# changelog

author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-315.196.5.el9uek]
changelog:
  - uek-rpm: add "bpf" to CONFIG_LSM (Alan Maguire) [Orabug: 35653191]
  - Revert "cpufreq: Introduce an optional cpuinfo_avg_freq sysfs entry" (Samasth Norway Ananda) [Orabug: 38613264]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-315.196.5.1.el9uek]
changelog:
  - netfilter: nf_tables: reject duplicate device on updates (Pablo Neira Ayuso)  [Orabug: 38744086]  {CVE-2025-38678} 
  - Reapply "cpuidle: menu: Avoid discarding useful information" (Harshvardhan Jha)  [Orabug: 38744084]  
  - rtc: expose RTC_FEATURE_UPDATE_INTERRUPT (Alexandre Belloni)  [Orabug: 38744082]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-315.196.5.1.el9uek]
changelog:
  - netfilter: nf_tables: reject duplicate device on updates (Pablo Neira Ayuso)  [Orabug: 38744086]  {CVE-2025-38678}
  - Reapply "cpuidle: menu: Avoid discarding useful information" (Harshvardhan Jha)  [Orabug: 38744084]
  - rtc: expose RTC_FEATURE_UPDATE_INTERRUPT (Alexandre Belloni)  [Orabug: 38744082]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-315.196.5.2.el9uek]
changelog:
  - tipc: Fix use-after-free in tipc_mon_reinit_self(). (Kuniyuki Iwashima)  [Orabug: 38786195]  {CVE-2025-40280} 
  - fs/proc: fix uaf in proc_readdir_de() (Wei Yang)  [Orabug: 38786194]  {CVE-2025-40271} 
  - vsock: Ignore signal/timeout on connect() if already established (Michal Luczaj)  [Orabug: 38786193]  {CVE-2025-40248}


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-315.196.3.el9uek]
changelog:
  - KVM: VMX: Intercept reads to invalid and write-only x2APIC registers (Sean Christopherson) [Orabug: 38535186]
  - KVM: VMX: Always intercept accesses to unsupported "extended" x2APIC regs (Sean Christopherson) [Orabug: 38535186]
  - KVM: x86: Split out logic to generate "readable" APIC regs mask to helper (Sean Christopherson) [Orabug: 38535186]
  - KVM: x86: Mark x2APIC DFR reg as non-existent for x2APIC (Sean Christopherson) [Orabug: 38535186]
  - uek-rpm/ol9/config-mips64-emb: Enable NF_TABLES for MIPS64 (Vijay Kumar) [Orabug: 38578981]
  - LTS version: v5.15.196 (Vijayendra Suman)
  - PCI: rcar: Demote WARN() to dev_warn_ratelimited() in rcar_pcie_wakeup() (Marek Vasut) [Orabug: 38641258] {CVE-2024-43876}
  - net: rtnetlink: fix module reference count leak issue in rtnetlink_rcv_msg (Zhengchao Shao)
  - usb: gadget: f_acm: Refactor bind path to use __free() (Kuen-Han Tsai) [Orabug: 38601854] {CVE-2025-40094}
  - usb: gadget: f_ncm: Refactor bind path to use __free() (Kuen-Han Tsai) [Orabug: 38601837] {CVE-2025-40092}
  - usb: gadget: Introduce free_usb_request helper (Kuen-Han Tsai)
  - usb: gadget: Store endpoint pointer in usb_request (Kuen-Han Tsai)
  - arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() (Kaushlendra Kumar)
  - xfs: always warn about deprecated mount options (Darrick J. Wong)
  - devcoredump: Fix circular locking dependency with devcd->mutex. (Maarten Lankhorst)
  - PCI: tegra194: Reset BARs when running in PCIe endpoint mode (Niklas Cassel)
  - PCI: rcar-host: Drop PMSR spinlock (Marek Vasut)
  - PCI: rcar: Finish transition to L1 state in rcar_pcie_config_access() (Marek Vasut)
  - PCI: tegra194: Handle errors in BPMP response (Vidya Sagar)
  - f2fs: fix wrong block mapping for multi-devices (Jaegeuk Kim)
  - NFSD: Define a proc_layoutcommit for the FlexFiles layout type (Chuck Lever) [Orabug: 38601818] {CVE-2025-40087}
  - vfs: Don't leak disconnected dentries on umount (Jan Kara) [Orabug: 38601923] {CVE-2025-40105}
  - drm/amdgpu: use atomic functions with memory barriers for vm fault info (Gui-Dong Han)
  - PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock (Marek Vasut)
  - wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again (Muhammad Usama Anjum)
  - PCI: j721e: Fix programming sequence of "strap" settings (Siddharth Vadapalli)
  - PCI: j721e: Enable ACSPCIE Refclk if "ti,syscon-acspcie-proxy-ctrl" exists (Siddharth Vadapalli)
  - fuse: fix livelock in synchronous file put from fuseblk workers (Darrick J. Wong) [Orabug: 38730516] {CVE-2025-40220}
  - fuse: allocate ff->release_args only if release is needed (Amir Goldstein)
  - padata: Reset next CPU when reorder sequence wraps around (Xiao Liang)
  - iio: imu: inv_icm42600: Simplify pm_runtime setup (Sean Nyekjaer)
  - PM: runtime: Add new devm functions (Csókás Bence)
  - iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended (Sean Nyekjaer)
  - iio: imu: inv_icm42600: use = { } instead of memset() (David Lechner)
  - NFSD: Fix last write offset handling in layoutcommit (Sergey Bashirov)
  - NFSD: Minor cleanup in layoutcommit processing (Sergey Bashirov)
  - NFSD: Rework encoding and decoding of nfsd4_deviceid (Sergey Bashirov)
  - xfs: fix log CRC mismatches between i386 and other architectures (Christoph Hellwig)
  - xfs: rename the old_crc variable in xlog_recover_process (Christoph Hellwig)
  - s390/cio: Update purge function to unregister the unused subchannels (Vineeth Vijayan)
  - arm64: cputype: Add Neoverse-V3AE definitions (Mark Rutland)
  - serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018 (Florian Eckert)
  - most: usb: hdm_probe: Fix calling put_device() before device initialization (Victoria Votokina)
  - most: usb: Fix use-after-free in hdm_disconnect (Victoria Votokina)
  - mei: me: add wildcat lake P DID (Alexander Usyskin)
  - comedi: fix divide-by-zero in comedi_buf_munge() (Deepanshu Kartikey)
  - binder: remove "invalid inc weak" check (Alice Ryhl)
  - xhci: dbc: enable back DbC in resume if it was enabled before suspend (Mathias Nyman)
  - usb: raw-gadget: do not limit transfer length (Andrey Konovalov)
  - usb/core/quirks: Add Huawei ME906S to wakeup quirk (Tim Guttzeit)
  - USB: serial: option: add Telit FN920C04 ECM compositions (Li Qingwu)
  - USB: serial: option: add Quectel RG255C (Reinhard Speyerer)
  - USB: serial: option: add UNISOC UIS7720 (Renjun Wang)
  - net: ravb: Ensure memory write completes before ringing TX doorbell (Lad Prabhakar)
  - net: usb: rtl8150: Fix frame padding (Michał Pecio)
  - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [Orabug: 38730748] {CVE-2025-40231}
  - ocfs2: clear extent cache after moving/defragmenting extents (Deepanshu Kartikey) [Orabug: 38730546] {CVE-2025-40233}
  - MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering (Maciej W. Rozycki)
  - Revert "cpuidle: menu: Avoid discarding useful information" (Rafael J. Wysocki)
  - net: bonding: fix possible peer notify event loss or dup issue (Tonghao Zhang)
  - sctp: avoid NULL dereference when chunk data buffer is missing (Alexey Simakov) [Orabug: 38730566] {CVE-2025-40240}
  - arm64, mm: avoid always making PTE dirty in pte_mkwrite() (Huang, Ying)
  - dpaa2-eth: fix the pointer passed to PTR_ALIGN on Tx path (Ioana Ciornei)
  - net: enetc: correct the value of ENETC_RXB_TRUESIZE (Wei Fang)
  - rtnetlink: Allow deleting FDB entries in user namespace (Johannes Wiesboeck)
  - net: rtnetlink: add NLM_F_BULK support to rtnl_fdb_del (Nikolay Aleksandrov)
  - net: rtnetlink: add bulk delete support flag (Nikolay Aleksandrov)
  - net: netlink: add NLM_F_BULK delete request modifier (Nikolay Aleksandrov)
  - net: rtnetlink: use BIT for flag values (Nikolay Aleksandrov)
  - net: rtnetlink: add helper to extract msg type's kind (Nikolay Aleksandrov)
  - m68k: bitops: Fix find_*_bit() signatures (Geert Uytterhoeven)
  - hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super() (Yangtao Li)
  - hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits() (Viacheslav Dubeyko)
  - dlm: check for defined force value in dlm_lockspace_release (Alexander Aring)
  - hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat() (Viacheslav Dubeyko)
  - hfs: validate record offset in hfsplus_bmap_alloc (Yang Chenzhi)
  - hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent() (Viacheslav Dubeyko)
  - hfs: make proper initalization of struct hfs_find_data (Viacheslav Dubeyko)
  - hfs: clear offset and space out of valid records in b-tree node (Viacheslav Dubeyko)
  - nios2: ensure that memblock.current_limit is set when setting pfn limits (Simon Schuster)
  - exec: Fix incorrect type for ret (Xichao Zhao)
  - PCI/sysfs: Ensure devices are powered for config reads (part 2) (Brian Norris)
  - hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() (Viacheslav Dubeyko)
  - ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card (Jiaming Zhang) [Orabug: 38597093] {CVE-2025-40085}
  - ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings (Randy Dunlap)
  - sched/fair: Fix pelt lost idle time detection (Vincent Guittot)
  - sched/balancing: Rename newidle_balance() => sched_balance_newidle() (Ingo Molnar)
  - drm/amd/powerplay: Fix CIK shutdown temperature (Timur Kristóf)
  - net: usb: lan78xx: fix use of improperly initialized dev->chipid in lan78xx_reset (I Viswanath)
  - net: usb: lan78xx: Add error handling to lan78xx_init_mac_address (Oleksij Rempel)
  - net: usb: use eth_hw_addr_set() instead of ether_addr_copy() (Jakub Kicinski)
  - tls: don't rely on tx_work during send() (Sabrina Dubroca)
  - tls: always set record_type in tls_process_cmsg (Sabrina Dubroca)
  - tls: wait for async encrypt in case of error during latter iterations of sendmsg (Sabrina Dubroca)
  - net: tls: wait for async completion on last message (Sascha Hauer)
  - tg3: prevent use of uninitialized remote_adv and local_adv variables (Alexey Simakov)
  - tcp: fix tcp_tso_should_defer() vs large RTT (Eric Dumazet)
  - amd-xgbe: Avoid spurious link down messages during interface toggle (Raju Rangoju)
  - net/ip6_tunnel: Prevent perpetual tunnel growth (Dmitry Safonov) [Orabug: 38649259] {CVE-2025-40173}
  - r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H (Linmao Li)
  - doc: fix seg6_flowlabel path (Nicolas Dichtel)
  - net: dlink: handle dma_map_single() failure properly (Moon Yeounsu)
  - can: m_can: m_can_plat_remove(): add missing pm_runtime_disable() (Marc Kleine-Budde)
  - dax: skip read lock assertion for read-only filesystems (Yuezhang Mo)
  - HID: multitouch: fix sticky fingers (Benjamin Tissoires)
  - cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay (Rafael J. Wysocki)
  - crypto: rockchip - Fix dma_unmap_sg() nents value (Thomas Fourier)
  - drm/exynos: exynos7_drm_decon: remove ctx->suspended (Kaustabh Chakraborty)
  - drm/exynos: exynos7_drm_decon: properly clear channels during bind (Kaustabh Chakraborty)
  - drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions (Kaustabh Chakraborty)
  - blk-crypto: fix missing blktrace bio split events (Yu Kuai)
  - media: lirc: Fix error handling in lirc_register() (Ma Ke)
  - media: rc: Directly use ida_free() (Keliu)
  - media: s5p-mfc: remove an unused/uninitialized variable (Arnd Bergmann)
  - btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running (Filipe Manana)
  - ext4: detect invalid INLINE_DATA + EXTENTS flag combination (Deepanshu Kartikey) [Orabug: 38649222] {CVE-2025-40167}
  - jbd2: ensure that all ongoing I/O complete before freeing blocks (Zhang Yi)
  - r8152: add error handling in rtl8152_driver_init (Yi Cong)
  - LTS version: v5.15.195 (Vijayendra Suman)
  - selftests: mptcp: join: validate C-flag + def limit (Matthieu Baerts)
  - mptcp: pm: in-kernel: usable client side with C-flag (Matthieu Baerts)
  - media: pci: ivtv: Add check for DMA map result (Mikhail Kobuk) [Orabug: 38641260] {CVE-2024-43877}
  - xen/events: Update virq_to_irq on migration (Jason Andryuk)
  - media: pci: ivtv: Add missing check after DMA map (Thomas Fourier)
  - media: pci/ivtv: switch from 'pci_' to 'dma_' API (Christophe Jaillet)
  - arm64: mte: Do not flag the zero page as PG_mte_tagged (Catalin Marinas)
  - media: cx18: Add missing check after DMA map (Thomas Fourier)
  - media: switch from 'pci_' to 'dma_' API (Christophe Jaillet)
  - writeback: Avoid excessively long inode switching times (Jan Kara)
  - writeback: Avoid softlockup when switching many inodes (Jan Kara)
  - cramfs: Verify inode mode when loading from disk (Tetsuo Handa)
  - fs: Add 'initramfs_options' to set initramfs mount options (Lichen Liu)
  - pid: Add a judgment for ns null in pid_nr_ns (Gaoxiang17) [Orabug: 38649275] {CVE-2025-40178}
  - minixfs: Verify inode mode when loading from disk (Tetsuo Handa)
  - minmax.h: remove some #defines that are only expanded once (David Laight)
  - minmax.h: simplify the variants of clamp() (David Laight)
  - minmax.h: move all the clamp() definitions after the min/max() ones (David Laight)
  - minmax.h: use BUILD_BUG_ON_MSG() for the lo < hi test in clamp() (David Laight)
  - minmax.h: reduce the #define expansion of min(), max() and clamp() (David Laight)
  - minmax.h: update some comments (David Laight)
  - minmax.h: add whitespace around operators and after commas (David Laight)
  - minmax: fix up min3() and max3() too (Linus Torvalds)
  - minmax: improve macro expansion and type checking (Linus Torvalds)
  - minmax: simplify min()/max()/clamp() implementation (Linus Torvalds)
  - minmax: don't use max() in situations that want a C constant expression (Linus Torvalds)
  - minmax: make generic MIN() and MAX() macros available everywhere (Linus Torvalds)
  - minmax: simplify and clarify min_t()/max_t() implementation (Linus Torvalds)
  - minmax: add a few more MIN_T/MAX_T users (Linus Torvalds)
  - minmax: avoid overly complicated constant expressions in VM code (Linus Torvalds)
  - minmax: fix indentation of __cmp_once() and __clamp_once() (David Laight)
  - minmax: deduplicate __unconst_integer_typeof() (Andy Shevchenko)
  - minmax: Introduce {min,max}_array() (Herve Codina)
  - arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees (Stephan Gerhold)
  - btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() (Qu Wenruo)
  - fscontext: do not consume log entries when returning -EMSGSIZE (Aleksa Sarai)
  - dm: fix NULL pointer dereference in __dm_suspend() (Zheng Qixing) [Orabug: 38649056] {CVE-2025-40134}
  - tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (Yuan Chen) [Orabug: 38592032] {CVE-2025-40042}
  - ksmbd: fix error code overwriting in smb2_get_info_filesystem() (Matvey Kovalev)
  - net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock (Oleksij Rempel) [Orabug: 38649002] {CVE-2025-40120}
  - mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag (Hans de Goede)
  - mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type (Andy Shevchenko)
  - mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value (Hans de Goede)
  - media: mc: Clear minor number before put device (Edward Adam Davis) [Orabug: 38649397] {CVE-2025-40197}
  - Squashfs: reject negative file sizes in squashfs_read_inode() (Phillip Lougher) [Orabug: 38649424] {CVE-2025-40200}
  - Squashfs: add additional inode sanity checking (Phillip Lougher)
  - ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() (Ma Ke)
  - ASoC: codecs: wcd934x: Simplify with dev_err_probe (Krzysztof Kozlowski)
  - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Sean Christopherson) [Orabug: 38591958] {CVE-2025-40026}
  - lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older (Nathan Chancellor)
  - ext4: free orphan info with kvfree (Jan Kara)
  - ext4: guard against EA inode refcount underflow in xattr update (Ahmet Eray Karadag) [Orabug: 38649329] {CVE-2025-40190}
  - ext4: correctly handle queries for metadata mappings (Ojaswin Mujoo)
  - ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() (Yongjian Sun)
  - ext4: verify orphan file size is not too big (Jan Kara) [Orabug: 38649284] {CVE-2025-40179}
  - nfsd: nfserr_jukebox in nlm_fopen should lead to a retry (Olga Kornievskaia)
  - NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() (Thorsten Blum)
  - mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations (Thadeu Lima de Souza Cascardo)
  - x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases) (Sean Christopherson)
  - x86/umip: Check that the instruction opcode is at least two bytes (Sean Christopherson)
  - spi: cadence-quadspi: Flush posted register writes before DAC access (Pratyush Yadav)
  - spi: cadence-quadspi: Flush posted register writes before INDAC access (Pratyush Yadav)
  - PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() (Niklas Cassel)
  - PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit (Siddharth Vadapalli)
  - PCI/AER: Support errors introduced by PCIe r6.0 (Lukas Wunner)
  - PCI/AER: Fix missing uevent on recovery when a reset is requested (Niklas Schnelle)
  - PCI/ERR: Fix uevent on failure to recover (Lukas Wunner)
  - PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV (Niklas Schnelle) [Orabug: 38730511] {CVE-2025-40219}
  - PCI/sysfs: Ensure devices are powered for config reads (Brian Norris)
  - rseq/selftests: Use weak symbol reference, not definition, to link with glibc (Sean Christopherson)
  - rtc: interface: Fix long-standing race when setting alarm (Esben Haabendal)
  - rtc: interface: Ensure alarm irq is enabled when UIE is enabled (Esben Haabendal)
  - memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe (Zhen Ni)
  - mmc: core: SPI mode remove cmd7 (Rex Chen)
  - mtd: rawnand: fsmc: Default to autodetect buswidth (Linus Walleij)
  - sparc: fix error handling in scan_one_device() (Ma Ke)
  - sparc64: fix hugetlb for sun4u (Anthony Yznaga)
  - sctp: Fix MAC comparison to be constant-time (Eric Biggers) [Orabug: 38649450] {CVE-2025-40204}
  - scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() (Thorsten Blum)
  - pwm: berlin: Fix wrong register in suspend/resume (Jisheng Zhang)
  - powerpc/pseries/msi: Fix potential underflow and leak issue (Nam Cao)
  - powerpc/powernv/pci: Fix underflow and leak issue (Nam Cao)
  - nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk (Georg Gottleuber)
  - parisc: don't reference obsolete termio struct for TC* constants (Sam James)
  - openat2: don't trigger automounts with RESOLVE_NO_XDEV (Askar Safin)
  - lib/genalloc: fix device leak in of_gen_pool_get() (Johan Hovold)
  - KEYS: trusted_tpm1: Compare HMAC values in constant time (Eric Biggers)
  - iommu/vt-d: PRS isn't usable if PDS isn't supported (Lu Baolu)
  - iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume (Sean Nyekjaer)
  - init: handle bootloader identifier in kernel parameters (Huacai Chen)
  - iio: frequency: adf4350: Fix prescaler usage. (Michael Hennerich)
  - iio: dac: ad5421: use int type to store negative error codes (Rong Qianfeng)
  - iio: dac: ad5360: use int type to store negative error codes (Rong Qianfeng)
  - fs/ntfs3: Fix a resource leak bug in wnd_extend() (Haoxiang Li)
  - crypto: atmel - Fix dma_unmap_sg() direction (Thomas Fourier)
  - cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() (Rafael J. Wysocki) [Orabug: 38649365] {CVE-2025-40194}
  - copy_sighand: Handle architectures where sizeof(unsigned long) < sizeof(u64) (Simon Schuster)
  - bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() (Adam Xue)
  - btrfs: avoid potential out-of-bounds in btrfs_encode_fh() (Anderson Nascimento) [Orabug: 38649461] {CVE-2025-40205}
  - drm/nouveau: fix bad ret code in nouveau_bo_move_prep (Shuhao Fu)
  - media: i2c: mt9v111: fix incorrect type for ret (Rong Qianfeng)
  - firmware: meson_sm: fix device leak at probe (Johan Hovold)
  - xen/manage: Fix suspend error path (Lukas Wunner)
  - xen/events: Cleanup find_virq() return codes (Jason Andryuk)
  - ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init (Miaoqian Lin)
  - arm64: dts: qcom: msm8916: Add missing MDSS reset (Stephan Gerhold)
  - ACPI: debug: fix signedness issues in read/write helpers (Amir Mohammad Jahangirzad)
  - ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT (Daniel Tang)
  - bpf: Avoid RCU context warning when unpinning htab with internal structs (Kafai Wan)
  - gpio: wcd934x: mark the GPIO controller as sleeping (Bartosz Golaszewski)
  - gpio: wcd934x: Remove duplicate assignment of of_gpio_n_cells (Andy Shevchenko)
  - tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single (Gunnar Kudrjavets)
  - crypto: essiv - Check ssize for decryption and in-place encryption (Herbert Xu) [Orabug: 38581454,38705933] {CVE-2025-40019}
  - bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() (Eric Woudstra)
  - drm/amd/display: Properly disable scaling on DCE6 (Timur Kristóf)
  - drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 (Timur Kristóf)
  - drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs (Timur Kristóf)
  - drm/amdgpu: Add additional DCE6 SCL registers (Alex Deucher)
  - bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} (Daniel Borkmann) [Orabug: 38649299] {CVE-2025-40183}
  - mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes (Harini T)
  - mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call (Harini T)
  - tools build: Align warning options with perf (Leo Yan)
  - net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe (Erick Karanja)
  - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Kuniyuki Iwashima) [Orabug: 38649578] {CVE-2025-40186}
  - net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (Alexandr Sapozhnikov) [Orabug: 38649311] {CVE-2025-40187}
  - drm/vmwgfx: Fix Use-after-free in validation (Ian Forbes) [Orabug: 38643545] {CVE-2025-40111}
  - drm/vmwgfx: Copy DRM hash-table code into driver (Thomas Zimmermann)
  - s390/cio: unregister the subchannel while purging (Vineeth Vijayan)
  - net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() (Dan Carpenter)
  - scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (Duoming Zhou) [Orabug: 38557653] {CVE-2025-40001}
  - scsi: mvsas: Use sas_task_find_rq() for tagging (John Garry)
  - scsi: mvsas: Delete mvs_tag_init() (John Garry)
  - scsi: libsas: Add sas_task_find_rq() (John Garry)
  - cpufreq: tegra186: Set target frequency for all cpus in policy (Aaron Kling)
  - clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver (Alok Tiwari)
  - clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() (Brian Masney)
  - perf session: Fix handling when buffer exceeds 2 GiB (Leo Yan)
  - rtc: x1205: Fix Xicor X1205 vendor prefix (Rob Herring)
  - perf util: Fix compression checks returning -1 as bool (Yunseong Kim)
  - clk: at91: peripheral: fix return value (Brian Masney)
  - libperf event: Ensure tracing data is multiple of 8 sized (Ian Rogers)
  - perf evsel: Avoid container_of on a NULL leader (Ian Rogers)
  - iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE (Michael Hennerich)
  - clocksource/drivers/clps711x: Fix resource leaks in error paths (Zhen Ni)
  - fs: always return zero on success from replace_fd() (Thomas Weißschuh)
  - usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call (Miaoqian Lin)
  - bus: fsl-mc: Check return value of platform_get_resource() (Salah Triki)
  - pinctrl: check the return value of pinmux_ops::get_function_name() (Bartosz Golaszewski) [Orabug: 38591980] {CVE-2025-40030}
  - Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak (Zhen Ni) [Orabug: 38592000] {CVE-2025-40035}
  - Input: atmel_mxt_ts - allow reset GPIO to sleep (Marek Vasut)
  - nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() (Guangshuo Li)
  - mm: hugetlb: avoid soft lockup when mprotect to large memory area (Yang Shi) [Orabug: 38649149] {CVE-2025-40153}
  - ext4: fix checks for orphan inodes (Jan Kara)
  - mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() (Bartosz Golaszewski)
  - net: nfc: nci: Add parameter validation for packet data (Deepak Sharma)
  - fs: udf: fix OOB read in lengthAllocDescs handling (Larshin Sergey) [Orabug: 38592047] {CVE-2025-40044}
  - uio_hv_generic: Let userspace take care of interrupt mask (Naman Jain) [Orabug: 38592066] {CVE-2025-40048}
  - Squashfs: fix uninit-value in squashfs_get_parent (Phillip Lougher) [Orabug: 38592076] {CVE-2025-40049}
  - net: dlink: handle copy_thresh allocation failure (Moon Yeounsu) [Orabug: 38592097] {CVE-2025-40053}
  - net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable (Kohei Enju)
  - nfp: fix RSS hash key size when RSS is not supported (Kohei Enju)
  - drivers/base/node: fix double free in register_one_node() (Donet Tom)
  - ocfs2: fix double free in user_cluster_connect() (Dan Carpenter) [Orabug: 38592109] {CVE-2025-40055}
  - hwrng: ks-sa - fix division by zero in ks_sa_rng_init (Nishanth Menon)
  - Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO (Luiz Augusto von Dentz)
  - net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast (I Viswanath) [Orabug: 38649095] {CVE-2025-40140}
  - RDMA/siw: Always report immediate post SQ errors (Bernard Metzler)
  - usb: vhci-hcd: Prevent suspending virtually attached devices (Cristian Ciocaltea)
  - scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() (Ranjan Kumar) [Orabug: 38648980] {CVE-2025-40115}
  - ipvs: Defer ip_vs_ftp unregister during netns cleanup (Slavin Liu) [Orabug: 38581444] {CVE-2025-40018}
  - NFSv4.1: fix backchannel max_resp_sz verification check (Anthony Iliopoulos)
  - coresight: trbe: Return NULL pointer for allocation failures (Leo Yan)
  - remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice (Stephan Gerhold)
  - sparc: fix accurate exception reporting in copy_{from,to}_user for M7 (Michael Karcher)
  - sparc: fix accurate exception reporting in copy_to_user for Niagara 4 (Michael Karcher)
  - sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara (Michael Karcher)
  - sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III (Michael Karcher)
  - sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC (Michael Karcher)
  - wifi: ath10k: avoid unnecessary wait for service ready message (Baochen Qiang)
  - Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram (Bagas Sanjaya)
  - IB/sa: Fix sa_local_svc_timeout_ms read race (Vlad Dumitrescu)
  - RDMA/core: Resolve MAC of next-hop device without ARP support (Parav Pandit)
  - Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running" (Michał Pecio)
  - scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() (Rong Qianfeng)
  - scsi: qla2xxx: edif: Fix incorrect sign of error code (Rong Qianfeng)
  - ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message (Colin Ian King)
  - wifi: mt76: fix potential memory leak in mt76_wmac_probe() (Abdun Nihaal)
  - RDMA/cm: Rate limit destroy CM ID timeout error message (Håkon Bugge)
  - drivers/base/node: handle error properly in register_one_node() (Donet Tom)
  - watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog (Christophe Leroy)
  - netfilter: ipset: Remove unused htable_bits in macro ahash_region (Zhen Ni)
  - iio: consumers: Fix offset handling in iio_convert_raw_to_processed() (Hans de Goede)
  - fs: ntfs3: Fix integer overflow in run_unpack() (Vitaly Grigoryev)
  - ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping (Takashi Iwai) [Orabug: 38649006] {CVE-2025-40121}
  - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (Takashi Iwai) [Orabug: 38649156] {CVE-2025-40154}
  - ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping (Takashi Iwai)
  - pps: fix warning in pps_register_cdev when register device fail (Wang Liang) [Orabug: 38592169] {CVE-2025-40070}
  - misc: genwqe: Fix incorrect cmd field being reported in error (Colin Ian King)
  - usb: gadget: configfs: Correctly set use_os_string at bind (William Wu)
  - usb: phy: twl6030: Fix incorrect type for ret (Xichao Zhao)
  - drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() (Rong Qianfeng)
  - tcp: fix __tcp_close() to only send RST when required (Eric Dumazet)
  - PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation (Alok Tiwari)
  - wifi: mwifiex: send world regulatory domain to driver (Stefan Kerkmann)
  - drm/amdgpu: Power up UVD 3 for FW validation (v2) (Timur Kristóf)
  - ALSA: lx_core: use int type to store negative error codes (Rong Qianfeng)
  - media: rj54n1cb0c: Fix memleak in rj54n1_probe() (Zhang Shurong)
  - scsi: myrs: Fix dma_alloc_coherent() error check (Thomas Fourier)
  - scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod (Niklas Cassel) [Orabug: 38649566] {CVE-2025-40118}
  - usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup (Dan Carpenter)
  - drm/radeon/r600_cs: clean up of dead code in r600_cs (Brahmajit Das)
  - i2c: designware: Add disabling clocks when probe fails (Kunihiko Hayashi)
  - i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD (Leilk Liu)
  - thermal/drivers/qcom/lmh: Add missing IRQ includes (Dmitry Baryshkov)
  - thermal/drivers/qcom: Make LMH select QCOM_SCM (Dmitry Baryshkov)
  - tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers (Zhouyi Zhou)
  - smp: Fix up and expand the smp_call_function_many() kerneldoc (Rafael J. Wysocki)
  - bpf: Explicitly check accesses to bpf_sock_addr (Paul Chaignon) [Orabug: 38592204] {CVE-2025-40078}
  - selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported (Akhilesh Patil)
  - i3c: master: svc: Recycle unused IBI slot (Stanley Chu)
  - nvmet-fc: move lsop put work to nvmet_fc_ls_req_op (Daniel Wagner) [Orabug: 38649248] {CVE-2025-40171}
  - pwm: tiehrpwm: Fix corner case in clock divisor calculation (Uwe Kleine-König)
  - arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible (AngeloGioacchino Del Regno)
  - firmware: firmware: meson-sm: fix compile-test default (Johan Hovold)
  - pinctrl: renesas: Use int type to store negative error codes (Rong Qianfeng)
  - PM: sleep: core: Clear power.must_resume in noirq suspend error path (Rafael J. Wysocki)
  - block: use int to store blk_stack_limits() return value (Rong Qianfeng)
  - regulator: scmi: Use int type to store negative error codes (Rong Qianfeng)
  - ARM: at91: pm: fix MCKx restore routine (Nicolas Ferre)
  - blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx (Li Nan) [Orabug: 38649025] {CVE-2025-40125}
  - pinctrl: meson-gxl: add missing i2c_d pinmux (Da Xue)
  - soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS (Sneh Mankad)
  - ACPI: processor: idle: Fix memory leak when register cpuidle device failed (Huisong Li)
  - cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus() (Florian Fainelli)
  - libbpf: Fix reuse of DEVMAP (Yureka Lilian)
  - regmap: Remove superfluous check for !config in __regmap_init() (Geert Uytterhoeven)
  - x86/vdso: Fix output operand size of RDPID (Uros Bizjak)
  - perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (Leo Yan) [Orabug: 38592220] {CVE-2025-40081}
  - coresight: trbe: Prevent overflow in PERF_IDX2OFF() (Leo Yan)
  - selftests: arm64: Check fread return value in exec_target (Bala-Vignesh-Reddy)
  - filelock: add FL_RECLAIM to show_fl_flags() macro (Jeff Layton)
  - net/9p: fix double req put in p9_fd_cancelled (Nalivayko Sergey) [Orabug: 38591964] {CVE-2025-40027}
  - minmax: add in_range() macro (Matthew Wilcox)
  - crypto: rng - Ensure set_ent is always present (Herbert Xu) [Orabug: 38643530] {CVE-2025-40109}
  - platform/x86: int3472: Check for adev == NULL (Hans de Goede)
  - driver core/PM: Set power.no_callbacks along with power.no_pm (Rafael J. Wysocki)
  - staging: axis-fifo: flush RX FIFO on read errors (Ovidiu Panait)
  - staging: axis-fifo: fix maximum TX packet length check (Ovidiu Panait)
  - serial: stm32: allow selecting console when the driver is module (Raphaël Gallais-Pou)
  - hid: fix I2C read buffer overflow in raw_event() for mcp2221 (Arnaud Lecomte)
  - perf subcmd: avoid crash in exclude_cmds when excludes is empty (Hupu)
  - dm-integrity: limit MAX_TAG_SIZE to 255 (Mikulas Patocka)
  - wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
  - USB: serial: option: add SIMCom 8230C compositions (Xiaowei Li)
  - media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe (Duoming Zhou)
  - media: tuner: xc5000: Fix use-after-free in xc5000_release (Duoming Zhou) [Orabug: 38548036] {CVE-2025-39994}
  - media: tunner: xc5000: Refactor firmware load (Ricardo Ribalda)
  - udp: Fix memory accounting leak. (Kuniyuki Iwashima) [Orabug: 37844324] {CVE-2025-22058}
  - KVM: arm64: Fix softirq masking in FPSIMD register saving sequence (Will Deacon) [Orabug: 38513233]
  - media: rc: fix races with imon_disconnect() (Larshin Sergey) [Orabug: 38548026] {CVE-2025-39993}
  - media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove (Duoming Zhou) [Orabug: 38548050] {CVE-2025-39996}
  - scsi: target: target_core_configfs: Add length check to avoid buffer overflow (Wang Haoran) [Orabug: 38548058] {CVE-2025-39998}
  - LTS version: v5.15.194 (Vijayendra Suman)
  - drm/i915/backlight: Return immediately when scale() finds invalid parameters (Guenter Roeck)
  - i40e: add validation for ring_len param (Lukasz Czapnik) [Orabug: 38547951,38603025,38607608] {CVE-2025-39973}
  - i40e: increase max descriptors for XL710 (Justin Bronder)
  - i40e: fix idx validation in config queues msg (Lukasz Czapnik) [Orabug: 38547937] {CVE-2025-39971}
  - i40e: fix validation of VF state in get resources (Lukasz Czapnik) [Orabug: 38547928] {CVE-2025-39969}
  - mm/hugetlb: fix folio is still mapped when deleted (Tu Jinjiang) [Orabug: 38560480] {CVE-2025-40006}
  - mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize() (David Hildenbrand)
  - fbcon: Fix OOB access in font allocation (Thomas Zimmermann)
  - fbcon: fix integer overflow in fbcon_do_set_font (Samasth Norway Ananda) [Orabug: 38547912] {CVE-2025-39967}
  - tracing: dynevent: Add a missing lockdown check on dynevent (Masami Hiramatsu) [Orabug: 38581470] {CVE-2025-40021}
  - i40e: add mask to apply valid bits for itr_idx (Lukasz Czapnik)
  - i40e: add max boundary check for VF filters (Lukasz Czapnik) [Orabug: 38547922] {CVE-2025-39968}
  - i40e: fix input validation logic for action_meta (Lukasz Czapnik) [Orabug: 38547932] {CVE-2025-39970}
  - i40e: fix idx validation in i40e_validate_queue_map (Lukasz Czapnik) [Orabug: 38547945] {CVE-2025-39972}
  - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (Eric Biggers) [Orabug: 38641289] {CVE-2025-40022}
  - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (Herbert Xu) [Orabug: 38537468,38575792,38575804] {CVE-2025-39964}
  - drm/gma500: Fix null dereference in hdmi teardown (Zabelin Nikita) [Orabug: 38560495] {CVE-2025-40011}
  - net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port (Vladimir Oltean)
  - net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() (Vladimir Oltean)
  - net: dsa: lantiq_gswip: do also enable or disable cpu port (Martin Schiller)
  - selftests: fib_nexthops: Fix creation of non-FDB nexthops (Ido Schimmel)
  - nexthop: Forbid FDB status change while nexthop is in a group (Ido Schimmel) [Orabug: 38547971] {CVE-2025-39980}
  - bnxt_en: correct offset handling for IPv6 destination address (Alok Tiwari)
  - ethernet: rvu-af: Remove slash from the driver name (Petr Malat)
  - can: peak_usb: fix shift-out-of-bounds issue (Stephane Grosjean) [Orabug: 38581461] {CVE-2025-40020}
  - can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
  - can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
  - can: hi311x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
  - can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
  - can: etas_es58x: sort the includes by alphabetic order (Vincent Mailhol)
  - can: etas_es58x: advertise timestamping capabilities and add ioctl support (Vincent Mailhol)
  - can: dev: add generic function can_eth_ioctl_hwts() (Vincent Mailhol)
  - can: dev: add generic function can_ethtool_op_get_ts_info_hwts() (Vincent Mailhol)
  - can: bittiming: replace CAN units with the generic ones from linux/units.h (Vincent Mailhol)
  - can: bittiming: allow TDC{V,O} to be zero and add can_tdc_const::tdc{v,o,f}_min (Vincent Mailhol)
  - bpf: Reject bpf_timer for PREEMPT_RT (Leon Hwang)
  - can: rcar_can: rcar_can_resume(): fix s2ram with PSCI (Geert Uytterhoeven)
  - arm64: dts: imx8mp: Correct thermal sensor index (Peng Fan)
  - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Or Har-Toov)
  - usb: core: Add 0x prefix to quirks debug output (Jiayi Li)
  - ALSA: usb-audio: Fix build with CONFIG_INPUT=n (Takashi Iwai)
  - ALSA: usb-audio: Convert comma to semicolon (Chen Ni)
  - ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 (Cristian Ciocaltea)
  - ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks (Cristian Ciocaltea)
  - ALSA: usb-audio: Simplify NULL comparison in mixer_quirks (Cristian Ciocaltea)
  - ALSA: usb-audio: Avoid multiple assignments in mixer_quirks (Cristian Ciocaltea)
  - ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks (Cristian Ciocaltea)
  - ALSA: usb-audio: Fix block comments in mixer_quirks (Cristian Ciocaltea)
  - net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer (Hans de Goede)
  - net: rfkill: gpio: add DT support (Philipp Zabel)
  - mptcp: propagate shutdown to subflows when possible (Matthieu Baerts)
  - ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer (Namjae Jeon)
  - mptcp: set remote_deny_join_id0 on SYN recv (Matthieu Baerts)
  - phy: ti: omap-usb2: fix device leak at unbind (Johan Hovold)
  - phy: Use device_get_match_data() (Rob Herring)
  - phy: broadcom: ns-usb3: fix Wvoid-pointer-to-enum-cast warning (Krzysztof Kozlowski)
  - USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels (Alan Stern)
  - usb: gadget: dummy_hcd: remove usage of list iterator past the loop body (Jakob Koschel)
  - xhci: dbc: Fix full DbC transfer ring after several reconnects (Mathias Nyman)
  - xhci: dbc: decouple endpoint allocation from initialization (Mathias Nyman)
  - serial: sc16is7xx: fix bug in flow control levels init (Hugo Villeneuve)
  - drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path (Qi Xi)
  - drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ (Loic Poulain)
  - ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message (Colin Ian King)
  - ASoC: wm8974: Correct PLL rate rounding (Charles Keepax)
  - ASoC: wm8940: Correct typo in control name (Charles Keepax)
  - mmc: mvsdio: Fix dma_unmap_sg() nents value (Thomas Fourier)
  - btrfs: tree-checker: fix the incorrect inode ref size check (Qu Wenruo)
  - power: supply: bq27xxx: restrict no-battery detection to bq27000 (H. Nikolaus Schaller)
  - power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery (H. Nikolaus Schaller)
  - nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* (Nathan Chancellor)
  - cnic: Fix use-after-free bugs in cnic_delete_task (Duoming Zhou) [Orabug: 38503848] {CVE-2025-39945}
  - net: liquidio: fix overflow in octeon_init_instr_queue() (Alexey Nepomnyashih)
  - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). (Kuniyuki Iwashima) [Orabug: 38526387] {CVE-2025-39955}
  - i40e: remove redundant memory barrier when cleaning Tx descs (Maciej Fijalkowski)
  - net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure (Moon Yeounsu)
  - qed: Don't collect too many protection override GRC elements (Jamie Bainbridge) [Orabug: 38503869] {CVE-2025-39949}
  - dpaa2-switch: fix buffer pool seeding for control traffic (Ioana Ciornei)
  - um: virtio_uml: Fix use-after-free after put_device in probe (Miaoqian Lin)
  - cgroup: split cgroup_destroy_wq into 3 workqueues (Chen Ridong) [Orabug: 38503891] {CVE-2025-39953}
  - pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch (Geert Uytterhoeven)
  - wifi: mac80211: fix incorrect type for ret (Liao Yuanhong)
  - ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported (Takashi Sakamoto)
  - net: hsr: hsr_slave: Fix the promiscuous mode in offload mode (Ravi Gunasekaran)
  - mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Miaohe Lin) [Orabug: 38461847] {CVE-2025-39883}
  - drm/i915/power: fix size for for_each_set_bit() in abox iteration (Jani Nikula)
  - phy: ti-pipe3: fix device leak at unbind (Johan Hovold)
  - phy: tegra: xusb: fix device and OF node leak at probe (Johan Hovold)
  - dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees (Stephan Gerhold) [Orabug: 38494821] {CVE-2025-39923}
  - regulator: sy7636a: fix lifecycle of power good gpio (Andreas Kemnade)
  - dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (Anders Roxell)
  - hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr (Hangbin Liu)
  - hsr: use rtnl lock when iterating over ports (Hangbin Liu)
  - net: hsr: Add VLAN CTAG filter support (Murali Karicheri)
  - net: hsr: Add support for MC filtering at the slave device (Murali Karicheri)
  - net: hsr: Disable promiscuous mode in offload mode (Ravi Gunasekaran)
  - can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB (Anssi Hannula)
  - can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails (Tetsuo Handa)
  - can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed (Tetsuo Handa)
  - i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path (Michal Schmidt) [Orabug: 38494786] {CVE-2025-39911}
  - i40e: Use irq_update_affinity_hint() (Nitesh Narayan Lal)
  - igb: fix link test skipping when interface is admin down (Kohei Enju)
  - tunnels: reset the GSO metadata before reusing the skb (Antoine Tenart)
  - net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() (Stefan Wahren)
  - USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
  - USB: serial: option: add Telit Cinterion FN990A w/audio compositions (Fabio Porcedda)
  - dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks (Krzysztof Kozlowski)
  - tty: hvc_console: Call hvc_kick in hvc_write unconditionally (Fabian Vogt)
  - Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table (Christoffer Sandberg)
  - mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer (Christophe Kerello)
  - mtd: rawnand: stm32_fmc2: Fix dma_map_sg error check (Jack Wang)
  - mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing (Alexander Sverdlin)
  - mtd: nand: raw: atmel: Fix comment in timings preparation (Alexander Dahl)
  - mm/khugepaged: fix the address passed to notifier on testing young (Wei Yang)
  - libceph: fix invalid accesses to ceph_connection_v1_info (Ilya Dryomov) [Orabug: 38461836] {CVE-2025-39880}
  - fuse: prevent overflow in copy_file_range return value (Miklos Szeredi)
  - fuse: check if copy_file_range() returns larger than requested size (Miklos Szeredi)
  - mtd: rawnand: stm32_fmc2: fix ECC overwrite (Christophe Kerello)
  - ocfs2: fix recursive semaphore deadlock in fiemap call (Mark Tinguely) [Orabug: 38461858] {CVE-2025-39885}
  - mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN (Krister Johansen)
  - compiler-clang.h: define __SANITIZE_*__ macros only when undefined (Nathan Chancellor)
  - EDAC/altera: Delete an inappropriate dma_free_coherent() call (Salah Triki)
  - tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. (Kuniyuki Iwashima) [Orabug: 38494796] {CVE-2025-39913}
  - NFSv4/flexfiles: Fix layout merge mirror check. (Jonathan Curley)
  - tracing: Fix tracing_marker may trigger page fault during preempt_disable (Luo Gengkun)
  - NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server (Trond Myklebust)
  - NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set (Trond Myklebust)
  - mm/rmap: reject hugetlb folios in folio_make_device_exclusive() (David Hildenbrand)
  - net: Fix null-ptr-deref by sock_lock_init_class_and_name() and rmmod. (Kuniyuki Iwashima) [Orabug: 37901603] {CVE-2025-23143}
  - media: i2c: imx214: Fix link frequency validation (André Apitzsch)
  - media: mtk-vcodec: venc: avoid -Wenum-compare-conditional warning (Arnd Bergmann)
  - mm: introduce and use {pgd,p4d}_populate_kernel() (Harry Yoo)
  - kunit: kasan_test: disable fortify string checker on kasan_strings() test (Levi Yun)
  - xfs: short circuit xfs_growfs_data_private() if delta is zero (Eric Sandeen)
  - Revert "fbdev: Disable sysfb device registration when removing conflicting FBs" (Brett A C Sheffield)


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-316.196.1.el9uek]
changelog:
  - uek-rpm: kabi: Remove the kabi protection for debug kernels (Yifei Liu) [Orabug: 38609547]
  - bnxt_en: Fix memory corruption when FW resources change during ifdown (Sreekanth Reddy) [Orabug: 38440240] {CVE-2025-39810}
  - selftests/proc: add PROCMAP_QUERY ioctl tests (Andrii Nakryiko) [Orabug: 38410775]
  - tools: sync uapi/linux/fs.h header into tools subdir (Andrii Nakryiko) [Orabug: 38410775]
  - docs/procfs: call out ioctl()-based PROCMAP_QUERY command existence (Andrii Nakryiko) [Orabug: 38410775]
  - fs/procfs: add build ID fetching to PROCMAP_QUERY API (Andrii Nakryiko) [Orabug: 38410775]
  - fs/procfs: implement efficient VMA querying API for /proc/<pid>/maps (Andrii Nakryiko) [Orabug: 38410775]
  - fs/procfs: extract logic for getting VMA name constituents (Andrii Nakryiko) [Orabug: 38410775]
  - fs: create helper file_user_path() for user displayed mapped file path (Amir Goldstein) [Orabug: 38410775]
  - mm: factor out VMA stack and heap checks (Kefeng Wang) [Orabug: 38410775]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-316.196.2.el9uek]
changelog:
  - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Pradyumn Rahar) [Orabug: 37961220,38730620] {CVE-2025-40250}


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-316.196.3.el9uek]
changelog:
  - rds: Add smp_rmb before reading c_destroy_in_prog (Håkon Bugge) [Orabug: 38352484]
  - Revert "block: don't add or resize partition on the disk with GENHD_FL_NO_PART" (Gulam Mohamed) [Orabug: 38652797]
  - Revert "block: Move checking GENHD_FL_NO_PART to bdev_add_partition()" (Gulam Mohamed) [Orabug: 38652797]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-316.196.4.el9uek]
changelog:
  - vhost_scsi: Sync up cmd completion locking with upstream (Mike Christie)  [Orabug: 38545946]
  - vhost_scsi: add support for worker ioctls (Mike Christie)  [Orabug: 38545946]
  - vhost: Limit access to vhost worker ioctls (Mike Christie)  [Orabug: 38545946]
  - vhost: allow userspace to create workers (Mike Christie)  [Orabug: 38545946]
  - vhost: replace single worker pointer with xarray (Mike Christie)  [Orabug: 38545946]
  - vhost: add helper to parse userspace vring state/file (Mike Christie)  [Orabug: 38545946]
  - vhost: remove vhost_work_queue (Mike Christie)  [Orabug: 38545946]
  - vhost_scsi: flush IO vqs then send TMF rsp (Mike Christie)  [Orabug: 38545946]
  - vhost_scsi: convert to vhost_vq_work_queue (Mike Christie)  [Orabug: 38545946]
  - vhost_scsi: make SCSI cmd completion per vq (Mike Christie)  [Orabug: 38545946]
  - vhost_sock: convert to vhost_vq_work_queue (Mike Christie)  [Orabug: 38545946]
  - vhost: convert poll work to be vq based (Mike Christie)  [Orabug: 38545946]
  - vhost: take worker or vq for flushing (Mike Christie)  [Orabug: 38545946]
  - vhost: take worker or vq instead of dev for queueing (Mike Christie)  [Orabug: 38545946]
  - vhost, vhost_net: add helper to check if vq has work (Mike Christie)  [Orabug: 38545946]
  - vhost: add vhost_worker pointer to vhost_virtqueue (Mike Christie)  [Orabug: 38545946]
  - vhost: dynamically allocate vhost_worker (Mike Christie)  [Orabug: 38545946]
  - vhost: create worker at end of vhost_dev_set_owner (Mike Christie)  [Orabug: 38545946]
  - vhost-scsi: Fix crash during LUN unmapping (Mike Christie)  [Orabug: 38545946]
  - vhost: move worker thread fields to new struct (Mike Christie)  [Orabug: 38545946]
  - vhost: Fix livepatch timeouts in vhost_worker() (Josh Poimboeuf)  [Orabug: 38545946]
  - vhost: rename vhost_work_dev_flush (Mike Christie)  [Orabug: 38545946]
  - vhost-test: drop flush after vhost_dev_cleanup (Mike Christie)  [Orabug: 38545946]
  - vhost/test: fix memory leak of vhost virtqueues (Xianting Tian)  [Orabug: 38545946]
  - vhost-scsi: drop flush after vhost_dev_cleanup (Mike Christie)  [Orabug: 38545946]
  - vhost_vsock: simplify vhost_vsock_flush() (Andrey Ryabinin)  [Orabug: 38545946]
  - vhost_test: remove vhost_test_flush_vq() (Andrey Ryabinin)  [Orabug: 38545946]
  - vhost_net: get rid of vhost_net_flush_vq() and extra flush calls (Andrey Ryabinin)  [Orabug: 38545946]
  - vhost: flush dev once during vhost_dev_stop (Mike Christie)  [Orabug: 38545946]
  - vhost: get rid of vhost_poll_flush() wrapper (Andrey Ryabinin)  [Orabug: 38545946]
  - net/mlx5e: Add a miss level for ipsec crypto offload (Lama Kayal)  [Orabug: 38600056]
  - net/mlx5e: Add new prio for promiscuous mode (Jianbo Liu)  [Orabug: 38600056]
  - mm/hugetlb: add option to allows disabling CVE-2025-38085 mitigation (Joe Jin)  [Orabug: 38728358]
  - uek-rpm: Replace check-kabi tool with kabi (Yifei Liu)  [Orabug: 38673381]
  - uek-rpm: Introduce check function for uek-rpm/tools/kabi (Yifei Liu)  [Orabug: 38673381]
  - rtc: expose RTC_FEATURE_UPDATE_INTERRUPT (Alexandre Belloni)  [Orabug: 38708842]
  - Reapply "cpuidle: menu: Avoid discarding useful information" (Harshvardhan Jha)  [Orabug: 38710346]
  - netfilter: nf_tables: reject duplicate device on updates (Pablo Neira Ayuso)  [Orabug: 38389767]  {CVE-2025-38678}
  - HID: quirks: work around VID/PID conflict for 0x4c4a/0x4155 (Zhang Heng)
  - mptcp: pm: in-kernel: C-flag: handle late ADD_ADDR (Matthieu Baerts (NGI0))
  - USB: storage: Remove subclass and protocol overrides from Novatek quirk (Alan Stern)
  - most: usb: fix double free on late probe failure (Johan Hovold)
  - uio_hv_generic: Set event for all channels on the device (Long Li)
  - regmap: slimbus: fix bus_context pointer in regmap init calls (Alexey Klimov)
  - usb: typec: ucsi: psy: Set max current to zero when disconnected (Jameson Thies)
  - ata: libata-scsi: Fix system suspend for a security locked drive (Niklas Cassel)
  - MIPS: mm: Prevent a TLB shutdown on initial uniquification (Maciej W. Rozycki)


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-316.196.4.1.el9uek]
changelog:
  - tipc: Fix use-after-free in tipc_mon_reinit_self(). (Kuniyuki Iwashima)  [Orabug: 38788585]  {CVE-2025-40280} 
  - fs/proc: fix uaf in proc_readdir_de() (Wei Yang)  [Orabug: 38788587]  {CVE-2025-40271} 
  - vsock: Ignore signal/timeout on connect() if already established (Michal Luczaj)  [Orabug: 38788594]  {CVE-2025-40248}


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-316.196.4.1.el9uek]
changelog:
  - tipc: Fix use-after-free in tipc_mon_reinit_self(). (Kuniyuki Iwashima)  [Orabug: 38788585]  {CVE-2025-40280}
  - fs/proc: fix uaf in proc_readdir_de() (Wei Yang)  [Orabug: 38788587]  {CVE-2025-40271}
  - vsock: Ignore signal/timeout on connect() if already established (Michal Luczaj)  [Orabug: 38788594]  {CVE-2025-40248}


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-316.196.4.2.el9uek]
changelog:
  - xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added (Sabrina Dubroca)   
  - usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE (Gopi Krishna Menon)   
  - ext4: clear i_state_flags when alloc inode (Haibo Chen)   
  - ext4: align max orphan file size with e2fsprogs limit (Baokun Li)   
  - PM: runtime: Do not clear needs_force_resume with enabled runtime PM (Rafael J. Wysocki)   
  - net: enetc: fix build warning when PAGE_SIZE is greater than 128K (Wei Fang)   
  - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Xiang Mei)   
  - block: fix comment for op_is_zone_mgmt() to include RESET_ALL (shechenglong)   
  - fuse: fix readahead reclaim deadlock (Joanne Koong)   
  - i40e: validate ring_len parameter against hardware-specific values (Gregory Herrero)   
  - fs/ntfs3: fix mount failure for sparse runs in run_unpack() (Konstantin Komarov)   
  - xfrm: delete x->tunnel as we delete x (Sabrina Dubroca)  [Orabug: 38933003]  {CVE-2025-40215} 
  - mptcp: fix race condition in mptcp_schedule_work() (Eric Dumazet)  [Orabug: 38932997]  {CVE-2025-40258} 
  - mlx5: Fix default values in create CQ (Akiva Goldberger)  [Orabug: 38932992]  
  - sunrpc: fix handling of server side tls alerts (Olga Kornievskaia)  [Orabug: 38932991]  {CVE-2025-38566} 
  - sunrpc: fix client side handling of tls alerts (Olga Kornievskaia)  [Orabug: 38932988]  {CVE-2025-38571}


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-316.196.4.el9uek]
changelog:
  - vhost_scsi: Sync up cmd completion locking with upstream (Mike Christie) [Orabug: 38545946]
  - vhost_scsi: add support for worker ioctls (Mike Christie) [Orabug: 38545946]
  - vhost: Limit access to vhost worker ioctls (Mike Christie) [Orabug: 38545946]
  - vhost: allow userspace to create workers (Mike Christie) [Orabug: 38545946]
  - vhost: replace single worker pointer with xarray (Mike Christie) [Orabug: 38545946]
  - vhost: add helper to parse userspace vring state/file (Mike Christie) [Orabug: 38545946]
  - vhost: remove vhost_work_queue (Mike Christie) [Orabug: 38545946]
  - vhost_scsi: flush IO vqs then send TMF rsp (Mike Christie) [Orabug: 38545946]
  - vhost_scsi: convert to vhost_vq_work_queue (Mike Christie) [Orabug: 38545946]
  - vhost_scsi: make SCSI cmd completion per vq (Mike Christie) [Orabug: 38545946]
  - vhost_sock: convert to vhost_vq_work_queue (Mike Christie) [Orabug: 38545946]
  - vhost: convert poll work to be vq based (Mike Christie) [Orabug: 38545946]
  - vhost: take worker or vq for flushing (Mike Christie) [Orabug: 38545946]
  - vhost: take worker or vq instead of dev for queueing (Mike Christie) [Orabug: 38545946]
  - vhost, vhost_net: add helper to check if vq has work (Mike Christie) [Orabug: 38545946]
  - vhost: add vhost_worker pointer to vhost_virtqueue (Mike Christie) [Orabug: 38545946]
  - vhost: dynamically allocate vhost_worker (Mike Christie) [Orabug: 38545946]
  - vhost: create worker at end of vhost_dev_set_owner (Mike Christie) [Orabug: 38545946]
  - vhost-scsi: Fix crash during LUN unmapping (Mike Christie) [Orabug: 38545946]
  - vhost: move worker thread fields to new struct (Mike Christie) [Orabug: 38545946]
  - vhost: Fix livepatch timeouts in vhost_worker() (Josh Poimboeuf) [Orabug: 38545946]
  - vhost: rename vhost_work_dev_flush (Mike Christie) [Orabug: 38545946]
  - vhost-test: drop flush after vhost_dev_cleanup (Mike Christie) [Orabug: 38545946]
  - vhost/test: fix memory leak of vhost virtqueues (Xianting Tian) [Orabug: 38545946]
  - vhost-scsi: drop flush after vhost_dev_cleanup (Mike Christie) [Orabug: 38545946]
  - vhost_vsock: simplify vhost_vsock_flush() (Andrey Ryabinin) [Orabug: 38545946]
  - vhost_test: remove vhost_test_flush_vq() (Andrey Ryabinin) [Orabug: 38545946]
  - vhost_net: get rid of vhost_net_flush_vq() and extra flush calls (Andrey Ryabinin) [Orabug: 38545946]
  - vhost: flush dev once during vhost_dev_stop (Mike Christie) [Orabug: 38545946]
  - vhost: get rid of vhost_poll_flush() wrapper (Andrey Ryabinin) [Orabug: 38545946]
  - net/mlx5e: Add a miss level for ipsec crypto offload (Lama Kayal) [Orabug: 38600056]
  - net/mlx5e: Add new prio for promiscuous mode (Jianbo Liu) [Orabug: 38600056]
  - mm/hugetlb: add option to allows disabling CVE-2025-38085 mitigation (Joe Jin) [Orabug: 38728358] {CVE-2025-38085}
  - uek-rpm: Replace check-kabi tool with kabi (Yifei Liu) [Orabug: 38673381]
  - uek-rpm: Introduce check function for uek-rpm/tools/kabi (Yifei Liu) [Orabug: 38673381]
  - rtc: expose RTC_FEATURE_UPDATE_INTERRUPT (Alexandre Belloni) [Orabug: 38708842]
  - Reapply "cpuidle: menu: Avoid discarding useful information" (Harshvardhan Jha) [Orabug: 38710346]
  - netfilter: nf_tables: reject duplicate device on updates (Pablo Neira Ayuso) [Orabug: 38389767,38744086] {CVE-2025-38678}
  - HID: quirks: work around VID/PID conflict for 0x4c4a/0x4155 (Zhang Heng)
  - mptcp: pm: in-kernel: C-flag: handle late ADD_ADDR (Matthieu Baerts)
  - USB: storage: Remove subclass and protocol overrides from Novatek quirk (Alan Stern)
  - most: usb: fix double free on late probe failure (Johan Hovold)
  - uio_hv_generic: Set event for all channels on the device (Long Li)
  - regmap: slimbus: fix bus_context pointer in regmap init calls (Alexey Klimov)
  - usb: typec: ucsi: psy: Set max current to zero when disconnected (Jameson Thies)
  - ata: libata-scsi: Fix system suspend for a security locked drive (Niklas Cassel)
  - MIPS: mm: Prevent a TLB shutdown on initial uniquification (Maciej W. Rozycki)


