refcount if the hist/hist_debug file fails to open (Tengda Wu)
  - tracing/hist: Support POLLPRI event for poll on histogram (Masami Hiramatsu (Google))
  - tracing/hist: Add poll(POLLIN) support on hist file (Masami Hiramatsu (Google))
  - tracing: Switch trace_events_hist.c code over to use guard() (Steven Rostedt)
  - tools/power turbostat: report CoreThr per measurement interval (Len Brown)
  - perf/core: Fix child_total_time_enabled accounting bug at task exit (Yeoreum Yun)
  - drm/amdgpu/gfx12: fix num_mec (Alex Deucher)
  - drm/amdgpu/gfx11: fix num_mec (Alex Deucher)
  - kbuild: deb-pkg: don't set KBUILD_BUILD_VERSION unconditionally (Alexandru Gagniuc)
  - net: ibmveth: make veth_pool_store stop hanging (Dave Marquardt)
  - arcnet: Add NULL check in com20020pci_probe() (Henry Martin)
  - ipv6: Do not consider link down nexthops in path selection (Ido Schimmel)
  - ipv6: Start path selection from the first nexthop (Ido Schimmel)
  - net: fix geneve_opt length integer overflow (Lin Ma)
  - net: dsa: mv88e6xxx: propperly shutdown PPU re-enable timer on destroy (David Oberhollenzer)
  - ipv6: fix omitted netlink attributes when using RTEXT_FILTER_SKIP_STATS (Fernando Fernandez Mancera)
  - netfilter: nft_tunnel: fix geneve_opt type confusion addition (Lin Ma)
  - net: decrease cached dst counters in dst_release (Antoine Tenart)
  - tunnels: Accept PACKET_HOST in skb_tunnel_check_pmtu(). (Guillaume Nault)
  - vsock: avoid timeout during connect() if the socket is closing (Stefano Garzarella)
  - udp: Fix memory accounting leak. (Kuniyuki Iwashima)
  - udp: Fix multiple wraparounds of sk->sk_rmem_alloc. (Kuniyuki Iwashima)
  - net: mvpp2: Prevent parser TCAM memory corruption (Tobias Waldekranz)
  - sctp: add mutual exclusion in proc_sctp_do_udp_port() (Eric Dumazet)
  - net_sched: skbprio: Remove overly strict queue assertions (Cong Wang)
  - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (Debin Zhu)
  - netfilter: nf_tables: don't unregister hook when table is dormant (Florian Westphal)
  - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Pablo Neira Ayuso)
  - idpf: fix adapter NULL pointer dereference on reboot (Emil Tantilov)
  - e1000e: change k1 configuration on MTP and later platforms (Vitaly Lifshits)
  - spi: bcm2835: Restore native CS probing when pinctrl-bcm2835 is absent (Florian Fainelli)
  - ALSA: hda/realtek: Fix built-in mic on another ASUS VivoBook model (Takashi Iwai)
  - spi: bcm2835: Do not call gpiod_put() on invalid descriptor (Florian Fainelli)
  - ASoC: imx-card: Add NULL check in imx_card_probe() (Henry Martin)
  - nvme/ioctl: don't warn on vectorized uring_cmd with fixed buffer (Caleb Sander Mateos)
  - riscv/purgatory: 4B align purgatory_start (Björn Töpel)
  - riscv/kexec_file: Handle R_RISCV_64 in purgatory relocator (Yao Zi)
  - riscv: Fix hugetlb retrieval of number of ptes in case of !present pte (Alexandre Ghiti)
  - spi: cadence: Fix out-of-bounds array access in cdns_mrvl_xspi_setup_clock() (Josh Poimboeuf)
  - ASoC: codecs: rt5665: Fix some error handling paths in rt5665_probe() (Christophe JAILLET)
  - s390/entry: Fix setting _CIF_MCCK_GUEST with lowcore relocation (Sven Schnelle)
  - ublk: make sure ubq->canceling is set when queue is frozen (Ming Lei)
  - x86/uaccess: Improve performance by aligning writes to 8 bytes in copy_user_generic(), on non-FSRM/ERMS CPUs (Herton R. Krzesinski)
  - RISC-V: errata: Use medany for relocatable builds (Palmer Dabbelt)
  - ALSA: hda/realtek: Fix built-in mic breakage on ASUS VivoBook X515JA (Takashi Iwai)
  - firmware: cs_dsp: Ensure cs_dsp_load[_coeff]() returns 0 on success (Richard Fitzgerald)
  - ntb: intel: Fix using link status DB's (Nikita Shubin)
  - ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans (Yajun Deng)
  - riscv: ftrace: Add parentheses in macro definitions of make_call_t0 and make_call_ra (Juhan Jin)
  - fs/9p: fix NULL pointer dereference on mkdir (Christian Schoenebeck)
  - spufs: fix a leak in spufs_create_context() (Al Viro)
  - spufs: fix gang directory lifetimes (Al Viro)
  - spufs: fix a leak on spufs_new_file() failure (Al Viro)
  - netfs: Fix netfs_unbuffered_read() to return ssize_t rather than int (David Howells)
  - hwmon: (nct6775-core) Fix out of bounds access for NCT679{8,9} (Tasos Sahanidis)
  - memory: omap-gpmc: drop no compatible check (Roger Quadros)
  - can: statistics: use atomic access in hot path (Oliver Hartkopp)
  - ALSA: hda/realtek: Add mute LED quirk for HP Pavilion x360 14-dy1xxx (Navon John Lukose)
  - selftests: netfilter: skip br_netfilter queue tests if kernel is tainted (Florian Westphal)
  - net: devmem: do not WARN conditionally after netdev_rx_queue_restart() (Taehee Yoo)
  - drm/amd: Keep display off while going into S4 (Mario Limonciello)
  - nvme-pci: fix stuck reset on concurrent DPC and HP (Keith Busch)
  - x86/sgx: Warn explicitly if X86_FEATURE_SGX_LC is not enabled (Vladis Dronov)
  - x86/hyperv: Fix output argument to hypercall that changes page visibility (Michael Kelley)
  - locking/semaphore: Use wake_q to wake up processes outside lock critical section (Waiman Long)
  - wifi: mac80211: fix SA Query processing in MLO (Johannes Berg)
  - wifi: mac80211: flush the station before moving it to UN-AUTHORIZED state (Emmanuel Grumbach)
  - ASoC: rt1320: set wake_capable = 0 explicitly (Bard Liao)
  - ASoC: codecs: wsa884x: report temps to hwmon in millidegree of Celsius (Alexey Klimov)
  - x86/hyperv/vtl: Stop kernel from probing VTL0 low memory (Naman Jain)
  - sched/deadline: Use online cpus for validating runtime (Shrikanth Hegde)
  - ALSA: hda/realtek: Add support for ASUS Zenbook UM3406KA Laptops using CS35L41 HDA (Stefan Binding)
  - ALSA: hda/realtek: Add support for ASUS B5405 and B5605 Laptops using CS35L41 HDA (Stefan Binding)
  - ALSA: hda/realtek: Add support for ASUS B3405 and B3605 Laptops using CS35L41 HDA (Stefan Binding)
  - ALSA: hda/realtek: Add support for various ASUS Laptops using CS35L41 HDA (Stefan Binding)
  - ALSA: hda/realtek: Add support for ASUS ROG Strix G614 Laptops using CS35L41 HDA (Stefan Binding)
  - ALSA: hda/realtek: Add support for ASUS ROG Strix GA603 Laptops using CS35L41 HDA (Stefan Binding)
  - ALSA: hda/realtek: Add support for ASUS ROG Strix G814 Laptop using CS35L41 HDA (Stefan Binding)
  - exfat: add a check for invalid data size (Yuezhang Mo)
  - platform/x86/amd/pmf: Update PMF Driver for Compatibility with new PMF-TA (Shyam Sundar S K)
  - platform/x86/amd/pmf: Propagate PMF-TA return codes (Shyam Sundar S K)
  - HID: i2c-hid: improve i2c_hid_get_report error message (Wentao Guan)
  - net: dsa: rtl8366rb: don't prompt users for LED control (Jakub Kicinski)
  - platform/x86/intel/vsec: Add Diamond Rapids support (David E. Box)
  - platform/x86: intel-hid: fix volume buttons on Microsoft Surface Go 4 tablet (Dmitry Panchenko)
  - cifs: fix incorrect validation for num_aces field of smb_acl (Namjae Jeon)
  - smb: common: change the data type of num_aces to le16 (Namjae Jeon)
  - perf/core: Fix perf_pmu_register() vs. perf_init_event() (Peter Zijlstra)
  - ALSA: hda: Fix speakers on ASUS EXPERTBOOK P5405CSA 1.0 (Daniel Bárta)
  - ALSA: hda/realtek: Fix Asus Z13 2025 audio (Antheas Kapenekakis)
  - affs: don't write overlarge OFS data block size fields (Simon Tatham)
  - affs: generate OFS sequence numbers starting at 1 (Simon Tatham)
  - wifi: brcmfmac: keep power during suspend if board requires it (Matthias Proske)
  - nvme-pci: skip CMB blocks incompatible with PCI P2P DMA (Icenowy Zheng)
  - nvme-pci: clean up CMBMSC when registering CMB fails (Icenowy Zheng)
  - nvme-tcp: fix possible UAF in nvme_tcp_poll (Sagi Grimberg)
  - wifi: iwlwifi: mvm: use the right version of the rate API (Emmanuel Grumbach)
  - wifi: iwlwifi: fw: allocate chained SG tables for dump (Johannes Berg)
  - wifi: mac80211: remove debugfs dir for virtual monitor (Alexander Wetzel)
  - wifi: mac80211: Cleanup sta TXQs on flush (Alexander Wetzel)
  - nfs: Add missing release on error in nfs_lock_and_join_requests() (Dan Carpenter)
  - objtool/loongarch: Add unwind hints in prepare_frametrace() (Josh Poimboeuf)
  - rcu-tasks: Always inline rcu_irq_work_resched() (Josh Poimboeuf)
  - context_tracking: Always inline ct_{nmi,irq}_{enter,exit}() (Josh Poimboeuf)
  - sched/smt: Always inline sched_smt_active() (Josh Poimboeuf)
  - objtool: Fix verbose disassembly if CROSS_COMPILE isn't set (David Laight)
  - octeontx2-af: Free NIX_AF_INT_VEC_GEN irq (Geetha sowjanya)
  - octeontx2-af: Fix mbox INTR handler when num VFs > 64 (Geetha sowjanya)
  - net: phy: broadcom: Correct BCM5221 PHY model detection (Jim Liu)
  - ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (Giovanni Gherdovich)
  - LoongArch: Rework the arch_kgdb_breakpoint() implementation (Yuli Wang)
  - LoongArch: Fix device node refcount leak in fdt_cpu_clk_init() (Miaoqian Lin)
  - LoongArch: Fix help text of CMDLINE_EXTEND in Kconfig (谢致邦 (XIE Zhibang))
  - objtool: Fix segfault in ignore_unreachable_insn() (Josh Poimboeuf)
  - ring-buffer: Fix bytes_dropped calculation issue (Feng Yang)
  - net/mlx5e: SHAMPO, Make reserved size independent of page size (Lama Kayal)
  - ksmbd: fix r_count dec/increment mismatch (Namjae Jeon)
  - ksmbd: fix multichannel connection failure (Namjae Jeon)
  - ksmbd: use aead_request_free to match aead_request_alloc (Miaoqian Lin)
  - rndis_host: Flag RNDIS modems as WWAN devices (Lubomir Rintel)
  - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Mark Zhang)
  - exfat: fix missing shutdown check (Yuezhang Mo)
  - exfat: fix the infinite loop in exfat_find_last_cluster() (Yuezhang Mo)
  - smb: client: Fix netns refcount imbalance causing leaks and use-after-free (Wang Zhaolong)
  - NFS: Shut down the nfs_client only after all the superblocks (Trond Myklebust)
  - objtool, media: dib8000: Prevent divide-by-zero in dib8000_set_dds() (Josh Poimboeuf)
  - objtool, nvmet: Fix out-of-bounds stack access in nvmet_ctrl_state_show() (Josh Poimboeuf)
  - thermal: core: Remove duplicate struct declaration (xueqin Luo)
  - perf bpf-filter: Fix a parsing error with comma (Namhyung Kim)
  - perf tools: annotate asm_pure_loop.S (Marcus Meissner)
  - fs/procfs: fix the comment above proc_pid_wchan() (Bart Van Assche)
  - perf vendor events arm64 AmpereOneX: Fix frontend_bound calculation (Ilkka Koskinen)
  - tty: n_tty: use uint for space returned by tty_write_room() (Jiri Slaby (SUSE))
  - staging: vchiq_arm: Fix possible NPR of keep-alive thread (Stefan Wahren)
  - staging: vchiq_arm: Register debugfs after cdev (Stefan Wahren)
  - staging: rtl8723bs: select CONFIG_CRYPTO_LIB_AES (谢致邦 (XIE Zhibang))
  - perf: intel-tpebs: Fix incorrect usage of zfree() (James Clark)
  - perf python: Check if there is space to copy all the event (Arnaldo Carvalho de Melo)
  - perf python: Don't keep a raw_data pointer to consumed ring buffer space (Arnaldo Carvalho de Melo)
  - perf python: Decrement the refcount of just created event on failure (Arnaldo Carvalho de Melo)
  - perf python: Fixup description of sample.id event member (Arnaldo Carvalho de Melo)
  - i3c: master: svc: Fix missing the IBI rules (Stanley Chu)
  - um: hostfs: avoid issues on inode number reuse by host (Benjamin Berg)
  - um: remove copy_from_kernel_nofault_allowed (Benjamin Berg)
  - um: Pass the correct Rust target and options with gcc (David Gow)
  - selftests/mm/cow: fix the incorrect error handling (Cyan Yang)
  - fuse: fix dax truncate/punch_hole fault path (Alistair Popple)
  - NFS: fix open_owner_id_maxsz and related fields. (NeilBrown)
  - NFSv4: Avoid unnecessary scans of filesystems for delayed delegations (Trond Myklebust)
  - NFSv4: Avoid unnecessary scans of filesystems for expired delegations (Trond Myklebust)
  - NFSv4: Avoid unnecessary scans of filesystems for returning delegations (Trond Myklebust)
  - NFSv4: Don't trigger uneccessary scans for return-on-close delegations (Trond Myklebust)
  - arch/powerpc: drop GENERIC_PTDUMP from mpc885_ads_defconfig (Anshuman Khandual)
  - ocfs2: validate l_tree_depth to avoid out-of-bounds access (Vasiliy Kovalev)
  - kexec: initialize ELF lowest address to ULONG_MAX (Sourabh Jain)
  - kernel/events/uprobes: handle device-exclusive entries correctly in __replace_page() (David Hildenbrand)
  - perf units: Fix insufficient array space (Arnaldo Carvalho de Melo)
  - perf evlist: Add success path to evlist__create_syswide_maps (Ian Rogers)
  - perf debug: Avoid stack overflow in recursive error message (Ian Rogers)
  - iio: light: Add check for array bounds in veml6075_read_int_time_ms (Karan Sanghavi)
  - iio: adc: ad7768-1: set MOSI idle state to prevent accidental reset (Jonathan Santos)
  - iio: adc: ad7173: Fix comparison of channel configs (Uwe Kleine-König)
  - iio: adc: ad7124: Fix comparison of channel configs (Uwe Kleine-König)
  - iio: adc: ad4130: Fix comparison of channel setups (Uwe Kleine-König)
  - dmaengine: fsl-edma: free irq correctly in remove path (Peng Fan)
  - dmaengine: fsl-edma: cleanup chan after dma_async_device_unregister (Peng Fan)
  - fs/ntfs3: Prevent integer overflow in hdr_first_de() (Dan Carpenter)
  - fs/ntfs3: Fix a couple integer overflows on 32bit systems (Dan Carpenter)
  - usb: xhci: correct debug message page size calculation (Niklas Neronin)
  - perf bench: Fix perf bench syscall loop count (Thomas Richter)
  - perf arm-spe: Fix load-store operation checking (Leo Yan)
  - iio: backend: make sure to NULL terminate stack buffer (Nuno Sá)
  - iio: accel: msa311: Fix failure to release runtime pm if direct mode claim fails. (Jonathan Cameron)
  - iio: accel: mma8452: Ensure error return on failure to matching oversampling ratio (Jonathan Cameron)
  - ucsi_ccg: Don't show failed to get FW build information error (Mario Limonciello)
  - perf build: Fix in-tree build due to symbolic link (Luca Ceresoli)
  - tools/x86: Fix linux/unaligned.h include path in lib/insn.c (Ian Rogers)
  - perf pmu: Don't double count common sysfs and json events (James Clark)
  - coresight-etm4x: add isb() before reading the TRCSTATR (Yuanfang Zhang)
  - vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint (Mike Christie)
  - coresight: catu: Fix number of pages while using 64k pages (Ilkka Koskinen)
  - greybus: gb-beagleplay: Add error handling for gb_greybus_init (Wentao Liang)
  - perf report: Switch data file correctly in TUI (Namhyung Kim)
  - soundwire: slave: fix an OF node reference leak in soundwire slave device (Joe Hattori)
  - isofs: fix KMSAN uninit-value bug in do_isofs_readdir() (Qasim Ijaz)
  - phy: phy-rockchip-samsung-hdptx: Don't use dt aliases to determine phy-id (Heiko Stuebner)
  - fs/ntfs3: Update inode->i_mapping->a_ops on compression state (Konstantin Komarov)
  - w1: fix NULL pointer dereference in probe (Chenyuan Yang)
  - perf: Always feature test reallocarray (James Clark)
  - perf stat: Fix find_stat for mixed legacy/non-legacy events (Ian Rogers)
  - clk: qcom: mmcc-sdm660: fix stuck video_subcore0 clock (Barnabás Czémán)
  - pinctrl: intel: Fix wrong bypass assignment in intel_pinctrl_probe_pwm() (Andy Shevchenko)
  - crypto: hisilicon/sec2 - fix for aead auth key length (Wenkai Lin)
  - RDMA/core: Fix use-after-free when rename device name (Wang Liang)
  - x86/dumpstack: Fix inaccurate unwinding from exception stacks due to misplaced assignment (Jann Horn)
  - leds: Fix LED_OFF brightness race (Remi Pommarel)
  - mfd: sm501: Switch to BIT() to mitigate integer overflows (Nikita Zhandarovich)
  - pinctrl: renesas: rzv2m: Fix missing of_node_put() call (Fabrizio Castro)
  - RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow (Patrisious Haddad)
  - bpf: Fix array bounds error with may_goto (Jiayuan Chen)
  - clk: qcom: gcc-sm8650: Do not turn off USB GDSCs during gdsc_disable() (Neil Armstrong)
  - crypto: nx - Fix uninitialised hv_nxc on error (Herbert Xu)
  - power: supply: max77693: Fix wrong conversion of charge input threshold value (Artur Weber)
  - x86/entry: Fix ORC unwinder for PUSH_REGS with save_ret=1 (Jann Horn)
  - clk: amlogic: g12a: fix mmc A peripheral clock (Jerome Brunet)
  - clk: clk-imx8mp-audiomix: fix dsp/ocram_a clock parents (Laurentiu Mihalcea)
  - crypto: qat - remove access to parity register for QAT GEN4 (Bairavi Alagappan)
  - pinctrl: npcm8xx: Fix incorrect struct npcm8xx_pincfg assignment (Andy Shevchenko)
  - rust: fix signature of rust_fmt_argument (Alice Ryhl)
  - selftests/bpf: Select NUMA_NO_NODE to create map (Saket Kumar Bhaskar)
  - clk: amlogic: gxbb: drop non existing 32k clock parent (Jerome Brunet)
  - clk: amlogic: g12b: fix cluster A parent data (Jerome Brunet)
  - pinctrl: tegra: Set SFIO mode to Mux Register (Prathamesh Shete)
  - IB/mad: Check available slots before posting receive WRs (Maher Sanalla)
  - crypto: api - Fix larval relookup type and mask (Herbert Xu)
  - power: supply: bq27xxx_battery: do not update cached flags prematurely (Sicelo A. Mhlongo)
  - remoteproc: qcom_q6v5_mss: Handle platforms with one power domain (Luca Weiss)
  - RDMA/erdma: Prevent use-after-free in erdma_accept_newconn() (Cheng Xu)
  - RDMA/mlx5: Fix calculation of total invalidated pages (Chiara Meiohas)
  - RDMA/core: Don't expose hw_counters outside of init net namespace (Roman Gushchin)
  - clk: rockchip: rk3328: fix wrong clk_ref_usb3otg parent (Peter Geis)
  - selftests/bpf: Fix freplace_link segfault in tailcalls prog test (Tengda Wu)
  - RDMA/mlx5: Fix MR cache initialization error flow (Michael Guralnik)
  - pinctrl: renesas: rzg2l: Fix missing of_node_put() call (Fabrizio Castro)
  - pinctrl: renesas: rza2: Fix missing of_node_put() call (Fabrizio Castro)
  - lib: 842: Improve error handling in sw842_compress() (Tanya Agarwal)
  - bpf: Use preempt_count() directly in bpf_send_signal_common() (Hou Tao)
  - clk: qcom: gcc-x1e80100: Unregister GCC_GPU_CFG_AHB_CLK/GCC_DISP_XO_CLK (Konrad Dybcio)
  - remoteproc: qcom_q6v5_pas: Use resource with CX PD for MSM8226 (Luca Weiss)
  - crypto: tegra - Set IV to NULL explicitly for AES ECB (Akhil R)
  - RDMA/mana_ib: Ensure variable err is initialized (Kees Bakker)
  - s390: Remove ioremap_wt() and pgprot_writethrough() (Niklas Schnelle)
  - clk: qcom: gcc-msm8953: fix stuck venus0_core0 clock (Vladimir Lypak)
  - crypto: tegra - Fix CMAC intermediate result handling (Akhil R)
  - pinctrl: nuvoton: npcm8xx: Fix error handling in npcm8xx_gpio_fw() (Yue Haibing)
  - clk: samsung: Fix UBSAN panic in samsung_clk_init() (Will McVicker)
  - remoteproc: qcom: pas: add minidump_id to SC7280 WPSS (Luca Weiss)
  - clk: renesas: r8a08g045: Check the source of the CPU PLL settings (Claudiu Beznea)
  - x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range() (David Hildenbrand)
  - selftests/bpf: Fix string read in strncmp benchmark (Viktor Malik)
  - libbpf: Fix hypothetical STT_SECTION extern NULL deref case (Andrii Nakryiko)
  - remoteproc: qcom_q6v5_pas: Make single-PD handling more robust (Luca Weiss)
  - pinctrl: renesas: rzg2l: Suppress binding attributes (Claudiu Beznea)
  - of: property: Increase NR_FWNODE_REFERENCE_ARGS (Zijun Hu)
  - remoteproc: core: Clear table_sz when rproc_shutdown (Peng Fan)
  - RDMA/mlx5: Fix page_size variable overflow (Michael Guralnik)
  - crypto: hisilicon/sec2 - fix for sec spec check (Wenkai Lin)
  - crypto: hisilicon/sec2 - fix for aead authsize alignment (Wenkai Lin)
  - clk: amlogic: gxbb: drop incorrect flag on 32k clock (Jerome Brunet)
  - crypto: tegra - Use HMAC fallback when keyslots are full (Akhil R)
  - crypto: bpf - Add MODULE_DESCRIPTION for skcipher (Arnd Bergmann)
  - crypto: tegra - check return value for hash do_one_req (Akhil R)
  - crypto: tegra - Use separate buffer for setkey (Akhil R)
  - crypto: qat - set parity error mask for qat_420xx (Bairavi Alagappan)
  - crypto: iaa - Test the correct request flag (Herbert Xu)
  - fbdev: sm501fb: Add some geometry checks. (Danila Chernetsov)
  - mdacon: rework dependency list (Arnd Bergmann)
  - dummycon: fix default rows/cols (Arnd Bergmann)
  - fbdev: au1100fb: Move a variable assignment behind a null pointer check (Markus Elfring)
  - PCI: pciehp: Don't enable HPIE when resuming in poll mode (Ilpo Järvinen)
  - PCI: Fix BAR resizing when VF BARs are assigned (Ilpo Järvinen)
  - PCI: histb: Fix an error handling path in histb_pcie_probe() (Christophe JAILLET)
  - PCI: dwc: ep: Return -ENOMEM for allocation failures (Dan Carpenter)
  - drm/amd/display: avoid NPD when ASIC does not support DMUB (Thadeu Lima de Souza Cascardo)
  - drm/mediatek: dsi: fix error codes in mtk_dsi_host_transfer() (Dan Carpenter)
  - drm/mediatek: dp: drm_err => dev_err in HPD path to avoid NULL ptr (Douglas Anderson)
  - drm/mediatek: Fix config_updating flag never false when no mbox channel (Jason-JH Lin)
  - PCI: xilinx-cpm: Fix IRQ domain leak in error path of probe (Thippeswamy Havalige)
  - PCI: Remove stray put_device() in pci_register_host_bridge() (Dan Carpenter)
  - powerpc/kexec: fix physical address calculation in clear_utlb_entry() (Christophe Leroy)
  - crypto: powerpc: Mark ghashp8-ppc.o as an OBJECT_FILES_NON_STANDARD (Christophe Leroy)
  - drm/msm/a6xx: Fix a6xx indexed-regs in devcoreduump (Rob Clark)
  - drm/amd/display: fix type mismatch in CalculateDynamicMetadataParameters() (Vitaliy Shevtsov)
  - drm/panthor: Update CS_STATUS_ defines to correct values (Ashley Smith)
  - PCI: Avoid reset when disabled via sysfs (Nishanth Aravamudan)
  - PCI/portdrv: Only disable pciehp interrupts early when needed (Feng Tang)
  - PCI: brcmstb: Fix potential premature regulator disabling (Jim Quinlan)
  - PCI: brcmstb: Fix error path after a call to regulator_bulk_get() (Jim Quinlan)
  - PCI: brcmstb: Use internal register to change link capability (Jim Quinlan)
  - PCI: brcmstb: Set generation limit before PCIe link up (Jim Quinlan)
  - PCI: cadence-ep: Fix the driver to send MSG TLP for INTx without data payload (Hans Zhang)
  - drm/amdkfd: Fix Circular Locking Dependency in 'svm_range_cpu_invalidate_pagetables' (Srinivasan Shanmugam)
  - drm/msm/dsi: Set PHY usescase (and mode) before registering DSI host (Marijn Suijten)
  - drm/msm/dsi: Use existing per-interface slice count in DSC timing (Marijn Suijten)
  - drm/msm/dsi/phy: Program clock inverters in correct register (Krzysztof Kozlowski)
  - drm/msm/dpu: don't use active in atomic_check() (Dmitry Baryshkov)
  - drm/amd/display: fix an indent issue in DML21 (Aurabindo Pillai)
  - PCI/ACS: Fix 'pci=config_acs=' parameter (Tushar Dave)
  - drm/panel: ilitek-ili9882t: fix GPIO name in error message (John Keeping)
  - PCI/ASPM: Fix link state exit during switch upstream function removal (Daniel Stodden)
  - drm/mediatek: mtk_hdmi: Fix typo for aud_sampe_size member (AngeloGioacchino Del Regno)
  - drm/mediatek: mtk_hdmi: Unregister audio platform device on failure (AngeloGioacchino Del Regno)
  - PCI: Remove add_align overwrite unrelated to size0 (Ilpo Järvinen)
  - PCI: Use downstream bridges for distributing resources (Kai-Heng Feng)
  - drm/amdgpu/umsch: fix ucode check (Alex Deucher)
  - drm/amdgpu: refine smu send msg debug log format (Yang Wang)
  - gpu: cdns-mhdp8546: fix call balance of mhdp->clk handling routines (Vitalii Mordan)
  - drm/vkms: Fix use after free and double free on init error (José Expósito)
  - drm: xlnx: zynqmp: Fix max dma segment size (Tomi Valkeinen)
  - drm/bridge: it6505: fix HDCP V match check is not performed correctly (Hermes Wu)
  - drm/dp_mst: Fix drm RAD print (Wayne Lin)
  - drm/ssd130x: ensure ssd132x pitch is correct (John Keeping)
  - drm/ssd130x: fix ssd132x encoding (John Keeping)
  - drm/ssd130x: Set SPI .id_table to prevent an SPI core warning (Javier Martinez Canillas)
  - drm/bridge: ti-sn65dsi86: Fix multiple instances (Geert Uytterhoeven)
  - ALSA: timer: Don't take register_mutex with copy_from/to_user() (Takashi Iwai)
  - ASoC: ti: j721e-evm: Fix clock configuration for ti,j7200-cpb-audio compatible (Jayesh Choudhary)
  - ALSA: hda/realtek: Always honor no_shutup_pins (Takashi Iwai)
  - dt-bindings: vendor-prefixes: add GOcontroll (Maud Spierings)
  - HID: remove superfluous (and wrong) Makefile entry for CONFIG_INTEL_ISH_FIRMWARE_DOWNLOADER (Jiri Kosina)
  - ASoC: amd: acp: Fix for enabling DMIC on acp platforms via _DSD entry (Venkata Prasad Potturu)
  - ASoC: cs35l41: check the return value from spi_setup() (Vitaliy Shevtsov)
  - platform/x86: dell-ddv: Fix temperature calculation (Armin Wolf)
  - platform/x86: dell-uart-backlight: Make dell_uart_bl_serdev_driver static (Ilpo Järvinen)
  - platform/x86: lenovo-yoga-tab2-pro-1380-fastcharger: Make symbol static (Ilpo Järvinen)
  - auxdisplay: panel: Fix an API misuse in panel.c (Andy Shevchenko)
  - media: platform: allgro-dvt: unregister v4l2_device on the error path (Joe Hattori)
  - media: verisilicon: HEVC: Initialize start_bit field (Benjamin Gaignard)
  - auxdisplay: MAX6959 should select BITREVERSE (Geert Uytterhoeven)
  - regulator: pca9450: Fix enable register for LDO5 (Frieder Schrempf)
  - x86/entry: Add __init to ia32_emulation_override_cmdline() (Vitaly Kuznetsov)
  - x86/fpu/xstate: Fix inconsistencies in guest FPU xfeatures (Chao Gao)
  - x86/traps: Make exc_double_fault() consistently noreturn (Josh Poimboeuf)
  - perf/ring_buffer: Allow the EPOLLRDNORM flag for poll (Tao Chen)
  - lockdep: Don't disable interrupts on RT in disable_irq_nosync_lockdep.*() (Sebastian Andrzej Siewior)
  - PM: sleep: Fix handling devices with direct_complete set on errors (Rafael J. Wysocki)
  - thermal: int340x: Add NULL check for adev (Chenyuan Yang)
  - x86/resctrl: Fix allocation of cleanest CLOSID on platforms with no monitors (James Morse)
  - EDAC/ie31200: Fix the error path order of ie31200_init() (Qiuxu Zhuo)
  - EDAC/ie31200: Fix the DIMM size mask for several SoCs (Qiuxu Zhuo)
  - EDAC/ie31200: Fix the size of EDAC_MC_LAYER_CHIP_SELECT layer (Qiuxu Zhuo)
  - selinux: Chain up tool resolving errors in install_policy.sh (Tim Schumacher)
  - watchdog/hardlockup/perf: Fix perf_event memory leak (Li Huafei)
  - kunit/stackinit: Use fill byte different from Clang i386 pattern (Kees Cook)
  - RISC-V: KVM: Disable the kernel perf counter during configure (Atish Patra)
  - cpufreq: tegra194: Allow building for Tegra234 (Aaron Kling)
  - PM: sleep: Adjust check before setting power.must_resume (Rafael J. Wysocki)
  - lockdep/mm: Fix might_fault() lockdep check of current->mm->mmap_lock (Peter Zijlstra)
  - x86/sev: Add missing RIP_REL_REF() invocations during sme_enable() (Kevin Loughlin)
  - x86/platform: Only allow CONFIG_EISA for 32-bit (Arnd Bergmann)
  - x86/fpu: Avoid copying dynamic FP state from init_task in arch_dup_task_struct() (Benjamin Berg)
  - x86/fpu: Fix guest FPU state buffer allocation size (Stanislav Spassov)
  - EDAC/{skx_common,i10nm}: Fix some missing error reports on Emerald Rapids (Qiuxu Zhuo)
  - cpufreq: governor: Fix negative 'idle_time' handling in dbs_update() (Jie Zhan)
  - sched/eevdf: Force propagating min_slice of cfs_rq when {en,de}queue tasks (Tianchen Ding)
  - sched: Cancel the slice protection of the idle entity (zihan zhou)
  - smack: ipv4/ipv6: tcp/dccp/sctp: fix incorrect child socket label (Konstantin Andreev)
  - smack: dont compile ipv6 code unless ipv6 is configured (Konstantin Andreev)
  - cpufreq: scpi: compare kHz instead of Hz (zuoqian)
  - x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Mike Rapoport (Microsoft))
  - watch_queue: fix pipe accounting mismatch (Eric Sandeen)
  - LTS version: v6.12.22 (Jack Vogel)
  - bcachefs: bch2_ioctl_subvolume_destroy() fixes (Kent Overstreet)
  - serial: 8250_dma: terminate correct DMA in tx_dma_flush() (John Keeping)
  - serial: stm32: do not deassert RS485 RTS GPIO prematurely (Cheick Traore)
  - perf tools: Fix up some comments and code to properly use the event_source bus (Greg Kroah-Hartman)
  - memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (Luo Qiu)
  - usb: xhci: Apply the link chain quirk on NEC isoc endpoints (Michal Pecio)
  - usb: xhci: Don't skip on Stopped - Length Invalid (Michal Pecio)
  - net: usb: usbnet: restore usb%d name exception for local mac addresses (Dominique Martinet)
  - net: usb: qmi_wwan: add Telit Cinterion FE990B composition (Fabio Porcedda)
  - net: usb: qmi_wwan: add Telit Cinterion FN990B composition (Fabio Porcedda)
  - tty: serial: fsl_lpuart: disable transmitter before changing RS485 related registers (Sherry Sun)
  - tty: serial: 8250: Add Brainboxes XC devices (Cameron Williams)
  - tty: serial: 8250: Add some more device IDs (Cameron Williams)
  - counter: microchip-tcb-capture: Fix undefined counter channel state on probe (William Breathitt Gray)
  - counter: stm32-lptimer-cnt: fix error handling when enabling (Fabrice Gasnier)
  - ALSA: hda/realtek: Support mute LED on HP Laptop 15s-du3xxx (Dhruv Deshpande)
  - netfilter: socket: Lookup orig tuple for IPv6 SNAT (Maxim Mikityanskiy)
  - drm/amd/display: Don't write DP_MSTM_CTRL after LT (Wayne Lin)
  - atm: Fix NULL pointer dereference (Minjoong Kim)
  - HID: hid-plantronics: Add mic mute mapping and generalize quirks (Terry Junge)
  - ALSA: usb-audio: Add quirk for Plantronics headsets to fix control names (Terry Junge)
  - LTS version: v6.12.21 (Jack Vogel)
  - mptcp: Fix data stream corruption in the address announcement (Arthur Mongodin)
  - mm/huge_memory: drop beyond-EOF folios with the right number of refs (Zi Yan)
  - arm64: dts: rockchip: fix u2phy1_host status for NanoPi R4S (Justin Klaassen)
  - libsubcmd: Silence compiler warning (Eder Zulian)
  - Revert "sched/core: Reduce cost of sched_move_task when config autogroup" (Dietmar Eggemann)
  - KVM: arm64: Eagerly switch ZCR_EL{1,2} (Mark Rutland)
  - KVM: arm64: Mark some header functions as inline (Mark Rutland)
  - KVM: arm64: Refactor exit handlers (Mark Rutland)
  - KVM: arm64: Remove VHE host restore of CPACR_EL1.SMEN (Mark Rutland)
  - KVM: arm64: Remove VHE host restore of CPACR_EL1.ZEN (Mark Rutland)
  - KVM: arm64: Remove host FPSIMD saving for non-protected KVM (Mark Rutland)
  - KVM: arm64: Unconditionally save+flush host FPSIMD/SVE/SME state (Mark Rutland)
  - KVM: arm64: Calculate cptr_el2 traps on activating traps (Fuad Tabba)
  - io_uring/net: fix sendzc double notif flush (Pavel Begunkov)
  - ksmbd: fix incorrect validation for num_aces field of smb_acl (Namjae Jeon)
  - drm/amdkfd: Fix user queue validation on Gfx7/8 (Philip Yang)
  - drm/amdgpu: Fix JPEG video caps max size for navi1x and raven (David Rosca)
  - drm/amdgpu: Fix MPEG2, MPEG4 and VC1 video caps max size (David Rosca)
  - drm/amdgpu: Remove JPEG from vega and carrizo video caps (David Rosca)
  - drm/amdgpu/pm: wire up hwmon fan speed for smu 14.0.2 (Alex Deucher)
  - drm/amdgpu/pm: Handle SCLK offset correctly in overdrive for smu 14.0.2 (Tomasz Pakuła)
  - drm/amdgpu: Restore uncached behaviour on GFX12 (David Belanger)
  - drm/amd/pm: add unique_id for gfx12 (Harish Kasiviswanathan)
  - drm/amd/display: Use HW lock mgr for PSR1 when only one eDP (Mario Limonciello)
  - drm/amd/display: Fix message for support_edp0_on_dp1 (Yilin Chen)
  - drm/amdgpu/gfx12: correct cleanup of 'me' field with gfx_v12_0_me_fini() (Wentao Liang)
  - drm/sched: Fix fence reference count leak (qianyi liu)
  - drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse() (Nikita Zhandarovich)
  - pmdomain: amlogic: fix T7 ISP secpower (Xianwei Zhao)
  - soc: qcom: pdr: Fix the potential deadlock (Saranya R)
  - batman-adv: Ignore own maximum aggregation size during RX (Sven Eckelmann)
  - xsk: fix an integer overflow in xp_create_and_assign_umem() (Gavrilov Ilia)
  - keys: Fix UAF in key_put() (David Howells)
  - efi/libstub: Avoid physical address 0x0 when doing random allocation (Ard Biesheuvel)
  - firmware: qcom: uefisecapp: fix efivars registration race (Johan Hovold)
  - ARM: shmobile: smp: Enforce shmobile_smp_* alignment (Geert Uytterhoeven)
  - ARM: dts: imx6qdl-apalis: Fix poweroff on Apalis iMX6 (Stefan Eichenberger)
  - memcg: drain obj stock on cpu hotplug teardown (Shakeel Butt)
  - proc: fix UAF in proc_get_inode() (Ye Bin)
  - mm/page_alloc: fix memory accept before watermarks gets initialized (Kirill A. Shutemov)
  - mm/migrate: fix shmem xarray update during migration (Zi Yan)
  - mm: fix error handling in __filemap_get_folio() with FGP_NOWAIT (Raphael S. Carvalho)
  - selftests/mm: run_vmtests.sh: fix half_ufd_size_MB calculation (Rafael Aquini)
  - mmc: atmel-mci: Add missing clk_disable_unprepare() (Gu Bowen)
  - mmc: sdhci-brcmstb: add cqhci suspend/resume to PM ops (Kamal Dasu)
  - arm64: dts: rockchip: fix pinmux of UART5 for PX30 Ringneck on Haikou (Quentin Schulz)
  - arm64: dts: rockchip: fix pinmux of UART0 for PX30 Ringneck on Haikou (Quentin Schulz)
  - arm64: dts: freescale: imx8mm-verdin-dahlia: add Microphone Jack to sound card (Stefan Eichenberger)
  - arm64: dts: freescale: imx8mp-verdin-dahlia: add Microphone Jack to sound card (Stefan Eichenberger)
  - accel/qaic: Fix integer overflow in qaic_validate_req() (Dan Carpenter)
  - regulator: check that dummy regulator has been probed before using it (Christian Eggers)
  - regulator: dummy: force synchronous probing (Christian Eggers)
  - netfs: Call `invalidate_cache` only if implemented (Max Kellermann)
  - riscv: dts: starfive: Fix a typo in StarFive JH7110 pin function definitions (E Shattow)
  - io_uring/net: don't clear REQ_F_NEED_CLEANUP unconditionally (Jens Axboe)
  - drm/v3d: Don't run jobs that have errors flagged in its fence (Maíra Canal)
  - drm/xe: Fix exporting xe buffers multiple times (Tomasz Rusinowicz)
  - can: flexcan: disable transceiver during system PM (Haibo Chen)
  - can: flexcan: only change CAN state when link up in system PM (Haibo Chen)
  - can: ucan: fix out of bound read in strscpy() source (Vincent Mailhol)
  - can: rcar_canfd: Fix page entries in the AFL list (Biju Das)
  - dt-bindings: can: renesas,rcar-canfd: Fix typo in pattern properties for R-Car V4M (Biju Das)
  - net: mana: Support holes in device list reply msg (Haiyang Zhang)
  - i2c: omap: fix IRQ storms (Andreas Kemnade)
  - tracing: tprobe-events: Fix leakage of module refcount (Masami Hiramatsu (Google))
  - Revert "gre: Fix IPv6 link-local address generation." (Guillaume Nault)
  - net/neighbor: add missing policy for NDTPA_QUEUE_LENBYTES (Lin Ma)
  - libfs: Fix duplicate directory entry in offset_dir_lookup (Yongjian Sun)
  - net: ipv6: ioam6: fix lwtunnel_output() loop (Justin Iurman)
  - net: lwtunnel: fix recursion loops (Justin Iurman)
  - net: ti: icssg-prueth: Add lock to stats (MD Danish Anwar)
  - net: atm: fix use after free in lec_send() (Dan Carpenter)
  - gpu: host1x: Do not assume that a NULL domain means no DMA IOMMU (Jason Gunthorpe)
  - phy: fix xa_alloc_cyclic() error handling (Michal Swiatkowski)
  - dpll: fix xa_alloc_cyclic() error handling (Michal Swiatkowski)
  - devlink: fix xa_alloc_cyclic() error handling (Michal Swiatkowski)
  - ipv6: Set errno after ip_fib_metrics_init() in ip6_route_info_create(). (Kuniyuki Iwashima)
  - ipv6: Fix memleak of nhc_pcpu_rth_output in fib_check_nh_v6_gw(). (Kuniyuki Iwashima)
  - net: ipv6: fix TCP GSO segmentation with NAT (Felix Fietkau)
  - net: ethernet: ti: am65-cpsw: Fix NAPI registration sequence (Vignesh Raghavendra)
  - ata: libata-core: Add ATA_QUIRK_NO_LPM_ON_ATI for certain Samsung SSDs (Niklas Cassel)
  - tracing: tprobe-events: Fix to clean up tprobe correctly when module unload (Masami Hiramatsu (Google))
  - ARM: davinci: da850: fix selecting ARCH_DAVINCI_DA8XX (David Lechner)
  - accel/qaic: Fix possible data corruption in BOs > 2G (Jeffrey Hugo)
  - Bluetooth: hci_event: Fix connection regression between LE and non-LE adapters (Arkadiusz Bokowy)
  - Bluetooth: Fix error code in chan_alloc_skb_cb() (Dan Carpenter)
  - RDMA/hns: Fix wrong value of max_sge_rd (Junxian Huang)
  - RDMA/hns: Fix missing xa_destroy() (Junxian Huang)
  - RDMA/hns: Fix a missing rollback in error path of hns_roce_create_qp_common() (Junxian Huang)
  - RDMA/hns: Fix invalid sq params not being blocked (Junxian Huang)
  - RDMA/hns: Fix unmatched condition in error path of alloc_user_qp_db() (Junxian Huang)
  - RDMA/hns: Fix soft lockup during bt pages loop (Junxian Huang)
  - RDMA/bnxt_re: Avoid clearing VLAN_ID mask in modify qp path (Saravanan Vajravel)
  - dma-mapping: fix missing clear bdr in check_ram_in_range_map() (Baochen Qiang)
  - ARM: dts: BCM5301X: Fix switch port labels of ASUS RT-AC3200 (Chester A. Unal)
  - ARM: dts: BCM5301X: Fix switch port labels of ASUS RT-AC5300 (Chester A. Unal)
  - ARM: dts: bcm2711: Don't mark timer regs unconfigured (Phil Elwell)
  - ARM: OMAP1: select CONFIG_GENERIC_IRQ_CHIP (Arnd Bergmann)
  - RDMA/mlx5: Handle errors returned from mlx5r_ib_rate() (Qasim Ijaz)
  - RDMA/bnxt_re: Add missing paranthesis in map_qp_id_to_tbl_indx (Kashyap Desai)
  - RDMA/rxe: Fix the failure of ibv_query_device() and ibv_query_device_ex() tests (Zhu Yanjun)
  - arm64: dts: rockchip: Remove undocumented sdmmc property from lubancat-1 (Yao Zi)
  - arm64: dts: bcm2712: PL011 UARTs are actually r1p5 (Phil Elwell)
  - ARM: dts: bcm2711: PL011 UARTs are actually r1p5 (Phil Elwell)
  - ARM: dts: bcm2711: Fix xHCI power-domain (Stefan Wahren)
  - soc: imx8m: Unregister cpufreq and soc dev in cleanup path (Peng Fan)
  - soc: imx8m: Use devm_* to simplify probe failure handling (Marek Vasut)
  - soc: imx8m: Remove global soc_uid (Marek Vasut)
  - xfrm_output: Force software GSO only in tunnel mode (Cosmin Ratiu)
  - xfrm: fix tunnel mode TX datapath in packet offload mode (Alexandre Cassen)
  - arm64: dts: rockchip: remove supports-cqe from rk3588 tiger (Heiko Stuebner)
  - arm64: dts: rockchip: remove supports-cqe from rk3588 jaguar (Heiko Stuebner)
  - arm64: dts: freescale: tqma8mpql: Fix vqmmc-supply (Alexander Stein)
  - firmware: imx-scu: fix OF node leak in .probe() (Joe Hattori)
  - firmware: qcom: scm: Fix error code in probe() (Dan Carpenter)
  - rds: Tear down the copy-from-user cache before destroying rds_wq (Håkon Bugge)  [Orabug: 37379052]
  - uek-rpm: Set uek_release variable in UEK 8 spec file (Harshit Mogalapalli)  [Orabug: 37801392]


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-1.23.2.el9uek]
changelog:
  - vhost_scsi: log write descriptors (Dongli Zhang)  [Orabug: 37393517]
  - vhost-scsi: protect vq->log_base with vq->mutex (Dongli Zhang)  [Orabug: 37393517]
  - RDS: avoid queueing delayed work on an offlined cpu (Praveen Kumar Kannoju)  [Orabug: 37260584] [Orabug: 37551308]
  - Revert "x86/simplefb: simplefb was broken on UEFI mode Oracle and HP system, skip VIDEO_TYPE_EFI" (Harshit Mogalapalli)  [Orabug: 37638881]
  - uek-rpm: Replace legacy FBDEV drivers with simpledrm and fbdev emulation layer (Harshit Mogalapalli)  [Orabug: 37638881]
  - uek-rpm/kernel-uek.spec: Set DEFAULTKERNEL correctly during %postun (Vijay Kumar)
  - uek-rpm: Enable gcov build (Sherry Yang)  [Orabug: 37734677]
  - uek-rpm: remove .el9 from shim version (Samasth Norway Ananda)  [Orabug: 37820202]
  - drm/mgag200: Added support for the new device G200eH5 (Gwenael Georgeault)  [Orabug: 37835185]


