# changelog

author: Brian Maly <brian.maly@oracle.com> [5.15.0-309.180.3.el9uek]
changelog:
  - net/mlx5: Reclaim max 50K pages at once (Anand Khoje) [Orabug: 36933755]
  - x86/sev: Fix position dependent variable references in startup code (Ard Biesheuvel) [Orabug: 37356711]
  - x86/PCI: Export find_cap() to be used in early PCI code (Rayan Dasoriya) [Orabug: 37356711]
  - x86/quirks: Scan all busses for early PCI quirks (Rayan Dasoriya) [Orabug: 37356711]
  - x86/quirks: Add parameter to clear MSIs early on boot (Rayan Dasoriya) [Orabug: 37356711]
  - iommu/amd: Add map/unmap_pages() iommu_domain_ops callback support (Vasant Hegde) [Orabug: 37356711]
  - iommu/amd/io-pgtable: Implement unmap_pages io_pgtable_ops callback (Vasant Hegde) [Orabug: 37356711]
  - iommu/amd/io-pgtable: Implement map_pages io_pgtable_ops callback (Vasant Hegde) [Orabug: 37356711]
  - iommu/amd: Use put_pages_list (Matthew Wilcox) [Orabug: 37356711]
  - x86/sev: Make enc_dec_hypercall() accept a size instead of npages (Steve Rutherford) [Orabug: 37356711]
  - iommu/amd: Simplify pagetable freeing (Robin Murphy) [Orabug: 37356711]
  - x86/kvm: Add kexec support for SEV Live Migration. (Ashish Kalra) [Orabug: 37356711]
  - nfsd: allow layout state to be admin-revoked. (Neil Brown) [Orabug: 37644985]
  - nfsd: allow delegation state ids to be revoked and then freed (Neil Brown) [Orabug: 37644985]
  - nfsd: allow open state ids to be revoked and then freed (Neil Brown) [Orabug: 37644985]
  - nfsd: allow lock state ids to be revoked and then freed (Neil Brown) [Orabug: 37644985]
  - nfsd: allow admin-revoked NFSv4.0 state to be freed. (Neil Brown) [Orabug: 37644985]
  - nfsd: report in /proc/fs/nfsd/clients/*/states when state is admin-revoke (Neil Brown) [Orabug: 37644985]
  - nfsd: allow state with no file to appear in /proc/fs/nfsd/clients/*/states (Neil Brown) [Orabug: 37644985]
  - nfsd: prepare for supporting admin-revocation of state (Neil Brown) [Orabug: 37644985]
  - nfsd: split sc_status out of sc_type (Neil Brown) [Orabug: 37644985]
  - nfsd: remove stale comment in nfs4_show_deleg() (Neil Brown) [Orabug: 37644985]
  - nfsd: avoid race after unhash_delegation_locked() (Neil Brown) [Orabug: 37644985]
  - nfsd: don't call functions with side-effecting inside WARN_ON() (Neil Brown) [Orabug: 37644985]
  - NFSD: Add nfsd_seq4_status trace event (Chuck Lever) [Orabug: 37644985]
  - NFSD: Clean up nfsd4_encode_layoutreturn() (Chuck Lever) [Orabug: 37644985]
  - NFSD: Make @lgp parameter of ->encode_layoutget a const pointer (Chuck Lever) [Orabug: 37644985]
  - NFSD: Clean up nfsd4_encode_stateid() (Chuck Lever) [Orabug: 37644985]
  - NFSD: Add simple u32, u64, and bool encoders (Chuck Lever) [Orabug: 37644985]
  - NFSD: Add encoders for NFSv4 clientids and verifiers (Chuck Lever) [Orabug: 37644985]
  - nfsd: add some kerneldoc comments for stateid preprocessing functions (Jeff Layton) [Orabug: 37644985]
  - nfsd: eliminate find_deleg_file_locked (Jeff Layton) [Orabug: 37644985]
  - nfsd: fix potential race in nfs4_find_file (Jeff Layton) [Orabug: 37644985]
  - vhost-scsi: Fix vhost_scsi_send_status() (Dongli Zhang) [Orabug: 37840544]
  - vhost-scsi: Fix vhost_scsi_send_bad_target() (Dongli Zhang) [Orabug: 37840544]
  - vhost-scsi: protect vq->log_used with vq->mutex (Dongli Zhang) [Orabug: 37840544,38095126] {CVE-2025-38074}
  - vhost-scsi: Reduce response iov mem use (Mike Christie) [Orabug: 37840544]
  - vhost-scsi: Allocate iov_iter used for unaligned copies when needed (Mike Christie) [Orabug: 37840544]
  - vhost-scsi: Stop duplicating se_cmd fields (Mike Christie) [Orabug: 37840544]
  - vhost-scsi: Dynamically allocate scatterlists (Mike Christie) [Orabug: 37840544]
  - vhost-scsi: Return queue full for page alloc failures during copy (Mike Christie) [Orabug: 37840544]
  - vhost-scsi: Add better resource allocation failure handling (Mike Christie) [Orabug: 37840544]
  - vhost-scsi: Allocate T10 PI structs only when enabled (Mike Christie) [Orabug: 37840544]
  - vhost-scsi: Reduce mem use by moving upages to per queue (Mike Christie) [Orabug: 37840544]
  - scsi: target: core: Use RCU helpers for INQUIRY t10_alua_tg_pt_gp (Mike Christie) [Orabug: 37840544]
  - scsi: target: Perform ALUA group changes in one step (Mike Christie) [Orabug: 37840544]
  - scsi: target: Replace lun_tg_pt_gp_lock with rcu in I/O path (Mike Christie) [Orabug: 37840544]
  - scsi: target: Fix write perf due to unneeded throttling (Mike Christie) [Orabug: 37840544]
  - vhost scsi: Allow user to control num virtqueues (Mike Christie) [Orabug: 37840544]
  - vhost-scsi: Rename vhost_scsi_iov_to_sgl (Mike Christie) [Orabug: 37840544]
  - vhost-scsi: unbreak any layout for response (Jason Wang) [Orabug: 37840544]
  - Revert "vhost-scsi: protect vq->log_base with vq->mutex" (Mike Christie) [Orabug: 37840544]
  - Revert "vhost_scsi: log write descriptors" (Mike Christie) [Orabug: 37840544]
  - x86/bugs: Enabling Retbleed and SRSO mitigation can taint the kernel (Alexandre Chartre) [Orabug: 37945824]
  - x86/bhi: Do not set BHI_DIS_S in 32-bit mode (Pawan Gupta) [Orabug: 37945831]
  - x86/bpf: Add IBHF call at end of classic BPF (Daniel Sneddon) [Orabug: 37945831]
  - x86/bpf: Call branch history clearing sequence on exit (Daniel Sneddon) [Orabug: 37945831]
  - selftest/x86/bugs: Add selftests for ITS (Pawan Gupta) [Orabug: 37945842] {CVE-2024-28956}
  - x86/its: Align RETs in BHB clear sequence to avoid thunking (Pawan Gupta) [Orabug: 37945842] {CVE-2024-28956}
  - x86/its: Add "vmexit" option to skip mitigation on some CPUs (Pawan Gupta) [Orabug: 37945842] {CVE-2024-28956}
  - x86/its: Enable Indirect Target Selection mitigation (Pawan Gupta) [Orabug: 37945842] {CVE-2024-28956}
  - x86/its: Add support for ITS-safe return thunk (Pawan Gupta) [Orabug: 37945842] {CVE-2024-28956}
  - x86/its: Add support for ITS-safe indirect thunk (Pawan Gupta) [Orabug: 37945842] {CVE-2024-28956}
  - x86/its: Enumerate Indirect Target Selection (ITS) bug (Pawan Gupta) [Orabug: 37945842] {CVE-2024-28956}
  - Documentation: x86/bugs/its: Add ITS documentation (Pawan Gupta) [Orabug: 37945842] {CVE-2024-28956}
  - x86/alternatives: Remove faulty optimization (Josh Poimboeuf) [Orabug: 37945842] {CVE-2024-28956}
  - x86/alternative: Optimize returns patching (Borislav Petkov) [Orabug: 37945842] {CVE-2024-28956}


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-309.180.4.el9uek]
changelog:
  - nvme: unblock ctrl state transition for firmware update (Daniel Wagner)
  - nfsd: decrease sc_count directly if fail to queue dl_recall (Li Lingfeng) [Orabug: 37938121] {CVE-2025-37871}
  - cpufreq/sched: Fix the usage of CPUFREQ_NEED_UPDATE_LIMITS (Rafael J. Wysocki)
  - ice: Check VF VSI Pointer Value in ice_vc_add_fdir_fltr() (Luoxuanqiang) [Orabug: 37976780] {CVE-2025-37912}
  - usb: chipidea: ci_hdrc_imx: fix usbmisc handling (Fedor Pchelkin) [Orabug: 37938106] {CVE-2025-37811}
  - Revert "PCI: Avoid reset when disabled via sysfs" (Alex Williamson)
  - uek-rpm: CONFIG_PTP_1588_CLOCK_OCP enable for OCI (Vijayendra Suman) [Orabug: 37777354]
  - ptp: ocp: let ptp core report driver name instead of the drivers (Vijayendra Suman) [Orabug: 37777354]
  - ptp: ocp: Add .getmaxphase ptp_clock_info callback (Rahul Rameshbabu) [Orabug: 37777354]
  - ptp: ocp: remove flash image header check fallback (Vadim Fedorenko) [Orabug: 37777354]
  - ptp: ocp: expose config and temperature for ART card (Vadim Fedorenko) [Orabug: 37777354]
  - ptp: ocp: add serial port of mRO50 MAC on ART card (Vadim Fedorenko) [Orabug: 37777354]
  - ptp: ocp: add Orolia timecard support (Vadim Fedorenko) [Orabug: 37777354]
  - ptp: ocp: upgrade serial line information (Vadim Fedorenko) [Orabug: 37777354]
  - ] ptp: ocp: remove symlink for second GNSS (Vadim Fedorenko) [Orabug: 37777354]
  - ptp_ocp: use device_find_any_child() instead of custom approach (Andy Shevchenko) [Orabug: 37777354]
  - ptp_ocp: replace kzalloc(x*y) by kcalloc(y, x) (Andy Shevchenko) [Orabug: 37777354]
  - ptp_ocp: do not call pci_set_drvdata(pdev, NULL) (Andy Shevchenko) [Orabug: 37777354]
  - ptp_ocp: drop duplicate NULL check in ptp_ocp_detach() (Andy Shevchenko) [Orabug: 37777354]
  - ptp_ocp: use bits.h macros for all masks (Andy Shevchenko) [Orabug: 37777354]
  - ptp: ocp: Add firmware header checks (Vadim Fedorenko) [Orabug: 37777354]
  - ptp: ocp: fix PPS source selector debugfs reporting (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: add .init function for sma_op vector (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: vectorize the sma accessor functions (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: constify selectors (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: parameterize input/output sma selectors (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: revise firmware display (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: add Celestica timecard PCI ids (Vadim Fedorenko) [Orabug: 37777354]
  - ptp: ocp: Remove #ifdefs around PCI IDs (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: 32-bit fixups for pci start address (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: change sysfs attr group handling (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: have adjtime handle negative delta_ns correctly (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: Use DIV64_U64_ROUND_UP for rounding. (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: handle error from nvmem_device_find (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: use snprintf() in ptp_ocp_verify() (Dan Carpenter) [Orabug: 37777354]
  - ptp: ocp: Make debugfs variables the correct bitwidth (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: Fix PTP_PF_* verification requests (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: Add 2 more timestampers (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: Add 4 frequency counters (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: Program the signal generators via PTP_CLK_REQ_PEROUT (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: Add signal generators and update sysfs nodes (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: Add firmware capability bits for feature gating (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: Add GND and VCC output selectors (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: Rename output selector 'GNSS' to 'GNSS1' (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: Add ability to disable input selectors. (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: Add support for selectable SMA directions. (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: add UPF_NO_THRE_TEST flag for serial ports (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: Update devlink firmware display path. (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: add nvmem interface for accessing eeprom (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: correct label for error path (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: off by in in ptp_ocp_tod_gnss_name() (Dan Carpenter) [Orabug: 37777354]
  - ptp: ocp: Add serial port information to the debug summary (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: adjust utc_tai_offset to TOD info (Vadim Fedorenko) [Orabug: 37777354]
  - ptp: ocp: add tod_correction attribute (Vadim Fedorenko) [Orabug: 37777354]
  - ptp: ocp: Expose clock status drift and offset (Vadim Fedorenko) [Orabug: 37777354]
  - ptp: ocp: add TOD debug information (Vadim Fedorenko) [Orabug: 37777354]
  - ptp: ocp: Add ptp_ocp_adjtime_coarse for large adjustments (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: Move devlink registration to be last devlink command (Leon Romanovsky) [Orabug: 37777354]
  - ptp: ocp: Avoid operator precedence warning in ptp_ocp_summary_show() (Nathan Chancellor) [Orabug: 37777354]
  - ptp: ocp: Add timestamp window adjustment (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: Have FPGA fold in ns adjustment for adjtime. (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: Enable 4th timestamper / PPS generator (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: Add second GNSS device (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: Add NMEA output (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: Add debugfs entry for timecard (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: Separate the init and info logic (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: Add sysfs attribute utc_tai_offset (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: Add IRIG-B output mode control (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: Add IRIG-B and DCF blocks (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: Add SMA selector and controls (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: Add third timestamper (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: Report error if resource registration fails. (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: Skip resources with out of range irqs (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: Skip I2C flash read when there is no controller. (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: Parameterize the TOD information display. (Jonathan Lemon) [Orabug: 37777354]
  - ptp: ocp: parameterize the i2c driver used (Jonathan Lemon) [Orabug: 37777354]
  - vhost-scsi: log event queue write descriptors (Dongli Zhang) [Orabug: 37884058]
  - vhost-scsi: log control queue write descriptors (Dongli Zhang) [Orabug: 37884058]
  - vhost-scsi: log I/O queue write descriptors (Dongli Zhang) [Orabug: 37884058]
  - vhost-scsi: adjust vhost_scsi_get_desc() to log vring descriptors (Dongli Zhang) [Orabug: 37884058]
  - vhost: modify vhost_log_write() for broader users (Dongli Zhang) [Orabug: 37884058]
  - mm: make page_mapped_in_vma() hugetlb walk aware (Jane Chu) [Orabug: 37956589]
  - mm/rmap: Fix handling of hugetlbfs pages in page_vma_mapped_walk (Zhenwei Pi) [Orabug: 37956589]
  - ext4: update the backup superblock's at the end of the online resize (Theodore Ts'O) [Orabug: 37356729]
  - gve: ignore nonrelevant GSO type bits when processing TSO headers (Joshua Washington) [Orabug: 37356729]
  - gve: update gve.rst (Rushil Gupta) [Orabug: 37356729]
  - gve: RX path for DQO-QPL (Rushil Gupta) [Orabug: 37356729]
  - gve: Tx path for DQO-QPL (Rushil Gupta) [Orabug: 37356729]
  - gve: Control path for DQO-QPL (Rushil Gupta) [Orabug: 37356729]
  - gve: Fix gve interrupt names (Praveen Kaligineedi) [Orabug: 37356729]
  - gve: Handle alternate miss completions (Jeroen de Borst) [Orabug: 37356729]
  - gve: Adding a new AdminQ command to verify driver (Jeroen de Borst) [Orabug: 37356729]
  - gve: Fix error return code in gve_prefill_rx_pages() (Yang Yingliang) [Orabug: 37356729]
  - gve: Reduce alloc and copy costs in the GQ rx path (Shailend Chand) [Orabug: 37356729]
  - google/gve:fix repeated words in comments (Jilin Yuan) [Orabug: 37356729]
  - gve: Fix spelling mistake "droping" -> "dropping" (Colin Ian King) [Orabug: 37356729]
  - gve: enhance no queue page list detection (Haiyue Wang) [Orabug: 37356729]
  - gve: Recording rx queue before sending to napi (Tao Liu) [Orabug: 37356729]
  - ext4: add ioctls to get/set the ext4 superblock uuid (Jeremy Bongio) [Orabug: 37356729]
  - ext4: implement support for get/set fs label (Lukas Czerner) [Orabug: 37356729]
  - gve: Add tx|rx-coalesce-usec for DQO (Tao Liu) [Orabug: 37356729]
  - gve: Add consumed counts to ethtool stats (Jordan Kim) [Orabug: 37356729]
  - gve: Implement suspend/resume/shutdown (Catherine Sullivan) [Orabug: 37356729]
  - gve: Add optional metadata descriptor type GVE_TXD_MTD (Willem de Bruijn) [Orabug: 37356729]
  - gve: remove memory barrier around seqno (Catherine Sullivan) [Orabug: 37356729]
  - gve: Update gve_free_queue_page_list signature (Catherine Sullivan) [Orabug: 37356729]
  - gve: Move the irq db indexes out of the ntfy block struct (Catherine Sullivan) [Orabug: 37356729]
  - gve: Correct order of processing device options (Jeroen de Borst) [Orabug: 37356729]
  - gve: fix for null pointer dereference. (Ameer Hamza) [Orabug: 37356729]
  - gve: fix unmatched u64_stats_update_end() (Dan Carpenter) [Orabug: 37356729]
  - gve: Add a jumbo-frame device option. (Shailend Chand) [Orabug: 37356729]
  - gve: Implement packet continuation for RX. (David Awogbemila) [Orabug: 37356729]
  - gve: Allow pageflips on larger pages (Jordan Kim) [Orabug: 37356729]
  - gve: Add netif_set_xps_queue call (Catherine Sullivan) [Orabug: 37356729]
  - gve: Do lazy cleanup in TX path (Tao Liu) [Orabug: 37356729]
  - gve: Add rx buffer pagecnt bias (Catherine Sullivan) [Orabug: 37356729]
  - gve: Switch to use napi_complete_done (Yanchun Fu) [Orabug: 37356729]
  - gve: Use kvcalloc() instead of kvzalloc() (Gustavo A R Silva) [Orabug: 37356729]
  - selftests/net: optmem_max became per netns (Eric Dumazet) [Orabug: 37356732]
  - tcp: derive delack_max with tcp_rto_min helper (Kevin Yang) [Orabug: 37356732]
  - tcp: derive delack_max from rto_min (Eric Dumazet) [Orabug: 37356732]
  - tcp: add sysctl_tcp_rto_min_us (Kevin Yang) [Orabug: 37356732]
  - tcp: constify tcp_rto_min() and tcp_rto_min_us() argument (Eric Dumazet) [Orabug: 37356732]
  - net: constify sk_dst_get() and __sk_dst_get() argument (Eric Dumazet) [Orabug: 37356732]
  - net: Namespace-ify sysctl_optmem_max (Eric Dumazet) [Orabug: 37356732]
  - net: increase optmem_max default value (Eric Dumazet) [Orabug: 37356732]
  - net: phy: dp83867: Fix SGMII FIFO depth for non OF devices (Michael Sit Wei Hong) [Orabug: 37670821]
  - net: phy: dp83867: fix get nvmem cell fail (Nikita Shubin) [Orabug: 37670821]
  - net: phy: dp83867: implement support for io_impedance_ctrl nvmem cell (Rasmus Villemoes) [Orabug: 37670821]
  - net: phy: constify netdev->dev_addr references (Jakub Kicinski) [Orabug: 37670821]
  - net: phy: dp83867: introduce critical chip default init for non-of platform (Lay, Kuan Loon) [Orabug: 37670821]
  - RDS: use pin_user_pages_fast() (Stephen Brennan) [Orabug: 37872748]
  - uek-rpm: Reduce the size of the Bluefield 3 kernel (Henry Willard) [Orabug: 37910874]
  - uek-rpm: Make sure dtb directory exists for emb3. (Henry Willard) [Orabug: 37910874]
  - uek-rpm: Move the gve kernel module from extra to kernel-uek-core (Samasth Norway Ananda) [Orabug: 37940898]
  - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (Shravan Kumar Ramani) [Orabug: 37955981]
  - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (David Thompson) [Orabug: 37955981,37989158] {CVE-2025-37866}
  - mlxbf-bootctl: Support sysfs entries for RTC battery status (Xiangrong Li) [Orabug: 37955981]
  - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37955981]
  - drivers/platform/mellanox: Convert snprintf to sysfs_emit (Li Zhijian) [Orabug: 37955981]
  - certs: Add new Oracle Linux Driver Signing (key 1) certificate (Sherry Yang) [Orabug: 37967553]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-310.180.1.el9uek]
changelog:
  - uek-rpm: Enable CONFIG_ACPI_THERMAL and other ACPI config for Bluefield 3 (Thomas Tai) [Orabug: 38007368]
  - dt-bindings: trivial-devices: add onnn,adt7462 (Chanh Nguyen) [Orabug: 38006900]
  - mailbox: pcc: Check before sending MCTP PCC response ACK (Adam Young) [Orabug: 38006900]
  - media: dt-bindings: Add OV5642 (Fabio Estevam) [Orabug: 38006900]
  - hwmon: (xgene) Migrate to use generic PCC shmem related macros (Sudeep Holla) [Orabug: 38006900]
  - i2c: xgene-slimpro: Migrate to use generic PCC shmem related macros (Sudeep Holla) [Orabug: 38006900]
  - ACPI: PCC: Add PCC shared memory region command and status bitfields (Sudeep Holla) [Orabug: 38006900]
  - mailbox: pcc: Support shared interrupt for multiple subspaces (Huisong Li) [Orabug: 38006900]
  - mailbox: pcc: Add support for platform notification handling (Huisong Li) [Orabug: 38006900]
  - mailbox: pcc: Use mbox_bind_client (Elliot Berman) [Orabug: 38006900]
  - mailbox: omap: Use mbox_bind_client (Elliot Berman) [Orabug: 38006900]
  - mailbox: Allow direct registration to a channel (Elliot Berman) [Orabug: 38006900]
  - mailbox: pcc: Reset pcc_chan_count to zero in case of PCC probe failure (Huisong Li) [Orabug: 38006900]
  - mailbox: pcc: Fix spelling mistake "Plaform" -> "Platform" (Colin Ian King) [Orabug: 38006900]
  - mailbox: pcc: Fix an invalid-load caught by the address sanitizer (Mario Limonciello) [Orabug: 38006900]
  - mailbox: pcc: Handle all PCC subtypes correctly in pcc_mbox_irq (Sudeep Holla) [Orabug: 38006900]
  - mailbox: pcc: Avoid using the uninitialized variable 'dev' (Sudeep Holla) [Orabug: 38006900]
  - ACPI/PCC: Add maintainer for PCC mailbox driver (Sudeep Holla) [Orabug: 38006900]
  - mailbox: pcc: Move bulk of PCCT parsing into pcc_mbox_probe (Sudeep Holla) [Orabug: 38006900]
  - mailbox: pcc: Add support for PCCT extended PCC subspaces(type 3/4) (Sudeep Holla) [Orabug: 38006900]
  - mailbox: pcc: Drop handling invalid bit-width in {read,write}_register (Sudeep Holla) [Orabug: 38006900]
  - mailbox: pcc: Avoid accessing PCCT table in pcc_send_data and pcc_mbox_irq (Sudeep Holla) [Orabug: 38006900]
  - mailbox: pcc: Add PCC register bundle and associated accessor functions (Sudeep Holla) [Orabug: 38006900]
  - mailbox: pcc: Rename doorbell ack to platform interrupt ack register (Sudeep Holla) [Orabug: 38006900]
  - uek-rpm: Enable CONFIG_VITESSE_PHY for Bluefield 3 (Thomas Tai) [Orabug: 37985802]
  - x86/its: Fix build errors when CONFIG_MODULES=n (Eric Biggers) [Orabug: 37970165]
  - x86/its: Use dynamic thunks for indirect branches (Peter Zijlstra) [Orabug: 37970165]
  - x86/modules: Set VM_FLUSH_RESET_PERMS in module_alloc() (Thomas Gleixner) [Orabug: 37970165]
  - uek-rpm/config-aarch64: Enable BT_HCIUART_BCM for RPi Bluetooth (Vijay Kumar) [Orabug: 37960844]
  - x86/its: its_native_only bug is not correctly reported (Alexandre Chartre) [Orabug: 37960160]
  - RDMA/mlx5: Fix CC counters query for MPV (Patrisious Haddad) [Orabug: 37358844]
  - amd_hsmp: Increase the SMU timeout to 500ms (Vijay Kumar) [Orabug: 37266677]
  - bpf/bpf_get,set_sockopt: add option to set TCP-BPF sock ops flags (Alan Maguire) [Orabug: 36699198]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-310.184.2.el9uek]
changelog:
  - LTS version: v5.15.184 (Vijayendra Suman)
  - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [Orabug: 38071844] {CVE-2024-56655}
  - netfilter: nf_tables: wait for rcu grace period on net_device removal (Pablo Neira Ayuso)
  - netfilter: nf_tables: pass nft_chain to destroy function, not nft_ctx (Florian Westphal)
  - btrfs: do not clean up repair bio if submit fails (Josef Bacik)
  - btrfs: don't BUG_ON() when 0 reference count at btrfs_lookup_extent_info() (Filipe Manana) [Orabug: 37074536] {CVE-2024-46751}
  - sctp: add mutual exclusion in proc_sctp_do_udp_port() (Eric Dumazet) [Orabug: 37844338] {CVE-2025-22062}
  - selftests/mm: compaction_test: support platform with huge mount of memory (Feng Tang)
  - usb: typec: fix pm usage counter imbalance in ucsi_ccg_sync_control() (Gong, Ruiqi)
  - usb: typec: fix potential array underflow in ucsi_ccg_sync_control() (Dan Carpenter) [Orabug: 37433551] {CVE-2024-53203}
  - usb: typec: altmodes/displayport: create sysfs nodes as driver's default device attribute group (Rd Babiera) [Orabug: 36642199] {CVE-2024-35790}
  - usb: typec: ucsi: displayport: Fix deadlock (Andrei Kuchynski) [Orabug: 37977019] {CVE-2025-37967}
  - clocksource/i8253: Use raw_spinlock_irqsave() in clockevent_i8253_disable() (Sebastian Andrzej Siewior)
  - block: fix direct io NOWAIT flag not work (Fengnan Chang)
  - dmaengine: idxd: fix memory leak in error handling path of idxd_setup_groups (Shuai Xue)
  - dmaengine: idxd: fix memory leak in error handling path of idxd_setup_engines (Shuai Xue)
  - dmaengine: ti: k3-udma: Use cap_mask directly from dma_device structure instead of a local copy (Yemike Abhilash Chandra)
  - dmaengine: ti: k3-udma: Add missing locking (Ronald Wahl) [Orabug: 38094757] {CVE-2025-38005}
  - wifi: mt76: disable napi on driver removal (Fedor Pchelkin) [Orabug: 38094771] {CVE-2025-38009}
  - phy: renesas: rcar-gen3-usb2: Set timing registers only once (Claudiu Beznea)
  - phy: Fix error handling in tegra_xusb_port_init (Ma Ke)
  - tracing: samples: Initialize trace_array_printk() with the correct function (Steven Rostedt)
  - ftrace: Fix preemption accounting for stacktrace filter command (Donglin Peng)
  - ftrace: Fix preemption accounting for stacktrace trigger command (Donglin Peng)
  - ALSA: usb-audio: Add sample rate quirk for Microdia JP001 USB Camera (Nicolas Chauvet)
  - ALSA: usb-audio: Add sample rate quirk for Audioengine D1 (Christian Heusel)
  - ALSA: es1968: Add error handling for snd_pcm_hw_constraint_pow2() (Xu Wang)
  - ACPI: PPTT: Fix processor subtable walk (Jeremy Linton)
  - btrfs: fix discard worker infinite loop after disabling discard (Filipe Manana)
  - dmaengine: Revert "dmaengine: dmatest: Fix dmatest waiting less when interrupted" (Nathan Lynch)
  - x86/its: FineIBT-paranoid vs ITS (Peter Zijlstra)
  - x86/speculation: Remove the extra #ifdef around CALL_NOSPEC (Pawan Gupta)
  - x86/speculation: Add a conditional CS prefix to CALL_NOSPEC (Pawan Gupta)
  - x86/speculation: Simplify and make CALL_NOSPEC consistent (Pawan Gupta)
  - x86,nospec: Simplify {JMP,CALL}_NOSPEC (Peter Zijlstra)
  - NFSv4/pnfs: Reset the layout state after a layoutreturn (Trond Myklebust)
  - qlcnic: fix memory leak in qlcnic_sriov_channel_cfg_cmd() (Abdun Nihaal)
  - ALSA: sh: SND_AICA should depend on SH_DMA_API (Geert Uytterhoeven)
  - net: dsa: sja1105: discard incoming frames in BR_STATE_LISTENING (Vladimir Oltean)
  - net: cadence: macb: Fix a possible deadlock in macb_halt_tx. (Mathieu Othacehe)
  - net_sched: Flush gso_skb list too during ->change() (Cong Wang) [Orabug: 37998129] {CVE-2025-37992}
  - spi: loopback-test: Do not split 1024-byte hexdumps (Geert Uytterhoeven)
  - nfs: handle failure of nfs_get_lock_context in unlock path (Li Lingfeng) [Orabug: 38094819] {CVE-2025-38023}
  - RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug (Zhu Yanjun) [Orabug: 38094828] {CVE-2025-38024}
  - iio: chemical: sps30: use aligned_s64 for timestamp (David Lechner)
  - iio: adc: ad7768-1: Fix insufficient alignment of timestamp. (Jonathan Cameron)
  - tracing: probes: Fix a possible race in trace_probe_log APIs (Masami Hiramatsu)
  - platform/x86: asus-wmi: Fix wlan_ctrl_by_user detection (Hans de Goede)
  - LTS version: v5.15.183 (Vijayendra Suman)
  - Revert "net: phy: microchip: force IRQ polling mode for lan88xx" (Greg Kroah-Hartman)
  - do_umount(): add missing barrier before refcount checks in sync case (Al Viro)
  - drm/panel: simple: Update timings for AUO G101EVN010 (Kevin Baker)
  - MIPS: Fix MAX_REG_OFFSET (Thorsten Blum)
  - iio: adc: dln2: Use aligned_s64 for timestamp (Jonathan Cameron)
  - types: Complement the aligned types with signed 64-bit one (Andy Shevchenko)
  - usb: usbtmc: Fix erroneous generic_read ioctl return (Dave Penkler)
  - usb: usbtmc: Fix erroneous wait_srq ioctl return (Dave Penkler)
  - usb: usbtmc: Fix erroneous get_stb ioctl error returns (Dave Penkler)
  - USB: usbtmc: use interruptible sleep in usbtmc_read (Oliver Neukum)
  - usb: typec: ucsi: displayport: Fix NULL pointer access (Andrei Kuchynski) [Orabug: 38015127] {CVE-2025-37994}
  - usb: typec: tcpm: delay SNK_TRY_WAIT_DEBOUNCE to SRC_TRYWAIT transition (Rd Babiera)
  - usb: host: tegra: Prevent host controller crash when OTG port is used (Jim Lin)
  - usb: gadget: tegra-xudc: ACK ST_RC after clearing CTRL_RUN (Wayne Chang)
  - usb: cdnsp: fix L1 resume issue for RTL_REVISION_NEW_LPM version (Pawel Laszczak)
  - usb: cdnsp: Fix issue with resuming from L1 (Pawel Laszczak)
  - ocfs2: stop quota recovery before disabling quotas (Jan Kara)
  - ocfs2: implement handshaking with ocfs2 recovery thread (Jan Kara)
  - ocfs2: switch osb->disable_recovery to enum (Jan Kara)
  - module: ensure that kobject_put() is safe for module type kobjects (Dmitry Antipov) [Orabug: 38015132] {CVE-2025-37995}
  - xenbus: Use kref to track req lifetime (Jason Andryuk) [Orabug: 37976935] {CVE-2025-37949}
  - usb: uhci-platform: Make the clock really optional (Alexey Charkov)
  - drm/amd/display: Fix wrong handling for AUX_DEFER case (Wayne Lin)
  - iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_tagged_fifo (Silvano Seva) [Orabug: 37977032] {CVE-2025-37969}
  - iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_fifo (Silvano Seva) [Orabug: 37977038] {CVE-2025-37970}
  - iio: adis16201: Correct inclinometer channel resolution (Gabriel)
  - iio: adc: ad7606: fix serial register access (Angelo Dureghello)
  - staging: axis-fifo: Correct handling of tx_fifo_depth for size validation (Gabriel)
  - staging: axis-fifo: Remove hardware resets for user errors (Gabriel)
  - staging: iio: adc: ad7816: Correct conditional logic for store mode (Gabriel)
  - Input: synaptics - enable InterTouch on TUXEDO InfinityBook Pro 14 v5 (Aditya Garg)
  - Input: synaptics - enable SMBus for HP Elitebook 850 G1 (Dmitry Torokhov)
  - Input: synaptics - enable InterTouch on Dell Precision M3800 (Aditya Garg)
  - Input: synaptics - enable InterTouch on Dynabook Portege X30L-G (Aditya Garg)
  - Input: synaptics - enable InterTouch on Dynabook Portege X30-D (Manuel Fombuena)
  - net: dsa: b53: fix learning on VLAN unaware bridges (Jonas Gorski)
  - net: dsa: b53: always rejoin default untagged VLAN on bridge leave (Jonas Gorski)
  - net: dsa: b53: fix VLAN ID for untagged vlan on bridge leave (Jonas Gorski)
  - net: dsa: b53: fix flushing old pvid VLAN on pvid change (Jonas Gorski)
  - net: dsa: b53: fix clearing PVID of a port (Jonas Gorski)
  - net: dsa: b53: allow leaky reserved multicast (Jonas Gorski)
  - netfilter: ipset: fix region locking in hash types (Jozsef Kadlecsik) [Orabug: 38015142] {CVE-2025-37997}
  - can: gw: fix RCU/BH usage in cgw_create_job() (Oliver Hartkopp)
  - can: gw: use call_rcu() instead of costly synchronize_rcu() (Eric Dumazet)
  - gre: Fix again IPv6 link-local address generation. (Guillaume Nault)
  - openvswitch: Fix unsafe attribute parsing in output_userspace() (Eelco Chaudron) [Orabug: 38015149] {CVE-2025-37998}
  - can: mcp251xfd: mcp251xfd_remove(): fix order of unregistration calls (Marc Kleine-Budde)
  - can: mcan: m_can_class_unregister(): fix order of unregistration calls (Marc Kleine-Budde)
  - LTS version: v5.15.182 (Vijayendra Suman)
  - dm: fix copying after src array boundaries (Tudor Ambarus)
  - iommu/arm-smmu-v3: Fix iommu_device_probe bug due to duplicated stream ids (Nicolin Chen)
  - iommu/arm-smmu-v3: Use the new rb tree helpers (Jason Gunthorpe)
  - irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode() (Suzuki K Poulose) [Orabug: 37930013] {CVE-2025-37819}
  - irqchip/gic-v2m: Mark a few functions __init (Thomas Gleixner)
  - irqchip/gic-v2m: Add const to of_device_id (Xiang Wangx)
  - Revert "drm/meson: vclk: fix calculation of 59.94 fractional rates" (Christian Hewitt)
  - net: phy: microchip: force IRQ polling mode for lan88xx (Fiona Klute)
  - ARM: dts: opos6ul: add ksz8081 phy properties (Sébastien Szymanski)
  - firmware: arm_scmi: Balance device refcount when destroying devices (Cristian Marussi) [Orabug: 37976753] {CVE-2025-37905}
  - net: hns3: fix deadlock issue when externel_lb and reset are executed together (Yonglong Liu)
  - of: module: add buffer overflow check in of_modalias() (Sergey Shtylyov) [Orabug: 36753381] {CVE-2024-38541}
  - PCI: imx6: Skip controller_id generation logic for i.MX7D (Richard Zhu)
  - net: hns3: defer calling ptp_clock_register() (Jian Shen)
  - net: hns3: fixed debugfs tm_qset size (Hao Lan)
  - net: hns3: fix an interrupt residual problem (Yonglong Liu)
  - net: hns3: add support for external loopback test (Yonglong Liu)
  - net: hns3: store rx VLAN tag offload state for VF (Jian Shen)
  - net: fec: ERR007885 Workaround for conventional TX (Mattias Barthel)
  - net: lan743x: Fix memleak issue when GSO enabled (Thangaraj Samynathan) [Orabug: 37976766] {CVE-2025-37909}
  - nvme-tcp: fix premature queue removal and I/O failover (Michael Liang)
  - bnxt_en: Fix ethtool -d byte order for 32-bit values (Michael Chan)
  - bnxt_en: Fix out-of-bound memcpy() during ethtool -w (Shruti Parab) [Orabug: 37976774] {CVE-2025-37911}
  - bnxt_en: Fix coredump logic to free allocated buffer (Shruti Parab)
  - net: ipv6: fix UDPv6 GSO segmentation with NAT (Felix Fietkau)
  - net: dlink: Correct endianness handling of led_mode (Simon Horman)
  - net_sched: qfq: Fix double list add in class with netem as child qdisc (Victor Nogueira) [Orabug: 37976784] {CVE-2025-37913}
  - net_sched: ets: Fix double list add in class with netem as child qdisc (Victor Nogueira) [Orabug: 37976789] {CVE-2025-37914}
  - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (Victor Nogueira) [Orabug: 37967411] {CVE-2025-37890}
  - net_sched: drr: Fix double list add in class with netem as child qdisc (Victor Nogueira) [Orabug: 37976793] {CVE-2025-37915}
  - net: ethernet: mtk-star-emac: rearm interrupts in rx_poll only when advised (Louis-Alexis Eyraud)
  - net: ethernet: mtk-star-emac: fix spinlock recursion issues on rx/tx poll (Louis-Alexis Eyraud)
  - net: ethernet: mtk-star-emac: separate tx/rx handling with two NAPIs (Biao Huang)
  - net/mlx5: E-switch, Fix error handling for enabling roce (Chris Mi)
  - net/mlx5: E-Switch, Initialize MAC Address for Default GID (Maor Gottlieb)
  - net/sched: act_mirred: don't override retval if we already lost the skb (Jakub Kicinski) [Orabug: 36530679] {CVE-2024-26739}
  - KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop (Sean Christopherson) [Orabug: 37685666] {CVE-2025-21839}
  - tracing: Fix oob write in trace_seq_to_buffer() (Jeongjun Park) [Orabug: 37976822] {CVE-2025-37923}
  - iommu/vt-d: Apply quirk_iommu_igfx for 8086:0044 (QM57/QS57) (Mingcong Bai)
  - iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid (Pavel Paklov) [Orabug: 37976837] {CVE-2025-37927}
  - dm: always update the array size in realloc_argv on success (Benjamin Marzinski)
  - dm-integrity: fix a warning on invalid table line (Mikulas Patocka)
  - wifi: brcm80211: fmac: Add error handling for brcmf_usb_dl_writeimage() (Xu Wang) [Orabug: 37977120] {CVE-2025-37990}
  - mmc: renesas_sdhi: Fix error handling in renesas_sdhi_probe (Ruslan Piasetskyi)
  - amd-xgbe: Fix to ensure dependent features are toggled with RX checksum offload (Vishal Badole)
  - parisc: Fix double SIGFPE crash (Helge Deller) [Orabug: 37977128] {CVE-2025-37991}
  - arm64: errata: Add missing sentinels to Spectre-BHB MIDR arrays (Will Deacon) [Orabug: 38071958] {CVE-2025-37929}
  - i2c: imx-lpi2c: Fix clock count when probe defers (Clark Wang)
  - EDAC/altera: Set DDR and SDMMC interrupt mask before registration (Niravkumar L Rabara)
  - EDAC/altera: Test the correct error reg offset (Niravkumar L Rabara)
  - drm/nouveau: Fix WARN_ON in nouveau_fence_context_kill() (Philipp Stanner) [Orabug: 37976851] {CVE-2025-37930}
  - ALSA: usb-audio: Add second USB ID for Jabra Evolve 65 headset (Joachim Priesner)
  - LTS version: v5.15.181 (Vijayendra Suman)
  - PCI: Release resource invalidated by coalescing (Ross Lagerwall)
  - PCI: Fix dropping valid root bus resources with .end = zero (Geert Uytterhoeven)
  - PCI: Fix use-after-free in pci_bus_release_domain_nr() (Rob Herring)
  - nvme: fixup scan failure for non-ANA multipath controllers (Hannes Reinecke)
  - MIPS: cm: Fix warning if MIPS_CM is disabled (Thomas Bogendoerfer)
  - xdp: Reset bpf_redirect_info before running a xdp's BPF prog. (Sebastian Andrzej Siewior)
  - drm/amd/display: fix double free issue during amdgpu module unload (Tim Huang) [Orabug: 37206238] {CVE-2024-49989}
  - net: dsa: mv88e6xxx: enable .port_set_policy() for 6320 family (Marek Behún)
  - net: dsa: mv88e6xxx: enable PVT for 6321 switch (Marek Behún)
  - net: dsa: mv88e6xxx: fix atu_move_port_mask for 6341 family (Marek Behún)
  - crypto: atmel-sha204a - Set hwrng quality to lowest possible (Marek Behún)
  - comedi: jr3_pci: Fix synchronous deletion of timer (Ian Abbott)
  - jfs: define xtree root and page independently (Dave Kleikamp)
  - md/raid1: Add check for missing source disk in process_checks() (Meir Elisha)
  - ubsan: Fix panic from test_ubsan_out_of_bounds (Mostafa Saleh)
  - loop: aio inherit the ioprio of original request (Yunlong Xing)
  - scsi: pm80xx: Set phy_attached to zero when device is gone (Igor Pylypiv)
  - scsi: hisi_sas: Fix I/O errors caused by hardware port ID changes (Xingui Yang)
  - ext4: make block validity check resistent to sb bh corruption (Ojaswin Mujoo)
  - nvmet-fc: put ref when assoc->del_work is already scheduled (Daniel Wagner)
  - nvmet-fc: take tgtport reference only once (Daniel Wagner)
  - x86/bugs: Don't fill RSB on context switch with eIBRS (Josh Poimboeuf)
  - x86/bugs: Don't fill RSB on VMEXIT with eIBRS+retpoline (Josh Poimboeuf)
  - x86/bugs: Use SBPB in write_ibpb() if applicable (Josh Poimboeuf)
  - selftests/mincore: Allow read-ahead pages to reach the end of the file (Qiuxu Zhuo)
  - objtool: Stop UNRET validation on UD2 (Josh Poimboeuf)
  - nvme: re-read ANA log page after ns scan completes (Hannes Reinecke)
  - ACPI PPTT: Fix coding mistakes in a couple of sizeof() calls (Jean-Marc Eurin)
  - nvme: requeue namespace scan on missed AENs (Hannes Reinecke)
  - xen: Change xen-acpi-processor dom0 dependency (Jason Andryuk)
  - selftests: ublk: fix test_stripe_04 (Ming Lei)
  - udmabuf: fix a buf size overflow issue during udmabuf creation (Xiaogang Chen) [Orabug: 37929938] {CVE-2025-37803}
  - KVM: s390: Don't use %pK through tracepoints (Thomas Weißschuh)
  - sched/isolation: Make CONFIG_CPU_ISOLATION depend on CONFIG_SMP (Oleg Nesterov)
  - ntb: reduce stack usage in idt_scan_mws (Arnd Bergmann)
  - qibfs: fix _another_ leak (Al Viro) [Orabug: 37977083] {CVE-2025-37983}
  - objtool, ASoC: codecs: wcd934x: Remove potential undefined behavior in wcd934x_slim_irq_handler() (Josh Poimboeuf)
  - usb: gadget: aspeed: Add NULL pointer check in ast_vhub_init_dev() (Chenyuan Yang) [Orabug: 37937503] {CVE-2025-37881}
  - usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running (Michał Pecio)
  - dmaengine: dmatest: Fix dmatest waiting less when interrupted (Vinicius Costa Gomes)
  - sound/virtio: Fix cancel_sync warnings on uninitialized work_structs (John Stultz) [Orabug: 37929953] {CVE-2025-37805}
  - usb: dwc3: gadget: Avoid using reserved endpoints on Intel Merrifield (Andy Shevchenko)
  - fs/ntfs3: Fix WARNING in ntfs_extend_initialized_size (Edward Adam Davis)
  - usb: host: max3421-hcd: Add missing spi_device_id table (Alexander Stein)
  - s390/tty: Fix a potential memory leak bug (Haoxiang Li)
  - s390/sclp: Add check for get_zeroed_page() (Haoxiang Li) [Orabug: 37937517] {CVE-2025-37883}
  - parisc: PDT: Fix missing prototype warning (Yu-Chun Lin)
  - clk: check for disabled clock-provider in of_clk_get_hw_from_clkspec() (Heiko Stuebner)
  - crypto: null - Use spin lock instead of mutex (Herbert Xu) [Orabug: 37929973] {CVE-2025-37808}
  - MIPS: cm: Detect CM quirks from device tree (Gregory Clement)
  - USB: wdm: add annotation (Oliver Neukum)
  - USB: wdm: wdm_wwan_port_tx_complete mutex in atomic context (Oliver Neukum)
  - USB: wdm: close race between wdm_open and wdm_wwan_port_stop (Oliver Neukum) [Orabug: 37977098] {CVE-2025-37985}
  - USB: wdm: handle IO errors in wdm_wwan_port_start (Oliver Neukum)
  - USB: VLI disk crashes if LPM is used (Oliver Neukum)
  - usb: quirks: Add delay init quirk for SanDisk 3.2Gen1 Flash Drive (Miao Li)
  - usb: quirks: add DELAY_INIT quirk for Silicon Motion Flash Drive (Miao Li)
  - usb: dwc3: gadget: check that event count does not exceed event buffer length (Frode Isaksen) [Orabug: 37929981] {CVE-2025-37810}
  - USB: OHCI: Add quirk for LS7A OHCI controller (rev 0x02) (Huacai Chen)
  - usb: chipidea: ci_hdrc_imx: implement usb_phy_init() error handling (Fedor Pchelkin)
  - usb: chipidea: ci_hdrc_imx: fix call balance of regulator routines (Fedor Pchelkin)
  - usb: cdns3: Fix deadlock when using NCM gadget (Ralph Siemsen) [Orabug: 37929988] {CVE-2025-37812}
  - USB: serial: simple: add OWON HDS200 series oscilloscope support (Craig Hesling)
  - USB: serial: option: add Sierra Wireless EM9291 (Adam Xue)
  - USB: serial: ftdi_sio: add support for Abacus Electrics Optical Probe (Michael Ehrenreich)
  - serial: sifive: lock port in startup()/shutdown() callbacks (Ryo Takakura)
  - KVM: x86: Reset IRTE to host control if *new* route isn't postable (Sean Christopherson) [Orabug: 37937535] {CVE-2025-37885}
  - mei: me: add panther lake H DID (Alexander Usyskin)
  - USB: storage: quirk for ADATA Portable HDD CH94 (Oliver Neukum)
  - mcb: fix a double free bug in chameleon_parse_gdd() (Haoxiang Li) [Orabug: 37930000] {CVE-2025-37817}
  - KVM: SVM: Allocate IR data using atomic allocation (Sean Christopherson)
  - drm/amd/display: Fix gpu reset in multidisplay config (Roman Li)
  - net: selftests: initialize TCP header and skb payload with zero (Oleksij Rempel)
  - virtio_console: fix missing byte order handling for cols and rows (Halil Pasic)
  - iommu/amd: Return an error if vCPU affinity is set for non-vCPU IRTE (Sean Christopherson)
  - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (Cong Wang) [Orabug: 37930028] {CVE-2025-37823}
  - net_sched: hfsc: Fix a UAF vulnerability in class handling (Cong Wang) [Orabug: 37908484] {CVE-2025-37797}
  - tipc: fix NULL pointer dereference in tipc_mon_reinit_self() (Tung Nguyen) [Orabug: 37930039] {CVE-2025-37824}
  - net: phy: leds: fix memory leak (Qingfang Deng) [Orabug: 37977112] {CVE-2025-37989}
  - cpufreq: cppc: Fix invalid return value in .get() callback (Marc Zyngier)
  - cpufreq: scpi: Fix null-ptr-deref in scpi_cpufreq_get_rate() (Henry Martin) [Orabug: 37930051] {CVE-2025-37829}
  - cpufreq: scmi: Fix null-ptr-deref in scmi_cpufreq_get_rate() (Henry Martin) [Orabug: 37930056] {CVE-2025-37830}
  - dma/contiguous: avoid warning about unused size_bytes (Arnd Bergmann)
  - drm/msm/a6xx: Fix stale rpmh votes from GPU (Akhil P Oommen)
  - drm/msm/a6xx: Avoid gx gbit halt during rpm suspend (Akhil P Oommen)
  - drm/msm/a6xx: Handle GMU prepare-slumber hfi failure (Akhil P Oommen)
  - drm/msm/a6xx: Improve gpu recovery sequence (Akhil P Oommen)
  - string: Add load_unaligned_zeropad() code path to sized_strscpy() (Peter Collingbourne)
  - kmsan: disable strscpy() optimization under KMSAN (Alexander Potapenko)
  - selftests/mm: generate a temporary mountpoint for cgroup filesystem (Mark Brown)
  - ksmbd: Prevent integer overflow in calculation of deadtime (Denis Arefev)
  - PCI: Fix reference leak in pci_register_host_bridge() (Ma Ke) [Orabug: 37937272] {CVE-2025-37836}
  - PCI: Assign PCI domain IDs by ida_alloc() (Pali Rohár)
  - PCI: Coalesce host bridge contiguous apertures (Kai-Heng Feng)
  - gpio: tegra186: fix resource handling in ACPI probe path (Guixin Liu)
  - cifs: fix integer overflow in match_server() (Roman Smirnov)
  - cifs: avoid NULL pointer dereference in dbg call (Alexandra Diupina) [Orabug: 37937310] {CVE-2025-37844}
  - cifs: print TIDs as hex (Enzo Matsumiya)
  - backlight: led_bl: Hold led_access lock when calling led_sysfs_disable() (Herve Codina) [Orabug: 37901610] {CVE-2025-23144}
  - backlight: led_bl: Convert to platform remove callback returning void (Uwe Kleine-König)
  - iio: adc: ad7768-1: Fix conversion result sign (Sergiu Cuciurean)
  - iio: adc: ad7768-1: Move setting of val a bit later to avoid unnecessary return value check (Jonathan Cameron)
  - soc: samsung: exynos-chipid: Add NULL pointer check in exynos_chipid_probe() (Chenyuan Yang) [Orabug: 37901625] {CVE-2025-23148}
  - soc: samsung: exynos-chipid: Pass revision reg offsets (Sam Protsenko)
  - soc: samsung: exynos-chipid: avoid soc_device_to_device() (Krzysztof Kozlowski)
  - net: dsa: mv88e6xxx: fix VTU methods for 6320 family (Marek Behún)
  - auxdisplay: hd44780: Fix an API misuse in hd44780.c (Haoxiang Li)
  - auxdisplay: hd44780: Convert to platform remove callback returning void (Uwe Kleine-König)
  - media: streamzap: fix race between device disconnection and urb callback (Murad Masimov) [Orabug: 37844171] {CVE-2025-22027}
  - media: streamzap: remove unused struct members (Sean Young)
  - media: streamzap: less chatter (Sean Young)
  - media: streamzap: no need for usb pid/vid in device name (Sean Young)
  - media: streamzap: remove unnecessary ir_raw_event_reset and handle (Sean Young)
  - module: sign with sha512 instead of sha1 by default (Thorsten Leemhuis)
  - Bluetooth: SCO: Fix UAF on sco_sock_timeout (Luiz Augusto von Dentz) [Orabug: 37252400] {CVE-2024-50125}
  - f2fs: Add inline to f2fs_build_fault_attr() stub (Nathan Chancellor)
  - pmdomain: ti: Add a null pointer check to the omap_prm_domain_init (Kunwu Chan) [Orabug: 36643315] {CVE-2024-35943}
  - f2fs: check validation of fault attrs in f2fs_build_fault_attr() (Chao Yu) [Orabug: 36897956] {CVE-2024-42160}
  - mm: fix apply_to_existing_page_range() (Kirill A. Shutemov)
  - fs/proc: do_task_stat: use sig->stats_lock to gather the threads/children stats (Oleg Nesterov) [Orabug: 36530401] {CVE-2024-26686}
  - drm/i915/gt: Cleanup partial engine discovery failures (Chris Wilson)
  - dm cache: fix flushing uninitialized delayed_work on cache_ctr error (Ming-Hung Tsai) [Orabug: 37298744] {CVE-2024-50280}
  - jfs: Fix shift-out-of-bounds in dbDiscardAG (Pei Li) [Orabug: 36993154] {CVE-2024-44938}
  - MIPS: ds1287: Match ds1287_set_base_clock() function types (Yuli Wang)
  - MIPS: cevt-ds1287: Add missing ds1287.h include (Yuli Wang)
  - MIPS: dec: Declare which_prom() as static (Yuli Wang)
  - net: defer final 'struct net' free in netns dismantle (Eric Dumazet) [Orabug: 37434229] {CVE-2024-56658}
  - scsi: ufs: bsg: Set bsg_queue to NULL after removal (Guixin Liu) [Orabug: 37649536] {CVE-2024-54458}
  - openvswitch: fix lockup on tx to unregistering netdev with carrier (Ilya Maximets) [Orabug: 38071902] {CVE-2025-21681}
  - net: openvswitch: fix race on port output (Felix Huettner)
  - ipvs: properly dereference pe in ip_vs_add_service (Chen Hanxiao) [Orabug: 36964418] {CVE-2024-42322}
  - ext4: fix timer use-after-free on failed mount (Xiaxi Shen) [Orabug: 37206114] {CVE-2024-49960}
  - blk-iocost: do not WARN if iocg was already offlined (Li Nan) [Orabug: 36683303] {CVE-2024-36908}
  - blk-cgroup: support to track if policy is online (Yu Kuai)
  - bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers (Hou Tao) [Orabug: 37283326] {CVE-2023-52621}
  - bpf: avoid holding freeze_mutex during mmap operation (Andrii Nakryiko) [Orabug: 37702062] {CVE-2025-21853}
  - sched/task_stack: fix object_is_on_stack() for KASAN tagged pointers (Qun-Wei Lin) [Orabug: 37388807] {CVE-2024-53128}
  - smb: client: fix potential UAF in cifs_stats_proc_show() (Paulo Alcantara) [Orabug: 36642549] {CVE-2024-35867}
  - smb: client: fix potential deadlock when releasing mids (Paulo Alcantara) [Orabug: 37283429] {CVE-2023-52757}
  - smb/server: fix potential null-ptr-deref of lease_ctx_info in smb2_open() (Chenxiaosong) [Orabug: 37074481] {CVE-2024-46742}
  - smb: client: fix NULL ptr deref in crypto_aead_setkey() (Paulo Alcantara) [Orabug: 38071970] {CVE-2024-53185}
  - smb: client: fix UAF in async decryption (Enzo Matsumiya) [Orabug: 37206489] {CVE-2024-50047}
  - cifs: Fix UAF in cifs_demultiplex_thread() (Zhang Xiaoxu) [Orabug: 36983926] {CVE-2023-52572}
  - smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (Paulo Alcantara)
  - ksmbd: fix potencial out-of-bounds when buffer offset is invalid (Namjae Jeon) [Orabug: 36596770] {CVE-2024-26952}
  - smb: client: fix potential UAF in cifs_dump_full_key() (Paulo Alcantara) [Orabug: 36642544] {CVE-2024-35866}
  - nvmet-fc: Remove unused functions (Yuli Wang)
  - landlock: Add the errata interface (Mickaël Salaün)
  - drm/amdgpu: fix usage slab after free (Vitaly Prosyak) [Orabug: 37433728] {CVE-2024-56551}
  - drm/amd/display: Add null checks for 'stream' and 'plane' before dereferencing (Srinivasan Shanmugam)
  - drm/amd/display: Fix out-of-bounds access in 'dcn21_link_encoder_create' (Srinivasan Shanmugam)
  - drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links (Hersen Wu) [Orabug: 37116370] {CVE-2024-46816}
  - wifi: ath10k: avoid NULL pointer error during sdio remove (Kang Yang) [Orabug: 37433947] {CVE-2024-56599}
  - phy: tegra: xusb: Fix return value of tegra_xusb_find_port_node function (Miaoqian Lin)
  - powerpc/rtas: Prevent Spectre v1 gadget construction in sys_rtas() (Nathan Lynch) [Orabug: 37074647] {CVE-2024-46774}
  - x86/pvh: Call C code via the kernel virtual mapping (Ard Biesheuvel)
  - net: mana: Fix error handling in mana_create_txq/rxq's NAPI cleanup (Souradeep Chakrabarti) [Orabug: 37074695] {CVE-2024-46784}
  - bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq (Michal Schmidt) [Orabug: 36753377] {CVE-2024-38540}
  - phonet/pep: fix racy skb_queue_empty() use (Remi Denis-Courmont) [Orabug: 36642006] {CVE-2024-27402}
  - filemap: Fix bounds checking in filemap_read() (Trond Myklebust) [Orabug: 37298710] {CVE-2024-50272}
  - net: fix crash when config small gso_max_size/gso_ipv4_max_size (Wang Liang) [Orabug: 37268692] {CVE-2024-50258}
  - ipv6: release nexthop on device removal (Paolo Abeni) [Orabug: 37434497] {CVE-2024-56751}
  - misc: pci_endpoint_test: Fix 'irq_type' to convey the correct type (Kunihiko Hayashi)
  - misc: pci_endpoint_test: Fix displaying 'irq_type' after 'request_irq' error (Kunihiko Hayashi)
  - misc: pci_endpoint_test: Avoid issue of interrupts remaining after request_irq error (Kunihiko Hayashi) [Orabug: 37901585] {CVE-2025-23140}
  - mptcp: sockopt: fix getting IPV6_V6ONLY (Matthieu Baerts)
  - kbuild: Add '-fno-builtin-wcslen' (Nathan Chancellor)
  - cpufreq: Reference count policy in cpufreq_update_limits() (Rafael J. Wysocki)
  - KVM: arm64: Eagerly switch ZCR_EL{1,2} (Mark Rutland)
  - KVM: arm64: Calculate cptr_el2 traps on activating traps (Fuad Tabba)
  - KVM: arm64: Remove VHE host restore of CPACR_EL1.ZEN (Mark Rutland)
  - KVM: arm64: Remove host FPSIMD saving for non-protected KVM (Mark Rutland)
  - KVM: arm64: Unconditionally save+flush host FPSIMD/SVE/SME state (Mark Rutland)
  - arm64/fpsimd: Stop using TIF_SVE to manage register saving in KVM (Mark Brown)
  - arm64/fpsimd: Have KVM explicitly say which FP registers to save (Mark Brown)
  - arm64/fpsimd: Track the saved FPSIMD state type separately to TIF_SVE (Mark Brown)
  - KVM: arm64: Discard any SVE state when entering KVM guests (Mark Brown)
  - KVM: arm64: Always start with clearing SVE flag on load (Marc Zyngier)
  - KVM: arm64: Get rid of host SVE tracking/saving (Mark Brown)
  - drm/sti: remove duplicate object names (Rolf Eike Beer)
  - drm/nouveau: prime: fix ttm_bo_delayed_delete oops (Chris Bainbridge) [Orabug: 37901817] {CVE-2025-37765}
  - drm/amdgpu/dma_buf: fix page_link check (Matthew Auld)
  - drm/amd/pm/powerplay/hwmgr/vega20_thermal: Prevent division by zero (Denis Arefev) [Orabug: 37901823,37901827,37901830,37901840,37901847] {CVE-2025-37766,CVE-2025-37767,CVE-2025-37768,CVE-2025-37770,CVE-2025-37771}
  - drm/amd/pm/swsmu/smu13/smu_v13_0: Prevent division by zero (Denis Arefev) [Orabug: 37901823,37901827,37901830,37901840,37901847] {CVE-2025-37766,CVE-2025-37767,CVE-2025-37768,CVE-2025-37770,CVE-2025-37771}
  - drm/amd/pm/powerplay/hwmgr/smu7_thermal: Prevent division by zero (Denis Arefev) [Orabug: 37901823,37901827,37901830,37901840,37901847] {CVE-2025-37766,CVE-2025-37767,CVE-2025-37768,CVE-2025-37770,CVE-2025-37771}
  - drm/amd/pm/powerplay: Prevent division by zero (Denis Arefev) [Orabug: 37901823,37901827,37901830,37901840,37901847] {CVE-2025-37766,CVE-2025-37767,CVE-2025-37768,CVE-2025-37770,CVE-2025-37771}
  - drm/amd/pm: Prevent division by zero (Denis Arefev) [Orabug: 37901823,37901827,37901830,37901840,37901847] {CVE-2025-37766,CVE-2025-37767,CVE-2025-37768,CVE-2025-37770,CVE-2025-37771}
  - drm/repaper: fix integer overflows in repeat functions (Nikita Zhandarovich)
  - perf/x86/intel/uncore: Fix the scale of IIO free running counters on SPR (Kan Liang)
  - perf/x86/intel/uncore: Fix the scale of IIO free running counters on ICX (Kan Liang)
  - perf/x86/intel/uncore: Fix the scale of IIO free running counters on SNR (Kan Liang)
  - perf/x86/intel: Allow to update user space GPRs from PEBS records (Dapeng Mi)
  - virtiofs: add filesystem context source name check (Xiangsheng Hou) [Orabug: 37901854] {CVE-2025-37773}
  - tracing: Fix filter string testing (Steven Rostedt)
  - riscv: Avoid fortify warning in syscall_get_arguments() (Nathan Chancellor)
  - mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Baoquan He)
  - loop: LOOP_SET_FD: send uevents for partitions (Thomas Weißschuh)
  - loop: properly send KOBJ_CHANGED uevent for disk device (Thomas Weißschuh)
  - isofs: Prevent the use of too small fid (Edward Adam Davis) [Orabug: 37901889] {CVE-2025-37780}
  - i2c: cros-ec-tunnel: defer probe if parent EC is not present (Thadeu Lima de Souza Cascardo) [Orabug: 37901896] {CVE-2025-37781}
  - hfs/hfsplus: fix slab-out-of-bounds in hfs_bnode_read_key (Vasiliy Kovalev)
  - crypto: caam/qi - Fix drv_ctx refcount bug (Herbert Xu)
  - btrfs: correctly escape subvol in btrfs_show_options() (Johannes Kimmel)
  - nfs: add missing selections of CONFIG_CRC32 (Eric Biggers)
  - nfs: move nfs_fhandle_hash to common include file (Jeff Layton)
  - asus-laptop: Fix an uninitialized variable (Denis Arefev)
  - ASoC: codecs:lpass-wsa-macro: Fix logic of enabling vi channels (Srinivas Kandagatla)
  - ASoC: codecs:lpass-wsa-macro: Fix vi feedback rate (Srinivas Kandagatla)
  - writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher)
  - riscv: KGDB: Remove ".option norvc/.option rvc" for kgdb_compiled_break (Yuli Wang)
  - riscv: KGDB: Do not inline arch_kgdb_breakpoint() (Yuli Wang)
  - riscv: Properly export reserved regions in /proc/iomem (Björn Töpel)
  - net: dsa: avoid refcount warnings when ds->ops->tag_8021q_vlan_del() fails (Vladimir Oltean)
  - net: dsa: mv88e6xxx: avoid unregistering devlink regions which were never registered (Vladimir Oltean) [Orabug: 37901916] {CVE-2025-37787}
  - net: b53: enable BPDU reception for management port (Jonas Gorski)
  - cxgb4: fix memory leak in cxgb4_init_ethtool_filters() error path (Abdun Nihaal) [Orabug: 37901919] {CVE-2025-37788}
  - net: openvswitch: fix nested key length validation in the set() action (Ilya Maximets) [Orabug: 37901922] {CVE-2025-37789}
  - net: mctp: Set SOCK_RCU_FREE (Matt Johnston) [Orabug: 37901929] {CVE-2025-37790}
  - igc: cleanup PTP module if probe fails (Christopher S Hall)
  - igc: handle the IGC_PTP_ENABLED flag correctly (Christopher S Hall)
  - igc: move ktime snapshot into PTM retry loop (Christopher S Hall)
  - igc: fix PTM cycle trigger logic (Christopher S Hall) [Orabug: 37937458] {CVE-2025-37875}
  - Revert "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" (Johannes Berg)
  - Bluetooth: l2cap: Check encryption key size on incoming connection (Frédéric Danis)
  - Bluetooth: btrtl: Prevent potential NULL dereference (Dan Carpenter) [Orabug: 37901933] {CVE-2025-37792}
  - Bluetooth: hci_event: Fix sending MGMT_EV_DEVICE_FOUND for invalid address (Luiz Augusto von Dentz)
  - RDMA/core: Silence oversized kvmalloc() warning (Shay Drory) [Orabug: 37937427] {CVE-2025-37867}
  - RDMA/hns: Fix wrong maximum DMA segment size (Chengchang Tang)
  - RDMA/usnic: Fix passing zero to PTR_ERR in usnic_ib_pci_probe() (Yue Haibing)
  - md/raid10: fix missing discard IO accounting (Yu Kuai)
  - scsi: iscsi: Fix missing scsi_host_put() in error path (Miaoqian Lin)
  - wifi: wl1251: fix memory leak in wl1251_tx_work (Abdun Nihaal) [Orabug: 37977075] {CVE-2025-37982}
  - wifi: mac80211: Purge vif txq in ieee80211_do_stop() (Remi Pommarel) [Orabug: 37901939] {CVE-2025-37794}
  - wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue() (Remi Pommarel)
  - wifi: at76c50x: fix use after free access in at76_disconnect (Abdun Nihaal) [Orabug: 37901952] {CVE-2025-37796}
  - scsi: hisi_sas: Enable force phy when SATA disk directly connected (Xingui Yang)
  - scsi: libsas: Add struct sas_tmf_task (John Garry)
  - scsi: libsas: Delete lldd_clear_aca callback (John Garry)
  - scsi: hisi_sas: Fix setting of hisi_sas_slot.is_internal (John Garry)
  - scsi: hisi_sas: Factor out task prep and delivery code (John Garry)
  - scsi: hisi_sas: Pass abort structure for internal abort (John Garry)
  - scsi: hisi_sas: Start delivery hisi_sas_task_exec() directly (John Garry)
  - Bluetooth: hci_uart: Fix another race during initialization (Arseniy Krasnov)
  - x86/e820: Fix handling of subpage regions when calculating nosave ranges in e820__register_nosave_regions() (Myrrh Periwinkle)
  - ACPI: platform-profile: Fix CFI violation when accessing sysfs files (Nathan Chancellor)
  - arm64: errata: Add newer ARM cores to the spectre_bhb_loop_affected() lists (Douglas Anderson)
  - HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition (Kaixin Wang) [Orabug: 37855340] {CVE-2025-37838}
  - pinctrl: qcom: Clear latched interrupt status when changing IRQ type (Stephan Gerhold)
  - PCI: Fix reference leak in pci_alloc_child_bus() (Ma Ke)
  - PCI: brcmstb: Fix missing of_node_put() in brcm_pcie_probe() (Stanimir Varbanov)
  - of/irq: Fix device node refcount leakages in of_irq_init() (Zijun Hu)
  - of/irq: Fix device node refcount leakage in API irq_of_parse_and_map() (Zijun Hu)
  - of/irq: Fix device node refcount leakages in of_irq_count() (Zijun Hu)
  - ntb: use 64-bit arithmetic for the MSI doorbell mask (Fedor Pchelkin)
  - gpio: zynq: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
  - ftrace: Add cond_resched() to ftrace_graph_set_hash() (Zhoumin) [Orabug: 37976892] {CVE-2025-37940}
  - dm-integrity: set ti->error on memory allocation failure (Mikulas Patocka)
  - crypto: ccp - Fix check for the primary ASP device (Tom Lendacky)
  - thermal/drivers/rockchip: Add missing rk3328 mapping entry (Trevor Woerner)
  - sctp: detect and prevent references to a freed transport in sendmsg (Ricardo Cañuelo Navarro) [Orabug: 37901596] {CVE-2025-23142}
  - mm/hwpoison: do not send SIGBUS to processes with recovered clean pages (Shuai Xue)
  - mm: add missing release barrier on PGDAT_RECLAIM_LOCKED unlock (Mathieu Desnoyers)
  - sparc/mm: disable preemption in lazy mmu mode (Ryan Roberts)
  - arm64: dts: mediatek: mt8173: Fix disp-pwm compatible string (Chen-Yu Tsai)
  - mtd: rawnand: Add status chack in r852_ready() (Xu Wang)
  - mtd: inftlcore: Add error check for inftl_read_oob() (Xu Wang) [Orabug: 37976719] {CVE-2025-37892}
  - mptcp: only inc MPJoinAckHMacFailure for HMAC failures (Matthieu Baerts)
  - mptcp: fix NULL pointer in can_accept_new_subflow (Gang Yan) [Orabug: 37901614] {CVE-2025-23145}
  - lib: scatterlist: fix sg_split_phys to preserve original scatterlist offsets (T Pratham)
  - locking/lockdep: Decrease nr_unused_locks if lock unused in zap_class() (Boqun Feng)
  - mfd: ene-kb3930: Fix a potential NULL pointer dereference (Chenyuan Yang) [Orabug: 37901617] {CVE-2025-23146}
  - jbd2: remove wrong sb->s_sequence check (Jan Kara) [Orabug: 37937282] {CVE-2025-37839}
  - i3c: Add NULL pointer check in i3c_master_queue_ibi() (Manjunatha Venkatesh) [Orabug: 37901621] {CVE-2025-23147}
  - i3c: master: svc: Use readsb helper for reading MDB (Stanley Chu)
  - vdpa/mlx5: Fix oversized null mkey longer than 32bit (Si-Wei Liu)
  - ext4: fix off-by-one error in do_split (Artem Sadovnikov) [Orabug: 37901630] {CVE-2025-23150}
  - bus: mhi: host: Fix race between unprepare and queue_buf (Jeffrey Hugo) [Orabug: 37901637] {CVE-2025-23151}
  - ASoC: qdsp6: q6asm-dai: fix q6asm_dai_compr_set_params error path (Alexey Klimov)
  - wifi: mac80211: fix integer overflow in hwmp_route_info_get() (Gavrilov Ilia)
  - wifi: mt76: Add check for devm_kstrdup() (Haoxiang Li)
  - clocksource/drivers/stm32-lptimer: Use wakeup capable instead of init wakeup (Alexandre Torgue)
  - mtd: Replace kcalloc() with devm_kcalloc() (Jiasheng Jiang)
  - net: dsa: mv88e6xxx: workaround RGMII transmit delay erratum for 6320 family (Marek Behún)
  - mtd: Add check for devm_kcalloc() (Jiasheng Jiang)
  - media: venus: hfi_parser: refactor hfi packet parsing logic (Vikash Garodia) [Orabug: 37901647] {CVE-2025-23156}
  - media: venus: hfi_parser: add check to avoid out of bound access (Vikash Garodia) [Orabug: 37901652] {CVE-2025-23157}
  - media: i2c: ov7251: Introduce 1 ms delay between regulators and en GPIO (Sakari Ailus)
  - media: i2c: ov7251: Set enable GPIO low in probe (Sakari Ailus)
  - media: i2c: ccs: Set the device's runtime PM status correctly in probe (Sakari Ailus)
  - media: i2c: ccs: Set the device's runtime PM status correctly in remove (Sakari Ailus)
  - media: v4l2-dv-timings: prevent possible overflow in v4l2_detect_gtf() (Karina Yankevich)
  - media: streamzap: prevent processing IR data on URB failure (Murad Masimov)
  - mtd: rawnand: brcmnand: fix PM resume warning (Kamal Dasu) [Orabug: 37937291] {CVE-2025-37840}
  - spi: cadence-qspi: Fix probe on AM62A LP SK (Miquel Raynal)
  - arm64: errata: Add KRYO 2XX/3XX/4XX silver cores to Spectre BHB safe list (Douglas Anderson)
  - arm64: errata: Assume that unknown CPUs _are_ vulnerable to Spectre BHB (Douglas Anderson)
  - arm64: errata: Add QCOM_KRYO_4XX_GOLD to the spectre_bhb_k24_list (Douglas Anderson)
  - arm64: cputype: Add MIDR_CORTEX_A76AE (Douglas Anderson)
  - xenfs/xensyms: respect hypervisor's "next" indication (Jan Beulich)
  - media: siano: Fix error handling in smsdvb_module_init() (Yuan Can)
  - media: vim2m: print device name after registering device (Matthew Majewski)
  - media: venus: hfi: add check to handle incorrect queue size (Vikash Garodia) [Orabug: 37901656] {CVE-2025-23158}
  - media: venus: hfi: add a check to handle OOB in sfr region (Vikash Garodia) [Orabug: 37901661] {CVE-2025-23159}
  - media: i2c: adv748x: Fix test pattern selection mask (Niklas Söderlund)
  - ext4: don't treat fhandle lookup of ea_inode as FS corruption (Jann Horn)
  - bpf: support SKF_NET_OFF and SKF_LL_OFF on skb frags (Willem de Bruijn)
  - bpf: Add endian modifiers to fix endian warnings (Ben Dooks)
  - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Uwe Kleine-König)
  - pwm: rcar: Improve register calculation (Uwe Kleine-König)
  - pwm: rcar: Simplify multiplication/shift logic (Geert Uytterhoeven)
  - pwm: mediatek: Prevent divide-by-zero in pwm_mediatek_config() (Josh Poimboeuf) [Orabug: 37937328] {CVE-2025-37850}
  - ktest: Fix Test Failures Due to Missing LOG_FILE Directories (Ayush Jain)
  - fbdev: omapfb: Add 'plane' value check (Leonid Arapov)
  - PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type (Ryo Takakura) [Orabug: 37901667] {CVE-2025-23161}
  - drm/mediatek: mtk_dpi: Explicitly manage TVD clock in power on/off (AngeloGioacchino Del Regno)
  - drm/amdkfd: Fix pqm_destroy_queue race with GPU reset (Philip Yang)
  - drm/amdkfd: clamp queue size to minimum (David Yat Sin)
  - drivers: base: devres: Allow to release group on device release (Lucas De Marchi)
  - drm/bridge: panel: forbid initializing a panel with unknown connector type (Luca Ceresoli)
  - drm: panel-orientation-quirks: Add new quirk for GPD Win 2 (Andrew Wyatt)
  - drm: panel-orientation-quirks: Add support for AYANEO 2S (Andrew Wyatt)
  - drm/amd/display: Update Cursor request mode to the beginning prefetch always (Zhikai Zhai)
  - drm: allow encoder mode_set even when connectors change for crtc (Abhinav Kumar)
  - Bluetooth: hci_uart: fix race during initialization (Arseniy Krasnov)
  - tracing: fix return value in __ftrace_event_enable_disable for TRACE_REG_UNREGISTER (Gabriele Paoloni)
  - net: vlan: don't propagate flags on open (Stanislav Fomichev) [Orabug: 37901683] {CVE-2025-23163}
  - wifi: mt76: mt76x2u: add TP-Link TL-WDN6200 ID to device table (Icenowy Zheng)
  - scsi: st: Fix array overflow in st_setup() (Kai Mäkisara) [Orabug: 37937378] {CVE-2025-37857}
  - ext4: ignore xattrs past end (Bhupesh) [Orabug: 37901690] {CVE-2025-37738}
  - ext4: protect ext4_release_dquot against freezing (Ojaswin Mujoo)
  - ahci: add PCI ID for Marvell 88SE9215 SATA Controller (Daniel Kral)
  - f2fs: fix to avoid out-of-bounds access in f2fs_truncate_inode_blocks() (Chao Yu) [Orabug: 37901700] {CVE-2025-37739}
  - ata: libata-eh: Do not use ATAPI DMA for a device limited to PIO mode (Niklas Cassel)
  - jfs: add sanity check for agwidth in dbMount (Edward Adam Davis) [Orabug: 37901706] {CVE-2025-37740}
  - jfs: Prevent copying of nlink with value 0 from disk inode (Edward Adam Davis) [Orabug: 37901715] {CVE-2025-37741}
  - fs/jfs: Prevent integer overflow in AG size calculation (Rand Deeb) [Orabug: 37937386] {CVE-2025-37858}
  - fs/jfs: cast inactags to s64 to prevent potential overflow (Rand Deeb)
  - jfs: Fix uninit-value access of imap allocated in the diMount() function (Zhongqiu Han) [Orabug: 37901723] {CVE-2025-37742}
  - page_pool: avoid infinite loop to schedule delayed worker (Jason Xing) [Orabug: 37937394] {CVE-2025-37859}
  - ALSA: usb-audio: Fix CME quirk for UF series keyboards (Ricard Wanderlof)
  - ASoC: fsl_audmix: register card device depends on 'dais' property (Shengjiu Wang)
  - ALSA: hda: intel: Fix Optimus when GPU has no sound (Maxim Mikityanskiy)
  - HID: pidff: Fix null pointer dereference in pidff_find_fields (Tomasz Pakuła) [Orabug: 37937409] {CVE-2025-37862}
  - HID: pidff: Do not send effect envelope if it's empty (Tomasz Pakuła)
  - HID: pidff: Convert infinite length from Linux API to PID standard (Tomasz Pakuła)
  - xen/mcelog: Add __nonstring annotations for unterminated strings (Kees Cook)
  - arm64: cputype: Add QCOM_CPU_PART_KRYO_3XX_GOLD (Douglas Anderson)
  - perf: arm_pmu: Don't disable counter in armpmu_add() (Mark Rutland)
  - x86/cpu: Don't clear X86_FEATURE_LAHF_LM flag in init_amd_k8() on AMD when running in a virtual machine (Max Grobecker)
  - pm: cpupower: bench: Prevent NULL dereference on malloc failure (Zhongqiu Han) [Orabug: 37937296] {CVE-2025-37841}
  - umount: Allow superblock owners to force umount (Trond Myklebust)
  - nft_set_pipapo: fix incorrect avx2 match of 5th field octet (Florian Westphal)
  - net: ppp: Add bound checking for skb data on ppp_sync_txmung (Arnaud Lecomte) [Orabug: 37901765] {CVE-2025-37749}
  - nvmet-fcloop: swap list_add_tail arguments (Daniel Wagner)
  - ata: sata_sx4: Add error handling in pdc20621_i2c_read() (Xu Wang)
  - ata: sata_sx4: Drop pointless VPRINTK() calls and convert the remaining ones (Hannes Reinecke)
  - net: ethtool: Don't call .cleanup_data when prepare_data fails (Maxime Chevallier)
  - net: tls: explicitly disallow disconnect (Jakub Kicinski) [Orabug: 37901782] {CVE-2025-37756}
  - tipc: fix memory leak in tipc_link_xmit (Tung Nguyen) [Orabug: 37901789] {CVE-2025-37757}
  - ata: pata_pxa: Fix potential NULL pointer dereference in pxa_ata_probe() (Henry Martin) [Orabug: 37901795] {CVE-2025-37758}


