[El-errata] ELBA-2025-20277 Oracle Linux 9 Unbreakable Enterprise kernel bug fix update

[Errata Announcements for Oracle Linux]

Oracle Linux Bug Fix Advisory ELBA-2025-20277

http://linux.oracle.com/errata/ELBA-2025-20277.html

The following updated rpms for Oracle Linux 9 have been uploaded to the Unbreakable Linux Network:


aarch64:
bpftool-5.15.0-303.171.5.2.2.el9uek.aarch64.rpm
kernel-uek-5.15.0-303.171.5.2.2.el9uek.aarch64.rpm
kernel-uek-container-5.15.0-303.171.5.2.2.el9uek.aarch64.rpm
kernel-uek-container-debug-5.15.0-303.171.5.2.2.el9uek.aarch64.rpm
kernel-uek-core-5.15.0-303.171.5.2.2.el9uek.aarch64.rpm
kernel-uek-debug-5.15.0-303.171.5.2.2.el9uek.aarch64.rpm
kernel-uek-debug-core-5.15.0-303.171.5.2.2.el9uek.aarch64.rpm
kernel-uek-debug-devel-5.15.0-303.171.5.2.2.el9uek.aarch64.rpm
kernel-uek-debug-modules-5.15.0-303.171.5.2.2.el9uek.aarch64.rpm
kernel-uek-debug-modules-extra-5.15.0-303.171.5.2.2.el9uek.aarch64.rpm
kernel-uek-devel-5.15.0-303.171.5.2.2.el9uek.aarch64.rpm
kernel-uek-doc-5.15.0-303.171.5.2.2.el9uek.noarch.rpm
kernel-uek-modules-5.15.0-303.171.5.2.2.el9uek.aarch64.rpm
kernel-uek-modules-extra-5.15.0-303.171.5.2.2.el9uek.aarch64.rpm
kernel-uek64k-5.15.0-303.171.5.2.2.el9uek.aarch64.rpm
kernel-uek64k-core-5.15.0-303.171.5.2.2.el9uek.aarch64.rpm
kernel-uek64k-modules-5.15.0-303.171.5.2.2.el9uek.aarch64.rpm
kernel-uek64k-modules-extra-5.15.0-303.171.5.2.2.el9uek.aarch64.rpm


SRPMS:
http://oss.oracle.com/ol9/SRPMS-updates//kernel-uek-5.15.0-303.171.5.2.2.el9uek.src.rpm



Description of changes:

[5.15.0-303.171.5.2.2.el9uek]
- Uek-rpm/ol9: Enable CONFIG_FIPS_SIGNATURE_SELFTEST for mips64 (Vijay Kumar)  [Orabug: 37509583]
- uek-rpm: Enable CONFIG_FIPS_SIGNATURE_SELFTEST for all archs (Saeed Mirzamohammadi)  [Orabug: 37509575]
- Revert "crypto: jitter - permanent and intermittent health errors" (Saeed Mirzamohammadi)  [Orabug: 37492621]
- Revert "crypto: jitter - correct health test during initialization" (Saeed Mirzamohammadi)  [Orabug: 37492621]

[5.15.0-303.171.5.2.1.el9uek]
- cgroup: cgroup-v1: do not exclude cgrp_dfl_root (Vishal Verma)  [Orabug: 37410450]
- vhost_scsi: log write descriptors (Dongli Zhang)  [Orabug: 37423790]
- vhost-scsi: protect vq->log_base with vq->mutex (Dongli Zhang)  [Orabug: 37423790]

[5.15.0-303.171.5.2.el9uek]
- build: populate modules_thick.builtin for dirs containing only modules (Nick Alcock)  [Orabug: 37393454]
- x86/pkeys: Ensure updated PKRU value is XRSTOR'd (Aruna Ramakrishna)  [Orabug: 37384237]
- x86/pkeys: Change caller of update_pkru_in_sigframe() (Aruna Ramakrishna)  [Orabug: 37384237]
- Revert "ocfs2: fix the la space leak when unmounting an ocfs2 volume" (Sherry Yang)  [Orabug: 37383283]

[5.15.0-303.171.5.1.el9uek]
- sunrpc: fix a NULL deref in svc_process() when ->sv_stats doesn't exist (Calum Mackay)  [Orabug: 37346134]

[5.15.0-303.171.5.el9uek]
- intel_idle: fix ACPI _CST matching for newer Xeon platforms (Artem Bityutskiy)  [Orabug: 37249457]
- x86: Fix CPUIDLE_FLAG_IRQ_ENABLE leaking timer reprogram (Peter Zijlstra)  [Orabug: 37249457]
- perf/tests: Add AMX instructions to x86 instruction decoder test (Adrian Hunter)  [Orabug: 37249457]