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-317.197.1.el9uek]
changelog:
  - LTS version: v5.15.197 (Vijayendra Suman)
  - libbpf: Fix invalid return address register in s390 (Daniel T. Lee)
  - libbpf, riscv: Use a0 for RC register (Yixun Lan)
  - libbpf: Fix riscv register names (Ilya Leoshkevich)
  - selftests/bpf: Don't rely on preserving volatile in PT_REGS macros in loop3 (Andrii Nakryiko)
  - scsi: pm80xx: Set phy->enable_completion only when we (Igor Pylypiv) [Orabug: 37159744] {CVE-2024-47666}
  - Bluetooth: Add more enc key size check (Alex Lu)
  - usb: renesas_usbhs: Fix synchronous external abort on unbind (Claudiu Beznea) [Orabug: 38792571] {CVE-2025-68327}
  - usb: renesas_usbhs: Convert to platform remove callback returning void (Uwe Kleine-König)
  - smb: client: fix memory leak in cifs_construct_tcon() (Paulo Alcantara) [Orabug: 38773704] {CVE-2025-68295}
  - mptcp: Fix proto fallback detection with BPF (Jiayuan Chen) [Orabug: 38773435] {CVE-2025-68227}
  - mptcp: avoid unneeded subflow-level drops (Paolo Abeni)
  - selftests: mptcp: join: rm: set backup flag (Matthieu Baerts)
  - staging: rtl8712: Remove driver using deprecated API wext (Philipp Hortmann)
  - libceph: prevent potential out-of-bounds writes in handle_auth_session_key() (Ziming Zhang) [Orabug: 38773649] {CVE-2025-68284}
  - libceph: fix potential use-after-free in have_mon_and_osd_map() (Ilya Dryomov) [Orabug: 38773655] {CVE-2025-68285}
  - drm/amd/display: Check NULL before accessing (Alex Hung) [Orabug: 38773664] {CVE-2025-68286}
  - drm: sti: fix device leaks at component probe (Johan Hovold)
  - USB: serial: option: add support for Rolling RW101R-GL (Vanillan Wang)
  - USB: serial: ftdi_sio: add support for u-blox EVK-M101 (Oleksandr Suvorov)
  - xhci: dbgtty: Fix data corruption when transmitting data form DbC to host (Mathias Nyman)
  - usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths (Manish Nagar) [Orabug: 38773671] {CVE-2025-68287}
  - usb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer (Owen Gu) [Orabug: 38792593] {CVE-2025-68331}
  - usb: storage: sddr55: Reject out-of-bound new_pba (Tianchu Chen) [Orabug: 38762730] {CVE-2025-40345}
  - usb: storage: Fix memory leak in USB bulk transport (Desnes Nunes) [Orabug: 38773677] {CVE-2018-1000204,CVE-2025-68288}
  - usb: gadget: f_eem: Fix memory leak in eem_unwrap (Kuen-Han Tsai) [Orabug: 38773687] {CVE-2025-68289}
  - usb: cdns3: Fix double resource release in cdns3_pci_probe (Miaoqian Lin)
  - serial: amba-pl011: prefer dma_mapping_error() over explicit address checking (Miaoqian Lin)
  - firmware: stratix10-svc: fix bug in saving controller data (Khairul Anuar Romli)
  - slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves (Miaoqian Lin)
  - thunderbolt: Add support for Intel Wildcat Lake (Alan Borzeszkowski)
  - drivers/usb/dwc3: fix PCI parent check (Jamie Iles)
  - dm-verity: fix unreliable memory allocation (Mikulas Patocka)
  - can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling (Marc Kleine-Budde)
  - can: sja1000: fix max irq loop handling (Thomas Mühlbacher)
  - atm/fore200e: Fix possible data race in fore200e_open() (Gui-Dong Han)
  - iio: accel: bmc150: Fix irq assumption regression (Linus Walleij) [Orabug: 38792587] {CVE-2025-68330}
  - iio:common:ssp_sensors: Fix an error handling path ssp_probe() (Christophe Jaillet)
  - iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields (Francesco Lavra)
  - Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()" (Jiri Olsa)
  - spi: bcm63xx: fix premature CS deassertion on RX-only transactions (Hang Zhou)
  - mailbox: mailbox-test: Fix debugfs_create_dir error checking (Xu Wang)
  - net: atlantic: fix fragment overflow handling in RX path (Jiefeng Zhang) [Orabug: 38773729] {CVE-2025-68301}
  - net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic (Vladimir Oltean)
  - net: dsa: sja1105: simplify static configuration reload (Russell King)
  - net: dsa: sja1105: Convert to mdiobus_c45_read (Andrew Lunn)
  - net: sxgbe: fix potential NULL dereference in sxgbe_rx() (Alexey Kodanev)
  - net/mlx5e: Fix validation logic in rate limiting (Danielle Costantino)
  - net: aquantia: Add missing descriptor cache invalidation on ATL2 (Kai-Heng Feng)
  - platform/x86: intel: punit_ipc: fix memory corruption (Dan Carpenter)
  - Bluetooth: SMP: Fix not generating mackey and ltk when repairing (Luiz Augusto von Dentz)
  - can: kvaser_usb: leaf: Fix potential infinite loop in command parsers (Seungjin Bae) [Orabug: 38773760] {CVE-2025-68308}
  - Revert "block: don't add or resize partition on the disk with GENHD_FL_NO_PART" (Gulam Mohamed) [Orabug: 38652797]
  - Revert "block: Move checking GENHD_FL_NO_PART to bdev_add_partition()" (Gulam Mohamed) [Orabug: 38652797]
  - mptcp: do not fallback when OoO is present (Paolo Abeni)
  - mptcp: fix a race in mptcp_pm_del_add_timer() (Eric Dumazet) [Orabug: 38730656] {CVE-2025-40257}
  - mptcp: fix premature close in case of fallback (Paolo Abeni)
  - mptcp: fix ack generation for fallback msk (Paolo Abeni)
  - dt-bindings: pinctrl: toshiba,visconti: Fix number of items in groups (Krzysztof Kozlowski)
  - Input: pegasus-notetaker - fix potential out-of-bounds access (Seungjin Bae)
  - Input: remove third argument of usb_maxpacket() (Vincent Mailhol)
  - usb: deprecate the third argument of usb_maxpacket() (Vincent Mailhol)
  - mptcp: Disallow MPTCP subflows from sockmap (Jiayuan Chen)
  - selftests: mptcp: connect: fix fallback note due to OoO (Matthieu Baerts)
  - pmdomain: samsung: plug potential memleak during probe (André Draszik)
  - pmdomain: arm: scmi: Fix genpd leak on provider registration failure (Sudeep Holla)
  - pmdomain: imx: Fix reference count leak in imx_gpc_remove (Miaoqian Lin)
  - net: netpoll: fix incorrect refcount handling causing incorrect cleanup (Breno Leitao) [Orabug: 38773509] {CVE-2025-68245}
  - mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4 (Shawn Lin)
  - net: qede: Initialize qede_ll_ops with designated initializer (Nathan Chancellor)
  - btrfs: fix crash on racing fsync and size-extending write into prealloc (Omar Sandoval) [Orabug: 36774582] {CVE-2024-37354}
  - btrfs: add helper to truncate inode items when logging inode (Filipe Manana)
  - Makefile.compiler: replace cc-ifversion with compiler-specific macros (Nick Desaulniers)
  - tracing/tools: Fix incorrcet short option in usage text for --threads (Zhang Chujun)
  - net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error (Nishanth Menon)
  - ALSA: usb-audio: fix uac2 clock source at terminal parser (René Rebe)
  - mm/secretmem: fix use-after-free race in fault handler (Lance Yang) [Orabug: 38737039] {CVE-2025-40272}
  - mm/mm_init: fix hash table order logging in alloc_large_system_hash() (Isaac J. Manjarres)
  - kconfig/nconf: Initialize the default locale at startup (Jakub Horký)
  - kconfig/mconf: Initialize the default locale at startup (Jakub Horký)
  - net: tls: Cancel RX async resync request on rcd_delta overflow (Shahar Shitrit)
  - selftests: net: use BASH for bareudp testing (Po-Hsu Lin)
  - scsi: core: Fix a regression triggered by scsi_host_busy() (Bart Van Assche) [Orabug: 38773426]
  - vsock: Ignore signal/timeout on connect() if already established (Michal Luczaj) [Orabug: 38730611,38786193,38788594] {CVE-2025-40248}
  - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Pavel Zhigulin) [Orabug: 38730629] {CVE-2025-40252}
  - kernel.h: Move ARRAY_SIZE() to a separate header (Alejandro Colomar)
  - platform/x86/intel/speed_select_if: Convert PCIBIOS_* return codes to errnos (Xu Wang)
  - s390/ctcm: Fix double-kfree (Aleksei Nikiforov)
  - net: openvswitch: remove never-working support for setting nsh fields (Ilya Maximets) [Orabug: 38730648] {CVE-2025-40254}
  - net: dsa: hellcreek: fix missing error handling in LED registration (Pavel Zhigulin)
  - mlxsw: spectrum: Fix memory leak in mlxsw_sp_flower_stats() (Zilin Guan)
  - drm/tegra: dc: Fix reference leak in tegra_dc_couple() (Ma Ke)
  - mptcp: fix race condition in mptcp_schedule_work() (Eric Dumazet) [Orabug: 38730659] {CVE-2025-40258}
  - MIPS: Malta: Fix !EVA SOC-it PCI MMIO (Maciej W. Rozycki)
  - scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show() (Hamza Mahfooz) [Orabug: 38773440] {CVE-2025-68229}
  - scsi: sg: Do not sleep in atomic context (Bart Van Assche) [Orabug: 38730663] {CVE-2025-40259}
  - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [Orabug: 38730673] {CVE-2025-40261}
  - Input: imx_sc_key - fix memory corruption on unload (Dan Carpenter)
  - Input: cros_ec_keyb - fix an invalid memory access (Tzung-Bi Shih) [Orabug: 38730680] {CVE-2025-40263}
  - be2net: pass wrb_params in case of OS2BMC (Andrey Vatoropin) [Orabug: 38730689] {CVE-2025-40264}
  - exfat: check return value of sb_min_blocksize in exfat_read_boot_sector (Yongpeng Yang)
  - mtd: rawnand: cadence: fix DMA device NULL pointer dereference (Niravkumar L Rabara)
  - net/sched: act_connmark: handle errno on tcf_idr_check_alloc (Pedro Tammela)
  - isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe() (Abdun Nihaal) [Orabug: 38798907] {CVE-2025-68734}
  - EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection (Niravkumar L Rabara)
  - EDAC/altera: Handle OCRAM ECC enable after warm reset (Niravkumar L Rabara)
  - spi: Try to get ACPI GPIO IRQ earlier (Hans de Goede)
  - ALSA: usb-audio: Fix missing unlock at error path of maxpacksize check (Takashi Iwai)
  - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (Takashi Iwai) [Orabug: 38737023] {CVE-2025-40269}
  - fs/proc: fix uaf in proc_readdir_de() (Wei Yang) [Orabug: 38737033,38786194,38788587] {CVE-2025-40271}
  - ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe (Chuang Wang) [Orabug: 38773495] {CVE-2025-68241}
  - strparser: Fix signed/unsigned mismatch bug (Nate Karstens)
  - gcov: add support for GCC 15 (Peter Oberparleiter)
  - NFSD: free copynotify stateid in nfs4_free_ol_stateid() (Olga Kornievskaia) [Orabug: 38737042] {CVE-2025-40273}
  - HID: hid-ntrig: Prevent memory leak in ntrig_report_version() (Masami Ichikawa)
  - mtd: onenand: Pass correct pointer to IRQ handler (Dan Carpenter)
  - lib/crypto: arm/curve25519: Disable on CPU_BIG_ENDIAN (Eric Biggers)
  - mm/ksm: fix flag-dropping behavior in ksm_madvise (Jakub Acs) [Orabug: 38592026] {CVE-2025-40040}
  - bpf: Add bpf_prog_run_data_pointers() (Eric Dumazet) [Orabug: 38773327] {CVE-2025-68200}
  - ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd (Haein Lee) [Orabug: 38737051] {CVE-2025-40275}
  - NFSv4: Fix an incorrect parameter when calling nfs4_call_sync() (Trond Myklebust)
  - drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (Ian Forbes) [Orabug: 38737060] {CVE-2025-40277}
  - ASoC: cs4271: Fix regulator leak on probe failure (Xu Wang)
  - regulator: fixed: fix GPIO descriptor leak on register failure (Xu Wang)
  - acpi,srat: Fix incorrect device handle check for Generic Initiator (Shuai Xue)
  - Bluetooth: L2CAP: export l2cap_chan_hold for modules (Pauli Virtanen)
  - hsr: Fix supervision frame sending on HSRv0 (Felix Maurer)
  - net_sched: limit try_bulk_dequeue_skb() batches (Eric Dumazet)
  - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Gal Pressman)
  - net/mlx5e: Fix maxrate wraparound in threshold between units (Gal Pressman)
  - net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak (Ranganath V N)
  - net: sched: act_connmark: initialize struct tc_ife to fix kernel leak (Ranganath V N) [Orabug: 38737072] {CVE-2025-40279}
  - net_sched: act_connmark: use RCU in tcf_connmark_dump() (Eric Dumazet)
  - net/sched: act_connmark: transition to percpu stats and rcu (Pedro Tammela)
  - net: sched: act_connmark: get rid of tcf_connmark_walker and tcf_connmark_search (Zhengchao Shao)
  - net: sched: act: move global static variable net_id to tc_action_ops (Zhengchao Shao)
  - wifi: mac80211: skip rate verification for not captured PSDUs (Benjamin Berg)
  - net: mdio: fix resource leak in mdiobus_register_device() (Csaba Buday)
  - tipc: Fix use-after-free in tipc_mon_reinit_self(). (Kuniyuki Iwashima) [Orabug: 38737082,38786195,38788585] {CVE-2025-40280}
  - net/smc: fix mismatch between CLC header and proposal (D. Wythe)
  - sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto (Eric Dumazet) [Orabug: 38737090] {CVE-2025-40281}
  - Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions (Pauli Virtanen)
  - Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion (Pauli Virtanen)
  - Bluetooth: 6lowpan: reset link-local header on ipv6 recv path (Pauli Virtanen)
  - Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF (Raphael Pinsonneault-Thibeault) [Orabug: 38737103] {CVE-2025-40283}
  - net: fec: correct rx_bytes statistic for the case SHIFT16 is set (Wei Fang)
  - ASoC: max98090/91: fixed max98091 ALSA widget powering up/down (Sharique Mohammad)
  - NFS: check if suid/sgid was cleared after a write as needed (Scott Mayhew)
  - HID: quirks: avoid Cooler Master MM712 dongle wakeup bug (Tristan Lobb)
  - NFS4: Fix state renewals missing after boot (Joshua Watt)
  - RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid rfence errors (Danil Skrebenkov)
  - compiler_types: Move unused static inline functions warning to W=2 (Peter Zijlstra)
  - drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD (Janusz Krzysztofik) [Orabug: 38773506] {CVE-2025-68244}
  - selftests: netdevsim: set test timeout to 10 minutes (Jakub Kicinski)
  - extcon: adc-jack: Cleanup wakeup source only if it was enabled (Krzysztof Kozlowski)
  - lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC (Nathan Chancellor)
  - rtc: rx8025: fix incorrect register reference (Yuta Hayama)
  - tracing: Fix memory leaks in create_field_var() (Zilin Guan)
  - bnxt_en: Fix a possible memory leak in bnxt_ptp_init (Kalesh Ap)
  - net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup (Qendrim Maxhuni) [Orabug: 38773282] {CVE-2025-68192}
  - sctp: Hold sock lock while iterating over address list (Stefan Wiehler)
  - sctp: Prevent TOCTOU out-of-bounds write (Stefan Wiehler) [Orabug: 38747446] {CVE-2025-40331}
  - sctp: Hold RCU read lock while iterating over address list (Stefan Wiehler)
  - net: dsa: b53: stop reading ARL entries if search is done (Jonas Gorski)
  - net: dsa: b53: fix enabling ip multicast (Jonas Gorski)
  - net: dsa: b53: fix resetting speed and pause on forced link (Jonas Gorski)
  - net: vlan: sync VLAN features with lower device (Hangbin Liu)
  - selftests: netdevsim: Fix ethtool-coalesce.sh fail by installing ethtool-common.sh (Wang Liang)
  - netdevsim: add Makefile for selftests (David Wei)
  - selftests/net: use destination options instead of hop-by-hop (Anubhav Singh)
  - selftests/net: fix GRO coalesce test and add ext header coalesce tests (Richard Gobert)
  - selftests/net: fix out-of-order delivery of FIN in gro:tcp test (Anubhav Singh)
  - net: dsa: tag_brcm: legacy: fix untagged rx on unbridged ports for bcm63xx (Jonas Gorski)
  - riscv: ptdump: use seq_puts() in pt_dump_seq_puts() macro (Josephine Pfeiffer)
  - Revert "wifi: ath10k: avoid unnecessary wait for service ready message" (Baochen Qiang)
  - ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again (Kailang Yang)
  - ceph: add checking of wait_for_completion_killable() return value (Viacheslav Dubeyko)
  - ASoC: meson: aiu-encoder-i2s: fix bit clock polarity (Valerio Setti)
  - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (Albin Babu Varghese) [Orabug: 38737181] {CVE-2025-40304}
  - ACPI: property: Return present device nodes only on fwnode interface (Sakari Ailus)
  - 9p: sysfs_init: don't hardcode error to ENOMEM (Randall P. Embry)
  - cpufreq: tegra186: Initialize all cores to max frequencies (Aaron Kling)
  - 9p: fix /sys/fs/9p/caches overwriting itself (Randall P. Embry)
  - clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled (Matthias Schiffer)
  - clk: at91: clk-master: Add check for divide by 3 (Ryan Wanner)
  - ARM: at91: pm: save and restore ACR during PLL disable/enable (Nicolas Ferre)
  - rtc: pcf2127: clear minute/second interrupt (Josua Mayer)
  - um: Fix help message for ssl-non-raw (Tiwei Bie)
  - fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink (Yikang Yue)
  - btrfs: mark dirty extent range for out of bound prealloc extents (Austinchang)
  - RDMA/hns: Fix wrong WQE data when QP wraps around (Junxian Huang)
  - RDMA/irdma: Set irdma_cq cq_num field during CQ create (Jacob Moroni)
  - RDMA/irdma: Remove unused struct irdma_cq fields (Jacob Moroni)
  - RDMA/irdma: Fix SD index calculation (Jacob Moroni)
  - ACPICA: Update dsmethod.c to get rid of unused variable warning (Saket Dumbre)
  - orangefs: fix xattr related buffer overflow... (Mike Marshall)
  - page_pool: Clamp pool size to max 16K pages (Dragos Tatulea)
  - exfat: limit log print for IO error (Chi Zhiling)
  - ALSA: usb-audio: add mono main switch to Presonus S1824c (Roy Vegard Ovesen)
  - Bluetooth: bcsp: receive data only if registered (Ivan Pravdin) [Orabug: 38737212] {CVE-2025-40308}
  - Bluetooth: SCO: Fix UAF on sco_conn_free (Luiz Augusto von Dentz) [Orabug: 38737223] {CVE-2025-40309}
  - net: macb: avoid dealing with endianness in macb_set_hwaddr() (Théo Lebrun)
  - fs: ext4: change GFP_KERNEL to GFP_NOFS to avoid deadlock (Chuguangqing) [Orabug: 38773127] {CVE-2025-40361}
  - scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill() (Alok Tiwari)
  - nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode dereferencing (Al Viro) [Orabug: 38773244] {CVE-2025-68185}
  - NFSv4.1: fix mount hang after CREATE_SESSION failure (Anthony Iliopoulos)
  - NFSv4: handle ERR_GRACE on delegation recalls (Olga Kornievskaia)
  - remoteproc: qcom: q6v5: Avoid handling handover twice (Stephan Gerhold)
  - sparc/module: Add R_SPARC_UA64 relocation handling (Koakuma)
  - PCI: cadence: Check for the existence of cdns_pcie::ops before using it (Chen Wang)
  - r8169: set EEE speed down ratio to 1 (Chunhao Lin)
  - net: intel: fm10k: Fix parameter idx set but not used (Brahmajit Das)
  - wifi: ath10k: Fix connection after GTK rekeying (Loic Poulain)
  - iommu/vt-d: Replace snprintf with scnprintf in dmar_latency_snapshot() (Seyediman Seyedarab)
  - net: ethernet: microchip: sparx5: make it selectable for ARCH_LAN969X (Robert Marko)
  - jfs: fix uninitialized waitqueue in transaction manager (Shaurya Rane)
  - jfs: Verify inode mode when loading from disk (Tetsuo Handa)
  - ipv6: np->rxpmtu race annotation (Eric Dumazet)
  - usb: xhci: plat: Facilitate using autosuspend for xhci plat devices (Krishna Kurapati)
  - usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs (Forest Crossman)
  - allow finish_no_open(file, ERR_PTR(-E...)) (Al Viro)
  - scsi: lpfc: Define size of debugfs entry for xri rebalancing (Justin Tee)
  - scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup (Justin Tee)
  - scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET (Justin Tee)
  - selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency (Nai-Chen Cheng)
  - page_pool: always add GFP_NOWARN for ATOMIC allocations (Jakub Kicinski) [Orabug: 38773835] {CVE-2025-68321}
  - drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl (Tvrtko Ursulin)
  - net/cls_cgroup: Fix task_get_classid() during qdisc run (Yafang Shao)
  - udp_tunnel: use netdev_warn() instead of netdev_WARN() (Alok Tiwari) [Orabug: 38773275] {CVE-2025-68191}
  - selftests: Replace sleep with slowwait (David Ahern)
  - eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP (Daniel Palmer)
  - selftests: Disable dad for ipv6 in fcnal-test.sh (David Ahern)
  - x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of PV_UNHALT (Li Rongqing)
  - netfilter: nf_reject: don't reply to icmp error messages (Florian Westphal)
  - selftests: traceroute: Use require_command() (Ido Schimmel)
  - media: redrat3: use int type to store negative error codes (Rong Qianfeng)
  - net: sh_eth: Disable WoL if system can not suspend (Niklas Söderlund)
  - phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0 (Michael Riesch)
  - phy: cadence: cdns-dphy: Enable lower resolutions in dphy (Harikrishna Shenoy)
  - ntfs3: pretend $Extend records as regular files (Tetsuo Handa)
  - net: phy: marvell: Fix 88e1510 downshift counter errata (Rohan G Thomas)
  - drm/msm: make sure to not queue up recovery more than once (Antonino Maniscalco)
  - usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget (Chen Yufeng)
  - usb: gadget: f_hid: Fix zero length packet transfer (William Wu)
  - iommu/amd: Skip enabling command/event buffers for kdump (Ashish Kalra)
  - net: call cond_resched() less often in __release_sock() (Eric Dumazet)
  - net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms (Juraj Šarinay)
  - ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled (Yue Haibing)
  - drm/msm/dsi/phy_7nm: Fix missing initial VCO rate (Krzysztof Kozlowski)
  - drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL (Krzysztof Kozlowski)
  - dmaengine: dw-edma: Set status for callback_result (Devendra K Verma)
  - dmaengine: mv_xor: match alloc_wc and free_wc (Rosen Penev)
  - dmaengine: sh: setup_xref error handling (Thomas Andreatta)
  - ptp: Limit time setting of PTP clocks (Miroslav Lichvar)
  - scsi: pm8001: Use int instead of u32 to store error codes (Rong Qianfeng)
  - mips: lantiq: xway: sysctrl: rename stp clock (Aleksander Jan Bajkowski)
  - mips: lantiq: danube: add missing device_type in pci node (Aleksander Jan Bajkowski)
  - mips: lantiq: danube: add missing properties to cpu node (Aleksander Jan Bajkowski)
  - media: fix uninitialized symbol warnings (Chelsy Ratnawat)
  - drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption (Amber Lin)
  - extcon: adc-jack: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
  - scsi: pm80xx: Fix race condition caused by static variables (Francisco Gutierrez)
  - scsi: mpi3mr: Fix controller init failure on fault during queue creation (Chandrakanth Patil)
  - ALSA: usb-audio: Add validation of UAC2/UAC3 effect units (Takashi Iwai)
  - PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call (Sungho Kim)
  - net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV. (Kuniyuki Iwashima)
  - net: When removing nexthops, don't call synchronize_net if it is not necessary (Christoph Paasch)
  - char: misc: Does not request module for miscdevice with dynamic minor (Zijun Hu)
  - usb: gadget: f_ncm: Fix MAC assignment NCM ethernet (Raub Camaioni)
  - iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register (Rodrigo Gobbi)
  - drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts (Dmitry Baryshkov)
  - media: imon: make send_packet() more robust (Tetsuo Handa) [Orabug: 38773297] {CVE-2025-68194}
  - net: ipv6: fix field-spanning memcpy warning in AH output (Charalampos Mitrodimas) [Orabug: 38773140] {CVE-2025-40363}
  - bridge: Redirect to backup port when port is administratively down (Ido Schimmel)
  - powerpc/eeh: Use result of error_detected() in uevent (Niklas Schnelle)
  - thunderbolt: Use is_pciehp instead of is_hotplug_bridge (Lukas Wunner)
  - net: stmmac: Check stmmac_hw_setup() in stmmac_resume() (Tiezhu Yang)
  - x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall (Kirill A. Shutemov)
  - drm/tidss: Set crtc modesetting parameters with adjusted mode (Jayesh Choudhary)
  - drm/tidss: Use the crtc_* timings when programming the HW (Tomi Valkeinen)
  - media: pci: ivtv: Don't create fake v4l2_fh (Laurent Pinchart)
  - drm/amdkfd: return -ENOTTY for unsupported IOCTLs (Geoffrey Mcrae)
  - selftests/net: Ensure assert() triggers in psock_tpacket.c (Wake Liu)
  - selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8 (Wake Liu)
  - PCI: Disable MSI on RDC PCI to PCIe bridges (Marcos Del Sol Vives)
  - drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() (Seyediman Seyedarab)
  - drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff (Sathishkumar S)
  - drm/amd/pm: Use cached metrics data on arcturus (Lijo Lazar)
  - drm/amd/pm: Use cached metrics data on aldebaran (Lijo Lazar)
  - mfd: da9063: Split chip variant reading in two bus transactions (Jens Kehne)
  - mfd: madera: Work around false-positive -Wininitialized warning (Arnd Bergmann)
  - mfd: stmpe-i2c: Add missing MODULE_LICENSE (Alexander Stein)
  - mfd: stmpe: Remove IRQ domain upon removal (Alexander Stein)
  - tools/power x86_energy_perf_policy: Prefer driver HWP limits (Len Brown)
  - tools/power x86_energy_perf_policy: Enhance HWP enable (Len Brown)
  - tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage (Kaushlendra Kumar)
  - tools/cpupower: Fix incorrect size in cpuidle_state_disable() (Kaushlendra Kumar)
  - hwmon: (dell-smm) Add support for Dell OptiPlex 7040 (Armin Wolf)
  - uprobe: Do not emulate/sstep original instruction when ip is changed (Jiri Olsa)
  - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Daniel Lezcano)
  - cpuidle: Fail cpuidle device registration if there is one already (Rafael J. Wysocki)
  - tools/cpupower: fix error return value in cpupower_write_sysfs() (Kaushlendra Kumar)
  - video: backlight: lp855x_bl: Set correct EPROM start for LP8556 (Svyatoslav Ryhel)
  - nvme-fc: use lock accessing port_state and rport state (Daniel Wagner) [Orabug: 38747531] {CVE-2025-40342}
  - nvmet-fc: avoid scheduling association deletion twice (Daniel Wagner) [Orabug: 38747538] {CVE-2025-40343}
  - tee: allow a driver to allocate a tee_device without a pool (Amirreza Zarrabi)
  - ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() (Hans de Goede)
  - mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card (Sarthak Garg)
  - power: supply: sbs-charger: Support multiple devices (Fabien Proriol)
  - hwmon: (sbtsi_temp) AMD CPU extended temperature range support (Chuande Chen)
  - ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[] (Hans de Goede)
  - ACPI: PRM: Skip handlers with NULL handler_address or NULL VA (Shang Song)
  - irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment (Christian Bruel)
  - arc: Fix __fls() const-foldability via __builtin_clzl() (Kees Cook)
  - cpufreq/longhaul: handle NULL policy in longhaul_exit (Dennis Beier)
  - selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2 (Ricardo B. Marlière)
  - ACPI: video: force native for Lenovo 82K8 (Mario Limonciello)
  - memstick: Add timeout to prevent indefinite waiting (Jiayi Li)
  - mmc: host: renesas_sdhi: Fix the actual clock (Biju Das)
  - pinctrl: single: fix bias pull up/down handling in pin_config_set (Chi Zhang)
  - bpf: Don't use %pK through printk (Thomas Weißschuh)
  - soc: ti: pruss: don't use %pK through printk (Thomas Weißschuh)
  - spi: loopback-test: Don't use %pK through printk (Thomas Weißschuh)
  - soc: qcom: smem: Fix endian-unaware access of num_entries (Jens Reidel)
  - soc: aspeed: socinfo: Add AST27xx silicon IDs (Ryan Chen)
  - block: make REQ_OP_ZONE_OPEN a write operation (Damien Le Moal)
  - drm/sysfb: Do not dereference NULL pointer in plane reset (Thomas Zimmermann) [Orabug: 38773123] {CVE-2025-40360}
  - drm/sched: Fix race in drm_sched_entity_select_rq() (Philipp Stanner)
  - usb: gadget: f_fs: Fix epfile null pointer access after ep enable. (Owen Gu)
  - Revert "docs/process/howto: Replace C89 with C11" (Matthieu Baerts)
  - arch: back to -std=gnu89 in < v5.18 (Matthieu Baerts)
  - x86/boot: Compile boot code with -std=gnu11 too (Alexey Dobriyan)
  - xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event (Mathias Nyman)
  - xhci: dbc: Avoid event polling busyloop if pending rx transfers are inactive. (Mathias Nyman)
  - xhci: dbc: Improve performance by removing delay in transfer event polling. (Mathias Nyman)
  - xhci: dbc: Allow users to modify DbC poll interval via sysfs (Uday M Bhat)
  - xhci: dbc: poll at different rate depending on data transfer activity (Mathias Nyman)
  - xhci: dbc: Provide sysfs option to configure dbc descriptors (Mathias Nyman)
  - x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID (Babu Moger)
  - net: phy: dp83867: Disable EEE support as not implemented (Emanuele Ghidoli)
  - can: gs_usb: increase max interface to U8_MAX (Celeste Liu)
  - net: ravb: Enforce descriptor type ordering (Lad Prabhakar)
  - ravb: Exclude gPTP feature support for RZ/G2L (Biju Das)
  - dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp (Xu Yang)
  - serial: 8250_dw: handle reset control deassert error (Artem Shimko)
  - serial: 8250_dw: Use devm_add_action_or_reset() (Andy Shevchenko)
  - block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL (Damien Le Moal)
  - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland (John Smith)
  - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji (John Smith)
  - drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() (Yang Wang)
  - net: hns3: return error code when function fails (Jijie Shao)
  - drm/etnaviv: fix flush sequence logic (Tomeu Vizoso)
  - usbnet: Prevents free active kevent (Lizhi Xu) [Orabug: 38773783] {CVE-2025-68312}
  - libbpf: Fix powerpc's stack register definition in bpf_tracing.h (Andrii Nakryiko)
  - libbpf: Normalize PT_REGS_xxx() macro definitions (Andrii Nakryiko)
  - riscv, libbpf: Add RISC-V (RV64) support to bpf_tracing.h (Björn Töpel)
  - bpf: Do not audit capability check in do_jit() (Ondrej Mosnacek)
  - bpf: Sync pending IRQ work before freeing ring buffer (Noorain Eqbal) [Orabug: 38737284] {CVE-2025-40319}
  - ALSA: usb-audio: fix control pipe direction (Roy Vegard Ovesen)
  - drm/msm/a6xx: Fix GMU firmware parser (Akhil P Oommen)
  - wifi: ath10k: Fix memory leak on unsupported WMI command (Loic Poulain)
  - ASoC: qdsp6: q6asm: do not sleep while atomic (Srinivas Kandagatla)
  - mptcp: restore window probe (Paolo Abeni)
  - fbdev: valkyriefb: Fix reference count leak in valkyriefb_init (Miaoqian Lin)
  - fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS (Florian Fuchs)
  - wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode (Gokul Sivakumar) [Orabug: 38737291] {CVE-2025-40321}
  - fbdev: bitblit: bound-check glyph index in bit_putcs* (Junjie Cao) [Orabug: 38737300] {CVE-2025-40322}
  - ACPI: video: Fix use-after-free in acpi_video_switch_brightness() (Yuhao Jiang) [Orabug: 38687004] {CVE-2025-40211}
  - fbdev: atyfb: Check if pll_ops->init_pll failed (Daniel Palmer)
  - net: usb: asix_devices: Check return value of usbnet_get_endpoints (Miaoqian Lin)
  - NFSD: Fix crash in nfsd4_read_release() (Chuck Lever) [Orabug: 38737315] {CVE-2025-40324}
  - btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() (Filipe Manana)
  - btrfs: always drop log root tree reference in btrfs_replay_log() (Filipe Manana)
  - btrfs: scrub: replace max_t()/min_t() with clamp() in scrub_throttle_dev_io() (Thorsten Blum)
  - x86/bugs: Fix reporting of LFENCE retpoline (David Kaplan)
  - net/sched: sch_qfq: Fix null-deref in agg_dequeue (Xiang Mei) [Orabug: 38597084] {CVE-2025-40083}


author: Samasth Norway Ananda <samasth.norway.ananda@oracle.com> [5.15.0-317.197.2.el9uek]
changelog:
  - x86/its: Build fails with CONFIG_MITIGATION_ITS=n (Alexandre Chartre) [Orabug: 38756952]
  - net/sched: adjust device watchdog timer to detect stopped queue at right time (Praveen Kumar Kannoju) [Orabug: 38341919]
  - KVM: arm64: Add minimal handling for the ARMv8.7 PMU (Marc Zyngier) [Orabug: 38784458]
  - scsi: megaraid_sas: Fix invalid node index (Chen Yu) [Orabug: 38175026] {CVE-2025-38239}
  - Revert "iommu/amd: Skip enabling command/event buffers for kdump" (Dongli Zhang) [Orabug: 38790823]
  - mm: list_lru: avoid using NULL list_lru_one. (Imran Khan) [Orabug: 38619860]
  - mm: list_lru: fix UAF for memory cgroup (Muchun Song) [Orabug: 38619860]
  - net/rds: improve conn destroy printk message (Sharath Srinivasan) [Orabug: 38728740]
  - net/rds: expand kref coverage to rds_notifier->n_conn (Sharath Srinivasan) [Orabug: 38728740]
  - net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn (Sharath Srinivasan) [Orabug: 38728740]
  - net/rds: rds_sendmsg must use rs_conn only when not being destroyed (Sharath Srinivasan) [Orabug: 38728743]
  - net/mlx5e: Set default burst period for TX and RX reporters (Shahar Shitrit) [Orabug: 38512377]
  - devlink: Make health reporter burst period configurable (Shahar Shitrit) [Orabug: 38512377]
  - devlink: Introduce burst period for health reporter (Shahar Shitrit) [Orabug: 38512377]
  - devlink: Move health reporter recovery abort logic to a separate function (Shahar Shitrit) [Orabug: 38512377]
  - devlink: Move graceful period parameter to reporter ops (Shahar Shitrit) [Orabug: 38512377]
  - devlink: introduce devlink_nl_put_u64() (Przemek Kitszel) [Orabug: 38512377]
  - net/mlx5: remove fw reporter dump option for non PF (Moshe Shemesh) [Orabug: 38512377]
  - net/mlx5: remove fw_fatal reporter dump option for non PF (Moshe Shemesh) [Orabug: 38512377]
  - devlink: Hold devlink lock on health reporter dump get (Moshe Shemesh) [Orabug: 38512377]
  - Revert "net/mlx5: set graceful_period to 0 to allow multiple transmission queue recovery" (Qing Huang) [Orabug: 38512377]
  - NVIDIA: SAUCE: iommu/arm-smmu-v3: Allow default substream bypass with a pasid support (Nicolin Chen) [Orabug: 38463999]
  - RDMA/mlx5: Fix a WARN during dereg_mr for DM type (Yishai Hadas) [Orabug: 37766291,38463999] {CVE-2025-21888}
  - uek-rpm: replace CONFIG_IOMMU_SVA_LIB with CONFIG_IOMMU_SVA (Junxiao Bi) [Orabug: 38463999]
  - iommu/sva: Rename CONFIG_IOMMU_SVA_LIB to CONFIG_IOMMU_SVA (Fenghua Yu) [Orabug: 38463999]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-317.197.3.el9uek]
changelog:
  - kpcimgr: Enable loading firmware via kernel infrastructure (Joseph Dobosenski) [Orabug: 38546110]
  - Move hnic crashkernel to cnic-image-builder (Henry Willard) [Orabug: 38546110]
  - Bump supported capmem range count from 64 to 256 (Jan Setje-Eilers) [Orabug: 38546110]
  - irqchip/pensando: Fix partial of_iomap() leak on error (#505) (Brad Larson) [Orabug: 38546110]
  - pensando: Allow sparse allowed ranges in cap_mem (Maciej S. Szmigiero) [Orabug: 38546110]
  - soc/pensando/cap-pcie: Handle zero-ed out MS_CFG_WDT_IDX/WDT_IDX (Joao Martins) [Orabug: 38546110]
  - pensando: Enable penfw driver for smartnic (Jan Setje-Eilers) [Orabug: 38546110]
  - irqchip/gic-v3-its: remove WARN_ON gic_reserve_range (Tom Saeger) [Orabug: 38546110]
  - hnic: Disable CONFIG_OVERLAY_FS_INDEX (Patrick Colp) [Orabug: 38546110]
  - pensando: missing diffs from AMD (Jan Setje-Eilers) [Orabug: 38546110]
  - hnic: config: Build FUSE into the kernel (not as a module) (Patrick Colp) [Orabug: 38546110]
  - hnic: config: Add DM_VERITY support (Patrick Colp) [Orabug: 38546110]
  - hnic config: Add LOCKDOWN_LSM support (Patrick Colp) [Orabug: 38546110]
  - Subject: uek-rpm: Build hostnic kernel for Pensando (Dave Kleikamp) [Orabug: 38546110]
  - pensando: kpcimgr: support pcie port bifurcation (Darshan Prajapati) [Orabug: 38546110]
  - Add changes for penfw and sbus.c for secureboot (Rahshekh) [Orabug: 38546110]
  - arm64: GIC ITS MSI encapsulator address configured from device tree (Brad Larson) [Orabug: 38546110]
  - perf/arm-cmn: Enable AMD Pensando Salina SoC CMN PMU driver (Brad Larson) [Orabug: 38546110]
  - reset: salinasr: Add AMD Pensando Salina SoC reset (Brad Larson) [Orabug: 38546110]
  - spi: dw-mmio: Add AMD Pensando Salina SoC support (Brad Larson) [Orabug: 38546110]
  - EDAC/elba: Support AMD Pensando Giglio SoC (Brad Larson) [Orabug: 38546110]
  - arm64: defconfig: Add AMD Pensando Salina SoC defconfig (Brad Larson) [Orabug: 38546110]
  - soc/pensando: Support AMD Pensando Salina SoC (Brad Larson) [Orabug: 38546110]
  - arm64: dts: Add AMD Pensando Salina SoC support (Brad Larson) [Orabug: 38546110]
  - mmc: sdhci-cadence: Support AMD Salina SoC (Brad Larson) [Orabug: 38546110]
  - PCI/AER: Avoid NULL pointer dereference in aer_ratelimit() (Breno Leitao) [Orabug: 38597010] {CVE-2025-40034}
  - mm/hugetlb: disable huge_pmd_unshare TLB sync by default on Exadata (Joe Jin) [Orabug: 38829889]
  - vhost: Account for worker thread under owner's nproc (Mike Christie) [Orabug: 38770748]
  - vhost: revert CAP_SYS restrictions on worker ioctls (Mike Christie) [Orabug: 38770748]
  - RDMA/cm: Base cm_id destruction timeout on CMA values (Håkon Bugge) [Orabug: 38753654]
  - mlx5: Fix default values in create CQ (Akiva Goldberger) [Orabug: 38420735,38773370] {CVE-2025-68209}
  - uek-rpm: Allow disabling kabichk at command line (Yifei Liu) [Orabug: 38744825]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-317.197.4.el9uek]
changelog:
  - gpio: mlxbf3: use platform_get_irq_optional() (David Thompson) [Orabug: 38755419]
  - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (Alok Tiwari) [Orabug: 38755419]
  - pinctrl: mlxbf3: Fix return value check for devm_platform_ioremap_resource (Chen Ni) [Orabug: 38755419]
  - net/mlx5e: Query FW for buffer ownership (Alexei Lazar) [Orabug: 38755419]
  - net/mlx5: Add IFC bits and enums for buf_ownership (Oren Sidi) [Orabug: 38755419]
  - net/mlx5: Update mlx5_ifc to support FEC for 200G per lane link modes (Jianbo Liu) [Orabug: 38755419]
  - net/mlx5e: Support FEC settings for 100G/lane modes (Cosmin Ratiu) [Orabug: 38755419]
  - net/mlx5e: Extract checking of FEC support for a link mode (Cosmin Ratiu) [Orabug: 38755419]
  - tcp: Set pingpong threshold via sysctl (Haiyang Zhang) [Orabug: 38853979]
  - arm64: hnic: config: Add NBD driver (Patrick Colp) [Orabug: 38858773]
  - arm64: pensando: Fix spec file for HNIC (Rob Gardner) [Orabug: 38858773]
  - Enable additional drivers needed to support MIPS64 SmartNic (Vijay Kumar) [Orabug: 38846771]
  - MIPS: Fix build error for mips ARCH_ATOMIC (Vijay Kumar) [Orabug: 38846771]
  - Added atomic addition,subtraction functions. (Anagha K J) [Orabug: 38846771]
  - Allocate the required IV size referenced by the cypher handle in init_state (Anagha K J) [Orabug: 38846771]
  - Setting up numa system and memory initializations (Anagha K J) [Orabug: 38846771]
  - Implemented clocksource provider driven by node-0 FPA_CLK_COUNT (Anagha K J) [Orabug: 38846771]
  - Processor cache information made available to userspace (Anagha K J) [Orabug: 38846771]
  - MIPS: mm: kmalloc tlb_vpn array to avoid stack overflow (Thomas Bogendoerfer) [Orabug: 38851582]
  - usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE (Gopi Krishna Menon)
  - ext4: clear i_state_flags when alloc inode (Haibo Chen)
  - ext4: align max orphan file size with e2fsprogs limit (Baokun Li)
  - PM: runtime: Do not clear needs_force_resume with enabled runtime PM (Rafael J. Wysocki)
  - net: enetc: fix build warning when PAGE_SIZE is greater than 128K (Wei Fang)
  - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Xiang Mei) [Orabug: 38783137] {CVE-2025-68325}
  - block: fix comment for op_is_zone_mgmt() to include RESET_ALL (Shechenglong)
  - fuse: fix readahead reclaim deadlock (Joanne Koong) [Orabug: 38847946] {CVE-2025-68821}
  - i40e: validate ring_len parameter against hardware-specific values (Gregory Herrero)
  - fs/ntfs3: fix mount failure for sparse runs in run_unpack() (Konstantin Komarov)
  - ntfs3: init run lock for extend inode (Edward Adam Davis)


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-317.197.5.el9uek]
changelog:
  - KVM: x86: conditionally clear masterclock request for uek=exadata (Dongli Zhang)  [Orabug: 38801641]
  - Partial backport of "KVM: x86: Fix software TSC upscaling in kvm_update_guest_time()" (Dongli Zhang)  [Orabug: 38801641]
  - uek-rpm: pensando: Move crashkernel to cnic-image-builder (Henry Willard)  [Orabug: 38851137]
  - ext4: drop dio overwrite only flag and associated warning (Brian Foster)  [Orabug: 38381010]
  - ext4: fix racy may inline data check in dio write (Brian Foster)  [Orabug: 38381010]
  - ext4: allow concurrent unaligned dio overwrites (Brian Foster)  [Orabug: 38381010]
  - ext4: dio take shared inode lock when overwriting preallocated blocks (Zhang Yi)  [Orabug: 38381010]
  - net: mana: Reduce waiting time if HWC not responding (Haiyang Zhang)  [Orabug: 38172423]
  - uek-rpm: hnic: add unique hnic signing certs (Tom Saeger)  [Orabug: 38894488]
  - drivers/soc/pensando/sbus: Secure mode support. (Hiren Mehta)  [Orabug: 38894106]
  - drivers/soc/pensando/pen_secure: Report register address on access errors (Maciej S. Szmigiero)  [Orabug: 38894106]
  - drivers/edac/elba_edac: Secure mode support (Hiren Mehta)  [Orabug: 38894106]
  - drivers/soc/pensando/bsm: Add secure-mode support. (Hiren Mehta)  [Orabug: 38894106]
  - drivers/soc/pensando/rstcause: Add secure mode support. (Hiren Mehta)  [Orabug: 38894106]
  - drivers/soc/pensando/penfw: New SMC support for secure-mode. (Hiren Mehta)  [Orabug: 38894106]
  - drivers/soc/pensando/sbus: Secure mode support (Hiren Mehta)  [Orabug: 38894106]
  - sunrpc: fix client side handling of tls alerts (Olga Kornievskaia)  [Orabug: 38334981]  {CVE-2025-38571}
  - sunrpc: fix handling of server side tls alerts (Olga Kornievskaia)  [Orabug: 38334968]  {CVE-2025-38566}
  - xfrm: delete x->tunnel as we delete x (Sabrina Dubroca)  [Orabug: 38730492]  {CVE-2025-40215}


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-317.197.5.1.el9uek]
changelog:
  - Revert "net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn" (Vijayendra Suman)  [Orabug: 38961010]  
  - Revert "net/rds: expand kref coverage to rds_notifier->n_conn" (Sharath Srinivasan)  [Orabug: 38961010]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-317.197.5.1.el9uek]
changelog:
  - Revert "net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn" (Vijayendra Suman)  [Orabug: 38961010]
  - Revert "net/rds: expand kref coverage to rds_notifier->n_conn" (Sharath Srinivasan)  [Orabug: 38961010]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-317.197.5.2.el9uek]
changelog:
  - xfrm: flush all states in xfrm_state_fini (Sabrina Dubroca)  [Orabug: 39016261]  
  - xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added (Sabrina Dubroca)  [Orabug: 39016261]  
  - Revert "xfrm: destroy xfrm_state synchronously on net exit path" (Sabrina Dubroca)  [Orabug: 39016261]  
  - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (Kuniyuki Iwashima)  [Orabug: 39016219]  {CVE-2025-40149} 
  - net: Add locking to protect skb->dev access in ip_output (Sharath Chandra Vurukala)  [Orabug: 39016219]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-317.197.5.el9uek]
changelog:
  - KVM: x86: conditionally clear masterclock request for uek=exadata (Dongli Zhang) [Orabug: 38801641]
  - Partial backport of "KVM: x86: Fix software TSC upscaling in kvm_update_guest_time()" (Dongli Zhang) [Orabug: 38801641]
  - uek-rpm: pensando: Move crashkernel to cnic-image-builder (Henry Willard) [Orabug: 38851137]
  - ext4: drop dio overwrite only flag and associated warning (Brian Foster) [Orabug: 38381010]
  - ext4: fix racy may inline data check in dio write (Brian Foster) [Orabug: 38381010]
  - ext4: allow concurrent unaligned dio overwrites (Brian Foster) [Orabug: 38381010]
  - ext4: dio take shared inode lock when overwriting preallocated blocks (Zhang Yi) [Orabug: 38381010]
  - net: mana: Reduce waiting time if HWC not responding (Haiyang Zhang) [Orabug: 38172423]
  - uek-rpm: hnic: add unique hnic signing certs (Tom Saeger) [Orabug: 38894488]
  - drivers/soc/pensando/sbus: Secure mode support. (Hiren Mehta) [Orabug: 38894106]
  - drivers/soc/pensando/pen_secure: Report register address on access errors (Maciej S. Szmigiero) [Orabug: 38894106]
  - drivers/edac/elba_edac: Secure mode support (Hiren Mehta) [Orabug: 38894106]
  - drivers/soc/pensando/bsm: Add secure-mode support. (Hiren Mehta) [Orabug: 38894106]
  - drivers/soc/pensando/rstcause: Add secure mode support. (Hiren Mehta) [Orabug: 38894106]
  - drivers/soc/pensando/penfw: New SMC support for secure-mode. (Hiren Mehta) [Orabug: 38894106]
  - drivers/soc/pensando/sbus: Secure mode support (Hiren Mehta) [Orabug: 38894106]
  - sunrpc: fix client side handling of tls alerts (Olga Kornievskaia) [Orabug: 38334981,38932988] {CVE-2025-38571}
  - sunrpc: fix handling of server side tls alerts (Olga Kornievskaia) [Orabug: 38334968,38932991] {CVE-2025-38566}
  - xfrm: delete x->tunnel as we delete x (Sabrina Dubroca) [Orabug: 38730492,38933003] {CVE-2025-40215}