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-310.184.3.el9uek]
changelog:
  - x86/its: Fix undefined reference to cpu_wants_rethunk_at() (Pawan Gupta)
  - padata: do not leak refcount in reorder_work (Dominik Grzegorzek) [Orabug: 38094844] {CVE-2025-38031}
  - Revert "drm/amd: Keep display off while going into S4" (Mario Limonciello)
  - memcg: always call cond_resched() after fn() (Breno Leitao)
  - lib: cpu_rmap: Use allocator for rmap entries (Eli Cohen) [Orabug: 38037237]
  - uek-rpm: build the fwctl mlx5 driver on UEK (Qing Huang) [Orabug: 37810637]
  - fwctl: Adapt upstream code for UEK7 (Mikhael Goikhman) [Orabug: 37810637]
  - mlx5: Create an auxiliary device for fwctl_mlx5 (Saeed Mahameed) [Orabug: 37810637]
  - fwctl/mlx5: Support for communicating with mlx5 fw (Saeed Mahameed) [Orabug: 37810637]
  - fwctl: Add documentation (Jason Gunthorpe) [Orabug: 37810637]
  - fwctl: FWCTL_RPC to execute a Remote Procedure Call to device firmware (Jason Gunthorpe) [Orabug: 37810637]
  - taint: Add TAINT_FWCTL (Jason Gunthorpe) [Orabug: 37810637]
  - fwctl: FWCTL_INFO to return basic information about the device (Jason Gunthorpe) [Orabug: 37810637]
  - fwctl: Basic ioctl dispatch for the character device (Jason Gunthorpe) [Orabug: 37810637]
  - fwctl: Add basic structure for a class subsystem with a cdev (Jason Gunthorpe) [Orabug: 37810637]
  - net/mlx5: Add IFC related stuff for data direct (Yishai Hadas) [Orabug: 37810637]
  - Documentation: Add detailed explanation for 'N' taint flag (Benjamin Poirier) [Orabug: 37810637]
  - kernel/panic: initialize taint_flags[] using a macro (Jani Nikula) [Orabug: 37810637]
  - kernel/panic: return early from print_tainted() when not tainted (Jani Nikula) [Orabug: 37810637]
  - tools: Add new "test" taint to kernel-chktaint (Joe Fradley) [Orabug: 37810637]
  - panic: use error_report_end tracepoint on warnings (Marco Elver) [Orabug: 37810637]
  - Revert "fwctl: Add basic structure for a class subsystem with a cdev" (Qing Huang) [Orabug: 37810637]
  - Revert "fwctl: Basic ioctl dispatch for the character device" (Qing Huang) [Orabug: 37810637]
  - Revert "fwctl: FWCTL_INFO to return basic information about the device" (Qing Huang) [Orabug: 37810637]
  - Revert "fwctl: FWCTL_RPC to execute a Remote Procedure Call to device firmware" (Qing Huang) [Orabug: 37810637]
  - Revert "fwctl/mlx5: Support for communicating with mlx5 fw" (Qing Huang) [Orabug: 37810637]
  - Revert "mlx5: Create an auxiliary device for fwctl_mlx5" (Qing Huang) [Orabug: 37810637]
  - Revert "taint: Add TAINT_FWCTL" (Qing Huang) [Orabug: 37810637]
  - Revert "fwctl: Adapt code for UEK7" (Qing Huang) [Orabug: 37810637]
  - Revert "fwctl/mlx5: Add INTERNAL_DEV_RES uctx capability" (Qing Huang) [Orabug: 37810637]
  - Revert "fwctl: Allow up to 4k devices" (Qing Huang) [Orabug: 37810637]
  - Revert "fwctl: Expand adaption of code for UEK7" (Qing Huang) [Orabug: 37810637]
  - Revert "uek-rpm: build the fwctl mlx5 driver on UEK" (Qing Huang) [Orabug: 37810637]


author: Brian Maly <brian.maly@oracle.com> [5.15.0-310.184.4.el9uek]
changelog:
  - vhost-scsi: Fix log flooding with target does not exist errors (Mike Christie) [Orabug: 37424174]
  - mm: do not write protect COW mappings when preserving across exec (Anthony Yznaga) [Orabug: 37734242]
  - mm: hold the source mmap write lock when copying PTEs (Anthony Yznaga) [Orabug: 37734242]
  - uek-rpm: Bluefield 3: Enable CONFIG_CONTIG_ALLOC (Thomas Tai) [Orabug: 38067846]
  - mm: shmem: remove unnecessary warning in shmem_writepage() (Ricardo Cañuelo Navarro) [Orabug: 38091965]
  - shmem: add support to ignore swap (Luis Chamberlain) [Orabug: 38091965]
  - shmem: update documentation (Luis Chamberlain) [Orabug: 38091965]
  - shmem: skip page split if we're not reclaiming (Luis Chamberlain) [Orabug: 38091965]
  - shmem: move reclaim check early on writepages() (Luis Chamberlain) [Orabug: 38091965]
  - shmem: set shmem_writepage() variables early (Luis Chamberlain) [Orabug: 38091965]
  - shmem: remove check for folio lock on writepage() (Luis Chamberlain) [Orabug: 38091965]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-310.184.5.el9uek]
changelog:
  - sched/numa: skip VMA scanning on memory pinned to one NUMA node via cpuset.mems (Libo Chen)  [Orabug: 38070120]
  - bridge: netfilter: Fix forwarding of fragmented packets (Ido Schimmel)  [Orabug: 38069363]
  - Revert "net: bridge: IP defragmentation failing for jumboframes" (Venkat Venkatsubra)  [Orabug: 38069363]
  - vhost-scsi: Change def inline_sg_cnt and max_io_vqs for exadata (Mike Christie)  [Orabug: 38053186]
  - rds: ib: Add cm_id generation scheme in order to detect new ones (Håkon Bugge)  [Orabug: 37799170]
  - Revert "i2c: designware: Fix corrupted memory seen in the ISR" (Vijay Kumar)  [Orabug: 37771338]
  - ipmi:ssif: Improve detecting during probing (Corey Minyard)  [Orabug: 37771338]
  - ipmi: ssif: replace strlcpy with strscpy (Jason Wang)  [Orabug: 37771338]
  - uek-rpm: Enable CONFIG_SERIAL_RP2 as m (Samasth Norway Ananda)  [Orabug: 37459981]
  - serial: update the rp2 driver code (Samasth Norway Ananda)  [Orabug: 37459981]


author: Jack Vogel <jack.vogel@oracle.com> [5.15.0-310.184.5.1.el9uek]
changelog:
  - Add Zen34 clients (Borislav Petkov (AMD))  [Orabug: 38023240]  {CVE-2024-36350} {CVE-2024-36357}
  - x86/process: Move the buffer clearing before MONITOR (Kim Phillips)  [Orabug: 38023240]  {CVE-2024-36350} {CVE-2024-36357}
  - Add normal counters (Borislav Petkov (AMD))  [Orabug: 38023240]  {CVE-2024-36350} {CVE-2024-36357}
  - KVM: SVM: Advertize TSA CPUID bits to guests (Borislav Petkov (AMD))  [Orabug: 38023240]  {CVE-2024-36350} {CVE-2024-36357}
  - x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov (AMD))  [Orabug: 38023240]  {CVE-2024-36350} {CVE-2024-36357}
  - x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov (AMD))  [Orabug: 38023240]  {CVE-2024-36350} {CVE-2024-36357}
  - x86/CPU/AMD: Add ZenX generations flags (Borislav Petkov (AMD))  [Orabug: 38023240]  {CVE-2024-36350} {CVE-2024-36357}
  - x86/bugs: Free X86_BUG_AMD_APIC_C1E and X86_BUG_AMD_E400 bits (Boris Ostrovsky)  [Orabug: 38023240]  {CVE-2024-36350} {CVE-2024-36357}


author: Brian Maly <brian.maly@oracle.com> [5.15.0-310.184.5.2.el9uek]
changelog:
  - sunrpc: handle SVC_GARBAGE during svc auth processing as auth error (Jeff Layton)   {CVE-2025-38089} 
  - net_sched: sch_sfq: move the limit validation (Octavian Purdila)   {CVE-2025-37752} 
  - net_sched: sch_sfq: use a temporary work area for validating configuration (Octavian Purdila)   
  - net_sched: sch_sfq: don't allow 1 packet limit (Octavian Purdila)   
  - net_sched: sch_sfq: handle bigger packets (Eric Dumazet)   
  - net_sched: sch_sfq: annotate data-races around q->perturb_period (Eric Dumazet)   
  - block: assign bi_bdev for cloned bios in blk_rq_prep_clone (Christoph Hellwig)  [Orabug: 37931495]  
  - fs/proc: do_task_stat: use __for_each_thread() (Oleg Nesterov)  [Orabug: 38081922]


author: Brian Maly <brian.maly@oracle.com> [5.15.0-310.184.5.2.el9uek]
changelog:
  - sunrpc: handle SVC_GARBAGE during svc auth processing as auth error (Jeff Layton)   {CVE-2025-38089}
  - net_sched: sch_sfq: move the limit validation (Octavian Purdila)   {CVE-2025-37752}
  - net_sched: sch_sfq: use a temporary work area for validating configuration (Octavian Purdila)
  - net_sched: sch_sfq: don't allow 1 packet limit (Octavian Purdila)
  - net_sched: sch_sfq: handle bigger packets (Eric Dumazet)
  - net_sched: sch_sfq: annotate data-races around q->perturb_period (Eric Dumazet)
  - block: assign bi_bdev for cloned bios in blk_rq_prep_clone (Christoph Hellwig)  [Orabug: 37931495]
  - fs/proc: do_task_stat: use __for_each_thread() (Oleg Nesterov)  [Orabug: 38081922]


author: Brian Maly <brian.maly@oracle.com> [5.15.0-310.184.5.3.el9uek]
changelog:
  - nfs: clear SB_RDONLY before getting superblock (Li Lingfeng)   
  - nfs: ignore SB_RDONLY when remounting nfs (Li Lingfeng)  [Orabug: 38258810]  
  - net/rds: poll eq during user-reset (Praveen Kumar Kannoju)  [Orabug: 38258827]  
  - net/mlx5: Add poll-eq API to be used by ULP's (Praveen Kumar Kannoju)  [Orabug: 38258830]  
  - vhost-scsi: Fix vhost_scsi struct use after free (Mike Christie)  [Orabug: 38258837]  
  - net/mlx5: set graceful_period to 0 to allow multiple transmission queue recovery (Praveen Kumar Kannoju)  [Orabug: 38258844]  
  - x86: Pin task-stack in __get_wchan() (Peter Zijlstra)  [Orabug: 38258846]  
  - x86: Fix __get_wchan() for !STACKTRACE (Peter Zijlstra)  [Orabug: 38258846]  
  - sched: Add wrapper for get_wchan() to keep task blocked (Kees Cook)  [Orabug: 38258846]  
  - x86: Fix get_wchan() to support the ORC unwinder (Qi Zheng)  [Orabug: 38258846]  
  - mm: synchronise PGD in x86 when utilising dax vmemmap optimisation (Lorenzo Stoakes)  [Orabug: 38258866]  
  - rds: ib: Make sure a QP in INIT state is transitioned to ERR (Håkon Bugge)  [Orabug: 38258860]  
  - Reapply "rds: ib: Make sure receives are posted before connection is up" (Håkon Bugge)  [Orabug: 38258860]  
  - KVM: x86: revert APICV_INHIBIT_REASON_APIC_ID_MODIFIED clear path for uek=exadata (Dongli Zhang)  [Orabug: 38258871]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-311.184.1.el9uek]
changelog:
  - net/rds: tracepoints for rds_conn_kref_get and put (Sharath Srinivasan)  [Orabug: 38118655]
  - net/rds: Add krefs to struct rds_connection (Sharath Srinivasan)  [Orabug: 38118655]
  - net/rds: Add missing switch/break in rds_recv_worker() (Sharath Srinivasan)  [Orabug: 38118668]
  - net/mlx5: Expose ICM consumption per function (Akiva Goldberger)  [Orabug: 38063298]
  - net/mlx5: Rename and move mlx5_esw_query_vport_vhca_id (Akiva Goldberger)  [Orabug: 38063298]
  - net/mlx5: Add nic_cap_reg and vhca_icm_ctrl registers (Akiva Goldberger)  [Orabug: 38063298]
  - KVM: x86: revert APICV_INHIBIT_REASON_APIC_ID_MODIFIED clear path for uek=exadata (Dongli Zhang)  [Orabug: 37944981]
  - arm64: pensando: kpcimgr: Support PSCI and XEN (Rob Gardner)  [Orabug: 37911761]
  - arm64: pensando: Add PL011 serial to config for XEN (Rob Gardner)  [Orabug: 37911761]
  - net/rds: Merge uses of conn->c_destroy_in_prog & RDS_DESTROY_PENDING (Sharath Srinivasan)  [Orabug: 35519912]
  - net_sched: sch_sfq: don't allow 1 packet limit (Octavian Purdila)  [Orabug: 37649663]  {CVE-2024-57996}
  - net_sched: sch_sfq: handle bigger packets (Eric Dumazet)  [Orabug: 38139143]
  - net_sched: sch_sfq: annotate data-races around q->perturb_period (Eric Dumazet)  [Orabug: 38139143]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-311.185.2.el9uek]
changelog:
  - Revert "x86/bugs: Make spectre user default depend on MITIGATION_SPECTRE_V2" on v6.6 and older (Breno Leitao)
  - Revert "cpufreq: tegra186: Share policy per cluster" (Jon Hunter)
  - net: tipc: fix refcount warning in tipc_aead_encrypt (Charalampos Mitrodimas)
  - tracing: Fix compilation warning on arm32 (Pan Taixi)
  - PM: sleep: Fix power.is_suspended cleanup for direct-complete devices (Rafael J. Wysocki)
  - nfs: clear SB_RDONLY before getting superblock (Li Lingfeng)
  - usb: usbtmc: Fix read_stb function and get_stb ioctl (Dave Penkler)
  - acpi-cpufreq: Fix nominal_freq units to KHz in get_max_boost_ratio() (Gautham R. Shenoy)
  - LTS version: v5.15.185 (Vijayendra Suman)
  - perf/arm-cmn: Initialise cmn->cpu earlier (Robin Murphy)
  - platform/x86: thinkpad_acpi: Ignore battery threshold change event notification (Mark Pearson)
  - platform/x86: fujitsu-laptop: Support Lifebook S2110 hotkeys (Valtteri Koskivuori)
  - tpm: tis: Double the timeout B to 4s (Michal Suchanek)
  - nvme-pci: add NVME_QUIRK_NO_DEEPEST_PS quirk for SOLIDIGM P44 Pro (Ilya Guterman)
  - spi: spi-sun4i: fix early activation (Alessandro Grassi)
  - um: let 'make clean' properly clean underlying SUBARCH as well (Masahiro Yamada)
  - platform/x86: thinkpad_acpi: Support also NEC Lavie X1475JAS (John Chau)
  - nfs: don't share pNFS DS connections between net namespaces (Jeff Layton)
  - HID: quirks: Add ADATA XPG alpha wireless mouse support (Milton Barrera)
  - coredump: hand a pidfd to the usermode coredump helper (Christian Brauner)
  - fork: use pidfd_prepare() (Christian Brauner)
  - pid: add pidfd_prepare() (Christian Brauner)
  - coredump: fix error handling for replace_fd() (Christian Brauner)
  - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Pedro Tammela)
  - arm64: dts: qcom: sm8350: Fix typo in pil_camera_mem node (Alok Tiwari)
  - smb: client: Reset all search buffer pointers when releasing buffer (Wang Zhaolong)
  - smb: client: Fix use-after-free in cifs_fill_dirent (Wang Zhaolong)
  - drm/i915/gvt: fix unterminated-string-initialization warning (Jani Nikula)
  - xen/swiotlb: relax alignment requirements (Juergen Gross)
  - i3c: master: svc: Fix implicit fallthrough in svc_i3c_master_ibi_work() (Nathan Chancellor)
  - kbuild: Disable -Wdefault-const-init-unsafe (Nathan Chancellor)
  - spi: spi-fsl-dspi: Reset SR flags before sending a new message (Larisa Grigore)
  - spi: spi-fsl-dspi: Halt the module after a new message transfer (Bogdan-Gabriel Roman)
  - spi: spi-fsl-dspi: restrict register range for regmap access (Larisa Grigore)
  - Revert "arm64: dts: allwinner: h6: Use RSB for AXP805 PMIC connection" (Jernej Skrabec)
  - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Tianyang Zhang)
  - drm/edid: fixed the bug that hdr metadata was not reset (feijuan.li)
  - platform/x86: dell-wmi-sysman: Avoid buffer overflow in current_password_store() (Vladimir Moskovkin)
  - llc: fix data loss when reading from a socket in llc_ui_recvmsg() (Ilia Gavrilov)
  - ALSA: pcm: Fix race of buffer access at PCM OSS layer (Takashi Iwai)
  - can: bcm: add missing rcu read protection for procfs content (Oliver Hartkopp)
  - can: bcm: add locking for bcm_op runtime updates (Oliver Hartkopp)
  - crypto: algif_hash - fix double free in hash_accept (Ivan Pravdin)
  - octeontx2-af: Set LMT_ENA bit for APR table entries (Subbaraya Sundeep)
  - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (Wang Liang)
  - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (Cong Wang)
  - net: dwmac-sun8i: Use parsed internal PHY address instead of 1 (Paul Kocialkowski)
  - Bluetooth: L2CAP: Fix not checking l2cap_chan security level (Luiz Augusto von Dentz)
  - xfrm: Sanitize marks before insert (Paul Chaignon)
  - remoteproc: qcom_wcnss: Fix on platforms without fallback regulators (Matti Lehtimäki)
  - __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock (Al Viro)
  - xenbus: Allow PVH dom0 a non-local xenstore (Jason Andryuk)
  - btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref (Goldwyn Rodrigues)
  - nvmet-tcp: don't restore null sk_state_change (Alistair Francis)
  - ALSA: hda/realtek: Add quirk for HP Spectre x360 15-df1xxx (Takashi Iwai)
  - ASoC: Intel: bytcr_rt5640: Add DMI quirk for Acer Aspire SW3-013 (Takashi Iwai)
  - pinctrl: meson: define the pull up/down resistor value as 60 kOhm (Martin Blumenstingl)
  - ASoC: imx-card: Adjust over allocation of memory in imx_card_parse_of() (Chenyuan Yang)
  - drm: Add valid clones check (Jessica Zhang)
  - drm/atomic: clarify the rules around drm_atomic_state->allow_modeset (Simona Vetter)
  - wifi: ath9k: return by of_get_mac_address (Rosen Penev)
  - regulator: ad5398: Add device tree support (Isaac Scott)
  - spi: zynqmp-gqspi: Always acknowledge interrupts (Sean Anderson)
  - wifi: rtw88: Don't use static local variable in rtw8822b_set_tx_power_index_by_rate (Bitterblue Smith)
  - perf/amd/ibs: Fix perf_ibs_op.cnt_mask for CurCnt (Ravi Bangoria)
  - bpftool: Fix readlink usage in get_fd_type (Viktor Malik)
  - drm/ast: Find VBIOS mode from regular display size (Thomas Zimmermann)
  - HID: usbkbd: Fix the bit shift number for LED_KANA (junan)
  - scsi: st: Restore some drive settings after reset (Kai Mäkisara)
  - scsi: lpfc: Handle duplicate D_IDs in ndlp search-by D_ID routine (Justin Tee)
  - net/mana: fix warning in the writer of client oob (Konstantin Taranov)
  - rcu: fix header guard for rcu_all_qs() (Ankur Arora)
  - rcu: handle quiescent states for PREEMPT_RCU=n, PREEMPT_COUNT=y (Ankur Arora)
  - r8169: don't scan PHY addresses > 0 (Heiner Kallweit)
  - vxlan: Annotate FDB data races (Ido Schimmel)
  - media: qcom: camss: csid: Only add TPG v4l2 ctrl if TPG hardware is available (Depeng Shao)
  - hwmon: (xgene-hwmon) use appropriate type for the latency value (Andrey Vatoropin)
  - clk: qcom: camcc-sm8250: Use clk_rcg2_shared_ops for some RCGs (Jordan Crouse)
  - wifi: rtw88: Fix download_firmware_validate() for RTL8814AU (Bitterblue Smith)
  - r8152: add vendor/device ID pair for Dell Alienware AW1022z (Aleksander Jan Bajkowski)
  - ip: fib_rules: Fetch net from fib_rule in fib[46]_rule_configure(). (Kuniyuki Iwashima)
  - arch/powerpc/perf: Check the instruction type before creating sample with perf_mem_data_src (Athira Rajeev)
  - wifi: mac80211: remove misplaced drv_mgd_complete_tx() call (Johannes Berg)
  - wifi: mac80211: don't unconditionally call drv_mgd_complete_tx() (Johannes Berg)
  - net/mlx5e: reduce rep rxq depth to 256 for ECPF (William Tu)
  - net/mlx5e: set the tx_queue_len for pfifo_fast (William Tu)
  - net/mlx5: Extend Ethtool loopback selftest to support non-linear SKB (Alexei Lazar)
  - drm/amd/display: Initial psr_version with correct setting (Tom Chung)
  - drm/amdgpu: reset psp->cmd to NULL after releasing the buffer (Jiang Liu)
  - phy: core: don't require set_mode() callback for phy_get_mode() to work (Dmitry Baryshkov)
  - net/mlx4_core: Avoid impossible mlx4_db_alloc() order value (Kees Cook)
  - media: v4l: Memset argument to 0 before calling get_mbus_config pad op (Sakari Ailus)
  - smack: recognize ipv4 CIPSO w/o categories (Konstantin Andreev)
  - pinctrl: devicetree: do not goto err when probing hogs in pinctrl_dt_to_map (Valentin Caron)
  - ASoC: soc-dai: check return value at snd_soc_dai_set_tdm_slot() (Kuninori Morimoto)
  - ASoC: tas2764: Power up/down amp on mute ops (Hector Martin)
  - ASoC: ops: Enforce platform maximum on initial value (Martin Povišer)
  - net/mlx5: Apply rate-limiting to high temperature warning (Shahar Shitrit)
  - net/mlx5: Modify LSB bitmask in temperature event to include only the first bit (Shahar Shitrit)
  - ACPI: HED: Always initialize before evged (Xiaofei Tan)
  - PCI: Fix old_size lower bound in calculate_iosize() too (Ilpo Järvinen)
  - eth: mlx4: don't try to complete XDP frames in netpoll (Jakub Kicinski)
  - can: c_can: Use of_property_present() to test existence of DT property (Krzysztof Kozlowski)
  - RDMA/core: Fix best page size finding when it can cross SG entries (Michael Margolin)
  - EDAC/ie31200: work around false positive build warning (Arnd Bergmann)
  - net: pktgen: fix access outside of user given buffer in pktgen_thread_write() (Peter Seiderer)
  - wifi: rtw88: Fix rtw_desc_to_mcsrate() to handle MCS16-31 (Bitterblue Smith)
  - wifi: rtw88: Fix rtw_init_ht_cap() for RTL8814AU (Bitterblue Smith)
  - wifi: rtw88: Fix rtw_init_vht_cap() for RTL8814AU (Bitterblue Smith)
  - scsi: mpt3sas: Send a diag reset if target reset fails (Shivasharan S)
  - clocksource: mips-gic-timer: Enable counter when CPUs start (Paul Burton)
  - MIPS: pm-cps: Use per-CPU variables as per-CPU, not per-core (Paul Burton)
  - MIPS: Use arch specific syscall name match function (Bibo Mao)
  - x86/kaslr: Reduce KASLR entropy on most x86 systems (Balbir Singh)
  - libbpf: Fix out-of-bound read (Nandakumar Edamana)
  - cpuidle: menu: Avoid discarding useful information (Rafael J. Wysocki)
  - x86/nmi: Add an emergency handler in nmi_desc & use it in nmi_shootdown_cpus() (Waiman Long)
  - drm/amd/display: handle max_downscale_src_width fail check (Yihan Zhu)
  - x86/build: Fix broken copy command in genimage.sh when making isoimage (Nir Lichtman)
  - soc: ti: k3-socinfo: Do not use syscon helper to build regmap (Andrew Davis)
  - bonding: report duplicate MAC address in all situations (Hangbin Liu)
  - net: xgene-v2: remove incorrect ACPI_PTR annotation (Arnd Bergmann)
  - drm/amdkfd: KFD release_work possible circular locking (Philip Yang)
  - selftests/net: have `gro.sh -t` return a correct exit code (Kevin Krakauer)
  - net/mlx5: Avoid report two health errors on same syndrome (Moshe Shemesh)
  - firmware: arm_ffa: Set dma_mask for ffa devices (Viresh Kumar)
  - PCI: brcmstb: Add a softdep to MIP MSI-X driver (Stanimir Varbanov)
  - PCI: brcmstb: Expand inbound window size up to 64GB (Stanimir Varbanov)
  - fpga: altera-cvp: Increase credit timeout (Kuhanh Murugasen Krishnan)
  - drm/mediatek: mtk_dpi: Add checks for reg_h_fre_con existence (AngeloGioacchino Del Regno)
  - ARM: at91: pm: fix at91_suspend_finish for ZQ calibration (Li Bin)
  - hwmon: (gpio-fan) Add missing mutex locks (Alexander Stein)
  - x86/bugs: Make spectre user default depend on MITIGATION_SPECTRE_V2 (Breno Leitao)
  - clk: imx8mp: inform CCF of maximum frequency of clocks (Ahmad Fatoum)
  - media: uvcvideo: Add sanity check to uvc_ioctl_xu_ctrl_map (Ricardo Ribalda)
  - ipv4: fib: Move fib_valid_key_len() to rtm_to_fib_config(). (Kuniyuki Iwashima)
  - net: pktgen: fix mpls maximum labels list parsing (Peter Seiderer)
  - net: ethernet: ti: cpsw_new: populate netdev of_node (Alexander Sverdlin)
  - pinctrl: bcm281xx: Use "unsigned int" instead of bare "unsigned" (Artur Weber)
  - media: cx231xx: set device_caps for 417 (Hans Verkuil)
  - drm/amdgpu: Do not program AGP BAR regs under SRIOV in gfxhub_v1_0.c (Victor Lu)
  - remoteproc: qcom_wcnss: Handle platforms with only single power domain (Matti Lehtimäki)
  - orangefs: Do not truncate file size (Matthew Wilcox (Oracle))
  - dm cache: prevent BUG_ON by blocking retries on failed device resumes (Ming-Hung Tsai)
  - media: c8sectpfe: Call of_node_put(i2c_bus) only once in c8sectpfe_probe() (Markus Elfring)
  - ARM: tegra: Switch DSI-B clock parent to PLLD on Tegra114 (Svyatoslav Ryhel)
  - ieee802154: ca8210: Use proper setters and getters for bitwise types (Andy Shevchenko)
  - rtc: ds1307: stop disabling alarms on probe (Alexandre Belloni)
  - tcp: bring back NUMA dispersion in inet_ehash_locks_alloc() (Eric Dumazet)
  - powerpc/prom_init: Fixup missing #size-cells on PowerBook6,7 (Andreas Schwab)
  - arm64: tegra: p2597: Fix gpio for vdd-1v8-dis regulator (Diogo Ivo)
  - crypto: lzo - Fix compression buffer overrun (Herbert Xu)
  - cpufreq: tegra186: Share policy per cluster (Aaron Kling)
  - ASoC: qcom: sm8250: explicitly set format in sm8250_be_hw_params_fixup() (Alexey Klimov)
  - auxdisplay: charlcd: Partially revert "Move hwidth and bwidth to struct hd44780_common" (Andy Shevchenko)
  - ipv6: save dontfrag in cork (Willem de Bruijn)
  - mmc: sdhci: Disable SD card clock before changing parameters (Erick Shepherd)
  - arm64/mm: Check PUD_TYPE_TABLE in pud_bad() (Ryan Roberts)
  - netfilter: conntrack: Bound nf_conntrack sysctl writes (Nicolas Bouchinet)
  - timer_list: Don't use %pK through printk() (Thomas Weißschuh)
  - posix-timers: Add cond_resched() to posix_timer_add() search loop (Eric Dumazet)
  - RDMA/uverbs: Propagate errors from rdma_lookup_get_uobject() (Maher Sanalla)
  - xen: Add support for XenServer 6.1 platform device (Frediano Ziglio)
  - dm: restrict dm device size to 2^63-512 bytes (Mikulas Patocka)
  - crypto: octeontx2 - suppress auth failure screaming due to negative tests (Shashank Gupta)
  - kbuild: fix argument parsing in scripts/config (Seyediman Seyedarab)
  - ASoC: mediatek: mt6359: Add stub for mt6359_accdet_enable_jack_detect (Nícolas F. R. A. Prado)
  - rtc: rv3032: fix EERD location (Alexandre Belloni)
  - tcp: reorganize tcp_in_ack_event() and tcp_count_delivered() (Ilpo Järvinen)
  - vfio/pci: Handle INTx IRQ_NOTCONNECTED (Alex Williamson)
  - scsi: st: ERASE does not change tape location (Kai Mäkisara)
  - scsi: st: Tighten the page format heuristics with MODE SELECT (Kai Mäkisara)
  - ext4: reorder capability check last (Christian Göttsche)
  - um: Update min_low_pfn to match changes in uml_reserved (Tiwei Bie)
  - um: Store full CSGSFS and SS register from mcontext (Benjamin Berg)
  - dlm: make tcp still work in multi-link env (Heming Zhao)
  - i3c: master: svc: Fix missing STOP for master request (Stanley Chu)
  - btrfs: send: return -ENAMETOOLONG when attempting a path that is too long (Filipe Manana)
  - btrfs: get zone unusable bytes while holding lock at btrfs_reclaim_bgs_work() (Filipe Manana)
  - btrfs: avoid linker error in btrfs_find_create_tree_block() (Mark Harmstone)
  - btrfs: make btrfs_discard_workfn() block_group ref explicit (Boris Burkov)
  - i2c: pxa: fix call balance of i2c->clk handling routines (Vitalii Mordan)
  - i2c: qup: Vote for interconnect bandwidth to DRAM (Stephan Gerhold)
  - wifi: mt76: only mark tx-status-failed frames as ACKed on mt76x0/2 (Felix Fietkau)
  - mmc: host: Wait for Vdd to settle on card power off (Erick Shepherd)
  - libnvdimm/labels: Fix divide error in nd_label_data_init() (Robert Richter)
  - PCI: vmd: Disable MSI remapping bypass under Xen (Roger Pau Monne)
  - pNFS/flexfiles: Report ENETDOWN as a connection error (Trond Myklebust)
  - tools/build: Don't pass test log files to linker (Ian Rogers)
  - PCI: dwc: ep: Ensure proper iteration over outbound map windows (Frank Li)
  - lockdep: Fix wait context check on softirq for PREEMPT_RT (Ryo Takakura)
  - dql: Fix dql->limit value when reset. (Jing Su)
  - thermal/drivers/qoriq: Power down TMU on system suspend (Alice Guo)
  - SUNRPC: rpcbind should never reset the port to the value '0' (Trond Myklebust)
  - SUNRPC: rpc_clnt_set_transport() must not change the autobind setting (Trond Myklebust)
  - NFSv4: Treat ENETUNREACH errors as fatal for state recovery (Trond Myklebust)
  - fbdev: core: tileblit: Implement missing margin clearing for tileblit (Zsolt Kajtar)
  - fbcon: Use correct erase colour for clearing in fbcon (Zsolt Kajtar)
  - fbdev: fsl-diu-fb: add missing device_remove_file() (Shixiong Ou)
  - mailbox: use error ret code of of_parse_phandle_with_args() (Tudor Ambarus)
  - tracing: Mark binary printing functions with __printf() attribute (Andy Shevchenko)
  - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Trond Myklebust)
  - kconfig: merge_config: use an empty file as initfile (Daniel Gomez)
  - samples/bpf: Fix compilation failure for samples/bpf on LoongArch Fedora (Haoran Jiang)
  - bpf: fix possible endless loop in BPF map iteration (Brandon Kammerdiener)
  - net: enetc: refactor bulk flipping of RX buffers to separate function (Vladimir Oltean)
  - cgroup: Fix compilation issue due to cgroup_mutex not being exported (gaoxu)
  - dma-mapping: avoid potential unused data compilation warning (Marek Szyprowski)
  - virtio_ring: Fix data race by tagging event_triggered as racy for KCSAN (Zhongqiu Han)
  - scsi: target: iscsi: Fix timeout on deleted connection (Dmitry Bogdanov)


author: Brian Maly <brian.maly@oracle.com> [5.15.0-311.185.3.el9uek]
changelog:
  - net_sched: sch_sfq: move the limit validation (Octavian Purdila)  [Orabug: 38160459]  {CVE-2025-37752}
  - net_sched: sch_sfq: use a temporary work area for validating configuration (Octavian Purdila)
  - mm: synchronise PGD in x86 when utilising dax vmemmap optimisation (Lorenzo Stoakes)  [Orabug: 38055896]
  - rds: ib: Make sure a QP in INIT state is transitioned to ERR (Håkon Bugge)  [Orabug: 38119112]
  - Reapply "rds: ib: Make sure receives are posted before connection is up" (Håkon Bugge)  [Orabug: 38119112]
  - rds: Fix array index out of bounds in rds_message_purge() (Harshit Mogalapalli)  [Orabug: 38158026]
  - block: assign bi_bdev for cloned bios in blk_rq_prep_clone (Christoph Hellwig)  [Orabug: 38172722]
  - fs/proc: do_task_stat: use __for_each_thread() (Oleg Nesterov)  [Orabug: 38092818]
  - Add Zen34 clients (Borislav Petkov (AMD))  [Orabug: 38167060]  {CVE-2024-36350} {CVE-2024-36357}
  - x86/process: Move the buffer clearing before MONITOR (Kim Phillips)  [Orabug: 38167060]  {CVE-2024-36350} {CVE-2024-36357}
  - Add normal counters (Borislav Petkov (AMD))  [Orabug: 38167060]  {CVE-2024-36350} {CVE-2024-36357}
  - KVM: SVM: Advertize TSA CPUID bits to guests (Borislav Petkov (AMD))  [Orabug: 38167060]  {CVE-2024-36350} {CVE-2024-36357}
  - x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov (AMD))  [Orabug: 38167060]  {CVE-2024-36350} {CVE-2024-36357}
  - x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov (AMD))  [Orabug: 38167060]  {CVE-2024-36350} {CVE-2024-36357}
  - x86/CPU/AMD: Add ZenX generations flags (Borislav Petkov (AMD))  [Orabug: 38167060]  {CVE-2024-36350} {CVE-2024-36357}
  - x86/bugs: Free X86_BUG_AMD_APIC_C1E and X86_BUG_AMD_E400 bits (Boris Ostrovsky)  [Orabug: 38167060]  {CVE-2024-36350} {CVE-2024-36357}


