[El-errata] ELSA-2026-50113 Important: Oracle Linux 8 Unbreakable Enterprise kernel security update

[Errata Announcements for Oracle Linux]

Oracle Linux Security Advisory ELSA-2026-50113

http://linux.oracle.com/errata/ELSA-2026-50113.html

The following updated rpms for Oracle Linux 8 have been uploaded to the Unbreakable Linux Network:

x86_64:
bpftool-5.15.0-317.197.5.1.el8uek.x86_64.rpm
kernel-uek-5.15.0-317.197.5.1.el8uek.x86_64.rpm
kernel-uek-core-5.15.0-317.197.5.1.el8uek.x86_64.rpm
kernel-uek-debug-5.15.0-317.197.5.1.el8uek.x86_64.rpm
kernel-uek-debug-core-5.15.0-317.197.5.1.el8uek.x86_64.rpm
kernel-uek-debug-devel-5.15.0-317.197.5.1.el8uek.x86_64.rpm
kernel-uek-debug-modules-5.15.0-317.197.5.1.el8uek.x86_64.rpm
kernel-uek-debug-modules-extra-5.15.0-317.197.5.1.el8uek.x86_64.rpm
kernel-uek-devel-5.15.0-317.197.5.1.el8uek.x86_64.rpm
kernel-uek-doc-5.15.0-317.197.5.1.el8uek.noarch.rpm
kernel-uek-modules-5.15.0-317.197.5.1.el8uek.x86_64.rpm
kernel-uek-modules-extra-5.15.0-317.197.5.1.el8uek.x86_64.rpm
kernel-uek-container-5.15.0-317.197.5.1.el8uek.x86_64.rpm
kernel-uek-container-debug-5.15.0-317.197.5.1.el8uek.x86_64.rpm

aarch64:
bpftool-5.15.0-317.197.5.1.el8uek.aarch64.rpm
kernel-uek-5.15.0-317.197.5.1.el8uek.aarch64.rpm
kernel-uek-core-5.15.0-317.197.5.1.el8uek.aarch64.rpm
kernel-uek-debug-5.15.0-317.197.5.1.el8uek.aarch64.rpm
kernel-uek-debug-core-5.15.0-317.197.5.1.el8uek.aarch64.rpm
kernel-uek-debug-devel-5.15.0-317.197.5.1.el8uek.aarch64.rpm
kernel-uek-debug-modules-5.15.0-317.197.5.1.el8uek.aarch64.rpm
kernel-uek-debug-modules-extra-5.15.0-317.197.5.1.el8uek.aarch64.rpm
kernel-uek-devel-5.15.0-317.197.5.1.el8uek.aarch64.rpm
kernel-uek-doc-5.15.0-317.197.5.1.el8uek.noarch.rpm
kernel-uek-modules-5.15.0-317.197.5.1.el8uek.aarch64.rpm
kernel-uek-modules-extra-5.15.0-317.197.5.1.el8uek.aarch64.rpm
kernel-uek-container-5.15.0-317.197.5.1.el8uek.aarch64.rpm
kernel-uek-container-debug-5.15.0-317.197.5.1.el8uek.aarch64.rpm


SRPMS:
http://oss.oracle.com/ol8/SRPMS-updates/kernel-uek-5.15.0-317.197.5.1.el8uek.src.rpm

Related CVEs:

CVE-2018-1000204
CVE-2024-37354
CVE-2024-47666
CVE-2025-21888
CVE-2025-38239
CVE-2025-38566
CVE-2025-38571
CVE-2025-40034
CVE-2025-40040
CVE-2025-40083
CVE-2025-40211
CVE-2025-40215
CVE-2025-40248
CVE-2025-40252
CVE-2025-40254
CVE-2025-40257
CVE-2025-40258
CVE-2025-40259
CVE-2025-40261
CVE-2025-40263
CVE-2025-40264
CVE-2025-40269
CVE-2025-40271
CVE-2025-40272
CVE-2025-40273
CVE-2025-40275
CVE-2025-40277
CVE-2025-40279
CVE-2025-40280
CVE-2025-40281
CVE-2025-40283
CVE-2025-40304
CVE-2025-40308
CVE-2025-40309
CVE-2025-40319
CVE-2025-40321
CVE-2025-40322
CVE-2025-40324
CVE-2025-40331
CVE-2025-40342
CVE-2025-40343
CVE-2025-40345
CVE-2025-40360
CVE-2025-40361
CVE-2025-40363
CVE-2025-68185
CVE-2025-68191
CVE-2025-68192
CVE-2025-68194
CVE-2025-68200
CVE-2025-68209
CVE-2025-68224
CVE-2025-68227
CVE-2025-68229
CVE-2025-68241
CVE-2025-68244
CVE-2025-68245
CVE-2025-68284
CVE-2025-68285
CVE-2025-68286
CVE-2025-68287
CVE-2025-68288
CVE-2025-68289
CVE-2025-68295
CVE-2025-68301
CVE-2025-68308
CVE-2025-68312
CVE-2025-68321
CVE-2025-68325
CVE-2025-68327
CVE-2025-68330
CVE-2025-68331
CVE-2025-68734
CVE-2025-68821