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-318.199.1.el9uek]
changelog:
  - LTS version: v5.15.199 (Vijayendra Suman)
  - wifi: cfg80211: init wiphy_work before allocating rfkill fails (Edward Adam Davis) [Orabug: 39004275] {CVE-2025-22119}
  - wifi: cfg80211: fully move wiphy work to unbound workqueue (Johannes Berg)
  - wifi: cfg80211: cancel wiphy_work before freeing wiphy (Miri Korenblit) [Orabug: 39004414] {CVE-2025-21979}
  - wifi: cfg80211: fix wiphy delayed work queueing (Johannes Berg)
  - wifi: cfg80211: use system_unbound_wq for wiphy work (Johannes Berg)
  - team: Move team device type change at the end of team_port_add (Nikola Z. Ivanov)
  - pinctrl: meson: mark the GPIO controller as sleeping (Bartosz Golaszewski)
  - mptcp: avoid dup SUB_CLOSED events after disconnect (Matthieu Baerts)
  - writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 (Laveesh Bansal)
  - drm/imx/tve: fix probe device leak (Johan Hovold)
  - pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver (Bartosz Golaszewski)
  - net/sched: act_ife: convert comma to semicolon (Chen Ni)
  - btrfs: prevent use-after-free on page private data in btrfs_subpage_clear_uptodate() (Jp Kobryn)
  - drm/amdkfd: fix a memory leak in device_queue_manager_init() (Haoxiang Li)
  - can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
  - genirq/irq_sim: Initialize work context pointers properly (Gyeyoung Baek)
  - HID: uclogic: Add NULL check in uclogic_input_configured() (Henry Martin) [Orabug: 39004242] {CVE-2025-38007}
  - HID: uclogic: Correct devm device reference for hidinput input_dev name (Rahul Rameshbabu)
  - wifi: mac80211: move TDLS work to wiphy work (Johannes Berg)
  - wifi: mac80211: use wiphy work for sdata->work (Johannes Berg)
  - wifi: cfg80211: add a work abstraction with special semantics (Johannes Berg)
  - Bluetooth: Fix hci_suspend_sync crash (Ying Hsu)
  - net: stmmac: make sure that ptp_rate is not 0 before configuring EST (Alexis Lothoré)
  - usbnet: Fix using smp_processor_id() in preemptible code warnings (Zqiang) [Orabug: 38649206] {CVE-2025-40164}
  - NFSD: fix race between nfsd registration and exports_proc (Maninder Singh) [Orabug: 38158712] {CVE-2025-38232}
  - ext4: fix memory leaks in ext4_fname_{setup_filename,prepare_lookup} (Luis Henriques)
  - espintcp: fix skb leaks (Sabrina Dubroca) [Orabug: 38094997] {CVE-2025-38057}
  - fs/ntfs3: Initialize allocated memory before use (Bartlomiej Kubik)
  - ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency (Namjae Jeon)
  - drm/ttm: fix undefined behavior in bit shift for TTM_TT_FLAG_PRIV_POPULATED (Gaosheng Cui)
  - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Pedro Demarchi Gomes) [Orabug: 38773375] {CVE-2025-68211}
  - mm/pagewalk: add walk_page_range_vma() (David Hildenbrand)
  - ksmbd: smbd: fix dma_unmap_sg() nents (Thomas Fourier)
  - mei: trace: treat reg parameter as string (Alexander Usyskin)
  - ALSA: scarlett2: Fix buffer overflow in config retrieval (Samasth Norway Ananda)
  - nvme: fix PCIe subsystem reset controller state transition (Nilay Shroff)
  - nvme-pci: do not directly handle subsys reset fallout (Keith Busch)
  - nvme-fc: rename free_ctrl callback to match name pattern (Daniel Wagner)
  - xfs: set max_agbno to allow sparse alloc of last full inode chunk (Brian Foster)
  - dmaengine: stm32: dmamux: fix device leak on route allocation (Johan Hovold)
  - dmaengine: stm32: dmamux: fix OF node leak on route allocation failure (Johan Hovold)
  - w1: therm: Fix off-by-one buffer overflow in alarms_store (Thorsten Blum) [Orabug: 38930799] {CVE-2025-71197}
  - w1: w1_therm: use swap() to make code cleaner (Yang Guang)
  - arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s (Geraldo Nascimento)
  - scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() (Abdun Nihaal) [Orabug: 38931015] {CVE-2026-23087}
  - iio: adc: exynos_adc: fix OF populate on driver rebind (Johan Hovold)
  - of: platform: Use default match table for /firmware (Rob Herring)
  - comedi: Fix getting range information for subdevices 16 to 255 (Ian Abbott)
  - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (Kuniyuki Iwashima) [Orabug: 38649138] {CVE-2025-40149}
  - net: Add locking to protect skb->dev access in ip_output (Sharath Chandra Vurukala)
  - mptcp: only reset subflow errors when propagated (Matthieu Baerts)
  - scsi: qla2xxx: edif: Fix dma_free_coherent() size (Thomas Fourier)
  - scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() (Haoxiang Li)
  - ASoC: fsl: imx-card: Do not force slot width to sample width (Fabio Estevam)
  - dma/pool: distinguish between missing and exhausted atomic pools (Sai Sree Kartheek Adivi)
  - gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler (Denis Sergeev)
  - scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() (Kery Qi)
  - net: bridge: fix static key check (Martin Kaiser)
  - nfc: nci: Fix race between rfkill and nci_unregister_device(). (Kuniyuki Iwashima)
  - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Gal Pressman)
  - net/mlx5e: Report rx_discards_phy via rx_dropped (Yafang Shao)
  - ice: stop counting UDP csum mismatch as rx_errors (Jesse Brandeburg)
  - nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). (Kuniyuki Iwashima)
  - rocker: fix memory leak in rocker_world_port_post_fini() (Kery Qi) [Orabug: 38970353] {CVE-2026-23164}
  - ipv6: use the right ifindex when replying to icmpv6 from localhost (Fernando Fernandez Mancera)
  - net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() (Zilin Guan)
  - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Zilin Guan)
  - Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (Jia-Hong Su) [Orabug: 38970605] {CVE-2026-23146}
  - bpf: Reject narrower access to pointer ctx fields (Paul Chaignon) [Orabug: 38335081] {CVE-2025-38591}
  - bpf: Do not let BPF test infra emit invalid GSO types to stack (Daniel Borkmann) [Orabug: 38798882] {CVE-2025-68725}
  - migrate: correct lock ordering for hugetlb file folios (Matthew Wilcox) [Orabug: 38931067] {CVE-2026-23097}
  - can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38931121] {CVE-2026-23108}
  - can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
  - can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930883] {CVE-2026-23061}
  - can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930860] {CVE-2026-23058}
  - irqchip/gic-v3-its: Avoid truncating memory addresses (Arnd Bergmann) [Orabug: 38931002] {CVE-2026-23085}
  - perf/x86/intel: Do not enable BTS for guests (Fernand Sieber)
  - netrom: fix double-free in nr_route_frame() (Jeongjun Park)
  - uacce: ensure safe queue release with state management (Chenghai Huang)
  - uacce: implement mremap in uacce_vm_ops to return -EPERM (Yang Shen)
  - uacce: fix cdev handling in the cleanup path (Wenkai Lin)
  - intel_th: fix device leak on output open() (Johan Hovold) [Orabug: 38931041] {CVE-2026-23091}
  - slimbus: core: fix device reference leak on report present (Johan Hovold)
  - slimbus: core: fix runtime PM imbalance on report present (Johan Hovold)
  - octeontx2: Fix otx2_dma_map_page() error return code (Thomas Fourier)
  - arm64: Set __nocfi on swsusp_arch_resume() (Zhaoyang Huang)
  - wifi: rsi: Fix memory corruption due to not set vif driver data size (Marek Vasut) [Orabug: 38930941] {CVE-2026-23073}
  - wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (Dan Carpenter)
  - wifi: ath10k: fix dma_free_coherent() pointer (Thomas Fourier) [Orabug: 38970255] {CVE-2026-23133}
  - mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function (Matthew Schwartz)
  - ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (Berk Cem Goksel) [Orabug: 38931030] {CVE-2026-23089}
  - ALSA: ctxfi: Fix potential OOB access in audio mixer handling (Takashi Iwai) [Orabug: 38930967] {CVE-2026-23076}
  - iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl (Andreas Kübrich)
  - iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver (Pei Xiao)
  - iio: adc: ad9467: fix ad9434 vref mask (Tomas Melin)
  - of: fix reference count leak in of_alias_scan() (Weigang He)
  - leds: led-class: Only Add LED to leds_list when it is fully ready (Hans de Goede) [Orabug: 38931092] {CVE-2026-23101}
  - x86: make page fault handling disable interrupts properly (Cedric Xing)
  - net/sched: act_ife: avoid possible NULL deref (Eric Dumazet)
  - octeontx2-af: Fix error handling (Ratheesh Kannoth)
  - bonding: provide a net pointer to __skb_flow_dissect() (Eric Dumazet) [Orabug: 38970200] {CVE-2026-23119}
  - be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (Andrey Vatoropin) [Orabug: 38930993] {CVE-2026-23084}
  - drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) (Timur Kristóf)
  - drm/amd/pm: Don't clear SI SMC table when setting power limit (Timur Kristóf)
  - usbnet: limit max_mtu based on device's hard_mtu (Laurent Vivier)
  - ipv6: annotate data-race in ndisc_router_discovery() (Eric Dumazet) [Orabug: 38970223] {CVE-2026-23124}
  - mISDN: annotate data-race around dev->work (Eric Dumazet) [Orabug: 38970211] {CVE-2026-23121}
  - net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue (Jijie Shao)
  - net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M (Jijie Shao)
  - ALSA: usb: Increase volume range that triggers a warning (Arun Raghavan)
  - regmap: Fix race condition in hwspinlock irqsave routine (Cheng-Yu Lee) [Orabug: 38930931] {CVE-2026-23071}
  - iio: adc: ad7280a: handle spi_setup() errors in probe() (Pavel Zhigulin)
  - staging:iio:adc:ad7280a: Register define cleanup. (Jonathan Cameron)
  - x86/kfence: avoid writing L1TF-vulnerable PTEs (Andrew Cooper)
  - scsi: storvsc: Process unsupported MODE_SENSE_10 (Long Li)
  - Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA (Feng)
  - Input: i8042 - add quirks for MECHREVO Wujie 15X Pro (Gongqi)
  - Revert "nfc/nci: Add the inconsistency check between the input data length and count" (Thadeu Lima de Souza Cascardo)
  - w1: fix redundant counter decrement in w1_attach_slave_device() (Haoxiang Li)
  - comedi: dmm32at: serialize use of paged registers (Ian Abbott)
  - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Taeyang Lee) [Orabug: 38930875] {CVE-2026-23060}
  - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (Jamal Hadi Salim) [Orabug: 38931111] {CVE-2026-23105}
  - net/sched: Enforce that teql can only be used as root qdisc (Jamal Hadi Salim) [Orabug: 38930949] {CVE-2026-23074}
  - ipvlan: Make the addrs_lock be per port (Dmitry Skorodumov) [Orabug: 38931103] {CVE-2026-23103}
  - l2tp: avoid one data-race in l2tp_tunnel_del_work() (Eric Dumazet) [Orabug: 38970203] {CVE-2026-23120}
  - fou: Don't allow 0 for FOU_ATTR_IPPROTO. (Kuniyuki Iwashima)
  - net: fou: use policy and operation tables generated from the spec (Jakub Kicinski)
  - net: fou: rename the source for linking (Jakub Kicinski)
  - netlink: add a proto specification for FOU (Jakub Kicinski)
  - gue: Fix skb memleak with inner IP protocol 0. (Kuniyuki Iwashima)
  - amd-xgbe: avoid misleading per-packet error log (Raju Rangoju)
  - sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [Orabug: 38970226] {CVE-2026-23125}
  - bonding: limit BOND_MODE_8023AD to Ethernet devices (Eric Dumazet) [Orabug: 38931080] {CVE-2026-23099}
  - net: usb: dm9601: remove broken SR9700 support (Ethan Nelson-Moore)
  - testptp: Add option to open PHC in readonly mode (Wojtek Wasko)
  - selftest/ptp: update ptp selftest to exercise the gettimex options (Mahesh Bandewar)
  - ptp: add testptp mask test (Xabier Marquiegui)
  - selftests/ptp: Add -X option for testing PTP_SYS_OFFSET_PRECISE (Alex Maftei)
  - selftests/ptp: Add -x option for testing PTP_SYS_OFFSET_EXTENDED (Alex Maftei)
  - testptp: Add support for testing ptp_clock_info .adjphase callback (Rahul Rameshbabu)
  - testptp: add option to shift clock by nanoseconds (Maciek Machnikowski)
  - ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE. (Wojtek Wasko)
  - posix-clock: Store file pointer in struct posix_clock_context (Wojtek Wasko)
  - Fix memory leak in posix_clock_open() (Linus Torvalds) [Orabug: 39004188] {CVE-2024-26655}
  - posix-clock: introduce posix_clock_context concept (Xabier Marquiegui)
  - btrfs: fix deadlock in wait_current_trans() due to ignored transaction type (Robbie Ko) [Orabug: 38930779] {CVE-2025-71194}
  - dmaengine: ti: k3-udma: fix device leak on udma lookup (Johan Hovold)
  - dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation (Johan Hovold)
  - dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation (Johan Hovold)
  - dmaengine: sh: rz-dmac: Fix rz_dmac_terminate_all() (Biju Das)
  - dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config() (Miaoqian Lin)
  - dmaengine: lpc18xx-dmamux: fix device leak on route allocation (Johan Hovold)
  - dmaengine: idxd: fix device leaks on compat bind and unbind (Johan Hovold)
  - dmaengine: bcm-sba-raid: fix device leak on probe (Johan Hovold) [Orabug: 38914728] {CVE-2025-71190}
  - dmaengine: at_hdmac: fix device leak on of_dma_xlate() (Johan Hovold)
  - drm/vmwgfx: Fix an error return check in vmw_compat_shader_add() (Haoxiang Li)
  - drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel (Marek Vasut) [Orabug: 38930830] {CVE-2026-23049}
  - drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare (Lyude Paul)
  - mm/page_alloc: make percpu_pagelist_high_fraction reads lock-free (Aboorva Devarajan)
  - x86/resctrl: Fix memory bandwidth counter width for Hygon (Xiaochen Shen)
  - x86/resctrl: Add missing resctrl initialization for Hygon (Xiaochen Shen)
  - EDAC/i3200: Fix a resource leak in i3200_probe1() (Haoxiang Li)
  - EDAC/x38: Fix a resource leak in x38_probe1() (Haoxiang Li)
  - hrtimer: Fix softirq base check in update_needs_ipi() (Thomas Weißschuh)
  - ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref (Yangerkun) [Orabug: 38970601] {CVE-2026-23145}
  - nvme-pci: disable secondary temp for Wodposit WPBSNM8 (Ilikara Zheng)
  - USB: serial: ftdi_sio: add support for PICAXE AXE027 cable (Ethan Nelson-Moore)
  - USB: serial: option: add Telit LE910 MBIM composition (Ulrich Mohr)
  - USB: OHCI/UHCI: Add soft dependencies on ehci_platform (Huacai Chen)
  - usb: dwc3: Check for USB4 IP_NAME (Thinh Nguyen)
  - phy: tegra: xusb: Explicitly configure HS_DISCON_LEVEL to 0x7 (Wayne Chang)
  - phy: rockchip: inno-usb2: fix communication disruption in gadget mode (Luca Ceresoli)
  - phy: rockchip: inno-usb2: fix disconnection in gadget mode (Louis Chauvet)
  - x86/kaslr: Recognize all ZONE_DEVICE users as physaddr consumers (Dan Williams)
  - net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts (Tetsuo Handa) [Orabug: 38887710] {CVE-2026-22997}
  - ALSA: pcm: Improve the fix for race of buffer access at PCM OSS layer (Jaroslav Kysela)
  - HID: usbhid: paper over wrong bNumDescriptor field (Benjamin Tissoires)
  - dmaengine: omap-dma: fix dma_pool resource leak in error paths (Xu Wang)
  - phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again) (Krzysztof Kozlowski)
  - phy: stm32-usphyc: Fix off by one in probe() (Dan Carpenter)
  - dmaengine: xilinx_dma: Fix uninitialized addr_width when "xlnx,addrwidth" property is missing (Suraj Gupta)
  - dmaengine: tegra-adma: Fix use-after-free (Sheetal)
  - mm, kfence: describe @slab parameter in __kfence_obj_info() (Bagas Sanjaya)
  - textsearch: describe @list member in ts_ops search (Bagas Sanjaya)
  - ASoC: tlv320adcx140: fix word length (Emil Svendsen)
  - net/sched: sch_qfq: do not free existing class in qfq_change_class() (Eric Dumazet) [Orabug: 38887718] {CVE-2026-22999}
  - selftests: drv-net: fix RPS mask handling for high CPU numbers (Gal Pressman)
  - net/mlx5e: Restore destroying state bit after profile cleanup (Saeed Mahameed)
  - vsock/test: add a final full barrier after run all tests (Stefano Garzarella)
  - ipv4: ip_gre: make ipgre_header() robust (Eric Dumazet) [Orabug: 38887758] {CVE-2026-23011}
  - macvlan: fix possible UAF in macvlan_forward_source() (Eric Dumazet) [Orabug: 38887730] {CVE-2026-23001}
  - net: update netdev_lock_{type,name} (Eric Dumazet)
  - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (Eric Dumazet) [Orabug: 38887738] {CVE-2026-23003}
  - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (Shivam Kumar) [Orabug: 38887714] {CVE-2026-22998}
  - nvmet-tcp: remove boilerplate code (Maurizio Lombardi)
  - can: etas_es58x: allow partial RX URB allocation to succeed (Szymon Wilczek)
  - pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() (Zilin Guan) [Orabug: 38914816] {CVE-2026-23038}
  - LTS version: v5.15.198 (Vijayendra Suman)
  - NFS: add barriers when testing for NFS_FSDATA_BLOCKED (Neil Brown)
  - NFS: unlink/rmdir shouldn't call d_delete() twice on ENOENT (Neil Brown)
  - efi/cper: Fix cper_bits_to_str buffer handling and return value (Dandan Zhang)
  - firmware: imx: scu-irq: Set mu_resource_id before get handle (Peng Fan)
  - scsi: sg: Fix occasional bogus elapsed time that exceeds timeout (Michal Rábek)
  - ASoC: fsl_sai: Add missing registers to cache default (Alexander Stein)
  - can: j1939: make j1939_session_activate() fail if device is no longer registered (Tetsuo Handa) [Orabug: 38914675] {CVE-2025-71182}
  - powercap: fix sscanf() error return value handling (Sumeet Pawnikar)
  - powercap: fix race condition in register_control_type() (Sumeet Pawnikar)
  - blk-throttle: Set BIO_THROTTLED when bio has been throttled (Laibin Qiu)
  - pinctrl: qcom: lpass-lpi: mark the GPIO controller as sleeping (Bartosz Golaszewski)
  - pinctrl: qcom: lpass-lpi: Remove duplicate assignment of of_gpio_n_cells (Andy Shevchenko)
  - counter: interrupt-cnt: Drop IRQF_NO_THREAD flag (Alexander Sverdlin)
  - nfsd: provide locking for v4_end_grace (Neil Brown) [Orabug: 38887659] {CVE-2026-22980}
  - NFSD: Remove NFSERR_EAGAIN (Chuck Lever)
  - nfs_common: factor out nfs_errtbl and nfs_stat_to_errno (Mike Snitzer)
  - NFS: trace: show TIMEDOUT instead of 0x6e (Chen Hanxiao)
  - arp: do not assume dev_hard_header() does not change skb->head (Eric Dumazet) [Orabug: 39004363] {CVE-2026-22988}
  - net: usb: pegasus: fix memory leak in update_eth_regs_async() (Petko Manolov) [Orabug: 38914761] {CVE-2026-23021}
  - net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset (Xiang Mei) [Orabug: 38872325] {CVE-2026-22976}
  - HID: quirks: work around VID/PID conflict for appledisplay (René Rebe)
  - bnxt_en: Fix potential data corruption with HW GRO/LRO (Srijit Bose)
  - net/mlx5e: Don't print error message due to invalid module (Gal Pressman)
  - netdev: preserve NETIF_F_ALL_FOR_ALL across TSO updates (Di Zhu)
  - net: sock: fix hardened usercopy panic in sock_recv_errqueue (Weiming Shi) [Orabug: 38877947] {CVE-2026-22977}
  - inet: ping: Fix icmp out counting (Yuan Gao)
  - net: mscc: ocelot: Fix crash when adding interface under a lag (Jerry Wu)
  - bridge: fix C-VLAN preservation in 802.1ad vlan_tunnel egress (Alexandre Knecht)
  - net: marvell: prestera: fix NULL dereference on devlink_alloc() failure (Alok Tiwari)
  - netfilter: nf_conncount: update last_gc only when GC has been performed (Fernando Fernandez Mancera) [Orabug: 38970278] {CVE-2026-23139}
  - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Zilin Guan)
  - netfilter: nft_synproxy: avoid possible data-race on update operation (Fernando Fernandez Mancera)
  - ARM: dts: imx6q-ba16: fix RTC interrupt level (Ian Ray)
  - arm64: dts: add off-on-delay-us for usdhc2 regulator (Haibo Chen)
  - scsi: Revert "scsi: libsas: Fix exp-attached device scan after probe failure scanned in again after probe failed" (Xingui Yang)
  - scsi: ipr: Enable/disable IRQD_NO_BALANCING during reset (Wen Xiong)
  - NFS: Fix up the automount fs_context to use the correct cred (Trond Myklebust)
  - NFSv4: ensure the open stateid seqid doesn't go backwards (Scott Mayhew)
  - alpha: don't reference obsolete termio struct for TC* constants (Sam James)
  - ARM: 9461/1: Disable HIGHPTE on PREEMPT_RT kernels (Sebastian Andrzej Siewior)
  - csky: fix csky_cmpxchg_fixup not working (Yang Li)
  - ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() (Ye Bin) [Orabug: 37844521] {CVE-2025-22121}
  - ext4: introduce ITAIL helper (Ye Bin)
  - libceph: make calc_target() set t->paused, not just clear it (Ilya Dryomov) [Orabug: 38930821] {CVE-2026-23047}
  - libceph: return the handler error from mon_handle_auth_done() (Ilya Dryomov) [Orabug: 38887697] {CVE-2026-22992}
  - libceph: make free_choose_arg_map() resilient to partial allocation (Tuo Li) [Orabug: 38887691] {CVE-2026-22991}
  - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (Ilya Dryomov) [Orabug: 38887685] {CVE-2026-22990}
  - libceph: prevent potential out-of-bounds reads in handle_auth_done() (Ziming Zhang) [Orabug: 38887673] {CVE-2026-22984}
  - wifi: avoid kernel-infoleak from struct iw_point (Eric Dumazet) [Orabug: 38887650] {CVE-2026-22978}
  - drm/pl111: Fix error handling in pl111_amba_probe (Miaoqian Lin)
  - lib/crypto: aes: Fix missing MMU protection for AES S-box (Eric Biggers)
  - mei: me: add nova lake point S DID (Alexander Usyskin)
  - net: 3com: 3c59x: fix possible null dereference in vortex_probe1() (Thomas Fourier) [Orabug: 38914755] {CVE-2026-23020}
  - atm: Fix dma_free_coherent() size (Thomas Fourier)
  - usb: gadget: lpc32xx_udc: fix clock imbalance in error path (Johan Hovold)
  - net: ethtool: fix the error condition in ethtool_get_phy_stats_ethtool() (Su Hui) [Orabug: 39004163] {CVE-2024-40928}
  - firmware: arm_scmi: Fix unused notifier-block in unregister (Amitai Gottlieb)
  - ext4: fix error message when rejecting the default hash (Gabriel Krisman Bertazi)
  - ext4: factor out ext4_hash_info_init() (Jason Yan)
  - ext4: filesystems without casefold feature cannot be mounted with siphash (Lizhi Xu) [Orabug: 37206152] {CVE-2024-49968}
  - pwm: stm32: Always program polarity (Sean Nyekjaer)
  - x86: remove __range_not_ok() (Arnd Bergmann)
  - selftests: net: test_vxlan_under_vrf: fix HV connectivity test (Andrea Righi)
  - ipv4: Fix uninit-value access in __ip_make_skb() (Shigeru Yoshida) [Orabug: 36683410] {CVE-2024-36927}
  - ipv6: Fix potential uninit-value access in __ip6_make_skb() (Shigeru Yoshida) [Orabug: 36683284] {CVE-2024-36903}
  - KVM: arm64: sys_regs: disable -Wuninitialized-const-pointer warning (Justin Stitt)
  - HID: core: Harden s32ton() against conversion to 0 bits (Alan Stern) [Orabug: 38334903] {CVE-2025-38556}
  - KVM: x86: Acquire kvm->srcu when handling KVM_SET_VCPU_EVENTS (Sean Christopherson) [Orabug: 37116451] {CVE-2024-46830}
  - page_pool: Fix use-after-free in page_pool_recycle_in_ring (Dong Chenchen) [Orabug: 38152994] {CVE-2025-38129}
  - drm/i915/selftests: fix subtraction overflow bug (Andrzej Hajda)
  - mmc: core: use sysfs_emit() instead of sprintf() (Sergey Shtylyov)
  - net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF. (Thadeu Lima de Souza Cascardo) [Orabug: 37844500] {CVE-2025-22111}
  - drm/gma500: Remove unused helper psb_fbdev_fb_setcolreg() (Thomas Zimmermann)
  - wifi: mac80211: Discard Beacon frames to non-broadcast address (Jouni Malinen) [Orabug: 38852361] {CVE-2025-71127}
  - ASoC: stm32: sai: fix OF node leak on probe (Johan Hovold)
  - lockd: fix vfs_test_lock() calls (Neil Brown)
  - powerpc/pseries/cmm: adjust BALLOON_MIGRATE when migrating pages (David Hildenbrand)
  - mm/balloon_compaction: convert balloon_page_delete() to balloon_page_finalize() (David Hildenbrand)
  - mm/balloon_compaction: we cannot have isolated pages in the balloon list (David Hildenbrand)
  - mm/balloon_compaction: make balloon page compaction callbacks static (Miaohe Lin)
  - ASoC: stm32: sai: fix clk prepare imbalance on probe failure (Johan Hovold)
  - ASoC: stm32: sai: Use the devm_clk_get_optional() helper (Christophe Jaillet)
  - ASoC: stm: Use dev_err_probe() helper (Kuninori Morimoto)
  - r8169: fix RTL8117 Wake-on-Lan in DASH mode (René Rebe)
  - iommu/qcom: fix device leak on of_xlate() (Johan Hovold)
  - powerpc/64s/slb: Fix SLB multihit issue during SLB preload (Donet Tom)
  - PCI: brcmstb: Fix disabling L0s capability (Jim Quinlan)
  - powerpc/pseries/cmm: call balloon_devinfo_init() also without CONFIG_BALLOON_COMPACTION (David Hildenbrand)
  - media: renesas: rcar_drif: fix device node reference leak in rcar_drif_bond_enabled (Miaoqian Lin)
  - media: samsung: exynos4-is: fix potential ABBA deadlock on init (Marek Szyprowski)
  - NFSD: NFSv4 file creation neglects setting ACL (Chuck Lever) [Orabug: 38847872] {CVE-2025-68803}
  - media: verisilicon: Protect G2 HEVC decoder against invalid DPB index (Nicolas Dufresne)
  - media: vpif_capture: fix section mismatch (Johan Hovold)
  - media: mediatek: vcodec: Fix a reference leak in mtk_vcodec_fw_vpu_init() (Haoxiang Li)
  - SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf (Joshua Rogers) [Orabug: 38852341] {CVE-2025-71120}
  - KVM: SVM: Mark VMCB_NPT as dirty on nested VMRUN (Jim Mattson)
  - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Shivani Agarwal) [Orabug: 38852312] {CVE-2025-71113}
  - svcrdma: bound check rq_pages index in inline path (Joshua Rogers) [Orabug: 38847976] {CVE-2025-71068}
  - ARM: dts: microchip: sama7g5: fix uart fifo size to 32 (Nicolas Ferre)
  - usb: ohci-nxp: fix device leak on probe failure (Johan Hovold)
  - usb: ohci-nxp: Use helper function devm_clk_get_enabled() (Zhang Zekun)
  - mptcp: pm: ignore unknown endpoint flags (Matthieu Baerts)
  - usb: dwc3: keep susphy enabled during exit to avoid controller faults (Udipto Goswami)
  - f2fs: fix to avoid updating zero-sized extent in extent cache (Chao Yu)
  - f2fs: fix to propagate error from f2fs_enable_checkpoint() (Chao Yu)
  - f2fs: use global inline_xattr_slab instead of per-sb slab cache (Chao Yu)
  - f2fs: fix to detect recoverable inode during dryrun of find_fsync_dnodes() (Chao Yu)
  - xfs: fix a memory leak in xfs_buf_item_init() (Haoxiang Li)
  - KVM: nVMX: Immediately refresh APICv controls as needed on nested VM-Exit (Dongli Zhang)
  - NFSD: Clear SECLABEL in the suppattr_exclcreat bitmap (Chuck Lever)
  - ALSA: wavefront: Fix integer overflow in sample size validation (Junrui Luo)
  - ALSA: wavefront: Use standard print API (Takashi Iwai)
  - ALSA: wavefront: Clear substream pointers on close (Junrui Luo)
  - wifi: mt76: Fix DTS power-limits on little endian systems (Sven Eckelmann)
  - btrfs: don't rewrite ret from inode_permission (Josef Bacik)
  - tpm: Cap the number of PCR banks (Jarkko Sakkinen) [Orabug: 38848017] {CVE-2025-71077}
  - jbd2: fix the inconsistency between checksum and data in memory for journal sb (Ye Bin)
  - xhci: dbgtty: fix device unregister (Łukasz Bartosik)
  - xhci: dbgtty: use IDR to support several dbc instances. (Mathias Nyman)
  - usb: gadget: udc: fix use-after-free in usb_gadget_state_work (Jimmy Hu) [Orabug: 38773636] {CVE-2025-68282}
  - usb: xhci: Apply the link chain quirk on NEC isoc endpoints (Michał Pecio) [Orabug: 37844150] {CVE-2025-22022}
  - usb: xhci: move link chain bit quirk checks into one helper function. (Niklas Neronin)
  - drm/vmwgfx: Fix a null-ptr access in the cursor snooper (Zack Rusin) [Orabug: 38643537] {CVE-2025-40110}
  - virtio_console: fix order of fields cols and rows (Maximilian Immanuel Brandtner)
  - kbuild: Use CRC32 and a 1MiB dictionary for XZ compressed modules (Martin Nybo Andersen)
  - mm/damon/tests/core-kunit: handle memory alloc failure from damon_test_aggregate() (Seongjae Park)
  - mm/damon/tests/core-kunit: handle alloc failures on damon_test_split_regions_of() (Seongjae Park)
  - mm/damon/tests/core-kunit: handle memory failure from damon_test_target() (Seongjae Park)
  - mm/damon/tests/core-kunit: handle alloc failures on damon_test_merge_two() (Seongjae Park)
  - mm/damon/tests/core-kunit: handle alloc failures on dasmon_test_merge_regions_of() (Seongjae Park)
  - mm/damon/tests/core-kunit: handle alloc failures on damon_test_split_at() (Seongjae Park)
  - mm/damon/tests/core-kunit: handle allocation failures in damon_test_regions() (Seongjae Park)
  - mm/damon/tests/vaddr-kunit: handle alloc failures on damon_test_split_evenly_succ() (Seongjae Park)
  - RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem (Zhu Yanjun) [Orabug: 38094814] {CVE-2025-38022}
  - mm/damon/tests/vaddr-kunit: handle alloc failures on damon_do_test_apply_three_regions() (Seongjae Park)
  - mm/damon/tests/vaddr-kunit: handle alloc failures in damon_test_split_evenly_fail() (Seongjae Park)
  - drm/nouveau/dispnv50: Don't call drm_atomic_get_crtc_state() in prepare_fb (Lyude Paul)
  - drm/ttm: Avoid NULL pointer deref for evicted BOs (Simon Richter) [Orabug: 38848052] {CVE-2025-71083}
  - drm/msm/a6xx: Fix out of bound IO access in a6xx_get_gmu_registers (Akhil P Oommen)
  - net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write (Deepanshu Kartikey)
  - net: usb: sr9700: fix incorrect command used to write single register (Ethan Nelson-Moore)
  - nfsd: Drop the client reference in client_states_open() (Haoxiang Li)
  - fjes: Add missing iounmap in fjes_hw_init() (Haoxiang Li)
  - e1000: fix OOB in e1000_tbi_should_accept() (Guangshuo Li) [Orabug: 38848099] {CVE-2025-71093}
  - RDMA/cm: Fix leaking the multicast GID table reference (Jason Gunthorpe) [Orabug: 38848058] {CVE-2025-71084}
  - RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly (Jason Gunthorpe) [Orabug: 38848117] {CVE-2025-71096}
  - idr: fix idr_alloc() returning an ID out of range (Matthew Wilcox)
  - media: i2c: adv7842: Remove redundant cancel_delayed_work in probe (Duoming Zhou)
  - media: i2c: ADV7604: Remove redundant cancel_delayed_work in probe (Duoming Zhou)
  - media: TDA1997x: Remove redundant cancel_delayed_work in probe (Duoming Zhou)
  - media: msp3400: Avoid possible out-of-bounds array accesses in msp3400c_thread() (Ivan Abramov)
  - media: cec: Fix debugfs leak on bus_register() failure (Xu Wang)
  - fbdev: tcx.c fix mem_map to correct smem_start offset (René Rebe)
  - fbdev: pxafb: Fix multiple clamped values in pxafb_adjust_timing (Thorsten Blum)
  - fbdev: gbefb: fix to use physical address instead of dma address (René Rebe)
  - dm-ebs: Mark full buffer dirty even on partial write (Uladzislau Rezki)
  - media: adv7842: Avoid possible out-of-bounds array accesses in adv7842_cp_log_status() (Ivan Abramov)
  - parisc: entry: set W bit for !compat tasks in syscall_restore_rfi() (Sven Schnelle)
  - parisc: entry.S: fix space adjustment on interruption for 64-bit userspace (Sven Schnelle)
  - media: rc: st_rc: Fix reset control resource leak (Xu Wang)
  - mfd: max77620: Fix potential IRQ chip conflict when probing two devices (Krzysztof Kozlowski)
  - mfd: altera-sysmgr: Fix device leak on sysmgr regmap lookup (Johan Hovold)
  - leds: leds-lp50xx: LP5009 supports 3 modules for a total of 9 LEDs (Christian Hitz)
  - leds: leds-lp50xx: Allow LED 0 to be added to module bank (Christian Hitz)
  - PCI/PM: Reinstate clearing state_saved in legacy and !PM codepaths (Lukas Wunner)
  - HID: logitech-dj: Remove duplicate error logging (Hans de Goede)
  - iommu/tegra: fix device leak on probe_device() (Johan Hovold)
  - iommu/sun50i: fix device leak on of_xlate() (Johan Hovold)
  - iommu/omap: fix device leaks on probe_device() (Johan Hovold)
  - iommu/mediatek: fix device leak on of_xlate() (Johan Hovold)
  - iommu/mediatek-v1: fix device leak on probe_device() (Johan Hovold)
  - iommu/ipmmu-vmsa: fix device leak on of_xlate() (Johan Hovold)
  - iommu/exynos: fix device leak on of_xlate() (Johan Hovold)
  - iommu/apple-dart: fix device leak on of_xlate() (Johan Hovold)
  - ASoC: qcom: qdsp6: q6asm-dai: set 10 ms period and buffer alignment. (Srinivas Kandagatla)
  - ASoC: qcom: q6adm: the the copp device only during last instance (Srinivas Kandagatla)
  - ASoC: qcom: q6asm-dai: perform correct state check before closing (Srinivas Kandagatla)
  - ASoC: stm32: sai: fix device leak on probe (Johan Hovold)
  - selftests/ftrace: traceonoff_triggers: strip off names (Yipeng Zou)
  - RDMA/bnxt_re: fix dma_free_coherent() pointer (Thomas Fourier)
  - RDMA/rtrs: Fix clt_path::max_pages_per_mr calculation (Lihonggang)
  - RDMA/bnxt_re: Fix to use correct page size for PDE table (Kalesh Ap)
  - RDMA/bnxt_re: Fix IB_SEND_IP_CSUM handling in post_send (Alok Tiwari)
  - RDMA/bnxt_re: Fix incorrect BAR check in bnxt_qplib_map_creq_db() (Alok Tiwari)
  - RDMA/core: Fix logic error in ib_get_gids_from_rdma_hdr() (Jang Ingyu)
  - RDMA/efa: Remove possible negative shift (Michael Margolin)
  - RDMA/irdma: avoid invalid read in irdma_net_event (Michal Schmidt) [Orabug: 38852379] {CVE-2025-71133}
  - net: rose: fix invalid array index in rose_kill_by_device() (Pwnverse)
  - ipv4: Fix reference count leak when using error routes with nexthop objects (Ido Schimmel) [Orabug: 38848125] {CVE-2025-71097}
  - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (Will Rosenberg) [Orabug: 38848061] {CVE-2025-71085}
  - octeontx2-pf: fix "UBSAN: shift-out-of-bounds error" (Anshumali Gaur)
  - net: bridge: Describe @tunnel_hash member in net_bridge_vlan_group struct (Bagas Sanjaya)
  - net: usb: asix: validate PHY address before use (Deepanshu Kartikey) [Orabug: 38848107] {CVE-2025-71094}
  - net: dsa: b53: skip multicast entries for fdb_dump() (Jonas Gorski)
  - firewire: nosy: Fix dma_free_coherent() size (Thomas Fourier)
  - genalloc.h: fix htmldocs warning (Andrew Morton)
  - smc91x: fix broken irq-context in PREEMPT_RT (Levi Yun) [Orabug: 38852376] {CVE-2025-71132}
  - net: usb: rtl8150: fix memory leak on usb_submit_urb() failure (Deepakkumar Karn) [Orabug: 38887620] {CVE-2025-71154}
  - team: fix check for port enabled in team_queue_override_port_prio_changed() (Jiri Pirko) [Orabug: 38848088] {CVE-2025-71091}
  - platform/x86: ibm_rtl: fix EBDA signature search pointer arithmetic (Junrui Luo)
  - platform/x86: msi-laptop: add missing sysfs_remove_group() (Thomas Fourier)
  - ip6_gre: make ip6gre_header() robust (Eric Dumazet) [Orabug: 38848131] {CVE-2025-71098}
  - net: openvswitch: Avoid needlessly taking the RTNL on vport destroy (Toke Høiland-Jørgensen)
  - net: mdio: aspeed: add dummy read to avoid read-after-write issue (Jacky Chou)
  - net: mdio: aspeed: move reg accessing part into separate functions (Potin Lai)
  - Bluetooth: btusb: revert use of devm_kzalloc in btusb (Raphael Pinsonneault-Thibeault) [Orabug: 38848044] {CVE-2025-71082}
  - crypto: seqiv - Do not use req->iv after crypto_aead_encrypt (Herbert Xu) [Orabug: 38852370] {CVE-2025-71131}
  - iavf: fix off-by-one issues in iavf_config_rss_reg() (Kohei Enju) [Orabug: 38848073] {CVE-2025-71087}
  - i40e: Refactor argument of i40e_detect_recover_hung() (Ivan Vecera)
  - i40e: Refactor argument of several client notification functions (Ivan Vecera)
  - i40e: fix scheduling in set_rx_mode (Przemyslaw Korba)
  - hwmon: (w83l786ng) Convert macros to functions to avoid TOCTOU (Gui-Dong Han)
  - hwmon: (w83791d) Convert macros to functions to avoid TOCTOU (Gui-Dong Han) [Orabug: 38852300] {CVE-2025-71111}
  - hwmon: (max16065) Use local variable to avoid TOCTOU (Gui-Dong Han)
  - i2c: amd-mp2: fix reference leak in MP2 PCI device (Ma Ke)
  - rpmsg: glink: fix rpmsg device leak (Srinivas Kandagatla)
  - soc: amlogic: canvas: fix device leak on lookup (Johan Hovold)
  - soc: qcom: ocmem: fix device leak on lookup (Johan Hovold)
  - amba: tegra-ahb: Fix device leak on SMMU enable (Johan Hovold)
  - drm/amd/display: Use GFP_ATOMIC in dc_create_plane_state() (Alex Deucher)
  - io_uring: fix filename leak in __io_openat_prep() (Prithvi Tambewagh)
  - svcrdma: return 0 on success from svc_rdma_copy_inline_range (Joshua Rogers)
  - nfsd: Mark variable __maybe_unused to avoid W=1 build break (Andy Shevchenko)
  - fsnotify: do not generate ACCESS/MODIFY events on child for special files (Amir Goldstein) [Orabug: 38847800] {CVE-2025-68788}
  - tracing: Do not register unsupported perf events (Steven Rostedt) [Orabug: 38852355] {CVE-2025-71125}
  - KVM: nSVM: Clear exit_code_hi in VMCB when synthesizing nested VM-Exits (Sean Christopherson)
  - KVM: nSVM: Set exit_code_hi to -1 when synthesizing SVM_EXIT_ERR (failed VMRUN) (Sean Christopherson)
  - KVM: nSVM: Propagate SVM_EXIT_CR0_SEL_WRITE correctly for LMSW emulation (Yosry Ahmed)
  - KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer (Fuqiang Wang) [Orabug: 38852273] {CVE-2025-71104}
  - KVM: x86: Explicitly set new periodic hrtimer expiration in apic_timer_fn() (Fuqiang Wang)
  - KVM: x86: WARN if hrtimer callback for periodic APIC timer fires with period=0 (Sean Christopherson)
  - libceph: make decode_pool() more resilient against corrupted osdmaps (Ilya Dryomov) [Orabug: 38852325] {CVE-2025-71116}
  - parisc: Do not reprogram affinitiy on ASP chip (Helge Deller)
  - scs: fix a wrong parameter in __scs_magic (Zhichi Lin)
  - platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver (Tzung-Bi Shih)
  - ocfs2: fix kernel BUG in ocfs2_find_victim_chain (Prithvi Tambewagh) [Orabug: 38847688] {CVE-2025-68771}
  - media: vidtv: initialize local pointers upon transfer of memory ownership (Jeongjun Park)
  - tools/testing/nvdimm: Use per-DIMM device handle (Alison Schofield)
  - f2fs: fix return value of f2fs_recover_fsync_data() (Chao Yu)
  - f2fs: invalidate dentry cache on failed whiteout creation (Deepanshu Kartikey)
  - scsi: target: Reset t_task_cdb pointer in error case (Andrey Vatoropin) [Orabug: 38847770] {CVE-2025-68782}
  - NFSD: use correct reservation type in nfsd4_scsi_fence_client (Dai Ngo)
  - scsi: aic94xx: fix use-after-free in device removal path (Junrui Luo) [Orabug: 38848009] {CVE-2025-71075}
  - scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" (Tony Battersby) [Orabug: 38847931] {CVE-2025-68818}
  - cpufreq: nforce2: fix reference count leak in nforce2 (Miaoqian Lin)
  - intel_th: Fix error handling in intel_th_output_open (Ma Ke)
  - char: applicom: fix NULL pointer dereference in ac_ioctl (Tianchu Chen)
  - usb: renesas_usbhs: Fix a resource leak in usbhs_pipe_malloc() (Haoxiang Li)
  - usb: dwc3: of-simple: fix clock resource leak in dwc3_of_simple_probe (Miaoqian Lin)
  - usb: phy: isp1301: fix non-OF device reference imbalance (Johan Hovold)
  - USB: lpc32xx_udc: Fix error handling in probe (Ma Ke)
  - phy: broadcom: bcm63xx-usbh: fix section mismatches (Johan Hovold)
  - media: pvrusb2: Fix incorrect variable used in trace message (Colin Ian King)
  - media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg() (Jeongjun Park) [Orabug: 38847937] {CVE-2025-68819}
  - usb: usb-storage: Maintain minimal modifications to the bcdDevice range. (Chenchangcheng)
  - media: v4l2-mem2mem: Fix outdated documentation (Laurent Pinchart)
  - jbd2: use a weaker annotation in journal handling (Byungchul Park)
  - ext4: fix incorrect group number assertion in mb_check_buddy (Yongjian Sun)
  - ext4: xattr: fix null pointer deref in ext4_raw_inode() (Karina Yankevich) [Orabug: 38848276] {CVE-2025-68820}
  - ktest.pl: Fix uninitialized var in config-bisect.pl (Steven Rostedt)
  - floppy: fix for PAGE_SIZE != 4KB (René Rebe)
  - block: rate-limit capacity change info log (Li Chen)
  - lib/crypto: x86/blake2s: Fix 32-bit arg treated as 64-bit (Eric Biggers)
  - mmc: sdhci-msm: Avoid early clock doubling during HS400 transition (Sarthak Garg)
  - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Jarkko Sakkinen) [Orabug: 38887597] {CVE-2025-71147}
  - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella)
  - platform/x86/intel/hid: Add Dell Pro Rugged 10/12 tablet to VGBS DMI quirks (Chia-Lin Kao)
  - nvme-fc: don't hold rport lock when putting ctrl (Daniel Wagner)
  - serial: sprd: Return -EPROBE_DEFER when uart clock is not ready (Wenhua Lin)
  - usb: usb-storage: No additional quirks need to be added to the EL-R12 optical drive. (Chenchangcheng)
  - usb: xhci: limit run_graceperiod for only usb 3.0 devices (Hongyu Xie)
  - usb: typec: ucsi: Handle incorrect num_connectors capability (Mark Pearson) [Orabug: 38852285] {CVE-2025-71108}
  - usbip: Fix locking bug in RT-enabled kernels (Lizhi Xu)
  - exfat: fix remount failure in different process environments (Yuezhang Mo)
  - via_wdt: fix critical boot hang due to unnamed resource allocation (Li Qiang) [Orabug: 38852318] {CVE-2025-71114}
  - scsi: qla2xxx: Use reinit_completion on mbx_intr_comp (Tony Battersby)
  - scsi: qla2xxx: Fix initiator mode with qlini_mode=exclusive (Tony Battersby)
  - scsi: qla2xxx: Fix lost interrupts with qlini_mode=disabled (Tony Battersby)
  - powerpc/addnote: Fix overflow on 32-bit builds (Ben Collins)
  - clk: mvebu: cp110 add CLK_IGNORE_UNUSED to pcie_x10, pcie_x11 & pcie_x4 (Josua Mayer)
  - ti-sysc: allow OMAP2 and OMAP4 timers to be reserved on AM33xx (Matthias Schiffer)
  - firmware: imx: scu-irq: Init workqueue before request mbox channel (Peng Fan)
  - ipmi: Fix __scan_channels() failing to rescan channels (Jinhui Guo)
  - ipmi: Fix the race between __scan_channels() and deliver_response() (Jinhui Guo)
  - ALSA: usb-mixer: us16x08: validate meter packet indices (Shipei Qu) [Orabug: 38847775] {CVE-2025-68783}
  - ALSA: pcmcia: Fix resource leak in snd_pdacf_probe error path (Xu Wang)
  - ALSA: vxpocket: Fix resource leak in vxpocket_probe error path (Xu Wang)
  - net/hsr: fix NULL pointer dereference in prp_get_untagged_frame() (Shaurya Rane) [Orabug: 38847724] {CVE-2025-68776}
  - mmc: sdhci-esdhc-imx: add alternate ARCH_S32 dependency to Kconfig (Jared Kangas)
  - spi: fsl-cpm: Check length parity before switching to 16 bit mode (Christophe Leroy)
  - ACPI: CPPC: Fix missing PCC check for guaranteed_perf (Pengjie Zhang)
  - Input: i8042 - add TUXEDO InfinityBook Max Gen10 AMD to i8042 quirk table (Christoffer Sandberg)
  - Input: ti_am335x_tsc - fix off-by-one error in wire_order validation (Junjie Cao)
  - HID: input: map HID_GD_Z to ABS_DISTANCE for stylus/pen (Ping Cheng)
  - net: hns3: add VLAN id validation before using (Jian Shen)
  - net: hns3: using the num_tqps to check whether tqp_index is out of range when vf get ring info from mbx (Jian Shen)
  - net: hns3: Align type of some variables with their print type (Hao Chen)
  - net: hns3: using the num_tqps in the vf driver to apply for resources (Jian Shen)
  - net/mlx5: fw_tracer, Handle escaped percent properly (Shay Drory)
  - net/mlx5: fw_tracer, Validate format string parameters (Shay Drory) [Orabug: 38847914] {CVE-2025-68816}
  - ethtool: Avoid overflowing userspace buffer on stats query (Gal Pressman) [Orabug: 38847826] {CVE-2025-68795}
  - net/ethtool/ioctl: split ethtool_get_phy_stats into multiple helpers (Daniil Tatianin)
  - net/ethtool/ioctl: remove if n_stats checks from ethtool_get_phy_stats (Daniil Tatianin)
  - ethtool: use phydev variable (Tom Rix)
  - nfc: pn533: Fix error code in pn533_acr122_poweron_rdr() (Dan Carpenter)
  - net/sched: ets: Remove drr class from the active list if it changes to strict (Victor Nogueira) [Orabug: 38847910] {CVE-2025-68815}
  - caif: fix integer underflow in cffrml_receive() (Junrui Luo)
  - ipvs: fix ipv4 null-ptr-deref in route error path (Slavin Liu) [Orabug: 38847900] {CVE-2025-68813}
  - netfilter: nf_conncount: fix leaked ct in error paths (Fernando Fernandez Mancera) [Orabug: 38974757] {CVE-2025-71146}
  - broadcom: b44: prevent uninitialized value usage (Alexey Simakov)
  - net: openvswitch: fix middle attribute validation in push_nsh() action (Ilya Maximets) [Orabug: 38847784] {CVE-2025-68785}
  - mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats (Ido Schimmel)
  - mlxsw: spectrum_router: Fix neighbour use-after-free (Ido Schimmel)
  - ipvlan: Ignore PACKET_LOOPBACK in handle_mode_l2() (Dmitry Skorodumov)
  - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (Jamal Hadi Salim) [Orabug: 38847965] {CVE-2025-71066}
  - netrom: Fix memory leak in nr_sendmsg() (Wang Liang)
  - Bluetooth: btusb: Add new VID/PID 13d3/3533 for RTL8821CE (Gongwei Li)
  - btrfs: scrub: always update btrfs_scrub_progress::last_physical (Qu Wenruo)
  - hfsplus: fix volume corruption issue for generic/073 (Viacheslav Dubeyko)
  - hfsplus: Verify inode mode when loading from disk (Tetsuo Handa)
  - hfsplus: fix missing hfs_bnode_get() in __hfs_bnode_create (Yang Chenzhi)
  - hfsplus: fix volume corruption issue for generic/070 (Viacheslav Dubeyko)
  - fs/ntfs3: Support timestamps prior to epoch (Konstantin Komarov)
  - livepatch: Match old_sympos 0 and 1 in klp_find_func() (Song Liu)
  - cpufreq: s5pv210: fix refcount leak (Shuhao Fu)
  - ACPI: property: Use ACPI functions in acpi_graph_get_next_endpoint() only (Sakari Ailus)
  - ACPICA: Avoid walking the Namespace if start_node is NULL (Cryolitia Pukngae) [Orabug: 38852333] {CVE-2025-71118}
  - x86/ptrace: Always inline trivial accessors (Peter Zijlstra)
  - sched/deadline: only set free_cpus for online runqueues (Doug Berger) [Orabug: 38847753] {CVE-2025-68780}
  - btrfs: fix memory leak of fs_devices in degraded seed device path (Deepanshu Kartikey)
  - bpf, arm64: Do not audit capability check in do_jit() (Ondrej Mosnacek)
  - spi: tegra210-quad: Fix X1_X2_X4 encoding and support x4 transfers (Vishwaroop A)
  - coresight: etm4x: Correct polling IDLE bit (Leo Yan)
  - netfilter: nf_conncount: garbage collection is not skipped when jiffies wrap around (Nicklas Bo Jensen)
  - NFS: Fix missing unlock in nfs_unlink() (Sun Ke)
  - ASoC: fsl_xcvr: get channel status data when PHY is not exists (Shengjiu Wang)
  - ALSA: dice: fix buffer overflow in detect_stream_formats() (Junrui Luo) [Orabug: 38798767] {CVE-2025-68346}
  - usb: phy: Initialize struct usb_phy list_head (Diogo Ivo)
  - usb: gadget: tegra-xudc: Always reinitialize data toggle when clear halt (Haotien Hsu)
  - ocfs2: fix memory leak in ocfs2_merge_rec_left() (Dmitry Antipov)
  - efi/cper: align ARM CPER type with UEFI 2.9A/2.10 specs (Mauro Carvalho Chehab)
  - efi/cper: Adjust infopfx size to accept an extra space (Mauro Carvalho Chehab)
  - efi/cper: Add a new helper function to print bitmasks (Mauro Carvalho Chehab)
  - dm log-writes: Add missing set_freezable() for freezable kthread (Xu Wang)
  - dm-raid: fix possible NULL dereference with undefined raid type (Alexey Simakov)
  - ARM: 9464/1: fix input-only operand modification in load_unaligned_zeropad() (Pangliyuan)
  - ALSA: uapi: Fix typo in asound.h comment (Andres J Rosa)
  - dma/pool: eliminate alloc_pages warning in atomic_pool_expand (Dave Kleikamp)
  - blk-mq: Abort suspend when wakeup events are pending (Cong Zhang)
  - ASoC: ak5558: Disable regulator when error happens (Shengjiu Wang)
  - ASoC: ak4458: Disable regulator when error happens (Shengjiu Wang)
  - ASoC: bcm: bcm63xx-pcm-whistler: Check return value of of_dma_configure() (Xu Wang)
  - platform/x86: asus-wmi: use brightness_set_blocking() for kbd led (Anton Khirnov)
  - fs/nls: Fix inconsistency between utf8_to_utf32() and utf32_to_utf8() (Armin Wolf)
  - NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags (Trond Myklebust) [Orabug: 38818237] {CVE-2025-68764}
  - fs_context: drop the unused lsm_flags member (Ondrej Mosnacek)
  - Revert "nfs: ignore SB_RDONLY when mounting nfs" (Trond Myklebust)
  - Revert "nfs: clear SB_RDONLY before getting superblock" (Trond Myklebust)
  - Revert "nfs: ignore SB_RDONLY when remounting nfs" (Trond Myklebust)
  - NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (Jonathan Curley) [Orabug: 38798775] {CVE-2025-68349}
  - NFS: Initialise verifiers for visible dentries in nfs_atomic_open() (Trond Myklebust)
  - NFS: Fix the verifier for case sensitive filesystem in nfs_atomic_open() (Trond Myklebust)
  - NFSv4: Add some support for case insensitive filesystems (Trond Myklebust)
  - fs/nls: Fix utf16 to utf8 conversion (Armin Wolf)
  - NFS: Avoid changing nlink when file removes and attribute updates race (Trond Myklebust)
  - NFS: don't unhash dentry during unlink/rename (Neil Brown)
  - NFS: Label the dentry with a verifier in nfs_rmdir() and nfs_unlink() (Trond Myklebust)
  - fbdev: ssd1307fb: fix potential page leak in ssd1307fb_probe() (Abdun Nihaal)
  - pinctrl: single: Fix incorrect type for error return variable (Xu Wang)
  - pinctrl: single: Fix PIN_CONFIG_BIAS_DISABLE handling (Matthijs Kooijman)
  - perf tools: Fix split kallsyms DSO counting (Namhyung Kim)
  - remoteproc: qcom_q6v5_wcss: fix parsing of qcom,halt-regs (Alexandru Gagniuc)
  - mtd: lpddr_cmds: fix signed shifts in lpddr_cmds (Ivan Stepchenko)
  - net: stmmac: fix rx limit check in stmmac_rx_zc() (Alexey Kodanev)
  - netfilter: nft_connlimit: update the count if add was skipped (Fernando Fernandez Mancera)
  - netfilter: nf_conncount: rework API to use sk_buff directly (Fernando Fernandez Mancera)
  - netfilter: nf_conncount: reduce unnecessary GC (William Tu)
  - netfilter: flowtable: check for maximum number of encapsulations in bridge vlan (Pablo Neira Ayuso)
  - regulator: core: Protect regulator_supply_alias_list with regulator_list_mutex (Sparkhuang) [Orabug: 38798787] {CVE-2025-68354}
  - ASoC: Intel: catpt: Fix error path in hw_params() (Cezary Rojewski)
  - virtio: fix virtqueue_set_affinity() docs (Michael S. Tsirkin)
  - virtio_vdpa: fix misleading return in void function (Alok Tiwari)
  - ext4: improve integrity checking in __mb_check_buddy by enhancing order-0 validation (Yongjian Sun)
  - ext4: remove unused return value of __mb_check_buddy (Kemeng Shi)
  - ACPI: processor_core: fix map_x2apic_id for amd-pstate on am4 (René Rebe)
  - drm/amd/display: Fix logical vs bitwise bug in get_embedded_panel_info_v2_1() (Dan Carpenter)
  - ASoC: fsl_xcvr: clear the channel status control memory (Shengjiu Wang)
  - ASoC: fsl_xcvr: Add support for i.MX93 platform (Chancel Liu)
  - ASoC: fsl_xcvr: Add Counter registers (Shengjiu Wang)
  - RDMA/irdma: Fix data race in irdma_free_pble (Krzysztof Czurylo)
  - RDMA/irdma: Fix data race in irdma_sc_ccq_arm (Krzysztof Czurylo)
  - iommu/arm-smmu-qcom: Enable use of all SMR groups when running bare-metal (Stephan Gerhold)
  - backlight: lp855x: Fix lp855x.h kernel-doc warnings (Randy Dunlap)
  - backlight: led-bl: Add devlink to supplier LEDs (Luca Ceresoli)
  - backlight: led_bl: Take led_access lock when required (Mans Rullgard)
  - wifi: ieee80211: correct FILS status codes (Ria Thomas)
  - PCI: dwc: Fix wrong PORT_LOGIC_LTSSM_STATE_MASK definition (Shawn Lin)
  - staging: fbtft: core: fix potential memory leak in fbtft_probe_common() (Jianglei Nie)
  - mt76: mt7615: Fix memory leak in mt7615_mcu_wtbl_sta_add() (Zilin Guan)
  - crypto: ccree - Correctly handle return of sg_nents_for_len (Xu Wang)
  - selftests/bpf: Improve reliability of test_perf_branches_no_hw() (Matt Bobrowski)
  - selftests/bpf: skip test_perf_branches_hw() on unsupported platforms (Matt Bobrowski)
  - usb: dwc2: fix hang during suspend if set as peripheral (Jisheng Zhang)
  - usb: dwc2: fix hang during shutdown if set as peripheral (Jisheng Zhang)
  - usb: dwc2: disable platform lowlevel hw resources during shutdown (Jisheng Zhang)
  - usb: chaoskey: fix locking for O_NONBLOCK (Oliver Neukum)
  - ima: Handle error code returned by ima_filter_rule_match() (Zhao Yipeng) [Orabug: 38798922] {CVE-2025-68740}
  - wifi: rtl818x: rtl8187: Fix potential buffer underflow in rtl8187_rx_cb() (Seungjin Bae) [Orabug: 38798815] {CVE-2025-68362}
  - mfd: mt6358-irq: Fix missing irq_domain_remove() in error path (Xu Wang)
  - mfd: mt6397-irq: Fix missing irq_domain_remove() in error path (Xu Wang)
  - pwm: bcm2835: Make sure the channel is enabled after pwm_request() (Uwe Kleine-König)
  - drm/mediatek: Fix CCORR mtk_ctm_s31_32_to_s1_n function issue (Jay Liu)
  - fs/ntfs3: Prevent memory leaks in add sub record (Edward Adam Davis)
  - fs/ntfs3: out1 also needs to put mi (Edward Adam Davis)
  - fs/ntfs3: Make ni_ins_new_attr return error (Konstantin Komarov)
  - fs/ntfs3: Add new argument is_mft to ntfs_mark_rec_free (Konstantin Komarov)
  - fs/ntfs3: Remove unused mi_mark_free (Konstantin Komarov)
  - powerpc/64s/ptdump: Fix kernel_hash_pagetable dump for ISA v3.00 HPTE format (Ritesh Harjani)
  - wifi: rtl818x: Fix potential memory leaks in rtl8180_init_rx_ring() (Abdun Nihaal) [Orabug: 38818222] {CVE-2025-68759}
  - NFSD/blocklayout: Fix minlength check in proc_layoutget (Sergey Bashirov)
  - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Xu Wang)
  - watchdog: wdat_wdt: Stop watchdog when uninstalling module (Liu Xinpeng)
  - selftests/bpf: Fix failure paths in send_signal test (Alexei Starovoitov)
  - ps3disk: use memcpy_{from,to}_bvec index (René Rebe)
  - PCI: keystone: Exit ks_pcie_probe() for invalid mode (Siddharth Vadapalli)
  - leds: netxbig: Fix GPIO descriptor leak in error paths (Xu Wang)
  - scsi: sim710: Fix resource leak by adding missing ioport_unmap() calls (Xu Wang)
  - ACPI: property: Fix fwnode refcount leak in acpi_fwnode_graph_parse_endpoint() (Xu Wang)
  - ocfs2: relax BUG() to ocfs2_error() in __ocfs2_move_extent() (Dmitry Antipov) [Orabug: 38798824] {CVE-2025-68364}
  - lib/vsprintf: Check pointer before dereferencing in time_and_date() (Andy Shevchenko)
  - clk: renesas: r9a06g032: Fix memory leak in error path (Xu Wang)
  - coresight: etm4x: Add context synchronization before enabling trace (Leo Yan)
  - coresight: etm4x: Extract the trace unit controlling (Leo Yan)
  - coresight-etm4x: add isb() before reading the TRCSTATR (Yuanfang Zhang)
  - coresight: etm4x: Use Trace Filtering controls dynamically (Suzuki K Poulose)
  - coresight: etm4x: Save restore TRFCR_EL1 (Suzuki K Poulose)
  - nbd: defer config unlock in nbd_genl_connect (Zheng Qixing) [Orabug: 38798833] {CVE-2025-68366}
  - wifi: cw1200: Fix potential memory leak in cw1200_bh_rx_helper() (Abdun Nihaal)
  - macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse (Long Li) [Orabug: 38798838] {CVE-2025-68367}
  - powerpc/32: Fix unpaired stwcx. on interrupt exit (Christophe Leroy)
  - RDMA/rtrs: server: Fix error handling in get_or_create_srv (Ma Ke)
  - dt-bindings: PCI: amlogic: Fix the register name of the DBI region (Manivannan Sadhasivam)
  - dt-bindings: PCI: convert amlogic,meson-pcie.txt to dt-schema (Neil Armstrong)
  - scsi: stex: Fix reboot_notifier leak in probe error path (Xu Wang)
  - nbd: defer config put in recv_work (Zheng Qixing) [Orabug: 38798851] {CVE-2025-68372}
  - nbd: partition nbd_read_stat() into nbd_read_reply() and nbd_handle_reply() (Yu Kuai)
  - nbd: clean up return value checking of sock_xmit() (Yu Kuai)
  - regulator: core: disable supply if enabling main regulator fails (Gabor Juhos)
  - perf/x86/intel: Correct large PEBS flag check (Dapeng Mi)
  - ext4: correct the checking of quota files before moving extents (Zhang Yi)
  - ext4: minor defrag code improvements (Eric Whitney)
  - mfd: da9055: Fix missing regmap_del_irq_chip() in error path (Xu Wang)
  - spi: tegra210-quad: Fix timeout handling (Vishwaroop A) [Orabug: 38798944] {CVE-2025-68746}
  - spi: tegra210-quad: modify chip select (CS) deactivation (Vishwaroop A)
  - scsi: target: Do not write NUL characters into ASCII configfs output (Bart Van Assche)
  - power: supply: apm_power: only unset own apm_get_power_status (Ahelenia Ziemiańska)
  - power: supply: wm831x: Check wm831x_set_bits() return value (Ivan Abramov)
  - i3c: master: svc: Prevent incomplete IBI transaction (Stanley Chu)
  - i3c: fix refcount inconsistency in i3c_master_register (Frank Li)
  - pinctrl: stm32: fix hwspinlock resource leak in probe function (Xu Wang)
  - x86/dumpstack: Prevent KASAN false positive warnings in __show_regs() (Tengda Wu)
  - x86: kmsan: don't instrument stack walking functions (Alexander Potapenko)
  - kmsan: introduce __no_sanitize_memory and __no_kmsan_checks (Alexander Potapenko)
  - compiler-gcc.h: Define __SANITIZE_ADDRESS__ under hwaddress sanitizer (Kees Cook)
  - sctp: Defer SCTP_DBG_OBJCNT_DEC() to sctp_destroy_sock(). (Kuniyuki Iwashima)
  - phy: mscc: Fix PTP for VSC8574 and VSC8572 (Horatiu Vultur)
  - firmware: imx: scu-irq: fix OF node leak in (Peng Fan)
  - s390/ap: Don't leak debug feature files if AP instructions are not available (Heiko Carstens)
  - s390/smp: Fix fallback CPU detection (Heiko Carstens)
  - crypto: hisilicon/qm - restore original qos values (Nieweiqiang)
  - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (Thorsten Blum) [Orabug: 38798875] {CVE-2025-68724}
  - uio: uio_fsl_elbc_gpcm:: Add null pointer check to uio_fsl_elbc_gpcm_probe (Li Qiang)
  - arm64: dts: imx8mm-venice-gw72xx: remove unused sdhc1 pinctrl (Tim Harvey)
  - iio: imu: st_lsm6dsx: Fix measurement unit for odr struct member (Francesco Lavra)
  - iio: imu: st_lsm6dsx: discard samples during filters settling time (Lorenzo Bianconi)
  - iio: imu: st_lsm6dsx: introduce st_lsm6dsx_device_set_enable routine (Lorenzo Bianconi)
  - inet: Avoid ehash lookup race in inet_ehash_insert() (Luoxuanqiang)
  - rculist: Add hlist_nulls_replace_rcu() and hlist_nulls_replace_init_rcu() (Luoxuanqiang)
  - ntfs3: Fix uninit buffer allocated by __getname() (Sidharth Seela)
  - ntfs3: fix uninit memory after failed mi_read in mi_format_new (Raphael Pinsonneault-Thibeault)
  - irqchip/qcom-irq-combiner: Fix section mismatch (Johan Hovold)
  - USB: Fix descriptor count when handling invalid MBIM extended descriptor (Seungjin Bae)
  - drm/vgem-fence: Fix potential deadlock on release (Janusz Krzysztofik) [Orabug: 38818212] {CVE-2025-68757}
  - drm/panel: visionox-rm69299: Don't clear all mode flags (Guido Günther)
  - gpu: host1x: Fix race in syncpt alloc/free (Mainak Sen) [Orabug: 38798899] {CVE-2025-68732}
  - smack: fix bug: unprivileged task can create labels (Konstantin Andreev)
  - staging: rtl8723bs: fix out-of-bounds read in OnBeacon ESR IE parsing (Navaneeth K) [Orabug: 38773544] {CVE-2025-68254}
  - staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing (Navaneeth K) [Orabug: 38773554] {CVE-2025-68255}
  - comedi: check device's attached status in compat ioctls (Nikita Zhandarovich)
  - comedi: multiq3: sanitize config options in multiq3_attach() (Nikita Zhandarovich)
  - comedi: c6xdigio: Fix invalid PNP driver unregistration (Ian Abbott)
  - HID: elecom: Add support for ELECOM M-XT3URBK (018F) (Naoki Ueki)
  - platform/x86: huawei-wmi: add keys for HONOR models (Ston Jia)
  - platform/x86: acer-wmi: Ignore backlight event (Armin Wolf)
  - pinctrl: qcom: msm: Fix deadlock in pinmux configuration (Praveen Talari)
  - bfs: Reconstruct file type when loading from disk (Tetsuo Handa)
  - spi: imx: keep dma request disabled before dma transfer setup (Robin Gong)
  - spi: xilinx: increase number of retries before declaring stall (Alvaro Gamez Machado)
  - USB: serial: kobil_sct: fix TIOCMBIS and TIOCMBIC (Johan Hovold)
  - USB: serial: belkin_sa: fix TIOCMBIS and TIOCMBIC (Johan Hovold)
  - serial: add support of CPCI cards (Magne Bruno)
  - USB: serial: ftdi_sio: match on interface number for jtag (Johan Hovold)
  - USB: serial: option: move Telit 0x10c7 composition in the right place (Fabio Porcedda)
  - USB: serial: option: add Telit Cinterion FE910C04 new compositions (Fabio Porcedda)
  - USB: serial: option: add Foxconn T99W760 (Slark Xiao)
  - comedi: pcl818: fix null-ptr-deref in pcl818_ai_cancel() (Nikita Zhandarovich)
  - ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() (Alexey Nepomnyashih) [Orabug: 38773587] {CVE-2025-68261}
  - locking/spinlock/debug: Fix data-race in do_raw_write_lock (Alexander Sverdlin)
  - ext4: refresh inline data size before write operations (Deepanshu Kartikey) [Orabug: 38773603] {CVE-2025-68264}
  - jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted (Ye Bin) [Orabug: 38792633] {CVE-2025-68337}
  - Documentation: process: Also mention Sasha Levin as stable tree maintainer (Bagas Sanjaya)
  - leds: spi-byte: Use devm_led_classdev_register_ext() (Stefan Kalscheuer)
  - leds: Replace all non-returning strlcpy with strscpy (Azeem Shaikh)
  - drm/i915/selftests: Fix inconsistent IS_ERR and PTR_ERR (Kai Song)
  - dpaa2-mac: bail if the dpmacs fwnode is not found (Robert-Ionut Alexa)
  - xfrm: flush all states in xfrm_state_fini (Sabrina Dubroca)
  - xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added (Sabrina Dubroca) [Orabug: 39004269] {CVE-2025-40256}
  - Revert "xfrm: destroy xfrm_state synchronously on net exit path" (Sabrina Dubroca)


author: Samasth Norway Ananda <samasth.norway.ananda@oracle.com> [5.15.0-318.199.2.el9uek]
changelog:
  - drivers/soc/pensando/penfw: Add support for pcie serdes fw download. (Hiren Mehta) [Orabug: 38953591]
  - arm64: pensando: Add support for kpcimgr dynamic event queue (Rob Gardner) [Orabug: 38928823]
  - procfs: move dropping pde and pid from ->evict_inode() to ->free_inode() (Al Viro) [Orabug: 38945002]
  - ext4/jbd2: skip sb flush when EIO happened (Wengang Wang) [Orabug: 38188749]
  - jbd2: store more accurate errno in superblock when possible (Wengang Wang) [Orabug: 38188749]
  - Revert "IB/mlx5: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923519]
  - Revert "IB/core: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923519]
  - Revert "IB/core: Fix off-by-one attr index in setup_hw_port_stats" (Sharath Srinivasan) [Orabug: 38923519]
  - drivers/soc/pensando/bsm: Fix various issues with secure-mode. (Hiren Mehta) [Orabug: 38944299]
  - net/rds: wait_event_timeout until zero connections during rmmod (Sharath Srinivasan) [Orabug: 38928274]
  - net/rds: rds_send_xmit should INIT_LIST_HEAD(&to_be_dropped) on restart (Sharath Srinivasan) [Orabug: 38928272]
  - net/rds: fix rds_message memleak in rds_send_queue_rm (Sharath Srinivasan) [Orabug: 38928270]
  - net/rds: fix rds_message memleak in rds_send_xmit (Sharath Srinivasan) [Orabug: 38923496]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-318.199.3.el9uek]
changelog:
  - hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Kang Chen)
  - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Breno Leitao) [Orabug: 38970594] {CVE-2026-23202}
  - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Breno Leitao)
  - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Breno Leitao)
  - x86/kfence: fix booting on 32bit non-PAE systems (Andrew Cooper)
  - KVM: x86: Don't snapshot "max" TSC if host TSC is constant (Sean Christopherson) [Orabug: 38966500]
  - KVM: x86: Accept KVM_[GS]ET_TSC_KHZ as a VM ioctl. (David Woodhouse) [Orabug: 38966500]
  - sfc: fix NULL dereferences in ef100_process_design_param() (Edward Cree) [Orabug: 37855346] {CVE-2025-37860}
  - Revert "net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn" (Sharath Srinivasan) [Orabug: 38937481]
  - Revert "net/rds: expand kref coverage to rds_notifier->n_conn" (Sharath Srinivasan) [Orabug: 38937481]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-318.199.3.1.el9uek]
changelog:
  - nvme-pci: fix stuck reset on concurrent DPC and HP (Keith Busch)  [Orabug: 39026355]
  - nvme: cancel pending I/O if nvme controller is in terminal state (Nilay Shroff)  [Orabug: 39026355]
  - nvme-pci: fix queue unquiesce check on slot_reset (Keith Busch)  [Orabug: 39026355]
  - nvme: ensure disabling pairs with unquiesce (Keith Busch)  [Orabug: 39026355]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-318.199.3.2.el9uek]
changelog:
  - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Eric Dumazet)  [Orabug: 39057366]
  - macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet)  [Orabug: 39057366]  {CVE-2026-23209}
  - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano)  [Orabug: 39057346]  {CVE-2026-23111}
  - net: tunnel: make skb_vlan_inet_prepare() return drop reasons (Menglong Dong)  [Orabug: 39055945]