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-311.185.4.el9uek]
changelog:
  - KVM: arm64: Sanitize PM{C,I}NTEN{SET,CLR}, PMOVS{SET,CLR} before first run (Raghavendra Rao Ananta)  [Orabug: 38178527]
  - KVM: arm64: PMU: Add a helper to read a vCPU's PMCR_EL0 (Reiji Watanabe)  [Orabug: 38178527]
  - vhost-scsi: Fix vhost_scsi struct use after free (Mike Christie)  [Orabug: 38178300]
  - sunrpc: handle SVC_GARBAGE during svc auth processing as auth error (Jeff Layton)  [Orabug: 38137450]  {CVE-2025-38089}
  - bnxt_en: Cap the size of HWRM_PORT_PHY_QCFG forwarded response (Michael Chan)  [Orabug: 35789734]


author: Brian Maly <brian.maly@oracle.com> [5.15.0-311.185.5.el9uek]
changelog:
  - KVM: x86: Remove VT-d mention in posted interrupt tracepoint (Alejandro Jimenez)  [Orabug: 38195091]
  - KVM: x86: Only set APICV_INHIBIT_REASON_ABSENT if APICv is enabled (Alejandro Jimenez)  [Orabug: 38195091]
  - KVM: x86: Print names of apicv inhibit reasons in traces (Alejandro Jimenez)  [Orabug: 38195091]
  - KVM: SVM: Always update local APIC on writes to logical dest register (Sean Christopherson)  [Orabug: 38195091]
  - x86: Pin task-stack in __get_wchan() (Peter Zijlstra)  [Orabug: 38161988]
  - x86: Fix __get_wchan() for !STACKTRACE (Peter Zijlstra)  [Orabug: 38161988]
  - sched: Add wrapper for get_wchan() to keep task blocked (Kees Cook)  [Orabug: 38161988]
  - x86: Fix get_wchan() to support the ORC unwinder (Qi Zheng)  [Orabug: 38161988]
  - nvme: tcp: avoid race between queue_lock lock and destroy (Hannes Reinecke)  [Orabug: 37331887]  {CVE-2024-53100}
  - PCI/AER: Add sysfs attributes for log ratelimits (Jon Pan-Doh)  [Orabug: 36952192]
  - PCI/AER: Ratelimit correctable and non-fatal error logging (Jon Pan-Doh)  [Orabug: 36952192]
  - PCI/AER: Simplify add_error_device() (Bjorn Helgaas)  [Orabug: 36952192]
  - PCI/AER: Convert aer_get_device_error_info(), aer_print_error() to index (Bjorn Helgaas)  [Orabug: 36952192]
  - PCI/AER: Reduce pci_print_aer() correctable error level to KERN_WARNING (Karolina Stolarek)  [Orabug: 36952192]
  - PCI/AER: Check log level once and remember it (Karolina Stolarek)  [Orabug: 36952192]
  - PCI/AER: Trace error event before ratelimiting (Bjorn Helgaas)  [Orabug: 36952192]
  - PCI/AER: Update statistics before ratelimiting (Bjorn Helgaas)  [Orabug: 36952192]
  - PCI/AER: Simplify pci_print_aer() (Bjorn Helgaas)  [Orabug: 36952192]
  - PCI/AER: Initialize aer_err_info before using it (Bjorn Helgaas)  [Orabug: 36952192]
  - PCI/AER: Move aer_print_source() earlier in file (Bjorn Helgaas)  [Orabug: 36952192]
  - PCI/AER: Rename aer_print_port_info() to aer_print_source() (Jon Pan-Doh)  [Orabug: 36952192]
  - PCI/AER: Extract bus/dev/fn in aer_print_port_info() with PCI_BUS_NUM(), etc (Bjorn Helgaas)  [Orabug: 36952192]
  - PCI/AER: Consolidate Error Source ID logging in aer_isr_one_error_type() (Bjorn Helgaas)  [Orabug: 36952192]
  - PCI/AER: Factor COR/UNCOR error handling out from aer_isr_one_error() (Bjorn Helgaas)  [Orabug: 36952192]
  - PCI/AER: Descope pci_printk() to aer_printk() (Ilpo Järvinen)  [Orabug: 36952192]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-311.185.6.el9uek]
changelog:
  - gre: Fix IPv6 multicast route creation. (Guillaume Nault)
  - pwm: mediatek: Ensure to disable clocks in error path (Uwe Kleine-König)
  - Revert "mmc: sdhci: Disable SD card clock before changing parameters" (Ulf Hansson)
  - net/sched: Always pass notifications when child class becomes empty (Lion Ackermann)
  - Revert "ipv6: save dontfrag in cork" (Brett A C Sheffield (Librecast))
  - net/mlx5: set graceful_period to 0 to allow multiple transmission queue recovery (Praveen Kumar Kannoju)  [Orabug: 38182990]
  - Revert "net/rds: Add krefs to struct rds_connection" (Håkon Bugge)  [Orabug: 38165949]
  - Revert "net/rds: tracepoints for rds_conn_kref_get and put" (Håkon Bugge)  [Orabug: 38165949]
  - sched: Change nr_uninterruptible type to unsigned long (Aruna Ramakrishna)  [Orabug: 37942383]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-311.185.7.el9uek]
changelog:
  - perf: Fix perf_event_validate_size() lockdep splat (Mark Rutland)  [Orabug: 36261485]  {CVE-2023-6931}
  - perf: Fix perf_event_validate_size() (Peter Zijlstra)  [Orabug: 36261485]  {CVE-2023-6931}


author: Brian Maly <brian.maly@oracle.com> [5.15.0-311.185.8.el9uek]
changelog:
  - net/mlx5: Add poll-eq API to be used by ULP's (Praveen Kumar Kannoju)  [Orabug: 38182400]
  - net/rds: poll eq during user-reset (Praveen Kumar Kannoju)  [Orabug: 38189328]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-311.185.6.el9uek]
changelog:
  - gre: Fix IPv6 multicast route creation. (Guillaume Nault)
  - pwm: mediatek: Ensure to disable clocks in error path (Uwe Kleine-König)
  - Revert "mmc: sdhci: Disable SD card clock before changing parameters" (Ulf Hansson)
  - net/sched: Always pass notifications when child class becomes empty (Lion Ackermann) [Orabug: 38217338] {CVE-2025-38350}
  - Revert "ipv6: save dontfrag in cork" (Brett A C Sheffield)
  - net/mlx5: set graceful_period to 0 to allow multiple transmission queue recovery (Praveen Kumar Kannoju) [Orabug: 38182990]
  - Revert "net/rds: Add krefs to struct rds_connection" (Håkon Bugge) [Orabug: 38165949]
  - Revert "net/rds: tracepoints for rds_conn_kref_get and put" (Håkon Bugge) [Orabug: 38165949]
  - sched: Change nr_uninterruptible type to unsigned long (Aruna Ramakrishna) [Orabug: 37942383]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-311.185.7.el9uek]
changelog:
  - perf: Fix perf_event_validate_size() lockdep splat (Mark Rutland) [Orabug: 36261485] {CVE-2023-6931}
  - perf: Fix perf_event_validate_size() (Peter Zijlstra) [Orabug: 36261485] {CVE-2023-6931}


author: Brian Maly <brian.maly@oracle.com> [5.15.0-311.185.8.el9uek]
changelog:
  - net/mlx5: Add poll-eq API to be used by ULP's (Praveen Kumar Kannoju) [Orabug: 38182400]
  - net/rds: poll eq during user-reset (Praveen Kumar Kannoju) [Orabug: 38189328]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-312.185.1.el9uek]
changelog:
  - uek-rpm: mips: Disable CONFIG_TRANSPARENT_HUGEPAGE (Dave Kleikamp) [Orabug: 38280961]
  - KVM: x86/MMU: Allow faulting at hugepages during dirty tracking (Joao Martins) [Orabug: 36409415]
  - KVM: x86/MMU: Dirty tracking without write-protection for shadow paging (Joao Martins) [Orabug: 36409415]
  - KVM: x86/MMU: Track rmap present pages (Joao Martins) [Orabug: 36409415]
  - nvme: check for valid nvme_identify_ns() before using it (Ewan D. Milne) [Orabug: 38207640]
  - nvme: bring back auto-removal of deleted namespaces during sequential scan (Christoph Hellwig) [Orabug: 38207640]
  - rds: tcp: block BH in TCP callbacks (Eric Dumazet) [Orabug: 38236843]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-312.187.2.el9uek]
changelog:
  - EDAC: Octeon: Fix compile error by replacing sdei_init() with acpi_sdei_init() (Vijayendra Suman) [Orabug: 38294908]
  - LTS version: v5.15.187 (Vijayendra Suman)
  - usb: typec: displayport: Fix potential deadlock (Andrei Kuchynski) [Orabug: 38309912] {CVE-2025-38404}
  - platform/x86: think-lmi: Create ksets consecutively (Kurt Borja)
  - Logitech C-270 even more broken (Oliver Neukum)
  - i2c/designware: Fix an initialization issue (Michael J. Ruhl) [Orabug: 38253850] {CVE-2025-38380}
  - usb: cdnsp: do not disable slot for disabled slot (Peter Chen)
  - xhci: dbc: Flush queued requests before stopping dbc (Mathias Nyman)
  - xhci: dbctty: disable ECHO flag by default (Łukasz Bartosik)
  - platform/x86: dell-wmi-sysman: Fix class device unregistration (Kurt Borja)
  - platform/x86: think-lmi: Fix class device unregistration (Kurt Borja)
  - dpaa2-eth: fix xdp_rxq_info leak (Wangfushuai)
  - net: dpaa2-eth: rearrange variable in dpaa2_eth_get_ethtool_stats (Ioana Ciornei)
  - dpaa2-eth: Update SINGLE_STEP register access (Radu Bulie)
  - dpaa2-eth: Update dpni_get_single_step_cfg command (Radu Bulie)
  - ethernet: atl1: Add missing DMA mapping error checks and count errors (Thomas Fourier)
  - NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Trond Myklebust)
  - drm/v3d: Disable interrupts before resetting the GPU (Maíra Canal) [Orabug: 38253820] {CVE-2025-38371}
  - regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods (Manivannan Sadhasivam) [Orabug: 38253906] {CVE-2025-38395}
  - regulator: gpio: Add input_supply support in gpio_regulator_config (Jerome Neanne)
  - mmc: core: sd: Apply BROKEN_SD_DISCARD quirk earlier (Avri Altman)
  - rcu: Return early if callback is not specified (Uladzislau Rezki)
  - mtd: spinand: fix memory leak of ECC engine conf (Pablo Martin-Gomez) [Orabug: 38253863] {CVE-2025-38384}
  - ACPICA: Refuse to evaluate a method if arguments are missing (Rafael J. Wysocki) [Orabug: 38253874] {CVE-2025-38386}
  - wifi: ath6kl: remove WARN on bad firmware input (Johannes Berg) [Orabug: 38253945] {CVE-2025-38406}
  - wifi: mac80211: drop invalid source address OCB frames (Johannes Berg)
  - scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() (Maurizio Lombardi) [Orabug: 38253914] {CVE-2025-38399}
  - powerpc: Fix struct termio related ioctl macros (Madhavan Srinivasan)
  - ata: pata_cs5536: fix build on 32-bit UML (Johannes Berg)
  - ALSA: sb: Force to disable DMAs once when DMA mode is changed (Takashi Iwai)
  - ALSA: sb: Don't allow changing the DMA mode during operations (Takashi Iwai)
  - drm/msm: Fix a fence leak in submit error path (Rob Clark) [Orabug: 38253967] {CVE-2025-38410}
  - nui: Fix dma_mapping_error() check (Thomas Fourier)
  - rose: fix dangling neighbour pointers in rose_rt_device_down() (Kohei Enju) [Orabug: 38253841] {CVE-2025-38377}
  - enic: fix incorrect MTU comparison in enic_change_mtu() (Alok Tiwari)
  - amd-xgbe: align CL37 AN sequence as per databook (Raju Rangoju)
  - lib: test_objagg: Set error message in check_expect_hints_stats() (Dan Carpenter)
  - igc: disable L1.2 PCI-E link substate to avoid performance issue (Vitaly Lifshits)
  - drm/i915/gt: Fix timeline left held on VMA alloc error (Janusz Krzysztofik) [Orabug: 38253886] {CVE-2025-38389}
  - platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks (Kurt Borja) [Orabug: 38253976] {CVE-2025-38412}
  - drm/i915/selftests: Change mock_request() to return error pointers (Dan Carpenter)
  - spi: spi-fsl-dspi: Clear completion counter before initiating transfer (James Clark)
  - drm/exynos: fimd: Guard display clock control with runtime PM calls (Marek Szyprowski)
  - btrfs: fix missing error handling when searching for inode refs during log replay (Filipe Manana)
  - scsi: ufs: core: Fix spelling of a sysfs attribute name (Bart Van Assche)
  - scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu() (Thomas Fourier)
  - scsi: qla2xxx: Fix DMA mapping test in qla24xx_get_port_database() (Thomas Fourier)
  - NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [Orabug: 38253900] {CVE-2025-38393}
  - nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. (Kuniyuki Iwashima) [Orabug: 38253922] {CVE-2025-38400}
  - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Mark Zhang) [Orabug: 38253880] {CVE-2025-38387}
  - platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment (David Thompson)
  - mtk-sd: reset host->mrq on prepare_data() error (Sergey Senozhatsky)
  - mtk-sd: Prevent memory corruption from DMA map failure (Masami Hiramatsu) [Orabug: 38253927] {CVE-2025-38401}
  - mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data (Masami Hiramatsu)
  - usb: typec: altmodes/displayport: do not index invalid pin_assignments (Rd Babiera) [Orabug: 38253893] {CVE-2025-38391}
  - mmc: sdhci: Add a helper function for dump register in dynamic debug mode (Victor Shih)
  - vsock/vmci: Clear the vmci transport packet properly when initializing it (Harshavardhana S A) [Orabug: 38253936] {CVE-2025-38403}
  - rtc: cmos: use spin_lock_irqsave in cmos_interrupt (Mateusz Jończyk)
  - ARM: 9354/1: ptrace: Use bitfield helpers (Geert Uytterhoeven)
  - btrfs: don't drop extent_map for free space inode on write error (Josef Bacik) [Orabug: 36530624] {CVE-2024-26726}
  - arm64: Restrict pagetable teardown to avoid false warning (Dev Jain)
  - s390: Add '-std=gnu11' to decompressor and purgatory CFLAGS (Nathan Chancellor)
  - s390/entry: Fix last breaking event handling in case of stack corruption (Heiko Carstens)
  - media: uvcvideo: Rollback non processed entities on error (Ricardo Ribalda)
  - PCI: hv: Do not set PCI_COMMAND_MEMORY to reduce VM boot time (Dexuan Cui)
  - drm/amd/display: Add null pointer check for get_first_active_display() (Xu Wang) [Orabug: 38253794] {CVE-2025-38362}
  - drm/bridge: cdns-dsi: Wait for Clk and Data Lanes to be ready (Aradhya Bhatia)
  - drm/bridge: cdns-dsi: Check return value when getting default PHY config (Aradhya Bhatia)
  - drm/bridge: cdns-dsi: Fix connecting to next bridge (Aradhya Bhatia)
  - drm/bridge: cdns-dsi: Fix the clock variable for mode_valid() (Aradhya Bhatia)
  - drm/amdkfd: Fix race in GWS queue scheduling (Jay Cornwall)
  - drm/udl: Unregister device before cleaning up on disconnect (Thomas Zimmermann)
  - drm/tegra: Fix a possible null pointer dereference (Qiu-Ji Chen) [Orabug: 38253800] {CVE-2025-38363}
  - drm/tegra: Assign plane type before registration (Thierry Reding)
  - HID: wacom: fix kobject reference count leak (Qasim Ijaz)
  - HID: wacom: fix memory leak on sysfs attribute creation failure (Qasim Ijaz)
  - HID: wacom: fix memory leak on kobject creation failure (Qasim Ijaz)
  - btrfs: update superblock's device bytes_used when dropping chunk (Mark Harmstone)
  - dm-raid: fix variable in journal device check (Heinz Mauelshagen)
  - Bluetooth: L2CAP: Fix L2CAP MTU negotiation (Frédéric Danis)
  - dt-bindings: serial: 8250: Make clocks and clock-frequency exclusive (Yao Zi)
  - staging: rtl8723bs: Avoid memset() in aes_cipher() and aes_decipher() (Nathan Chancellor)
  - net: selftests: fix TCP packet checksum (Jakub Kicinski)
  - atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister(). (Kuniyuki Iwashima) [Orabug: 38175043] {CVE-2025-38245}
  - net: enetc: Correct endianness handling in _enetc_rd_reg64 (Simon Horman)
  - um: ubd: Add missing error check in start_io_thread() (Tiwei Bie)
  - vsock/uapi: fix linux/vm_sockets.h userspace compilation errors (Stefano Garzarella)
  - af_unix: Don't set -ECONNRESET for consumed OOB skb. (Kuniyuki Iwashima)
  - wifi: mac80211: fix beacon interval calculation overflow (Lachlan Hodges)
  - libbpf: Fix null pointer dereference in btf_dump__free on allocation failure (Yuan Chen)
  - attach_recursive_mnt(): do not lock the covering tree when sliding something under it (Al Viro)
  - ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() (Youngjun Lee) [Orabug: 38175063] {CVE-2025-38249}
  - atm: clip: prevent NULL deref in clip_push() (Eric Dumazet) [Orabug: 38175077] {CVE-2025-38251}
  - s390/pkey: Prevent overflow in size calculation for memdup_user() (Fedor Pchelkin) [Orabug: 38175091] {CVE-2025-38257}
  - i2c: robotfuzz-osif: disable zero-length read messages (Wolfram Sang)
  - i2c: tiny-usb: disable zero-length read messages (Wolfram Sang)
  - platform/x86: ideapad-laptop: use usleep_range() for EC polling (Rongrong)
  - dummycon: Trigger redraw when switching consoles with deferred takeover (Thomas Zimmermann)
  - tty: vt: make consw::con_switch() return a bool (Jiri Slaby)
  - tty: vt: sanitize arguments of consw::con_clear() (Jiri Slaby)
  - tty: vt: make init parameter of consw::con_init() a bool (Jiri Slaby)
  - vgacon: remove unneeded forward declarations (Jiri Slaby)
  - vgacon: switch vgacon_scrolldelta() and vgacon_restore_screen() (Jiri Slaby)
  - tty/vt: consolemap: rename and document struct uni_pagedir (Jiri Slaby)
  - fbcon: delete a few unneeded forward decl (Daniel Vetter)
  - uio_hv_generic: Align ring size to system page (Long Li)
  - uio_hv_generic: Query the ringbuffer size for device (Saurabh Singh Sengar)
  - Drivers: hv: vmbus: Add utility function for querying ring size (Saurabh Singh Sengar)
  - Drivers: hv: Rename 'alloced' to 'allocated' (Vitaly Kuznetsov)
  - f2fs: don't over-report free space or inodes in statvfs (Chao Yu)
  - media: imx-jpeg: Drop the first error frames (Ming Qian)
  - clk: ti: am43xx: Add clkctrl data for am43xx ADC1 (Miquel Raynal)
  - media: omap3isp: use sgtable-based scatterlist wrappers (Marek Szyprowski)
  - media: davinci: vpif: Fix memory leak in probe error path (Dmitry Nikiforov)
  - jfs: validate AG parameters in dbMount() to prevent crashes (Vasiliy Kovalev) [Orabug: 38158700] {CVE-2025-38230}
  - fs/jfs: consolidate sanity checking in dbMount (Dave Kleikamp)
  - ovl: Check for NULL d_inode() in ovl_dentry_upper() (Kees Cook)
  - ceph: fix possible integer overflow in ceph_zero_objects() (Dmitry Kandybka)
  - ALSA: usb-audio: Add a quirk for Lenovo Thinkpad Thunderbolt 3 dock (Mario Limonciello)
  - ALSA: hda: Add new pci id for AMD GPU display HD audio controller (Vijendar Mukunda)
  - ALSA: hda: Ignore unsol events for cards being shut down (Cezary Rojewski)
  - usb: typec: displayport: Receive DP Status Update NAK request exit dp altmode (Jos Wang)
  - usb: cdc-wdm: avoid setting WDM_READ for ZLP-s (Robert Hodaszi)
  - usb: Add checks for snprintf() calls in usb_alloc_dev() (Andy Shevchenko)
  - usb: common: usb-conn-gpio: use a unique name for usb connector device (Chance Yang)
  - tty: serial: uartlite: register uart driver in init (Jakub Lewalski) [Orabug: 38175113] {CVE-2025-38262}
  - usb: potential integer overflow in usbg_make_tpg() (Chen Yufeng)
  - usb: dwc2: also exit clock_gating when stopping udc while suspended (Michael Grzeschik)
  - coresight: Only check bottom two claim bits (James Clark)
  - um: Add cmpxchg8b_emu and checksum functions to asm-prototypes.h (Sami Tolvanen)
  - iio: pressure: zpa2326: Use aligned_s64 for the timestamp (Jonathan Cameron)
  - bcache: fix NULL pointer in cache_set_flush() (Linggang Zeng) [Orabug: 38175119] {CVE-2025-38263}
  - md/md-bitmap: fix dm-raid max_write_behind setting (Yu Kuai)
  - dmaengine: xilinx_dma: Set dma_device directions (Thomas Gessler)
  - ksmbd: allow a filename to contain special characters on SMB3.1.1 posix extension (Namjae Jeon)
  - hwmon: (pmbus/max34440) Fix support for max34451 (Alexis Czezar Torreno)
  - leds: multicolor: Fix intensity setting while SW blinking (Sven Schwermer)
  - mfd: max14577: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
  - mailbox: Not protect module_put with spin_lock_irqsave (Peng Fan)
  - NFSv4.2: fix listxattr to return selinux security label (Olga Kornievskaia)
  - NFSv4: Always set NLINK even if the server doesn't support it (Han Young)
  - cifs: Fix cifs_query_path_info() for Windows NT servers (Pali Rohár)
  - LTS version: v5.15.186 (Vijayendra Suman)
  - scsi: qedf: Use designated initializer for struct qed_fcoe_cb_ops (Kees Cook)
  - scsi: elx: efct: Fix memory leak in efct_hw_parse_filter() (Vitaliy Shevtsov)
  - arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() (Tengda Wu) [Orabug: 38180595] {CVE-2025-38320}
  - perf: Fix sample vs do_exit() (Peter Zijlstra) [Orabug: 38254029] {CVE-2025-38424}
  - s390/pci: Fix __pcilg_mio_inuser() inline assembly (Heiko Carstens)
  - bpf: Fix L4 csum update on IPv6 in CHECKSUM_COMPLETE (Paul Chaignon)
  - net: Fix checksum update for ILA adj-transport (Paul Chaignon)
  - ext4: avoid remount errors with 'abort' mount option (Jan Kara)
  - ext4: make 'abort' mount option handling standard (Jan Kara)
  - mm/huge_memory: fix dereferencing invalid pmd migration entry (Gavin Guo) [Orabug: 37976983] {CVE-2025-37958}
  - net_sched: sch_sfq: reject invalid perturb period (Eric Dumazet) [Orabug: 38158476] {CVE-2025-38193}
  - arm64: proton-pack: Add new CPUs 'k' values for branch mitigation (James Morse)
  - arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users (James Morse) [Orabug: 37977005] {CVE-2025-37963}
  - arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs (James Morse) [Orabug: 37976929] {CVE-2025-37948}
  - arm64: spectre: increase parameters that can be used to turn off bhb mitigation individually (Liu Song)
  - arm64: proton-pack: Expose whether the branchy loop k value (James Morse)
  - arm64: proton-pack: Expose whether the platform is mitigated by firmware (James Morse)
  - arm64: insn: Add support for encoding DSB (James Morse)
  - arm64: insn: add encoders for atomic operations (Hou Tao)
  - arm64: move AARCH64_BREAK_FAULT into insn-def.h (Hou Tao)
  - serial: sh-sci: Increment the runtime usage counter for the earlycon device (Claudiu Beznea)
  - ARM: dts: am335x-bone-common: Increase MDIO reset deassert delay to 50ms (Geert Uytterhoeven)
  - ARM: dts: am335x-bone-common: Increase MDIO reset deassert time (Colin Foster)
  - ARM: dts: am335x-bone-common: Add GPIO PHY reset on revision C3 board (Shengyu Qu)
  - net: atm: fix /proc/net/atm/lec handling (Eric Dumazet) [Orabug: 38158405] {CVE-2025-38180}
  - net: atm: add lec_mutex (Eric Dumazet) [Orabug: 38180611] {CVE-2025-38323}
  - calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). (Kuniyuki Iwashima) [Orabug: 38158412] {CVE-2025-38181}
  - tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (Haixia Qu) [Orabug: 38158424] {CVE-2025-38184}
  - tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen() behavior (Neal Cardwell)
  - atm: atmtcp: Free invalid length skb in atmtcp_c_send(). (Kuniyuki Iwashima) [Orabug: 38158433] {CVE-2025-38185}
  - mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). (Kuniyuki Iwashima) [Orabug: 38180617] {CVE-2025-38324}
  - wifi: carl9170: do not ping device which has failed to load firmware (Dmitry Antipov) [Orabug: 38254010] {CVE-2025-38420}
  - ptp: fix breakage after ptp_vclock_in_use() rework (Vladimir Oltean)
  - net: ice: Perform accurate aRFS flow match (Krishna Kumar)
  - aoe: clean device rq_list in aoedev_downdev() (Justin Sanders) [Orabug: 38180627] {CVE-2025-38326}
  - pldmfw: Select CRC32 when PLDMFW is selected (Simon Horman)
  - hwmon: (occ) fix unaligned accesses (Arnd Bergmann)
  - hwmon: (occ) Rework attribute registration for stack usage (Arnd Bergmann)
  - hwmon: (occ) Add soft minimum power cap attribute (Eddie James)
  - drm/nouveau/bl: increase buffer size to avoid truncate warning (Jacob Keller)
  - drm/msm/dsi/dsi_phy_10nm: Fix missing initial VCO rate (Krzysztof Kozlowski)
  - erofs: remove unused trace event erofs_destroy_inode (Gao Xiang)
  - mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Jann Horn) [Orabug: 38132180] {CVE-2025-38085}
  - mm: hugetlb: independent PMD page table shared count (Liu Shixin) [Orabug: 37484959] {CVE-2024-57883}
  - mm/hugetlb: unshare page tables during VMA split, not before (Jann Horn) [Orabug: 38132171] {CVE-2025-38084}
  - iio: accel: fxls8962af: Fix temperature calculation (Sean Nyekjaer)
  - ALSA: hda/realtek: enable headset mic on Latitude 5420 Rugged (Jonathan Lane)
  - ALSA: hda/intel: Add Thinkpad E15 to PM deny list (Takashi Iwai)
  - ALSA: usb-audio: Rename ALSA kcontrol PCM and PCM1 for the KTMicro sound card (Wangdicheng)
  - Input: sparcspkr - avoid unannotated fall-through (Yuli Wang)
  - block: default BLOCK_LEGACY_AUTOLOAD to y (Christoph Hellwig)
  - HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() (Terry Junge) [Orabug: 38152876] {CVE-2025-38103}
  - atm: Revert atm_account_tx() if copy_from_iter_full() fails. (Kuniyuki Iwashima) [Orabug: 38158457] {CVE-2025-38190}
  - selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len (Stephen Smalley)
  - selftests/x86: Add a test to detect infinite SIGTRAP handler loop (Xin Li)
  - udmabuf: use sgtable-based scatterlist wrappers (Marek Szyprowski)
  - scsi: s390: zfcp: Ensure synchronous unit_add (Peter Oberparleiter)
  - scsi: storvsc: Increase the timeouts to storvsc_timeout (Dexuan Cui)
  - jffs2: check jffs2_prealloc_raw_node_refs() result in few other places (Fedor Pchelkin) [Orabug: 38180635] {CVE-2025-38328}
  - jffs2: check that raw node were preallocated before writing summary (Artem Sadovnikov) [Orabug: 38158483] {CVE-2025-38194}
  - drivers/rapidio/rio_cm.c: prevent possible heap overwrite (Andrew Morton) [Orabug: 38137453] {CVE-2025-38090}
  - powerpc/eeh: Fix missing PE bridge reconfiguration during VFIO EEH recovery (Narayana Murty N)
  - platform/x86: dell_rbu: Stop overwriting data buffer (Stuart Hayes)
  - platform/x86: dell_rbu: Fix list usage (Stuart Hayes) [Orabug: 38158494] {CVE-2025-38197}
  - Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first" (Alexander Sverdlin)
  - tee: Prevent size calculation wraparound on 32-bit kernels (Jann Horn)
  - ARM: OMAP2+: Fix l4ls clk domain handling in STANDBY (Sukrut Bellary)
  - bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value (Laurentiu Tudor)
  - watchdog: da9052_wdt: respect TWDMIN (Marcus Folkesson)
  - octeontx2-pf: Add error log forcn10k_map_unmap_rq_policer() (Xu Wang)
  - bpf, sockmap: Fix data lost during EAGAIN retries (Jiayuan Chen)
  - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Kyungwook Boo) [Orabug: 38158517] {CVE-2025-38200}
  - sock: Correct error checking condition for (assign|release)_proto_idx() (Zijun Hu)
  - scsi: lpfc: Use memcpy() for BIOS version (Daniel Wagner) [Orabug: 38180667] {CVE-2025-38332}
  - pinctrl: mcp23s08: Reset all pins to input at probe (Mike Looijmans)
  - software node: Correct a OOB check in software_node_get_reference_args() (Zijun Hu) [Orabug: 38180730] {CVE-2025-38342}
  - vxlan: Do not treat dst cache initialization errors as fatal (Ido Schimmel)
  - net: bridge: mcast: re-implement br_multicast_{enable, disable}_port functions (Yong Wang)
  - iommu/amd: Ensure GA log notifier callbacks finish running before module unload (Sean Christopherson)
  - scsi: lpfc: Fix lpfc_check_sli_ndlp() handling for GEN_REQUEST64 commands (Justin Tee)
  - libbpf: Add identical pointer detection to btf_dedup_is_equiv() (Alan Maguire)
  - clk: rockchip: rk3036: mark ddrphy as critical (Heiko Stuebner)
  - wifi: mac80211: do not offer a mesh path if forwarding is disabled (Benjamin Berg)
  - net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info (Jason Xing)
  - pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get() (Gabor Juhos)
  - pinctrl: armada-37xx: propagate error from armada_37xx_pmx_gpio_set_direction() (Gabor Juhos)
  - pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get_direction() (Gabor Juhos)
  - pinctrl: armada-37xx: propagate error from armada_37xx_pmx_set_by_name() (Gabor Juhos)
  - net: atlantic: generate software timestamp just before the doorbell (Jason Xing)
  - ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT (Sebastian Andrzej Siewior)
  - tcp: fix initial tp->rcvq_space.space value for passive TS enabled flows (Eric Dumazet)
  - tcp: always seek for minimal rtt in tcp_rcv_rtt_update() (Eric Dumazet)
  - net: dlink: add synchronization for stats update (Moon Yeounsu)
  - i2c: npcm: Add clock toggle recovery (Tali Perry)
  - cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs (Mike Tipton)
  - sctp: Do not wake readers in __sctp_write_space() (Petr Malat)
  - wifi: mt76: mt76x2: Add support for LiteOn WN4516R,WN4519R (Henk Vergonet)
  - emulex/benet: correct command version selection in be_cmd_get_stats() (Alok Tiwari)
  - i2c: designware: Invoke runtime suspend on quick slave re-registration (Tan En De)
  - tipc: use kfree_sensitive() for aead cleanup (Zilin Guan)
  - net: macb: Check return value of dma_set_mask_and_coherent() (Sergio Perez Gonzalez)
  - cpufreq: Force sync policy boost with global boost on sysfs update (Viresh Kumar)
  - thermal/drivers/qcom/tsens: Update conditions to strictly evaluate for IP v2+ (George Moussalem)
  - pmdomain: ti: Fix STANDBY handling of PER power domain (Sukrut Bellary)
  - nios2: force update_mmu_cache on spurious tlb-permission--related pagefaults (Simon Schuster)
  - media: i2c: imx334: update mode_3840x2160_regs array (Shravan Chippa)
  - media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode() (Xu Wang) [Orabug: 38175013] {CVE-2025-38237}
  - media: tc358743: ignore video while HPD is low (Hans Verkuil)
  - drm/amdkfd: Set SDMA_RLCx_IB_CNTL/SWITCH_INSIDE_IB (Amber Lin)
  - drm/msm/dpu: don't select single flush for active CTL blocks (Dmitry Baryshkov)
  - jfs: Fix null-ptr-deref in jfs_ioc_trim (Dylan Wolff) [Orabug: 38158545] {CVE-2025-38203}
  - drm/amdgpu/gfx9: fix CSIB handling (Alex Deucher)
  - drm/amdgpu/gfx8: fix CSIB handling (Alex Deucher)
  - ext4: prevent stale extent cache entries caused by concurrent get es_cache (Zhang Yi)
  - sunrpc: fix race in cache cleanup causing stale nextcheck time (Long Li)
  - media: rkvdec: Initialize the m2m context before the controls (Nicolas Dufresne)
  - media: ti: cal: Fix wrong goto on error path (Tomi Valkeinen)
  - jfs: fix array-index-out-of-bounds read in add_missing_indices (Aditya Dutt) [Orabug: 38158552] {CVE-2025-38204}
  - ext4: ext4: unify EXT4_EX_NOCACHE|NOFAIL flags in ext4_ext_remove_space() (Zhang Yi)
  - drm/amdgpu/gfx7: fix CSIB handling (Alex Deucher)
  - media: uapi: v4l: Change V4L2_TYPE_IS_CAPTURE condition (Nas Chung)
  - media: ccs-pll: Better validate VT PLL branch (Sakari Ailus)
  - drm/amdgpu/gfx10: fix CSIB handling (Alex Deucher)
  - media: i2c: imx334: Fix runtime PM handling in remove function (Tarang Raval)
  - drm/msm/a6xx: Increase HFI response timeout (Akhil P Oommen)
  - drm/amd/display: Add NULL pointer checks in dm_force_atomic_commit() (Srinivasan Shanmugam)
  - media: uapi: v4l: Fix V4L2_TYPE_IS_OUTPUT condition (Nas Chung)
  - drm/msm/hdmi: add runtime PM calls to DDC transfer function (Dmitry Baryshkov)
  - media: i2c: imx334: Enable runtime PM before sub-device registration (Tarang Raval)
  - drm/bridge: anx7625: change the gpiod_set_value API (Ayushi Makhija)
  - exfat: fix double free in delayed_free (Namjae Jeon) [Orabug: 38158566] {CVE-2025-38206}
  - drm/bridge: analogix_dp: Add irq flag IRQF_NO_AUTOEN instead of calling disable_irq() (Damon Ding)
  - sunrpc: update nextcheck time when adding new cache entries (Long Li)
  - drm/amdgpu/gfx6: fix CSIB handling (Alex Deucher)
  - ACPI: battery: negate current when discharging (Peter Marheine)
  - PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn() (Charan Teja Kalla)
  - ASoC: tegra210_ahub: Add check to of_device_get_match_data() (Yuanjun Gong)
  - ACPICA: utilities: Fix overflow check in vsnprintf() (Philip Redkin)
  - power: supply: bq27xxx: Retrieve again when busy (Jerry Lv)
  - ACPICA: fix acpi parse and parseext cache leaks (Seunghun Han) [Orabug: 38180747] {CVE-2025-38344}
  - ACPI: bus: Bail out if acpi_kobj registration fails (Armin Wolf)
  - ASoC: tas2770: Power cycle amp on ISENSE/VSENSE change (Hector Martin)
  - ACPICA: Avoid sequence overread in call to strncmp() (Ahmed Salem)
  - clocksource: Fix the CPUs' choice in the watchdog per CPU verification (Guilherme G. Piccoli)
  - ACPICA: fix acpi operand cache leak in dswstate.c (Seunghun Han) [Orabug: 38180755] {CVE-2025-38345}
  - iio: adc: ad7606_spi: fix reg write value mask (David Lechner)
  - iio: imu: inv_icm42600: Fix temperature calculation (Sean Nyekjaer)
  - iio: accel: fxls8962af: Fix temperature scan element sign (Sean Nyekjaer)
  - PCI: dw-rockchip: Fix PHY function call sequence in rockchip_pcie_phy_deinit() (Diederik de Haas)
  - PCI: Fix lock symmetry in pci_slot_unlock() (Ilpo Järvinen)
  - PCI: Add ACS quirk for Loongson PCIe (Huacai Chen)
  - PCI: cadence-ep: Correct PBA offset in .set_msix() callback (Niklas Cassel)
  - uio_hv_generic: Use correct size for interrupt and monitor pages (Long Li)
  - remoteproc: core: Release rproc->clean_table after rproc_attach() fails (Xiaolei Wang) [Orabug: 38254002] {CVE-2025-38418}
  - remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach() (Xiaolei Wang) [Orabug: 38254006] {CVE-2025-38419}
  - regulator: max14577: Add error check for max14577_read_reg() (Xu Wang)
  - mips: Add -std= flag specified in KBUILD_CFLAGS to vdso CFLAGS (Khem Raj)
  - staging: iio: ad5933: Correct settling cycles encoding per datasheet (Gabriel)
  - net: ch9200: fix uninitialised access during mii_nway_restart (Qasim Ijaz) [Orabug: 38132188] {CVE-2025-38086}
  - ftrace: Fix UAF when lookup kallsym after ftrace disabled (Ye Bin) [Orabug: 38180767] {CVE-2025-38346}
  - dm-mirror: fix a tiny race condition (Mikulas Patocka)
  - mtd: nand: sunxi: Add randomizer configuration before randomizer enable (Xu Wang)
  - mtd: rawnand: sunxi: Add randomizer configuration in sunxi_nfc_hw_ecc_write_chunk (Xu Wang)
  - mm: fix ratelimit_pages update error in dirty_ratio_handler() (Jinliang Zheng)
  - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Shin'Ichiro Kawasaki) [Orabug: 38158591] {CVE-2025-38211}
  - ipc: fix to protect IPCS lookups using RCU (Jeongjun Park) [Orabug: 38158597] {CVE-2025-38212}
  - clk: meson-g12a: add missing fclk_div2 to spicc (Da Xue)
  - parisc: fix building with gcc-15 (Arnd Bergmann)
  - vgacon: Add check for vc_origin address range in vgacon_scroll() (Gong, Ruiqi)
  - fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var (Murad Masimov) [Orabug: 38158614] {CVE-2025-38214}
  - EDAC/altera: Use correct write width with the INTTEST register (Niravkumar L Rabara)
  - NFC: nci: uart: Set tty->disc_data only in success path (Krzysztof Kozlowski) [Orabug: 38253991] {CVE-2025-38416}
  - f2fs: fix to do sanity check on sit_bitmap_size (Chao Yu) [Orabug: 38158639] {CVE-2025-38218}
  - f2fs: prevent kernel warning due to negative i_nlink from corrupted image (Jaegeuk Kim) [Orabug: 38158647] {CVE-2025-38219}
  - Input: ims-pcu - check record size in ims_pcu_flash_firmware() (Dan Carpenter) [Orabug: 38254053] {CVE-2025-38428}
  - ext4: ensure i_size is smaller than maxbytes (Zhang Yi)
  - ext4: factor out ext4_get_maxbytes() (Zhang Yi)
  - ext4: fix calculation of credits for extent tree modification (Jan Kara)
  - ext4: inline: fix len overflow in ext4_prepare_inline_data (Thadeu Lima de Souza Cascardo) [Orabug: 38158661] {CVE-2025-38222}
  - bus: fsl-mc: fix GET/SET_TAILDROP command ids (Wan Junjie)
  - bus: fsl-mc: do not add a device-link for the UAPI used DPMCP device (Ioana Ciornei)
  - ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330 (Tasos Sahanidis) [Orabug: 38180696] {CVE-2025-38336}
  - can: tcan4x5x: fix power regulator retrieval during probe (Brett Werling)
  - bus: mhi: host: Fix conflict between power_up and SYSERR (Jeffrey Hugo)
  - ARM: omap: pmic-cpcap: do not mess around without CPCAP or OMAP4 (Andreas Kemnade)
  - ARM: 9447/1: arm/memremap: fix arch_memremap_can_ram_remap() (Ross Stutterheim)
  - media: uvcvideo: Fix deferred probing error (Ricardo Ribalda)
  - media: uvcvideo: Send control events for partial succeeds (Ricardo Ribalda)
  - media: uvcvideo: Return the number of processed controls (Ricardo Ribalda)
  - media: vivid: Change the siize of the composing (Denis Arefev) [Orabug: 38158680] {CVE-2025-38226}
  - media: vidtv: Terminating the subsequent process of initialization failure (Edward Adam Davis) [Orabug: 38158685] {CVE-2025-38227}
  - media: videobuf2: use sgtable-based scatterlist wrappers (Marek Szyprowski)
  - media: venus: Fix probe error handling (Loic Poulain)
  - media: v4l2-dev: fix error handling in __video_register_device() (Ma Ke)
  - media: gspca: Add error handling for stv06xx_read_sensor() (Xu Wang)
  - media: cxusb: no longer judge rbuf when the write fails (Edward Adam Davis) [Orabug: 38158691] {CVE-2025-38229}
  - media: ccs-pll: Check for too high VT PLL multiplier in dual PLL case (Sakari Ailus)
  - media: ccs-pll: Correct the upper limit of maximum op_pre_pll_clk_div (Sakari Ailus)
  - media: ccs-pll: Start OP pre-PLL multiplier search from correct value (Sakari Ailus)
  - media: ccs-pll: Start VT pre-PLL multiplier search from correct value (Sakari Ailus)
  - media: ov8856: suppress probe deferral errors (Johan Hovold)
  - wifi: rtlwifi: disable ASPM for RTL8723BE with subsystem ID 11ad:1723 (Mingcong Bai)
  - jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() (Jeongjun Park) [Orabug: 38180706] {CVE-2025-38337}
  - nfsd: Initialize ssc before laundromat_work to prevent NULL dereference (Li Lingfeng) [Orabug: 38158706] {CVE-2025-38231}
  - nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request (Neil Brown) [Orabug: 38254061] {CVE-2025-38430}
  - wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback() (Christian Lamparter) [Orabug: 38180782] {CVE-2025-38348}
  - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Xu Wang)
  - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Xu Wang)
  - powerpc/pseries/msi: Avoid reading PCI device registers in reduced power states (Gautam Menghani)
  - ASoC: meson: meson-card-utils: use of_property_present() for DT parsing (Martin Blumenstingl)
  - ASoC: qcom: sdm845: Add error handling in sdm845_slim_snd_hw_params() (Xu Wang)
  - gfs2: move msleep to sleepable context (Alexander Aring)
  - crypto: marvell/cesa - Do not chain submitted requests (Herbert Xu)
  - configfs: Do not override creating attribute file failure in populate_attrs() (Zijun Hu)
  - xfs: allow inode inactivation during a ro mount log recovery (Darrick J. Wong)
  - kbuild: hdrcheck: fix cross build with clang (Arnd Bergmann)
  - kbuild: userprogs: fix bitsize and target detection on clang (Thomas Weißschuh)
  - drm/meson: Use 1000ULL when operating with mode->clock (I Hsin Cheng)
  - net: usb: aqc111: debug info before sanitation (Oliver Neukum)
  - calipso: unlock rcu before returning -EAFNOSUPPORT (Eric Dumazet)
  - x86/iopl: Cure TIF_IO_BITMAP inconsistencies (Thomas Gleixner) [Orabug: 38152863] {CVE-2025-38100}
  - xen/arm: call uaccess_ttbr0_enable for dm_op hypercall (Stefano Stabellini)
  - usb: typec: tcpm/tcpci_maxim: Fix bounds check in process_rx() (Amit Sunil Dhamne)
  - usb: Flush altsetting 0 endpoints before reinitializating them after reset. (Mathias Nyman)
  - usb: cdnsp: Fix issue with detecting USB 3.2 speed (Pawel Laszczak)
  - usb: cdnsp: Fix issue with detecting command completion event (Pawel Laszczak)
  - VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify (Ma Wupeng) [Orabug: 38152868] {CVE-2025-38102}
  - drm/amd/display: Do not add '-mhard-float' to dcn2{1,0}_resource.o for clang (Nathan Chancellor)
  - kbuild: Add KBUILD_CPPFLAGS to as-option invocation (Nathan Chancellor)
  - kbuild: add $(CLANG_FLAGS) to KBUILD_CPPFLAGS (Masahiro Yamada)
  - kbuild: Add CLANG_FLAGS to as-instr (Nathan Chancellor)
  - mips: Include KBUILD_CPPFLAGS in CHECKFLAGS invocation (Nathan Chancellor)
  - drm/amd/display: Do not add '-mhard-float' to dml_ccflags for clang (Nathan Chancellor)
  - kbuild: Update assembler calls to use proper flags and language target (Nick Desaulniers)
  - MIPS: Prefer cc-option for additions to cflags (Nathan Chancellor)
  - MIPS: Move '-Wa,-msoft-float' check from as-option to cc-option (Nathan Chancellor)
  - x86/boot/compressed: prefer cc-option for CFLAGS additions (Nick Desaulniers)
  - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [Orabug: 38223086] {CVE-2025-38352}
  - ALSA: usb-audio: Add implicit feedback quirk for RODE AI-1 (David Heimann)
  - perf: Ensure bpf_perf_link path is properly serialized (Peter Zijlstra)
  - nvmet-fcloop: access fcpreq only when holding reqlock (Daniel Wagner)
  - fs/filesystems: Fix potential unsigned integer underflow in fs_name() (Zijun Hu)
  - net_sched: ets: fix a race in ets_qdisc_change() (Eric Dumazet) [Orabug: 38152893] {CVE-2025-38107}
  - sch_ets: make est_qlen_notify() idempotent (Cong Wang)
  - net_sched: tbf: fix a race in tbf_change() (Eric Dumazet)
  - net_sched: red: fix a race in __red_change() (Eric Dumazet) [Orabug: 38152898] {CVE-2025-38108}
  - net_sched: prio: fix a race in prio_tune() (Eric Dumazet) [Orabug: 38105333] {CVE-2025-38083}
  - net/mlx5: Fix return value when searching for existing flow group (Patrisious Haddad)
  - net/mlx5: Ensure fw pages are always allocated on same NUMA (Moshe Shemesh)
  - net/mdiobus: Fix potential out-of-bounds read/write access (Jakub Raczynski) [Orabug: 38152911] {CVE-2025-38111}
  - net: mdio: C22 is now optional, EOPNOTSUPP if not provided (Andrew Lunn)
  - macsec: MACsec SCI assignment for ES = 0 (Carlos Fernandez)
  - net: Fix TOCTOU issue in sk_is_readable() (Michal Luczaj) [Orabug: 38152915] {CVE-2025-38112}
  - i40e: retry VFLR handling if there is ongoing VF reset (Robert Malz)
  - i40e: return false from i40e_reset_vf if reset is in progress (Robert Malz)
  - drm/meson: fix more rounding issues with 59.94Hz modes (Martin Blumenstingl)
  - drm/meson: use vclk_freq instead of pixel_freq in debug print (Martin Blumenstingl)
  - drm/meson: fix debug log statement when setting the HDMI clocks (Martin Blumenstingl)
  - drm/meson: use unsigned long long / Hz for frequency types (Martin Blumenstingl)
  - powerpc/vas: Return -EINVAL if the offset is non-zero in mmap() (Haren Myneni)
  - powerpc/powernv/memtrace: Fix out of bounds issue in memtrace mmap (Ritesh Harjani) [Orabug: 38137444] {CVE-2025-38088}
  - net_sched: sch_sfq: fix a potential crash on gso_skb handling (Eric Dumazet) [Orabug: 38152922] {CVE-2025-38115}
  - scsi: iscsi: Fix incorrect error path labels for flashnode operations (Alok Tiwari)
  - ath10k: snoc: fix unbalanced IRQ enable in crash recovery (Caleb Connolly)
  - ptp: remove ptp->n_vclocks check logic in ptp_vclock_in_use() (Jeongjun Park) [Orabug: 38180545] {CVE-2025-38305}
  - scsi: core: ufs: Fix a hang in the error handler (Sanjeev Yadav) [Orabug: 38152945] {CVE-2025-38119}
  - serial: sh-sci: Clean sci_ports[0] after at earlycon exit (Claudiu Beznea)
  - serial: sh-sci: Move runtime PM enable to sci_probe_single() (Claudiu Beznea)
  - serial: sh-sci: Check if TX data was written to device in .tx_empty() (Claudiu Beznea)
  - arm64: dts: ti: k3-am65-main: Add missing taps to sdhci0 (Judith Mendez)
  - arm64: dts: ti: k3-am65-main: Fix sdhci node properties (Judith Mendez)
  - arm64: dts: ti: k3-am65-main: Drop deprecated ti,otap-del-sel property (Nishanth Menon)
  - Input: synaptics-rmi - fix crash with unsupported versions of F34 (Dmitry Torokhov)
  - Input: synaptics-rmi4 - convert to use sysfs_emit() APIs (Zhang Songyi)
  - pmdomain: core: Fix error checking in genpd_dev_pm_attach_by_id() (Dan Carpenter)
  - do_change_type(): refuse to operate on unmounted/not ours mounts (Al Viro) [Orabug: 38256449] {CVE-2025-38498}
  - fix propagation graph breakage by MOVE_MOUNT_SET_GROUP move_mount(2) (Al Viro)
  - seg6: Fix validation of nexthop addresses (Ido Schimmel) [Orabug: 38180555] {CVE-2025-38310}
  - wireguard: device: enable threaded NAPI (Mirco Barone)
  - netfilter: nf_set_pipapo_avx2: fix initial map fill (Florian Westphal) [Orabug: 38152957] {CVE-2025-38120}
  - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Alok Tiwari) [Orabug: 38152965] {CVE-2025-38122}
  - vmxnet3: correctly report gso type for UDP tunnels (Ronak Doshi)
  - net: dsa: tag_brcm: legacy: fix pskb_may_pull length (Álvaro Fernández Rojas)
  - ice: create new Tx scheduler nodes for new queues only (Michal Kubiak)
  - Bluetooth: L2CAP: Fix not responding with L2CAP_CR_LE_ENCRYPTION (Luiz Augusto von Dentz)
  - spi: bcm63xx-hsspi: fix shared reset (Álvaro Fernández Rojas)
  - spi: bcm63xx-spi: fix shared reset (Álvaro Fernández Rojas)
  - net/mlx4_en: Prevent potential integer overflow calculating Hz (Dan Carpenter)
  - driver: net: ethernet: mtk_star_emac: fix suspend/resume issue (Yanqing Wang)
  - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Alok Tiwari)
  - net: stmmac: platform: guarantee uniqueness of bus_id (Quentin Schulz)
  - vt: remove VT_RESIZE and VT_RESIZEX from vt_compat_ioctl() (Nicolas Pitre)
  - MIPS: Loongson64: Add missing '#interrupt-cells' for loongson64c_ls7a (Yuli Wang)
  - iio: adc: ad7124: Fix 3dB filter frequency reading (Uwe Kleine-König)
  - serial: Fix potential null-ptr-deref in mlb_usio_probe() (Henry Martin) [Orabug: 38153011] {CVE-2025-38135}
  - usb: renesas_usbhs: Reorder clock handling and power management in probe (Lad Prabhakar) [Orabug: 38153016] {CVE-2025-38136}
  - PCI/DPC: Initialize aer_err_info before using it (Bjorn Helgaas)
  - dmaengine: ti: Add NULL check in udma_probe() (Henry Martin) [Orabug: 38153029] {CVE-2025-38138}
  - PCI: cadence: Fix runtime atomic count underflow (Hans Zhang)
  - rtc: sh: assign correct interrupts with DT (Wolfram Sang)
  - perf record: Fix incorrect --user-regs comments (Dapeng Mi)
  - perf tests switch-tracking: Fix timestamp comparison (Leo Yan)
  - mfd: stmpe-spi: Correct the name used in MODULE_DEVICE_TABLE (Alexey Gladkov)
  - mfd: exynos-lpass: Avoid calling exynos_lpass_disable() twice in exynos_lpass_remove() (Christophe Jaillet)
  - rpmsg: qcom_smd: Fix uninitialized return variable in __qcom_smd_send() (Dan Carpenter)
  - remoteproc: qcom_wcnss_iris: Add missing put_device() on error in probe (Dan Carpenter)
  - perf scripts python: exported-sql-viewer.py: Fix pattern matching with Python 3 (Adrian Hunter)
  - backlight: pm8941: Add NULL check in wled_configure() (Henry Martin) [Orabug: 38153050] {CVE-2025-38143}
  - perf ui browser hists: Set actions->thread before calling do_zoom_thread() (Arnaldo Carvalho de Melo)
  - perf build: Warn when libdebuginfod devel files are not available (Arnaldo Carvalho de Melo)
  - fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod() (Sergey Shtylyov) [Orabug: 38180565] {CVE-2025-38312}
  - soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop() (Henry Martin) [Orabug: 38153059] {CVE-2025-38145}
  - soc: aspeed: lpc: Fix impossible judgment condition (Su Hui)
  - arm64: dts: rockchip: disable unrouted USB controllers and PHY on RK3399 Puma with Haikou (Quentin Schulz)
  - ARM: dts: qcom: apq8064 merge hw splinlock into corresponding syscon device (Dmitry Baryshkov)
  - bus: fsl-mc: fix double-free on mc_dev (Ioana Ciornei) [Orabug: 38180572] {CVE-2025-38313}
  - nilfs2: do not propagate ENOENT error from nilfs_btree_propagate() (Ryusuke Konishi)
  - nilfs2: add pointer check for nilfs_direct_propagate() (Xu Wang)
  - ocfs2: fix possible memory leak in ocfs2_finish_quota_recovery (Murad Masimov)
  - Squashfs: check return result of sb_min_blocksize (Phillip Lougher) [Orabug: 38253984] {CVE-2025-38415}
  - arm64: dts: imx8mn-beacon: Fix RTC capacitive load (Adam Ford)
  - arm64: dts: imx8mm-beacon: Fix RTC capacitive load (Adam Ford)
  - ARM: dts: at91: at91sam9263: fix NAND chip selects (Wolfram Sang)
  - ARM: dts: at91: usb_a9263: fix GPIO for Dataflash chip select (Wolfram Sang)
  - f2fs: fix to correct check conditions in f2fs_cross_rename (Zhiguo Niu)
  - f2fs: use d_inode(dentry) cleanup dentry->d_inode (Zhiguo Niu)
  - net: phy: mscc: Stop clearing the the UDPv4 checksum for L2 frames (Horatiu Vultur)
  - net: openvswitch: Fix the dead loop of MPLS parse (Faicker Mo) [Orabug: 38153064] {CVE-2025-38146}
  - calipso: Don't call calipso functions for AF_INET sk. (Kuniyuki Iwashima) [Orabug: 38153069] {CVE-2025-38147}
  - net: lan743x: rename lan743x_reset_phy to lan743x_hw_reset_phy (Thangaraj Samynathan)
  - bpf: Avoid __bpf_prog_ret0_warn when jit fails (Kafai Wan) [Orabug: 38180470] {CVE-2025-38280}
  - net: usb: aqc111: fix error handling of usbnet read calls (Nikita Zhandarovich) [Orabug: 38153088] {CVE-2025-38153}
  - netfilter: nft_tunnel: fix geneve_opt dump (Fernando Fernandez Mancera)
  - bpf, sockmap: Avoid using sk_socket after free when sending (Jiayuan Chen) [Orabug: 38153094] {CVE-2025-38154}
  - vfio/type1: Fix error unwind in migration dirty bitmap allocation (Li Rongqing)
  - netfilter: nf_tables: nft_fib_ipv6: fix VRF ipv4/ipv6 result discrepancy (Florian Westphal)
  - wifi: ath9k_htc: Abort software beacon handling if disabled (Toke Høiland-Jørgensen) [Orabug: 38153109] {CVE-2025-38157}
  - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (Alexey Kodanev) [Orabug: 38153121] {CVE-2025-38159}
  - s390/bpf: Store backchain even for leaf progs (Ilya Leoshkevich)
  - clk: qcom: gcc-msm8939: Fix mclk0 & mclk1 for 24 MHz (Vincent Knecht)
  - bpf: Fix WARN() in get_bpf_raw_tp_regs (Tao Chen) [Orabug: 38180488] {CVE-2025-38285}
  - pinctrl: at91: Fix possible out-of-boundary access (Andy Shevchenko) [Orabug: 38180494] {CVE-2025-38286}
  - libbpf: Use proper errno value in nlattr (Anton Protopopov)
  - ktls, sockmap: Fix missing uncharge operation (Jiayuan Chen)
  - clk: bcm: rpi: Add NULL check in raspberrypi_clk_register() (Henry Martin) [Orabug: 38153131] {CVE-2025-38160}
  - clk: qcom: gcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
  - bpf: Fix uninitialized values in BPF_{CORE,PROBE}_READ (Anton Protopopov)
  - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Patrisious Haddad) [Orabug: 38153138] {CVE-2025-38161}
  - netfilter: nft_quota: match correctly when the quota just depleted (Zhongqiu Duan)
  - netfilter: bridge: Move specific fragmented packet to slow_path instead of dropping it (Huajian Yang)
  - libbpf: Use proper errno value in linker (Anton Protopopov)
  - f2fs: fix to detect gcing page in f2fs_is_cp_guaranteed() (Chao Yu)
  - f2fs: clean up w/ fscrypt_is_bounce_page() (Chao Yu)
  - iommu: Protect against overflow in iommu_pgsize() (Jason Gunthorpe)
  - RDMA/hns: Include hnae3.h in hns_roce_hw_v2.h (Junxian Huang)
  - wifi: rtw88: do not ignore hardware read error during DPK (Dmitry Antipov)
  - libbpf: Fix buffer overflow in bpf_object__init_prog (Viktor Malik)
  - net: ncsi: Fix GCPS 64-bit member variables (Hari Kalavakunta)
  - f2fs: fix to do sanity check on sbi->total_valid_block_count (Chao Yu) [Orabug: 38153149] {CVE-2025-38163}
  - bpf, sockmap: fix duplicated data transmission (Jiayuan Chen)
  - IB/cm: use rwlock for MAD agent lock (Jacob Moroni)
  - wifi: ath11k: fix node corruption in ar->arvifs list (Stone Zhang) [Orabug: 38180515] {CVE-2025-38293}
  - firmware: SDEI: Allow sdei initialization without ACPI_APEI_GHES (Huang Yiwei)
  - drm/tegra: rgb: Fix the unbound reference count (Biju Das)
  - drm/vkms: Adjust vkms_state->active_planes allocation type (Kees Cook)
  - drm: rcar-du: Fix memory leak in rcar_du_vsps_init() (Biju Das)
  - selftests/seccomp: fix syscall_restart test for arm compat (Neill Kapron)
  - firmware: psci: Fix refcount leak in psci_dt_init (Miaoqian Lin)
  - m68k: mac: Fix macintosh_config for Mac II (Finn Thain)
  - fs/ntfs3: handle hdr_first_de() return value (Andrey Vatoropin) [Orabug: 38153172] {CVE-2025-38167}
  - media: rkvdec: Fix frame size enumeration (Jonas Karlman)
  - drm/amd/pp: Fix potential NULL pointer dereference in atomctrl_initialize_mc_reg_table (Charles Han) [Orabug: 38180589] {CVE-2025-38319}
  - spi: sh-msiof: Fix maximum DMA transfer size (Geert Uytterhoeven)
  - ACPI: OSI: Stop advertising support for "3.0 _SCP Extensions" (Armin Wolf)
  - x86/mtrr: Check if fixed-range MTRRs exist in mtrr_save_fixed_ranges() (Jiaqing Zhao)
  - PM: wakeup: Delete space in the end of string shown by pm_show_wakelocks() (Zijun Hu)
  - power: reset: at91-reset: Optimize at91_reset() (Alexander Shiyan)
  - EDAC/skx_common: Fix general protection fault (Qiuxu Zhuo) [Orabug: 38180524] {CVE-2025-38298}
  - crypto: sun8i-ce - move fallback ahash_request to the end of the struct (Ovidiu Panait)
  - crypto: xts - Only add ecb if it is not already there (Herbert Xu)
  - crypto: lrw - Only add ecb if it is not already there (Herbert Xu)
  - crypto: marvell/cesa - Avoid empty transfer descriptor (Herbert Xu)
  - crypto: marvell/cesa - Handle zero-length skcipher requests (Herbert Xu) [Orabug: 38153188] {CVE-2025-38173}
  - x86/cpu: Sanitize CPUID(0x80000000) output (Ahmed S. Darwish)
  - crypto: sun8i-ss - do not use sg_dma_len before calling DMA functions (Corentin Labbe)
  - perf/core: Fix broken throttling when max_samples_per_tick=1 (Qing Wang)
  - gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher)
  - thunderbolt: Do not double dequeue a configuration request (Sergey Senozhatsky) [Orabug: 38158383] {CVE-2025-38174}
  - usb: usbtmc: Fix timeout value in get_stb (Dave Penkler)
  - USB: serial: pl2303: add new chip PL2303GC-Q20 and PL2303GT-2AB (Charles Yeh)
  - usb: storage: Ignore UAS driver for SanDisk 3.2 Gen2 storage device (Hongyu Xie)
  - usb: quirks: Add NO_LPM quirk for SanDisk Extreme 55AE (Jiayi Li)
  - rtc: Fix offset calculation for .start_secs < 0 (Alexandre Mergnat)
  - rtc: Make rtc_time64_to_tm() support dates before 1970 (Alexandre Mergnat)
  - pinctrl: armada-37xx: set GPIO output value before setting direction (Gabor Juhos)
  - pinctrl: armada-37xx: use correct OUTPUT_VAL register for GPIOs > 31 (Gabor Juhos)