Description of changes:

[5.15.0-317.197.5.1]
- Revert "net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn" (Vijayendra Suman)  [Orabug: 38961010]
- Revert "net/rds: expand kref coverage to rds_notifier->n_conn" (Sharath Srinivasan)  [Orabug: 38961010]

[5.15.0-317.197.5]
- KVM: x86: conditionally clear masterclock request for uek=exadata (Dongli Zhang)  [Orabug: 38801641]
- Partial backport of "KVM: x86: Fix software TSC upscaling in kvm_update_guest_time()" (Dongli Zhang)  [Orabug: 38801641]
- uek-rpm: pensando: Move crashkernel to cnic-image-builder (Henry Willard)  [Orabug: 38851137]
- ext4: drop dio overwrite only flag and associated warning (Brian Foster)  [Orabug: 38381010]
- ext4: fix racy may inline data check in dio write (Brian Foster)  [Orabug: 38381010]
- ext4: allow concurrent unaligned dio overwrites (Brian Foster)  [Orabug: 38381010]
- ext4: dio take shared inode lock when overwriting preallocated blocks (Zhang Yi)  [Orabug: 38381010]
- net: mana: Reduce waiting time if HWC not responding (Haiyang Zhang)  [Orabug: 38172423]
- uek-rpm: hnic: add unique hnic signing certs (Tom Saeger)  [Orabug: 38894488]
- drivers/soc/pensando/sbus: Secure mode support. (Hiren Mehta)  [Orabug: 38894106]
- drivers/soc/pensando/pen_secure: Report register address on access errors (Maciej S. Szmigiero)  [Orabug: 38894106]
- drivers/edac/elba_edac: Secure mode support (Hiren Mehta)  [Orabug: 38894106]
- drivers/soc/pensando/bsm: Add secure-mode support. (Hiren Mehta)  [Orabug: 38894106]
- drivers/soc/pensando/rstcause: Add secure mode support. (Hiren Mehta)  [Orabug: 38894106]
- drivers/soc/pensando/penfw: New SMC support for secure-mode. (Hiren Mehta)  [Orabug: 38894106]
- drivers/soc/pensando/sbus: Secure mode support (Hiren Mehta)  [Orabug: 38894106]
- sunrpc: fix client side handling of tls alerts (Olga Kornievskaia)  [Orabug: 38334981]  {CVE-2025-38571}
- sunrpc: fix handling of server side tls alerts (Olga Kornievskaia)  [Orabug: 38334968]  {CVE-2025-38566}
- xfrm: delete x->tunnel as we delete x (Sabrina Dubroca)  [Orabug: 38730492]  {CVE-2025-40215}