- x86/insn: Add AMX instructions to the x86 instruction decoder (Adrian Hunter)  [Orabug: 37249457]
- intel_idle: add Granite Rapids Xeon support (Artem Bityutskiy)  [Orabug: 37249457]
- cpuidle, intel_idle: Fix CPUIDLE_FLAG_IRQ_ENABLE *again* (Peter Zijlstra)  [Orabug: 37249457]
- intel_idle: Fix false positive RCU splats due to incorrect hardirqs state (Waiman Long)  [Orabug: 37249457]
- cpuidle,intel_idle: Fix CPUIDLE_FLAG_IRQ_ENABLE (Peter Zijlstra)  [Orabug: 37249457]
- intel_idle: Add a new flag to initialize the AMX state (Chang S. Bae)  [Orabug: 37249457]
- x86/fpu: Add a helper to prepare AMX state for low-power CPU idle (Chang S. Bae)  [Orabug: 37249457]
- intel_idle: enable interrupts before C1 on Xeons (Artem Bityutskiy)  [Orabug: 37249457]

[5.15.0-303.171.4.el9uek]
- rds: recv_payload_bad_checksum was not 0 after running rds-stress on UEK6 (William Kucharski)  [Orabug: 37265126]
- rds: If RDS Checksums are enabled for RDMA RDS operations, the extension headers will overflow causing incorrect operation (William Kucharski)  [Orabug: 37265124]
- rds: rds_message_alloc() needlessly zeroes m_used_sgs (William Kucharski)  [Orabug: 37265122]
- rds: tracepoint in rds_receive_csum_err() prints pointless information (William Kucharski)  [Orabug: 37265120]
- rds: rds_inc_init() should initialize the inc->i_conn_path field (William Kucharski)  [Orabug: 37265116]
- rds: Race condition in adding RDS payload checksum extension header may result in RDS header corruption (William Kucharski)  [Orabug: 37265114]
- Revert "net/mlx5: disable the 'fast unload' feature on Exadata systems" (Qing Huang)  [Orabug: 37285222]
- Revert "net/mlx5: pretend 'fast unload' succeeded on Exadata systems" (Qing Huang)  [Orabug: 37285222]
- RDMA/mlx5: Fix Shared PD prefetch of ODP memory region (Mark Haywood)  [Orabug: 31688618] [Orabug: 37279176]
- blk-mq: fix missing blk_account_io_done() in error path (Yu Kuai)  [Orabug: 37228086]
- rds: Add rds stuck shutdown timeout (Rohit Nair)  [Orabug: 37214078]
- KVM: x86: Stop compiling vmenter.S with OBJECT_FILES_NON_STANDARD (Sean Christopherson)  [Orabug: 37273739]
- KVM: SVM: Create a stack frame in __svm_sev_es_vcpu_run() (Sean Christopherson)  [Orabug: 37273739]
- KVM: SVM: Create a stack frame in __svm_vcpu_run() for unwinding (Sean Christopherson)  [Orabug: 37273739]
- mm/memory-failure: pass the folio and the page to collect_procs() (Matthew Wilcox (Oracle))  [Orabug: 37270260]
- LTS version: v5.15.171 (Vijayendra Suman)
- mac80211: always have ieee80211_sta_restart() (Johannes Berg)
- vt: prevent kernel-infoleak in con_font_get() (Jeongjun Park)
- drm/i915: Fix potential context UAFs (Rob Clark)
- Revert "drm/mipi-dsi: Set the fwnode for mipi_dsi_device" (Jason-JH.Lin)
- mm: shmem: fix data-race in shmem_getattr() (Jeongjun Park) [Orabug: 37268580] {CVE-2024-50228}
- wifi: iwlwifi: mvm: fix 6 GHz scan construction (Johannes Berg) [Orabug: 37304734] {CVE-2024-53055}
- nilfs2: fix kernel bug due to missing clearing of checked flag (Ryusuke Konishi) [Orabug: 37268588] {CVE-2024-50230}
- x86/bugs: Use code segment selector for VERW operand (Pawan Gupta) [Orabug: 37227383] {CVE-2024-50072}