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-312.187.3.el9uek]
changelog:
  - TIOCSTI: Document CAP_SYS_ADMIN behaviour in Kconfig (Günther Noack) [Orabug: 38255504]
  - TIOCSTI: always enable for CAP_SYS_ADMIN (Samuel Thibault) [Orabug: 38255504]
  - tty: Fix typo in LEGACY_TIOCSTI Kconfig description (Hanno Böck) [Orabug: 38255504]
  - tty: Move TIOCSTI toggle variable before kerndoc (Kees Cook) [Orabug: 38255504]
  - tty: Allow TIOCSTI to be disabled (Kees Cook) [Orabug: 38255504]
  - tty: Move sysctl setup into "core" tty logic (Kees Cook) [Orabug: 38255504]
  - tty: reformat kernel-doc in tty_io.c (Jiri Slaby) [Orabug: 38255504]
  - tty: reformat kernel-doc in tty_ldisc.c (Jiri Slaby) [Orabug: 38255504]
  - net/mlx5: E-Switch, Fix switching to switchdev mode in MPV (Patrisious Haddad) [Orabug: 38236297]
  - net/mlx5: E-Switch, Fix switching to switchdev mode with IB device disabled (Patrisious Haddad) [Orabug: 38236297]
  - net/mlx5: E-switch, refactor eswitch mode change (Patrisious Haddad) [Orabug: 38236297]
  - IB/mlx5: Support querying eswitch functions from DEVX (Bodong Wang) [Orabug: 38236297]
  - RDMA/mlx5: Fix HW counters query for non-representor devices (Patrisious Haddad) [Orabug: 38161800]
  - RDMA/mlx5: Fix CC counters query for MPV (Patrisious Haddad) [Orabug: 38161800]
  - Revert "RDMA/mlx5: Fix CC counters query for MPV" (Qing Huang) [Orabug: 38161800]
  - RDMA/mlx5: Fix vport loopback for MPV device (Patrisious Haddad) [Orabug: 38118599]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-312.187.4.el9uek]
changelog:
  - rds: Fix NULL ptr deref in xas_start (Håkon Bugge)  [Orabug: 38166374]
  - KVM: x86: use array_index_nospec with indices that come from guest (Thijs Raymakers)  [Orabug: 38319943]
  - hugetlb: arm64: add mte support (Dave Kleikamp)  [Orabug: 38177800]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-312.187.5.el9uek]
changelog:
  - Revert "mm: hugetlb: independent PMD page table shared count" (Harshit Mogalapalli)  [Orabug: 38327655]


author: Jack Vogel <jack.vogel@oracle.com> [5.15.0-312.187.5.1.el9uek]
changelog:
  - x86/vmscape: Warn when STIBP is disabled with SMT (Pawan Gupta)  [Orabug: 38343660]  
  - x86/bugs: Move cpu_bugs_smt_update() down (Pawan Gupta)  [Orabug: 38343660]  
  - x86/vmscape: Enable the mitigation (Pawan Gupta)  [Orabug: 38343660]  
  - x86/vmscape: Add conditional IBPB mitigation (Pawan Gupta)  [Orabug: 38343660]  
  - x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (Josh Poimboeuf)  [Orabug: 38343660]  
  - x86/vmscape: Add old Intel CPUs to affected list (Pawan Gupta)  [Orabug: 38343660]  
  - x86/vmscape: Enumerate VMSCAPE bug (Pawan Gupta)  [Orabug: 38343660]  
  - Documentation/hw-vuln: Add VMSCAPE documentation (Pawan Gupta)  [Orabug: 38343660]


author: Jack Vogel <jack.vogel@oracle.com> [5.15.0-312.187.5.1.el9uek]
changelog:
  - x86/vmscape: Warn when STIBP is disabled with SMT (Pawan Gupta)  [Orabug: 38343660]
  - x86/bugs: Move cpu_bugs_smt_update() down (Pawan Gupta)  [Orabug: 38343660]
  - x86/vmscape: Enable the mitigation (Pawan Gupta)  [Orabug: 38343660]
  - x86/vmscape: Add conditional IBPB mitigation (Pawan Gupta)  [Orabug: 38343660]
  - x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (Josh Poimboeuf)  [Orabug: 38343660]
  - x86/vmscape: Add old Intel CPUs to affected list (Pawan Gupta)  [Orabug: 38343660]
  - x86/vmscape: Enumerate VMSCAPE bug (Pawan Gupta)  [Orabug: 38343660]
  - Documentation/hw-vuln: Add VMSCAPE documentation (Pawan Gupta)  [Orabug: 38343660]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-312.187.5.2.el9uek]
changelog:
  - arm64: errata: Work around AmpereOne's erratum AC04_CPU_23 (D Scott Phillips)  [Orabug: 38435500]  
  - ARM: UEK: Disable arm64 erratum QCOM_FALKOR_ERRATUM_1003 (Boris Ostrovsky)  [Orabug: 38435500]


author: Brian Maly <brian.maly@oracle.com> [5.15.0-311.185.5.el9uek]
changelog:
  - KVM: x86: Remove VT-d mention in posted interrupt tracepoint (Alejandro Jimenez) [Orabug: 38195091]
  - KVM: x86: Only set APICV_INHIBIT_REASON_ABSENT if APICv is enabled (Alejandro Jimenez) [Orabug: 38195091]
  - KVM: x86: Print names of apicv inhibit reasons in traces (Alejandro Jimenez) [Orabug: 38195091]
  - KVM: SVM: Always update local APIC on writes to logical dest register (Sean Christopherson) [Orabug: 38195091]
  - x86: Pin task-stack in __get_wchan() (Peter Zijlstra) [Orabug: 38161988]
  - x86: Fix __get_wchan() for !STACKTRACE (Peter Zijlstra) [Orabug: 38161988]
  - sched: Add wrapper for get_wchan() to keep task blocked (Kees Cook) [Orabug: 38161988]
  - x86: Fix get_wchan() to support the ORC unwinder (Qi Zheng) [Orabug: 38161988]
  - nvme: tcp: avoid race between queue_lock lock and destroy (Hannes Reinecke) [Orabug: 37331887] {CVE-2024-53100}
  - PCI/AER: Add sysfs attributes for log ratelimits (Jon Pan-Doh) [Orabug: 36952192]
  - PCI/AER: Ratelimit correctable and non-fatal error logging (Jon Pan-Doh) [Orabug: 36952192]
  - PCI/AER: Simplify add_error_device() (Bjorn Helgaas) [Orabug: 36952192]
  - PCI/AER: Convert aer_get_device_error_info(), aer_print_error() to index (Bjorn Helgaas) [Orabug: 36952192]
  - PCI/AER: Reduce pci_print_aer() correctable error level to KERN_WARNING (Karolina Stolarek) [Orabug: 36952192]
  - PCI/AER: Check log level once and remember it (Karolina Stolarek) [Orabug: 36952192]
  - PCI/AER: Trace error event before ratelimiting (Bjorn Helgaas) [Orabug: 36952192]
  - PCI/AER: Update statistics before ratelimiting (Bjorn Helgaas) [Orabug: 36952192]
  - PCI/AER: Simplify pci_print_aer() (Bjorn Helgaas) [Orabug: 36952192]
  - PCI/AER: Initialize aer_err_info before using it (Bjorn Helgaas) [Orabug: 36952192]
  - PCI/AER: Move aer_print_source() earlier in file (Bjorn Helgaas) [Orabug: 36952192]
  - PCI/AER: Rename aer_print_port_info() to aer_print_source() (Jon Pan-Doh) [Orabug: 36952192]
  - PCI/AER: Extract bus/dev/fn in aer_print_port_info() with PCI_BUS_NUM(), etc (Bjorn Helgaas) [Orabug: 36952192]
  - PCI/AER: Consolidate Error Source ID logging in aer_isr_one_error_type() (Bjorn Helgaas) [Orabug: 36952192]
  - PCI/AER: Factor COR/UNCOR error handling out from aer_isr_one_error() (Bjorn Helgaas) [Orabug: 36952192]
  - PCI/AER: Descope pci_printk() to aer_printk() (Ilpo Järvinen) [Orabug: 36952192]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-312.187.2.el9uek]
changelog:
  - EDAC: Octeon: Fix compile error by replacing sdei_init() with acpi_sdei_init() (Vijayendra Suman) [Orabug: 38294908]
  - LTS version: v5.15.187 (Vijayendra Suman)
  - usb: typec: displayport: Fix potential deadlock (Andrei Kuchynski) [Orabug: 38309912] {CVE-2025-38404}
  - platform/x86: think-lmi: Create ksets consecutively (Kurt Borja)
  - Logitech C-270 even more broken (Oliver Neukum)
  - i2c/designware: Fix an initialization issue (Michael J. Ruhl)
  - usb: cdnsp: do not disable slot for disabled slot (Peter Chen)
  - xhci: dbc: Flush queued requests before stopping dbc (Mathias Nyman)
  - xhci: dbctty: disable ECHO flag by default (Łukasz Bartosik)
  - platform/x86: dell-wmi-sysman: Fix class device unregistration (Kurt Borja)
  - platform/x86: think-lmi: Fix class device unregistration (Kurt Borja)
  - dpaa2-eth: fix xdp_rxq_info leak (Wangfushuai)
  - net: dpaa2-eth: rearrange variable in dpaa2_eth_get_ethtool_stats (Ioana Ciornei)
  - dpaa2-eth: Update SINGLE_STEP register access (Radu Bulie)
  - dpaa2-eth: Update dpni_get_single_step_cfg command (Radu Bulie)
  - ethernet: atl1: Add missing DMA mapping error checks and count errors (Thomas Fourier)
  - NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Trond Myklebust)
  - drm/v3d: Disable interrupts before resetting the GPU (Maíra Canal) [Orabug: 38253820] {CVE-2025-38371}
  - regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods (Manivannan Sadhasivam) [Orabug: 38253906] {CVE-2025-38395}
  - regulator: gpio: Add input_supply support in gpio_regulator_config (Jerome Neanne)
  - mmc: core: sd: Apply BROKEN_SD_DISCARD quirk earlier (Avri Altman)
  - rcu: Return early if callback is not specified (Uladzislau Rezki)
  - mtd: spinand: fix memory leak of ECC engine conf (Pablo Martin-Gomez) [Orabug: 38253863] {CVE-2025-38384}
  - ACPICA: Refuse to evaluate a method if arguments are missing (Rafael J. Wysocki) [Orabug: 38253874] {CVE-2025-38386}
  - wifi: ath6kl: remove WARN on bad firmware input (Johannes Berg) [Orabug: 38253945] {CVE-2025-38406}
  - wifi: mac80211: drop invalid source address OCB frames (Johannes Berg)
  - scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() (Maurizio Lombardi) [Orabug: 38253914] {CVE-2025-38399}
  - powerpc: Fix struct termio related ioctl macros (Madhavan Srinivasan)
  - ata: pata_cs5536: fix build on 32-bit UML (Johannes Berg)
  - ALSA: sb: Force to disable DMAs once when DMA mode is changed (Takashi Iwai)
  - ALSA: sb: Don't allow changing the DMA mode during operations (Takashi Iwai)
  - drm/msm: Fix a fence leak in submit error path (Rob Clark) [Orabug: 38253967] {CVE-2025-38410}
  - nui: Fix dma_mapping_error() check (Thomas Fourier)
  - rose: fix dangling neighbour pointers in rose_rt_device_down() (Kohei Enju) [Orabug: 38253841] {CVE-2025-38377}
  - enic: fix incorrect MTU comparison in enic_change_mtu() (Alok Tiwari)
  - amd-xgbe: align CL37 AN sequence as per databook (Raju Rangoju)
  - lib: test_objagg: Set error message in check_expect_hints_stats() (Dan Carpenter)
  - igc: disable L1.2 PCI-E link substate to avoid performance issue (Vitaly Lifshits)
  - drm/i915/gt: Fix timeline left held on VMA alloc error (Janusz Krzysztofik) [Orabug: 38253886] {CVE-2025-38389}
  - platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks (Kurt Borja) [Orabug: 38253976] {CVE-2025-38412}
  - drm/i915/selftests: Change mock_request() to return error pointers (Dan Carpenter)
  - spi: spi-fsl-dspi: Clear completion counter before initiating transfer (James Clark)
  - drm/exynos: fimd: Guard display clock control with runtime PM calls (Marek Szyprowski)
  - btrfs: fix missing error handling when searching for inode refs during log replay (Filipe Manana)
  - scsi: ufs: core: Fix spelling of a sysfs attribute name (Bart Van Assche)
  - scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu() (Thomas Fourier)
  - scsi: qla2xxx: Fix DMA mapping test in qla24xx_get_port_database() (Thomas Fourier)
  - NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [Orabug: 38253900] {CVE-2025-38393}
  - nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. (Kuniyuki Iwashima) [Orabug: 38253922] {CVE-2025-38400}
  - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Mark Zhang) [Orabug: 38253880] {CVE-2025-38387}
  - platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment (David Thompson)
  - mtk-sd: reset host->mrq on prepare_data() error (Sergey Senozhatsky)
  - mtk-sd: Prevent memory corruption from DMA map failure (Masami Hiramatsu) [Orabug: 38253927] {CVE-2025-38401}
  - mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data (Masami Hiramatsu)
  - usb: typec: altmodes/displayport: do not index invalid pin_assignments (Rd Babiera) [Orabug: 38253893] {CVE-2025-38391}
  - mmc: sdhci: Add a helper function for dump register in dynamic debug mode (Victor Shih)
  - vsock/vmci: Clear the vmci transport packet properly when initializing it (Harshavardhana S A) [Orabug: 38253936] {CVE-2025-38403}
  - rtc: cmos: use spin_lock_irqsave in cmos_interrupt (Mateusz Jończyk)
  - ARM: 9354/1: ptrace: Use bitfield helpers (Geert Uytterhoeven)
  - btrfs: don't drop extent_map for free space inode on write error (Josef Bacik) [Orabug: 36530624] {CVE-2024-26726}
  - arm64: Restrict pagetable teardown to avoid false warning (Dev Jain)
  - s390: Add '-std=gnu11' to decompressor and purgatory CFLAGS (Nathan Chancellor)
  - s390/entry: Fix last breaking event handling in case of stack corruption (Heiko Carstens)
  - media: uvcvideo: Rollback non processed entities on error (Ricardo Ribalda)
  - PCI: hv: Do not set PCI_COMMAND_MEMORY to reduce VM boot time (Dexuan Cui)
  - drm/amd/display: Add null pointer check for get_first_active_display() (Xu Wang) [Orabug: 38253794] {CVE-2025-38362}
  - drm/bridge: cdns-dsi: Wait for Clk and Data Lanes to be ready (Aradhya Bhatia)
  - drm/bridge: cdns-dsi: Check return value when getting default PHY config (Aradhya Bhatia)
  - drm/bridge: cdns-dsi: Fix connecting to next bridge (Aradhya Bhatia)
  - drm/bridge: cdns-dsi: Fix the clock variable for mode_valid() (Aradhya Bhatia)
  - drm/amdkfd: Fix race in GWS queue scheduling (Jay Cornwall)
  - drm/udl: Unregister device before cleaning up on disconnect (Thomas Zimmermann)
  - drm/tegra: Fix a possible null pointer dereference (Qiu-Ji Chen) [Orabug: 38253800] {CVE-2025-38363}
  - drm/tegra: Assign plane type before registration (Thierry Reding)
  - HID: wacom: fix kobject reference count leak (Qasim Ijaz)
  - HID: wacom: fix memory leak on sysfs attribute creation failure (Qasim Ijaz)
  - HID: wacom: fix memory leak on kobject creation failure (Qasim Ijaz)
  - btrfs: update superblock's device bytes_used when dropping chunk (Mark Harmstone)
  - dm-raid: fix variable in journal device check (Heinz Mauelshagen)
  - Bluetooth: L2CAP: Fix L2CAP MTU negotiation (Frédéric Danis)
  - dt-bindings: serial: 8250: Make clocks and clock-frequency exclusive (Yao Zi)
  - staging: rtl8723bs: Avoid memset() in aes_cipher() and aes_decipher() (Nathan Chancellor)
  - net: selftests: fix TCP packet checksum (Jakub Kicinski)
  - atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister(). (Kuniyuki Iwashima) [Orabug: 38175043] {CVE-2025-38245}
  - net: enetc: Correct endianness handling in _enetc_rd_reg64 (Simon Horman)
  - um: ubd: Add missing error check in start_io_thread() (Tiwei Bie)
  - vsock/uapi: fix linux/vm_sockets.h userspace compilation errors (Stefano Garzarella)
  - af_unix: Don't set -ECONNRESET for consumed OOB skb. (Kuniyuki Iwashima)
  - wifi: mac80211: fix beacon interval calculation overflow (Lachlan Hodges)
  - libbpf: Fix null pointer dereference in btf_dump__free on allocation failure (Yuan Chen)
  - attach_recursive_mnt(): do not lock the covering tree when sliding something under it (Al Viro)
  - ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() (Youngjun Lee) [Orabug: 38175063] {CVE-2025-38249}
  - atm: clip: prevent NULL deref in clip_push() (Eric Dumazet) [Orabug: 38175077] {CVE-2025-38251}
  - s390/pkey: Prevent overflow in size calculation for memdup_user() (Fedor Pchelkin) [Orabug: 38175091] {CVE-2025-38257}
  - i2c: robotfuzz-osif: disable zero-length read messages (Wolfram Sang)
  - i2c: tiny-usb: disable zero-length read messages (Wolfram Sang)
  - platform/x86: ideapad-laptop: use usleep_range() for EC polling (Rongrong)
  - dummycon: Trigger redraw when switching consoles with deferred takeover (Thomas Zimmermann)
  - tty: vt: make consw::con_switch() return a bool (Jiri Slaby)
  - tty: vt: sanitize arguments of consw::con_clear() (Jiri Slaby)
  - tty: vt: make init parameter of consw::con_init() a bool (Jiri Slaby)
  - vgacon: remove unneeded forward declarations (Jiri Slaby)
  - vgacon: switch vgacon_scrolldelta() and vgacon_restore_screen() (Jiri Slaby)
  - tty/vt: consolemap: rename and document struct uni_pagedir (Jiri Slaby)
  - fbcon: delete a few unneeded forward decl (Daniel Vetter)
  - uio_hv_generic: Align ring size to system page (Long Li)
  - uio_hv_generic: Query the ringbuffer size for device (Saurabh Singh Sengar)
  - Drivers: hv: vmbus: Add utility function for querying ring size (Saurabh Singh Sengar)
  - Drivers: hv: Rename 'alloced' to 'allocated' (Vitaly Kuznetsov)
  - f2fs: don't over-report free space or inodes in statvfs (Chao Yu)
  - media: imx-jpeg: Drop the first error frames (Ming Qian)
  - clk: ti: am43xx: Add clkctrl data for am43xx ADC1 (Miquel Raynal)
  - media: omap3isp: use sgtable-based scatterlist wrappers (Marek Szyprowski)
  - media: davinci: vpif: Fix memory leak in probe error path (Dmitry Nikiforov)
  - jfs: validate AG parameters in dbMount() to prevent crashes (Vasiliy Kovalev) [Orabug: 38158700] {CVE-2025-38230}
  - fs/jfs: consolidate sanity checking in dbMount (Dave Kleikamp)
  - ovl: Check for NULL d_inode() in ovl_dentry_upper() (Kees Cook)
  - ceph: fix possible integer overflow in ceph_zero_objects() (Dmitry Kandybka)
  - ALSA: usb-audio: Add a quirk for Lenovo Thinkpad Thunderbolt 3 dock (Mario Limonciello)
  - ALSA: hda: Add new pci id for AMD GPU display HD audio controller (Vijendar Mukunda)
  - ALSA: hda: Ignore unsol events for cards being shut down (Cezary Rojewski)
  - usb: typec: displayport: Receive DP Status Update NAK request exit dp altmode (Jos Wang)
  - usb: cdc-wdm: avoid setting WDM_READ for ZLP-s (Robert Hodaszi)
  - usb: Add checks for snprintf() calls in usb_alloc_dev() (Andy Shevchenko)
  - usb: common: usb-conn-gpio: use a unique name for usb connector device (Chance Yang)
  - tty: serial: uartlite: register uart driver in init (Jakub Lewalski) [Orabug: 38175113] {CVE-2025-38262}
  - usb: potential integer overflow in usbg_make_tpg() (Chen Yufeng)
  - usb: dwc2: also exit clock_gating when stopping udc while suspended (Michael Grzeschik)
  - coresight: Only check bottom two claim bits (James Clark)
  - um: Add cmpxchg8b_emu and checksum functions to asm-prototypes.h (Sami Tolvanen)
  - iio: pressure: zpa2326: Use aligned_s64 for the timestamp (Jonathan Cameron)
  - bcache: fix NULL pointer in cache_set_flush() (Linggang Zeng) [Orabug: 38175119] {CVE-2025-38263}
  - md/md-bitmap: fix dm-raid max_write_behind setting (Yu Kuai)
  - dmaengine: xilinx_dma: Set dma_device directions (Thomas Gessler)
  - ksmbd: allow a filename to contain special characters on SMB3.1.1 posix extension (Namjae Jeon)
  - hwmon: (pmbus/max34440) Fix support for max34451 (Alexis Czezar Torreno)
  - leds: multicolor: Fix intensity setting while SW blinking (Sven Schwermer)
  - mfd: max14577: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
  - mailbox: Not protect module_put with spin_lock_irqsave (Peng Fan)
  - NFSv4.2: fix listxattr to return selinux security label (Olga Kornievskaia)
  - NFSv4: Always set NLINK even if the server doesn't support it (Han Young)
  - cifs: Fix cifs_query_path_info() for Windows NT servers (Pali Rohár)
  - LTS version: v5.15.186 (Vijayendra Suman)
  - scsi: qedf: Use designated initializer for struct qed_fcoe_cb_ops (Kees Cook)
  - scsi: elx: efct: Fix memory leak in efct_hw_parse_filter() (Vitaliy Shevtsov)
  - arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() (Tengda Wu) [Orabug: 38180595] {CVE-2025-38320}
  - perf: Fix sample vs do_exit() (Peter Zijlstra) [Orabug: 38254029] {CVE-2025-38424}
  - s390/pci: Fix __pcilg_mio_inuser() inline assembly (Heiko Carstens)
  - bpf: Fix L4 csum update on IPv6 in CHECKSUM_COMPLETE (Paul Chaignon)
  - net: Fix checksum update for ILA adj-transport (Paul Chaignon)
  - ext4: avoid remount errors with 'abort' mount option (Jan Kara)
  - ext4: make 'abort' mount option handling standard (Jan Kara)
  - mm/huge_memory: fix dereferencing invalid pmd migration entry (Gavin Guo) [Orabug: 37976983] {CVE-2025-37958}
  - net_sched: sch_sfq: reject invalid perturb period (Eric Dumazet) [Orabug: 38158476] {CVE-2025-38193}
  - arm64: proton-pack: Add new CPUs 'k' values for branch mitigation (James Morse)
  - arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users (James Morse) [Orabug: 37977005] {CVE-2025-37963}
  - arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs (James Morse) [Orabug: 37976929] {CVE-2025-37948}
  - arm64: spectre: increase parameters that can be used to turn off bhb mitigation individually (Liu Song)
  - arm64: proton-pack: Expose whether the branchy loop k value (James Morse)
  - arm64: proton-pack: Expose whether the platform is mitigated by firmware (James Morse)
  - arm64: insn: Add support for encoding DSB (James Morse)
  - arm64: insn: add encoders for atomic operations (Hou Tao)
  - arm64: move AARCH64_BREAK_FAULT into insn-def.h (Hou Tao)
  - serial: sh-sci: Increment the runtime usage counter for the earlycon device (Claudiu Beznea)
  - ARM: dts: am335x-bone-common: Increase MDIO reset deassert delay to 50ms (Geert Uytterhoeven)
  - ARM: dts: am335x-bone-common: Increase MDIO reset deassert time (Colin Foster)
  - ARM: dts: am335x-bone-common: Add GPIO PHY reset on revision C3 board (Shengyu Qu)
  - net: atm: fix /proc/net/atm/lec handling (Eric Dumazet) [Orabug: 38158405] {CVE-2025-38180}
  - net: atm: add lec_mutex (Eric Dumazet) [Orabug: 38180611] {CVE-2025-38323}
  - calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). (Kuniyuki Iwashima) [Orabug: 38158412] {CVE-2025-38181}
  - tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (Haixia Qu) [Orabug: 38158424] {CVE-2025-38184}
  - tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen() behavior (Neal Cardwell)
  - atm: atmtcp: Free invalid length skb in atmtcp_c_send(). (Kuniyuki Iwashima) [Orabug: 38158433] {CVE-2025-38185}
  - mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). (Kuniyuki Iwashima) [Orabug: 38180617] {CVE-2025-38324}
  - wifi: carl9170: do not ping device which has failed to load firmware (Dmitry Antipov) [Orabug: 38254010] {CVE-2025-38420}
  - ptp: fix breakage after ptp_vclock_in_use() rework (Vladimir Oltean)
  - net: ice: Perform accurate aRFS flow match (Krishna Kumar)
  - aoe: clean device rq_list in aoedev_downdev() (Justin Sanders) [Orabug: 38180627] {CVE-2025-38326}
  - pldmfw: Select CRC32 when PLDMFW is selected (Simon Horman)
  - hwmon: (occ) fix unaligned accesses (Arnd Bergmann)
  - hwmon: (occ) Rework attribute registration for stack usage (Arnd Bergmann)
  - hwmon: (occ) Add soft minimum power cap attribute (Eddie James)
  - drm/nouveau/bl: increase buffer size to avoid truncate warning (Jacob Keller)
  - drm/msm/dsi/dsi_phy_10nm: Fix missing initial VCO rate (Krzysztof Kozlowski)
  - erofs: remove unused trace event erofs_destroy_inode (Gao Xiang)
  - mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Jann Horn) [Orabug: 38132180] {CVE-2025-38085}
  - mm: hugetlb: independent PMD page table shared count (Liu Shixin) [Orabug: 37484959] {CVE-2024-57883}
  - mm/hugetlb: unshare page tables during VMA split, not before (Jann Horn) [Orabug: 38132171] {CVE-2025-38084}
  - iio: accel: fxls8962af: Fix temperature calculation (Sean Nyekjaer)
  - ALSA: hda/realtek: enable headset mic on Latitude 5420 Rugged (Jonathan Lane)
  - ALSA: hda/intel: Add Thinkpad E15 to PM deny list (Takashi Iwai)
  - ALSA: usb-audio: Rename ALSA kcontrol PCM and PCM1 for the KTMicro sound card (Wangdicheng)
  - Input: sparcspkr - avoid unannotated fall-through (Yuli Wang)
  - block: default BLOCK_LEGACY_AUTOLOAD to y (Christoph Hellwig)
  - HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() (Terry Junge) [Orabug: 38152876] {CVE-2025-38103}
  - atm: Revert atm_account_tx() if copy_from_iter_full() fails. (Kuniyuki Iwashima) [Orabug: 38158457] {CVE-2025-38190}
  - selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len (Stephen Smalley)
  - selftests/x86: Add a test to detect infinite SIGTRAP handler loop (Xin Li)
  - udmabuf: use sgtable-based scatterlist wrappers (Marek Szyprowski)
  - scsi: s390: zfcp: Ensure synchronous unit_add (Peter Oberparleiter)
  - scsi: storvsc: Increase the timeouts to storvsc_timeout (Dexuan Cui)
  - jffs2: check jffs2_prealloc_raw_node_refs() result in few other places (Fedor Pchelkin) [Orabug: 38180635] {CVE-2025-38328}
  - jffs2: check that raw node were preallocated before writing summary (Artem Sadovnikov) [Orabug: 38158483] {CVE-2025-38194}
  - drivers/rapidio/rio_cm.c: prevent possible heap overwrite (Andrew Morton) [Orabug: 38137453] {CVE-2025-38090}
  - powerpc/eeh: Fix missing PE bridge reconfiguration during VFIO EEH recovery (Narayana Murty N)
  - platform/x86: dell_rbu: Stop overwriting data buffer (Stuart Hayes)
  - platform/x86: dell_rbu: Fix list usage (Stuart Hayes) [Orabug: 38158494] {CVE-2025-38197}
  - Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first" (Alexander Sverdlin)
  - tee: Prevent size calculation wraparound on 32-bit kernels (Jann Horn)
  - ARM: OMAP2+: Fix l4ls clk domain handling in STANDBY (Sukrut Bellary)
  - bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value (Laurentiu Tudor)
  - watchdog: da9052_wdt: respect TWDMIN (Marcus Folkesson)
  - octeontx2-pf: Add error log forcn10k_map_unmap_rq_policer() (Xu Wang)
  - bpf, sockmap: Fix data lost during EAGAIN retries (Jiayuan Chen)
  - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Kyungwook Boo) [Orabug: 38158517] {CVE-2025-38200}
  - sock: Correct error checking condition for (assign|release)_proto_idx() (Zijun Hu)
  - scsi: lpfc: Use memcpy() for BIOS version (Daniel Wagner) [Orabug: 38180667] {CVE-2025-38332}
  - pinctrl: mcp23s08: Reset all pins to input at probe (Mike Looijmans)
  - software node: Correct a OOB check in software_node_get_reference_args() (Zijun Hu) [Orabug: 38180730] {CVE-2025-38342}
  - vxlan: Do not treat dst cache initialization errors as fatal (Ido Schimmel)
  - net: bridge: mcast: re-implement br_multicast_{enable, disable}_port functions (Yong Wang)
  - iommu/amd: Ensure GA log notifier callbacks finish running before module unload (Sean Christopherson)
  - scsi: lpfc: Fix lpfc_check_sli_ndlp() handling for GEN_REQUEST64 commands (Justin Tee)
  - libbpf: Add identical pointer detection to btf_dedup_is_equiv() (Alan Maguire)
  - clk: rockchip: rk3036: mark ddrphy as critical (Heiko Stuebner)
  - wifi: mac80211: do not offer a mesh path if forwarding is disabled (Benjamin Berg)
  - net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info (Jason Xing)
  - pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get() (Gabor Juhos)
  - pinctrl: armada-37xx: propagate error from armada_37xx_pmx_gpio_set_direction() (Gabor Juhos)
  - pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get_direction() (Gabor Juhos)
  - pinctrl: armada-37xx: propagate error from armada_37xx_pmx_set_by_name() (Gabor Juhos)
  - net: atlantic: generate software timestamp just before the doorbell (Jason Xing)
  - ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT (Sebastian Andrzej Siewior)
  - tcp: fix initial tp->rcvq_space.space value for passive TS enabled flows (Eric Dumazet)
  - tcp: always seek for minimal rtt in tcp_rcv_rtt_update() (Eric Dumazet)
  - net: dlink: add synchronization for stats update (Moon Yeounsu)
  - i2c: npcm: Add clock toggle recovery (Tali Perry)
  - cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs (Mike Tipton)
  - sctp: Do not wake readers in __sctp_write_space() (Petr Malat)
  - wifi: mt76: mt76x2: Add support for LiteOn WN4516R,WN4519R (Henk Vergonet)
  - emulex/benet: correct command version selection in be_cmd_get_stats() (Alok Tiwari)
  - i2c: designware: Invoke runtime suspend on quick slave re-registration (Tan En De)
  - tipc: use kfree_sensitive() for aead cleanup (Zilin Guan)
  - net: macb: Check return value of dma_set_mask_and_coherent() (Sergio Perez Gonzalez)
  - cpufreq: Force sync policy boost with global boost on sysfs update (Viresh Kumar)
  - thermal/drivers/qcom/tsens: Update conditions to strictly evaluate for IP v2+ (George Moussalem)
  - pmdomain: ti: Fix STANDBY handling of PER power domain (Sukrut Bellary)
  - nios2: force update_mmu_cache on spurious tlb-permission--related pagefaults (Simon Schuster)
  - media: i2c: imx334: update mode_3840x2160_regs array (Shravan Chippa)
  - media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode() (Xu Wang) [Orabug: 38175013] {CVE-2025-38237}
  - media: tc358743: ignore video while HPD is low (Hans Verkuil)
  - drm/amdkfd: Set SDMA_RLCx_IB_CNTL/SWITCH_INSIDE_IB (Amber Lin)
  - drm/msm/dpu: don't select single flush for active CTL blocks (Dmitry Baryshkov)
  - jfs: Fix null-ptr-deref in jfs_ioc_trim (Dylan Wolff) [Orabug: 38158545] {CVE-2025-38203}
  - drm/amdgpu/gfx9: fix CSIB handling (Alex Deucher)
  - drm/amdgpu/gfx8: fix CSIB handling (Alex Deucher)
  - ext4: prevent stale extent cache entries caused by concurrent get es_cache (Zhang Yi)
  - sunrpc: fix race in cache cleanup causing stale nextcheck time (Long Li)
  - media: rkvdec: Initialize the m2m context before the controls (Nicolas Dufresne)
  - media: ti: cal: Fix wrong goto on error path (Tomi Valkeinen)
  - jfs: fix array-index-out-of-bounds read in add_missing_indices (Aditya Dutt) [Orabug: 38158552] {CVE-2025-38204}
  - ext4: ext4: unify EXT4_EX_NOCACHE|NOFAIL flags in ext4_ext_remove_space() (Zhang Yi)
  - drm/amdgpu/gfx7: fix CSIB handling (Alex Deucher)
  - media: uapi: v4l: Change V4L2_TYPE_IS_CAPTURE condition (Nas Chung)
  - media: ccs-pll: Better validate VT PLL branch (Sakari Ailus)
  - drm/amdgpu/gfx10: fix CSIB handling (Alex Deucher)
  - media: i2c: imx334: Fix runtime PM handling in remove function (Tarang Raval)
  - drm/msm/a6xx: Increase HFI response timeout (Akhil P Oommen)
  - drm/amd/display: Add NULL pointer checks in dm_force_atomic_commit() (Srinivasan Shanmugam)
  - media: uapi: v4l: Fix V4L2_TYPE_IS_OUTPUT condition (Nas Chung)
  - drm/msm/hdmi: add runtime PM calls to DDC transfer function (Dmitry Baryshkov)
  - media: i2c: imx334: Enable runtime PM before sub-device registration (Tarang Raval)
  - drm/bridge: anx7625: change the gpiod_set_value API (Ayushi Makhija)
  - exfat: fix double free in delayed_free (Namjae Jeon) [Orabug: 38158566] {CVE-2025-38206}
  - drm/bridge: analogix_dp: Add irq flag IRQF_NO_AUTOEN instead of calling disable_irq() (Damon Ding)
  - sunrpc: update nextcheck time when adding new cache entries (Long Li)
  - drm/amdgpu/gfx6: fix CSIB handling (Alex Deucher)
  - ACPI: battery: negate current when discharging (Peter Marheine)
  - PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn() (Charan Teja Kalla)
  - ASoC: tegra210_ahub: Add check to of_device_get_match_data() (Yuanjun Gong)
  - ACPICA: utilities: Fix overflow check in vsnprintf() (Philip Redkin)
  - power: supply: bq27xxx: Retrieve again when busy (Jerry Lv)
  - ACPICA: fix acpi parse and parseext cache leaks (Seunghun Han) [Orabug: 38180747] {CVE-2025-38344}
  - ACPI: bus: Bail out if acpi_kobj registration fails (Armin Wolf)
  - ASoC: tas2770: Power cycle amp on ISENSE/VSENSE change (Hector Martin)
  - ACPICA: Avoid sequence overread in call to strncmp() (Ahmed Salem)
  - clocksource: Fix the CPUs' choice in the watchdog per CPU verification (Guilherme G. Piccoli)
  - ACPICA: fix acpi operand cache leak in dswstate.c (Seunghun Han) [Orabug: 38180755] {CVE-2025-38345}
  - iio: adc: ad7606_spi: fix reg write value mask (David Lechner)
  - iio: imu: inv_icm42600: Fix temperature calculation (Sean Nyekjaer)
  - iio: accel: fxls8962af: Fix temperature scan element sign (Sean Nyekjaer)
  - PCI: dw-rockchip: Fix PHY function call sequence in rockchip_pcie_phy_deinit() (Diederik de Haas)
  - PCI: Fix lock symmetry in pci_slot_unlock() (Ilpo Järvinen)
  - PCI: Add ACS quirk for Loongson PCIe (Huacai Chen)
  - PCI: cadence-ep: Correct PBA offset in .set_msix() callback (Niklas Cassel)
  - uio_hv_generic: Use correct size for interrupt and monitor pages (Long Li)
  - remoteproc: core: Release rproc->clean_table after rproc_attach() fails (Xiaolei Wang) [Orabug: 38254002] {CVE-2025-38418}
  - remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach() (Xiaolei Wang) [Orabug: 38254006] {CVE-2025-38419}
  - regulator: max14577: Add error check for max14577_read_reg() (Xu Wang)
  - mips: Add -std= flag specified in KBUILD_CFLAGS to vdso CFLAGS (Khem Raj)
  - staging: iio: ad5933: Correct settling cycles encoding per datasheet (Gabriel)
  - net: ch9200: fix uninitialised access during mii_nway_restart (Qasim Ijaz) [Orabug: 38132188] {CVE-2025-38086}
  - ftrace: Fix UAF when lookup kallsym after ftrace disabled (Ye Bin) [Orabug: 38180767] {CVE-2025-38346}
  - dm-mirror: fix a tiny race condition (Mikulas Patocka)
  - mtd: nand: sunxi: Add randomizer configuration before randomizer enable (Xu Wang)
  - mtd: rawnand: sunxi: Add randomizer configuration in sunxi_nfc_hw_ecc_write_chunk (Xu Wang)
  - mm: fix ratelimit_pages update error in dirty_ratio_handler() (Jinliang Zheng)
  - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Shin'Ichiro Kawasaki) [Orabug: 38158591] {CVE-2025-38211}
  - ipc: fix to protect IPCS lookups using RCU (Jeongjun Park) [Orabug: 38158597] {CVE-2025-38212}
  - clk: meson-g12a: add missing fclk_div2 to spicc (Da Xue)
  - parisc: fix building with gcc-15 (Arnd Bergmann)
  - vgacon: Add check for vc_origin address range in vgacon_scroll() (Gong, Ruiqi)
  - fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var (Murad Masimov) [Orabug: 38158614] {CVE-2025-38214}
  - EDAC/altera: Use correct write width with the INTTEST register (Niravkumar L Rabara)
  - NFC: nci: uart: Set tty->disc_data only in success path (Krzysztof Kozlowski) [Orabug: 38253991] {CVE-2025-38416}
  - f2fs: fix to do sanity check on sit_bitmap_size (Chao Yu) [Orabug: 38158639] {CVE-2025-38218}
  - f2fs: prevent kernel warning due to negative i_nlink from corrupted image (Jaegeuk Kim) [Orabug: 38158647] {CVE-2025-38219}
  - Input: ims-pcu - check record size in ims_pcu_flash_firmware() (Dan Carpenter) [Orabug: 38254053] {CVE-2025-38428}
  - ext4: ensure i_size is smaller than maxbytes (Zhang Yi)
  - ext4: factor out ext4_get_maxbytes() (Zhang Yi)
  - ext4: fix calculation of credits for extent tree modification (Jan Kara)
  - ext4: inline: fix len overflow in ext4_prepare_inline_data (Thadeu Lima de Souza Cascardo) [Orabug: 38158661] {CVE-2025-38222}
  - bus: fsl-mc: fix GET/SET_TAILDROP command ids (Wan Junjie)
  - bus: fsl-mc: do not add a device-link for the UAPI used DPMCP device (Ioana Ciornei)
  - ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330 (Tasos Sahanidis) [Orabug: 38180696] {CVE-2025-38336}
  - can: tcan4x5x: fix power regulator retrieval during probe (Brett Werling)
  - bus: mhi: host: Fix conflict between power_up and SYSERR (Jeffrey Hugo)
  - ARM: omap: pmic-cpcap: do not mess around without CPCAP or OMAP4 (Andreas Kemnade)
  - ARM: 9447/1: arm/memremap: fix arch_memremap_can_ram_remap() (Ross Stutterheim)
  - media: uvcvideo: Fix deferred probing error (Ricardo Ribalda)
  - media: uvcvideo: Send control events for partial succeeds (Ricardo Ribalda)
  - media: uvcvideo: Return the number of processed controls (Ricardo Ribalda)
  - media: vivid: Change the siize of the composing (Denis Arefev) [Orabug: 38158680] {CVE-2025-38226}
  - media: vidtv: Terminating the subsequent process of initialization failure (Edward Adam Davis) [Orabug: 38158685] {CVE-2025-38227}
  - media: videobuf2: use sgtable-based scatterlist wrappers (Marek Szyprowski)
  - media: venus: Fix probe error handling (Loic Poulain)
  - media: v4l2-dev: fix error handling in __video_register_device() (Ma Ke)
  - media: gspca: Add error handling for stv06xx_read_sensor() (Xu Wang)
  - media: cxusb: no longer judge rbuf when the write fails (Edward Adam Davis) [Orabug: 38158691] {CVE-2025-38229}
  - media: ccs-pll: Check for too high VT PLL multiplier in dual PLL case (Sakari Ailus)
  - media: ccs-pll: Correct the upper limit of maximum op_pre_pll_clk_div (Sakari Ailus)
  - media: ccs-pll: Start OP pre-PLL multiplier search from correct value (Sakari Ailus)
  - media: ccs-pll: Start VT pre-PLL multiplier search from correct value (Sakari Ailus)
  - media: ov8856: suppress probe deferral errors (Johan Hovold)
  - wifi: rtlwifi: disable ASPM for RTL8723BE with subsystem ID 11ad:1723 (Mingcong Bai)
  - jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() (Jeongjun Park) [Orabug: 38180706] {CVE-2025-38337}
  - nfsd: Initialize ssc before laundromat_work to prevent NULL dereference (Li Lingfeng) [Orabug: 38158706] {CVE-2025-38231}
  - nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request (Neil Brown) [Orabug: 38254061] {CVE-2025-38430}
  - wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback() (Christian Lamparter) [Orabug: 38180782] {CVE-2025-38348}
  - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Xu Wang)
  - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Xu Wang)
  - powerpc/pseries/msi: Avoid reading PCI device registers in reduced power states (Gautam Menghani)
  - ASoC: meson: meson-card-utils: use of_property_present() for DT parsing (Martin Blumenstingl)
  - ASoC: qcom: sdm845: Add error handling in sdm845_slim_snd_hw_params() (Xu Wang)
  - gfs2: move msleep to sleepable context (Alexander Aring)
  - crypto: marvell/cesa - Do not chain submitted requests (Herbert Xu)
  - configfs: Do not override creating attribute file failure in populate_attrs() (Zijun Hu)
  - xfs: allow inode inactivation during a ro mount log recovery (Darrick J. Wong)
  - kbuild: hdrcheck: fix cross build with clang (Arnd Bergmann)
  - kbuild: userprogs: fix bitsize and target detection on clang (Thomas Weißschuh)
  - drm/meson: Use 1000ULL when operating with mode->clock (I Hsin Cheng)
  - net: usb: aqc111: debug info before sanitation (Oliver Neukum)
  - calipso: unlock rcu before returning -EAFNOSUPPORT (Eric Dumazet)
  - x86/iopl: Cure TIF_IO_BITMAP inconsistencies (Thomas Gleixner) [Orabug: 38152863] {CVE-2025-38100}
  - xen/arm: call uaccess_ttbr0_enable for dm_op hypercall (Stefano Stabellini)
  - usb: typec: tcpm/tcpci_maxim: Fix bounds check in process_rx() (Amit Sunil Dhamne)
  - usb: Flush altsetting 0 endpoints before reinitializating them after reset. (Mathias Nyman)
  - usb: cdnsp: Fix issue with detecting USB 3.2 speed (Pawel Laszczak)
  - usb: cdnsp: Fix issue with detecting command completion event (Pawel Laszczak)
  - VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify (Ma Wupeng) [Orabug: 38152868] {CVE-2025-38102}
  - drm/amd/display: Do not add '-mhard-float' to dcn2{1,0}_resource.o for clang (Nathan Chancellor)
  - kbuild: Add KBUILD_CPPFLAGS to as-option invocation (Nathan Chancellor)
  - kbuild: add $(CLANG_FLAGS) to KBUILD_CPPFLAGS (Masahiro Yamada)
  - kbuild: Add CLANG_FLAGS to as-instr (Nathan Chancellor)
  - mips: Include KBUILD_CPPFLAGS in CHECKFLAGS invocation (Nathan Chancellor)
  - drm/amd/display: Do not add '-mhard-float' to dml_ccflags for clang (Nathan Chancellor)
  - kbuild: Update assembler calls to use proper flags and language target (Nick Desaulniers)
  - MIPS: Prefer cc-option for additions to cflags (Nathan Chancellor)
  - MIPS: Move '-Wa,-msoft-float' check from as-option to cc-option (Nathan Chancellor)
  - x86/boot/compressed: prefer cc-option for CFLAGS additions (Nick Desaulniers)
  - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [Orabug: 38223086] {CVE-2025-38352}
  - ALSA: usb-audio: Add implicit feedback quirk for RODE AI-1 (David Heimann)
  - perf: Ensure bpf_perf_link path is properly serialized (Peter Zijlstra)
  - nvmet-fcloop: access fcpreq only when holding reqlock (Daniel Wagner)
  - fs/filesystems: Fix potential unsigned integer underflow in fs_name() (Zijun Hu)
  - net_sched: ets: fix a race in ets_qdisc_change() (Eric Dumazet) [Orabug: 38152893] {CVE-2025-38107}
  - sch_ets: make est_qlen_notify() idempotent (Cong Wang)
  - net_sched: tbf: fix a race in tbf_change() (Eric Dumazet)
  - net_sched: red: fix a race in __red_change() (Eric Dumazet) [Orabug: 38152898] {CVE-2025-38108}
  - net_sched: prio: fix a race in prio_tune() (Eric Dumazet) [Orabug: 38105333] {CVE-2025-38083}
  - net/mlx5: Fix return value when searching for existing flow group (Patrisious Haddad)
  - net/mlx5: Ensure fw pages are always allocated on same NUMA (Moshe Shemesh)
  - net/mdiobus: Fix potential out-of-bounds read/write access (Jakub Raczynski) [Orabug: 38152911] {CVE-2025-38111}
  - net: mdio: C22 is now optional, EOPNOTSUPP if not provided (Andrew Lunn)
  - macsec: MACsec SCI assignment for ES = 0 (Carlos Fernandez)
  - net: Fix TOCTOU issue in sk_is_readable() (Michal Luczaj) [Orabug: 38152915] {CVE-2025-38112}
  - i40e: retry VFLR handling if there is ongoing VF reset (Robert Malz)
  - i40e: return false from i40e_reset_vf if reset is in progress (Robert Malz)
  - drm/meson: fix more rounding issues with 59.94Hz modes (Martin Blumenstingl)
  - drm/meson: use vclk_freq instead of pixel_freq in debug print (Martin Blumenstingl)
  - drm/meson: fix debug log statement when setting the HDMI clocks (Martin Blumenstingl)
  - drm/meson: use unsigned long long / Hz for frequency types (Martin Blumenstingl)
  - powerpc/vas: Return -EINVAL if the offset is non-zero in mmap() (Haren Myneni)
  - powerpc/powernv/memtrace: Fix out of bounds issue in memtrace mmap (Ritesh Harjani) [Orabug: 38137444] {CVE-2025-38088}
  - net_sched: sch_sfq: fix a potential crash on gso_skb handling (Eric Dumazet) [Orabug: 38152922] {CVE-2025-38115}
  - scsi: iscsi: Fix incorrect error path labels for flashnode operations (Alok Tiwari)
  - ath10k: snoc: fix unbalanced IRQ enable in crash recovery (Caleb Connolly)
  - ptp: remove ptp->n_vclocks check logic in ptp_vclock_in_use() (Jeongjun Park) [Orabug: 38180545] {CVE-2025-38305}
  - scsi: core: ufs: Fix a hang in the error handler (Sanjeev Yadav) [Orabug: 38152945] {CVE-2025-38119}
  - serial: sh-sci: Clean sci_ports[0] after at earlycon exit (Claudiu Beznea)
  - serial: sh-sci: Move runtime PM enable to sci_probe_single() (Claudiu Beznea)
  - serial: sh-sci: Check if TX data was written to device in .tx_empty() (Claudiu Beznea)
  - arm64: dts: ti: k3-am65-main: Add missing taps to sdhci0 (Judith Mendez)
  - arm64: dts: ti: k3-am65-main: Fix sdhci node properties (Judith Mendez)
  - arm64: dts: ti: k3-am65-main: Drop deprecated ti,otap-del-sel property (Nishanth Menon)
  - Input: synaptics-rmi - fix crash with unsupported versions of F34 (Dmitry Torokhov)
  - Input: synaptics-rmi4 - convert to use sysfs_emit() APIs (Zhang Songyi)
  - pmdomain: core: Fix error checking in genpd_dev_pm_attach_by_id() (Dan Carpenter)
  - do_change_type(): refuse to operate on unmounted/not ours mounts (Al Viro) [Orabug: 38256449] {CVE-2025-38498}
  - fix propagation graph breakage by MOVE_MOUNT_SET_GROUP move_mount(2) (Al Viro)
  - seg6: Fix validation of nexthop addresses (Ido Schimmel) [Orabug: 38180555] {CVE-2025-38310}
  - wireguard: device: enable threaded NAPI (Mirco Barone)
  - netfilter: nf_set_pipapo_avx2: fix initial map fill (Florian Westphal) [Orabug: 38152957] {CVE-2025-38120}
  - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Alok Tiwari) [Orabug: 38152965] {CVE-2025-38122}
  - vmxnet3: correctly report gso type for UDP tunnels (Ronak Doshi)
  - net: dsa: tag_brcm: legacy: fix pskb_may_pull length (Álvaro Fernández Rojas)
  - ice: create new Tx scheduler nodes for new queues only (Michal Kubiak)
  - Bluetooth: L2CAP: Fix not responding with L2CAP_CR_LE_ENCRYPTION (Luiz Augusto von Dentz)
  - spi: bcm63xx-hsspi: fix shared reset (Álvaro Fernández Rojas)
  - spi: bcm63xx-spi: fix shared reset (Álvaro Fernández Rojas)
  - net/mlx4_en: Prevent potential integer overflow calculating Hz (Dan Carpenter)
  - driver: net: ethernet: mtk_star_emac: fix suspend/resume issue (Yanqing Wang)
  - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Alok Tiwari)
  - net: stmmac: platform: guarantee uniqueness of bus_id (Quentin Schulz)
  - vt: remove VT_RESIZE and VT_RESIZEX from vt_compat_ioctl() (Nicolas Pitre)
  - MIPS: Loongson64: Add missing '#interrupt-cells' for loongson64c_ls7a (Yuli Wang)
  - iio: adc: ad7124: Fix 3dB filter frequency reading (Uwe Kleine-König)
  - serial: Fix potential null-ptr-deref in mlb_usio_probe() (Henry Martin) [Orabug: 38153011] {CVE-2025-38135}
  - usb: renesas_usbhs: Reorder clock handling and power management in probe (Lad Prabhakar) [Orabug: 38153016] {CVE-2025-38136}
  - PCI/DPC: Initialize aer_err_info before using it (Bjorn Helgaas)
  - dmaengine: ti: Add NULL check in udma_probe() (Henry Martin) [Orabug: 38153029] {CVE-2025-38138}
  - PCI: cadence: Fix runtime atomic count underflow (Hans Zhang)
  - rtc: sh: assign correct interrupts with DT (Wolfram Sang)
  - perf record: Fix incorrect --user-regs comments (Dapeng Mi)
  - perf tests switch-tracking: Fix timestamp comparison (Leo Yan)
  - mfd: stmpe-spi: Correct the name used in MODULE_DEVICE_TABLE (Alexey Gladkov)
  - mfd: exynos-lpass: Avoid calling exynos_lpass_disable() twice in exynos_lpass_remove() (Christophe Jaillet)
  - rpmsg: qcom_smd: Fix uninitialized return variable in __qcom_smd_send() (Dan Carpenter)
  - remoteproc: qcom_wcnss_iris: Add missing put_device() on error in probe (Dan Carpenter)
  - perf scripts python: exported-sql-viewer.py: Fix pattern matching with Python 3 (Adrian Hunter)
  - backlight: pm8941: Add NULL check in wled_configure() (Henry Martin) [Orabug: 38153050] {CVE-2025-38143}
  - perf ui browser hists: Set actions->thread before calling do_zoom_thread() (Arnaldo Carvalho de Melo)
  - perf build: Warn when libdebuginfod devel files are not available (Arnaldo Carvalho de Melo)
  - fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod() (Sergey Shtylyov) [Orabug: 38180565] {CVE-2025-38312}
  - soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop() (Henry Martin) [Orabug: 38153059] {CVE-2025-38145}
  - soc: aspeed: lpc: Fix impossible judgment condition (Su Hui)
  - arm64: dts: rockchip: disable unrouted USB controllers and PHY on RK3399 Puma with Haikou (Quentin Schulz)
  - ARM: dts: qcom: apq8064 merge hw splinlock into corresponding syscon device (Dmitry Baryshkov)
  - bus: fsl-mc: fix double-free on mc_dev (Ioana Ciornei) [Orabug: 38180572] {CVE-2025-38313}
  - nilfs2: do not propagate ENOENT error from nilfs_btree_propagate() (Ryusuke Konishi)
  - nilfs2: add pointer check for nilfs_direct_propagate() (Xu Wang)
  - ocfs2: fix possible memory leak in ocfs2_finish_quota_recovery (Murad Masimov)
  - Squashfs: check return result of sb_min_blocksize (Phillip Lougher) [Orabug: 38253984] {CVE-2025-38415}
  - arm64: dts: imx8mn-beacon: Fix RTC capacitive load (Adam Ford)
  - arm64: dts: imx8mm-beacon: Fix RTC capacitive load (Adam Ford)
  - ARM: dts: at91: at91sam9263: fix NAND chip selects (Wolfram Sang)
  - ARM: dts: at91: usb_a9263: fix GPIO for Dataflash chip select (Wolfram Sang)
  - f2fs: fix to correct check conditions in f2fs_cross_rename (Zhiguo Niu)
  - f2fs: use d_inode(dentry) cleanup dentry->d_inode (Zhiguo Niu)
  - net: phy: mscc: Stop clearing the the UDPv4 checksum for L2 frames (Horatiu Vultur)
  - net: openvswitch: Fix the dead loop of MPLS parse (Faicker Mo) [Orabug: 38153064] {CVE-2025-38146}
  - calipso: Don't call calipso functions for AF_INET sk. (Kuniyuki Iwashima) [Orabug: 38153069] {CVE-2025-38147}
  - net: lan743x: rename lan743x_reset_phy to lan743x_hw_reset_phy (Thangaraj Samynathan)
  - bpf: Avoid __bpf_prog_ret0_warn when jit fails (Kafai Wan) [Orabug: 38180470] {CVE-2025-38280}
  - net: usb: aqc111: fix error handling of usbnet read calls (Nikita Zhandarovich) [Orabug: 38153088] {CVE-2025-38153}
  - netfilter: nft_tunnel: fix geneve_opt dump (Fernando Fernandez Mancera)
  - bpf, sockmap: Avoid using sk_socket after free when sending (Jiayuan Chen) [Orabug: 38153094] {CVE-2025-38154}
  - vfio/type1: Fix error unwind in migration dirty bitmap allocation (Li Rongqing)
  - netfilter: nf_tables: nft_fib_ipv6: fix VRF ipv4/ipv6 result discrepancy (Florian Westphal)
  - wifi: ath9k_htc: Abort software beacon handling if disabled (Toke Høiland-Jørgensen) [Orabug: 38153109] {CVE-2025-38157}
  - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (Alexey Kodanev) [Orabug: 38153121] {CVE-2025-38159}
  - s390/bpf: Store backchain even for leaf progs (Ilya Leoshkevich)
  - clk: qcom: gcc-msm8939: Fix mclk0 & mclk1 for 24 MHz (Vincent Knecht)
  - bpf: Fix WARN() in get_bpf_raw_tp_regs (Tao Chen) [Orabug: 38180488] {CVE-2025-38285}
  - pinctrl: at91: Fix possible out-of-boundary access (Andy Shevchenko) [Orabug: 38180494] {CVE-2025-38286}
  - libbpf: Use proper errno value in nlattr (Anton Protopopov)
  - ktls, sockmap: Fix missing uncharge operation (Jiayuan Chen)
  - clk: bcm: rpi: Add NULL check in raspberrypi_clk_register() (Henry Martin) [Orabug: 38153131] {CVE-2025-38160}
  - clk: qcom: gcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
  - bpf: Fix uninitialized values in BPF_{CORE,PROBE}_READ (Anton Protopopov)
  - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Patrisious Haddad) [Orabug: 38153138] {CVE-2025-38161}
  - netfilter: nft_quota: match correctly when the quota just depleted (Zhongqiu Duan)
  - netfilter: bridge: Move specific fragmented packet to slow_path instead of dropping it (Huajian Yang)
  - libbpf: Use proper errno value in linker (Anton Protopopov)
  - f2fs: fix to detect gcing page in f2fs_is_cp_guaranteed() (Chao Yu)
  - f2fs: clean up w/ fscrypt_is_bounce_page() (Chao Yu)
  - iommu: Protect against overflow in iommu_pgsize() (Jason Gunthorpe)
  - RDMA/hns: Include hnae3.h in hns_roce_hw_v2.h (Junxian Huang)
  - wifi: rtw88: do not ignore hardware read error during DPK (Dmitry Antipov)
  - libbpf: Fix buffer overflow in bpf_object__init_prog (Viktor Malik)
  - net: ncsi: Fix GCPS 64-bit member variables (Hari Kalavakunta)
  - f2fs: fix to do sanity check on sbi->total_valid_block_count (Chao Yu) [Orabug: 38153149] {CVE-2025-38163}
  - bpf, sockmap: fix duplicated data transmission (Jiayuan Chen)
  - IB/cm: use rwlock for MAD agent lock (Jacob Moroni)
  - wifi: ath11k: fix node corruption in ar->arvifs list (Stone Zhang) [Orabug: 38180515] {CVE-2025-38293}
  - firmware: SDEI: Allow sdei initialization without ACPI_APEI_GHES (Huang Yiwei)
  - drm/tegra: rgb: Fix the unbound reference count (Biju Das)
  - drm/vkms: Adjust vkms_state->active_planes allocation type (Kees Cook)
  - drm: rcar-du: Fix memory leak in rcar_du_vsps_init() (Biju Das)
  - selftests/seccomp: fix syscall_restart test for arm compat (Neill Kapron)
  - firmware: psci: Fix refcount leak in psci_dt_init (Miaoqian Lin)
  - m68k: mac: Fix macintosh_config for Mac II (Finn Thain)
  - fs/ntfs3: handle hdr_first_de() return value (Andrey Vatoropin) [Orabug: 38153172] {CVE-2025-38167}
  - media: rkvdec: Fix frame size enumeration (Jonas Karlman)
  - drm/amd/pp: Fix potential NULL pointer dereference in atomctrl_initialize_mc_reg_table (Charles Han) [Orabug: 38180589] {CVE-2025-38319}
  - spi: sh-msiof: Fix maximum DMA transfer size (Geert Uytterhoeven)
  - ACPI: OSI: Stop advertising support for "3.0 _SCP Extensions" (Armin Wolf)
  - x86/mtrr: Check if fixed-range MTRRs exist in mtrr_save_fixed_ranges() (Jiaqing Zhao)
  - PM: wakeup: Delete space in the end of string shown by pm_show_wakelocks() (Zijun Hu)
  - power: reset: at91-reset: Optimize at91_reset() (Alexander Shiyan)
  - EDAC/skx_common: Fix general protection fault (Qiuxu Zhuo) [Orabug: 38180524] {CVE-2025-38298}
  - crypto: sun8i-ce - move fallback ahash_request to the end of the struct (Ovidiu Panait)
  - crypto: xts - Only add ecb if it is not already there (Herbert Xu)
  - crypto: lrw - Only add ecb if it is not already there (Herbert Xu)
  - crypto: marvell/cesa - Avoid empty transfer descriptor (Herbert Xu)
  - crypto: marvell/cesa - Handle zero-length skcipher requests (Herbert Xu) [Orabug: 38153188] {CVE-2025-38173}
  - x86/cpu: Sanitize CPUID(0x80000000) output (Ahmed S. Darwish)
  - crypto: sun8i-ss - do not use sg_dma_len before calling DMA functions (Corentin Labbe)
  - perf/core: Fix broken throttling when max_samples_per_tick=1 (Qing Wang)
  - gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher)
  - thunderbolt: Do not double dequeue a configuration request (Sergey Senozhatsky) [Orabug: 38158383] {CVE-2025-38174}
  - usb: usbtmc: Fix timeout value in get_stb (Dave Penkler)
  - USB: serial: pl2303: add new chip PL2303GC-Q20 and PL2303GT-2AB (Charles Yeh)
  - usb: storage: Ignore UAS driver for SanDisk 3.2 Gen2 storage device (Hongyu Xie)
  - usb: quirks: Add NO_LPM quirk for SanDisk Extreme 55AE (Jiayi Li)
  - rtc: Fix offset calculation for .start_secs < 0 (Alexandre Mergnat)
  - rtc: Make rtc_time64_to_tm() support dates before 1970 (Alexandre Mergnat)
  - pinctrl: armada-37xx: set GPIO output value before setting direction (Gabor Juhos)
  - pinctrl: armada-37xx: use correct OUTPUT_VAL register for GPIOs > 31 (Gabor Juhos)


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-312.187.4.el9uek]
changelog:
  - rds: Fix NULL ptr deref in xas_start (Håkon Bugge) [Orabug: 38166374]
  - KVM: x86: use array_index_nospec with indices that come from guest (Thijs Raymakers) [Orabug: 38319943,38440301] {CVE-2025-39823}
  - hugetlb: arm64: add mte support (Dave Kleikamp) [Orabug: 38177800]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-312.187.5.el9uek]
changelog:
  - Revert "mm: hugetlb: independent PMD page table shared count" (Harshit Mogalapalli) [Orabug: 38327655]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-313.187.1.el9uek]
changelog:
  - drm/amdgpu: Remove ATC L2 access for MMHUB 2.1.x (Lijo Lazar) [Orabug: 37778293]
  - PCI/portdrv: Don't disable AER reporting in get_port_device_capability() (Stefan Roese) [Orabug: 37778293]
  - PCI/AER: Enable error reporting when AER is native (Stefan Roese) [Orabug: 37778293]
  - PCI/AER: Configure ECRC for every device (Stefan Roese) [Orabug: 37778293]
  - net/rds: Add support for RDS_CMSG_TOS (Gerd Rausch) [Orabug: 38058308]
  - net/rds: Add support RDS_FEATURE ELF notes (Gerd Rausch) [Orabug: 38063328]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-313.189.2.el9uek]
changelog:
  - LTS version: v5.15.189 (Vijayendra Suman)
  - rseq: Fix segfault on registration when rseq_cs is non-zero (Michael Jeanson) [Orabug: 38095071] {CVE-2025-38067}
  - x86/mm: Disable hugetlb page table sharing on 32-bit (Jann Horn)
  - Input: atkbd - do not skip atkbd_deactivate() when skipping ATKBD_CMD_GETID (Hans de Goede)
  - HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras (Chia-Lin Kao) [Orabug: 38324278] {CVE-2025-38540}
  - HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY (Zhang Heng)
  - vt: add missing notification when switching back to text mode (Nicolas Pitre)
  - HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2 (Akira Inoue)
  - net: usb: qmi_wwan: add SIMCom 8230C composition (Xiaowei Li)
  - um: vector: Reduce stack usage in vector_eth_configure() (Tiwei Bie)
  - atm: idt77252: Add missing `dma_map_error()` (Thomas Fourier)
  - bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (Somnath Kotur) [Orabug: 38254089] {CVE-2025-38439}
  - bnxt_en: Fix DCB ETS validation (Shravya Kn)
  - net: ll_temac: Fix missing tx_pending check in ethtools_set_ringparam() (Alok Tiwari)
  - can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level (Sean Nyekjaer)
  - net: phy: microchip: limit 100M workaround to link-down events on LAN88xx (Oleksij Rempel)
  - net: appletalk: Fix device refcount leak in atrtr_create() (Kito Xu) [Orabug: 38324289] {CVE-2025-38542}
  - netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (Eric Dumazet) [Orabug: 38254095] {CVE-2025-38441}
  - ksmbd: fix a mount write count leak in ksmbd_vfs_kern_path_locked() (Al Viro)
  - smb: server: make use of rdma_destroy_qp() (Stefan Metzmacher)
  - nbd: fix uaf in nbd_genl_connect() error path (Zheng Qixing) [Orabug: 38254101] {CVE-2025-38443}
  - raid10: cleanup memleak at raid10_make_request (Nigel Croxon) [Orabug: 38254105] {CVE-2025-38444}
  - md/raid1: Fix stack memory use after return in raid1_reshape (Wang Jinchao) [Orabug: 38254108] {CVE-2025-38445}
  - wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() (Daniil Dulov) [Orabug: 38324160] {CVE-2025-38513}
  - dma-buf: fix timeout handling in dma_resv_wait_timeout v2 (Christian König)
  - dma-buf: use new iterator in dma_resv_wait_timeout (Christian König)
  - dma-buf: add dma_resv_for_each_fence_unlocked v8 (Christian König)
  - usb: dwc3: Abort suspend on soft disconnect failure (Kuen-Han Tsai)
  - usb: cdnsp: Fix issue with CV Bad Descriptor test (Pawel Laszczak)
  - usb: cdnsp: Replace snprintf() with the safer scnprintf() variant (Lee Jones)
  - usb:cdnsp: remove TRB_FLUSH_ENDPOINT command (Pawel Laszczak)
  - Input: xpad - support Acer NGR 200 Controller (Nilton Perim Neto)
  - xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS (Hongyu Xie)
  - usb: xhci: quirk for data loss in ISOC transfers (Raju Rangoju)
  - xhci: Allow RPM on the USB controller (1022:43f7) by default (Basavaraj Natikar)
  - virtio-net: ensure the received length does not exceed allocated size (Bui Quang Minh) [Orabug: 38253833] {CVE-2025-38375}
  - netlink: make sure we allow at least one dump skb (Jakub Kicinski)
  - netlink: Fix rmem check in netlink_broadcast_deliver(). (Kuniyuki Iwashima)
  - btrfs: use btrfs_record_snapshot_destroy() during rmdir (Filipe Manana)
  - btrfs: propagate last_unlink_trans earlier when doing a rmdir (Filipe Manana)
  - Revert "ACPI: battery: negate current when discharging" (Rafael J. Wysocki)
  - usb: gadget: u_serial: Fix race condition in TTY wakeup (Kuen-Han Tsai) [Orabug: 38254117] {CVE-2025-38448}
  - drm/gem: Fix race in drm_gem_handle_create_tail() (Simona Vetter)
  - drm/sched: Increment job count before swapping tail spsc queue (Matthew Brost) [Orabug: 38324179] {CVE-2025-38515}
  - pinctrl: qcom: msm: mark certain pins as invalid for interrupts (Bartosz Golaszewski) [Orabug: 38324185] {CVE-2025-38516}
  - x86/mce: Make sure CMCI banks are cleared during shutdown on Intel (Jp Kobryn)
  - x86/mce: Don't remove sysfs if thresholding sysfs init fails (Yazen Ghannam)
  - x86/mce/amd: Fix threshold limit reset (Yazen Ghannam)
  - xen: replace xen_remap() with memremap() (Juergen Gross)
  - jfs: fix null ptr deref in dtInsertEntry (Edward Adam Davis) [Orabug: 36993160] {CVE-2024-44939}
  - bpf, sockmap: Fix skb refcnt race after locking changes (John Fastabend)
  - aoe: avoid potential deadlock at set_capacity (Maksim Kiselev) [Orabug: 36530894] {CVE-2024-26775}
  - thermal/int340x_thermal: handle data_vault when the value is ZERO_SIZE_PTR (Lee, Chun-Yi) [Orabug: 37283277] {CVE-2022-48703}
  - bpf: fix precision backtracking instruction iteration (Andrii Nakryiko)
  - rxrpc: Fix oops due to non-existence of prealloc backlog struct (David Howells) [Orabug: 38324169] {CVE-2025-38514}
  - net/sched: Abort __tc_modify_qdisc if parent class does not exist (Victor Nogueira) [Orabug: 38254146] {CVE-2025-38457}
  - atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (Yue Haibing) [Orabug: 38254152] {CVE-2025-38458}
  - atm: clip: Fix infinite recursive call of clip_push(). (Kuniyuki Iwashima) [Orabug: 38254160] {CVE-2025-38459}
  - atm: clip: Fix memory leak of struct clip_vcc. (Kuniyuki Iwashima) [Orabug: 38324308] {CVE-2025-38546}
  - atm: clip: Fix potential null-ptr-deref in to_atmarpd(). (Kuniyuki Iwashima) [Orabug: 38254166] {CVE-2025-38460}
  - net: phy: smsc: Fix link failure in forced mode with Auto-MDIX (Oleksij Rempel)
  - net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap (Oleksij Rempel)
  - vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also `transport_local` (Michal Luczaj)
  - vsock: Fix transport_* TOCTOU (Michal Luczaj) [Orabug: 38254172] {CVE-2025-38461}
  - vsock: Fix transport_{g2h,h2g} TOCTOU (Michal Luczaj) [Orabug: 38254175] {CVE-2025-38462}
  - tipc: Fix use-after-free in tipc_conn_close(). (Kuniyuki Iwashima) [Orabug: 38254180] {CVE-2025-38464}
  - netlink: Fix wraparounds of sk->sk_rmem_alloc. (Kuniyuki Iwashima) [Orabug: 38254187] {CVE-2025-38465}
  - fix proc_sys_compare() handling of in-lookup dentries (Al Viro)
  - perf: Revert to requiring CAP_SYS_ADMIN for uprobes (Peter Zijlstra) [Orabug: 38254196] {CVE-2025-38466}
  - ASoC: fsl_asrc: use internal measured ratio for non-ideal ratio mode (Shengjiu Wang)
  - drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling (Kaustabh Chakraborty) [Orabug: 38254202] {CVE-2025-38467}