author: Jack Vogel <jack.vogel@oracle.com> [5.15.0-318.199.3.2.1.el9uek]
changelog:
  - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson)  [Orabug: 39071316]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-317.197.1.el9uek]
changelog:
  - LTS version: v5.15.197 (Vijayendra Suman)
  - libbpf: Fix invalid return address register in s390 (Daniel T. Lee)
  - libbpf, riscv: Use a0 for RC register (Yixun Lan)
  - libbpf: Fix riscv register names (Ilya Leoshkevich)
  - selftests/bpf: Don't rely on preserving volatile in PT_REGS macros in loop3 (Andrii Nakryiko)
  - scsi: pm80xx: Set phy->enable_completion only when we (Igor Pylypiv) [Orabug: 37159744] {CVE-2024-47666}
  - Bluetooth: Add more enc key size check (Alex Lu)
  - usb: renesas_usbhs: Fix synchronous external abort on unbind (Claudiu Beznea) [Orabug: 38792571] {CVE-2025-68327}
  - usb: renesas_usbhs: Convert to platform remove callback returning void (Uwe Kleine-König)
  - smb: client: fix memory leak in cifs_construct_tcon() (Paulo Alcantara) [Orabug: 38773704] {CVE-2025-68295}
  - mptcp: Fix proto fallback detection with BPF (Jiayuan Chen) [Orabug: 38773435] {CVE-2025-68227}
  - mptcp: avoid unneeded subflow-level drops (Paolo Abeni)
  - selftests: mptcp: join: rm: set backup flag (Matthieu Baerts)
  - staging: rtl8712: Remove driver using deprecated API wext (Philipp Hortmann)
  - libceph: prevent potential out-of-bounds writes in handle_auth_session_key() (Ziming Zhang) [Orabug: 38773649] {CVE-2025-68284}
  - libceph: fix potential use-after-free in have_mon_and_osd_map() (Ilya Dryomov) [Orabug: 38773655] {CVE-2025-68285}
  - drm/amd/display: Check NULL before accessing (Alex Hung) [Orabug: 38773664] {CVE-2025-68286}
  - drm: sti: fix device leaks at component probe (Johan Hovold)
  - USB: serial: option: add support for Rolling RW101R-GL (Vanillan Wang)
  - USB: serial: ftdi_sio: add support for u-blox EVK-M101 (Oleksandr Suvorov)
  - xhci: dbgtty: Fix data corruption when transmitting data form DbC to host (Mathias Nyman)
  - usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths (Manish Nagar) [Orabug: 38773671] {CVE-2025-68287}
  - usb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer (Owen Gu) [Orabug: 38792593] {CVE-2025-68331}
  - usb: storage: sddr55: Reject out-of-bound new_pba (Tianchu Chen) [Orabug: 38762730] {CVE-2025-40345}
  - usb: storage: Fix memory leak in USB bulk transport (Desnes Nunes) [Orabug: 38773677] {CVE-2018-1000204,CVE-2025-68288}
  - usb: gadget: f_eem: Fix memory leak in eem_unwrap (Kuen-Han Tsai) [Orabug: 38773687] {CVE-2025-68289}
  - usb: cdns3: Fix double resource release in cdns3_pci_probe (Miaoqian Lin)
  - serial: amba-pl011: prefer dma_mapping_error() over explicit address checking (Miaoqian Lin)
  - firmware: stratix10-svc: fix bug in saving controller data (Khairul Anuar Romli)
  - slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves (Miaoqian Lin)
  - thunderbolt: Add support for Intel Wildcat Lake (Alan Borzeszkowski)
  - drivers/usb/dwc3: fix PCI parent check (Jamie Iles)
  - dm-verity: fix unreliable memory allocation (Mikulas Patocka)
  - can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling (Marc Kleine-Budde)
  - can: sja1000: fix max irq loop handling (Thomas Mühlbacher)
  - atm/fore200e: Fix possible data race in fore200e_open() (Gui-Dong Han)
  - iio: accel: bmc150: Fix irq assumption regression (Linus Walleij) [Orabug: 38792587] {CVE-2025-68330}
  - iio:common:ssp_sensors: Fix an error handling path ssp_probe() (Christophe Jaillet)
  - iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields (Francesco Lavra)
  - Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()" (Jiri Olsa) [Orabug: 38893604]
  - spi: bcm63xx: fix premature CS deassertion on RX-only transactions (Hang Zhou)
  - mailbox: mailbox-test: Fix debugfs_create_dir error checking (Xu Wang)
  - net: atlantic: fix fragment overflow handling in RX path (Jiefeng Zhang) [Orabug: 38773729] {CVE-2025-68301}
  - net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic (Vladimir Oltean)
  - net: dsa: sja1105: simplify static configuration reload (Russell King)
  - net: dsa: sja1105: Convert to mdiobus_c45_read (Andrew Lunn)
  - net: sxgbe: fix potential NULL dereference in sxgbe_rx() (Alexey Kodanev)
  - net/mlx5e: Fix validation logic in rate limiting (Danielle Costantino)
  - net: aquantia: Add missing descriptor cache invalidation on ATL2 (Kai-Heng Feng)
  - platform/x86: intel: punit_ipc: fix memory corruption (Dan Carpenter)
  - Bluetooth: SMP: Fix not generating mackey and ltk when repairing (Luiz Augusto von Dentz)
  - can: kvaser_usb: leaf: Fix potential infinite loop in command parsers (Seungjin Bae) [Orabug: 38773760] {CVE-2025-68308}
  - Revert "block: don't add or resize partition on the disk with GENHD_FL_NO_PART" (Gulam Mohamed) [Orabug: 38652797]
  - Revert "block: Move checking GENHD_FL_NO_PART to bdev_add_partition()" (Gulam Mohamed) [Orabug: 38652797]
  - mptcp: do not fallback when OoO is present (Paolo Abeni)
  - mptcp: fix a race in mptcp_pm_del_add_timer() (Eric Dumazet) [Orabug: 38730656] {CVE-2025-40257}
  - mptcp: fix premature close in case of fallback (Paolo Abeni)
  - mptcp: fix ack generation for fallback msk (Paolo Abeni)
  - dt-bindings: pinctrl: toshiba,visconti: Fix number of items in groups (Krzysztof Kozlowski)
  - Input: pegasus-notetaker - fix potential out-of-bounds access (Seungjin Bae)
  - Input: remove third argument of usb_maxpacket() (Vincent Mailhol)
  - usb: deprecate the third argument of usb_maxpacket() (Vincent Mailhol)
  - mptcp: Disallow MPTCP subflows from sockmap (Jiayuan Chen)
  - selftests: mptcp: connect: fix fallback note due to OoO (Matthieu Baerts)
  - pmdomain: samsung: plug potential memleak during probe (André Draszik)
  - pmdomain: arm: scmi: Fix genpd leak on provider registration failure (Sudeep Holla)
  - pmdomain: imx: Fix reference count leak in imx_gpc_remove (Miaoqian Lin)
  - net: netpoll: fix incorrect refcount handling causing incorrect cleanup (Breno Leitao) [Orabug: 38773509] {CVE-2025-68245}
  - mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4 (Shawn Lin)
  - net: qede: Initialize qede_ll_ops with designated initializer (Nathan Chancellor)
  - btrfs: fix crash on racing fsync and size-extending write into prealloc (Omar Sandoval) [Orabug: 36774582] {CVE-2024-37354}
  - btrfs: add helper to truncate inode items when logging inode (Filipe Manana)
  - Makefile.compiler: replace cc-ifversion with compiler-specific macros (Nick Desaulniers)
  - tracing/tools: Fix incorrcet short option in usage text for --threads (Zhang Chujun)
  - net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error (Nishanth Menon)
  - ALSA: usb-audio: fix uac2 clock source at terminal parser (René Rebe)
  - mm/secretmem: fix use-after-free race in fault handler (Lance Yang) [Orabug: 38737039] {CVE-2025-40272}
  - mm/mm_init: fix hash table order logging in alloc_large_system_hash() (Isaac J. Manjarres)
  - kconfig/nconf: Initialize the default locale at startup (Jakub Horký)
  - kconfig/mconf: Initialize the default locale at startup (Jakub Horký)
  - net: tls: Cancel RX async resync request on rcd_delta overflow (Shahar Shitrit)
  - selftests: net: use BASH for bareudp testing (Po-Hsu Lin)
  - scsi: core: Fix a regression triggered by scsi_host_busy() (Bart Van Assche) [Orabug: 38773426]
  - vsock: Ignore signal/timeout on connect() if already established (Michal Luczaj) [Orabug: 38730611,38786193,38788594] {CVE-2025-40248}
  - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Pavel Zhigulin) [Orabug: 38730629] {CVE-2025-40252}
  - kernel.h: Move ARRAY_SIZE() to a separate header (Alejandro Colomar)
  - platform/x86/intel/speed_select_if: Convert PCIBIOS_* return codes to errnos (Xu Wang)
  - s390/ctcm: Fix double-kfree (Aleksei Nikiforov)
  - net: openvswitch: remove never-working support for setting nsh fields (Ilya Maximets) [Orabug: 38730648] {CVE-2025-40254}
  - net: dsa: hellcreek: fix missing error handling in LED registration (Pavel Zhigulin)
  - mlxsw: spectrum: Fix memory leak in mlxsw_sp_flower_stats() (Zilin Guan)
  - drm/tegra: dc: Fix reference leak in tegra_dc_couple() (Ma Ke)
  - mptcp: fix race condition in mptcp_schedule_work() (Eric Dumazet) [Orabug: 38730659,38932997] {CVE-2025-40258}
  - MIPS: Malta: Fix !EVA SOC-it PCI MMIO (Maciej W. Rozycki)
  - scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show() (Hamza Mahfooz) [Orabug: 38773440] {CVE-2025-68229}
  - scsi: sg: Do not sleep in atomic context (Bart Van Assche) [Orabug: 38730663] {CVE-2025-40259}
  - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [Orabug: 38730673] {CVE-2025-40261}
  - Input: imx_sc_key - fix memory corruption on unload (Dan Carpenter)
  - Input: cros_ec_keyb - fix an invalid memory access (Tzung-Bi Shih) [Orabug: 38730680] {CVE-2025-40263}
  - be2net: pass wrb_params in case of OS2BMC (Andrey Vatoropin) [Orabug: 38730689] {CVE-2025-40264}
  - exfat: check return value of sb_min_blocksize in exfat_read_boot_sector (Yongpeng Yang)
  - mtd: rawnand: cadence: fix DMA device NULL pointer dereference (Niravkumar L Rabara)
  - net/sched: act_connmark: handle errno on tcf_idr_check_alloc (Pedro Tammela)
  - isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe() (Abdun Nihaal) [Orabug: 38798907] {CVE-2025-68734}
  - EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection (Niravkumar L Rabara)
  - EDAC/altera: Handle OCRAM ECC enable after warm reset (Niravkumar L Rabara)
  - spi: Try to get ACPI GPIO IRQ earlier (Hans de Goede)
  - ALSA: usb-audio: Fix missing unlock at error path of maxpacksize check (Takashi Iwai)
  - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (Takashi Iwai) [Orabug: 38737023] {CVE-2025-40269}
  - fs/proc: fix uaf in proc_readdir_de() (Wei Yang) [Orabug: 38737033,38786194,38788587] {CVE-2025-40271}
  - ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe (Chuang Wang) [Orabug: 38773495] {CVE-2025-68241}
  - strparser: Fix signed/unsigned mismatch bug (Nate Karstens)
  - gcov: add support for GCC 15 (Peter Oberparleiter)
  - NFSD: free copynotify stateid in nfs4_free_ol_stateid() (Olga Kornievskaia) [Orabug: 38737042] {CVE-2025-40273}
  - HID: hid-ntrig: Prevent memory leak in ntrig_report_version() (Masami Ichikawa)
  - mtd: onenand: Pass correct pointer to IRQ handler (Dan Carpenter)
  - lib/crypto: arm/curve25519: Disable on CPU_BIG_ENDIAN (Eric Biggers)
  - mm/ksm: fix flag-dropping behavior in ksm_madvise (Jakub Acs) [Orabug: 38592026] {CVE-2025-40040}
  - bpf: Add bpf_prog_run_data_pointers() (Eric Dumazet) [Orabug: 38773327] {CVE-2025-68200}
  - ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd (Haein Lee) [Orabug: 38737051] {CVE-2025-40275}
  - NFSv4: Fix an incorrect parameter when calling nfs4_call_sync() (Trond Myklebust)
  - drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (Ian Forbes) [Orabug: 38737060] {CVE-2025-40277}
  - ASoC: cs4271: Fix regulator leak on probe failure (Xu Wang)
  - regulator: fixed: fix GPIO descriptor leak on register failure (Xu Wang)
  - acpi,srat: Fix incorrect device handle check for Generic Initiator (Shuai Xue)
  - Bluetooth: L2CAP: export l2cap_chan_hold for modules (Pauli Virtanen)
  - hsr: Fix supervision frame sending on HSRv0 (Felix Maurer)
  - net_sched: limit try_bulk_dequeue_skb() batches (Eric Dumazet)
  - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Gal Pressman)
  - net/mlx5e: Fix maxrate wraparound in threshold between units (Gal Pressman)
  - net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak (Ranganath V N)
  - net: sched: act_connmark: initialize struct tc_ife to fix kernel leak (Ranganath V N) [Orabug: 38737072] {CVE-2025-40279}
  - net_sched: act_connmark: use RCU in tcf_connmark_dump() (Eric Dumazet)
  - net/sched: act_connmark: transition to percpu stats and rcu (Pedro Tammela)
  - net: sched: act_connmark: get rid of tcf_connmark_walker and tcf_connmark_search (Zhengchao Shao)
  - net: sched: act: move global static variable net_id to tc_action_ops (Zhengchao Shao)
  - wifi: mac80211: skip rate verification for not captured PSDUs (Benjamin Berg)
  - net: mdio: fix resource leak in mdiobus_register_device() (Csaba Buday)
  - tipc: Fix use-after-free in tipc_mon_reinit_self(). (Kuniyuki Iwashima) [Orabug: 38737082,38786195,38788585] {CVE-2025-40280}
  - net/smc: fix mismatch between CLC header and proposal (D. Wythe)
  - sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto (Eric Dumazet) [Orabug: 38737090] {CVE-2025-40281}
  - Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions (Pauli Virtanen)
  - Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion (Pauli Virtanen)
  - Bluetooth: 6lowpan: reset link-local header on ipv6 recv path (Pauli Virtanen)
  - Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF (Raphael Pinsonneault-Thibeault) [Orabug: 38737103] {CVE-2025-40283}
  - net: fec: correct rx_bytes statistic for the case SHIFT16 is set (Wei Fang)
  - ASoC: max98090/91: fixed max98091 ALSA widget powering up/down (Sharique Mohammad)
  - NFS: check if suid/sgid was cleared after a write as needed (Scott Mayhew)
  - HID: quirks: avoid Cooler Master MM712 dongle wakeup bug (Tristan Lobb)
  - NFS4: Fix state renewals missing after boot (Joshua Watt)
  - RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid rfence errors (Danil Skrebenkov)
  - compiler_types: Move unused static inline functions warning to W=2 (Peter Zijlstra)
  - drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD (Janusz Krzysztofik) [Orabug: 38773506] {CVE-2025-68244}
  - selftests: netdevsim: set test timeout to 10 minutes (Jakub Kicinski)
  - extcon: adc-jack: Cleanup wakeup source only if it was enabled (Krzysztof Kozlowski)
  - lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC (Nathan Chancellor)
  - rtc: rx8025: fix incorrect register reference (Yuta Hayama)
  - tracing: Fix memory leaks in create_field_var() (Zilin Guan)
  - bnxt_en: Fix a possible memory leak in bnxt_ptp_init (Kalesh Ap)
  - net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup (Qendrim Maxhuni) [Orabug: 38773282] {CVE-2025-68192}
  - sctp: Hold sock lock while iterating over address list (Stefan Wiehler)
  - sctp: Prevent TOCTOU out-of-bounds write (Stefan Wiehler) [Orabug: 38747446] {CVE-2025-40331}
  - sctp: Hold RCU read lock while iterating over address list (Stefan Wiehler)
  - net: dsa: b53: stop reading ARL entries if search is done (Jonas Gorski)
  - net: dsa: b53: fix enabling ip multicast (Jonas Gorski)
  - net: dsa: b53: fix resetting speed and pause on forced link (Jonas Gorski)
  - net: vlan: sync VLAN features with lower device (Hangbin Liu)
  - selftests: netdevsim: Fix ethtool-coalesce.sh fail by installing ethtool-common.sh (Wang Liang)
  - netdevsim: add Makefile for selftests (David Wei)
  - selftests/net: use destination options instead of hop-by-hop (Anubhav Singh)
  - selftests/net: fix GRO coalesce test and add ext header coalesce tests (Richard Gobert)
  - selftests/net: fix out-of-order delivery of FIN in gro:tcp test (Anubhav Singh)
  - net: dsa: tag_brcm: legacy: fix untagged rx on unbridged ports for bcm63xx (Jonas Gorski)
  - riscv: ptdump: use seq_puts() in pt_dump_seq_puts() macro (Josephine Pfeiffer)
  - Revert "wifi: ath10k: avoid unnecessary wait for service ready message" (Baochen Qiang)
  - ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again (Kailang Yang)
  - ceph: add checking of wait_for_completion_killable() return value (Viacheslav Dubeyko)
  - ASoC: meson: aiu-encoder-i2s: fix bit clock polarity (Valerio Setti)
  - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (Albin Babu Varghese) [Orabug: 38737181] {CVE-2025-40304}
  - ACPI: property: Return present device nodes only on fwnode interface (Sakari Ailus)
  - 9p: sysfs_init: don't hardcode error to ENOMEM (Randall P. Embry)
  - cpufreq: tegra186: Initialize all cores to max frequencies (Aaron Kling)
  - 9p: fix /sys/fs/9p/caches overwriting itself (Randall P. Embry)
  - clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled (Matthias Schiffer)
  - clk: at91: clk-master: Add check for divide by 3 (Ryan Wanner)
  - ARM: at91: pm: save and restore ACR during PLL disable/enable (Nicolas Ferre)
  - rtc: pcf2127: clear minute/second interrupt (Josua Mayer)
  - um: Fix help message for ssl-non-raw (Tiwei Bie)
  - fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink (Yikang Yue)
  - btrfs: mark dirty extent range for out of bound prealloc extents (Austinchang)
  - RDMA/hns: Fix wrong WQE data when QP wraps around (Junxian Huang)
  - RDMA/irdma: Set irdma_cq cq_num field during CQ create (Jacob Moroni)
  - RDMA/irdma: Remove unused struct irdma_cq fields (Jacob Moroni)
  - RDMA/irdma: Fix SD index calculation (Jacob Moroni)
  - ACPICA: Update dsmethod.c to get rid of unused variable warning (Saket Dumbre)
  - orangefs: fix xattr related buffer overflow... (Mike Marshall)
  - page_pool: Clamp pool size to max 16K pages (Dragos Tatulea)
  - exfat: limit log print for IO error (Chi Zhiling)
  - ALSA: usb-audio: add mono main switch to Presonus S1824c (Roy Vegard Ovesen)
  - Bluetooth: bcsp: receive data only if registered (Ivan Pravdin) [Orabug: 38737212] {CVE-2025-40308}
  - Bluetooth: SCO: Fix UAF on sco_conn_free (Luiz Augusto von Dentz) [Orabug: 38737223] {CVE-2025-40309}
  - net: macb: avoid dealing with endianness in macb_set_hwaddr() (Théo Lebrun)
  - fs: ext4: change GFP_KERNEL to GFP_NOFS to avoid deadlock (Chuguangqing)
  - scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill() (Alok Tiwari)
  - nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode dereferencing (Al Viro) [Orabug: 38773244] {CVE-2025-68185}
  - NFSv4.1: fix mount hang after CREATE_SESSION failure (Anthony Iliopoulos)
  - NFSv4: handle ERR_GRACE on delegation recalls (Olga Kornievskaia)
  - remoteproc: qcom: q6v5: Avoid handling handover twice (Stephan Gerhold)
  - sparc/module: Add R_SPARC_UA64 relocation handling (Koakuma)
  - PCI: cadence: Check for the existence of cdns_pcie::ops before using it (Chen Wang)
  - r8169: set EEE speed down ratio to 1 (Chunhao Lin)
  - net: intel: fm10k: Fix parameter idx set but not used (Brahmajit Das)
  - wifi: ath10k: Fix connection after GTK rekeying (Loic Poulain)
  - iommu/vt-d: Replace snprintf with scnprintf in dmar_latency_snapshot() (Seyediman Seyedarab)
  - net: ethernet: microchip: sparx5: make it selectable for ARCH_LAN969X (Robert Marko)
  - jfs: fix uninitialized waitqueue in transaction manager (Shaurya Rane)
  - jfs: Verify inode mode when loading from disk (Tetsuo Handa)
  - ipv6: np->rxpmtu race annotation (Eric Dumazet)
  - usb: xhci: plat: Facilitate using autosuspend for xhci plat devices (Krishna Kurapati)
  - usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs (Forest Crossman)
  - allow finish_no_open(file, ERR_PTR(-E...)) (Al Viro)
  - scsi: lpfc: Define size of debugfs entry for xri rebalancing (Justin Tee)
  - scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup (Justin Tee)
  - scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET (Justin Tee)
  - selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency (Nai-Chen Cheng)
  - page_pool: always add GFP_NOWARN for ATOMIC allocations (Jakub Kicinski) [Orabug: 38773835] {CVE-2025-68321}
  - drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl (Tvrtko Ursulin)
  - net/cls_cgroup: Fix task_get_classid() during qdisc run (Yafang Shao)
  - udp_tunnel: use netdev_warn() instead of netdev_WARN() (Alok Tiwari) [Orabug: 38773275] {CVE-2025-68191}
  - selftests: Replace sleep with slowwait (David Ahern)
  - eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP (Daniel Palmer)
  - selftests: Disable dad for ipv6 in fcnal-test.sh (David Ahern)
  - x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of PV_UNHALT (Li Rongqing)
  - netfilter: nf_reject: don't reply to icmp error messages (Florian Westphal)
  - selftests: traceroute: Use require_command() (Ido Schimmel)
  - media: redrat3: use int type to store negative error codes (Rong Qianfeng)
  - net: sh_eth: Disable WoL if system can not suspend (Niklas Söderlund)
  - phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0 (Michael Riesch)
  - phy: cadence: cdns-dphy: Enable lower resolutions in dphy (Harikrishna Shenoy)
  - ntfs3: pretend $Extend records as regular files (Tetsuo Handa)
  - net: phy: marvell: Fix 88e1510 downshift counter errata (Rohan G Thomas)
  - drm/msm: make sure to not queue up recovery more than once (Antonino Maniscalco)
  - usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget (Chen Yufeng)
  - usb: gadget: f_hid: Fix zero length packet transfer (William Wu)
  - iommu/amd: Skip enabling command/event buffers for kdump (Ashish Kalra)
  - net: call cond_resched() less often in __release_sock() (Eric Dumazet)
  - net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms (Juraj Šarinay)
  - ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled (Yue Haibing)
  - drm/msm/dsi/phy_7nm: Fix missing initial VCO rate (Krzysztof Kozlowski)
  - drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL (Krzysztof Kozlowski)
  - dmaengine: dw-edma: Set status for callback_result (Devendra K Verma)
  - dmaengine: mv_xor: match alloc_wc and free_wc (Rosen Penev)
  - dmaengine: sh: setup_xref error handling (Thomas Andreatta)
  - ptp: Limit time setting of PTP clocks (Miroslav Lichvar)
  - scsi: pm8001: Use int instead of u32 to store error codes (Rong Qianfeng)
  - mips: lantiq: xway: sysctrl: rename stp clock (Aleksander Jan Bajkowski)
  - mips: lantiq: danube: add missing device_type in pci node (Aleksander Jan Bajkowski)
  - mips: lantiq: danube: add missing properties to cpu node (Aleksander Jan Bajkowski)
  - media: fix uninitialized symbol warnings (Chelsy Ratnawat)
  - drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption (Amber Lin)
  - extcon: adc-jack: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
  - scsi: pm80xx: Fix race condition caused by static variables (Francisco Gutierrez)
  - scsi: mpi3mr: Fix controller init failure on fault during queue creation (Chandrakanth Patil)
  - ALSA: usb-audio: Add validation of UAC2/UAC3 effect units (Takashi Iwai)
  - PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call (Sungho Kim)
  - net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV. (Kuniyuki Iwashima)
  - net: When removing nexthops, don't call synchronize_net if it is not necessary (Christoph Paasch)
  - char: misc: Does not request module for miscdevice with dynamic minor (Zijun Hu)
  - usb: gadget: f_ncm: Fix MAC assignment NCM ethernet (Raub Camaioni)
  - iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register (Rodrigo Gobbi)
  - drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts (Dmitry Baryshkov)
  - media: imon: make send_packet() more robust (Tetsuo Handa) [Orabug: 38773297] {CVE-2025-68194}
  - net: ipv6: fix field-spanning memcpy warning in AH output (Charalampos Mitrodimas) [Orabug: 38773140] {CVE-2025-40363}
  - bridge: Redirect to backup port when port is administratively down (Ido Schimmel)
  - powerpc/eeh: Use result of error_detected() in uevent (Niklas Schnelle)
  - thunderbolt: Use is_pciehp instead of is_hotplug_bridge (Lukas Wunner)
  - net: stmmac: Check stmmac_hw_setup() in stmmac_resume() (Tiezhu Yang)
  - x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall (Kirill A. Shutemov)
  - drm/tidss: Set crtc modesetting parameters with adjusted mode (Jayesh Choudhary)
  - drm/tidss: Use the crtc_* timings when programming the HW (Tomi Valkeinen)
  - media: pci: ivtv: Don't create fake v4l2_fh (Laurent Pinchart)
  - drm/amdkfd: return -ENOTTY for unsupported IOCTLs (Geoffrey Mcrae)
  - selftests/net: Ensure assert() triggers in psock_tpacket.c (Wake Liu)
  - selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8 (Wake Liu)
  - PCI: Disable MSI on RDC PCI to PCIe bridges (Marcos Del Sol Vives)
  - drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() (Seyediman Seyedarab)
  - drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff (Sathishkumar S)
  - drm/amd/pm: Use cached metrics data on arcturus (Lijo Lazar)
  - drm/amd/pm: Use cached metrics data on aldebaran (Lijo Lazar)
  - mfd: da9063: Split chip variant reading in two bus transactions (Jens Kehne)
  - mfd: madera: Work around false-positive -Wininitialized warning (Arnd Bergmann)
  - mfd: stmpe-i2c: Add missing MODULE_LICENSE (Alexander Stein)
  - mfd: stmpe: Remove IRQ domain upon removal (Alexander Stein)
  - tools/power x86_energy_perf_policy: Prefer driver HWP limits (Len Brown)
  - tools/power x86_energy_perf_policy: Enhance HWP enable (Len Brown)
  - tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage (Kaushlendra Kumar)
  - tools/cpupower: Fix incorrect size in cpuidle_state_disable() (Kaushlendra Kumar)
  - hwmon: (dell-smm) Add support for Dell OptiPlex 7040 (Armin Wolf)
  - uprobe: Do not emulate/sstep original instruction when ip is changed (Jiri Olsa)
  - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Daniel Lezcano)
  - cpuidle: Fail cpuidle device registration if there is one already (Rafael J. Wysocki)
  - tools/cpupower: fix error return value in cpupower_write_sysfs() (Kaushlendra Kumar)
  - video: backlight: lp855x_bl: Set correct EPROM start for LP8556 (Svyatoslav Ryhel)
  - nvme-fc: use lock accessing port_state and rport state (Daniel Wagner) [Orabug: 38747531] {CVE-2025-40342}
  - nvmet-fc: avoid scheduling association deletion twice (Daniel Wagner) [Orabug: 38747538] {CVE-2025-40343}
  - tee: allow a driver to allocate a tee_device without a pool (Amirreza Zarrabi)
  - ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() (Hans de Goede)
  - mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card (Sarthak Garg)
  - power: supply: sbs-charger: Support multiple devices (Fabien Proriol)
  - hwmon: (sbtsi_temp) AMD CPU extended temperature range support (Chuande Chen)
  - ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[] (Hans de Goede)
  - ACPI: PRM: Skip handlers with NULL handler_address or NULL VA (Shang Song)
  - irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment (Christian Bruel)
  - arc: Fix __fls() const-foldability via __builtin_clzl() (Kees Cook)
  - cpufreq/longhaul: handle NULL policy in longhaul_exit (Dennis Beier)
  - selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2 (Ricardo B. Marlière)
  - ACPI: video: force native for Lenovo 82K8 (Mario Limonciello)
  - memstick: Add timeout to prevent indefinite waiting (Jiayi Li)
  - mmc: host: renesas_sdhi: Fix the actual clock (Biju Das)
  - pinctrl: single: fix bias pull up/down handling in pin_config_set (Chi Zhang)
  - bpf: Don't use %pK through printk (Thomas Weißschuh)
  - soc: ti: pruss: don't use %pK through printk (Thomas Weißschuh)
  - spi: loopback-test: Don't use %pK through printk (Thomas Weißschuh)
  - soc: qcom: smem: Fix endian-unaware access of num_entries (Jens Reidel)
  - soc: aspeed: socinfo: Add AST27xx silicon IDs (Ryan Chen)
  - block: make REQ_OP_ZONE_OPEN a write operation (Damien Le Moal)
  - drm/sysfb: Do not dereference NULL pointer in plane reset (Thomas Zimmermann) [Orabug: 38773123] {CVE-2025-40360}
  - drm/sched: Fix race in drm_sched_entity_select_rq() (Philipp Stanner)
  - usb: gadget: f_fs: Fix epfile null pointer access after ep enable. (Owen Gu)
  - Revert "docs/process/howto: Replace C89 with C11" (Matthieu Baerts)
  - arch: back to -std=gnu89 in < v5.18 (Matthieu Baerts)
  - x86/boot: Compile boot code with -std=gnu11 too (Alexey Dobriyan)
  - xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event (Mathias Nyman)
  - xhci: dbc: Avoid event polling busyloop if pending rx transfers are inactive. (Mathias Nyman)
  - xhci: dbc: Improve performance by removing delay in transfer event polling. (Mathias Nyman)
  - xhci: dbc: Allow users to modify DbC poll interval via sysfs (Uday M Bhat)
  - xhci: dbc: poll at different rate depending on data transfer activity (Mathias Nyman)
  - xhci: dbc: Provide sysfs option to configure dbc descriptors (Mathias Nyman)
  - x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID (Babu Moger)
  - net: phy: dp83867: Disable EEE support as not implemented (Emanuele Ghidoli)
  - can: gs_usb: increase max interface to U8_MAX (Celeste Liu)
  - net: ravb: Enforce descriptor type ordering (Lad Prabhakar)
  - ravb: Exclude gPTP feature support for RZ/G2L (Biju Das)
  - dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp (Xu Yang)
  - serial: 8250_dw: handle reset control deassert error (Artem Shimko)
  - serial: 8250_dw: Use devm_add_action_or_reset() (Andy Shevchenko)
  - block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL (Damien Le Moal)
  - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland (John Smith)
  - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji (John Smith)
  - drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() (Yang Wang)
  - net: hns3: return error code when function fails (Jijie Shao)
  - drm/etnaviv: fix flush sequence logic (Tomeu Vizoso)
  - usbnet: Prevents free active kevent (Lizhi Xu) [Orabug: 38773783] {CVE-2025-68312}
  - libbpf: Fix powerpc's stack register definition in bpf_tracing.h (Andrii Nakryiko)
  - libbpf: Normalize PT_REGS_xxx() macro definitions (Andrii Nakryiko)
  - riscv, libbpf: Add RISC-V (RV64) support to bpf_tracing.h (Björn Töpel)
  - bpf: Do not audit capability check in do_jit() (Ondrej Mosnacek)
  - bpf: Sync pending IRQ work before freeing ring buffer (Noorain Eqbal) [Orabug: 38737284] {CVE-2025-40319}
  - ALSA: usb-audio: fix control pipe direction (Roy Vegard Ovesen)
  - drm/msm/a6xx: Fix GMU firmware parser (Akhil P Oommen)
  - wifi: ath10k: Fix memory leak on unsupported WMI command (Loic Poulain)
  - ASoC: qdsp6: q6asm: do not sleep while atomic (Srinivas Kandagatla)
  - mptcp: restore window probe (Paolo Abeni)
  - fbdev: valkyriefb: Fix reference count leak in valkyriefb_init (Miaoqian Lin)
  - fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS (Florian Fuchs)
  - wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode (Gokul Sivakumar) [Orabug: 38737291] {CVE-2025-40321}
  - fbdev: bitblit: bound-check glyph index in bit_putcs* (Junjie Cao) [Orabug: 38737300] {CVE-2025-40322}
  - ACPI: video: Fix use-after-free in acpi_video_switch_brightness() (Yuhao Jiang) [Orabug: 38687004] {CVE-2025-40211}
  - fbdev: atyfb: Check if pll_ops->init_pll failed (Daniel Palmer)
  - net: usb: asix_devices: Check return value of usbnet_get_endpoints (Miaoqian Lin)
  - NFSD: Fix crash in nfsd4_read_release() (Chuck Lever) [Orabug: 38737315] {CVE-2025-40324}
  - btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() (Filipe Manana)
  - btrfs: always drop log root tree reference in btrfs_replay_log() (Filipe Manana)
  - btrfs: scrub: replace max_t()/min_t() with clamp() in scrub_throttle_dev_io() (Thorsten Blum)
  - x86/bugs: Fix reporting of LFENCE retpoline (David Kaplan)
  - net/sched: sch_qfq: Fix null-deref in agg_dequeue (Xiang Mei) [Orabug: 38597084] {CVE-2025-40083}


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-318.199.3.2.el9uek]
changelog:
  - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Eric Dumazet)  [Orabug: 39057366]  
  - macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet)  [Orabug: 39057366]  {CVE-2026-23209} 
  - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano)  [Orabug: 39057346]  {CVE-2026-23111} 
  - net: tunnel: make skb_vlan_inet_prepare() return drop reasons (Menglong Dong)  [Orabug: 39055945]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-319.199.1.el9uek]
changelog:
  - genirq/cpuhotplug: Notify about affinity changes breaking the affinity mask (Imran Khan)  [Orabug: 39001910]
  - nvme-pci: fix stuck reset on concurrent DPC and HP (Keith Busch)  [Orabug: 38928033]
  - nvme: cancel pending I/O if nvme controller is in terminal state (Nilay Shroff)  [Orabug: 38928033]
  - nvme-pci: fix queue unquiesce check on slot_reset (Keith Busch)  [Orabug: 38928033]
  - nvme: ensure disabling pairs with unquiesce (Keith Busch)  [Orabug: 38928033]
  - ionic: Rate limit unknown xcvr type messages (Eric Joyner)  [Orabug: 38977644]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-319.201.2.el9uek]
changelog:
  - LTS version: v5.15.201 (Vijayendra Suman)
  - USB: serial: option: add Telit FN920C04 RNDIS compositions (Fabio Porcedda)
  - f2fs: fix out-of-bounds access in sysfs attribute read/write (Yongpeng Yang)
  - f2fs: fix to avoid UAF in f2fs_write_end_io() (Chao Yu)
  - fbdev: smscufx: properly copy ioctl memory to kernelspace (Greg Kroah-Hartman)
  - fbdev: rivafb: fix divide error in nv3_arb() (Guangshuo Li)
  - PCI: endpoint: Avoid creating sub-groups asynchronously (Liu Song)
  - PCI: endpoint: Remove unused field in struct pci_epf_group (Christophe JAILLET)
  - PCI: endpoint: Automatically create a function specific attributes group (Damien Le Moal)
  - scsi: qla2xxx: Free sp in error path to fix system crash (Anil Gurumurthy)
  - scsi: qla2xxx: Use named initializers for port_[d]state_str (Gleb Chesnokov)
  - scsi: qla2xxx: Fix bsg_done() causing double free (Anil Gurumurthy)
  - bus: fsl-mc: fix use-after-free in driver_override_show() (Gui-Dong Han)
  - bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions (Chelsy Ratnawat)
  - smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() (Henrique Carvalho)
  - crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req (Bibo Mao)
  - mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (Eric Dumazet)
  - selftests: mptcp: pm: ensure unknown flags are ignored (Matthieu Baerts (NGI0))
  - net: dsa: free routing table on probe failure (Vladimir Oltean)
  - smb: client: set correct id, uid and cruid for multiuser automounts (Paulo Alcantara)
  - btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (Boris Burkov)
  - Revert "wireguard: device: enable threaded NAPI" (Daniel Borkmann)
  - gpiolib: acpi: Fix gpio count with string references (Alban Bedel)
  - ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
  - platform/x86: panasonic-laptop: Fix sysfs group leak in error path (Rafael J. Wysocki)
  - platform/x86: classmate-laptop: Add missing NULL pointer checks (Rafael J. Wysocki)
  - drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used (Brahmajit Das)
  - romfs: check sb_set_blocksize() return value (Deepanshu Kartikey)
  - gpio: sprd: Change sprd_gpio lock to raw_spin_lock (Xuewen Yan)
  - ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
  - gpio: omap: do not register driver in probe() (Danilo Krummrich)
  - scsi: qla2xxx: Query FW again before proceeding with login (Anil Gurumurthy)
  - scsi: qla2xxx: Delay module unload while fabric scan in progress (Anil Gurumurthy)
  - scsi: qla2xxx: Validate sp before freeing associated memory (Anil Gurumurthy)
  - nilfs2: Fix potential block overflow that cause system hang (Edward Adam Davis)
  - crypto: virtio - Add spinlock protection with virtqueue notification (Bibo Mao)
  - crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly (Kees Cook)
  - crypto: octeontx - Fix length check to avoid truncation in ucode_load_store (Thorsten Blum)
  - LTS version: v5.15.200 (Vijayendra Suman)
  - riscv: Replace function-like macro by static inline function (Björn Töpel)
  - nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page() (Varun Prakash)
  - spi: tegra: Fix a memory leak in tegra_slink_probe() (Felix Gu)
  - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Breno Leitao)
  - spi: tegra210-quad: Move curr_xfer read inside spinlock (Breno Leitao)
  - iommu: disable SVA when CONFIG_X86 is set (Lu Baolu)
  - Bluetooth: hci_event: call disconnect callback before deleting conn (Pauli Virtanen)
  - gve: Correct ethtool rx_dropped calculation (Max Yuan)
  - gve: Fix stats report corruption on queue count change (Debarghya Kundu)
  - gfs2: Fix NULL pointer dereference in gfs2_log_flush (Andreas Gruenbacher)
  - riscv: uprobes: Add missing fence.i after building the XOL buffer (Björn Töpel)
  - ASoC: amd: fix memory leak in acp3x pdm dma ops (Chris Bainbridge)
  - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (YunJe Shin)
  - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano)
  - hwmon: (occ) Mark occ_init_attribute() as __printf (Arnd Bergmann)
  - tipc: use kfree_sensitive() for session key material (Daniel Hodges)
  - macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet)
  - dpaa2-switch: add bounds check for if_id in IRQ handler (Junrui Luo)
  - net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup (Zilin Guan)
  - net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup (Zilin Guan)
  - net: liquidio: Initialize netdev pointer before queue setup (Zilin Guan)
  - dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (Junrui Luo)
  - platform/x86: intel_telemetry: Fix PSS event register mask (Kaushlendra Kumar)
  - platform/x86: toshiba_haps: Fix memory leaks in add/remove routines (Rafael J. Wysocki)
  - wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice (Miri Korenblit)
  - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi)
  - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi)
  - wifi: cfg80211: Fix bitrate calculation overflow for HE rates (Veerendranath Jakkam)
  - ASoC: tlv320adcx140: Propagate error codes during probe (Dimitrios Katsaros)
  - ASoC: davinci-evm: Fix reference leak in davinci_evm_probe (Kery Qi)
  - wifi: mac80211: collect station statistics earlier when disconnect (Baochen Qiang)
  - ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free (Wupeng Ma)
  - HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) (Rodrigo Lugathe da Conceição Alves)
  - HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list (Chris Chiu)
  - netfilter: replace -EEXIST with -EBUSY (Daniel Gomez)
  - ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk (Ruslan Krupitsa)
  - HID: playstation: Center initial joystick axes to prevent spurious events (Siarhei Vishniakou)
  - HID: intel-ish-hid: Reset enum_devices_done before enumeration (Zhang Lixu)
  - HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL (DaytonCL)
  - smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() (ZhangGuoDong)
  - block,bfq: fix aux stat accumulation destination (shechenglong)
  - net: usb: sr9700: support devices with virtual driver CD (Ethan Nelson-Moore)
  - wifi: wlcore: ensure skb headroom before skb_push (Peter Åstrand)
  - wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (Moon Hee Lee)
  - binderfs: fix ida_alloc_max() upper bound (Carlos Llamas)
  - Bluetooth: hci_qca: Fix the teardown problem for real (Thomas Gleixner)
  - clocksource/drivers/arm_arch_timer: Do not use timer namespace for timer_shutdown() function (Steven Rostedt (Google))
  - ARM: spear: Do not use timer namespace for timer_shutdown() function (Steven Rostedt (Google))
  - Documentation: Remove bogus claim about del_timer_sync() (Thomas Gleixner)
  - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Pablo Neira Ayuso)
  - mm/kfence: randomize the freelist on initialization (Pimyn Girgis)
  - KVM: Don't clobber irqfd routing type when deassigning irqfd (Sean Christopherson)
  - ARM: 9468/1: fix memset64() on big-endian (Thomas Weissschuh)
  - rbd: check for EOD after exclusive lock is ensured to be held (Ilya Dryomov)
  - platform/x86: intel_telemetry: Fix swapped arrays in PSS output (Kaushlendra Kumar)


author: Samasth Norway Ananda <samasth.norway.ananda@oracle.com> [5.15.0-319.201.3.el9uek]
changelog:
  - arm64: pensando: Add non-caching option to capmem/mmap (Rob Gardner)  [Orabug: 39017011]
  - PCI: Fix BUILD_BUG_ON usage for old gcc (Alex Williamson)  [Orabug: 39021252]
  - PCI: Batch BAR sizing operations (Alex Williamson)  [Orabug: 39021252]
  - net: tunnel: make skb_vlan_inet_prepare() return drop reasons (Menglong Dong)  [Orabug: 39053373]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-319.201.4.el9uek]
changelog:
  - bnxt_en: Fix GSO type for HW GRO packets on 5750X chips (Michael Chan)  [Orabug: 39086190]
  - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled (Fernando Fernandez Mancera)  [Orabug: 39080807]
  - hv_netvsc: Use VF's tso_max_size value when data path is VF (Shradha Gupta)  [Orabug: 39065407]
  - net: mana: Allow tso_max_size to go up-to GSO_MAX_SIZE (Shradha Gupta)  [Orabug: 39065407]
  - IPv6/GRO: generic helper to remove temporary HBH/jumbo header in driver (Coco Li)  [Orabug: 39065407]
  - rds: Drop rds conn in connect worker if not in down state. (Rohit Nair)  [Orabug: 39045034]
  - exadata: tools: perf: use comm_ignore_digit for report, top (Stephen Brennan)  [Orabug: 38567667]
  - tools: perf: add comm_ignore_digit column (Stephen Brennan)  [Orabug: 38567667]
  - mm/page_alloc: ignore the exact initial compaction result (Vlastimil Babka)  [Orabug: 39071712]
  - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Vlastimil Babka)  [Orabug: 39071712]
  - rds: Add state field to RDS trace logs. (Rohit Nair)  [Orabug: 38870357]
  - i3c: Move device name assignment after i3c_bus_init (Billy Tsai)
  - ASoC: fsl_xcvr: Revert fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
  - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Eric Dumazet)
  - netfilter: nf_conncount: fix tracking of connections from localhost (Fernando Fernandez Mancera)
  - PCI/IOV: Fix race between SR-IOV enable/disable and hotplug (Niklas Schnelle)
  - Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" (Niklas Schnelle)
  - rtc: interface: Alarm race handling should not discard preceding error (Anthony Pighin (Nokia))


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-319.201.4.1.el9uek]
changelog:
  - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson)  [Orabug: 39153095]
  - vfio: Adapt to upstream uAPI for VFIO_PRECOPY_INFO_REINIT (Maciej S. Szmigiero)  [Orabug: 39153092]
  - vfio/mlx5: Add REINIT support to VFIO_MIG_GET_PRECOPY_INFO (Yishai Hadas)  [Orabug: 39153077]
  - vfio/mlx5: consider inflight SAVE during PRE_COPY (Yishai Hadas)  [Orabug: 39153077]
  - net/mlx5: Add IFC bits for migration state (Yishai Hadas)  [Orabug: 39153077]
  - vfio: Adapt drivers to use the core helper vfio_check_precopy_ioctl (Yishai Hadas)  [Orabug: 39153077]
  - vfio: Add support for VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2 (Yishai Hadas)  [Orabug: 39153077]
  - vfio: Define uAPI for re-init initial bytes during the PRE_COPY phase (Yishai Hadas)  [Orabug: 39153077]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-319.201.4.2.el9uek]
changelog:
  - Revert "rds: Drop rds conn in connect worker if not in down state." (Vijayendra Suman)  [Orabug: 39200414]


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-0.20.20.1.el9uek]
changelog:
  - rds: ib: Fix NULL ptr deref in rds_ib_cq_follow_affinity (Håkon Bugge)  [Orabug: 37702023]
  - scsi: mpi3mr: Task Abort EH Support (Chandrakanth Patil)  [Orabug: 37778472]
  - scsi: mpi3mr: Update driver version to 8.13.0.5.50 (Ranjan Kumar)  [Orabug: 37778472]
  - scsi: mpi3mr: Check admin reply queue from Watchdog (Ranjan Kumar)  [Orabug: 37778472]
  - scsi: mpi3mr: Update timestamp only for supervisor IOCs (Ranjan Kumar)  [Orabug: 37778472]
  - scsi: mpi3mr: Update MPI Headers to revision 35 (Ranjan Kumar)  [Orabug: 37778472]
  - scsi: mpi3mr: Fix locking in an error path (Bart Van Assche)  [Orabug: 37778472]
  - scsi: mpi3mr: Fix spelling mistake "skiping" -> "skipping" (Colin Ian King)  [Orabug: 37778472]
  - scsi: mpi3mr: Update driver version to 8.12.1.0.50 (Ranjan Kumar)  [Orabug: 37778472]
  - scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue (Ranjan Kumar)  [Orabug: 37778472]
  - scsi: mpi3mr: Support for Segmented Hardware Trace buffer (Ranjan Kumar)  [Orabug: 37778472]
  - scsi: mpi3mr: Avoid reply queue full condition (Ranjan Kumar)  [Orabug: 37778472]
  - scsi: mpi3mr: Update driver version to 8.12.0.3.50 (Ranjan Kumar)  [Orabug: 37778472]
  - uek-rpm: Enable Intel In Field Scan as a module in UEK8 (Harshit Mogalapalli)  [Orabug: 37778856]