- ocfs2: pass u64 to ocfs2_truncate_inline maybe overflow (Edward Adam Davis) [Orabug: 37268563] {CVE-2024-50218}
- mm/page_alloc: let GFP_ATOMIC order-0 allocs access highatomic reserves (Matt Fleming) [Orabug: 37268568] {CVE-2024-50219}
- mm/page_alloc: explicitly define how __GFP_HIGH non-blocking allocations accesses reserves (Mel Gorman)
- mm/page_alloc: explicitly define what alloc flags deplete min reserves (Mel Gorman)
- mm/page_alloc: explicitly record high-order atomic allocations in alloc_flags (Mel Gorman)
- mm/page_alloc: treat RT tasks similar to __GFP_HIGH (Mel Gorman)
- mm/page_alloc: rename ALLOC_HIGH to ALLOC_MIN_RESERVE (Mel Gorman)
- mm/page_alloc: split out buddy removal code from rmqueue into separate helper (Mel Gorman)
- mm/page_alloc: fix tracepoint mm_page_alloc_zone_locked() (Wonhyuk Yang)
- mm/page_alloc: call check_new_pages() while zone spinlock is not held (Eric Dumazet)
- riscv: Remove duplicated GET_RM (Chunyan Zhang)
- riscv: Remove unused GENERATING_ASM_OFFSETS (Chunyan Zhang)
- riscv: Use '%u' to format the output of 'cpu' (WangYuli)
- riscv: efi: Set NX compat flag in PE/COFF header (Heinrich Schuchardt)
- riscv: vdso: Prevent the compiler from inserting calls to memset() (Alexandre Ghiti)
- nilfs2: fix potential deadlock with newly created symlinks (Ryusuke Konishi) [Orabug: 37268584] {CVE-2024-50229}
- iio: light: veml6030: fix microlux value calculation (Javier Carrasco)
- iio: adc: ad7124: fix division by zero in ad7124_set_channel_odr() (Zicheng Qu) [Orabug: 37268595] {CVE-2024-50232}
- staging: iio: frequency: ad9832: fix division by zero in ad9832_calc_freqreg() (Zicheng Qu) [Orabug: 37268597] {CVE-2024-50233}
- wifi: iwlegacy: Clear stale interrupts before resuming device (Ville Syrjälä) [Orabug: 37268602] {CVE-2024-50234}
- wifi: ath10k: Fix memory leak in management tx (Manikanta Pubbisetty) [Orabug: 37268610] {CVE-2024-50236}
- wifi: mac80211: do not pass a stopped vif to the driver in .get_txpower (Felix Fietkau) [Orabug: 37268613] {CVE-2024-50237}
- xhci: Use pm_runtime_get to prevent RPM on unsupported systems (Basavaraj Natikar)
- xhci: Fix Link TRB DMA in command ring stopped completion event (Faisal Hassan)
- usb: typec: fix unreleased fwnode_handle in typec_port_register_altmodes() (Javier Carrasco)
- usb: phy: Fix API devm_usb_put_phy() can not release the phy (Zijun Hu)
- usbip: tools: Fix detach_port() invalid port error path (Zongmin Zhou)
- misc: sgi-gru: Don't disable preemption in GRU driver (Dimitri Sivanich)
- net: amd: mvme147: Fix probe banner message (Daniel Palmer)
- scsi: scsi_transport_fc: Allow setting rport state to current state (Benjamin Marzinski)
- fs/ntfs3: Additional check in ni_clear() (Konstantin Komarov) [Orabug: 37268638] {CVE-2024-50244}
- fs/ntfs3: Fix possible deadlock in mi_read (Konstantin Komarov) [Orabug: 37268644] {CVE-2024-50245}
- fs/ntfs3: Fix warning possible deadlock in ntfs_set_state (Konstantin Komarov)
- fs/ntfs3: Check if more than chunk-size bytes are written (Andrew Ballance) [Orabug: 37268655] {CVE-2024-50247}
- firmware: arm_sdei: Fix the input parameter of cpuhp_remove_state() (Xiongfeng Wang)