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-313.189.3.el9uek]
changelog:
  - x86/vmscape: Warn when STIBP is disabled with SMT (Pawan Gupta) [Orabug: 38424092]
  - x86/bugs: Move cpu_bugs_smt_update() down (Pawan Gupta) [Orabug: 38424092]
  - x86/vmscape: Enable the mitigation (Pawan Gupta) [Orabug: 38424092]
  - x86/vmscape: Add conditional IBPB mitigation (Pawan Gupta) [Orabug: 38424092]
  - x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (Josh Poimboeuf) [Orabug: 38424092]
  - x86/vmscape: Add old Intel CPUs to affected list (Pawan Gupta) [Orabug: 38424092]
  - x86/vmscape: Enumerate VMSCAPE bug (Pawan Gupta) [Orabug: 38424092]
  - Documentation/hw-vuln: Add VMSCAPE documentation (Pawan Gupta) [Orabug: 38424092]
  - vsock: Do not allow binding to VMADDR_PORT_ANY (Budimir Markovic) [Orabug: 38454665,38351770] {CVE-2025-38618}
  - HID: core: ensure the allocated report buffer can contain the reserved report ID (Benjamin Tissoires) [Orabug: 38254347,38454662] {CVE-2025-38495}
  - HID: core: do not bypass hid_hw_raw_request (Benjamin Tissoires) [Orabug: 38254339,38454666] {CVE-2025-38494}
  - clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (Al Viro) [Orabug: 38310006,38454664] {CVE-2025-38499}
  - igc: fix disabling L1.2 PCI-E link substate on I226 on init (Valdikss) [Orabug: 38343660]
  - Input: xpad - set correct controller type for Acer NGR200 (Nilton Perim Neto)
  - ASoC: soc-dai: tidyup return value of snd_soc_xlate_tdm_slot_mask() (Kuninori Morimoto)
  - squashfs: fix memory leak in squashfs_fill_super (Phillip Lougher) [Orabug: 38343660]
  - ASoC: ops: dynamically allocate struct snd_ctl_elem_value (Arnd Bergmann)
  - compiler: remove __ADDRESSABLE_ASM{_STR,}() again (Jan Beulich)
  - mm/memory-failure: fix infinite UCE for VM_PFNMAP pfn (Tu Jinjiang)
  - KVM: arm64: Fix kernel BUG() due to bad backport of FPSIMD/SVE/SME fix (Will Deacon)
  - benet: fix BUG when creating VFs (Michal Schmidt) [Orabug: 38334975] {CVE-2025-38569}
  - smb: client: fix use-after-free in crypt_message when using async crypto (Wang Zhaolong) [Orabug: 38254323] {CVE-2025-38488}
  - kbuild: userprogs: use correct linker when mixing clang and GNU ld (Thomas Weißschuh)
  - ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS (Nathan Chancellor)
  - NFSv4.2: another fix for listxattr (Olga Kornievskaia)
  - cpuidle: governors: menu: Avoid using invalid recent intervals data (Rafael J. Wysocki)
  - netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin) [Orabug: 38395124] {CVE-2025-38727}
  - Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()" (Helge Deller) [Orabug: 38343660]
  - bpf, sockmap: Fix panic when calling skb_linearize (Jiayuan Chen) [Orabug: 38394723] {CVE-2025-38165}
  - netfilter: nf_tables: adjust lockdep assertions handling (Fedor Pchelkin)
  - arm64: errata: Work around AmpereOne's erratum AC04_CPU_23 (D Scott Phillips) [Orabug: 38166347]
  - ARM: UEK: Disable arm64 erratum QCOM_FALKOR_ERRATUM_1003 (Boris Ostrovsky) [Orabug: 38166347]
  - vhost-scsi: Fix check for inline_sg_cnt exceeding preallocated limit (Alok Tiwari) [Orabug: 38324335]
  - mm/hugetlb: fix copy_hugetlb_page_range() to check ->pt_share_count (Jane Chu) [Orabug: 38346475]
  - Reapply "mm: hugetlb: independent PMD page table shared count" (Jane Chu) [Orabug: 38346475]
  - uek-rpm: pensando: enable config options for fips (Joseph Dobosenski) [Orabug: 38354692]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-313.189.5.el9uek]
changelog:
  - net/rds: tracepoints for rds_conn_kref_get and put (Sharath Srinivasan) [Orabug: 37793025]
  - net/rds: Add krefs to struct rds_connection (Sharath Srinivasan) [Orabug: 37793025]
  - nvme-tcp: sanitize request list handling (Hannes Reinecke) [Orabug: 38175126,38454661] {CVE-2025-38264}
  - llist: add interface to check if a node is on a list. (Neil Brown) [Orabug: 38175126] {CVE-2025-38264}


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-313.189.5.1.el9uek]
changelog:
  - af_unix: Don't leave consecutive consumed OOB skbs. (Kuniyuki Iwashima)  [Orabug: 38528187]  {CVE-2025-38236} 
  - fs: writeback: fix use-after-free in __mark_inode_dirty() (Jiufei Xue)  [Orabug: 38528183]  {CVE-2025-39866} 
  - rtnetlink: Fix L3 stats disable handling in rtnl_offload_xstats_fill() (Vijayendra Suman)  [Orabug: 38528177]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-313.189.2.el9uek]
changelog:
  - LTS version: v5.15.189 (Vijayendra Suman)
  - rseq: Fix segfault on registration when rseq_cs is non-zero (Michael Jeanson) [Orabug: 38095071] {CVE-2025-38067}
  - x86/mm: Disable hugetlb page table sharing on 32-bit (Jann Horn)
  - Input: atkbd - do not skip atkbd_deactivate() when skipping ATKBD_CMD_GETID (Hans de Goede)
  - HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras (Chia-Lin Kao) [Orabug: 38324278] {CVE-2025-38540}
  - HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY (Zhang Heng)
  - vt: add missing notification when switching back to text mode (Nicolas Pitre)
  - HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2 (Akira Inoue)
  - net: usb: qmi_wwan: add SIMCom 8230C composition (Xiaowei Li)
  - um: vector: Reduce stack usage in vector_eth_configure() (Tiwei Bie)
  - atm: idt77252: Add missing `dma_map_error()` (Thomas Fourier)
  - bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (Somnath Kotur) [Orabug: 38254089] {CVE-2025-38439}
  - bnxt_en: Fix DCB ETS validation (Shravya Kn)
  - net: ll_temac: Fix missing tx_pending check in ethtools_set_ringparam() (Alok Tiwari)
  - can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level (Sean Nyekjaer)
  - net: phy: microchip: limit 100M workaround to link-down events on LAN88xx (Oleksij Rempel)
  - net: appletalk: Fix device refcount leak in atrtr_create() (Kito Xu)
  - netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (Eric Dumazet) [Orabug: 38254095] {CVE-2025-38441}
  - ksmbd: fix a mount write count leak in ksmbd_vfs_kern_path_locked() (Al Viro)
  - smb: server: make use of rdma_destroy_qp() (Stefan Metzmacher)
  - nbd: fix uaf in nbd_genl_connect() error path (Zheng Qixing) [Orabug: 38254101] {CVE-2025-38443}
  - raid10: cleanup memleak at raid10_make_request (Nigel Croxon) [Orabug: 38254105] {CVE-2025-38444}
  - md/raid1: Fix stack memory use after return in raid1_reshape (Wang Jinchao) [Orabug: 38254108] {CVE-2025-38445}
  - wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() (Daniil Dulov) [Orabug: 38324160] {CVE-2025-38513}
  - dma-buf: fix timeout handling in dma_resv_wait_timeout v2 (Christian König)
  - dma-buf: use new iterator in dma_resv_wait_timeout (Christian König)
  - dma-buf: add dma_resv_for_each_fence_unlocked v8 (Christian König)
  - usb: dwc3: Abort suspend on soft disconnect failure (Kuen-Han Tsai)
  - usb: cdnsp: Fix issue with CV Bad Descriptor test (Pawel Laszczak)
  - usb: cdnsp: Replace snprintf() with the safer scnprintf() variant (Lee Jones)
  - usb:cdnsp: remove TRB_FLUSH_ENDPOINT command (Pawel Laszczak)
  - Input: xpad - support Acer NGR 200 Controller (Nilton Perim Neto)
  - xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS (Hongyu Xie)
  - usb: xhci: quirk for data loss in ISOC transfers (Raju Rangoju)
  - xhci: Allow RPM on the USB controller (1022:43f7) by default (Basavaraj Natikar)
  - virtio-net: ensure the received length does not exceed allocated size (Bui Quang Minh) [Orabug: 38253833] {CVE-2025-38375}
  - netlink: make sure we allow at least one dump skb (Jakub Kicinski)
  - netlink: Fix rmem check in netlink_broadcast_deliver(). (Kuniyuki Iwashima)
  - btrfs: use btrfs_record_snapshot_destroy() during rmdir (Filipe Manana)
  - btrfs: propagate last_unlink_trans earlier when doing a rmdir (Filipe Manana)
  - Revert "ACPI: battery: negate current when discharging" (Rafael J. Wysocki)
  - usb: gadget: u_serial: Fix race condition in TTY wakeup (Kuen-Han Tsai) [Orabug: 38254117] {CVE-2025-38448}
  - drm/gem: Fix race in drm_gem_handle_create_tail() (Simona Vetter)
  - drm/sched: Increment job count before swapping tail spsc queue (Matthew Brost) [Orabug: 38324179] {CVE-2025-38515}
  - pinctrl: qcom: msm: mark certain pins as invalid for interrupts (Bartosz Golaszewski) [Orabug: 38324185] {CVE-2025-38516}
  - x86/mce: Make sure CMCI banks are cleared during shutdown on Intel (Jp Kobryn)
  - x86/mce: Don't remove sysfs if thresholding sysfs init fails (Yazen Ghannam)
  - x86/mce/amd: Fix threshold limit reset (Yazen Ghannam)
  - xen: replace xen_remap() with memremap() (Juergen Gross)
  - jfs: fix null ptr deref in dtInsertEntry (Edward Adam Davis)
  - bpf, sockmap: Fix skb refcnt race after locking changes (John Fastabend)
  - aoe: avoid potential deadlock at set_capacity (Maksim Kiselev) [Orabug: 36530894] {CVE-2024-26775}
  - thermal/int340x_thermal: handle data_vault when the value is ZERO_SIZE_PTR (Lee, Chun-Yi) [Orabug: 37283277] {CVE-2022-48703}
  - bpf: fix precision backtracking instruction iteration (Andrii Nakryiko)
  - rxrpc: Fix oops due to non-existence of prealloc backlog struct (David Howells)
  - net/sched: Abort __tc_modify_qdisc if parent class does not exist (Victor Nogueira) [Orabug: 38254146] {CVE-2025-38457}
  - atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (Yue Haibing) [Orabug: 38254152] {CVE-2025-38458}
  - atm: clip: Fix infinite recursive call of clip_push(). (Kuniyuki Iwashima) [Orabug: 38254160] {CVE-2025-38459}
  - atm: clip: Fix memory leak of struct clip_vcc. (Kuniyuki Iwashima) [Orabug: 38324308] {CVE-2025-38546}
  - atm: clip: Fix potential null-ptr-deref in to_atmarpd(). (Kuniyuki Iwashima) [Orabug: 38254166] {CVE-2025-38460}
  - net: phy: smsc: Fix link failure in forced mode with Auto-MDIX (Oleksij Rempel)
  - net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap (Oleksij Rempel)
  - vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also `transport_local` (Michal Luczaj)
  - vsock: Fix transport_* TOCTOU (Michal Luczaj) [Orabug: 38254172] {CVE-2025-38461}
  - vsock: Fix transport_{g2h,h2g} TOCTOU (Michal Luczaj) [Orabug: 38254175] {CVE-2025-38462}
  - tipc: Fix use-after-free in tipc_conn_close(). (Kuniyuki Iwashima) [Orabug: 38254180] {CVE-2025-38464}
  - netlink: Fix wraparounds of sk->sk_rmem_alloc. (Kuniyuki Iwashima) [Orabug: 38254187] {CVE-2025-38465}
  - fix proc_sys_compare() handling of in-lookup dentries (Al Viro)
  - perf: Revert to requiring CAP_SYS_ADMIN for uprobes (Peter Zijlstra) [Orabug: 38254196] {CVE-2025-38466}
  - ASoC: fsl_asrc: use internal measured ratio for non-ideal ratio mode (Shengjiu Wang)
  - drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling (Kaustabh Chakraborty) [Orabug: 38254202] {CVE-2025-38467}


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-313.189.3.el9uek]
changelog:
  - x86/vmscape: Warn when STIBP is disabled with SMT (Pawan Gupta) [Orabug: 38424092]
  - x86/bugs: Move cpu_bugs_smt_update() down (Pawan Gupta) [Orabug: 38424092]
  - x86/vmscape: Enable the mitigation (Pawan Gupta) [Orabug: 38424092]
  - x86/vmscape: Add conditional IBPB mitigation (Pawan Gupta) [Orabug: 38424092]
  - x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (Josh Poimboeuf) [Orabug: 38424092]
  - x86/vmscape: Add old Intel CPUs to affected list (Pawan Gupta) [Orabug: 38424092]
  - x86/vmscape: Enumerate VMSCAPE bug (Pawan Gupta) [Orabug: 38424092]
  - Documentation/hw-vuln: Add VMSCAPE documentation (Pawan Gupta) [Orabug: 38424092]
  - vsock: Do not allow binding to VMADDR_PORT_ANY (Budimir Markovic) [Orabug: 38351770,38454665] {CVE-2025-38618}
  - HID: core: ensure the allocated report buffer can contain the reserved report ID (Benjamin Tissoires) [Orabug: 38254347,38454662] {CVE-2025-38495}
  - HID: core: do not bypass hid_hw_raw_request (Benjamin Tissoires) [Orabug: 38254339,38454666] {CVE-2025-38494}
  - clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (Al Viro) [Orabug: 38310006,38454664] {CVE-2025-38499}
  - igc: fix disabling L1.2 PCI-E link substate on I226 on init (Valdikss) [Orabug: 38343660]
  - Input: xpad - set correct controller type for Acer NGR200 (Nilton Perim Neto)
  - ASoC: soc-dai: tidyup return value of snd_soc_xlate_tdm_slot_mask() (Kuninori Morimoto)
  - squashfs: fix memory leak in squashfs_fill_super (Phillip Lougher) [Orabug: 38343660]
  - ASoC: ops: dynamically allocate struct snd_ctl_elem_value (Arnd Bergmann)
  - compiler: remove __ADDRESSABLE_ASM{_STR,}() again (Jan Beulich)
  - mm/memory-failure: fix infinite UCE for VM_PFNMAP pfn (Tu Jinjiang)
  - KVM: arm64: Fix kernel BUG() due to bad backport of FPSIMD/SVE/SME fix (Will Deacon)
  - benet: fix BUG when creating VFs (Michal Schmidt) [Orabug: 38334975] {CVE-2025-38569}
  - smb: client: fix use-after-free in crypt_message when using async crypto (Wang Zhaolong)
  - kbuild: userprogs: use correct linker when mixing clang and GNU ld (Thomas Weißschuh)
  - ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS (Nathan Chancellor)
  - NFSv4.2: another fix for listxattr (Olga Kornievskaia)
  - cpuidle: governors: menu: Avoid using invalid recent intervals data (Rafael J. Wysocki)
  - netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin) [Orabug: 38395124] {CVE-2025-38727}
  - Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()" (Helge Deller) [Orabug: 38343660]
  - bpf, sockmap: Fix panic when calling skb_linearize (Jiayuan Chen) [Orabug: 38394723] {CVE-2025-38165}
  - netfilter: nf_tables: adjust lockdep assertions handling (Fedor Pchelkin)
  - arm64: errata: Work around AmpereOne's erratum AC04_CPU_23 (D Scott Phillips) [Orabug: 38166347]
  - ARM: UEK: Disable arm64 erratum QCOM_FALKOR_ERRATUM_1003 (Boris Ostrovsky) [Orabug: 38166347]
  - vhost-scsi: Fix check for inline_sg_cnt exceeding preallocated limit (Alok Tiwari) [Orabug: 38324335]
  - mm/hugetlb: fix copy_hugetlb_page_range() to check ->pt_share_count (Jane Chu) [Orabug: 38346475]
  - Reapply "mm: hugetlb: independent PMD page table shared count" (Jane Chu) [Orabug: 38346475]
  - uek-rpm: pensando: enable config options for fips (Joseph Dobosenski) [Orabug: 38354692]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-313.189.5.1.el9uek]
changelog:
  - af_unix: Don't leave consecutive consumed OOB skbs. (Kuniyuki Iwashima) [Orabug: 38528187] {CVE-2025-38236}
  - fs: writeback: fix use-after-free in __mark_inode_dirty() (Jiufei Xue) [Orabug: 38528183] {CVE-2025-39866}
  - rtnetlink: Fix L3 stats disable handling in rtnl_offload_xstats_fill() (Vijayendra Suman) [Orabug: 38528177]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-313.189.5.2.el9uek]
changelog:
  - nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (Jeff Layton)  [Orabug: 38575798]  {CVE-2025-38724} 
  - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (Eric Biggers)  [Orabug: 38575792]  
  - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (Herbert Xu)  [Orabug: 38575792]  {CVE-2025-39964}


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-313.189.5.2.el9uek]
changelog:
  - nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (Jeff Layton)  [Orabug: 38575798]  {CVE-2025-38724}
  - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (Eric Biggers)  [Orabug: 38575792]
  - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (Herbert Xu)  [Orabug: 38575792]  {CVE-2025-39964}


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-313.189.5.3.el9uek]
changelog:
  - i40e: add validation for ring_len param (Lukasz Czapnik)  [Orabug: 38603025]  {CVE-2025-39973} 
  - i40e: increase max descriptors for XL710 (Justin Bronder)  [Orabug: 38603025]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-314.189.1.el9uek]
changelog:
  - net/mlx5: HWS, fix bad parameter in CQ creation (Yevgeny Kliteynik) [Orabug: 38253291]
  - net/mlx5: HWS, fix missing ip_version handling in definer (Yevgeny Kliteynik) [Orabug: 38253291]
  - net/mlx5e: Use custom tunnel header for vxlan gbp (Vlad Dogaru) [Orabug: 38253291]
  - net/mlx5: HWS, Rightsize bwc matcher priority (Vlad Dogaru) [Orabug: 38253291]
  - net/mlx5: HWS, fix definer's HWS_SET32 macro for negative offset (Yevgeny Kliteynik) [Orabug: 38253291]
  - net/mlx5: HWS: Properly set bwc queue locks lock classes (Cosmin Ratiu) [Orabug: 38253291]
  - net/mlx5: HWS: Fix memory leak in mlx5hws_definer_calc_layout (Cosmin Ratiu) [Orabug: 38253291]
  - net/mlx5: HWS, don't destroy more bwc queue locks than allocated (Cosmin Ratiu) [Orabug: 38253291]
  - net/mlx5: HWS, fixed double free in error flow of definer layout (Yevgeny Kliteynik) [Orabug: 38253291]
  - net/mlx5: HWS, removed wrong access to a number of rules variable (Yevgeny Kliteynik) [Orabug: 38253291]
  - net/mlx5: HWS, changed E2BIG error to a negative return code (Yevgeny Kliteynik) [Orabug: 38253291]
  - net/mlx5: HWS, fixed double-free in error flow of creating SQ (Yevgeny Kliteynik) [Orabug: 38253291]
  - net/mlx5: Fix wrong reserved field in hca_cap_2 in mlx5_ifc (Yevgeny Kliteynik) [Orabug: 38253291]
  - net/mlx5: HWS, check the correct variable in hws_send_ring_alloc_sq() (Dan Carpenter) [Orabug: 38253291]
  - net/mlx5e: Support RX xfrm state selector's UPSPEC for packet offload (Jianbo Liu) [Orabug: 38253291]
  - net/mlx5e: Add pass flow group for IPSec RX status table (Jianbo Liu) [Orabug: 38253291]
  - net/mlx5e: Add num_reserved_entries param for ipsec_ft_create() (Jianbo Liu) [Orabug: 38253291]
  - net/mlx5e: Skip IPSec RX policy check for crypto offload (Jianbo Liu) [Orabug: 38253291]
  - net/mlx5e: Move IPSec policy check after decryption (Jianbo Liu) [Orabug: 38253291]
  - net/mlx5e: Add correct match to check IPSec syndromes for switchdev mode (Jianbo Liu) [Orabug: 38253291]
  - net/mlx5e: Change the destination of IPSec RX SA miss rule (Jianbo Liu) [Orabug: 38253291]
  - net/mlx5e: Add helper function to update IPSec default destination (Jianbo Liu) [Orabug: 38253291]
  - net/mlx5: fs, add counter object to flow destination (Moshe Shemesh) [Orabug: 38253291]
  - net/mlx5: DR, moved all the SWS code into a separate directory (Yevgeny Kliteynik) [Orabug: 38253291]
  - net/mlx5: HWS, use lock classes for bwc locks (Cosmin Ratiu) [Orabug: 38253291]
  - net/mlx5: hw counters: Remove mlx5_fc_create_ex (Cosmin Ratiu) [Orabug: 38253291]
  - net/mlx5: hw counters: Don't maintain a counter count (Cosmin Ratiu) [Orabug: 38253291]
  - net/mlx5: hw counters: Drop unneeded cacheline alignment (Cosmin Ratiu) [Orabug: 38253291]
  - net/mlx5: hw counters: Replace IDR+lists with xarray (Cosmin Ratiu) [Orabug: 38253291]
  - net/mlx5: hw counters: Use kvmalloc for bulk query buffer (Cosmin Ratiu) [Orabug: 38253291]
  - net/mlx5: hw counters: Make fc_stats & fc_pool private (Cosmin Ratiu) [Orabug: 38253291]
  - net/mlx5: fs, separate action and destination into distinct struct (Mark Bloch) [Orabug: 38253291]
  - net/mlx5: fs, remove unused member (Mark Bloch) [Orabug: 38253291]
  - net/mlx5: fs, move hardware fte deletion function reset (Mark Bloch) [Orabug: 38253291]
  - net/mlx5: fs, make get_root_namespace API function (Moshe Shemesh) [Orabug: 38253291]
  - net/mlx5: HWS, fixed error flow return values of some functions (Yevgeny Kliteynik) [Orabug: 38253291]
  - net/mlx5: HWS, updated API functions comments to kernel doc (Yevgeny Kliteynik) [Orabug: 38253291]
  - net/mlx5: HWS, added API and enabled HWS support (Yevgeny Kliteynik) [Orabug: 38253291]
  - net/mlx5: HWS, added send engine and context handling (Yevgeny Kliteynik) [Orabug: 38253291]
  - net/mlx5: HWS, added debug dump and internal headers (Yevgeny Kliteynik) [Orabug: 38253291]
  - net/mlx5: HWS, added backward-compatible API handling (Yevgeny Kliteynik) [Orabug: 38253291]
  - net/mlx5: HWS, added memory management handling (Yevgeny Kliteynik) [Orabug: 38253291]
  - net/mlx5: HWS, added vport handling (Yevgeny Kliteynik) [Orabug: 38253291]
  - net/mlx5: HWS, added modify header pattern and args handling (Yevgeny Kliteynik) [Orabug: 38253291]
  - net/mlx5: HWS, added FW commands handling (Yevgeny Kliteynik) [Orabug: 38253291]
  - net/mlx5: HWS, added matchers functionality (Yevgeny Kliteynik) [Orabug: 38253291]
  - net/mlx5: HWS, added definers handling (Yevgeny Kliteynik) [Orabug: 38253291]
  - net/mlx5: HWS, added rules handling (Yevgeny Kliteynik) [Orabug: 38253291]
  - net/mlx5: HWS, added tables handling (Yevgeny Kliteynik) [Orabug: 38253291]
  - net/mlx5: HWS, added actions handling (Yevgeny Kliteynik) [Orabug: 38253291]
  - net/mlx5: Added missing definitions in preparation for HW Steering (Yevgeny Kliteynik) [Orabug: 38253291]
  - net/mlx5: Added missing mlx5_ifc definition for HW Steering (Yevgeny Kliteynik) [Orabug: 38253291]
  - net/rds: Enforce sibling ToS lanes are not UP when auto reaping a conn (Sharath Srinivasan) [Orabug: 38343380]
  - net/rds: replace rds_conn_addr_list with reentrant code (Sharath Srinivasan) [Orabug: 38343380]
  - net/rds: Auto-reap dropped conn via sysctl net.rds.conn_reap_after_drop_secs (Sharath Srinivasan) [Orabug: 38343380]
  - net/rds: Enable tracing for rds_conn_reap() (Sharath Srinivasan) [Orabug: 38343380]
  - net/rds: Disallow user conn reap via sysctl net.rds.conn_user_reap_enable (Sharath Srinivasan) [Orabug: 38343380]
  - net/rds: Add sockopt member all_tos to reset/reap all conns for src-dst (Sharath Srinivasan) [Orabug: 38343380]
  - net/rds: Reap rds_rdma connections via sockopt RDS_CONN_REAP (Sharath Srinivasan) [Orabug: 38343380]
  - mm, numa: fix bad pmd by atomically checking is_swap_pmd() in change_prot_numa() (Harry Yoo) [Orabug: 38410500]
  - scsi: target: Export fabric driver direct submit settings (Mike Christie) [Orabug: 38443422]
  - scsi: target: core: Unexport target_queue_submission() (Mike Christie) [Orabug: 38443422]
  - scsi: target: Allow userspace to request direct submissions (Mike Christie) [Orabug: 38443422]
  - scsi: target: core: Kill transport_handle_cdb_direct() (Mike Christie) [Orabug: 38443422]
  - scsi: target: core: Move buffer clearing hack (Mike Christie) [Orabug: 38443422]
  - scsi: target: core: Move core_alua_check_nonop_delay() call (Mike Christie) [Orabug: 38443422]
  - scsi: target: Have drivers report if they support direct submissions (Mike Christie) [Orabug: 38443422]
  - scsi: target: iscs: Make write_pending_must_be_called a bit field (Mike Christie) [Orabug: 38443422]
  - KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active (Maciej S. Szmigiero) [Orabug: 38458436]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-314.189.2.el9uek]
changelog:
  - uek-rpm: Bluefield 3: Enable CONFIG_KEXEC_{FILE,SIG,IMAGE_VERIFY_SIG} and CONFIG_EDAC_GHES (Thomas Tai) [Orabug: 38474014]
  - uek-rpm: Enable the FWCTL PDS in UEK7 (Joao Martins) [Orabug: 38467344]
  - pds_core: init viftype default in declaration (Shannon Nelson) [Orabug: 38467344]
  - pds_core: smaller adminq poll starting interval (Shannon Nelson) [Orabug: 38467344]
  - pds_core: Allocate pdsc_viftype_defaults copy with ARRAY_SIZE() (Kees Cook) [Orabug: 38467344]
  - pds_core: remove write-after-free of client_id (Shannon Nelson) [Orabug: 37976798,38467344] {CVE-2025-37916}
  - pds_core: make wait_context part of q_info (Shannon Nelson) [Orabug: 37937540,38467344] {CVE-2025-37886}
  - pds_core: Remove unnecessary check in pds_client_adminq_cmd() (Brett Creeley) [Orabug: 38467344]
  - pds_core: handle unsupported PDS_CORE_CMD_FW_CONTROL result (Brett Creeley) [Orabug: 37937543,38467344] {CVE-2025-37887}
  - pds_core: Prevent possible adminq overflow/stuck condition (Brett Creeley) [Orabug: 37977106,38467344] {CVE-2025-37987}
  - pds_core: fix memory leak in pdsc_debugfs_add_qcq() (Abdun Nihaal) [Orabug: 38467344]
  - pds_fwctl: Fix type and endian complaints (Shannon Nelson) [Orabug: 38467344]
  - pds_fwctl: add rpc and query support (Brett Creeley) [Orabug: 38467344]
  - pds_fwctl: initial driver framework (Shannon Nelson) [Orabug: 38467344]
  - pds_core: add new fwctl auxiliary_device (Shannon Nelson) [Orabug: 38467344]
  - pds_core: specify auxiliary_device to be created (Shannon Nelson) [Orabug: 38467344]
  - pds_core: make pdsc_auxbus_dev_del() void (Shannon Nelson) [Orabug: 38467344]
  - pds_core: limit loop over fw name list (Shannon Nelson) [Orabug: 38467344]
  - pds_core: Remove redundant null pointer checks (Li Zetao) [Orabug: 38467344]
  - pds_core: Fix pdsc_check_pci_health function to use work thread (Brett Creeley) [Orabug: 38467344,38498854] {CVE-2024-35968}
  - pds_core: use pci_reset_function for health reset (Shannon Nelson) [Orabug: 38467344]
  - pds_core: delete VF dev on reset (Shannon Nelson) [Orabug: 38467344]
  - pds_core: add simple AER handler (Shannon Nelson) [Orabug: 38467344]
  - pds_core: no health-thread in VF path (Shannon Nelson) [Orabug: 38467344]
  - pds_core: Clean up init/uninit flows to be more readable (Brett Creeley) [Orabug: 38467344]
  - pds_core: Fix up some minor issues (Brett Creeley) [Orabug: 38467344]
  - pds_core: Unmask adminq interrupt in work thread (Brett Creeley) [Orabug: 38467344]
  - pds_core: Don't assign interrupt index/bound_intr to notifyq (Brett Creeley) [Orabug: 38467344]
  - pds_core: Rework teardown/setup flow to be more common (Brett Creeley) [Orabug: 38467344]
  - pds_core: Clear BARs on reset (Brett Creeley) [Orabug: 38467344]
  - pds_core: Use struct pdsc for the pdsc_adminq_isr private data (Brett Creeley) [Orabug: 38467344]
  - pds_core: Cancel AQ work on teardown (Brett Creeley) [Orabug: 38467344]
  - pds_core: Prevent health thread from running during reset/remove (Brett Creeley) [Orabug: 38467344]
  - pds_core: fix up some format-truncation complaints (Shannon Nelson) [Orabug: 38467344]
  - net: pds_core: Fix possible double free in error handling path (Yongzhi Liu) [Orabug: 36530186] {CVE-2024-26652}
  - x86/its: ITS impacts performance even when mitigation is disabled (Alexandre Chartre) [Orabug: 38346576]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-314.193.3.el9uek]
changelog:
  - LTS version: v5.15.193 (Vijayendra Suman)
  - LTS version: v5.15.192 (Vijayendra Suman)
  - dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status() (Qiu-Ji Chen)
  - spi: tegra114: Use value to check for invalid delays (Aaron Kling)
  - clk: qcom: gdsc: Set retain_ff before moving to HW CTRL (Taniya Das)
  - perf bpf-event: Fix use-after-free in synthesis (Ian Rogers)
  - drm/bridge: ti-sn65dsi86: fix REFCLK setting (Michael Walle)
  - spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort (Larisa Grigore)
  - spi: spi-fsl-lpspi: Set correct chip-select polarity bit (Larisa Grigore)
  - spi: spi-fsl-lpspi: Fix transmissions when using CONT (Larisa Grigore)
  - pcmcia: Add error handling for add_interval() in do_validate_mem() (Xu Wang)
  - ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model (Takashi Iwai)
  - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Li Qiong) [Orabug: 38494760] {CVE-2025-39902}
  - randstruct: gcc-plugin: Fix attribute addition (Kees Cook)
  - randstruct: gcc-plugin: Remove bogus void member (Kees Cook)
  - arm64: dts: marvell: uDPU: define pinctrl state for alarm LEDs (Gabor Juhos)
  - vmxnet3: update MTU after device quiesce (Ronak Doshi)
  - net: dsa: microchip: linearize skb for tail-tagging switches (Jakob Unterwurzacher)
  - net: dsa: microchip: update tag_ksz masks for KSZ9477 family (Pieter Van Trappen)
  - dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status() (Qiu-Ji Chen)
  - dma-buf: insert memory barrier before updating num_fences (Hyejeong Choi) [Orabug: 38152833] {CVE-2025-38095}
  - gpio: pca953x: fix IRQ storm on system wake up (Emanuele Ghidoli)
  - iio: light: opt3001: fix deadlock due to concurrent flag access (Luca Ceresoli) [Orabug: 37977027] {CVE-2025-37968}
  - iio: chemical: pms7003: use aligned_s64 for timestamp (David Lechner)
  - spi: tegra114: Don't fail set_cs_timing when delays are zero (Aaron Kling)
  - spi: tegra114: Remove unnecessary NULL-pointer checks (Alexander Danilenko)
  - KVM: x86: Take irqfds.lock when adding/deleting IRQ bypass producer (Sean Christopherson) [Orabug: 38494247]
  - cpufreq/sched: Explicitly synchronize limits_changed flag handling (Rafael J. Wysocki)
  - mm/khugepaged: fix ->anon_vma race (Jann Horn)
  - e1000e: fix heap overflow in e1000_set_eeprom (Vitaly Lifshits) [Orabug: 38494739] {CVE-2025-39898}
  - batman-adv: fix OOB read/write in network-coding decode (Stanislav Fort)
  - scsi: lpfc: Fix buffer free/clear order in deferred receive path (John Evans) [Orabug: 38456753] {CVE-2025-39841}
  - drm/amdgpu: drop hw access in non-DC audio fini (Alex Deucher)
  - wifi: mwifiex: Initialize the chan_stats array to zero (Rong Qianfeng) [Orabug: 38494722] {CVE-2025-39891}
  - mm: move page table sync declarations to linux/pgtable.h (Harry Yoo) [Orabug: 38456763] {CVE-2025-39844}
  - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Harry Yoo) [Orabug: 38456766] {CVE-2025-39845}
  - pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region() (Ma Ke)
  - ALSA: usb-audio: Add mute TLV for playback volumes on some devices (Cryolitia Pukngae)
  - phy: mscc: Stop taking ts_lock for tx_queue and use its own lock (Horatiu Vultur)
  - net: phy: mscc: Fix memory leak when using one step timestamping (Horatiu Vultur) [Orabug: 38153076] {CVE-2025-38148}
  - ptp: Add generic PTP is_sync() function (Kurt Kanzenbach)
  - ppp: fix memory leak in pad_compress_skb (Qingfang Deng) [Orabug: 38456780] {CVE-2025-39847}
  - net: atm: fix memory leak in atm_register_sysfs when device_register fail (Wang Liang)
  - ax25: properly unshare skbs in ax25_kiss_rcv() (Eric Dumazet)
  - ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init() (Dan Carpenter)
  - net: thunder_bgx: decrement cleanup index before use (Rosen Penev)
  - net: thunder_bgx: add a missing of_node_put (Rosen Penev)
  - wifi: libertas: cap SSID len in lbs_associate() (Dan Carpenter)
  - wifi: cw1200: cap SSID length in cw1200_do_join() (Dan Carpenter)
  - net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets (Felix Fietkau)
  - i40e: Fix potential invalid access when MAC list is empty (Zhen Ni) [Orabug: 38456813] {CVE-2025-39853}
  - icmp: fix icmp_ndo_send address translation for reply direction (Fabian Bläse)
  - mISDN: Fix memory leak in dsp_hwec_enable() (Miaoqian Lin)
  - xirc2ps_cs: fix register access when enabling FullDuplex (Alok Tiwari)
  - Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (Kuniyuki Iwashima) [Orabug: 38456833] {CVE-2025-39860}
  - netfilter: conntrack: helper: Replace -EEXIST by -EBUSY (Phil Sutter)
  - netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm (Wang Liang) [Orabug: 38494730] {CVE-2025-39894}
  - wifi: cfg80211: fix use-after-free in cmp_bss() (Dmitry Antipov) [Orabug: 38456858] {CVE-2025-39864}
  - arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro (Peter Robinson)
  - tee: fix NULL pointer dereference in tee_shm_put (Pei Xiao) [Orabug: 38456865] {CVE-2025-39865}
  - fs: writeback: fix use-after-free in __mark_inode_dirty() (Jiufei Xue) [Orabug: 38456870,38528183] {CVE-2025-39866}
  - drm/amd/display: Don't warn when missing DCE encoder caps (Timur Kristóf)
  - bpf: Fix oob access in cgroup local storage (Daniel Borkmann) [Orabug: 38324117] {CVE-2025-38502}
  - bpf: Move bpf map owner out of common struct (Daniel Borkmann)
  - bpf: Move cgroup iterator helpers to bpf.h (Daniel Borkmann)
  - bpf: Add cookie object to bpf maps (Daniel Borkmann)
  - LTS version: v5.15.191 (Vijayendra Suman)
  - xfs: do not propagate ENODATA disk errors into xattr code (Eric Sandeen) [Orabug: 38440385] {CVE-2025-39835}
  - Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS" (Imre Deak)
  - HID: mcp2221: Handle reads greater than 60 bytes (Hamish Martin)
  - HID: mcp2221: Don't set bus speed on every transfer (Hamish Martin)
  - drm/nouveau/disp: Always accept linear modifier (James Jones)
  - net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
  - dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted (Shanker Donthineni)
  - Revert "drm/amdgpu: fix incorrect vm flags to map bo" (Alex Deucher) [Orabug: 38343660]
  - HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() (Minjong Kim) [Orabug: 38440227] {CVE-2025-39808}
  - HID: wacom: Add a new Art Pen 2 (Ping Cheng)
  - HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() (Qasim Ijaz) [Orabug: 38440223] {CVE-2025-39806}
  - HID: asus: fix UAF via HID_CLAIMED_INPUT validation (Qasim Ijaz) [Orabug: 38440309] {CVE-2025-39824}
  - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (Li Nan) [Orabug: 38440276] {CVE-2025-39817}
  - sctp: initialize more fields in sctp_v6_from_sk() (Eric Dumazet) [Orabug: 38440249] {CVE-2025-39812}
  - net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts (Rohan G Thomas)
  - net/mlx5e: Set local Xoff after FW update (Alexei Lazar)
  - net/mlx5e: Update and set Xon/Xoff upon port speed set (Alexei Lazar)
  - net/mlx5e: Update and set Xon/Xoff upon MTU set (Alexei Lazar)
  - phy: mscc: Fix when PTP clock is register and unregister (Horatiu Vultur)
  - net: dlink: fix multicast stats being counted incorrectly (Moon Yeounsu)
  - atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). (Kuniyuki Iwashima) [Orabug: 38440345] {CVE-2025-39828}
  - Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced (Luiz Augusto von Dentz)
  - powerpc/kvm: Fix ifdef to remove build warning (Madhavan Srinivasan)
  - net: ipv4: fix regression in local-broadcast routes (Oscar Maes) [Orabug: 38343660]
  - vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() (Nikolay Kuratov)
  - NFS: Fix a race when updating an existing write (Trond Myklebust) [Orabug: 38401609] {CVE-2025-39697}
  - nfs: fold nfs_page_group_lock_subrequests into nfs_lock_and_join_requests (Christoph Hellwig)
  - ASoC: codecs: tx-macro: correct tx_macro_component_drv name (Alexey Klimov)
  - scsi: core: sysfs: Correct sysfs attributes access rights (Damien Le Moal)
  - ftrace: Fix potential warning in trace_printk_seq during ftrace_dump (Tengda Wu) [Orabug: 38440258] {CVE-2025-39813}
  - pinctrl: STMFX: add missing HAS_IOMEM dependency (Randy Dunlap)
  - LTS version: v5.15.190 (Vijayendra Suman)
  - alloc_fdtable(): change calling conventions. (Al Viro)
  - wifi: mac80211: check basic rates validity in sta_link_apply_parameters (Mikhail Lobanov)
  - netfilter: nf_reject: don't leak dst refcount for loopback packets (Florian Westphal) [Orabug: 38401481] {CVE-2025-38732}
  - s390/hypfs: Enable limited access during lockdown (Peter Oberparleiter)
  - s390/hypfs: Avoid unnecessary ioctl registration in debugfs (Peter Oberparleiter)
  - ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation (Takashi Iwai)
  - bonding: update LACP activity flag after setting lacp_active (Hangbin Liu)
  - net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate (William Liu)
  - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (William Liu) [Orabug: 38423456] {CVE-2025-39766}
  - ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc (Jason Xing)
  - net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization (Yuichiro Tsuji) [Orabug: 38516727] {CVE-2025-38736}
  - phy: mscc: Fix timestamping for vsc8584 (Horatiu Vultur)
  - net: phy: Use netif_rx(). (Sebastian Andrzej Siewior)
  - ppp: fix race conditions in ppp_fill_forward_path (Qingfang Deng) [Orabug: 38401500] {CVE-2025-39673}
  - ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add (Heminhong)
  - drm/amd/display: Add null pointer check in mod_hdcp_hdcp1_create_session() (Chenyuan Yang)
  - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Dan Carpenter) [Orabug: 38343660]
  - drm/hisilicon/hibmc: fix the hibmc loaded failed bug (Baihan Li) [Orabug: 38423473] {CVE-2025-39772}
  - mlxsw: spectrum: Forward packets with an IPv4 link-local source IP (Ido Schimmel)
  - iommu/amd: Avoid stack buffer overflow from kernel cmdline (Kees Cook) [Orabug: 38360925] {CVE-2025-38676}
  - scsi: qla4xxx: Prevent a potential error pointer dereference (Dan Carpenter) [Orabug: 38401513] {CVE-2025-39676}
  - net: bridge: fix soft lockup in br_multicast_query_expired() (Wang Liang) [Orabug: 38423478] {CVE-2025-39773}
  - RDMA/bnxt_re: Fix to initialize the PBL array (Anantha Prabhu)
  - cgroup/cpuset: Use static_branch_enable_cpuslocked() on cpusets_insane_config_key (Waiman Long)
  - mm/page_alloc: detect allocation forbidden by cpuset and bail out early (Feng Tang)
  - x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper (Tianxiang Peng) [Orabug: 38401541] {CVE-2025-39681}
  - iio: light: as73211: Ensure buffer holes are zeroed (Jonathan Cameron)
  - tracing: Limit access to parser->buffer when trace_get_user failed (Pu Lehui) [Orabug: 38401546] {CVE-2025-39683}
  - tracing: Remove unneeded goto out logic (Steven Rostedt)
  - iio: imu: inv_icm42600: change invalid data error to -EBUSY (Jean-Baptiste Maneyrol)
  - usb: xhci: Fix slot_id resource race conflict (Weitao Wang)
  - selftests: mptcp: pm: check flush doesn't reset limits (Matthieu Baerts)
  - pwm: mediatek: Fix duty and period setting (Uwe Kleine-König)
  - pwm: mediatek: Handle hardware enable and clock enable separately (Uwe Kleine-König)
  - pwm: mediatek: Implement .apply() callback (Uwe Kleine-König)
  - scsi: mpi3mr: Serialize admin queue BAR writes on 32-bit systems (Ranjan Kumar)
  - scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers (Ranjan Kumar)
  - scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE (André Draszik)
  - iio: adc: ad_sigma_delta: change to buffer predisable (David Lechner)
  - soc: qcom: mdt_loader: Ensure we don't read past the ELF header (Bjorn Andersson) [Orabug: 38423523] {CVE-2025-39787}
  - wifi: ath11k: fix dest ring-buffer corruption when ring is full (Johan Hovold)
  - asm-generic: Add memory barrier dma_mb() (Kefeng Wang)
  - locking/barriers, kcsan: Support generic instrumentation (Marco Elver)
  - media: venus: protect against spurious interrupts during probe (Jorge Ramirez-Ortiz)
  - media: venus: Add support for SSR trigger using fault injection (Dikshita Agarwal)
  - media: qcom: camss: cleanup media device allocated resource on error path (Sasha Levin)
  - media: camss: Convert to platform remove callback returning void (Uwe Kleine-König)
  - f2fs: fix to avoid out-of-boundary access in dnode page (Chao Yu)
  - drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS (Imre Deak)
  - mptcp: disable add_addr retransmission when timeout is 0 (Geliang Tang)
  - drm/amd/display: Don't overclock DCE 6 by 15% (Timur Kristóf)
  - usb: dwc3: Remove WARN_ON for device endpoint command timeouts (Selvarasu Ganesan) [Orabug: 38435009] {CVE-2025-39801}
  - usb: dwc3: Ignore late xferNotReady event to prevent halt timeout (Kuen-Han Tsai)
  - USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles (Zenm Chen)
  - usb: storage: realtek_cr: Use correct byte order for bcs->Residue (Thorsten Blum)
  - USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera (Mael Guerin)
  - usb: renesas-xhci: Fix External ROM access timeouts (Marek Vasut)
  - usb: core: hcd: fix accessing unmapped memory in SINGLE_STEP_SET_FEATURE test (Xu Yang)
  - comedi: Fix use of uninitialized memory in do_insn_ioctl() and do_insnlist_ioctl() (Ian Abbott)
  - comedi: pcl726: Prevent invalid irq number (Edward Adam Davis)
  - comedi: Make insn_rw_emulate_bits() do insn->n samples (Ian Abbott)
  - usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive (Miao Li)
  - most: core: Drop device reference after usage in get_channel() (Miaoqian Lin)
  - iio: proximity: isl29501: fix buffered read on big-endian systems (David Lechner)
  - iio: pressure: bmp280: Use IS_ERR() in bmp280_common_probe() (Salah Triki)
  - ftrace: Also allocate and copy hash for reading of filter files (Steven Rostedt) [Orabug: 38401580] {CVE-2025-39689}
  - fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable() (Xu Yilun)
  - use uniform permission checks for all mount propagation changes (Al Viro)
  - fs/buffer: fix use-after-free when call bh_read() helper (Ye Bin) [Orabug: 38401586] {CVE-2025-39691}
  - drm/amd/display: Fill display clock and vblank time in dce110_fill_display_configs (Timur Kristóf)
  - drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs (Timur Kristóf)
  - drm/amd/display: Fix DP audio DTO1 clock source on DCE 6. (Timur Kristóf)
  - drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3 (Timur Kristóf)
  - drm/amd/display: Avoid a NULL pointer dereference (Mario Limonciello) [Orabug: 38401596] {CVE-2025-39693}
  - ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and EliteBook 830 G6 (Evgeniy Harchenko)
  - mm/debug_vm_pgtable: clear page table entries at destroy_args() (Herton Ronaldo Krzesinski)
  - mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for consistency (Victor Shih)
  - memstick: Fix deadlock by moving removing flag earlier (Jiayi Li)
  - scsi: ufs: ufs-pci: Fix default runtime and system PM levels (Adrian Hunter)
  - scsi: ufs: ufs-pci: Fix hibernate state transition for Intel MTL-like host controllers (Archana Patni)
  - mptcp: do not queue data on closed subflows (Paolo Abeni)
  - mptcp: drop unused sk in mptcp_push_release (Geliang Tang)
  - selftests: mptcp: Initialize variables to quiet gcc 12 warnings (Mat Martineau)
  - mptcp: introduce MAPPING_BAD_CSUM (Paolo Abeni)
  - mptcp: fix error mibs accounting (Paolo Abeni)
  - selftests: mptcp: add missing join check (Matthieu Baerts)
  - selftests: mptcp: connect: also cover checksum (Matthieu Baerts)
  - selftests: mptcp: connect: also cover alt modes (Matthieu Baerts)
  - selftests: mptcp: make sendfile selftest work (Florian Westphal)
  - ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value (Li Zhong)
  - PCI: vmd: Assign VMD IRQ domain before enumeration (Nirmal Patel)
  - sch_htb: make htb_deactivate() idempotent (Cong Wang) [Orabug: 38516621] {CVE-2025-37953}
  - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Cong Wang) [Orabug: 37908491] {CVE-2025-37798}
  - sch_drr: make drr_qlen_notify() idempotent (Cong Wang)
  - btrfs: populate otime when logging an inode item (Qu Wenruo)
  - KVM: VMX: Flush shadow VMCS on emergency reboot (Chao Gao)
  - net/sched: ets: use old 'nbands' while purging unused classes (Davide Caratti) [Orabug: 38394836] {CVE-2025-38684}
  - net_sched: sch_ets: implement lockless ets_dump() (Eric Dumazet)
  - net/sched: sch_ets: properly init all active DRR list handles (Davide Caratti) [Orabug: 35290200]
  - platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister() (Tzung-Bi Shih)
  - platform/chrome: cros_ec: remove unneeded label and if-condition (Tzung-Bi Shih)
  - platform/chrome: cros_ec: Use per-device lockdep key (Chen-Yu Tsai)
  - platform/chrome: cros_ec: Make cros_ec_unregister() return void (Uwe Kleine-König)
  - usb: dwc3: imx8mp: fix device leak at unbind (Johan Hovold)
  - bus: mhi: host: Detect events pointing to unexpected TREs (Youssef Samir) [Orabug: 38423539] {CVE-2025-39790}
  - ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig (Damien Le Moal)
  - usb: musb: omap2430: fix device leak at unbind (Johan Hovold)
  - usb: musb: omap2430: Convert to platform remove callback returning void (Uwe Kleine-König)
  - mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd() (Anshuman Khandual)
  - NFS: Fix the setting of capabilities when automounting a new filesystem (Trond Myklebust) [Orabug: 38429210] {CVE-2025-39798}
  - NFS: Create an nfs4_server_set_init_caps() function (Anna Schumaker)
  - net: enetc: fix device and OF node leak at probe (Johan Hovold)
  - block: Make REQ_OP_ZONE_FINISH a write operation (Damien Le Moal)
  - PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports (Lukas Wunner)
  - usb: typec: fusb302: cache PD RX state (Sebastian Reichel)
  - hv_netvsc: Fix panic during namespace deletion with VF (Haiyang Zhang) [Orabug: 38394830] {CVE-2025-38683}
  - smb: server: Fix extension string in ksmbd_extract_shortname() (Thorsten Blum)
  - ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx() (Geoffrey D. Bennett)
  - x86/fpu: Delay instruction pointer fixup until after warning (Dave Hansen)
  - usb: hub: Don't try to recover devices lost during warm reset. (Mathias Nyman)
  - usb: hub: avoid warm port reset during USB3 disconnect (Mathias Nyman)
  - x86/mce/amd: Add default names for MCA banks and blocks (Yazen Ghannam)
  - iio: hid-sensor-prox: Fix incorrect OFFSET calculation (Zhang Lixu)
  - iio: hid-sensor-prox: Restore lost scale assignments (Zhang Lixu)
  - f2fs: fix to do sanity check on ino and xnid (Chao Yu)
  - arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack() (Ada Couprie Diaz) [Orabug: 38351990] {CVE-2025-38670}
  - drm/sched: Remove optimization that causes hang when killing dependent jobs (Lin Cao)
  - ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (Haoxiang Li) [Orabug: 38351929] {CVE-2025-38664}
  - selftests/memfd: add test for mapping write-sealed memfd read-only (Lorenzo Stoakes)
  - mm: reinstate ability to map write-sealed memfd mappings read-only (Lorenzo Stoakes)
  - mm: update memfd seal write check to include F_SEAL_WRITE (Lorenzo Stoakes)
  - mm: drop the assumption that VM_SHARED always implies writable (Lorenzo Stoakes)
  - sch_qfq: make qfq_qlen_notify() idempotent (Cong Wang)
  - sch_hfsc: make hfsc_qlen_notify() idempotent (Cong Wang) [Orabug: 38158395] {CVE-2025-38177}
  - sch_htb: make htb_qlen_notify() idempotent (Cong Wang) [Orabug: 37976859] {CVE-2025-37932}
  - mptcp: pm: kernel: flush: do not reset ADD_ADDR limit (Matthieu Baerts)
  - mptcp: drop skb if MPTCP skb extension allocation fails (Christoph Paasch)
  - ipv6: sr: Fix MAC comparison to be constant-time (Eric Biggers)
  - net, hsr: reject HSR frame if skb can't hold tag (Jakub Acs) [Orabug: 38401632] {CVE-2025-39703}
  - drm/amd/display: Don't overwrite dce60_clk_mgr (Timur Kristóf)
  - drm/amd: Restore cached power limit during resume (Mario Limonciello)
  - media: venus: venc: Clamp param smaller than 1fps and bigger than 240 (Ricardo Ribalda)
  - media: venus: vdec: Clamp param smaller than 1fps and bigger than 240. (Ricardo Ribalda)
  - media: venus: hfi: explicitly release IRQ during teardown (Jorge Ramirez-Ortiz)
  - media: venus: Add a check for packet size after reading from shared memory (Vedang Nagar)
  - media: ov2659: Fix memory leaks in ov2659_probe() (Zhang Shurong)
  - media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() (Gui-Dong Han) [Orabug: 38401676] {CVE-2025-39713}
  - media: usbtv: Lock resolution while streaming (Ludwig Disterhof) [Orabug: 38401683] {CVE-2025-39714}
  - media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free() (Sakari Ailus)
  - media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init() (Haoxiang Li)
  - media: hi556: correct the test pattern configuration (Bingbu Cao)
  - media: gspca: Add bounds checking to firmware parser (Dan Carpenter)
  - soc/tegra: pmc: Ensure power-domains are in a known state (Jonathan Hunter)
  - jbd2: prevent softlockup in jbd2_log_do_checkpoint() (Baokun Li) [Orabug: 38423508] {CVE-2025-39782}
  - PCI: endpoint: Fix configfs group removal on driver teardown (Damien Le Moal)
  - PCI: endpoint: Fix configfs group list head handling (Damien Le Moal)
  - mtd: rawnand: fsmc: Add missing check after DMA map (Thomas Fourier)
  - mtd: spinand: propagate spinand_wait() errors from spinand_write_page() (Gabor Juhos)
  - hwmon: (gsc-hwmon) fix fan pwm setpoint show functions (Tim Harvey)
  - pwm: imx-tpm: Reset counter if CMOD is 0 (Laurentiu Mihalcea)
  - wifi: ath11k: fix source ring-buffer corruption (Johan Hovold)
  - wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table() (Nathan Chancellor)
  - zynq_fpga: use sgtable-based scatterlist wrappers (Marek Szyprowski)
  - ata: libata-scsi: Fix ata_to_sense_error() status handling (Damien Le Moal)
  - scsi: mpi3mr: Fix race between config read submit and interrupt completion (Ranjan Kumar)
  - ext4: fix hole length calculation overflow in non-extent inodes (Zhang Yi)
  - ext4: use kmalloc_array() for array space allocation (Liao Yuanhong)
  - ext4: don't try to clear the orphan_present feature block device is r/o (Theodore Ts'O)
  - ext4: fix reserved gdt blocks handling in fsmap (Ojaswin Mujoo)
  - ext4: fix fsmap end of range reporting with bigalloc (Ojaswin Mujoo)
  - ext4: check fast symlink for ea_inode correctly (Andreas Dilger)
  - lib/crypto: mips/chacha: Fix clang build and remove unneeded byteswap (Eric Biggers)
  - vt: defkeymap: Map keycodes above 127 to K_HOLE (Myrrh Periwinkle)
  - vt: keyboard: Don't process Unicode characters in K_OFF mode (Myrrh Periwinkle)
  - bus: mhi: host: Fix endianness of BHI vector table (Alexander Wilhelm)
  - usb: dwc3: meson-g12a: fix device leaks at unbind (Johan Hovold)
  - usb: gadget: udc: renesas_usb3: fix device leak at unbind (Johan Hovold)
  - usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init() (Nathan Chancellor)
  - m68k: Fix lost column on framebuffer debug console (Finn Thain)
  - cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table() (Dan Carpenter)
  - serial: 8250: fix panic due to PSLVERR (Yunhui Cui) [Orabug: 38401728] {CVE-2025-39724}
  - HID: magicmouse: avoid setting up battery timer when not needed (Aditya Garg)
  - media: uvcvideo: Do not mark valid metadata as invalid (Ricardo Ribalda)
  - media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() (Youngjun Lee) [Orabug: 38394815] {CVE-2025-38680}
  - mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock (Breno Leitao)
  - mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup() (Waiman Long)
  - parisc: Makefile: fix a typo in palo.conf (Randy Dunlap)
  - fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (Sravan Kumar Gundu) [Orabug: 38394843] {CVE-2025-38685}
  - btrfs: do not allow relocation of partially dropped subvolumes (Qu Wenruo) [Orabug: 38423271] {CVE-2025-39738}
  - btrfs: fix log tree replay failure due to file with 0 links and extents (Filipe Manana)
  - cdc-acm: fix race between initial clearing halt and open (Oliver Neukum)
  - thunderbolt: Fix copy+paste error in match_service_id() (Eric Biggers)
  - comedi: fix race between polling and detaching (Ian Abbott)
  - usb: typec: ucsi: Update power_supply on power role change (Myrrh Periwinkle)
  - misc: rtsx: usb: Ensure mmc child device is active when card is present (Ricky Wu)
  - usb: core: config: Prevent OOB read in SS endpoint companion parsing (Xinyu Liu) [Orabug: 38423420] {CVE-2025-39760}
  - ext4: fix largest free orders lists corruption on mb_optimize_scan switch (Baokun Li)
  - drm/amdgpu: fix incorrect vm flags to map bo (Jack Xiao)
  - ASoC: fsl_sai: replace regmap_write with regmap_update_bits (Shengjiu Wang)
  - ASoC: soc-dai.h: merge DAI call back functions into ops (Kuninori Morimoto)
  - ASoC: soc-dai.c: add missing flag check at snd_soc_pcm_dai_probe() (Kuninori Morimoto)
  - scsi: lpfc: Remove redundant assignment to avoid memory leak (Jiasheng Jiang)
  - rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe (Meagan Lloyd)
  - pNFS: Fix uninited ptr deref in block/scsi layout (Sergey Bashirov) [Orabug: 38394865] {CVE-2025-38691}
  - pNFS: Handle RPC size limit for layoutcommits (Sergey Bashirov)
  - pNFS: Fix disk addr range check in block/scsi layout (Sergey Bashirov)
  - pNFS: Fix stripe mapping in block/scsi layout (Sergey Bashirov)
  - block: avoid possible overflow for chunk_sectors check in blk_stack_limits() (John Garry) [Orabug: 38429192] {CVE-2025-39795}
  - net: phy: smsc: add proper reset flags for LAN8710A (Csaba Buday)
  - ipmi: Fix strcpy source and destination the same (Corey Minyard)
  - kconfig: lxdialog: fix 'space' to (de)select options (Yann E. MORIN)
  - kconfig: gconf: fix potential memory leak in renderer_edited() (Masahiro Yamada)
  - kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed() (Masahiro Yamada)
  - ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Breno Leitao)
  - scsi: aacraid: Stop using PCI_IRQ_AFFINITY (John Garry)
  - scsi: target: core: Generate correct identifiers for PR OUT transport IDs (Maurizio Lombardi)
  - scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans (Ranjan Kumar)
  - kconfig: nconf: Ensure null termination where strncpy is used (Shankari Anand)
  - kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c (Suchit Karunakaran)
  - i2c: Force DLL0945 touchpad i2c freq to 100khz (Fangzhong Zhou)
  - dm-mpath: don't print the "loaded" message if registering fails (Mikulas Patocka)
  - i3c: don't fail if GETHDRCAP is unsupported (Wolfram Sang)
  - rtc: ds1307: handle oscillator stop flag (OSF) for ds1341 (Meagan Lloyd)
  - i3c: add missing include to internal header (Wolfram Sang)
  - md: dm-zoned-target: Initialize return variable r to avoid uninitialized use (Purva Yeshi)
  - crypto: octeontx2 - add timeout for load_fvc completion poll (Bharat Bhushan)
  - media: uvcvideo: Fix bandwidth issue for Alcor camera (Chenchangcheng)
  - media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar (Alex Guo) [Orabug: 38394879] {CVE-2025-38693}
  - media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb() (Alex Guo) [Orabug: 38394886] {CVE-2025-38694}
  - media: usb: hdpvr: disable zero-length read messages (Wolfram Sang)
  - media: tc358743: Increase FIFO trigger level to 374 (Dave Stevenson)
  - media: tc358743: Return an appropriate colorspace from tc358743_set_fmt (Dave Stevenson)
  - media: tc358743: Check I2C succeeded during probe (Dave Stevenson)
  - pinctrl: stm32: Manage irq affinity settings (Cheick Traore)
  - scsi: mpt3sas: Correctly handle ATA device errors (Damien Le Moal)
  - scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure (Justin Tee) [Orabug: 38394893] {CVE-2025-38695}
  - RDMA/core: reduce stack using in nldev_stat_get_doit() (Arnd Bergmann)
  - RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() (Yury Norov) [Orabug: 38423285] {CVE-2025-39742}
  - leds: leds-lp50xx: Handle reg to get correct multi_index (Johan Adolfsson)
  - media: v4l2-common: Reduce warnings about missing V4L2_CID_LINK_FREQ control (Niklas Söderlund)
  - MIPS: Don't crash in stack_top() for tasks without ABI or vDSO (Thomas Weißschuh)
  - jfs: upper bound check of tree index in dbAllocAG (Arnaud Lecomte)
  - jfs: Regular file corruption check (Edward Adam Davis)
  - jfs: truncate good inode pages when hard link is 0 (Lizhi Xu)
  - scsi: bfa: Double-free fix (Jackysliu) [Orabug: 38394923] {CVE-2025-38699}
  - watchdog: iTCO_wdt: Report error if timeout configuration fails (Ziyan Fu)
  - MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free} (Shiji Yang)
  - watchdog: dw_wdt: Fix default timeout (Sebastian Reichel)
  - fs/orangefs: use snprintf() instead of sprintf() (Amir Mohammad Jahangirzad)
  - scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated (Showrya M N) [Orabug: 38394930] {CVE-2025-38700}
  - ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr (Theodore Ts'O) [Orabug: 38394936] {CVE-2025-38701}
  - crypto: hisilicon/hpre - fix dma unmap sequence (Zhiqi Song)
  - cifs: Fix calling CIFSFindFirst() for root path without msearch (Pali Rohár)
  - watchdog: sbsa: Adjust keepalive timeout to avoid MediaTek WS0 race condition (Aaron Plattner)
  - vhost: fail early when __vhost_add_used() fails (Jason Wang)
  - net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325 (Álvaro Fernández Rojas)
  - drm/ttm: Respect the shrinker core free target (Tvrtko Ursulin)
  - uapi: in6: restore visibility of most IPv6 socket options (Jakub Kicinski)
  - drm/ttm: Should to return the evict error (Emily Deng)
  - net: ncsi: Fix buffer overflow in fetching version id (Hari Kalavakunta)
  - wifi: rtlwifi: fix possible skb memory leak in _rtl_pci_init_one_rxdesc() (Thomas Fourier)
  - net: dsa: b53: prevent SWITCH_CTRL access on BCM5325 (Álvaro Fernández Rojas)
  - net: dsa: b53: prevent DIS_LEARNING access on BCM5325 (Álvaro Fernández Rojas)
  - net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325 (Álvaro Fernández Rojas)
  - net: dsa: b53: fix b53_imp_vlan_setup for BCM5325 (Álvaro Fernández Rojas)
  - gve: Return error for unknown admin queue command (Alok Tiwari)
  - net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs (Gal Pressman)
  - drm/amd: Allow printing VanGogh OD SCLK levels without setting dpm to manual (Mario Limonciello)
  - dpaa_eth: don't use fixed_phy_change_carrier (Heiner Kallweit)
  - wifi: iwlegacy: Check rate_idx range after addition (Stanislaw Gruszka)
  - netmem: fix skb_frag_address_safe with unreadable skbs (Mina Almasry)
  - wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`. (Thomas Fourier)
  - drm/amd/display: Fix 'failed to blank crtc!' (Wen Chen)
  - wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect (Anjaneyulu)
  - wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd() (Rand Deeb)
  - drm/amd/display: Separate set_gsl from set_gsl_source_select (Ilya Bakoulin)
  - net: fec: allow disable coalescing (Jonas Rebmann)
  - net: atlantic: add set_power to fw_ops for atl2 to fix wol (Eric Work)
  - net: thunderbolt: Fix the parameter passing of tb_xdomain_enable_paths()/tb_xdomain_disable_paths() (Jianrong Zhang)
  - drm/msm: use trylock for debugfs (Rob Clark)
  - ipv6: mcast: Check inet6_dev->dead under idev->mc_lock in __ipv6_dev_mc_inc(). (Kuniyuki Iwashima)
  - (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer (Thomas Fourier)
  - wifi: mac80211: don't complete management TX on SAE commit (Johannes Berg)
  - s390/stp: Remove udelay from stp_sync_clock() (Sven Schnelle)
  - wifi: iwlwifi: mvm: fix scan request validation (Avraham Stern)
  - sched/deadline: Fix accounting after global limits change (Juri Lelli)
  - net: thunderx: Fix format-truncation warning in bgx_acpi_match_id() (Alok Tiwari)
  - net: ipv4: fix incorrect MTU in broadcast routes (Oscar Maes)
  - wifi: cfg80211: Fix interface type validation (Ilan Peer)
  - net: mctp: Prevent duplicate binds (Matt Johnston)
  - rcu: Protect ->defer_qs_iw_pending from data race (Paul E. McKenney) [Orabug: 38423340] {CVE-2025-39749}
  - arm64: Mark kernel as tainted on SAE and SError panic (Breno Leitao)
  - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Leon Romanovsky)
  - net: ag71xx: Add missing check after DMA map (Thomas Fourier)
  - et131x: Add missing check after DMA map (Thomas Fourier)
  - be2net: Use correct byte order and format string for TCP seq and ack_seq (Alok Tiwari)
  - s390/time: Use monotonic clock in get_cycles() (Sven Schnelle)
  - wifi: cfg80211: reject HTC bit for management frames (Johannes Berg)
  - ktest.pl: Prevent recursion of default variable options (Steven Rostedt)
  - xen/netfront: Fix TX response spurious interrupts (Anthoine Bourgeois)
  - ASoC: codecs: rt5640: Retry DEVICE_ID verification (Xinxin Wan)
  - iio: adc: ad7768-1: Ensure SYNC_IN pulse minimum timing requirement (Jonathan Santos)
  - ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros (Cristian Ciocaltea)
  - ALSA: pcm: Rewrite recalculate_boundary() to avoid costly loop (Christophe Leroy)
  - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (Lucy Thrun)
  - platform/chrome: cros_ec_typec: Defer probe on missing EC parent (Tomasz Michalec)
  - platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches (Kees Cook)
  - pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop() (Gautham R. Shenoy)
  - usb: core: usb_submit_urb: downgrade type check (Oliver Neukum)
  - usb: typec: intel_pmc_mux: Defer probe if SCU IPC isn't present (Tomasz Michalec)
  - ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (Peter Ujfalusi) [Orabug: 38394977] {CVE-2025-38706}
  - ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4 (Alok Tiwari)
  - ASoC: hdac_hdmi: Rate limit logging on connection and disconnection (Mark Brown)
  - x86/bugs: Avoid warning when overriding return thunk (Pawan Gupta)
  - mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode() (Ulf Hansson)
  - reset: brcmstb: Enable reset drivers for ARCH_BCM2835 (Peter Robinson)
  - pps: clients: gpio: fix interrupt handling order in remove path (Eliav Farber)
  - ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path (Breno Leitao)
  - mmc: sdhci-msm: Ensure SD card power isn't ON when card removed (Sarthak Garg)
  - ACPI: processor: fix acpi_object initialization (Sebastian Ott)
  - PM: sleep: console: Fix the black screen issue (Tuhaowen)
  - thermal: sysfs: Return ENODATA instead of EAGAIN for reads (Hsin-Te Yuan)
  - PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit() (Rafael J. Wysocki)
  - ACPI: PRM: Reduce unnecessary printing to avoid user confusion (Zhu Qiyu)
  - selftests: tracing: Use mutex_unlock for testing glob filter (Masami Hiramatsu)
  - ARM: tegra: Use I/O memcpy to write to IRAM (Aaron Kling)
  - gpio: tps65912: check the return value of regmap_update_bits() (Bartosz Golaszewski)
  - tools/nolibc: define time_t in terms of __kernel_old_time_t (Thomas Weißschuh)
  - thermal/drivers/qcom-spmi-temp-alarm: Enable stage 2 shutdown when required (David Collins)
  - ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed (Kuninori Morimoto)
  - EDAC/synopsys: Clear the ECC counters on init (Shubhrajyoti Datta)
  - PM / devfreq: governor: Replace sscanf() with kstrtoul() in set_freq_store() (Lifeng Zheng)
  - ARM: rockchip: fix kernel hang during smp initialization (Alexander Kochetkov)
  - cpufreq: Exit governor when failed to start old governor (Lifeng Zheng)
  - gpio: wcd934x: check the return value of regmap_update_bits() (Bartosz Golaszewski)
  - usb: xhci: Avoid showing errors during surprise removal (Mario Limonciello)
  - usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command (Jay Chen)
  - usb: xhci: Avoid showing warnings for dying controller (Mario Limonciello)
  - usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default (Benson Leung)
  - selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t (Cynthia Huang)
  - cpufreq: CPPC: Mark driver with NEED_UPDATE_LIMITS flag (Prashant Malani)
  - usb: xhci: print xhci->xhc_state when queue_command failed (Su Hui)
  - securityfs: don't pin dentries twice, once is enough... (Al Viro)
  - ext2: Handle fiemap on empty files to prevent EINVAL (Wei Gao)
  - fs/ntfs3: correctly create symlink for relative path (Rong Zhang)
  - fs/ntfs3: Add sanity check for file name (Lizhi Xu)
  - ata: libata-sata: Disallow changing LPM state if not supported (Damien Le Moal)
  - better lockdep annotations for simple_recursive_removal() (Al Viro)
  - hfs: fix not erasing deleted b-tree node issue (Viacheslav Dubeyko)
  - drbd: add missing kref_get in handle_write_conflicts (Sarah Newman) [Orabug: 38394994] {CVE-2025-38708}
  - udf: Verify partition map count (Jan Kara)
  - smb/server: avoid deadlock when linking with ReplaceIfExists (Neil Brown)
  - arm64: Handle KCOV __init vs inline mismatches (Kees Cook)
  - hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file() (Tetsuo Handa)
  - hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Viacheslav Dubeyko)
  - hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read() (Viacheslav Dubeyko)
  - hfs: fix slab-out-of-bounds in hfs_bnode_read() (Viacheslav Dubeyko)
  - ptp: prevent possible ABBA deadlock in ptp_clock_freerun() (Jeongjun Park)
  - intel_idle: Allow loading ACPI tables for any family (Len Brown)
  - sctp: linearize cloned gso packets in sctp_rcv (Xin Long) [Orabug: 38395058] {CVE-2025-38718}
  - netfilter: ctnetlink: fix refcount leak on table dump (Florian Westphal) [Orabug: 38395066] {CVE-2025-38721}
  - udp: also consider secpath when evaluating ipsec use for checksumming (Sabrina Dubroca)
  - ACPI: processor: perflib: Move problematic pr->performance check (Rafael J. Wysocki)
  - ACPI: processor: perflib: Fix initial _PPC limit application (Jiayi Li)
  - Documentation: ACPI: Fix parent device references (Andy Shevchenko)
  - eventpoll: Fix semi-unbounded recursion (Jann Horn) [Orabug: 38335161] {CVE-2025-38614}
  - fs: Prevent file descriptor table allocations exceeding INT_MAX (Sasha Levin) [Orabug: 38423396] {CVE-2025-39756}
  - sunvdc: Balance device refcount in vdc_port_mpgroup_check (Ma Ke)
  - NFSD: detect mismatch of file handle and delegation stateid in OPEN op (Dai Ngo)
  - nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (Jeff Layton) [Orabug: 38395080] {CVE-2025-38724}
  - net: usb: asix_devices: add phy_mask for ax88772 mdio bus (Xu Yang) [Orabug: 38395088] {CVE-2025-38725}
  - net: dpaa: fix device leak when querying time stamp info (Johan Hovold)
  - net: gianfar: fix device leak when querying time stamp info (Johan Hovold)
  - gpio: virtio: Fix config space reading. (Harald Mommer)
  - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Takashi Iwai) [Orabug: 38423406] {CVE-2025-39757}
  - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Takashi Iwai) [Orabug: 38395100] {CVE-2025-38729}
  - io_uring: don't use int for ABI (Pavel Begunkov)
  - usb: gadget : fix use-after-free in composite_dev_cleanup() (Taoxue) [Orabug: 38334897] {CVE-2025-38555}
  - mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery (Andy Shevchenko)
  - MIPS: mm: tlb-r4k: Uniquify TLB entries on init (Jiaxun Yang)
  - ALSA: intel_hdmi: Fix off-by-one error in __hdmi_lpe_audio_probe() (Thorsten Blum)
  - net: usbnet: Fix the wrong netif_carrier_on() call (Ammar Faizi)
  - net: usbnet: Avoid potential RCU stall on LINK_CHANGE event (John Ernberg)
  - USB: serial: option: add Foxconn T99W709 (Slark Xiao)
  - net/packet: fix a race in packet_set_ring() and packet_notifier() (Quang Le) [Orabug: 38351763] {CVE-2025-38617}
  - selftests/perf_events: Add a mmap() correctness test (Lorenzo Stoakes)
  - perf/core: Prevent VMA split of buffer mappings (Thomas Gleixner) [Orabug: 38334947] {CVE-2025-38563}
  - perf/core: Exit early on perf_mmap() fail (Thomas Gleixner) [Orabug: 38334957] {CVE-2025-38565}
  - perf/core: Don't leak AUX buffer refcount on allocation failure (Thomas Gleixner)
  - pptp: fix pptp_xmit() error path (Eric Dumazet)
  - smb: client: let recv_done() cleanup before notifying the callers. (Stefan Metzmacher)
  - smb: server: let recv_done() avoid touching data_transfer after cleanup/move (Stefan Metzmacher)
  - smb: server: let recv_done() consistently call put_recvmsg/smb_direct_disconnect_rdma_connection (Stefan Metzmacher)
  - smb: server: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already (Stefan Metzmacher)
  - smb: server: remove separate empty_recvmsg_queue (Stefan Metzmacher)
  - ALSA: hda/ca0132: Fix missing error handling in ca0132_alt_select_out() (Takashi Iwai)
  - net: drop UFO packets in udp_rcv_segment() (Wang Liang) [Orabug: 38351785] {CVE-2025-38622}
  - ipv6: reject malicious packets in ipv6_gso_segment() (Eric Dumazet) [Orabug: 38334987] {CVE-2025-38572}
  - net/mlx5: Correctly set gso_segs when LRO is used (Christoph Paasch)
  - pptp: ensure minimal skb length in pptp_xmit() (Eric Dumazet) [Orabug: 38335003] {CVE-2025-38574}
  - phy: mscc: Fix parsing of unicast frames (Horatiu Vultur)
  - netpoll: prevent hanging NAPI when netcons gets enabled (Jakub Kicinski)
  - NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY (Benjamin Coddington)
  - XArray: Add calls to might_alloc() (Matthew Wilcox)
  - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (Trond Myklebust) [Orabug: 38401744] {CVE-2025-39730}
  - pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Tigran Mkrtchyan)
  - PCI: pnv_php: Fix surprise plug detection and recovery (Timothy Pearson)
  - powerpc/eeh: Make EEH driver device hotplug safe (Timothy Pearson)
  - powerpc/eeh: Rely on dev->link_active_reporting (Maciej W. Rozycki)
  - powerpc/eeh: Export eeh_unfreeze_pe() (Timothy Pearson)
  - PCI: pnv_php: Work around switches with broken presence detection (Timothy Pearson)
  - PCI: pnv_php: Clean up allocated IRQs on unplug (Timothy Pearson)
  - kconfig: qconf: fix ConfigList::updateListAllforAll() (Masahiro Yamada)
  - scsi: ufs: core: Use link recovery when h8 exit fails during runtime resume (Seunghui Lee)
  - scsi: mpt3sas: Fix a fw_event memory leak (Tomas Henzl)
  - f2fs: fix to avoid out-of-boundary access in devs.path (Chao Yu)
  - f2fs: fix to avoid panic in f2fs_evict_inode (Chao Yu)
  - f2fs: fix to avoid UAF in f2fs_sync_inode_meta() (Chao Yu)
  - f2fs: doc: fix wrong quota mount option description (Chao Yu)
  - f2fs: fix KMSAN uninit-value in extent_info usage (Abinash Singh)
  - rtc: rv3028: fix incorrect maximum clock rate handling (Brian Masney)
  - rtc: pcf8563: fix incorrect maximum clock rate handling (Brian Masney)
  - rtc: pcf85063: fix incorrect maximum clock rate handling (Brian Masney)
  - rtc: hym8563: fix incorrect maximum clock rate handling (Brian Masney)
  - rtc: ds1307: fix incorrect maximum clock rate handling (Brian Masney)
  - ucount: fix atomic_long_inc_below() argument type (Uros Bizjak)
  - module: Restore the moduleparam prefix length check (Petr Pavlu)
  - apparmor: ensure WB_HISTORY_SIZE value is a power of 2 (Ryan Lee)
  - bpf: Check flow_dissector ctx accesses are aligned (Paul Chaignon)
  - mtd: rawnand: atmel: set pmecc data setup time (Balamanikandan Gunasundar)
  - mtd: rawnand: rockchip: Add missing check after DMA map (Thomas Fourier)
  - mtd: rawnand: atmel: Fix dma_mapping_error() address (Thomas Fourier)
  - jfs: fix metapage reference count leak in dbAllocCtl (Zheng Yu)
  - fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref (Chenyuan Yang)
  - crypto: qat - fix seq_file position update in adf_ring_next() (Giovanni Cabiddu)
  - sh: Do not use hyphen in exported variable name (Ben Hutchings)
  - dmaengine: nbpfaxi: Add missing check after DMA map (Thomas Fourier)
  - dmaengine: mv_xor: Fix missing check after DMA map and missing unmap (Thomas Fourier)
  - fs/orangefs: Allow 2 more characters in do_c_string() (Dan Carpenter)
  - PCI: endpoint: pci-epf-vntb: Fix the incorrect usage of __iomem attribute (Manivannan Sadhasivam)
  - soundwire: stream: restore params when prepare ports fail (Bard Liao)
  - crypto: img-hash - Fix dma_unmap_sg() nents value (Thomas Fourier)
  - crypto: keembay - Fix dma_unmap_sg() nents value (Thomas Fourier)
  - hwrng: mtk - handle devm_pm_runtime_enable errors (Ovidiu Panait)
  - watchdog: ziirave_wdt: check record length in ziirave_firm_verify() (Dan Carpenter)
  - scsi: isci: Fix dma_unmap_sg() nents value (Thomas Fourier)
  - scsi: mvsas: Fix dma_unmap_sg() nents value (Thomas Fourier)
  - scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value (Thomas Fourier)
  - clk: sunxi-ng: v3s: Fix de clock definition (Paul Kocialkowski)
  - perf tests bp_account: Fix leaked file descriptor (Leo Yan)
  - kernel: trace: preemptirq_delay_test: use offstack cpu mask (Arnd Bergmann)
  - RDMA/hns: Fix -Wframe-larger-than issue (Junxian Huang)
  - crypto: ccp - Fix crash when rebind ccp device for ccp.ko (Mengbiao Xiong)
  - crypto: inside-secure - Fix `dma_unmap_sg()` nents value (Thomas Fourier)
  - perf sched: Fix memory leaks for evsel->priv in timehist (Namhyung Kim)
  - clk: clk-axi-clkgen: fix fpfd_max frequency for zynq (Nuno Sa)
  - pinctrl: sunxi: Fix memory leak on krealloc failure (Yuan Chen)
  - PCI: endpoint: pci-epf-vntb: Return -ENOENT if pci_epc_get_next_free_bar() fails (Jerome Brunet)
  - power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set (Charles Han)
  - power: supply: cpcap-charger: Fix null check for power_supply_get_by_name (Charles Han)
  - clk: xilinx: vcu: unregister pll_post only if registered correctly (Rohit Visavalia)
  - media: v4l2-ctrls: Fix H264 SEPARATE_COLOUR_PLANE check (James Cowgill)
  - clk: davinci: Add NULL check in davinci_lpsc_clk_register() (Henry Martin)
  - mtd: fix possible integer overflow in erase_xfer() (Ivan Stepchenko)
  - crypto: marvell/cesa - Fix engine load inaccuracy (Herbert Xu)
  - PCI: rockchip-host: Fix "Unexpected Completion" log message (Hans Zhang)
  - vrf: Drop existing dst reference in vrf_ip6_input_dst (Stanislav Fomichev)
  - selftests: rtnetlink.sh: remove esp4_offload after test (Xiumei Mu)
  - netfilter: xt_nfacct: don't assume acct name is null-terminated (Florian Westphal) [Orabug: 38351853] {CVE-2025-38639}
  - can: kvaser_usb: Assign netdev.dev_port based on device channel index (Jimmy Assarsson)
  - can: kvaser_pciefd: Store device channel index (Jimmy Assarsson)
  - wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE (Gokul Sivakumar)
  - Reapply "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" (Remi Pommarel)
  - wifi: mac80211: Check 802.11 encaps offloading in ieee80211_tx_h_select_key() (Remi Pommarel)
  - wifi: mac80211: Don't call fq_flow_idx() for management frames (Alexander Wetzel)
  - mwl8k: Add missing check after DMA map (Thomas Fourier)
  - wifi: rtl8xxxu: Fix RX skb size for aggregation disabled (Martin Kaistra)
  - xen/gntdev: remove struct gntdev_copy_batch from stack (Juergen Gross)
  - net_sched: act_ctinfo: use atomic64_t for three counters (Eric Dumazet)
  - net/sched: Restrict conditions for adding duplicating netems to qdisc tree (William Liu) [Orabug: 38331465] {CVE-2025-38553}
  - um: rtc: Avoid shadowing err in uml_rtc_start() (Tiwei Bie)
  - arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX (Johan Korsnes)
  - drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value (Fedor Pchelkin)
  - m68k: Don't unregister boot console needlessly (Finn Thain)
  - net/mlx5: Check device memory pointer before usage (Stav Aviram) [Orabug: 38351877] {CVE-2025-38645}
  - tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range (Xin Guo)
  - wifi: ath11k: clear initialized flag for deinit-ed srng lists (Sergey Senozhatsky) [Orabug: 38335105] {CVE-2025-38601}
  - iwlwifi: Add missing check for alloc_ordered_workqueue (Jiasheng Jiang) [Orabug: 38335109] {CVE-2025-38602}
  - wifi: iwlwifi: Fix memory leak in iwl_mvm_init() (Xiu Jianfeng)
  - wifi: rtl818x: Kill URBs before clearing tx status queue (Daniil Dulov) [Orabug: 38335118] {CVE-2025-38604}
  - caif: reduce stack size, again (Arnd Bergmann)
  - bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure (Yuan Chen)
  - bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls (Jiayuan Chen) [Orabug: 38335130] {CVE-2025-38608}
  - bpf, sockmap: Fix psock incorrectly pointing to sk (Jiayuan Chen)
  - drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed (Andy Yan)
  - selftests/tracing: Fix false failure of subsystem event test (Steven Rostedt)
  - staging: nvec: Fix incorrect null termination of battery manufacturer (Alok Tiwari)
  - samples: mei: Fix building on musl libc (Brahmajit Das)
  - cpufreq: Init policy->rwsem before it may be possibly used (Lifeng Zheng)
  - cpufreq: Initialize cpufreq-based frequency-invariance later (Lifeng Zheng)
  - cpufreq: intel_pstate: Always use HWP_DESIRED_PERF in passive mode (Rafael J. Wysocki)
  - PM / devfreq: Check governor before using governor->name (Lifeng Zheng) [Orabug: 38335134] {CVE-2025-38609}
  - arm64: dts: imx8mn-beacon: Fix HS400 USDHC clock speed (Adam Ford)
  - arm64: dts: imx8mm-beacon: Fix HS400 USDHC clock speed (Adam Ford)
  - ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface (Annette Kobou)
  - arm: dts: ti: omap: Fixup pinheader typo (Albin Törnqvist)
  - usb: early: xhci-dbc: Fix early_ioremap leak (Lucas De Marchi)
  - Revert "vmci: Prevent the dispatching of uninitialized payloads" (Greg Kroah-Hartman)
  - pps: fix poll support (Denis Osterland-Heim)
  - vmci: Prevent the dispatching of uninitialized payloads (Lizhi Xu)
  - staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() (Abdun Nihaal)
  - usb: misc: apple-mfi-fastcharge: Make power supply names unique (Charalampos Mitrodimas)
  - ARM: dts: vfxxx: Correctly use two tuples for timer address (Krzysztof Kozlowski)
  - selftests: Fix errno checking in syscall_user_dispatch test (Dmitry Vyukov)
  - Revert "fs/ntfs3: Replace inode_trylock with inode_lock" (Konstantin Komarov)
  - hfsplus: remove mutex_lock check in hfsplus_free_extents (Yangtao Li)
  - fs_context: fix parameter name in infofc() macro (Rubenkelevra)
  - ASoC: Intel: fix SND_SOC_SOF dependencies (Arnd Bergmann)
  - ethernet: intel: fix building with large NR_CPUS (Arnd Bergmann)
  - usb: phy: mxs: disconnect line when USB charger is attached (Xu Yang)
  - usb: chipidea: add USB PHY event (Xu Yang)
  - ALSA: hda: Add missing NVIDIA HDA codec IDs (Daniel Dadap)
  - comedi: comedi_test: Fix possible deletion of uninitialized timers (Ian Abbott)
  - jfs: reject on-disk inodes of an unsupported type (Dmitry Antipov)
  - usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach (Rd Babiera)
  - usb: typec: tcpm: allow switching to mode accessory to mux properly (Michael Grzeschik)
  - usb: typec: tcpm: allow to use sink in accessory mode (Michael Grzeschik)
  - mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n (Harry Yoo)
  - nilfs2: reject invalid file types when reading inodes (Ryusuke Konishi)
  - gve: Fix stuck TX queue for DQ queue format (Praveen Kaligineedi)
  - e1000e: ignore uninitialized checksum word on tgp (Jacek Kowalski)
  - e1000e: disregard NVM checksum on tgp when valid checksum bit is not set (Jacek Kowalski)
  - dpaa2-switch: Fix device reference count leak in MAC endpoint handling (Ma Ke)
  - dpaa2-eth: Fix device reference count leak in MAC endpoint handling (Ma Ke)
  - ALSA: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx (Dawid Rezler)
  - bus: fsl-mc: Fix potential double device reference in fsl_mc_get_endpoint() (Ma Ke)
  - i2c: virtio: Avoid hang by using interruptible completion wait (Viresh Kumar)
  - i2c: qup: jump out of the loop in case of timeout (Yang Xiwen) [Orabug: 38351993] {CVE-2025-38671}
  - platform/x86: ideapad-laptop: Fix kbd backlight not remembered among boots (Rongrong)
  - net: hns3: fixed vf get max channels bug (Jian Shen)
  - net: hns3: disable interrupt when ptp init failed (Yonglong Liu)
  - net: hns3: fix concurrent setting vlan filter issue (Jian Shen)
  - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (Xiang Mei)
  - net: appletalk: Fix use-after-free in AARP proxy probe (Kito Xu)
  - i40e: report VF tx_dropped with tx_errors instead of tx_discards (Dennis Chen)
  - i40e: Add rx_missed_errors for buffer exhaustion (Yajun Deng)
  - regmap: fix potential memory leak of regmap_bus (Abdun Nihaal)
  - interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1 node (Xilin Wu)
  - RDMA/core: Rate limit GID cache warning messages (Maor Gottlieb)
  - regulator: core: fix NULL dereference on unbind due to stale coupling data (Alessandro Carminati) [Orabug: 38351977] {CVE-2025-38668}
  - Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT (Fabrice Gasnier) [Orabug: 38180692] {CVE-2025-38335}
  - platform/x86: think-lmi: Fix kobject cleanup (Kurt Borja)
  - powercap: intel_rapl: Do not change CLAMPING bit if ENABLE bit cannot be changed (Zhang Rui)
  - mm/vmalloc: leave lazy MMU mode on PTE mapping error (Alexander Gordeev)
  - ASoC: fsl_sai: Force a software reset when starting in consumer mode (Arun Raghavan)
  - usb: dwc3: qcom: Don't leave BCR asserted (Krishna Kurapati)
  - usb: musb: fix gadget state on disconnect (Drew Hamilton)
  - usb: musb: Add and use inline functions musb_{get,set}_state (Paul Cercueil)
  - usb: hub: Fix flushing of delayed work used for post resume purposes (Mathias Nyman)
  - usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm (Mathias Nyman)
  - usb: hub: fix detection of high tier USB3 devices behind suspended hubs (Mathias Nyman)
  - net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (William Liu) [Orabug: 38254213] {CVE-2025-38468}
  - net: bridge: Do not offload IGMP/MLD messages (Joseph Huang)
  - net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (Dong Chenchen) [Orabug: 38254224] {CVE-2025-38470}
  - Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU (Luiz Augusto von Dentz)
  - ipv6: mcast: Delay put pmc->idev in mld_del_delrec() (Yue Haibing) [Orabug: 38324326] {CVE-2025-38550}
  - net/mlx5: Correctly set gso_size when LRO is used (Christoph Paasch)
  - Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout (Luiz Augusto von Dentz)
  - Bluetooth: SMP: If an unallowed command is received consider it a failure (Luiz Augusto von Dentz)
  - Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() (Kuniyuki Iwashima) [Orabug: 38254240] {CVE-2025-38473}
  - usb: net: sierra: check for no status endpoint (Oliver Neukum) [Orabug: 38254248] {CVE-2025-38474}
  - hwmon: (corsair-cpro) Validate the size of the received input buffer (Marius Zachmann)
  - selftests: net: increase inter-packet timeout in udpgro.sh (Paolo Abeni)
  - selftests: udpgro: report error when receive failed (Hangbin Liu)
  - nvme: fix misaccounting of nvme-mpath inflight I/O (Yu Kuai)
  - smb: client: fix use-after-free in cifs_oplock_break (Wang Zhaolong)
  - pinctrl: mediatek: moore: check if pin_desc is valid before use (Sam Shih)
  - rpl: Fix use-after-free in rpl_do_srh_inline(). (Kuniyuki Iwashima)
  - net/sched: sch_qfq: Fix race condition on qfq_aggregate (Xiang Mei) [Orabug: 38254265] {CVE-2025-38477}
  - net: emaclite: Fix missing pointer increment in aligned_read() (Alok Tiwari)
  - bpf: Reject %p% format string in bprintf-like helpers (Paul Chaignon) [Orabug: 38324226] {CVE-2025-38528}
  - comedi: Fix initialization of data for instructions that write to subdevice (Ian Abbott)
  - comedi: Fix use of uninitialized data in insn_rw_emulate_bits() (Ian Abbott)
  - comedi: Fix some signed shift left operations (Ian Abbott)
  - comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large (Ian Abbott)
  - comedi: das6402: Fix bit shift out of bounds (Ian Abbott)
  - comedi: das16m1: Fix bit shift out of bounds (Ian Abbott)
  - comedi: aio_iiro_16: Fix bit shift out of bounds (Ian Abbott)
  - comedi: pcl812: Fix bit shift out of bounds (Ian Abbott)
  - iio: adc: stm32-adc: Fix race in installing chained IRQ handler (Chen Ni)
  - iio: adc: max1363: Reorder mode_list[] entries (Fabio Estevam)
  - iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] (Fabio Estevam)
  - soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled (Andrew Jeffery)
  - soc: aspeed: lpc-snoop: Cleanup resources in stack-order (Andrew Jeffery)
  - pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov (Maulik Shah)
  - mmc: sdhci_am654: Workaround for Errata i2312 (Judith Mendez)
  - mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models (Edson Juliano Drosdeck)
  - mmc: bcm2835: Fix dma_unmap_sg() nents value (Thomas Fourier)
  - memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() (Nathan Chancellor)
  - isofs: Verify inode mode when loading from disk (Jan Kara)
  - dmaengine: nbpfaxi: Fix memory corruption in probe() (Dan Carpenter)
  - af_packet: fix soft lockup issue caused by tpacket_snd() (Yun Lu)
  - af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() (Yun Lu)
  - phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() (Nathan Chancellor)
  - tracing: Add down_write(trace_event_sem) when adding trace event (Steven Rostedt) [Orabug: 38324269] {CVE-2025-38539}
  - HID: core: ensure __hid_request reserves the report ID as the first byte (Benjamin Tissoires)
  - pch_uart: Fix dma_sync_sg_for_device() nents value (Thomas Fourier)
  - thunderbolt: Fix bit masking in tb_dp_port_set_hops() (Alok Tiwari)
  - i2c: stm32: fix the device used for the DMA map (Clément Le Goffic)
  - usb: gadget: configfs: Fix OOB read on empty string write (Xinyu Liu) [Orabug: 38254357] {CVE-2025-38497}
  - USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI (Ryan Mann)
  - USB: serial: option: add Foxconn T99W640 (Slark Xiao)
  - USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition (Fabio Porcedda)
  - phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode (Wayne Chang) [Orabug: 38324257] {CVE-2025-38535}