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-1.23.1.el9uek]
changelog:
  - LTS version: v6.12.23 (Jack Vogel)
  - platform/x86/amd/pmf: fix cleanup in amd_pmf_init_smart_pc() (Dan Carpenter)
  - tracing: Do not use PERF enums when perf is not defined (Steven Rostedt)
  - ARM: 9443/1: Require linker to support KEEP within OVERLAY for DCE (Nathan Chancellor)
  - NFSD: Skip sending CB_RECALL_ANY when the backchannel isn't up (Chuck Lever)
  - NFSD: Never return NFS4ERR_FILE_OPEN when removing a directory (Chuck Lever)
  - NFSD: nfsd_unlink() clobbers non-zero status returned from fh_fill_pre_attrs() (Chuck Lever)
  - nfsd: fix management of listener transports (Olga Kornievskaia)
  - nfsd: put dl_stid if fail to queue dl_recall (Li Lingfeng)
  - nfsd: allow SC_STATUS_FREEABLE when searching via nfs4_lookup_stateid() (Jeff Layton)
  - media: streamzap: fix race between device disconnection and urb callback (Murad Masimov)
  - media: vimc: skip .s_stream() for stopped entities (Nikita Zhandarovich)
  - exec: fix the racy usage of fs_struct->in_exec (Oleg Nesterov)
  - mm: zswap: fix crypto_free_acomp() deadlock in zswap_cpu_comp_dead() (Yosry Ahmed)
  - jfs: add index corruption check to DT_GETPAGE() (Roman Smirnov)
  - jfs: fix slab-out-of-bounds read in ea_get() (Qasim Ijaz)
  - ext4: fix OOB read when checking dotdot dir (Acs, Jakub)
  - ext4: don't over-report free space or inodes in statvfs (Theodore Ts'o)
  - wifi: mt76: mt7921: fix kernel panic due to null pointer dereference (Ming Yen Hsieh)
  - arm64: Don't call NULL in do_compat_alignment_fixup() (Angelos Oikonomopoulos)
  - mm/gup: reject FOLL_SPLIT_PMD with hugetlb VMAs (David Hildenbrand)
  - tracing/osnoise: Fix possible recursive locking for cpus_read_lock() (Ran Xiaokai)
  - tracing: Fix synth event printk format for str fields (Douglas Raillard)
  - tracing: Ensure module defining synth event cannot be unloaded while tracing (Douglas Raillard)
  - tracing: Fix use-after-free in print_graph_function_flags during tracer switching (Tengda Wu)
  - exfat: fix potential wrong error return from get_block (Sungjong Seo)
  - exfat: fix random stack corruption after get_block (Sungjong Seo)
  - ksmbd: fix null pointer dereference in alloc_preauth_hash() (Namjae Jeon)
  - ksmbd: validate zero num_subauth before sub_auth is accessed (Norbert Szetei)
  - ksmbd: fix overflow in dacloffset bounds check (Norbert Szetei)
  - ksmbd: fix session use-after-free in multichannel connection (Namjae Jeon)
  - ksmbd: fix use-after-free in ksmbd_sessions_deregister() (Namjae Jeon)
  - ksmbd: add bounds check for create lease context (Norbert Szetei)
  - ksmbd: add bounds check for durable handle context (Namjae Jeon)
  - KVM: SVM: Don't change target vCPU state on AP Creation VMGEXIT error (Sean Christopherson)
  - mmc: sdhci-omap: Disable MMC_CAP_AGGRESSIVE_PM for eMMC/SD (Ulf Hansson)
  - mmc: sdhci-pxav3: set NEED_RSP_BUSY capability (Karel Balej)
  - mmc: omap: Fix memory leak in mmc_omap_new_slot (Miaoqian Lin)
  - Remove unnecessary firmware version check for gc v9_4_2 (Candice Li)
  - media: omap3isp: Handle ARM dma_iommu_mapping (Robin Murphy)
  - ARM: 9444/1: add KEEP() keyword to ARM_VECTORS (Christian Eggers)
  - ACPI: resource: Skip IRQ override on ASUS Vivobook 14 X1404VAP (Paul Menzel)
  - acpi: nfit: fix narrowing conversion in acpi_nfit_ctl (Murad Masimov)
  - wifi: mt76: mt7925: remove unused acpi function for clc (Ming Yen Hsieh)
  - x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (Jann Horn)
  - x86/tsc: Always save/restore TSC sched_clock() on suspend/resume (Guilherme G. Piccoli)
  - x86/Kconfig: Add cmpxchg8b support back to Geode CPUs (Arnd Bergmann)
  - uprobes/x86: Harden uretprobe syscall trampoline check (Jiri Olsa)
  - perf/x86/intel: Avoid disable PMU if !cpuc->enabled in sample read (Kan Liang)
  - perf/x86/intel: Apply static call for drain_pebs (Peter Zijlstra (Intel))
  - ntb_perf: Delete duplicate dmaengine_unmap_put() call in perf_copy_chunk() (Markus Elfring)
  - platform/x86: ISST: Correct command storage data length (Srinivas Pandruvada)
  - platform/x86: thinkpad_acpi: disable ACPI fan access for T495* and E560 (Eduard Christian Dumitrescu)
  - ACPI: x86: Extend Lenovo Yoga Tab 3 quirk with skip GPIO event-handlers (Hans de Goede)
  - x86/tdx: Fix arch_safe_halt() execution for TDX VMs (Vishal Annapurve)
  - x86/mce: use is_copy_from_user() to determine copy-from-user context (Shuai Xue)
  - x86/microcode/AMD: Fix __apply_microcode_amd()'s return value (Boris Ostrovsky)
  - KVM: x86: block KVM_CAP_SYNC_REGS if guest state is protected (Paolo Bonzini)
  - x86/hyperv: Fix check of return value from snp_set_vmsa() (Tianyu Lan)
  - LoongArch: BPF: Use move_addr() for BPF_PSEUDO_FUNC (Hengqi Chen)
  - LoongArch: BPF: Don't override subprog's return value (Hengqi Chen)
  - LoongArch: BPF: Fix off-by-one error in build_prologue() (Hengqi Chen)
  - LoongArch: Increase MAX_IO_PICS up to 8 (Huacai Chen)
  - LoongArch: Increase ARCH_DMA_MINALIGN up to 16 (Huacai Chen)
  - rust: Fix enabling Rust and building with GCC for LoongArch (WANG Rui)
  - usbnet:fix NPE during rx_complete (Ying Lu)
  - wifi: mac80211: Fix sparse warning for monitor_sdata (Alexander Wetzel)
  - tty: serial: lpuart: only disable CTS instead of overwriting the whole UARTMODIR register (Sherry Sun)
  - tty: serial: fsl_lpuart: Fix unused variable 'sport' build warning (Sherry Sun)
  - tty: serial: fsl_lpuart: use port struct directly to simply code (Sherry Sun)
  - tty: serial: fsl_lpuart: Use u32 and u8 for register variables (Sherry Sun)
  - cgroup/rstat: Fix forceidle time in cpu.stat (Abel Wu)
  - cgroup/rstat: Tracking cgroup-level niced CPU time (Joshua Hahn)
  - tracing: Correct the refcount if the hist/hist_debug file fails to open (Tengda Wu)
  - tracing/hist: Support POLLPRI event for poll on histogram (Masami Hiramatsu (Google))
  - tracing/hist: Add poll(POLLIN) support on hist file (Masami Hiramatsu (Google))
  - tracing: Switch trace_events_hist.c code over to use guard() (Steven Rostedt)
  - tools/power turbostat: report CoreThr per measurement interval (Len Brown)
  - perf/core: Fix child_total_time_enabled accounting bug at task exit (Yeoreum Yun)
  - drm/amdgpu/gfx12: fix num_mec (Alex Deucher)
  - drm/amdgpu/gfx11: fix num_mec (Alex Deucher)
  - kbuild: deb-pkg: don't set KBUILD_BUILD_VERSION unconditionally (Alexandru Gagniuc)
  - net: ibmveth: make veth_pool_store stop hanging (Dave Marquardt)
  - arcnet: Add NULL check in com20020pci_probe() (Henry Martin)
  - ipv6: Do not consider link down nexthops in path selection (Ido Schimmel)
  - ipv6: Start path selection from the first nexthop (Ido Schimmel)
  - net: fix geneve_opt length integer overflow (Lin Ma)
  - net: dsa: mv88e6xxx: propperly shutdown PPU re-enable timer on destroy (David Oberhollenzer)
  - ipv6: fix omitted netlink attributes when using RTEXT_FILTER_SKIP_STATS (Fernando Fernandez Mancera)
  - netfilter: nft_tunnel: fix geneve_opt type confusion addition (Lin Ma)
  - net: decrease cached dst counters in dst_release (Antoine Tenart)
  - tunnels: Accept PACKET_HOST in skb_tunnel_check_pmtu(). (Guillaume Nault)
  - vsock: avoid timeout during connect() if the socket is closing (Stefano Garzarella)
  - udp: Fix memory accounting leak. (Kuniyuki Iwashima)
  - udp: Fix multiple wraparounds of sk->sk_rmem_alloc. (Kuniyuki Iwashima)
  - net: mvpp2: Prevent parser TCAM memory corruption (Tobias Waldekranz)
  - sctp: add mutual exclusion in proc_sctp_do_udp_port() (Eric Dumazet)
  - net_sched: skbprio: Remove overly strict queue assertions (Cong Wang)
  - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (Debin Zhu)
  - netfilter: nf_tables: don't unregister hook when table is dormant (Florian Westphal)
  - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Pablo Neira Ayuso)
  - idpf: fix adapter NULL pointer dereference on reboot (Emil Tantilov)
  - e1000e: change k1 configuration on MTP and later platforms (Vitaly Lifshits)
  - spi: bcm2835: Restore native CS probing when pinctrl-bcm2835 is absent (Florian Fainelli)
  - ALSA: hda/realtek: Fix built-in mic on another ASUS VivoBook model (Takashi Iwai)
  - spi: bcm2835: Do not call gpiod_put() on invalid descriptor (Florian Fainelli)
  - ASoC: imx-card: Add NULL check in imx_card_probe() (Henry Martin)
  - nvme/ioctl: don't warn on vectorized uring_cmd with fixed buffer (Caleb Sander Mateos)
  - riscv/purgatory: 4B align purgatory_start (Björn Töpel)
  - riscv/kexec_file: Handle R_RISCV_64 in purgatory relocator (Yao Zi)
  - riscv: Fix hugetlb retrieval of number of ptes in case of !present pte (Alexandre Ghiti)
  - spi: cadence: Fix out-of-bounds array access in cdns_mrvl_xspi_setup_clock() (Josh Poimboeuf)
  - ASoC: codecs: rt5665: Fix some error handling paths in rt5665_probe() (Christophe JAILLET)
  - s390/entry: Fix setting _CIF_MCCK_GUEST with lowcore relocation (Sven Schnelle)
  - ublk: make sure ubq->canceling is set when queue is frozen (Ming Lei)
  - x86/uaccess: Improve performance by aligning writes to 8 bytes in copy_user_generic(), on non-FSRM/ERMS CPUs (Herton R. Krzesinski)
  - RISC-V: errata: Use medany for relocatable builds (Palmer Dabbelt)
  - ALSA: hda/realtek: Fix built-in mic breakage on ASUS VivoBook X515JA (Takashi Iwai)
  - firmware: cs_dsp: Ensure cs_dsp_load[_coeff]() returns 0 on success (Richard Fitzgerald)
  - ntb: intel: Fix using link status DB's (Nikita Shubin)
  - ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans (Yajun Deng)
  - riscv: ftrace: Add parentheses in macro definitions of make_call_t0 and make_call_ra (Juhan Jin)
  - fs/9p: fix NULL pointer dereference on mkdir (Christian Schoenebeck)
  - spufs: fix a leak in spufs_create_context() (Al Viro)
  - spufs: fix gang directory lifetimes (Al Viro)
  - spufs: fix a leak on spufs_new_file() failure (Al Viro)
  - netfs: Fix netfs_unbuffered_read() to return ssize_t rather than int (David Howells)
  - hwmon: (nct6775-core) Fix out of bounds access for NCT679{8,9} (Tasos Sahanidis)
  - memory: omap-gpmc: drop no compatible check (Roger Quadros)
  - can: statistics: use atomic access in hot path (Oliver Hartkopp)
  - ALSA: hda/realtek: Add mute LED quirk for HP Pavilion x360 14-dy1xxx (Navon John Lukose)
  - selftests: netfilter: skip br_netfilter queue tests if kernel is tainted (Florian Westphal)
  - net: devmem: do not WARN conditionally after netdev_rx_queue_restart() (Taehee Yoo)
  - drm/amd: Keep display off while going into S4 (Mario Limonciello)
  - nvme-pci: fix stuck reset on concurrent DPC and HP (Keith Busch)
  - x86/sgx: Warn explicitly if X86_FEATURE_SGX_LC is not enabled (Vladis Dronov)
  - x86/hyperv: Fix output argument to hypercall that changes page visibility (Michael Kelley)
  - locking/semaphore: Use wake_q to wake up processes outside lock critical section (Waiman Long)
  - wifi: mac80211: fix SA Query processing in MLO (Johannes Berg)
  - wifi: mac80211: flush the station before moving it to UN-AUTHORIZED state (Emmanuel Grumbach)
  - ASoC: rt1320: set wake_capable = 0 explicitly (Bard Liao)
  - ASoC: codecs: wsa884x: report temps to hwmon in millidegree of Celsius (Alexey Klimov)
  - x86/hyperv/vtl: Stop kernel from probing VTL0 low memory (Naman Jain)
  - sched/deadline: Use online cpus for validating runtime (Shrikanth Hegde)
  - ALSA: hda/realtek: Add support for ASUS Zenbook UM3406KA Laptops using CS35L41 HDA (Stefan Binding)
  - ALSA: hda/realtek: Add support for ASUS B5405 and B5605 Laptops using CS35L41 HDA (Stefan Binding)
  - ALSA: hda/realtek: Add support for ASUS B3405 and B3605 Laptops using CS35L41 HDA (Stefan Binding)
  - ALSA: hda/realtek: Add support for various ASUS Laptops using CS35L41 HDA (Stefan Binding)
  - ALSA: hda/realtek: Add support for ASUS ROG Strix G614 Laptops using CS35L41 HDA (Stefan Binding)
  - ALSA: hda/realtek: Add support for ASUS ROG Strix GA603 Laptops using CS35L41 HDA (Stefan Binding)
  - ALSA: hda/realtek: Add support for ASUS ROG Strix G814 Laptop using CS35L41 HDA (Stefan Binding)
  - exfat: add a check for invalid data size (Yuezhang Mo)
  - platform/x86/amd/pmf: Update PMF Driver for Compatibility with new PMF-TA (Shyam Sundar S K)
  - platform/x86/amd/pmf: Propagate PMF-TA return codes (Shyam Sundar S K)
  - HID: i2c-hid: improve i2c_hid_get_report error message (Wentao Guan)
  - net: dsa: rtl8366rb: don't prompt users for LED control (Jakub Kicinski)
  - platform/x86/intel/vsec: Add Diamond Rapids support (David E. Box)
  - platform/x86: intel-hid: fix volume buttons on Microsoft Surface Go 4 tablet (Dmitry Panchenko)
  - cifs: fix incorrect validation for num_aces field of smb_acl (Namjae Jeon)
  - smb: common: change the data type of num_aces to le16 (Namjae Jeon)
  - perf/core: Fix perf_pmu_register() vs. perf_init_event() (Peter Zijlstra)
  - ALSA: hda: Fix speakers on ASUS EXPERTBOOK P5405CSA 1.0 (Daniel Bárta)
  - ALSA: hda/realtek: Fix Asus Z13 2025 audio (Antheas Kapenekakis)
  - affs: don't write overlarge OFS data block size fields (Simon Tatham)
  - affs: generate OFS sequence numbers starting at 1 (Simon Tatham)
  - wifi: brcmfmac: keep power during suspend if board requires it (Matthias Proske)
  - nvme-pci: skip CMB blocks incompatible with PCI P2P DMA (Icenowy Zheng)
  - nvme-pci: clean up CMBMSC when registering CMB fails (Icenowy Zheng)
  - nvme-tcp: fix possible UAF in nvme_tcp_poll (Sagi Grimberg)
  - wifi: iwlwifi: mvm: use the right version of the rate API (Emmanuel Grumbach)
  - wifi: iwlwifi: fw: allocate chained SG tables for dump (Johannes Berg)
  - wifi: mac80211: remove debugfs dir for virtual monitor (Alexander Wetzel)
  - wifi: mac80211: Cleanup sta TXQs on flush (Alexander Wetzel)
  - nfs: Add missing release on error in nfs_lock_and_join_requests() (Dan Carpenter)
  - objtool/loongarch: Add unwind hints in prepare_frametrace() (Josh Poimboeuf)
  - rcu-tasks: Always inline rcu_irq_work_resched() (Josh Poimboeuf)
  - context_tracking: Always inline ct_{nmi,irq}_{enter,exit}() (Josh Poimboeuf)
  - sched/smt: Always inline sched_smt_active() (Josh Poimboeuf)
  - objtool: Fix verbose disassembly if CROSS_COMPILE isn't set (David Laight)
  - octeontx2-af: Free NIX_AF_INT_VEC_GEN irq (Geetha sowjanya)
  - octeontx2-af: Fix mbox INTR handler when num VFs > 64 (Geetha sowjanya)
  - net: phy: broadcom: Correct BCM5221 PHY model detection (Jim Liu)
  - ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (Giovanni Gherdovich)
  - LoongArch: Rework the arch_kgdb_breakpoint() implementation (Yuli Wang)
  - LoongArch: Fix device node refcount leak in fdt_cpu_clk_init() (Miaoqian Lin)
  - LoongArch: Fix help text of CMDLINE_EXTEND in Kconfig (谢致邦 (XIE Zhibang))
  - objtool: Fix segfault in ignore_unreachable_insn() (Josh Poimboeuf)
  - ring-buffer: Fix bytes_dropped calculation issue (Feng Yang)
  - net/mlx5e: SHAMPO, Make reserved size independent of page size (Lama Kayal)
  - ksmbd: fix r_count dec/increment mismatch (Namjae Jeon)
  - ksmbd: fix multichannel connection failure (Namjae Jeon)
  - ksmbd: use aead_request_free to match aead_request_alloc (Miaoqian Lin)
  - rndis_host: Flag RNDIS modems as WWAN devices (Lubomir Rintel)
  - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Mark Zhang)
  - exfat: fix missing shutdown check (Yuezhang Mo)
  - exfat: fix the infinite loop in exfat_find_last_cluster() (Yuezhang Mo)
  - smb: client: Fix netns refcount imbalance causing leaks and use-after-free (Wang Zhaolong)
  - NFS: Shut down the nfs_client only after all the superblocks (Trond Myklebust)
  - objtool, media: dib8000: Prevent divide-by-zero in dib8000_set_dds() (Josh Poimboeuf)
  - objtool, nvmet: Fix out-of-bounds stack access in nvmet_ctrl_state_show() (Josh Poimboeuf)
  - thermal: core: Remove duplicate struct declaration (xueqin Luo)
  - perf bpf-filter: Fix a parsing error with comma (Namhyung Kim)
  - perf tools: annotate asm_pure_loop.S (Marcus Meissner)
  - fs/procfs: fix the comment above proc_pid_wchan() (Bart Van Assche)
  - perf vendor events arm64 AmpereOneX: Fix frontend_bound calculation (Ilkka Koskinen)
  - tty: n_tty: use uint for space returned by tty_write_room() (Jiri Slaby (SUSE))
  - staging: vchiq_arm: Fix possible NPR of keep-alive thread (Stefan Wahren)
  - staging: vchiq_arm: Register debugfs after cdev (Stefan Wahren)
  - staging: rtl8723bs: select CONFIG_CRYPTO_LIB_AES (谢致邦 (XIE Zhibang))
  - perf: intel-tpebs: Fix incorrect usage of zfree() (James Clark)
  - perf python: Check if there is space to copy all the event (Arnaldo Carvalho de Melo)
  - perf python: Don't keep a raw_data pointer to consumed ring buffer space (Arnaldo Carvalho de Melo)
  - perf python: Decrement the refcount of just created event on failure (Arnaldo Carvalho de Melo)
  - perf python: Fixup description of sample.id event member (Arnaldo Carvalho de Melo)
  - i3c: master: svc: Fix missing the IBI rules (Stanley Chu)
  - um: hostfs: avoid issues on inode number reuse by host (Benjamin Berg)
  - um: remove copy_from_kernel_nofault_allowed (Benjamin Berg)
  - um: Pass the correct Rust target and options with gcc (David Gow)
  - selftests/mm/cow: fix the incorrect error handling (Cyan Yang)
  - fuse: fix dax truncate/punch_hole fault path (Alistair Popple)
  - NFS: fix open_owner_id_maxsz and related fields. (NeilBrown)
  - NFSv4: Avoid unnecessary scans of filesystems for delayed delegations (Trond Myklebust)
  - NFSv4: Avoid unnecessary scans of filesystems for expired delegations (Trond Myklebust)
  - NFSv4: Avoid unnecessary scans of filesystems for returning delegations (Trond Myklebust)
  - NFSv4: Don't trigger uneccessary scans for return-on-close delegations (Trond Myklebust)
  - arch/powerpc: drop GENERIC_PTDUMP from mpc885_ads_defconfig (Anshuman Khandual)
  - ocfs2: validate l_tree_depth to avoid out-of-bounds access (Vasiliy Kovalev)
  - kexec: initialize ELF lowest address to ULONG_MAX (Sourabh Jain)
  - kernel/events/uprobes: handle device-exclusive entries correctly in __replace_page() (David Hildenbrand)
  - perf units: Fix insufficient array space (Arnaldo Carvalho de Melo)
  - perf evlist: Add success path to evlist__create_syswide_maps (Ian Rogers)
  - perf debug: Avoid stack overflow in recursive error message (Ian Rogers)
  - iio: light: Add check for array bounds in veml6075_read_int_time_ms (Karan Sanghavi)
  - iio: adc: ad7768-1: set MOSI idle state to prevent accidental reset (Jonathan Santos)
  - iio: adc: ad7173: Fix comparison of channel configs (Uwe Kleine-König)
  - iio: adc: ad7124: Fix comparison of channel configs (Uwe Kleine-König)
  - iio: adc: ad4130: Fix comparison of channel setups (Uwe Kleine-König)
  - dmaengine: fsl-edma: free irq correctly in remove path (Peng Fan)
  - dmaengine: fsl-edma: cleanup chan after dma_async_device_unregister (Peng Fan)
  - fs/ntfs3: Prevent integer overflow in hdr_first_de() (Dan Carpenter)
  - fs/ntfs3: Fix a couple integer overflows on 32bit systems (Dan Carpenter)
  - usb: xhci: correct debug message page size calculation (Niklas Neronin)
  - perf bench: Fix perf bench syscall loop count (Thomas Richter)
  - perf arm-spe: Fix load-store operation checking (Leo Yan)
  - iio: backend: make sure to NULL terminate stack buffer (Nuno Sá)
  - iio: accel: msa311: Fix failure to release runtime pm if direct mode claim fails. (Jonathan Cameron)
  - iio: accel: mma8452: Ensure error return on failure to matching oversampling ratio (Jonathan Cameron)
  - ucsi_ccg: Don't show failed to get FW build information error (Mario Limonciello)
  - perf build: Fix in-tree build due to symbolic link (Luca Ceresoli)
  - tools/x86: Fix linux/unaligned.h include path in lib/insn.c (Ian Rogers)
  - perf pmu: Don't double count common sysfs and json events (James Clark)
  - coresight-etm4x: add isb() before reading the TRCSTATR (Yuanfang Zhang)
  - vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint (Mike Christie)
  - coresight: catu: Fix number of pages while using 64k pages (Ilkka Koskinen)
  - greybus: gb-beagleplay: Add error handling for gb_greybus_init (Wentao Liang)
  - perf report: Switch data file correctly in TUI (Namhyung Kim)
  - soundwire: slave: fix an OF node reference leak in soundwire slave device (Joe Hattori)
  - isofs: fix KMSAN uninit-value bug in do_isofs_readdir() (Qasim Ijaz)
  - phy: phy-rockchip-samsung-hdptx: Don't use dt aliases to determine phy-id (Heiko Stuebner)
  - fs/ntfs3: Update inode->i_mapping->a_ops on compression state (Konstantin Komarov)
  - w1: fix NULL pointer dereference in probe (Chenyuan Yang)
  - perf: Always feature test reallocarray (James Clark)
  - perf stat: Fix find_stat for mixed legacy/non-legacy events (Ian Rogers)
  - clk: qcom: mmcc-sdm660: fix stuck video_subcore0 clock (Barnabás Czémán)
  - pinctrl: intel: Fix wrong bypass assignment in intel_pinctrl_probe_pwm() (Andy Shevchenko)
  - crypto: hisilicon/sec2 - fix for aead auth key length (Wenkai Lin)
  - RDMA/core: Fix use-after-free when rename device name (Wang Liang)
  - x86/dumpstack: Fix inaccurate unwinding from exception stacks due to misplaced assignment (Jann Horn)
  - leds: Fix LED_OFF brightness race (Remi Pommarel)
  - mfd: sm501: Switch to BIT() to mitigate integer overflows (Nikita Zhandarovich)
  - pinctrl: renesas: rzv2m: Fix missing of_node_put() call (Fabrizio Castro)
  - RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow (Patrisious Haddad)
  - bpf: Fix array bounds error with may_goto (Jiayuan Chen)
  - clk: qcom: gcc-sm8650: Do not turn off USB GDSCs during gdsc_disable() (Neil Armstrong)
  - crypto: nx - Fix uninitialised hv_nxc on error (Herbert Xu)
  - power: supply: max77693: Fix wrong conversion of charge input threshold value (Artur Weber)
  - x86/entry: Fix ORC unwinder for PUSH_REGS with save_ret=1 (Jann Horn)
  - clk: amlogic: g12a: fix mmc A peripheral clock (Jerome Brunet)
  - clk: clk-imx8mp-audiomix: fix dsp/ocram_a clock parents (Laurentiu Mihalcea)
  - crypto: qat - remove access to parity register for QAT GEN4 (Bairavi Alagappan)
  - pinctrl: npcm8xx: Fix incorrect struct npcm8xx_pincfg assignment (Andy Shevchenko)
  - rust: fix signature of rust_fmt_argument (Alice Ryhl)
  - selftests/bpf: Select NUMA_NO_NODE to create map (Saket Kumar Bhaskar)
  - clk: amlogic: gxbb: drop non existing 32k clock parent (Jerome Brunet)
  - clk: amlogic: g12b: fix cluster A parent data (Jerome Brunet)
  - pinctrl: tegra: Set SFIO mode to Mux Register (Prathamesh Shete)
  - IB/mad: Check available slots before posting receive WRs (Maher Sanalla)
  - crypto: api - Fix larval relookup type and mask (Herbert Xu)
  - power: supply: bq27xxx_battery: do not update cached flags prematurely (Sicelo A. Mhlongo)
  - remoteproc: qcom_q6v5_mss: Handle platforms with one power domain (Luca Weiss)
  - RDMA/erdma: Prevent use-after-free in erdma_accept_newconn() (Cheng Xu)
  - RDMA/mlx5: Fix calculation of total invalidated pages (Chiara Meiohas)
  - RDMA/core: Don't expose hw_counters outside of init net namespace (Roman Gushchin)
  - clk: rockchip: rk3328: fix wrong clk_ref_usb3otg parent (Peter Geis)
  - selftests/bpf: Fix freplace_link segfault in tailcalls prog test (Tengda Wu)
  - RDMA/mlx5: Fix MR cache initialization error flow (Michael Guralnik)
  - pinctrl: renesas: rzg2l: Fix missing of_node_put() call (Fabrizio Castro)
  - pinctrl: renesas: rza2: Fix missing of_node_put() call (Fabrizio Castro)
  - lib: 842: Improve error handling in sw842_compress() (Tanya Agarwal)
  - bpf: Use preempt_count() directly in bpf_send_signal_common() (Hou Tao)
  - clk: qcom: gcc-x1e80100: Unregister GCC_GPU_CFG_AHB_CLK/GCC_DISP_XO_CLK (Konrad Dybcio)
  - remoteproc: qcom_q6v5_pas: Use resource with CX PD for MSM8226 (Luca Weiss)
  - crypto: tegra - Set IV to NULL explicitly for AES ECB (Akhil R)
  - RDMA/mana_ib: Ensure variable err is initialized (Kees Bakker)
  - s390: Remove ioremap_wt() and pgprot_writethrough() (Niklas Schnelle)
  - clk: qcom: gcc-msm8953: fix stuck venus0_core0 clock (Vladimir Lypak)
  - crypto: tegra - Fix CMAC intermediate result handling (Akhil R)
  - pinctrl: nuvoton: npcm8xx: Fix error handling in npcm8xx_gpio_fw() (Yue Haibing)
  - clk: samsung: Fix UBSAN panic in samsung_clk_init() (Will McVicker)
  - remoteproc: qcom: pas: add minidump_id to SC7280 WPSS (Luca Weiss)
  - clk: renesas: r8a08g045: Check the source of the CPU PLL settings (Claudiu Beznea)
  - x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range() (David Hildenbrand)
  - selftests/bpf: Fix string read in strncmp benchmark (Viktor Malik)
  - libbpf: Fix hypothetical STT_SECTION extern NULL deref case (Andrii Nakryiko)
  - remoteproc: qcom_q6v5_pas: Make single-PD handling more robust (Luca Weiss)
  - pinctrl: renesas: rzg2l: Suppress binding attributes (Claudiu Beznea)
  - of: property: Increase NR_FWNODE_REFERENCE_ARGS (Zijun Hu)
  - remoteproc: core: Clear table_sz when rproc_shutdown (Peng Fan)
  - RDMA/mlx5: Fix page_size variable overflow (Michael Guralnik)
  - crypto: hisilicon/sec2 - fix for sec spec check (Wenkai Lin)
  - crypto: hisilicon/sec2 - fix for aead authsize alignment (Wenkai Lin)
  - clk: amlogic: gxbb: drop incorrect flag on 32k clock (Jerome Brunet)
  - crypto: tegra - Use HMAC fallback when keyslots are full (Akhil R)
  - crypto: bpf - Add MODULE_DESCRIPTION for skcipher (Arnd Bergmann)
  - crypto: tegra - check return value for hash do_one_req (Akhil R)
  - crypto: tegra - Use separate buffer for setkey (Akhil R)
  - crypto: qat - set parity error mask for qat_420xx (Bairavi Alagappan)
  - crypto: iaa - Test the correct request flag (Herbert Xu)
  - fbdev: sm501fb: Add some geometry checks. (Danila Chernetsov)
  - mdacon: rework dependency list (Arnd Bergmann)
  - dummycon: fix default rows/cols (Arnd Bergmann)
  - fbdev: au1100fb: Move a variable assignment behind a null pointer check (Markus Elfring)
  - PCI: pciehp: Don't enable HPIE when resuming in poll mode (Ilpo Järvinen)
  - PCI: Fix BAR resizing when VF BARs are assigned (Ilpo Järvinen)
  - PCI: histb: Fix an error handling path in histb_pcie_probe() (Christophe JAILLET)
  - PCI: dwc: ep: Return -ENOMEM for allocation failures (Dan Carpenter)
  - drm/amd/display: avoid NPD when ASIC does not support DMUB (Thadeu Lima de Souza Cascardo)
  - drm/mediatek: dsi: fix error codes in mtk_dsi_host_transfer() (Dan Carpenter)
  - drm/mediatek: dp: drm_err => dev_err in HPD path to avoid NULL ptr (Douglas Anderson)
  - drm/mediatek: Fix config_updating flag never false when no mbox channel (Jason-JH Lin)
  - PCI: xilinx-cpm: Fix IRQ domain leak in error path of probe (Thippeswamy Havalige)
  - PCI: Remove stray put_device() in pci_register_host_bridge() (Dan Carpenter)
  - powerpc/kexec: fix physical address calculation in clear_utlb_entry() (Christophe Leroy)
  - crypto: powerpc: Mark ghashp8-ppc.o as an OBJECT_FILES_NON_STANDARD (Christophe Leroy)
  - drm/msm/a6xx: Fix a6xx indexed-regs in devcoreduump (Rob Clark)
  - drm/amd/display: fix type mismatch in CalculateDynamicMetadataParameters() (Vitaliy Shevtsov)
  - drm/panthor: Update CS_STATUS_ defines to correct values (Ashley Smith)
  - PCI: Avoid reset when disabled via sysfs (Nishanth Aravamudan)
  - PCI/portdrv: Only disable pciehp interrupts early when needed (Feng Tang)
  - PCI: brcmstb: Fix potential premature regulator disabling (Jim Quinlan)
  - PCI: brcmstb: Fix error path after a call to regulator_bulk_get() (Jim Quinlan)
  - PCI: brcmstb: Use internal register to change link capability (Jim Quinlan)
  - PCI: brcmstb: Set generation limit before PCIe link up (Jim Quinlan)
  - PCI: cadence-ep: Fix the driver to send MSG TLP for INTx without data payload (Hans Zhang)
  - drm/amdkfd: Fix Circular Locking Dependency in 'svm_range_cpu_invalidate_pagetables' (Srinivasan Shanmugam)
  - drm/msm/dsi: Set PHY usescase (and mode) before registering DSI host (Marijn Suijten)
  - drm/msm/dsi: Use existing per-interface slice count in DSC timing (Marijn Suijten)
  - drm/msm/dsi/phy: Program clock inverters in correct register (Krzysztof Kozlowski)
  - drm/msm/dpu: don't use active in atomic_check() (Dmitry Baryshkov)
  - drm/amd/display: fix an indent issue in DML21 (Aurabindo Pillai)
  - PCI/ACS: Fix 'pci=config_acs=' parameter (Tushar Dave)
  - drm/panel: ilitek-ili9882t: fix GPIO name in error message (John Keeping)
  - PCI/ASPM: Fix link state exit during switch upstream function removal (Daniel Stodden)
  - drm/mediatek: mtk_hdmi: Fix typo for aud_sampe_size member (AngeloGioacchino Del Regno)
  - drm/mediatek: mtk_hdmi: Unregister audio platform device on failure (AngeloGioacchino Del Regno)
  - PCI: Remove add_align overwrite unrelated to size0 (Ilpo Järvinen)
  - PCI: Use downstream bridges for distributing resources (Kai-Heng Feng)
  - drm/amdgpu/umsch: fix ucode check (Alex Deucher)
  - drm/amdgpu: refine smu send msg debug log format (Yang Wang)
  - gpu: cdns-mhdp8546: fix call balance of mhdp->clk handling routines (Vitalii Mordan)
  - drm/vkms: Fix use after free and double free on init error (José Expósito)
  - drm: xlnx: zynqmp: Fix max dma segment size (Tomi Valkeinen)
  - drm/bridge: it6505: fix HDCP V match check is not performed correctly (Hermes Wu)
  - drm/dp_mst: Fix drm RAD print (Wayne Lin)
  - drm/ssd130x: ensure ssd132x pitch is correct (John Keeping)
  - drm/ssd130x: fix ssd132x encoding (John Keeping)
  - drm/ssd130x: Set SPI .id_table to prevent an SPI core warning (Javier Martinez Canillas)
  - drm/bridge: ti-sn65dsi86: Fix multiple instances (Geert Uytterhoeven)
  - ALSA: timer: Don't take register_mutex with copy_from/to_user() (Takashi Iwai)
  - ASoC: ti: j721e-evm: Fix clock configuration for ti,j7200-cpb-audio compatible (Jayesh Choudhary)
  - ALSA: hda/realtek: Always honor no_shutup_pins (Takashi Iwai)
  - dt-bindings: vendor-prefixes: add GOcontroll (Maud Spierings)
  - HID: remove superfluous (and wrong) Makefile entry for CONFIG_INTEL_ISH_FIRMWARE_DOWNLOADER (Jiri Kosina)
  - ASoC: amd: acp: Fix for enabling DMIC on acp platforms via _DSD entry (Venkata Prasad Potturu)
  - ASoC: cs35l41: check the return value from spi_setup() (Vitaliy Shevtsov)
  - platform/x86: dell-ddv: Fix temperature calculation (Armin Wolf)
  - platform/x86: dell-uart-backlight: Make dell_uart_bl_serdev_driver static (Ilpo Järvinen)
  - platform/x86: lenovo-yoga-tab2-pro-1380-fastcharger: Make symbol static (Ilpo Järvinen)
  - auxdisplay: panel: Fix an API misuse in panel.c (Andy Shevchenko)
  - media: platform: allgro-dvt: unregister v4l2_device on the error path (Joe Hattori)
  - media: verisilicon: HEVC: Initialize start_bit field (Benjamin Gaignard)
  - auxdisplay: MAX6959 should select BITREVERSE (Geert Uytterhoeven)
  - regulator: pca9450: Fix enable register for LDO5 (Frieder Schrempf)
  - x86/entry: Add __init to ia32_emulation_override_cmdline() (Vitaly Kuznetsov)
  - x86/fpu/xstate: Fix inconsistencies in guest FPU xfeatures (Chao Gao)
  - x86/traps: Make exc_double_fault() consistently noreturn (Josh Poimboeuf)
  - perf/ring_buffer: Allow the EPOLLRDNORM flag for poll (Tao Chen)
  - lockdep: Don't disable interrupts on RT in disable_irq_nosync_lockdep.*() (Sebastian Andrzej Siewior)
  - PM: sleep: Fix handling devices with direct_complete set on errors (Rafael J. Wysocki)
  - thermal: int340x: Add NULL check for adev (Chenyuan Yang)
  - x86/resctrl: Fix allocation of cleanest CLOSID on platforms with no monitors (James Morse)
  - EDAC/ie31200: Fix the error path order of ie31200_init() (Qiuxu Zhuo)
  - EDAC/ie31200: Fix the DIMM size mask for several SoCs (Qiuxu Zhuo)
  - EDAC/ie31200: Fix the size of EDAC_MC_LAYER_CHIP_SELECT layer (Qiuxu Zhuo)
  - selinux: Chain up tool resolving errors in install_policy.sh (Tim Schumacher)
  - watchdog/hardlockup/perf: Fix perf_event memory leak (Li Huafei)
  - kunit/stackinit: Use fill byte different from Clang i386 pattern (Kees Cook)
  - RISC-V: KVM: Disable the kernel perf counter during configure (Atish Patra)
  - cpufreq: tegra194: Allow building for Tegra234 (Aaron Kling)
  - PM: sleep: Adjust check before setting power.must_resume (Rafael J. Wysocki)
  - lockdep/mm: Fix might_fault() lockdep check of current->mm->mmap_lock (Peter Zijlstra)
  - x86/sev: Add missing RIP_REL_REF() invocations during sme_enable() (Kevin Loughlin)
  - x86/platform: Only allow CONFIG_EISA for 32-bit (Arnd Bergmann)
  - x86/fpu: Avoid copying dynamic FP state from init_task in arch_dup_task_struct() (Benjamin Berg)
  - x86/fpu: Fix guest FPU state buffer allocation size (Stanislav Spassov)
  - EDAC/{skx_common,i10nm}: Fix some missing error reports on Emerald Rapids (Qiuxu Zhuo)
  - cpufreq: governor: Fix negative 'idle_time' handling in dbs_update() (Jie Zhan)
  - sched/eevdf: Force propagating min_slice of cfs_rq when {en,de}queue tasks (Tianchen Ding)
  - sched: Cancel the slice protection of the idle entity (zihan zhou)
  - smack: ipv4/ipv6: tcp/dccp/sctp: fix incorrect child socket label (Konstantin Andreev)
  - smack: dont compile ipv6 code unless ipv6 is configured (Konstantin Andreev)
  - cpufreq: scpi: compare kHz instead of Hz (zuoqian)
  - x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Mike Rapoport (Microsoft))
  - watch_queue: fix pipe accounting mismatch (Eric Sandeen)
  - LTS version: v6.12.22 (Jack Vogel)
  - bcachefs: bch2_ioctl_subvolume_destroy() fixes (Kent Overstreet)
  - serial: 8250_dma: terminate correct DMA in tx_dma_flush() (John Keeping)
  - serial: stm32: do not deassert RS485 RTS GPIO prematurely (Cheick Traore)
  - perf tools: Fix up some comments and code to properly use the event_source bus (Greg Kroah-Hartman)
  - memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (Luo Qiu)
  - usb: xhci: Apply the link chain quirk on NEC isoc endpoints (Michal Pecio)
  - usb: xhci: Don't skip on Stopped - Length Invalid (Michal Pecio)
  - net: usb: usbnet: restore usb%d name exception for local mac addresses (Dominique Martinet)
  - net: usb: qmi_wwan: add Telit Cinterion FE990B composition (Fabio Porcedda)
  - net: usb: qmi_wwan: add Telit Cinterion FN990B composition (Fabio Porcedda)
  - tty: serial: fsl_lpuart: disable transmitter before changing RS485 related registers (Sherry Sun)
  - tty: serial: 8250: Add Brainboxes XC devices (Cameron Williams)
  - tty: serial: 8250: Add some more device IDs (Cameron Williams)
  - counter: microchip-tcb-capture: Fix undefined counter channel state on probe (William Breathitt Gray)
  - counter: stm32-lptimer-cnt: fix error handling when enabling (Fabrice Gasnier)
  - ALSA: hda/realtek: Support mute LED on HP Laptop 15s-du3xxx (Dhruv Deshpande)
  - netfilter: socket: Lookup orig tuple for IPv6 SNAT (Maxim Mikityanskiy)
  - drm/amd/display: Don't write DP_MSTM_CTRL after LT (Wayne Lin)
  - atm: Fix NULL pointer dereference (Minjoong Kim)
  - HID: hid-plantronics: Add mic mute mapping and generalize quirks (Terry Junge)
  - ALSA: usb-audio: Add quirk for Plantronics headsets to fix control names (Terry Junge)
  - LTS version: v6.12.21 (Jack Vogel)
  - mptcp: Fix data stream corruption in the address announcement (Arthur Mongodin)
  - mm/huge_memory: drop beyond-EOF folios with the right number of refs (Zi Yan)
  - arm64: dts: rockchip: fix u2phy1_host status for NanoPi R4S (Justin Klaassen)
  - libsubcmd: Silence compiler warning (Eder Zulian)
  - Revert "sched/core: Reduce cost of sched_move_task when config autogroup" (Dietmar Eggemann)
  - KVM: arm64: Eagerly switch ZCR_EL{1,2} (Mark Rutland)
  - KVM: arm64: Mark some header functions as inline (Mark Rutland)
  - KVM: arm64: Refactor exit handlers (Mark Rutland)
  - KVM: arm64: Remove VHE host restore of CPACR_EL1.SMEN (Mark Rutland)
  - KVM: arm64: Remove VHE host restore of CPACR_EL1.ZEN (Mark Rutland)
  - KVM: arm64: Remove host FPSIMD saving for non-protected KVM (Mark Rutland)
  - KVM: arm64: Unconditionally save+flush host FPSIMD/SVE/SME state (Mark Rutland)
  - KVM: arm64: Calculate cptr_el2 traps on activating traps (Fuad Tabba)
  - io_uring/net: fix sendzc double notif flush (Pavel Begunkov)
  - ksmbd: fix incorrect validation for num_aces field of smb_acl (Namjae Jeon)
  - drm/amdkfd: Fix user queue validation on Gfx7/8 (Philip Yang)
  - drm/amdgpu: Fix JPEG video caps max size for navi1x and raven (David Rosca)
  - drm/amdgpu: Fix MPEG2, MPEG4 and VC1 video caps max size (David Rosca)
  - drm/amdgpu: Remove JPEG from vega and carrizo video caps (David Rosca)
  - drm/amdgpu/pm: wire up hwmon fan speed for smu 14.0.2 (Alex Deucher)
  - drm/amdgpu/pm: Handle SCLK offset correctly in overdrive for smu 14.0.2 (Tomasz Pakuła)
  - drm/amdgpu: Restore uncached behaviour on GFX12 (David Belanger)
  - drm/amd/pm: add unique_id for gfx12 (Harish Kasiviswanathan)
  - drm/amd/display: Use HW lock mgr for PSR1 when only one eDP (Mario Limonciello)
  - drm/amd/display: Fix message for support_edp0_on_dp1 (Yilin Chen)
  - drm/amdgpu/gfx12: correct cleanup of 'me' field with gfx_v12_0_me_fini() (Wentao Liang)
  - drm/sched: Fix fence reference count leak (qianyi liu)
  - drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse() (Nikita Zhandarovich)
  - pmdomain: amlogic: fix T7 ISP secpower (Xianwei Zhao)
  - soc: qcom: pdr: Fix the potential deadlock (Saranya R)
  - batman-adv: Ignore own maximum aggregation size during RX (Sven Eckelmann)
  - xsk: fix an integer overflow in xp_create_and_assign_umem() (Gavrilov Ilia)
  - keys: Fix UAF in key_put() (David Howells)
  - efi/libstub: Avoid physical address 0x0 when doing random allocation (Ard Biesheuvel)
  - firmware: qcom: uefisecapp: fix efivars registration race (Johan Hovold)
  - ARM: shmobile: smp: Enforce shmobile_smp_* alignment (Geert Uytterhoeven)
  - ARM: dts: imx6qdl-apalis: Fix poweroff on Apalis iMX6 (Stefan Eichenberger)
  - memcg: drain obj stock on cpu hotplug teardown (Shakeel Butt)
  - proc: fix UAF in proc_get_inode() (Ye Bin)
  - mm/page_alloc: fix memory accept before watermarks gets initialized (Kirill A. Shutemov)
  - mm/migrate: fix shmem xarray update during migration (Zi Yan)
  - mm: fix error handling in __filemap_get_folio() with FGP_NOWAIT (Raphael S. Carvalho)
  - selftests/mm: run_vmtests.sh: fix half_ufd_size_MB calculation (Rafael Aquini)
  - mmc: atmel-mci: Add missing clk_disable_unprepare() (Gu Bowen)
  - mmc: sdhci-brcmstb: add cqhci suspend/resume to PM ops (Kamal Dasu)
  - arm64: dts: rockchip: fix pinmux of UART5 for PX30 Ringneck on Haikou (Quentin Schulz)
  - arm64: dts: rockchip: fix pinmux of UART0 for PX30 Ringneck on Haikou (Quentin Schulz)
  - arm64: dts: freescale: imx8mm-verdin-dahlia: add Microphone Jack to sound card (Stefan Eichenberger)
  - arm64: dts: freescale: imx8mp-verdin-dahlia: add Microphone Jack to sound card (Stefan Eichenberger)
  - accel/qaic: Fix integer overflow in qaic_validate_req() (Dan Carpenter)
  - regulator: check that dummy regulator has been probed before using it (Christian Eggers)
  - regulator: dummy: force synchronous probing (Christian Eggers)
  - netfs: Call `invalidate_cache` only if implemented (Max Kellermann)
  - riscv: dts: starfive: Fix a typo in StarFive JH7110 pin function definitions (E Shattow)
  - io_uring/net: don't clear REQ_F_NEED_CLEANUP unconditionally (Jens Axboe)
  - drm/v3d: Don't run jobs that have errors flagged in its fence (Maíra Canal)
  - drm/xe: Fix exporting xe buffers multiple times (Tomasz Rusinowicz)
  - can: flexcan: disable transceiver during system PM (Haibo Chen)
  - can: flexcan: only change CAN state when link up in system PM (Haibo Chen)
  - can: ucan: fix out of bound read in strscpy() source (Vincent Mailhol)
  - can: rcar_canfd: Fix page entries in the AFL list (Biju Das)
  - dt-bindings: can: renesas,rcar-canfd: Fix typo in pattern properties for R-Car V4M (Biju Das)
  - net: mana: Support holes in device list reply msg (Haiyang Zhang)
  - i2c: omap: fix IRQ storms (Andreas Kemnade)
  - tracing: tprobe-events: Fix leakage of module refcount (Masami Hiramatsu (Google))
  - Revert "gre: Fix IPv6 link-local address generation." (Guillaume Nault)
  - net/neighbor: add missing policy for NDTPA_QUEUE_LENBYTES (Lin Ma)
  - libfs: Fix duplicate directory entry in offset_dir_lookup (Yongjian Sun)
  - net: ipv6: ioam6: fix lwtunnel_output() loop (Justin Iurman)
  - net: lwtunnel: fix recursion loops (Justin Iurman)
  - net: ti: icssg-prueth: Add lock to stats (MD Danish Anwar)
  - net: atm: fix use after free in lec_send() (Dan Carpenter)
  - gpu: host1x: Do not assume that a NULL domain means no DMA IOMMU (Jason Gunthorpe)
  - phy: fix xa_alloc_cyclic() error handling (Michal Swiatkowski)
  - dpll: fix xa_alloc_cyclic() error handling (Michal Swiatkowski)
  - devlink: fix xa_alloc_cyclic() error handling (Michal Swiatkowski)
  - ipv6: Set errno after ip_fib_metrics_init() in ip6_route_info_create(). (Kuniyuki Iwashima)
  - ipv6: Fix memleak of nhc_pcpu_rth_output in fib_check_nh_v6_gw(). (Kuniyuki Iwashima)
  - net: ipv6: fix TCP GSO segmentation with NAT (Felix Fietkau)
  - net: ethernet: ti: am65-cpsw: Fix NAPI registration sequence (Vignesh Raghavendra)
  - ata: libata-core: Add ATA_QUIRK_NO_LPM_ON_ATI for certain Samsung SSDs (Niklas Cassel)
  - tracing: tprobe-events: Fix to clean up tprobe correctly when module unload (Masami Hiramatsu (Google))
  - ARM: davinci: da850: fix selecting ARCH_DAVINCI_DA8XX (David Lechner)
  - accel/qaic: Fix possible data corruption in BOs > 2G (Jeffrey Hugo)
  - Bluetooth: hci_event: Fix connection regression between LE and non-LE adapters (Arkadiusz Bokowy)
  - Bluetooth: Fix error code in chan_alloc_skb_cb() (Dan Carpenter)
  - RDMA/hns: Fix wrong value of max_sge_rd (Junxian Huang)
  - RDMA/hns: Fix missing xa_destroy() (Junxian Huang)
  - RDMA/hns: Fix a missing rollback in error path of hns_roce_create_qp_common() (Junxian Huang)
  - RDMA/hns: Fix invalid sq params not being blocked (Junxian Huang)
  - RDMA/hns: Fix unmatched condition in error path of alloc_user_qp_db() (Junxian Huang)
  - RDMA/hns: Fix soft lockup during bt pages loop (Junxian Huang)
  - RDMA/bnxt_re: Avoid clearing VLAN_ID mask in modify qp path (Saravanan Vajravel)
  - dma-mapping: fix missing clear bdr in check_ram_in_range_map() (Baochen Qiang)
  - ARM: dts: BCM5301X: Fix switch port labels of ASUS RT-AC3200 (Chester A. Unal)
  - ARM: dts: BCM5301X: Fix switch port labels of ASUS RT-AC5300 (Chester A. Unal)
  - ARM: dts: bcm2711: Don't mark timer regs unconfigured (Phil Elwell)
  - ARM: OMAP1: select CONFIG_GENERIC_IRQ_CHIP (Arnd Bergmann)
  - RDMA/mlx5: Handle errors returned from mlx5r_ib_rate() (Qasim Ijaz)
  - RDMA/bnxt_re: Add missing paranthesis in map_qp_id_to_tbl_indx (Kashyap Desai)
  - RDMA/rxe: Fix the failure of ibv_query_device() and ibv_query_device_ex() tests (Zhu Yanjun)
  - arm64: dts: rockchip: Remove undocumented sdmmc property from lubancat-1 (Yao Zi)
  - arm64: dts: bcm2712: PL011 UARTs are actually r1p5 (Phil Elwell)
  - ARM: dts: bcm2711: PL011 UARTs are actually r1p5 (Phil Elwell)
  - ARM: dts: bcm2711: Fix xHCI power-domain (Stefan Wahren)
  - soc: imx8m: Unregister cpufreq and soc dev in cleanup path (Peng Fan)
  - soc: imx8m: Use devm_* to simplify probe failure handling (Marek Vasut)
  - soc: imx8m: Remove global soc_uid (Marek Vasut)
  - xfrm_output: Force software GSO only in tunnel mode (Cosmin Ratiu)
  - xfrm: fix tunnel mode TX datapath in packet offload mode (Alexandre Cassen)
  - arm64: dts: rockchip: remove supports-cqe from rk3588 tiger (Heiko Stuebner)
  - arm64: dts: rockchip: remove supports-cqe from rk3588 jaguar (Heiko Stuebner)
  - arm64: dts: freescale: tqma8mpql: Fix vqmmc-supply (Alexander Stein)
  - firmware: imx-scu: fix OF node leak in .probe() (Joe Hattori)
  - firmware: qcom: scm: Fix error code in probe() (Dan Carpenter)
  - rds: Tear down the copy-from-user cache before destroying rds_wq (Håkon Bugge)  [Orabug: 37379052]
  - uek-rpm: Set uek_release variable in UEK 8 spec file (Harshit Mogalapalli)  [Orabug: 37801392]


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-1.23.2.el9uek]
changelog:
  - vhost_scsi: log write descriptors (Dongli Zhang)  [Orabug: 37393517]
  - vhost-scsi: protect vq->log_base with vq->mutex (Dongli Zhang)  [Orabug: 37393517]
  - RDS: avoid queueing delayed work on an offlined cpu (Praveen Kumar Kannoju)  [Orabug: 37260584] [Orabug: 37551308]
  - Revert "x86/simplefb: simplefb was broken on UEFI mode Oracle and HP system, skip VIDEO_TYPE_EFI" (Harshit Mogalapalli)  [Orabug: 37638881]
  - uek-rpm: Replace legacy FBDEV drivers with simpledrm and fbdev emulation layer (Harshit Mogalapalli)  [Orabug: 37638881]
  - uek-rpm/kernel-uek.spec: Set DEFAULTKERNEL correctly during %postun (Vijay Kumar)
  - uek-rpm: Enable gcov build (Sherry Yang)  [Orabug: 37734677]
  - uek-rpm: remove .el9 from shim version (Samasth Norway Ananda)  [Orabug: 37820202]
  - drm/mgag200: Added support for the new device G200eH5 (Gwenael Georgeault)  [Orabug: 37835185]


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-2.24.1.el9uek]
changelog:
  - x86/microcode/AMD: Clean the cache if update did not load microcode (Boris Ostrovsky)  [Orabug: 37800727]
  - LTS version: v6.12.24 (Jack Vogel)
  - HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition (Kaixin Wang)
  - s390/cpumf: Fix double free on error in cpumf_pmu_event_init() (Thomas Richter)
  - Bluetooth: hci_uart: Fix another race during initialization (Arseniy Krasnov)
  - media: mediatek: vcodec: mark vdec_vp9_slice_map_counts_eob_coef noinline (Arnd Bergmann)
  - kbuild: Add '-fno-builtin-wcslen' (Nathan Chancellor)
  - libbpf: Prevent compiler warnings/errors (Eder Zulian)
  - x86/e820: Fix handling of subpage regions when calculating nosave ranges in e820__register_nosave_regions() (Myrrh Periwinkle)
  - nfsd: don't ignore the return code of svc_proc_register() (Jeff Layton)
  - NFSD: Fix CB_GETATTR status fix (Chuck Lever)
  - NFSD: fix decoding in nfs4_xdr_dec_cb_getattr (Olga Kornievskaia)
  - ACPI: platform-profile: Fix CFI violation when accessing sysfs files (Nathan Chancellor)
  - iommufd: Fail replace if device has not been attached (Yi Liu)
  - iommufd: Make attach_handle generic than fault specific (Nicolin Chen)
  - arm64: errata: Add newer ARM cores to the spectre_bhb_loop_affected() lists (Douglas Anderson)
  - thermal/drivers/mediatek/lvts: Disable Stage 3 thermal threshold (Nícolas F. R. A. Prado)
  - thermal/drivers/mediatek/lvts: Disable monitor mode during suspend (Nícolas F. R. A. Prado)
  - selftests: mptcp: fix incorrect fd checks in main_loop (Cong Liu)
  - selftests: mptcp: close fd_in before returning in main_loop (Geliang Tang)
  - sched_ext: create_dsq: Return -EEXIST on duplicate request (Jake Hillion)
  - s390: Fix linker error when -no-pie option is unavailable (Sumanth Korikkar)
  - s390/virtio_ccw: Don't allocate/assign airqs for non-existing queues (David Hildenbrand)
  - s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs (Niklas Schnelle)
  - ring-buffer: Use flush_kernel_vmap_range() over flush_dcache_folio() (Steven Rostedt)
  - pinctrl: samsung: add support for eint_fltcon_offset (Peter Griffin)
  - pinctrl: qcom: Clear latched interrupt status when changing IRQ type (Stephan Gerhold)
  - phy: freescale: imx8m-pcie: assert phy reset and perst in power off (Stefan Eichenberger)
  - PCI: Fix wrong length of devres array (Philipp Stanner)
  - PCI: Fix reference leak in pci_register_host_bridge() (Ma Ke)
  - PCI: Fix reference leak in pci_alloc_child_bus() (Ma Ke)
  - PCI: pciehp: Avoid unnecessary device replacement check (Lukas Wunner)
  - PCI: j721e: Fix the value of .linkdown_irq_regfield for J784S4 (Siddharth Vadapalli)
  - PCI: brcmstb: Fix missing of_node_put() in brcm_pcie_probe() (Stanimir Varbanov)
  - of/irq: Fix device node refcount leakages in of_irq_init() (Zijun Hu)
  - of/irq: Fix device node refcount leakage in API irq_of_parse_and_map() (Zijun Hu)
  - of/irq: Fix device node refcount leakages in of_irq_count() (Zijun Hu)
  - of/irq: Fix device node refcount leakage in API of_irq_parse_raw() (Zijun Hu)
  - of/irq: Fix device node refcount leakage in API of_irq_parse_one() (Zijun Hu)
  - ntb: use 64-bit arithmetic for the MSI doorbell mask (Fedor Pchelkin)
  - net: mana: Switch to page pool for jumbo frames (Haiyang Zhang)
  - misc: pci_endpoint_test: Fix displaying 'irq_type' after 'request_irq' error (Kunihiko Hayashi)
  - selftests/landlock: Add a new test for setuid() (Mickaël Salaün)
  - selftests/landlock: Split signal_scoping_threads tests (Mickaël Salaün)
  - landlock: Prepare to add second errata (Mickaël Salaün)
  - landlock: Always allow signals between threads of the same process (Mickaël Salaün)
  - landlock: Add erratum for TCP fix (Mickaël Salaün)
  - landlock: Add the errata interface (Mickaël Salaün)
  - landlock: Move code to ease future backports (Mickaël Salaün)
  - KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses (Sean Christopherson)
  - KVM: x86: Explicitly zero-initialize on-stack CPUID unions (Sean Christopherson)
  - KVM: PPC: Enable CAP_SPAPR_TCE_VFIO on pSeries KVM guests (Amit Machhiwal)
  - gve: handle overflow when reporting TX consumed descriptors (Joshua Washington)
  - gpio: zynq: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
  - gpio: tegra186: fix resource handling in ACPI probe path (Guixin Liu)
  - ftrace: Properly merge notrace hashes (Andy Chiu)
  - ftrace: Add cond_resched() to ftrace_graph_set_hash() (zhoumin)
  - dt-bindings: coresight: qcom,coresight-tpdm: Fix too many 'reg' (Krzysztof Kozlowski)
  - dt-bindings: coresight: qcom,coresight-tpda: Fix too many 'reg' (Krzysztof Kozlowski)
  - dm-verity: fix prefetch-vs-suspend race (Mikulas Patocka)
  - dm-integrity: fix non-constant-time tag verification (Jo Van Bulck)
  - dm-integrity: set ti->error on memory allocation failure (Mikulas Patocka)
  - dm-ebs: fix prefetch-vs-suspend race (Mikulas Patocka)
  - dlm: fix error if active rsb is not hashed (Alexander Aring)
  - dlm: fix error if inactive rsb is not hashed (Alexander Aring)
  - crypto: ccp - Fix uAPI definitions of PSP errors (Dionna Glaze)
  - crypto: ccp - Fix check for the primary ASP device (Tom Lendacky)
  - clk: qcom: gdsc: Set retain_ff before moving to HW CTRL (Taniya Das)
  - clk: qcom: gdsc: Capture pm_genpd_add_subdomain result code (Bryan O'Donoghue)
  - clk: qcom: gdsc: Release pm subdomains in reverse add order (Bryan O'Donoghue)
  - clk: qcom: clk-branch: Fix invert halt status bit check for votable clocks (Ajit Pandey)
  - clk: renesas: r9a07g043: Fix HP clock source for RZ/Five (Lad Prabhakar)
  - cifs: Ensure that all non-client-specific reparse points are processed by the server (Pali Rohár)
  - cifs: fix integer overflow in match_server() (Roman Smirnov)
  - cifs: avoid NULL pointer dereference in dbg call (Alexandra Diupina)
  - CIFS: Propagate min offload along with other parameters from primary to secondary channels. (Aman)
  - thermal/drivers/rockchip: Add missing rk3328 mapping entry (Trevor Woerner)
  - tracing: Do not add length to print format in synthetic events (Steven Rostedt)
  - tracing: fprobe events: Fix possible UAF on modules (Masami Hiramatsu (Google))
  - x86/xen: fix balloon target initialization for PVH dom0 (Roger Pau Monne)
  - sctp: detect and prevent references to a freed transport in sendmsg (Ricardo Cañuelo Navarro)
  - mm/hwpoison: introduce folio_contain_hwpoisoned_page() helper (Jinjiang Tu)
  - mm/hugetlb: move hugetlb_sysctl_init() to the __init section (Marc Herbert)
  - mm/hwpoison: do not send SIGBUS to processes with recovered clean pages (Shuai Xue)
  - mm/userfaultfd: fix release hang over concurrent GUP (Peter Xu)
  - mm: add missing release barrier on PGDAT_RECLAIM_LOCKED unlock (Mathieu Desnoyers)
  - mm/mremap: correctly handle partial mremap() of VMA starting at 0 (Lorenzo Stoakes)
  - mm: fix lazy mmu docs and usage (Ryan Roberts)
  - mm: make page_mapped_in_vma() hugetlb walk aware (Jane Chu)
  - mm/rmap: reject hugetlb folios in folio_make_device_exclusive() (David Hildenbrand)
  - mm/damon/ops: have damon_get_folio return folio even for tail pages (Usama Arif)
  - sparc/mm: avoid calling arch_enter/leave_lazy_mmu() in set_ptes (Ryan Roberts)
  - sparc/mm: disable preemption in lazy mmu mode (Ryan Roberts)
  - iommu/vt-d: Wire up irq_ack() to irq_move_irq() for posted MSIs (Sean Christopherson)
  - iommu/vt-d: Fix possible circular locking dependency (Lu Baolu)
  - iommu/vt-d: Don't clobber posted vCPU IRTE when host IRQ affinity changes (Sean Christopherson)
  - iommu/vt-d: Put IRTE back into posted MSI mode if vCPU posting is disabled (Sean Christopherson)
  - iommu/tegra241-cmdqv: Fix warnings due to dmam_free_coherent() (Nicolin Chen)
  - iommufd: Fix uninitialized rc in iommufd_access_rw() (Nicolin Chen)
  - btrfs: zoned: fix zone finishing with missing devices (Johannes Thumshirn)
  - btrfs: zoned: fix zone activation with missing devices (Johannes Thumshirn)
  - btrfs: tests: fix chunk map leak after failure to add it to the tree (Filipe Manana)
  - btrfs: fix non-empty delayed iputs list on unmount due to compressed write workers (Filipe Manana)
  - backlight: led_bl: Hold led_access lock when calling led_sysfs_disable() (Herve Codina)
  - arm64: dts: exynos: gs101: disable pinctrl_gsacore node (Peter Griffin)
  - arm64: dts: mediatek: mt8173: Fix disp-pwm compatible string (Chen-Yu Tsai)
  - arm64: mm: Correct the update of max_pfn (Zhenhua Huang)
  - arm64: tegra: Remove the Orin NX/Nano suspend key (Ninad Malwade)
  - arm64: mops: Do not dereference src reg for a set operation (Keir Fraser)
  - mtd: rawnand: Add status chack in r852_ready() (Wentao Liang)
  - mtd: inftlcore: Add error check for inftl_read_oob() (Wentao Liang)
  - mptcp: only inc MPJoinAckHMacFailure for HMAC failures (Matthieu Baerts (NGI0))
  - mptcp: fix NULL pointer in can_accept_new_subflow (Gang Yan)
  - lib: scatterlist: fix sg_split_phys to preserve original scatterlist offsets (T Pratham)
  - locking/lockdep: Decrease nr_unused_locks if lock unused in zap_class() (Boqun Feng)
  - mailbox: tegra-hsp: Define dimensioning masks in SoC data (Kartik Rajput)
  - mfd: ene-kb3930: Fix a potential NULL pointer dereference (Chenyuan Yang)
  - leds: rgb: leds-qcom-lpg: Fix calculation of best period Hi-Res PWMs (Abel Vesa)
  - leds: rgb: leds-qcom-lpg: Fix pwm resolution max for Hi-Res PWMs (Abel Vesa)
  - jbd2: remove wrong sb->s_sequence check (Jan Kara)
  - i3c: Add NULL pointer check in i3c_master_queue_ibi() (Manjunatha Venkatesh)
  - i3c: master: svc: Use readsb helper for reading MDB (Stanley Chu)
  - ima: limit the number of ToMToU integrity violations (Mimi Zohar)
  - ima: limit the number of open-writers integrity violations (Mimi Zohar)
  - smb311 client: fix missing tcon check when mounting with linux/posix extensions (Steve French)
  - soc: samsung: exynos-chipid: Add NULL pointer check in exynos_chipid_probe() (Chenyuan Yang)
  - svcrdma: do not unregister device for listeners (Olga Kornievskaia)
  - tpm: do not start chip while suspended (Thadeu Lima de Souza Cascardo)
  - udf: Fix inode_getblk() return value (Jan Kara)
  - vdpa/mlx5: Fix oversized null mkey longer than 32bit (Si-Wei Liu)
  - f2fs: fix to avoid atomicity corruption of atomic file (Yeongjin Gil)
  - ext4: fix off-by-one error in do_split (Artem Sadovnikov)
  - bus: mhi: host: Fix race between unprepare and queue_buf (Jeff Hugo)
  - accel/ivpu: Fix deadlock in ivpu_ms_cleanup() (Jacek Lawrynowicz)
  - accel/ivpu: Fix warning in ivpu_ipc_send_receive_internal() (Jacek Lawrynowicz)
  - ALSA: hda/realtek: Enable Mute LED on HP OMEN 16 Laptop xd000xx (Sharan Kumar M)
  - ASoC: qdsp6: q6asm-dai: fix q6asm_dai_compr_set_params error path (Alexey Klimov)
  - ASoC: qdsp6: q6apm-dai: fix capture pipeline overruns. (Srinivas Kandagatla)
  - ASoC: qdsp6: q6apm-dai: set 10 ms period and buffer alignment. (Srinivas Kandagatla)
  - ASoC: q6apm-dai: make use of q6apm_get_hw_pointer (Srinivas Kandagatla)
  - ASoC: q6apm-dai: schedule all available frames to avoid dsp under-runs (Srinivas Kandagatla)
  - ASoC: q6apm: add q6apm_get_hw_pointer helper (Srinivas Kandagatla)
  - ASoC: codecs: wcd937x: fix a potential memory leak in wcd937x_soc_codec_probe() (Haoxiang Li)
  - io_uring/kbuf: reject zero sized provided buffers (Jens Axboe)
  - io_uring/net: fix io_req_post_cqe abuse by send bundle (Pavel Begunkov)
  - io_uring/net: fix accept multishot handling (Pavel Begunkov)
  - wifi: mt76: mt7925: fix the wrong simultaneous cap for MLO (Ming Yen Hsieh)
  - wifi: mt76: mt7925: fix the wrong link_idx when a p2p_device is present (Ming Yen Hsieh)
  - wifi: mt76: mt7925: fix country count limitation for CLC (Ming Yen Hsieh)
  - wifi: mt76: mt7925: ensure wow pattern command align fw format (Ming Yen Hsieh)
  - wifi: mac80211: fix integer overflow in hwmp_route_info_get() (Gavrilov Ilia)
  - wifi: mt76: Add check for devm_kstrdup() (Haoxiang Li)
  - clocksource/drivers/stm32-lptimer: Use wakeup capable instead of init wakeup (Alexandre Torgue)
  - mtd: Replace kcalloc() with devm_kcalloc() (Jiasheng Jiang)
  - net: dsa: mv88e6xxx: fix internal PHYs for 6320 family (Marek Behún)
  - net: dsa: mv88e6xxx: workaround RGMII transmit delay erratum for 6320 family (Marek Behún)
  - mtd: Add check for devm_kcalloc() (Jiasheng Jiang)
  - mptcp: sockopt: fix getting freebind & transparent (Matthieu Baerts (NGI0))
  - mptcp: sockopt: fix getting IPV6_V6ONLY (Matthieu Baerts (NGI0))
  - media: chips-media: wave5: Fix timeout while testing 10bit hevc fluster (Jackson.lee)
  - media: chips-media: wave5: Fix a hang after seeking (Jackson.lee)
  - media: chips-media: wave5: Avoid race condition in the interrupt handler (Jackson.lee)
  - media: chips-media: wave5: Fix gray color on screen (Jackson.lee)
  - media: i2c: imx214: Rectify probe error handling related to runtime PM (Sakari Ailus)
  - media: i2c: imx219: Rectify runtime PM handling in probe and remove (Sakari Ailus)
  - media: i2c: imx319: Rectify runtime PM handling probe and remove (Sakari Ailus)
  - media: venus: hfi_parser: refactor hfi packet parsing logic (Vikash Garodia)
  - media: venus: hfi_parser: add check to avoid out of bound access (Vikash Garodia)
  - media: nuvoton: Fix reference handling of ece_pdev (Ricardo Ribalda)
  - media: nuvoton: Fix reference handling of ece_node (Ricardo Ribalda)
  - media: i2c: ov7251: Introduce 1 ms delay between regulators and en GPIO (Sakari Ailus)
  - media: i2c: ov7251: Set enable GPIO low in probe (Sakari Ailus)
  - media: i2c: ccs: Set the device's runtime PM status correctly in probe (Sakari Ailus)
  - media: i2c: ccs: Set the device's runtime PM status correctly in remove (Sakari Ailus)
  - Revert "media: imx214: Fix the error handling in imx214_probe()" (Sakari Ailus)
  - media: v4l2-dv-timings: prevent possible overflow in v4l2_detect_gtf() (Karina Yankevich)
  - media: imx219: Adjust PLL settings based on the number of MIPI lanes (Dave Stevenson)
  - media: platform: stm32: Add check for clk_enable() (Jiasheng Jiang)
  - media: visl: Fix ERANGE error when setting enum controls (Nicolas Dufresne)
  - media: hi556: Fix memory leak (on error) in hi556_check_hwcfg() (Hans de Goede)
  - media: streamzap: prevent processing IR data on URB failure (Murad Masimov)
  - accel/ivpu: Fix PM related deadlocks in MS IOCTLs (Jacek Lawrynowicz)
  - tpm, tpm_tis: Fix timeout handling when waiting for TPM status (Jonathan McDowell)
  - mtd: rawnand: brcmnand: fix PM resume warning (Kamal Dasu)
  - spi: cadence-qspi: Fix probe on AM62A LP SK (Miquel Raynal)
  - KVM: arm64: Tear down vGIC on failed vCPU creation (Will Deacon)
  - arm64: errata: Add KRYO 2XX/3XX/4XX silver cores to Spectre BHB safe list (Douglas Anderson)
  - arm64: errata: Assume that unknown CPUs _are_ vulnerable to Spectre BHB (Douglas Anderson)
  - arm64: errata: Add QCOM_KRYO_4XX_GOLD to the spectre_bhb_k24_list (Douglas Anderson)
  - arm64: cputype: Add MIDR_CORTEX_A76AE (Douglas Anderson)
  - xenfs/xensyms: respect hypervisor's "next" indication (Jan Beulich)
  - media: rockchip: rga: fix rga offset lookup (John Keeping)
  - media: siano: Fix error handling in smsdvb_module_init() (Yuan Can)
  - media: vim2m: print device name after registering device (Matthew Majewski)
  - media: venus: hfi: add check to handle incorrect queue size (Vikash Garodia)
  - media: venus: hfi: add a check to handle OOB in sfr region (Vikash Garodia)
  - media: intel/ipu6: set the dev_parent of video device to pdev (Bingbu Cao)
  - media: mgb4: Fix switched CMT frequency range "magic values" sets (Martin Tůma)
  - media: i2c: adv748x: Fix test pattern selection mask (Niklas Söderlund)
  - media: mgb4: Fix CMT registers update logic (Martin Tůma)
  - media: uapi: rkisp1-config: Fix typo in extensible params example (Niklas Söderlund)
  - media: mtk-vcodec: venc: avoid -Wenum-compare-conditional warning (Arnd Bergmann)
  - media: mediatek: vcodec: Fix a resource leak related to the scp device in FW initialization (Jiasheng Jiang)
  - dt-bindings: media: st,stmipid02: correct lane-polarities maxItems (Alain Volmat)
  - auxdisplay: hd44780: Fix an API misuse in hd44780.c (Haoxiang Li)
  - HID: pidff: Fix set_device_control() (Tomasz Pakuła)
  - HID: pidff: Fix 90 degrees direction name North -> East (Tomasz Pakuła)
  - HID: pidff: Compute INFINITE value instead of using hardcoded 0xffff (Tomasz Pakuła)
  - HID: pidff: Clamp effect playback LOOP_COUNT value (Tomasz Pakuła)
  - HID: pidff: Rename two functions to align them with naming convention (Tomasz Pakuła)
  - HID: pidff: Remove redundant call to pidff_find_special_keys (Tomasz Pakuła)
  - HID: pidff: Support device error response from PID_BLOCK_LOAD (Tomasz Pakuła)
  - HID: pidff: Comment and code style update (Tomasz Pakuła)
  - HID: hid-universal-pidff: Add Asetek wheelbases support (Tomasz Pakuła)
  - HID: pidff: Make sure to fetch pool before checking SIMULTANEOUS_MAX (Tomasz Pakuła)
  - HID: pidff: Factor out pool report fetch and remove excess declaration (Tomasz Pakuła)
  - HID: pidff: Use macros instead of hardcoded min/max values for shorts (Tomasz Pakuła)
  - HID: pidff: Simplify pidff_rescale_signed (Tomasz Pakuła)
  - HID: pidff: Move all hid-pidff definitions to a dedicated header (Tomasz Pakuła)
  - HID: pidff: Factor out code for setting gain (Tomasz Pakuła)
  - HID: pidff: Rescale time values to match field units (Tomasz Pakuła)
  - HID: pidff: Define values used in pidff_find_special_fields (Tomasz Pakuła)
  - HID: pidff: Simplify pidff_upload_effect function (Tomasz Pakuła)
  - HID: pidff: Completely rework and fix pidff_reset function (Tomasz Pakuła)
  - HID: pidff: Stop all effects before enabling actuators (Tomasz Pakuła)
  - HID: pidff: Clamp PERIODIC effect period to device's logical range (Tomasz Pakuła)
  - s390/pci: Fix s390_mmio_read/write syscall page fault handling (Niklas Schnelle)
  - ext4: don't treat fhandle lookup of ea_inode as FS corruption (Jann Horn)
  - bpf: support SKF_NET_OFF and SKF_LL_OFF on skb frags (Willem de Bruijn)
  - erofs: set error to bio if file-backed IO fails (Sheng Yong)
  - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Uwe Kleine-König)
  - pwm: rcar: Improve register calculation (Uwe Kleine-König)
  - pwm: mediatek: Prevent divide-by-zero in pwm_mediatek_config() (Josh Poimboeuf)
  - tpm: End any active auth session before shutdown (Jonathan McDowell)
  - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Jonathan McDowell)
  - ktest: Fix Test Failures Due to Missing LOG_FILE Directories (Ayush Jain)
  - tracing: probe-events: Add comments about entry data storing code (Masami Hiramatsu (Google))
  - fbdev: omapfb: Add 'plane' value check (Leonid Arapov)
  - drm/amdgpu: grab an additional reference on the gang fence v2 (Christian König)
  - drm/amdgpu: Fix the race condition for draining retry fault (Emily Deng)
  - PCI: Enable Configuration RRS SV early (Bjorn Helgaas)
  - drm/amdgpu: handle amdgpu_cgs_create_device() errors in amd_powerplay_create() (Wentao Liang)
  - PCI: Add Rockchip Vendor ID (Shawn Lin)
  - drm/mediatek: mtk_dpi: Explicitly manage TVD clock in power on/off (AngeloGioacchino Del Regno)
  - drm/mediatek: mtk_dpi: Move the input_2p_en bit to platform data (AngeloGioacchino Del Regno)
  - drm/xe/xelp: Move Wa_16011163337 from tunings to workarounds (Tvrtko Ursulin)
  - drm/amdkfd: debugfs hang_hws skip GPU with MES (Philip Yang)
  - drm/amdkfd: Fix pqm_destroy_queue race with GPU reset (Philip Yang)
  - drm/amdkfd: Fix mode1 reset crash issue (Philip Yang)
  - drm/amdkfd: clamp queue size to minimum (David Yat Sin)
  - drivers: base: devres: Allow to release group on device release (Lucas De Marchi)
  - drm/amd/display: stop DML2 from removing pipes based on planes (Mike Katsnelson)
  - drm/bridge: panel: forbid initializing a panel with unknown connector type (Luca Ceresoli)
  - drm/debugfs: fix printk format for bridge index (Luca Ceresoli)
  - drm: panel-orientation-quirks: Add quirk for OneXPlayer Mini (Intel) (Andrew Wyatt)
  - drm: panel-orientation-quirks: Add new quirk for GPD Win 2 (Andrew Wyatt)
  - drm: panel-orientation-quirks: Add quirk for AYA NEO Slide (Andrew Wyatt)
  - drm: panel-orientation-quirks: Add quirks for AYA NEO Flip DS and KB (Andrew Wyatt)
  - drm: panel-orientation-quirks: Add support for AYANEO 2S (Andrew Wyatt)
  - drm/amdgpu: Unlocked unmap only clear page table leaves (Philip Yang)
  - drm/amd/display: Update Cursor request mode to the beginning prefetch always (Zhikai Zhai)
  - drm/xe/vf: Don't try to trigger a full GT reset if VF (Michal Wajdeczko)
  - drm/xe/bmg: Add new PCI IDs (Shekhar Chauhan)
  - drm: allow encoder mode_set even when connectors change for crtc (Abhinav Kumar)
  - Bluetooth: Add quirk for broken READ_PAGE_SCAN_TYPE (Pedro Nishiyama)
  - Bluetooth: Add quirk for broken READ_VOICE_SETTING (Pedro Nishiyama)
  - Bluetooth: qca: simplify WCN399x NVM loading (Dmitry Baryshkov)
  - Bluetooth: hci_qca: use the power sequencer for wcn6750 (Janaki Ramaiah Thota)
  - Bluetooth: btusb: Add 2 HWIDs for MT7922 (Jiande Lu)
  - Bluetooth: hci_uart: fix race during initialization (Arseniy Krasnov)
  - Bluetooth: btintel_pcie: Add device id of Whale Peak (Kiran K)
  - tracing: fix return value in __ftrace_event_enable_disable for TRACE_REG_UNREGISTER (Gabriele Paoloni)
  - net: vlan: don't propagate flags on open (Stanislav Fomichev)
  - wifi: mt76: mt76x2u: add TP-Link TL-WDN6200 ID to device table (Icenowy Zheng)
  - btrfs: harden block_group::bg_list against list_del() races (Boris Burkov)
  - ahci: Marvell 88SE9215 controllers prefer DMA for ATAPI (Huacai Chen)
  - scsi: st: Fix array overflow in st_setup() (Kai Mäkisara)
  - cdc_ether|r8152: ThinkPad Hybrid USB-C/A Dock quirk (Philipp Hahn)
  - ext4: ignore xattrs past end (Bhupesh)
  - Revert "f2fs: rebuild nat_bits during umount" (Chao Yu)
  - ext4: protect ext4_release_dquot against freezing (Ojaswin Mujoo)
  - ahci: add PCI ID for Marvell 88SE9215 SATA Controller (Daniel Kral)
  - net: sfp: add quirk for FS SFP-10GM-T copper SFP+ module (Martin Schiller)
  - f2fs: fix to avoid out-of-bounds access in f2fs_truncate_inode_blocks() (Chao Yu)
  - wifi: ath12k: Fix invalid data access in ath12k_dp_rx_h_undecap_nwifi (Manish Dharanenthiran)
  - net: sfp: add quirk for 2.5G OEM BX SFP (Birger Koblitz)
  - ata: libata-eh: Do not use ATAPI DMA for a device limited to PIO mode (Niklas Cassel)
  - jfs: add sanity check for agwidth in dbMount (Edward Adam Davis)
  - jfs: Prevent copying of nlink with value 0 from disk inode (Edward Adam Davis)
  - fs/jfs: Prevent integer overflow in AG size calculation (Rand Deeb)
  - fs/jfs: cast inactags to s64 to prevent potential overflow (Rand Deeb)
  - jfs: Fix uninit-value access of imap allocated in the diMount() function (Zhongqiu Han)
  - can: flexcan: add NXP S32G2/S32G3 SoC support (Ciprian Marian Costea)
  - can: flexcan: Add quirk to handle separate interrupt lines for mailboxes (Ciprian Marian Costea)
  - page_pool: avoid infinite loop to schedule delayed worker (Jason Xing)
  - net: usb: asix_devices: add FiberGecko DeviceID (Max Schulze)
  - scsi: target: spc: Fix RSOC parameter data header size (Chaohai Chen)
  - wifi: mac80211: ensure sdata->work is canceled before initialized. (Miri Korenblit)
  - wifi: mac80211: add strict mode disabling workarounds (Johannes Berg)
  - f2fs: don't retry IO for corrupted data scenario (Chao Yu)
  - net: page_pool: don't cast mp param to devmem (Pavel Begunkov)
  - ata: libata-core: Add 'external' to the libata.force kernel parameter (Niklas Cassel)
  - wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process (P Praneesh)
  - wifi: ath12k: fix memory leak in ath12k_pci_remove() (Miaoqing Pan)
  - wifi: ath11k: fix memory leak in ath11k_xxx_remove() (Miaoqing Pan)
  - wifi: ath11k: Fix DMA buffer allocation to resolve SWIOTLB issues (P Praneesh)
  - platform/x86: x86-android-tablets: Add select POWER_SUPPLY to Kconfig (Hans de Goede)
  - ASoC: amd: yc: update quirk data for new Lenovo model (Syed Saba kareem)
  - ASoC: amd: Add DMI quirk for ACP6X mic support (keenplify)
  - ALSA: usb-audio: Fix CME quirk for UF series keyboards (Ricard Wanderlof)
  - mmc: dw_mmc: add a quirk for accessing 64-bit FIFOs in two halves (Kaustabh Chakraborty)
  - media: s5p-mfc: Corrected NV12M/NV21M plane-sizes (Aakarsh Jain)
  - media: uvcvideo: Add quirk for Actions UVC05 (Ricardo Ribalda)
  - ASoC: fsl_audmix: register card device depends on 'dais' property (Shengjiu Wang)
  - ALSA: hda: intel: Add Lenovo IdeaPad Z570 to probe denylist (Maxim Mikityanskiy)
  - ALSA: hda: intel: Fix Optimus when GPU has no sound (Maxim Mikityanskiy)
  - ASoC: amd: ps: use macro for ACP6.3 pci revision id (Vijendar Mukunda)
  - HID: pidff: Fix null pointer dereference in pidff_find_fields (Tomasz Pakuła)
  - HID: pidff: Add PERIODIC_SINE_ONLY quirk (Tomasz Pakuła)
  - HID: Add hid-universal-pidff driver and supported device ids (Tomasz Pakuła)
  - HID: pidff: Add FIX_WHEEL_DIRECTION quirk (Tomasz Pakuła)
  - HID: pidff: Add hid_pidff_init_with_quirks and export as GPL symbol (Tomasz Pakuła)
  - HID: pidff: Add PERMISSIVE_CONTROL quirk (Tomasz Pakuła)
  - HID: pidff: Add MISSING_PBO quirk and its detection (Tomasz Pakuła)
  - HID: pidff: Add MISSING_DELAY quirk and its detection (Tomasz Pakuła)
  - HID: pidff: Do not send effect envelope if it's empty (Tomasz Pakuła)
  - HID: pidff: Convert infinite length from Linux API to PID standard (Tomasz Pakuła)
  - ASoC: SOF: topology: Use krealloc_array() to replace krealloc() (Zhang Heng)
  - platform/chrome: cros_ec_lpc: Match on Framework ACPI device (Daniel Schaefer)
  - zstd: Increase DYNAMIC_BMI2 GCC version cutoff from 4.8 to 11.0 to work around compiler segfault (Ingo Molnar)
  - xen/mcelog: Add __nonstring annotations for unterminated strings (Kees Cook)
  - arm64: cputype: Add QCOM_CPU_PART_KRYO_3XX_GOLD (Douglas Anderson)
  - Flush console log from kernel_power_off() (Paul E. McKenney)
  - PM: hibernate: Avoid deadlock in hibernate_compressor_param_set() (Lizhi Xu)
  - perf/dwc_pcie: fix some unreleased resources (Yunhui Cui)
  - perf: arm_pmu: Don't disable counter in armpmu_add() (Mark Rutland)
  - x86/cpu: Don't clear X86_FEATURE_LAHF_LM flag in init_amd_k8() on AMD when running in a virtual machine (Max Grobecker)
  - x86/ia32: Leave NULL selector values 0~3 unchanged (Xin Li (Intel))
  - x86/percpu: Disable named address spaces for UBSAN_BOOL with KASAN for GCC < 14.2 (Uros Bizjak)
  - x86/mm: Clear _PAGE_DIRTY for kernel mappings when we clear _PAGE_RW (Matthew Wilcox (Oracle))
  - pm: cpupower: bench: Prevent NULL dereference on malloc failure (Zhongqiu Han)
  - umount: Allow superblock owners to force umount (Trond Myklebust)
  - fs: consistently deref the files table with rcu_dereference_raw() (Mateusz Guzik)
  - iommu/mediatek: Fix NULL pointer deference in mtk_iommu_device_group (Louis-Alexis Eyraud)
  - iommu/exynos: Fix suspend/resume with IDENTITY domain (Marek Szyprowski)
  - nft_set_pipapo: fix incorrect avx2 match of 5th field octet (Florian Westphal)
  - net: ppp: Add bound checking for skb data on ppp_sync_txmung (Arnaud Lecomte)
  - ipv6: Align behavior across nexthops during path selection (Ido Schimmel)
  - net: phy: allow MDIO bus PM ops to start/stop state machine for phylink-controlled PHY (Vladimir Oltean)
  - net: phy: move phy_link_change() prior to mdio_bus_phy_may_suspend() (Vladimir Oltean)
  - smb: client: fix UAF in decryption with multichannel (Paulo Alcantara)
  - net_sched: sch_sfq: move the limit validation (Octavian Purdila)
  - net_sched: sch_sfq: use a temporary work area for validating configuration (Octavian Purdila)
  - nvmet-fcloop: swap list_add_tail arguments (Daniel Wagner)
  - drm/i915/huc: Fix fence not released on early probe errors (Janusz Krzysztofik)
  - ata: sata_sx4: Add error handling in pdc20621_i2c_read() (Wentao Liang)
  - net: libwx: handle page_pool_dev_alloc_pages error (Chenyuan Yang)
  - drm/tests: probe-helper: Fix drm_display_mode memory leak (Maxime Ripard)
  - drm/tests: modes: Fix drm_display_mode memory leak (Maxime Ripard)
  - drm/tests: cmdline: Fix drm_display_mode memory leak (Maxime Ripard)
  - drm/tests: helpers: Create kunit helper to destroy a drm_display_mode (Maxime Ripard)
  - drm/tests: modeset: Fix drm_display_mode memory leak (Maxime Ripard)
  - net: ethtool: Don't call .cleanup_data when prepare_data fails (Maxime Chevallier)
  - tc: Ensure we have enough buffer space when sending filter netlink notifications (Toke Høiland-Jørgensen)
  - octeontx2-pf: qos: fix VF root node parent queue index (Hariprasad Kelam)
  - net: tls: explicitly disallow disconnect (Jakub Kicinski)
  - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Cong Wang)
  - tipc: fix memory leak in tipc_link_xmit (Tung Nguyen)
  - objtool: Fix INSN_CONTEXT_SWITCH handling in validate_unret() (Josh Poimboeuf)
  - ata: pata_pxa: Fix potential NULL pointer dereference in pxa_ata_probe() (Henry Martin)
  - drm/xe/hw_engine: define sysfs_ops on all directories (Tejas Upadhyay)
  - x86/acpi: Don't limit CPUs to 1 for Xen PV guests due to disabled ACPI (Petr Vaněk)
  - drm/i915: Disable RPG during live selftest (Badal Nilawar)
  - ublk: fix handling recovery & reissue in ublk_abort_queue() (Ming Lei)
  - ublk: refactor recovery configuration flag helpers (Uday Shankar)
  - selftests/futex: futex_waitv wouldblock test should fail (Edward Liaw)
  - gpiolib: of: Fix the choice for Ingenic NAND quirk (Andy Shevchenko)
  - cgroup/cpuset: Further optimize code if CONFIG_CPUSETS_V1 not set (Waiman Long)
  - cgroup/cpuset: Enforce at most one rebuild_sched_domains_locked() call per operation (Waiman Long)
  - cgroup/cpuset: Revert "Allow suppression of sched domain rebuild in update_cpumasks_hier()" (Waiman Long)
  - cgroup/cpuset: Fix error handling in remote_partition_disable() (Waiman Long)
  - cgroup/cpuset: Fix incorrect isolated_cpus update in update_parent_effective_cpumask() (Waiman Long)
  - ASoC: Intel: adl: add 2xrt1316 audio configuration (Bard Liao)