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-2.24.1.el9uek]
changelog:
  - x86/microcode/AMD: Clean the cache if update did not load microcode (Boris Ostrovsky)  [Orabug: 37800727]
  - LTS version: v6.12.24 (Jack Vogel)
  - HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition (Kaixin Wang)
  - s390/cpumf: Fix double free on error in cpumf_pmu_event_init() (Thomas Richter)
  - Bluetooth: hci_uart: Fix another race during initialization (Arseniy Krasnov)
  - media: mediatek: vcodec: mark vdec_vp9_slice_map_counts_eob_coef noinline (Arnd Bergmann)
  - kbuild: Add '-fno-builtin-wcslen' (Nathan Chancellor)
  - libbpf: Prevent compiler warnings/errors (Eder Zulian)
  - x86/e820: Fix handling of subpage regions when calculating nosave ranges in e820__register_nosave_regions() (Myrrh Periwinkle)
  - nfsd: don't ignore the return code of svc_proc_register() (Jeff Layton)
  - NFSD: Fix CB_GETATTR status fix (Chuck Lever)
  - NFSD: fix decoding in nfs4_xdr_dec_cb_getattr (Olga Kornievskaia)
  - ACPI: platform-profile: Fix CFI violation when accessing sysfs files (Nathan Chancellor)
  - iommufd: Fail replace if device has not been attached (Yi Liu)
  - iommufd: Make attach_handle generic than fault specific (Nicolin Chen)
  - arm64: errata: Add newer ARM cores to the spectre_bhb_loop_affected() lists (Douglas Anderson)
  - thermal/drivers/mediatek/lvts: Disable Stage 3 thermal threshold (Nícolas F. R. A. Prado)
  - thermal/drivers/mediatek/lvts: Disable monitor mode during suspend (Nícolas F. R. A. Prado)
  - selftests: mptcp: fix incorrect fd checks in main_loop (Cong Liu)
  - selftests: mptcp: close fd_in before returning in main_loop (Geliang Tang)
  - sched_ext: create_dsq: Return -EEXIST on duplicate request (Jake Hillion)
  - s390: Fix linker error when -no-pie option is unavailable (Sumanth Korikkar)
  - s390/virtio_ccw: Don't allocate/assign airqs for non-existing queues (David Hildenbrand)
  - s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs (Niklas Schnelle)
  - ring-buffer: Use flush_kernel_vmap_range() over flush_dcache_folio() (Steven Rostedt)
  - pinctrl: samsung: add support for eint_fltcon_offset (Peter Griffin)
  - pinctrl: qcom: Clear latched interrupt status when changing IRQ type (Stephan Gerhold)
  - phy: freescale: imx8m-pcie: assert phy reset and perst in power off (Stefan Eichenberger)
  - PCI: Fix wrong length of devres array (Philipp Stanner)
  - PCI: Fix reference leak in pci_register_host_bridge() (Ma Ke)
  - PCI: Fix reference leak in pci_alloc_child_bus() (Ma Ke)
  - PCI: pciehp: Avoid unnecessary device replacement check (Lukas Wunner)
  - PCI: j721e: Fix the value of .linkdown_irq_regfield for J784S4 (Siddharth Vadapalli)
  - PCI: brcmstb: Fix missing of_node_put() in brcm_pcie_probe() (Stanimir Varbanov)
  - of/irq: Fix device node refcount leakages in of_irq_init() (Zijun Hu)
  - of/irq: Fix device node refcount leakage in API irq_of_parse_and_map() (Zijun Hu)
  - of/irq: Fix device node refcount leakages in of_irq_count() (Zijun Hu)
  - of/irq: Fix device node refcount leakage in API of_irq_parse_raw() (Zijun Hu)
  - of/irq: Fix device node refcount leakage in API of_irq_parse_one() (Zijun Hu)
  - ntb: use 64-bit arithmetic for the MSI doorbell mask (Fedor Pchelkin)
  - net: mana: Switch to page pool for jumbo frames (Haiyang Zhang)
  - misc: pci_endpoint_test: Fix displaying 'irq_type' after 'request_irq' error (Kunihiko Hayashi)
  - selftests/landlock: Add a new test for setuid() (Mickaël Salaün)
  - selftests/landlock: Split signal_scoping_threads tests (Mickaël Salaün)
  - landlock: Prepare to add second errata (Mickaël Salaün)
  - landlock: Always allow signals between threads of the same process (Mickaël Salaün)
  - landlock: Add erratum for TCP fix (Mickaël Salaün)
  - landlock: Add the errata interface (Mickaël Salaün)
  - landlock: Move code to ease future backports (Mickaël Salaün)
  - KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses (Sean Christopherson)
  - KVM: x86: Explicitly zero-initialize on-stack CPUID unions (Sean Christopherson)
  - KVM: PPC: Enable CAP_SPAPR_TCE_VFIO on pSeries KVM guests (Amit Machhiwal)
  - gve: handle overflow when reporting TX consumed descriptors (Joshua Washington)
  - gpio: zynq: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
  - gpio: tegra186: fix resource handling in ACPI probe path (Guixin Liu)
  - ftrace: Properly merge notrace hashes (Andy Chiu)
  - ftrace: Add cond_resched() to ftrace_graph_set_hash() (zhoumin)
  - dt-bindings: coresight: qcom,coresight-tpdm: Fix too many 'reg' (Krzysztof Kozlowski)
  - dt-bindings: coresight: qcom,coresight-tpda: Fix too many 'reg' (Krzysztof Kozlowski)
  - dm-verity: fix prefetch-vs-suspend race (Mikulas Patocka)
  - dm-integrity: fix non-constant-time tag verification (Jo Van Bulck)
  - dm-integrity: set ti->error on memory allocation failure (Mikulas Patocka)
  - dm-ebs: fix prefetch-vs-suspend race (Mikulas Patocka)
  - dlm: fix error if active rsb is not hashed (Alexander Aring)
  - dlm: fix error if inactive rsb is not hashed (Alexander Aring)
  - crypto: ccp - Fix uAPI definitions of PSP errors (Dionna Glaze)
  - crypto: ccp - Fix check for the primary ASP device (Tom Lendacky)
  - clk: qcom: gdsc: Set retain_ff before moving to HW CTRL (Taniya Das)
  - clk: qcom: gdsc: Capture pm_genpd_add_subdomain result code (Bryan O'Donoghue)
  - clk: qcom: gdsc: Release pm subdomains in reverse add order (Bryan O'Donoghue)
  - clk: qcom: clk-branch: Fix invert halt status bit check for votable clocks (Ajit Pandey)
  - clk: renesas: r9a07g043: Fix HP clock source for RZ/Five (Lad Prabhakar)
  - cifs: Ensure that all non-client-specific reparse points are processed by the server (Pali Rohár)
  - cifs: fix integer overflow in match_server() (Roman Smirnov)
  - cifs: avoid NULL pointer dereference in dbg call (Alexandra Diupina)
  - CIFS: Propagate min offload along with other parameters from primary to secondary channels. (Aman)
  - thermal/drivers/rockchip: Add missing rk3328 mapping entry (Trevor Woerner)
  - tracing: Do not add length to print format in synthetic events (Steven Rostedt)
  - tracing: fprobe events: Fix possible UAF on modules (Masami Hiramatsu (Google))
  - x86/xen: fix balloon target initialization for PVH dom0 (Roger Pau Monne)
  - sctp: detect and prevent references to a freed transport in sendmsg (Ricardo Cañuelo Navarro)
  - mm/hwpoison: introduce folio_contain_hwpoisoned_page() helper (Jinjiang Tu)
  - mm/hugetlb: move hugetlb_sysctl_init() to the __init section (Marc Herbert)
  - mm/hwpoison: do not send SIGBUS to processes with recovered clean pages (Shuai Xue)
  - mm/userfaultfd: fix release hang over concurrent GUP (Peter Xu)
  - mm: add missing release barrier on PGDAT_RECLAIM_LOCKED unlock (Mathieu Desnoyers)
  - mm/mremap: correctly handle partial mremap() of VMA starting at 0 (Lorenzo Stoakes)
  - mm: fix lazy mmu docs and usage (Ryan Roberts)
  - mm: make page_mapped_in_vma() hugetlb walk aware (Jane Chu)
  - mm/rmap: reject hugetlb folios in folio_make_device_exclusive() (David Hildenbrand)
  - mm/damon/ops: have damon_get_folio return folio even for tail pages (Usama Arif)
  - sparc/mm: avoid calling arch_enter/leave_lazy_mmu() in set_ptes (Ryan Roberts)
  - sparc/mm: disable preemption in lazy mmu mode (Ryan Roberts)
  - iommu/vt-d: Wire up irq_ack() to irq_move_irq() for posted MSIs (Sean Christopherson)
  - iommu/vt-d: Fix possible circular locking dependency (Lu Baolu)
  - iommu/vt-d: Don't clobber posted vCPU IRTE when host IRQ affinity changes (Sean Christopherson)
  - iommu/vt-d: Put IRTE back into posted MSI mode if vCPU posting is disabled (Sean Christopherson)
  - iommu/tegra241-cmdqv: Fix warnings due to dmam_free_coherent() (Nicolin Chen)
  - iommufd: Fix uninitialized rc in iommufd_access_rw() (Nicolin Chen)
  - btrfs: zoned: fix zone finishing with missing devices (Johannes Thumshirn)
  - btrfs: zoned: fix zone activation with missing devices (Johannes Thumshirn)
  - btrfs: tests: fix chunk map leak after failure to add it to the tree (Filipe Manana)
  - btrfs: fix non-empty delayed iputs list on unmount due to compressed write workers (Filipe Manana)
  - backlight: led_bl: Hold led_access lock when calling led_sysfs_disable() (Herve Codina)
  - arm64: dts: exynos: gs101: disable pinctrl_gsacore node (Peter Griffin)
  - arm64: dts: mediatek: mt8173: Fix disp-pwm compatible string (Chen-Yu Tsai)
  - arm64: mm: Correct the update of max_pfn (Zhenhua Huang)
  - arm64: tegra: Remove the Orin NX/Nano suspend key (Ninad Malwade)
  - arm64: mops: Do not dereference src reg for a set operation (Keir Fraser)
  - mtd: rawnand: Add status chack in r852_ready() (Wentao Liang)
  - mtd: inftlcore: Add error check for inftl_read_oob() (Wentao Liang)
  - mptcp: only inc MPJoinAckHMacFailure for HMAC failures (Matthieu Baerts (NGI0))
  - mptcp: fix NULL pointer in can_accept_new_subflow (Gang Yan)
  - lib: scatterlist: fix sg_split_phys to preserve original scatterlist offsets (T Pratham)
  - locking/lockdep: Decrease nr_unused_locks if lock unused in zap_class() (Boqun Feng)
  - mailbox: tegra-hsp: Define dimensioning masks in SoC data (Kartik Rajput)
  - mfd: ene-kb3930: Fix a potential NULL pointer dereference (Chenyuan Yang)
  - leds: rgb: leds-qcom-lpg: Fix calculation of best period Hi-Res PWMs (Abel Vesa)
  - leds: rgb: leds-qcom-lpg: Fix pwm resolution max for Hi-Res PWMs (Abel Vesa)
  - jbd2: remove wrong sb->s_sequence check (Jan Kara)
  - i3c: Add NULL pointer check in i3c_master_queue_ibi() (Manjunatha Venkatesh)
  - i3c: master: svc: Use readsb helper for reading MDB (Stanley Chu)
  - ima: limit the number of ToMToU integrity violations (Mimi Zohar)
  - ima: limit the number of open-writers integrity violations (Mimi Zohar)
  - smb311 client: fix missing tcon check when mounting with linux/posix extensions (Steve French)
  - soc: samsung: exynos-chipid: Add NULL pointer check in exynos_chipid_probe() (Chenyuan Yang)
  - svcrdma: do not unregister device for listeners (Olga Kornievskaia)
  - tpm: do not start chip while suspended (Thadeu Lima de Souza Cascardo)
  - udf: Fix inode_getblk() return value (Jan Kara)
  - vdpa/mlx5: Fix oversized null mkey longer than 32bit (Si-Wei Liu)
  - f2fs: fix to avoid atomicity corruption of atomic file (Yeongjin Gil)
  - ext4: fix off-by-one error in do_split (Artem Sadovnikov)
  - bus: mhi: host: Fix race between unprepare and queue_buf (Jeff Hugo)
  - accel/ivpu: Fix deadlock in ivpu_ms_cleanup() (Jacek Lawrynowicz)
  - accel/ivpu: Fix warning in ivpu_ipc_send_receive_internal() (Jacek Lawrynowicz)
  - ALSA: hda/realtek: Enable Mute LED on HP OMEN 16 Laptop xd000xx (Sharan Kumar M)
  - ASoC: qdsp6: q6asm-dai: fix q6asm_dai_compr_set_params error path (Alexey Klimov)
  - ASoC: qdsp6: q6apm-dai: fix capture pipeline overruns. (Srinivas Kandagatla)
  - ASoC: qdsp6: q6apm-dai: set 10 ms period and buffer alignment. (Srinivas Kandagatla)
  - ASoC: q6apm-dai: make use of q6apm_get_hw_pointer (Srinivas Kandagatla)
  - ASoC: q6apm-dai: schedule all available frames to avoid dsp under-runs (Srinivas Kandagatla)
  - ASoC: q6apm: add q6apm_get_hw_pointer helper (Srinivas Kandagatla)
  - ASoC: codecs: wcd937x: fix a potential memory leak in wcd937x_soc_codec_probe() (Haoxiang Li)
  - io_uring/kbuf: reject zero sized provided buffers (Jens Axboe)
  - io_uring/net: fix io_req_post_cqe abuse by send bundle (Pavel Begunkov)
  - io_uring/net: fix accept multishot handling (Pavel Begunkov)
  - wifi: mt76: mt7925: fix the wrong simultaneous cap for MLO (Ming Yen Hsieh)
  - wifi: mt76: mt7925: fix the wrong link_idx when a p2p_device is present (Ming Yen Hsieh)
  - wifi: mt76: mt7925: fix country count limitation for CLC (Ming Yen Hsieh)
  - wifi: mt76: mt7925: ensure wow pattern command align fw format (Ming Yen Hsieh)
  - wifi: mac80211: fix integer overflow in hwmp_route_info_get() (Gavrilov Ilia)
  - wifi: mt76: Add check for devm_kstrdup() (Haoxiang Li)
  - clocksource/drivers/stm32-lptimer: Use wakeup capable instead of init wakeup (Alexandre Torgue)
  - mtd: Replace kcalloc() with devm_kcalloc() (Jiasheng Jiang)
  - net: dsa: mv88e6xxx: fix internal PHYs for 6320 family (Marek Behún)
  - net: dsa: mv88e6xxx: workaround RGMII transmit delay erratum for 6320 family (Marek Behún)
  - mtd: Add check for devm_kcalloc() (Jiasheng Jiang)
  - mptcp: sockopt: fix getting freebind & transparent (Matthieu Baerts (NGI0))
  - mptcp: sockopt: fix getting IPV6_V6ONLY (Matthieu Baerts (NGI0))
  - media: chips-media: wave5: Fix timeout while testing 10bit hevc fluster (Jackson.lee)
  - media: chips-media: wave5: Fix a hang after seeking (Jackson.lee)
  - media: chips-media: wave5: Avoid race condition in the interrupt handler (Jackson.lee)
  - media: chips-media: wave5: Fix gray color on screen (Jackson.lee)
  - media: i2c: imx214: Rectify probe error handling related to runtime PM (Sakari Ailus)
  - media: i2c: imx219: Rectify runtime PM handling in probe and remove (Sakari Ailus)
  - media: i2c: imx319: Rectify runtime PM handling probe and remove (Sakari Ailus)
  - media: venus: hfi_parser: refactor hfi packet parsing logic (Vikash Garodia)
  - media: venus: hfi_parser: add check to avoid out of bound access (Vikash Garodia)
  - media: nuvoton: Fix reference handling of ece_pdev (Ricardo Ribalda)
  - media: nuvoton: Fix reference handling of ece_node (Ricardo Ribalda)
  - media: i2c: ov7251: Introduce 1 ms delay between regulators and en GPIO (Sakari Ailus)
  - media: i2c: ov7251: Set enable GPIO low in probe (Sakari Ailus)
  - media: i2c: ccs: Set the device's runtime PM status correctly in probe (Sakari Ailus)
  - media: i2c: ccs: Set the device's runtime PM status correctly in remove (Sakari Ailus)
  - Revert "media: imx214: Fix the error handling in imx214_probe()" (Sakari Ailus)
  - media: v4l2-dv-timings: prevent possible overflow in v4l2_detect_gtf() (Karina Yankevich)
  - media: imx219: Adjust PLL settings based on the number of MIPI lanes (Dave Stevenson)
  - media: platform: stm32: Add check for clk_enable() (Jiasheng Jiang)
  - media: visl: Fix ERANGE error when setting enum controls (Nicolas Dufresne)
  - media: hi556: Fix memory leak (on error) in hi556_check_hwcfg() (Hans de Goede)
  - media: streamzap: prevent processing IR data on URB failure (Murad Masimov)
  - accel/ivpu: Fix PM related deadlocks in MS IOCTLs (Jacek Lawrynowicz)
  - tpm, tpm_tis: Fix timeout handling when waiting for TPM status (Jonathan McDowell)
  - mtd: rawnand: brcmnand: fix PM resume warning (Kamal Dasu)
  - spi: cadence-qspi: Fix probe on AM62A LP SK (Miquel Raynal)
  - KVM: arm64: Tear down vGIC on failed vCPU creation (Will Deacon)
  - arm64: errata: Add KRYO 2XX/3XX/4XX silver cores to Spectre BHB safe list (Douglas Anderson)
  - arm64: errata: Assume that unknown CPUs _are_ vulnerable to Spectre BHB (Douglas Anderson)
  - arm64: errata: Add QCOM_KRYO_4XX_GOLD to the spectre_bhb_k24_list (Douglas Anderson)
  - arm64: cputype: Add MIDR_CORTEX_A76AE (Douglas Anderson)
  - xenfs/xensyms: respect hypervisor's "next" indication (Jan Beulich)
  - media: rockchip: rga: fix rga offset lookup (John Keeping)
  - media: siano: Fix error handling in smsdvb_module_init() (Yuan Can)
  - media: vim2m: print device name after registering device (Matthew Majewski)
  - media: venus: hfi: add check to handle incorrect queue size (Vikash Garodia)
  - media: venus: hfi: add a check to handle OOB in sfr region (Vikash Garodia)
  - media: intel/ipu6: set the dev_parent of video device to pdev (Bingbu Cao)
  - media: mgb4: Fix switched CMT frequency range "magic values" sets (Martin Tůma)
  - media: i2c: adv748x: Fix test pattern selection mask (Niklas Söderlund)
  - media: mgb4: Fix CMT registers update logic (Martin Tůma)
  - media: uapi: rkisp1-config: Fix typo in extensible params example (Niklas Söderlund)
  - media: mtk-vcodec: venc: avoid -Wenum-compare-conditional warning (Arnd Bergmann)
  - media: mediatek: vcodec: Fix a resource leak related to the scp device in FW initialization (Jiasheng Jiang)
  - dt-bindings: media: st,stmipid02: correct lane-polarities maxItems (Alain Volmat)
  - auxdisplay: hd44780: Fix an API misuse in hd44780.c (Haoxiang Li)
  - HID: pidff: Fix set_device_control() (Tomasz Pakuła)
  - HID: pidff: Fix 90 degrees direction name North -> East (Tomasz Pakuła)
  - HID: pidff: Compute INFINITE value instead of using hardcoded 0xffff (Tomasz Pakuła)
  - HID: pidff: Clamp effect playback LOOP_COUNT value (Tomasz Pakuła)
  - HID: pidff: Rename two functions to align them with naming convention (Tomasz Pakuła)
  - HID: pidff: Remove redundant call to pidff_find_special_keys (Tomasz Pakuła)
  - HID: pidff: Support device error response from PID_BLOCK_LOAD (Tomasz Pakuła)
  - HID: pidff: Comment and code style update (Tomasz Pakuła)
  - HID: hid-universal-pidff: Add Asetek wheelbases support (Tomasz Pakuła)
  - HID: pidff: Make sure to fetch pool before checking SIMULTANEOUS_MAX (Tomasz Pakuła)
  - HID: pidff: Factor out pool report fetch and remove excess declaration (Tomasz Pakuła)
  - HID: pidff: Use macros instead of hardcoded min/max values for shorts (Tomasz Pakuła)
  - HID: pidff: Simplify pidff_rescale_signed (Tomasz Pakuła)
  - HID: pidff: Move all hid-pidff definitions to a dedicated header (Tomasz Pakuła)
  - HID: pidff: Factor out code for setting gain (Tomasz Pakuła)
  - HID: pidff: Rescale time values to match field units (Tomasz Pakuła)
  - HID: pidff: Define values used in pidff_find_special_fields (Tomasz Pakuła)
  - HID: pidff: Simplify pidff_upload_effect function (Tomasz Pakuła)
  - HID: pidff: Completely rework and fix pidff_reset function (Tomasz Pakuła)
  - HID: pidff: Stop all effects before enabling actuators (Tomasz Pakuła)
  - HID: pidff: Clamp PERIODIC effect period to device's logical range (Tomasz Pakuła)
  - s390/pci: Fix s390_mmio_read/write syscall page fault handling (Niklas Schnelle)
  - ext4: don't treat fhandle lookup of ea_inode as FS corruption (Jann Horn)
  - bpf: support SKF_NET_OFF and SKF_LL_OFF on skb frags (Willem de Bruijn)
  - erofs: set error to bio if file-backed IO fails (Sheng Yong)
  - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Uwe Kleine-König)
  - pwm: rcar: Improve register calculation (Uwe Kleine-König)
  - pwm: mediatek: Prevent divide-by-zero in pwm_mediatek_config() (Josh Poimboeuf)
  - tpm: End any active auth session before shutdown (Jonathan McDowell)
  - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Jonathan McDowell)
  - ktest: Fix Test Failures Due to Missing LOG_FILE Directories (Ayush Jain)
  - tracing: probe-events: Add comments about entry data storing code (Masami Hiramatsu (Google))
  - fbdev: omapfb: Add 'plane' value check (Leonid Arapov)
  - drm/amdgpu: grab an additional reference on the gang fence v2 (Christian König)
  - drm/amdgpu: Fix the race condition for draining retry fault (Emily Deng)
  - PCI: Enable Configuration RRS SV early (Bjorn Helgaas)
  - drm/amdgpu: handle amdgpu_cgs_create_device() errors in amd_powerplay_create() (Wentao Liang)
  - PCI: Add Rockchip Vendor ID (Shawn Lin)
  - drm/mediatek: mtk_dpi: Explicitly manage TVD clock in power on/off (AngeloGioacchino Del Regno)
  - drm/mediatek: mtk_dpi: Move the input_2p_en bit to platform data (AngeloGioacchino Del Regno)
  - drm/xe/xelp: Move Wa_16011163337 from tunings to workarounds (Tvrtko Ursulin)
  - drm/amdkfd: debugfs hang_hws skip GPU with MES (Philip Yang)
  - drm/amdkfd: Fix pqm_destroy_queue race with GPU reset (Philip Yang)
  - drm/amdkfd: Fix mode1 reset crash issue (Philip Yang)
  - drm/amdkfd: clamp queue size to minimum (David Yat Sin)
  - drivers: base: devres: Allow to release group on device release (Lucas De Marchi)
  - drm/amd/display: stop DML2 from removing pipes based on planes (Mike Katsnelson)
  - drm/bridge: panel: forbid initializing a panel with unknown connector type (Luca Ceresoli)
  - drm/debugfs: fix printk format for bridge index (Luca Ceresoli)
  - drm: panel-orientation-quirks: Add quirk for OneXPlayer Mini (Intel) (Andrew Wyatt)
  - drm: panel-orientation-quirks: Add new quirk for GPD Win 2 (Andrew Wyatt)
  - drm: panel-orientation-quirks: Add quirk for AYA NEO Slide (Andrew Wyatt)
  - drm: panel-orientation-quirks: Add quirks for AYA NEO Flip DS and KB (Andrew Wyatt)
  - drm: panel-orientation-quirks: Add support for AYANEO 2S (Andrew Wyatt)
  - drm/amdgpu: Unlocked unmap only clear page table leaves (Philip Yang)
  - drm/amd/display: Update Cursor request mode to the beginning prefetch always (Zhikai Zhai)
  - drm/xe/vf: Don't try to trigger a full GT reset if VF (Michal Wajdeczko)
  - drm/xe/bmg: Add new PCI IDs (Shekhar Chauhan)
  - drm: allow encoder mode_set even when connectors change for crtc (Abhinav Kumar)
  - Bluetooth: Add quirk for broken READ_PAGE_SCAN_TYPE (Pedro Nishiyama)
  - Bluetooth: Add quirk for broken READ_VOICE_SETTING (Pedro Nishiyama)
  - Bluetooth: qca: simplify WCN399x NVM loading (Dmitry Baryshkov)
  - Bluetooth: hci_qca: use the power sequencer for wcn6750 (Janaki Ramaiah Thota)
  - Bluetooth: btusb: Add 2 HWIDs for MT7922 (Jiande Lu)
  - Bluetooth: hci_uart: fix race during initialization (Arseniy Krasnov)
  - Bluetooth: btintel_pcie: Add device id of Whale Peak (Kiran K)
  - tracing: fix return value in __ftrace_event_enable_disable for TRACE_REG_UNREGISTER (Gabriele Paoloni)
  - net: vlan: don't propagate flags on open (Stanislav Fomichev)
  - wifi: mt76: mt76x2u: add TP-Link TL-WDN6200 ID to device table (Icenowy Zheng)
  - btrfs: harden block_group::bg_list against list_del() races (Boris Burkov)
  - ahci: Marvell 88SE9215 controllers prefer DMA for ATAPI (Huacai Chen)
  - scsi: st: Fix array overflow in st_setup() (Kai Mäkisara)
  - cdc_ether|r8152: ThinkPad Hybrid USB-C/A Dock quirk (Philipp Hahn)
  - ext4: ignore xattrs past end (Bhupesh)
  - Revert "f2fs: rebuild nat_bits during umount" (Chao Yu)
  - ext4: protect ext4_release_dquot against freezing (Ojaswin Mujoo)
  - ahci: add PCI ID for Marvell 88SE9215 SATA Controller (Daniel Kral)
  - net: sfp: add quirk for FS SFP-10GM-T copper SFP+ module (Martin Schiller)
  - f2fs: fix to avoid out-of-bounds access in f2fs_truncate_inode_blocks() (Chao Yu)
  - wifi: ath12k: Fix invalid data access in ath12k_dp_rx_h_undecap_nwifi (Manish Dharanenthiran)
  - net: sfp: add quirk for 2.5G OEM BX SFP (Birger Koblitz)
  - ata: libata-eh: Do not use ATAPI DMA for a device limited to PIO mode (Niklas Cassel)
  - jfs: add sanity check for agwidth in dbMount (Edward Adam Davis)
  - jfs: Prevent copying of nlink with value 0 from disk inode (Edward Adam Davis)
  - fs/jfs: Prevent integer overflow in AG size calculation (Rand Deeb)
  - fs/jfs: cast inactags to s64 to prevent potential overflow (Rand Deeb)
  - jfs: Fix uninit-value access of imap allocated in the diMount() function (Zhongqiu Han)
  - can: flexcan: add NXP S32G2/S32G3 SoC support (Ciprian Marian Costea)
  - can: flexcan: Add quirk to handle separate interrupt lines for mailboxes (Ciprian Marian Costea)
  - page_pool: avoid infinite loop to schedule delayed worker (Jason Xing)
  - net: usb: asix_devices: add FiberGecko DeviceID (Max Schulze)
  - scsi: target: spc: Fix RSOC parameter data header size (Chaohai Chen)
  - wifi: mac80211: ensure sdata->work is canceled before initialized. (Miri Korenblit)
  - wifi: mac80211: add strict mode disabling workarounds (Johannes Berg)
  - f2fs: don't retry IO for corrupted data scenario (Chao Yu)
  - net: page_pool: don't cast mp param to devmem (Pavel Begunkov)
  - ata: libata-core: Add 'external' to the libata.force kernel parameter (Niklas Cassel)
  - wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process (P Praneesh)
  - wifi: ath12k: fix memory leak in ath12k_pci_remove() (Miaoqing Pan)
  - wifi: ath11k: fix memory leak in ath11k_xxx_remove() (Miaoqing Pan)
  - wifi: ath11k: Fix DMA buffer allocation to resolve SWIOTLB issues (P Praneesh)
  - platform/x86: x86-android-tablets: Add select POWER_SUPPLY to Kconfig (Hans de Goede)
  - ASoC: amd: yc: update quirk data for new Lenovo model (Syed Saba kareem)
  - ASoC: amd: Add DMI quirk for ACP6X mic support (keenplify)
  - ALSA: usb-audio: Fix CME quirk for UF series keyboards (Ricard Wanderlof)
  - mmc: dw_mmc: add a quirk for accessing 64-bit FIFOs in two halves (Kaustabh Chakraborty)
  - media: s5p-mfc: Corrected NV12M/NV21M plane-sizes (Aakarsh Jain)
  - media: uvcvideo: Add quirk for Actions UVC05 (Ricardo Ribalda)
  - ASoC: fsl_audmix: register card device depends on 'dais' property (Shengjiu Wang)
  - ALSA: hda: intel: Add Lenovo IdeaPad Z570 to probe denylist (Maxim Mikityanskiy)
  - ALSA: hda: intel: Fix Optimus when GPU has no sound (Maxim Mikityanskiy)
  - ASoC: amd: ps: use macro for ACP6.3 pci revision id (Vijendar Mukunda)
  - HID: pidff: Fix null pointer dereference in pidff_find_fields (Tomasz Pakuła)
  - HID: pidff: Add PERIODIC_SINE_ONLY quirk (Tomasz Pakuła)
  - HID: Add hid-universal-pidff driver and supported device ids (Tomasz Pakuła)
  - HID: pidff: Add FIX_WHEEL_DIRECTION quirk (Tomasz Pakuła)
  - HID: pidff: Add hid_pidff_init_with_quirks and export as GPL symbol (Tomasz Pakuła)
  - HID: pidff: Add PERMISSIVE_CONTROL quirk (Tomasz Pakuła)
  - HID: pidff: Add MISSING_PBO quirk and its detection (Tomasz Pakuła)
  - HID: pidff: Add MISSING_DELAY quirk and its detection (Tomasz Pakuła)
  - HID: pidff: Do not send effect envelope if it's empty (Tomasz Pakuła)
  - HID: pidff: Convert infinite length from Linux API to PID standard (Tomasz Pakuła)
  - ASoC: SOF: topology: Use krealloc_array() to replace krealloc() (Zhang Heng)
  - platform/chrome: cros_ec_lpc: Match on Framework ACPI device (Daniel Schaefer)
  - zstd: Increase DYNAMIC_BMI2 GCC version cutoff from 4.8 to 11.0 to work around compiler segfault (Ingo Molnar)
  - xen/mcelog: Add __nonstring annotations for unterminated strings (Kees Cook)
  - arm64: cputype: Add QCOM_CPU_PART_KRYO_3XX_GOLD (Douglas Anderson)
  - Flush console log from kernel_power_off() (Paul E. McKenney)
  - PM: hibernate: Avoid deadlock in hibernate_compressor_param_set() (Lizhi Xu)
  - perf/dwc_pcie: fix some unreleased resources (Yunhui Cui)
  - perf: arm_pmu: Don't disable counter in armpmu_add() (Mark Rutland)
  - x86/cpu: Don't clear X86_FEATURE_LAHF_LM flag in init_amd_k8() on AMD when running in a virtual machine (Max Grobecker)
  - x86/ia32: Leave NULL selector values 0~3 unchanged (Xin Li (Intel))
  - x86/percpu: Disable named address spaces for UBSAN_BOOL with KASAN for GCC < 14.2 (Uros Bizjak)
  - x86/mm: Clear _PAGE_DIRTY for kernel mappings when we clear _PAGE_RW (Matthew Wilcox (Oracle))
  - pm: cpupower: bench: Prevent NULL dereference on malloc failure (Zhongqiu Han)
  - umount: Allow superblock owners to force umount (Trond Myklebust)
  - fs: consistently deref the files table with rcu_dereference_raw() (Mateusz Guzik)
  - iommu/mediatek: Fix NULL pointer deference in mtk_iommu_device_group (Louis-Alexis Eyraud)
  - iommu/exynos: Fix suspend/resume with IDENTITY domain (Marek Szyprowski)
  - nft_set_pipapo: fix incorrect avx2 match of 5th field octet (Florian Westphal)
  - net: ppp: Add bound checking for skb data on ppp_sync_txmung (Arnaud Lecomte)
  - ipv6: Align behavior across nexthops during path selection (Ido Schimmel)
  - net: phy: allow MDIO bus PM ops to start/stop state machine for phylink-controlled PHY (Vladimir Oltean)
  - net: phy: move phy_link_change() prior to mdio_bus_phy_may_suspend() (Vladimir Oltean)
  - smb: client: fix UAF in decryption with multichannel (Paulo Alcantara)
  - net_sched: sch_sfq: move the limit validation (Octavian Purdila)
  - net_sched: sch_sfq: use a temporary work area for validating configuration (Octavian Purdila)
  - nvmet-fcloop: swap list_add_tail arguments (Daniel Wagner)
  - drm/i915/huc: Fix fence not released on early probe errors (Janusz Krzysztofik)
  - ata: sata_sx4: Add error handling in pdc20621_i2c_read() (Wentao Liang)
  - net: libwx: handle page_pool_dev_alloc_pages error (Chenyuan Yang)
  - drm/tests: probe-helper: Fix drm_display_mode memory leak (Maxime Ripard)
  - drm/tests: modes: Fix drm_display_mode memory leak (Maxime Ripard)
  - drm/tests: cmdline: Fix drm_display_mode memory leak (Maxime Ripard)
  - drm/tests: helpers: Create kunit helper to destroy a drm_display_mode (Maxime Ripard)
  - drm/tests: modeset: Fix drm_display_mode memory leak (Maxime Ripard)
  - net: ethtool: Don't call .cleanup_data when prepare_data fails (Maxime Chevallier)
  - tc: Ensure we have enough buffer space when sending filter netlink notifications (Toke Høiland-Jørgensen)
  - octeontx2-pf: qos: fix VF root node parent queue index (Hariprasad Kelam)
  - net: tls: explicitly disallow disconnect (Jakub Kicinski)
  - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Cong Wang)
  - tipc: fix memory leak in tipc_link_xmit (Tung Nguyen)
  - objtool: Fix INSN_CONTEXT_SWITCH handling in validate_unret() (Josh Poimboeuf)
  - ata: pata_pxa: Fix potential NULL pointer dereference in pxa_ata_probe() (Henry Martin)
  - drm/xe/hw_engine: define sysfs_ops on all directories (Tejas Upadhyay)
  - x86/acpi: Don't limit CPUs to 1 for Xen PV guests due to disabled ACPI (Petr Vaněk)
  - drm/i915: Disable RPG during live selftest (Badal Nilawar)
  - ublk: fix handling recovery & reissue in ublk_abort_queue() (Ming Lei)
  - ublk: refactor recovery configuration flag helpers (Uday Shankar)
  - selftests/futex: futex_waitv wouldblock test should fail (Edward Liaw)
  - gpiolib: of: Fix the choice for Ingenic NAND quirk (Andy Shevchenko)
  - cgroup/cpuset: Further optimize code if CONFIG_CPUSETS_V1 not set (Waiman Long)
  - cgroup/cpuset: Enforce at most one rebuild_sched_domains_locked() call per operation (Waiman Long)
  - cgroup/cpuset: Revert "Allow suppression of sched domain rebuild in update_cpumasks_hier()" (Waiman Long)
  - cgroup/cpuset: Fix error handling in remote_partition_disable() (Waiman Long)
  - cgroup/cpuset: Fix incorrect isolated_cpus update in update_parent_effective_cpumask() (Waiman Long)
  - ASoC: Intel: adl: add 2xrt1316 audio configuration (Bard Liao)