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-314.193.4.el9uek]
changelog:
  - af_unix: Don't leave consecutive consumed OOB skbs. (Kuniyuki Iwashima) [Orabug: 38528187] {CVE-2025-38236}
  - Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set" (Tariq Toukan)
  - NFSv4: Don't clear capabilities that won't be reset (Trond Myklebust)
  - soc: qcom: mdt_loader: Deal with zero e_shentsize (Bjorn Andersson)
  - cpufreq: Initialize cpufreq-based invariance before subsys (Christian Loehle)
  - tracing: Do not add length to print format in synthetic events (Steven Rostedt)
  - flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Tigran Mkrtchyan)
  - drm/amdgpu: fix a memory leak in fence cleanup when unloading (Alex Deucher)
  - rtnetlink: Fix L3 stats disable handling in rtnl_offload_xstats_fill() (Vijayendra Suman) [Orabug: 38511910]
  - Revert "md/raid10: fix missing discard IO accounting" (Richard Li) [Orabug: 38483693]
  - uek: kabi: Update check-kabi to support namespace checks (Saeed Mirzamohammadi) [Orabug: 38459104]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-314.193.5.el9uek]
changelog:
  - Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" (Jakub Kicinski) [Orabug: 38545203]
  - uek-rpm/config-aarch64: Enable configs for Grace platform support (Vijay Kumar) [Orabug: 38526393]
  - uek-rpm: mips: Enable CONFIG_TRANSPARENT_HUGEPAGE (Henry Willard) [Orabug: 38526762]
  - crypto: ccp - Add support for PCI device 0x17D8 (John Allen) [Orabug: 38332429]
  - x86/CPU/AMD: Add X86_FEATURE_ZEN6 (Yazen Ghannam) [Orabug: 38332429]
  - x86/cpufeatures: Free up unused feature bits (Sohil Mehta) [Orabug: 38332429]
  - x86/CPU/AMD: Rename init_amd_zn() to init_amd_zen_common() (Borislav Petkov) [Orabug: 38332429]
  - x86/CPU/AMD: Call the spectral chicken in the Zen2 init function (Borislav Petkov) [Orabug: 38332429]
  - x86/CPU/AMD: Move erratum 1076 fix into the Zen1 init function (Borislav Petkov) [Orabug: 38332429]
  - x86/CPU/AMD: Move the Zen3 BTC_NO detection to the Zen3 init function (Borislav Petkov) [Orabug: 38332429]
  - x86/CPU/AMD: Carve out the erratum 1386 fix (Borislav Petkov) [Orabug: 38332429]
  - x86/CPU/AMD: Add X86_FEATURE_ZEN5 (Borislav Petkov) [Orabug: 38332429]
  - rds: Free all frags when rds_ib_recv_cache_put() fails (Hans Westgaard Ry) [Orabug: 38492233]
  - cpufreq: CPPC: Fix unused-function warning (Pierre Gondois) [Orabug: 38471683]
  - PM: EM: Add .get_cost() callback (Lukasz Luba) [Orabug: 38471683]
  - PM: EM: add macro to set .active_power() callback conditionally (Lukasz Luba) [Orabug: 38471683]
  - cpufreq: Introduce an optional cpuinfo_avg_freq sysfs entry (Beata Michalska) [Orabug: 38471683]
  - cpufreq: update to sysfs_emit() for safer buffer handling (Perry Yuan) [Orabug: 38471683]
  - cpufreq: Optimize cpufreq_show_cpus() (Viresh Kumar) [Orabug: 38471683]
  - PCI: Use downstream bridges for distributing resources (Kai-Heng Feng) [Orabug: 38471683]
  - PCI: Distribute available resources for root buses, too (Mika Westerberg) [Orabug: 38471683]
  - PCI: Move pci_assign_unassigned_root_bus_resources() (Mika Westerberg) [Orabug: 38471683]
  - cppc_cpufreq: Remove HiSilicon CPPC workaround (Jie Zhan) [Orabug: 38471683]
  - cpufreq: remove useless INIT_LIST_HEAD() (Han Wang) [Orabug: 38471683]
  - cpufreq/cppc: Don't compare desired_perf in target() (Riwen Lu) [Orabug: 38471683]
  - cpufreq/cppc: Move and rename cppc_cpufreq_{perf_to_khz|khz_to_perf}() (Vincent Guittot) [Orabug: 38471683]
  - cpufreq: CPPC: Register EM based on efficiency class information (Pierre Gondois) [Orabug: 38471683]
  - cpufreq: CPPC: Enable fast_switch (Pierre Gondois) [Orabug: 38471683]
  - i2c: tegra: check msg length in SMBUS block read (Akhil R) [Orabug: 38254038,38471683] {CVE-2025-38425}
  - PCI/ACS: Fix 'pci=config_acs=' parameter (Tushar Dave) [Orabug: 38471683]
  - RDMA/mlx5: Add support to multi-plane device and port (Mark Zhang) [Orabug: 38471683]
  - net/mlx5: mlx5_ifc update for multi-plane support (Mark Zhang) [Orabug: 38471683]
  - RDMA/core: Create "issm*" device nodes only when SMI is supported (Mark Zhang) [Orabug: 38471683]
  - RDMA/mlx5: Limit usage of over-sized mkeys from the MR cache (Michael Guralnik) [Orabug: 38471683]
  - RDMA/mlx5: Fix counter update on MR cache mkey creation (Michael Guralnik) [Orabug: 38471683]
  - RDMA/mlx5: Enable ATS when allocating kernel MRs (Maher Sanalla) [Orabug: 38471683]
  - ACPI: PRM: Remove unnecessary strict handler address checks (Aubrey Li) [Orabug: 38471683]
  - ACPI/HMAT: Move HMAT messages to pr_debug() (Dan Williams) [Orabug: 38471683]
  - ACPI: HMAT: Drop unused dev_fmt() and redundant 'HMAT' prefix (Liu Shixin) [Orabug: 38471683]
  - perf: arm_cspmu: nvidia: monitor all ports by default (Besar Wicaksono) [Orabug: 38471683]
  - perf: arm_cspmu: nvidia: enable NVLINK-C2C port filtering (Besar Wicaksono) [Orabug: 38471683]
  - perf: arm_cspmu: nvidia: fix sysfs path in the kernel doc (Besar Wicaksono) [Orabug: 38471683]
  - perf: arm_cspmu: nvidia: remove unsupported SCF events (Besar Wicaksono) [Orabug: 38471683]
  - device-dax: correct pgoff align in dax_set_mapping() (Kun(Llfl)) [Orabug: 37206403] {CVE-2024-50022}
  - vfio/mlx5: Fix an unwind issue in mlx5vf_add_migration_pages() (Yishai Hadas) [Orabug: 37434467] {CVE-2024-56742}
  - sched/fair: add opt-in knob to use runnable_avg in wakeup fast path (Daniel Jordan) [Orabug: 38404517]
  - RDMA/mlx5: Fix vport loopback forcing for MPV device (Patrisious Haddad) [Orabug: 38225626]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-314.193.5.1.el9uek]
changelog:
  - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (Eric Biggers)  [Orabug: 38575804]
  - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (Herbert Xu)  [Orabug: 38575804]  {CVE-2025-39964}


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-314.193.5.2.el9uek]
changelog:
  - i40e: add validation for ring_len param (Lukasz Czapnik)  [Orabug: 38607608]  {CVE-2025-39973}
  - i40e: increase max descriptors for XL710 (Justin Bronder)  [Orabug: 38607608]
  - uek-rpm: Enable CONFIG_COMPAT_32BIT_TIME for x86 container kernel (Boris Ostrovsky)  [Orabug: 38607625]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-314.193.5.3.el9uek]
changelog:
  - Revert "cpufreq: Introduce an optional cpuinfo_avg_freq sysfs entry" (Samasth Norway Ananda)  [Orabug: 38633525]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-314.193.5.4.el9uek]
changelog:
  - KVM: arm64: Fix softirq masking in FPSIMD register saving sequence (Will Deacon)  [Orabug: 38513233]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-314.193.5.5.el9uek]
changelog:
  - crypto: essiv - Check ssize for decryption and in-place encryption (Herbert Xu)  [Orabug: 38705933]  {CVE-2025-40019}


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-0.20.20.1.el9uek]
changelog:
  - rds: ib: Fix NULL ptr deref in rds_ib_cq_follow_affinity (Håkon Bugge)  [Orabug: 37702023]
  - scsi: mpi3mr: Task Abort EH Support (Chandrakanth Patil)  [Orabug: 37778472]
  - scsi: mpi3mr: Update driver version to 8.13.0.5.50 (Ranjan Kumar)  [Orabug: 37778472]
  - scsi: mpi3mr: Check admin reply queue from Watchdog (Ranjan Kumar)  [Orabug: 37778472]
  - scsi: mpi3mr: Update timestamp only for supervisor IOCs (Ranjan Kumar)  [Orabug: 37778472]
  - scsi: mpi3mr: Update MPI Headers to revision 35 (Ranjan Kumar)  [Orabug: 37778472]
  - scsi: mpi3mr: Fix locking in an error path (Bart Van Assche)  [Orabug: 37778472]
  - scsi: mpi3mr: Fix spelling mistake "skiping" -> "skipping" (Colin Ian King)  [Orabug: 37778472]
  - scsi: mpi3mr: Update driver version to 8.12.1.0.50 (Ranjan Kumar)  [Orabug: 37778472]
  - scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue (Ranjan Kumar)  [Orabug: 37778472]
  - scsi: mpi3mr: Support for Segmented Hardware Trace buffer (Ranjan Kumar)  [Orabug: 37778472]
  - scsi: mpi3mr: Avoid reply queue full condition (Ranjan Kumar)  [Orabug: 37778472]
  - scsi: mpi3mr: Update driver version to 8.12.0.3.50 (Ranjan Kumar)  [Orabug: 37778472]
  - uek-rpm: Enable Intel In Field Scan as a module in UEK8 (Harshit Mogalapalli)  [Orabug: 37778856]