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-2.27.2.el9uek]
changelog:
  - LTS version: v6.12.27 (Jack Vogel)
  - bpf: Fix BPF_INTERNAL namespace import (Xi Ruoyao)
  - LTS version: v6.12.26 (Jack Vogel)
  - mq-deadline: don't call req_get_ioprio from the I/O completion handler (Christoph Hellwig)
  - arm64: dts: ti: k3-j784s4-j742s2-main-common: Correct the GICD size (Keerthy)
  - crypto: Kconfig - Select LIB generic option (Herbert Xu)
  - usb: typec: class: Unlocked on error in typec_register_partner() (Dan Carpenter)
  - objtool: Silence more KCOV warnings, part 2 (Josh Poimboeuf)
  - objtool: Ignore end-of-section jumps for KCOV/GCOV (Josh Poimboeuf)
  - usb: xhci: Fix Short Packet handling rework ignoring errors (Michal Pecio)
  - nvme: fixup scan failure for non-ANA multipath controllers (Hannes Reinecke)
  - MIPS: cm: Fix warning if MIPS_CM is disabled (Thomas Bogendoerfer)
  - media: i2c: imx214: Fix uninitialized variable in imx214_set_ctrl() (Dan Carpenter)
  - crypto: lib/Kconfig - Hide arch options from user (Herbert Xu)
  - iommu: Handle race with default domain setup (Robin Murphy)
  - net: dsa: mv88e6xxx: enable STU methods for 6320 family (Marek Behún)
  - net: dsa: mv88e6xxx: enable .port_set_policy() for 6320 family (Marek Behún)
  - net: dsa: mv88e6xxx: enable PVT for 6321 switch (Marek Behún)
  - net: dsa: mv88e6xxx: fix atu_move_port_mask for 6341 family (Marek Behún)
  - Revert "net: dsa: mv88e6xxx: fix internal PHYs for 6320 family" (Marek Behún)
  - usb: typec: class: Invalidate USB device pointers on partner unregistration (Andrei Kuchynski)
  - ext4: goto right label 'out_mmap_sem' in ext4_setattr() (Baokun Li)
  - comedi: jr3_pci: Fix synchronous deletion of timer (Ian Abbott)
  - vmxnet3: Fix malformed packet sizing in vmxnet3_process_xdp (Daniel Borkmann)
  - usb: typec: class: Fix NULL pointer access (Andrei Kuchynski)
  - selftests/bpf: Adjust data size to have ETH_HLEN (Shigeru Yoshida)
  - selftests/bpf: check program redirect in xdp_cpumap_attach (Alexis Lothoré (eBPF Foundation))
  - selftests/bpf: make xdp_cpumap_attach keep redirect prog attached (Alexis Lothoré (eBPF Foundation))
  - selftests/bpf: fix bpf_map_redirect call for cpu map test (Alexis Lothoré (eBPF Foundation))
  - xfs: flush inodegc before swapon (Christoph Hellwig)
  - xfs: rename xfs_iomap_swapfile_activate to xfs_vm_swap_activate (Christoph Hellwig)
  - xfs: Do not allow norecovery mount with quotacheck (Carlos Maiolino)
  - xfs: do not check NEEDSREPAIR if ro,norecovery mount. (Lukas Herbolt)
  - driver core: fix potential NULL pointer dereference in dev_uevent() (Dmitry Torokhov)
  - driver core: introduce device_set_driver() helper (Dmitry Torokhov)
  - Revert "drivers: core: synchronize really_probe() and dev_uevent()" (Dmitry Torokhov)
  - spi: spi-imx: Add check for spi_imx_setupxfer() (Tamura Dai)
  - drm/amdgpu: Use the right function for hdp flush (Lijo Lazar)
  - drm/amdgpu: use a dummy owner for sysfs triggered cleaner shaders v4 (Christian König)
  - md/raid1: Add check for missing source disk in process_checks() (Meir Elisha)
  - x86/cpu: Add CPU model number for Bartlett Lake CPUs with Raptor Cove cores (Pi Xiange)
  - ubsan: Fix panic from test_ubsan_out_of_bounds (Mostafa Saleh)
  - spi: tegra210-quad: add rate limiting and simplify timeout error message (Breno Leitao)
  - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Breno Leitao)
  - ksmbd: fix WARNING "do not call blocking ops when !TASK_RUNNING" (Namjae Jeon)
  - riscv: Provide all alternative macros all the time (Andrew Jones)
  - iomap: skip unnecessary ifs_block_is_uptodate check (Gou Hao)
  - netfs: Only create /proc/fs/netfs with CONFIG_PROC_FS (Song Liu)
  - x86/i8253: Call clockevent_i8253_disable() with interrupts disabled (Fernando Fernandez Mancera)
  - ASoC: fsl_asrc_dma: get codec or cpu dai from backend (Shengjiu Wang)
  - scsi: pm80xx: Set phy_attached to zero when device is gone (Igor Pylypiv)
  - scsi: ufs: exynos: gs101: Put UFS device in reset on .suspend() (Peter Griffin)
  - scsi: ufs: exynos: Move phy calls to .exit() callback (Peter Griffin)
  - scsi: ufs: exynos: Enable PRDT pre-fetching with UFSHCD_CAP_CRYPTO (Peter Griffin)
  - scsi: ufs: exynos: Ensure pre_link() executes before exynos_ufs_phy_init() (Peter Griffin)
  - scsi: hisi_sas: Fix I/O errors caused by hardware port ID changes (Xingui Yang)
  - ext4: make block validity check resistent to sb bh corruption (Ojaswin Mujoo)
  - iommu: Clear iommu-dma ops on cleanup (Robin Murphy)
  - cifs: Fix querying of WSL CHR and BLK reparse points over SMB1 (Pali Rohár)
  - timekeeping: Add a lockdep override in tick_freeze() (Sebastian Andrzej Siewior)
  - cifs: Fix encoding of SMB1 Session Setup Kerberos Request in non-UNICODE mode (Pali Rohár)
  - nvmet-fc: put ref when assoc->del_work is already scheduled (Daniel Wagner)
  - nvmet-fc: take tgtport reference only once (Daniel Wagner)
  - x86/bugs: Don't fill RSB on context switch with eIBRS (Josh Poimboeuf)
  - x86/bugs: Don't fill RSB on VMEXIT with eIBRS+retpoline (Josh Poimboeuf)
  - x86/bugs: Use SBPB in write_ibpb() if applicable (Josh Poimboeuf)
  - selftests/mincore: Allow read-ahead pages to reach the end of the file (Qiuxu Zhuo)
  - x86/xen: disable CPU idle and frequency drivers for PVH dom0 (Roger Pau Monne)
  - gpiolib: of: Move Atmel HSMCI quirk up out of the regulator comment (Andy Shevchenko)
  - objtool: Stop UNRET validation on UD2 (Josh Poimboeuf)
  - nvme: multipath: fix return value of nvme_available_path (Uday Shankar)
  - nvme: re-read ANA log page after ns scan completes (Hannes Reinecke)
  - drm/xe/xe3lpg: Apply Wa_14022293748, Wa_22019794406 (Julia Filipchuk)
  - drm/amdgpu: Increase KIQ invalidate_tlbs timeout (Jay Cornwall)
  - ACPI PPTT: Fix coding mistakes in a couple of sizeof() calls (Jean-Marc Eurin)
  - ACPI: EC: Set ec_no_wakeup for Lenovo Go S (Mario Limonciello)
  - nvme: requeue namespace scan on missed AENs (Hannes Reinecke)
  - xen: Change xen-acpi-processor dom0 dependency (Jason Andryuk)
  - perf/core: Fix WARN_ON(!ctx) in __free_event() for partial init (Gabriel Shahrouzi)
  - selftests: ublk: fix test_stripe_04 (Ming Lei)
  - cgroup/cpuset: Don't allow creation of local partition over a remote one (Waiman Long)
  - KVM: s390: Don't use %pK through debug printing (Thomas Weißschuh)
  - KVM: s390: Don't use %pK through tracepoints (Thomas Weißschuh)
  - sched/isolation: Make CONFIG_CPU_ISOLATION depend on CONFIG_SMP (Oleg Nesterov)
  - kbuild: add dependency from vmlinux to sorttable (Xi Ruoyao)
  - io_uring: always do atomic put from iowq (Pavel Begunkov)
  - rtc: pcf85063: do a SW reset if POR failed (Lukas Stockmann)
  - 9p/trans_fd: mark concurrent read and writes to p9_conn->err (Ignacio Encinas)
  - 9p/net: fix improper handling of bogus negative read/write replies (Dominique Martinet)
  - ntb_hw_amd: Add NTB PCI ID for new gen CPU (Basavaraj Natikar)
  - ntb: reduce stack usage in idt_scan_mws (Arnd Bergmann)
  - qibfs: fix _another_ leak (Al Viro)
  - objtool, lkdtm: Obfuscate the do_nothing() pointer (Josh Poimboeuf)
  - objtool, regulator: rk808: Remove potential undefined behavior in rk806_set_mode_dcdc() (Josh Poimboeuf)
  - objtool, ASoC: codecs: wcd934x: Remove potential undefined behavior in wcd934x_slim_irq_handler() (Josh Poimboeuf)
  - objtool, panic: Disable SMAP in __stack_chk_fail() (Josh Poimboeuf)
  - objtool: Silence more KCOV warnings (Josh Poimboeuf)
  - um: work around sched_yield not yielding in time-travel mode (Benjamin Berg)
  - thunderbolt: Scan retimers after device router has been enumerated (Mika Westerberg)
  - usb: host: xhci-plat: mvebu: use ->quirks instead of ->init_quirk() func (Théo Lebrun)
  - usb: gadget: aspeed: Add NULL pointer check in ast_vhub_init_dev() (Chenyuan Yang)
  - phy: rockchip: usbdp: Avoid call hpd_event_trigger in dp_phy_init (Andy Yan)
  - usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running (Michal Pecio)
  - dmaengine: dmatest: Fix dmatest waiting less when interrupted (Vinicius Costa Gomes)
  - i3c: master: svc: Add support for Nuvoton npcm845 i3c (Stanley Chu)
  - xhci: Handle spurious events on Etron host isoc enpoints (Mathias Nyman)
  - usb: xhci: Fix isochronous Ring Underrun/Overrun event handling (Michal Pecio)
  - usb: xhci: Complete 'error mid TD' transfers when handling Missed Service (Michal Pecio)
  - sound/virtio: Fix cancel_sync warnings on uninitialized work_structs (John Stultz)
  - usb: dwc3: gadget: Avoid using reserved endpoints on Intel Merrifield (Andy Shevchenko)
  - usb: dwc3: gadget: Refactor loop to avoid NULL endpoints (Andy Shevchenko)
  - fs/ntfs3: Fix WARNING in ntfs_extend_initialized_size (Edward Adam Davis)
  - fs/ntfs3: Keep write operations atomic (Lizhi Xu)
  - usb: host: max3421-hcd: Add missing spi_device_id table (Alexander Stein)
  - mailbox: pcc: Always clear the platform ack interrupt first (Sudeep Holla)
  - mailbox: pcc: Fix the possible race in updation of chan_in_use flag (Huisong Li)
  - bpf: Reject attaching fexit/fmod_ret to __noreturn functions (Yafang Shao)
  - bpf: Only fails the busy counter check in bpf_cgrp_storage_get if it creates storage (Martin KaFai Lau)
  - bpf: bpftool: Setting error code in do_loader() (Sewon Nam)
  - s390/tty: Fix a potential memory leak bug (Haoxiang Li)
  - s390/sclp: Add check for get_zeroed_page() (Haoxiang Li)
  - parisc: PDT: Fix missing prototype warning (Yu-Chun Lin)
  - clk: check for disabled clock-provider in of_clk_get_hw_from_clkspec() (Heiko Stuebner)
  - bpf: Fix deadlock between rcu_tasks_trace and event_mutex. (Alexei Starovoitov)
  - bpf: Fix kmemleak warning for percpu hashmap (Yonghong Song)
  - crypto: null - Use spin lock instead of mutex (Herbert Xu)
  - crypto: lib/Kconfig - Fix lib built-in failure when arch is modular (Herbert Xu)
  - crypto: ccp - Add support for PCI device 0x1134 (Devaraj Rangasamy)
  - MIPS: cm: Detect CM quirks from device tree (Gregory CLEMENT)
  - pinctrl: mcp23s08: Get rid of spurious level interrupts (Dmitry Mastykin)
  - pinctrl: renesas: rza2: Fix potential NULL pointer dereference (Chenyuan Yang)
  - selftests/bpf: Fix stdout race condition in traffic monitor (Amery Hung)
  - USB: wdm: add annotation (Oliver Neukum)
  - USB: wdm: wdm_wwan_port_tx_complete mutex in atomic context (Oliver Neukum)
  - USB: wdm: close race between wdm_open and wdm_wwan_port_stop (Oliver Neukum)
  - USB: wdm: handle IO errors in wdm_wwan_port_start (Oliver Neukum)
  - USB: VLI disk crashes if LPM is used (Oliver Neukum)
  - usb: quirks: Add delay init quirk for SanDisk 3.2Gen1 Flash Drive (Miao Li)
  - usb: quirks: add DELAY_INIT quirk for Silicon Motion Flash Drive (Miao Li)
  - usb: dwc3: xilinx: Prevent spike in reset signal (Mike Looijmans)
  - usb: dwc3: gadget: check that event count does not exceed event buffer length (Frode Isaksen)
  - USB: OHCI: Add quirk for LS7A OHCI controller (rev 0x02) (Huacai Chen)
  - usb: chipidea: ci_hdrc_imx: implement usb_phy_init() error handling (Fedor Pchelkin)
  - usb: chipidea: ci_hdrc_imx: fix call balance of regulator routines (Fedor Pchelkin)
  - usb: chipidea: ci_hdrc_imx: fix usbmisc handling (Fedor Pchelkin)
  - usb: cdns3: Fix deadlock when using NCM gadget (Ralph Siemsen)
  - usb: xhci: Fix invalid pointer dereference in Etron workaround (Michal Pecio)
  - xhci: Limit time spent with xHC interrupts disabled during bus resume (Mathias Nyman)
  - USB: serial: simple: add OWON HDS200 series oscilloscope support (Craig Hesling)
  - USB: serial: option: add Sierra Wireless EM9291 (Adam Xue)
  - USB: serial: ftdi_sio: add support for Abacus Electrics Optical Probe (Michael Ehrenreich)
  - serial: sifive: lock port in startup()/shutdown() callbacks (Ryo Takakura)
  - serial: msm: Configure correct working mode before starting earlycon (Stephan Gerhold)
  - tty: Require CAP_SYS_ADMIN for all usages of TIOCL_SELMOUSEREPORT (Günther Noack)
  - firmware: stratix10-svc: Add of_platform_default_populate() (Mahesh Rao)
  - misc: microchip: pci1xxxx: Fix incorrect IRQ status handling during ack (Rengarajan S)
  - misc: microchip: pci1xxxx: Fix Kernel panic during IRQ handler registration (Rengarajan S)
  - char: misc: register chrdev region with all possible minors (Thadeu Lima de Souza Cascardo)
  - KVM: x86: Take irqfds.lock when adding/deleting IRQ bypass producer (Sean Christopherson)
  - KVM: x86: Reset IRTE to host control if *new* route isn't postable (Sean Christopherson)
  - KVM: x86: Explicitly treat routing entry type changes as changes (Sean Christopherson)
  - mei: vsc: Fix fortify-panic caused by invalid counted_by() use (Hans de Goede)
  - mei: me: add panther lake H DID (Alexander Usyskin)
  - scsi: Improve CDL control (Damien Le Moal)
  - USB: storage: quirk for ADATA Portable HDD CH94 (Oliver Neukum)
  - ata: libata-scsi: Fix ata_msense_control_ata_feature() (Damien Le Moal)
  - ata: libata-scsi: Fix ata_mselect_control_ata_feature() return type (Damien Le Moal)
  - ata: libata-scsi: Improve CDL control (Damien Le Moal)
  - mcb: fix a double free bug in chameleon_parse_gdd() (Haoxiang Li)
  - cxl/core/regs.c: Skip Memory Space Enable check for RCD and RCH Ports (Smita Koralahalli)
  - KVM: SVM: Allocate IR data using atomic allocation (Sean Christopherson)
  - io_uring: fix 'sync' handling of io_fallback_tw() (Jens Axboe)
  - LoongArch: KVM: Fix PMU pass-through issue if VM exits to host finally (Bibo Mao)
  - LoongArch: KVM: Fully clear some CSRs when VM reboot (Bibo Mao)
  - LoongArch: Remove a bogus reference to ZONE_DMA (Petr Tesarik)
  - LoongArch: Return NULL from huge_pte_offset() for invalid PMD (Ming Wang)
  - LoongArch: Handle fp, lsx, lasx and lbt assembly symbols (Tiezhu Yang)
  - irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode() (Suzuki K Poulose)
  - x86/insn: Fix CTEST instruction decoding (Kirill A. Shutemov)
  - drm/amd/display: Force full update in gpu reset (Roman Li)
  - drm/amd/display: Fix gpu reset in multidisplay config (Roman Li)
  - drm: panel: jd9365da: fix reset signal polarity in unprepare (Hugo Villeneuve)
  - rust: firmware: Use `ffi::c_char` type in `FwFunc` (Christian Schrefl)
  - net: phy: microchip: force IRQ polling mode for lan88xx (Fiona Klute)
  - net: selftests: initialize TCP header and skb payload with zero (Oleksij Rempel)
  - xen-netfront: handle NULL returned by xdp_convert_buff_to_frame() (Alexey Nepomnyashih)
  - crypto: atmel-sha204a - Set hwrng quality to lowest possible (Marek Behún)
  - sched_ext: Use kvzalloc for large exit_dump allocation (Breno Leitao)
  - virtio_console: fix missing byte order handling for cols and rows (Halil Pasic)
  - netfilter: fib: avoid lookup if socket is available (Florian Westphal)
  - LoongArch: Make do_xyz() exception handlers more robust (Tiezhu Yang)
  - LoongArch: Make regs_irqs_disabled() more clear (Tiezhu Yang)
  - LoongArch: Select ARCH_USE_MEMTEST (Yuli Wang)
  - perf/x86: Fix non-sampling (counting) events on certain x86 platforms (Luo Gengkun)
  - bpf: Add namespace to BPF internal symbols (Alexei Starovoitov)
  - splice: remove duplicate noinline from pipe_clear_nowait (T.J. Mercier)
  - riscv: uprobes: Add missing fence.i after building the XOL buffer (Björn Töpel)
  - riscv: Replace function-like macro by static inline function (Björn Töpel)
  - iommu/amd: Return an error if vCPU affinity is set for non-vCPU IRTE (Sean Christopherson)
  - block: never reduce ra_pages in blk_apply_bdi_limits (Christoph Hellwig)
  - pds_core: make wait_context part of q_info (Shannon Nelson)
  - pds_core: Remove unnecessary check in pds_client_adminq_cmd() (Brett Creeley)
  - pds_core: handle unsupported PDS_CORE_CMD_FW_CONTROL result (Brett Creeley)
  - pds_core: Prevent possible adminq overflow/stuck condition (Brett Creeley)
  - net: dsa: mt7530: sync driver-specific behavior of MT7531 variants (Daniel Golle)
  - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (Cong Wang)
  - net_sched: hfsc: Fix a UAF vulnerability in class handling (Cong Wang)
  - fix a couple of races in MNT_TREE_BENEATH handling by do_move_mount() (Al Viro)
  - net: ethernet: mtk_eth_soc: net: revise NETSYSv3 hardware configuration (Bo-Cun Chen)
  - tipc: fix NULL pointer dereference in tipc_mon_reinit_self() (Tung Nguyen)
  - net: phy: leds: fix memory leak (Qingfang Deng)
  - net: lwtunnel: disable BHs when required (Justin Iurman)
  - scsi: ufs: core: Add NULL check in ufshcd_mcq_compl_pending_transfer() (Chenyuan Yang)
  - scsi: core: Clear flags for scsi_cmnd that did not complete (Anastasia Kovaleva)
  - net/mlx5: Move ttc allocation after switch case to prevent leaks (Henry Martin)
  - net/mlx5: Fix null-ptr-deref in mlx5_create_{inner_,}ttc_table() (Henry Martin)
  - cgroup/cpuset-v1: Add missing support for cpuset_v2_mode (T.J. Mercier)
  - btrfs: zoned: return EIO on RAID1 block group write pointer mismatch (Johannes Thumshirn)
  - btrfs: avoid page_lockend underflow in btrfs_punch_hole_lock_range() (Qu Wenruo)
  - cpufreq: fix compile-test defaults (Johan Hovold)
  - cpufreq: Do not enable by default during compile testing (Krzysztof Kozlowski)
  - cpufreq: cppc: Fix invalid return value in .get() callback (Marc Zyngier)
  - scsi: ufs: mcq: Add NULL check in ufshcd_mcq_abort() (Chenyuan Yang)
  - cpufreq: scpi: Fix null-ptr-deref in scpi_cpufreq_get_rate() (Henry Martin)
  - cpufreq: scmi: Fix null-ptr-deref in scmi_cpufreq_get_rate() (Henry Martin)
  - cpufreq: apple-soc: Fix null-ptr-deref in apple_soc_cpufreq_get_rate() (Henry Martin)
  - dma/contiguous: avoid warning about unused size_bytes (Arnd Bergmann)
  - cpufreq: sun50i: prevent out-of-bounds access (Andre Przywara)
  - ceph: Fix incorrect flush end position calculation (David Howells)
  - lib/Kconfig.ubsan: Remove 'default UBSAN' from UBSAN_INTEGER_WRAP (Nathan Chancellor)
  - drm/amd/display/dml2: use vzalloc rather than kzalloc (Alex Deucher)
  - drm/amd/display: Fix unnecessary cast warnings from checkpatch (Rohit Chavan)
  - drm/xe/bmg: Add one additional PCI ID (Matt Roper)
  - net/niu: Niu requires MSIX ENTRY_DATA fields touch before entry reads (Jonathan Currier)
  - scsi: ufs: exynos: Disable iocc if dma-coherent property isn't set (Peter Griffin)
  - scsi: ufs: exynos: Move UFS shareability value to drvdata (Peter Griffin)
  - scsi: ufs: exynos: Add gs101_ufs_drv_init() hook and enable WriteBooster (Peter Griffin)
  - scsi: ufs: exynos: Remove superfluous function parameter (Tudor Ambarus)
  - scsi: ufs: exynos: Remove empty drv_init method (Tudor Ambarus)
  - ksmbd: fix use-after-free in __smb2_lease_break_noti() (Namjae Jeon)
  - ksmbd: browse interfaces list on FSCTL_QUERY_INTERFACE_INFO IOCTL (Namjae Jeon)
  - ksmbd: add netdev-up/down event debug print (Namjae Jeon)
  - ksmbd: use __GFP_RETRY_MAYFAIL (Namjae Jeon)
  - accel/ivpu: Fix the NPU's DPU frequency calculation (Andrzej Kacprowski)
  - accel/ivpu: Add auto selection logic for job scheduler (Jacek Lawrynowicz)
  - PCI/MSI: Add an option to write MSIX ENTRY_DATA before any reads (Jonathan Currier)
  - PCI/MSI: Handle the NOMASK flag correctly for all PCI/MSI backends (Thomas Gleixner)
  - PCI/MSI: Convert pci_msi_ignore_mask to per MSI domain flag (Roger Pau Monne)
  - scsi: ufs: qcom: fix dev reference leaked through of_qcom_ice_get (Tudor Ambarus)
  - of: resolver: Fix device node refcount leakage in of_resolve_phandles() (Zijun Hu)
  - of: resolver: Simplify of_resolve_phandles() using __free() (Rob Herring (Arm))
  - arm64: dts: ti: k3-j784s4-j742s2-main-common: Fix serdes_ln_ctrl reg-masks (Siddharth Vadapalli)
  - arm64: dts: ti: Refactor J784s4 SoC files to a common file (Manorit Chawdhry)
  - iio: adc: ad7768-1: Fix conversion result sign (Sergiu Cuciurean)
  - iio: adc: ad7768-1: Move setting of val a bit later to avoid unnecessary return value check (Jonathan Cameron)
  - net: dsa: mv88e6xxx: fix VTU methods for 6320 family (Marek Behún)
  - media: ov08x40: Add missing ov08x40_identify_module() call on stream-start (Hans de Goede)
  - media: ov08x40: Move ov08x40_identify_module() function up (Hans de Goede)
  - media: i2c: imx214: Fix link frequency validation (André Apitzsch)
  - media: i2c: imx214: Check number of lanes from device tree (André Apitzsch)
  - media: i2c: imx214: Replace register addresses with macros (André Apitzsch)
  - media: i2c: imx214: Convert to CCI register access helpers (André Apitzsch)
  - media: i2c: imx214: Simplify with dev_err_probe() (André Apitzsch)
  - media: i2c: imx214: Use subdev active state (André Apitzsch)
  - PM: EM: Address RCU-related sparse warnings (Rafael J. Wysocki)
  - PM: EM: use kfree_rcu() to simplify the code (Li RongQing)
  - mmc: sdhci-msm: fix dev reference leaked through of_qcom_ice_get (Tudor Ambarus)
  - soc: qcom: ice: introduce devm_of_qcom_ice_get (Tudor Ambarus)
  - mm/vmscan: don't try to reclaim hwpoison folio (Jinjiang Tu)
  - tracing: Verify event formats that have "%*p.." (Steven Rostedt)
  - tracing: Add __print_dynamic_array() helper (Steven Rostedt)
  - module: sign with sha512 instead of sha1 by default (Thorsten Leemhuis)
  - LTS version: v6.12.25 (Jack Vogel)
  - selftests/bpf: extend changes_pkt_data with cases w/o subprograms (Eduard Zingerman)
  - bpf: fix null dereference when computing changes_pkt_data of prog w/o subprogs (Eduard Zingerman)
  - selftests/bpf: validate that tail call invalidates packet pointers (Eduard Zingerman)
  - selftests/bpf: freplace tests for tracking of changes_packet_data (Eduard Zingerman)
  - bpf: check changes_pkt_data property for extension programs (Eduard Zingerman)
  - selftests/bpf: test for changing packet data from global functions (Eduard Zingerman)
  - bpf: track changes_pkt_data property for global functions (Eduard Zingerman)
  - bpf: add find_containing_subprog() utility function (Eduard Zingerman)
  - wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process (P Praneesh)
  - MIPS: ds1287: Match ds1287_set_base_clock() function types (WangYuli)
  - MIPS: cevt-ds1287: Add missing ds1287.h include (WangYuli)
  - MIPS: dec: Declare which_prom() as static (WangYuli)
  - Revert "wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process" (Alexander Tsoy)
  - mm/vma: add give_up_on_oom option on modify/merge, use in uffd release (Lorenzo Stoakes)
  - nvmet-fc: Remove unused functions (WangYuli)
  - drm/amd/display: Temporarily disable hostvm on DCN31 (Aurabindo Pillai)
  - LoongArch: Eliminate superfluous get_numa_distances_cnt() (Yuli Wang)
  - efi/libstub: Bump up EFI_MMAP_NR_SLACK_SLOTS to 32 (Hamza Mahfooz)
  - misc: pci_endpoint_test: Fix 'irq_type' to convey the correct type (Kunihiko Hayashi)
  - misc: pci_endpoint_test: Avoid issue of interrupts remaining after request_irq error (Kunihiko Hayashi)
  - selftests/bpf: Fix raw_tp null handling test (Shung-Hsi Yu)
  - md: fix mddev uaf while iterating all_mddevs list (Yu Kuai)
  - platform/x86: msi-wmi-platform: Workaround a ACPI firmware bug (Armin Wolf)
  - platform/x86: msi-wmi-platform: Rename "data" variable (Armin Wolf)
  - kbuild: Add '-fno-builtin-wcslen' (Nathan Chancellor)
  - scripts: generate_rust_analyzer: Add ffi crate (Lukas Fischer)
  - cpufreq: Reference count policy in cpufreq_update_limits() (Rafael J. Wysocki)
  - arm64/boot: Enable EL2 requirements for FEAT_PMUv3p9 (Anshuman Khandual)
  - arm64/sysreg: Add register fields for HFGWTR2_EL2 (Anshuman Khandual)
  - arm64/sysreg: Add register fields for HFGRTR2_EL2 (Anshuman Khandual)
  - arm64/sysreg: Add register fields for HFGITR2_EL2 (Anshuman Khandual)
  - arm64/sysreg: Add register fields for HDFGWTR2_EL2 (Anshuman Khandual)
  - arm64/sysreg: Add register fields for HDFGRTR2_EL2 (Anshuman Khandual)
  - arm64/sysreg: Update register fields for ID_AA64MMFR0_EL1 (Anshuman Khandual)
  - drm/mgag200: Fix value in <VBLKSTR> register (Thomas Zimmermann)
  - drm/amdgpu: fix warning of drm_mm_clean (ZhenGuo Yin)
  - drm/xe: Set LRC addresses before guc load (Lucas De Marchi)
  - drm/xe/userptr: fix notifier vs folio deadlock (Matthew Auld)
  - drm/xe/dma_buf: stop relying on placement in unmap (Matthew Auld)
  - drm/amd/display: Add HP Probook 445 and 465 to the quirk list for eDP on DP1 (Mario Limonciello)
  - drm/amd/display: Protect FPU in dml2_init()/dml21_init() (Huacai Chen)
  - drm/amd/display: Do not enable Replay and PSR while VRR is on in amdgpu_dm_commit_planes() (Tom Chung)
  - drm/amdgpu: immediately use GTT for new allocations (Christian König)
  - drm/i915/gvt: fix unterminated-string-initialization warning (Jani Nikula)
  - drm/xe: Fix an out-of-bounds shift when invalidating TLB (Thomas Hellström)
  - drm/sti: remove duplicate object names (Rolf Eike Beer)
  - drm/imagination: take paired job reference (Brendan King)
  - drm/imagination: fix firmware memory leaks (Brendan King)
  - drm/nouveau: prime: fix ttm_bo_delayed_delete oops (Chris Bainbridge)
  - drm/amdgpu/dma_buf: fix page_link check (Matthew Auld)
  - drm/amdgpu/mes11: optimize MES pipe FW version fetching (Alex Deucher)
  - drm/amd/display: Protect FPU in dml21_copy() (Huacai Chen)
  - drm/amd/display: Protect FPU in dml2_validate()/dml21_validate() (Huacai Chen)
  - drm/amd/display: Add HP Elitebook 645 to the quirk list for eDP on DP1 (Mario Limonciello)
  - drm/xe: Use local fence in error path of xe_migrate_clear (Matthew Brost)
  - drm/i915/vrr: Add vrr.vsync_{start, end} in vrr_params_changed (Ankit Nautiyal)
  - drm/amdgpu/mes12: optimize MES pipe FW version fetching (Alex Deucher)
  - drm/amd/pm/powerplay/hwmgr/vega20_thermal: Prevent division by zero (Denis Arefev)
  - drm/amd/pm/swsmu/smu13/smu_v13_0: Prevent division by zero (Denis Arefev)
  - drm/amd/pm/powerplay/hwmgr/smu7_thermal: Prevent division by zero (Denis Arefev)
  - drm/amd/pm/smu11: Prevent division by zero (Denis Arefev)
  - drm/amd/pm/powerplay: Prevent division by zero (Denis Arefev)
  - drm/amd/pm: Prevent division by zero (Denis Arefev)
  - drm/amd/display: Increase vblank offdelay for PSR panels (Leo Li)
  - drm/amd/display: Actually do immediate vblank disable (Leo Li)
  - drm/amd: Handle being compiled without SI or CIK support better (Mario Limonciello)
  - drm/amd/display: prevent hang on link training fail (Brendan Tam)
  - drm/amdgpu: Prefer shadow rom when available (Lijo Lazar)
  - drm/msm/a6xx: Fix stale rpmh votes from GPU (Akhil P Oommen)
  - drm/msm/dsi: Add check for devm_kstrdup() (Haoxiang Li)
  - drm/ast: Fix ast_dp connection status (Jocelyn Falempe)
  - drm/repaper: fix integer overflows in repeat functions (Nikita Zhandarovich)
  - perf/x86/intel/uncore: Fix the scale of IIO free running counters on SPR (Kan Liang)
  - perf/x86/intel/uncore: Fix the scale of IIO free running counters on ICX (Kan Liang)
  - perf/x86/intel/uncore: Fix the scale of IIO free running counters on SNR (Kan Liang)
  - perf/x86/intel: Allow to update user space GPRs from PEBS records (Dapeng Mi)
  - platform/x86: amd: pmf: Fix STT limits (Mario Limonciello)
  - RAS/AMD/FMPM: Get masked address (Yazen Ghannam)
  - RAS/AMD/ATL: Include row[13] bit in row retirement (Yazen Ghannam)
  - scsi: ufs: exynos: Ensure consistent phy reference counts (Peter Griffin)
  - scsi: megaraid_sas: Block zero-length ATA VPD inquiry (Chandrakanth Patil)
  - x86/boot/sev: Avoid shared GHCB page for early memory acceptance (Ard Biesheuvel)
  - x86/cpu/amd: Fix workaround for erratum 1054 (Sandipan Das)
  - x86/microcode/AMD: Extend the SHA check to Zen5, block loading of any unreleased standalone Zen5 microcode patches (Borislav Petkov (AMD))
  - virtiofs: add filesystem context source name check (Xiangsheng Hou)
  - tracing: Fix filter string testing (Steven Rostedt)
  - string: Add load_unaligned_zeropad() code path to sized_strscpy() (Peter Collingbourne)
  - smb3 client: fix open hardlink on deferred close file error (Chunjie Zhu)
  - slab: ensure slab->obj_exts is clear in a newly allocated slab page (Suren Baghdasaryan)
  - selftests/mm: generate a temporary mountpoint for cgroup filesystem (Mark Brown)
  - riscv: Avoid fortify warning in syscall_get_arguments() (Nathan Chancellor)
  - Revert "smb: client: fix TCP timers deadlock after rmmod" (Kuniyuki Iwashima)
  - Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free" (Kuniyuki Iwashima)
  - ksmbd: fix the warning from __kernel_write_iter (Namjae Jeon)
  - ksmbd: Prevent integer overflow in calculation of deadtime (Denis Arefev)
  - ksmbd: fix use-after-free in smb_break_all_levII_oplock() (Namjae Jeon)
  - ksmbd: Fix dangling pointer in krb_authenticate (Sean Heelan)
  - ovl: don't allow datadir only (Miklos Szeredi)
  - mm: fix apply_to_existing_page_range() (Kirill A. Shutemov)
  - mm: fix filemap_get_folios_contig returning batches of identical folios (Vishal Moola (Oracle))
  - mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Baoquan He)
  - mm/compaction: fix bug in hugetlb handling pathway (Vishal Moola (Oracle))
  - loop: LOOP_SET_FD: send uevents for partitions (Thomas Weißschuh)
  - loop: properly send KOBJ_CHANGED uevent for disk device (Thomas Weißschuh)
  - isofs: Prevent the use of too small fid (Edward Adam Davis)
  - i2c: cros-ec-tunnel: defer probe if parent EC is not present (Thadeu Lima de Souza Cascardo)
  - hfs/hfsplus: fix slab-out-of-bounds in hfs_bnode_read_key (Vasiliy Kovalev)
  - crypto: caam/qi - Fix drv_ctx refcount bug (Herbert Xu)
  - cpufreq/sched: Explicitly synchronize limits_changed flag handling (Rafael J. Wysocki)
  - btrfs: correctly escape subvol in btrfs_show_options() (Johannes Kimmel)
  - Bluetooth: vhci: Avoid needless snprintf() calls (Kees Cook)
  - Bluetooth: l2cap: Process valid commands in too long frame (Frédéric Danis)
  - drm/msm/a6xx+: Don't let IB_SIZE overflow (Rob Clark)
  - ftrace: fix incorrect hash size in register_ftrace_direct() (Menglong Dong)
  - i2c: atr: Fix wrong include (Andy Shevchenko)
  - nfsd: decrease sc_count directly if fail to queue dl_recall (Li Lingfeng)
  - nfs: add missing selections of CONFIG_CRC32 (Eric Biggers)
  - dma-buf/sw_sync: Decrement refcount on error in sw_sync_ioctl_get_deadline() (Dan Carpenter)
  - drm/v3d: Fix Indirect Dispatch configuration for V3D 7.1.6 and later (Maíra Canal)
  - block: integrity: Do not call set_page_dirty_lock() (Martin K. Petersen)
  - asus-laptop: Fix an uninitialized variable (Denis Arefev)
  - ASoC: qcom: Fix sc7280 lpass potential buffer overflow (Evgeny Pimenov)
  - ASoC: Intel: sof_sdw: Add quirk for Asus Zenbook S16 (Peter Ujfalusi)
  - ASoC: codecs:lpass-wsa-macro: Fix logic of enabling vi channels (Srinivas Kandagatla)
  - ASoC: codecs:lpass-wsa-macro: Fix vi feedback rate (Srinivas Kandagatla)
  - ASoC: fsl: fsl_qmc_audio: Reset audio data pointers on TRIGGER_START event (Herve Codina)
  - Revert "PCI: Avoid reset when disabled via sysfs" (Alex Williamson)
  - writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher)
  - rust: kbuild: use `pound` to support GNU Make < 4.3 (Miguel Ojeda)
  - rust: disable `clippy::needless_continue` (Miguel Ojeda)
  - rust: kasan/kbuild: fix missing flags on first build (Miguel Ojeda)
  - objtool/rust: add one more `noreturn` Rust function for Rust 1.86.0 (Miguel Ojeda)
  - cpufreq/sched: Fix the usage of CPUFREQ_NEED_UPDATE_LIMITS (Rafael J. Wysocki)
  - riscv: KGDB: Remove ".option norvc/.option rvc" for kgdb_compiled_break (WangYuli)
  - riscv: KGDB: Do not inline arch_kgdb_breakpoint() (WangYuli)
  - kunit: qemu_configs: SH: Respect kunit cmdline (Thomas Weißschuh)
  - riscv: module: Allocate PLT entries for R_RISCV_PLT32 (Samuel Holland)
  - riscv: module: Fix out-of-bounds relocation access (Samuel Holland)
  - riscv: Properly export reserved regions in /proc/iomem (Björn Töpel)
  - riscv: Use kvmalloc_array on relocation_hashtable (Will Pierce)
  - net: ethernet: mtk_eth_soc: revise QDMA packet scheduler settings (Bo-Cun Chen)
  - net: ethernet: mtk_eth_soc: correct the max weight of the queue limit for 100Mbps (Bo-Cun Chen)
  - net: ethernet: mtk_eth_soc: reapply mdc divider on reset (Bo-Cun Chen)
  - net: ti: icss-iep: Fix possible NULL pointer dereference for perout request (Meghana Malladi)
  - net: ti: icss-iep: Add phase offset configuration for perout signal (Meghana Malladi)
  - net: ti: icss-iep: Add pwidth configuration for perout signal (Meghana Malladi)
  - ptp: ocp: fix start time alignment in ptp_ocp_signal_set (Sagi Maimon)
  - net: dsa: avoid refcount warnings when ds->ops->tag_8021q_vlan_del() fails (Vladimir Oltean)
  - net: dsa: free routing table on probe failure (Vladimir Oltean)
  - net: dsa: clean up FDB, MDB, VLAN entries on unbind (Vladimir Oltean)
  - net: dsa: mv88e6xxx: fix -ENOENT when deleting VLANs and MST is unsupported (Vladimir Oltean)
  - net: dsa: mv88e6xxx: avoid unregistering devlink regions which were never registered (Vladimir Oltean)
  - net: txgbe: fix memory leak in txgbe_probe() error path (Abdun Nihaal)
  - net: bridge: switchdev: do not notify new brentries as changed (Jonas Gorski)
  - net: b53: enable BPDU reception for management port (Jonas Gorski)
  - netlink: specs: rt-link: adjust mctp attribute naming (Jakub Kicinski)
  - netlink: specs: rt-link: add an attr layer around alt-ifname (Jakub Kicinski)
  - cxgb4: fix memory leak in cxgb4_init_ethtool_filters() error path (Abdun Nihaal)
  - ata: libata-sata: Save all fields from sense data descriptor (Niklas Cassel)
  - loop: stop using vfs_iter_{read,write} for buffered I/O (Christoph Hellwig)
  - loop: aio inherit the ioprio of original request (Yunlong Xing)
  - eth: bnxt: fix missing ring index trim on error path (Jakub Kicinski)
  - net: ethernet: ti: am65-cpsw: fix port_np reference counting (Michael Walle)
  - net: ngbe: fix memory leak in ngbe_probe() error path (Abdun Nihaal)
  - can: rockchip_canfd: fix broken quirks checks (Weizhao Ouyang)
  - net: openvswitch: fix nested key length validation in the set() action (Ilya Maximets)
  - netlink: specs: ovs_vport: align with C codegen capabilities (Jakub Kicinski)
  - block: fix resource leak in blk_register_queue() error path (Zheng Qixing)
  - net: mctp: Set SOCK_RCU_FREE (Matt Johnston)
  - ethtool: cmis_cdb: use correct rpl size in ethtool_cmis_module_poll() (Damodharam Ammepalli)
  - pds_core: fix memory leak in pdsc_debugfs_add_qcq() (Abdun Nihaal)
  - test suite: use %zu to print size_t (Matthew Wilcox (Oracle))
  - smc: Fix lockdep false-positive for IPPROTO_SMC. (Kuniyuki Iwashima)
  - dt-bindings: soc: fsl: fsl,ls1028a-reset: Fix maintainer entry (Geert Uytterhoeven)
  - igc: add lock preventing multiple simultaneous PTM transactions (Christopher S M Hall)
  - igc: cleanup PTP module if probe fails (Christopher S M Hall)
  - igc: handle the IGC_PTP_ENABLED flag correctly (Christopher S M Hall)
  - igc: move ktime snapshot into PTM retry loop (Christopher S M Hall)
  - igc: increase wait time before retrying PTM (Christopher S M Hall)
  - igc: fix PTM cycle trigger logic (Christopher S M Hall)
  - Revert "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" (Johannes Berg)
  - xen: fix multicall debug feature (Juergen Gross)
  - ipv6: add exception routes to GC list in rt6_insert_exception (Xin Long)
  - Bluetooth: l2cap: Check encryption key size on incoming connection (Frédéric Danis)
  - Bluetooth: btrtl: Prevent potential NULL dereference (Dan Carpenter)
  - Bluetooth: hci_event: Fix sending MGMT_EV_DEVICE_FOUND for invalid address (Luiz Augusto von Dentz)
  - RDMA/core: Silence oversized kvmalloc() warning (Shay Drory)
  - ASoC: cs42l43: Reset clamp override on jack removal (Charles Keepax)
  - ALSA: hda/realtek - Fixed ASUS platform headset Mic issue (Kailang Yang)
  - ALSA: hda/realtek: Workaround for resume on Dell Venue 11 Pro 7130 (Takashi Iwai)
  - ALSA: hda: improve bass speaker support for ASUS Zenbook UM5606WA (Jaroslav Kysela)
  - ALSA: hda/cirrus_scodec_test: Don't select dependencies (Richard Fitzgerald)
  - RDMA/hns: Fix wrong maximum DMA segment size (Chengchang Tang)
  - RDMA/usnic: Fix passing zero to PTR_ERR in usnic_ib_pci_probe() (Yue Haibing)
  - ovl: remove unused forward declaration (Giuseppe Scrivano)
  - crypto: tegra - Fix IV usage for AES ECB (Akhil R)
  - crypto: tegra - Do not use fixed size buffers (Akhil R)
  - crypto: tegra - remove redundant error check on ret (Colin Ian King)
  - ASoC: Intel: avs: Fix null-ptr-deref in avs_component_probe() (Henry Martin)
  - ASoC: dwc: always enable/disable i2s irqs (Brady Norander)
  - md/md-bitmap: fix stats collection for external bitmaps (Zheng Qixing)
  - md/raid10: fix missing discard IO accounting (Yu Kuai)
  - scsi: iscsi: Fix missing scsi_host_put() in error path (Miaoqian Lin)
  - wifi: wl1251: fix memory leak in wl1251_tx_work (Abdun Nihaal)
  - wifi: mac80211: Purge vif txq in ieee80211_do_stop() (Remi Pommarel)
  - wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue() (Remi Pommarel)
  - wifi: at76c50x: fix use after free access in at76_disconnect (Abdun Nihaal)
  - scsi: hisi_sas: Enable force phy when SATA disk directly connected (Xingui Yang)
  - aarch64: increase DEFAULT_CRASH_KERNEL_LOW_SIZE for kdump (Brian Maly)  [Orabug: 37446372]
  - vhost-scsi: Fix vhost_scsi_send_status() (Dongli Zhang)  [Orabug: 37840543]
  - vhost-scsi: Fix vhost_scsi_send_bad_target() (Dongli Zhang)  [Orabug: 37840543]
  - vhost-scsi: protect vq->log_used with vq->mutex (Dongli Zhang)  [Orabug: 37840543]
  - vhost-scsi: Reduce response iov mem use (Mike Christie)  [Orabug: 37840543]
  - vhost-scsi: Allocate iov_iter used for unaligned copies when needed (Mike Christie)  [Orabug: 37840543]
  - vhost-scsi: Stop duplicating se_cmd fields (Mike Christie)  [Orabug: 37840543]
  - vhost-scsi: Dynamically allocate scatterlists (Mike Christie)  [Orabug: 37840543]
  - vhost-scsi: Return queue full for page alloc failures during copy (Mike Christie)  [Orabug: 37840543]
  - vhost-scsi: Add better resource allocation failure handling (Mike Christie)  [Orabug: 37840543]
  - vhost-scsi: Allocate T10 PI structs only when enabled (Mike Christie)  [Orabug: 37840543]
  - vhost-scsi: Reduce mem use by moving upages to per queue (Mike Christie)  [Orabug: 37840543]
  - Revert "vhost-scsi: protect vq->log_base with vq->mutex" (Mike Christie)  [Orabug: 37840543]
  - Revert "vhost_scsi: log write descriptors" (Mike Christie)  [Orabug: 37840543]
  - scsi: mpi3mr: Event processing debug improvement (Ranjan Kumar)  [Orabug: 37878021]
  - scsi: mpi3mr: Add level check to control event logging (Ranjan Kumar)  [Orabug: 37878021]
  - scsi: mpi3mr: Reset the pending interrupt flag (Ranjan Kumar)  [Orabug: 37878021]
  - scsi: mpi3mr: Fix pending I/O counter (Ranjan Kumar)  [Orabug: 37878021]


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-2.28.3.el9uek]
changelog:
  - LTS version: v6.12.28 (Jack Vogel)
  - dm: fix copying after src array boundaries (Tudor Ambarus)
  - drm/amd/display: Fix slab-use-after-free in hdcp (Chris Bainbridge)
  - drm/amd/display: Add scoped mutexes for amdgpu_dm_dhcp (Mario Limonciello)
  - drivers: base: handle module_kobject creation (Shyam Saini)
  - kernel: globalize lookup_or_create_module_kobject() (Shyam Saini)
  - kernel: param: rename locate_module_kobject (Shyam Saini)
  - Revert "drm/meson: vclk: fix calculation of 59.94 fractional rates" (Christian Hewitt)
  - arm64: dts: st: Use 128kB size for aliased GIC400 register access on stm32mp25 SoCs (Christian Bruel)
  - arm64: dts: st: Adjust interrupt-controller for stm32mp25 SoCs (Christian Bruel)
  - ARM: dts: opos6ul: add ksz8081 phy properties (Sébastien Szymanski)
  - arm64: dts: imx95: Correct the range of PCIe app-reg region (Richard Zhu)
  - firmware: arm_ffa: Skip Rx buffer ownership release if not acquired (Sudeep Holla)
  - firmware: arm_scmi: Balance device refcount when destroying devices (Cristian Marussi)
  - drm/xe: Ensure fixed_slice_mode gets set after ccs_mode change (Niranjana Vishwanathapura)
  - sch_ets: make est_qlen_notify() idempotent (Cong Wang)
  - sch_qfq: make qfq_qlen_notify() idempotent (Cong Wang)
  - sch_hfsc: make hfsc_qlen_notify() idempotent (Cong Wang)
  - sch_drr: make drr_qlen_notify() idempotent (Cong Wang)
  - sch_htb: make htb_qlen_notify() idempotent (Cong Wang)
  - accel/ivpu: Add handling of VPU_JSM_STATUS_MVNCI_CONTEXT_VIOLATION_HW (Karol Wachowski)
  - accel/ivpu: Fix locking order in ivpu_job_submit (Karol Wachowski)
  - accel/ivpu: Abort all jobs after command queue unregister (Karol Wachowski)
  - accel/ivpu: Update VPU FW API headers (Andrzej Kacprowski)
  - accel/ivpu: Fix a typo (Andrew Kreimer)
  - accel/ivpu: Use xa_alloc_cyclic() instead of custom function (Karol Wachowski)
  - accel/ivpu: Make DB_ID and JOB_ID allocations incremental (Tomasz Rusinowicz)
  - net: Fix the devmem sock opts and msgs for parisc (Pranjal Shrivastava)
  - bcachefs: Remove incorrect __counted_by annotation (Alan Huang)
  - mm, slab: clean up slab->obj_exts always (Zhenhua Huang)
  - net: vertexcom: mse102x: Fix RX error handling (Stefan Wahren)
  - net: vertexcom: mse102x: Add range check for CMD_RTS (Stefan Wahren)
  - net: vertexcom: mse102x: Fix LEN_MASK (Stefan Wahren)
  - net: vertexcom: mse102x: Fix possible stuck of SPI interrupt (Stefan Wahren)
  - net: hns3: defer calling ptp_clock_register() (Jian Shen)
  - net: hns3: fixed debugfs tm_qset size (Hao Lan)
  - net: hns3: fix an interrupt residual problem (Yonglong Liu)
  - net: hns3: store rx VLAN tag offload state for VF (Jian Shen)
  - octeon_ep: Fix host hang issue during device reboot (Sathesh B Edara)
  - net: fec: ERR007885 Workaround for conventional TX (Mattias Barthel)
  - net: lan743x: Fix memleak issue when GSO enabled (Thangaraj Samynathan)
  - ptp: ocp: Fix NULL dereference in Adva board SMA sysfs operations (Sagi Maimon)
  - net: use sock_gen_put() when sk_state is TCP_TIME_WAIT (Jibin Zhang)
  - bnxt_en: fix module unload sequence (Vadim Fedorenko)
  - ASoC: simple-card-utils: Fix pointer check in graph_util_parse_link_direction (Alexander Stein)
  - nvmet-tcp: select CONFIG_TLS from CONFIG_NVME_TARGET_TCP_TLS (Alistair Francis)
  - nvme-tcp: select CONFIG_TLS from CONFIG_NVME_TCP_TLS (Alistair Francis)
  - nvme-tcp: fix premature queue removal and I/O failover (Michael Liang)
  - bnxt_en: Fix ethtool -d byte order for 32-bit values (Michael Chan)
  - bnxt_en: Fix out-of-bound memcpy() during ethtool -w (Shruti Parab)
  - bnxt_en: Fix coredump logic to free allocated buffer (Shruti Parab)
  - bnxt_en: call pci_alloc_irq_vectors() after bnxt_reserve_rings() (Kashyap Desai)
  - bnxt_en: Add missing skb_mark_for_recycle() in bnxt_rx_vlan() (Somnath Kotur)
  - bnxt_en: Fix ethtool selftest output in one of the failure cases (Kalesh AP)
  - bnxt_en: Fix error handling path in bnxt_init_chip() (Shravya KN)
  - ALSA: hda/realtek: Fix built-mic regression on other ASUS models (Takashi Iwai)
  - net: ipv6: fix UDPv6 GSO segmentation with NAT (Felix Fietkau)
  - net: dsa: felix: fix broken taprio gate states after clock jump (Vladimir Oltean)
  - net: ethernet: mtk_eth_soc: fix SER panic with 4GB+ RAM (Chad Monroe)
  - igc: fix lock order in igc_ptp_reset (Jacob Keller)
  - idpf: protect shutdown from reset (Larysa Zaremba)
  - idpf: fix potential memory leak on kcalloc() failure (Michal Swiatkowski)
  - net: mdio: mux-meson-gxl: set reversed bit when using internal phy (Da Xue)
  - net: dlink: Correct endianness handling of led_mode (Simon Horman)
  - drm/mipi-dbi: Fix blanking for non-16 bit formats (Russell Cloran)
  - drm/tests: shmem: Fix memleak (Maxime Ripard)
  - nvme-pci: fix queue unquiesce check on slot_reset (Keith Busch)
  - ALSA: ump: Fix buffer overflow at UMP SysEx message conversion (Takashi Iwai)
  - scsi: ufs: core: Remove redundant query_complete trace (Keoseong Park)
  - idpf: fix offloads support for encapsulated packets (Madhu Chittim)
  - ice: Check VF VSI Pointer Value in ice_vc_add_fdir_fltr() (Xuanqiang Luo)
  - net_sched: qfq: Fix double list add in class with netem as child qdisc (Victor Nogueira)
  - net_sched: ets: Fix double list add in class with netem as child qdisc (Victor Nogueira)
  - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (Victor Nogueira)
  - net_sched: drr: Fix double list add in class with netem as child qdisc (Victor Nogueira)
  - pds_core: remove write-after-free of client_id (Shannon Nelson)
  - pds_core: specify auxiliary_device to be created (Shannon Nelson)
  - pds_core: make pdsc_auxbus_dev_del() void (Shannon Nelson)
  - net: ethernet: mtk_eth_soc: sync mtk_clks_source_name array (Daniel Golle)
  - net: ethernet: mtk-star-emac: rearm interrupts in rx_poll only when advised (Louis-Alexis Eyraud)
  - net: ethernet: mtk-star-emac: fix spinlock recursion issues on rx/tx poll (Louis-Alexis Eyraud)
  - rtase: Modify the condition used to detect overflow in rtase_calc_time_mitigation (Justin Lai)
  - bnxt_en: improve TX timestamping FIFO configuration (Vadim Fedorenko)
  - octeon_ep_vf: Resolve netdevice usage count issue (Sathesh B Edara)
  - net: mscc: ocelot: delete PVID VLAN when readding it as non-PVID (Vladimir Oltean)
  - Bluetooth: L2CAP: copy RX timestamp to new fragments (Pauli Virtanen)
  - Bluetooth: btintel_pcie: Add additional to checks to clear TX/RX paths (Kiran K)
  - Bluetooth: btusb: avoid NULL pointer dereference in skb_dequeue() (En-Wei Wu)
  - Bluetooth: btintel_pcie: Avoid redundant buffer allocation (Kiran K)
  - Bluetooth: hci_conn: Fix not setting timeout for BIG Create Sync (Luiz Augusto von Dentz)
  - Bluetooth: hci_conn: Fix not setting conn_timeout for Broadcast Receiver (Luiz Augusto von Dentz)
  - Bluetooth: hci_conn: Remove alloc from critical section (Iulia Tanasescu)
  - ASoC: amd: acp: Fix NULL pointer deref in acp_i2s_set_tdm_slot (Venkata Prasad Potturu)
  - accel/ivpu: Correct DCT interrupt handling (Karol Wachowski)
  - net/mlx5: E-switch, Fix error handling for enabling roce (Chris Mi)
  - net/mlx5e: Fix lock order in mlx5e_tx_reporter_ptpsq_unhealthy_recover (Cosmin Ratiu)
  - net/mlx5e: TC, Continue the attr process even if encap entry is invalid (Jianbo Liu)
  - net/mlx5: E-Switch, Initialize MAC Address for Default GID (Maor Gottlieb)
  - net/mlx5e: Use custom tunnel header for vxlan gbp (Vlad Dogaru)
  - xsk: Fix race condition in AF_XDP generic RX path (e.kubanski)
  - vxlan: vnifilter: Fix unlocked deletion of default FDB entry (Ido Schimmel)
  - powerpc/boot: Fix dash warning (Madhavan Srinivasan)
  - wifi: plfxlc: Remove erroneous assert in plfxlc_mac_release (Murad Masimov)
  - wifi: iwlwifi: fix the check for the SCRATCH register upon resume (Emmanuel Grumbach)
  - wifi: iwlwifi: don't warn if the NIC is gone in resume (Emmanuel Grumbach)
  - drm/i915/pxp: fix undefined reference to `intel_pxp_gsccs_is_ready_for_sessions' (Chen Linxuan)
  - ALSA: hda/realtek - Enable speaker for HP platform (Kailang Yang)
  - ASoC: Intel: sof_sdw: Add NULL check in asoc_sdw_rt_dmic_rtd_init() (Chenyuan Yang)
  - powerpc/boot: Check for ld-option support (Madhavan Srinivasan)
  - pinctrl: imx: Return NULL if no group is matched and found (Hui Wang)
  - book3s64/radix : Align section vmemmap start address to PAGE_SIZE (Donet Tom)
  - ASoC: soc-pcm: Fix hw_params() and DAPM widget sequence (Sheetal)
  - ASoC: cs-amp-lib-test: Don't select SND_SOC_CS_AMP_LIB (Richard Fitzgerald)
  - ASoC: soc-core: Stop using of_property_read_bool() for non-boolean properties (Geert Uytterhoeven)
  - drm/amd/display: Default IPS to RCG_IN_ACTIVE_IPS2_IN_OFF (Leo Li)
  - tracing: Fix oob write in trace_seq_to_buffer() (Jeongjun Park)
  - cpufreq: Fix setting policy limits when frequency tables are used (Rafael J. Wysocki)
  - cpufreq: Avoid using inconsistent policy->min and policy->max (Rafael J. Wysocki)
  - smb: client: fix zero length for mkdir POSIX create context (Jethro Donaldson)
  - ksmbd: fix use-after-free in session logoff (Sean Heelan)
  - ksmbd: fix use-after-free in kerberos authentication (Sean Heelan)
  - ksmbd: fix use-after-free in ksmbd_session_rpc_open (Namjae Jeon)
  - platform/x86/intel-uncore-freq: Fix missing uncore sysfs during CPU hotplug (Shouye Liu)
  - platform/x86/amd: pmc: Require at least 2.5 seconds between HW sleep cycles (Mario Limonciello)
  - iommu: Fix two issues in iommu_copy_struct_from_user() (Nicolin Chen)
  - iommu/vt-d: Apply quirk_iommu_igfx for 8086:0044 (QM57/QS57) (Mingcong Bai)
  - iommu/arm-smmu-v3: Fix pgsize_bit for sva domains (Balbir Singh)
  - iommu/arm-smmu-v3: Fix iommu_device_probe bug due to duplicated stream ids (Nicolin Chen)
  - iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid (Pavel Paklov)
  - drm: Select DRM_KMS_HELPER from DRM_DEBUG_DP_MST_TOPOLOGY_REFS (Janne Grunau)
  - drm/amdgpu: Fix offset for HDP remap in nbio v7.11 (Lijo Lazar)
  - dm: always update the array size in realloc_argv on success (Benjamin Marzinski)
  - dm-integrity: fix a warning on invalid table line (Mikulas Patocka)
  - dm-bufio: don't schedule in atomic context (LongPing Wei)
  - x86/boot/sev: Support memory acceptance in the EFI stub under SVSM (Ard Biesheuvel)
  - wifi: brcm80211: fmac: Add error handling for brcmf_usb_dl_writeimage() (Wentao Liang)
  - tracing: Do not take trace_event_sem in print_event_fields() (Steven Rostedt)
  - spi: tegra114: Don't fail set_cs_timing when delays are zero (Aaron Kling)
  - mmc: renesas_sdhi: Fix error handling in renesas_sdhi_probe (Ruslan Piasetskyi)
  - mm/memblock: repeat setting reserved region nid if array is doubled (Wei Yang)
  - mm/memblock: pass size instead of end to memblock_set_node() (Wei Yang)
  - irqchip/qcom-mpm: Prevent crash when trying to handle non-wake GPIOs (Stephan Gerhold)
  - amd-xgbe: Fix to ensure dependent features are toggled with RX checksum offload (Vishal Badole)
  - perf/x86/intel: KVM: Mask PEBS_ENABLE loaded for guest with vCPU's value. (Sean Christopherson)
  - perf/x86/intel: Only check the group flag for X86 leader (Kan Liang)
  - parisc: Fix double SIGFPE crash (Helge Deller)
  - arm64: errata: Add missing sentinels to Spectre-BHB MIDR arrays (Will Deacon)
  - i2c: imx-lpi2c: Fix clock count when probe defers (Clark Wang)
  - EDAC/altera: Set DDR and SDMMC interrupt mask before registration (Niravkumar L Rabara)
  - EDAC/altera: Test the correct error reg offset (Niravkumar L Rabara)
  - drm/nouveau: Fix WARN_ON in nouveau_fence_context_kill() (Philipp Stanner)
  - drm/fdinfo: Protect against driver unbind (Tvrtko Ursulin)
  - cpufreq: intel_pstate: Unchecked MSR aceess in legacy mode (Srinivas Pandruvada)
  - btrfs: fix COW handling in run_delalloc_nocow() (Dave Chen)
  - btrfs: adjust subpage bit start based on sectorsize (Josef Bacik)
  - binder: fix offset calculation in debug log (Carlos Llamas)
  - ALSA: usb-audio: Add second USB ID for Jabra Evolve 65 headset (Joachim Priesner)
  - ALSA: usb-audio: Add retry on -EPROTO from usb_set_interface() (Geoffrey D. Bennett)
  - Revert "rndis_host: Flag RNDIS modems as WWAN devices" (Christian Heusel)
  - Bluetooth: btusb: Add 13 USB device IDs for Qualcomm WCN785x (Zijun Hu)
  - Bluetooth: btusb: Add new VID/PID for WCN785x (Dorian Cruveiller)
  - Bluetooth: btusb: Add ID 0x2c7c:0x0130 for Qualcomm WCN785x (Mark Dietzer)
  - Bluetooth: btusb: Add one more ID 0x13d3:0x3623 for Qualcomm WCN785x (Zijun Hu)
  - Bluetooth: btusb: Add one more ID 0x0489:0xe0f3 for Qualcomm WCN785x (Zijun Hu)
  - Bluetooth: btusb: add Foxconn 0xe0fc for Qualcomm WCN785x (Aaron Ma)
  - x86/PCI: Export find_cap() to be used in early PCI code (Rayan Dasoriya)  [Orabug: 37383447]
  - x86/quirks: Scan all busses for early PCI quirks (Rayan Dasoriya)  [Orabug: 37383447]
  - x86/quirks: Add parameter to clear MSIs early on boot (Rayan Dasoriya)  [Orabug: 37383447]
  - scsi: megaraid_sas: Driver version update to 07.734.00.00-rc1 (Chandrakanth Patil)  [Orabug: 37877985]
  - scsi: megaraid_sas: Make most module parameters static (Dr. David Alan Gilbert)  [Orabug: 37877985]
  - scsi: mpt3sas: Fix buffer overflow in mpt3sas_send_mctp_passthru_req() (Dan Carpenter)  [Orabug: 37878012]
  - scsi: mpt3sas: Fix spelling mistake "receveid" -> "received" (Colin Ian King)  [Orabug: 37878012]
  - scsi: mpt3sas: update driver version to 52.100.00.00 (Shivasharan S)  [Orabug: 37878012]
  - scsi: mpt3sas: Send a diag reset if target reset fails (Shivasharan S)  [Orabug: 37878012]
  - scsi: mpt3sas: Report driver capability as part of IOCINFO command (Shivasharan S)  [Orabug: 37878012]
  - scsi: mpt3sas: Add support for MCTP Passthrough commands (Shivasharan S)  [Orabug: 37878012]
  - scsi: mpt3sas: Update MPI headers to 02.00.62 version (Shivasharan S)  [Orabug: 37878012]
  - scsi: mpt3sas: Fix a locking bug in an error path (Bart Van Assche)  [Orabug: 37878012]
  - scsi: mpt3sas: Reduce log level of ignore_delay_remove message to KERN_INFO (Paul Menzel)  [Orabug: 37878012]
  - scsi: mpt3sas: Remove unused config functions (Dr. David Alan Gilbert)  [Orabug: 37878012]
  - scsi: mpt3sas: Add details to EEDPTagMode error message (Paul Menzel)  [Orabug: 37878012]
  - scsi: mpt3sas: Update driver version to 51.100.00.00 (Ranjan Kumar)  [Orabug: 37878012]
  - vhost-scsi: log event queue write descriptors (Dongli Zhang)  [Orabug: 37883837]
  - vhost-scsi: log control queue write descriptors (Dongli Zhang)  [Orabug: 37883837]
  - vhost-scsi: log I/O queue write descriptors (Dongli Zhang)  [Orabug: 37883837]
  - vhost-scsi: adjust vhost_scsi_get_desc() to log vring descriptors (Dongli Zhang)  [Orabug: 37883837]
  - vhost: modify vhost_log_write() for broader users (Dongli Zhang)  [Orabug: 37883837]
  - uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu)  [Orabug: 37899161]
  - uek-rpm: Move vmxnet3 to module-core in UEK8 (Harshit Mogalapalli)  [Orabug: 37908279]
  - x86/bugs: Enabling Retbleed and SRSO mitigation can taint the kernel (Alexandre Chartre)  [Orabug: 37936569]
  - x86/bhi: Do not set BHI_DIS_S in 32-bit mode (Pawan Gupta)  [Orabug: 37920673]
  - x86/bpf: Add IBHF call at end of classic BPF (Daniel Sneddon)  [Orabug: 37920673]
  - x86/bpf: Call branch history clearing sequence on exit (Daniel Sneddon)  [Orabug: 37920673]
  - selftest/x86/bugs: Add selftests for ITS (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
  - x86/its: Align RETs in BHB clear sequence to avoid thunking (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
  - x86/its: Add support for RSB stuffing mitigation (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
  - x86/its: Add "vmexit" option to skip mitigation on some CPUs (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
  - x86/its: Enable Indirect Target Selection mitigation (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
  - x86/its: Add support for ITS-safe return thunk (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
  - x86/its: Add support for ITS-safe indirect thunk (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
  - x86/its: Enumerate Indirect Target Selection (ITS) bug (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
  - Documentation: x86/bugs/its: Add ITS documentation (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-100.28.1.el9uek]
changelog:
  - KVM: SEV: Add KVM_SEV_SNP_ENABLE_REQ_CERTS command (Michael Roth)  [Orabug: 37894105]
  - KVM: Introduce KVM_EXIT_SNP_REQ_CERTS for SNP certificate-fetching (Michael Roth)  [Orabug: 37894105]
  - Revert "KVM: Introduce KVM_EXIT_SNP_REQ_CERTS for SNP certificate-fetching" (Liam Merwick)  [Orabug: 37894105]
  - uek-rpm: Enable SECURITY_DMESG_RESTRICT in UEK8 (Harshit Mogalapalli)  [Orabug: 37867042]