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-2.27.2.el9uek]
changelog:
  - LTS version: v6.12.27 (Jack Vogel)
  - bpf: Fix BPF_INTERNAL namespace import (Xi Ruoyao)
  - LTS version: v6.12.26 (Jack Vogel)
  - mq-deadline: don't call req_get_ioprio from the I/O completion handler (Christoph Hellwig)
  - arm64: dts: ti: k3-j784s4-j742s2-main-common: Correct the GICD size (Keerthy)
  - crypto: Kconfig - Select LIB generic option (Herbert Xu)
  - usb: typec: class: Unlocked on error in typec_register_partner() (Dan Carpenter)
  - objtool: Silence more KCOV warnings, part 2 (Josh Poimboeuf)
  - objtool: Ignore end-of-section jumps for KCOV/GCOV (Josh Poimboeuf)
  - usb: xhci: Fix Short Packet handling rework ignoring errors (Michal Pecio)
  - nvme: fixup scan failure for non-ANA multipath controllers (Hannes Reinecke)
  - MIPS: cm: Fix warning if MIPS_CM is disabled (Thomas Bogendoerfer)
  - media: i2c: imx214: Fix uninitialized variable in imx214_set_ctrl() (Dan Carpenter)
  - crypto: lib/Kconfig - Hide arch options from user (Herbert Xu)
  - iommu: Handle race with default domain setup (Robin Murphy)
  - net: dsa: mv88e6xxx: enable STU methods for 6320 family (Marek Behún)
  - net: dsa: mv88e6xxx: enable .port_set_policy() for 6320 family (Marek Behún)
  - net: dsa: mv88e6xxx: enable PVT for 6321 switch (Marek Behún)
  - net: dsa: mv88e6xxx: fix atu_move_port_mask for 6341 family (Marek Behún)
  - Revert "net: dsa: mv88e6xxx: fix internal PHYs for 6320 family" (Marek Behún)
  - usb: typec: class: Invalidate USB device pointers on partner unregistration (Andrei Kuchynski)
  - ext4: goto right label 'out_mmap_sem' in ext4_setattr() (Baokun Li)
  - comedi: jr3_pci: Fix synchronous deletion of timer (Ian Abbott)
  - vmxnet3: Fix malformed packet sizing in vmxnet3_process_xdp (Daniel Borkmann)
  - usb: typec: class: Fix NULL pointer access (Andrei Kuchynski)
  - selftests/bpf: Adjust data size to have ETH_HLEN (Shigeru Yoshida)
  - selftests/bpf: check program redirect in xdp_cpumap_attach (Alexis Lothoré (eBPF Foundation))
  - selftests/bpf: make xdp_cpumap_attach keep redirect prog attached (Alexis Lothoré (eBPF Foundation))
  - selftests/bpf: fix bpf_map_redirect call for cpu map test (Alexis Lothoré (eBPF Foundation))
  - xfs: flush inodegc before swapon (Christoph Hellwig)
  - xfs: rename xfs_iomap_swapfile_activate to xfs_vm_swap_activate (Christoph Hellwig)
  - xfs: Do not allow norecovery mount with quotacheck (Carlos Maiolino)
  - xfs: do not check NEEDSREPAIR if ro,norecovery mount. (Lukas Herbolt)
  - driver core: fix potential NULL pointer dereference in dev_uevent() (Dmitry Torokhov)
  - driver core: introduce device_set_driver() helper (Dmitry Torokhov)
  - Revert "drivers: core: synchronize really_probe() and dev_uevent()" (Dmitry Torokhov)
  - spi: spi-imx: Add check for spi_imx_setupxfer() (Tamura Dai)
  - drm/amdgpu: Use the right function for hdp flush (Lijo Lazar)
  - drm/amdgpu: use a dummy owner for sysfs triggered cleaner shaders v4 (Christian König)
  - md/raid1: Add check for missing source disk in process_checks() (Meir Elisha)
  - x86/cpu: Add CPU model number for Bartlett Lake CPUs with Raptor Cove cores (Pi Xiange)
  - ubsan: Fix panic from test_ubsan_out_of_bounds (Mostafa Saleh)
  - spi: tegra210-quad: add rate limiting and simplify timeout error message (Breno Leitao)
  - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Breno Leitao)
  - ksmbd: fix WARNING "do not call blocking ops when !TASK_RUNNING" (Namjae Jeon)
  - riscv: Provide all alternative macros all the time (Andrew Jones)
  - iomap: skip unnecessary ifs_block_is_uptodate check (Gou Hao)
  - netfs: Only create /proc/fs/netfs with CONFIG_PROC_FS (Song Liu)
  - x86/i8253: Call clockevent_i8253_disable() with interrupts disabled (Fernando Fernandez Mancera)
  - ASoC: fsl_asrc_dma: get codec or cpu dai from backend (Shengjiu Wang)
  - scsi: pm80xx: Set phy_attached to zero when device is gone (Igor Pylypiv)
  - scsi: ufs: exynos: gs101: Put UFS device in reset on .suspend() (Peter Griffin)
  - scsi: ufs: exynos: Move phy calls to .exit() callback (Peter Griffin)
  - scsi: ufs: exynos: Enable PRDT pre-fetching with UFSHCD_CAP_CRYPTO (Peter Griffin)
  - scsi: ufs: exynos: Ensure pre_link() executes before exynos_ufs_phy_init() (Peter Griffin)
  - scsi: hisi_sas: Fix I/O errors caused by hardware port ID changes (Xingui Yang)
  - ext4: make block validity check resistent to sb bh corruption (Ojaswin Mujoo)
  - iommu: Clear iommu-dma ops on cleanup (Robin Murphy)
  - cifs: Fix querying of WSL CHR and BLK reparse points over SMB1 (Pali Rohár)
  - timekeeping: Add a lockdep override in tick_freeze() (Sebastian Andrzej Siewior)
  - cifs: Fix encoding of SMB1 Session Setup Kerberos Request in non-UNICODE mode (Pali Rohár)
  - nvmet-fc: put ref when assoc->del_work is already scheduled (Daniel Wagner)
  - nvmet-fc: take tgtport reference only once (Daniel Wagner)
  - x86/bugs: Don't fill RSB on context switch with eIBRS (Josh Poimboeuf)
  - x86/bugs: Don't fill RSB on VMEXIT with eIBRS+retpoline (Josh Poimboeuf)
  - x86/bugs: Use SBPB in write_ibpb() if applicable (Josh Poimboeuf)
  - selftests/mincore: Allow read-ahead pages to reach the end of the file (Qiuxu Zhuo)
  - x86/xen: disable CPU idle and frequency drivers for PVH dom0 (Roger Pau Monne)
  - gpiolib: of: Move Atmel HSMCI quirk up out of the regulator comment (Andy Shevchenko)
  - objtool: Stop UNRET validation on UD2 (Josh Poimboeuf)
  - nvme: multipath: fix return value of nvme_available_path (Uday Shankar)
  - nvme: re-read ANA log page after ns scan completes (Hannes Reinecke)
  - drm/xe/xe3lpg: Apply Wa_14022293748, Wa_22019794406 (Julia Filipchuk)
  - drm/amdgpu: Increase KIQ invalidate_tlbs timeout (Jay Cornwall)
  - ACPI PPTT: Fix coding mistakes in a couple of sizeof() calls (Jean-Marc Eurin)
  - ACPI: EC: Set ec_no_wakeup for Lenovo Go S (Mario Limonciello)
  - nvme: requeue namespace scan on missed AENs (Hannes Reinecke)
  - xen: Change xen-acpi-processor dom0 dependency (Jason Andryuk)
  - perf/core: Fix WARN_ON(!ctx) in __free_event() for partial init (Gabriel Shahrouzi)
  - selftests: ublk: fix test_stripe_04 (Ming Lei)
  - cgroup/cpuset: Don't allow creation of local partition over a remote one (Waiman Long)
  - KVM: s390: Don't use %pK through debug printing (Thomas Weißschuh)
  - KVM: s390: Don't use %pK through tracepoints (Thomas Weißschuh)
  - sched/isolation: Make CONFIG_CPU_ISOLATION depend on CONFIG_SMP (Oleg Nesterov)
  - kbuild: add dependency from vmlinux to sorttable (Xi Ruoyao)
  - io_uring: always do atomic put from iowq (Pavel Begunkov)
  - rtc: pcf85063: do a SW reset if POR failed (Lukas Stockmann)
  - 9p/trans_fd: mark concurrent read and writes to p9_conn->err (Ignacio Encinas)
  - 9p/net: fix improper handling of bogus negative read/write replies (Dominique Martinet)
  - ntb_hw_amd: Add NTB PCI ID for new gen CPU (Basavaraj Natikar)
  - ntb: reduce stack usage in idt_scan_mws (Arnd Bergmann)
  - qibfs: fix _another_ leak (Al Viro)
  - objtool, lkdtm: Obfuscate the do_nothing() pointer (Josh Poimboeuf)
  - objtool, regulator: rk808: Remove potential undefined behavior in rk806_set_mode_dcdc() (Josh Poimboeuf)
  - objtool, ASoC: codecs: wcd934x: Remove potential undefined behavior in wcd934x_slim_irq_handler() (Josh Poimboeuf)
  - objtool, panic: Disable SMAP in __stack_chk_fail() (Josh Poimboeuf)
  - objtool: Silence more KCOV warnings (Josh Poimboeuf)
  - um: work around sched_yield not yielding in time-travel mode (Benjamin Berg)
  - thunderbolt: Scan retimers after device router has been enumerated (Mika Westerberg)
  - usb: host: xhci-plat: mvebu: use ->quirks instead of ->init_quirk() func (Théo Lebrun)
  - usb: gadget: aspeed: Add NULL pointer check in ast_vhub_init_dev() (Chenyuan Yang)
  - phy: rockchip: usbdp: Avoid call hpd_event_trigger in dp_phy_init (Andy Yan)
  - usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running (Michal Pecio)
  - dmaengine: dmatest: Fix dmatest waiting less when interrupted (Vinicius Costa Gomes)
  - i3c: master: svc: Add support for Nuvoton npcm845 i3c (Stanley Chu)
  - xhci: Handle spurious events on Etron host isoc enpoints (Mathias Nyman)
  - usb: xhci: Fix isochronous Ring Underrun/Overrun event handling (Michal Pecio)
  - usb: xhci: Complete 'error mid TD' transfers when handling Missed Service (Michal Pecio)
  - sound/virtio: Fix cancel_sync warnings on uninitialized work_structs (John Stultz)
  - usb: dwc3: gadget: Avoid using reserved endpoints on Intel Merrifield (Andy Shevchenko)
  - usb: dwc3: gadget: Refactor loop to avoid NULL endpoints (Andy Shevchenko)
  - fs/ntfs3: Fix WARNING in ntfs_extend_initialized_size (Edward Adam Davis)
  - fs/ntfs3: Keep write operations atomic (Lizhi Xu)
  - usb: host: max3421-hcd: Add missing spi_device_id table (Alexander Stein)
  - mailbox: pcc: Always clear the platform ack interrupt first (Sudeep Holla)
  - mailbox: pcc: Fix the possible race in updation of chan_in_use flag (Huisong Li)
  - bpf: Reject attaching fexit/fmod_ret to __noreturn functions (Yafang Shao)
  - bpf: Only fails the busy counter check in bpf_cgrp_storage_get if it creates storage (Martin KaFai Lau)
  - bpf: bpftool: Setting error code in do_loader() (Sewon Nam)
  - s390/tty: Fix a potential memory leak bug (Haoxiang Li)
  - s390/sclp: Add check for get_zeroed_page() (Haoxiang Li)
  - parisc: PDT: Fix missing prototype warning (Yu-Chun Lin)
  - clk: check for disabled clock-provider in of_clk_get_hw_from_clkspec() (Heiko Stuebner)
  - bpf: Fix deadlock between rcu_tasks_trace and event_mutex. (Alexei Starovoitov)
  - bpf: Fix kmemleak warning for percpu hashmap (Yonghong Song)
  - crypto: null - Use spin lock instead of mutex (Herbert Xu)
  - crypto: lib/Kconfig - Fix lib built-in failure when arch is modular (Herbert Xu)
  - crypto: ccp - Add support for PCI device 0x1134 (Devaraj Rangasamy)
  - MIPS: cm: Detect CM quirks from device tree (Gregory CLEMENT)
  - pinctrl: mcp23s08: Get rid of spurious level interrupts (Dmitry Mastykin)
  - pinctrl: renesas: rza2: Fix potential NULL pointer dereference (Chenyuan Yang)
  - selftests/bpf: Fix stdout race condition in traffic monitor (Amery Hung)
  - USB: wdm: add annotation (Oliver Neukum)
  - USB: wdm: wdm_wwan_port_tx_complete mutex in atomic context (Oliver Neukum)
  - USB: wdm: close race between wdm_open and wdm_wwan_port_stop (Oliver Neukum)
  - USB: wdm: handle IO errors in wdm_wwan_port_start (Oliver Neukum)
  - USB: VLI disk crashes if LPM is used (Oliver Neukum)
  - usb: quirks: Add delay init quirk for SanDisk 3.2Gen1 Flash Drive (Miao Li)
  - usb: quirks: add DELAY_INIT quirk for Silicon Motion Flash Drive (Miao Li)
  - usb: dwc3: xilinx: Prevent spike in reset signal (Mike Looijmans)
  - usb: dwc3: gadget: check that event count does not exceed event buffer length (Frode Isaksen)
  - USB: OHCI: Add quirk for LS7A OHCI controller (rev 0x02) (Huacai Chen)
  - usb: chipidea: ci_hdrc_imx: implement usb_phy_init() error handling (Fedor Pchelkin)
  - usb: chipidea: ci_hdrc_imx: fix call balance of regulator routines (Fedor Pchelkin)
  - usb: chipidea: ci_hdrc_imx: fix usbmisc handling (Fedor Pchelkin)
  - usb: cdns3: Fix deadlock when using NCM gadget (Ralph Siemsen)
  - usb: xhci: Fix invalid pointer dereference in Etron workaround (Michal Pecio)
  - xhci: Limit time spent with xHC interrupts disabled during bus resume (Mathias Nyman)
  - USB: serial: simple: add OWON HDS200 series oscilloscope support (Craig Hesling)
  - USB: serial: option: add Sierra Wireless EM9291 (Adam Xue)
  - USB: serial: ftdi_sio: add support for Abacus Electrics Optical Probe (Michael Ehrenreich)
  - serial: sifive: lock port in startup()/shutdown() callbacks (Ryo Takakura)
  - serial: msm: Configure correct working mode before starting earlycon (Stephan Gerhold)
  - tty: Require CAP_SYS_ADMIN for all usages of TIOCL_SELMOUSEREPORT (Günther Noack)
  - firmware: stratix10-svc: Add of_platform_default_populate() (Mahesh Rao)
  - misc: microchip: pci1xxxx: Fix incorrect IRQ status handling during ack (Rengarajan S)
  - misc: microchip: pci1xxxx: Fix Kernel panic during IRQ handler registration (Rengarajan S)
  - char: misc: register chrdev region with all possible minors (Thadeu Lima de Souza Cascardo)
  - KVM: x86: Take irqfds.lock when adding/deleting IRQ bypass producer (Sean Christopherson)
  - KVM: x86: Reset IRTE to host control if *new* route isn't postable (Sean Christopherson)
  - KVM: x86: Explicitly treat routing entry type changes as changes (Sean Christopherson)
  - mei: vsc: Fix fortify-panic caused by invalid counted_by() use (Hans de Goede)
  - mei: me: add panther lake H DID (Alexander Usyskin)
  - scsi: Improve CDL control (Damien Le Moal)
  - USB: storage: quirk for ADATA Portable HDD CH94 (Oliver Neukum)
  - ata: libata-scsi: Fix ata_msense_control_ata_feature() (Damien Le Moal)
  - ata: libata-scsi: Fix ata_mselect_control_ata_feature() return type (Damien Le Moal)
  - ata: libata-scsi: Improve CDL control (Damien Le Moal)
  - mcb: fix a double free bug in chameleon_parse_gdd() (Haoxiang Li)
  - cxl/core/regs.c: Skip Memory Space Enable check for RCD and RCH Ports (Smita Koralahalli)
  - KVM: SVM: Allocate IR data using atomic allocation (Sean Christopherson)
  - io_uring: fix 'sync' handling of io_fallback_tw() (Jens Axboe)
  - LoongArch: KVM: Fix PMU pass-through issue if VM exits to host finally (Bibo Mao)
  - LoongArch: KVM: Fully clear some CSRs when VM reboot (Bibo Mao)
  - LoongArch: Remove a bogus reference to ZONE_DMA (Petr Tesarik)
  - LoongArch: Return NULL from huge_pte_offset() for invalid PMD (Ming Wang)
  - LoongArch: Handle fp, lsx, lasx and lbt assembly symbols (Tiezhu Yang)
  - irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode() (Suzuki K Poulose)
  - x86/insn: Fix CTEST instruction decoding (Kirill A. Shutemov)
  - drm/amd/display: Force full update in gpu reset (Roman Li)
  - drm/amd/display: Fix gpu reset in multidisplay config (Roman Li)
  - drm: panel: jd9365da: fix reset signal polarity in unprepare (Hugo Villeneuve)
  - rust: firmware: Use `ffi::c_char` type in `FwFunc` (Christian Schrefl)
  - net: phy: microchip: force IRQ polling mode for lan88xx (Fiona Klute)
  - net: selftests: initialize TCP header and skb payload with zero (Oleksij Rempel)
  - xen-netfront: handle NULL returned by xdp_convert_buff_to_frame() (Alexey Nepomnyashih)
  - crypto: atmel-sha204a - Set hwrng quality to lowest possible (Marek Behún)
  - sched_ext: Use kvzalloc for large exit_dump allocation (Breno Leitao)
  - virtio_console: fix missing byte order handling for cols and rows (Halil Pasic)
  - netfilter: fib: avoid lookup if socket is available (Florian Westphal)
  - LoongArch: Make do_xyz() exception handlers more robust (Tiezhu Yang)
  - LoongArch: Make regs_irqs_disabled() more clear (Tiezhu Yang)
  - LoongArch: Select ARCH_USE_MEMTEST (Yuli Wang)
  - perf/x86: Fix non-sampling (counting) events on certain x86 platforms (Luo Gengkun)
  - bpf: Add namespace to BPF internal symbols (Alexei Starovoitov)
  - splice: remove duplicate noinline from pipe_clear_nowait (T.J. Mercier)
  - riscv: uprobes: Add missing fence.i after building the XOL buffer (Björn Töpel)
  - riscv: Replace function-like macro by static inline function (Björn Töpel)
  - iommu/amd: Return an error if vCPU affinity is set for non-vCPU IRTE (Sean Christopherson)
  - block: never reduce ra_pages in blk_apply_bdi_limits (Christoph Hellwig)
  - pds_core: make wait_context part of q_info (Shannon Nelson)
  - pds_core: Remove unnecessary check in pds_client_adminq_cmd() (Brett Creeley)
  - pds_core: handle unsupported PDS_CORE_CMD_FW_CONTROL result (Brett Creeley)
  - pds_core: Prevent possible adminq overflow/stuck condition (Brett Creeley)
  - net: dsa: mt7530: sync driver-specific behavior of MT7531 variants (Daniel Golle)
  - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (Cong Wang)
  - net_sched: hfsc: Fix a UAF vulnerability in class handling (Cong Wang)
  - fix a couple of races in MNT_TREE_BENEATH handling by do_move_mount() (Al Viro)
  - net: ethernet: mtk_eth_soc: net: revise NETSYSv3 hardware configuration (Bo-Cun Chen)
  - tipc: fix NULL pointer dereference in tipc_mon_reinit_self() (Tung Nguyen)
  - net: phy: leds: fix memory leak (Qingfang Deng)
  - net: lwtunnel: disable BHs when required (Justin Iurman)
  - scsi: ufs: core: Add NULL check in ufshcd_mcq_compl_pending_transfer() (Chenyuan Yang)
  - scsi: core: Clear flags for scsi_cmnd that did not complete (Anastasia Kovaleva)
  - net/mlx5: Move ttc allocation after switch case to prevent leaks (Henry Martin)
  - net/mlx5: Fix null-ptr-deref in mlx5_create_{inner_,}ttc_table() (Henry Martin)
  - cgroup/cpuset-v1: Add missing support for cpuset_v2_mode (T.J. Mercier)
  - btrfs: zoned: return EIO on RAID1 block group write pointer mismatch (Johannes Thumshirn)
  - btrfs: avoid page_lockend underflow in btrfs_punch_hole_lock_range() (Qu Wenruo)
  - cpufreq: fix compile-test defaults (Johan Hovold)
  - cpufreq: Do not enable by default during compile testing (Krzysztof Kozlowski)
  - cpufreq: cppc: Fix invalid return value in .get() callback (Marc Zyngier)
  - scsi: ufs: mcq: Add NULL check in ufshcd_mcq_abort() (Chenyuan Yang)
  - cpufreq: scpi: Fix null-ptr-deref in scpi_cpufreq_get_rate() (Henry Martin)
  - cpufreq: scmi: Fix null-ptr-deref in scmi_cpufreq_get_rate() (Henry Martin)
  - cpufreq: apple-soc: Fix null-ptr-deref in apple_soc_cpufreq_get_rate() (Henry Martin)
  - dma/contiguous: avoid warning about unused size_bytes (Arnd Bergmann)
  - cpufreq: sun50i: prevent out-of-bounds access (Andre Przywara)
  - ceph: Fix incorrect flush end position calculation (David Howells)
  - lib/Kconfig.ubsan: Remove 'default UBSAN' from UBSAN_INTEGER_WRAP (Nathan Chancellor)
  - drm/amd/display/dml2: use vzalloc rather than kzalloc (Alex Deucher)
  - drm/amd/display: Fix unnecessary cast warnings from checkpatch (Rohit Chavan)
  - drm/xe/bmg: Add one additional PCI ID (Matt Roper)
  - net/niu: Niu requires MSIX ENTRY_DATA fields touch before entry reads (Jonathan Currier)
  - scsi: ufs: exynos: Disable iocc if dma-coherent property isn't set (Peter Griffin)
  - scsi: ufs: exynos: Move UFS shareability value to drvdata (Peter Griffin)
  - scsi: ufs: exynos: Add gs101_ufs_drv_init() hook and enable WriteBooster (Peter Griffin)
  - scsi: ufs: exynos: Remove superfluous function parameter (Tudor Ambarus)
  - scsi: ufs: exynos: Remove empty drv_init method (Tudor Ambarus)
  - ksmbd: fix use-after-free in __smb2_lease_break_noti() (Namjae Jeon)
  - ksmbd: browse interfaces list on FSCTL_QUERY_INTERFACE_INFO IOCTL (Namjae Jeon)
  - ksmbd: add netdev-up/down event debug print (Namjae Jeon)
  - ksmbd: use __GFP_RETRY_MAYFAIL (Namjae Jeon)
  - accel/ivpu: Fix the NPU's DPU frequency calculation (Andrzej Kacprowski)
  - accel/ivpu: Add auto selection logic for job scheduler (Jacek Lawrynowicz)
  - PCI/MSI: Add an option to write MSIX ENTRY_DATA before any reads (Jonathan Currier)
  - PCI/MSI: Handle the NOMASK flag correctly for all PCI/MSI backends (Thomas Gleixner)
  - PCI/MSI: Convert pci_msi_ignore_mask to per MSI domain flag (Roger Pau Monne)
  - scsi: ufs: qcom: fix dev reference leaked through of_qcom_ice_get (Tudor Ambarus)
  - of: resolver: Fix device node refcount leakage in of_resolve_phandles() (Zijun Hu)
  - of: resolver: Simplify of_resolve_phandles() using __free() (Rob Herring (Arm))
  - arm64: dts: ti: k3-j784s4-j742s2-main-common: Fix serdes_ln_ctrl reg-masks (Siddharth Vadapalli)
  - arm64: dts: ti: Refactor J784s4 SoC files to a common file (Manorit Chawdhry)
  - iio: adc: ad7768-1: Fix conversion result sign (Sergiu Cuciurean)
  - iio: adc: ad7768-1: Move setting of val a bit later to avoid unnecessary return value check (Jonathan Cameron)
  - net: dsa: mv88e6xxx: fix VTU methods for 6320 family (Marek Behún)
  - media: ov08x40: Add missing ov08x40_identify_module() call on stream-start (Hans de Goede)
  - media: ov08x40: Move ov08x40_identify_module() function up (Hans de Goede)
  - media: i2c: imx214: Fix link frequency validation (André Apitzsch)
  - media: i2c: imx214: Check number of lanes from device tree (André Apitzsch)
  - media: i2c: imx214: Replace register addresses with macros (André Apitzsch)
  - media: i2c: imx214: Convert to CCI register access helpers (André Apitzsch)
  - media: i2c: imx214: Simplify with dev_err_probe() (André Apitzsch)
  - media: i2c: imx214: Use subdev active state (André Apitzsch)
  - PM: EM: Address RCU-related sparse warnings (Rafael J. Wysocki)
  - PM: EM: use kfree_rcu() to simplify the code (Li RongQing)
  - mmc: sdhci-msm: fix dev reference leaked through of_qcom_ice_get (Tudor Ambarus)
  - soc: qcom: ice: introduce devm_of_qcom_ice_get (Tudor Ambarus)
  - mm/vmscan: don't try to reclaim hwpoison folio (Jinjiang Tu)
  - tracing: Verify event formats that have "%*p.." (Steven Rostedt)
  - tracing: Add __print_dynamic_array() helper (Steven Rostedt)
  - module: sign with sha512 instead of sha1 by default (Thorsten Leemhuis)
  - LTS version: v6.12.25 (Jack Vogel)
  - selftests/bpf: extend changes_pkt_data with cases w/o subprograms (Eduard Zingerman)
  - bpf: fix null dereference when computing changes_pkt_data of prog w/o subprogs (Eduard Zingerman)
  - selftests/bpf: validate that tail call invalidates packet pointers (Eduard Zingerman)
  - selftests/bpf: freplace tests for tracking of changes_packet_data (Eduard Zingerman)
  - bpf: check changes_pkt_data property for extension programs (Eduard Zingerman)
  - selftests/bpf: test for changing packet data from global functions (Eduard Zingerman)
  - bpf: track changes_pkt_data property for global functions (Eduard Zingerman)
  - bpf: add find_containing_subprog() utility function (Eduard Zingerman)
  - wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process (P Praneesh)
  - MIPS: ds1287: Match ds1287_set_base_clock() function types (WangYuli)
  - MIPS: cevt-ds1287: Add missing ds1287.h include (WangYuli)
  - MIPS: dec: Declare which_prom() as static (WangYuli)
  - Revert "wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process" (Alexander Tsoy)
  - mm/vma: add give_up_on_oom option on modify/merge, use in uffd release (Lorenzo Stoakes)
  - nvmet-fc: Remove unused functions (WangYuli)
  - drm/amd/display: Temporarily disable hostvm on DCN31 (Aurabindo Pillai)
  - LoongArch: Eliminate superfluous get_numa_distances_cnt() (Yuli Wang)
  - efi/libstub: Bump up EFI_MMAP_NR_SLACK_SLOTS to 32 (Hamza Mahfooz)
  - misc: pci_endpoint_test: Fix 'irq_type' to convey the correct type (Kunihiko Hayashi)
  - misc: pci_endpoint_test: Avoid issue of interrupts remaining after request_irq error (Kunihiko Hayashi)
  - selftests/bpf: Fix raw_tp null handling test (Shung-Hsi Yu)
  - md: fix mddev uaf while iterating all_mddevs list (Yu Kuai)
  - platform/x86: msi-wmi-platform: Workaround a ACPI firmware bug (Armin Wolf)
  - platform/x86: msi-wmi-platform: Rename "data" variable (Armin Wolf)
  - kbuild: Add '-fno-builtin-wcslen' (Nathan Chancellor)
  - scripts: generate_rust_analyzer: Add ffi crate (Lukas Fischer)
  - cpufreq: Reference count policy in cpufreq_update_limits() (Rafael J. Wysocki)
  - arm64/boot: Enable EL2 requirements for FEAT_PMUv3p9 (Anshuman Khandual)
  - arm64/sysreg: Add register fields for HFGWTR2_EL2 (Anshuman Khandual)
  - arm64/sysreg: Add register fields for HFGRTR2_EL2 (Anshuman Khandual)
  - arm64/sysreg: Add register fields for HFGITR2_EL2 (Anshuman Khandual)
  - arm64/sysreg: Add register fields for HDFGWTR2_EL2 (Anshuman Khandual)
  - arm64/sysreg: Add register fields for HDFGRTR2_EL2 (Anshuman Khandual)
  - arm64/sysreg: Update register fields for ID_AA64MMFR0_EL1 (Anshuman Khandual)
  - drm/mgag200: Fix value in <VBLKSTR> register (Thomas Zimmermann)
  - drm/amdgpu: fix warning of drm_mm_clean (ZhenGuo Yin)
  - drm/xe: Set LRC addresses before guc load (Lucas De Marchi)
  - drm/xe/userptr: fix notifier vs folio deadlock (Matthew Auld)
  - drm/xe/dma_buf: stop relying on placement in unmap (Matthew Auld)
  - drm/amd/display: Add HP Probook 445 and 465 to the quirk list for eDP on DP1 (Mario Limonciello)
  - drm/amd/display: Protect FPU in dml2_init()/dml21_init() (Huacai Chen)
  - drm/amd/display: Do not enable Replay and PSR while VRR is on in amdgpu_dm_commit_planes() (Tom Chung)
  - drm/amdgpu: immediately use GTT for new allocations (Christian König)
  - drm/i915/gvt: fix unterminated-string-initialization warning (Jani Nikula)
  - drm/xe: Fix an out-of-bounds shift when invalidating TLB (Thomas Hellström)
  - drm/sti: remove duplicate object names (Rolf Eike Beer)
  - drm/imagination: take paired job reference (Brendan King)
  - drm/imagination: fix firmware memory leaks (Brendan King)
  - drm/nouveau: prime: fix ttm_bo_delayed_delete oops (Chris Bainbridge)
  - drm/amdgpu/dma_buf: fix page_link check (Matthew Auld)
  - drm/amdgpu/mes11: optimize MES pipe FW version fetching (Alex Deucher)
  - drm/amd/display: Protect FPU in dml21_copy() (Huacai Chen)
  - drm/amd/display: Protect FPU in dml2_validate()/dml21_validate() (Huacai Chen)
  - drm/amd/display: Add HP Elitebook 645 to the quirk list for eDP on DP1 (Mario Limonciello)
  - drm/xe: Use local fence in error path of xe_migrate_clear (Matthew Brost)
  - drm/i915/vrr: Add vrr.vsync_{start, end} in vrr_params_changed (Ankit Nautiyal)
  - drm/amdgpu/mes12: optimize MES pipe FW version fetching (Alex Deucher)
  - drm/amd/pm/powerplay/hwmgr/vega20_thermal: Prevent division by zero (Denis Arefev)
  - drm/amd/pm/swsmu/smu13/smu_v13_0: Prevent division by zero (Denis Arefev)
  - drm/amd/pm/powerplay/hwmgr/smu7_thermal: Prevent division by zero (Denis Arefev)
  - drm/amd/pm/smu11: Prevent division by zero (Denis Arefev)
  - drm/amd/pm/powerplay: Prevent division by zero (Denis Arefev)
  - drm/amd/pm: Prevent division by zero (Denis Arefev)
  - drm/amd/display: Increase vblank offdelay for PSR panels (Leo Li)
  - drm/amd/display: Actually do immediate vblank disable (Leo Li)
  - drm/amd: Handle being compiled without SI or CIK support better (Mario Limonciello)
  - drm/amd/display: prevent hang on link training fail (Brendan Tam)
  - drm/amdgpu: Prefer shadow rom when available (Lijo Lazar)
  - drm/msm/a6xx: Fix stale rpmh votes from GPU (Akhil P Oommen)
  - drm/msm/dsi: Add check for devm_kstrdup() (Haoxiang Li)
  - drm/ast: Fix ast_dp connection status (Jocelyn Falempe)
  - drm/repaper: fix integer overflows in repeat functions (Nikita Zhandarovich)
  - perf/x86/intel/uncore: Fix the scale of IIO free running counters on SPR (Kan Liang)
  - perf/x86/intel/uncore: Fix the scale of IIO free running counters on ICX (Kan Liang)
  - perf/x86/intel/uncore: Fix the scale of IIO free running counters on SNR (Kan Liang)
  - perf/x86/intel: Allow to update user space GPRs from PEBS records (Dapeng Mi)
  - platform/x86: amd: pmf: Fix STT limits (Mario Limonciello)
  - RAS/AMD/FMPM: Get masked address (Yazen Ghannam)
  - RAS/AMD/ATL: Include row[13] bit in row retirement (Yazen Ghannam)
  - scsi: ufs: exynos: Ensure consistent phy reference counts (Peter Griffin)
  - scsi: megaraid_sas: Block zero-length ATA VPD inquiry (Chandrakanth Patil)
  - x86/boot/sev: Avoid shared GHCB page for early memory acceptance (Ard Biesheuvel)
  - x86/cpu/amd: Fix workaround for erratum 1054 (Sandipan Das)
  - x86/microcode/AMD: Extend the SHA check to Zen5, block loading of any unreleased standalone Zen5 microcode patches (Borislav Petkov (AMD))
  - virtiofs: add filesystem context source name check (Xiangsheng Hou)
  - tracing: Fix filter string testing (Steven Rostedt)
  - string: Add load_unaligned_zeropad() code path to sized_strscpy() (Peter Collingbourne)
  - smb3 client: fix open hardlink on deferred close file error (Chunjie Zhu)
  - slab: ensure slab->obj_exts is clear in a newly allocated slab page (Suren Baghdasaryan)
  - selftests/mm: generate a temporary mountpoint for cgroup filesystem (Mark Brown)
  - riscv: Avoid fortify warning in syscall_get_arguments() (Nathan Chancellor)
  - Revert "smb: client: fix TCP timers deadlock after rmmod" (Kuniyuki Iwashima)
  - Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free" (Kuniyuki Iwashima)
  - ksmbd: fix the warning from __kernel_write_iter (Namjae Jeon)
  - ksmbd: Prevent integer overflow in calculation of deadtime (Denis Arefev)
  - ksmbd: fix use-after-free in smb_break_all_levII_oplock() (Namjae Jeon)
  - ksmbd: Fix dangling pointer in krb_authenticate (Sean Heelan)
  - ovl: don't allow datadir only (Miklos Szeredi)
  - mm: fix apply_to_existing_page_range() (Kirill A. Shutemov)
  - mm: fix filemap_get_folios_contig returning batches of identical folios (Vishal Moola (Oracle))
  - mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Baoquan He)
  - mm/compaction: fix bug in hugetlb handling pathway (Vishal Moola (Oracle))
  - loop: LOOP_SET_FD: send uevents for partitions (Thomas Weißschuh)
  - loop: properly send KOBJ_CHANGED uevent for disk device (Thomas Weißschuh)
  - isofs: Prevent the use of too small fid (Edward Adam Davis)
  - i2c: cros-ec-tunnel: defer probe if parent EC is not present (Thadeu Lima de Souza Cascardo)
  - hfs/hfsplus: fix slab-out-of-bounds in hfs_bnode_read_key (Vasiliy Kovalev)
  - crypto: caam/qi - Fix drv_ctx refcount bug (Herbert Xu)
  - cpufreq/sched: Explicitly synchronize limits_changed flag handling (Rafael J. Wysocki)
  - btrfs: correctly escape subvol in btrfs_show_options() (Johannes Kimmel)
  - Bluetooth: vhci: Avoid needless snprintf() calls (Kees Cook)
  - Bluetooth: l2cap: Process valid commands in too long frame (Frédéric Danis)
  - drm/msm/a6xx+: Don't let IB_SIZE overflow (Rob Clark)
  - ftrace: fix incorrect hash size in register_ftrace_direct() (Menglong Dong)
  - i2c: atr: Fix wrong include (Andy Shevchenko)
  - nfsd: decrease sc_count directly if fail to queue dl_recall (Li Lingfeng)
  - nfs: add missing selections of CONFIG_CRC32 (Eric Biggers)
  - dma-buf/sw_sync: Decrement refcount on error in sw_sync_ioctl_get_deadline() (Dan Carpenter)
  - drm/v3d: Fix Indirect Dispatch configuration for V3D 7.1.6 and later (Maíra Canal)
  - block: integrity: Do not call set_page_dirty_lock() (Martin K. Petersen)
  - asus-laptop: Fix an uninitialized variable (Denis Arefev)
  - ASoC: qcom: Fix sc7280 lpass potential buffer overflow (Evgeny Pimenov)
  - ASoC: Intel: sof_sdw: Add quirk for Asus Zenbook S16 (Peter Ujfalusi)
  - ASoC: codecs:lpass-wsa-macro: Fix logic of enabling vi channels (Srinivas Kandagatla)
  - ASoC: codecs:lpass-wsa-macro: Fix vi feedback rate (Srinivas Kandagatla)
  - ASoC: fsl: fsl_qmc_audio: Reset audio data pointers on TRIGGER_START event (Herve Codina)
  - Revert "PCI: Avoid reset when disabled via sysfs" (Alex Williamson)
  - writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher)
  - rust: kbuild: use `pound` to support GNU Make < 4.3 (Miguel Ojeda)
  - rust: disable `clippy::needless_continue` (Miguel Ojeda)
  - rust: kasan/kbuild: fix missing flags on first build (Miguel Ojeda)
  - objtool/rust: add one more `noreturn` Rust function for Rust 1.86.0 (Miguel Ojeda)
  - cpufreq/sched: Fix the usage of CPUFREQ_NEED_UPDATE_LIMITS (Rafael J. Wysocki)
  - riscv: KGDB: Remove ".option norvc/.option rvc" for kgdb_compiled_break (WangYuli)
  - riscv: KGDB: Do not inline arch_kgdb_breakpoint() (WangYuli)
  - kunit: qemu_configs: SH: Respect kunit cmdline (Thomas Weißschuh)
  - riscv: module: Allocate PLT entries for R_RISCV_PLT32 (Samuel Holland)
  - riscv: module: Fix out-of-bounds relocation access (Samuel Holland)
  - riscv: Properly export reserved regions in /proc/iomem (Björn Töpel)
  - riscv: Use kvmalloc_array on relocation_hashtable (Will Pierce)
  - net: ethernet: mtk_eth_soc: revise QDMA packet scheduler settings (Bo-Cun Chen)
  - net: ethernet: mtk_eth_soc: correct the max weight of the queue limit for 100Mbps (Bo-Cun Chen)
  - net: ethernet: mtk_eth_soc: reapply mdc divider on reset (Bo-Cun Chen)
  - net: ti: icss-iep: Fix possible NULL pointer dereference for perout request (Meghana Malladi)
  - net: ti: icss-iep: Add phase offset configuration for perout signal (Meghana Malladi)
  - net: ti: icss-iep: Add pwidth configuration for perout signal (Meghana Malladi)
  - ptp: ocp: fix start time alignment in ptp_ocp_signal_set (Sagi Maimon)
  - net: dsa: avoid refcount warnings when ds->ops->tag_8021q_vlan_del() fails (Vladimir Oltean)
  - net: dsa: free routing table on probe failure (Vladimir Oltean)
  - net: dsa: clean up FDB, MDB, VLAN entries on unbind (Vladimir Oltean)
  - net: dsa: mv88e6xxx: fix -ENOENT when deleting VLANs and MST is unsupported (Vladimir Oltean)
  - net: dsa: mv88e6xxx: avoid unregistering devlink regions which were never registered (Vladimir Oltean)
  - net: txgbe: fix memory leak in txgbe_probe() error path (Abdun Nihaal)
  - net: bridge: switchdev: do not notify new brentries as changed (Jonas Gorski)
  - net: b53: enable BPDU reception for management port (Jonas Gorski)
  - netlink: specs: rt-link: adjust mctp attribute naming (Jakub Kicinski)
  - netlink: specs: rt-link: add an attr layer around alt-ifname (Jakub Kicinski)
  - cxgb4: fix memory leak in cxgb4_init_ethtool_filters() error path (Abdun Nihaal)
  - ata: libata-sata: Save all fields from sense data descriptor (Niklas Cassel)
  - loop: stop using vfs_iter_{read,write} for buffered I/O (Christoph Hellwig)
  - loop: aio inherit the ioprio of original request (Yunlong Xing)
  - eth: bnxt: fix missing ring index trim on error path (Jakub Kicinski)
  - net: ethernet: ti: am65-cpsw: fix port_np reference counting (Michael Walle)
  - net: ngbe: fix memory leak in ngbe_probe() error path (Abdun Nihaal)
  - can: rockchip_canfd: fix broken quirks checks (Weizhao Ouyang)
  - net: openvswitch: fix nested key length validation in the set() action (Ilya Maximets)
  - netlink: specs: ovs_vport: align with C codegen capabilities (Jakub Kicinski)
  - block: fix resource leak in blk_register_queue() error path (Zheng Qixing)
  - net: mctp: Set SOCK_RCU_FREE (Matt Johnston)
  - ethtool: cmis_cdb: use correct rpl size in ethtool_cmis_module_poll() (Damodharam Ammepalli)
  - pds_core: fix memory leak in pdsc_debugfs_add_qcq() (Abdun Nihaal)
  - test suite: use %zu to print size_t (Matthew Wilcox (Oracle))
  - smc: Fix lockdep false-positive for IPPROTO_SMC. (Kuniyuki Iwashima)
  - dt-bindings: soc: fsl: fsl,ls1028a-reset: Fix maintainer entry (Geert Uytterhoeven)
  - igc: add lock preventing multiple simultaneous PTM transactions (Christopher S M Hall)
  - igc: cleanup PTP module if probe fails (Christopher S M Hall)
  - igc: handle the IGC_PTP_ENABLED flag correctly (Christopher S M Hall)
  - igc: move ktime snapshot into PTM retry loop (Christopher S M Hall)
  - igc: increase wait time before retrying PTM (Christopher S M Hall)
  - igc: fix PTM cycle trigger logic (Christopher S M Hall)
  - Revert "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" (Johannes Berg)
  - xen: fix multicall debug feature (Juergen Gross)
  - ipv6: add exception routes to GC list in rt6_insert_exception (Xin Long)
  - Bluetooth: l2cap: Check encryption key size on incoming connection (Frédéric Danis)
  - Bluetooth: btrtl: Prevent potential NULL dereference (Dan Carpenter)
  - Bluetooth: hci_event: Fix sending MGMT_EV_DEVICE_FOUND for invalid address (Luiz Augusto von Dentz)
  - RDMA/core: Silence oversized kvmalloc() warning (Shay Drory)
  - ASoC: cs42l43: Reset clamp override on jack removal (Charles Keepax)
  - ALSA: hda/realtek - Fixed ASUS platform headset Mic issue (Kailang Yang)
  - ALSA: hda/realtek: Workaround for resume on Dell Venue 11 Pro 7130 (Takashi Iwai)
  - ALSA: hda: improve bass speaker support for ASUS Zenbook UM5606WA (Jaroslav Kysela)
  - ALSA: hda/cirrus_scodec_test: Don't select dependencies (Richard Fitzgerald)
  - RDMA/hns: Fix wrong maximum DMA segment size (Chengchang Tang)
  - RDMA/usnic: Fix passing zero to PTR_ERR in usnic_ib_pci_probe() (Yue Haibing)
  - ovl: remove unused forward declaration (Giuseppe Scrivano)
  - crypto: tegra - Fix IV usage for AES ECB (Akhil R)
  - crypto: tegra - Do not use fixed size buffers (Akhil R)
  - crypto: tegra - remove redundant error check on ret (Colin Ian King)
  - ASoC: Intel: avs: Fix null-ptr-deref in avs_component_probe() (Henry Martin)
  - ASoC: dwc: always enable/disable i2s irqs (Brady Norander)
  - md/md-bitmap: fix stats collection for external bitmaps (Zheng Qixing)
  - md/raid10: fix missing discard IO accounting (Yu Kuai)
  - scsi: iscsi: Fix missing scsi_host_put() in error path (Miaoqian Lin)
  - wifi: wl1251: fix memory leak in wl1251_tx_work (Abdun Nihaal)
  - wifi: mac80211: Purge vif txq in ieee80211_do_stop() (Remi Pommarel)
  - wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue() (Remi Pommarel)
  - wifi: at76c50x: fix use after free access in at76_disconnect (Abdun Nihaal)
  - scsi: hisi_sas: Enable force phy when SATA disk directly connected (Xingui Yang)
  - aarch64: increase DEFAULT_CRASH_KERNEL_LOW_SIZE for kdump (Brian Maly)  [Orabug: 37446372]
  - vhost-scsi: Fix vhost_scsi_send_status() (Dongli Zhang)  [Orabug: 37840543]
  - vhost-scsi: Fix vhost_scsi_send_bad_target() (Dongli Zhang)  [Orabug: 37840543]
  - vhost-scsi: protect vq->log_used with vq->mutex (Dongli Zhang)  [Orabug: 37840543]
  - vhost-scsi: Reduce response iov mem use (Mike Christie)  [Orabug: 37840543]
  - vhost-scsi: Allocate iov_iter used for unaligned copies when needed (Mike Christie)  [Orabug: 37840543]
  - vhost-scsi: Stop duplicating se_cmd fields (Mike Christie)  [Orabug: 37840543]
  - vhost-scsi: Dynamically allocate scatterlists (Mike Christie)  [Orabug: 37840543]
  - vhost-scsi: Return queue full for page alloc failures during copy (Mike Christie)  [Orabug: 37840543]
  - vhost-scsi: Add better resource allocation failure handling (Mike Christie)  [Orabug: 37840543]
  - vhost-scsi: Allocate T10 PI structs only when enabled (Mike Christie)  [Orabug: 37840543]
  - vhost-scsi: Reduce mem use by moving upages to per queue (Mike Christie)  [Orabug: 37840543]
  - Revert "vhost-scsi: protect vq->log_base with vq->mutex" (Mike Christie)  [Orabug: 37840543]
  - Revert "vhost_scsi: log write descriptors" (Mike Christie)  [Orabug: 37840543]
  - scsi: mpi3mr: Event processing debug improvement (Ranjan Kumar)  [Orabug: 37878021]
  - scsi: mpi3mr: Add level check to control event logging (Ranjan Kumar)  [Orabug: 37878021]
  - scsi: mpi3mr: Reset the pending interrupt flag (Ranjan Kumar)  [Orabug: 37878021]
  - scsi: mpi3mr: Fix pending I/O counter (Ranjan Kumar)  [Orabug: 37878021]


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-2.28.3.el9uek]
changelog:
  - LTS version: v6.12.28 (Jack Vogel)
  - dm: fix copying after src array boundaries (Tudor Ambarus)
  - drm/amd/display: Fix slab-use-after-free in hdcp (Chris Bainbridge)
  - drm/amd/display: Add scoped mutexes for amdgpu_dm_dhcp (Mario Limonciello)
  - drivers: base: handle module_kobject creation (Shyam Saini)
  - kernel: globalize lookup_or_create_module_kobject() (Shyam Saini)
  - kernel: param: rename locate_module_kobject (Shyam Saini)
  - Revert "drm/meson: vclk: fix calculation of 59.94 fractional rates" (Christian Hewitt)
  - arm64: dts: st: Use 128kB size for aliased GIC400 register access on stm32mp25 SoCs (Christian Bruel)
  - arm64: dts: st: Adjust interrupt-controller for stm32mp25 SoCs (Christian Bruel)
  - ARM: dts: opos6ul: add ksz8081 phy properties (Sébastien Szymanski)
  - arm64: dts: imx95: Correct the range of PCIe app-reg region (Richard Zhu)
  - firmware: arm_ffa: Skip Rx buffer ownership release if not acquired (Sudeep Holla)
  - firmware: arm_scmi: Balance device refcount when destroying devices (Cristian Marussi)
  - drm/xe: Ensure fixed_slice_mode gets set after ccs_mode change (Niranjana Vishwanathapura)
  - sch_ets: make est_qlen_notify() idempotent (Cong Wang)
  - sch_qfq: make qfq_qlen_notify() idempotent (Cong Wang)
  - sch_hfsc: make hfsc_qlen_notify() idempotent (Cong Wang)
  - sch_drr: make drr_qlen_notify() idempotent (Cong Wang)
  - sch_htb: make htb_qlen_notify() idempotent (Cong Wang)
  - accel/ivpu: Add handling of VPU_JSM_STATUS_MVNCI_CONTEXT_VIOLATION_HW (Karol Wachowski)
  - accel/ivpu: Fix locking order in ivpu_job_submit (Karol Wachowski)
  - accel/ivpu: Abort all jobs after command queue unregister (Karol Wachowski)
  - accel/ivpu: Update VPU FW API headers (Andrzej Kacprowski)
  - accel/ivpu: Fix a typo (Andrew Kreimer)
  - accel/ivpu: Use xa_alloc_cyclic() instead of custom function (Karol Wachowski)
  - accel/ivpu: Make DB_ID and JOB_ID allocations incremental (Tomasz Rusinowicz)
  - net: Fix the devmem sock opts and msgs for parisc (Pranjal Shrivastava)
  - bcachefs: Remove incorrect __counted_by annotation (Alan Huang)
  - mm, slab: clean up slab->obj_exts always (Zhenhua Huang)
  - net: vertexcom: mse102x: Fix RX error handling (Stefan Wahren)
  - net: vertexcom: mse102x: Add range check for CMD_RTS (Stefan Wahren)
  - net: vertexcom: mse102x: Fix LEN_MASK (Stefan Wahren)
  - net: vertexcom: mse102x: Fix possible stuck of SPI interrupt (Stefan Wahren)
  - net: hns3: defer calling ptp_clock_register() (Jian Shen)
  - net: hns3: fixed debugfs tm_qset size (Hao Lan)
  - net: hns3: fix an interrupt residual problem (Yonglong Liu)
  - net: hns3: store rx VLAN tag offload state for VF (Jian Shen)
  - octeon_ep: Fix host hang issue during device reboot (Sathesh B Edara)
  - net: fec: ERR007885 Workaround for conventional TX (Mattias Barthel)
  - net: lan743x: Fix memleak issue when GSO enabled (Thangaraj Samynathan)
  - ptp: ocp: Fix NULL dereference in Adva board SMA sysfs operations (Sagi Maimon)
  - net: use sock_gen_put() when sk_state is TCP_TIME_WAIT (Jibin Zhang)
  - bnxt_en: fix module unload sequence (Vadim Fedorenko)
  - ASoC: simple-card-utils: Fix pointer check in graph_util_parse_link_direction (Alexander Stein)
  - nvmet-tcp: select CONFIG_TLS from CONFIG_NVME_TARGET_TCP_TLS (Alistair Francis)
  - nvme-tcp: select CONFIG_TLS from CONFIG_NVME_TCP_TLS (Alistair Francis)
  - nvme-tcp: fix premature queue removal and I/O failover (Michael Liang)
  - bnxt_en: Fix ethtool -d byte order for 32-bit values (Michael Chan)
  - bnxt_en: Fix out-of-bound memcpy() during ethtool -w (Shruti Parab)
  - bnxt_en: Fix coredump logic to free allocated buffer (Shruti Parab)
  - bnxt_en: call pci_alloc_irq_vectors() after bnxt_reserve_rings() (Kashyap Desai)
  - bnxt_en: Add missing skb_mark_for_recycle() in bnxt_rx_vlan() (Somnath Kotur)
  - bnxt_en: Fix ethtool selftest output in one of the failure cases (Kalesh AP)
  - bnxt_en: Fix error handling path in bnxt_init_chip() (Shravya KN)
  - ALSA: hda/realtek: Fix built-mic regression on other ASUS models (Takashi Iwai)
  - net: ipv6: fix UDPv6 GSO segmentation with NAT (Felix Fietkau)
  - net: dsa: felix: fix broken taprio gate states after clock jump (Vladimir Oltean)
  - net: ethernet: mtk_eth_soc: fix SER panic with 4GB+ RAM (Chad Monroe)
  - igc: fix lock order in igc_ptp_reset (Jacob Keller)
  - idpf: protect shutdown from reset (Larysa Zaremba)
  - idpf: fix potential memory leak on kcalloc() failure (Michal Swiatkowski)
  - net: mdio: mux-meson-gxl: set reversed bit when using internal phy (Da Xue)
  - net: dlink: Correct endianness handling of led_mode (Simon Horman)
  - drm/mipi-dbi: Fix blanking for non-16 bit formats (Russell Cloran)
  - drm/tests: shmem: Fix memleak (Maxime Ripard)
  - nvme-pci: fix queue unquiesce check on slot_reset (Keith Busch)
  - ALSA: ump: Fix buffer overflow at UMP SysEx message conversion (Takashi Iwai)
  - scsi: ufs: core: Remove redundant query_complete trace (Keoseong Park)
  - idpf: fix offloads support for encapsulated packets (Madhu Chittim)
  - ice: Check VF VSI Pointer Value in ice_vc_add_fdir_fltr() (Xuanqiang Luo)
  - net_sched: qfq: Fix double list add in class with netem as child qdisc (Victor Nogueira)
  - net_sched: ets: Fix double list add in class with netem as child qdisc (Victor Nogueira)
  - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (Victor Nogueira)
  - net_sched: drr: Fix double list add in class with netem as child qdisc (Victor Nogueira)
  - pds_core: remove write-after-free of client_id (Shannon Nelson)
  - pds_core: specify auxiliary_device to be created (Shannon Nelson)
  - pds_core: make pdsc_auxbus_dev_del() void (Shannon Nelson)
  - net: ethernet: mtk_eth_soc: sync mtk_clks_source_name array (Daniel Golle)
  - net: ethernet: mtk-star-emac: rearm interrupts in rx_poll only when advised (Louis-Alexis Eyraud)
  - net: ethernet: mtk-star-emac: fix spinlock recursion issues on rx/tx poll (Louis-Alexis Eyraud)
  - rtase: Modify the condition used to detect overflow in rtase_calc_time_mitigation (Justin Lai)
  - bnxt_en: improve TX timestamping FIFO configuration (Vadim Fedorenko)
  - octeon_ep_vf: Resolve netdevice usage count issue (Sathesh B Edara)
  - net: mscc: ocelot: delete PVID VLAN when readding it as non-PVID (Vladimir Oltean)
  - Bluetooth: L2CAP: copy RX timestamp to new fragments (Pauli Virtanen)
  - Bluetooth: btintel_pcie: Add additional to checks to clear TX/RX paths (Kiran K)
  - Bluetooth: btusb: avoid NULL pointer dereference in skb_dequeue() (En-Wei Wu)
  - Bluetooth: btintel_pcie: Avoid redundant buffer allocation (Kiran K)
  - Bluetooth: hci_conn: Fix not setting timeout for BIG Create Sync (Luiz Augusto von Dentz)
  - Bluetooth: hci_conn: Fix not setting conn_timeout for Broadcast Receiver (Luiz Augusto von Dentz)
  - Bluetooth: hci_conn: Remove alloc from critical section (Iulia Tanasescu)
  - ASoC: amd: acp: Fix NULL pointer deref in acp_i2s_set_tdm_slot (Venkata Prasad Potturu)
  - accel/ivpu: Correct DCT interrupt handling (Karol Wachowski)
  - net/mlx5: E-switch, Fix error handling for enabling roce (Chris Mi)
  - net/mlx5e: Fix lock order in mlx5e_tx_reporter_ptpsq_unhealthy_recover (Cosmin Ratiu)
  - net/mlx5e: TC, Continue the attr process even if encap entry is invalid (Jianbo Liu)
  - net/mlx5: E-Switch, Initialize MAC Address for Default GID (Maor Gottlieb)
  - net/mlx5e: Use custom tunnel header for vxlan gbp (Vlad Dogaru)
  - xsk: Fix race condition in AF_XDP generic RX path (e.kubanski)
  - vxlan: vnifilter: Fix unlocked deletion of default FDB entry (Ido Schimmel)
  - powerpc/boot: Fix dash warning (Madhavan Srinivasan)
  - wifi: plfxlc: Remove erroneous assert in plfxlc_mac_release (Murad Masimov)
  - wifi: iwlwifi: fix the check for the SCRATCH register upon resume (Emmanuel Grumbach)
  - wifi: iwlwifi: don't warn if the NIC is gone in resume (Emmanuel Grumbach)
  - drm/i915/pxp: fix undefined reference to `intel_pxp_gsccs_is_ready_for_sessions' (Chen Linxuan)
  - ALSA: hda/realtek - Enable speaker for HP platform (Kailang Yang)
  - ASoC: Intel: sof_sdw: Add NULL check in asoc_sdw_rt_dmic_rtd_init() (Chenyuan Yang)
  - powerpc/boot: Check for ld-option support (Madhavan Srinivasan)
  - pinctrl: imx: Return NULL if no group is matched and found (Hui Wang)
  - book3s64/radix : Align section vmemmap start address to PAGE_SIZE (Donet Tom)
  - ASoC: soc-pcm: Fix hw_params() and DAPM widget sequence (Sheetal)
  - ASoC: cs-amp-lib-test: Don't select SND_SOC_CS_AMP_LIB (Richard Fitzgerald)
  - ASoC: soc-core: Stop using of_property_read_bool() for non-boolean properties (Geert Uytterhoeven)
  - drm/amd/display: Default IPS to RCG_IN_ACTIVE_IPS2_IN_OFF (Leo Li)
  - tracing: Fix oob write in trace_seq_to_buffer() (Jeongjun Park)
  - cpufreq: Fix setting policy limits when frequency tables are used (Rafael J. Wysocki)
  - cpufreq: Avoid using inconsistent policy->min and policy->max (Rafael J. Wysocki)
  - smb: client: fix zero length for mkdir POSIX create context (Jethro Donaldson)
  - ksmbd: fix use-after-free in session logoff (Sean Heelan)
  - ksmbd: fix use-after-free in kerberos authentication (Sean Heelan)
  - ksmbd: fix use-after-free in ksmbd_session_rpc_open (Namjae Jeon)
  - platform/x86/intel-uncore-freq: Fix missing uncore sysfs during CPU hotplug (Shouye Liu)
  - platform/x86/amd: pmc: Require at least 2.5 seconds between HW sleep cycles (Mario Limonciello)
  - iommu: Fix two issues in iommu_copy_struct_from_user() (Nicolin Chen)
  - iommu/vt-d: Apply quirk_iommu_igfx for 8086:0044 (QM57/QS57) (Mingcong Bai)
  - iommu/arm-smmu-v3: Fix pgsize_bit for sva domains (Balbir Singh)
  - iommu/arm-smmu-v3: Fix iommu_device_probe bug due to duplicated stream ids (Nicolin Chen)
  - iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid (Pavel Paklov)
  - drm: Select DRM_KMS_HELPER from DRM_DEBUG_DP_MST_TOPOLOGY_REFS (Janne Grunau)
  - drm/amdgpu: Fix offset for HDP remap in nbio v7.11 (Lijo Lazar)
  - dm: always update the array size in realloc_argv on success (Benjamin Marzinski)
  - dm-integrity: fix a warning on invalid table line (Mikulas Patocka)
  - dm-bufio: don't schedule in atomic context (LongPing Wei)
  - x86/boot/sev: Support memory acceptance in the EFI stub under SVSM (Ard Biesheuvel)
  - wifi: brcm80211: fmac: Add error handling for brcmf_usb_dl_writeimage() (Wentao Liang)
  - tracing: Do not take trace_event_sem in print_event_fields() (Steven Rostedt)
  - spi: tegra114: Don't fail set_cs_timing when delays are zero (Aaron Kling)
  - mmc: renesas_sdhi: Fix error handling in renesas_sdhi_probe (Ruslan Piasetskyi)
  - mm/memblock: repeat setting reserved region nid if array is doubled (Wei Yang)
  - mm/memblock: pass size instead of end to memblock_set_node() (Wei Yang)
  - irqchip/qcom-mpm: Prevent crash when trying to handle non-wake GPIOs (Stephan Gerhold)
  - amd-xgbe: Fix to ensure dependent features are toggled with RX checksum offload (Vishal Badole)
  - perf/x86/intel: KVM: Mask PEBS_ENABLE loaded for guest with vCPU's value. (Sean Christopherson)
  - perf/x86/intel: Only check the group flag for X86 leader (Kan Liang)
  - parisc: Fix double SIGFPE crash (Helge Deller)
  - arm64: errata: Add missing sentinels to Spectre-BHB MIDR arrays (Will Deacon)
  - i2c: imx-lpi2c: Fix clock count when probe defers (Clark Wang)
  - EDAC/altera: Set DDR and SDMMC interrupt mask before registration (Niravkumar L Rabara)
  - EDAC/altera: Test the correct error reg offset (Niravkumar L Rabara)
  - drm/nouveau: Fix WARN_ON in nouveau_fence_context_kill() (Philipp Stanner)
  - drm/fdinfo: Protect against driver unbind (Tvrtko Ursulin)
  - cpufreq: intel_pstate: Unchecked MSR aceess in legacy mode (Srinivas Pandruvada)
  - btrfs: fix COW handling in run_delalloc_nocow() (Dave Chen)
  - btrfs: adjust subpage bit start based on sectorsize (Josef Bacik)
  - binder: fix offset calculation in debug log (Carlos Llamas)
  - ALSA: usb-audio: Add second USB ID for Jabra Evolve 65 headset (Joachim Priesner)
  - ALSA: usb-audio: Add retry on -EPROTO from usb_set_interface() (Geoffrey D. Bennett)
  - Revert "rndis_host: Flag RNDIS modems as WWAN devices" (Christian Heusel)
  - Bluetooth: btusb: Add 13 USB device IDs for Qualcomm WCN785x (Zijun Hu)
  - Bluetooth: btusb: Add new VID/PID for WCN785x (Dorian Cruveiller)
  - Bluetooth: btusb: Add ID 0x2c7c:0x0130 for Qualcomm WCN785x (Mark Dietzer)
  - Bluetooth: btusb: Add one more ID 0x13d3:0x3623 for Qualcomm WCN785x (Zijun Hu)
  - Bluetooth: btusb: Add one more ID 0x0489:0xe0f3 for Qualcomm WCN785x (Zijun Hu)
  - Bluetooth: btusb: add Foxconn 0xe0fc for Qualcomm WCN785x (Aaron Ma)
  - x86/PCI: Export find_cap() to be used in early PCI code (Rayan Dasoriya)  [Orabug: 37383447]
  - x86/quirks: Scan all busses for early PCI quirks (Rayan Dasoriya)  [Orabug: 37383447]
  - x86/quirks: Add parameter to clear MSIs early on boot (Rayan Dasoriya)  [Orabug: 37383447]
  - scsi: megaraid_sas: Driver version update to 07.734.00.00-rc1 (Chandrakanth Patil)  [Orabug: 37877985]
  - scsi: megaraid_sas: Make most module parameters static (Dr. David Alan Gilbert)  [Orabug: 37877985]
  - scsi: mpt3sas: Fix buffer overflow in mpt3sas_send_mctp_passthru_req() (Dan Carpenter)  [Orabug: 37878012]
  - scsi: mpt3sas: Fix spelling mistake "receveid" -> "received" (Colin Ian King)  [Orabug: 37878012]
  - scsi: mpt3sas: update driver version to 52.100.00.00 (Shivasharan S)  [Orabug: 37878012]
  - scsi: mpt3sas: Send a diag reset if target reset fails (Shivasharan S)  [Orabug: 37878012]
  - scsi: mpt3sas: Report driver capability as part of IOCINFO command (Shivasharan S)  [Orabug: 37878012]
  - scsi: mpt3sas: Add support for MCTP Passthrough commands (Shivasharan S)  [Orabug: 37878012]
  - scsi: mpt3sas: Update MPI headers to 02.00.62 version (Shivasharan S)  [Orabug: 37878012]
  - scsi: mpt3sas: Fix a locking bug in an error path (Bart Van Assche)  [Orabug: 37878012]
  - scsi: mpt3sas: Reduce log level of ignore_delay_remove message to KERN_INFO (Paul Menzel)  [Orabug: 37878012]
  - scsi: mpt3sas: Remove unused config functions (Dr. David Alan Gilbert)  [Orabug: 37878012]
  - scsi: mpt3sas: Add details to EEDPTagMode error message (Paul Menzel)  [Orabug: 37878012]
  - scsi: mpt3sas: Update driver version to 51.100.00.00 (Ranjan Kumar)  [Orabug: 37878012]
  - vhost-scsi: log event queue write descriptors (Dongli Zhang)  [Orabug: 37883837]
  - vhost-scsi: log control queue write descriptors (Dongli Zhang)  [Orabug: 37883837]
  - vhost-scsi: log I/O queue write descriptors (Dongli Zhang)  [Orabug: 37883837]
  - vhost-scsi: adjust vhost_scsi_get_desc() to log vring descriptors (Dongli Zhang)  [Orabug: 37883837]
  - vhost: modify vhost_log_write() for broader users (Dongli Zhang)  [Orabug: 37883837]
  - uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu)  [Orabug: 37899161]
  - uek-rpm: Move vmxnet3 to module-core in UEK8 (Harshit Mogalapalli)  [Orabug: 37908279]
  - x86/bugs: Enabling Retbleed and SRSO mitigation can taint the kernel (Alexandre Chartre)  [Orabug: 37936569]
  - x86/bhi: Do not set BHI_DIS_S in 32-bit mode (Pawan Gupta)  [Orabug: 37920673]
  - x86/bpf: Add IBHF call at end of classic BPF (Daniel Sneddon)  [Orabug: 37920673]
  - x86/bpf: Call branch history clearing sequence on exit (Daniel Sneddon)  [Orabug: 37920673]
  - selftest/x86/bugs: Add selftests for ITS (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
  - x86/its: Align RETs in BHB clear sequence to avoid thunking (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
  - x86/its: Add support for RSB stuffing mitigation (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
  - x86/its: Add "vmexit" option to skip mitigation on some CPUs (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
  - x86/its: Enable Indirect Target Selection mitigation (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
  - x86/its: Add support for ITS-safe return thunk (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
  - x86/its: Add support for ITS-safe indirect thunk (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
  - x86/its: Enumerate Indirect Target Selection (ITS) bug (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
  - Documentation: x86/bugs/its: Add ITS documentation (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-100.28.1.el9uek]
changelog:
  - KVM: SEV: Add KVM_SEV_SNP_ENABLE_REQ_CERTS command (Michael Roth)  [Orabug: 37894105]
  - KVM: Introduce KVM_EXIT_SNP_REQ_CERTS for SNP certificate-fetching (Michael Roth)  [Orabug: 37894105]
  - Revert "KVM: Introduce KVM_EXIT_SNP_REQ_CERTS for SNP certificate-fetching" (Liam Merwick)  [Orabug: 37894105]
  - uek-rpm: Enable SECURITY_DMESG_RESTRICT in UEK8 (Harshit Mogalapalli)  [Orabug: 37867042]


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-100.28.2.el9uek]
changelog:
  - sched/eevdf: Fix se->slice being set to U64_MAX and resulting crash (Omar Sandoval)
  - certs: Add new Oracle Linux Driver Signing (key 1) certificate (Sherry Yang)  [Orabug: 37967533]
  - Revert "block: sysfs option to change ioticks granularity" (Gulam Mohamed)  [Orabug: 37921776]
  - RDS: use pin_user_pages_fast() (Stephen Brennan)  [Orabug: 37968545]


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-100.28.2.2.el9uek]
changelog:
  - Add Zen34 clients (Borislav Petkov (AMD))  [Orabug: 38129827]  {CVE-2024-36350} {CVE-2024-36357} 
  - x86/process: Move the buffer clearing before MONITOR (Kim Phillips)  [Orabug: 38129827]  {CVE-2024-36350} {CVE-2024-36357} 
  - Add normal counters (Borislav Petkov (AMD))  [Orabug: 38129827]  {CVE-2024-36350} {CVE-2024-36357} 
  - KVM: SVM: Advertize TSA CPUID bits to guests (Borislav Petkov (AMD))  [Orabug: 38129827]  {CVE-2024-36350} {CVE-2024-36357} 
  - x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov (AMD))  [Orabug: 38129827]  {CVE-2024-36350} {CVE-2024-36357} 
  - x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov (AMD))  [Orabug: 38129827]  {CVE-2024-36350} {CVE-2024-36357}


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-0.20.20.el9uek]
changelog:
  - block: prevent calls to should_fail_bio() optimized by gcc (Prasad Singamsetty)  [Orabug: 37782458]


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-100.28.2.el9uek]
changelog:
  - sched/eevdf: Fix se->slice being set to U64_MAX and resulting crash (Omar Sandoval)   
  - certs: Add new Oracle Linux Driver Signing (key 1) certificate (Sherry Yang)  [Orabug: 37967533]  
  - Revert "block: sysfs option to change ioticks granularity" (Gulam Mohamed)  [Orabug: 37921776]  
  - RDS: use pin_user_pages_fast() (Stephen Brennan)  [Orabug: 37968545]