[5.15.0-317.197.4]
- gpio: mlxbf3: use platform_get_irq_optional() (David Thompson) [Orabug: 38755419]
- platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (Alok Tiwari) [Orabug: 38755419]
- pinctrl: mlxbf3: Fix return value check for devm_platform_ioremap_resource (Chen Ni) [Orabug: 38755419]
- net/mlx5e: Query FW for buffer ownership (Alexei Lazar) [Orabug: 38755419]
- net/mlx5: Add IFC bits and enums for buf_ownership (Oren Sidi) [Orabug: 38755419]
- net/mlx5: Update mlx5_ifc to support FEC for 200G per lane link modes (Jianbo Liu) [Orabug: 38755419]
- net/mlx5e: Support FEC settings for 100G/lane modes (Cosmin Ratiu) [Orabug: 38755419]
- net/mlx5e: Extract checking of FEC support for a link mode (Cosmin Ratiu) [Orabug: 38755419]
- tcp: Set pingpong threshold via sysctl (Haiyang Zhang) [Orabug: 38853979]
- arm64: hnic: config: Add NBD driver (Patrick Colp) [Orabug: 38858773]
- arm64: pensando: Fix spec file for HNIC (Rob Gardner) [Orabug: 38858773]
- Enable additional drivers needed to support MIPS64 SmartNic (Vijay Kumar) [Orabug: 38846771]
- MIPS: Fix build error for mips ARCH_ATOMIC (Vijay Kumar) [Orabug: 38846771]
- Added atomic addition,subtraction functions. (Anagha K J) [Orabug: 38846771]
- Allocate the required IV size referenced by the cypher handle in init_state (Anagha K J) [Orabug: 38846771]
- Setting up numa system and memory initializations (Anagha K J) [Orabug: 38846771]
- Implemented clocksource provider driven by node-0 FPA_CLK_COUNT (Anagha K J) [Orabug: 38846771]
- Processor cache information made available to userspace (Anagha K J) [Orabug: 38846771]
- MIPS: mm: kmalloc tlb_vpn array to avoid stack overflow (Thomas Bogendoerfer) [Orabug: 38851582]
- usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE (Gopi Krishna Menon)
- ext4: clear i_state_flags when alloc inode (Haibo Chen)
- ext4: align max orphan file size with e2fsprogs limit (Baokun Li)
- PM: runtime: Do not clear needs_force_resume with enabled runtime PM (Rafael J. Wysocki)
- net: enetc: fix build warning when PAGE_SIZE is greater than 128K (Wei Fang)
- net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Xiang Mei) [Orabug: 38783137] {CVE-2025-68325}
- block: fix comment for op_is_zone_mgmt() to include RESET_ALL (Shechenglong)
- fuse: fix readahead reclaim deadlock (Joanne Koong) [Orabug: 38847946] {CVE-2025-68821}
- i40e: validate ring_len parameter against hardware-specific values (Gregory Herrero)
- fs/ntfs3: fix mount failure for sparse runs in run_unpack() (Konstantin Komarov)
- ntfs3: init run lock for extend inode (Edward Adam Davis)

[5.15.0-317.197.3]
- kpcimgr: Enable loading firmware via kernel infrastructure (Joseph Dobosenski) [Orabug: 38546110]
- Move hnic crashkernel to cnic-image-builder (Henry Willard) [Orabug: 38546110]
- Bump supported capmem range count from 64 to 256 (Jan Setje-Eilers) [Orabug: 38546110]
- irqchip/pensando: Fix partial of_iomap() leak on error (#505) (Brad Larson) [Orabug: 38546110]
- pensando: Allow sparse allowed ranges in cap_mem (Maciej S. Szmigiero) [Orabug: 38546110]
- soc/pensando/cap-pcie: Handle zero-ed out MS_CFG_WDT_IDX/WDT_IDX (Joao Martins) [Orabug: 38546110]
- pensando: Enable penfw driver for smartnic (Jan Setje-Eilers) [Orabug: 38546110]
- irqchip/gic-v3-its: remove WARN_ON gic_reserve_range (Tom Saeger) [Orabug: 38546110]
- hnic: Disable CONFIG_OVERLAY_FS_INDEX (Patrick Colp) [Orabug: 38546110]
- pensando: missing diffs from AMD (Jan Setje-Eilers) [Orabug: 38546110]
- hnic: config: Build FUSE into the kernel (not as a module) (Patrick Colp) [Orabug: 38546110]
- hnic: config: Add DM_VERITY support (Patrick Colp) [Orabug: 38546110]
- hnic config: Add LOCKDOWN_LSM support (Patrick Colp) [Orabug: 38546110]
- Subject: uek-rpm: Build hostnic kernel for Pensando (Dave Kleikamp) [Orabug: 38546110]
- pensando: kpcimgr: support pcie port bifurcation (Darshan Prajapati) [Orabug: 38546110]
- Add changes for penfw and sbus.c for secureboot (Rahshekh) [Orabug: 38546110]
- arm64: GIC ITS MSI encapsulator address configured from device tree (Brad Larson) [Orabug: 38546110]
- perf/arm-cmn: Enable AMD Pensando Salina SoC CMN PMU driver (Brad Larson) [Orabug: 38546110]
- reset: salinasr: Add AMD Pensando Salina SoC reset (Brad Larson) [Orabug: 38546110]
- spi: dw-mmio: Add AMD Pensando Salina SoC support (Brad Larson) [Orabug: 38546110]
- EDAC/elba: Support AMD Pensando Giglio SoC (Brad Larson) [Orabug: 38546110]
- arm64: defconfig: Add AMD Pensando Salina SoC defconfig (Brad Larson) [Orabug: 38546110]
- soc/pensando: Support AMD Pensando Salina SoC (Brad Larson) [Orabug: 38546110]
- arm64: dts: Add AMD Pensando Salina SoC support (Brad Larson) [Orabug: 38546110]
- mmc: sdhci-cadence: Support AMD Salina SoC (Brad Larson) [Orabug: 38546110]
- PCI/AER: Avoid NULL pointer dereference in aer_ratelimit() (Breno Leitao) [Orabug: 38597010] {CVE-2025-40034}
- mm/hugetlb: disable huge_pmd_unshare TLB sync by default on Exadata (Joe Jin) [Orabug: 38829889]
- vhost: Account for worker thread under owner's nproc (Mike Christie) [Orabug: 38770748]
- vhost: revert CAP_SYS restrictions on worker ioctls (Mike Christie) [Orabug: 38770748]
- RDMA/cm: Base cm_id destruction timeout on CMA values (Håkon Bugge) [Orabug: 38753654]
- mlx5: Fix default values in create CQ (Akiva Goldberger) [Orabug: 38420735,38773370] {CVE-2025-68209}
- uek-rpm: Allow disabling kabichk at command line (Yifei Liu) [Orabug: 38744825]