- netfilter: nft_payload: sanitize offset and length before calling skb_checksum() (Pablo Neira Ayuso) [Orabug: 37268670] {CVE-2024-50251}
- net: skip offload for NETIF_F_IPV6_CSUM if ipv6 header contains extension (Benoît Monin)
- netfilter: Fix use-after-free in get_info() (Dong Chenchen) [Orabug: 37268689] {CVE-2024-50257}
- bpf: Fix out-of-bounds write in trie_get_next_key() (Byeonguk Jeong) [Orabug: 37268702] {CVE-2024-50262}
- netdevsim: Add trailing zero to terminate the string in nsim_nexthop_bucket_activity_write() (Zichen Xie) [Orabug: 37268697] {CVE-2024-50259}
- net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (Pedro Tammela) [Orabug: 37304740] {CVE-2024-53057}
- net: stmmac: TSO: Fix unbalanced DMA map/unmap for non-paged SKB data (Furong Xu) [Orabug: 37304745] {CVE-2024-53058}
- ASoC: cs42l51: Fix some error handling paths in cs42l51_probe() (Christophe JAILLET)
- wifi: iwlwifi: mvm: Fix response handling in iwl_mvm_send_recovery_cmd() (Daniel Gabay) [Orabug: 37304749] {CVE-2024-53059}
- wifi: iwlwifi: mvm: disconnect station vifs if recovery failed (Emmanuel Grumbach)
- mac80211: Add support to trigger sta disconnect on hardware restart (Youghandhar Chintala)
- mac80211: do drv_reconfig_complete() before restarting all (Johannes Berg)
- RDMA/bnxt_re: synchronize the qp-handle table array (Selvin Xavier)
- RDMA/mlx5: Round max_rd_atomic/max_dest_rd_atomic up instead of down (Patrisious Haddad)
- RDMA/cxgb4: Dump vendor specific QP details (Leon Romanovsky)
- wifi: brcm80211: BRCM_TRACING should depend on TRACING (Geert Uytterhoeven)
- wifi: mac80211: skip non-uploaded keys in ieee80211_iter_keys (Felix Fietkau)
- mac80211: MAC80211_MESSAGE_TRACING should depend on TRACING (Geert Uytterhoeven)
- cgroup: Fix potential overflow issue when checking max_depth (Xiu Jianfeng)
- ACPI: PRM: Find EFI_MEMORY_RUNTIME block for PRM handler and context (Koba Ko) [Orabug: 37264072] {CVE-2024-50141}
- ACPI: PRM: Change handler_addr type to void pointer (Sudeep Holla)
- ACPI: PRM: Remove unnecessary blank lines (Aubrey Li)
- ksmbd: fix user-after-free from session log off (Namjae Jeon) [Orabug: 37227413] {CVE-2024-50086}
- selftests/mm: fix incorrect buffer->mirror size in hmm2 double_map test (Donet Tom)
- LTS version: v5.15.170 (Vijayendra Suman)
- xfrm: validate new SA's prefixlen using SA family when sel.family is unset (Sabrina Dubroca) [Orabug: 37264074] {CVE-2024-50142}
- ASoC: qcom: Fix NULL Dereference in asoc_qcom_lpass_cpu_platform_probe() (Zichen Xie) [Orabug: 37252324] {CVE-2024-50103}
- net: phy: dp83822: Fix reset pin definitions (Michel Alex)
- serial: protect uart_port_dtr_rts() in uart_shutdown() too (Jiri Slaby (SUSE))
- selinux: improve error checking in sel_write_load() (Paul Moore)
- hv_netvsc: Fix VF namespace also in synthetic NIC NETDEV_REGISTER event (Haiyang Zhang)
- xfrm: fix one more kernel-infoleak in algo dumping (Petr Vaganov) [Orabug: 37252349] {CVE-2024-50110}
- ALSA: hda/realtek: Add subwoofer quirk for Acer Predator G9-593 (José Relvas)
- KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory (Sean Christopherson) [Orabug: 37252372] {CVE-2024-50115}