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-2.28.3.el9uek]
changelog:
  - LTS version: v6.12.28 (Jack Vogel)
  - dm: fix copying after src array boundaries (Tudor Ambarus)
  - drm/amd/display: Fix slab-use-after-free in hdcp (Chris Bainbridge) [Orabug: 37976747] {CVE-2025-37903}
  - drm/amd/display: Add scoped mutexes for amdgpu_dm_dhcp (Mario Limonciello)
  - drivers: base: handle module_kobject creation (Shyam Saini)
  - kernel: globalize lookup_or_create_module_kobject() (Shyam Saini)
  - kernel: param: rename locate_module_kobject (Shyam Saini)
  - Revert "drm/meson: vclk: fix calculation of 59.94 fractional rates" (Christian Hewitt)
  - arm64: dts: st: Use 128kB size for aliased GIC400 register access on stm32mp25 SoCs (Christian Bruel)
  - arm64: dts: st: Adjust interrupt-controller for stm32mp25 SoCs (Christian Bruel)
  - ARM: dts: opos6ul: add ksz8081 phy properties (Sébastien Szymanski)
  - arm64: dts: imx95: Correct the range of PCIe app-reg region (Richard Zhu)
  - firmware: arm_ffa: Skip Rx buffer ownership release if not acquired (Sudeep Holla)
  - firmware: arm_scmi: Balance device refcount when destroying devices (Cristian Marussi) [Orabug: 37976752] {CVE-2025-37905}
  - drm/xe: Ensure fixed_slice_mode gets set after ccs_mode change (Niranjana Vishwanathapura)
  - sch_ets: make est_qlen_notify() idempotent (Cong Wang)
  - sch_qfq: make qfq_qlen_notify() idempotent (Cong Wang)
  - sch_hfsc: make hfsc_qlen_notify() idempotent (Cong Wang)
  - sch_drr: make drr_qlen_notify() idempotent (Cong Wang)
  - sch_htb: make htb_qlen_notify() idempotent (Cong Wang) [Orabug: 37976858] {CVE-2025-37932}
  - accel/ivpu: Add handling of VPU_JSM_STATUS_MVNCI_CONTEXT_VIOLATION_HW (Karol Wachowski)
  - accel/ivpu: Fix locking order in ivpu_job_submit (Karol Wachowski) [Orabug: 37976760] {CVE-2025-37907}
  - accel/ivpu: Abort all jobs after command queue unregister (Karol Wachowski)
  - accel/ivpu: Update VPU FW API headers (Andrzej Kacprowski)
  - accel/ivpu: Fix a typo (Andrew Kreimer)
  - accel/ivpu: Use xa_alloc_cyclic() instead of custom function (Karol Wachowski)
  - accel/ivpu: Make DB_ID and JOB_ID allocations incremental (Tomasz Rusinowicz)
  - net: Fix the devmem sock opts and msgs for parisc (Pranjal Shrivastava)
  - bcachefs: Remove incorrect __counted_by annotation (Alan Huang)
  - mm, slab: clean up slab->obj_exts always (Zhenhua Huang) [Orabug: 37976762] {CVE-2025-37908}
  - net: vertexcom: mse102x: Fix RX error handling (Stefan Wahren)
  - net: vertexcom: mse102x: Add range check for CMD_RTS (Stefan Wahren)
  - net: vertexcom: mse102x: Fix LEN_MASK (Stefan Wahren)
  - net: vertexcom: mse102x: Fix possible stuck of SPI interrupt (Stefan Wahren)
  - net: hns3: defer calling ptp_clock_register() (Jian Shen)
  - net: hns3: fixed debugfs tm_qset size (Hao Lan)
  - net: hns3: fix an interrupt residual problem (Yonglong Liu)
  - net: hns3: store rx VLAN tag offload state for VF (Jian Shen)
  - octeon_ep: Fix host hang issue during device reboot (Sathesh Edara) [Orabug: 37976864] {CVE-2025-37933}
  - net: fec: ERR007885 Workaround for conventional TX (Mattias Barthel)
  - net: lan743x: Fix memleak issue when GSO enabled (Thangaraj Samynathan) [Orabug: 37976765] {CVE-2025-37909}
  - ptp: ocp: Fix NULL dereference in Adva board SMA sysfs operations (Sagi Maimon) [Orabug: 37976771] {CVE-2025-37910}
  - net: use sock_gen_put() when sk_state is TCP_TIME_WAIT (Jibin Zhang) [Orabug: 37976728] {CVE-2025-37894}
  - bnxt_en: fix module unload sequence (Vadim Fedorenko)
  - ASoC: simple-card-utils: Fix pointer check in graph_util_parse_link_direction (Alexander Stein) [Orabug: 37976869] {CVE-2025-37934}
  - nvmet-tcp: select CONFIG_TLS from CONFIG_NVME_TARGET_TCP_TLS (Alistair Francis)
  - nvme-tcp: select CONFIG_TLS from CONFIG_NVME_TCP_TLS (Alistair Francis)
  - nvme-tcp: fix premature queue removal and I/O failover (Michael Liang)
  - bnxt_en: Fix ethtool -d byte order for 32-bit values (Michael Chan)
  - bnxt_en: Fix out-of-bound memcpy() during ethtool -w (Shruti Parab) [Orabug: 37976773] {CVE-2025-37911}
  - bnxt_en: Fix coredump logic to free allocated buffer (Shruti Parab)
  - bnxt_en: call pci_alloc_irq_vectors() after bnxt_reserve_rings() (Kashyap Desai)
  - bnxt_en: Add missing skb_mark_for_recycle() in bnxt_rx_vlan() (Somnath Kotur)
  - bnxt_en: Fix ethtool selftest output in one of the failure cases (Kalesh Ap)
  - bnxt_en: Fix error handling path in bnxt_init_chip() (Shravya Kn) [Orabug: 37976731] {CVE-2025-37895}
  - ALSA: hda/realtek: Fix built-mic regression on other ASUS models (Takashi Iwai)
  - net: ipv6: fix UDPv6 GSO segmentation with NAT (Felix Fietkau)
  - net: dsa: felix: fix broken taprio gate states after clock jump (Vladimir Oltean)
  - net: ethernet: mtk_eth_soc: fix SER panic with 4GB+ RAM (Chad Monroe) [Orabug: 37976872] {CVE-2025-37935}
  - igc: fix lock order in igc_ptp_reset (Jacob Keller)
  - idpf: protect shutdown from reset (Larysa Zaremba)
  - idpf: fix potential memory leak on kcalloc() failure (Michal Swiatkowski)
  - net: mdio: mux-meson-gxl: set reversed bit when using internal phy (Da Xue)
  - net: dlink: Correct endianness handling of led_mode (Simon Horman)
  - drm/mipi-dbi: Fix blanking for non-16 bit formats (Russell Cloran)
  - drm/tests: shmem: Fix memleak (Maxime Ripard)
  - nvme-pci: fix queue unquiesce check on slot_reset (Keith Busch)
  - ALSA: ump: Fix buffer overflow at UMP SysEx message conversion (Takashi Iwai) [Orabug: 37970918] {CVE-2025-37891}
  - scsi: ufs: core: Remove redundant query_complete trace (Keoseong Park)
  - idpf: fix offloads support for encapsulated packets (Madhu Chittim)
  - ice: Check VF VSI Pointer Value in ice_vc_add_fdir_fltr() (Luoxuanqiang) [Orabug: 37976779] {CVE-2025-37912}
  - net_sched: qfq: Fix double list add in class with netem as child qdisc (Victor Nogueira) [Orabug: 37976783] {CVE-2025-37913}
  - net_sched: ets: Fix double list add in class with netem as child qdisc (Victor Nogueira) [Orabug: 37976788] {CVE-2025-37914}
  - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (Victor Nogueira) [Orabug: 37970915] {CVE-2025-37890}
  - net_sched: drr: Fix double list add in class with netem as child qdisc (Victor Nogueira) [Orabug: 37976792] {CVE-2025-37915}
  - pds_core: remove write-after-free of client_id (Shannon Nelson) [Orabug: 37976797] {CVE-2025-37916}
  - pds_core: specify auxiliary_device to be created (Shannon Nelson)
  - pds_core: make pdsc_auxbus_dev_del() void (Shannon Nelson)
  - net: ethernet: mtk_eth_soc: sync mtk_clks_source_name array (Daniel Golle)
  - net: ethernet: mtk-star-emac: rearm interrupts in rx_poll only when advised (Louis-Alexis Eyraud)
  - net: ethernet: mtk-star-emac: fix spinlock recursion issues on rx/tx poll (Louis-Alexis Eyraud) [Orabug: 37976802] {CVE-2025-37917}
  - rtase: Modify the condition used to detect overflow in rtase_calc_time_mitigation (Justin Lai)
  - bnxt_en: improve TX timestamping FIFO configuration (Vadim Fedorenko)
  - octeon_ep_vf: Resolve netdevice usage count issue (Sathesh Edara)
  - net: mscc: ocelot: delete PVID VLAN when readding it as non-PVID (Vladimir Oltean)
  - Bluetooth: L2CAP: copy RX timestamp to new fragments (Pauli Virtanen)
  - Bluetooth: btintel_pcie: Add additional to checks to clear TX/RX paths (Kiran K)
  - Bluetooth: btusb: avoid NULL pointer dereference in skb_dequeue() (En-Wei Wu) [Orabug: 37976804] {CVE-2025-37918}
  - Bluetooth: btintel_pcie: Avoid redundant buffer allocation (Kiran K)
  - Bluetooth: hci_conn: Fix not setting timeout for BIG Create Sync (Luiz Augusto von Dentz)
  - Bluetooth: hci_conn: Fix not setting conn_timeout for Broadcast Receiver (Luiz Augusto von Dentz)
  - Bluetooth: hci_conn: Remove alloc from critical section (Iulia Tanasescu)
  - ASoC: amd: acp: Fix NULL pointer deref in acp_i2s_set_tdm_slot (Venkata Prasad Potturu) [Orabug: 37976806] {CVE-2025-37919}
  - accel/ivpu: Correct DCT interrupt handling (Karol Wachowski)
  - net/mlx5: E-switch, Fix error handling for enabling roce (Chris Mi)
  - net/mlx5e: Fix lock order in mlx5e_tx_reporter_ptpsq_unhealthy_recover (Cosmin Ratiu)
  - net/mlx5e: TC, Continue the attr process even if encap entry is invalid (Jianbo Liu)
  - net/mlx5: E-Switch, Initialize MAC Address for Default GID (Maor Gottlieb)
  - net/mlx5e: Use custom tunnel header for vxlan gbp (Vlad Dogaru)
  - xsk: Fix race condition in AF_XDP generic RX path (Eryk Kubanski) [Orabug: 37976809] {CVE-2025-37920}
  - vxlan: vnifilter: Fix unlocked deletion of default FDB entry (Ido Schimmel) [Orabug: 37976815] {CVE-2025-37921}
  - powerpc/boot: Fix dash warning (Madhavan Srinivasan)
  - wifi: plfxlc: Remove erroneous assert in plfxlc_mac_release (Murad Masimov) [Orabug: 37976734] {CVE-2025-37897}
  - wifi: iwlwifi: fix the check for the SCRATCH register upon resume (Emmanuel Grumbach)
  - wifi: iwlwifi: don't warn if the NIC is gone in resume (Emmanuel Grumbach)
  - drm/i915/pxp: fix undefined reference to `intel_pxp_gsccs_is_ready_for_sessions' (Chen Linxuan)
  - ALSA: hda/realtek - Enable speaker for HP platform (Kailang Yang)
  - ASoC: Intel: sof_sdw: Add NULL check in asoc_sdw_rt_dmic_rtd_init() (Chenyuan Yang)
  - powerpc/boot: Check for ld-option support (Madhavan Srinivasan)
  - pinctrl: imx: Return NULL if no group is matched and found (Hui Wang)
  - book3s64/radix : Align section vmemmap start address to PAGE_SIZE (Donet Tom) [Orabug: 37976819] {CVE-2025-37922}
  - ASoC: soc-pcm: Fix hw_params() and DAPM widget sequence (Sheetal)
  - ASoC: cs-amp-lib-test: Don't select SND_SOC_CS_AMP_LIB (Richard Fitzgerald)
  - ASoC: soc-core: Stop using of_property_read_bool() for non-boolean properties (Geert Uytterhoeven)
  - drm/amd/display: Default IPS to RCG_IN_ACTIVE_IPS2_IN_OFF (Sun Peng Li)
  - tracing: Fix oob write in trace_seq_to_buffer() (Jeongjun Park) [Orabug: 37976821] {CVE-2025-37923}
  - cpufreq: Fix setting policy limits when frequency tables are used (Rafael J. Wysocki)
  - cpufreq: Avoid using inconsistent policy->min and policy->max (Rafael J. Wysocki)
  - smb: client: fix zero length for mkdir POSIX create context (Jethro Donaldson)
  - ksmbd: fix use-after-free in session logoff (Sean Heelan) [Orabug: 37976738] {CVE-2025-37899}
  - ksmbd: fix use-after-free in kerberos authentication (Sean Heelan) [Orabug: 37976828] {CVE-2025-37924}
  - ksmbd: fix use-after-free in ksmbd_session_rpc_open (Namjae Jeon) [Orabug: 37976832] {CVE-2025-37926}
  - platform/x86/intel-uncore-freq: Fix missing uncore sysfs during CPU hotplug (Shouye Liu)
  - platform/x86/amd: pmc: Require at least 2.5 seconds between HW sleep cycles (Mario Limonciello)
  - iommu: Fix two issues in iommu_copy_struct_from_user() (Nicolin Chen) [Orabug: 37976741] {CVE-2025-37900}
  - iommu/vt-d: Apply quirk_iommu_igfx for 8086:0044 (QM57/QS57) (Mingcong Bai)
  - iommu/arm-smmu-v3: Fix pgsize_bit for sva domains (Balbir Singh)
  - iommu/arm-smmu-v3: Fix iommu_device_probe bug due to duplicated stream ids (Nicolin Chen)
  - iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid (Pavel Paklov) [Orabug: 37976836] {CVE-2025-37927}
  - drm: Select DRM_KMS_HELPER from DRM_DEBUG_DP_MST_TOPOLOGY_REFS (Janne Grunau)
  - drm/amdgpu: Fix offset for HDP remap in nbio v7.11 (Lijo Lazar)
  - dm: always update the array size in realloc_argv on success (Benjamin Marzinski)
  - dm-integrity: fix a warning on invalid table line (Mikulas Patocka)
  - dm-bufio: don't schedule in atomic context (Longping Wei) [Orabug: 37976844] {CVE-2025-37928}
  - x86/boot/sev: Support memory acceptance in the EFI stub under SVSM (Ard Biesheuvel)
  - wifi: brcm80211: fmac: Add error handling for brcmf_usb_dl_writeimage() (Xu Wang) [Orabug: 37977118] {CVE-2025-37990}
  - tracing: Do not take trace_event_sem in print_event_fields() (Steven Rostedt)
  - spi: tegra114: Don't fail set_cs_timing when delays are zero (Aaron Kling)
  - mmc: renesas_sdhi: Fix error handling in renesas_sdhi_probe (Ruslan Piasetskyi)
  - mm/memblock: repeat setting reserved region nid if array is doubled (Wei Yang)
  - mm/memblock: pass size instead of end to memblock_set_node() (Wei Yang)
  - irqchip/qcom-mpm: Prevent crash when trying to handle non-wake GPIOs (Stephan Gerhold) [Orabug: 37976744] {CVE-2025-37901}
  - amd-xgbe: Fix to ensure dependent features are toggled with RX checksum offload (Vishal Badole)
  - perf/x86/intel: KVM: Mask PEBS_ENABLE loaded for guest with vCPU's value. (Sean Christopherson) [Orabug: 37976874] {CVE-2025-37936}
  - perf/x86/intel: Only check the group flag for X86 leader (Kan Liang)
  - parisc: Fix double SIGFPE crash (Helge Deller) [Orabug: 37977127] {CVE-2025-37991}
  - arm64: errata: Add missing sentinels to Spectre-BHB MIDR arrays (Will Deacon) [Orabug: 37977182] {CVE-2025-37929}
  - i2c: imx-lpi2c: Fix clock count when probe defers (Clark Wang)
  - EDAC/altera: Set DDR and SDMMC interrupt mask before registration (Niravkumar L Rabara)
  - EDAC/altera: Test the correct error reg offset (Niravkumar L Rabara)
  - drm/nouveau: Fix WARN_ON in nouveau_fence_context_kill() (Philipp Stanner) [Orabug: 37976850] {CVE-2025-37930}
  - drm/fdinfo: Protect against driver unbind (Tvrtko Ursulin)
  - cpufreq: intel_pstate: Unchecked MSR aceess in legacy mode (Srinivas Pandruvada)
  - btrfs: fix COW handling in run_delalloc_nocow() (Dave Chen)
  - btrfs: adjust subpage bit start based on sectorsize (Josef Bacik) [Orabug: 37976853] {CVE-2025-37931}
  - binder: fix offset calculation in debug log (Carlos Llamas)
  - ALSA: usb-audio: Add second USB ID for Jabra Evolve 65 headset (Joachim Priesner)
  - ALSA: usb-audio: Add retry on -EPROTO from usb_set_interface() (Geoffrey D. Bennett)
  - Revert "rndis_host: Flag RNDIS modems as WWAN devices" (Christian Heusel)
  - Bluetooth: btusb: Add 13 USB device IDs for Qualcomm WCN785x (Zijun Hu)
  - Bluetooth: btusb: Add new VID/PID for WCN785x (Dorian Cruveiller)
  - Bluetooth: btusb: Add ID 0x2c7c:0x0130 for Qualcomm WCN785x (Mark Dietzer)
  - Bluetooth: btusb: Add one more ID 0x13d3:0x3623 for Qualcomm WCN785x (Zijun Hu)
  - Bluetooth: btusb: Add one more ID 0x0489:0xe0f3 for Qualcomm WCN785x (Zijun Hu)
  - Bluetooth: btusb: add Foxconn 0xe0fc for Qualcomm WCN785x (Aaron Ma)
  - x86/PCI: Export find_cap() to be used in early PCI code (Rayan Dasoriya) [Orabug: 37383447]
  - x86/quirks: Scan all busses for early PCI quirks (Rayan Dasoriya) [Orabug: 37383447]
  - x86/quirks: Add parameter to clear MSIs early on boot (Rayan Dasoriya) [Orabug: 37383447]
  - scsi: megaraid_sas: Driver version update to 07.734.00.00-rc1 (Chandrakanth Patil) [Orabug: 37877985]
  - scsi: megaraid_sas: Make most module parameters static (Dr. David Alan Gilbert) [Orabug: 37877985]
  - scsi: mpt3sas: Fix buffer overflow in mpt3sas_send_mctp_passthru_req() (Dan Carpenter) [Orabug: 37878012]
  - scsi: mpt3sas: Fix spelling mistake "receveid" -> "received" (Colin Ian King) [Orabug: 37878012]
  - scsi: mpt3sas: update driver version to 52.100.00.00 (Shivasharan S) [Orabug: 37878012]
  - scsi: mpt3sas: Send a diag reset if target reset fails (Shivasharan S) [Orabug: 37878012]
  - scsi: mpt3sas: Report driver capability as part of IOCINFO command (Shivasharan S) [Orabug: 37878012]
  - scsi: mpt3sas: Add support for MCTP Passthrough commands (Shivasharan S) [Orabug: 37878012]
  - scsi: mpt3sas: Update MPI headers to 02.00.62 version (Shivasharan S) [Orabug: 37878012]
  - scsi: mpt3sas: Fix a locking bug in an error path (Bart Van Assche) [Orabug: 37878012]
  - scsi: mpt3sas: Reduce log level of ignore_delay_remove message to KERN_INFO (Paul Menzel) [Orabug: 37878012]
  - scsi: mpt3sas: Remove unused config functions (Dr. David Alan Gilbert) [Orabug: 37878012]
  - scsi: mpt3sas: Add details to EEDPTagMode error message (Paul Menzel) [Orabug: 37878012]
  - scsi: mpt3sas: Update driver version to 51.100.00.00 (Ranjan Kumar) [Orabug: 37878012]
  - vhost-scsi: log event queue write descriptors (Dongli Zhang) [Orabug: 37883837]
  - vhost-scsi: log control queue write descriptors (Dongli Zhang) [Orabug: 37883837]
  - vhost-scsi: log I/O queue write descriptors (Dongli Zhang) [Orabug: 37883837]
  - vhost-scsi: adjust vhost_scsi_get_desc() to log vring descriptors (Dongli Zhang) [Orabug: 37883837]
  - vhost: modify vhost_log_write() for broader users (Dongli Zhang) [Orabug: 37883837]
  - uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu) [Orabug: 37899161]
  - uek-rpm: Move vmxnet3 to module-core in UEK8 (Harshit Mogalapalli) [Orabug: 37908279]
  - x86/bugs: Enabling Retbleed and SRSO mitigation can taint the kernel (Alexandre Chartre) [Orabug: 37936569]
  - x86/bhi: Do not set BHI_DIS_S in 32-bit mode (Pawan Gupta) [Orabug: 37920673]
  - x86/bpf: Add IBHF call at end of classic BPF (Daniel Sneddon) [Orabug: 37920673]
  - x86/bpf: Call branch history clearing sequence on exit (Daniel Sneddon) [Orabug: 37920673]
  - selftest/x86/bugs: Add selftests for ITS (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
  - x86/its: Align RETs in BHB clear sequence to avoid thunking (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
  - x86/its: Add support for RSB stuffing mitigation (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
  - x86/its: Add "vmexit" option to skip mitigation on some CPUs (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
  - x86/its: Enable Indirect Target Selection mitigation (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
  - x86/its: Add support for ITS-safe return thunk (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
  - x86/its: Add support for ITS-safe indirect thunk (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
  - x86/its: Enumerate Indirect Target Selection (ITS) bug (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
  - Documentation: x86/bugs/its: Add ITS documentation (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-100.28.1.el9uek]
changelog:
  - KVM: SEV: Add KVM_SEV_SNP_ENABLE_REQ_CERTS command (Michael Roth) [Orabug: 37894105]
  - KVM: Introduce KVM_EXIT_SNP_REQ_CERTS for SNP certificate-fetching (Michael Roth) [Orabug: 37894105]
  - Revert "KVM: Introduce KVM_EXIT_SNP_REQ_CERTS for SNP certificate-fetching" (Liam Merwick) [Orabug: 37894105]
  - uek-rpm: Enable SECURITY_DMESG_RESTRICT in UEK8 (Harshit Mogalapalli) [Orabug: 37867042]


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-100.28.2.el9uek]
changelog:
  - sched/eevdf: Fix se->slice being set to U64_MAX and resulting crash (Omar Sandoval) [Orabug: 37930100] {CVE-2025-37821}
  - certs: Add new Oracle Linux Driver Signing (key 1) certificate (Sherry Yang) [Orabug: 37967533]
  - Revert "block: sysfs option to change ioticks granularity" (Gulam Mohamed) [Orabug: 37921776]
  - RDS: use pin_user_pages_fast() (Stephen Brennan) [Orabug: 37968545]