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-1.23.1.el9uek]
changelog:
  - LTS version: v6.12.23 (Jack Vogel)
  - platform/x86/amd/pmf: fix cleanup in amd_pmf_init_smart_pc() (Dan Carpenter)
  - tracing: Do not use PERF enums when perf is not defined (Steven Rostedt)
  - ARM: 9443/1: Require linker to support KEEP within OVERLAY for DCE (Nathan Chancellor)
  - NFSD: Skip sending CB_RECALL_ANY when the backchannel isn't up (Chuck Lever)
  - NFSD: Never return NFS4ERR_FILE_OPEN when removing a directory (Chuck Lever)
  - NFSD: nfsd_unlink() clobbers non-zero status returned from fh_fill_pre_attrs() (Chuck Lever)
  - nfsd: fix management of listener transports (Olga Kornievskaia)
  - nfsd: put dl_stid if fail to queue dl_recall (Li Lingfeng)
  - nfsd: allow SC_STATUS_FREEABLE when searching via nfs4_lookup_stateid() (Jeff Layton)
  - media: streamzap: fix race between device disconnection and urb callback (Murad Masimov)
  - media: vimc: skip .s_stream() for stopped entities (Nikita Zhandarovich)
  - exec: fix the racy usage of fs_struct->in_exec (Oleg Nesterov)
  - mm: zswap: fix crypto_free_acomp() deadlock in zswap_cpu_comp_dead() (Yosry Ahmed)
  - jfs: add index corruption check to DT_GETPAGE() (Roman Smirnov)
  - jfs: fix slab-out-of-bounds read in ea_get() (Qasim Ijaz)
  - ext4: fix OOB read when checking dotdot dir (Acs, Jakub)
  - ext4: don't over-report free space or inodes in statvfs (Theodore Ts'o)
  - wifi: mt76: mt7921: fix kernel panic due to null pointer dereference (Ming Yen Hsieh)
  - arm64: Don't call NULL in do_compat_alignment_fixup() (Angelos Oikonomopoulos)
  - mm/gup: reject FOLL_SPLIT_PMD with hugetlb VMAs (David Hildenbrand)
  - tracing/osnoise: Fix possible recursive locking for cpus_read_lock() (Ran Xiaokai)
  - tracing: Fix synth event printk format for str fields (Douglas Raillard)
  - tracing: Ensure module defining synth event cannot be unloaded while tracing (Douglas Raillard)
  - tracing: Fix use-after-free in print_graph_function_flags during tracer switching (Tengda Wu)
  - exfat: fix potential wrong error return from get_block (Sungjong Seo)
  - exfat: fix random stack corruption after get_block (Sungjong Seo)
  - ksmbd: fix null pointer dereference in alloc_preauth_hash() (Namjae Jeon)
  - ksmbd: validate zero num_subauth before sub_auth is accessed (Norbert Szetei)
  - ksmbd: fix overflow in dacloffset bounds check (Norbert Szetei)
  - ksmbd: fix session use-after-free in multichannel connection (Namjae Jeon)
  - ksmbd: fix use-after-free in ksmbd_sessions_deregister() (Namjae Jeon)
  - ksmbd: add bounds check for create lease context (Norbert Szetei)
  - ksmbd: add bounds check for durable handle context (Namjae Jeon)
  - KVM: SVM: Don't change target vCPU state on AP Creation VMGEXIT error (Sean Christopherson)
  - mmc: sdhci-omap: Disable MMC_CAP_AGGRESSIVE_PM for eMMC/SD (Ulf Hansson)
  - mmc: sdhci-pxav3: set NEED_RSP_BUSY capability (Karel Balej)
  - mmc: omap: Fix memory leak in mmc_omap_new_slot (Miaoqian Lin)
  - Remove unnecessary firmware version check for gc v9_4_2 (Candice Li)
  - media: omap3isp: Handle ARM dma_iommu_mapping (Robin Murphy)
  - ARM: 9444/1: add KEEP() keyword to ARM_VECTORS (Christian Eggers)
  - ACPI: resource: Skip IRQ override on ASUS Vivobook 14 X1404VAP (Paul Menzel)
  - acpi: nfit: fix narrowing conversion in acpi_nfit_ctl (Murad Masimov)
  - wifi: mt76: mt7925: remove unused acpi function for clc (Ming Yen Hsieh)
  - x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (Jann Horn)
  - x86/tsc: Always save/restore TSC sched_clock() on suspend/resume (Guilherme G. Piccoli)
  - x86/Kconfig: Add cmpxchg8b support back to Geode CPUs (Arnd Bergmann)
  - uprobes/x86: Harden uretprobe syscall trampoline check (Jiri Olsa)
  - perf/x86/intel: Avoid disable PMU if !cpuc->enabled in sample read (Kan Liang)
  - perf/x86/intel: Apply static call for drain_pebs (Peter Zijlstra (Intel))
  - ntb_perf: Delete duplicate dmaengine_unmap_put() call in perf_copy_chunk() (Markus Elfring)
  - platform/x86: ISST: Correct command storage data length (Srinivas Pandruvada)
  - platform/x86: thinkpad_acpi: disable ACPI fan access for T495* and E560 (Eduard Christian Dumitrescu)
  - ACPI: x86: Extend Lenovo Yoga Tab 3 quirk with skip GPIO event-handlers (Hans de Goede)
  - x86/tdx: Fix arch_safe_halt() execution for TDX VMs (Vishal Annapurve)
  - x86/mce: use is_copy_from_user() to determine copy-from-user context (Shuai Xue)
  - x86/microcode/AMD: Fix __apply_microcode_amd()'s return value (Boris Ostrovsky)
  - KVM: x86: block KVM_CAP_SYNC_REGS if guest state is protected (Paolo Bonzini)
  - x86/hyperv: Fix check of return value from snp_set_vmsa() (Tianyu Lan)
  - LoongArch: BPF: Use move_addr() for BPF_PSEUDO_FUNC (Hengqi Chen)
  - LoongArch: BPF: Don't override subprog's return value (Hengqi Chen)
  - LoongArch: BPF: Fix off-by-one error in build_prologue() (Hengqi Chen)
  - LoongArch: Increase MAX_IO_PICS up to 8 (Huacai Chen)
  - LoongArch: Increase ARCH_DMA_MINALIGN up to 16 (Huacai Chen)
  - rust: Fix enabling Rust and building with GCC for LoongArch (WANG Rui)
  - usbnet:fix NPE during rx_complete (Ying Lu)
  - wifi: mac80211: Fix sparse warning for monitor_sdata (Alexander Wetzel)
  - tty: serial: lpuart: only disable CTS instead of overwriting the whole UARTMODIR register (Sherry Sun)
  - tty: serial: fsl_lpuart: Fix unused variable 'sport' build warning (Sherry Sun)
  - tty: serial: fsl_lpuart: use port struct directly to simply code (Sherry Sun)
  - tty: serial: fsl_lpuart: Use u32 and u8 for register variables (Sherry Sun)
  - cgroup/rstat: Fix forceidle time in cpu.stat (Abel Wu)
  - cgroup/rstat: Tracking cgroup-level niced CPU time (Joshua Hahn)
  - tracing: Correct the refcount if the hist/hist_debug file fails to open (Tengda Wu)
  - tracing/hist: Support POLLPRI event for poll on histogram (Masami Hiramatsu (Google))
  - tracing/hist: Add poll(POLLIN) support on hist file (Masami Hiramatsu (Google))
  - tracing: Switch trace_events_hist.c code over to use guard() (Steven Rostedt)
  - tools/power turbostat: report CoreThr per measurement interval (Len Brown)
  - perf/core: Fix child_total_time_enabled accounting bug at task exit (Yeoreum Yun)
  - drm/amdgpu/gfx12: fix num_mec (Alex Deucher)
  - drm/amdgpu/gfx11: fix num_mec (Alex Deucher)
  - kbuild: deb-pkg: don't set KBUILD_BUILD_VERSION unconditionally (Alexandru Gagniuc)
  - net: ibmveth: make veth_pool_store stop hanging (Dave Marquardt)
  - arcnet: Add NULL check in com20020pci_probe() (Henry Martin)
  - ipv6: Do not consider link down nexthops in path selection (Ido Schimmel)
  - ipv6: Start path selection from the first nexthop (Ido Schimmel)
  - net: fix geneve_opt length integer overflow (Lin Ma)
  - net: dsa: mv88e6xxx: propperly shutdown PPU re-enable timer on destroy (David Oberhollenzer)
  - ipv6: fix omitted netlink attributes when using RTEXT_FILTER_SKIP_STATS (Fernando Fernandez Mancera)
  - netfilter: nft_tunnel: fix geneve_opt type confusion addition (Lin Ma)
  - net: decrease cached dst counters in dst_release (Antoine Tenart)
  - tunnels: Accept PACKET_HOST in skb_tunnel_check_pmtu(). (Guillaume Nault)
  - vsock: avoid timeout during connect() if the socket is closing (Stefano Garzarella)
  - udp: Fix memory accounting leak. (Kuniyuki Iwashima)
  - udp: Fix multiple wraparounds of sk->sk_rmem_alloc. (Kuniyuki Iwashima)
  - net: mvpp2: Prevent parser TCAM memory corruption (Tobias Waldekranz)
  - sctp: add mutual exclusion in proc_sctp_do_udp_port() (Eric Dumazet)
  - net_sched: skbprio: Remove overly strict queue assertions (Cong Wang)
  - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (Debin Zhu)
  - netfilter: nf_tables: don't unregister hook when table is dormant (Florian Westphal)
  - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Pablo Neira Ayuso)
  - idpf: fix adapter NULL pointer dereference on reboot (Emil Tantilov)
  - e1000e: change k1 configuration on MTP and later platforms (Vitaly Lifshits)
  - spi: bcm2835: Restore native CS probing when pinctrl-bcm2835 is absent (Florian Fainelli)
  - ALSA: hda/realtek: Fix built-in mic on another ASUS VivoBook model (Takashi Iwai)
  - spi: bcm2835: Do not call gpiod_put() on invalid descriptor (Florian Fainelli)
  - ASoC: imx-card: Add NULL check in imx_card_probe() (Henry Martin)
  - nvme/ioctl: don't warn on vectorized uring_cmd with fixed buffer (Caleb Sander Mateos)
  - riscv/purgatory: 4B align purgatory_start (Björn Töpel)
  - riscv/kexec_file: Handle R_RISCV_64 in purgatory relocator (Yao Zi)
  - riscv: Fix hugetlb retrieval of number of ptes in case of !present pte (Alexandre Ghiti)
  - spi: cadence: Fix out-of-bounds array access in cdns_mrvl_xspi_setup_clock() (Josh Poimboeuf)
  - ASoC: codecs: rt5665: Fix some error handling paths in rt5665_probe() (Christophe JAILLET)
  - s390/entry: Fix setting _CIF_MCCK_GUEST with lowcore relocation (Sven Schnelle)
  - ublk: make sure ubq->canceling is set when queue is frozen (Ming Lei)
  - x86/uaccess: Improve performance by aligning writes to 8 bytes in copy_user_generic(), on non-FSRM/ERMS CPUs (Herton R. Krzesinski)
  - RISC-V: errata: Use medany for relocatable builds (Palmer Dabbelt)
  - ALSA: hda/realtek: Fix built-in mic breakage on ASUS VivoBook X515JA (Takashi Iwai)
  - firmware: cs_dsp: Ensure cs_dsp_load[_coeff]() returns 0 on success (Richard Fitzgerald)
  - ntb: intel: Fix using link status DB's (Nikita Shubin)
  - ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans (Yajun Deng)
  - riscv: ftrace: Add parentheses in macro definitions of make_call_t0 and make_call_ra (Juhan Jin)
  - fs/9p: fix NULL pointer dereference on mkdir (Christian Schoenebeck)
  - spufs: fix a leak in spufs_create_context() (Al Viro)
  - spufs: fix gang directory lifetimes (Al Viro)
  - spufs: fix a leak on spufs_new_file() failure (Al Viro)
  - netfs: Fix netfs_unbuffered_read() to return ssize_t rather than int (David Howells)
  - hwmon: (nct6775-core) Fix out of bounds access for NCT679{8,9} (Tasos Sahanidis)
  - memory: omap-gpmc: drop no compatible check (Roger Quadros)
  - can: statistics: use atomic access in hot path (Oliver Hartkopp)
  - ALSA: hda/realtek: Add mute LED quirk for HP Pavilion x360 14-dy1xxx (Navon John Lukose)
  - selftests: netfilter: skip br_netfilter queue tests if kernel is tainted (Florian Westphal)
  - net: devmem: do not WARN conditionally after netdev_rx_queue_restart() (Taehee Yoo)
  - drm/amd: Keep display off while going into S4 (Mario Limonciello)
  - nvme-pci: fix stuck reset on concurrent DPC and HP (Keith Busch)
  - x86/sgx: Warn explicitly if X86_FEATURE_SGX_LC is not enabled (Vladis Dronov)
  - x86/hyperv: Fix output argument to hypercall that changes page visibility (Michael Kelley)
  - locking/semaphore: Use wake_q to wake up processes outside lock critical section (Waiman Long)
  - wifi: mac80211: fix SA Query processing in MLO (Johannes Berg)
  - wifi: mac80211: flush the station before moving it to UN-AUTHORIZED state (Emmanuel Grumbach)
  - ASoC: rt1320: set wake_capable = 0 explicitly (Bard Liao)
  - ASoC: codecs: wsa884x: report temps to hwmon in millidegree of Celsius (Alexey Klimov)
  - x86/hyperv/vtl: Stop kernel from probing VTL0 low memory (Naman Jain)
  - sched/deadline: Use online cpus for validating runtime (Shrikanth Hegde)
  - ALSA: hda/realtek: Add support for ASUS Zenbook UM3406KA Laptops using CS35L41 HDA (Stefan Binding)
  - ALSA: hda/realtek: Add support for ASUS B5405 and B5605 Laptops using CS35L41 HDA (Stefan Binding)
  - ALSA: hda/realtek: Add support for ASUS B3405 and B3605 Laptops using CS35L41 HDA (Stefan Binding)
  - ALSA: hda/realtek: Add support for various ASUS Laptops using CS35L41 HDA (Stefan Binding)
  - ALSA: hda/realtek: Add support for ASUS ROG Strix G614 Laptops using CS35L41 HDA (Stefan Binding)
  - ALSA: hda/realtek: Add support for ASUS ROG Strix GA603 Laptops using CS35L41 HDA (Stefan Binding)
  - ALSA: hda/realtek: Add support for ASUS ROG Strix G814 Laptop using CS35L41 HDA (Stefan Binding)
  - exfat: add a check for invalid data size (Yuezhang Mo)
  - platform/x86/amd/pmf: Update PMF Driver for Compatibility with new PMF-TA (Shyam Sundar S K)
  - platform/x86/amd/pmf: Propagate PMF-TA return codes (Shyam Sundar S K)
  - HID: i2c-hid: improve i2c_hid_get_report error message (Wentao Guan)
  - net: dsa: rtl8366rb: don't prompt users for LED control (Jakub Kicinski)
  - platform/x86/intel/vsec: Add Diamond Rapids support (David E. Box)
  - platform/x86: intel-hid: fix volume buttons on Microsoft Surface Go 4 tablet (Dmitry Panchenko)
  - cifs: fix incorrect validation for num_aces field of smb_acl (Namjae Jeon)
  - smb: common: change the data type of num_aces to le16 (Namjae Jeon)
  - perf/core: Fix perf_pmu_register() vs. perf_init_event() (Peter Zijlstra)
  - ALSA: hda: Fix speakers on ASUS EXPERTBOOK P5405CSA 1.0 (Daniel Bárta)
  - ALSA: hda/realtek: Fix Asus Z13 2025 audio (Antheas Kapenekakis)
  - affs: don't write overlarge OFS data block size fields (Simon Tatham)
  - affs: generate OFS sequence numbers starting at 1 (Simon Tatham)
  - wifi: brcmfmac: keep power during suspend if board requires it (Matthias Proske)
  - nvme-pci: skip CMB blocks incompatible with PCI P2P DMA (Icenowy Zheng)
  - nvme-pci: clean up CMBMSC when registering CMB fails (Icenowy Zheng)
  - nvme-tcp: fix possible UAF in nvme_tcp_poll (Sagi Grimberg)
  - wifi: iwlwifi: mvm: use the right version of the rate API (Emmanuel Grumbach)
  - wifi: iwlwifi: fw: allocate chained SG tables for dump (Johannes Berg)
  - wifi: mac80211: remove debugfs dir for virtual monitor (Alexander Wetzel)
  - wifi: mac80211: Cleanup sta TXQs on flush (Alexander Wetzel)
  - nfs: Add missing release on error in nfs_lock_and_join_requests() (Dan Carpenter)
  - objtool/loongarch: Add unwind hints in prepare_frametrace() (Josh Poimboeuf)
  - rcu-tasks: Always inline rcu_irq_work_resched() (Josh Poimboeuf)
  - context_tracking: Always inline ct_{nmi,irq}_{enter,exit}() (Josh Poimboeuf)
  - sched/smt: Always inline sched_smt_active() (Josh Poimboeuf)
  - objtool: Fix verbose disassembly if CROSS_COMPILE isn't set (David Laight)
  - octeontx2-af: Free NIX_AF_INT_VEC_GEN irq (Geetha sowjanya)
  - octeontx2-af: Fix mbox INTR handler when num VFs > 64 (Geetha sowjanya)
  - net: phy: broadcom: Correct BCM5221 PHY model detection (Jim Liu)
  - ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (Giovanni Gherdovich)
  - LoongArch: Rework the arch_kgdb_breakpoint() implementation (Yuli Wang)
  - LoongArch: Fix device node refcount leak in fdt_cpu_clk_init() (Miaoqian Lin)
  - LoongArch: Fix help text of CMDLINE_EXTEND in Kconfig (谢致邦 (XIE Zhibang))
  - objtool: Fix segfault in ignore_unreachable_insn() (Josh Poimboeuf)
  - ring-buffer: Fix bytes_dropped calculation issue (Feng Yang)
  - net/mlx5e: SHAMPO, Make reserved size independent of page size (Lama Kayal)
  - ksmbd: fix r_count dec/increment mismatch (Namjae Jeon)
  - ksmbd: fix multichannel connection failure (Namjae Jeon)
  - ksmbd: use aead_request_free to match aead_request_alloc (Miaoqian Lin)
  - rndis_host: Flag RNDIS modems as WWAN devices (Lubomir Rintel)
  - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Mark Zhang)
  - exfat: fix missing shutdown check (Yuezhang Mo)
  - exfat: fix the infinite loop in exfat_find_last_cluster() (Yuezhang Mo)
  - smb: client: Fix netns refcount imbalance causing leaks and use-after-free (Wang Zhaolong)
  - NFS: Shut down the nfs_client only after all the superblocks (Trond Myklebust)
  - objtool, media: dib8000: Prevent divide-by-zero in dib8000_set_dds() (Josh Poimboeuf)
  - objtool, nvmet: Fix out-of-bounds stack access in nvmet_ctrl_state_show() (Josh Poimboeuf)
  - thermal: core: Remove duplicate struct declaration (xueqin Luo)
  - perf bpf-filter: Fix a parsing error with comma (Namhyung Kim)
  - perf tools: annotate asm_pure_loop.S (Marcus Meissner)
  - fs/procfs: fix the comment above proc_pid_wchan() (Bart Van Assche)
  - perf vendor events arm64 AmpereOneX: Fix frontend_bound calculation (Ilkka Koskinen)
  - tty: n_tty: use uint for space returned by tty_write_room() (Jiri Slaby (SUSE))
  - staging: vchiq_arm: Fix possible NPR of keep-alive thread (Stefan Wahren)
  - staging: vchiq_arm: Register debugfs after cdev (Stefan Wahren)
  - staging: rtl8723bs: select CONFIG_CRYPTO_LIB_AES (谢致邦 (XIE Zhibang))
  - perf: intel-tpebs: Fix incorrect usage of zfree() (James Clark)
  - perf python: Check if there is space to copy all the event (Arnaldo Carvalho de Melo)
  - perf python: Don't keep a raw_data pointer to consumed ring buffer space (Arnaldo Carvalho de Melo)
  - perf python: Decrement the refcount of just created event on failure (Arnaldo Carvalho de Melo)
  - perf python: Fixup description of sample.id event member (Arnaldo Carvalho de Melo)
  - i3c: master: svc: Fix missing the IBI rules (Stanley Chu)
  - um: hostfs: avoid issues on inode number reuse by host (Benjamin Berg)
  - um: remove copy_from_kernel_nofault_allowed (Benjamin Berg)
  - um: Pass the correct Rust target and options with gcc (David Gow)
  - selftests/mm/cow: fix the incorrect error handling (Cyan Yang)
  - fuse: fix dax truncate/punch_hole fault path (Alistair Popple)
  - NFS: fix open_owner_id_maxsz and related fields. (NeilBrown)
  - NFSv4: Avoid unnecessary scans of filesystems for delayed delegations (Trond Myklebust)
  - NFSv4: Avoid unnecessary scans of filesystems for expired delegations (Trond Myklebust)
  - NFSv4: Avoid unnecessary scans of filesystems for returning delegations (Trond Myklebust)
  - NFSv4: Don't trigger uneccessary scans for return-on-close delegations (Trond Myklebust)
  - arch/powerpc: drop GENERIC_PTDUMP from mpc885_ads_defconfig (Anshuman Khandual)
  - ocfs2: validate l_tree_depth to avoid out-of-bounds access (Vasiliy Kovalev)
  - kexec: initialize ELF lowest address to ULONG_MAX (Sourabh Jain)
  - kernel/events/uprobes: handle device-exclusive entries correctly in __replace_page() (David Hildenbrand)
  - perf units: Fix insufficient array space (Arnaldo Carvalho de Melo)
  - perf evlist: Add success path to evlist__create_syswide_maps (Ian Rogers)
  - perf debug: Avoid stack overflow in recursive error message (Ian Rogers)
  - iio: light: Add check for array bounds in veml6075_read_int_time_ms (Karan Sanghavi)
  - iio: adc: ad7768-1: set MOSI idle state to prevent accidental reset (Jonathan Santos)
  - iio: adc: ad7173: Fix comparison of channel configs (Uwe Kleine-König)
  - iio: adc: ad7124: Fix comparison of channel configs (Uwe Kleine-König)
  - iio: adc: ad4130: Fix comparison of channel setups (Uwe Kleine-König)
  - dmaengine: fsl-edma: free irq correctly in remove path (Peng Fan)
  - dmaengine: fsl-edma: cleanup chan after dma_async_device_unregister (Peng Fan)
  - fs/ntfs3: Prevent integer overflow in hdr_first_de() (Dan Carpenter)
  - fs/ntfs3: Fix a couple integer overflows on 32bit systems (Dan Carpenter)
  - usb: xhci: correct debug message page size calculation (Niklas Neronin)
  - perf bench: Fix perf bench syscall loop count (Thomas Richter)
  - perf arm-spe: Fix load-store operation checking (Leo Yan)
  - iio: backend: make sure to NULL terminate stack buffer (Nuno Sá)
  - iio: accel: msa311: Fix failure to release runtime pm if direct mode claim fails. (Jonathan Cameron)
  - iio: accel: mma8452: Ensure error return on failure to matching oversampling ratio (Jonathan Cameron)
  - ucsi_ccg: Don't show failed to get FW build information error (Mario Limonciello)
  - perf build: Fix in-tree build due to symbolic link (Luca Ceresoli)
  - tools/x86: Fix linux/unaligned.h include path in lib/insn.c (Ian Rogers)
  - perf pmu: Don't double count common sysfs and json events (James Clark)
  - coresight-etm4x: add isb() before reading the TRCSTATR (Yuanfang Zhang)
  - vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint (Mike Christie)
  - coresight: catu: Fix number of pages while using 64k pages (Ilkka Koskinen)
  - greybus: gb-beagleplay: Add error handling for gb_greybus_init (Wentao Liang)
  - perf report: Switch data file correctly in TUI (Namhyung Kim)
  - soundwire: slave: fix an OF node reference leak in soundwire slave device (Joe Hattori)
  - isofs: fix KMSAN uninit-value bug in do_isofs_readdir() (Qasim Ijaz)
  - phy: phy-rockchip-samsung-hdptx: Don't use dt aliases to determine phy-id (Heiko Stuebner)
  - fs/ntfs3: Update inode->i_mapping->a_ops on compression state (Konstantin Komarov)
  - w1: fix NULL pointer dereference in probe (Chenyuan Yang)
  - perf: Always feature test reallocarray (James Clark)
  - perf stat: Fix find_stat for mixed legacy/non-legacy events (Ian Rogers)
  - clk: qcom: mmcc-sdm660: fix stuck video_subcore0 clock (Barnabás Czémán)
  - pinctrl: intel: Fix wrong bypass assignment in intel_pinctrl_probe_pwm() (Andy Shevchenko)
  - crypto: hisilicon/sec2 - fix for aead auth key length (Wenkai Lin)
  - RDMA/core: Fix use-after-free when rename device name (Wang Liang)
  - x86/dumpstack: Fix inaccurate unwinding from exception stacks due to misplaced assignment (Jann Horn)
  - leds: Fix LED_OFF brightness race (Remi Pommarel)
  - mfd: sm501: Switch to BIT() to mitigate integer overflows (Nikita Zhandarovich)
  - pinctrl: renesas: rzv2m: Fix missing of_node_put() call (Fabrizio Castro)
  - RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow (Patrisious Haddad)
  - bpf: Fix array bounds error with may_goto (Jiayuan Chen)
  - clk: qcom: gcc-sm8650: Do not turn off USB GDSCs during gdsc_disable() (Neil Armstrong)
  - crypto: nx - Fix uninitialised hv_nxc on error (Herbert Xu)
  - power: supply: max77693: Fix wrong conversion of charge input threshold value (Artur Weber)
  - x86/entry: Fix ORC unwinder for PUSH_REGS with save_ret=1 (Jann Horn)
  - clk: amlogic: g12a: fix mmc A peripheral clock (Jerome Brunet)
  - clk: clk-imx8mp-audiomix: fix dsp/ocram_a clock parents (Laurentiu Mihalcea)
  - crypto: qat - remove access to parity register for QAT GEN4 (Bairavi Alagappan)
  - pinctrl: npcm8xx: Fix incorrect struct npcm8xx_pincfg assignment (Andy Shevchenko)
  - rust: fix signature of rust_fmt_argument (Alice Ryhl)
  - selftests/bpf: Select NUMA_NO_NODE to create map (Saket Kumar Bhaskar)
  - clk: amlogic: gxbb: drop non existing 32k clock parent (Jerome Brunet)
  - clk: amlogic: g12b: fix cluster A parent data (Jerome Brunet)
  - pinctrl: tegra: Set SFIO mode to Mux Register (Prathamesh Shete)
  - IB/mad: Check available slots before posting receive WRs (Maher Sanalla)
  - crypto: api - Fix larval relookup type and mask (Herbert Xu)
  - power: supply: bq27xxx_battery: do not update cached flags prematurely (Sicelo A. Mhlongo)
  - remoteproc: qcom_q6v5_mss: Handle platforms with one power domain (Luca Weiss)
  - RDMA/erdma: Prevent use-after-free in erdma_accept_newconn() (Cheng Xu)
  - RDMA/mlx5: Fix calculation of total invalidated pages (Chiara Meiohas)
  - RDMA/core: Don't expose hw_counters outside of init net namespace (Roman Gushchin)
  - clk: rockchip: rk3328: fix wrong clk_ref_usb3otg parent (Peter Geis)
  - selftests/bpf: Fix freplace_link segfault in tailcalls prog test (Tengda Wu)
  - RDMA/mlx5: Fix MR cache initialization error flow (Michael Guralnik)
  - pinctrl: renesas: rzg2l: Fix missing of_node_put() call (Fabrizio Castro)
  - pinctrl: renesas: rza2: Fix missing of_node_put() call (Fabrizio Castro)
  - lib: 842: Improve error handling in sw842_compress() (Tanya Agarwal)
  - bpf: Use preempt_count() directly in bpf_send_signal_common() (Hou Tao)
  - clk: qcom: gcc-x1e80100: Unregister GCC_GPU_CFG_AHB_CLK/GCC_DISP_XO_CLK (Konrad Dybcio)
  - remoteproc: qcom_q6v5_pas: Use resource with CX PD for MSM8226 (Luca Weiss)
  - crypto: tegra - Set IV to NULL explicitly for AES ECB (Akhil R)
  - RDMA/mana_ib: Ensure variable err is initialized (Kees Bakker)
  - s390: Remove ioremap_wt() and pgprot_writethrough() (Niklas Schnelle)
  - clk: qcom: gcc-msm8953: fix stuck venus0_core0 clock (Vladimir Lypak)
  - crypto: tegra - Fix CMAC intermediate result handling (Akhil R)
  - pinctrl: nuvoton: npcm8xx: Fix error handling in npcm8xx_gpio_fw() (Yue Haibing)
  - clk: samsung: Fix UBSAN panic in samsung_clk_init() (Will McVicker)
  - remoteproc: qcom: pas: add minidump_id to SC7280 WPSS (Luca Weiss)
  - clk: renesas: r8a08g045: Check the source of the CPU PLL settings (Claudiu Beznea)
  - x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range() (David Hildenbrand)
  - selftests/bpf: Fix string read in strncmp benchmark (Viktor Malik)
  - libbpf: Fix hypothetical STT_SECTION extern NULL deref case (Andrii Nakryiko)
  - remoteproc: qcom_q6v5_pas: Make single-PD handling more robust (Luca Weiss)
  - pinctrl: renesas: rzg2l: Suppress binding attributes (Claudiu Beznea)
  - of: property: Increase NR_FWNODE_REFERENCE_ARGS (Zijun Hu)
  - remoteproc: core: Clear table_sz when rproc_shutdown (Peng Fan)
  - RDMA/mlx5: Fix page_size variable overflow (Michael Guralnik)
  - crypto: hisilicon/sec2 - fix for sec spec check (Wenkai Lin)
  - crypto: hisilicon/sec2 - fix for aead authsize alignment (Wenkai Lin)
  - clk: amlogic: gxbb: drop incorrect flag on 32k clock (Jerome Brunet)
  - crypto: tegra - Use HMAC fallback when keyslots are full (Akhil R)
  - crypto: bpf - Add MODULE_DESCRIPTION for skcipher (Arnd Bergmann)
  - crypto: tegra - check return value for hash do_one_req (Akhil R)
  - crypto: tegra - Use separate buffer for setkey (Akhil R)
  - crypto: qat - set parity error mask for qat_420xx (Bairavi Alagappan)
  - crypto: iaa - Test the correct request flag (Herbert Xu)
  - fbdev: sm501fb: Add some geometry checks. (Danila Chernetsov)
  - mdacon: rework dependency list (Arnd Bergmann)
  - dummycon: fix default rows/cols (Arnd Bergmann)
  - fbdev: au1100fb: Move a variable assignment behind a null pointer check (Markus Elfring)
  - PCI: pciehp: Don't enable HPIE when resuming in poll mode (Ilpo Järvinen)
  - PCI: Fix BAR resizing when VF BARs are assigned (Ilpo Järvinen)
  - PCI: histb: Fix an error handling path in histb_pcie_probe() (Christophe JAILLET)
  - PCI: dwc: ep: Return -ENOMEM for allocation failures (Dan Carpenter)
  - drm/amd/display: avoid NPD when ASIC does not support DMUB (Thadeu Lima de Souza Cascardo)
  - drm/mediatek: dsi: fix error codes in mtk_dsi_host_transfer() (Dan Carpenter)
  - drm/mediatek: dp: drm_err => dev_err in HPD path to avoid NULL ptr (Douglas Anderson)
  - drm/mediatek: Fix config_updating flag never false when no mbox channel (Jason-JH Lin)
  - PCI: xilinx-cpm: Fix IRQ domain leak in error path of probe (Thippeswamy Havalige)
  - PCI: Remove stray put_device() in pci_register_host_bridge() (Dan Carpenter)
  - powerpc/kexec: fix physical address calculation in clear_utlb_entry() (Christophe Leroy)
  - crypto: powerpc: Mark ghashp8-ppc.o as an OBJECT_FILES_NON_STANDARD (Christophe Leroy)
  - drm/msm/a6xx: Fix a6xx indexed-regs in devcoreduump (Rob Clark)
  - drm/amd/display: fix type mismatch in CalculateDynamicMetadataParameters() (Vitaliy Shevtsov)
  - drm/panthor: Update CS_STATUS_ defines to correct values (Ashley Smith)
  - PCI: Avoid reset when disabled via sysfs (Nishanth Aravamudan)
  - PCI/portdrv: Only disable pciehp interrupts early when needed (Feng Tang)
  - PCI: brcmstb: Fix potential premature regulator disabling (Jim Quinlan)
  - PCI: brcmstb: Fix error path after a call to regulator_bulk_get() (Jim Quinlan)
  - PCI: brcmstb: Use internal register to change link capability (Jim Quinlan)
  - PCI: brcmstb: Set generation limit before PCIe link up (Jim Quinlan)
  - PCI: cadence-ep: Fix the driver to send MSG TLP for INTx without data payload (Hans Zhang)
  - drm/amdkfd: Fix Circular Locking Dependency in 'svm_range_cpu_invalidate_pagetables' (Srinivasan Shanmugam)
  - drm/msm/dsi: Set PHY usescase (and mode) before registering DSI host (Marijn Suijten)
  - drm/msm/dsi: Use existing per-interface slice count in DSC timing (Marijn Suijten)
  - drm/msm/dsi/phy: Program clock inverters in correct register (Krzysztof Kozlowski)
  - drm/msm/dpu: don't use active in atomic_check() (Dmitry Baryshkov)
  - drm/amd/display: fix an indent issue in DML21 (Aurabindo Pillai)
  - PCI/ACS: Fix 'pci=config_acs=' parameter (Tushar Dave)
  - drm/panel: ilitek-ili9882t: fix GPIO name in error message (John Keeping)
  - PCI/ASPM: Fix link state exit during switch upstream function removal (Daniel Stodden)
  - drm/mediatek: mtk_hdmi: Fix typo for aud_sampe_size member (AngeloGioacchino Del Regno)
  - drm/mediatek: mtk_hdmi: Unregister audio platform device on failure (AngeloGioacchino Del Regno)
  - PCI: Remove add_align overwrite unrelated to size0 (Ilpo Järvinen)
  - PCI: Use downstream bridges for distributing resources (Kai-Heng Feng)
  - drm/amdgpu/umsch: fix ucode check (Alex Deucher)
  - drm/amdgpu: refine smu send msg debug log format (Yang Wang)
  - gpu: cdns-mhdp8546: fix call balance of mhdp->clk handling routines (Vitalii Mordan)
  - drm/vkms: Fix use after free and double free on init error (José Expósito)
  - drm: xlnx: zynqmp: Fix max dma segment size (Tomi Valkeinen)
  - drm/bridge: it6505: fix HDCP V match check is not performed correctly (Hermes Wu)
  - drm/dp_mst: Fix drm RAD print (Wayne Lin)
  - drm/ssd130x: ensure ssd132x pitch is correct (John Keeping)
  - drm/ssd130x: fix ssd132x encoding (John Keeping)
  - drm/ssd130x: Set SPI .id_table to prevent an SPI core warning (Javier Martinez Canillas)
  - drm/bridge: ti-sn65dsi86: Fix multiple instances (Geert Uytterhoeven)
  - ALSA: timer: Don't take register_mutex with copy_from/to_user() (Takashi Iwai)
  - ASoC: ti: j721e-evm: Fix clock configuration for ti,j7200-cpb-audio compatible (Jayesh Choudhary)
  - ALSA: hda/realtek: Always honor no_shutup_pins (Takashi Iwai)
  - dt-bindings: vendor-prefixes: add GOcontroll (Maud Spierings)
  - HID: remove superfluous (and wrong) Makefile entry for CONFIG_INTEL_ISH_FIRMWARE_DOWNLOADER (Jiri Kosina)
  - ASoC: amd: acp: Fix for enabling DMIC on acp platforms via _DSD entry (Venkata Prasad Potturu)
  - ASoC: cs35l41: check the return value from spi_setup() (Vitaliy Shevtsov)
  - platform/x86: dell-ddv: Fix temperature calculation (Armin Wolf)
  - platform/x86: dell-uart-backlight: Make dell_uart_bl_serdev_driver static (Ilpo Järvinen)
  - platform/x86: lenovo-yoga-tab2-pro-1380-fastcharger: Make symbol static (Ilpo Järvinen)
  - auxdisplay: panel: Fix an API misuse in panel.c (Andy Shevchenko)
  - media: platform: allgro-dvt: unregister v4l2_device on the error path (Joe Hattori)
  - media: verisilicon: HEVC: Initialize start_bit field (Benjamin Gaignard)
  - auxdisplay: MAX6959 should select BITREVERSE (Geert Uytterhoeven)
  - regulator: pca9450: Fix enable register for LDO5 (Frieder Schrempf)
  - x86/entry: Add __init to ia32_emulation_override_cmdline() (Vitaly Kuznetsov)
  - x86/fpu/xstate: Fix inconsistencies in guest FPU xfeatures (Chao Gao)
  - x86/traps: Make exc_double_fault() consistently noreturn (Josh Poimboeuf)
  - perf/ring_buffer: Allow the EPOLLRDNORM flag for poll (Tao Chen)
  - lockdep: Don't disable interrupts on RT in disable_irq_nosync_lockdep.*() (Sebastian Andrzej Siewior)
  - PM: sleep: Fix handling devices with direct_complete set on errors (Rafael J. Wysocki)
  - thermal: int340x: Add NULL check for adev (Chenyuan Yang)
  - x86/resctrl: Fix allocation of cleanest CLOSID on platforms with no monitors (James Morse)
  - EDAC/ie31200: Fix the error path order of ie31200_init() (Qiuxu Zhuo)
  - EDAC/ie31200: Fix the DIMM size mask for several SoCs (Qiuxu Zhuo)
  - EDAC/ie31200: Fix the size of EDAC_MC_LAYER_CHIP_SELECT layer (Qiuxu Zhuo)
  - selinux: Chain up tool resolving errors in install_policy.sh (Tim Schumacher)
  - watchdog/hardlockup/perf: Fix perf_event memory leak (Li Huafei)
  - kunit/stackinit: Use fill byte different from Clang i386 pattern (Kees Cook)
  - RISC-V: KVM: Disable the kernel perf counter during configure (Atish Patra)
  - cpufreq: tegra194: Allow building for Tegra234 (Aaron Kling)
  - PM: sleep: Adjust check before setting power.must_resume (Rafael J. Wysocki)
  - lockdep/mm: Fix might_fault() lockdep check of current->mm->mmap_lock (Peter Zijlstra)
  - x86/sev: Add missing RIP_REL_REF() invocations during sme_enable() (Kevin Loughlin)
  - x86/platform: Only allow CONFIG_EISA for 32-bit (Arnd Bergmann)
  - x86/fpu: Avoid copying dynamic FP state from init_task in arch_dup_task_struct() (Benjamin Berg)
  - x86/fpu: Fix guest FPU state buffer allocation size (Stanislav Spassov)
  - EDAC/{skx_common,i10nm}: Fix some missing error reports on Emerald Rapids (Qiuxu Zhuo)
  - cpufreq: governor: Fix negative 'idle_time' handling in dbs_update() (Jie Zhan)
  - sched/eevdf: Force propagating min_slice of cfs_rq when {en,de}queue tasks (Tianchen Ding)
  - sched: Cancel the slice protection of the idle entity (zihan zhou)
  - smack: ipv4/ipv6: tcp/dccp/sctp: fix incorrect child socket label (Konstantin Andreev)
  - smack: dont compile ipv6 code unless ipv6 is configured (Konstantin Andreev)
  - cpufreq: scpi: compare kHz instead of Hz (zuoqian)
  - x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Mike Rapoport (Microsoft))
  - watch_queue: fix pipe accounting mismatch (Eric Sandeen)
  - LTS version: v6.12.22 (Jack Vogel)
  - bcachefs: bch2_ioctl_subvolume_destroy() fixes (Kent Overstreet)
  - serial: 8250_dma: terminate correct DMA in tx_dma_flush() (John Keeping)
  - serial: stm32: do not deassert RS485 RTS GPIO prematurely (Cheick Traore)
  - perf tools: Fix up some comments and code to properly use the event_source bus (Greg Kroah-Hartman)
  - memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (Luo Qiu)
  - usb: xhci: Apply the link chain quirk on NEC isoc endpoints (Michal Pecio)
  - usb: xhci: Don't skip on Stopped - Length Invalid (Michal Pecio)
  - net: usb: usbnet: restore usb%d name exception for local mac addresses (Dominique Martinet)
  - net: usb: qmi_wwan: add Telit Cinterion FE990B composition (Fabio Porcedda)
  - net: usb: qmi_wwan: add Telit Cinterion FN990B composition (Fabio Porcedda)
  - tty: serial: fsl_lpuart: disable transmitter before changing RS485 related registers (Sherry Sun)
  - tty: serial: 8250: Add Brainboxes XC devices (Cameron Williams)
  - tty: serial: 8250: Add some more device IDs (Cameron Williams)
  - counter: microchip-tcb-capture: Fix undefined counter channel state on probe (William Breathitt Gray)
  - counter: stm32-lptimer-cnt: fix error handling when enabling (Fabrice Gasnier)
  - ALSA: hda/realtek: Support mute LED on HP Laptop 15s-du3xxx (Dhruv Deshpande)
  - netfilter: socket: Lookup orig tuple for IPv6 SNAT (Maxim Mikityanskiy)
  - drm/amd/display: Don't write DP_MSTM_CTRL after LT (Wayne Lin)
  - atm: Fix NULL pointer dereference (Minjoong Kim)
  - HID: hid-plantronics: Add mic mute mapping and generalize quirks (Terry Junge)
  - ALSA: usb-audio: Add quirk for Plantronics headsets to fix control names (Terry Junge)
  - LTS version: v6.12.21 (Jack Vogel)
  - mptcp: Fix data stream corruption in the address announcement (Arthur Mongodin)
  - mm/huge_memory: drop beyond-EOF folios with the right number of refs (Zi Yan)
  - arm64: dts: rockchip: fix u2phy1_host status for NanoPi R4S (Justin Klaassen)
  - libsubcmd: Silence compiler warning (Eder Zulian)
  - Revert "sched/core: Reduce cost of sched_move_task when config autogroup" (Dietmar Eggemann)
  - KVM: arm64: Eagerly switch ZCR_EL{1,2} (Mark Rutland)
  - KVM: arm64: Mark some header functions as inline (Mark Rutland)
  - KVM: arm64: Refactor exit handlers (Mark Rutland)
  - KVM: arm64: Remove VHE host restore of CPACR_EL1.SMEN (Mark Rutland)
  - KVM: arm64: Remove VHE host restore of CPACR_EL1.ZEN (Mark Rutland)
  - KVM: arm64: Remove host FPSIMD saving for non-protected KVM (Mark Rutland)
  - KVM: arm64: Unconditionally save+flush host FPSIMD/SVE/SME state (Mark Rutland)
  - KVM: arm64: Calculate cptr_el2 traps on activating traps (Fuad Tabba)
  - io_uring/net: fix sendzc double notif flush (Pavel Begunkov)
  - ksmbd: fix incorrect validation for num_aces field of smb_acl (Namjae Jeon)
  - drm/amdkfd: Fix user queue validation on Gfx7/8 (Philip Yang)
  - drm/amdgpu: Fix JPEG video caps max size for navi1x and raven (David Rosca)
  - drm/amdgpu: Fix MPEG2, MPEG4 and VC1 video caps max size (David Rosca)
  - drm/amdgpu: Remove JPEG from vega and carrizo video caps (David Rosca)
  - drm/amdgpu/pm: wire up hwmon fan speed for smu 14.0.2 (Alex Deucher)
  - drm/amdgpu/pm: Handle SCLK offset correctly in overdrive for smu 14.0.2 (Tomasz Pakuła)
  - drm/amdgpu: Restore uncached behaviour on GFX12 (David Belanger)
  - drm/amd/pm: add unique_id for gfx12 (Harish Kasiviswanathan)
  - drm/amd/display: Use HW lock mgr for PSR1 when only one eDP (Mario Limonciello)
  - drm/amd/display: Fix message for support_edp0_on_dp1 (Yilin Chen)
  - drm/amdgpu/gfx12: correct cleanup of 'me' field with gfx_v12_0_me_fini() (Wentao Liang)
  - drm/sched: Fix fence reference count leak (qianyi liu)
  - drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse() (Nikita Zhandarovich)
  - pmdomain: amlogic: fix T7 ISP secpower (Xianwei Zhao)
  - soc: qcom: pdr: Fix the potential deadlock (Saranya R)
  - batman-adv: Ignore own maximum aggregation size during RX (Sven Eckelmann)
  - xsk: fix an integer overflow in xp_create_and_assign_umem() (Gavrilov Ilia)
  - keys: Fix UAF in key_put() (David Howells)
  - efi/libstub: Avoid physical address 0x0 when doing random allocation (Ard Biesheuvel)
  - firmware: qcom: uefisecapp: fix efivars registration race (Johan Hovold)
  - ARM: shmobile: smp: Enforce shmobile_smp_* alignment (Geert Uytterhoeven)
  - ARM: dts: imx6qdl-apalis: Fix poweroff on Apalis iMX6 (Stefan Eichenberger)
  - memcg: drain obj stock on cpu hotplug teardown (Shakeel Butt)
  - proc: fix UAF in proc_get_inode() (Ye Bin)
  - mm/page_alloc: fix memory accept before watermarks gets initialized (Kirill A. Shutemov)
  - mm/migrate: fix shmem xarray update during migration (Zi Yan)
  - mm: fix error handling in __filemap_get_folio() with FGP_NOWAIT (Raphael S. Carvalho)
  - selftests/mm: run_vmtests.sh: fix half_ufd_size_MB calculation (Rafael Aquini)
  - mmc: atmel-mci: Add missing clk_disable_unprepare() (Gu Bowen)
  - mmc: sdhci-brcmstb: add cqhci suspend/resume to PM ops (Kamal Dasu)
  - arm64: dts: rockchip: fix pinmux of UART5 for PX30 Ringneck on Haikou (Quentin Schulz)
  - arm64: dts: rockchip: fix pinmux of UART0 for PX30 Ringneck on Haikou (Quentin Schulz)
  - arm64: dts: freescale: imx8mm-verdin-dahlia: add Microphone Jack to sound card (Stefan Eichenberger)
  - arm64: dts: freescale: imx8mp-verdin-dahlia: add Microphone Jack to sound card (Stefan Eichenberger)
  - accel/qaic: Fix integer overflow in qaic_validate_req() (Dan Carpenter)
  - regulator: check that dummy regulator has been probed before using it (Christian Eggers)
  - regulator: dummy: force synchronous probing (Christian Eggers)
  - netfs: Call `invalidate_cache` only if implemented (Max Kellermann)
  - riscv: dts: starfive: Fix a typo in StarFive JH7110 pin function definitions (E Shattow)
  - io_uring/net: don't clear REQ_F_NEED_CLEANUP unconditionally (Jens Axboe)
  - drm/v3d: Don't run jobs that have errors flagged in its fence (Maíra Canal)
  - drm/xe: Fix exporting xe buffers multiple times (Tomasz Rusinowicz)
  - can: flexcan: disable transceiver during system PM (Haibo Chen)
  - can: flexcan: only change CAN state when link up in system PM (Haibo Chen)
  - can: ucan: fix out of bound read in strscpy() source (Vincent Mailhol)
  - can: rcar_canfd: Fix page entries in the AFL list (Biju Das)
  - dt-bindings: can: renesas,rcar-canfd: Fix typo in pattern properties for R-Car V4M (Biju Das)
  - net: mana: Support holes in device list reply msg (Haiyang Zhang)
  - i2c: omap: fix IRQ storms (Andreas Kemnade)
  - tracing: tprobe-events: Fix leakage of module refcount (Masami Hiramatsu (Google))
  - Revert "gre: Fix IPv6 link-local address generation." (Guillaume Nault)
  - net/neighbor: add missing policy for NDTPA_QUEUE_LENBYTES (Lin Ma)
  - libfs: Fix duplicate directory entry in offset_dir_lookup (Yongjian Sun)
  - net: ipv6: ioam6: fix lwtunnel_output() loop (Justin Iurman)
  - net: lwtunnel: fix recursion loops (Justin Iurman)
  - net: ti: icssg-prueth: Add lock to stats (MD Danish Anwar)
  - net: atm: fix use after free in lec_send() (Dan Carpenter)
  - gpu: host1x: Do not assume that a NULL domain means no DMA IOMMU (Jason Gunthorpe)
  - phy: fix xa_alloc_cyclic() error handling (Michal Swiatkowski)
  - dpll: fix xa_alloc_cyclic() error handling (Michal Swiatkowski)
  - devlink: fix xa_alloc_cyclic() error handling (Michal Swiatkowski)
  - ipv6: Set errno after ip_fib_metrics_init() in ip6_route_info_create(). (Kuniyuki Iwashima)
  - ipv6: Fix memleak of nhc_pcpu_rth_output in fib_check_nh_v6_gw(). (Kuniyuki Iwashima)
  - net: ipv6: fix TCP GSO segmentation with NAT (Felix Fietkau)
  - net: ethernet: ti: am65-cpsw: Fix NAPI registration sequence (Vignesh Raghavendra)
  - ata: libata-core: Add ATA_QUIRK_NO_LPM_ON_ATI for certain Samsung SSDs (Niklas Cassel)
  - tracing: tprobe-events: Fix to clean up tprobe correctly when module unload (Masami Hiramatsu (Google))
  - ARM: davinci: da850: fix selecting ARCH_DAVINCI_DA8XX (David Lechner)
  - accel/qaic: Fix possible data corruption in BOs > 2G (Jeffrey Hugo)
  - Bluetooth: hci_event: Fix connection regression between LE and non-LE adapters (Arkadiusz Bokowy)
  - Bluetooth: Fix error code in chan_alloc_skb_cb() (Dan Carpenter)
  - RDMA/hns: Fix wrong value of max_sge_rd (Junxian Huang)
  - RDMA/hns: Fix missing xa_destroy() (Junxian Huang)
  - RDMA/hns: Fix a missing rollback in error path of hns_roce_create_qp_common() (Junxian Huang)
  - RDMA/hns: Fix invalid sq params not being blocked (Junxian Huang)
  - RDMA/hns: Fix unmatched condition in error path of alloc_user_qp_db() (Junxian Huang)
  - RDMA/hns: Fix soft lockup during bt pages loop (Junxian Huang)
  - RDMA/bnxt_re: Avoid clearing VLAN_ID mask in modify qp path (Saravanan Vajravel)
  - dma-mapping: fix missing clear bdr in check_ram_in_range_map() (Baochen Qiang)
  - ARM: dts: BCM5301X: Fix switch port labels of ASUS RT-AC3200 (Chester A. Unal)
  - ARM: dts: BCM5301X: Fix switch port labels of ASUS RT-AC5300 (Chester A. Unal)
  - ARM: dts: bcm2711: Don't mark timer regs unconfigured (Phil Elwell)
  - ARM: OMAP1: select CONFIG_GENERIC_IRQ_CHIP (Arnd Bergmann)
  - RDMA/mlx5: Handle errors returned from mlx5r_ib_rate() (Qasim Ijaz)
  - RDMA/bnxt_re: Add missing paranthesis in map_qp_id_to_tbl_indx (Kashyap Desai)
  - RDMA/rxe: Fix the failure of ibv_query_device() and ibv_query_device_ex() tests (Zhu Yanjun)
  - arm64: dts: rockchip: Remove undocumented sdmmc property from lubancat-1 (Yao Zi)
  - arm64: dts: bcm2712: PL011 UARTs are actually r1p5 (Phil Elwell)
  - ARM: dts: bcm2711: PL011 UARTs are actually r1p5 (Phil Elwell)
  - ARM: dts: bcm2711: Fix xHCI power-domain (Stefan Wahren)
  - soc: imx8m: Unregister cpufreq and soc dev in cleanup path (Peng Fan)
  - soc: imx8m: Use devm_* to simplify probe failure handling (Marek Vasut)
  - soc: imx8m: Remove global soc_uid (Marek Vasut)
  - xfrm_output: Force software GSO only in tunnel mode (Cosmin Ratiu)
  - xfrm: fix tunnel mode TX datapath in packet offload mode (Alexandre Cassen)
  - arm64: dts: rockchip: remove supports-cqe from rk3588 tiger (Heiko Stuebner)
  - arm64: dts: rockchip: remove supports-cqe from rk3588 jaguar (Heiko Stuebner)
  - arm64: dts: freescale: tqma8mpql: Fix vqmmc-supply (Alexander Stein)
  - firmware: imx-scu: fix OF node leak in .probe() (Joe Hattori)
  - firmware: qcom: scm: Fix error code in probe() (Dan Carpenter)
  - rds: Tear down the copy-from-user cache before destroying rds_wq (Håkon Bugge)  [Orabug: 37379052]
  - uek-rpm: Set uek_release variable in UEK 8 spec file (Harshit Mogalapalli)  [Orabug: 37801392]


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-1.23.2.el9uek]
changelog:
  - vhost_scsi: log write descriptors (Dongli Zhang)  [Orabug: 37393517]
  - vhost-scsi: protect vq->log_base with vq->mutex (Dongli Zhang)  [Orabug: 37393517]
  - RDS: avoid queueing delayed work on an offlined cpu (Praveen Kumar Kannoju)  [Orabug: 37260584] [Orabug: 37551308]
  - Revert "x86/simplefb: simplefb was broken on UEFI mode Oracle and HP system, skip VIDEO_TYPE_EFI" (Harshit Mogalapalli)  [Orabug: 37638881]
  - uek-rpm: Replace legacy FBDEV drivers with simpledrm and fbdev emulation layer (Harshit Mogalapalli)  [Orabug: 37638881]
  - uek-rpm/kernel-uek.spec: Set DEFAULTKERNEL correctly during %postun (Vijay Kumar)
  - uek-rpm: Enable gcov build (Sherry Yang)  [Orabug: 37734677]
  - uek-rpm: remove .el9 from shim version (Samasth Norway Ananda)  [Orabug: 37820202]
  - drm/mgag200: Added support for the new device G200eH5 (Gwenael Georgeault)  [Orabug: 37835185]


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-2.24.1.el9uek]
changelog:
  - x86/microcode/AMD: Clean the cache if update did not load microcode (Boris Ostrovsky)  [Orabug: 37800727]
  - LTS version: v6.12.24 (Jack Vogel)
  - HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition (Kaixin Wang)
  - s390/cpumf: Fix double free on error in cpumf_pmu_event_init() (Thomas Richter)
  - Bluetooth: hci_uart: Fix another race during initialization (Arseniy Krasnov)
  - media: mediatek: vcodec: mark vdec_vp9_slice_map_counts_eob_coef noinline (Arnd Bergmann)
  - kbuild: Add '-fno-builtin-wcslen' (Nathan Chancellor)
  - libbpf: Prevent compiler warnings/errors (Eder Zulian)
  - x86/e820: Fix handling of subpage regions when calculating nosave ranges in e820__register_nosave_regions() (Myrrh Periwinkle)
  - nfsd: don't ignore the return code of svc_proc_register() (Jeff Layton)
  - NFSD: Fix CB_GETATTR status fix (Chuck Lever)
  - NFSD: fix decoding in nfs4_xdr_dec_cb_getattr (Olga Kornievskaia)
  - ACPI: platform-profile: Fix CFI violation when accessing sysfs files (Nathan Chancellor)
  - iommufd: Fail replace if device has not been attached (Yi Liu)
  - iommufd: Make attach_handle generic than fault specific (Nicolin Chen)
  - arm64: errata: Add newer ARM cores to the spectre_bhb_loop_affected() lists (Douglas Anderson)
  - thermal/drivers/mediatek/lvts: Disable Stage 3 thermal threshold (Nícolas F. R. A. Prado)
  - thermal/drivers/mediatek/lvts: Disable monitor mode during suspend (Nícolas F. R. A. Prado)
  - selftests: mptcp: fix incorrect fd checks in main_loop (Cong Liu)
  - selftests: mptcp: close fd_in before returning in main_loop (Geliang Tang)
  - sched_ext: create_dsq: Return -EEXIST on duplicate request (Jake Hillion)
  - s390: Fix linker error when -no-pie option is unavailable (Sumanth Korikkar)
  - s390/virtio_ccw: Don't allocate/assign airqs for non-existing queues (David Hildenbrand)
  - s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs (Niklas Schnelle)
  - ring-buffer: Use flush_kernel_vmap_range() over flush_dcache_folio() (Steven Rostedt)
  - pinctrl: samsung: add support for eint_fltcon_offset (Peter Griffin)
  - pinctrl: qcom: Clear latched interrupt status when changing IRQ type (Stephan Gerhold)
  - phy: freescale: imx8m-pcie: assert phy reset and perst in power off (Stefan Eichenberger)
  - PCI: Fix wrong length of devres array (Philipp Stanner)
  - PCI: Fix reference leak in pci_register_host_bridge() (Ma Ke)
  - PCI: Fix reference leak in pci_alloc_child_bus() (Ma Ke)
  - PCI: pciehp: Avoid unnecessary device replacement check (Lukas Wunner)
  - PCI: j721e: Fix the value of .linkdown_irq_regfield for J784S4 (Siddharth Vadapalli)
  - PCI: brcmstb: Fix missing of_node_put() in brcm_pcie_probe() (Stanimir Varbanov)
  - of/irq: Fix device node refcount leakages in of_irq_init() (Zijun Hu)
  - of/irq: Fix device node refcount leakage in API irq_of_parse_and_map() (Zijun Hu)
  - of/irq: Fix device node refcount leakages in of_irq_count() (Zijun Hu)
  - of/irq: Fix device node refcount leakage in API of_irq_parse_raw() (Zijun Hu)
  - of/irq: Fix device node refcount leakage in API of_irq_parse_one() (Zijun Hu)
  - ntb: use 64-bit arithmetic for the MSI doorbell mask (Fedor Pchelkin)
  - net: mana: Switch to page pool for jumbo frames (Haiyang Zhang)
  - misc: pci_endpoint_test: Fix displaying 'irq_type' after 'request_irq' error (Kunihiko Hayashi)
  - selftests/landlock: Add a new test for setuid() (Mickaël Salaün)
  - selftests/landlock: Split signal_scoping_threads tests (Mickaël Salaün)
  - landlock: Prepare to add second errata (Mickaël Salaün)
  - landlock: Always allow signals between threads of the same process (Mickaël Salaün)
  - landlock: Add erratum for TCP fix (Mickaël Salaün)
  - landlock: Add the errata interface (Mickaël Salaün)
  - landlock: Move code to ease future backports (Mickaël Salaün)
  - KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses (Sean Christopherson)
  - KVM: x86: Explicitly zero-initialize on-stack CPUID unions (Sean Christopherson)
  - KVM: PPC: Enable CAP_SPAPR_TCE_VFIO on pSeries KVM guests (Amit Machhiwal)
  - gve: handle overflow when reporting TX consumed descriptors (Joshua Washington)
  - gpio: zynq: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
  - gpio: tegra186: fix resource handling in ACPI probe path (Guixin Liu)
  - ftrace: Properly merge notrace hashes (Andy Chiu)
  - ftrace: Add cond_resched() to ftrace_graph_set_hash() (zhoumin)
  - dt-bindings: coresight: qcom,coresight-tpdm: Fix too many 'reg' (Krzysztof Kozlowski)
  - dt-bindings: coresight: qcom,coresight-tpda: Fix too many 'reg' (Krzysztof Kozlowski)
  - dm-verity: fix prefetch-vs-suspend race (Mikulas Patocka)
  - dm-integrity: fix non-constant-time tag verification (Jo Van Bulck)
  - dm-integrity: set ti->error on memory allocation failure (Mikulas Patocka)
  - dm-ebs: fix prefetch-vs-suspend race (Mikulas Patocka)
  - dlm: fix error if active rsb is not hashed (Alexander Aring)
  - dlm: fix error if inactive rsb is not hashed (Alexander Aring)
  - crypto: ccp - Fix uAPI definitions of PSP errors (Dionna Glaze)
  - crypto: ccp - Fix check for the primary ASP device (Tom Lendacky)
  - clk: qcom: gdsc: Set retain_ff before moving to HW CTRL (Taniya Das)
  - clk: qcom: gdsc: Capture pm_genpd_add_subdomain result code (Bryan O'Donoghue)
  - clk: qcom: gdsc: Release pm subdomains in reverse add order (Bryan O'Donoghue)
  - clk: qcom: clk-branch: Fix invert halt status bit check for votable clocks (Ajit Pandey)
  - clk: renesas: r9a07g043: Fix HP clock source for RZ/Five (Lad Prabhakar)
  - cifs: Ensure that all non-client-specific reparse points are processed by the server (Pali Rohár)
  - cifs: fix integer overflow in match_server() (Roman Smirnov)
  - cifs: avoid NULL pointer dereference in dbg call (Alexandra Diupina)
  - CIFS: Propagate min offload along with other parameters from primary to secondary channels. (Aman)
  - thermal/drivers/rockchip: Add missing rk3328 mapping entry (Trevor Woerner)
  - tracing: Do not add length to print format in synthetic events (Steven Rostedt)
  - tracing: fprobe events: Fix possible UAF on modules (Masami Hiramatsu (Google))
  - x86/xen: fix balloon target initialization for PVH dom0 (Roger Pau Monne)
  - sctp: detect and prevent references to a freed transport in sendmsg (Ricardo Cañuelo Navarro)
  - mm/hwpoison: introduce folio_contain_hwpoisoned_page() helper (Jinjiang Tu)
  - mm/hugetlb: move hugetlb_sysctl_init() to the __init section (Marc Herbert)
  - mm/hwpoison: do not send SIGBUS to processes with recovered clean pages (Shuai Xue)
  - mm/userfaultfd: fix release hang over concurrent GUP (Peter Xu)
  - mm: add missing release barrier on PGDAT_RECLAIM_LOCKED unlock (Mathieu Desnoyers)
  - mm/mremap: correctly handle partial mremap() of VMA starting at 0 (Lorenzo Stoakes)
  - mm: fix lazy mmu docs and usage (Ryan Roberts)
  - mm: make page_mapped_in_vma() hugetlb walk aware (Jane Chu)
  - mm/rmap: reject hugetlb folios in folio_make_device_exclusive() (David Hildenbrand)
  - mm/damon/ops: have damon_get_folio return folio even for tail pages (Usama Arif)
  - sparc/mm: avoid calling arch_enter/leave_lazy_mmu() in set_ptes (Ryan Roberts)
  - sparc/mm: disable preemption in lazy mmu mode (Ryan Roberts)
  - iommu/vt-d: Wire up irq_ack() to irq_move_irq() for posted MSIs (Sean Christopherson)
  - iommu/vt-d: Fix possible circular locking dependency (Lu Baolu)
  - iommu/vt-d: Don't clobber posted vCPU IRTE when host IRQ affinity changes (Sean Christopherson)
  - iommu/vt-d: Put IRTE back into posted MSI mode if vCPU posting is disabled (Sean Christopherson)
  - iommu/tegra241-cmdqv: Fix warnings due to dmam_free_coherent() (Nicolin Chen)
  - iommufd: Fix uninitialized rc in iommufd_access_rw() (Nicolin Chen)
  - btrfs: zoned: fix zone finishing with missing devices (Johannes Thumshirn)
  - btrfs: zoned: fix zone activation with missing devices (Johannes Thumshirn)
  - btrfs: tests: fix chunk map leak after failure to add it to the tree (Filipe Manana)
  - btrfs: fix non-empty delayed iputs list on unmount due to compressed write workers (Filipe Manana)
  - backlight: led_bl: Hold led_access lock when calling led_sysfs_disable() (Herve Codina)
  - arm64: dts: exynos: gs101: disable pinctrl_gsacore node (Peter Griffin)
  - arm64: dts: mediatek: mt8173: Fix disp-pwm compatible string (Chen-Yu Tsai)
  - arm64: mm: Correct the update of max_pfn (Zhenhua Huang)
  - arm64: tegra: Remove the Orin NX/Nano suspend key (Ninad Malwade)
  - arm64: mops: Do not dereference src reg for a set operation (Keir Fraser)
  - mtd: rawnand: Add status chack in r852_ready() (Wentao Liang)
  - mtd: inftlcore: Add error check for inftl_read_oob() (Wentao Liang)
  - mptcp: only inc MPJoinAckHMacFailure for HMAC failures (Matthieu Baerts (NGI0))
  - mptcp: fix NULL pointer in can_accept_new_subflow (Gang Yan)
  - lib: scatterlist: fix sg_split_phys to preserve original scatterlist offsets (T Pratham)
  - locking/lockdep: Decrease nr_unused_locks if lock unused in zap_class() (Boqun Feng)
  - mailbox: tegra-hsp: Define dimensioning masks in SoC data (Kartik Rajput)
  - mfd: ene-kb3930: Fix a potential NULL pointer dereference (Chenyuan Yang)
  - leds: rgb: leds-qcom-lpg: Fix calculation of best period Hi-Res PWMs (Abel Vesa)
  - leds: rgb: leds-qcom-lpg: Fix pwm resolution max for Hi-Res PWMs (Abel Vesa)
  - jbd2: remove wrong sb->s_sequence check (Jan Kara)
  - i3c: Add NULL pointer check in i3c_master_queue_ibi() (Manjunatha Venkatesh)
  - i3c: master: svc: Use readsb helper for reading MDB (Stanley Chu)
  - ima: limit the number of ToMToU integrity violations (Mimi Zohar)
  - ima: limit the number of open-writers integrity violations (Mimi Zohar)
  - smb311 client: fix missing tcon check when mounting with linux/posix extensions (Steve French)
  - soc: samsung: exynos-chipid: Add NULL pointer check in exynos_chipid_probe() (Chenyuan Yang)
  - svcrdma: do not unregister device for listeners (Olga Kornievskaia)
  - tpm: do not start chip while suspended (Thadeu Lima de Souza Cascardo)
  - udf: Fix inode_getblk() return value (Jan Kara)
  - vdpa/mlx5: Fix oversized null mkey longer than 32bit (Si-Wei Liu)
  - f2fs: fix to avoid atomicity corruption of atomic file (Yeongjin Gil)
  - ext4: fix off-by-one error in do_split (Artem Sadovnikov)
  - bus: mhi: host: Fix race between unprepare and queue_buf (Jeff Hugo)
  - accel/ivpu: Fix deadlock in ivpu_ms_cleanup() (Jacek Lawrynowicz)
  - accel/ivpu: Fix warning in ivpu_ipc_send_receive_internal() (Jacek Lawrynowicz)
  - ALSA: hda/realtek: Enable Mute LED on HP OMEN 16 Laptop xd000xx (Sharan Kumar M)
  - ASoC: qdsp6: q6asm-dai: fix q6asm_dai_compr_set_params error path (Alexey Klimov)
  - ASoC: qdsp6: q6apm-dai: fix capture pipeline overruns. (Srinivas Kandagatla)
  - ASoC: qdsp6: q6apm-dai: set 10 ms period and buffer alignment. (Srinivas Kandagatla)
  - ASoC: q6apm-dai: make use of q6apm_get_hw_pointer (Srinivas Kandagatla)
  - ASoC: q6apm-dai: schedule all available frames to avoid dsp under-runs (Srinivas Kandagatla)
  - ASoC: q6apm: add q6apm_get_hw_pointer helper (Srinivas Kandagatla)
  - ASoC: codecs: wcd937x: fix a potential memory leak in wcd937x_soc_codec_probe() (Haoxiang Li)
  - io_uring/kbuf: reject zero sized provided buffers (Jens Axboe)
  - io_uring/net: fix io_req_post_cqe abuse by send bundle (Pavel Begunkov)
  - io_uring/net: fix accept multishot handling (Pavel Begunkov)
  - wifi: mt76: mt7925: fix the wrong simultaneous cap for MLO (Ming Yen Hsieh)
  - wifi: mt76: mt7925: fix the wrong link_idx when a p2p_device is present (Ming Yen Hsieh)
  - wifi: mt76: mt7925: fix country count limitation for CLC (Ming Yen Hsieh)
  - wifi: mt76: mt7925: ensure wow pattern command align fw format (Ming Yen Hsieh)
  - wifi: mac80211: fix integer overflow in hwmp_route_info_get() (Gavrilov Ilia)
  - wifi: mt76: Add check for devm_kstrdup() (Haoxiang Li)
  - clocksource/drivers/stm32-lptimer: Use wakeup capable instead of init wakeup (Alexandre Torgue)
  - mtd: Replace kcalloc() with devm_kcalloc() (Jiasheng Jiang)
  - net: dsa: mv88e6xxx: fix internal PHYs for 6320 family (Marek Behún)
  - net: dsa: mv88e6xxx: workaround RGMII transmit delay erratum for 6320 family (Marek Behún)
  - mtd: Add check for devm_kcalloc() (Jiasheng Jiang)
  - mptcp: sockopt: fix getting freebind & transparent (Matthieu Baerts (NGI0))
  - mptcp: sockopt: fix getting IPV6_V6ONLY (Matthieu Baerts (NGI0))
  - media: chips-media: wave5: Fix timeout while testing 10bit hevc fluster (Jackson.lee)
  - media: chips-media: wave5: Fix a hang after seeking (Jackson.lee)
  - media: chips-media: wave5: Avoid race condition in the interrupt handler (Jackson.lee)
  - media: chips-media: wave5: Fix gray color on screen (Jackson.lee)
  - media: i2c: imx214: Rectify probe error handling related to runtime PM (Sakari Ailus)
  - media: i2c: imx219: Rectify runtime PM handling in probe and remove (Sakari Ailus)
  - media: i2c: imx319: Rectify runtime PM handling probe and remove (Sakari Ailus)
  - media: venus: hfi_parser: refactor hfi packet parsing logic (Vikash Garodia)
  - media: venus: hfi_parser: add check to avoid out of bound access (Vikash Garodia)
  - media: nuvoton: Fix reference handling of ece_pdev (Ricardo Ribalda)
  - media: nuvoton: Fix reference handling of ece_node (Ricardo Ribalda)
  - media: i2c: ov7251: Introduce 1 ms delay between regulators and en GPIO (Sakari Ailus)
  - media: i2c: ov7251: Set enable GPIO low in probe (Sakari Ailus)
  - media: i2c: ccs: Set the device's runtime PM status correctly in probe (Sakari Ailus)
  - media: i2c: ccs: Set the device's runtime PM status correctly in remove (Sakari Ailus)
  - Revert "media: imx214: Fix the error handling in imx214_probe()" (Sakari Ailus)
  - media: v4l2-dv-timings: prevent possible overflow in v4l2_detect_gtf() (Karina Yankevich)
  - media: imx219: Adjust PLL settings based on the number of MIPI lanes (Dave Stevenson)
  - media: platform: stm32: Add check for clk_enable() (Jiasheng Jiang)
  - media: visl: Fix ERANGE error when setting enum controls (Nicolas Dufresne)
  - media: hi556: Fix memory leak (on error) in hi556_check_hwcfg() (Hans de Goede)
  - media: streamzap: prevent processing IR data on URB failure (Murad Masimov)
  - accel/ivpu: Fix PM related deadlocks in MS IOCTLs (Jacek Lawrynowicz)
  - tpm, tpm_tis: Fix timeout handling when waiting for TPM status (Jonathan McDowell)
  - mtd: rawnand: brcmnand: fix PM resume warning (Kamal Dasu)
  - spi: cadence-qspi: Fix probe on AM62A LP SK (Miquel Raynal)
  - KVM: arm64: Tear down vGIC on failed vCPU creation (Will Deacon)
  - arm64: errata: Add KRYO 2XX/3XX/4XX silver cores to Spectre BHB safe list (Douglas Anderson)
  - arm64: errata: Assume that unknown CPUs _are_ vulnerable to Spectre BHB (Douglas Anderson)
  - arm64: errata: Add QCOM_KRYO_4XX_GOLD to the spectre_bhb_k24_list (Douglas Anderson)
  - arm64: cputype: Add MIDR_CORTEX_A76AE (Douglas Anderson)
  - xenfs/xensyms: respect hypervisor's "next" indication (Jan Beulich)
  - media: rockchip: rga: fix rga offset lookup (John Keeping)
  - media: siano: Fix error handling in smsdvb_module_init() (Yuan Can)
  - media: vim2m: print device name after registering device (Matthew Majewski)
  - media: venus: hfi: add check to handle incorrect queue size (Vikash Garodia)
  - media: venus: hfi: add a check to handle OOB in sfr region (Vikash Garodia)
  - media: intel/ipu6: set the dev_parent of video device to pdev (Bingbu Cao)
  - media: mgb4: Fix switched CMT frequency range "magic values" sets (Martin Tůma)
  - media: i2c: adv748x: Fix test pattern selection mask (Niklas Söderlund)
  - media: mgb4: Fix CMT registers update logic (Martin Tůma)
  - media: uapi: rkisp1-config: Fix typo in extensible params example (Niklas Söderlund)
  - media: mtk-vcodec: venc: avoid -Wenum-compare-conditional warning (Arnd Bergmann)
  - media: mediatek: vcodec: Fix a resource leak related to the scp device in FW initialization (Jiasheng Jiang)
  - dt-bindings: media: st,stmipid02: correct lane-polarities maxItems (Alain Volmat)
  - auxdisplay: hd44780: Fix an API misuse in hd44780.c (Haoxiang Li)
  - HID: pidff: Fix set_device_control() (Tomasz Pakuła)
  - HID: pidff: Fix 90 degrees direction name North -> East (Tomasz Pakuła)
  - HID: pidff: Compute INFINITE value instead of using hardcoded 0xffff (Tomasz Pakuła)
  - HID: pidff: Clamp effect playback LOOP_COUNT value (Tomasz Pakuła)
  - HID: pidff: Rename two functions to align them with naming convention (Tomasz Pakuła)
  - HID: pidff: Remove redundant call to pidff_find_special_keys (Tomasz Pakuła)
  - HID: pidff: Support device error response from PID_BLOCK_LOAD (Tomasz Pakuła)
  - HID: pidff: Comment and code style update (Tomasz Pakuła)
  - HID: hid-universal-pidff: Add Asetek wheelbases support (Tomasz Pakuła)
  - HID: pidff: Make sure to fetch pool before checking SIMULTANEOUS_MAX (Tomasz Pakuła)
  - HID: pidff: Factor out pool report fetch and remove excess declaration (Tomasz Pakuła)
  - HID: pidff: Use macros instead of hardcoded min/max values for shorts (Tomasz Pakuła)
  - HID: pidff: Simplify pidff_rescale_signed (Tomasz Pakuła)
  - HID: pidff: Move all hid-pidff definitions to a dedicated header (Tomasz Pakuła)
  - HID: pidff: Factor out code for setting gain (Tomasz Pakuła)
  - HID: pidff: Rescale time values to match field units (Tomasz Pakuła)
  - HID: pidff: Define values used in pidff_find_special_fields (Tomasz Pakuła)
  - HID: pidff: Simplify pidff_upload_effect function (Tomasz Pakuła)
  - HID: pidff: Completely rework and fix pidff_reset function (Tomasz Pakuła)
  - HID: pidff: Stop all effects before enabling actuators (Tomasz Pakuła)
  - HID: pidff: Clamp PERIODIC effect period to device's logical range (Tomasz Pakuła)
  - s390/pci: Fix s390_mmio_read/write syscall page fault handling (Niklas Schnelle)
  - ext4: don't treat fhandle lookup of ea_inode as FS corruption (Jann Horn)
  - bpf: support SKF_NET_OFF and SKF_LL_OFF on skb frags (Willem de Bruijn)
  - erofs: set error to bio if file-backed IO fails (Sheng Yong)
  - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Uwe Kleine-König)
  - pwm: rcar: Improve register calculation (Uwe Kleine-König)
  - pwm: mediatek: Prevent divide-by-zero in pwm_mediatek_config() (Josh Poimboeuf)
  - tpm: End any active auth session before shutdown (Jonathan McDowell)
  - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Jonathan McDowell)
  - ktest: Fix Test Failures Due to Missing LOG_FILE Directories (Ayush Jain)
  - tracing: probe-events: Add comments about entry data storing code (Masami Hiramatsu (Google))
  - fbdev: omapfb: Add 'plane' value check (Leonid Arapov)
  - drm/amdgpu: grab an additional reference on the gang fence v2 (Christian König)
  - drm/amdgpu: Fix the race condition for draining retry fault (Emily Deng)
  - PCI: Enable Configuration RRS SV early (Bjorn Helgaas)
  - drm/amdgpu: handle amdgpu_cgs_create_device() errors in amd_powerplay_create() (Wentao Liang)
  - PCI: Add Rockchip Vendor ID (Shawn Lin)
  - drm/mediatek: mtk_dpi: Explicitly manage TVD clock in power on/off (AngeloGioacchino Del Regno)
  - drm/mediatek: mtk_dpi: Move the input_2p_en bit to platform data (AngeloGioacchino Del Regno)
  - drm/xe/xelp: Move Wa_16011163337 from tunings to workarounds (Tvrtko Ursulin)
  - drm/amdkfd: debugfs hang_hws skip GPU with MES (Philip Yang)
  - drm/amdkfd: Fix pqm_destroy_queue race with GPU reset (Philip Yang)
  - drm/amdkfd: Fix mode1 reset crash issue (Philip Yang)
  - drm/amdkfd: clamp queue size to minimum (David Yat Sin)
  - drivers: base: devres: Allow to release group on device release (Lucas De Marchi)
  - drm/amd/display: stop DML2 from removing pipes based on planes (Mike Katsnelson)
  - drm/bridge: panel: forbid initializing a panel with unknown connector type (Luca Ceresoli)
  - drm/debugfs: fix printk format for bridge index (Luca Ceresoli)
  - drm: panel-orientation-quirks: Add quirk for OneXPlayer Mini (Intel) (Andrew Wyatt)
  - drm: panel-orientation-quirks: Add new quirk for GPD Win 2 (Andrew Wyatt)
  - drm: panel-orientation-quirks: Add quirk for AYA NEO Slide (Andrew Wyatt)
  - drm: panel-orientation-quirks: Add quirks for AYA NEO Flip DS and KB (Andrew Wyatt)
  - drm: panel-orientation-quirks: Add support for AYANEO 2S (Andrew Wyatt)
  - drm/amdgpu: Unlocked unmap only clear page table leaves (Philip Yang)
  - drm/amd/display: Update Cursor request mode to the beginning prefetch always (Zhikai Zhai)
  - drm/xe/vf: Don't try to trigger a full GT reset if VF (Michal Wajdeczko)
  - drm/xe/bmg: Add new PCI IDs (Shekhar Chauhan)
  - drm: allow encoder mode_set even when connectors change for crtc (Abhinav Kumar)
  - Bluetooth: Add quirk for broken READ_PAGE_SCAN_TYPE (Pedro Nishiyama)
  - Bluetooth: Add quirk for broken READ_VOICE_SETTING (Pedro Nishiyama)
  - Bluetooth: qca: simplify WCN399x NVM loading (Dmitry Baryshkov)
  - Bluetooth: hci_qca: use the power sequencer for wcn6750 (Janaki Ramaiah Thota)
  - Bluetooth: btusb: Add 2 HWIDs for MT7922 (Jiande Lu)
  - Bluetooth: hci_uart: fix race during initialization (Arseniy Krasnov)
  - Bluetooth: btintel_pcie: Add device id of Whale Peak (Kiran K)
  - tracing: fix return value in __ftrace_event_enable_disable for TRACE_REG_UNREGISTER (Gabriele Paoloni)
  - net: vlan: don't propagate flags on open (Stanislav Fomichev)
  - wifi: mt76: mt76x2u: add TP-Link TL-WDN6200 ID to device table (Icenowy Zheng)
  - btrfs: harden block_group::bg_list against list_del() races (Boris Burkov)
  - ahci: Marvell 88SE9215 controllers prefer DMA for ATAPI (Huacai Chen)
  - scsi: st: Fix array overflow in st_setup() (Kai Mäkisara)
  - cdc_ether|r8152: ThinkPad Hybrid USB-C/A Dock quirk (Philipp Hahn)
  - ext4: ignore xattrs past end (Bhupesh)
  - Revert "f2fs: rebuild nat_bits during umount" (Chao Yu)
  - ext4: protect ext4_release_dquot against freezing (Ojaswin Mujoo)
  - ahci: add PCI ID for Marvell 88SE9215 SATA Controller (Daniel Kral)
  - net: sfp: add quirk for FS SFP-10GM-T copper SFP+ module (Martin Schiller)
  - f2fs: fix to avoid out-of-bounds access in f2fs_truncate_inode_blocks() (Chao Yu)
  - wifi: ath12k: Fix invalid data access in ath12k_dp_rx_h_undecap_nwifi (Manish Dharanenthiran)
  - net: sfp: add quirk for 2.5G OEM BX SFP (Birger Koblitz)
  - ata: libata-eh: Do not use ATAPI DMA for a device limited to PIO mode (Niklas Cassel)
  - jfs: add sanity check for agwidth in dbMount (Edward Adam Davis)
  - jfs: Prevent copying of nlink with value 0 from disk inode (Edward Adam Davis)
  - fs/jfs: Prevent integer overflow in AG size calculation (Rand Deeb)
  - fs/jfs: cast inactags to s64 to prevent potential overflow (Rand Deeb)
  - jfs: Fix uninit-value access of imap allocated in the diMount() function (Zhongqiu Han)
  - can: flexcan: add NXP S32G2/S32G3 SoC support (Ciprian Marian Costea)
  - can: flexcan: Add quirk to handle separate interrupt lines for mailboxes (Ciprian Marian Costea)
  - page_pool: avoid infinite loop to schedule delayed worker (Jason Xing)
  - net: usb: asix_devices: add FiberGecko DeviceID (Max Schulze)
  - scsi: target: spc: Fix RSOC parameter data header size (Chaohai Chen)
  - wifi: mac80211: ensure sdata->work is canceled before initialized. (Miri Korenblit)
  - wifi: mac80211: add strict mode disabling workarounds (Johannes Berg)
  - f2fs: don't retry IO for corrupted data scenario (Chao Yu)
  - net: page_pool: don't cast mp param to devmem (Pavel Begunkov)
  - ata: libata-core: Add 'external' to the libata.force kernel parameter (Niklas Cassel)
  - wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process (P Praneesh)
  - wifi: ath12k: fix memory leak in ath12k_pci_remove() (Miaoqing Pan)
  - wifi: ath11k: fix memory leak in ath11k_xxx_remove() (Miaoqing Pan)
  - wifi: ath11k: Fix DMA buffer allocation to resolve SWIOTLB issues (P Praneesh)
  - platform/x86: x86-android-tablets: Add select POWER_SUPPLY to Kconfig (Hans de Goede)
  - ASoC: amd: yc: update quirk data for new Lenovo model (Syed Saba kareem)
  - ASoC: amd: Add DMI quirk for ACP6X mic support (keenplify)
  - ALSA: usb-audio: Fix CME quirk for UF series keyboards (Ricard Wanderlof)
  - mmc: dw_mmc: add a quirk for accessing 64-bit FIFOs in two halves (Kaustabh Chakraborty)
  - media: s5p-mfc: Corrected NV12M/NV21M plane-sizes (Aakarsh Jain)
  - media: uvcvideo: Add quirk for Actions UVC05 (Ricardo Ribalda)
  - ASoC: fsl_audmix: register card device depends on 'dais' property (Shengjiu Wang)
  - ALSA: hda: intel: Add Lenovo IdeaPad Z570 to probe denylist (Maxim Mikityanskiy)
  - ALSA: hda: intel: Fix Optimus when GPU has no sound (Maxim Mikityanskiy)
  - ASoC: amd: ps: use macro for ACP6.3 pci revision id (Vijendar Mukunda)
  - HID: pidff: Fix null pointer dereference in pidff_find_fields (Tomasz Pakuła)
  - HID: pidff: Add PERIODIC_SINE_ONLY quirk (Tomasz Pakuła)
  - HID: Add hid-universal-pidff driver and supported device ids (Tomasz Pakuła)
  - HID: pidff: Add FIX_WHEEL_DIRECTION quirk (Tomasz Pakuła)
  - HID: pidff: Add hid_pidff_init_with_quirks and export as GPL symbol (Tomasz Pakuła)
  - HID: pidff: Add PERMISSIVE_CONTROL quirk (Tomasz Pakuła)
  - HID: pidff: Add MISSING_PBO quirk and its detection (Tomasz Pakuła)
  - HID: pidff: Add MISSING_DELAY quirk and its detection (Tomasz Pakuła)
  - HID: pidff: Do not send effect envelope if it's empty (Tomasz Pakuła)
  - HID: pidff: Convert infinite length from Linux API to PID standard (Tomasz Pakuła)
  - ASoC: SOF: topology: Use krealloc_array() to replace krealloc() (Zhang Heng)
  - platform/chrome: cros_ec_lpc: Match on Framework ACPI device (Daniel Schaefer)
  - zstd: Increase DYNAMIC_BMI2 GCC version cutoff from 4.8 to 11.0 to work around compiler segfault (Ingo Molnar)
  - xen/mcelog: Add __nonstring annotations for unterminated strings (Kees Cook)
  - arm64: cputype: Add QCOM_CPU_PART_KRYO_3XX_GOLD (Douglas Anderson)
  - Flush console log from kernel_power_off() (Paul E. McKenney)
  - PM: hibernate: Avoid deadlock in hibernate_compressor_param_set() (Lizhi Xu)
  - perf/dwc_pcie: fix some unreleased resources (Yunhui Cui)
  - perf: arm_pmu: Don't disable counter in armpmu_add() (Mark Rutland)
  - x86/cpu: Don't clear X86_FEATURE_LAHF_LM flag in init_amd_k8() on AMD when running in a virtual machine (Max Grobecker)
  - x86/ia32: Leave NULL selector values 0~3 unchanged (Xin Li (Intel))
  - x86/percpu: Disable named address spaces for UBSAN_BOOL with KASAN for GCC < 14.2 (Uros Bizjak)
  - x86/mm: Clear _PAGE_DIRTY for kernel mappings when we clear _PAGE_RW (Matthew Wilcox (Oracle))
  - pm: cpupower: bench: Prevent NULL dereference on malloc failure (Zhongqiu Han)
  - umount: Allow superblock owners to force umount (Trond Myklebust)
  - fs: consistently deref the files table with rcu_dereference_raw() (Mateusz Guzik)
  - iommu/mediatek: Fix NULL pointer deference in mtk_iommu_device_group (Louis-Alexis Eyraud)
  - iommu/exynos: Fix suspend/resume with IDENTITY domain (Marek Szyprowski)
  - nft_set_pipapo: fix incorrect avx2 match of 5th field octet (Florian Westphal)
  - net: ppp: Add bound checking for skb data on ppp_sync_txmung (Arnaud Lecomte)
  - ipv6: Align behavior across nexthops during path selection (Ido Schimmel)
  - net: phy: allow MDIO bus PM ops to start/stop state machine for phylink-controlled PHY (Vladimir Oltean)
  - net: phy: move phy_link_change() prior to mdio_bus_phy_may_suspend() (Vladimir Oltean)
  - smb: client: fix UAF in decryption with multichannel (Paulo Alcantara)
  - net_sched: sch_sfq: move the limit validation (Octavian Purdila)
  - net_sched: sch_sfq: use a temporary work area for validating configuration (Octavian Purdila)
  - nvmet-fcloop: swap list_add_tail arguments (Daniel Wagner)
  - drm/i915/huc: Fix fence not released on early probe errors (Janusz Krzysztofik)
  - ata: sata_sx4: Add error handling in pdc20621_i2c_read() (Wentao Liang)
  - net: libwx: handle page_pool_dev_alloc_pages error (Chenyuan Yang)
  - drm/tests: probe-helper: Fix drm_display_mode memory leak (Maxime Ripard)
  - drm/tests: modes: Fix drm_display_mode memory leak (Maxime Ripard)
  - drm/tests: cmdline: Fix drm_display_mode memory leak (Maxime Ripard)
  - drm/tests: helpers: Create kunit helper to destroy a drm_display_mode (Maxime Ripard)
  - drm/tests: modeset: Fix drm_display_mode memory leak (Maxime Ripard)
  - net: ethtool: Don't call .cleanup_data when prepare_data fails (Maxime Chevallier)
  - tc: Ensure we have enough buffer space when sending filter netlink notifications (Toke Høiland-Jørgensen)
  - octeontx2-pf: qos: fix VF root node parent queue index (Hariprasad Kelam)
  - net: tls: explicitly disallow disconnect (Jakub Kicinski)
  - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Cong Wang)
  - tipc: fix memory leak in tipc_link_xmit (Tung Nguyen)
  - objtool: Fix INSN_CONTEXT_SWITCH handling in validate_unret() (Josh Poimboeuf)
  - ata: pata_pxa: Fix potential NULL pointer dereference in pxa_ata_probe() (Henry Martin)
  - drm/xe/hw_engine: define sysfs_ops on all directories (Tejas Upadhyay)
  - x86/acpi: Don't limit CPUs to 1 for Xen PV guests due to disabled ACPI (Petr Vaněk)
  - drm/i915: Disable RPG during live selftest (Badal Nilawar)
  - ublk: fix handling recovery & reissue in ublk_abort_queue() (Ming Lei)
  - ublk: refactor recovery configuration flag helpers (Uday Shankar)
  - selftests/futex: futex_waitv wouldblock test should fail (Edward Liaw)
  - gpiolib: of: Fix the choice for Ingenic NAND quirk (Andy Shevchenko)
  - cgroup/cpuset: Further optimize code if CONFIG_CPUSETS_V1 not set (Waiman Long)
  - cgroup/cpuset: Enforce at most one rebuild_sched_domains_locked() call per operation (Waiman Long)
  - cgroup/cpuset: Revert "Allow suppression of sched domain rebuild in update_cpumasks_hier()" (Waiman Long)
  - cgroup/cpuset: Fix error handling in remote_partition_disable() (Waiman Long)
  - cgroup/cpuset: Fix incorrect isolated_cpus update in update_parent_effective_cpumask() (Waiman Long)
  - ASoC: Intel: adl: add 2xrt1316 audio configuration (Bard Liao)