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-100.28.2.el9uek]
changelog:
  - sched/eevdf: Fix se->slice being set to U64_MAX and resulting crash (Omar Sandoval)
  - certs: Add new Oracle Linux Driver Signing (key 1) certificate (Sherry Yang)  [Orabug: 37967533]
  - Revert "block: sysfs option to change ioticks granularity" (Gulam Mohamed)  [Orabug: 37921776]
  - RDS: use pin_user_pages_fast() (Stephen Brennan)  [Orabug: 37968545]


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-100.28.2.2.el9uek]
changelog:
  - Add Zen34 clients (Borislav Petkov (AMD))  [Orabug: 38129827]  {CVE-2024-36350} {CVE-2024-36357} 
  - x86/process: Move the buffer clearing before MONITOR (Kim Phillips)  [Orabug: 38129827]  {CVE-2024-36350} {CVE-2024-36357} 
  - Add normal counters (Borislav Petkov (AMD))  [Orabug: 38129827]  {CVE-2024-36350} {CVE-2024-36357} 
  - KVM: SVM: Advertize TSA CPUID bits to guests (Borislav Petkov (AMD))  [Orabug: 38129827]  {CVE-2024-36350} {CVE-2024-36357} 
  - x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov (AMD))  [Orabug: 38129827]  {CVE-2024-36350} {CVE-2024-36357} 
  - x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov (AMD))  [Orabug: 38129827]  {CVE-2024-36350} {CVE-2024-36357}


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-0.20.20.el9uek]
changelog:
  - block: prevent calls to should_fail_bio() optimized by gcc (Prasad Singamsetty)  [Orabug: 37782458]


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-100.28.2.el9uek]
changelog:
  - sched/eevdf: Fix se->slice being set to U64_MAX and resulting crash (Omar Sandoval)   
  - certs: Add new Oracle Linux Driver Signing (key 1) certificate (Sherry Yang)  [Orabug: 37967533]  
  - Revert "block: sysfs option to change ioticks granularity" (Gulam Mohamed)  [Orabug: 37921776]  
  - RDS: use pin_user_pages_fast() (Stephen Brennan)  [Orabug: 37968545]


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-2.28.3.el9uek]
changelog:
  - LTS version: v6.12.28 (Jack Vogel)
  - dm: fix copying after src array boundaries (Tudor Ambarus)
  - drm/amd/display: Fix slab-use-after-free in hdcp (Chris Bainbridge) [Orabug: 37976747] {CVE-2025-37903}
  - drm/amd/display: Add scoped mutexes for amdgpu_dm_dhcp (Mario Limonciello)
  - drivers: base: handle module_kobject creation (Shyam Saini)
  - kernel: globalize lookup_or_create_module_kobject() (Shyam Saini)
  - kernel: param: rename locate_module_kobject (Shyam Saini)
  - Revert "drm/meson: vclk: fix calculation of 59.94 fractional rates" (Christian Hewitt)
  - arm64: dts: st: Use 128kB size for aliased GIC400 register access on stm32mp25 SoCs (Christian Bruel)
  - arm64: dts: st: Adjust interrupt-controller for stm32mp25 SoCs (Christian Bruel)
  - ARM: dts: opos6ul: add ksz8081 phy properties (Sébastien Szymanski)
  - arm64: dts: imx95: Correct the range of PCIe app-reg region (Richard Zhu)
  - firmware: arm_ffa: Skip Rx buffer ownership release if not acquired (Sudeep Holla)
  - firmware: arm_scmi: Balance device refcount when destroying devices (Cristian Marussi) [Orabug: 37976752] {CVE-2025-37905}
  - drm/xe: Ensure fixed_slice_mode gets set after ccs_mode change (Niranjana Vishwanathapura)
  - sch_ets: make est_qlen_notify() idempotent (Cong Wang)
  - sch_qfq: make qfq_qlen_notify() idempotent (Cong Wang)
  - sch_hfsc: make hfsc_qlen_notify() idempotent (Cong Wang)
  - sch_drr: make drr_qlen_notify() idempotent (Cong Wang)
  - sch_htb: make htb_qlen_notify() idempotent (Cong Wang) [Orabug: 37976858] {CVE-2025-37932}
  - accel/ivpu: Add handling of VPU_JSM_STATUS_MVNCI_CONTEXT_VIOLATION_HW (Karol Wachowski)
  - accel/ivpu: Fix locking order in ivpu_job_submit (Karol Wachowski) [Orabug: 37976760] {CVE-2025-37907}
  - accel/ivpu: Abort all jobs after command queue unregister (Karol Wachowski)
  - accel/ivpu: Update VPU FW API headers (Andrzej Kacprowski)
  - accel/ivpu: Fix a typo (Andrew Kreimer)
  - accel/ivpu: Use xa_alloc_cyclic() instead of custom function (Karol Wachowski)
  - accel/ivpu: Make DB_ID and JOB_ID allocations incremental (Tomasz Rusinowicz)
  - net: Fix the devmem sock opts and msgs for parisc (Pranjal Shrivastava)
  - bcachefs: Remove incorrect __counted_by annotation (Alan Huang)
  - mm, slab: clean up slab->obj_exts always (Zhenhua Huang) [Orabug: 37976762] {CVE-2025-37908}
  - net: vertexcom: mse102x: Fix RX error handling (Stefan Wahren)
  - net: vertexcom: mse102x: Add range check for CMD_RTS (Stefan Wahren)
  - net: vertexcom: mse102x: Fix LEN_MASK (Stefan Wahren)
  - net: vertexcom: mse102x: Fix possible stuck of SPI interrupt (Stefan Wahren)
  - net: hns3: defer calling ptp_clock_register() (Jian Shen)
  - net: hns3: fixed debugfs tm_qset size (Hao Lan)
  - net: hns3: fix an interrupt residual problem (Yonglong Liu)
  - net: hns3: store rx VLAN tag offload state for VF (Jian Shen)
  - octeon_ep: Fix host hang issue during device reboot (Sathesh Edara) [Orabug: 37976864] {CVE-2025-37933}
  - net: fec: ERR007885 Workaround for conventional TX (Mattias Barthel)
  - net: lan743x: Fix memleak issue when GSO enabled (Thangaraj Samynathan) [Orabug: 37976765] {CVE-2025-37909}
  - ptp: ocp: Fix NULL dereference in Adva board SMA sysfs operations (Sagi Maimon) [Orabug: 37976771] {CVE-2025-37910}
  - net: use sock_gen_put() when sk_state is TCP_TIME_WAIT (Jibin Zhang) [Orabug: 37976728] {CVE-2025-37894}
  - bnxt_en: fix module unload sequence (Vadim Fedorenko)
  - ASoC: simple-card-utils: Fix pointer check in graph_util_parse_link_direction (Alexander Stein) [Orabug: 37976869] {CVE-2025-37934}
  - nvmet-tcp: select CONFIG_TLS from CONFIG_NVME_TARGET_TCP_TLS (Alistair Francis)
  - nvme-tcp: select CONFIG_TLS from CONFIG_NVME_TCP_TLS (Alistair Francis)
  - nvme-tcp: fix premature queue removal and I/O failover (Michael Liang)
  - bnxt_en: Fix ethtool -d byte order for 32-bit values (Michael Chan)
  - bnxt_en: Fix out-of-bound memcpy() during ethtool -w (Shruti Parab) [Orabug: 37976773] {CVE-2025-37911}
  - bnxt_en: Fix coredump logic to free allocated buffer (Shruti Parab)
  - bnxt_en: call pci_alloc_irq_vectors() after bnxt_reserve_rings() (Kashyap Desai)
  - bnxt_en: Add missing skb_mark_for_recycle() in bnxt_rx_vlan() (Somnath Kotur)
  - bnxt_en: Fix ethtool selftest output in one of the failure cases (Kalesh Ap)
  - bnxt_en: Fix error handling path in bnxt_init_chip() (Shravya Kn) [Orabug: 37976731] {CVE-2025-37895}
  - ALSA: hda/realtek: Fix built-mic regression on other ASUS models (Takashi Iwai)
  - net: ipv6: fix UDPv6 GSO segmentation with NAT (Felix Fietkau)
  - net: dsa: felix: fix broken taprio gate states after clock jump (Vladimir Oltean)
  - net: ethernet: mtk_eth_soc: fix SER panic with 4GB+ RAM (Chad Monroe) [Orabug: 37976872] {CVE-2025-37935}
  - igc: fix lock order in igc_ptp_reset (Jacob Keller)
  - idpf: protect shutdown from reset (Larysa Zaremba)
  - idpf: fix potential memory leak on kcalloc() failure (Michal Swiatkowski)
  - net: mdio: mux-meson-gxl: set reversed bit when using internal phy (Da Xue)
  - net: dlink: Correct endianness handling of led_mode (Simon Horman)
  - drm/mipi-dbi: Fix blanking for non-16 bit formats (Russell Cloran)
  - drm/tests: shmem: Fix memleak (Maxime Ripard)
  - nvme-pci: fix queue unquiesce check on slot_reset (Keith Busch)
  - ALSA: ump: Fix buffer overflow at UMP SysEx message conversion (Takashi Iwai) [Orabug: 37970918] {CVE-2025-37891}
  - scsi: ufs: core: Remove redundant query_complete trace (Keoseong Park)
  - idpf: fix offloads support for encapsulated packets (Madhu Chittim)
  - ice: Check VF VSI Pointer Value in ice_vc_add_fdir_fltr() (Luoxuanqiang) [Orabug: 37976779] {CVE-2025-37912}
  - net_sched: qfq: Fix double list add in class with netem as child qdisc (Victor Nogueira) [Orabug: 37976783] {CVE-2025-37913}
  - net_sched: ets: Fix double list add in class with netem as child qdisc (Victor Nogueira) [Orabug: 37976788] {CVE-2025-37914}
  - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (Victor Nogueira) [Orabug: 37970915] {CVE-2025-37890}
  - net_sched: drr: Fix double list add in class with netem as child qdisc (Victor Nogueira) [Orabug: 37976792] {CVE-2025-37915}
  - pds_core: remove write-after-free of client_id (Shannon Nelson) [Orabug: 37976797] {CVE-2025-37916}
  - pds_core: specify auxiliary_device to be created (Shannon Nelson)
  - pds_core: make pdsc_auxbus_dev_del() void (Shannon Nelson)
  - net: ethernet: mtk_eth_soc: sync mtk_clks_source_name array (Daniel Golle)
  - net: ethernet: mtk-star-emac: rearm interrupts in rx_poll only when advised (Louis-Alexis Eyraud)
  - net: ethernet: mtk-star-emac: fix spinlock recursion issues on rx/tx poll (Louis-Alexis Eyraud) [Orabug: 37976802] {CVE-2025-37917}
  - rtase: Modify the condition used to detect overflow in rtase_calc_time_mitigation (Justin Lai)
  - bnxt_en: improve TX timestamping FIFO configuration (Vadim Fedorenko)
  - octeon_ep_vf: Resolve netdevice usage count issue (Sathesh Edara)
  - net: mscc: ocelot: delete PVID VLAN when readding it as non-PVID (Vladimir Oltean)
  - Bluetooth: L2CAP: copy RX timestamp to new fragments (Pauli Virtanen)
  - Bluetooth: btintel_pcie: Add additional to checks to clear TX/RX paths (Kiran K)
  - Bluetooth: btusb: avoid NULL pointer dereference in skb_dequeue() (En-Wei Wu) [Orabug: 37976804] {CVE-2025-37918}
  - Bluetooth: btintel_pcie: Avoid redundant buffer allocation (Kiran K)
  - Bluetooth: hci_conn: Fix not setting timeout for BIG Create Sync (Luiz Augusto von Dentz)
  - Bluetooth: hci_conn: Fix not setting conn_timeout for Broadcast Receiver (Luiz Augusto von Dentz)
  - Bluetooth: hci_conn: Remove alloc from critical section (Iulia Tanasescu)
  - ASoC: amd: acp: Fix NULL pointer deref in acp_i2s_set_tdm_slot (Venkata Prasad Potturu) [Orabug: 37976806] {CVE-2025-37919}
  - accel/ivpu: Correct DCT interrupt handling (Karol Wachowski)
  - net/mlx5: E-switch, Fix error handling for enabling roce (Chris Mi)
  - net/mlx5e: Fix lock order in mlx5e_tx_reporter_ptpsq_unhealthy_recover (Cosmin Ratiu)
  - net/mlx5e: TC, Continue the attr process even if encap entry is invalid (Jianbo Liu)
  - net/mlx5: E-Switch, Initialize MAC Address for Default GID (Maor Gottlieb)
  - net/mlx5e: Use custom tunnel header for vxlan gbp (Vlad Dogaru)
  - xsk: Fix race condition in AF_XDP generic RX path (Eryk Kubanski) [Orabug: 37976809] {CVE-2025-37920}
  - vxlan: vnifilter: Fix unlocked deletion of default FDB entry (Ido Schimmel) [Orabug: 37976815] {CVE-2025-37921}
  - powerpc/boot: Fix dash warning (Madhavan Srinivasan)
  - wifi: plfxlc: Remove erroneous assert in plfxlc_mac_release (Murad Masimov) [Orabug: 37976734] {CVE-2025-37897}
  - wifi: iwlwifi: fix the check for the SCRATCH register upon resume (Emmanuel Grumbach)
  - wifi: iwlwifi: don't warn if the NIC is gone in resume (Emmanuel Grumbach)
  - drm/i915/pxp: fix undefined reference to `intel_pxp_gsccs_is_ready_for_sessions' (Chen Linxuan)
  - ALSA: hda/realtek - Enable speaker for HP platform (Kailang Yang)
  - ASoC: Intel: sof_sdw: Add NULL check in asoc_sdw_rt_dmic_rtd_init() (Chenyuan Yang)
  - powerpc/boot: Check for ld-option support (Madhavan Srinivasan)
  - pinctrl: imx: Return NULL if no group is matched and found (Hui Wang)
  - book3s64/radix : Align section vmemmap start address to PAGE_SIZE (Donet Tom) [Orabug: 37976819] {CVE-2025-37922}
  - ASoC: soc-pcm: Fix hw_params() and DAPM widget sequence (Sheetal)
  - ASoC: cs-amp-lib-test: Don't select SND_SOC_CS_AMP_LIB (Richard Fitzgerald)
  - ASoC: soc-core: Stop using of_property_read_bool() for non-boolean properties (Geert Uytterhoeven)
  - drm/amd/display: Default IPS to RCG_IN_ACTIVE_IPS2_IN_OFF (Sun Peng Li)
  - tracing: Fix oob write in trace_seq_to_buffer() (Jeongjun Park) [Orabug: 37976821] {CVE-2025-37923}
  - cpufreq: Fix setting policy limits when frequency tables are used (Rafael J. Wysocki)
  - cpufreq: Avoid using inconsistent policy->min and policy->max (Rafael J. Wysocki)
  - smb: client: fix zero length for mkdir POSIX create context (Jethro Donaldson)
  - ksmbd: fix use-after-free in session logoff (Sean Heelan) [Orabug: 37976738] {CVE-2025-37899}
  - ksmbd: fix use-after-free in kerberos authentication (Sean Heelan) [Orabug: 37976828] {CVE-2025-37924}
  - ksmbd: fix use-after-free in ksmbd_session_rpc_open (Namjae Jeon) [Orabug: 37976832] {CVE-2025-37926}
  - platform/x86/intel-uncore-freq: Fix missing uncore sysfs during CPU hotplug (Shouye Liu)
  - platform/x86/amd: pmc: Require at least 2.5 seconds between HW sleep cycles (Mario Limonciello)
  - iommu: Fix two issues in iommu_copy_struct_from_user() (Nicolin Chen) [Orabug: 37976741] {CVE-2025-37900}
  - iommu/vt-d: Apply quirk_iommu_igfx for 8086:0044 (QM57/QS57) (Mingcong Bai)
  - iommu/arm-smmu-v3: Fix pgsize_bit for sva domains (Balbir Singh)
  - iommu/arm-smmu-v3: Fix iommu_device_probe bug due to duplicated stream ids (Nicolin Chen)
  - iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid (Pavel Paklov) [Orabug: 37976836] {CVE-2025-37927}
  - drm: Select DRM_KMS_HELPER from DRM_DEBUG_DP_MST_TOPOLOGY_REFS (Janne Grunau)
  - drm/amdgpu: Fix offset for HDP remap in nbio v7.11 (Lijo Lazar)
  - dm: always update the array size in realloc_argv on success (Benjamin Marzinski)
  - dm-integrity: fix a warning on invalid table line (Mikulas Patocka)
  - dm-bufio: don't schedule in atomic context (Longping Wei) [Orabug: 37976844] {CVE-2025-37928}
  - x86/boot/sev: Support memory acceptance in the EFI stub under SVSM (Ard Biesheuvel)
  - wifi: brcm80211: fmac: Add error handling for brcmf_usb_dl_writeimage() (Xu Wang) [Orabug: 37977118] {CVE-2025-37990}
  - tracing: Do not take trace_event_sem in print_event_fields() (Steven Rostedt)
  - spi: tegra114: Don't fail set_cs_timing when delays are zero (Aaron Kling)
  - mmc: renesas_sdhi: Fix error handling in renesas_sdhi_probe (Ruslan Piasetskyi)
  - mm/memblock: repeat setting reserved region nid if array is doubled (Wei Yang)
  - mm/memblock: pass size instead of end to memblock_set_node() (Wei Yang)
  - irqchip/qcom-mpm: Prevent crash when trying to handle non-wake GPIOs (Stephan Gerhold) [Orabug: 37976744] {CVE-2025-37901}
  - amd-xgbe: Fix to ensure dependent features are toggled with RX checksum offload (Vishal Badole)
  - perf/x86/intel: KVM: Mask PEBS_ENABLE loaded for guest with vCPU's value. (Sean Christopherson) [Orabug: 37976874] {CVE-2025-37936}
  - perf/x86/intel: Only check the group flag for X86 leader (Kan Liang)
  - parisc: Fix double SIGFPE crash (Helge Deller) [Orabug: 37977127] {CVE-2025-37991}
  - arm64: errata: Add missing sentinels to Spectre-BHB MIDR arrays (Will Deacon) [Orabug: 37977182] {CVE-2025-37929}
  - i2c: imx-lpi2c: Fix clock count when probe defers (Clark Wang)
  - EDAC/altera: Set DDR and SDMMC interrupt mask before registration (Niravkumar L Rabara)
  - EDAC/altera: Test the correct error reg offset (Niravkumar L Rabara)
  - drm/nouveau: Fix WARN_ON in nouveau_fence_context_kill() (Philipp Stanner) [Orabug: 37976850] {CVE-2025-37930}
  - drm/fdinfo: Protect against driver unbind (Tvrtko Ursulin)
  - cpufreq: intel_pstate: Unchecked MSR aceess in legacy mode (Srinivas Pandruvada)
  - btrfs: fix COW handling in run_delalloc_nocow() (Dave Chen)
  - btrfs: adjust subpage bit start based on sectorsize (Josef Bacik) [Orabug: 37976853] {CVE-2025-37931}
  - binder: fix offset calculation in debug log (Carlos Llamas)
  - ALSA: usb-audio: Add second USB ID for Jabra Evolve 65 headset (Joachim Priesner)
  - ALSA: usb-audio: Add retry on -EPROTO from usb_set_interface() (Geoffrey D. Bennett)
  - Revert "rndis_host: Flag RNDIS modems as WWAN devices" (Christian Heusel)
  - Bluetooth: btusb: Add 13 USB device IDs for Qualcomm WCN785x (Zijun Hu)
  - Bluetooth: btusb: Add new VID/PID for WCN785x (Dorian Cruveiller)
  - Bluetooth: btusb: Add ID 0x2c7c:0x0130 for Qualcomm WCN785x (Mark Dietzer)
  - Bluetooth: btusb: Add one more ID 0x13d3:0x3623 for Qualcomm WCN785x (Zijun Hu)
  - Bluetooth: btusb: Add one more ID 0x0489:0xe0f3 for Qualcomm WCN785x (Zijun Hu)
  - Bluetooth: btusb: add Foxconn 0xe0fc for Qualcomm WCN785x (Aaron Ma)
  - x86/PCI: Export find_cap() to be used in early PCI code (Rayan Dasoriya) [Orabug: 37383447]
  - x86/quirks: Scan all busses for early PCI quirks (Rayan Dasoriya) [Orabug: 37383447]
  - x86/quirks: Add parameter to clear MSIs early on boot (Rayan Dasoriya) [Orabug: 37383447]
  - scsi: megaraid_sas: Driver version update to 07.734.00.00-rc1 (Chandrakanth Patil) [Orabug: 37877985]
  - scsi: megaraid_sas: Make most module parameters static (Dr. David Alan Gilbert) [Orabug: 37877985]
  - scsi: mpt3sas: Fix buffer overflow in mpt3sas_send_mctp_passthru_req() (Dan Carpenter) [Orabug: 37878012]
  - scsi: mpt3sas: Fix spelling mistake "receveid" -> "received" (Colin Ian King) [Orabug: 37878012]
  - scsi: mpt3sas: update driver version to 52.100.00.00 (Shivasharan S) [Orabug: 37878012]
  - scsi: mpt3sas: Send a diag reset if target reset fails (Shivasharan S) [Orabug: 37878012]
  - scsi: mpt3sas: Report driver capability as part of IOCINFO command (Shivasharan S) [Orabug: 37878012]
  - scsi: mpt3sas: Add support for MCTP Passthrough commands (Shivasharan S) [Orabug: 37878012]
  - scsi: mpt3sas: Update MPI headers to 02.00.62 version (Shivasharan S) [Orabug: 37878012]
  - scsi: mpt3sas: Fix a locking bug in an error path (Bart Van Assche) [Orabug: 37878012]
  - scsi: mpt3sas: Reduce log level of ignore_delay_remove message to KERN_INFO (Paul Menzel) [Orabug: 37878012]
  - scsi: mpt3sas: Remove unused config functions (Dr. David Alan Gilbert) [Orabug: 37878012]
  - scsi: mpt3sas: Add details to EEDPTagMode error message (Paul Menzel) [Orabug: 37878012]
  - scsi: mpt3sas: Update driver version to 51.100.00.00 (Ranjan Kumar) [Orabug: 37878012]
  - vhost-scsi: log event queue write descriptors (Dongli Zhang) [Orabug: 37883837]
  - vhost-scsi: log control queue write descriptors (Dongli Zhang) [Orabug: 37883837]
  - vhost-scsi: log I/O queue write descriptors (Dongli Zhang) [Orabug: 37883837]
  - vhost-scsi: adjust vhost_scsi_get_desc() to log vring descriptors (Dongli Zhang) [Orabug: 37883837]
  - vhost: modify vhost_log_write() for broader users (Dongli Zhang) [Orabug: 37883837]
  - uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu) [Orabug: 37899161]
  - uek-rpm: Move vmxnet3 to module-core in UEK8 (Harshit Mogalapalli) [Orabug: 37908279]
  - x86/bugs: Enabling Retbleed and SRSO mitigation can taint the kernel (Alexandre Chartre) [Orabug: 37936569]
  - x86/bhi: Do not set BHI_DIS_S in 32-bit mode (Pawan Gupta) [Orabug: 37920673]
  - x86/bpf: Add IBHF call at end of classic BPF (Daniel Sneddon) [Orabug: 37920673]
  - x86/bpf: Call branch history clearing sequence on exit (Daniel Sneddon) [Orabug: 37920673]
  - selftest/x86/bugs: Add selftests for ITS (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
  - x86/its: Align RETs in BHB clear sequence to avoid thunking (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
  - x86/its: Add support for RSB stuffing mitigation (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
  - x86/its: Add "vmexit" option to skip mitigation on some CPUs (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
  - x86/its: Enable Indirect Target Selection mitigation (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
  - x86/its: Add support for ITS-safe return thunk (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
  - x86/its: Add support for ITS-safe indirect thunk (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
  - x86/its: Enumerate Indirect Target Selection (ITS) bug (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
  - Documentation: x86/bugs/its: Add ITS documentation (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-100.28.1.el9uek]
changelog:
  - KVM: SEV: Add KVM_SEV_SNP_ENABLE_REQ_CERTS command (Michael Roth) [Orabug: 37894105]
  - KVM: Introduce KVM_EXIT_SNP_REQ_CERTS for SNP certificate-fetching (Michael Roth) [Orabug: 37894105]
  - Revert "KVM: Introduce KVM_EXIT_SNP_REQ_CERTS for SNP certificate-fetching" (Liam Merwick) [Orabug: 37894105]
  - uek-rpm: Enable SECURITY_DMESG_RESTRICT in UEK8 (Harshit Mogalapalli) [Orabug: 37867042]


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-100.28.2.el9uek]
changelog:
  - sched/eevdf: Fix se->slice being set to U64_MAX and resulting crash (Omar Sandoval) [Orabug: 37930100] {CVE-2025-37821}
  - certs: Add new Oracle Linux Driver Signing (key 1) certificate (Sherry Yang) [Orabug: 37967533]
  - Revert "block: sysfs option to change ioticks granularity" (Gulam Mohamed) [Orabug: 37921776]
  - RDS: use pin_user_pages_fast() (Stephen Brennan) [Orabug: 37968545]