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-101.31.1.el9uek]
changelog:
  - LTS version: v6.12.31 (Jack Vogel)
  - drm/gem: Internally test import_attach for imported objects (Thomas Zimmermann)
  - x86/mm/init: Handle the special case of device private pages in add_pages(), to not increase max_pfn and trigger dma_addressing_limited() bounce buffers bounce buffers (Balbir Singh)
  - i3c: master: svc: Fix implicit fallthrough in svc_i3c_master_ibi_work() (Nathan Chancellor)
  - pinctrl: tegra: Fix off by one in tegra_pinctrl_get_group() (Dan Carpenter)
  - watchdog: aspeed: fix 64-bit division (Arnd Bergmann)
  - drm/amdkfd: Correct F8_MODE for gfx950 (Amber Lin)
  - serial: sh-sci: Save and restore more registers (Geert Uytterhoeven)
  - bpf: abort verification if env->cur_state->loop_entry != NULL (Eduard Zingerman)
  - drm/amd/display: Exit idle optimizations before accessing PHY (Ovidiu Bunea)
  - kbuild: Properly disable -Wunterminated-string-initialization for clang (Nathan Chancellor)
  - Fix mis-uses of 'cc-option' for warning disablement (Linus Torvalds)
  - gcc-15: disable '-Wunterminated-string-initialization' entirely for now (Linus Torvalds)
  - gcc-15: make 'unterminated string initialization' just a warning (Linus Torvalds)
  - err.h: move IOMEM_ERR_PTR() to err.h (Raag Jadav)
  - spi: spi-fsl-dspi: Reset SR flags before sending a new message (Larisa Grigore)
  - spi: spi-fsl-dspi: Halt the module after a new message transfer (Bogdan-Gabriel Roman)
  - spi: spi-fsl-dspi: restrict register range for regmap access (Larisa Grigore)
  - spi: use container_of_cont() for to_spi_device() (Greg Kroah-Hartman)
  - platform/x86: think-lmi: Fix attribute name usage for non-compliant items (Mark Pearson)
  - ksmbd: fix stream write failure (Namjae Jeon)
  - Revert "arm64: dts: allwinner: h6: Use RSB for AXP805 PMIC connection" (Jernej Skrabec)
  - Bluetooth: btmtksdio: Do close if SDIO card removed without close (Chris Lu)
  - Bluetooth: btmtksdio: Check function enabled before doing close (Chris Lu)
  - nilfs2: fix deadlock warnings caused by lock dependency in init_nilfs() (Ryusuke Konishi)
  - mm: mmap: map MAP_STACK to VM_NOHUGEPAGE only if THP is enabled (Ignacio Moreno Gonzalez)
  - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Tianyang Zhang)
  - memcg: always call cond_resched() after fn() (Breno Leitao)
  - highmem: add folio_test_partial_kmap() (Matthew Wilcox)
  - Input: xpad - add more controllers (Vicki Pfau)
  - Revert "drm/amd: Keep display off while going into S4" (Mario Limonciello)
  - smb: client: Reset all search buffer pointers when releasing buffer (Zhaolong Wang)
  - arm64: dts: marvell: uDPU: define pinctrl state for alarm LEDs (Gabor Juhos)
  - smb: client: Fix use-after-free in cifs_fill_dirent (Zhaolong Wang) [Orabug: 38094970] {CVE-2025-38051}
  - drm/edid: fixed the bug that hdr metadata was not reset (Feijuan Li)
  - thermal: intel: x86_pkg_temp_thermal: Fix bogus trip temperature (Zhang Rui)
  - platform/x86: dell-wmi-sysman: Avoid buffer overflow in current_password_store() (Vladimir Moskovkin) [Orabug: 38095141] {CVE-2025-38077}
  - pmdomain: core: Fix error checking in genpd_dev_pm_attach_by_id() (Dan Carpenter)
  - pmdomain: renesas: rcar: Remove obsolete nullify checks (Geert Uytterhoeven)
  - vmxnet3: update MTU after device quiesce (Ronak Doshi)
  - net: dsa: microchip: linearize skb for tail-tagging switches (Jakob Unterwurzacher)
  - can: kvaser_pciefd: Fix echo_skb race (Axel Forsman)
  - can: kvaser_pciefd: Continue parsing DMA buf after dropped RX (Axel Forsman)
  - llc: fix data loss when reading from a socket in llc_ui_recvmsg() (Gavrilov Ilia)
  - ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14ASP10 (Ed Burcher)
  - ALSA: pcm: Fix race of buffer access at PCM OSS layer (Takashi Iwai) [Orabug: 38095145] {CVE-2025-38078}
  - ASoC: SOF: ipc4-pcm: Delay reporting is only supported for playback direction (Peter Ujfalusi)
  - ASoc: SOF: topology: connect DAI to a single DAI link (Kai Vehmanen)
  - ASoC: SOF: Intel: hda-bus: Use PIO mode on ACE2+ platforms (Peter Ujfalusi)
  - ASoC: SOF: ipc4-control: Use SOF_CTRL_CMD_BINARY as numid for bytes_ext (Peter Ujfalusi)
  - can: bcm: add missing rcu read protection for procfs content (Oliver Hartkopp) [Orabug: 38049369] {CVE-2025-38003}
  - can: bcm: add locking for bcm_op runtime updates (Oliver Hartkopp) [Orabug: 38049374] {CVE-2025-38004}
  - can: slcan: allow reception of short error messages (Carlos Sanchez)
  - padata: do not leak refcount in reorder_work (Dominik Grzegorzek) [Orabug: 38094842] {CVE-2025-38031}
  - crypto: algif_hash - fix double free in hash_accept (Ivan Pravdin) [Orabug: 38095153] {CVE-2025-38079}
  - clk: s2mps11: initialise clk_hw_onecell_data::num before accessing ::hws[] in probe() (André Draszik)
  - octeontx2-af: Fix APR entry mapping based on APR_LMT_CFG (Geetha Sowjanya)
  - octeontx2-af: Set LMT_ENA bit for APR table entries (Subbaraya Sundeep)
  - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (Wang Liang) [Orabug: 38094978] {CVE-2025-38052}
  - octeontx2-pf: Add AF_XDP non-zero copy support (Suman Ghosh)
  - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (Cong Wang) [Orabug: 38049357] {CVE-2025-38000}
  - idpf: fix idpf_vport_splitq_napi_poll() (Eric Dumazet)
  - io_uring: fix overflow resched cqe reordering (Pavel Begunkov)
  - net: lan743x: Restore SGMII CTRL register on resume (Thangaraj Samynathan)
  - net: dwmac-sun8i: Use parsed internal PHY address instead of 1 (Paul Kocialkowski)
  - pinctrl: qcom: switch to devm_register_sys_off_handler() (Dmitry Baryshkov)
  - loop: don't require ->write_iter for writable files in loop_configure (Christoph Hellwig)
  - idpf: fix null-ptr-deref in idpf_features_check (Pavan Kumar Linga) [Orabug: 38094982] {CVE-2025-38053}
  - ice: Fix LACP bonds without SRIOV environment (Dave Ertman)
  - ice: fix vf->num_mac count with port representors (Jacob Keller)
  - bridge: netfilter: Fix forwarding of fragmented packets (Ido Schimmel)
  - ptp: ocp: Limit signal/freq counts in summary output functions (Sagi Maimon) [Orabug: 38094984] {CVE-2025-38054}
  - Bluetooth: btusb: use skb_pull to avoid unsafe access in QCA dump handling (En-Wei Wu)
  - Bluetooth: L2CAP: Fix not checking l2cap_chan security level (Luiz Augusto von Dentz)
  - perf/x86/intel: Fix segfault with PEBS-via-PT with sample_freq (Adrian Hunter) [Orabug: 38094988] {CVE-2025-38055}
  - irqchip/riscv-imsic: Start local sync timer on correct CPU (Andrew Bresticker)
  - ASoC: SOF: Intel: hda: Fix UAF when reloading module (Tavian Barnes) [Orabug: 38094991] {CVE-2025-38056}
  - devres: Introduce devm_kmemdup_array() (Raag Jadav)
  - driver core: Split devres APIs to device/devres.h (Andy Shevchenko)
  - dmaengine: fsl-edma: Fix return code for unhandled interrupts (Stefan Wahren)
  - dmaengine: idxd: Fix ->poll() return value (Dave Jiang)
  - xfrm: Sanitize marks before insert (Paul Chaignon)
  - clk: sunxi-ng: d1: Add missing divider for MMC mod clocks (Andre Przywara)
  - remoteproc: qcom_wcnss: Fix on platforms without fallback regulators (Matti Lehtimäki)
  - kernel/fork: only call untrack_pfn_clear() on VMAs duplicated for fork() (David Hildenbrand)
  - x86/sev: Fix operator precedence in GHCB_MSR_VMPL_REQ_LEVEL macro (Seongman Lee)
  - dmaengine: idxd: Fix allowing write() from different address spaces (Vinicius Costa Gomes)
  - xfrm: Fix UDP GRO handling for some corner cases (Tobias Brunner)
  - espintcp: remove encap socket caching to avoid reference leak (Sabrina Dubroca)
  - espintcp: fix skb leaks (Sabrina Dubroca) [Orabug: 38094993] {CVE-2025-38057}
  - soundwire: bus: Fix race on the creation of the IRQ domain (Charles Keepax)
  - __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock (Al Viro) [Orabug: 38095000] {CVE-2025-38058}
  - drm/amd/display: Call FP Protect Before Mode Programming/Mode Support (Austin Zheng)
  - xenbus: Allow PVH dom0 a non-local xenstore (Jason Andryuk)
  - x86/Kconfig: make CFI_AUTO_DEFAULT depend on !RUST or Rust >= 1.88 (Paweł Anikiel) [Orabug: 38094847] {CVE-2025-38033}
  - wifi: iwlwifi: add support for Killer on MTL (Johannes Berg)
  - block: only update request sector if needed (Johannes Thumshirn)
  - tools: ynl-gen: validate 0 len strings from kernel (David Wei)
  - btrfs: avoid NULL pointer dereference if no valid csum tree (Qu Wenruo) [Orabug: 38095010] {CVE-2025-38059}
  - btrfs: handle empty eb->folios in num_extent_folios() (Boris Burkov)
  - btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref (Goldwyn Rodrigues) [Orabug: 38094856] {CVE-2025-38034}
  - btrfs: compression: adjust cb->compressed_folios allocation type (Kees Cook)
  - ASoC: intel/sdw_utils: Add volume limit to cs42l43 speakers (Stefan Binding)
  - cifs: Fix changing times and read-only attr over SMB1 smb_set_file_info() function (Pali Rohár)
  - cifs: Fix and improve cifs_query_path_info() and cifs_query_file_info() (Pali Rohár)
  - io_uring/fdinfo: annotate racy sq/cq head/tail reads (Jens Axboe)
  - nvmet-tcp: don't restore null sk_state_change (Alistair Francis) [Orabug: 38094863] {CVE-2025-38035}
  - ALSA: usb-audio: Fix duplicated name in MIDI substream names (Takashi Iwai)
  - nvme-pci: add quirks for WDC Blue SN550 15b7:5009 (Guan Wentao)
  - nvme-pci: add quirks for device 126f:1001 (Guan Wentao)
  - ALSA: hda/realtek: Add quirk for HP Spectre x360 15-df1xxx (Takashi Iwai)
  - ASoC: Intel: bytcr_rt5640: Add DMI quirk for Acer Aspire SW3-013 (Takashi Iwai)
  - ASoC: cs42l43: Disable headphone clamps during type detection (Charles Keepax)
  - platform/x86: ideapad-laptop: add support for some new buttons (Gašper Nemgar)
  - platform/x86: asus-wmi: Disable OOBE state after resume from hibernation (Pavel Nikulin)
  - platform/x86/intel: hid: Add Pantherlake support (Saranya Gopal)
  - smb: server: smb2pdu: check return value of xa_store() (Salah Triki)
  - pinctrl: meson: define the pull up/down resistor value as 60 kOhm (Martin Blumenstingl)
  - book3s64/radix: Fix compile errors when CONFIG_ARCH_WANT_OPTIMIZE_DAX_VMEMMAP=n (Ritesh Harjani)
  - ASoC: imx-card: Adjust over allocation of memory in imx_card_parse_of() (Chenyuan Yang)
  - drm: Add valid clones check (Jessica Zhang)
  - drm/panel-edp: Add Starry 116KHD024006 (Douglas Anderson)
  - drm/buddy: fix issue that force_merge cannot free all roots (Lin Cao)
  - drm/atomic: clarify the rules around drm_atomic_state->allow_modeset (Simona Vetter)
  - drm/xe: Reject BO eviction if BO is bound to current VM (Oak Zeng)
  - drm/xe/sa: Always call drm_suballoc_manager_fini() (Michal Wajdeczko)
  - wifi: rtw89: coex: Separated Wi-Fi connecting event from Wi-Fi scan event (Ching-Te Ku)
  - drm/xe: Do not attempt to bootstrap VF in execlists mode (Maarten Lankhorst)
  - drm/xe: Move suballocator init to after display init (Maarten Lankhorst)
  - wifi: ath11k: Use dma_alloc_noncoherent for rx_tid buffer allocation (P Praneesh)
  - drm/nouveau: fix the broken marco GSP_MSG_MAX_SIZE (Zhi Wang)
  - drm: bridge: adv7511: fill stream capabilities (Olivier Moysan)
  - wifi: ath12k: Fix end offset bit definition in monitor ring descriptor (P Praneesh)
  - wifi: ath12k: Fetch regdb.bin file from board-2.bin (Aaradhana Sahu)
  - wifi: ath9k: return by of_get_mac_address (Rosen Penev)
  - drm/xe/pf: Reset GuC VF config when unprovisioning critical resource (Michal Wajdeczko)
  - accel/qaic: Mask out SR-IOV PCI resources (Youssef Samir)
  - wifi: ath12k: fix ath12k_hal_tx_cmd_ext_desc_setup() info1 override (Nicolas Escande)
  - regulator: ad5398: Add device tree support (Isaac Scott)
  - spi: zynqmp-gqspi: Always acknowledge interrupts (Sean Anderson)
  - wifi: rtw89: add wiphy_lock() to work that isn't held wiphy_lock() yet (Ping-Ke Shih)
  - wifi: rtw88: Don't use static local variable in rtw8822b_set_tx_power_index_by_rate (Bitterblue Smith)
  - wifi: rtl8xxxu: retry firmware download on error (Soeren Moch)
  - clk: renesas: rzg2l-cpg: Refactor Runtime PM clock validation (Lad Prabhakar)
  - perf/amd/ibs: Fix ->config to sample period calculation for OP PMU (Ravi Bangoria)
  - perf/amd/ibs: Fix perf_ibs_op.cnt_mask for CurCnt (Ravi Bangoria)
  - firmware: arm_scmi: Relax duplicate name constraint across protocol ids (Sudeep Holla)
  - bpftool: Fix readlink usage in get_fd_type (Viktor Malik)
  - bpf: Use kallsyms to find the function name of a struct_ops's stub function (Martin Kafai Lau)
  - drm/ast: Find VBIOS mode from regular display size (Thomas Zimmermann)
  - dm vdo: use a short static string for thread name prefix (Matthew Sakai)
  - dm vdo indexer: prevent unterminated string warning (Chung Chung)
  - irqchip/riscv-aplic: Add support for hart indexes (Vladimir Kondratiev)
  - ASoC: rt722-sdca: Add some missing readable registers (Charles Keepax)
  - ASoC: codecs: pcm3168a: Allow for 24-bit in provider mode (Cezary Rojewski)
  - arm64: zynqmp: add clock-output-names property in clock nodes (Naman Trivedi Manojbhai)
  - HID: usbkbd: Fix the bit shift number for LED_KANA (Junan)
  - wifi: ath12k: Avoid napi_sync() before napi_enable() (Avula Sri Charan)
  - scsi: st: Restore some drive settings after reset (Kai Mäkisara)
  - net/mana: fix warning in the writer of client oob (Konstantin Taranov)
  - drm/xe/relay: Don't use GFP_KERNEL for new transactions (Michal Wajdeczko)
  - ice: count combined queues using Rx/Tx count (Michal Swiatkowski)
  - perf: Avoid the read if the count is already updated (Peter Zijlstra)
  - rcu: fix header guard for rcu_all_qs() (Ankur Arora)
  - rcu: handle unstable rdp in rcu_read_unlock_strict() (Ankur Arora)
  - rcu: handle quiescent states for PREEMPT_RCU=n, PREEMPT_COUNT=y (Ankur Arora)
  - ice: treat dyn_allowed only as suggestion (Michal Swiatkowski)
  - ice: init flow director before RDMA (Michal Swiatkowski)
  - bridge: mdb: Allow replace of a host-joined group (Petr Machata)
  - net: flush_backlog() small changes (Eric Dumazet)
  - r8169: don't scan PHY addresses > 0 (Heiner Kallweit)
  - ipv4: ip_gre: Fix set but not used warning in ipgre_err() if IPv4-only (Geert Uytterhoeven)
  - vxlan: Annotate FDB data races (Ido Schimmel) [Orabug: 38094879] {CVE-2025-38037}
  - cpufreq: amd-pstate: Remove unnecessary driver_lock in set_boost (Dhananjay Ugwekar) [Orabug: 38094888] {CVE-2025-38038}
  - tools: ynl-gen: don't output external constants (Jakub Kicinski)
  - eth: fbnic: set IFF_UNICAST_FLT to avoid enabling promiscuous mode when adding unicast addrs (Alexander Duyck)
  - drm/rockchip: vop2: Improve display modes handling on RK3588 HDMI0 (Cristian Ciocaltea)
  - media: qcom: camss: Add default case in vfe_src_pad_code (Depeng Shao)
  - media: qcom: camss: csid: Only add TPG v4l2 ctrl if TPG hardware is available (Depeng Shao)
  - f2fs: introduce f2fs_base_attr for global sysfs entries (Jaegeuk Kim)
  - hwmon: (xgene-hwmon) use appropriate type for the latency value (Andrey Vatoropin)
  - tools/power turbostat: Clustered Uncore MHz counters should honor show/hide options (Len Brown)
  - net: page_pool: avoid false positive warning if NAPI was never added (Jakub Kicinski)
  - clk: qcom: camcc-sm8250: Use clk_rcg2_shared_ops for some RCGs (Jordan Crouse)
  - wifi: rtw89: call power_on ahead before selecting firmware (Ping-Ke Shih)
  - wifi: rtw89: fw: validate multi-firmware header before accessing (Ping-Ke Shih)
  - wifi: rtw89: fw: validate multi-firmware header before getting its size (Ping-Ke Shih)
  - wifi: rtw89: coex: Assign value over than 0 to avoid firmware timer hang (Ching-Te Ku)
  - wifi: rtw88: Fix __rtw_download_firmware() for RTL8814AU (Bitterblue Smith)
  - wifi: rtw88: Fix download_firmware_validate() for RTL8814AU (Bitterblue Smith)
  - ext4: remove writable userspace mappings before truncating page cache (Zhang Yi)
  - ext4: don't write back data before punch hole in nojournal mode (Zhang Yi)
  - leds: trigger: netdev: Configure LED blink interval for HW offload (Marek Vasut)
  - pstore: Change kmsg_bytes storage size to u32 (Kees Cook)
  - iio: adc: ad7944: don't use storagebits for sizing (David Lechner)
  - r8152: add vendor/device ID pair for Dell Alienware AW1022z (Aleksander Jan Bajkowski)
  - ip: fib_rules: Fetch net from fib_rule in fib[46]_rule_configure(). (Kuniyuki Iwashima)
  - arch/powerpc/perf: Check the instruction type before creating sample with perf_mem_data_src (Athira Rajeev)
  - powerpc/pseries/iommu: create DDW for devices with DMA mask less than 64-bits (Gaurav Batra)
  - powerpc/pseries/iommu: memory notifier incorrectly adds TCEs for pmemory (Gaurav Batra)
  - net: fec: Refactor MAC reset to function (Csókás Bence)
  - wifi: mac80211: set ieee80211_prep_tx_info::link_id upon Auth Rx (Emmanuel Grumbach)
  - wifi: mac80211: remove misplaced drv_mgd_complete_tx() call (Johannes Berg)
  - wifi: mac80211: don't unconditionally call drv_mgd_complete_tx() (Johannes Berg)
  - wifi: iwlwifi: don't warn during reprobe (Miri Korenblit)
  - wifi: iwlwifi: use correct IMR dump variable (Johannes Berg)
  - mptcp: pm: userspace: flags: clearer msg if no remote addr (Matthieu Baerts)
  - wifi: ath12k: fix the ampdu id fetch in the HAL_RX_MPDU_START TLV (P Praneesh)
  - xfrm: prevent high SEQ input in non-ESN mode (Leon Romanovsky)
  - drm/v3d: Add clock handling (Stefan Wahren)
  - net/mlx5e: reduce the max log mpwrq sz for ECPF and reps (William Tu)
  - net/mlx5e: reduce rep rxq depth to 256 for ECPF (William Tu)
  - net/mlx5e: set the tx_queue_len for pfifo_fast (William Tu)
  - net/mlx5: Extend Ethtool loopback selftest to support non-linear SKB (Alexei Lazar)
  - net/mlx5: XDP, Enable TX side XDP multi-buffer support (Alexei Lazar)
  - scsi: target: spc: Fix loop traversal in spc_rsoc_get_descr() (Chaohai Chen)
  - drm/amd/display/dm: drop hw_support check in amdgpu_dm_i2c_xfer() (Alex Deucher)
  - drm/amdgpu: enlarge the VBIOS binary size limit (Morris Zhang)
  - drm/amdgpu: Use active umc info from discovery (Lijo Lazar)
  - drm/amd/display: Populate register address for dentist for dcn401 (Dillon Varone)
  - drm/amd/display: Use Nominal vBlank If Provided Instead Of Capping It (Austin Zheng)
  - drm/amd/display: Increase block_sequence array size (Joshua Aberback) [Orabug: 38095164] {CVE-2025-38080}
  - drm/amd/display: Initial psr_version with correct setting (Tom Chung)
  - drm/amd/display: Update CR AUX RD interval interpretation (George Shen)
  - Revert "drm/amd/display: Exit idle optimizations before attempt to access PHY" (Brandon Syu)
  - drm/amd/display: Support multiple options during psr entry. (Martin Tsai)
  - drm/amd/pm: Skip P2S load for SMU v13.0.12 (Asad Kamal)
  - drm/amdgpu: reset psp->cmd to NULL after releasing the buffer (Jiang Liu)
  - drm/amd/display: Don't try AUX transactions on disconnected link (Ilya Bakoulin)
  - drm/amd/display: pass calculated dram_speed_mts to dml2 (Charlene Liu)
  - drm/amdgpu: Set snoop bit for SDMA for MI series (Harish Kasiviswanathan)
  - drm/amdkfd: fix missing L2 cache info in topology (Eric Huang)
  - drm/amdgpu/mes11: fix set_hw_resources_1 calculation (Alex Deucher)
  - net: stmmac: dwmac-loongson: Set correct {tx,rx}_fifo_size (Huacai Chen)
  - soundwire: cadence_master: set frame shape and divider based on actual clk freq (Bard Liao)
  - soundwire: amd: change the soundwire wake enable/disable sequence (Vijendar Mukunda)
  - phy: exynos5-usbdrd: fix EDS distribution tuning (gs101) (André Draszik)
  - phy: core: don't require set_mode() callback for phy_get_mode() to work (Dmitry Baryshkov)
  - phy: phy-rockchip-samsung-hdptx: Swap the definitions of LCPLL_REF and ROPLL_REF (Damon Ding)
  - pinctrl: renesas: rzg2l: Add suspend/resume support for pull up/down (Claudiu Beznea)
  - serial: sh-sci: Update the suspend/resume support (Claudiu Beznea)
  - sched: Reduce the default slice to avoid tasks getting an extra tick (Zihan Zhou)
  - x86/traps: Cleanup and robustify decode_bug() (Peter Zijlstra)
  - x86/ibt: Handle FineIBT in handle_cfi_failure() (Peter Zijlstra)
  - drm/xe/debugfs: Add missing xe_pm_runtime_put in wedge_mode_set (Shuicheng Lin)
  - drm/xe/debugfs: fixed the return value of wedged_mode_set (Xin Wang)
  - clk: qcom: clk-alpha-pll: Do not use random stack value for recalc rate (Krzysztof Kozlowski)
  - clk: qcom: ipq5018: allow it to be bulid on arm32 (Karl Chan)
  - drm/xe: Fix xe_tile_init_noalloc() error propagation (Lucas De Marchi)
  - drm/xe: Stop ignoring errors from xe_ttm_stolen_mgr_init() (Lucas De Marchi)
  - net/mlx4_core: Avoid impossible mlx4_db_alloc() order value (Kees Cook)
  - media: v4l: Memset argument to 0 before calling get_mbus_config pad op (Sakari Ailus)
  - media: i2c: imx219: Correct the minimum vblanking value (David Plowman)
  - kunit: tool: Use qboot on QEMU x86_64 (Brendan Jackman)
  - smack: Revert "smackfs: Added check catlen" (Konstantin Andreev)
  - smack: recognize ipv4 CIPSO w/o categories (Konstantin Andreev)
  - pinctrl: devicetree: do not goto err when probing hogs in pinctrl_dt_to_map (Valentin Caron)
  - ASoC: soc-dai: check return value at snd_soc_dai_set_tdm_slot() (Kuninori Morimoto)
  - ASoC: tas2764: Power up/down amp on mute ops (Hector Martin)
  - ASoC: tas2764: Mark SW_RESET as volatile (Hector Martin)
  - ASoC: tas2764: Add reg defaults for TAS2764_INT_CLK_CFG (Hector Martin)
  - ASoC: ops: Enforce platform maximum on initial value (Martin Povišer)
  - firmware: xilinx: Dont send linux address to get fpga config get status (Siva Durga Prasad Paladugu)
  - firmware: arm_ffa: Handle the presence of host partition in the partition info (Sudeep Holla)
  - firmware: arm_ffa: Reject higher major version as incompatible (Sudeep Holla)
  - net/mlx5: Apply rate-limiting to high temperature warning (Shahar Shitrit)
  - net/mlx5: Modify LSB bitmask in temperature event to include only the first bit (Shahar Shitrit)
  - media: test-drivers: vivid: don't call schedule in loop (Hans Verkuil)
  - irqchip/riscv-imsic: Set irq_set_affinity() for IMSIC base (Andrew Jones)
  - hrtimers: Replace hrtimer_clock_to_base_table with switch-case (Andy Shevchenko)
  - vxlan: Join / leave MC group after remote changes (Petr Machata)
  - ACPI: HED: Always initialize before evged (Xiaofei Tan)
  - PCI: Fix old_size lower bound in calculate_iosize() too (Ilpo Järvinen)
  - eth: mlx4: don't try to complete XDP frames in netpoll (Jakub Kicinski)
  - bpf: copy_verifier_state() should copy 'loop_entry' field (Eduard Zingerman) [Orabug: 38095018] {CVE-2025-38060}
  - bpf: don't do clean_live_states when state->loop_entry->branches > 0 (Eduard Zingerman)
  - can: c_can: Use of_property_present() to test existence of DT property (Krzysztof Kozlowski)
  - pmdomain: imx: gpcv2: use proper helper for property detection (Ahmad Fatoum)
  - RDMA/core: Fix best page size finding when it can cross SG entries (Michael Margolin)
  - serial: mctrl_gpio: split disable_ms into sync and no_sync APIs (Alexis Lothoré) [Orabug: 38094901] {CVE-2025-38040}
  - drm/amd/display: Don't treat wb connector as physical in create_validate_stream_for_sink (Harry Wentland)
  - Revert "drm/amd/display: Request HW cursor on DCN3.2 with SubVP" (Leo Zeng)
  - drm/amd/display: Read LTTPR ALPM caps during link cap retrieval (George Shen)
  - drm/amd/display: Fix BT2020 YCbCr limited/full range input (Ilya Bakoulin)
  - drm/amd/display: Guard against setting dispclk low when active (Nicholas Kazlauskas)
  - drm/amd/display: Add support for disconnected eDP streams (Harry Vanzylldejong)
  - drm/amd/pm: Fetch current power limit from PMFW (Lijo Lazar)
  - irqchip/riscv-imsic: Separate next and previous pointers in IMSIC vector (Anup Patel)
  - eeprom: ee1004: Check chip before probing (Eddie James)
  - mfd: axp20x: AXP717: Add AXP717_TS_PIN_CFG to writeable regs (Chris Morgan)
  - i3c: master: svc: Flush FIFO before sending Dynamic Address Assignment(DAA) (Frank Li)
  - EDAC/ie31200: work around false positive build warning (Arnd Bergmann)
  - power: supply: axp20x_battery: Update temp sensor for AXP717 from device tree (Chris Morgan)
  - net: pktgen: fix access outside of user given buffer in pktgen_thread_write() (Peter Seiderer) [Orabug: 38095024] {CVE-2025-38061}
  - wifi: rtw89: 8922a: fix incorrect STA-ID in EHT MU PPDU (Kuan-Chung Chen)
  - wifi: rtw89: fw: add blacklist to avoid obsolete secure firmware (Ping-Ke Shih)
  - wifi: rtw89: fw: get sb_sel_ver via get_unaligned_le32() (Ping-Ke Shih)
  - wifi: rtw89: fw: propagate error code from rtw89_h2c_tx() (Ping-Ke Shih)
  - wifi: rtw88: Fix rtw_desc_to_mcsrate() to handle MCS16-31 (Bitterblue Smith)
  - wifi: rtw88: Fix rtw_init_ht_cap() for RTL8814AU (Bitterblue Smith)
  - wifi: rtw88: Fix rtw_init_vht_cap() for RTL8814AU (Bitterblue Smith)
  - PCI: epf-mhi: Update device ID for SA8775P (Mrinmay Sarkar)
  - clocksource: mips-gic-timer: Enable counter when CPUs start (Paul Burton)
  - MIPS: pm-cps: Use per-CPU variables as per-CPU, not per-core (Paul Burton)
  - genirq/msi: Store the IOMMU IOVA directly in msi_desc instead of iommu_cookie (Jason Gunthorpe) [Orabug: 38095031] {CVE-2025-38062}
  - x86/locking: Use ALT_OUTPUT_SP() for percpu_{,try_}cmpxchg{64,128}_op() (Uros Bizjak)
  - drm/amdgpu: remove all KFD fences from the BO on release (Christian König)
  - MIPS: Use arch specific syscall name match function (Bibo Mao)
  - drm/xe/oa: Ensure that polled read returns latest data (Umesh Nerlige Ramappa)
  - net: ipv6: Init tunnel link-netns before registering dev (Xiao Liang)
  - crypto: skcipher - Zap type in crypto_alloc_sync_skcipher (Herbert Xu)
  - crypto: ahash - Set default reqsize from ahash_alg (Herbert Xu)
  - x86/kaslr: Reduce KASLR entropy on most x86 systems (Balbir Singh)
  - net/mlx5: Change POOL_NEXT_SIZE define value and make it global (Patrisious Haddad)
  - scsi: scsi_debug: First fixes for tapes (Kai Mäkisara)
  - dm: fix unconditional IO throttle caused by REQ_PREFLUSH (Jinliang Zheng) [Orabug: 38095038] {CVE-2025-38063}
  - libbpf: Fix out-of-bound read (Nandakumar Edamana)
  - loop: check in LO_FLAGS_DIRECT_IO in loop_default_blocksize (Christoph Hellwig)
  - net/mlx5e: Add correct match to check IPSec syndromes for switchdev mode (Jianbo Liu)
  - media: tc358746: improve calculation of the D-PHY timing registers (Matthias Fend)
  - media: adv7180: Disable test-pattern control on adv7180 (Niklas Söderlund)
  - cpuidle: menu: Avoid discarding useful information (Rafael J. Wysocki)
  - vdpa/mlx5: Fix mlx5_vdpa_get_config() endianness on big-endian machines (Konstantin Shkolnyy)
  - x86/nmi: Add an emergency handler in nmi_desc & use it in nmi_shootdown_cpus() (Waiman Long)
  - ASoC: mediatek: mt8188: Add reference for dmic clocks (Nícolas F R A Prado)
  - ASoC: mediatek: mt8188: Treat DMIC_GAINx_CUR as non-volatile (Nícolas F R A Prado)
  - drm/amd/display: Fix mismatch type comparison (Navid Assadian)
  - drm/amd/display: fix dcn4x init failed (Charlene Liu)
  - drm/amd/display: handle max_downscale_src_width fail check (Yihan Zhu)
  - x86/build: Fix broken copy command in genimage.sh when making isoimage (Nir Lichtman)
  - Octeontx2-af: RPM: Register driver with PCI subsys IDs (Hariprasad Kelam)
  - bpf: Search and add kfuncs in struct_ops prologue and epilogue (Amery Hung)
  - soc: ti: k3-socinfo: Do not use syscon helper to build regmap (Andrew Davis)
  - wifi: ath12k: Improve BSS discovery with hidden SSID in 6 GHz band (Ramasamy Kaliappan)
  - bonding: report duplicate MAC address in all situations (Hangbin Liu)
  - net: xgene-v2: remove incorrect ACPI_PTR annotation (Arnd Bergmann)
  - net: ethernet: mtk_ppe_offload: Allow QinQ, double ETH_P_8021Q only (Eric Woudstra)
  - leds: pwm-multicolor: Add check for fwnode_property_read_u32 (Yuanjun Gong)
  - drm/xe: xe_gen_wa_oob: replace program_invocation_short_name (Daniel Gomez)
  - drm/amdkfd: KFD release_work possible circular locking (Philip Yang)
  - pinctrl: sophgo: avoid to modify untouched bit when setting cv1800 pinconf (Inochi Amaoto)
  - selftests/net: have `gro.sh -t` return a correct exit code (Kevin Krakauer)
  - net/mlx5: Avoid report two health errors on same syndrome (Moshe Shemesh)
  - drm/xe/pf: Create a link between PF and VF devices (K V P Satyanarayana)
  - drm/xe/vf: Retry sending MMIO request to GUC on timeout error (K V P Satyanarayana)
  - firmware: arm_ffa: Set dma_mask for ffa devices (Viresh Kumar) [Orabug: 38094925] {CVE-2025-38043}
  - PCI: brcmstb: Add a softdep to MIP MSI-X driver (Stanimir Varbanov)
  - PCI: brcmstb: Expand inbound window size up to 64GB (Stanimir Varbanov)
  - wifi: ath12k: Report proper tx completion status to mac80211 (Vinith Kumar R)
  - soc: apple: rtkit: Implement OSLog buffers properly (Hector Martin)
  - soc: apple: rtkit: Use high prio work queue (Janne Grunau)
  - perf: arm_pmuv3: Call kvm_vcpu_pmu_resync_el0() before enabling counters (Rob Herring)
  - fpga: altera-cvp: Increase credit timeout (Kuhanh Murugasen Krishnan)
  - drm/mediatek: mtk_dpi: Add checks for reg_h_fre_con existence (AngeloGioacchino Del Regno)
  - ARM: at91: pm: fix at91_suspend_finish for ZQ calibration (Li Bin)
  - hwmon: (gpio-fan) Add missing mutex locks (Alexander Stein)
  - x86/bugs: Make spectre user default depend on MITIGATION_SPECTRE_V2 (Breno Leitao)
  - clk: imx8mp: inform CCF of maximum frequency of clocks (Ahmad Fatoum)
  - media: uvcvideo: Handle uvc menu translation inside uvc_get_le_value (Ricardo Ribalda)
  - media: uvcvideo: Add sanity check to uvc_ioctl_xu_ctrl_map (Ricardo Ribalda)
  - ublk: complete command synchronously on error (Caleb Sander)
  - block: mark bounce buffering as incompatible with integrity (Christoph Hellwig)
  - drm/rockchip: vop2: Add uv swap for cluster window (Andy Yan)
  - ipv4: fib: Move fib_valid_key_len() to rtm_to_fib_config(). (Kuniyuki Iwashima)
  - scsi: logging: Fix scsi_logging_level bounds (Nicolas Bouchinet)
  - ALSA: hda/realtek: Enable PC beep passthrough for HP EliteBook 855 G7 (Maciej S. Szmigiero)
  - perf/hw_breakpoint: Return EOPNOTSUPP for unsupported breakpoint type (Saket Kumar Bhaskar)
  - net: pktgen: fix mpls maximum labels list parsing (Peter Seiderer)
  - media: imx335: Set vblank immediately (Paul Elder)
  - iommufd: Disallow allocating nested parent domain with fault ID (Yi Liu)
  - ublk: enforce ublks_max only for unprivileged devices (Uday Shankar)
  - dpll: Add an assertion to check freq_supported_num (Jiasheng Jiang)
  - net: phy: nxp-c45-tja11xx: add match_phy_device to TJA1103/TJA1104 (Andrei Botila)
  - net: ethernet: ti: cpsw_new: populate netdev of_node (Alexander Sverdlin)
  - rcu: Fix get_state_synchronize_rcu_full() GP-start detection (Paul E. McKenney)
  - pinctrl: bcm281xx: Use "unsigned int" instead of bare "unsigned" (Artur Weber)
  - media: cx231xx: set device_caps for 417 (Hans Verkuil) [Orabug: 38094934] {CVE-2025-38044}
  - perf/core: Clean up perf_try_init_event() (Peter Zijlstra)
  - drm/amd/display: Request HW cursor on DCN3.2 with SubVP (Aric Cyr)
  - drm/amd/display: Fix p-state type when p-state is unsupported (Dillon Varone)
  - drm/amd/display: Fix DMUB reset sequence for DCN401 (Dillon Varone)
  - drm/amd/display: Skip checking FRL_MODE bit for PCON BW determination (George Shen)
  - drm/amd/display: Ensure DMCUB idle before reset on DCN31/DCN35 (Nicholas Kazlauskas)
  - drm/amdgpu: Do not program AGP BAR regs under SRIOV in gfxhub_v1_0.c (Victor Lu)
  - remoteproc: qcom_wcnss: Handle platforms with only single power domain (Matti Lehtimäki)
  - blk-throttle: don't take carryover for prioritized processing of metadata (Ming Lei)
  - net: phylink: use pl->link_interface in phylink_expects_phy() (Choong Yong Liang)
  - drm/gem: Test for imported GEM buffers with helper (Thomas Zimmermann)
  - orangefs: Do not truncate file size (Matthew Wilcox) [Orabug: 38095056] {CVE-2025-38065}
  - soc: mediatek: mtk-mutex: Add DPI1 SOF/EOF to MT8188 mutex tables (AngeloGioacchino Del Regno)
  - dm cache: prevent BUG_ON by blocking retries on failed device resumes (Ming-Hung Tsai) [Orabug: 38095063] {CVE-2025-38066}
  - usb: xhci: set page size to the xHCI-supported size (Niklas Neronin)
  - media: c8sectpfe: Call of_node_put(i2c_bus) only once in c8sectpfe_probe() (Markus Elfring)
  - ARM: tegra: Switch DSI-B clock parent to PLLD on Tegra114 (Svyatoslav Ryhel)
  - soc: samsung: include linux/array_size.h where needed (Arnd Bergmann)
  - drm/xe: Retry BO allocation (Matthew Brost)
  - drm/xe: Nuke VM's mapping upon close (Matthew Brost)
  - ieee802154: ca8210: Use proper setters and getters for bitwise types (Andy Shevchenko)
  - rtc: ds1307: stop disabling alarms on probe (Alexandre Belloni)
  - tcp: bring back NUMA dispersion in inet_ehash_locks_alloc() (Eric Dumazet)
  - ALSA: seq: Improve data consistency at polling (Takashi Iwai)
  - powerpc/prom_init: Fixup missing #size-cells on PowerBook6,7 (Andreas Schwab)
  - arm64: tegra: Resize aperture for the IGX PCIe C5 slot (Jonathan Hunter)
  - arm64: tegra: p2597: Fix gpio for vdd-1v8-dis regulator (Diogo Ivo)
  - drm/amdgpu: Fix missing drain retry fault the last entry (Emily Deng)
  - drm/amdkfd: Set per-process flags only once cik/vi (Harish Kasiviswanathan)
  - drm/amdkfd: Set per-process flags only once for gfx9/10/11/12 (Harish Kasiviswanathan)
  - crypto: mxs-dcp - Only set OTP_KEY bit for OTP key (Sven Schwermer)
  - crypto: lzo - Fix compression buffer overrun (Herbert Xu) [Orabug: 38095079] {CVE-2025-38068}
  - misc: pci_endpoint_test: Give disabled BARs a distinct error code (Niklas Cassel)
  - PCI: endpoint: pci-epf-test: Fix double free that causes kernel to oops (Christian Bruel) [Orabug: 38095087] {CVE-2025-38069}
  - watchdog: aspeed: Update bootstatus handling (Chin-Ting Kuo)
  - cpufreq: tegra186: Share policy per cluster (Aaron Kling)
  - iommu/amd/pgtbl_v2: Improve error handling (Vasant Hegde)
  - coresight-etb10: change etb_drvdata spinlock's type to raw_spinlock_t (Levi Yun)
  - badblocks: Fix a nonsense WARN_ON() which checks whether a u64 variable < 0 (Coly Li)
  - ASoC: qcom: sm8250: explicitly set format in sm8250_be_hw_params_fixup() (Alexey Klimov)
  - auxdisplay: charlcd: Partially revert "Move hwidth and bwidth to struct hd44780_common" (Andy Shevchenko)
  - gfs2: Check for empty queue in run_queue (Andreas Gruenbacher)
  - drm/amd/display: Fix incorrect DPCD configs while Replay/PSR switch (Leon Huang)
  - drm/amd/display: not abort link train when bw is low (Peichen Huang)
  - drm/amd/display: calculate the remain segments for all pipes (Zhikai Zhai)
  - drm/amd/display: remove minimum Dispclk and apply oem panel timing. (Charlene Liu)
  - ipv6: save dontfrag in cork (Willem de Bruijn)
  - wifi: cfg80211: allow IR in 20 MHz configurations (Anjaneyulu)
  - wifi: mac80211_hwsim: Fix MLD address translation (Ilan Peer)
  - wifi: mac80211: fix warning on disconnect during failed ML reconf (Johannes Berg)
  - wifi: iwlwifi: fix the ECKV UEFI variable name (Emmanuel Grumbach)
  - wifi: iwlwifi: mark Br device not integrated (Johannes Berg)
  - wifi: iwlwifi: fix debug actions order (Johannes Berg) [Orabug: 38094942] {CVE-2025-38045}
  - wifi: iwlwifi: w/a FW SMPS mode selection (Daniel Gabay)
  - wifi: iwlwifi: don't warn when if there is a FW error (Miri Korenblit)
  - printk: Check CON_SUSPEND when unblanking a console (Marcos Paulo de Souza)
  - iommu: Keep dev->iommu state consistent (Robin Murphy)
  - hwmon: (dell-smm) Increment the number of fans (Kurt Borja)
  - wifi: iwlwifi: mvm: fix setting the TK when associated (Avraham Stern)
  - usb: xhci: Don't change the status of stalled TDs on failed Stop EP (Michał Pecio)
  - mmc: sdhci: Disable SD card clock before changing parameters (Erick Shepherd)
  - mmc: dw_mmc: add exynos7870 DW MMC support (Kaustabh Chakraborty)
  - arm64/mm: Check PUD_TYPE_TABLE in pud_bad() (Ryan Roberts)
  - arm64/mm: Check pmd_table() in pmd_trans_huge() (Ryan Roberts)
  - phy: rockchip: usbdp: Only verify link rates/lanes/voltage when the corresponding set flags are set (Andy Yan)
  - PNP: Expand length of fixup id string (Kees Cook)
  - netfilter: conntrack: Bound nf_conntrack sysctl writes (Nicolas Bouchinet)
  - wifi: rtw89: set force HE TB mode when connecting to 11ax AP (Dian-Syuan Yang)
  - timer_list: Don't use %pK through printk() (Thomas Weißschuh)
  - net: hsr: Fix PRP duplicate detection (Jaakko Karrenpalo)
  - net: stmmac: dwmac-rk: Validate GRF and peripheral GRF during probe (Jonas Karlman)
  - posix-timers: Ensure that timer initialization is fully visible (Thomas Gleixner)
  - posix-timers: Add cond_resched() to posix_timer_add() search loop (Eric Dumazet)
  - RDMA/uverbs: Propagate errors from rdma_lookup_get_uobject() (Maher Sanalla)
  - ext4: do not convert the unwritten extents if data writeback fails (Baokun Li)
  - ext4: reject the 'data_err=abort' option in nojournal mode (Baokun Li)
  - clk: qcom: lpassaudiocc-sc7280: Add support for LPASS resets for QCM6490 (Taniya Das)
  - ASoC: sun4i-codec: support hp-det-gpios property (Ryan Walklin)
  - drm/amdgpu: Update SRIOV video codec caps (David Rosca)
  - drm/amdgpu/gfx11: don't read registers in mqd init (Alex Deucher)
  - drm/amdgpu/gfx12: don't read registers in mqd init (Alex Deucher)
  - mfd: tps65219: Remove TPS65219_REG_TI_DEV_ID check (Shree Ramamoorthy)
  - pinctrl-tegra: Restore SFSEL bit when freeing pins (Prathamesh Shete)
  - xen: Add support for XenServer 6.1 platform device (Frediano Ziglio)
  - net/smc: use the correct ndev to find pnetid by pnetid table (Guangguan Wang)
  - dm: restrict dm device size to 2^63-512 bytes (Mikulas Patocka)
  - crypto: octeontx2 - suppress auth failure screaming due to negative tests (Shashank Gupta)
  - kconfig: do not clear SYMBOL_VALID when reading include/config/auto.conf (Masahiro Yamada)
  - kbuild: fix argument parsing in scripts/config (Seyediman Seyedarab)
  - bpf: Allow pre-ordering for bpf cgroup progs (Yonghong Song)
  - ASoC: mediatek: mt6359: Add stub for mt6359_accdet_enable_jack_detect (Nícolas F R A Prado)
  - ASoC: pcm6240: Drop bogus code handling IRQ as GPIO (Linus Walleij)
  - spi: spi-mux: Fix coverity issue, unchecked return value (Sergio Perez Gonzalez)
  - erofs: initialize decompression early (Gao Xiang)
  - thunderbolt: Do not add non-active NVM if NVM upgrade is disabled for retimer (Mika Westerberg)
  - objtool: Fix error handling inconsistencies in check() (Josh Poimboeuf)
  - rtc: rv3032: fix EERD location (Alexandre Belloni)
  - tcp: reorganize tcp_in_ack_event() and tcp_count_delivered() (Ilpo Järvinen)
  - jbd2: do not try to recover wiped journal (Jan Kara)
  - PCI: dwc: Use resource start as ioremap() input in dw_pcie_pme_turn_off() (Frank Li)
  - bpf: Return prog btf_id without capable check (Mykyta Yatsenko)
  - vfio/pci: Handle INTx IRQ_NOTCONNECTED (Alex Williamson)
  - scsi: st: ERASE does not change tape location (Kai Mäkisara)
  - scsi: st: Tighten the page format heuristics with MODE SELECT (Kai Mäkisara)
  - hypfs_create_cpu_files(): add missing check for hypfs_mkdir() failure (Al Viro)
  - ext4: reorder capability check last (Christian Göttsche)
  - riscv: Call secondary mmu notifier when flushing the tlb (Alexandre Ghiti)
  - bnxt_en: Query FW parameters when the CAPS_CHANGE bit is set (Shantiprasad Shettar)
  - wifi: mwifiex: Fix HT40 bandwidth issue. (Jeff Chen)
  - um: Update min_low_pfn to match changes in uml_reserved (Tiwei Bie)
  - um: Store full CSGSFS and SS register from mcontext (Benjamin Berg)
  - clocksource/drivers/timer-riscv: Stop stimecmp when cpu hotplug (Nick Hu)
  - dlm: make tcp still work in multi-link env (Heming Zhao)
  - s390/tlb: Use mm_has_pgste() instead of mm_alloc_pgste() (Heiko Carstens)
  - i3c: master: svc: Fix missing STOP for master request (Stanley Chu)
  - drm/amdgpu: adjust drm_firmware_drivers_only() handling (Alex Deucher)
  - drm/amd/display: Guard against setting dispclk low for dcn31x (Jing Zhou)
  - drm/amdgpu: release xcp_mgr on exit (Flora Cui)
  - blk-cgroup: improve policy registration error handling (Chen Linxuan)
  - btrfs: send: return -ENAMETOOLONG when attempting a path that is too long (Filipe Manana)
  - btrfs: get zone unusable bytes while holding lock at btrfs_reclaim_bgs_work() (Filipe Manana)
  - btrfs: fix non-empty delayed iputs list on unmount due to async workers (Filipe Manana)
  - btrfs: run btrfs_error_commit_super() early (Qu Wenruo)
  - btrfs: avoid linker error in btrfs_find_create_tree_block() (Mark Harmstone)
  - btrfs: make btrfs_discard_workfn() block_group ref explicit (Boris Burkov)
  - i2c: pxa: fix call balance of i2c->clk handling routines (Vitalii Mordan)
  - i2c: qup: Vote for interconnect bandwidth to DRAM (Stephan Gerhold)
  - x86/mm: Check return value from memblock_phys_alloc_range() (Philip Redkin) [Orabug: 38095101] {CVE-2025-38071}
  - x86/microcode: Update the Intel processor flag scan check (Sohil Mehta)
  - x86/smpboot: Fix INIT delay assignment for extended Intel Families (Sohil Mehta)
  - x86/stackprotector/64: Only export __ref_stack_chk_guard on CONFIG_SMP (Ingo Molnar)
  - x86/headers: Replace __ASSEMBLY__ with __ASSEMBLER__ in UAPI headers (Thomas Huth)
  - wifi: mt76: mt7925: fix fails to enter low power mode in suspend state (Quan Zhou)
  - wifi: mt76: mt7925: load the appropriate CLC data based on hardware type (Ming Yen Hsieh)
  - wifi: mt76: mt7996: revise TXS size (Benjamin Lin)
  - wifi: mt76: mt7996: fix SER reset trigger on WED reset (Rex Lu)
  - wifi: mt76: only mark tx-status-failed frames as ACKed on mt76x0/2 (Felix Fietkau)
  - cgroup/rstat: avoid disabling irqs for O(num_cpu) (Eric Dumazet)
  - drm/amdgpu: Skip pcie_replay_count sysfs creation for VF (Victor Skvortsov)
  - mmc: host: Wait for Vdd to settle on card power off (Erick Shepherd)
  - staging: vchiq_arm: Create keep-alive thread during probe (Stefan Wahren)
  - pidfs: improve multi-threaded exec and premature thread-group leader exit polling (Christian Brauner)
  - libnvdimm/labels: Fix divide error in nd_label_data_init() (Robert Richter) [Orabug: 38095109] {CVE-2025-38072}
  - ext4: on a remount, only log the ro or r/w state when it has changed (Nicolas Bretz)
  - xen/pci: Do not register devices with segments >= 0x10000 (Roger Pau Monné)
  - PCI: vmd: Disable MSI remapping bypass under Xen (Roger Pau Monné)
  - drm/amdkfd: set precise mem ops caps to disabled for gfx 11 and 12 (Jonathan Kim)
  - drm/amdgpu/discovery: check ip_discovery fw file available (Flora Cui)
  - pNFS/flexfiles: Report ENETDOWN as a connection error (Trond Myklebust)
  - tools/build: Don't pass test log files to linker (Ian Rogers)
  - r8169: disable RTL8126 ZRX-DC timeout (Chunhao Lin)
  - PCI: dwc: ep: Ensure proper iteration over outbound map windows (Frank Li)
  - objtool: Properly disable uaccess validation (Josh Poimboeuf)
  - lockdep: Fix wait context check on softirq for PREEMPT_RT (Ryo Takakura)
  - dql: Fix dql->limit value when reset. (Jing Su)
  - Bluetooth: Disable SCO support if READ_VOICE_SETTING is unsupported/broken (Pedro Nishiyama)
  - Bluetooth: btmtksdio: Prevent enabling interrupts after IRQ handler removal (Sean Wang)
  - thermal/drivers/qoriq: Power down TMU on system suspend (Alice Guo)
  - thermal/drivers/mediatek/lvts: Start sensor interrupts disabled (Nícolas F R A Prado)
  - net: tn40xx: create swnode for mdio and aqr105 phy and add to mdiobus (Hans-Frieder Vogt)
  - net: tn40xx: add pci-id of the aqr105-based Tehuti TN4010 cards (Hans-Frieder Vogt)
  - mctp: Fix incorrect tx flow invalidation condition in mctp-i2c (Daniel Hsu)
  - ASoC: codecs: wsa883x: Correct VI sense channel mask (Krzysztof Kozlowski)
  - ASoC: codecs: wsa884x: Correct VI sense channel mask (Krzysztof Kozlowski)
  - spi-rockchip: Fix register out of bounds access (Luis de Arquer) [Orabug: 38095173] {CVE-2025-38081}
  - SUNRPC: rpcbind should never reset the port to the value '0' (Trond Myklebust)
  - SUNRPC: rpc_clnt_set_transport() must not change the autobind setting (Trond Myklebust)
  - NFSv4: Treat ENETUNREACH errors as fatal for state recovery (Trond Myklebust)
  - cifs: Fix establishing NetBIOS session for SMB2+ connection (Pali Rohár)
  - cifs: add validation check for the fields in smb_aces (Namjae Jeon)
  - cifs: Set default Netbios RFC1001 server name to hostname in UNC (Pali Rohár)
  - fbdev: core: tileblit: Implement missing margin clearing for tileblit (Zsolt Kajtar)
  - fbcon: Use correct erase colour for clearing in fbcon (Zsolt Kajtar)
  - fbdev: fsl-diu-fb: add missing device_remove_file() (Shixiong Ou)
  - riscv: Allow NOMMU kernels to access all of RAM (Samuel Holland)
  - mailbox: use error ret code of of_parse_phandle_with_args() (Tudor Ambarus)
  - mailbox: pcc: Use acpi_os_ioremap() instead of ioremap() (Sudeep Holla)
  - tpm: Convert warn to dbg in tpm2_start_auth_session() (Jonathan Mcdowell)
  - ACPI: PNP: Add Intel OC Watchdog IDs to non-PNP device list (Diogo Ivo)
  - tracing: Mark binary printing functions with __printf() attribute (Andy Shevchenko)
  - iommufd: Extend IOMMU_GET_HW_INFO to report PASID capability (Yi Liu)
  - arm64: Add support for HIP09 Spectre-BHB mitigation (Jinqian Yang)
  - SUNRPC: Don't allow waiting for exiting tasks (Trond Myklebust)
  - NFS: Don't allow waiting for exiting tasks (Trond Myklebust)
  - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Trond Myklebust)
  - io_uring/msg: initialise msg request opcode (Pavel Begunkov)
  - exfat: call bh_read in get_block only when necessary (Sungjong Seo)
  - fuse: Return EPERM rather than ENOSYS from link() (Matt Johnston)
  - smb: client: Store original IO parameters and prevent zero IO sizes (Zhaolong Wang)
  - cifs: Fix negotiate retry functionality (Pali Rohár)
  - cifs: Fix querying and creating MF symlinks over SMB1 (Pali Rohár)
  - cifs: Add fallback for SMB2 CREATE without FILE_READ_ATTRIBUTES (Pali Rohár)
  - s390/vfio-ap: Fix no AP queue sharing allowed message written to kernel log (Tony Krowiak)
  - x86/fred: Fix system hang during S4 resume with FRED enabled (Xin Li) [Orabug: 38094951] {CVE-2025-38047}
  - kconfig: merge_config: use an empty file as initfile (Daniel Gomez)
  - samples/bpf: Fix compilation failure for samples/bpf on LoongArch Fedora (Haoran Jiang)
  - bpf: fix possible endless loop in BPF map iteration (Brandon Kammerdiener)
  - io_uring: don't duplicate flushing in io_req_post_cqe (Pavel Begunkov)
  - block: fix race between set_blocksize and read paths (Darrick J. Wong) [Orabug: 38095117] {CVE-2025-38073}
  - selftests/bpf: Mitigate sockmap_ktls disconnect_after_delete failure (Ihor Solodrai)
  - drm/amdgpu: Allow P2P access through XGMI (Felix Kuehling)
  - drm/amd/display: Enable urgent latency adjustment on DCN35 (Nicholas Susanto)
  - fs/ext4: use sleeping version of sb_find_get_block() (Davidlohr Bueso)
  - fs/jbd2: use sleeping version of __find_get_block() (Davidlohr Bueso)
  - fs/ocfs2: use sleeping version of __find_get_block() (Davidlohr Bueso)
  - fs/buffer: use sleeping version of __find_get_block() (Davidlohr Bueso)
  - fs/buffer: introduce sleeping flavors for pagecache lookups (Davidlohr Bueso)
  - fs/buffer: split locking for pagecache lookups (Davidlohr Bueso)
  - ima: process_measurement() needlessly takes inode_lock() on MAY_READ (Frederick Lawler)
  - dma-mapping: Fix warning reported for missing prototype (Balbir Singh)
  - net: enetc: refactor bulk flipping of RX buffers to separate function (Vladimir Oltean)
  - vhost_task: fix vhost_task_create() documentation (Stefano Garzarella)
  - cgroup: Fix compilation issue due to cgroup_mutex not being exported (Gao Xu)
  - dma-mapping: avoid potential unused data compilation warning (Marek Szyprowski)
  - mei: vsc: Use struct vsc_tp_packet as vsc-tp tx_buf and rx_buf type (Hans de Goede)
  - intel_th: avoid using deprecated page->mapping, index fields (Lorenzo Stoakes)
  - dma/mapping.c: dev_dbg support for dma_addressing_limited (Balbir Singh)
  - virtio_ring: Fix data race by tagging event_triggered as racy for KCSAN (Zhongqiu Han) [Orabug: 38094958] {CVE-2025-38048}
  - scsi: ufs: Introduce quirk to extend PA_HIBERN8TIME for UFS devices (Manish Pandey)
  - scsi: target: iscsi: Fix timeout on deleted connection (Dmitry Bogdanov) [Orabug: 38095134] {CVE-2025-38075}
  - nvmem: qfprom: switch to 4-byte aligned reads (Dmitry Baryshkov)
  - nvmem: core: update raw_len if the bit reading is required (Dmitry Baryshkov)
  - nvmem: core: verify cell's raw_len (Dmitry Baryshkov)
  - nvmem: core: fix bit offsets of more than one byte (Dmitry Baryshkov)
  - nvmem: rockchip-otp: add rk3576 variant data (Heiko Stuebner)
  - nvmem: rockchip-otp: Move read-offset into variant-data (Heiko Stuebner)
  - cpufreq: Add SM8650 to cpufreq-dt-platdev blocklist (Pengyu Luo)
  - phy: renesas: rcar-gen3-usb2: Assert PLL reset on PHY power off (Claudiu Beznea)
  - phy: renesas: rcar-gen3-usb2: Lock around hardware registers and driver data (Claudiu Beznea)
  - phy: renesas: rcar-gen3-usb2: Move IRQ request in probe (Claudiu Beznea)
  - i2c: designware: Fix an error handling path in i2c_dw_pci_probe() (Christophe Jaillet)
  - i2c: designware: Use temporary variable for struct device (Andy Shevchenko)
  - drm/amd/display: Defer BW-optimization-blocked DRR adjustments (John Olender)
  - drm/amd/display: Correct timing_adjust_pending flag setting. (Zhongwei)
  - drm/amd/display: Do not enable replay when vtotal update is pending. (Sung-Huai Wang)
  - drm/amd/display: Configure DTBCLK_P with OPTC only for dcn401 (Dillon Varone)
  - LTS version: v6.12.30 (Jack Vogel)
  - drm/amdgpu: fix pm notifier handling (Alex Deucher)
  - phy: tegra: xusb: remove a stray unlock (Dan Carpenter)
  - usb: typec: ucsi: displayport: Fix deadlock (Andrei Kuchynski) [Orabug: 37977018] {CVE-2025-37967}
  - drm/tiny: panel-mipi-dbi: Use drm_client_setup_with_fourcc() (Fabio Estevam)
  - drm/panel-mipi-dbi: Run DRM default client setup (Thomas Zimmermann)
  - drm/fbdev-dma: Support struct drm_driver.fbdev_probe (Thomas Zimmermann)
  - Bluetooth: btnxpuart: Fix kernel panic during FW release (Neeraj Sanjay Kale) [Orabug: 37844459] {CVE-2025-22102}
  - iio: light: opt3001: fix deadlock due to concurrent flag access (Luca Ceresoli) [Orabug: 37977026] {CVE-2025-37968}
  - accel/ivpu: Fix fw log printing (Jacek Lawrynowicz)
  - accel/ivpu: Refactor functions in ivpu_fw_log.c (Jacek Lawrynowicz)
  - accel/ivpu: Reset fw log on cold boot (Tomasz Rusinowicz)
  - accel/ivpu: Rename ivpu_log_level to fw_log_level (Jacek Lawrynowicz)
  - mm/page_alloc: fix race condition in unaccepted memory handling (Kirill A. Shutemov) [Orabug: 38094767] {CVE-2025-38008}
  - drm/xe/gsc: do not flush the GSC worker from the reset path (Daniele Ceraolo Spurio)
  - CIFS: New mount option for cifs.upcall namespace resolution (Ritvik Budhiraja)
  - dmaengine: idxd: Refactor remove call with idxd_cleanup() helper (Shuai Xue) [Orabug: 38094790] {CVE-2025-38014}
  - dmaengine: idxd: fix memory leak in error handling path of idxd_pci_probe (Shuai Xue)
  - dmaengine: idxd: fix memory leak in error handling path of idxd_alloc (Shuai Xue) [Orabug: 38094793] {CVE-2025-38015}
  - dmaengine: idxd: Add missing idxd cleanup to fix memory leak in remove call (Shuai Xue)
  - dmaengine: idxd: Add missing cleanups in cleanup internals (Shuai Xue)
  - dmaengine: idxd: Add missing cleanup for early error out in idxd_setup_internals (Shuai Xue)
  - dmaengine: idxd: fix memory leak in error handling path of idxd_setup_groups (Shuai Xue)
  - dmaengine: idxd: fix memory leak in error handling path of idxd_setup_engines (Shuai Xue)
  - dmaengine: idxd: fix memory leak in error handling path of idxd_setup_wqs (Shuai Xue)
  - dmaengine: ti: k3-udma: Use cap_mask directly from dma_device structure instead of a local copy (Yemike Abhilash Chandra)
  - dmaengine: ti: k3-udma: Add missing locking (Ronald Wahl) [Orabug: 38094756] {CVE-2025-38005}
  - mm: userfaultfd: correct dirty flags set for both present and swap pte (Barry Song)
  - net: qede: Initialize qede_ll_ops with designated initializer (Nathan Chancellor)
  - ring-buffer: Fix persistent buffer when commit page is the reader page (Steven Rostedt)
  - wifi: mt76: disable napi on driver removal (Fedor Pchelkin) [Orabug: 38094770] {CVE-2025-38009}
  - tpm: Mask TPM RC in tpm2_start_auth_session() (Jarkko Sakkinen)
  - spi: tegra114: Use value to check for invalid delays (Aaron Kling)
  - smb: client: fix memory leak during error handling for POSIX mkdir (Jethro Donaldson)
  - scsi: sd_zbc: block: Respect bio vector limits for REPORT ZONES buffer (Steve Siwinski)
  - phy: renesas: rcar-gen3-usb2: Set timing registers only once (Claudiu Beznea)
  - phy: renesas: rcar-gen3-usb2: Fix role detection on unbind/bind (Claudiu Beznea)
  - phy: Fix error handling in tegra_xusb_port_init (Ma Ke)
  - phy: tegra: xusb: Use a bitmask for UTMI pad power state tracking (Wayne Chang) [Orabug: 38094777] {CVE-2025-38010}
  - tracing: samples: Initialize trace_array_printk() with the correct function (Steven Rostedt)
  - ftrace: Fix preemption accounting for stacktrace filter command (Donglin Peng)
  - ftrace: Fix preemption accounting for stacktrace trigger command (Donglin Peng)
  - kbuild: Disable -Wdefault-const-init-unsafe (Nathan Chancellor)
  - Drivers: hv: vmbus: Remove vmbus_sendpacket_pagebuffer() (Michael Kelley)
  - Drivers: hv: Allow vmbus_sendpacket_mpb_desc() to create multiple ranges (Michael Kelley)
  - arm64: dts: rockchip: Remove overdrive-mode OPPs from RK3588J SoC dtsi (Dragan Simic)
  - arm64: dts: amlogic: dreambox: fix missing clkc_audio node (Christian Hewitt)
  - hv_netvsc: Remove rmsg_pgcnt (Michael Kelley)
  - hv_netvsc: Preserve contiguous PFN grouping in the page buffer array (Michael Kelley)
  - hv_netvsc: Use vmbus_sendpacket_mpb_desc() to send VMBus messages (Michael Kelley)
  - dma-buf: insert memory barrier before updating num_fences (Hyejeong Choi)
  - ALSA: usb-audio: Add sample rate quirk for Microdia JP001 USB Camera (Nicolas Chauvet)
  - ALSA: usb-audio: Add sample rate quirk for Audioengine D1 (Christian Heusel)
  - ALSA: es1968: Add error handling for snd_pcm_hw_constraint_pow2() (Xu Wang)
  - ACPI: PPTT: Fix processor subtable walk (Jeremy Linton)
  - gpio: pca953x: fix IRQ storm on system wake up (Emanuele Ghidoli)
  - MAINTAINERS: Update Alexey Makhalov's email address (Alexey Makhalov)
  - drm/amd/display: Avoid flooding unnecessary info messages (Wayne Lin)
  - drm/amd/display: Correct the reply value when AUX write incomplete (Wayne Lin)
  - drm/amdgpu: csa unmap use uninterruptible lock (Philip Yang) [Orabug: 38094779] {CVE-2025-38011}
  - drm/amdgpu: fix incorrect MALL size for GFX1151 (Tim Huang)
  - Revert "drm/amd/display: Hardware cursor changes color when switched to software cursor" (Melissa Wen)
  - btrfs: add back warning for mount option commit values exceeding 300 (Kyoji Ogasawara)
  - btrfs: fix folio leak in submit_one_async_extent() (Boris Burkov)
  - btrfs: fix discard worker infinite loop after disabling discard (Filipe Manana)
  - LoongArch: uprobes: Remove redundant code about resume_era (Tiezhu Yang)
  - LoongArch: uprobes: Remove user_{en,dis}able_single_step() (Tiezhu Yang)
  - LoongArch: Fix MAX_REG_OFFSET calculation (Huacai Chen)
  - LoongArch: Save and restore CSR.CNTC for hibernation (Huacai Chen)
  - LoongArch: Move __arch_cpu_idle() to .cpuidle.text section (Huacai Chen)
  - LoongArch: Prevent cond_resched() occurring within kernel-fpu (Tianyang Zhang)
  - HID: bpf: abort dispatch if device destroyed (Rongrong) [Orabug: 38094796] {CVE-2025-38016}
  - udf: Make sure i_lenExtents is uptodate on inode eviction (Jan Kara)
  - sched_ext: bpf_iter_scx_dsq_new() should always initialize iterator (Tejun Heo) [Orabug: 38094786] {CVE-2025-38012}
  - dmaengine: Revert "dmaengine: dmatest: Fix dmatest waiting less when interrupted" (Nathan Lynch)
  - NFSv4/pnfs: Reset the layout state after a layoutreturn (Trond Myklebust)
  - tsnep: fix timestamping with a stacked DSA driver (Gerhard Engleder)
  - net/tls: fix kernel panic when alloc_page failed (Pengtao He) [Orabug: 38094802] {CVE-2025-38018}
  - mlxsw: spectrum_router: Fix use-after-free when deleting GRE net devices (Ido Schimmel) [Orabug: 38094804] {CVE-2025-38019}
  - wifi: mac80211: Set n_channels after allocating struct cfg80211_scan_request (Kees Cook) [Orabug: 38094788] {CVE-2025-38013}
  - octeontx2-pf: Do not reallocate all ntuple filters (Subbaraya Sundeep)
  - octeontx2-af: Fix CGX Receive counters (Hariprasad Kelam)
  - net: ethernet: mtk_eth_soc: fix typo for declaration MT7988 ESW capability (Bc-Bocun Chen)
  - octeontx2-pf: macsec: Fix incorrect max transmit size in TX secy (Subbaraya Sundeep)
  - netlink: specs: tc: all actions are indexed arrays (Jakub Kicinski)
  - netlink: specs: tc: fix a couple of attribute names (Jakub Kicinski)
  - drm/xe: Save CTX_TIMESTAMP mmio value instead of LRC value (Umesh Nerlige Ramappa)
  - regulator: max20086: fix invalid memory access (Cosmin Tanislav) [Orabug: 38094833] {CVE-2025-38027}
  - qlcnic: fix memory leak in qlcnic_sriov_channel_cfg_cmd() (Abdun Nihaal)
  - net/mlx5e: Disable MACsec offload for uplink representor profile (Carolina Jubran) [Orabug: 38094808] {CVE-2025-38020}
  - vsock/test: Fix occasional failure in SIOCOUTQ tests (Konstantin Shkolnyy)
  - net: dsa: b53: prevent standalone from trying to forward to other ports (Jonas Gorski)
  - ALSA: sh: SND_AICA should depend on SH_DMA_API (Geert Uytterhoeven)
  - nvme-pci: acquire cq_poll_lock in nvme_poll_irqdisable (Keith Busch)
  - nvme-pci: make nvme_pci_npages_prp() __always_inline (Kees Cook)
  - net: dsa: sja1105: discard incoming frames in BR_STATE_LISTENING (Vladimir Oltean)
  - net: cadence: macb: Fix a possible deadlock in macb_halt_tx. (Mathieu Othacehe)
  - ALSA: ump: Fix a typo of snd_ump_stream_msg_device_info (Takashi Iwai)
  - ALSA: seq: Fix delivery of UMP events to group ports (Takashi Iwai)
  - net: mctp: Ensure keys maintain only one ref to corresponding dev (Andrew Jeffery)
  - tests/ncdevmem: Fix double-free of queue array (Cosmin Ratiu)
  - selftests: ncdevmem: Switch to AF_INET6 (Stanislav Fomichev)
  - selftests: ncdevmem: Make client_ip optional (Stanislav Fomichev)
  - selftests: ncdevmem: Unify error handling (Stanislav Fomichev)
  - selftests: ncdevmem: Separate out dmabuf provider (Stanislav Fomichev)
  - selftests: ncdevmem: Redirect all non-payload output to stderr (Stanislav Fomichev)
  - net: mctp: Don't access ifa_index when missing (Matt Johnston)
  - mctp: no longer rely on net->dev_index_head[] (Eric Dumazet)
  - tools/net/ynl: ethtool: fix crash when Hardware Clock info is missing (Hangbin Liu)
  - net_sched: Flush gso_skb list too during ->change() (Cong Wang) [Orabug: 37998128] {CVE-2025-37992}
  - Bluetooth: MGMT: Fix MGMT_OP_ADD_DEVICE invalid device flags (Luiz Augusto von Dentz)
  - RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem (Zhu Yanjun) [Orabug: 38094813] {CVE-2025-38022}
  - spi: loopback-test: Do not split 1024-byte hexdumps (Geert Uytterhoeven)
  - nfs: handle failure of nfs_get_lock_context in unlock path (Li Lingfeng) [Orabug: 38094818] {CVE-2025-38023}
  - HID: uclogic: Add NULL check in uclogic_input_configured() (Henry Martin) [Orabug: 38094764] {CVE-2025-38007}
  - HID: thrustmaster: fix memory leak in thrustmaster_interrupts() (Qasim Ijaz)
  - RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug (Zhu Yanjun) [Orabug: 38094827] {CVE-2025-38024}
  - virtio_net: ensure netdev_tx_reset_queue is called on bind xsk for tx (Koichiro Den)
  - virtio_ring: add a func argument 'recycle_done' to virtqueue_reset() (Koichiro Den)
  - iio: chemical: sps30: use aligned_s64 for timestamp (David Lechner)
  - iio: adc: ad7768-1: Fix insufficient alignment of timestamp. (Jonathan Cameron)
  - xhci: dbc: Avoid event polling busyloop if pending rx transfers are inactive. (Mathias Nyman)
  - xhci: dbc: Improve performance by removing delay in transfer event polling. (Mathias Nyman)
  - Revert "drm/amd: Stop evicting resources on APUs in suspend" (Alex Deucher)
  - drm/amd: Add Suspend/Hibernate notification callback support (Mario Limonciello)
  - iio: pressure: mprls0025pa: use aligned_s64 for timestamp (David Lechner)
  - iio: chemical: pms7003: use aligned_s64 for timestamp (David Lechner)
  - iio: adc: ad7266: Fix potential timestamp alignment issue. (Jonathan Cameron)
  - KVM: x86/mmu: Prevent installing hugepages when mem attributes are changing (Sean Christopherson)
  - KVM: Add member to struct kvm_gfn_range to indicate private/shared (Isaku Yamahata)
  - uio_hv_generic: Fix sysfs creation path for ring buffer (Naman Jain)
  - tpm: tis: Double the timeout B to 4s (Michal Suchanek)
  - tracing: probes: Fix a possible race in trace_probe_log APIs (Masami Hiramatsu)
  - cgroup/cpuset: Extend kthread_is_per_cpu() check to all PF_NO_SETAFFINITY tasks (Waiman Long)
  - arm64: dts: imx8mp-var-som: Fix LDO5 shutdown causing SD card timeout (Himanshu Bhavani)
  - platform/x86: asus-wmi: Fix wlan_ctrl_by_user detection (Hans de Goede)
  - platform/x86/amd/pmc: Declare quirk_spurious_8042 for MECHREVO Wujie 14XA (GX4HRXL) (Runhua He)
  - binfmt_elf: Move brk for static PIE even if ASLR disabled (Kees Cook)
  - riscv: dts: sophgo: fix DMA data-width configuration for CV18xx (Ze Huang)
  - drivers/platform/x86/amd: pmf: Check for invalid Smart PC Policies (Mario Limonciello)
  - drivers/platform/x86/amd: pmf: Check for invalid sideloaded Smart PC Policies (Mario Limonciello)
  - fs/xattr.c: fix simple_xattr_list to always include security.* xattrs (Stephen Smalley)
  - arm64: dts: rockchip: Assign RT5616 MCLK rate on rk3588-friendlyelec-cm3588 (Tom Vincent)
  - LTS version: v6.12.29 (Jack Vogel)
  - arm64: proton-pack: Add new CPUs 'k' values for branch mitigation (James Morse)
  - arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users (James Morse) [Orabug: 37977004] {CVE-2025-37963}
  - arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs (James Morse) [Orabug: 37976926] {CVE-2025-37948}
  - arm64: proton-pack: Expose whether the branchy loop k value (James Morse)
  - arm64: proton-pack: Expose whether the platform is mitigated by firmware (James Morse)
  - arm64: insn: Add support for encoding DSB (James Morse)
  - mm: page_alloc: speed up fallbacks in rmqueue_bulk() (Johannes Weiner)
  - mm: page_alloc: don't steal single pages from biggest buddy (Johannes Weiner)
  - Bluetooth: btmtk: Remove the resetting step before downloading the fw (Hao Qin)
  - Bluetooth: btmtk: Remove resetting mt7921 before downloading the fw (Hao Qin)
  - io_uring: always arm linked timeouts prior to issue (Jens Axboe)
  - rust: clean Rust 1.88.0's `clippy::uninlined_format_args` lint (Miguel Ojeda)
  - rust: allow Rust 1.87.0's `clippy::ptr_eq` lint (Miguel Ojeda)
  - Revert "um: work around sched_yield not yielding in time-travel mode" (Christian Lamparter)
  - do_umount(): add missing barrier before refcount checks in sync case (Al Viro)
  - io_uring/sqpoll: Increase task_work submission batch size (Gabriel Krisman Bertazi)
  - drm/xe/tests/mocs: Hold XE_FORCEWAKE_ALL for LNCF regs (Tejas Upadhyay)
  - drm/xe/tests/mocs: Update xe_force_wake_get() return handling (Himal Prasad Ghimiray)
  - riscv: misaligned: enable IRQs while handling misaligned accesses (Clément Léger)
  - riscv: misaligned: factorize trap handling (Clément Léger)
  - nvme: unblock ctrl state transition for firmware update (Daniel Wagner)
  - drm/panel: simple: Update timings for AUO G101EVN010 (Kevin Baker)
  - loop: Add sanity check for read/write_iter (Lizhi Xu)
  - loop: factor out a loop_assign_backing_file helper (Christoph Hellwig)
  - loop: refactor queue limits updates (Christoph Hellwig)
  - loop: Fix ABBA locking race (Ogawa Hirofumi)
  - loop: Simplify discard granularity calc (John Garry)
  - loop: Use bdev limit helpers for configuring discard (John Garry)
  - riscv: misaligned: Add handling for ZCB instructions (Nylon Chen)
  - MIPS: Fix MAX_REG_OFFSET (Thorsten Blum)
  - iio: adc: dln2: Use aligned_s64 for timestamp (Jonathan Cameron)
  - iio: accel: adxl355: Make timestamp 64-bit aligned using aligned_s64 (Jonathan Cameron)
  - types: Complement the aligned types with signed 64-bit one (Andy Shevchenko)
  - iio: temp: maxim-thermocouple: Fix potential lack of DMA safe buffer. (Jonathan Cameron)
  - iio: accel: adxl367: fix setting odr for activity time update (Lothar Rubusch)
  - usb: usbtmc: Fix erroneous generic_read ioctl return (Dave Penkler)
  - usb: usbtmc: Fix erroneous wait_srq ioctl return (Dave Penkler)
  - usb: usbtmc: Fix erroneous get_stb ioctl error returns (Dave Penkler)
  - USB: usbtmc: use interruptible sleep in usbtmc_read (Oliver Neukum)
  - usb: typec: ucsi: displayport: Fix NULL pointer access (Andrei Kuchynski) [Orabug: 38015126] {CVE-2025-37994}
  - usb: typec: tcpm: delay SNK_TRY_WAIT_DEBOUNCE to SRC_TRYWAIT transition (Rd Babiera)
  - usb: misc: onboard_usb_dev: fix support for Cypress HX3 hubs (Lukasz Czechowski)
  - usb: host: tegra: Prevent host controller crash when OTG port is used (Jim Lin)
  - usb: gadget: Use get_status callback to set remote wakeup capability (Prashanth K)
  - usb: gadget: tegra-xudc: ACK ST_RC after clearing CTRL_RUN (Wayne Chang)
  - usb: gadget: f_ecm: Add get_status callback (Prashanth K)
  - usb: cdnsp: fix L1 resume issue for RTL_REVISION_NEW_LPM version (Pawel Laszczak)
  - usb: cdnsp: Fix issue with resuming from L1 (Pawel Laszczak)
  - usb: dwc3: gadget: Make gadget_wakeup asynchronous (Prashanth K)
  - x86/microcode: Consolidate the loader enablement checking (Borislav Petkov)
  - module: ensure that kobject_put() is safe for module type kobjects (Dmitry Antipov) [Orabug: 38015131] {CVE-2025-37995}
  - memblock: Accept allocated memory before use in memblock_double_array() (Tom Lendacky) [Orabug: 37976994] {CVE-2025-37960}
  - clocksource/i8253: Use raw_spinlock_irqsave() in clockevent_i8253_disable() (Sebastian Andrzej Siewior)
  - arm64: cpufeature: Move arm64_use_ng_mappings to the .data section to prevent wrong idmap generation (Levi Yun)
  - accel/ivpu: Increase state dump msg timeout (Jacek Lawrynowicz)
  - xenbus: Use kref to track req lifetime (Jason Andryuk) [Orabug: 37976934] {CVE-2025-37949}
  - xen: swiotlb: Use swiotlb bouncing if kmalloc allocation demands it (John Ernberg)
  - smb: client: Avoid race in open_cached_dir with lease breaks (Paul Aurich) [Orabug: 37976959] {CVE-2025-37954}
  - usb: uhci-platform: Make the clock really optional (Alexey Charkov)
  - drm/amdgpu/hdp7: use memcfg register to post the write for HDP flush (Alex Deucher)
  - drm/amdgpu/hdp6: use memcfg register to post the write for HDP flush (Alex Deucher)
  - drm/amdgpu/hdp5: use memcfg register to post the write for HDP flush (Alex Deucher)
  - drm/amdgpu/hdp5.2: use memcfg register to post the write for HDP flush (Alex Deucher)
  - drm/amdgpu/hdp4: use memcfg register to post the write for HDP flush (Alex Deucher)
  - drm/amd/display: Copy AUX read reply data whenever length > 0 (Wayne Lin)
  - drm/amd/display: Fix wrong handling for AUX_DEFER case (Wayne Lin)
  - drm/amd/display: Remove incorrect checking in dmub aux handler (Wayne Lin)
  - drm/amd/display: Fix the checking condition in dmub aux handling (Wayne Lin)
  - drm/amd/display: more liberal vmin/vmax update for freesync (Aurabindo Pillai)
  - drm/amd/display: Fix invalid context error in dml helper (Roman Li) [Orabug: 37977185] {CVE-2025-37965}
  - drm/amdgpu/vcn: using separate VCN1_AON_SOC offset (Ruijing Dong)
  - drm/xe: Add page queue multiplier (Matthew Brost)
  - drm/v3d: Add job to pending list if the reset was skipped (Maíra Canal) [Orabug: 37976942] {CVE-2025-37951}
  - iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_tagged_fifo (Silvano Seva) [Orabug: 37977031] {CVE-2025-37969}
  - iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_fifo (Silvano Seva) [Orabug: 37977037] {CVE-2025-37970}
  - iio: imu: inv_mpu6050: align buffer for timestamp (David Lechner)
  - iio: adis16201: Correct inclinometer channel resolution (Gabriel)
  - iio: adc: rockchip: Fix clock initialization sequence (Simon Xue)
  - iio: adc: ad7606: fix serial register access (Angelo Dureghello)
  - io_uring: ensure deferred completions are flushed for multishot (Jens Axboe)
  - drm/amd/display: Shift DMUB AUX reply command if necessary (Wayne Lin)
  - KVM: SVM: Forcibly leave SMM mode on SHUTDOWN interception (Mikhail Lobanov) [Orabug: 37976977] {CVE-2025-37957}
  - selftests/mm: fix a build failure on powerpc (Nysal Jan K.A.)
  - selftests/mm: compaction_test: support platform with huge mount of memory (Feng Tang)
  - mm/userfaultfd: fix uninitialized output field for -EAGAIN race (Peter Xu)
  - mm/huge_memory: fix dereferencing invalid pmd migration entry (Gavin Guo) [Orabug: 37976982] {CVE-2025-37958}
  - mm: fix folio_pte_batch() on XEN PV (Petr Vaněk)
  - x86/mm: Eliminate window where TLB flushes may be inadvertently skipped (Dave Hansen) [Orabug: 37977013] {CVE-2025-37964}
  - staging: axis-fifo: Correct handling of tx_fifo_depth for size validation (Gabriel)
  - staging: axis-fifo: Remove hardware resets for user errors (Gabriel)
  - staging: bcm2835-camera: Initialise dev in v4l2_dev (Dave Stevenson) [Orabug: 37977042] {CVE-2025-37971}
  - staging: iio: adc: ad7816: Correct conditional logic for store mode (Gabriel)
  - rust: clean Rust 1.88.0's warning about `clippy::disallowed_macros` configuration (Miguel Ojeda)
  - objtool/rust: add one more `noreturn` Rust function for Rust 1.87.0 (Miguel Ojeda)
  - rust: clean Rust 1.88.0's `unnecessary_transmutes` lint (Miguel Ojeda)
  - Input: synaptics - enable InterTouch on TUXEDO InfinityBook Pro 14 v5 (Aditya Garg)
  - Input: synaptics - enable SMBus for HP Elitebook 850 G1 (Dmitry Torokhov)
  - Input: synaptics - enable InterTouch on Dell Precision M3800 (Aditya Garg)
  - Input: synaptics - enable InterTouch on Dynabook Portege X30L-G (Aditya Garg)
  - Input: synaptics - enable InterTouch on Dynabook Portege X30-D (Manuel Fombuena)
  - Input: xpad - fix two controller table values (Vicki Pfau)
  - Input: xpad - add support for 8BitDo Ultimate 2 Wireless Controller (Lode Willems)
  - Input: xpad - fix Share button on Xbox One controllers (Vicki Pfau)
  - Input: mtk-pmic-keys - fix possible null pointer dereference (Gary Bisson) [Orabug: 37977044] {CVE-2025-37972}
  - Input: cyttsp5 - fix power control issue on wakeup (Mikael Gonella-Bolduc)
  - Input: cyttsp5 - ensure minimum reset pulse width (Hugo Villeneuve)
  - virtio-net: fix total qstat values (Jakub Kicinski)
  - net: export a helper for adding up queue stats (Jakub Kicinski)
  - fbnic: Do not allow mailbox to toggle to ready outside fbnic_mbx_poll_tx_ready (Alexander Duyck)
  - fbnic: Pull fbnic_fw_xmit_cap_msg use out of interrupt context (Alexander Duyck)
  - fbnic: Improve responsiveness of fbnic_mbx_poll_tx_ready (Alexander Duyck)
  - fbnic: Actually flush_tx instead of stalling out (Alexander Duyck)
  - fbnic: Gate AXI read/write enabling on FW mailbox (Alexander Duyck)
  - fbnic: Fix initialization of mailbox descriptor rings (Alexander Duyck)
  - net: dsa: b53: do not set learning and unicast/multicast on up (Jonas Gorski)
  - net: dsa: b53: fix learning on VLAN unaware bridges (Jonas Gorski)
  - net: dsa: b53: fix toggling vlan_filtering (Jonas Gorski)
  - net: dsa: b53: do not program vlans when vlan filtering is off (Jonas Gorski)
  - net: dsa: b53: do not allow to configure VLAN 0 (Jonas Gorski)
  - net: dsa: b53: always rejoin default untagged VLAN on bridge leave (Jonas Gorski)
  - net: dsa: b53: fix VLAN ID for untagged vlan on bridge leave (Jonas Gorski)
  - net: dsa: b53: fix flushing old pvid VLAN on pvid change (Jonas Gorski)
  - net: dsa: b53: fix clearing PVID of a port (Jonas Gorski)
  - net: dsa: b53: keep CPU port always tagged again (Jonas Gorski)
  - net: dsa: b53: allow leaky reserved multicast (Jonas Gorski)
  - bpf: Scrub packet on bpf_redirect_peer (Paul Chaignon) [Orabug: 37976990] {CVE-2025-37959}
  - netfilter: ipset: fix region locking in hash types (Jozsef Kadlecsik) [Orabug: 38015141] {CVE-2025-37997}
  - ipvs: fix uninit-value for saddr in do_output_route4 (Julian Anastasov) [Orabug: 37976996] {CVE-2025-37961}
  - erofs: ensure the extra temporary copy is valid for shortened bvecs (Gao Xiang)
  - ice: use DSN instead of PCI BDF for ice_adapter index (Przemek Kitszel)
  - ice: Initial support for E825C hardware in ice_adapter (Sergey Temerkhanov)
  - wifi: mac80211: fix the type of status_code for negotiated TID to Link Mapping (Michael-Cy Lee)
  - can: gw: fix RCU/BH usage in cgw_create_job() (Oliver Hartkopp)
  - can: mcp251xfd: fix TDC setting for low data bit rates (Kelsey Maes)
  - can: m_can: m_can_class_allocate_dev(): initialize spin lock on device probe (Antonios Salios) [Orabug: 38015123] {CVE-2025-37993}
  - net: ethernet: mtk_eth_soc: do not reset PSE when setting FE (Frank Wunderlich)
  - net: ethernet: mtk_eth_soc: reset all TX queues on DMA free (Daniel Golle)
  - gre: Fix again IPv6 link-local address generation. (Guillaume Nault)
  - virtio-net: free xsk_buffs on error in virtnet_xsk_pool_enable() (Jakub Kicinski) [Orabug: 37976969] {CVE-2025-37955}
  - virtio_net: xsk: bind/unbind xsk for tx (Xuan Zhuo)
  - sch_htb: make htb_deactivate() idempotent (Cong Wang) [Orabug: 37977176] {CVE-2025-37953}
  - s390/entry: Fix last breaking event handling in case of stack corruption (Heiko Carstens)
  - ksmbd: fix memory leak in parse_lease_state() (Zhaolong Wang) [Orabug: 37977180] {CVE-2025-37962}
  - openvswitch: Fix unsafe attribute parsing in output_userspace() (Eelco Chaudron) [Orabug: 38015148] {CVE-2025-37998}
  - ksmbd: Fix UAF in __close_file_table_ids (Sean Heelan) [Orabug: 37976951] {CVE-2025-37952}
  - ksmbd: prevent out-of-bounds stream writes by validating *pos (Norbert Szetei) [Orabug: 37976923] {CVE-2025-37947}
  - ksmbd: prevent rename with empty string (Namjae Jeon) [Orabug: 37976972] {CVE-2025-37956}
  - can: rockchip_canfd: rkcanfd_remove(): fix order of unregistration calls (Marc Kleine-Budde)
  - can: mcp251xfd: mcp251xfd_remove(): fix order of unregistration calls (Marc Kleine-Budde)
  - s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFs (Niklas Schnelle) [Orabug: 37976920] {CVE-2025-37946}
  - vfio/pci: Align huge faults to order (Alex Williamson)
  - wifi: cfg80211: fix out-of-bounds access during multi-link element defragmentation (Veerendranath Jakkam) [Orabug: 37977046] {CVE-2025-37973}
  - s390/pci: Fix missing check for zpci_create_device() error return (Niklas Schnelle) [Orabug: 37977050] {CVE-2025-37974}
  - can: mcan: m_can_class_unregister(): fix order of unregistration calls (Marc Kleine-Budde)
  - firmware: arm_scmi: Fix timeout checks on polling path (Cristian Marussi)
  - arm64: dts: imx8mm-verdin: Link reg_usdhc2_vqmmc to usdhc2 (Wojciech Dubowik)
  - Revert "btrfs: canonicalize the device path before adding it" (Qu Wenruo)
  - fs/erofs/fileio: call erofs_onlinefolio_split() after bio_add_folio() (Max Kellermann) [Orabug: 38015155] {CVE-2025-37999}
  - dm: add missing unlock on in dm_keyslot_evict() (Dan Carpenter)
  - mm/vmscan: wake up flushers conditionally to avoid cgroup OOM (Zeng Jingxiang) [Orabug: 37480932]
  - dmaengine: idxd: Narrow the restriction on BATCH to ver. 1 only (Vinicius Costa Gomes) [Orabug: 37801355]
  - uek-rpm: build the fwctl mlx5 driver on UEK (Qing Huang) [Orabug: 37810636]
  - fwctl: Adapt upstream code for UEK8 (Mikhael Goikhman) [Orabug: 37810636]
  - mlx5: Create an auxiliary device for fwctl_mlx5 (Saeed Mahameed) [Orabug: 37810636]
  - fwctl/mlx5: Support for communicating with mlx5 fw (Saeed Mahameed) [Orabug: 37810636]
  - fwctl: Add documentation (Jason Gunthorpe) [Orabug: 37810636]
  - fwctl: FWCTL_RPC to execute a Remote Procedure Call to device firmware (Jason Gunthorpe) [Orabug: 37810636]
  - taint: Add TAINT_FWCTL (Jason Gunthorpe) [Orabug: 37810636]
  - fwctl: FWCTL_INFO to return basic information about the device (Jason Gunthorpe) [Orabug: 37810636]
  - fwctl: Basic ioctl dispatch for the character device (Jason Gunthorpe) [Orabug: 37810636]
  - fwctl: Add basic structure for a class subsystem with a cdev (Jason Gunthorpe) [Orabug: 37810636]
  - Revert "fwctl: Add basic structure for a class subsystem with a cdev" (Qing Huang) [Orabug: 37810636]
  - Revert "fwctl: Basic ioctl dispatch for the character device" (Qing Huang) [Orabug: 37810636]
  - Revert "fwctl: FWCTL_INFO to return basic information about the device" (Qing Huang) [Orabug: 37810636]
  - Revert "fwctl: FWCTL_RPC to execute a Remote Procedure Call to device firmware" (Qing Huang) [Orabug: 37810636]
  - Revert "fwctl/mlx5: Support for communicating with mlx5 fw" (Qing Huang) [Orabug: 37810636]
  - Revert "mlx5: Create an auxiliary device for fwctl_mlx5" (Qing Huang) [Orabug: 37810636]
  - Revert "taint: Add TAINT_FWCTL" (Qing Huang) [Orabug: 37810636]
  - Revert "fwctl: Adapt code for UEK-NEXT" (Qing Huang) [Orabug: 37810636]
  - Revert "fwctl/mlx5: Add INTERNAL_DEV_RES uctx capability" (Qing Huang) [Orabug: 37810636]
  - Revert "fwctl: Allow up to 4k devices" (Qing Huang) [Orabug: 37810636]
  - Revert "uek-rpm: build the fwctl mlx5 driver on UEK" (Qing Huang) [Orabug: 37810636]
  - dmaengine: idxd: Change err messages to dbg (Jack Vogel) [Orabug: 37841831]
  - PCI: Add PCI_VDEVICE_SUB helper macro (Piotr Kwapulinski) [Orabug: 37889575]
  - ixgbevf: Add support for Intel(R) E610 device (Piotr Kwapulinski) [Orabug: 37889575]
  - ixgbe: Enable link management in E610 device (Piotr Kwapulinski) [Orabug: 37889575]
  - ixgbe: Clean up the E610 link management related code (Piotr Kwapulinski) [Orabug: 37889575]
  - ixgbe: Add ixgbe_x540 multiple header inclusion protection (Piotr Kwapulinski) [Orabug: 37889575]
  - ixgbe: Add support for EEPROM dump in E610 device (Piotr Kwapulinski) [Orabug: 37889575]
  - ixgbe: Add support for NVM handling in E610 device (Piotr Kwapulinski) [Orabug: 37889575]
  - ixgbe: Add link management support for E610 device (Piotr Kwapulinski) [Orabug: 37889575]
  - ixgbe: Add support for E610 device capabilities detection (Piotr Kwapulinski) [Orabug: 37889575]
  - ixgbe: Add support for E610 FW Admin Command Interface (Piotr Kwapulinski) [Orabug: 37889575]
  - uek-rpm: Move the gve kernel module from extra to kernel-uek-core (Samasth Norway Ananda) [Orabug: 37940897]
  - uek-rpm/config-aarch64: Enable BT_HCIUART_BCM for RPi Bluetooth (Vijay Kumar) [Orabug: 37961540]
  - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (Shravan Kumar Ramani) [Orabug: 37964051]
  - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (David Thompson) [Orabug: 37964051,38037120] {CVE-2025-37866}
  - mlxbf-bootctl: Support sysfs entries for RTC battery status (Xiangrong Li) [Orabug: 37964051]
  - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37964051]
  - uek-rpm: CONFIG_PTP_1588_CLOCK_OCP enable for OCI (Vijayendra Suman) [Orabug: 37966384]
  - x86/its: Fix build errors when CONFIG_MODULES=n (Eric Biggers) [Orabug: 37970148]
  - x86/its: Use dynamic thunks for indirect branches (Peter Zijlstra) [Orabug: 37970148]
  - x86/ibt: Keep IBT disabled during alternative patching (Pawan Gupta) [Orabug: 37970148]
  - RDMA/mlx5: Fix CC counters query for MPV (Patrisious Haddad) [Orabug: 37989268]
  - amd_hsmp: Increase the SMU timeout to 500ms (Vijay Kumar) [Orabug: 38000074]