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-2.27.2.el9uek]
changelog:
  - LTS version: v6.12.27 (Jack Vogel)
  - bpf: Fix BPF_INTERNAL namespace import (Xi Ruoyao)
  - LTS version: v6.12.26 (Jack Vogel)
  - mq-deadline: don't call req_get_ioprio from the I/O completion handler (Christoph Hellwig)
  - arm64: dts: ti: k3-j784s4-j742s2-main-common: Correct the GICD size (Keerthy)
  - crypto: Kconfig - Select LIB generic option (Herbert Xu)
  - usb: typec: class: Unlocked on error in typec_register_partner() (Dan Carpenter)
  - objtool: Silence more KCOV warnings, part 2 (Josh Poimboeuf)
  - objtool: Ignore end-of-section jumps for KCOV/GCOV (Josh Poimboeuf)
  - usb: xhci: Fix Short Packet handling rework ignoring errors (Michal Pecio)
  - nvme: fixup scan failure for non-ANA multipath controllers (Hannes Reinecke)
  - MIPS: cm: Fix warning if MIPS_CM is disabled (Thomas Bogendoerfer)
  - media: i2c: imx214: Fix uninitialized variable in imx214_set_ctrl() (Dan Carpenter)
  - crypto: lib/Kconfig - Hide arch options from user (Herbert Xu)
  - iommu: Handle race with default domain setup (Robin Murphy)
  - net: dsa: mv88e6xxx: enable STU methods for 6320 family (Marek Behún)
  - net: dsa: mv88e6xxx: enable .port_set_policy() for 6320 family (Marek Behún)
  - net: dsa: mv88e6xxx: enable PVT for 6321 switch (Marek Behún)
  - net: dsa: mv88e6xxx: fix atu_move_port_mask for 6341 family (Marek Behún)
  - Revert "net: dsa: mv88e6xxx: fix internal PHYs for 6320 family" (Marek Behún)
  - usb: typec: class: Invalidate USB device pointers on partner unregistration (Andrei Kuchynski)
  - ext4: goto right label 'out_mmap_sem' in ext4_setattr() (Baokun Li)
  - comedi: jr3_pci: Fix synchronous deletion of timer (Ian Abbott)
  - vmxnet3: Fix malformed packet sizing in vmxnet3_process_xdp (Daniel Borkmann)
  - usb: typec: class: Fix NULL pointer access (Andrei Kuchynski)
  - selftests/bpf: Adjust data size to have ETH_HLEN (Shigeru Yoshida)
  - selftests/bpf: check program redirect in xdp_cpumap_attach (Alexis Lothoré (eBPF Foundation))
  - selftests/bpf: make xdp_cpumap_attach keep redirect prog attached (Alexis Lothoré (eBPF Foundation))
  - selftests/bpf: fix bpf_map_redirect call for cpu map test (Alexis Lothoré (eBPF Foundation))
  - xfs: flush inodegc before swapon (Christoph Hellwig)
  - xfs: rename xfs_iomap_swapfile_activate to xfs_vm_swap_activate (Christoph Hellwig)
  - xfs: Do not allow norecovery mount with quotacheck (Carlos Maiolino)
  - xfs: do not check NEEDSREPAIR if ro,norecovery mount. (Lukas Herbolt)
  - driver core: fix potential NULL pointer dereference in dev_uevent() (Dmitry Torokhov)
  - driver core: introduce device_set_driver() helper (Dmitry Torokhov)
  - Revert "drivers: core: synchronize really_probe() and dev_uevent()" (Dmitry Torokhov)
  - spi: spi-imx: Add check for spi_imx_setupxfer() (Tamura Dai)
  - drm/amdgpu: Use the right function for hdp flush (Lijo Lazar)
  - drm/amdgpu: use a dummy owner for sysfs triggered cleaner shaders v4 (Christian König)
  - md/raid1: Add check for missing source disk in process_checks() (Meir Elisha)
  - x86/cpu: Add CPU model number for Bartlett Lake CPUs with Raptor Cove cores (Pi Xiange)
  - ubsan: Fix panic from test_ubsan_out_of_bounds (Mostafa Saleh)
  - spi: tegra210-quad: add rate limiting and simplify timeout error message (Breno Leitao)
  - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Breno Leitao)
  - ksmbd: fix WARNING "do not call blocking ops when !TASK_RUNNING" (Namjae Jeon)
  - riscv: Provide all alternative macros all the time (Andrew Jones)
  - iomap: skip unnecessary ifs_block_is_uptodate check (Gou Hao)
  - netfs: Only create /proc/fs/netfs with CONFIG_PROC_FS (Song Liu)
  - x86/i8253: Call clockevent_i8253_disable() with interrupts disabled (Fernando Fernandez Mancera)
  - ASoC: fsl_asrc_dma: get codec or cpu dai from backend (Shengjiu Wang)
  - scsi: pm80xx: Set phy_attached to zero when device is gone (Igor Pylypiv)
  - scsi: ufs: exynos: gs101: Put UFS device in reset on .suspend() (Peter Griffin)
  - scsi: ufs: exynos: Move phy calls to .exit() callback (Peter Griffin)
  - scsi: ufs: exynos: Enable PRDT pre-fetching with UFSHCD_CAP_CRYPTO (Peter Griffin)
  - scsi: ufs: exynos: Ensure pre_link() executes before exynos_ufs_phy_init() (Peter Griffin)
  - scsi: hisi_sas: Fix I/O errors caused by hardware port ID changes (Xingui Yang)
  - ext4: make block validity check resistent to sb bh corruption (Ojaswin Mujoo)
  - iommu: Clear iommu-dma ops on cleanup (Robin Murphy)
  - cifs: Fix querying of WSL CHR and BLK reparse points over SMB1 (Pali Rohár)
  - timekeeping: Add a lockdep override in tick_freeze() (Sebastian Andrzej Siewior)
  - cifs: Fix encoding of SMB1 Session Setup Kerberos Request in non-UNICODE mode (Pali Rohár)
  - nvmet-fc: put ref when assoc->del_work is already scheduled (Daniel Wagner)
  - nvmet-fc: take tgtport reference only once (Daniel Wagner)
  - x86/bugs: Don't fill RSB on context switch with eIBRS (Josh Poimboeuf)
  - x86/bugs: Don't fill RSB on VMEXIT with eIBRS+retpoline (Josh Poimboeuf)
  - x86/bugs: Use SBPB in write_ibpb() if applicable (Josh Poimboeuf)
  - selftests/mincore: Allow read-ahead pages to reach the end of the file (Qiuxu Zhuo)
  - x86/xen: disable CPU idle and frequency drivers for PVH dom0 (Roger Pau Monne)
  - gpiolib: of: Move Atmel HSMCI quirk up out of the regulator comment (Andy Shevchenko)
  - objtool: Stop UNRET validation on UD2 (Josh Poimboeuf)
  - nvme: multipath: fix return value of nvme_available_path (Uday Shankar)
  - nvme: re-read ANA log page after ns scan completes (Hannes Reinecke)
  - drm/xe/xe3lpg: Apply Wa_14022293748, Wa_22019794406 (Julia Filipchuk)
  - drm/amdgpu: Increase KIQ invalidate_tlbs timeout (Jay Cornwall)
  - ACPI PPTT: Fix coding mistakes in a couple of sizeof() calls (Jean-Marc Eurin)
  - ACPI: EC: Set ec_no_wakeup for Lenovo Go S (Mario Limonciello)
  - nvme: requeue namespace scan on missed AENs (Hannes Reinecke)
  - xen: Change xen-acpi-processor dom0 dependency (Jason Andryuk)
  - perf/core: Fix WARN_ON(!ctx) in __free_event() for partial init (Gabriel Shahrouzi)
  - selftests: ublk: fix test_stripe_04 (Ming Lei)
  - cgroup/cpuset: Don't allow creation of local partition over a remote one (Waiman Long)
  - KVM: s390: Don't use %pK through debug printing (Thomas Weißschuh)
  - KVM: s390: Don't use %pK through tracepoints (Thomas Weißschuh)
  - sched/isolation: Make CONFIG_CPU_ISOLATION depend on CONFIG_SMP (Oleg Nesterov)
  - kbuild: add dependency from vmlinux to sorttable (Xi Ruoyao)
  - io_uring: always do atomic put from iowq (Pavel Begunkov)
  - rtc: pcf85063: do a SW reset if POR failed (Lukas Stockmann)
  - 9p/trans_fd: mark concurrent read and writes to p9_conn->err (Ignacio Encinas)
  - 9p/net: fix improper handling of bogus negative read/write replies (Dominique Martinet)
  - ntb_hw_amd: Add NTB PCI ID for new gen CPU (Basavaraj Natikar)
  - ntb: reduce stack usage in idt_scan_mws (Arnd Bergmann)
  - qibfs: fix _another_ leak (Al Viro)
  - objtool, lkdtm: Obfuscate the do_nothing() pointer (Josh Poimboeuf)
  - objtool, regulator: rk808: Remove potential undefined behavior in rk806_set_mode_dcdc() (Josh Poimboeuf)
  - objtool, ASoC: codecs: wcd934x: Remove potential undefined behavior in wcd934x_slim_irq_handler() (Josh Poimboeuf)
  - objtool, panic: Disable SMAP in __stack_chk_fail() (Josh Poimboeuf)
  - objtool: Silence more KCOV warnings (Josh Poimboeuf)
  - um: work around sched_yield not yielding in time-travel mode (Benjamin Berg)
  - thunderbolt: Scan retimers after device router has been enumerated (Mika Westerberg)
  - usb: host: xhci-plat: mvebu: use ->quirks instead of ->init_quirk() func (Théo Lebrun)
  - usb: gadget: aspeed: Add NULL pointer check in ast_vhub_init_dev() (Chenyuan Yang)
  - phy: rockchip: usbdp: Avoid call hpd_event_trigger in dp_phy_init (Andy Yan)
  - usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running (Michal Pecio)
  - dmaengine: dmatest: Fix dmatest waiting less when interrupted (Vinicius Costa Gomes)
  - i3c: master: svc: Add support for Nuvoton npcm845 i3c (Stanley Chu)
  - xhci: Handle spurious events on Etron host isoc enpoints (Mathias Nyman)
  - usb: xhci: Fix isochronous Ring Underrun/Overrun event handling (Michal Pecio)
  - usb: xhci: Complete 'error mid TD' transfers when handling Missed Service (Michal Pecio)
  - sound/virtio: Fix cancel_sync warnings on uninitialized work_structs (John Stultz)
  - usb: dwc3: gadget: Avoid using reserved endpoints on Intel Merrifield (Andy Shevchenko)
  - usb: dwc3: gadget: Refactor loop to avoid NULL endpoints (Andy Shevchenko)
  - fs/ntfs3: Fix WARNING in ntfs_extend_initialized_size (Edward Adam Davis)
  - fs/ntfs3: Keep write operations atomic (Lizhi Xu)
  - usb: host: max3421-hcd: Add missing spi_device_id table (Alexander Stein)
  - mailbox: pcc: Always clear the platform ack interrupt first (Sudeep Holla)
  - mailbox: pcc: Fix the possible race in updation of chan_in_use flag (Huisong Li)
  - bpf: Reject attaching fexit/fmod_ret to __noreturn functions (Yafang Shao)
  - bpf: Only fails the busy counter check in bpf_cgrp_storage_get if it creates storage (Martin KaFai Lau)
  - bpf: bpftool: Setting error code in do_loader() (Sewon Nam)
  - s390/tty: Fix a potential memory leak bug (Haoxiang Li)
  - s390/sclp: Add check for get_zeroed_page() (Haoxiang Li)
  - parisc: PDT: Fix missing prototype warning (Yu-Chun Lin)
  - clk: check for disabled clock-provider in of_clk_get_hw_from_clkspec() (Heiko Stuebner)
  - bpf: Fix deadlock between rcu_tasks_trace and event_mutex. (Alexei Starovoitov)
  - bpf: Fix kmemleak warning for percpu hashmap (Yonghong Song)
  - crypto: null - Use spin lock instead of mutex (Herbert Xu)
  - crypto: lib/Kconfig - Fix lib built-in failure when arch is modular (Herbert Xu)
  - crypto: ccp - Add support for PCI device 0x1134 (Devaraj Rangasamy)
  - MIPS: cm: Detect CM quirks from device tree (Gregory CLEMENT)
  - pinctrl: mcp23s08: Get rid of spurious level interrupts (Dmitry Mastykin)
  - pinctrl: renesas: rza2: Fix potential NULL pointer dereference (Chenyuan Yang)
  - selftests/bpf: Fix stdout race condition in traffic monitor (Amery Hung)
  - USB: wdm: add annotation (Oliver Neukum)
  - USB: wdm: wdm_wwan_port_tx_complete mutex in atomic context (Oliver Neukum)
  - USB: wdm: close race between wdm_open and wdm_wwan_port_stop (Oliver Neukum)
  - USB: wdm: handle IO errors in wdm_wwan_port_start (Oliver Neukum)
  - USB: VLI disk crashes if LPM is used (Oliver Neukum)
  - usb: quirks: Add delay init quirk for SanDisk 3.2Gen1 Flash Drive (Miao Li)
  - usb: quirks: add DELAY_INIT quirk for Silicon Motion Flash Drive (Miao Li)
  - usb: dwc3: xilinx: Prevent spike in reset signal (Mike Looijmans)
  - usb: dwc3: gadget: check that event count does not exceed event buffer length (Frode Isaksen)
  - USB: OHCI: Add quirk for LS7A OHCI controller (rev 0x02) (Huacai Chen)
  - usb: chipidea: ci_hdrc_imx: implement usb_phy_init() error handling (Fedor Pchelkin)
  - usb: chipidea: ci_hdrc_imx: fix call balance of regulator routines (Fedor Pchelkin)
  - usb: chipidea: ci_hdrc_imx: fix usbmisc handling (Fedor Pchelkin)
  - usb: cdns3: Fix deadlock when using NCM gadget (Ralph Siemsen)
  - usb: xhci: Fix invalid pointer dereference in Etron workaround (Michal Pecio)
  - xhci: Limit time spent with xHC interrupts disabled during bus resume (Mathias Nyman)
  - USB: serial: simple: add OWON HDS200 series oscilloscope support (Craig Hesling)
  - USB: serial: option: add Sierra Wireless EM9291 (Adam Xue)
  - USB: serial: ftdi_sio: add support for Abacus Electrics Optical Probe (Michael Ehrenreich)
  - serial: sifive: lock port in startup()/shutdown() callbacks (Ryo Takakura)
  - serial: msm: Configure correct working mode before starting earlycon (Stephan Gerhold)
  - tty: Require CAP_SYS_ADMIN for all usages of TIOCL_SELMOUSEREPORT (Günther Noack)
  - firmware: stratix10-svc: Add of_platform_default_populate() (Mahesh Rao)
  - misc: microchip: pci1xxxx: Fix incorrect IRQ status handling during ack (Rengarajan S)
  - misc: microchip: pci1xxxx: Fix Kernel panic during IRQ handler registration (Rengarajan S)
  - char: misc: register chrdev region with all possible minors (Thadeu Lima de Souza Cascardo)
  - KVM: x86: Take irqfds.lock when adding/deleting IRQ bypass producer (Sean Christopherson)
  - KVM: x86: Reset IRTE to host control if *new* route isn't postable (Sean Christopherson)
  - KVM: x86: Explicitly treat routing entry type changes as changes (Sean Christopherson)
  - mei: vsc: Fix fortify-panic caused by invalid counted_by() use (Hans de Goede)
  - mei: me: add panther lake H DID (Alexander Usyskin)
  - scsi: Improve CDL control (Damien Le Moal)
  - USB: storage: quirk for ADATA Portable HDD CH94 (Oliver Neukum)
  - ata: libata-scsi: Fix ata_msense_control_ata_feature() (Damien Le Moal)
  - ata: libata-scsi: Fix ata_mselect_control_ata_feature() return type (Damien Le Moal)
  - ata: libata-scsi: Improve CDL control (Damien Le Moal)
  - mcb: fix a double free bug in chameleon_parse_gdd() (Haoxiang Li)
  - cxl/core/regs.c: Skip Memory Space Enable check for RCD and RCH Ports (Smita Koralahalli)
  - KVM: SVM: Allocate IR data using atomic allocation (Sean Christopherson)
  - io_uring: fix 'sync' handling of io_fallback_tw() (Jens Axboe)
  - LoongArch: KVM: Fix PMU pass-through issue if VM exits to host finally (Bibo Mao)
  - LoongArch: KVM: Fully clear some CSRs when VM reboot (Bibo Mao)
  - LoongArch: Remove a bogus reference to ZONE_DMA (Petr Tesarik)
  - LoongArch: Return NULL from huge_pte_offset() for invalid PMD (Ming Wang)
  - LoongArch: Handle fp, lsx, lasx and lbt assembly symbols (Tiezhu Yang)
  - irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode() (Suzuki K Poulose)
  - x86/insn: Fix CTEST instruction decoding (Kirill A. Shutemov)
  - drm/amd/display: Force full update in gpu reset (Roman Li)
  - drm/amd/display: Fix gpu reset in multidisplay config (Roman Li)
  - drm: panel: jd9365da: fix reset signal polarity in unprepare (Hugo Villeneuve)
  - rust: firmware: Use `ffi::c_char` type in `FwFunc` (Christian Schrefl)
  - net: phy: microchip: force IRQ polling mode for lan88xx (Fiona Klute)
  - net: selftests: initialize TCP header and skb payload with zero (Oleksij Rempel)
  - xen-netfront: handle NULL returned by xdp_convert_buff_to_frame() (Alexey Nepomnyashih)
  - crypto: atmel-sha204a - Set hwrng quality to lowest possible (Marek Behún)
  - sched_ext: Use kvzalloc for large exit_dump allocation (Breno Leitao)
  - virtio_console: fix missing byte order handling for cols and rows (Halil Pasic)
  - netfilter: fib: avoid lookup if socket is available (Florian Westphal)
  - LoongArch: Make do_xyz() exception handlers more robust (Tiezhu Yang)
  - LoongArch: Make regs_irqs_disabled() more clear (Tiezhu Yang)
  - LoongArch: Select ARCH_USE_MEMTEST (Yuli Wang)
  - perf/x86: Fix non-sampling (counting) events on certain x86 platforms (Luo Gengkun)
  - bpf: Add namespace to BPF internal symbols (Alexei Starovoitov)
  - splice: remove duplicate noinline from pipe_clear_nowait (T.J. Mercier)
  - riscv: uprobes: Add missing fence.i after building the XOL buffer (Björn Töpel)
  - riscv: Replace function-like macro by static inline function (Björn Töpel)
  - iommu/amd: Return an error if vCPU affinity is set for non-vCPU IRTE (Sean Christopherson)
  - block: never reduce ra_pages in blk_apply_bdi_limits (Christoph Hellwig)
  - pds_core: make wait_context part of q_info (Shannon Nelson)
  - pds_core: Remove unnecessary check in pds_client_adminq_cmd() (Brett Creeley)
  - pds_core: handle unsupported PDS_CORE_CMD_FW_CONTROL result (Brett Creeley)
  - pds_core: Prevent possible adminq overflow/stuck condition (Brett Creeley)
  - net: dsa: mt7530: sync driver-specific behavior of MT7531 variants (Daniel Golle)
  - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (Cong Wang)
  - net_sched: hfsc: Fix a UAF vulnerability in class handling (Cong Wang)
  - fix a couple of races in MNT_TREE_BENEATH handling by do_move_mount() (Al Viro)
  - net: ethernet: mtk_eth_soc: net: revise NETSYSv3 hardware configuration (Bo-Cun Chen)
  - tipc: fix NULL pointer dereference in tipc_mon_reinit_self() (Tung Nguyen)
  - net: phy: leds: fix memory leak (Qingfang Deng)
  - net: lwtunnel: disable BHs when required (Justin Iurman)
  - scsi: ufs: core: Add NULL check in ufshcd_mcq_compl_pending_transfer() (Chenyuan Yang)
  - scsi: core: Clear flags for scsi_cmnd that did not complete (Anastasia Kovaleva)
  - net/mlx5: Move ttc allocation after switch case to prevent leaks (Henry Martin)
  - net/mlx5: Fix null-ptr-deref in mlx5_create_{inner_,}ttc_table() (Henry Martin)
  - cgroup/cpuset-v1: Add missing support for cpuset_v2_mode (T.J. Mercier)
  - btrfs: zoned: return EIO on RAID1 block group write pointer mismatch (Johannes Thumshirn)
  - btrfs: avoid page_lockend underflow in btrfs_punch_hole_lock_range() (Qu Wenruo)
  - cpufreq: fix compile-test defaults (Johan Hovold)
  - cpufreq: Do not enable by default during compile testing (Krzysztof Kozlowski)
  - cpufreq: cppc: Fix invalid return value in .get() callback (Marc Zyngier)
  - scsi: ufs: mcq: Add NULL check in ufshcd_mcq_abort() (Chenyuan Yang)
  - cpufreq: scpi: Fix null-ptr-deref in scpi_cpufreq_get_rate() (Henry Martin)
  - cpufreq: scmi: Fix null-ptr-deref in scmi_cpufreq_get_rate() (Henry Martin)
  - cpufreq: apple-soc: Fix null-ptr-deref in apple_soc_cpufreq_get_rate() (Henry Martin)
  - dma/contiguous: avoid warning about unused size_bytes (Arnd Bergmann)
  - cpufreq: sun50i: prevent out-of-bounds access (Andre Przywara)
  - ceph: Fix incorrect flush end position calculation (David Howells)
  - lib/Kconfig.ubsan: Remove 'default UBSAN' from UBSAN_INTEGER_WRAP (Nathan Chancellor)
  - drm/amd/display/dml2: use vzalloc rather than kzalloc (Alex Deucher)
  - drm/amd/display: Fix unnecessary cast warnings from checkpatch (Rohit Chavan)
  - drm/xe/bmg: Add one additional PCI ID (Matt Roper)
  - net/niu: Niu requires MSIX ENTRY_DATA fields touch before entry reads (Jonathan Currier)
  - scsi: ufs: exynos: Disable iocc if dma-coherent property isn't set (Peter Griffin)
  - scsi: ufs: exynos: Move UFS shareability value to drvdata (Peter Griffin)
  - scsi: ufs: exynos: Add gs101_ufs_drv_init() hook and enable WriteBooster (Peter Griffin)
  - scsi: ufs: exynos: Remove superfluous function parameter (Tudor Ambarus)
  - scsi: ufs: exynos: Remove empty drv_init method (Tudor Ambarus)
  - ksmbd: fix use-after-free in __smb2_lease_break_noti() (Namjae Jeon)
  - ksmbd: browse interfaces list on FSCTL_QUERY_INTERFACE_INFO IOCTL (Namjae Jeon)
  - ksmbd: add netdev-up/down event debug print (Namjae Jeon)
  - ksmbd: use __GFP_RETRY_MAYFAIL (Namjae Jeon)
  - accel/ivpu: Fix the NPU's DPU frequency calculation (Andrzej Kacprowski)
  - accel/ivpu: Add auto selection logic for job scheduler (Jacek Lawrynowicz)
  - PCI/MSI: Add an option to write MSIX ENTRY_DATA before any reads (Jonathan Currier)
  - PCI/MSI: Handle the NOMASK flag correctly for all PCI/MSI backends (Thomas Gleixner)
  - PCI/MSI: Convert pci_msi_ignore_mask to per MSI domain flag (Roger Pau Monne)
  - scsi: ufs: qcom: fix dev reference leaked through of_qcom_ice_get (Tudor Ambarus)
  - of: resolver: Fix device node refcount leakage in of_resolve_phandles() (Zijun Hu)
  - of: resolver: Simplify of_resolve_phandles() using __free() (Rob Herring (Arm))
  - arm64: dts: ti: k3-j784s4-j742s2-main-common: Fix serdes_ln_ctrl reg-masks (Siddharth Vadapalli)
  - arm64: dts: ti: Refactor J784s4 SoC files to a common file (Manorit Chawdhry)
  - iio: adc: ad7768-1: Fix conversion result sign (Sergiu Cuciurean)
  - iio: adc: ad7768-1: Move setting of val a bit later to avoid unnecessary return value check (Jonathan Cameron)
  - net: dsa: mv88e6xxx: fix VTU methods for 6320 family (Marek Behún)
  - media: ov08x40: Add missing ov08x40_identify_module() call on stream-start (Hans de Goede)
  - media: ov08x40: Move ov08x40_identify_module() function up (Hans de Goede)
  - media: i2c: imx214: Fix link frequency validation (André Apitzsch)
  - media: i2c: imx214: Check number of lanes from device tree (André Apitzsch)
  - media: i2c: imx214: Replace register addresses with macros (André Apitzsch)
  - media: i2c: imx214: Convert to CCI register access helpers (André Apitzsch)
  - media: i2c: imx214: Simplify with dev_err_probe() (André Apitzsch)
  - media: i2c: imx214: Use subdev active state (André Apitzsch)
  - PM: EM: Address RCU-related sparse warnings (Rafael J. Wysocki)
  - PM: EM: use kfree_rcu() to simplify the code (Li RongQing)
  - mmc: sdhci-msm: fix dev reference leaked through of_qcom_ice_get (Tudor Ambarus)
  - soc: qcom: ice: introduce devm_of_qcom_ice_get (Tudor Ambarus)
  - mm/vmscan: don't try to reclaim hwpoison folio (Jinjiang Tu)
  - tracing: Verify event formats that have "%*p.." (Steven Rostedt)
  - tracing: Add __print_dynamic_array() helper (Steven Rostedt)
  - module: sign with sha512 instead of sha1 by default (Thorsten Leemhuis)
  - LTS version: v6.12.25 (Jack Vogel)
  - selftests/bpf: extend changes_pkt_data with cases w/o subprograms (Eduard Zingerman)
  - bpf: fix null dereference when computing changes_pkt_data of prog w/o subprogs (Eduard Zingerman)
  - selftests/bpf: validate that tail call invalidates packet pointers (Eduard Zingerman)
  - selftests/bpf: freplace tests for tracking of changes_packet_data (Eduard Zingerman)
  - bpf: check changes_pkt_data property for extension programs (Eduard Zingerman)
  - selftests/bpf: test for changing packet data from global functions (Eduard Zingerman)
  - bpf: track changes_pkt_data property for global functions (Eduard Zingerman)
  - bpf: add find_containing_subprog() utility function (Eduard Zingerman)
  - wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process (P Praneesh)
  - MIPS: ds1287: Match ds1287_set_base_clock() function types (WangYuli)
  - MIPS: cevt-ds1287: Add missing ds1287.h include (WangYuli)
  - MIPS: dec: Declare which_prom() as static (WangYuli)
  - Revert "wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process" (Alexander Tsoy)
  - mm/vma: add give_up_on_oom option on modify/merge, use in uffd release (Lorenzo Stoakes)
  - nvmet-fc: Remove unused functions (WangYuli)
  - drm/amd/display: Temporarily disable hostvm on DCN31 (Aurabindo Pillai)
  - LoongArch: Eliminate superfluous get_numa_distances_cnt() (Yuli Wang)
  - efi/libstub: Bump up EFI_MMAP_NR_SLACK_SLOTS to 32 (Hamza Mahfooz)
  - misc: pci_endpoint_test: Fix 'irq_type' to convey the correct type (Kunihiko Hayashi)
  - misc: pci_endpoint_test: Avoid issue of interrupts remaining after request_irq error (Kunihiko Hayashi)
  - selftests/bpf: Fix raw_tp null handling test (Shung-Hsi Yu)
  - md: fix mddev uaf while iterating all_mddevs list (Yu Kuai)
  - platform/x86: msi-wmi-platform: Workaround a ACPI firmware bug (Armin Wolf)
  - platform/x86: msi-wmi-platform: Rename "data" variable (Armin Wolf)
  - kbuild: Add '-fno-builtin-wcslen' (Nathan Chancellor)
  - scripts: generate_rust_analyzer: Add ffi crate (Lukas Fischer)
  - cpufreq: Reference count policy in cpufreq_update_limits() (Rafael J. Wysocki)
  - arm64/boot: Enable EL2 requirements for FEAT_PMUv3p9 (Anshuman Khandual)
  - arm64/sysreg: Add register fields for HFGWTR2_EL2 (Anshuman Khandual)
  - arm64/sysreg: Add register fields for HFGRTR2_EL2 (Anshuman Khandual)
  - arm64/sysreg: Add register fields for HFGITR2_EL2 (Anshuman Khandual)
  - arm64/sysreg: Add register fields for HDFGWTR2_EL2 (Anshuman Khandual)
  - arm64/sysreg: Add register fields for HDFGRTR2_EL2 (Anshuman Khandual)
  - arm64/sysreg: Update register fields for ID_AA64MMFR0_EL1 (Anshuman Khandual)
  - drm/mgag200: Fix value in <VBLKSTR> register (Thomas Zimmermann)
  - drm/amdgpu: fix warning of drm_mm_clean (ZhenGuo Yin)
  - drm/xe: Set LRC addresses before guc load (Lucas De Marchi)
  - drm/xe/userptr: fix notifier vs folio deadlock (Matthew Auld)
  - drm/xe/dma_buf: stop relying on placement in unmap (Matthew Auld)
  - drm/amd/display: Add HP Probook 445 and 465 to the quirk list for eDP on DP1 (Mario Limonciello)
  - drm/amd/display: Protect FPU in dml2_init()/dml21_init() (Huacai Chen)
  - drm/amd/display: Do not enable Replay and PSR while VRR is on in amdgpu_dm_commit_planes() (Tom Chung)
  - drm/amdgpu: immediately use GTT for new allocations (Christian König)
  - drm/i915/gvt: fix unterminated-string-initialization warning (Jani Nikula)
  - drm/xe: Fix an out-of-bounds shift when invalidating TLB (Thomas Hellström)
  - drm/sti: remove duplicate object names (Rolf Eike Beer)
  - drm/imagination: take paired job reference (Brendan King)
  - drm/imagination: fix firmware memory leaks (Brendan King)
  - drm/nouveau: prime: fix ttm_bo_delayed_delete oops (Chris Bainbridge)
  - drm/amdgpu/dma_buf: fix page_link check (Matthew Auld)
  - drm/amdgpu/mes11: optimize MES pipe FW version fetching (Alex Deucher)
  - drm/amd/display: Protect FPU in dml21_copy() (Huacai Chen)
  - drm/amd/display: Protect FPU in dml2_validate()/dml21_validate() (Huacai Chen)
  - drm/amd/display: Add HP Elitebook 645 to the quirk list for eDP on DP1 (Mario Limonciello)
  - drm/xe: Use local fence in error path of xe_migrate_clear (Matthew Brost)
  - drm/i915/vrr: Add vrr.vsync_{start, end} in vrr_params_changed (Ankit Nautiyal)
  - drm/amdgpu/mes12: optimize MES pipe FW version fetching (Alex Deucher)
  - drm/amd/pm/powerplay/hwmgr/vega20_thermal: Prevent division by zero (Denis Arefev)
  - drm/amd/pm/swsmu/smu13/smu_v13_0: Prevent division by zero (Denis Arefev)
  - drm/amd/pm/powerplay/hwmgr/smu7_thermal: Prevent division by zero (Denis Arefev)
  - drm/amd/pm/smu11: Prevent division by zero (Denis Arefev)
  - drm/amd/pm/powerplay: Prevent division by zero (Denis Arefev)
  - drm/amd/pm: Prevent division by zero (Denis Arefev)
  - drm/amd/display: Increase vblank offdelay for PSR panels (Leo Li)
  - drm/amd/display: Actually do immediate vblank disable (Leo Li)
  - drm/amd: Handle being compiled without SI or CIK support better (Mario Limonciello)
  - drm/amd/display: prevent hang on link training fail (Brendan Tam)
  - drm/amdgpu: Prefer shadow rom when available (Lijo Lazar)
  - drm/msm/a6xx: Fix stale rpmh votes from GPU (Akhil P Oommen)
  - drm/msm/dsi: Add check for devm_kstrdup() (Haoxiang Li)
  - drm/ast: Fix ast_dp connection status (Jocelyn Falempe)
  - drm/repaper: fix integer overflows in repeat functions (Nikita Zhandarovich)
  - perf/x86/intel/uncore: Fix the scale of IIO free running counters on SPR (Kan Liang)
  - perf/x86/intel/uncore: Fix the scale of IIO free running counters on ICX (Kan Liang)
  - perf/x86/intel/uncore: Fix the scale of IIO free running counters on SNR (Kan Liang)
  - perf/x86/intel: Allow to update user space GPRs from PEBS records (Dapeng Mi)
  - platform/x86: amd: pmf: Fix STT limits (Mario Limonciello)
  - RAS/AMD/FMPM: Get masked address (Yazen Ghannam)
  - RAS/AMD/ATL: Include row[13] bit in row retirement (Yazen Ghannam)
  - scsi: ufs: exynos: Ensure consistent phy reference counts (Peter Griffin)
  - scsi: megaraid_sas: Block zero-length ATA VPD inquiry (Chandrakanth Patil)
  - x86/boot/sev: Avoid shared GHCB page for early memory acceptance (Ard Biesheuvel)
  - x86/cpu/amd: Fix workaround for erratum 1054 (Sandipan Das)
  - x86/microcode/AMD: Extend the SHA check to Zen5, block loading of any unreleased standalone Zen5 microcode patches (Borislav Petkov (AMD))
  - virtiofs: add filesystem context source name check (Xiangsheng Hou)
  - tracing: Fix filter string testing (Steven Rostedt)
  - string: Add load_unaligned_zeropad() code path to sized_strscpy() (Peter Collingbourne)
  - smb3 client: fix open hardlink on deferred close file error (Chunjie Zhu)
  - slab: ensure slab->obj_exts is clear in a newly allocated slab page (Suren Baghdasaryan)
  - selftests/mm: generate a temporary mountpoint for cgroup filesystem (Mark Brown)
  - riscv: Avoid fortify warning in syscall_get_arguments() (Nathan Chancellor)
  - Revert "smb: client: fix TCP timers deadlock after rmmod" (Kuniyuki Iwashima)
  - Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free" (Kuniyuki Iwashima)
  - ksmbd: fix the warning from __kernel_write_iter (Namjae Jeon)
  - ksmbd: Prevent integer overflow in calculation of deadtime (Denis Arefev)
  - ksmbd: fix use-after-free in smb_break_all_levII_oplock() (Namjae Jeon)
  - ksmbd: Fix dangling pointer in krb_authenticate (Sean Heelan)
  - ovl: don't allow datadir only (Miklos Szeredi)
  - mm: fix apply_to_existing_page_range() (Kirill A. Shutemov)
  - mm: fix filemap_get_folios_contig returning batches of identical folios (Vishal Moola (Oracle))
  - mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Baoquan He)
  - mm/compaction: fix bug in hugetlb handling pathway (Vishal Moola (Oracle))
  - loop: LOOP_SET_FD: send uevents for partitions (Thomas Weißschuh)
  - loop: properly send KOBJ_CHANGED uevent for disk device (Thomas Weißschuh)
  - isofs: Prevent the use of too small fid (Edward Adam Davis)
  - i2c: cros-ec-tunnel: defer probe if parent EC is not present (Thadeu Lima de Souza Cascardo)
  - hfs/hfsplus: fix slab-out-of-bounds in hfs_bnode_read_key (Vasiliy Kovalev)
  - crypto: caam/qi - Fix drv_ctx refcount bug (Herbert Xu)
  - cpufreq/sched: Explicitly synchronize limits_changed flag handling (Rafael J. Wysocki)
  - btrfs: correctly escape subvol in btrfs_show_options() (Johannes Kimmel)
  - Bluetooth: vhci: Avoid needless snprintf() calls (Kees Cook)
  - Bluetooth: l2cap: Process valid commands in too long frame (Frédéric Danis)
  - drm/msm/a6xx+: Don't let IB_SIZE overflow (Rob Clark)
  - ftrace: fix incorrect hash size in register_ftrace_direct() (Menglong Dong)
  - i2c: atr: Fix wrong include (Andy Shevchenko)
  - nfsd: decrease sc_count directly if fail to queue dl_recall (Li Lingfeng)
  - nfs: add missing selections of CONFIG_CRC32 (Eric Biggers)
  - dma-buf/sw_sync: Decrement refcount on error in sw_sync_ioctl_get_deadline() (Dan Carpenter)
  - drm/v3d: Fix Indirect Dispatch configuration for V3D 7.1.6 and later (Maíra Canal)
  - block: integrity: Do not call set_page_dirty_lock() (Martin K. Petersen)
  - asus-laptop: Fix an uninitialized variable (Denis Arefev)
  - ASoC: qcom: Fix sc7280 lpass potential buffer overflow (Evgeny Pimenov)
  - ASoC: Intel: sof_sdw: Add quirk for Asus Zenbook S16 (Peter Ujfalusi)
  - ASoC: codecs:lpass-wsa-macro: Fix logic of enabling vi channels (Srinivas Kandagatla)
  - ASoC: codecs:lpass-wsa-macro: Fix vi feedback rate (Srinivas Kandagatla)
  - ASoC: fsl: fsl_qmc_audio: Reset audio data pointers on TRIGGER_START event (Herve Codina)
  - Revert "PCI: Avoid reset when disabled via sysfs" (Alex Williamson)
  - writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher)
  - rust: kbuild: use `pound` to support GNU Make < 4.3 (Miguel Ojeda)
  - rust: disable `clippy::needless_continue` (Miguel Ojeda)
  - rust: kasan/kbuild: fix missing flags on first build (Miguel Ojeda)
  - objtool/rust: add one more `noreturn` Rust function for Rust 1.86.0 (Miguel Ojeda)
  - cpufreq/sched: Fix the usage of CPUFREQ_NEED_UPDATE_LIMITS (Rafael J. Wysocki)
  - riscv: KGDB: Remove ".option norvc/.option rvc" for kgdb_compiled_break (WangYuli)
  - riscv: KGDB: Do not inline arch_kgdb_breakpoint() (WangYuli)
  - kunit: qemu_configs: SH: Respect kunit cmdline (Thomas Weißschuh)
  - riscv: module: Allocate PLT entries for R_RISCV_PLT32 (Samuel Holland)
  - riscv: module: Fix out-of-bounds relocation access (Samuel Holland)
  - riscv: Properly export reserved regions in /proc/iomem (Björn Töpel)
  - riscv: Use kvmalloc_array on relocation_hashtable (Will Pierce)
  - net: ethernet: mtk_eth_soc: revise QDMA packet scheduler settings (Bo-Cun Chen)
  - net: ethernet: mtk_eth_soc: correct the max weight of the queue limit for 100Mbps (Bo-Cun Chen)
  - net: ethernet: mtk_eth_soc: reapply mdc divider on reset (Bo-Cun Chen)
  - net: ti: icss-iep: Fix possible NULL pointer dereference for perout request (Meghana Malladi)
  - net: ti: icss-iep: Add phase offset configuration for perout signal (Meghana Malladi)
  - net: ti: icss-iep: Add pwidth configuration for perout signal (Meghana Malladi)
  - ptp: ocp: fix start time alignment in ptp_ocp_signal_set (Sagi Maimon)
  - net: dsa: avoid refcount warnings when ds->ops->tag_8021q_vlan_del() fails (Vladimir Oltean)
  - net: dsa: free routing table on probe failure (Vladimir Oltean)
  - net: dsa: clean up FDB, MDB, VLAN entries on unbind (Vladimir Oltean)
  - net: dsa: mv88e6xxx: fix -ENOENT when deleting VLANs and MST is unsupported (Vladimir Oltean)
  - net: dsa: mv88e6xxx: avoid unregistering devlink regions which were never registered (Vladimir Oltean)
  - net: txgbe: fix memory leak in txgbe_probe() error path (Abdun Nihaal)
  - net: bridge: switchdev: do not notify new brentries as changed (Jonas Gorski)
  - net: b53: enable BPDU reception for management port (Jonas Gorski)
  - netlink: specs: rt-link: adjust mctp attribute naming (Jakub Kicinski)
  - netlink: specs: rt-link: add an attr layer around alt-ifname (Jakub Kicinski)
  - cxgb4: fix memory leak in cxgb4_init_ethtool_filters() error path (Abdun Nihaal)
  - ata: libata-sata: Save all fields from sense data descriptor (Niklas Cassel)
  - loop: stop using vfs_iter_{read,write} for buffered I/O (Christoph Hellwig)
  - loop: aio inherit the ioprio of original request (Yunlong Xing)
  - eth: bnxt: fix missing ring index trim on error path (Jakub Kicinski)
  - net: ethernet: ti: am65-cpsw: fix port_np reference counting (Michael Walle)
  - net: ngbe: fix memory leak in ngbe_probe() error path (Abdun Nihaal)
  - can: rockchip_canfd: fix broken quirks checks (Weizhao Ouyang)
  - net: openvswitch: fix nested key length validation in the set() action (Ilya Maximets)
  - netlink: specs: ovs_vport: align with C codegen capabilities (Jakub Kicinski)
  - block: fix resource leak in blk_register_queue() error path (Zheng Qixing)
  - net: mctp: Set SOCK_RCU_FREE (Matt Johnston)
  - ethtool: cmis_cdb: use correct rpl size in ethtool_cmis_module_poll() (Damodharam Ammepalli)
  - pds_core: fix memory leak in pdsc_debugfs_add_qcq() (Abdun Nihaal)
  - test suite: use %zu to print size_t (Matthew Wilcox (Oracle))
  - smc: Fix lockdep false-positive for IPPROTO_SMC. (Kuniyuki Iwashima)
  - dt-bindings: soc: fsl: fsl,ls1028a-reset: Fix maintainer entry (Geert Uytterhoeven)
  - igc: add lock preventing multiple simultaneous PTM transactions (Christopher S M Hall)
  - igc: cleanup PTP module if probe fails (Christopher S M Hall)
  - igc: handle the IGC_PTP_ENABLED flag correctly (Christopher S M Hall)
  - igc: move ktime snapshot into PTM retry loop (Christopher S M Hall)
  - igc: increase wait time before retrying PTM (Christopher S M Hall)
  - igc: fix PTM cycle trigger logic (Christopher S M Hall)
  - Revert "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" (Johannes Berg)
  - xen: fix multicall debug feature (Juergen Gross)
  - ipv6: add exception routes to GC list in rt6_insert_exception (Xin Long)
  - Bluetooth: l2cap: Check encryption key size on incoming connection (Frédéric Danis)
  - Bluetooth: btrtl: Prevent potential NULL dereference (Dan Carpenter)
  - Bluetooth: hci_event: Fix sending MGMT_EV_DEVICE_FOUND for invalid address (Luiz Augusto von Dentz)
  - RDMA/core: Silence oversized kvmalloc() warning (Shay Drory)
  - ASoC: cs42l43: Reset clamp override on jack removal (Charles Keepax)
  - ALSA: hda/realtek - Fixed ASUS platform headset Mic issue (Kailang Yang)
  - ALSA: hda/realtek: Workaround for resume on Dell Venue 11 Pro 7130 (Takashi Iwai)
  - ALSA: hda: improve bass speaker support for ASUS Zenbook UM5606WA (Jaroslav Kysela)
  - ALSA: hda/cirrus_scodec_test: Don't select dependencies (Richard Fitzgerald)
  - RDMA/hns: Fix wrong maximum DMA segment size (Chengchang Tang)
  - RDMA/usnic: Fix passing zero to PTR_ERR in usnic_ib_pci_probe() (Yue Haibing)
  - ovl: remove unused forward declaration (Giuseppe Scrivano)
  - crypto: tegra - Fix IV usage for AES ECB (Akhil R)
  - crypto: tegra - Do not use fixed size buffers (Akhil R)
  - crypto: tegra - remove redundant error check on ret (Colin Ian King)
  - ASoC: Intel: avs: Fix null-ptr-deref in avs_component_probe() (Henry Martin)
  - ASoC: dwc: always enable/disable i2s irqs (Brady Norander)
  - md/md-bitmap: fix stats collection for external bitmaps (Zheng Qixing)
  - md/raid10: fix missing discard IO accounting (Yu Kuai)
  - scsi: iscsi: Fix missing scsi_host_put() in error path (Miaoqian Lin)
  - wifi: wl1251: fix memory leak in wl1251_tx_work (Abdun Nihaal)
  - wifi: mac80211: Purge vif txq in ieee80211_do_stop() (Remi Pommarel)
  - wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue() (Remi Pommarel)
  - wifi: at76c50x: fix use after free access in at76_disconnect (Abdun Nihaal)
  - scsi: hisi_sas: Enable force phy when SATA disk directly connected (Xingui Yang)
  - aarch64: increase DEFAULT_CRASH_KERNEL_LOW_SIZE for kdump (Brian Maly)  [Orabug: 37446372]
  - vhost-scsi: Fix vhost_scsi_send_status() (Dongli Zhang)  [Orabug: 37840543]
  - vhost-scsi: Fix vhost_scsi_send_bad_target() (Dongli Zhang)  [Orabug: 37840543]
  - vhost-scsi: protect vq->log_used with vq->mutex (Dongli Zhang)  [Orabug: 37840543]
  - vhost-scsi: Reduce response iov mem use (Mike Christie)  [Orabug: 37840543]
  - vhost-scsi: Allocate iov_iter used for unaligned copies when needed (Mike Christie)  [Orabug: 37840543]
  - vhost-scsi: Stop duplicating se_cmd fields (Mike Christie)  [Orabug: 37840543]
  - vhost-scsi: Dynamically allocate scatterlists (Mike Christie)  [Orabug: 37840543]
  - vhost-scsi: Return queue full for page alloc failures during copy (Mike Christie)  [Orabug: 37840543]
  - vhost-scsi: Add better resource allocation failure handling (Mike Christie)  [Orabug: 37840543]
  - vhost-scsi: Allocate T10 PI structs only when enabled (Mike Christie)  [Orabug: 37840543]
  - vhost-scsi: Reduce mem use by moving upages to per queue (Mike Christie)  [Orabug: 37840543]
  - Revert "vhost-scsi: protect vq->log_base with vq->mutex" (Mike Christie)  [Orabug: 37840543]
  - Revert "vhost_scsi: log write descriptors" (Mike Christie)  [Orabug: 37840543]
  - scsi: mpi3mr: Event processing debug improvement (Ranjan Kumar)  [Orabug: 37878021]
  - scsi: mpi3mr: Add level check to control event logging (Ranjan Kumar)  [Orabug: 37878021]
  - scsi: mpi3mr: Reset the pending interrupt flag (Ranjan Kumar)  [Orabug: 37878021]
  - scsi: mpi3mr: Fix pending I/O counter (Ranjan Kumar)  [Orabug: 37878021]