- openat2: explicitly return -E2BIG for (usize > PAGE_SIZE) (Aleksa Sarai)
- nilfs2: fix kernel bug due to missing clearing of buffer delay flag (Ryusuke Konishi) [Orabug: 37252377] {CVE-2024-50116}
- ACPI: button: Add DMI quirk for Samsung Galaxy Book2 to fix initial lid detection issue (Shubham Panwar)
- ACPI: resource: Add LG 16T90SP to irq1_level_low_skip_override[] (Christian Heusel)
- drm/amd: Guard against bad data for ATIF ACPI method (Mario Limonciello) [Orabug: 37252383] {CVE-2024-50117}
- btrfs: zoned: fix zone unusable accounting for freed reserved extent (Naohiro Aota)
- ALSA: hda/realtek: Update default depop procedure (Kailang Yang)
- ALSA: firewire-lib: Avoid division by zero in apply_constraint_to_size() (Andrey Shumilin) [Orabug: 37264274] {CVE-2024-50205}
- bpf,perf: Fix perf_event_detach_bpf_prog error handling (Jiri Olsa)
- posix-clock: posix-clock: Fix unbalanced locking in pc_clock_settime() (Jinjie Ruan) [Orabug: 37320233] {CVE-2024-50210}
- r8169: avoid unsolicited interrupts (Heiner Kallweit)
- net: sched: fix use-after-free in taprio_change() (Dmitry Antipov) [Orabug: 37252407] {CVE-2024-50127}
- net: wwan: fix global oob in wwan_rtnl_policy (Lin Ma) [Orabug: 37252410] {CVE-2024-50128}
- net: dsa: mv88e6xxx: Fix error when setting port policy on mv88e6393x (Peter Rashleigh)
- net: plip: fix break; causing plip to never transmit (Jakub Boehm)
- be2net: fix potential memory leak in be_xmit() (Wang Hai) [Orabug: 37264143] {CVE-2024-50167}
- net/sun3_82586: fix potential memory leak in sun3_82586_send_packet() (Wang Hai) [Orabug: 37264149] {CVE-2024-50168}
- xfrm: respect ip protocols rules criteria when performing dst lookups (Eyal Birger)
- xfrm: extract dst lookup parameters into a struct (Eyal Birger)
- tracing: Consider the NULL character when validating the event length (Leo Yan) [Orabug: 37252415] {CVE-2024-50131}
- platform/x86: dell-sysman: add support for alienware products (Crag Wang)
- ASoC: qcom: sm8250: add qrb4210-rb2-sndcard compatible string (Alexey Klimov)
- arm64/uprobes: change the uprobe_opcode_t typedef to fix the sparse warning (junhua huang)
- platform/x86: dell-wmi: Ignore suspend notifications (Armin Wolf)
- udf: fix uninit-value use in udf_get_fileshortad (Gianfranco Trad) [Orabug: 37264080] {CVE-2024-50143}
- arm64: Force position-independent veneers (Mark Rutland)
- ASoC: fsl_sai: Enable 'FIFO continue on error' FCONT bit (Shengjiu Wang)
- ASoC: codecs: lpass-rx-macro: add missing CDC_RX_BCL_VBAT_RF_PROC2 to default regs values (Alexey Klimov)
- drm/vboxvideo: Replace fake VLA at end of vbva_mouse_pointer_shape with real VLA (Hans de Goede) [Orabug: 37252420] {CVE-2024-50134}
- exec: don't WARN for racy path_noexec check (Mateusz Guzik) [Orabug: 37206344] {CVE-2024-50010}
- XHCI: Separate PORT and CAPs macros into dedicated file (Frank Li)
- usb: gadget: Add function wakeup support (Elson Roy Serrao)
- KVM: s390: gaccess: Check if guest address is in memslot (Nico Boehr)
- KVM: s390: gaccess: Cleanup access to guest pages (Janis Schoetterl-Glausch)
- KVM: s390: gaccess: Refactor access address range check (Janis Schoetterl-Glausch)