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-101.33.2.el9uek]
changelog:
  - net: mana: Add support for Multi Vports on Bare metal (Haiyang Zhang) [Orabug: 38052741]
  - tools: hv: Enable debug logs for hv_kvp_daemon (Shradha Gupta) [Orabug: 38052759]
  - LTS version: v6.12.33 (Jack Vogel)
  - Revert "drm/amd/display: more liberal vmin/vmax update for freesync" (Aurabindo Pillai)
  - dt-bindings: phy: imx8mq-usb: fix fsl,phy-tx-vboost-level-microvolt property (Xu Yang)
  - dt-bindings: usb: cypress,hx3: Add support for all variants (Lukasz Czechowski)
  - thunderbolt: Do not double dequeue a configuration request (Sergey Senozhatsky)
  - usb: usbtmc: Fix timeout value in get_stb (Dave Penkler)
  - serial: jsm: fix NPE during jsm_uart_port_init (Dustin Lundquist)
  - Bluetooth: hci_qca: move the SoC type check to the right place (Bartosz Golaszewski)
  - usb: typec: ucsi: fix Clang -Wsign-conversion warning (Qasim Ijaz)
  - USB: serial: pl2303: add new chip PL2303GC-Q20 and PL2303GT-2AB (Charles Yeh)
  - usb: storage: Ignore UAS driver for SanDisk 3.2 Gen2 storage device (Hongyu Xie)
  - usb: quirks: Add NO_LPM quirk for SanDisk Extreme 55AE (Jiayi Li)
  - Revert "cpufreq: tegra186: Share policy per cluster" (Jonathan Hunter)
  - block: fix adding folio to bio (Ming Lei) [Orabug: 37844657] {CVE-2025-22122}
  - PCI/ASPM: Disable L1 before disabling L1 PM Substates (Ajay Agarwal)
  - accel/ivpu: Update power island delays (Karol Wachowski)
  - accel/ivpu: Add initial Panther Lake support (Maciej Falkowski)
  - rtc: Fix offset calculation for .start_secs < 0 (Alexandre Mergnat)
  - rtc: Make rtc_time64_to_tm() support dates before 1970 (Alexandre Mergnat)
  - Documentation: ACPI: Use all-string data node references (Sakari Ailus)
  - acpi-cpufreq: Fix nominal_freq units to KHz in get_max_boost_ratio() (Gautham R. Shenoy)
  - pinctrl: armada-37xx: set GPIO output value before setting direction (Gabor Juhos)
  - pinctrl: armada-37xx: use correct OUTPUT_VAL register for GPIOs > 31 (Gabor Juhos)
  - f2fs: fix to avoid accessing uninitialized curseg (Chao Yu) [Orabug: 37844644] {CVE-2025-22123}
  - tracing: Fix compilation warning on arm32 (Pan Taixi)
  - LTS version: v6.12.32 (Jack Vogel)
  - ksmbd: use list_first_entry_or_null for opinfo_get_list() (Namjae Jeon)
  - net: ethernet: ti: am65-cpsw: Lower random mac address error print to info (Nishanth Menon)
  - platform/x86: thinkpad_acpi: Ignore battery threshold change event notification (Mark Pearson)
  - ALSA: hda/realtek - restore auto-mute mode for Dell Chrome platform (Kailang Yang)
  - platform/x86: fujitsu-laptop: Support Lifebook S2110 hotkeys (Valtteri Koskivuori)
  - NFS: Avoid flushing data while holding directory locks in nfs_rename() (Trond Myklebust)
  - char: tpm: tpm-buf: Add sanity check fallback in read helpers (Purva Yeshi)
  - drm/xe: Save the gt pointer in lrc and drop the tile (Umesh Nerlige Ramappa)
  - drm/xe/xe2hpg: Add Wa_22021007897 (Aradhya Bhatia)
  - nvme-pci: add NVME_QUIRK_NO_DEEPEST_PS quirk for SOLIDIGM P44 Pro (Ilya Guterman)
  - spi: spi-sun4i: fix early activation (Alessandro Grassi)
  - phy: phy-rockchip-samsung-hdptx: Fix PHY PLL output 50.25MHz error (Algea Cao)
  - phy: starfive: jh7110-usb: Fix USB 2.0 host occasional detection failure (Hal Feng)
  - drm/amd/display: check stream id dml21 wrapper to get plane_id (Aurabindo Pillai)
  - drm/amd/display: fix link_set_dpms_off multi-display MST corner case (George Shen)
  - gpio: virtuser: fix potential out-of-bound write (Markus Burri) [Orabug: 38095181] {CVE-2025-38082}
  - um: let 'make clean' properly clean underlying SUBARCH as well (Masahiro Yamada)
  - platform/x86: thinkpad_acpi: Support also NEC Lavie X1475JAS (John Chau)
  - nfs: don't share pNFS DS connections between net namespaces (Jeff Layton)
  - HID: quirks: Add ADATA XPG alpha wireless mouse support (Milton Barrera)
  - dmaengine: idxd: cdev: Fix uninitialized use of sva in idxd_cdev_open (Purva Yeshi)
  - coredump: hand a pidfd to the usermode coredump helper (Christian Brauner)
  - coredump: fix error handling for replace_fd() (Christian Brauner)
  - perf/arm-cmn: Add CMN S3 ACPI binding (Robin Murphy)
  - perf/arm-cmn: Initialise cmn->cpu earlier (Robin Murphy)
  - perf/arm-cmn: Fix REQ2/SNP2 mixup (Robin Murphy)
  - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Pedro Tammela) [Orabug: 38049363] {CVE-2025-38001}
  - arm64: dts: ti: k3-j784s4-j742s2-main-common: Fix length of serdes_ln_ctrl (Siddharth Vadapalli)
  - arm64: dts: ti: k3-j722s-main: Disable "serdes_wiz0" and "serdes_wiz1" (Siddharth Vadapalli)
  - arm64: dts: ti: k3-j722s-evm: Enable "serdes_wiz0" and "serdes_wiz1" (Siddharth Vadapalli)
  - arm64: dts: ti: k3-j721e-sk: Add requiried voltage supplies for IMX219 (Yemike Abhilash Chandra)
  - arm64: dts: ti: k3-j721e-sk: Remove clock-names property from IMX219 overlay (Yemike Abhilash Chandra)
  - arm64: dts: ti: k3-j721e-sk: Add DT nodes for power regulators (Yemike Abhilash Chandra)
  - arm64: dts: ti: k3-am68-sk: Fix regulator hierarchy (Yemike Abhilash Chandra)
  - arm64: dts: ti: k3-am65-main: Add missing taps to sdhci0 (Judith Mendez)
  - arm64: dts: ti: k3-am62x: Rename I2C switch to I2C mux in OV5640 overlay (Yemike Abhilash Chandra)
  - arm64: dts: ti: k3-am62x: Rename I2C switch to I2C mux in IMX219 overlay (Yemike Abhilash Chandra)
  - arm64: dts: ti: k3-am62x: Remove clock-names property from IMX219 overlay (Yemike Abhilash Chandra)
  - arm64: dts: ti: k3-am62p-j722s-common-main: Set eMMC clock parent to default (Judith Mendez)
  - arm64: dts: ti: k3-am62a-main: Set eMMC clock parent to default (Judith Mendez)
  - arm64: dts: ti: k3-am62-main: Set eMMC clock parent to default (Judith Mendez)
  - arm64: dts: qcom: x1e80100: Fix video thermal zone (Stephan Gerhold)
  - arm64: dts: qcom: x1e80100-yoga-slim7x: mark l12b and l15b always-on (Johan Hovold)
  - arm64: dts: qcom: x1e80100-qcp: mark l12b and l15b always-on (Johan Hovold)
  - arm64: dts: qcom: x1e80100-qcp: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
  - arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
  - arm64: dts: qcom: x1e80100-asus-vivobook-s15: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
  - arm64: dts: qcom: sm8650: Add missing properties for cryptobam (Stephan Gerhold)
  - arm64: dts: qcom: sm8550: Add missing properties for cryptobam (Stephan Gerhold)
  - arm64: dts: qcom: sm8450: Add missing properties for cryptobam (Stephan Gerhold)
  - arm64: dts: qcom: sm8350: Fix typo in pil_camera_mem node (Alok Tiwari)
  - arm64: dts: qcom: sa8775p: Remove cdsp compute-cb@10 (Karthik Sanagavarapu)
  - arm64: dts: qcom: sa8775p: Remove extra entries from the iommus property (Ling Xu)
  - arm64: dts: qcom: ipq9574: Add missing properties for cryptobam (Stephan Gerhold)
  - can: kvaser_pciefd: Force IRQ edge in case of nested IRQ (Axel Forsman)
  - RDMA/bnxt_re: Remove unusable nq variable (Leon Romanovsky) [Orabug: 37822348]
  - RDMA/bnxt_re: Fix budget handling of notification queue (Kashyap Desai) [Orabug: 37822348]
  - bnxt_en: Add FW trace coredump segments to the coredump (Shruti Parab) [Orabug: 37822348]
  - bnxt_en: Add a new ethtool -W dump flag (Michael Chan) [Orabug: 37822348]
  - bnxt_en: Add 2 parameters to bnxt_fill_coredump_seg_hdr() (Shruti Parab) [Orabug: 37822348]
  - bnxt_en: Add functions to copy host context memory (Sreekanth Reddy) [Orabug: 37822348]
  - bnxt_en: Do not free FW log context memory (Hongguang Gao) [Orabug: 37822348]
  - bnxt_en: Manage the FW trace context memory (Shruti Parab) [Orabug: 37822348]
  - bnxt_en: Allocate backing store memory for FW trace logs (Shruti Parab) [Orabug: 37822348]
  - bnxt_en: Add a 'force' parameter to bnxt_free_ctx_mem() (Hongguang Gao) [Orabug: 37822348]
  - bnxt_en: Refactor bnxt_free_ctx_mem() (Hongguang Gao) [Orabug: 37822348]
  - bnxt_en: Add mem_valid bit to struct bnxt_ctx_mem_type (Shruti Parab) [Orabug: 37822348]
  - bnxt_en: refactor bnxt_alloc_rx_rings() to call bnxt_alloc_rx_agg_bmap() (David Wei) [Orabug: 37822348]
  - bnxt_en: ethtool: Support unset l4proto on ip4/ip6 ntuple rules (Daniel Xu) [Orabug: 37822348]
  - bnxt_en: ethtool: Remove ip4/ip6 ntuple support for IPPROTO_RAW (Daniel Xu) [Orabug: 37822348]
  - bnxt_en: use irq_update_affinity_hint() (Mohammad Heib) [Orabug: 37822348]
  - bnxt_en: add unlocked version of bnxt_refclk_read (Vadim Fedorenko) [Orabug: 37822348]
  - bnxt_en: replace PTP spinlock with seqlock (Vadim Fedorenko) [Orabug: 37822348]
  - bnxt_en: cache only 24 bits of hw counter (Vadim Fedorenko) [Orabug: 37822348]
  - bnxt_en: Update firmware interface spec to 1.10.3.85 (Michael Chan) [Orabug: 37822348]
  - bnxt_en: Skip reading PXP registers during ethtool -d if unsupported (Michael Chan) [Orabug: 37822348]
  - bnxt_en: Skip MAC loopback selftest if it is unsupported by FW (Michael Chan) [Orabug: 37822348]
  - bnxt_en: Skip PHY loopback ethtool selftest if unsupported by FW (Michael Chan) [Orabug: 37822348]
  - bnxt_en: Do not allow ethtool -m on an untrusted VF (Michael Chan) [Orabug: 37822348]
  - RDMA/bnxt_re: Fix reporting maximum SRQs on P7 chips (Preethi G) [Orabug: 37822348]
  - RDMA/bnxt_re: Fix allocation of QP table (Kashyap Desai) [Orabug: 37822348]
  - RDMA/bnxt_re: Remove deliver net device event (Yuyu Li) [Orabug: 37822348]
  - RDMA/bnxt_re: Remove unnecessary goto in bnxt_re_netdev_event (Kalesh Ap) [Orabug: 37822348]
  - RDMA/bnxt_re: Remove extra new line in bnxt_re_netdev_event (Kalesh Ap) [Orabug: 37822348]
  - RDMA/bnxt_re: Optimize error handling in bnxt_re_probe (Kalesh Ap) [Orabug: 37822348]
  - RDMA/bnxt_re: Fix an issue in bnxt_re_async_notifier (Kalesh Ap) [Orabug: 37822348]
  - RDMA/bnxt_re: Pass the context for ulp_irq_stop (Kalesh Ap) [Orabug: 37822348]
  - RDMA/bnxt_re: Add support to handle DCB_CONFIG_CHANGE event (Kalesh Ap) [Orabug: 37822348]
  - RDMA/bnxt_re: Query firmware defaults of CC params during probe (Kalesh Ap) [Orabug: 37822348]
  - RDMA/bnxt_re: Add Async event handling support (Kalesh Ap) [Orabug: 37822348]
  - RDMA/bnxt_re: Remove unnecessary header file inclusion (Kalesh Ap) [Orabug: 37822348]
  - RDMA/bnxt_re: Eliminate need for some forward declarations (Kalesh Ap) [Orabug: 37822348]
  - bnxt_en: Add ULP call to notify async events (Michael Chan) [Orabug: 37822348]
  - RDMA/bnxt_re: Fix issue in the unload path (Kalesh Ap) [Orabug: 37822348]
  - RDMA/bnxt_re: Fix setting mandatory attributes for modify_qp (Damodharam Ammepalli) [Orabug: 37822348]
  - RDMA/bnxt_re: Don't fail destroy QP and cleanup debugfs earlier (Kalesh Ap) [Orabug: 37822348]
  - RDMA/bnxt_re: Use the default mode of congestion control (Kalesh Ap) [Orabug: 37822348]
  - RDMA/bnxt_re: Support different traffic class (Chandramohan Akula) [Orabug: 37822348]
  - RDMA/bnxt_re: Refurbish CQ to NQ hash calculation (Kalesh Ap) [Orabug: 37822348]
  - RDMA/bnxt_re: Enhance RoCE SRIOV resource configuration design (Bhargava Chenna Marreddy) [Orabug: 37822348]
  - bnxt_en: Add support for RoCE sriov configuration (Vikas Gupta) [Orabug: 37822348]
  - RDMA/bnxt_re: Add debugfs hook in the driver (Kalesh Ap) [Orabug: 37822348]
  - RDMA/bnxt_re: Support raw data query for each resources (Kashyap Desai) [Orabug: 37822348]
  - RDMA/bnxt_re: Add support for querying HW contexts (Kashyap Desai) [Orabug: 37822348]
  - RDMA/bnxt_re: Support driver specific data collection using rdma tool (Kashyap Desai) [Orabug: 37822348]
  - RDMA/bnxt_re: Fix access flags for MR and QP modify (Hongguang Gao) [Orabug: 37822348]
  - RDMA/bnxt_re: Add support for CQ rx coalescing (Chandramohan Akula) [Orabug: 37822348]
  - RDMA/bnxt_re: Add support for optimized modify QP (Kalesh Ap) [Orabug: 37822348]
  - mm/memcontrol: Fix LRU reparenting logic when !MGLRU (Kamalesh Babulal) [Orabug: 37920452]
  - mm: multi-gen LRU: skip rotation of offlined memcgs (Harry Yoo) [Orabug: 37997501]
  - mm: lru: move VM_WARN_ON_ONCE_FOLIO before MGLRU functions (Harry Yoo) [Orabug: 37997580]
  - mm: thp: replace folio_memcg() with folio_memcg_charged() (Muchun Song) [Orabug: 37997580]
  - mm: zswap: prevent lruvec release in zswap_folio_swapin() (Muchun Song) [Orabug: 37997580]
  - mm: workingset: prevent lruvec release in workingset_refault() (Muchun Song) [Orabug: 37997580]
  - mm: page_io: prevent memory cgroup release in page_io module (Muchun Song) [Orabug: 37997580]
  - mm: workingset: prevent memory cgroup release in lru_gen_eviction() (Muchun Song) [Orabug: 37997580]
  - writeback: prevent memory cgroup release in writeback module (Muchun Song) [Orabug: 37997580]
  - mm: memcontrol: protect lruvec critical section with the RCU read lock (Harry Yoo) [Orabug: 37997580]
  - mm: vmscan: disable IRQ before __mod_lruvec_state() (Harry Yoo) [Orabug: 37997618]
  - mm: multi-gen LRU: fix two warnings in evict_folios() (Harry Yoo) [Orabug: 37997618]
  - mm: multi-gen LRU: update lrugen->nr_pages during lruvec reparenting (Harry Yoo) [Orabug: 37997618]
  - ocfs2: fix the issue with discontiguous allocation in the global_bitmap (Heming Zhao) [Orabug: 38041352]
  - Reapply "ocfs2: fix sparse warnings" (Gautham Ananthakrishna) [Orabug: 38041352]
  - Reapply "ocfs2: speed up chain-list searching" (Gautham Ananthakrishna) [Orabug: 38041352]
  - Reapply "ocfs2: adjust enabling place for la window" (Gautham Ananthakrishna) [Orabug: 38041352]
  - Reapply "ocfs2: improve write IO performance when fragmentation is high" (Gautham Ananthakrishna) [Orabug: 38041352]


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-101.33.3.el9uek]
changelog:
  - mm: do not write protect COW mappings when preserving across exec (Anthony Yznaga) [Orabug: 38029049]
  - mm: hold the source mmap write lock when copying PTEs (Anthony Yznaga) [Orabug: 38029049]
  - Enable EROFS modules and related config options (Harshit Mogalapalli) [Orabug: 38042713]


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-101.33.4.el9uek]
changelog:
  - rds: ib: Add cm_id generation scheme in order to detect new ones (Håkon Bugge)  [Orabug: 37617972]
  - uek-rpm: Enable the FWCTL PDS and CXL support in UEK8 (Qing Huang)  [Orabug: 38006732]
  - cxl/feature: Update out_len in set feature failure case (Li Ming)  [Orabug: 38006732]
  - cxl: Fix devm host device for CXL fwctl initialization (Dave Jiang)  [Orabug: 38006732]
  - fwctl/cxl: Fix uuid_t usage in uapi (Dan Williams)  [Orabug: 38006732]
  - pds_fwctl: add Documentation entries (Shannon Nelson)  [Orabug: 38006732]
  - pds_fwctl: add rpc and query support (Brett Creeley)  [Orabug: 38006732]
  - pds_fwctl: initial driver framework (Shannon Nelson)  [Orabug: 38006732]
  - pds_core: add new fwctl auxiliary_device (Shannon Nelson)  [Orabug: 38006732]
  - cxl: Fixup kdoc issues for include/cxl/features.h (Dave Jiang)  [Orabug: 38006732]
  - fwctl/cxl: Add documentation to FWCTL CXL (Dave Jiang)  [Orabug: 38006732]
  - cxl/test: Add Set Feature support to cxl_test (Dave Jiang)  [Orabug: 38006732]
  - cxl/test: Add Get Feature support to cxl_test (Dave Jiang)  [Orabug: 38006732]
  - cxl: Add support to handle user feature commands for set feature (Dave Jiang)  [Orabug: 38006732]
  - cxl: Add support to handle user feature commands for get feature (Dave Jiang)  [Orabug: 38006732]
  - cxl: Add support for fwctl RPC command to enable CXL feature commands (Dave Jiang)  [Orabug: 38006732]
  - cxl: Move cxl feature command structs to user header (Dave Jiang)  [Orabug: 38006732]
  - cxl: Add FWCTL support to CXL (Dave Jiang)  [Orabug: 38006732]
  - cxl: Setup exclusive CXL features that are reserved for the kernel (Dave Jiang)  [Orabug: 38006732]
  - cxl/mbox: Add SET_FEATURE mailbox command (Shiju Jose)  [Orabug: 38006732]
  - cxl/mbox: Add GET_FEATURE mailbox command (Shiju Jose)  [Orabug: 38006732]
  - cxl/test: Add Get Supported Features mailbox command support (Dave Jiang)  [Orabug: 38006732]
  - cxl: Add Get Supported Features command for kernel usage (Dave Jiang)  [Orabug: 38006732]
  - cxl: Enumerate feature commands (Dave Jiang)  [Orabug: 38006732]
  - cxl: Refactor user ioctl command path from mds to mailbox (Dave Jiang)  [Orabug: 38006732]
  - vhost-scsi: Fix log flooding with target does not exist errors (Mike Christie)  [Orabug: 38053075]
  - vhost-scsi: Change def inline_sg_cnt and max_io_vqs for exadata (Mike Christie)  [Orabug: 38053233]
  - sched/numa: add tracepoint that tracks the skipping of numa balancing due to cpuset memory pinning (Libo Chen)  [Orabug: 38070168]
  - sched/numa: skip VMA scanning on memory pinned to one NUMA node via cpuset.mems (Libo Chen)  [Orabug: 38070168]
  - uek-rpm: Enable CONFIG_SERIAL_RP2 as m (Samasth Norway Ananda)  [Orabug: 38091733]
  - serial: update the rp2 driver code (Samasth Norway Ananda)  [Orabug: 38091733]


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-101.33.4.1.el9uek]
changelog:
  - Add Zen34 clients (Borislav Petkov (AMD))  [Orabug: 38023239]  {CVE-2024-36350} {CVE-2024-36357}
  - x86/process: Move the buffer clearing before MONITOR (Kim Phillips)  [Orabug: 38023239]  {CVE-2024-36350} {CVE-2024-36357}
  - Add normal counters (Borislav Petkov (AMD))  [Orabug: 38023239]  {CVE-2024-36350} {CVE-2024-36357}
  - KVM: SVM: Advertize TSA CPUID bits to guests (Borislav Petkov (AMD))  [Orabug: 38023239]  {CVE-2024-36350} {CVE-2024-36357}
  - x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov (AMD))  [Orabug: 38023239]  {CVE-2024-36350} {CVE-2024-36357}
  - x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov (AMD))  [Orabug: 38023239]  {CVE-2024-36350} {CVE-2024-36357}


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-101.33.4.2.el9uek]
changelog:
  - sunrpc: handle SVC_GARBAGE during svc auth processing as auth error (Jeff Layton)  [Orabug: 38178286]  {CVE-2025-38089}
  - mm: memcontrol: remove memcg from LRU on release instead of offline (Harry Yoo)  [Orabug: 38162790]
  - Revert "SUNRPC: Don't allow waiting for exiting tasks" (Harshvardhan Jha)  [Orabug: 38175263]
  - ipv6: replace ipcm6_init calls with ipcm6_init_sk (Willem de Bruijn)  [Orabug: 38175246]
  - ipv6: remove leftover ip6 cookie initializer (Willem de Bruijn)  [Orabug: 38175246]


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-101.33.4.el9uek]
changelog:
  - rds: ib: Add cm_id generation scheme in order to detect new ones (Håkon Bugge) [Orabug: 37617972]
  - uek-rpm: Enable the FWCTL PDS and CXL support in UEK8 (Qing Huang) [Orabug: 38006732]
  - cxl/feature: Update out_len in set feature failure case (Li Ming) [Orabug: 38006732]
  - cxl: Fix devm host device for CXL fwctl initialization (Dave Jiang) [Orabug: 38006732]
  - fwctl/cxl: Fix uuid_t usage in uapi (Dan Williams) [Orabug: 38006732]
  - pds_fwctl: add Documentation entries (Shannon Nelson) [Orabug: 38006732]
  - pds_fwctl: add rpc and query support (Brett Creeley) [Orabug: 38006732]
  - pds_fwctl: initial driver framework (Shannon Nelson) [Orabug: 38006732]
  - pds_core: add new fwctl auxiliary_device (Shannon Nelson) [Orabug: 38006732]
  - cxl: Fixup kdoc issues for include/cxl/features.h (Dave Jiang) [Orabug: 38006732]
  - fwctl/cxl: Add documentation to FWCTL CXL (Dave Jiang) [Orabug: 38006732]
  - cxl/test: Add Set Feature support to cxl_test (Dave Jiang) [Orabug: 38006732]
  - cxl/test: Add Get Feature support to cxl_test (Dave Jiang) [Orabug: 38006732]
  - cxl: Add support to handle user feature commands for set feature (Dave Jiang) [Orabug: 38006732]
  - cxl: Add support to handle user feature commands for get feature (Dave Jiang) [Orabug: 38006732]
  - cxl: Add support for fwctl RPC command to enable CXL feature commands (Dave Jiang) [Orabug: 38006732]
  - cxl: Move cxl feature command structs to user header (Dave Jiang) [Orabug: 38006732]
  - cxl: Add FWCTL support to CXL (Dave Jiang) [Orabug: 38006732]
  - cxl: Setup exclusive CXL features that are reserved for the kernel (Dave Jiang) [Orabug: 38006732]
  - cxl/mbox: Add SET_FEATURE mailbox command (Shiju Jose) [Orabug: 38006732]
  - cxl/mbox: Add GET_FEATURE mailbox command (Shiju Jose) [Orabug: 38006732]
  - cxl/test: Add Get Supported Features mailbox command support (Dave Jiang) [Orabug: 38006732]
  - cxl: Add Get Supported Features command for kernel usage (Dave Jiang) [Orabug: 38006732]
  - cxl: Enumerate feature commands (Dave Jiang) [Orabug: 38006732]
  - cxl: Refactor user ioctl command path from mds to mailbox (Dave Jiang) [Orabug: 38006732]
  - vhost-scsi: Fix log flooding with target does not exist errors (Mike Christie) [Orabug: 38053075]
  - vhost-scsi: Change def inline_sg_cnt and max_io_vqs for exadata (Mike Christie) [Orabug: 38053233]
  - sched/numa: add tracepoint that tracks the skipping of numa balancing due to cpuset memory pinning (Libo Chen) [Orabug: 38070168]
  - sched/numa: skip VMA scanning on memory pinned to one NUMA node via cpuset.mems (Libo Chen) [Orabug: 38070168]
  - uek-rpm: Enable CONFIG_SERIAL_RP2 as m (Samasth Norway Ananda) [Orabug: 38091733]
  - serial: update the rp2 driver code (Samasth Norway Ananda) [Orabug: 38091733]


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-102.33.1.el9uek]
changelog:
  - net/mlx5: Expose ICM consumption per function (Akiva Goldberger)  [Orabug: 38063374]
  - net/mlx5: Rename and move mlx5_esw_query_vport_vhca_id (Akiva Goldberger)  [Orabug: 38063374]
  - net/mlx5: Add nic_cap_reg and vhca_icm_ctrl registers (Akiva Goldberger)  [Orabug: 38063374]
  - mm: memcontrol: remove memcg from LRU on release instead of offline (Harry Yoo)  [Orabug: 38092785]
  - net/rds: tracepoints for rds_conn_kref_get and put (Sharath Srinivasan)  [Orabug: 38118654]
  - net/rds: Add krefs to struct rds_connection (Sharath Srinivasan)  [Orabug: 38118654]
  - net/rds: Add missing switch/break in rds_recv_worker() (Sharath Srinivasan)  [Orabug: 38118666]
  - net/rds: Merge uses of conn->c_destroy_in_prog & RDS_DESTROY_PENDING (Sharath Srinivasan)  [Orabug: 38118675]