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-101.31.1.el9uek]
changelog:
  - LTS version: v6.12.31 (Jack Vogel)
  - drm/gem: Internally test import_attach for imported objects (Thomas Zimmermann)
  - x86/mm/init: Handle the special case of device private pages in add_pages(), to not increase max_pfn and trigger dma_addressing_limited() bounce buffers bounce buffers (Balbir Singh)
  - i3c: master: svc: Fix implicit fallthrough in svc_i3c_master_ibi_work() (Nathan Chancellor)
  - pinctrl: tegra: Fix off by one in tegra_pinctrl_get_group() (Dan Carpenter)
  - watchdog: aspeed: fix 64-bit division (Arnd Bergmann)
  - drm/amdkfd: Correct F8_MODE for gfx950 (Amber Lin)
  - serial: sh-sci: Save and restore more registers (Geert Uytterhoeven)
  - bpf: abort verification if env->cur_state->loop_entry != NULL (Eduard Zingerman)
  - drm/amd/display: Exit idle optimizations before accessing PHY (Ovidiu Bunea)
  - kbuild: Properly disable -Wunterminated-string-initialization for clang (Nathan Chancellor)
  - Fix mis-uses of 'cc-option' for warning disablement (Linus Torvalds)
  - gcc-15: disable '-Wunterminated-string-initialization' entirely for now (Linus Torvalds)
  - gcc-15: make 'unterminated string initialization' just a warning (Linus Torvalds)
  - err.h: move IOMEM_ERR_PTR() to err.h (Raag Jadav)
  - spi: spi-fsl-dspi: Reset SR flags before sending a new message (Larisa Grigore)
  - spi: spi-fsl-dspi: Halt the module after a new message transfer (Bogdan-Gabriel Roman)
  - spi: spi-fsl-dspi: restrict register range for regmap access (Larisa Grigore)
  - spi: use container_of_cont() for to_spi_device() (Greg Kroah-Hartman)
  - platform/x86: think-lmi: Fix attribute name usage for non-compliant items (Mark Pearson)
  - ksmbd: fix stream write failure (Namjae Jeon)
  - Revert "arm64: dts: allwinner: h6: Use RSB for AXP805 PMIC connection" (Jernej Skrabec)
  - Bluetooth: btmtksdio: Do close if SDIO card removed without close (Chris Lu)
  - Bluetooth: btmtksdio: Check function enabled before doing close (Chris Lu)
  - nilfs2: fix deadlock warnings caused by lock dependency in init_nilfs() (Ryusuke Konishi)
  - mm: mmap: map MAP_STACK to VM_NOHUGEPAGE only if THP is enabled (Ignacio Moreno Gonzalez)
  - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Tianyang Zhang)
  - memcg: always call cond_resched() after fn() (Breno Leitao)
  - highmem: add folio_test_partial_kmap() (Matthew Wilcox)
  - Input: xpad - add more controllers (Vicki Pfau)
  - Revert "drm/amd: Keep display off while going into S4" (Mario Limonciello)
  - smb: client: Reset all search buffer pointers when releasing buffer (Zhaolong Wang)
  - arm64: dts: marvell: uDPU: define pinctrl state for alarm LEDs (Gabor Juhos)
  - smb: client: Fix use-after-free in cifs_fill_dirent (Zhaolong Wang) [Orabug: 38094970] {CVE-2025-38051}
  - drm/edid: fixed the bug that hdr metadata was not reset (Feijuan Li)
  - thermal: intel: x86_pkg_temp_thermal: Fix bogus trip temperature (Zhang Rui)
  - platform/x86: dell-wmi-sysman: Avoid buffer overflow in current_password_store() (Vladimir Moskovkin) [Orabug: 38095141] {CVE-2025-38077}
  - pmdomain: core: Fix error checking in genpd_dev_pm_attach_by_id() (Dan Carpenter)
  - pmdomain: renesas: rcar: Remove obsolete nullify checks (Geert Uytterhoeven)
  - vmxnet3: update MTU after device quiesce (Ronak Doshi)
  - net: dsa: microchip: linearize skb for tail-tagging switches (Jakob Unterwurzacher)
  - can: kvaser_pciefd: Fix echo_skb race (Axel Forsman)
  - can: kvaser_pciefd: Continue parsing DMA buf after dropped RX (Axel Forsman)
  - llc: fix data loss when reading from a socket in llc_ui_recvmsg() (Gavrilov Ilia)
  - ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14ASP10 (Ed Burcher)
  - ALSA: pcm: Fix race of buffer access at PCM OSS layer (Takashi Iwai) [Orabug: 38095145] {CVE-2025-38078}
  - ASoC: SOF: ipc4-pcm: Delay reporting is only supported for playback direction (Peter Ujfalusi)
  - ASoc: SOF: topology: connect DAI to a single DAI link (Kai Vehmanen)
  - ASoC: SOF: Intel: hda-bus: Use PIO mode on ACE2+ platforms (Peter Ujfalusi)
  - ASoC: SOF: ipc4-control: Use SOF_CTRL_CMD_BINARY as numid for bytes_ext (Peter Ujfalusi)
  - can: bcm: add missing rcu read protection for procfs content (Oliver Hartkopp) [Orabug: 38049369] {CVE-2025-38003}
  - can: bcm: add locking for bcm_op runtime updates (Oliver Hartkopp) [Orabug: 38049374] {CVE-2025-38004}
  - can: slcan: allow reception of short error messages (Carlos Sanchez)
  - padata: do not leak refcount in reorder_work (Dominik Grzegorzek) [Orabug: 38094842] {CVE-2025-38031}
  - crypto: algif_hash - fix double free in hash_accept (Ivan Pravdin) [Orabug: 38095153] {CVE-2025-38079}
  - clk: s2mps11: initialise clk_hw_onecell_data::num before accessing ::hws[] in probe() (André Draszik)
  - octeontx2-af: Fix APR entry mapping based on APR_LMT_CFG (Geetha Sowjanya)
  - octeontx2-af: Set LMT_ENA bit for APR table entries (Subbaraya Sundeep)
  - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (Wang Liang) [Orabug: 38094978] {CVE-2025-38052}
  - octeontx2-pf: Add AF_XDP non-zero copy support (Suman Ghosh)
  - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (Cong Wang) [Orabug: 38049357] {CVE-2025-38000}
  - idpf: fix idpf_vport_splitq_napi_poll() (Eric Dumazet)
  - io_uring: fix overflow resched cqe reordering (Pavel Begunkov)
  - net: lan743x: Restore SGMII CTRL register on resume (Thangaraj Samynathan)
  - net: dwmac-sun8i: Use parsed internal PHY address instead of 1 (Paul Kocialkowski)
  - pinctrl: qcom: switch to devm_register_sys_off_handler() (Dmitry Baryshkov)
  - loop: don't require ->write_iter for writable files in loop_configure (Christoph Hellwig)
  - idpf: fix null-ptr-deref in idpf_features_check (Pavan Kumar Linga) [Orabug: 38094982] {CVE-2025-38053}
  - ice: Fix LACP bonds without SRIOV environment (Dave Ertman)
  - ice: fix vf->num_mac count with port representors (Jacob Keller)
  - bridge: netfilter: Fix forwarding of fragmented packets (Ido Schimmel)
  - ptp: ocp: Limit signal/freq counts in summary output functions (Sagi Maimon) [Orabug: 38094984] {CVE-2025-38054}
  - Bluetooth: btusb: use skb_pull to avoid unsafe access in QCA dump handling (En-Wei Wu)
  - Bluetooth: L2CAP: Fix not checking l2cap_chan security level (Luiz Augusto von Dentz)
  - perf/x86/intel: Fix segfault with PEBS-via-PT with sample_freq (Adrian Hunter) [Orabug: 38094988] {CVE-2025-38055}
  - irqchip/riscv-imsic: Start local sync timer on correct CPU (Andrew Bresticker)
  - ASoC: SOF: Intel: hda: Fix UAF when reloading module (Tavian Barnes) [Orabug: 38094991] {CVE-2025-38056}
  - devres: Introduce devm_kmemdup_array() (Raag Jadav)
  - driver core: Split devres APIs to device/devres.h (Andy Shevchenko)
  - dmaengine: fsl-edma: Fix return code for unhandled interrupts (Stefan Wahren)
  - dmaengine: idxd: Fix ->poll() return value (Dave Jiang)
  - xfrm: Sanitize marks before insert (Paul Chaignon)
  - clk: sunxi-ng: d1: Add missing divider for MMC mod clocks (Andre Przywara)
  - remoteproc: qcom_wcnss: Fix on platforms without fallback regulators (Matti Lehtimäki)
  - kernel/fork: only call untrack_pfn_clear() on VMAs duplicated for fork() (David Hildenbrand)
  - x86/sev: Fix operator precedence in GHCB_MSR_VMPL_REQ_LEVEL macro (Seongman Lee)
  - dmaengine: idxd: Fix allowing write() from different address spaces (Vinicius Costa Gomes)
  - xfrm: Fix UDP GRO handling for some corner cases (Tobias Brunner)
  - espintcp: remove encap socket caching to avoid reference leak (Sabrina Dubroca)
  - espintcp: fix skb leaks (Sabrina Dubroca) [Orabug: 38094993] {CVE-2025-38057}
  - soundwire: bus: Fix race on the creation of the IRQ domain (Charles Keepax)
  - __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock (Al Viro) [Orabug: 38095000] {CVE-2025-38058}
  - drm/amd/display: Call FP Protect Before Mode Programming/Mode Support (Austin Zheng)
  - xenbus: Allow PVH dom0 a non-local xenstore (Jason Andryuk)
  - x86/Kconfig: make CFI_AUTO_DEFAULT depend on !RUST or Rust >= 1.88 (Paweł Anikiel) [Orabug: 38094847] {CVE-2025-38033}
  - wifi: iwlwifi: add support for Killer on MTL (Johannes Berg)
  - block: only update request sector if needed (Johannes Thumshirn)
  - tools: ynl-gen: validate 0 len strings from kernel (David Wei)
  - btrfs: avoid NULL pointer dereference if no valid csum tree (Qu Wenruo) [Orabug: 38095010] {CVE-2025-38059}
  - btrfs: handle empty eb->folios in num_extent_folios() (Boris Burkov)
  - btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref (Goldwyn Rodrigues) [Orabug: 38094856] {CVE-2025-38034}
  - btrfs: compression: adjust cb->compressed_folios allocation type (Kees Cook)
  - ASoC: intel/sdw_utils: Add volume limit to cs42l43 speakers (Stefan Binding)
  - cifs: Fix changing times and read-only attr over SMB1 smb_set_file_info() function (Pali Rohár)
  - cifs: Fix and improve cifs_query_path_info() and cifs_query_file_info() (Pali Rohár)
  - io_uring/fdinfo: annotate racy sq/cq head/tail reads (Jens Axboe)
  - nvmet-tcp: don't restore null sk_state_change (Alistair Francis) [Orabug: 38094863] {CVE-2025-38035}
  - ALSA: usb-audio: Fix duplicated name in MIDI substream names (Takashi Iwai)
  - nvme-pci: add quirks for WDC Blue SN550 15b7:5009 (Guan Wentao)
  - nvme-pci: add quirks for device 126f:1001 (Guan Wentao)
  - ALSA: hda/realtek: Add quirk for HP Spectre x360 15-df1xxx (Takashi Iwai)
  - ASoC: Intel: bytcr_rt5640: Add DMI quirk for Acer Aspire SW3-013 (Takashi Iwai)
  - ASoC: cs42l43: Disable headphone clamps during type detection (Charles Keepax)
  - platform/x86: ideapad-laptop: add support for some new buttons (Gašper Nemgar)
  - platform/x86: asus-wmi: Disable OOBE state after resume from hibernation (Pavel Nikulin)
  - platform/x86/intel: hid: Add Pantherlake support (Saranya Gopal)
  - smb: server: smb2pdu: check return value of xa_store() (Salah Triki)
  - pinctrl: meson: define the pull up/down resistor value as 60 kOhm (Martin Blumenstingl)
  - book3s64/radix: Fix compile errors when CONFIG_ARCH_WANT_OPTIMIZE_DAX_VMEMMAP=n (Ritesh Harjani)
  - ASoC: imx-card: Adjust over allocation of memory in imx_card_parse_of() (Chenyuan Yang)
  - drm: Add valid clones check (Jessica Zhang)
  - drm/panel-edp: Add Starry 116KHD024006 (Douglas Anderson)
  - drm/buddy: fix issue that force_merge cannot free all roots (Lin Cao)
  - drm/atomic: clarify the rules around drm_atomic_state->allow_modeset (Simona Vetter)
  - drm/xe: Reject BO eviction if BO is bound to current VM (Oak Zeng)
  - drm/xe/sa: Always call drm_suballoc_manager_fini() (Michal Wajdeczko)
  - wifi: rtw89: coex: Separated Wi-Fi connecting event from Wi-Fi scan event (Ching-Te Ku)
  - drm/xe: Do not attempt to bootstrap VF in execlists mode (Maarten Lankhorst)
  - drm/xe: Move suballocator init to after display init (Maarten Lankhorst)
  - wifi: ath11k: Use dma_alloc_noncoherent for rx_tid buffer allocation (P Praneesh)
  - drm/nouveau: fix the broken marco GSP_MSG_MAX_SIZE (Zhi Wang)
  - drm: bridge: adv7511: fill stream capabilities (Olivier Moysan)
  - wifi: ath12k: Fix end offset bit definition in monitor ring descriptor (P Praneesh)
  - wifi: ath12k: Fetch regdb.bin file from board-2.bin (Aaradhana Sahu)
  - wifi: ath9k: return by of_get_mac_address (Rosen Penev)
  - drm/xe/pf: Reset GuC VF config when unprovisioning critical resource (Michal Wajdeczko)
  - accel/qaic: Mask out SR-IOV PCI resources (Youssef Samir)
  - wifi: ath12k: fix ath12k_hal_tx_cmd_ext_desc_setup() info1 override (Nicolas Escande)
  - regulator: ad5398: Add device tree support (Isaac Scott)
  - spi: zynqmp-gqspi: Always acknowledge interrupts (Sean Anderson)
  - wifi: rtw89: add wiphy_lock() to work that isn't held wiphy_lock() yet (Ping-Ke Shih)
  - wifi: rtw88: Don't use static local variable in rtw8822b_set_tx_power_index_by_rate (Bitterblue Smith)
  - wifi: rtl8xxxu: retry firmware download on error (Soeren Moch)
  - clk: renesas: rzg2l-cpg: Refactor Runtime PM clock validation (Lad Prabhakar)
  - perf/amd/ibs: Fix ->config to sample period calculation for OP PMU (Ravi Bangoria)
  - perf/amd/ibs: Fix perf_ibs_op.cnt_mask for CurCnt (Ravi Bangoria)
  - firmware: arm_scmi: Relax duplicate name constraint across protocol ids (Sudeep Holla)
  - bpftool: Fix readlink usage in get_fd_type (Viktor Malik)
  - bpf: Use kallsyms to find the function name of a struct_ops's stub function (Martin Kafai Lau)
  - drm/ast: Find VBIOS mode from regular display size (Thomas Zimmermann)
  - dm vdo: use a short static string for thread name prefix (Matthew Sakai)
  - dm vdo indexer: prevent unterminated string warning (Chung Chung)
  - irqchip/riscv-aplic: Add support for hart indexes (Vladimir Kondratiev)
  - ASoC: rt722-sdca: Add some missing readable registers (Charles Keepax)
  - ASoC: codecs: pcm3168a: Allow for 24-bit in provider mode (Cezary Rojewski)
  - arm64: zynqmp: add clock-output-names property in clock nodes (Naman Trivedi Manojbhai)
  - HID: usbkbd: Fix the bit shift number for LED_KANA (Junan)
  - wifi: ath12k: Avoid napi_sync() before napi_enable() (Avula Sri Charan)
  - scsi: st: Restore some drive settings after reset (Kai Mäkisara)
  - net/mana: fix warning in the writer of client oob (Konstantin Taranov)
  - drm/xe/relay: Don't use GFP_KERNEL for new transactions (Michal Wajdeczko)
  - ice: count combined queues using Rx/Tx count (Michal Swiatkowski)
  - perf: Avoid the read if the count is already updated (Peter Zijlstra)
  - rcu: fix header guard for rcu_all_qs() (Ankur Arora)
  - rcu: handle unstable rdp in rcu_read_unlock_strict() (Ankur Arora)
  - rcu: handle quiescent states for PREEMPT_RCU=n, PREEMPT_COUNT=y (Ankur Arora)
  - ice: treat dyn_allowed only as suggestion (Michal Swiatkowski)
  - ice: init flow director before RDMA (Michal Swiatkowski)
  - bridge: mdb: Allow replace of a host-joined group (Petr Machata)
  - net: flush_backlog() small changes (Eric Dumazet)
  - r8169: don't scan PHY addresses > 0 (Heiner Kallweit)
  - ipv4: ip_gre: Fix set but not used warning in ipgre_err() if IPv4-only (Geert Uytterhoeven)
  - vxlan: Annotate FDB data races (Ido Schimmel) [Orabug: 38094879] {CVE-2025-38037}
  - cpufreq: amd-pstate: Remove unnecessary driver_lock in set_boost (Dhananjay Ugwekar) [Orabug: 38094888] {CVE-2025-38038}
  - tools: ynl-gen: don't output external constants (Jakub Kicinski)
  - eth: fbnic: set IFF_UNICAST_FLT to avoid enabling promiscuous mode when adding unicast addrs (Alexander Duyck)
  - drm/rockchip: vop2: Improve display modes handling on RK3588 HDMI0 (Cristian Ciocaltea)
  - media: qcom: camss: Add default case in vfe_src_pad_code (Depeng Shao)
  - media: qcom: camss: csid: Only add TPG v4l2 ctrl if TPG hardware is available (Depeng Shao)
  - f2fs: introduce f2fs_base_attr for global sysfs entries (Jaegeuk Kim)
  - hwmon: (xgene-hwmon) use appropriate type for the latency value (Andrey Vatoropin)
  - tools/power turbostat: Clustered Uncore MHz counters should honor show/hide options (Len Brown)
  - net: page_pool: avoid false positive warning if NAPI was never added (Jakub Kicinski)
  - clk: qcom: camcc-sm8250: Use clk_rcg2_shared_ops for some RCGs (Jordan Crouse)
  - wifi: rtw89: call power_on ahead before selecting firmware (Ping-Ke Shih)
  - wifi: rtw89: fw: validate multi-firmware header before accessing (Ping-Ke Shih)
  - wifi: rtw89: fw: validate multi-firmware header before getting its size (Ping-Ke Shih)
  - wifi: rtw89: coex: Assign value over than 0 to avoid firmware timer hang (Ching-Te Ku)
  - wifi: rtw88: Fix __rtw_download_firmware() for RTL8814AU (Bitterblue Smith)
  - wifi: rtw88: Fix download_firmware_validate() for RTL8814AU (Bitterblue Smith)
  - ext4: remove writable userspace mappings before truncating page cache (Zhang Yi)
  - ext4: don't write back data before punch hole in nojournal mode (Zhang Yi)
  - leds: trigger: netdev: Configure LED blink interval for HW offload (Marek Vasut)
  - pstore: Change kmsg_bytes storage size to u32 (Kees Cook)
  - iio: adc: ad7944: don't use storagebits for sizing (David Lechner)
  - r8152: add vendor/device ID pair for Dell Alienware AW1022z (Aleksander Jan Bajkowski)
  - ip: fib_rules: Fetch net from fib_rule in fib[46]_rule_configure(). (Kuniyuki Iwashima)
  - arch/powerpc/perf: Check the instruction type before creating sample with perf_mem_data_src (Athira Rajeev)
  - powerpc/pseries/iommu: create DDW for devices with DMA mask less than 64-bits (Gaurav Batra)
  - powerpc/pseries/iommu: memory notifier incorrectly adds TCEs for pmemory (Gaurav Batra)
  - net: fec: Refactor MAC reset to function (Csókás Bence)
  - wifi: mac80211: set ieee80211_prep_tx_info::link_id upon Auth Rx (Emmanuel Grumbach)
  - wifi: mac80211: remove misplaced drv_mgd_complete_tx() call (Johannes Berg)
  - wifi: mac80211: don't unconditionally call drv_mgd_complete_tx() (Johannes Berg)
  - wifi: iwlwifi: don't warn during reprobe (Miri Korenblit)
  - wifi: iwlwifi: use correct IMR dump variable (Johannes Berg)
  - mptcp: pm: userspace: flags: clearer msg if no remote addr (Matthieu Baerts)
  - wifi: ath12k: fix the ampdu id fetch in the HAL_RX_MPDU_START TLV (P Praneesh)
  - xfrm: prevent high SEQ input in non-ESN mode (Leon Romanovsky)
  - drm/v3d: Add clock handling (Stefan Wahren)
  - net/mlx5e: reduce the max log mpwrq sz for ECPF and reps (William Tu)
  - net/mlx5e: reduce rep rxq depth to 256 for ECPF (William Tu)
  - net/mlx5e: set the tx_queue_len for pfifo_fast (William Tu)
  - net/mlx5: Extend Ethtool loopback selftest to support non-linear SKB (Alexei Lazar)
  - net/mlx5: XDP, Enable TX side XDP multi-buffer support (Alexei Lazar)
  - scsi: target: spc: Fix loop traversal in spc_rsoc_get_descr() (Chaohai Chen)
  - drm/amd/display/dm: drop hw_support check in amdgpu_dm_i2c_xfer() (Alex Deucher)
  - drm/amdgpu: enlarge the VBIOS binary size limit (Morris Zhang)
  - drm/amdgpu: Use active umc info from discovery (Lijo Lazar)
  - drm/amd/display: Populate register address for dentist for dcn401 (Dillon Varone)
  - drm/amd/display: Use Nominal vBlank If Provided Instead Of Capping It (Austin Zheng)
  - drm/amd/display: Increase block_sequence array size (Joshua Aberback) [Orabug: 38095164] {CVE-2025-38080}
  - drm/amd/display: Initial psr_version with correct setting (Tom Chung)
  - drm/amd/display: Update CR AUX RD interval interpretation (George Shen)
  - Revert "drm/amd/display: Exit idle optimizations before attempt to access PHY" (Brandon Syu)
  - drm/amd/display: Support multiple options during psr entry. (Martin Tsai)
  - drm/amd/pm: Skip P2S load for SMU v13.0.12 (Asad Kamal)
  - drm/amdgpu: reset psp->cmd to NULL after releasing the buffer (Jiang Liu)
  - drm/amd/display: Don't try AUX transactions on disconnected link (Ilya Bakoulin)
  - drm/amd/display: pass calculated dram_speed_mts to dml2 (Charlene Liu)
  - drm/amdgpu: Set snoop bit for SDMA for MI series (Harish Kasiviswanathan)
  - drm/amdkfd: fix missing L2 cache info in topology (Eric Huang)
  - drm/amdgpu/mes11: fix set_hw_resources_1 calculation (Alex Deucher)
  - net: stmmac: dwmac-loongson: Set correct {tx,rx}_fifo_size (Huacai Chen)
  - soundwire: cadence_master: set frame shape and divider based on actual clk freq (Bard Liao)
  - soundwire: amd: change the soundwire wake enable/disable sequence (Vijendar Mukunda)
  - phy: exynos5-usbdrd: fix EDS distribution tuning (gs101) (André Draszik)
  - phy: core: don't require set_mode() callback for phy_get_mode() to work (Dmitry Baryshkov)
  - phy: phy-rockchip-samsung-hdptx: Swap the definitions of LCPLL_REF and ROPLL_REF (Damon Ding)
  - pinctrl: renesas: rzg2l: Add suspend/resume support for pull up/down (Claudiu Beznea)
  - serial: sh-sci: Update the suspend/resume support (Claudiu Beznea)
  - sched: Reduce the default slice to avoid tasks getting an extra tick (Zihan Zhou)
  - x86/traps: Cleanup and robustify decode_bug() (Peter Zijlstra)
  - x86/ibt: Handle FineIBT in handle_cfi_failure() (Peter Zijlstra)
  - drm/xe/debugfs: Add missing xe_pm_runtime_put in wedge_mode_set (Shuicheng Lin)
  - drm/xe/debugfs: fixed the return value of wedged_mode_set (Xin Wang)
  - clk: qcom: clk-alpha-pll: Do not use random stack value for recalc rate (Krzysztof Kozlowski)
  - clk: qcom: ipq5018: allow it to be bulid on arm32 (Karl Chan)
  - drm/xe: Fix xe_tile_init_noalloc() error propagation (Lucas De Marchi)
  - drm/xe: Stop ignoring errors from xe_ttm_stolen_mgr_init() (Lucas De Marchi)
  - net/mlx4_core: Avoid impossible mlx4_db_alloc() order value (Kees Cook)
  - media: v4l: Memset argument to 0 before calling get_mbus_config pad op (Sakari Ailus)
  - media: i2c: imx219: Correct the minimum vblanking value (David Plowman)
  - kunit: tool: Use qboot on QEMU x86_64 (Brendan Jackman)
  - smack: Revert "smackfs: Added check catlen" (Konstantin Andreev)
  - smack: recognize ipv4 CIPSO w/o categories (Konstantin Andreev)
  - pinctrl: devicetree: do not goto err when probing hogs in pinctrl_dt_to_map (Valentin Caron)
  - ASoC: soc-dai: check return value at snd_soc_dai_set_tdm_slot() (Kuninori Morimoto)
  - ASoC: tas2764: Power up/down amp on mute ops (Hector Martin)
  - ASoC: tas2764: Mark SW_RESET as volatile (Hector Martin)
  - ASoC: tas2764: Add reg defaults for TAS2764_INT_CLK_CFG (Hector Martin)
  - ASoC: ops: Enforce platform maximum on initial value (Martin Povišer)
  - firmware: xilinx: Dont send linux address to get fpga config get status (Siva Durga Prasad Paladugu)
  - firmware: arm_ffa: Handle the presence of host partition in the partition info (Sudeep Holla)
  - firmware: arm_ffa: Reject higher major version as incompatible (Sudeep Holla)
  - net/mlx5: Apply rate-limiting to high temperature warning (Shahar Shitrit)
  - net/mlx5: Modify LSB bitmask in temperature event to include only the first bit (Shahar Shitrit)
  - media: test-drivers: vivid: don't call schedule in loop (Hans Verkuil)
  - irqchip/riscv-imsic: Set irq_set_affinity() for IMSIC base (Andrew Jones)
  - hrtimers: Replace hrtimer_clock_to_base_table with switch-case (Andy Shevchenko)
  - vxlan: Join / leave MC group after remote changes (Petr Machata)
  - ACPI: HED: Always initialize before evged (Xiaofei Tan)
  - PCI: Fix old_size lower bound in calculate_iosize() too (Ilpo Järvinen)
  - eth: mlx4: don't try to complete XDP frames in netpoll (Jakub Kicinski)
  - bpf: copy_verifier_state() should copy 'loop_entry' field (Eduard Zingerman) [Orabug: 38095018] {CVE-2025-38060}
  - bpf: don't do clean_live_states when state->loop_entry->branches > 0 (Eduard Zingerman)
  - can: c_can: Use of_property_present() to test existence of DT property (Krzysztof Kozlowski)
  - pmdomain: imx: gpcv2: use proper helper for property detection (Ahmad Fatoum)
  - RDMA/core: Fix best page size finding when it can cross SG entries (Michael Margolin)
  - serial: mctrl_gpio: split disable_ms into sync and no_sync APIs (Alexis Lothoré) [Orabug: 38094901] {CVE-2025-38040}
  - drm/amd/display: Don't treat wb connector as physical in create_validate_stream_for_sink (Harry Wentland)
  - Revert "drm/amd/display: Request HW cursor on DCN3.2 with SubVP" (Leo Zeng)
  - drm/amd/display: Read LTTPR ALPM caps during link cap retrieval (George Shen)
  - drm/amd/display: Fix BT2020 YCbCr limited/full range input (Ilya Bakoulin)
  - drm/amd/display: Guard against setting dispclk low when active (Nicholas Kazlauskas)
  - drm/amd/display: Add support for disconnected eDP streams (Harry Vanzylldejong)
  - drm/amd/pm: Fetch current power limit from PMFW (Lijo Lazar)
  - irqchip/riscv-imsic: Separate next and previous pointers in IMSIC vector (Anup Patel)
  - eeprom: ee1004: Check chip before probing (Eddie James)
  - mfd: axp20x: AXP717: Add AXP717_TS_PIN_CFG to writeable regs (Chris Morgan)
  - i3c: master: svc: Flush FIFO before sending Dynamic Address Assignment(DAA) (Frank Li)
  - EDAC/ie31200: work around false positive build warning (Arnd Bergmann)
  - power: supply: axp20x_battery: Update temp sensor for AXP717 from device tree (Chris Morgan)
  - net: pktgen: fix access outside of user given buffer in pktgen_thread_write() (Peter Seiderer) [Orabug: 38095024] {CVE-2025-38061}
  - wifi: rtw89: 8922a: fix incorrect STA-ID in EHT MU PPDU (Kuan-Chung Chen)
  - wifi: rtw89: fw: add blacklist to avoid obsolete secure firmware (Ping-Ke Shih)
  - wifi: rtw89: fw: get sb_sel_ver via get_unaligned_le32() (Ping-Ke Shih)
  - wifi: rtw89: fw: propagate error code from rtw89_h2c_tx() (Ping-Ke Shih)
  - wifi: rtw88: Fix rtw_desc_to_mcsrate() to handle MCS16-31 (Bitterblue Smith)
  - wifi: rtw88: Fix rtw_init_ht_cap() for RTL8814AU (Bitterblue Smith)
  - wifi: rtw88: Fix rtw_init_vht_cap() for RTL8814AU (Bitterblue Smith)
  - PCI: epf-mhi: Update device ID for SA8775P (Mrinmay Sarkar)
  - clocksource: mips-gic-timer: Enable counter when CPUs start (Paul Burton)
  - MIPS: pm-cps: Use per-CPU variables as per-CPU, not per-core (Paul Burton)
  - genirq/msi: Store the IOMMU IOVA directly in msi_desc instead of iommu_cookie (Jason Gunthorpe) [Orabug: 38095031] {CVE-2025-38062}
  - x86/locking: Use ALT_OUTPUT_SP() for percpu_{,try_}cmpxchg{64,128}_op() (Uros Bizjak)
  - drm/amdgpu: remove all KFD fences from the BO on release (Christian König)
  - MIPS: Use arch specific syscall name match function (Bibo Mao)
  - drm/xe/oa: Ensure that polled read returns latest data (Umesh Nerlige Ramappa)
  - net: ipv6: Init tunnel link-netns before registering dev (Xiao Liang)
  - crypto: skcipher - Zap type in crypto_alloc_sync_skcipher (Herbert Xu)
  - crypto: ahash - Set default reqsize from ahash_alg (Herbert Xu)
  - x86/kaslr: Reduce KASLR entropy on most x86 systems (Balbir Singh)
  - net/mlx5: Change POOL_NEXT_SIZE define value and make it global (Patrisious Haddad)
  - scsi: scsi_debug: First fixes for tapes (Kai Mäkisara)
  - dm: fix unconditional IO throttle caused by REQ_PREFLUSH (Jinliang Zheng) [Orabug: 38095038] {CVE-2025-38063}
  - libbpf: Fix out-of-bound read (Nandakumar Edamana)
  - loop: check in LO_FLAGS_DIRECT_IO in loop_default_blocksize (Christoph Hellwig)
  - net/mlx5e: Add correct match to check IPSec syndromes for switchdev mode (Jianbo Liu)
  - media: tc358746: improve calculation of the D-PHY timing registers (Matthias Fend)
  - media: adv7180: Disable test-pattern control on adv7180 (Niklas Söderlund)
  - cpuidle: menu: Avoid discarding useful information (Rafael J. Wysocki)
  - vdpa/mlx5: Fix mlx5_vdpa_get_config() endianness on big-endian machines (Konstantin Shkolnyy)
  - x86/nmi: Add an emergency handler in nmi_desc & use it in nmi_shootdown_cpus() (Waiman Long)
  - ASoC: mediatek: mt8188: Add reference for dmic clocks (Nícolas F R A Prado)
  - ASoC: mediatek: mt8188: Treat DMIC_GAINx_CUR as non-volatile (Nícolas F R A Prado)
  - drm/amd/display: Fix mismatch type comparison (Navid Assadian)
  - drm/amd/display: fix dcn4x init failed (Charlene Liu)
  - drm/amd/display: handle max_downscale_src_width fail check (Yihan Zhu)
  - x86/build: Fix broken copy command in genimage.sh when making isoimage (Nir Lichtman)
  - Octeontx2-af: RPM: Register driver with PCI subsys IDs (Hariprasad Kelam)
  - bpf: Search and add kfuncs in struct_ops prologue and epilogue (Amery Hung)
  - soc: ti: k3-socinfo: Do not use syscon helper to build regmap (Andrew Davis)
  - wifi: ath12k: Improve BSS discovery with hidden SSID in 6 GHz band (Ramasamy Kaliappan)
  - bonding: report duplicate MAC address in all situations (Hangbin Liu)
  - net: xgene-v2: remove incorrect ACPI_PTR annotation (Arnd Bergmann)
  - net: ethernet: mtk_ppe_offload: Allow QinQ, double ETH_P_8021Q only (Eric Woudstra)
  - leds: pwm-multicolor: Add check for fwnode_property_read_u32 (Yuanjun Gong)
  - drm/xe: xe_gen_wa_oob: replace program_invocation_short_name (Daniel Gomez)
  - drm/amdkfd: KFD release_work possible circular locking (Philip Yang)
  - pinctrl: sophgo: avoid to modify untouched bit when setting cv1800 pinconf (Inochi Amaoto)
  - selftests/net: have `gro.sh -t` return a correct exit code (Kevin Krakauer)
  - net/mlx5: Avoid report two health errors on same syndrome (Moshe Shemesh)
  - drm/xe/pf: Create a link between PF and VF devices (K V P Satyanarayana)
  - drm/xe/vf: Retry sending MMIO request to GUC on timeout error (K V P Satyanarayana)
  - firmware: arm_ffa: Set dma_mask for ffa devices (Viresh Kumar) [Orabug: 38094925] {CVE-2025-38043}
  - PCI: brcmstb: Add a softdep to MIP MSI-X driver (Stanimir Varbanov)
  - PCI: brcmstb: Expand inbound window size up to 64GB (Stanimir Varbanov)
  - wifi: ath12k: Report proper tx completion status to mac80211 (Vinith Kumar R)
  - soc: apple: rtkit: Implement OSLog buffers properly (Hector Martin)
  - soc: apple: rtkit: Use high prio work queue (Janne Grunau)
  - perf: arm_pmuv3: Call kvm_vcpu_pmu_resync_el0() before enabling counters (Rob Herring)
  - fpga: altera-cvp: Increase credit timeout (Kuhanh Murugasen Krishnan)
  - drm/mediatek: mtk_dpi: Add checks for reg_h_fre_con existence (AngeloGioacchino Del Regno)
  - ARM: at91: pm: fix at91_suspend_finish for ZQ calibration (Li Bin)
  - hwmon: (gpio-fan) Add missing mutex locks (Alexander Stein)
  - x86/bugs: Make spectre user default depend on MITIGATION_SPECTRE_V2 (Breno Leitao)
  - clk: imx8mp: inform CCF of maximum frequency of clocks (Ahmad Fatoum)
  - media: uvcvideo: Handle uvc menu translation inside uvc_get_le_value (Ricardo Ribalda)
  - media: uvcvideo: Add sanity check to uvc_ioctl_xu_ctrl_map (Ricardo Ribalda)
  - ublk: complete command synchronously on error (Caleb Sander)
  - block: mark bounce buffering as incompatible with integrity (Christoph Hellwig)
  - drm/rockchip: vop2: Add uv swap for cluster window (Andy Yan)
  - ipv4: fib: Move fib_valid_key_len() to rtm_to_fib_config(). (Kuniyuki Iwashima)
  - scsi: logging: Fix scsi_logging_level bounds (Nicolas Bouchinet)
  - ALSA: hda/realtek: Enable PC beep passthrough for HP EliteBook 855 G7 (Maciej S. Szmigiero)
  - perf/hw_breakpoint: Return EOPNOTSUPP for unsupported breakpoint type (Saket Kumar Bhaskar)
  - net: pktgen: fix mpls maximum labels list parsing (Peter Seiderer)
  - media: imx335: Set vblank immediately (Paul Elder)
  - iommufd: Disallow allocating nested parent domain with fault ID (Yi Liu)
  - ublk: enforce ublks_max only for unprivileged devices (Uday Shankar)
  - dpll: Add an assertion to check freq_supported_num (Jiasheng Jiang)
  - net: phy: nxp-c45-tja11xx: add match_phy_device to TJA1103/TJA1104 (Andrei Botila)
  - net: ethernet: ti: cpsw_new: populate netdev of_node (Alexander Sverdlin)
  - rcu: Fix get_state_synchronize_rcu_full() GP-start detection (Paul E. McKenney)
  - pinctrl: bcm281xx: Use "unsigned int" instead of bare "unsigned" (Artur Weber)
  - media: cx231xx: set device_caps for 417 (Hans Verkuil) [Orabug: 38094934] {CVE-2025-38044}
  - perf/core: Clean up perf_try_init_event() (Peter Zijlstra)
  - drm/amd/display: Request HW cursor on DCN3.2 with SubVP (Aric Cyr)
  - drm/amd/display: Fix p-state type when p-state is unsupported (Dillon Varone)
  - drm/amd/display: Fix DMUB reset sequence for DCN401 (Dillon Varone)
  - drm/amd/display: Skip checking FRL_MODE bit for PCON BW determination (George Shen)
  - drm/amd/display: Ensure DMCUB idle before reset on DCN31/DCN35 (Nicholas Kazlauskas)
  - drm/amdgpu: Do not program AGP BAR regs under SRIOV in gfxhub_v1_0.c (Victor Lu)
  - remoteproc: qcom_wcnss: Handle platforms with only single power domain (Matti Lehtimäki)
  - blk-throttle: don't take carryover for prioritized processing of metadata (Ming Lei)
  - net: phylink: use pl->link_interface in phylink_expects_phy() (Choong Yong Liang)
  - drm/gem: Test for imported GEM buffers with helper (Thomas Zimmermann)
  - orangefs: Do not truncate file size (Matthew Wilcox) [Orabug: 38095056] {CVE-2025-38065}
  - soc: mediatek: mtk-mutex: Add DPI1 SOF/EOF to MT8188 mutex tables (AngeloGioacchino Del Regno)
  - dm cache: prevent BUG_ON by blocking retries on failed device resumes (Ming-Hung Tsai) [Orabug: 38095063] {CVE-2025-38066}
  - usb: xhci: set page size to the xHCI-supported size (Niklas Neronin)
  - media: c8sectpfe: Call of_node_put(i2c_bus) only once in c8sectpfe_probe() (Markus Elfring)
  - ARM: tegra: Switch DSI-B clock parent to PLLD on Tegra114 (Svyatoslav Ryhel)
  - soc: samsung: include linux/array_size.h where needed (Arnd Bergmann)
  - drm/xe: Retry BO allocation (Matthew Brost)
  - drm/xe: Nuke VM's mapping upon close (Matthew Brost)
  - ieee802154: ca8210: Use proper setters and getters for bitwise types (Andy Shevchenko)
  - rtc: ds1307: stop disabling alarms on probe (Alexandre Belloni)
  - tcp: bring back NUMA dispersion in inet_ehash_locks_alloc() (Eric Dumazet)
  - ALSA: seq: Improve data consistency at polling (Takashi Iwai)
  - powerpc/prom_init: Fixup missing #size-cells on PowerBook6,7 (Andreas Schwab)
  - arm64: tegra: Resize aperture for the IGX PCIe C5 slot (Jonathan Hunter)
  - arm64: tegra: p2597: Fix gpio for vdd-1v8-dis regulator (Diogo Ivo)
  - drm/amdgpu: Fix missing drain retry fault the last entry (Emily Deng)
  - drm/amdkfd: Set per-process flags only once cik/vi (Harish Kasiviswanathan)
  - drm/amdkfd: Set per-process flags only once for gfx9/10/11/12 (Harish Kasiviswanathan)
  - crypto: mxs-dcp - Only set OTP_KEY bit for OTP key (Sven Schwermer)
  - crypto: lzo - Fix compression buffer overrun (Herbert Xu) [Orabug: 38095079] {CVE-2025-38068}
  - misc: pci_endpoint_test: Give disabled BARs a distinct error code (Niklas Cassel)
  - PCI: endpoint: pci-epf-test: Fix double free that causes kernel to oops (Christian Bruel) [Orabug: 38095087] {CVE-2025-38069}
  - watchdog: aspeed: Update bootstatus handling (Chin-Ting Kuo)
  - cpufreq: tegra186: Share policy per cluster (Aaron Kling)
  - iommu/amd/pgtbl_v2: Improve error handling (Vasant Hegde)
  - coresight-etb10: change etb_drvdata spinlock's type to raw_spinlock_t (Levi Yun)
  - badblocks: Fix a nonsense WARN_ON() which checks whether a u64 variable < 0 (Coly Li)
  - ASoC: qcom: sm8250: explicitly set format in sm8250_be_hw_params_fixup() (Alexey Klimov)
  - auxdisplay: charlcd: Partially revert "Move hwidth and bwidth to struct hd44780_common" (Andy Shevchenko)
  - gfs2: Check for empty queue in run_queue (Andreas Gruenbacher)
  - drm/amd/display: Fix incorrect DPCD configs while Replay/PSR switch (Leon Huang)
  - drm/amd/display: not abort link train when bw is low (Peichen Huang)
  - drm/amd/display: calculate the remain segments for all pipes (Zhikai Zhai)
  - drm/amd/display: remove minimum Dispclk and apply oem panel timing. (Charlene Liu)
  - ipv6: save dontfrag in cork (Willem de Bruijn)
  - wifi: cfg80211: allow IR in 20 MHz configurations (Anjaneyulu)
  - wifi: mac80211_hwsim: Fix MLD address translation (Ilan Peer)
  - wifi: mac80211: fix warning on disconnect during failed ML reconf (Johannes Berg)
  - wifi: iwlwifi: fix the ECKV UEFI variable name (Emmanuel Grumbach)
  - wifi: iwlwifi: mark Br device not integrated (Johannes Berg)
  - wifi: iwlwifi: fix debug actions order (Johannes Berg) [Orabug: 38094942] {CVE-2025-38045}
  - wifi: iwlwifi: w/a FW SMPS mode selection (Daniel Gabay)
  - wifi: iwlwifi: don't warn when if there is a FW error (Miri Korenblit)
  - printk: Check CON_SUSPEND when unblanking a console (Marcos Paulo de Souza)
  - iommu: Keep dev->iommu state consistent (Robin Murphy)
  - hwmon: (dell-smm) Increment the number of fans (Kurt Borja)
  - wifi: iwlwifi: mvm: fix setting the TK when associated (Avraham Stern)
  - usb: xhci: Don't change the status of stalled TDs on failed Stop EP (Michał Pecio)
  - mmc: sdhci: Disable SD card clock before changing parameters (Erick Shepherd)
  - mmc: dw_mmc: add exynos7870 DW MMC support (Kaustabh Chakraborty)
  - arm64/mm: Check PUD_TYPE_TABLE in pud_bad() (Ryan Roberts)
  - arm64/mm: Check pmd_table() in pmd_trans_huge() (Ryan Roberts)
  - phy: rockchip: usbdp: Only verify link rates/lanes/voltage when the corresponding set flags are set (Andy Yan)
  - PNP: Expand length of fixup id string (Kees Cook)
  - netfilter: conntrack: Bound nf_conntrack sysctl writes (Nicolas Bouchinet)
  - wifi: rtw89: set force HE TB mode when connecting to 11ax AP (Dian-Syuan Yang)
  - timer_list: Don't use %pK through printk() (Thomas Weißschuh)
  - net: hsr: Fix PRP duplicate detection (Jaakko Karrenpalo)
  - net: stmmac: dwmac-rk: Validate GRF and peripheral GRF during probe (Jonas Karlman)
  - posix-timers: Ensure that timer initialization is fully visible (Thomas Gleixner)
  - posix-timers: Add cond_resched() to posix_timer_add() search loop (Eric Dumazet)
  - RDMA/uverbs: Propagate errors from rdma_lookup_get_uobject() (Maher Sanalla)
  - ext4: do not convert the unwritten extents if data writeback fails (Baokun Li)
  - ext4: reject the 'data_err=abort' option in nojournal mode (Baokun Li)
  - clk: qcom: lpassaudiocc-sc7280: Add support for LPASS resets for QCM6490 (Taniya Das)
  - ASoC: sun4i-codec: support hp-det-gpios property (Ryan Walklin)
  - drm/amdgpu: Update SRIOV video codec caps (David Rosca)
  - drm/amdgpu/gfx11: don't read registers in mqd init (Alex Deucher)
  - drm/amdgpu/gfx12: don't read registers in mqd init (Alex Deucher)
  - mfd: tps65219: Remove TPS65219_REG_TI_DEV_ID check (Shree Ramamoorthy)
  - pinctrl-tegra: Restore SFSEL bit when freeing pins (Prathamesh Shete)
  - xen: Add support for XenServer 6.1 platform device (Frediano Ziglio)
  - net/smc: use the correct ndev to find pnetid by pnetid table (Guangguan Wang)
  - dm: restrict dm device size to 2^63-512 bytes (Mikulas Patocka)
  - crypto: octeontx2 - suppress auth failure screaming due to negative tests (Shashank Gupta)
  - kconfig: do not clear SYMBOL_VALID when reading include/config/auto.conf (Masahiro Yamada)
  - kbuild: fix argument parsing in scripts/config (Seyediman Seyedarab)
  - bpf: Allow pre-ordering for bpf cgroup progs (Yonghong Song)
  - ASoC: mediatek: mt6359: Add stub for mt6359_accdet_enable_jack_detect (Nícolas F R A Prado)
  - ASoC: pcm6240: Drop bogus code handling IRQ as GPIO (Linus Walleij)
  - spi: spi-mux: Fix coverity issue, unchecked return value (Sergio Perez Gonzalez)
  - erofs: initialize decompression early (Gao Xiang)
  - thunderbolt: Do not add non-active NVM if NVM upgrade is disabled for retimer (Mika Westerberg)
  - objtool: Fix error handling inconsistencies in check() (Josh Poimboeuf)
  - rtc: rv3032: fix EERD location (Alexandre Belloni)
  - tcp: reorganize tcp_in_ack_event() and tcp_count_delivered() (Ilpo Järvinen)
  - jbd2: do not try to recover wiped journal (Jan Kara)
  - PCI: dwc: Use resource start as ioremap() input in dw_pcie_pme_turn_off() (Frank Li)
  - bpf: Return prog btf_id without capable check (Mykyta Yatsenko)
  - vfio/pci: Handle INTx IRQ_NOTCONNECTED (Alex Williamson)
  - scsi: st: ERASE does not change tape location (Kai Mäkisara)
  - scsi: st: Tighten the page format heuristics with MODE SELECT (Kai Mäkisara)
  - hypfs_create_cpu_files(): add missing check for hypfs_mkdir() failure (Al Viro)
  - ext4: reorder capability check last (Christian Göttsche)
  - riscv: Call secondary mmu notifier when flushing the tlb (Alexandre Ghiti)
  - bnxt_en: Query FW parameters when the CAPS_CHANGE bit is set (Shantiprasad Shettar)
  - wifi: mwifiex: Fix HT40 bandwidth issue. (Jeff Chen)
  - um: Update min_low_pfn to match changes in uml_reserved (Tiwei Bie)
  - um: Store full CSGSFS and SS register from mcontext (Benjamin Berg)
  - clocksource/drivers/timer-riscv: Stop stimecmp when cpu hotplug (Nick Hu)
  - dlm: make tcp still work in multi-link env (Heming Zhao)
  - s390/tlb: Use mm_has_pgste() instead of mm_alloc_pgste() (Heiko Carstens)
  - i3c: master: svc: Fix missing STOP for master request (Stanley Chu)
  - drm/amdgpu: adjust drm_firmware_drivers_only() handling (Alex Deucher)
  - drm/amd/display: Guard against setting dispclk low for dcn31x (Jing Zhou)
  - drm/amdgpu: release xcp_mgr on exit (Flora Cui)
  - blk-cgroup: improve policy registration error handling (Chen Linxuan)
  - btrfs: send: return -ENAMETOOLONG when attempting a path that is too long (Filipe Manana)
  - btrfs: get zone unusable bytes while holding lock at btrfs_reclaim_bgs_work() (Filipe Manana)
  - btrfs: fix non-empty delayed iputs list on unmount due to async workers (Filipe Manana)
  - btrfs: run btrfs_error_commit_super() early (Qu Wenruo)
  - btrfs: avoid linker error in btrfs_find_create_tree_block() (Mark Harmstone)
  - btrfs: make btrfs_discard_workfn() block_group ref explicit (Boris Burkov)
  - i2c: pxa: fix call balance of i2c->clk handling routines (Vitalii Mordan)
  - i2c: qup: Vote for interconnect bandwidth to DRAM (Stephan Gerhold)
  - x86/mm: Check return value from memblock_phys_alloc_range() (Philip Redkin) [Orabug: 38095101] {CVE-2025-38071}
  - x86/microcode: Update the Intel processor flag scan check (Sohil Mehta)
  - x86/smpboot: Fix INIT delay assignment for extended Intel Families (Sohil Mehta)
  - x86/stackprotector/64: Only export __ref_stack_chk_guard on CONFIG_SMP (Ingo Molnar)
  - x86/headers: Replace __ASSEMBLY__ with __ASSEMBLER__ in UAPI headers (Thomas Huth)
  - wifi: mt76: mt7925: fix fails to enter low power mode in suspend state (Quan Zhou)
  - wifi: mt76: mt7925: load the appropriate CLC data based on hardware type (Ming Yen Hsieh)
  - wifi: mt76: mt7996: revise TXS size (Benjamin Lin)
  - wifi: mt76: mt7996: fix SER reset trigger on WED reset (Rex Lu)
  - wifi: mt76: only mark tx-status-failed frames as ACKed on mt76x0/2 (Felix Fietkau)
  - cgroup/rstat: avoid disabling irqs for O(num_cpu) (Eric Dumazet)
  - drm/amdgpu: Skip pcie_replay_count sysfs creation for VF (Victor Skvortsov)
  - mmc: host: Wait for Vdd to settle on card power off (Erick Shepherd)
  - staging: vchiq_arm: Create keep-alive thread during probe (Stefan Wahren)
  - pidfs: improve multi-threaded exec and premature thread-group leader exit polling (Christian Brauner)
  - libnvdimm/labels: Fix divide error in nd_label_data_init() (Robert Richter) [Orabug: 38095109] {CVE-2025-38072}
  - ext4: on a remount, only log the ro or r/w state when it has changed (Nicolas Bretz)
  - xen/pci: Do not register devices with segments >= 0x10000 (Roger Pau Monné)
  - PCI: vmd: Disable MSI remapping bypass under Xen (Roger Pau Monné)
  - drm/amdkfd: set precise mem ops caps to disabled for gfx 11 and 12 (Jonathan Kim)
  - drm/amdgpu/discovery: check ip_discovery fw file available (Flora Cui)
  - pNFS/flexfiles: Report ENETDOWN as a connection error (Trond Myklebust)
  - tools/build: Don't pass test log files to linker (Ian Rogers)
  - r8169: disable RTL8126 ZRX-DC timeout (Chunhao Lin)
  - PCI: dwc: ep: Ensure proper iteration over outbound map windows (Frank Li)
  - objtool: Properly disable uaccess validation (Josh Poimboeuf)
  - lockdep: Fix wait context check on softirq for PREEMPT_RT (Ryo Takakura)
  - dql: Fix dql->limit value when reset. (Jing Su)
  - Bluetooth: Disable SCO support if READ_VOICE_SETTING is unsupported/broken (Pedro Nishiyama)
  - Bluetooth: btmtksdio: Prevent enabling interrupts after IRQ handler removal (Sean Wang)
  - thermal/drivers/qoriq: Power down TMU on system suspend (Alice Guo)
  - thermal/drivers/mediatek/lvts: Start sensor interrupts disabled (Nícolas F R A Prado)
  - net: tn40xx: create swnode for mdio and aqr105 phy and add to mdiobus (Hans-Frieder Vogt)
  - net: tn40xx: add pci-id of the aqr105-based Tehuti TN4010 cards (Hans-Frieder Vogt)
  - mctp: Fix incorrect tx flow invalidation condition in mctp-i2c (Daniel Hsu)
  - ASoC: codecs: wsa883x: Correct VI sense channel mask (Krzysztof Kozlowski)
  - ASoC: codecs: wsa884x: Correct VI sense channel mask (Krzysztof Kozlowski)
  - spi-rockchip: Fix register out of bounds access (Luis de Arquer) [Orabug: 38095173] {CVE-2025-38081}
  - SUNRPC: rpcbind should never reset the port to the value '0' (Trond Myklebust)
  - SUNRPC: rpc_clnt_set_transport() must not change the autobind setting (Trond Myklebust)
  - NFSv4: Treat ENETUNREACH errors as fatal for state recovery (Trond Myklebust)
  - cifs: Fix establishing NetBIOS session for SMB2+ connection (Pali Rohár)
  - cifs: add validation check for the fields in smb_aces (Namjae Jeon)
  - cifs: Set default Netbios RFC1001 server name to hostname in UNC (Pali Rohár)
  - fbdev: core: tileblit: Implement missing margin clearing for tileblit (Zsolt Kajtar)
  - fbcon: Use correct erase colour for clearing in fbcon (Zsolt Kajtar)
  - fbdev: fsl-diu-fb: add missing device_remove_file() (Shixiong Ou)
  - riscv: Allow NOMMU kernels to access all of RAM (Samuel Holland)
  - mailbox: use error ret code of of_parse_phandle_with_args() (Tudor Ambarus)
  - mailbox: pcc: Use acpi_os_ioremap() instead of ioremap() (Sudeep Holla)
  - tpm: Convert warn to dbg in tpm2_start_auth_session() (Jonathan Mcdowell)
  - ACPI: PNP: Add Intel OC Watchdog IDs to non-PNP device list (Diogo Ivo)
  - tracing: Mark binary printing functions with __printf() attribute (Andy Shevchenko)
  - iommufd: Extend IOMMU_GET_HW_INFO to report PASID capability (Yi Liu)
  - arm64: Add support for HIP09 Spectre-BHB mitigation (Jinqian Yang)
  - SUNRPC: Don't allow waiting for exiting tasks (Trond Myklebust)
  - NFS: Don't allow waiting for exiting tasks (Trond Myklebust)
  - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Trond Myklebust)
  - io_uring/msg: initialise msg request opcode (Pavel Begunkov)
  - exfat: call bh_read in get_block only when necessary (Sungjong Seo)
  - fuse: Return EPERM rather than ENOSYS from link() (Matt Johnston)
  - smb: client: Store original IO parameters and prevent zero IO sizes (Zhaolong Wang)
  - cifs: Fix negotiate retry functionality (Pali Rohár)
  - cifs: Fix querying and creating MF symlinks over SMB1 (Pali Rohár)
  - cifs: Add fallback for SMB2 CREATE without FILE_READ_ATTRIBUTES (Pali Rohár)
  - s390/vfio-ap: Fix no AP queue sharing allowed message written to kernel log (Tony Krowiak)
  - x86/fred: Fix system hang during S4 resume with FRED enabled (Xin Li) [Orabug: 38094951] {CVE-2025-38047}
  - kconfig: merge_config: use an empty file as initfile (Daniel Gomez)
  - samples/bpf: Fix compilation failure for samples/bpf on LoongArch Fedora (Haoran Jiang)
  - bpf: fix possible endless loop in BPF map iteration (Brandon Kammerdiener)
  - io_uring: don't duplicate flushing in io_req_post_cqe (Pavel Begunkov)
  - block: fix race between set_blocksize and read paths (Darrick J. Wong) [Orabug: 38095117] {CVE-2025-38073}
  - selftests/bpf: Mitigate sockmap_ktls disconnect_after_delete failure (Ihor Solodrai)
  - drm/amdgpu: Allow P2P access through XGMI (Felix Kuehling)
  - drm/amd/display: Enable urgent latency adjustment on DCN35 (Nicholas Susanto)
  - fs/ext4: use sleeping version of sb_find_get_block() (Davidlohr Bueso)
  - fs/jbd2: use sleeping version of __find_get_block() (Davidlohr Bueso)
  - fs/ocfs2: use sleeping version of __find_get_block() (Davidlohr Bueso)
  - fs/buffer: use sleeping version of __find_get_block() (Davidlohr Bueso)
  - fs/buffer: introduce sleeping flavors for pagecache lookups (Davidlohr Bueso)
  - fs/buffer: split locking for pagecache lookups (Davidlohr Bueso)
  - ima: process_measurement() needlessly takes inode_lock() on MAY_READ (Frederick Lawler)
  - dma-mapping: Fix warning reported for missing prototype (Balbir Singh)
  - net: enetc: refactor bulk flipping of RX buffers to separate function (Vladimir Oltean)
  - vhost_task: fix vhost_task_create() documentation (Stefano Garzarella)
  - cgroup: Fix compilation issue due to cgroup_mutex not being exported (Gao Xu)
  - dma-mapping: avoid potential unused data compilation warning (Marek Szyprowski)
  - mei: vsc: Use struct vsc_tp_packet as vsc-tp tx_buf and rx_buf type (Hans de Goede)
  - intel_th: avoid using deprecated page->mapping, index fields (Lorenzo Stoakes)
  - dma/mapping.c: dev_dbg support for dma_addressing_limited (Balbir Singh)
  - virtio_ring: Fix data race by tagging event_triggered as racy for KCSAN (Zhongqiu Han) [Orabug: 38094958] {CVE-2025-38048}
  - scsi: ufs: Introduce quirk to extend PA_HIBERN8TIME for UFS devices (Manish Pandey)
  - scsi: target: iscsi: Fix timeout on deleted connection (Dmitry Bogdanov) [Orabug: 38095134] {CVE-2025-38075}
  - nvmem: qfprom: switch to 4-byte aligned reads (Dmitry Baryshkov)
  - nvmem: core: update raw_len if the bit reading is required (Dmitry Baryshkov)
  - nvmem: core: verify cell's raw_len (Dmitry Baryshkov)
  - nvmem: core: fix bit offsets of more than one byte (Dmitry Baryshkov)
  - nvmem: rockchip-otp: add rk3576 variant data (Heiko Stuebner)
  - nvmem: rockchip-otp: Move read-offset into variant-data (Heiko Stuebner)
  - cpufreq: Add SM8650 to cpufreq-dt-platdev blocklist (Pengyu Luo)
  - phy: renesas: rcar-gen3-usb2: Assert PLL reset on PHY power off (Claudiu Beznea)
  - phy: renesas: rcar-gen3-usb2: Lock around hardware registers and driver data (Claudiu Beznea)
  - phy: renesas: rcar-gen3-usb2: Move IRQ request in probe (Claudiu Beznea)
  - i2c: designware: Fix an error handling path in i2c_dw_pci_probe() (Christophe Jaillet)
  - i2c: designware: Use temporary variable for struct device (Andy Shevchenko)
  - drm/amd/display: Defer BW-optimization-blocked DRR adjustments (John Olender)
  - drm/amd/display: Correct timing_adjust_pending flag setting. (Zhongwei)
  - drm/amd/display: Do not enable replay when vtotal update is pending. (Sung-Huai Wang)
  - drm/amd/display: Configure DTBCLK_P with OPTC only for dcn401 (Dillon Varone)
  - LTS version: v6.12.30 (Jack Vogel)
  - drm/amdgpu: fix pm notifier handling (Alex Deucher)
  - phy: tegra: xusb: remove a stray unlock (Dan Carpenter)
  - usb: typec: ucsi: displayport: Fix deadlock (Andrei Kuchynski) [Orabug: 37977018] {CVE-2025-37967}
  - drm/tiny: panel-mipi-dbi: Use drm_client_setup_with_fourcc() (Fabio Estevam)
  - drm/panel-mipi-dbi: Run DRM default client setup (Thomas Zimmermann)
  - drm/fbdev-dma: Support struct drm_driver.fbdev_probe (Thomas Zimmermann)
  - Bluetooth: btnxpuart: Fix kernel panic during FW release (Neeraj Sanjay Kale) [Orabug: 37844459] {CVE-2025-22102}
  - iio: light: opt3001: fix deadlock due to concurrent flag access (Luca Ceresoli) [Orabug: 37977026] {CVE-2025-37968}
  - accel/ivpu: Fix fw log printing (Jacek Lawrynowicz)
  - accel/ivpu: Refactor functions in ivpu_fw_log.c (Jacek Lawrynowicz)
  - accel/ivpu: Reset fw log on cold boot (Tomasz Rusinowicz)
  - accel/ivpu: Rename ivpu_log_level to fw_log_level (Jacek Lawrynowicz)
  - mm/page_alloc: fix race condition in unaccepted memory handling (Kirill A. Shutemov) [Orabug: 38094767] {CVE-2025-38008}
  - drm/xe/gsc: do not flush the GSC worker from the reset path (Daniele Ceraolo Spurio)
  - CIFS: New mount option for cifs.upcall namespace resolution (Ritvik Budhiraja)
  - dmaengine: idxd: Refactor remove call with idxd_cleanup() helper (Shuai Xue) [Orabug: 38094790] {CVE-2025-38014}
  - dmaengine: idxd: fix memory leak in error handling path of idxd_pci_probe (Shuai Xue)
  - dmaengine: idxd: fix memory leak in error handling path of idxd_alloc (Shuai Xue) [Orabug: 38094793] {CVE-2025-38015}
  - dmaengine: idxd: Add missing idxd cleanup to fix memory leak in remove call (Shuai Xue)
  - dmaengine: idxd: Add missing cleanups in cleanup internals (Shuai Xue)
  - dmaengine: idxd: Add missing cleanup for early error out in idxd_setup_internals (Shuai Xue)
  - dmaengine: idxd: fix memory leak in error handling path of idxd_setup_groups (Shuai Xue)
  - dmaengine: idxd: fix memory leak in error handling path of idxd_setup_engines (Shuai Xue)
  - dmaengine: idxd: fix memory leak in error handling path of idxd_setup_wqs (Shuai Xue)
  - dmaengine: ti: k3-udma: Use cap_mask directly from dma_device structure instead of a local copy (Yemike Abhilash Chandra)
  - dmaengine: ti: k3-udma: Add missing locking (Ronald Wahl) [Orabug: 38094756] {CVE-2025-38005}
  - mm: userfaultfd: correct dirty flags set for both present and swap pte (Barry Song)
  - net: qede: Initialize qede_ll_ops with designated initializer (Nathan Chancellor)
  - ring-buffer: Fix persistent buffer when commit page is the reader page (Steven Rostedt)
  - wifi: mt76: disable napi on driver removal (Fedor Pchelkin) [Orabug: 38094770] {CVE-2025-38009}
  - tpm: Mask TPM RC in tpm2_start_auth_session() (Jarkko Sakkinen)
  - spi: tegra114: Use value to check for invalid delays (Aaron Kling)
  - smb: client: fix memory leak during error handling for POSIX mkdir (Jethro Donaldson)
  - scsi: sd_zbc: block: Respect bio vector limits for REPORT ZONES buffer (Steve Siwinski)
  - phy: renesas: rcar-gen3-usb2: Set timing registers only once (Claudiu Beznea)
  - phy: renesas: rcar-gen3-usb2: Fix role detection on unbind/bind (Claudiu Beznea)
  - phy: Fix error handling in tegra_xusb_port_init (Ma Ke)
  - phy: tegra: xusb: Use a bitmask for UTMI pad power state tracking (Wayne Chang) [Orabug: 38094777] {CVE-2025-38010}
  - tracing: samples: Initialize trace_array_printk() with the correct function (Steven Rostedt)
  - ftrace: Fix preemption accounting for stacktrace filter command (Donglin Peng)
  - ftrace: Fix preemption accounting for stacktrace trigger command (Donglin Peng)
  - kbuild: Disable -Wdefault-const-init-unsafe (Nathan Chancellor)
  - Drivers: hv: vmbus: Remove vmbus_sendpacket_pagebuffer() (Michael Kelley)
  - Drivers: hv: Allow vmbus_sendpacket_mpb_desc() to create multiple ranges (Michael Kelley)
  - arm64: dts: rockchip: Remove overdrive-mode OPPs from RK3588J SoC dtsi (Dragan Simic)
  - arm64: dts: amlogic: dreambox: fix missing clkc_audio node (Christian Hewitt)
  - hv_netvsc: Remove rmsg_pgcnt (Michael Kelley)
  - hv_netvsc: Preserve contiguous PFN grouping in the page buffer array (Michael Kelley)
  - hv_netvsc: Use vmbus_sendpacket_mpb_desc() to send VMBus messages (Michael Kelley)
  - dma-buf: insert memory barrier before updating num_fences (Hyejeong Choi)
  - ALSA: usb-audio: Add sample rate quirk for Microdia JP001 USB Camera (Nicolas Chauvet)
  - ALSA: usb-audio: Add sample rate quirk for Audioengine D1 (Christian Heusel)
  - ALSA: es1968: Add error handling for snd_pcm_hw_constraint_pow2() (Xu Wang)
  - ACPI: PPTT: Fix processor subtable walk (Jeremy Linton)
  - gpio: pca953x: fix IRQ storm on system wake up (Emanuele Ghidoli)
  - MAINTAINERS: Update Alexey Makhalov's email address (Alexey Makhalov)
  - drm/amd/display: Avoid flooding unnecessary info messages (Wayne Lin)
  - drm/amd/display: Correct the reply value when AUX write incomplete (Wayne Lin)
  - drm/amdgpu: csa unmap use uninterruptible lock (Philip Yang) [Orabug: 38094779] {CVE-2025-38011}
  - drm/amdgpu: fix incorrect MALL size for GFX1151 (Tim Huang)
  - Revert "drm/amd/display: Hardware cursor changes color when switched to software cursor" (Melissa Wen)
  - btrfs: add back warning for mount option commit values exceeding 300 (Kyoji Ogasawara)
  - btrfs: fix folio leak in submit_one_async_extent() (Boris Burkov)
  - btrfs: fix discard worker infinite loop after disabling discard (Filipe Manana)
  - LoongArch: uprobes: Remove redundant code about resume_era (Tiezhu Yang)
  - LoongArch: uprobes: Remove user_{en,dis}able_single_step() (Tiezhu Yang)
  - LoongArch: Fix MAX_REG_OFFSET calculation (Huacai Chen)
  - LoongArch: Save and restore CSR.CNTC for hibernation (Huacai Chen)
  - LoongArch: Move __arch_cpu_idle() to .cpuidle.text section (Huacai Chen)
  - LoongArch: Prevent cond_resched() occurring within kernel-fpu (Tianyang Zhang)
  - HID: bpf: abort dispatch if device destroyed (Rongrong) [Orabug: 38094796] {CVE-2025-38016}
  - udf: Make sure i_lenExtents is uptodate on inode eviction (Jan Kara)
  - sched_ext: bpf_iter_scx_dsq_new() should always initialize iterator (Tejun Heo) [Orabug: 38094786] {CVE-2025-38012}
  - dmaengine: Revert "dmaengine: dmatest: Fix dmatest waiting less when interrupted" (Nathan Lynch)
  - NFSv4/pnfs: Reset the layout state after a layoutreturn (Trond Myklebust)
  - tsnep: fix timestamping with a stacked DSA driver (Gerhard Engleder)
  - net/tls: fix kernel panic when alloc_page failed (Pengtao He) [Orabug: 38094802] {CVE-2025-38018}
  - mlxsw: spectrum_router: Fix use-after-free when deleting GRE net devices (Ido Schimmel) [Orabug: 38094804] {CVE-2025-38019}
  - wifi: mac80211: Set n_channels after allocating struct cfg80211_scan_request (Kees Cook) [Orabug: 38094788] {CVE-2025-38013}
  - octeontx2-pf: Do not reallocate all ntuple filters (Subbaraya Sundeep)
  - octeontx2-af: Fix CGX Receive counters (Hariprasad Kelam)
  - net: ethernet: mtk_eth_soc: fix typo for declaration MT7988 ESW capability (Bc-Bocun Chen)
  - octeontx2-pf: macsec: Fix incorrect max transmit size in TX secy (Subbaraya Sundeep)
  - netlink: specs: tc: all actions are indexed arrays (Jakub Kicinski)
  - netlink: specs: tc: fix a couple of attribute names (Jakub Kicinski)
  - drm/xe: Save CTX_TIMESTAMP mmio value instead of LRC value (Umesh Nerlige Ramappa)
  - regulator: max20086: fix invalid memory access (Cosmin Tanislav) [Orabug: 38094833] {CVE-2025-38027}
  - qlcnic: fix memory leak in qlcnic_sriov_channel_cfg_cmd() (Abdun Nihaal)
  - net/mlx5e: Disable MACsec offload for uplink representor profile (Carolina Jubran) [Orabug: 38094808] {CVE-2025-38020}
  - vsock/test: Fix occasional failure in SIOCOUTQ tests (Konstantin Shkolnyy)
  - net: dsa: b53: prevent standalone from trying to forward to other ports (Jonas Gorski)
  - ALSA: sh: SND_AICA should depend on SH_DMA_API (Geert Uytterhoeven)
  - nvme-pci: acquire cq_poll_lock in nvme_poll_irqdisable (Keith Busch)
  - nvme-pci: make nvme_pci_npages_prp() __always_inline (Kees Cook)
  - net: dsa: sja1105: discard incoming frames in BR_STATE_LISTENING (Vladimir Oltean)
  - net: cadence: macb: Fix a possible deadlock in macb_halt_tx. (Mathieu Othacehe)
  - ALSA: ump: Fix a typo of snd_ump_stream_msg_device_info (Takashi Iwai)
  - ALSA: seq: Fix delivery of UMP events to group ports (Takashi Iwai)
  - net: mctp: Ensure keys maintain only one ref to corresponding dev (Andrew Jeffery)
  - tests/ncdevmem: Fix double-free of queue array (Cosmin Ratiu)
  - selftests: ncdevmem: Switch to AF_INET6 (Stanislav Fomichev)
  - selftests: ncdevmem: Make client_ip optional (Stanislav Fomichev)
  - selftests: ncdevmem: Unify error handling (Stanislav Fomichev)
  - selftests: ncdevmem: Separate out dmabuf provider (Stanislav Fomichev)
  - selftests: ncdevmem: Redirect all non-payload output to stderr (Stanislav Fomichev)
  - net: mctp: Don't access ifa_index when missing (Matt Johnston)
  - mctp: no longer rely on net->dev_index_head[] (Eric Dumazet)
  - tools/net/ynl: ethtool: fix crash when Hardware Clock info is missing (Hangbin Liu)
  - net_sched: Flush gso_skb list too during ->change() (Cong Wang) [Orabug: 37998128] {CVE-2025-37992}
  - Bluetooth: MGMT: Fix MGMT_OP_ADD_DEVICE invalid device flags (Luiz Augusto von Dentz)
  - RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem (Zhu Yanjun) [Orabug: 38094813] {CVE-2025-38022}
  - spi: loopback-test: Do not split 1024-byte hexdumps (Geert Uytterhoeven)
  - nfs: handle failure of nfs_get_lock_context in unlock path (Li Lingfeng) [Orabug: 38094818] {CVE-2025-38023}
  - HID: uclogic: Add NULL check in uclogic_input_configured() (Henry Martin) [Orabug: 38094764] {CVE-2025-38007}
  - HID: thrustmaster: fix memory leak in thrustmaster_interrupts() (Qasim Ijaz)
  - RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug (Zhu Yanjun) [Orabug: 38094827] {CVE-2025-38024}
  - virtio_net: ensure netdev_tx_reset_queue is called on bind xsk for tx (Koichiro Den)
  - virtio_ring: add a func argument 'recycle_done' to virtqueue_reset() (Koichiro Den)
  - iio: chemical: sps30: use aligned_s64 for timestamp (David Lechner)
  - iio: adc: ad7768-1: Fix insufficient alignment of timestamp. (Jonathan Cameron)
  - xhci: dbc: Avoid event polling busyloop if pending rx transfers are inactive. (Mathias Nyman)
  - xhci: dbc: Improve performance by removing delay in transfer event polling. (Mathias Nyman)
  - Revert "drm/amd: Stop evicting resources on APUs in suspend" (Alex Deucher)
  - drm/amd: Add Suspend/Hibernate notification callback support (Mario Limonciello)
  - iio: pressure: mprls0025pa: use aligned_s64 for timestamp (David Lechner)
  - iio: chemical: pms7003: use aligned_s64 for timestamp (David Lechner)
  - iio: adc: ad7266: Fix potential timestamp alignment issue. (Jonathan Cameron)
  - KVM: x86/mmu: Prevent installing hugepages when mem attributes are changing (Sean Christopherson)
  - KVM: Add member to struct kvm_gfn_range to indicate private/shared (Isaku Yamahata)
  - uio_hv_generic: Fix sysfs creation path for ring buffer (Naman Jain)
  - tpm: tis: Double the timeout B to 4s (Michal Suchanek)
  - tracing: probes: Fix a possible race in trace_probe_log APIs (Masami Hiramatsu)
  - cgroup/cpuset: Extend kthread_is_per_cpu() check to all PF_NO_SETAFFINITY tasks (Waiman Long)
  - arm64: dts: imx8mp-var-som: Fix LDO5 shutdown causing SD card timeout (Himanshu Bhavani)
  - platform/x86: asus-wmi: Fix wlan_ctrl_by_user detection (Hans de Goede)
  - platform/x86/amd/pmc: Declare quirk_spurious_8042 for MECHREVO Wujie 14XA (GX4HRXL) (Runhua He)
  - binfmt_elf: Move brk for static PIE even if ASLR disabled (Kees Cook)
  - riscv: dts: sophgo: fix DMA data-width configuration for CV18xx (Ze Huang)
  - drivers/platform/x86/amd: pmf: Check for invalid Smart PC Policies (Mario Limonciello)
  - drivers/platform/x86/amd: pmf: Check for invalid sideloaded Smart PC Policies (Mario Limonciello)
  - fs/xattr.c: fix simple_xattr_list to always include security.* xattrs (Stephen Smalley)
  - arm64: dts: rockchip: Assign RT5616 MCLK rate on rk3588-friendlyelec-cm3588 (Tom Vincent)
  - LTS version: v6.12.29 (Jack Vogel)
  - arm64: proton-pack: Add new CPUs 'k' values for branch mitigation (James Morse)
  - arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users (James Morse) [Orabug: 37977004] {CVE-2025-37963}
  - arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs (James Morse) [Orabug: 37976926] {CVE-2025-37948}
  - arm64: proton-pack: Expose whether the branchy loop k value (James Morse)
  - arm64: proton-pack: Expose whether the platform is mitigated by firmware (James Morse)
  - arm64: insn: Add support for encoding DSB (James Morse)
  - mm: page_alloc: speed up fallbacks in rmqueue_bulk() (Johannes Weiner)
  - mm: page_alloc: don't steal single pages from biggest buddy (Johannes Weiner)
  - Bluetooth: btmtk: Remove the resetting step before downloading the fw (Hao Qin)
  - Bluetooth: btmtk: Remove resetting mt7921 before downloading the fw (Hao Qin)
  - io_uring: always arm linked timeouts prior to issue (Jens Axboe)
  - rust: clean Rust 1.88.0's `clippy::uninlined_format_args` lint (Miguel Ojeda)
  - rust: allow Rust 1.87.0's `clippy::ptr_eq` lint (Miguel Ojeda)
  - Revert "um: work around sched_yield not yielding in time-travel mode" (Christian Lamparter)
  - do_umount(): add missing barrier before refcount checks in sync case (Al Viro)
  - io_uring/sqpoll: Increase task_work submission batch size (Gabriel Krisman Bertazi)
  - drm/xe/tests/mocs: Hold XE_FORCEWAKE_ALL for LNCF regs (Tejas Upadhyay)
  - drm/xe/tests/mocs: Update xe_force_wake_get() return handling (Himal Prasad Ghimiray)
  - riscv: misaligned: enable IRQs while handling misaligned accesses (Clément Léger)
  - riscv: misaligned: factorize trap handling (Clément Léger)
  - nvme: unblock ctrl state transition for firmware update (Daniel Wagner)
  - drm/panel: simple: Update timings for AUO G101EVN010 (Kevin Baker)
  - loop: Add sanity check for read/write_iter (Lizhi Xu)
  - loop: factor out a loop_assign_backing_file helper (Christoph Hellwig)
  - loop: refactor queue limits updates (Christoph Hellwig)
  - loop: Fix ABBA locking race (Ogawa Hirofumi)
  - loop: Simplify discard granularity calc (John Garry)
  - loop: Use bdev limit helpers for configuring discard (John Garry)
  - riscv: misaligned: Add handling for ZCB instructions (Nylon Chen)
  - MIPS: Fix MAX_REG_OFFSET (Thorsten Blum)
  - iio: adc: dln2: Use aligned_s64 for timestamp (Jonathan Cameron)
  - iio: accel: adxl355: Make timestamp 64-bit aligned using aligned_s64 (Jonathan Cameron)
  - types: Complement the aligned types with signed 64-bit one (Andy Shevchenko)
  - iio: temp: maxim-thermocouple: Fix potential lack of DMA safe buffer. (Jonathan Cameron)
  - iio: accel: adxl367: fix setting odr for activity time update (Lothar Rubusch)
  - usb: usbtmc: Fix erroneous generic_read ioctl return (Dave Penkler)
  - usb: usbtmc: Fix erroneous wait_srq ioctl return (Dave Penkler)
  - usb: usbtmc: Fix erroneous get_stb ioctl error returns (Dave Penkler)
  - USB: usbtmc: use interruptible sleep in usbtmc_read (Oliver Neukum)
  - usb: typec: ucsi: displayport: Fix NULL pointer access (Andrei Kuchynski) [Orabug: 38015126] {CVE-2025-37994}
  - usb: typec: tcpm: delay SNK_TRY_WAIT_DEBOUNCE to SRC_TRYWAIT transition (Rd Babiera)
  - usb: misc: onboard_usb_dev: fix support for Cypress HX3 hubs (Lukasz Czechowski)
  - usb: host: tegra: Prevent host controller crash when OTG port is used (Jim Lin)
  - usb: gadget: Use get_status callback to set remote wakeup capability (Prashanth K)
  - usb: gadget: tegra-xudc: ACK ST_RC after clearing CTRL_RUN (Wayne Chang)
  - usb: gadget: f_ecm: Add get_status callback (Prashanth K)
  - usb: cdnsp: fix L1 resume issue for RTL_REVISION_NEW_LPM version (Pawel Laszczak)
  - usb: cdnsp: Fix issue with resuming from L1 (Pawel Laszczak)
  - usb: dwc3: gadget: Make gadget_wakeup asynchronous (Prashanth K)
  - x86/microcode: Consolidate the loader enablement checking (Borislav Petkov)
  - module: ensure that kobject_put() is safe for module type kobjects (Dmitry Antipov) [Orabug: 38015131] {CVE-2025-37995}
  - memblock: Accept allocated memory before use in memblock_double_array() (Tom Lendacky) [Orabug: 37976994] {CVE-2025-37960}
  - clocksource/i8253: Use raw_spinlock_irqsave() in clockevent_i8253_disable() (Sebastian Andrzej Siewior)
  - arm64: cpufeature: Move arm64_use_ng_mappings to the .data section to prevent wrong idmap generation (Levi Yun)
  - accel/ivpu: Increase state dump msg timeout (Jacek Lawrynowicz)
  - xenbus: Use kref to track req lifetime (Jason Andryuk) [Orabug: 37976934] {CVE-2025-37949}
  - xen: swiotlb: Use swiotlb bouncing if kmalloc allocation demands it (John Ernberg)
  - smb: client: Avoid race in open_cached_dir with lease breaks (Paul Aurich) [Orabug: 37976959] {CVE-2025-37954}
  - usb: uhci-platform: Make the clock really optional (Alexey Charkov)
  - drm/amdgpu/hdp7: use memcfg register to post the write for HDP flush (Alex Deucher)
  - drm/amdgpu/hdp6: use memcfg register to post the write for HDP flush (Alex Deucher)
  - drm/amdgpu/hdp5: use memcfg register to post the write for HDP flush (Alex Deucher)
  - drm/amdgpu/hdp5.2: use memcfg register to post the write for HDP flush (Alex Deucher)
  - drm/amdgpu/hdp4: use memcfg register to post the write for HDP flush (Alex Deucher)
  - drm/amd/display: Copy AUX read reply data whenever length > 0 (Wayne Lin)
  - drm/amd/display: Fix wrong handling for AUX_DEFER case (Wayne Lin)
  - drm/amd/display: Remove incorrect checking in dmub aux handler (Wayne Lin)
  - drm/amd/display: Fix the checking condition in dmub aux handling (Wayne Lin)
  - drm/amd/display: more liberal vmin/vmax update for freesync (Aurabindo Pillai)
  - drm/amd/display: Fix invalid context error in dml helper (Roman Li) [Orabug: 37977185] {CVE-2025-37965}
  - drm/amdgpu/vcn: using separate VCN1_AON_SOC offset (Ruijing Dong)
  - drm/xe: Add page queue multiplier (Matthew Brost)
  - drm/v3d: Add job to pending list if the reset was skipped (Maíra Canal) [Orabug: 37976942] {CVE-2025-37951}
  - iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_tagged_fifo (Silvano Seva) [Orabug: 37977031] {CVE-2025-37969}
  - iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_fifo (Silvano Seva) [Orabug: 37977037] {CVE-2025-37970}
  - iio: imu: inv_mpu6050: align buffer for timestamp (David Lechner)
  - iio: adis16201: Correct inclinometer channel resolution (Gabriel)
  - iio: adc: rockchip: Fix clock initialization sequence (Simon Xue)
  - iio: adc: ad7606: fix serial register access (Angelo Dureghello)
  - io_uring: ensure deferred completions are flushed for multishot (Jens Axboe)
  - drm/amd/display: Shift DMUB AUX reply command if necessary (Wayne Lin)
  - KVM: SVM: Forcibly leave SMM mode on SHUTDOWN interception (Mikhail Lobanov) [Orabug: 37976977] {CVE-2025-37957}
  - selftests/mm: fix a build failure on powerpc (Nysal Jan K.A.)
  - selftests/mm: compaction_test: support platform with huge mount of memory (Feng Tang)
  - mm/userfaultfd: fix uninitialized output field for -EAGAIN race (Peter Xu)
  - mm/huge_memory: fix dereferencing invalid pmd migration entry (Gavin Guo) [Orabug: 37976982] {CVE-2025-37958}
  - mm: fix folio_pte_batch() on XEN PV (Petr Vaněk)
  - x86/mm: Eliminate window where TLB flushes may be inadvertently skipped (Dave Hansen) [Orabug: 37977013] {CVE-2025-37964}
  - staging: axis-fifo: Correct handling of tx_fifo_depth for size validation (Gabriel)
  - staging: axis-fifo: Remove hardware resets for user errors (Gabriel)
  - staging: bcm2835-camera: Initialise dev in v4l2_dev (Dave Stevenson) [Orabug: 37977042] {CVE-2025-37971}
  - staging: iio: adc: ad7816: Correct conditional logic for store mode (Gabriel)
  - rust: clean Rust 1.88.0's warning about `clippy::disallowed_macros` configuration (Miguel Ojeda)
  - objtool/rust: add one more `noreturn` Rust function for Rust 1.87.0 (Miguel Ojeda)
  - rust: clean Rust 1.88.0's `unnecessary_transmutes` lint (Miguel Ojeda)
  - Input: synaptics - enable InterTouch on TUXEDO InfinityBook Pro 14 v5 (Aditya Garg)
  - Input: synaptics - enable SMBus for HP Elitebook 850 G1 (Dmitry Torokhov)
  - Input: synaptics - enable InterTouch on Dell Precision M3800 (Aditya Garg)
  - Input: synaptics - enable InterTouch on Dynabook Portege X30L-G (Aditya Garg)
  - Input: synaptics - enable InterTouch on Dynabook Portege X30-D (Manuel Fombuena)
  - Input: xpad - fix two controller table values (Vicki Pfau)
  - Input: xpad - add support for 8BitDo Ultimate 2 Wireless Controller (Lode Willems)
  - Input: xpad - fix Share button on Xbox One controllers (Vicki Pfau)
  - Input: mtk-pmic-keys - fix possible null pointer dereference (Gary Bisson) [Orabug: 37977044] {CVE-2025-37972}
  - Input: cyttsp5 - fix power control issue on wakeup (Mikael Gonella-Bolduc)
  - Input: cyttsp5 - ensure minimum reset pulse width (Hugo Villeneuve)
  - virtio-net: fix total qstat values (Jakub Kicinski)
  - net: export a helper for adding up queue stats (Jakub Kicinski)
  - fbnic: Do not allow mailbox to toggle to ready outside fbnic_mbx_poll_tx_ready (Alexander Duyck)
  - fbnic: Pull fbnic_fw_xmit_cap_msg use out of interrupt context (Alexander Duyck)
  - fbnic: Improve responsiveness of fbnic_mbx_poll_tx_ready (Alexander Duyck)
  - fbnic: Actually flush_tx instead of stalling out (Alexander Duyck)
  - fbnic: Gate AXI read/write enabling on FW mailbox (Alexander Duyck)
  - fbnic: Fix initialization of mailbox descriptor rings (Alexander Duyck)
  - net: dsa: b53: do not set learning and unicast/multicast on up (Jonas Gorski)
  - net: dsa: b53: fix learning on VLAN unaware bridges (Jonas Gorski)
  - net: dsa: b53: fix toggling vlan_filtering (Jonas Gorski)
  - net: dsa: b53: do not program vlans when vlan filtering is off (Jonas Gorski)
  - net: dsa: b53: do not allow to configure VLAN 0 (Jonas Gorski)
  - net: dsa: b53: always rejoin default untagged VLAN on bridge leave (Jonas Gorski)
  - net: dsa: b53: fix VLAN ID for untagged vlan on bridge leave (Jonas Gorski)
  - net: dsa: b53: fix flushing old pvid VLAN on pvid change (Jonas Gorski)
  - net: dsa: b53: fix clearing PVID of a port (Jonas Gorski)
  - net: dsa: b53: keep CPU port always tagged again (Jonas Gorski)
  - net: dsa: b53: allow leaky reserved multicast (Jonas Gorski)
  - bpf: Scrub packet on bpf_redirect_peer (Paul Chaignon) [Orabug: 37976990] {CVE-2025-37959}
  - netfilter: ipset: fix region locking in hash types (Jozsef Kadlecsik) [Orabug: 38015141] {CVE-2025-37997}
  - ipvs: fix uninit-value for saddr in do_output_route4 (Julian Anastasov) [Orabug: 37976996] {CVE-2025-37961}
  - erofs: ensure the extra temporary copy is valid for shortened bvecs (Gao Xiang)
  - ice: use DSN instead of PCI BDF for ice_adapter index (Przemek Kitszel)
  - ice: Initial support for E825C hardware in ice_adapter (Sergey Temerkhanov)
  - wifi: mac80211: fix the type of status_code for negotiated TID to Link Mapping (Michael-Cy Lee)
  - can: gw: fix RCU/BH usage in cgw_create_job() (Oliver Hartkopp)
  - can: mcp251xfd: fix TDC setting for low data bit rates (Kelsey Maes)
  - can: m_can: m_can_class_allocate_dev(): initialize spin lock on device probe (Antonios Salios) [Orabug: 38015123] {CVE-2025-37993}
  - net: ethernet: mtk_eth_soc: do not reset PSE when setting FE (Frank Wunderlich)
  - net: ethernet: mtk_eth_soc: reset all TX queues on DMA free (Daniel Golle)
  - gre: Fix again IPv6 link-local address generation. (Guillaume Nault)
  - virtio-net: free xsk_buffs on error in virtnet_xsk_pool_enable() (Jakub Kicinski) [Orabug: 37976969] {CVE-2025-37955}
  - virtio_net: xsk: bind/unbind xsk for tx (Xuan Zhuo)
  - sch_htb: make htb_deactivate() idempotent (Cong Wang) [Orabug: 37977176] {CVE-2025-37953}
  - s390/entry: Fix last breaking event handling in case of stack corruption (Heiko Carstens)
  - ksmbd: fix memory leak in parse_lease_state() (Zhaolong Wang) [Orabug: 37977180] {CVE-2025-37962}
  - openvswitch: Fix unsafe attribute parsing in output_userspace() (Eelco Chaudron) [Orabug: 38015148] {CVE-2025-37998}
  - ksmbd: Fix UAF in __close_file_table_ids (Sean Heelan) [Orabug: 37976951] {CVE-2025-37952}
  - ksmbd: prevent out-of-bounds stream writes by validating *pos (Norbert Szetei) [Orabug: 37976923] {CVE-2025-37947}
  - ksmbd: prevent rename with empty string (Namjae Jeon) [Orabug: 37976972] {CVE-2025-37956}
  - can: rockchip_canfd: rkcanfd_remove(): fix order of unregistration calls (Marc Kleine-Budde)
  - can: mcp251xfd: mcp251xfd_remove(): fix order of unregistration calls (Marc Kleine-Budde)
  - s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFs (Niklas Schnelle) [Orabug: 37976920] {CVE-2025-37946}
  - vfio/pci: Align huge faults to order (Alex Williamson)
  - wifi: cfg80211: fix out-of-bounds access during multi-link element defragmentation (Veerendranath Jakkam) [Orabug: 37977046] {CVE-2025-37973}
  - s390/pci: Fix missing check for zpci_create_device() error return (Niklas Schnelle) [Orabug: 37977050] {CVE-2025-37974}
  - can: mcan: m_can_class_unregister(): fix order of unregistration calls (Marc Kleine-Budde)
  - firmware: arm_scmi: Fix timeout checks on polling path (Cristian Marussi)
  - arm64: dts: imx8mm-verdin: Link reg_usdhc2_vqmmc to usdhc2 (Wojciech Dubowik)
  - Revert "btrfs: canonicalize the device path before adding it" (Qu Wenruo)
  - fs/erofs/fileio: call erofs_onlinefolio_split() after bio_add_folio() (Max Kellermann) [Orabug: 38015155] {CVE-2025-37999}
  - dm: add missing unlock on in dm_keyslot_evict() (Dan Carpenter)
  - mm/vmscan: wake up flushers conditionally to avoid cgroup OOM (Zeng Jingxiang) [Orabug: 37480932]
  - dmaengine: idxd: Narrow the restriction on BATCH to ver. 1 only (Vinicius Costa Gomes) [Orabug: 37801355]
  - uek-rpm: build the fwctl mlx5 driver on UEK (Qing Huang) [Orabug: 37810636]
  - fwctl: Adapt upstream code for UEK8 (Mikhael Goikhman) [Orabug: 37810636]
  - mlx5: Create an auxiliary device for fwctl_mlx5 (Saeed Mahameed) [Orabug: 37810636]
  - fwctl/mlx5: Support for communicating with mlx5 fw (Saeed Mahameed) [Orabug: 37810636]
  - fwctl: Add documentation (Jason Gunthorpe) [Orabug: 37810636]
  - fwctl: FWCTL_RPC to execute a Remote Procedure Call to device firmware (Jason Gunthorpe) [Orabug: 37810636]
  - taint: Add TAINT_FWCTL (Jason Gunthorpe) [Orabug: 37810636]
  - fwctl: FWCTL_INFO to return basic information about the device (Jason Gunthorpe) [Orabug: 37810636]
  - fwctl: Basic ioctl dispatch for the character device (Jason Gunthorpe) [Orabug: 37810636]
  - fwctl: Add basic structure for a class subsystem with a cdev (Jason Gunthorpe) [Orabug: 37810636]
  - Revert "fwctl: Add basic structure for a class subsystem with a cdev" (Qing Huang) [Orabug: 37810636]
  - Revert "fwctl: Basic ioctl dispatch for the character device" (Qing Huang) [Orabug: 37810636]
  - Revert "fwctl: FWCTL_INFO to return basic information about the device" (Qing Huang) [Orabug: 37810636]
  - Revert "fwctl: FWCTL_RPC to execute a Remote Procedure Call to device firmware" (Qing Huang) [Orabug: 37810636]
  - Revert "fwctl/mlx5: Support for communicating with mlx5 fw" (Qing Huang) [Orabug: 37810636]
  - Revert "mlx5: Create an auxiliary device for fwctl_mlx5" (Qing Huang) [Orabug: 37810636]
  - Revert "taint: Add TAINT_FWCTL" (Qing Huang) [Orabug: 37810636]
  - Revert "fwctl: Adapt code for UEK-NEXT" (Qing Huang) [Orabug: 37810636]
  - Revert "fwctl/mlx5: Add INTERNAL_DEV_RES uctx capability" (Qing Huang) [Orabug: 37810636]
  - Revert "fwctl: Allow up to 4k devices" (Qing Huang) [Orabug: 37810636]
  - Revert "uek-rpm: build the fwctl mlx5 driver on UEK" (Qing Huang) [Orabug: 37810636]
  - dmaengine: idxd: Change err messages to dbg (Jack Vogel) [Orabug: 37841831]
  - PCI: Add PCI_VDEVICE_SUB helper macro (Piotr Kwapulinski) [Orabug: 37889575]
  - ixgbevf: Add support for Intel(R) E610 device (Piotr Kwapulinski) [Orabug: 37889575]
  - ixgbe: Enable link management in E610 device (Piotr Kwapulinski) [Orabug: 37889575]
  - ixgbe: Clean up the E610 link management related code (Piotr Kwapulinski) [Orabug: 37889575]
  - ixgbe: Add ixgbe_x540 multiple header inclusion protection (Piotr Kwapulinski) [Orabug: 37889575]
  - ixgbe: Add support for EEPROM dump in E610 device (Piotr Kwapulinski) [Orabug: 37889575]
  - ixgbe: Add support for NVM handling in E610 device (Piotr Kwapulinski) [Orabug: 37889575]
  - ixgbe: Add link management support for E610 device (Piotr Kwapulinski) [Orabug: 37889575]
  - ixgbe: Add support for E610 device capabilities detection (Piotr Kwapulinski) [Orabug: 37889575]
  - ixgbe: Add support for E610 FW Admin Command Interface (Piotr Kwapulinski) [Orabug: 37889575]
  - uek-rpm: Move the gve kernel module from extra to kernel-uek-core (Samasth Norway Ananda) [Orabug: 37940897]
  - uek-rpm/config-aarch64: Enable BT_HCIUART_BCM for RPi Bluetooth (Vijay Kumar) [Orabug: 37961540]
  - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (Shravan Kumar Ramani) [Orabug: 37964051]
  - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (David Thompson) [Orabug: 37964051,38037120] {CVE-2025-37866}
  - mlxbf-bootctl: Support sysfs entries for RTC battery status (Xiangrong Li) [Orabug: 37964051]
  - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37964051]
  - uek-rpm: CONFIG_PTP_1588_CLOCK_OCP enable for OCI (Vijayendra Suman) [Orabug: 37966384]
  - x86/its: Fix build errors when CONFIG_MODULES=n (Eric Biggers) [Orabug: 37970148]
  - x86/its: Use dynamic thunks for indirect branches (Peter Zijlstra) [Orabug: 37970148]
  - x86/ibt: Keep IBT disabled during alternative patching (Pawan Gupta) [Orabug: 37970148]
  - RDMA/mlx5: Fix CC counters query for MPV (Patrisious Haddad) [Orabug: 37989268]
  - amd_hsmp: Increase the SMU timeout to 500ms (Vijay Kumar) [Orabug: 38000074]