- KVM: s390: gaccess: Refactor gpa and length calculation (Janis Schoetterl-Glausch)
- arm64: probes: Fix uprobes for big-endian kernels (Mark Rutland) [Orabug: 37264236] {CVE-2024-50194}
- arm64:uprobe fix the uprobe SWBP_INSN in big-endian (junhua huang)
- Bluetooth: bnep: fix wild-memory-access in proto_unregister (Ye Bin) [Orabug: 37264096] {CVE-2024-50148}
- s390: Initialize psw mask in perf_arch_fetch_caller_regs() (Heiko Carstens)
- usb: typec: altmode should keep reference to parent (Thadeu Lima de Souza Cascardo) [Orabug: 37264102] {CVE-2024-50150}
- smb: client: fix OOBs when building SMB2_IOCTL request (Paulo Alcantara) [Orabug: 37264107] {CVE-2024-50151}
- scsi: target: core: Fix null-ptr-deref in target_alloc_device() (Wang Hai) [Orabug: 37264112] {CVE-2024-50153}
- genetlink: hold RCU in genlmsg_mcast() (Eric Dumazet)
- tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (Kuniyuki Iwashima) [Orabug: 37264114] {CVE-2024-50154}
- net: systemport: fix potential memory leak in bcm_sysport_xmit() (Wang Hai) [Orabug: 37264156] {CVE-2024-50171}
- net: xilinx: axienet: fix potential memory leak in axienet_start_xmit() (Wang Hai)
- net/smc: Fix searching in list of known pnetids in smc_pnet_add_pnetid (Li RongQing)
- net: ethernet: aeroflex: fix potential memory leak in greth_start_xmit_gbit() (Wang Hai)
- macsec: don't increment counters for an unrelated SA (Sabrina Dubroca)
- net: usb: usbnet: fix race in probe failure (Oliver Neukum)
- drm/msm: Allocate memory for disp snapshot with kvzalloc() (Douglas Anderson)
- drm/msm: Avoid NULL dereference in msm_disp_state_print_regs() (Douglas Anderson) [Orabug: 37264122] {CVE-2024-50156}
- drm/msm/dsi: fix 32-bit signed integer extension in pclk_rate calculation (Jonathan Marek)
- RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages (Bhargava Chenna Marreddy) [Orabug: 37264280] {CVE-2024-50208}
- RDMA/bnxt_re: Return more meaningful error (Kalesh AP)
- ipv4: give an IPv4 dev to blackhole_netdev (Xin Long)
- RDMA/irdma: Fix misspelling of "accept*" (Alexander Zubkov)
- RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP (Anumula Murali Mohan Reddy)
- ALSA: hda/cs8409: Fix possible NULL dereference (Murad Masimov) [Orabug: 37264129] {CVE-2024-50160}
- ARM: dts: bcm2837-rpi-cm3-io3: Fix HDMI hpd-gpio pin (Florian Klink)
- x86/resctrl: Avoid overflow in MB settings in bw_validate() (Martin Kletzander)
- RDMA/bnxt_re: Add a check for memory allocation (Kalesh AP) [Orabug: 37264285] {CVE-2024-50209}
- RDMA/bnxt_re: Fix incorrect AVID type in WQE structure (Saravanan Vajravel)
- bpf: devmap: provide rxq after redirect (Florian Kauer) [Orabug: 37264132] {CVE-2024-50162}
- bpf: Make sure internal and UAPI bpf_redirect flags don't overlap (Toke Høiland-Jørgensen) [Orabug: 37264134] {CVE-2024-50163}
- LTS version: v5.15.169 (Vijayendra Suman)
- ALSA: hda/conexant - Use cached pin control for Node 0x1d on HP EliteOne 1000 G2 (Vasiliy Kovalev)
- powerpc/mm: Always update max/min_low_pfn in mem_topology_setup() (Aneesh Kumar K.V)
- nilfs2: propagate directory read errors from nilfs_find_entry() (Ryusuke Konishi) [Orabug: 37264266] {CVE-2024-50202}