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-102.36.2.el9uek]
changelog:
  - LTS version: v6.12.36 (Jack Vogel)
  - spi: fsl-qspi: Fix double cleanup in probe error path (Kevin Hao)
  - btrfs: fix use-after-free on inode when scanning root during em shrinking (Sasha Levin)
  - btrfs: zoned: fix extent range end unlock in cow_file_range() (Naohiro Aota)
  - spi: fsl-qspi: use devm function instead of driver remove (Han Xu)
  - net: stmmac: Fix accessing freed irq affinity_hint (Qingfang Deng)
  - drm/amdkfd: Fix instruction hazard in gfx12 trap handler (Jay Cornwall)
  - drm/amdkfd: remove gfx 12 trap handler page size cap (Jonathan Kim)
  - ALSA: hda/realtek: Bass speaker fixup for ASUS UM5606KA (Andres Traumann)
  - arm64: dts: rockchip: Add avdd HDMI supplies to RockPro64 board dtsi (Dragan Simic)
  - riscv/atomic: Do proper sign extension also for unsigned in arch_cmpxchg (Sasha Levin)
  - btrfs: do regular iput instead of delayed iput during extent map shrinking (Filipe Manana)
  - btrfs: make the extent map shrinker run asynchronously as a work queue job (Filipe Manana)
  - btrfs: skip inodes without loaded extent maps when shrinking extent maps (Filipe Manana)
  - drm/fbdev-dma: Add shadow buffering for deferred I/O (Thomas Zimmermann)
  - drm/msm/dp: account for widebus and yuv420 during mode validation (Sasha Levin)
  - usb: typec: tcpm: PSSourceOffTimer timeout in PR_Swap enters ERROR_RECOVERY (Sasha Levin)
  - drm/xe: Carve out wopcm portion from the stolen memory (Sasha Levin)
  - iio: dac: ad3552r-common: fix ad3541/2r ranges (Angelo Dureghello)
  - iio: dac: ad3552r: extract common code (no changes in behavior intended) (Angelo Dureghello)
  - iio: dac: ad3552r: changes to use FIELD_PREP (Angelo Dureghello)
  - btrfs: do proper folio cleanup when cow_file_range() failed (Qu Wenruo)
  - net: phy: realtek: add RTL8125D-internal PHY (Heiner Kallweit)
  - net: phy: realtek: merge the drivers for internal NBase-T PHY's (Heiner Kallweit)
  - r8169: add support for RTL8125D (Heiner Kallweit)
  - mm/vma: reset VMA iterator on commit_merge() OOM failure (Lorenzo Stoakes)
  - io_uring/kbuf: flag partial buffer mappings (Jens Axboe)
  - io_uring/net: mark iov as dynamically allocated even for single segments (Jens Axboe)
  - io_uring/net: always use current transfer count for buffer put (Jens Axboe)
  - io_uring/net: only consider msg_inq if larger than 1 (Jens Axboe)
  - io_uring/net: only retry recv bundle for a full transfer (Jens Axboe)
  - io_uring/net: improve recv bundles (Jens Axboe)
  - io_uring/rsrc: don't rely on user vaddr alignment (Pavel Begunkov)
  - io_uring/rsrc: fix folio unpinning (Pavel Begunkov)
  - io_uring: fix potential page leak in io_sqe_buffer_register() (Penglei Jiang)
  - net: libwx: fix Tx L4 checksum (Jiawen Wu)
  - x86/pkeys: Simplify PKRU update in signal frame (Chang S. Bae)
  - x86/fpu: Refactor xfeature bitmask update code for sigframe XSAVE (Chang S. Bae)
  - media: uvcvideo: Rollback non processed entities on error (Ricardo Ribalda)
  - drm/amd/display: Fix mpv playback corruption on weston (Alex Hung)
  - drm/amdgpu: switch job hw_fence to amdgpu_fence (Alex Deucher)
  - drm/amdgpu: Fix SDMA UTC_L1 handling during start/stop sequences (Jesse Zhang)
  - drm/i915/dsi: Fix off by one in BXT_MIPI_TRANS_VTOTAL (Ville Syrjälä)
  - drm/xe: Fix early wedge on GuC load failure (Daniele Ceraolo Spurio)
  - drm/xe: Fix taking invalid lock on wedge (Lucas De Marchi)
  - drm/xe: Fix memset on iomem (Lucas De Marchi)
  - drm/amd/display: Check dce_hwseq before dereferencing it (Alex Hung)
  - drm/amdgpu: Add kicker device detection (Frank Min)
  - drm/amd/display: Fix RMCM programming seq errors (Yihan Zhu)
  - drm/xe/guc_submit: add back fix (Matthew Auld)
  - drm/xe/sched: stop re-submitting signalled jobs (Matthew Auld)
  - drm/xe/vm: move rebind_work init earlier (Matthew Auld)
  - drm/amd/display: Correct non-OLED pre_T11_delay. (Zhongwei Zhang)
  - drm/amdgpu: amdgpu_vram_mgr_new(): Clamp lpfn to total vram (John Olender)
  - drm/amd/display: Add null pointer check for get_first_active_display() (Wentao Liang)
  - drm/bridge: cdns-dsi: Wait for Clk and Data Lanes to be ready (Aradhya Bhatia)
  - drm/bridge: cdns-dsi: Check return value when getting default PHY config (Aradhya Bhatia)
  - drm/bridge: cdns-dsi: Fix connecting to next bridge (Aradhya Bhatia)
  - drm/bridge: cdns-dsi: Fix phy de-init and flag it so (Aradhya Bhatia)
  - drm/bridge: cdns-dsi: Fix the clock variable for mode_valid() (Aradhya Bhatia)
  - drm/amdkfd: Fix race in GWS queue scheduling (Jay Cornwall)
  - drm/msm/gpu: Fix crash when throttling GPU immediately during boot (Stephan Gerhold)
  - drm/udl: Unregister device before cleaning up on disconnect (Thomas Zimmermann)
  - drm/tegra: Fix a possible null pointer dereference (Qiu-ji Chen)
  - drm/tegra: Assign plane type before registration (Thierry Reding)
  - drm/etnaviv: Protect the scheduler's pending list with its lock (Maíra Canal)
  - drm/cirrus-qemu: Fix pitch programming (Thomas Zimmermann)
  - drm/ast: Fix comment on modeset lock (Thomas Zimmermann)
  - scsi: ufs: core: Fix clk scaling to be conditional in reset and restore (anvithdosapati)
  - scsi: megaraid_sas: Fix invalid node index (Chen Yu)
  - HID: wacom: fix kobject reference count leak (Qasim Ijaz)
  - HID: wacom: fix memory leak on sysfs attribute creation failure (Qasim Ijaz)
  - HID: wacom: fix memory leak on kobject creation failure (Qasim Ijaz)
  - HID: lenovo: Restrict F7/9/11 mode to compact keyboards only (Iusico Maxim)
  - f2fs: fix to zero post-eof page (Chao Yu)
  - mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked" (David Hildenbrand)
  - maple_tree: fix MA_STATE_PREALLOC flag in mas_preallocate() (Liam R. Howlett)
  - net: libwx: fix the creation of page_pool (Jiawen Wu)
  - spi: spi-cadence-quadspi: Fix pm runtime unbalance (Khairul Anuar Romli)
  - btrfs: update superblock's device bytes_used when dropping chunk (Mark Harmstone)
  - btrfs: fix a race between renames and directory logging (Filipe Manana)
  - dm-raid: fix variable in journal device check (Heinz Mauelshagen)
  - Bluetooth: L2CAP: Fix L2CAP MTU negotiation (Frédéric Danis)
  - serial: imx: Restore original RXTL for console to fix data loss (Fabio Estevam)
  - serial: core: restore of_node information in sysfs (Aidan Stewart)
  - dt-bindings: serial: 8250: Make clocks and clock-frequency exclusive (Yao Zi)
  - staging: rtl8723bs: Avoid memset() in aes_cipher() and aes_decipher() (Nathan Chancellor)
  - x86/traps: Initialize DR6 by writing its architectural reset value (Xin Li (Intel))
  - EDAC/amd64: Fix size calculation for Non-Power-of-Two DIMMs (Avadhut Naik)
  - cifs: Fix reading into an ITER_FOLIOQ from the smbdirect code (David Howells)
  - cifs: Fix the smbd_response slab to allow usercopy (David Howells)
  - smb: client: make use of common smbdirect_socket_parameters (Stefan Metzmacher)
  - smb: smbdirect: introduce smbdirect_socket_parameters (Stefan Metzmacher)
  - smb: client: make use of common smbdirect_socket (Stefan Metzmacher)
  - smb: smbdirect: add smbdirect_socket.h (Stefan Metzmacher)
  - smb: smbdirect: add smbdirect.h with public structures (Stefan Metzmacher)
  - smb: client: make use of common smbdirect_pdu.h (Stefan Metzmacher)
  - smb: smbdirect: add smbdirect_pdu.h with protocol definitions (Stefan Metzmacher)
  - smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara)
  - drm/xe: Process deferred GGTT node removals on device unwind (Michal Wajdeczko)
  - drm/bridge: ti-sn65dsi86: Add HPD for DisplayPort connector type (Jayesh Choudhary)
  - drm/bridge: ti-sn65dsi86: make use of debugfs_init callback (Wolfram Sang)
  - drm/i915: fix build error some more (Arnd Bergmann)
  - drm/amd: Adjust output for discovery error handling (Mario Limonciello)
  - drm/amdgpu/discovery: optionally use fw based ip discovery (Alex Deucher)
  - net: selftests: fix TCP packet checksum (Jakub Kicinski)
  - ALSA: hda/realtek: Fix built-in mic on ASUS VivoBook X507UAR (Salvatore Bonaccorso)
  - atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister(). (Kuniyuki Iwashima)
  - netlink: specs: tc: replace underscores with dashes in names (Jakub Kicinski)
  - net: enetc: Correct endianness handling in _enetc_rd_reg64 (Simon Horman)
  - libbpf: Fix possible use-after-free for externs (Adin Scannell)
  - um: ubd: Add missing error check in start_io_thread() (Tiwei Bie)
  - bnxt: properly flush XDP redirect lists (Yan Zhai)
  - vsock/uapi: fix linux/vm_sockets.h userspace compilation errors (Stefano Garzarella)
  - wifi: mac80211: finish link init before RCU publish (Johannes Berg)
  - wifi: mac80211: Create separate links for VLAN interfaces (Muna Sinada)
  - wifi: mac80211: Add link iteration macro for link data (Muna Sinada)
  - af_unix: Don't set -ECONNRESET for consumed OOB skb. (Kuniyuki Iwashima)
  - wifi: mac80211: fix beacon interval calculation overflow (Lachlan Hodges)
  - ethernet: ionic: Fix DMA mapping tests (Thomas Fourier)
  - libbpf: Fix null pointer dereference in btf_dump__free on allocation failure (Yuan Chen)
  - attach_recursive_mnt(): do not lock the covering tree when sliding something under it (Al Viro)
  - ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() (Youngjun Lee)
  - Bluetooth: hci_core: Fix use-after-free in vhci_flush() (Kuniyuki Iwashima)
  - atm: clip: prevent NULL deref in clip_push() (Eric Dumazet)
  - HID: wacom: fix crash in wacom_aes_battery_handler() (Thomas Zeitlhofer)
  - drm/xe/display: Add check for alloc_ordered_workqueue() (Haoxiang Li)
  - Revert "riscv: misaligned: fix sleeping function called during misaligned access handling" (Nam Cao)
  - Revert "riscv: Define TASK_SIZE_MAX for __access_ok()" (Nam Cao)
  - lib/group_cpus: fix NULL pointer dereference from group_cpus_evenly() (Yu Kuai)
  - fs/proc/task_mmu: fix PAGE_IS_PFNZERO detection for the huge zero folio (David Hildenbrand)
  - s390/pkey: Prevent overflow in size calculation for memdup_user() (Fedor Pchelkin)
  - ASoC: amd: yc: Add DMI quirk for Lenovo IdeaPad Slim 5 15 (Oliver Schramm)
  - mm/damon/sysfs-schemes: free old damon_sysfs_scheme_filter->memcg_path on write (SeongJae Park)
  - smb: client: remove 	 from TP_printk statements (Stefan Metzmacher)
  - ata: ahci: Use correct DMI identifier for ASUSPRO-D840SA LPM quirk (Niklas Cassel)
  - i2c: robotfuzz-osif: disable zero-length read messages (Wolfram Sang)
  - i2c: tiny-usb: disable zero-length read messages (Wolfram Sang)
  - af_unix: Don't leave consecutive consumed OOB skbs. (Kuniyuki Iwashima)
  - accel/ivpu: Trigger device recovery on engine reset/resume failure (Karol Wachowski)
  - accel/ivpu: Add debugfs interface for setting HWS priority bands (Karol Wachowski)
  - accel/ivpu: Separate DB ID and CMDQ ID allocations from CMDQ allocation (Karol Wachowski)
  - accel/ivpu: Make command queue ID allocated on XArray (Karol Wachowski)
  - accel/ivpu: Remove copy engine support (Andrzej Kacprowski)
  - accel/ivpu: Do not fail on cmdq if failed to allocate preemption buffers (Karol Wachowski)
  - PCI: apple: Set only available ports up (Janne Grunau)
  - PCI: apple: Use helper function for_each_child_of_node_scoped() (Zhang Zekun)
  - f2fs: don't over-report free space or inodes in statvfs (Chao Yu)
  - ASoC: codecs: wcd9335: Fix missing free of regulator supplies (Krzysztof Kozlowski)
  - ASoC: codec: wcd9335: Convert to GPIO descriptors (Peng Fan)
  - jfs: validate AG parameters in dbMount() to prevent crashes (Vasiliy Kovalev)
  - fs/jfs: consolidate sanity checking in dbMount (Dave Kleikamp)
  - btrfs: fix qgroup reservation leak on failure to allocate ordered extent (Filipe Manana)
  - btrfs: use unsigned types for constants defined as bit shifts (David Sterba)
  - btrfs: factor out nocow ordered extent and extent map generation into a helper (Qu Wenruo)
  - Revert "drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1" (Joonas Lahtinen)
  - drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1 (Ville Syrjälä)
  - btrfs: handle csum tree error with rescue=ibadroots correctly (Qu Wenruo)
  - ovl: Check for NULL d_inode() in ovl_dentry_upper() (Kees Cook)
  - scsi: ufs: core: Don't perform UFS clkscaling during host async scan (Ziqi Chen)
  - ceph: fix possible integer overflow in ceph_zero_objects() (Dmitry Kandybka)
  - ASoC: rt1320: fix speaker noise when volume bar is 100% (Shuming Fan)
  - ALSA: usb-audio: Add a quirk for Lenovo Thinkpad Thunderbolt 3 dock (Mario Limonciello)
  - ALSA: hda: Add new pci id for AMD GPU display HD audio controller (Vijendar Mukunda)
  - ALSA: hda: Ignore unsol events for cards being shut down (Cezary Rojewski)
  - riscv: add a data fence for CMODX in the kernel mode (Andy Chiu)
  - usb: typec: mux: do not return on EOPNOTSUPP in {mux, switch}_set (Michael Grzeschik)
  - usb: typec: displayport: Receive DP Status Update NAK request exit dp altmode (Jos Wang)
  - usb: gadget: f_hid: wake up readers on disable/unbind (Peter Korsgaard)
  - usb: cdc-wdm: avoid setting WDM_READ for ZLP-s (Robert Hodaszi)
  - usb: Add checks for snprintf() calls in usb_alloc_dev() (Andy Shevchenko)
  - usb: common: usb-conn-gpio: use a unique name for usb connector device (Chance Yang)
  - tty: serial: uartlite: register uart driver in init (Jakub Lewalski)
  - usb: potential integer overflow in usbg_make_tpg() (Chen Yufeng)
  - misc: tps6594-pfsm: Add NULL pointer check in tps6594_pfsm_probe() (Chenyuan Yang)
  - iio: adc: ad_sigma_delta: Fix use of uninitialized status_pos (Purva Yeshi)
  - usb: dwc2: also exit clock_gating when stopping udc while suspended (Michael Grzeschik)
  - coresight: Only check bottom two claim bits (James Clark)
  - 8250: microchip: pci1xxxx: Add PCIe Hot reset disable support for Rev C0 and later devices (Rengarajan S)
  - um: use proper care when taking mmap lock during segfault (Benjamin Berg)
  - um: Add cmpxchg8b_emu and checksum functions to asm-prototypes.h (Sami Tolvanen)
  - iio: pressure: zpa2326: Use aligned_s64 for the timestamp (Jonathan Cameron)
  - drm/scheduler: signal scheduled fence when kill job (Lin.Cao)
  - drm/amdgpu: seq64 memory unmap uses uninterruptible lock (Philip Yang)
  - bcache: fix NULL pointer in cache_set_flush() (Linggang Zeng)
  - amd/amdkfd: fix a kfd_process ref leak (Yifan Zhang)
  - md/md-bitmap: fix dm-raid max_write_behind setting (Yu Kuai)
  - nvme-tcp: sanitize request list handling (Hannes Reinecke)
  - nvme-tcp: fix I/O stalls on congested sockets (Hannes Reinecke)
  - PCI: imx6: Add workaround for errata ERR051624 (Richard Zhu)
  - PCI: apple: Fix missing OF node reference in apple_pcie_setup_port (Hector Martin)
  - PCI: dwc: Make link training more robust by setting PORT_LOGIC_LINK_WIDTH to one lane (Wenbin Yao)
  - dmaengine: xilinx_dma: Set dma_device directions (Thomas Gessler)
  - dmaengine: idxd: Check availability of workqueue allocated by idxd wq driver before using (Yi Sun)
  - rust: arm: fix unknown (to Clang) argument '-mno-fdpic' (Rudraksha Gupta)
  - rust: module: place cleanup_module() in .exit.text section (FUJITA Tomonori)
  - ksmbd: provide zero as a unique ID to the Mac client (Namjae Jeon)
  - ksmbd: allow a filename to contain special characters on SMB3.1.1 posix extension (Namjae Jeon)
  - hwmon: (pmbus/max34440) Fix support for max34451 (Alexis Czezar Torreno)
  - NFSv4: xattr handlers should check for absent nfs filehandles (Scott Mayhew)
  - cxl/region: Add a dev_err() on missing target list entries (Robert Richter)
  - fuse: fix race between concurrent setattrs from multiple nodes (Guang Yuan Wu)
  - leds: multicolor: Fix intensity setting while SW blinking (Sven Schwermer)
  - dm vdo indexer: don't read request structure after enqueuing (Matthew Sakai)
  - sunrpc: don't immediately retransmit on seqno miss (Nikhil Jha)
  - mfd: max14577: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
  - mailbox: Not protect module_put with spin_lock_irqsave (Peng Fan)
  - NFSv4.2: fix setattr caching of TIME_[MODIFY|ACCESS]_SET when timestamps are delegated (Sagi Grimberg)
  - NFSv4.2: fix listxattr to return selinux security label (Olga Kornievskaia)
  - NFSv4: Always set NLINK even if the server doesn't support it (Han Young)
  - cifs: Fix encoding of SMB1 Session Setup NTLMSSP Request in non-UNICODE mode (Pali Rohár)
  - cifs: Fix cifs_query_path_info() for Windows NT servers (Pali Rohár)
  - cifs: Correctly set SMB1 SessionKey field in Session Setup Request (Pali Rohár)
  - LTS version: v6.12.35 (Jack Vogel)
  - bpftool: Fix cgroup command to only show cgroup bpf programs (Martin KaFai Lau)
  - cifs: Remove duplicate fattr->cf_dtype assignment from wsl_to_fattr() function (Pali Rohár)
  - gpio: mlxbf3: only get IRQ for device instance 0 (David Thompson)
  - perf test: Directory file descriptor leak (Ian Rogers)
  - perf evsel: Missed close() when probing hybrid core PMUs (Ian Rogers)
  - gpio: pca953x: fix wrong error probe return value (Sascha Hauer)
  - RISC-V: KVM: Don't treat SBI HFENCE calls as NOPs (Anup Patel)
  - RISC-V: KVM: Fix the size parameter check in SBI SFENCE calls (Anup Patel)
  - scsi: elx: efct: Fix memory leak in efct_hw_parse_filter() (Vitaliy Shevtsov)
  - arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() (Tengda Wu)
  - perf/core: Fix WARN in perf_cgroup_switch() (Luo Gengkun)
  - perf: Fix cgroup state vs ERROR (Peter Zijlstra)
  - perf: Fix sample vs do_exit() (Peter Zijlstra)
  - s390/pci: Fix __pcilg_mio_inuser() inline assembly (Heiko Carstens)
  - smb: client: fix max_sge overflow in smb_extract_folioq_to_rdma() (Stefan Metzmacher)
  - smb: client: fix first command failure during re-negotiation (zhangjian)
  - serial: sh-sci: Increment the runtime usage counter for the earlycon device (Claudiu Beznea)
  - serial: sh-sci: Clean sci_ports[0] after at earlycon exit (Claudiu Beznea)
  - smb: Log an error when close_all_cached_dirs fails (Paul Aurich)
  - dt-bindings: i2c: nvidia,tegra20-i2c: Specify the required properties (Akhil R)
  - EDAC/amd64: Correct number of UMCs for family 19h models 70h-7fh (Avadhut Naik)
  - net: atm: fix /proc/net/atm/lec handling (Eric Dumazet)
  - net: atm: add lec_mutex (Eric Dumazet)
  - mlxbf_gige: return EPROBE_DEFER if PHY IRQ is not available (David Thompson)
  - calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). (Kuniyuki Iwashima)
  - drm/xe/bmg: Update Wa_16023588340 (Vinay Belgaumkar)
  - drm/xe/gt: Update handling of xe_force_wake_get return (Himal Prasad Ghimiray)
  - drm/xe: Wire up device shutdown handler (Maarten Lankhorst)
  - ublk: santizize the arguments from userspace when adding a device (Ronnie Sahlberg)
  - net: lan743x: fix potential out-of-bounds write in lan743x_ptp_io_event_clock_get() (Alexey Kodanev)
  - eth: fbnic: avoid double free when failing to DMA-map FW msg (Jakub Kicinski)
  - tcp: fix passive TFO socket having invalid NAPI ID (David Wei)
  - tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (Haixia Qu)
  - tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen() behavior (Neal Cardwell)
  - atm: atmtcp: Free invalid length skb in atmtcp_c_send(). (Kuniyuki Iwashima)
  - mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). (Kuniyuki Iwashima)
  - wifi: carl9170: do not ping device which has failed to load firmware (Dmitry Antipov)
  - ptp: allow reading of currently dialed frequency to succeed on free-running clocks (Vladimir Oltean)
  - ptp: fix breakage after ptp_vclock_in_use() rework (Vladimir Oltean)
  - bnxt_en: Update MRU and RSS table of RSS contexts on queue reset (Pavan Chebbi)
  - bnxt_en: Add a helper function to configure MRU and RSS (Pavan Chebbi)
  - eth: bnxt: fix out-of-range access of vnic_info array (Taehee Yoo)
  - bnxt_en: Fix double invocation of bnxt_ulp_stop()/bnxt_ulp_start() (Kalesh AP)
  - net: netmem: fix skb_ensure_writable with unreadable skbs (Mina Almasry)
  - ksmbd: add free_transport ops in ksmbd connection (Namjae Jeon)
  - workqueue: Initialize wq_isolated_cpumask in workqueue_init_early() (Chuyi Zhou)
  - e1000e: set fixed clock frequency indication for Nahum 11 and Nahum 13 (Vitaly Lifshits)
  - ice: fix eswitch code memory leak in reset scenario (Grzegorz Nitka)
  - net: ice: Perform accurate aRFS flow match (Krishna Kumar)
  - io_uring/sqpoll: don't put task_struct on tctx setup failure (Jens Axboe)
  - aoe: clean device rq_list in aoedev_downdev() (Justin Sanders)
  - pldmfw: Select CRC32 when PLDMFW is selected (Simon Horman)
  - hwmon: (ltc4282) avoid repeated register write (Nuno Sá)
  - hwmon: (occ) fix unaligned accesses (Arnd Bergmann)
  - hwmon: (occ) Rework attribute registration for stack usage (Arnd Bergmann)
  - drm/i915/pmu: Fix build error with GCOV and AutoFDO enabled (Tzung-Bi Shih)
  - drm/nouveau/bl: increase buffer size to avoid truncate warning (Jacob Keller)
  - ionic: Prevent driver/fw getting out of sync on devcmd(s) (Brett Creeley)
  - drm/ssd130x: fix ssd132x_clear_screen() columns (John Keeping)
  - drm/msm/a7xx: Call CP_RESET_CONTEXT_STATE (Connor Abbott)
  - drm/msm: Fix CP_RESET_CONTEXT_STATE bitfield names (Connor Abbott)
  - drm/msm/dsi/dsi_phy_10nm: Fix missing initial VCO rate (Krzysztof Kozlowski)
  - drm/msm/disp: Correct porch timing for SDM845 (James A. MacInnes)
  - smb: fix secondary channel creation issue with kerberos by populating hostname when adding channels (Bharath SM)
  - ipv6: replace ipcm6_init calls with ipcm6_init_sk (Willem de Bruijn)
  - ipv6: remove leftover ip6 cookie initializer (Willem de Bruijn)
  - x86/tools: Drop duplicate unlikely() definition in insn_decoder_test.c (Nathan Chancellor)
  - Kunit to check the longest symbol length (Sergio González Collado)
  - drm/v3d: Avoid NULL pointer dereference in `v3d_job_update_stats()` (Maíra Canal)
  - nfsd: use threads array as-is in netlink interface (Jeff Layton)
  - erofs: remove unused trace event erofs_destroy_inode (Gao Xiang)
  - bpf: Fix L4 csum update on IPv6 in CHECKSUM_COMPLETE (Paul Chaignon)
  - net: Fix checksum update for ILA adj-transport (Paul Chaignon)
  - rust: compile libcore with edition 2024 for 1.87+ (Gary Guo)
  - kbuild: rust: add rustc-min-version support function (Miguel Ojeda)
  - drm/amdgpu: read back register after written for VCN v4.0.5 (David (Ming Qiang) Wu)
  - mm/hugetlb: unshare page tables during VMA split, not before (Jann Horn)
  - iio: accel: fxls8962af: Fix temperature calculation (Sean Nyekjaer)
  - ALSA: hda/realtek: Add quirk for Asus GU605C (Richard Fitzgerald)
  - ALSA: hda/realtek: Fix built-in mic on ASUS VivoBook X513EA (Chris Chiu)
  - ALSA: hda/realtek: enable headset mic on Latitude 5420 Rugged (Jonathan Lane)
  - ALSA: hda/realtek - Add mute LED support for HP Victus 16-s1xxx and HP Victus 15-fa1xxx (Edip Hazuri)
  - ALSA: hda/intel: Add Thinkpad E15 to PM deny list (Takashi Iwai)
  - ALSA: usb-audio: Rename ALSA kcontrol PCM and PCM1 for the KTMicro sound card (wangdicheng)
  - arm64: Restrict pagetable teardown to avoid false warning (Dev Jain)
  - wifi: cfg80211: init wiphy_work before allocating rfkill fails (Edward Adam Davis)
  - wifi: ath12k: Clear affinity hint before calling ath12k_pci_free_irq() in error path (Manivannan Sadhasivam)
  - Input: sparcspkr - avoid unannotated fall-through (WangYuli)
  - cpufreq/amd-pstate: Add missing NULL ptr check in amd_pstate_update (Dhananjay Ugwekar)
  - wifi: rtw89: phy: add dummy C2H event handler for report of TAS power (Ping-Ke Shih)
  - atm: Revert atm_account_tx() if copy_from_iter_full() fails. (Kuniyuki Iwashima)
  - sched_ext, sched/core: Don't call scx_group_set_weight() prematurely from sched_create_group() (Tejun Heo)
  - platform/x86/intel-uncore-freq: Fail module load when plat_info is NULL (Srinivas Pandruvada)
  - selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len (Stephen Smalley)
  - platform/x86: ideapad-laptop: use usleep_range() for EC polling (Rong Zhang)
  - ksmbd: fix null pointer dereference in destroy_previous_session (Namjae Jeon)
  - selftests/x86: Add a test to detect infinite SIGTRAP handler loop (Xin Li (Intel))
  - x86/virt/tdx: Avoid indirect calls to TDX assembly functions (Kai Huang)
  - udmabuf: use sgtable-based scatterlist wrappers (Marek Szyprowski)
  - mm: close theoretical race where stale TLB entries could linger (Ryan Roberts)
  - net: clear the dst when changing skb protocol (Jakub Kicinski)
  - net_sched: sch_sfq: reject invalid perturb period (Eric Dumazet)
  - nvme: always punt polled uring_cmd end_io work to task_work (Jens Axboe)
  - scsi: s390: zfcp: Ensure synchronous unit_add (Peter Oberparleiter)
  - scsi: storvsc: Increase the timeouts to storvsc_timeout (Dexuan Cui)
  - smb: improve directory cache reuse for readdir operations (Bharath SM)
  - cifs: do not disable interface polling on failure (Shyam Prasad N)
  - cifs: serialize other channels when query server interfaces is pending (Shyam Prasad N)
  - cifs: deal with the channel loading lag while picking channels (Shyam Prasad N)
  - jffs2: check jffs2_prealloc_raw_node_refs() result in few other places (Fedor Pchelkin)
  - jffs2: check that raw node were preallocated before writing summary (Artem Sadovnikov)
  - LoongArch: Fix panic caused by NULL-PMD in huge_pte_offset() (Tianyang Zhang)
  - LoongArch: Avoid using $r0/$r1 as "mask" for csrxchg (Huacai Chen)
  - LoongArch: vDSO: Correctly use asm parameters in syscall wrappers (Thomas Weißschuh)
  - platform/loongarch: laptop: Add backlight power control support (Yao Zi)
  - platform/loongarch: laptop: Unregister generic_sub_drivers on exit (Yao Zi)
  - platform/loongarch: laptop: Get brightness setting from EC on probe (Yao Zi)
  - drivers/rapidio/rio_cm.c: prevent possible heap overwrite (Andrew Morton)
  - io_uring: fix task leak issue in io_wq_create() (Penglei Jiang)
  - io_uring/kbuf: don't truncate end buffer for multiple buffer peeks (Jens Axboe)
  - powerpc/eeh: Fix missing PE bridge reconfiguration during VFIO EEH recovery (Narayana Murty N)
  - powerpc/vdso: Fix build of VDSO32 with pcrel (Christophe Leroy)
  - platform/x86: dell_rbu: Stop overwriting data buffer (Stuart Hayes)
  - platform/x86: dell_rbu: Fix list usage (Stuart Hayes)
  - platform/x86/amd: pmf: Prevent amd_pmf_tee_deinit() from running twice (Mario Limonciello)
  - platform/x86/amd: pmc: Clear metrics table at start of cycle (Mario Limonciello)
  - fs/xattr.c: fix simple_xattr_list() (Stephen Smalley)
  - Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first" (Alexander Sverdlin)
  - tee: Prevent size calculation wraparound on 32-bit kernels (Jann Horn)
  - ARM: OMAP2+: Fix l4ls clk domain handling in STANDBY (Sukrut Bellary)
  - bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value (Laurentiu Tudor)
  - watchdog: da9052_wdt: respect TWDMIN (Marcus Folkesson)
  - fbcon: Make sure modelist not set on unregistered console (Kees Cook)
  - net/mlx5: HWS, Harden IP version definer checks (Vlad Dogaru)
  - wifi: ath12k: Pass correct values of center freq1 and center freq2 for 160 MHz (Suraj P Kizhakkethil)
  - wifi: ath12k: fix incorrect CE addresses (Balamurugan S)
  - wifi: ath12k: fix link valid field initialization in the monitor Rx (Hari Chandrakanthan)
  - wifi: ath11k: determine PM policy based on machine model (Baochen Qiang)
  - octeontx2-pf: Add error log forcn10k_map_unmap_rq_policer() (Wentao Liang)
  - net: ethernet: cortina: Use TOE/TSO on all TCP (Linus Walleij)
  - bpf, sockmap: Fix data lost during EAGAIN retries (Jiayuan Chen)
  - f2fs: fix to set atomic write status more clear (Chao Yu)
  - usbnet: asix AX88772: leave the carrier control to phylink (Krzysztof Hałasa)
  - ice: fix check for existing switch rule (Mateusz Pacuszka)
  - RDMA/hns: initialize db in update_srq_db() (Chen Linxuan)
  - ixgbe: Fix unreachable retry logic in combined and byte I2C write functions (Rand Deeb)
  - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Kyungwook Boo)
  - sock: Correct error checking condition for (assign|release)_proto_idx() (Zijun Hu)
  - scsi: lpfc: Use memcpy() for BIOS version (Daniel Wagner)
  - wifi: ath12k: fix failed to set mhi state error during reboot with hardware grouping (Aditya Kumar Singh)
  - pinctrl: mcp23s08: Reset all pins to input at probe (Mike Looijmans)
  - isofs: fix Y2038 and Y2156 issues in Rock Ridge TF entry (Jonas 'Sortie' Termansen)
  - software node: Correct a OOB check in software_node_get_reference_args() (Zijun Hu)
  - net: ethernet: ti: am65-cpsw: handle -EPROBE_DEFER (Michael Walle)
  - wifi: ath12k: using msdu end descriptor to check for rx multicast packets (Sarika Sharma)
  - bnxt_en: Remove unused field "ref_count" in struct bnxt_ulp (Kalesh AP)
  - vxlan: Do not treat dst cache initialization errors as fatal (Ido Schimmel)
  - net: bridge: mcast: re-implement br_multicast_{enable, disable}_port functions (Yong Wang)
  - net: bridge: mcast: update multicast contex when vlan state is changed (Yong Wang)
  - wifi: iwlwifi: Add missing MODULE_FIRMWARE for Qu-c0-jf-b0 (Víctor Gonzalo)
  - Revert "mac80211: Dynamically set CoDel parameters per station" (Toke Høiland-Jørgensen)
  - wifi: mac80211: VLAN traffic in multicast path (Muna Sinada)
  - bpf: Use proper type to calculate bpf_raw_tp_null_args.mask index (Shung-Hsi Yu)
  - net/mlx5: HWS, Fix IP version decision (Vlad Dogaru)
  - netdevsim: Mark NAPI ID on skb in nsim_rcv (Joe Damato)
  - wifi: mac80211_hwsim: Prevent tsf from setting if beacon is disabled (Edward Adam Davis)
  - wifi: rtw89: 8922a: fix TX fail with wrong VCO setting (Kuan-Chung Chen)
  - wifi: iwlwifi: pcie: make sure to lock rxq->read (Miri Korenblit)
  - iommu/amd: Ensure GA log notifier callbacks finish running before module unload (Sean Christopherson)
  - scsi: smartpqi: Add new PCI IDs (David Strahan)
  - scsi: lpfc: Fix lpfc_check_sli_ndlp() handling for GEN_REQUEST64 commands (Justin Tee)
  - libbpf: Add identical pointer detection to btf_dedup_is_equiv() (Alan Maguire)
  - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Pablo Neira Ayuso)
  - f2fs: fix to bail out in get_new_segment() (Chao Yu)
  - wifi: iwlwifi: mvm: fix beacon CCK flag (Johannes Berg)
  - hid-asus: check ROG Ally MCU version and warn (Luke D. Jones)
  - clk: rockchip: rk3036: mark ddrphy as critical (Heiko Stuebner)
  - wifi: mac80211: do not offer a mesh path if forwarding is disabled (Benjamin Berg)
  - wireless: purelifi: plfxlc: fix memory leak in plfxlc_usb_wreq_asyn() (Salah Triki)
  - net: vertexcom: mse102x: Return code for mse102x_rx_pkt_spi (Stefan Wahren)
  - net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info (Jason Xing)
  - pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get() (Gabor Juhos)
  - libbpf: Check bpf_map_skeleton link for NULL (Mykyta Yatsenko)
  - pinctrl: armada-37xx: propagate error from armada_37xx_pmx_gpio_set_direction() (Gabor Juhos)
  - net: stmmac: generate software timestamp just before the doorbell (Jason Xing)
  - bpf: Pass the same orig_call value to trampoline functions (Ilya Leoshkevich)
  - pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get_direction() (Gabor Juhos)
  - pinctrl: armada-37xx: propagate error from armada_37xx_pmx_set_by_name() (Gabor Juhos)
  - net: atlantic: generate software timestamp just before the doorbell (Jason Xing)
  - xfrm: validate assignment of maximal possible SEQ number (Leon Romanovsky)
  - net: page_pool: Don't recycle into cache on PREEMPT_RT (Sebastian Andrzej Siewior)
  - ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT (Sebastian Andrzej Siewior)
  - x86/sgx: Prevent attempts to reclaim poisoned pages (Andrew Zaborowski)
  - tcp: add receive queue awareness in tcp_rcv_space_adjust() (Eric Dumazet)
  - tcp: fix initial tp->rcvq_space.space value for passive TS enabled flows (Eric Dumazet)
  - tcp: remove zero TCP TS samples for autotuning (Eric Dumazet)
  - tcp: always seek for minimal rtt in tcp_rcv_rtt_update() (Eric Dumazet)
  - wifi: rtw89: leave idle mode when setting WEP encryption for AP mode (Dian-Syuan Yang)
  - iommu/amd: Allow matching ACPI HID devices without matching UIDs (Mario Limonciello)
  - wifi: ath11k: Fix QMI memory reuse logic (Muhammad Usama Anjum)
  - wifi: ath12k: fix a possible dead lock caused by ab->base_lock (Baochen Qiang)
  - wifi: ath12k: fix macro definition HAL_RX_MSDU_PKT_LENGTH_GET (Kang Yang)
  - net: dlink: add synchronization for stats update (Moon Yeounsu)
  - clk: qcom: gcc-x1e80100: Set FORCE MEM CORE for UFS clocks (Taniya Das)
  - i2c: npcm: Add clock toggle recovery (Tali Perry)
  - i2c: tegra: check msg length in SMBUS block read (Akhil R)
  - cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs (Mike Tipton)
  - libbpf/btf: Fix string handling to support multi-split BTF (Alan Maguire)
  - sctp: Do not wake readers in __sctp_write_space() (Petr Malat)
  - wifi: mac80211: validate SCAN_FLAG_AP in scan request during MLO (Aditya Kumar Singh)
  - wifi: mt76: mt7925: introduce thermal protection (Leon Yen)
  - wifi: mt76: mt7921: add 160 MHz AP for mt7922 device (Samuel Williams)
  - wifi: mt76: mt76x2: Add support for LiteOn WN4516R,WN4519R (Henk Vergonet)
  - Bluetooth: btusb: Add new VID/PID 13d3/3630 for MT7925 (Jiande Lu)
  - emulex/benet: correct command version selection in be_cmd_get_stats() (Alok Tiwari)
  - wifi: mt76: mt7996: drop fragments with multicast or broadcast RA (Benjamin Lin)
  - i2c: designware: Invoke runtime suspend on quick slave re-registration (Tan En De)
  - Bluetooth: btusb: Add new VID/PID 13d3/3584 for MT7922 (Liwei Sun)
  - bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem() (Hou Tao)
  - f2fs: use vmalloc instead of kvmalloc in .init_{,de}compress_ctx (Chao Yu)
  - tipc: use kfree_sensitive() for aead cleanup (Zilin Guan)
  - net: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devices (Rengarajan S)
  - net: macb: Check return value of dma_set_mask_and_coherent() (Sergio Perez Gonzalez)
  - ACPI: battery: negate current when discharging (Peter Marheine)
  - power: supply: max17040: adjust thermal channel scaling (Svyatoslav Ryhel)
  - PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn() (Charan Teja Kalla)
  - gpiolib: of: Add polarity quirk for s5m8767 (Peng Fan)
  - Make 'cc-option' work correctly for the -Wno-xyzzy pattern (Linus Torvalds)
  - ASoC: tegra210_ahub: Add check to of_device_get_match_data() (Yuanjun Gong)
  - platform-msi: Add msi_remove_device_irq_domain() in platform_device_msi_free_irqs_all() (Frank Li)
  - ACPICA: utilities: Fix overflow check in vsnprintf() (gldrk)
  - pmdomain: core: Reset genpd->states to avoid freeing invalid data (Ulf Hansson)
  - power: supply: bq27xxx: Retrieve again when busy (Jerry Lv)
  - ALSA: hda: cs35l41: Fix swapped l/r audio channels for Acer Helios laptops (Stefan Binding)
  - ACPICA: Apply pack(1) to union aml_resource (Tamir Duberstein)
  - ACPICA: fix acpi parse and parseext cache leaks (Seunghun Han)
  - ACPI: Add missing prototype for non CONFIG_SUSPEND/CONFIG_X86 case (Mario Limonciello)
  - ACPI: bus: Bail out if acpi_kobj registration fails (Armin Wolf)
  - ASoC: intel/sdw_utils: Assign initial value in asoc_sdw_rt_amp_spk_rtd_init() (I Hsin Cheng)
  - ASoC: tas2770: Power cycle amp on ISENSE/VSENSE change (Hector Martin)
  - ACPICA: Avoid sequence overread in call to strncmp() (Ahmed Salem)
  - mmc: Add quirk to disable DDR50 tuning (Erick Shepherd)
  - power: supply: collie: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
  - clocksource: Fix the CPUs' choice in the watchdog per CPU verification (Guilherme G. Piccoli)
  - ASoC: amd: yc: Add quirk for Lenovo Yoga Pro 7 14ASP9 (Talhah Peerbhai)
  - ACPICA: fix acpi operand cache leak in dswstate.c (Seunghun Han)
  - iio: adc: ad7606_spi: fix reg write value mask (David Lechner)
  - iio: adc: ti-ads1298: Kconfig: add kfifo dependency to fix module build (Arthur-Prince)
  - iio: adc: ad7944: mask high bits on direct read (David Lechner)
  - iio: imu: inv_icm42600: Fix temperature calculation (Sean Nyekjaer)
  - mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Jann Horn)
  - dummycon: Trigger redraw when switching consoles with deferred takeover (Thomas Zimmermann)
  - accel/ivpu: Fix warning in ivpu_gem_bo_free() (Jacek Lawrynowicz)
  - accel/ivpu: Use dma_resv_lock() instead of a custom mutex (Jacek Lawrynowicz)
  - accel/ivpu: Use firmware names from upstream repo (Jacek Lawrynowicz)
  - accel/ivpu: Improve buffer object logging (Jacek Lawrynowicz)
  - iio: accel: fxls8962af: Fix temperature scan element sign (Sean Nyekjaer)
  - PCI: dw-rockchip: Fix PHY function call sequence in rockchip_pcie_phy_deinit() (Diederik de Haas)
  - PCI: dw-rockchip: Remove PCIE_L0S_ENTRY check from rockchip_pcie_link_up() (Shawn Lin)
  - PCI: Fix lock symmetry in pci_slot_unlock() (Ilpo Järvinen)
  - PCI: Add ACS quirk for Loongson PCIe (Huacai Chen)
  - PCI: dwc: ep: Correct PBA offset in .set_msix() callback (Niklas Cassel)
  - PCI: cadence-ep: Correct PBA offset in .set_msix() callback (Niklas Cassel)
  - uio_hv_generic: Align ring size to system page (Long Li)
  - uio_hv_generic: Use correct size for interrupt and monitor pages (Long Li)
  - Drivers: hv: Allocate interrupt and monitor pages aligned to system page boundary (Long Li)
  - smb: client: add NULL check in automount_fullpath (Ruben Devos)
  - cifs: dns resolution is needed only for primary channel (Shyam Prasad N)
  - cifs: update dstaddr whenever channel iface is updated (Shyam Prasad N)
  - cifs: reset connections for all channels when reconnect requested (Shyam Prasad N)
  - remoteproc: k3-m4: Don't assert reset in detach routine (Beleswar Padhi)
  - remoteproc: core: Release rproc->clean_table after rproc_attach() fails (Xiaolei Wang)
  - remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach() (Xiaolei Wang)
  - regulator: max14577: Add error check for max14577_read_reg() (Wentao Liang)
  - ovl: Fix nested backing file paths (André Almeida)
  - mips: Add -std= flag specified in KBUILD_CFLAGS to vdso CFLAGS (Khem Raj)
  - staging: iio: ad5933: Correct settling cycles encoding per datasheet (Gabriel Shahrouzi)
  - pwm: axi-pwmgen: fix missing separate external clock (David Lechner)
  - video: screen_info: Relocate framebuffers behind PCI bridges (Thomas Zimmermann)
  - sysfb: Fix screen_info type check for VGA (Thomas Zimmermann)
  - KVM: s390: rename PROT_NONE to PROT_TYPE_DUMMY (Lorenzo Stoakes)
  - net: ch9200: fix uninitialised access during mii_nway_restart (Qasim Ijaz)
  - phy: fsl-imx8mq-usb: fix phy_tx_vboost_level_from_property() (Xu Yang)
  - dm: lock limits when reading them (Mikulas Patocka)
  - ftrace: Fix UAF when lookup kallsym after ftrace disabled (Ye Bin)
  - mtd: rawnand: qcom: Fix read len for onfi param page (Md Sadre Alam)
  - dm-verity: fix a memory leak if some arguments are specified multiple times (Mikulas Patocka)
  - dm-mirror: fix a tiny race condition (Mikulas Patocka)
  - KVM: VMX: Flush shadow VMCS on emergency reboot (Chao Gao)
  - KVM: SVM: Clear current_vmcb during vCPU free for all *possible* CPUs (Yosry Ahmed)
  - mtd: nand: sunxi: Add randomizer configuration before randomizer enable (Wentao Liang)
  - mtd: rawnand: sunxi: Add randomizer configuration in sunxi_nfc_hw_ecc_write_chunk (Wentao Liang)
  - firmware: arm_scmi: Ensure that the message-id supports fastchannel (Sibi Sankar)
  - configfs-tsm-report: Fix NULL dereference of tsm_ops (Dan Williams)
  - soc: qcom: pmic_glink_altmode: fix spurious DP hotplug events (Johan Hovold)
  - mm: fix ratelimit_pages update error in dirty_ratio_handler() (Jinliang Zheng)
  - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Shin'ichiro Kawasaki)
  - watchdog: fix watchdog may detect false positive of softlockup (Luo Gengkun)
  - ipc: fix to protect IPCS lookups using RCU (Jeongjun Park)
  - clk: meson-g12a: add missing fclk_div2 to spicc (Da Xue)
  - parisc: fix building with gcc-15 (Arnd Bergmann)
  - vgacon: Add check for vc_origin address range in vgacon_scroll() (GONG Ruiqi)
  - parisc/unaligned: Fix hex output to show 8 hex chars (Helge Deller)
  - fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var (Murad Masimov)
  - EDAC/altera: Use correct write width with the INTTEST register (Niravkumar L Rabara)
  - fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var (Murad Masimov)
  - iommu/vt-d: Restore context entry setup order for aliased devices (Lu Baolu)
  - net: ftgmac100: select FIXED_PHY (Heiner Kallweit)
  - net/sched: fix use-after-free in taprio_dev_notifier (Hyunwoo Kim)
  - NFC: nci: uart: Set tty->disc_data only in success path (Krzysztof Kozlowski)
  - hwmon: (ftsteutates) Fix TOCTOU race in fts_read() (Gui-Dong Han)
  - f2fs: fix to do sanity check on sit_bitmap_size (Chao Yu)
  - f2fs: prevent kernel warning due to negative i_nlink from corrupted image (Jaegeuk Kim)
  - f2fs: fix to do sanity check on ino and xnid (Chao Yu)
  - Input: gpio-keys - fix possible concurrent access in gpio_keys_irq_timer() (Gatien Chevallier)
  - Input: ims-pcu - check record size in ims_pcu_flash_firmware() (Dan Carpenter)
  - ext4: only dirty folios when data journaling regular files (Brian Foster)
  - ext4: ensure i_size is smaller than maxbytes (Zhang Yi)
  - ext4: factor out ext4_get_maxbytes() (Zhang Yi)
  - ext4: fix calculation of credits for extent tree modification (Jan Kara)
  - ext4: inline: fix len overflow in ext4_prepare_inline_data (Thadeu Lima de Souza Cascardo)
  - bus: fsl-mc: fix GET/SET_TAILDROP command ids (Wan Junjie)
  - bus: fsl-mc: do not add a device-link for the UAPI used DPMCP device (Ioana Ciornei)
  - ata: ahci: Disallow LPM for Asus B550-F motherboard (Mikko Korhonen)
  - ata: ahci: Disallow LPM for ASUSPRO-D840SA motherboard (Niklas Cassel)
  - ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330 (Tasos Sahanidis)
  - bus: firewall: Fix missing static inline annotations for stubs (Krzysztof Kozlowski)
  - cgroup,freezer: fix incomplete freezing when attaching tasks (Chen Ridong)
  - ceph: set superblock s_magic for IMA fsmagic matching (Dennis Marttinen)
  - ceph: avoid kernel BUG for encrypted inode with unaligned file size (Viacheslav Dubeyko)
  - can: tcan4x5x: fix power regulator retrieval during probe (Brett Werling)
  - can: kvaser_pciefd: refine error prone echo_skb_max handling logic (Fedor Pchelkin)
  - bus: mhi: host: Fix conflict between power_up and SYSERR (Jeff Hugo)
  - bus: mhi: ep: Update read pointer only after buffer is written (Sumit Kumar)
  - block: Clear BIO_EMULATES_ZONE_APPEND flag on BIO completion (Damien Le Moal)
  - ASoC: codecs: wcd937x: Drop unused buck_supply (Krzysztof Kozlowski)
  - ASoC: codecs: wcd9375: Fix double free of regulator supplies (Krzysztof Kozlowski)
  - ARM: omap: pmic-cpcap: do not mess around without CPCAP or OMAP4 (Andreas Kemnade)
  - ARM: 9447/1: arm/memremap: fix arch_memremap_can_ram_remap() (Ross Stutterheim)
  - arm64/mm: Close theoretical race where stale TLB entry remains valid (Ryan Roberts)
  - media: uvcvideo: Fix deferred probing error (Ricardo Ribalda)
  - media: uvcvideo: Send control events for partial succeeds (Ricardo Ribalda)
  - media: uvcvideo: Return the number of processed controls (Ricardo Ribalda)
  - media: imx-jpeg: Cleanup after an allocation error (Ming Qian)
  - media: imx-jpeg: Reset slot data pointers when freed (Ming Qian)
  - media: imx-jpeg: Move mxc_jpeg_free_slot_data() ahead (Ming Qian)
  - media: imx-jpeg: Drop the first error frames (Ming Qian)
  - media: vivid: Change the siize of the composing (Denis Arefev)
  - media: vidtv: Terminating the subsequent process of initialization failure (Edward Adam Davis)
  - media: videobuf2: use sgtable-based scatterlist wrappers (Marek Szyprowski)
  - media: venus: Fix probe error handling (Loic Poulain)
  - media: v4l2-dev: fix error handling in __video_register_device() (Ma Ke)
  - media: omap3isp: use sgtable-based scatterlist wrappers (Marek Szyprowski)
  - media: mediatek: vcodec: Correct vsi_core framebuffer size (Fei Shao)
  - media: ipu6: Remove workaround for Meteor Lake ES2 (Hao Yao)
  - media: intel/ipu6: Fix dma mask for non-secure mode (Stanislaw Gruszka)
  - media: imagination: fix a potential memory leak in e5010_probe() (Haoxiang Li)
  - media: i2c: imx335: Fix frame size enumeration (Kieran Bingham)
  - media: gspca: Add error handling for stv06xx_read_sensor() (Wentao Liang)
  - media: davinci: vpif: Fix memory leak in probe error path (Dmitry Nikiforov)
  - media: cxusb: no longer judge rbuf when the write fails (Edward Adam Davis)
  - media: ccs-pll: Check for too high VT PLL multiplier in dual PLL case (Sakari Ailus)
  - media: ccs-pll: Correct the upper limit of maximum op_pre_pll_clk_div (Sakari Ailus)
  - media: ccs-pll: Start OP pre-PLL multiplier search from correct value (Sakari Ailus)
  - media: ov2740: Move pm-runtime cleanup on probe-errors to proper place (Hans de Goede)
  - media: ccs-pll: Start VT pre-PLL multiplier search from correct value (Sakari Ailus)
  - media: i2c: ds90ub913: Fix returned fmt from .set_fmt() (Tomi Valkeinen)
  - media: nxp: imx8-isi: better handle the m2m usage_count (Laurentiu Palcu)
  - media: imx335: Use correct register width for HNUM (Umang Jain)
  - media: ov5675: suppress probe deferral errors (Johan Hovold)
  - media: ov8856: suppress probe deferral errors (Johan Hovold)
  - wifi: rtlwifi: disable ASPM for RTL8723BE with subsystem ID 11ad:1723 (Mingcong Bai)
  - wifi: rtw88: usb: Reduce control message timeout to 500 ms (Bitterblue Smith)
  - svcrdma: Unregister the device if svc_rdma_accept() fails (Chuck Lever)
  - jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() (Jeongjun Park)
  - wifi: ath12k: fix ring-buffer corruption (Johan Hovold)
  - fs/nfs/read: fix double-unlock bug in nfs_return_empty_folio() (Max Kellermann)
  - NFSv4: Don't check for OPEN feature support in v4.1 (Scott Mayhew)
  - SUNRPC: Prevent hang on NFS mount with xprtsec=[m]tls (Chuck Lever)
  - nfsd: Initialize ssc before laundromat_work to prevent NULL dereference (Li Lingfeng)
  - nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request (NeilBrown)
  - NFSD: Implement FATTR4_CLONE_BLKSIZE attribute (Chuck Lever)
  - NFSD: fix race between nfsd registration and exports_proc (Maninder Singh)
  - NFSD: unregister filesystem in case genl_register_family() fails (Maninder Singh)
  - wifi: ath11k: fix ring-buffer corruption (Johan Hovold)
  - wifi: rtw88: usb: Upload the firmware in bigger chunks (Bitterblue Smith)
  - wifi: ath11k: fix rx completion meta data corruption (Johan Hovold)
  - wifi: mt76: mt7925: fix host interrupt register initialization (Michael Lo)
  - wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback() (Christian Lamparter)
  - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Wentao Liang)
  - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Wentao Liang)
  - regulator: max20086: Change enable gpio to optional (João Paulo Gonçalves)
  - regulator: max20086: Fix MAX200086 chip id (João Paulo Gonçalves)
  - s390/pci: Serialize device addition and removal (Niklas Schnelle)
  - s390/pci: Allow re-add of a reserved but not yet removed device (Niklas Schnelle)
  - s390/pci: Prevent self deletion in disable_slot() (Niklas Schnelle)
  - s390/pci: Remove redundant bus removal and disable from zpci_release_device() (Niklas Schnelle)
  - powerpc/pseries/msi: Avoid reading PCI device registers in reduced power states (Gautam Menghani)
  - io_uring/kbuf: account ring io_buffer_list memory (Pavel Begunkov)
  - io_uring: account drain memory to cgroup (Pavel Begunkov)
  - ASoC: amd: sof_amd_sdw: Fix unlikely uninitialized variable use in create_sdw_dailinks() (Vijendar Mukunda)
  - ASoC: meson: meson-card-utils: use of_property_present() for DT parsing (Martin Blumenstingl)
  - ASoC: qcom: sdm845: Add error handling in sdm845_slim_snd_hw_params() (Wentao Liang)
  - crypto: qat - add shutdown handler to qat_dh895xcc (Giovanni Cabiddu)
  - crypto: qat - add shutdown handler to qat_c62x (Giovanni Cabiddu)
  - crypto: qat - add shutdown handler to qat_4xxx (Giovanni Cabiddu)
  - crypto: qat - add shutdown handler to qat_420xx (Giovanni Cabiddu)
  - crypto: qat - add shutdown handler to qat_c3xxx (Giovanni Cabiddu)
  - gfs2: move msleep to sleepable context (Alexander Aring)
  - crypto: marvell/cesa - Do not chain submitted requests (Herbert Xu)
  - configfs: Do not override creating attribute file failure in populate_attrs() (Zijun Hu)
  - LTS version: v6.12.34 (Jack Vogel)
  - thermal/drivers/mediatek/lvts: Remove unused lvts_debugfs_exit (Arnd Bergmann)
  - drm/meson: Use 1000ULL when operating with mode->clock (I Hsin Cheng)
  - gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add (Andrew Price)
  - overflow: Introduce __DEFINE_FLEX for having no initializer (Kees Cook)
  - net: usb: aqc111: debug info before sanitation (Oliver Neukum)
  - usb: misc: onboard_usb_dev: fix build warning for CONFIG_USB_ONBOARD_DEV_USB5744=n (Arnd Bergmann)
  - regulator: dt-bindings: mt6357: Drop fixed compatible requirement (Nícolas F. R. A. Prado)
  - calipso: unlock rcu before returning -EAFNOSUPPORT (Eric Dumazet)
  - x86/fred/signal: Prevent immediate repeat of single step trap on return from SIGTRAP handler (Xin Li (Intel))
  - x86/iopl: Cure TIF_IO_BITMAP inconsistencies (Thomas Gleixner)
  - xen/arm: call uaccess_ttbr0_enable for dm_op hypercall (Stefano Stabellini)
  - xfs: don't assume perags are initialised when trimming AGs (Dave Chinner)
  - ring-buffer: Move cpus_read_lock() outside of buffer->mutex (Steven Rostedt)
  - ring-buffer: Fix buffer locking in ring_buffer_subbuf_order_set() (Dmitry Antipov)
  - ring-buffer: Do not trigger WARN_ON() due to a commit_overrun (Steven Rostedt)
  - 9p: Add a migrate_folio method (Matthew Wilcox (Oracle))
  - usb: typec: tcpm: move tcpm_queue_vdm_unlocked to asynchronous work (RD Babiera)
  - usb: typec: tcpm/tcpci_maxim: Fix bounds check in process_rx() (Amit Sunil Dhamne)
  - usb: Flush altsetting 0 endpoints before reinitializating them after reset. (Mathias Nyman)
  - usb: cdnsp: Fix issue with detecting USB 3.2 speed (Pawel Laszczak)
  - usb: cdnsp: Fix issue with detecting command completion event (Pawel Laszczak)
  - usb: misc: onboard_usb_dev: Fix usb5744 initialization sequence (Jonathan Stroud)
  - tty: serial: 8250_omap: fix TX with DMA for am33xx (Jiri Slaby (SUSE))
  - VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify (Wupeng Ma)
  - usb: usbtmc: Fix read_stb function and get_stb ioctl (Dave Penkler)
  - nvmem: zynqmp_nvmem: unbreak driver after cleanup (Peter Korsgaard)
  - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov)
  - HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() (Terry Junge)
  - ALSA: usb-audio: Add implicit feedback quirk for RODE AI-1 (David Heimann)
  - Revert "wifi: mwifiex: Fix HT40 bandwidth issue." (Francesco Dolcini)
  - tools/resolve_btfids: Fix build when cross compiling kernel with clang. (Suleiman Souhlal)
  - objtool/rust: relax slice condition to cover more `noreturn` Rust functions (Miguel Ojeda)
  - block: Fix bvec_set_folio() for very large folios (Matthew Wilcox (Oracle))
  - bio: Fix bio_first_folio() for SPARSEMEM without VMEMMAP (Matthew Wilcox (Oracle))
  - io_uring: consistently use rcu semantics with sqpoll thread (Keith Busch)
  - block: don't use submit_bio_noacct_nocheck in blk_zone_wplug_bio_work (Christoph Hellwig)
  - io_uring: fix use-after-free of sq->thread in __io_uring_show_fdinfo() (Penglei Jiang)
  - block: use q->elevator with ->elevator_lock held in elv_iosched_show() (Ming Lei)
  - perf: Ensure bpf_perf_link path is properly serialized (Peter Zijlstra)
  - nvmet-fcloop: access fcpreq only when holding reqlock (Daniel Wagner)
  - btrfs: exit after state split error at set_extent_bit() (Filipe Manana)
  - gfs2: pass through holder from the VFS for freeze/thaw (Christian Brauner)
  - fs/filesystems: Fix potential unsigned integer underflow in fs_name() (Zijun Hu)
  - btrfs: exit after state insertion failure at btrfs_convert_extent_bit() (Filipe Manana)
  - net: drv: netdevsim: don't napi_complete() from netpoll (Jakub Kicinski)
  - net_sched: ets: fix a race in ets_qdisc_change() (Eric Dumazet)
  - net_sched: tbf: fix a race in tbf_change() (Eric Dumazet)
  - net_sched: red: fix a race in __red_change() (Eric Dumazet)
  - net_sched: prio: fix a race in prio_tune() (Eric Dumazet)
  - net/mlx5e: Fix leak of Geneve TLV option object (Jianbo Liu)
  - net/mlx5: HWS, fix missing ip_version handling in definer (Yevgeny Kliteynik)
  - net/mlx5: Fix return value when searching for existing flow group (Patrisious Haddad)
  - net/mlx5: Fix ECVF vports unload on shutdown flow (Amir Tzin)
  - net/mlx5: Ensure fw pages are always allocated on same NUMA (Moshe Shemesh)
  - Bluetooth: MGMT: Fix sparse errors (Luiz Augusto von Dentz)
  - Bluetooth: eir: Fix possible crashes on eir_create_adv_data (Luiz Augusto von Dentz)
  - Bluetooth: hci_sync: Fix broadcast/PA when using an existing instance (Luiz Augusto von Dentz)
  - Bluetooth: Fix NULL pointer deference on eir_get_service_data (Luiz Augusto von Dentz)
  - net/mdiobus: Fix potential out-of-bounds clause 45 read/write access (Jakub Raczynski)
  - net/mdiobus: Fix potential out-of-bounds read/write access (Jakub Raczynski)
  - macsec: MACsec SCI assignment for ES = 0 (Carlos Fernandez)
  - net: Fix TOCTOU issue in sk_is_readable() (Michal Luczaj)
  - ACPI: CPPC: Fix NULL pointer dereference when nosmp is used (Yunhui Cui)
  - i40e: retry VFLR handling if there is ongoing VF reset (Robert Malz)
  - i40e: return false from i40e_reset_vf if reset is in progress (Robert Malz)
  - drm/meson: fix more rounding issues with 59.94Hz modes (Martin Blumenstingl)
  - drm/meson: use vclk_freq instead of pixel_freq in debug print (Martin Blumenstingl)
  - drm/meson: fix debug log statement when setting the HDMI clocks (Martin Blumenstingl)
  - drm/meson: use unsigned long long / Hz for frequency types (Martin Blumenstingl)
  - powerpc/vas: Return -EINVAL if the offset is non-zero in mmap() (Haren Myneni)
  - powerpc/powernv/memtrace: Fix out of bounds issue in memtrace mmap (Ritesh Harjani (IBM))
  - net_sched: sch_sfq: fix a potential crash on gso_skb handling (Eric Dumazet)
  - scsi: iscsi: Fix incorrect error path labels for flashnode operations (Alok Tiwari)
  - pinctrl: qcom: pinctrl-qcm2290: Add missing pins (Wojciech Slenska)
  - spi: omap2-mcspi: Disable multi-mode when the previous message kept CS asserted (Félix Piédallu)
  - spi: omap2-mcspi: Disable multi mode when CS should be kept asserted after message (Félix Piédallu)
  - regulator: max20086: Fix refcount leak in max20086_parse_regulators_dt() (Dan Carpenter)
  - wifi: ath12k: fix GCC_GCC_PCIE_HOT_RST definition for WCN7850 (Baochen Qiang)
  - wifi: ath12k: refactor ath12k_hw_regs structure (P Praneesh)
  - wifi: ath11k: validate ath11k_crypto_mode on top of ath11k_core_qmi_firmware_ready (Rodrigo Gobbi)
  - wifi: ath11k: move some firmware stats related functions outside of debugfs (Baochen Qiang)
  - wifi: ath11k: don't wait when there is no vdev started (Baochen Qiang)
  - wifi: ath11k: don't use static variables in ath11k_debugfs_fw_stats_process() (Baochen Qiang)
  - wifi: ath11k: avoid burning CPU in ath11k_debugfs_fw_stats_request() (Baochen Qiang)
  - wifi: ath11k: convert timeouts to secs_to_jiffies() (Easwar Hariharan)
  - ath10k: snoc: fix unbalanced IRQ enable in crash recovery (Caleb Connolly)
  - ptp: remove ptp->n_vclocks check logic in ptp_vclock_in_use() (Jeongjun Park)
  - net: dsa: b53: fix untagged traffic sent via cpu tagged with VID 0 (Jonas Gorski)
  - Bluetooth: MGMT: Protect mgmt_pending list with its own lock (Luiz Augusto von Dentz)
  - Bluetooth: MGMT: Remove unused mgmt_pending_find_data (Dr. David Alan Gilbert)
  - Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete (Luiz Augusto von Dentz)
  - Bluetooth: btintel_pcie: Reduce driver buffer posting to prevent race condition (Chandrashekar Devegowda)
  - Bluetooth: btintel_pcie: Increase the tx and rx descriptor count (Chandrashekar Devegowda)
  - Bluetooth: btintel_pcie: Fix driver not posting maximum rx buffers (Kiran K)
  - Bluetooth: hci_core: fix list_for_each_entry_rcu usage (Pauli Virtanen)
  - scsi: core: ufs: Fix a hang in the error handler (Sanjeev Yadav)
  - serial: sh-sci: Move runtime PM enable to sci_probe_single() (Claudiu Beznea)
  - dt-bindings: pwm: adi,axi-pwmgen: Fix clocks (David Lechner)
  - dt-bindings: pwm: Correct indentation and style in DTS example (Krzysztof Kozlowski)
  - dt-bindings: pwm: adi,axi-pwmgen: Increase #pwm-cells to 3 (Uwe Kleine-König)
  - pinctrl: samsung: add gs101 specific eint suspend/resume callbacks (Peter Griffin)
  - pinctrl: samsung: add dedicated SoC eint suspend/resume callbacks (Peter Griffin)
  - pinctrl: samsung: refactor drvdata suspend & resume callbacks (Peter Griffin)
  - arm64: dts: qcom: x1e80100: Add GPU cooling (Stephan Gerhold)
  - arm64: dts: qcom: x1e80100: Apply consistent critical thermal shutdown (Stephan Gerhold)
  - mmc: sdhci-of-dwcmshc: add PD workaround on RK3576 (Nicolas Frattaroli)
  - pmdomain: core: Introduce dev_pm_genpd_rpm_always_on() (Ulf Hansson)
  - Input: synaptics-rmi - fix crash with unsupported versions of F34 (Dmitry Torokhov)
  - ALSA: hda/realtek: Add support for HP Agusta using CS35L41 HDA (Stefan Binding)
  - ALSA: hda/realtek - Add new HP ZBook laptop with micmute led fixup (Chris Chiu)
  - ALSA: hda/realtek - Support mute led function for HP platform (Kailang Yang)
  - ALSA: hda/realtek: Add support for various HP Laptops using CS35L41 HDA (Stefan Binding)
  - ALSA: hda/realtek: fix micmute LEDs on HP Laptops with ALC3247 (Chris Chiu)
  - ALSA: hda/realtek: fix micmute LEDs on HP Laptops with ALC3315 (Chris Chiu)
  - tools/power turbostat: Fix AMD package-energy reporting (Gautham R. Shenoy)
  - do_change_type(): refuse to operate on unmounted/not ours mounts (Al Viro)
  - fix propagation graph breakage by MOVE_MOUNT_SET_GROUP move_mount(2) (Al Viro)
  - path_overmount(): avoid false negatives (Al Viro)
  - iov_iter: use iov_offset for length calculation in iov_iter_aligned_bvec (Nitesh Shetty)
  - ASoC: ti: omap-hdmi: Re-add dai_link->platform to fix card init (Yuuki NAGAO)
  - ASoC: Intel: avs: Verify content returned by parse_int_array() (Cezary Rojewski)
  - ASoC: Intel: avs: Fix deadlock when the failing IPC is SET_D0IX (Cezary Rojewski)
  - ASoC: codecs: hda: Fix RPM usage count underflow (Cezary Rojewski)
  - scsi: ufs: qcom: Prevent calling phy_exit() before phy_init() (Nitin Rawat)
  - riscv: misaligned: fix sleeping function called during misaligned access handling (Nylon Chen)
  - seg6: Fix validation of nexthop addresses (Ido Schimmel)
  - wireguard: device: enable threaded NAPI (Mirco Barone)
  - net: wwan: mhi_wwan_mbim: use correct mux_id for multiplexing (Daniele Palmas)
  - wifi: cfg80211/mac80211: correctly parse S1G beacon optional elements (Lachlan Hodges)
  - net: dsa: b53: do not touch DLL_IQQD on bcm53115 (Jonas Gorski)
  - net: dsa: b53: allow RGMII for bcm63xx RGMII ports (Jonas Gorski)
  - net: dsa: b53: do not enable RGMII delay on bcm63xx (Jonas Gorski)
  - net: ti: icssg-prueth: Fix swapped TX stats for MII interfaces. (Meghana Malladi)
  - netfilter: nf_nat: also check reverse tuple to obtain clashing entry (Florian Westphal)
  - netfilter: nf_set_pipapo_avx2: fix initial map fill (Florian Westphal)
  - drm/panel-simple: fix the warnings for the Evervision VGG644804 (Michael Walle)
  - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Alok Tiwari)
  - nvme: fix command limits status code (Keith Busch)
  - PM: sleep: Fix power.is_suspended cleanup for direct-complete devices (Rafael J. Wysocki)
  - selftests: net: build net/lib dependency in all target (Bui Quang Minh)
  - vmxnet3: correctly report gso type for UDP tunnels (Ronak Doshi)
  - net: wwan: t7xx: Fix napi rx poll issue (Jinjian Song)
  - net: fix udp gso skb_segment after pull from frag_list (Shiming Cheng)
  - drm/i915/guc: Handle race condition where wakeref count drops below 0 (Jesus Narvaez)
  - drm/i915/psr: Fix using wrong mask in REG_FIELD_PREP (Jouni Högander)
  - drm/i915/guc: Check if expecting reply before decrementing outstanding_submission_g2h (Jesus Narvaez)
  - net: stmmac: make sure that ptp_rate is not 0 before configuring EST (Alexis Lothoré)
  - net: stmmac: make sure that ptp_rate is not 0 before configuring timestamping (Alexis Lothoré)
  - net: dsa: tag_brcm: legacy: fix pskb_may_pull length (Álvaro Fernández Rojas)
  - idpf: avoid mailbox timeout delays during reset (Emil Tantilov)
  - idpf: fix a race in txq wakeup (Brian Vazquez)
  - ice: fix rebuilding the Tx scheduler tree for large queue counts (Michal Kubiak)
  - ice: create new Tx scheduler nodes for new queues only (Michal Kubiak)
  - ice: fix Tx scheduler error handling in XDP callback (Michal Kubiak)
  - Bluetooth: L2CAP: Fix not responding with L2CAP_CR_LE_ENCRYPTION (Luiz Augusto von Dentz)
  - spi: bcm63xx-hsspi: fix shared reset (Álvaro Fernández Rojas)
  - spi: bcm63xx-spi: fix shared reset (Álvaro Fernández Rojas)
  - net: lan966x: Make sure to insert the vlan tags also in host mode (Horatiu Vultur)
  - net/mlx4_en: Prevent potential integer overflow calculating Hz (Dan Carpenter)
  - driver: net: ethernet: mtk_star_emac: fix suspend/resume issue (Yanqing Wang)
  - net: tipc: fix refcount warning in tipc_aead_encrypt (Charalampos Mitrodimas)
  - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Alok Tiwari)
  - net: stmmac: platform: guarantee uniqueness of bus_id (Quentin Schulz)
  - page_pool: Fix use-after-free in page_pool_recycle_in_ring (Dong Chenchen)
  - Fix sock_exceed_buf_limit not being triggered in __sk_mem_raise_allocated (Tengteng Yang)
  - drm/xe: Make xe_gt_freq part of the Documentation (Rodrigo Vivi)
  - loop: add file_start_write() and file_end_write() (Ming Lei)
  - USB: typec: fix const issue in typec_match() (Greg Kroah-Hartman)
  - USB: gadget: udc: fix const issue in gadget_match_driver() (Greg Kroah-Hartman)
  - iio: adc: mcp3911: fix device dependent mappings for conversion result registers (Marcus Folkesson)
  - iio: adc: PAC1934: fix typo in documentation link (Marius Cristea)
  - mei: vsc: Cast tx_buf to (__be32 *) when passed to cpu_to_be32_array() (Hans de Goede)
  - vt: remove VT_RESIZE and VT_RESIZEX from vt_compat_ioctl() (Nicolas Pitre)
  - coresight: prevent deactivate active config while enabling the config (Yeoreum Yun)
  - fpga: fix potential null pointer deref in fpga_mgr_test_img_load_sgt() (Qasim Ijaz)
  - counter: interrupt-cnt: Protect enable/disable OPs with mutex (Alexander Sverdlin)
  - coresight: catu: Introduce refcount and spinlock for enabling/disabling (Yabin Cui)
  - coresight: Fixes device's owner field for registered using coresight_init_driver() (Junhao He)
  - MIPS: Loongson64: Add missing '#interrupt-cells' for loongson64c_ls7a (WangYuli)
  - usb: acpi: Prevent null pointer dereference in usb_acpi_add_usb4_devlink() (Chenyuan Yang)
  - iio: adc: ad7124: Fix 3dB filter frequency reading (Uwe Kleine-König)
  - iio: filter: admv8818: Support frequencies >= 2^32 (Brian Pellegrino)
  - iio: filter: admv8818: fix range calculation (Sam Winchenbach)
  - iio: filter: admv8818: fix integer overflow (Sam Winchenbach)
  - iio: filter: admv8818: fix band 4, state 15 (Sam Winchenbach)
  - thunderbolt: Fix a logic error in wake on connect (Mario Limonciello)
  - serial: Fix potential null-ptr-deref in mlb_usio_probe() (Henry Martin)
  - usb: renesas_usbhs: Reorder clock handling and power management in probe (Lad Prabhakar)
  - PCI: endpoint: Retain fixed-size BAR size as well as aligned size (Jerome Brunet)
  - rtc: loongson: Add missing alarm notifications for ACPI RTC events (Liu Dalin)
  - PCI/DPC: Log Error Source ID only when valid (Bjorn Helgaas)
  - PCI/DPC: Initialize aer_err_info before using it (Bjorn Helgaas)
  - PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root() (Zhe Qiao)
  - dmaengine: ti: Add NULL check in udma_probe() (Henry Martin)
  - phy: qcom-qmp-usb: Fix an NULL vs IS_ERR() bug (Chenyuan Yang)
  - PCI: apple: Use gpiod_set_value_cansleep in probe flow (Hector Martin)
  - PCI: cadence: Fix runtime atomic count underflow (Hans Zhang)
  - PCI: rcar-gen4: set ep BAR4 fixed size (Jerome Brunet)
  - PCI: Print the actual delay time in pci_bridge_wait_for_secondary_bus() (Wilfred Mallawa)
  - phy: rockchip: samsung-hdptx: Do no set rk_hdptx_phy->rate in case of errors (Cristian Ciocaltea)
  - phy: rockchip: samsung-hdptx: Fix clock ratio setup (Cristian Ciocaltea)
  - rtc: sh: assign correct interrupts with DT (Wolfram Sang)
  - rust: alloc: add missing invariant in Vec::set_len() (Danilo Krummrich)
  - cifs: Fix validation of SMB1 query reparse point response (Pali Rohár)
  - perf callchain: Always populate the addr_location map when adding IP (Ian Rogers)
  - perf trace: Set errpid to false for rseq and set_robust_list (Anubhav Shelat)
  - nfs: ignore SB_RDONLY when remounting nfs (Li Lingfeng)
  - nfs: clear SB_RDONLY before getting superblock (Li Lingfeng)
  - perf trace: Always print return value for syscalls returning a pid (Anubhav Shelat)
  - perf record: Fix incorrect --user-regs comments (Dapeng Mi)
  - perf symbol: Fix use-after-free in filename__read_build_id (Ian Rogers)
  - mailbox: mtk-cmdq: Refine GCE_GCTL_VALUE setting (Jason-JH Lin)
  - mailbox: imx: Fix TXDB_V2 sending (Peng Fan)
  - perf tests switch-tracking: Fix timestamp comparison (Leo Yan)
  - mfd: stmpe-spi: Correct the name used in MODULE_DEVICE_TABLE (Alexey Gladkov)
  - mfd: exynos-lpass: Avoid calling exynos_lpass_disable() twice in exynos_lpass_remove() (Christophe JAILLET)
  - mfd: exynos-lpass: Fix an error handling path in exynos_lpass_probe() (Christophe JAILLET)
  - rpmsg: qcom_smd: Fix uninitialized return variable in __qcom_smd_send() (Dan Carpenter)
  - remoteproc: k3-dsp: Drop check performed in k3_dsp_rproc_{mbox_callback/kick} (Siddharth Vadapalli)
  - remoteproc: k3-r5: Drop check performed in k3_r5_rproc_{mbox_callback/kick} (Siddharth Vadapalli)
  - remoteproc: qcom_wcnss_iris: Add missing put_device() on error in probe (Dan Carpenter)
  - perf scripts python: exported-sql-viewer.py: Fix pattern matching with Python 3 (Adrian Hunter)
  - perf intel-pt: Fix PEBS-via-PT data_src (Adrian Hunter)
  - perf tests: Fix 'perf report' tests installation (Michael Petlan)
  - perf trace: Fix leaks of 'struct thread' in set_filter_loop_pids() (Namhyung Kim)
  - dm-flakey: make corrupting read bios work (Benjamin Marzinski)
  - dm-flakey: error all IOs when num_features is absent (Benjamin Marzinski)
  - dm: fix dm_blk_report_zones (Benjamin Marzinski)
  - perf symbol-minimal: Fix double free in filename__read_build_id (Ian Rogers)
  - hwmon: (asus-ec-sensors) check sensor index in read_string() (Alexei Safin)
  - mtd: nand: ecc-mxic: Fix use of uninitialized variable ret (Mikhail Arkhipov)
  - x86/irq: Ensure initial PIR loads are performed exactly once (Sean Christopherson)
  - backlight: pm8941: Add NULL check in wled_configure() (Henry Martin)
  - dm: free table mempools if not used in __bind (Benjamin Marzinski)
  - dm: don't change md if dm_table_set_restrictions() fails (Benjamin Marzinski)
  - perf ui browser hists: Set actions->thread before calling do_zoom_thread() (Arnaldo Carvalho de Melo)
  - perf build: Warn when libdebuginfod devel files are not available (Arnaldo Carvalho de Melo)
  - randstruct: gcc-plugin: Fix attribute addition (Kees Cook)
  - randstruct: gcc-plugin: Remove bogus void member (Kees Cook)
  - fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod() (Sergey Shtylyov)
  - soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop() (Henry Martin)
  - soc: aspeed: lpc: Fix impossible judgment condition (Su Hui)
  - ARM: aspeed: Don't select SRAM (Joel Stanley)
  - arm64: dts: mt6359: Rename RTC node to match binding expectations (Julien Massot)
  - arm64: dts: renesas: white-hawk-ard-audio: Fix TPU0 groups (Thuan Nguyen)
  - arm64: dts: qcom: qcm2290: fix (some) of QUP interconnects (Dmitry Baryshkov)
  - arm64: dts: rockchip: disable unrouted USB controllers and PHY on RK3399 Puma with Haikou (Quentin Schulz)
  - arm64: defconfig: mediatek: enable PHY drivers (Vignesh Raman)
  - ARM: dts: qcom: apq8064: move replicator out of soc node (Dmitry Baryshkov)
  - ARM: dts: qcom: apq8064 merge hw splinlock into corresponding syscon device (Dmitry Baryshkov)
  - ARM: dts: qcom: apq8064: add missing clocks to the timer node (Dmitry Baryshkov)
  - dt-bindings: vendor-prefixes: Add Liontron name (Andre Przywara)
  - bus: fsl-mc: fix double-free on mc_dev (Ioana Ciornei)
  - nilfs2: do not propagate ENOENT error from nilfs_btree_propagate() (Ryusuke Konishi)
  - nilfs2: add pointer check for nilfs_direct_propagate() (Wentao Liang)
  - Squashfs: check return result of sb_min_blocksize (Phillip Lougher)
  - soc: qcom: smp2p: Fix fallback to qcom,ipc parse (Barnabás Czémán)
  - arm64: dts: ti: k3-j721e-common-proc-board: Enable OSPI1 on J721E (Prasanth Babu Mantena)
  - arm64: tegra: Add uartd serial alias for Jetson TX1 module (Aaron Kling)
  - arm64: tegra: Drop remaining serial clock-names and reset-names (Aaron Kling)
  - arm64: dts: rockchip: Update eMMC for NanoPi R5 series (Peter Robinson)
  - arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3566-rock3c (Peter Robinson)
  - arm64: dts: qcom: sda660-ifc6560: Fix dt-validate warning (Alexey Minnekhanov)
  - arm64: dts: qcom: sdm660-lavender: Add missing USB phy supply (Alexey Minnekhanov)
  - arm64: dts: mt6359: Add missing 'compatible' property to regulators node (Julien Massot)
  - arm64: dts: mediatek: mt6357: Drop regulator-fixed compatibles (Nícolas F. R. A. Prado)
  - arm64: dts: imx8mn-beacon: Set SAI5 MCLK direction to output for HDMI audio (Adam Ford)
  - arm64: dts: imx8mm-beacon: Set SAI5 MCLK direction to output for HDMI audio (Adam Ford)
  - arm64: dts: imx8mp-beacon: Fix RTC capacitive load (Adam Ford)
  - arm64: dts: imx8mn-beacon: Fix RTC capacitive load (Adam Ford)
  - arm64: dts: imx8mm-beacon: Fix RTC capacitive load (Adam Ford)
  - arm64: dts: mt8183: Add port node to mt8183.dtsi (Pin-yen Lin)
  - arm64: dts: qcom: sdm660-xiaomi-lavender: Add missing SD card detect GPIO (Alexey Minnekhanov)
  - arm64: dts: mediatek: mt8195: Reparent vdec1/2 and venc1 power domains (AngeloGioacchino Del Regno)
  - ARM: dts: at91: at91sam9263: fix NAND chip selects (Wolfram Sang)
  - ARM: dts: at91: usb_a9263: fix GPIO for Dataflash chip select (Wolfram Sang)
  - arm64: dts: rockchip: Move SHMEM memory to reserved memory on rk3588 (Chukun Pan)
  - arm64: dts: qcom: ipq9574: Fix USB vdd info (Varadarajan Narayanan)
  - arm64: dts: qcom: sc8280xp-x13s: Drop duplicate DMIC supplies (Stephan Gerhold)
  - arm64: dts: qcom: sm8250: Fix CPU7 opp table (Xilin Wu)
  - arm64: dts: qcom: sm8350: Reenable crypto & cryptobam (Luca Weiss)
  - arm64: dts: qcom: sdm845-starqltechn: remove excess reserved gpios (Dzmitry Sankouski)
  - arm64: dts: qcom: sdm845-starqltechn: refactor node order (Dzmitry Sankouski)
  - arm64: dts: qcom: sdm845-starqltechn: fix usb regulator mistake (Dzmitry Sankouski)
  - arm64: dts: qcom: sdm845-starqltechn: remove wifi (Dzmitry Sankouski)
  - arm64: dts: qcom: x1e80100-romulus: Keep L12B and L15B always on (Konrad Dybcio)
  - arm64: dts: qcom: sm8650: add missing cpu-cfg interconnect path in the mdss node (Neil Armstrong)
  - arm64: dts: qcom: sm8650: setup gpu thermal with higher temperatures (Neil Armstrong)
  - arm64: dts: qcom: x1e80100: Mark usb_2 as dma-coherent (Mark Kettenis)
  - f2fs: fix to correct check conditions in f2fs_cross_rename (Zhiguo Niu)
  - f2fs: use d_inode(dentry) cleanup dentry->d_inode (Zhiguo Niu)
  - net: phy: mscc: Stop clearing the the UDPv4 checksum for L2 frames (Horatiu Vultur)
  - net: openvswitch: Fix the dead loop of MPLS parse (Faicker Mo)
  - calipso: Don't call calipso functions for AF_INET sk. (Kuniyuki Iwashima)
  - octeontx2-pf: QOS: Refactor TC_HTB_LEAF_DEL_LAST callback (Hariprasad Kelam)
  - octeontx2-pf: QOS: Perform cache sync on send queue teardown (Hariprasad Kelam)
  - net: phy: mscc: Fix memory leak when using one step timestamping (Horatiu Vultur)
  - net: lan743x: Fix PHY reset handling during initialization and WOL (Thangaraj Samynathan)
  - net: lan743x: rename lan743x_reset_phy to lan743x_hw_reset_phy (Thangaraj Samynathan)
  - net: phy: fix up const issues in to_mdio_device() and to_phy_device() (Greg Kroah-Hartman)
  - net: phy: clear phydev->devlink when the link is deleted (Wei Fang)
  - bpf: Avoid __bpf_prog_ret0_warn when jit fails (KaFai Wan)
  - net: xilinx: axienet: Fix Tx skb circular buffer occupancy check in dmaengine xmit (Suraj Gupta)
  - net: lan966x: Fix 1-step timestamping over ipv4 or ipv6 (Horatiu Vultur)
  - RDMA/cma: Fix hang when cma_netevent_callback fails to queue_work (Jack Morgenstein)
  - vsock/virtio: fix `rx_bytes` accounting for stream sockets (Stefano Garzarella)
  - net: usb: aqc111: fix error handling of usbnet read calls (Nikita Zhandarovich)
  - RISC-V: KVM: lock the correct mp_state during reset (Radim Krčmář)
  - netfilter: nft_tunnel: fix geneve_opt dump (Fernando Fernandez Mancera)
  - netfilter: nf_tables: nft_fib: consistent l3mdev handling (Florian Westphal)
  - bpf, sockmap: Avoid using sk_socket after free when sending (Jiayuan Chen)
  - Bluetooth: btintel: Check dsbr size from EFI variable (Kees Cook)
  - Bluetooth: MGMT: iterate over mesh commands in mgmt_mesh_foreach() (Dmitry Antipov)
  - vfio/type1: Fix error unwind in migration dirty bitmap allocation (Li RongQing)
  - netfilter: nf_tables: nft_fib_ipv6: fix VRF ipv4/ipv6 result discrepancy (Florian Westphal)
  - netfilter: xtables: support arpt_mark and ipv6 optstrip for iptables-nft only builds (Florian Westphal)
  - bpf: Revert "bpf: remove unnecessary rcu_read_{lock,unlock}() in multi-uprobe attach logic" (Di Shen)
  - wifi: mt76: mt7996: fix RX buffer size of MCU event (Shayne Chen)
  - wifi: mt76: mt7996: set EHT max ampdu length capability (Peter Chiu)
  - wifi: mt76: mt7925: ensure all MCU commands wait for response (Michael Lo)
  - wifi: mt76: mt7925: refine the sniffer commnad (Ming Yen Hsieh)
  - wifi: mt76: mt7925: prevent multiple scan commands (Ming Yen Hsieh)
  - wifi: mt76: mt7915: Fix null-ptr-deref in mt7915_mmio_wed_init() (Henry Martin)
  - wifi: mt76: mt7996: Fix null-ptr-deref in mt7996_mmio_wed_init() (Henry Martin)
  - Bluetooth: ISO: Fix not using SID from adv report (Luiz Augusto von Dentz)
  - kernfs: Relax constraint in draining guard (Michal Koutný)
  - scsi: ufs: mcq: Delete ufshcd_release_scsi_cmd() in ufshcd_mcq_abort() (ping.gao)
  - wifi: ath9k_htc: Abort software beacon handling if disabled (Toke Høiland-Jørgensen)
  - hisi_acc_vfio_pci: bugfix live migration function without VF device driver (Longfang Liu)
  - hisi_acc_vfio_pci: add eq and aeq interruption restore (Longfang Liu)
  - hisi_acc_vfio_pci: fix XQE dma address error (Longfang Liu)
  - wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event (Rajat Soni)
  - iommu: remove duplicate selection of DMAR_TABLE (Rolf Eike Beer)
  - wifi: rtw89: fix firmware scan delay unit for WiFi 6 chips (Chin-Yen Lee)
  - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (Alexey Kodanev)
  - wifi: rtw89: pci: enlarge retry times of RX tag to 1000 (Ping-Ke Shih)
  - s390/bpf: Store backchain even for leaf progs (Ilya Leoshkevich)
  - clk: qcom: gcc-msm8939: Fix mclk0 & mclk1 for 24 MHz (Vincent Knecht)
  - dt-bindings: soc: fsl,qman-fqd: Fix reserved-memory.yaml reference (Rob Herring (Arm))
  - bpf: Fix WARN() in get_bpf_raw_tp_regs (Tao Chen)
  - pinctrl: at91: Fix possible out-of-boundary access (Andy Shevchenko)
  - libbpf: Use proper errno value in nlattr (Anton Protopopov)
  - ktls, sockmap: Fix missing uncharge operation (Jiayuan Chen)
  - of: unittest: Unlock on error in unittest_data_add() (Dan Carpenter)
  - tracing: Fix error handling in event_trigger_parse() (Miaoqian Lin)
  - tracing: Rename event_trigger_alloc() to trigger_data_alloc() (Steven Rostedt)
  - selftests/bpf: Fix caps for __xlated/jited_unpriv (Luis Gerhorst)
  - efi/libstub: Describe missing 'out' parameter in efi_load_initrd (Hans Zhang)
  - wifi: iwlfiwi: mvm: Fix the rate reporting (Ilan Peer)
  - clk: bcm: rpi: Add NULL check in raspberrypi_clk_register() (Henry Martin)
  - bpftool: Fix regression of "bpftool cgroup tree" EINVAL on older kernels (YiFei Zhu)
  - clk: qcom: gpucc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
  - clk: qcom: gcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
  - clk: qcom: dispcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
  - clk: qcom: camcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
  - tracing: Move histogram trigger variables from stack to per CPU structure (Steven Rostedt)
  - bpf: Fix uninitialized values in BPF_{CORE,PROBE}_READ (Anton Protopopov)
  - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Patrisious Haddad)
  - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Pablo Neira Ayuso)
  - netfilter: nft_quota: match correctly when the quota just depleted (Zhongqiu Duan)
  - netfilter: bridge: Move specific fragmented packet to slow_path instead of dropping it (Huajian Yang)
  - bpf: Allow XDP dev-bound programs to perform XDP_REDIRECT into maps (Lorenzo Bianconi)
  - libbpf: Use proper errno value in linker (Anton Protopopov)
  - scsi: smartpqi: Fix smp_processor_id() call trace for preemptible kernels (Yi Zhang)
  - f2fs: fix to detect gcing page in f2fs_is_cp_guaranteed() (Chao Yu)
  - f2fs: clean up w/ fscrypt_is_bounce_page() (Chao Yu)
  - bonding: assign random address if device address is same as bond (Hangbin Liu)
  - iommu: Protect against overflow in iommu_pgsize() (Jason Gunthorpe)
  - Use thread-safe function pointer in libbpf_print (Jonathan Wiepert)
  - libbpf: Remove sample_period init in perf_buffer (Tao Chen)
  - libbpf: Fix event name too long error (Feng Yang)
  - scsi: hisi_sas: Call I_T_nexus after soft reset for SATA disk (Yihang Li)
  - RDMA/hns: Include hnae3.h in hns_roce_hw_v2.h (Junxian Huang)
  - wifi: ath12k: fix node corruption in ar->arvifs list (Maharaja Kennadyrajan)
  - wifi: ath12k: Fix the QoS control field offset to build QoS header (Ramasamy Kaliappan)
  - wifi: ath12k: Add MSDU length validation for TKIP MIC error (P Praneesh)
  - wifi: ath12k: fix invalid access to memory (Sarika Sharma)
  - wifi: rtw88: do not ignore hardware read error during DPK (Dmitry Antipov)
  - wifi: rtw88: sdio: call rtw_sdio_indicate_tx_status unconditionally (Zhen XIN)
  - wifi: rtw88: sdio: map mgmt frames to queue TX_DESC_QSEL_MGMT (Zhen XIN)
  - xfrm: Use xdo.dev instead of xdo.real_dev (Cosmin Ratiu)
  - net/mlx5: Avoid using xso.real_dev unnecessarily (Cosmin Ratiu)
  - libbpf: Fix buffer overflow in bpf_object__init_prog (Viktor Malik)
  - net: ncsi: Fix GCPS 64-bit member variables (Hari Kalavakunta)
  - page_pool: Track DMA-mapped pages and unmap them when destroying the pool (Toke Høiland-Jørgensen)
  - page_pool: Move pp_magic check into helper functions (Toke Høiland-Jørgensen)
  - f2fs: fix to do sanity check on sbi->total_valid_block_count (Chao Yu)
  - f2fs: prevent the current section from being selected as a victim during GC (yohan.joung)
  - f2fs: clean up unnecessary indentation (Jaegeuk Kim)
  - wifi: ath12k: Fix buffer overflow in debugfs (Dan Carpenter)
  - wifi: ath12k: Fix WMI tag for EHT rate in peer assoc (Ramya Gnanasekar)
  - wifi: ath12k: fix cleanup path after mhi init (Raj Kumar Bhagat)
  - f2fs: zone: fix to avoid inconsistence in between SIT and SSA (Chao Yu)
  - bpf, sockmap: Fix panic when calling skb_linearize (Jiayuan Chen)
  - bpf, sockmap: fix duplicated data transmission (Jiayuan Chen)
  - bpf: fix ktls panic with sockmap (Jiayuan Chen)
  - selftests/bpf: Fix bpf_nf selftest failure (Saket Kumar Bhaskar)
  - bpf: Check link_create.flags parameter for multi_kprobe (Tao Chen)
  - IB/cm: use rwlock for MAD agent lock (Jacob Moroni)
  - wifi: ath12k: Fix invalid memory access while forming 802.11 header (P Praneesh)
  - wifi: ath12k: Fix memory leak during vdev_id mismatch (P Praneesh)
  - wifi: ath11k: fix node corruption in ar->arvifs list (Stone Zhang)
  - xen/x86: fix initial memory balloon target (Roger Pau Monne)
  - svcrdma: Reduce the number of rdma_rw contexts per-QP (Chuck Lever)
  - media: verisilicon: Free post processor buffers on error (Detlev Casanova)
  - drm/mediatek: mtk_drm_drv: Unbind secondary mmsys components on err (AngeloGioacchino Del Regno)
  - drm/mediatek: Fix kobject put for component sub-drivers (AngeloGioacchino Del Regno)
  - drm/mediatek: mtk_drm_drv: Fix kobject put for mtk_mutex device ptr (AngeloGioacchino Del Regno)
  - drm/msm/a6xx: Disable rgb565_predicator on Adreno 7c3 (Konrad Dybcio)
  - selftests/seccomp: fix negative_ENOSYS tracer tests on arm32 (Terry Tritton)
  - perf/amlogic: Replace smp_processor_id() with raw_smp_processor_id() in meson_ddr_pmu_create() (Anand Moon)
  - scsi: qedf: Use designated initializer for struct qed_fcoe_cb_ops (Kees Cook)
  - overflow: Fix direct struct member initialization in _DEFINE_FLEX() (Gustavo A. R. Silva)
  - arm64/fpsimd: Do not discard modified SVE state (Mark Rutland)
  - firmware: SDEI: Allow sdei initialization without ACPI_APEI_GHES (Huang Yiwei)
  - drm/tegra: rgb: Fix the unbound reference count (Biju Das)
  - drm/vkms: Adjust vkms_state->active_planes allocation type (Kees Cook)
  - drm: rcar-du: Fix memory leak in rcar_du_vsps_init() (Biju Das)
  - drm/msm/dpu: enable SmartDMA on SC8180X (Dmitry Baryshkov)
  - drm/msm/dpu: enable SmartDMA on SM8150 (Dmitry Baryshkov)
  - selftests/seccomp: fix syscall_restart test for arm compat (Neill Kapron)
  - arm64/fpsimd: Avoid warning when sve_to_fpsimd() is unused (Mark Rutland)
  - arm64: Support ARM64_VA_BITS=52 when setting ARCH_MMAP_RND_BITS_MAX (Kornel Dulęba)
  - firmware: psci: Fix refcount leak in psci_dt_init (Miaoqian Lin)
  - m68k: mac: Fix macintosh_config for Mac II (Finn Thain)
  - watchdog: exar: Shorten identity name to fit correctly (Kees Cook)
  - kunit/usercopy: Disable u64 test on 32-bit SPARC (Thomas Weißschuh)
  - fs/ntfs3: Add missing direct_IO in ntfs_aops_cmpr (Lizhi Xu)
  - fs/ntfs3: handle hdr_first_de() return value (Andrey Vatoropin)
  - drm/bridge: lt9611uxc: Fix an error handling path in lt9611uxc_probe() (Christophe JAILLET)
  - drm/panel: samsung-sofef00: Drop s6e3fc2x01 support (Casey Connolly)
  - perf: arm-ni: Fix missing platform_set_drvdata() (Hongbo Yao)
  - perf: arm-ni: Unregister PMUs on probe failure (Hongbo Yao)
  - drm/panthor: Update panthor_mmu::irq::mask when needed (Boris Brezillon)
  - drm/panthor: Fix GPU_COHERENCY_ACE[_LITE] definitions (Boris Brezillon)
  - arm64/fpsimd: Fix merging of FPSIMD state during signal return (Mark Rutland)
  - arm64/fpsimd: Reset FPMR upon exec() (Mark Rutland)
  - arm64/fpsimd: Avoid clobbering kernel FPSIMD state with SMSTOP (Mark Rutland)
  - arm64/fpsimd: Don't corrupt FPMR when streaming mode changes (Mark Brown)
  - arm64/fpsimd: Discard stale CPU state when handling SME traps (Mark Brown)
  - arm64/fpsimd: Avoid RES0 bits in the SME trap handler (Mark Rutland)
  - media: rkvdec: Fix frame size enumeration (Jonas Karlman)
  - drm/amd/pp: Fix potential NULL pointer dereference in atomctrl_initialize_mc_reg_table (Charles Han)
  - drm/vc4: tests: Use return instead of assert (Maxime Ripard)
  - drm/xe/d3cold: Set power state to D3Cold during s2idle/s3 (Badal Nilawar)
  - drm/vmwgfx: Fix dumb buffer leak (Ian Forbes)
  - drm/vmwgfx: Add error path for xa_store in vmw_bo_add_detached_resource (Keisuke Nishimura)
  - drm/vmwgfx: Add seqno waiter for sync_files (Ian Forbes)
  - ALSA: core: fix up bus match const issues. (Greg Kroah-Hartman)
  - ASoC: apple: mca: Constrain channels according to TDM mask (Martin Povišer)
  - spi: sh-msiof: Fix maximum DMA transfer size (Geert Uytterhoeven)
  - ACPI: OSI: Stop advertising support for "3.0 _SCP Extensions" (Armin Wolf)
  - thermal/drivers/mediatek/lvts: Fix debugfs unregister on failure (AngeloGioacchino Del Regno)
  - PM: sleep: Print PM debug messages during hibernation (Rafael J. Wysocki)
  - x86/mtrr: Check if fixed-range MTRRs exist in mtrr_save_fixed_ranges() (Jiaqing Zhao)
  - ACPI: resource: fix a typo for MECHREVO in irq1_edge_low_force_override[] (Mingcong Bai)
  - PM: wakeup: Delete space in the end of string shown by pm_show_wakelocks() (Zijun Hu)
  - ASoC: SOF: amd: add missing acp descriptor field (Vijendar Mukunda)
  - ASoC: SOF: ipc4-pcm: Adjust pipeline_list->pipelines allocation type (Kees Cook)
  - PM: EM: Fix potential division-by-zero error in em_compute_costs() (Yaxiong Tian)
  - power: reset: at91-reset: Optimize at91_reset() (Alexander Shiyan)
  - spi: tegra210-quad: modify chip select (CS) deactivation (Vishwaroop A)
  - spi: tegra210-quad: remove redundant error handling code (Vishwaroop A)
  - spi: tegra210-quad: Fix X1_X2_X4 encoding and support x4 transfers (Vishwaroop A)
  - EDAC/{skx_common,i10nm}: Fix the loss of saved RRL for HBM pseudo channel 0 (Qiuxu Zhuo)
  - EDAC/skx_common: Fix general protection fault (Qiuxu Zhuo)
  - ASoC: mediatek: mt8195: Set ETDM1/2 IN/OUT to COMP_DUMMY() (Julien Massot)
  - ASoC: tas2764: Enable main IRQs (Hector Martin)
  - ACPICA: exserial: don't forget to handle FFixedHW opregions for reading (Daniil Tatianin)
  - crypto: api - Redo lookup on EEXIST (Herbert Xu)
  - kunit: Fix wrong parameter to kunit_deactivate_static_stub() (Tzung-Bi Shih)
  - crypto: sun8i-ce - move fallback ahash_request to the end of the struct (Ovidiu Panait)
  - crypto: xts - Only add ecb if it is not already there (Herbert Xu)
  - crypto: lrw - Only add ecb if it is not already there (Herbert Xu)
  - rcu/cpu_stall_cputime: fix the hardirq count for x86 architecture (Yongliang Gao)
  - btrfs: fix invalid data space release when truncating block in NOCOW mode (Filipe Manana)
  - btrfs: scrub: fix a wrong error type when metadata bytenr mismatches (Qu Wenruo)
  - btrfs: scrub: update device stats when an error is detected (Qu Wenruo)
  - powerpc/pseries/iommu: Fix kmemleak in TCE table userspace view (Gaurav Batra)
  - erofs: avoid using multiple devices with different type (Sheng Yong)
  - erofs: fix file handle encoding for 64-bit NIDs (Hongbo Li)
  - crypto: marvell/cesa - Avoid empty transfer descriptor (Herbert Xu)
  - crypto: marvell/cesa - Handle zero-length skcipher requests (Herbert Xu)
  - kselftest: cpufreq: Get rid of double suspend in rtcwake case (Nícolas F. R. A. Prado)
  - brd: fix discard end sector (Yu Kuai)
  - brd: fix aligned_sector from brd_do_discard() (Yu Kuai)
  - x86/insn: Fix opcode map (!REX2) superscript tags (Masami Hiramatsu (Google))
  - x86/cpu: Sanitize CPUID(0x80000000) output (Ahmed S. Darwish)
  - crypto: sun8i-ce - undo runtime PM changes during driver removal (Ovidiu Panait)
  - x86/microcode/AMD: Do not return error when microcode update is not necessary (Annie Li)
  - sched/core: Tweak wait_task_inactive() to force dequeue sched_delayed tasks (John Stultz)
  - powerpc/crash: Fix non-smp kexec preparation (Eddie James)
  - powerpc: do not build ppc_save_regs.o always (Jiri Slaby (SUSE))
  - crypto: sun8i-ss - do not use sg_dma_len before calling DMA functions (Corentin Labbe)
  - crypto: sun8i-ce-cipher - fix error handling in sun8i_ce_cipher_prepare() (Ovidiu Panait)
  - perf/core: Fix broken throttling when max_samples_per_tick=1 (Qing Wang)
  - gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher)
  - gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher)
  - perf/x86/amd/uncore: Prevent UMC counters from saturating (Sandipan Das)
  - perf/x86/amd/uncore: Remove unused 'struct amd_uncore_ctx::node' member (Sandipan Das)
  - sched: Fix trace_sched_switch(.prev_state) (Peter Zijlstra)
  - crypto: sun8i-ce-hash - fix error handling in sun8i_ce_hash_run() (Ovidiu Panait)
  - x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt() (Andrew Cooper)
  - tools/x86/kcpuid: Fix error handling (Ahmed S. Darwish)
  - uek-rpm: Set USBIP_VHCI_NR_HCS to 4 in UEK8U1 (Harshit Mogalapalli)  [Orabug: 38012102]
  - mptcp: disable by default (Harshvardhan Jha)  [Orabug: 38035668]
  - sunrpc: handle SVC_GARBAGE during svc auth processing as auth error (Jeff Layton)  [Orabug: 38137447]  {CVE-2025-38089}
  - x86/sev/docs: Document the SNP Reverse Map Table (RMP) (Tom Lendacky)  [Orabug: 38149216]
  - x86/sev: Add full support for a segmented RMP table (Tom Lendacky)  [Orabug: 38149216]
  - x86/sev: Treat the contiguous RMP table as a single RMP segment (Tom Lendacky)  [Orabug: 38149216]
  - x86/sev: Map only the RMP table entries instead of the full RMP range (Tom Lendacky)  [Orabug: 38149216]
  - x86/sev: Move the SNP probe routine out of the way (Tom Lendacky)  [Orabug: 38149216]
  - x86/sev: Require the RMPREAD instruction after Zen4 (Tom Lendacky)  [Orabug: 38149216]
  - x86/sev: Add support for the RMPREAD instruction (Tom Lendacky)  [Orabug: 38149216]
  - x86/sev: Prepare for using the RMPREAD instruction to access the RMP (Tom Lendacky)  [Orabug: 38149216]
  - rds: Fix array index out of bounds in rds_message_purge() (Harshit Mogalapalli)  [Orabug: 38158033]
  - Add Zen34 clients (Borislav Petkov (AMD))  [Orabug: 38172252]  {CVE-2024-36350} {CVE-2024-36357}
  - x86/process: Move the buffer clearing before MONITOR (Kim Phillips)  [Orabug: 38172252]  {CVE-2024-36350} {CVE-2024-36357}
  - Add normal counters (Borislav Petkov (AMD))  [Orabug: 38172252]  {CVE-2024-36350} {CVE-2024-36357}
  - KVM: SVM: Advertize TSA CPUID bits to guests (Borislav Petkov (AMD))  [Orabug: 38172252]  {CVE-2024-36350} {CVE-2024-36357}
  - x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov (AMD))  [Orabug: 38172252]  {CVE-2024-36350} {CVE-2024-36357}
  - x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov (AMD))  [Orabug: 38172252]  {CVE-2024-36350} {CVE-2024-36357}