- mptcp: prevent MPC handshake on port-based signal endpoints (Paolo Abeni)
- mptcp: fallback when MPTCP opts are dropped after 1st data (Matthieu Baerts (NGI0))
- tcp: fix mptcp DSS corruption due to large pmtu xmit (Paolo Abeni) [Orabug: 37227408] {CVE-2024-50083}
- mptcp: handle consistently DSS corruption (Paolo Abeni) [Orabug: 37264210] {CVE-2024-50185}
- mptcp: track and update contiguous data status (Geliang Tang)
- irqchip/gic-v4: Don't allow a VMOVP on a dying VPE (Marc Zyngier) [Orabug: 37264231] {CVE-2024-50192}
- pinctrl: ocelot: fix system hang on level based interrupts (Sergey Matsievskiy) [Orabug: 37264246] {CVE-2024-50196}
- x86/entry_32: Clear CPU buffers after register restore in NMI return (Pawan Gupta) [Orabug: 37264234] {CVE-2024-50193}
- x86/entry_32: Do not clobber user EFLAGS.ZF (Pawan Gupta)
- x86/apic: Always explicitly disarm TSC-deadline timer (Zhang Rui)
- x86/resctrl: Annotate get_mem_config() functions as __init (Nathan Chancellor)
- USB: serial: option: add Telit FN920C04 MBIM compositions (Daniele Palmas)
- USB: serial: option: add support for Quectel EG916Q-GL (Benjamin B. Frost)
- xhci: Mitigate failed set dequeue pointer commands (Mathias Nyman)
- xhci: Fix incorrect stream context type macro (Mathias Nyman)
- Bluetooth: btusb: Fix regression with fake CSR controllers 0a12:0001 (Luiz Augusto von Dentz)
- Bluetooth: Remove debugfs directory on module init failure (Aaron Thompson)
- iio: adc: ti-ads124s08: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig (Javier Carrasco)
- iio: proximity: mb1232: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig (Javier Carrasco)
- iio: light: opt3001: add missing full-scale range value (Emil Gedenryd)
- iio: light: veml6030: fix IIO device retrieval from embedded device (Javier Carrasco) [Orabug: 37264254] {CVE-2024-50198}
- iio: light: veml6030: fix ALS sensor resolution (Javier Carrasco)
- iio: hid-sensors: Fix an error handling path in _hid_sensor_set_report_latency() (Christophe JAILLET)
- iio: adc: ti-ads8688: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig (Javier Carrasco)
- iio: dac: stm32-dac-core: add missing select REGMAP_MMIO in Kconfig (Javier Carrasco)
- iio: dac: ltc1660: add missing select REGMAP_SPI in Kconfig (Javier Carrasco)
- iio: dac: ad5770r: add missing select REGMAP_SPI in Kconfig (Javier Carrasco)
- drm/vmwgfx: Handle surface check failure correctly (Nikolay Kuratov)
- drm/radeon: Fix encoder->possible_clones (Ville Syrjälä) [Orabug: 37264263] {CVE-2024-50201}
- io_uring/sqpoll: close race on waiting for sqring entries (Jens Axboe)
- blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race (Omar Sandoval) [Orabug: 37227403] {CVE-2024-50082}
- x86/bugs: Do not use UNTRAIN_RET with IBPB on entry (Johannes Wikner)
- x86/bugs: Skip RSB fill at VMEXIT (Johannes Wikner)
- x86/entry: Have entry_ibpb() invalidate return predictions (Johannes Wikner)
- x86/cpufeatures: Add a IBPB_NO_RET BUG flag (Johannes Wikner)
- x86/cpufeatures: Define X86_FEATURE_AMD_IBPB_RET (Jim Mattson)
- KVM: s390: Change virtual to physical address access in diag 0x258 handler (Michael Mueller)
- s390/sclp_vt220: Convert newlines to CRLF instead of LFCR (Thomas Weißschuh)
- iommu/vt-d: Fix incorrect pci_for_each_dma_alias() for non-PCI devices (Lu Baolu) [Orabug: 37252321] {CVE-2024-50101}
- io_uring/sqpoll: do not put cpumask on stack (Felix Moessbauer)
- io_uring/sqpoll: retain test for whether the CPU is valid (Jens Axboe)
- io_uring/sqpoll: do not allow pinning outside of cpuset (Felix Moessbauer)
- drm/shmem-helper: Fix BUG_ON() on mmap(PROT_WRITE, MAP_PRIVATE) (Wachowski, Karol)
- KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin() (Breno Leitao) [Orabug: 36835836] {CVE-2024-40953}
- dm-crypt, dm-verity: disable tasklets (Mikulas Patocka)
- wifi: mac80211: fix potential key use-after-free (Johannes Berg)
- secretmem: disable memfd_secret() if arch cannot set direct map (Patrick Roy) [Orabug: 37264195] {CVE-2024-50182}
- mm/swapfile: skip HugeTLB pages for unuse_vma (Liu Shixin) [Orabug: 37264256] {CVE-2024-50199}
- fat: fix uninitialized variable (OGAWA Hirofumi)
- irqchip/gic-v3-its: Fix VSYNC referencing an unmapped VPE on GIC v4.1 (Nianyao Tang)
- net: macb: Avoid 20s boot delay by skipping MDIO bus registration for fixed-link PHY (Oleksij Rempel)
- arm64: probes: Fix simulate_ldr*_literal() (Mark Rutland)
- arm64: probes: Remove broken LDR (literal) uprobe support (Mark Rutland) [Orabug: 37252316] {CVE-2024-50099}
- posix-clock: Fix missing timespec64 check in pc_clock_settime() (Jinjie Ruan) [Orabug: 37264241] {CVE-2024-50195}
- net: enetc: add missing static descriptor and inline keyword (Wei Fang)
- net: enetc: remove xdp_drops statistic from enetc_xdp_drop() (Wei Fang)
- udf: Fix bogus checksum computation in udf_rename() (Jan Kara) [Orabug: 37320204] {CVE-2024-43845}
- udf: Don't return bh from udf_expand_dir_adinicb() (Jan Kara)
- udf: Handle error when expanding directory (Jan Kara)
- udf: Remove old directory iteration code (Jan Kara)
- udf: Convert udf_link() to new directory iteration code (Jan Kara)
- udf: Convert udf_mkdir() to new directory iteration code (Jan Kara)
- udf: Convert udf_add_nondir() to new directory iteration (Jan Kara)
- udf: Implement adding of dir entries using new iteration code (Jan Kara)
- udf: Convert udf_unlink() to new directory iteration code (Jan Kara)
- udf: Convert udf_rmdir() to new directory iteration code (Jan Kara)
- udf: Convert empty_dir() to new directory iteration code (Jan Kara)
- udf: Convert udf_get_parent() to new directory iteration code (Jan Kara)
- udf: Convert udf_lookup() to use new directory iteration code (Jan Kara)
- udf: Convert udf_readdir() to new directory iteration (Jan Kara)
- udf: Convert udf_rename() to new directory iteration code (Jan Kara)
- udf: Provide function to mark entry as deleted using new directory iteration code (Jan Kara)
- udf: Implement searching for directory entry using new iteration code (Jan Kara)
- udf: Move udf_expand_dir_adinicb() to its callsite (Jan Kara)
- udf: Convert udf_expand_dir_adinicb() to new directory iteration (Jan Kara)
- udf: New directory iteration code (Jan Kara)
- ALSA: hda/conexant - Fix audio routing for HP EliteOne 1000 G2 (Vasiliy Kovalev)