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-102.36.3.el9uek]
changelog:
  - aarch64: increase DEFAULT_CRASH_KERNEL_LOW_SIZE for kdump for 64K kernels (Brian Maly)  [Orabug: 38001657]
  - fs: use new field for kstat.atomic_write_unit_max_opt to avoid KABI issue (John Garry)  [Orabug: 38026089]
  - nvme: all namespaces in a subsystem must adhere to a common atomic write size (Alan Adamson)  [Orabug: 38026089]
  - nvme: multipath: enable BLK_FEAT_ATOMIC_WRITES for multipathing (Alan Adamson)  [Orabug: 38026089]
  - scsi: scsi_debug: Reduce DEF_ATOMIC_WR_MAX_LENGTH (John Garry)  [Orabug: 38026089]
  - xfs: allow sysadmins to specify a maximum atomic write limit at mount time (John Garry)  [Orabug: 38026089]
  - xfs: update atomic write limits (John Garry)  [Orabug: 38026089]
  - xfs: add xfs_calc_atomic_write_unit_max() (John Garry)  [Orabug: 38026089]
  - xfs: add xfs_file_dio_write_atomic() (John Garry)  [Orabug: 38026089]
  - xfs: commit CoW-based atomic writes atomically (John Garry)  [Orabug: 38026089]
  - xfs: add large atomic writes checks in xfs_direct_write_iomap_begin() (John Garry)  [Orabug: 38026089]
  - xfs: add xfs_atomic_write_cow_iomap_begin() (John Garry)  [Orabug: 38026089]
  - xfs: refine atomic write size check in xfs_file_write_iter() (John Garry)  [Orabug: 38026089]
  - xfs: refactor xfs_reflink_end_cow_extent() (John Garry)  [Orabug: 38026089]
  - xfs: allow block allocator to take an alignment hint (John Garry)  [Orabug: 38026089]
  - xfs: ignore HW which cannot atomic write a single block (Darrick J. Wong)  [Orabug: 38026089]
  - xfs: add helpers to compute transaction reservation for finishing intent items (Darrick J. Wong)  [Orabug: 38026089]
  - xfs: add helpers to compute log item overhead (Darrick J. Wong)  [Orabug: 38026089]
  - xfs: separate out setting buftarg atomic writes limits (Darrick J. Wong)  [Orabug: 38026089]
  - xfs: rename xfs_inode_can_atomicwrite() -> xfs_inode_can_hw_atomic_write() (John Garry)  [Orabug: 38026089]
  - xfs: only call xfs_setsize_buftarg once per buffer target (Darrick J. Wong)  [Orabug: 38026089]
  - fs: add atomic write unit max opt to statx (John Garry)  [Orabug: 38026089]
  - xfs: stop using set_blocksize (Darrick J. Wong)  [Orabug: 38026089]
  - block: hoist block size validation code to a separate function (Darrick J. Wong)  [Orabug: 38026089]
  - xfs: cleanup xfs_vn_getattr (Christoph Hellwig)  [Orabug: 38026089]
  - fs: reformat the statx definition (Christoph Hellwig)  [Orabug: 38026089]
  - dm-table: Set BLK_FEAT_ATOMIC_WRITES for target queue limits (John Garry)  [Orabug: 38026089]
  - iomap: rework IOMAP atomic flags (John Garry)  [Orabug: 38026089]
  - iomap: comment on atomic write checks in iomap_dio_bio_iter() (John Garry)  [Orabug: 38026089]
  - iomap: inline iomap_dio_bio_opflags() (John Garry)  [Orabug: 38026089]
  - iomap: Lift blocksize restriction on atomic writes (Ritesh Harjani (IBM))  [Orabug: 38026089]
  - iomap: Support SW-based atomic writes (John Garry)  [Orabug: 38026089]
  - iomap: Rename IOMAP_ATOMIC -> IOMAP_ATOMIC_HW (John Garry)  [Orabug: 38026089]
  - iomap: Minor code simplification in iomap_dio_bio_iter() (John Garry)  [Orabug: 38026089]
  - dm-mirror: Support atomic writes (John Garry)  [Orabug: 38026089]
  - dm-io: Warn on creating multiple atomic write bios for a region (John Garry)  [Orabug: 38026089]
  - dm-stripe: Enable atomic writes (John Garry)  [Orabug: 38026089]
  - dm-linear: Enable atomic writes (John Garry)  [Orabug: 38026089]
  - dm: Ensure cloned bio is same length for atomic write (John Garry)  [Orabug: 38026089]
  - dm-table: atomic writes support (John Garry)  [Orabug: 38026089]
  - block: Don't trim an atomic write (John Garry)  [Orabug: 38026089]
  - block: Add common atomic writes enable flag (John Garry)  [Orabug: 38026089]
  - block: Change blk_stack_atomic_writes_limits() unit_min check (John Garry)  [Orabug: 38026089]
  - block: Ensure start sector is aligned for stacking atomic writes (John Garry)  [Orabug: 38026089]
  - md/raid10: Atomic write support (John Garry)  [Orabug: 38026089]
  - md/raid1: Atomic write support (John Garry)  [Orabug: 38026089]
  - md/raid0: Atomic write support (John Garry)  [Orabug: 38026089]
  - block: Support atomic writes limits for stacked devices (John Garry)  [Orabug: 38026089]
  - block: Add extra checks in blk_validate_atomic_write_limits() (John Garry)  [Orabug: 38026089]
  - md/raid10: Handle bio_split() errors (John Garry)  [Orabug: 38026089]
  - md/raid1: Handle bio_split() errors (John Garry)  [Orabug: 38026089]
  - md/raid0: Handle bio_split() errors (John Garry)  [Orabug: 38026089]
  - block: Handle bio_split() errors in bio_submit_split() (John Garry)  [Orabug: 38026089]
  - block: Error an attempt to split an atomic write in bio_split() (John Garry)  [Orabug: 38026089]
  - block: Rework bio_split() return value (John Garry)  [Orabug: 38026089]
  - ext4: Do not fallback to buffered-io for DIO atomic write (Ritesh Harjani (IBM))  [Orabug: 38026089]
  - ext4: Support setting FMODE_CAN_ATOMIC_WRITE (Ritesh Harjani (IBM))  [Orabug: 38026089]
  - ext4: Check for atomic writes support in write iter (Ritesh Harjani (IBM))  [Orabug: 38026089]
  - ext4: Add statx support for atomic writes (Ritesh Harjani (IBM))  [Orabug: 38026089]
  - xfs: Support setting FMODE_CAN_ATOMIC_WRITE (John Garry)  [Orabug: 38026089]
  - xfs: Validate atomic writes (John Garry)  [Orabug: 38026089]
  - xfs: Support atomic write for statx (John Garry)  [Orabug: 38026089]
  - fs: iomap: Atomic write support (John Garry)  [Orabug: 38026089]
  - fs: Export generic_atomic_write_valid() (John Garry)  [Orabug: 38026089]
  - block: Add bdev atomic write limits helpers (John Garry)  [Orabug: 38026089]
  - Revert "SUNRPC: Don't allow waiting for exiting tasks" (Harshvardhan Jha)  [Orabug: 38162684]
  - Revert "Add normal counters" (Boris Ostrovsky)  [Orabug: 38184971]