[5.15.0-317.197.2]
- x86/its: Build fails with CONFIG_MITIGATION_ITS=n (Alexandre Chartre) [Orabug: 38756952]
- net/sched: adjust device watchdog timer to detect stopped queue at right time (Praveen Kumar Kannoju) [Orabug: 38341919]
- KVM: arm64: Add minimal handling for the ARMv8.7 PMU (Marc Zyngier) [Orabug: 38784458]
- scsi: megaraid_sas: Fix invalid node index (Chen Yu) [Orabug: 38175026] {CVE-2025-38239}
- Revert "iommu/amd: Skip enabling command/event buffers for kdump" (Dongli Zhang) [Orabug: 38790823]
- mm: list_lru: avoid using NULL list_lru_one. (Imran Khan) [Orabug: 38619860]
- mm: list_lru: fix UAF for memory cgroup (Muchun Song) [Orabug: 38619860]
- net/rds: improve conn destroy printk message (Sharath Srinivasan) [Orabug: 38728740]
- net/rds: expand kref coverage to rds_notifier->n_conn (Sharath Srinivasan) [Orabug: 38728740]
- net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn (Sharath Srinivasan) [Orabug: 38728740]
- net/rds: rds_sendmsg must use rs_conn only when not being destroyed (Sharath Srinivasan) [Orabug: 38728743]
- net/mlx5e: Set default burst period for TX and RX reporters (Shahar Shitrit) [Orabug: 38512377]
- devlink: Make health reporter burst period configurable (Shahar Shitrit) [Orabug: 38512377]
- devlink: Introduce burst period for health reporter (Shahar Shitrit) [Orabug: 38512377]
- devlink: Move health reporter recovery abort logic to a separate function (Shahar Shitrit) [Orabug: 38512377]
- devlink: Move graceful period parameter to reporter ops (Shahar Shitrit) [Orabug: 38512377]
- devlink: introduce devlink_nl_put_u64() (Przemek Kitszel) [Orabug: 38512377]
- net/mlx5: remove fw reporter dump option for non PF (Moshe Shemesh) [Orabug: 38512377]
- net/mlx5: remove fw_fatal reporter dump option for non PF (Moshe Shemesh) [Orabug: 38512377]
- devlink: Hold devlink lock on health reporter dump get (Moshe Shemesh) [Orabug: 38512377]
- Revert "net/mlx5: set graceful_period to 0 to allow multiple transmission queue recovery" (Qing Huang) [Orabug: 38512377]
- NVIDIA: SAUCE: iommu/arm-smmu-v3: Allow default substream bypass with a pasid support (Nicolin Chen) [Orabug: 38463999]
- RDMA/mlx5: Fix a WARN during dereg_mr for DM type (Yishai Hadas) [Orabug: 37766291,38463999] {CVE-2025-21888}
- uek-rpm: replace CONFIG_IOMMU_SVA_LIB with CONFIG_IOMMU_SVA (Junxiao Bi) [Orabug: 38463999]
- iommu/sva: Rename CONFIG_IOMMU_SVA_LIB to CONFIG_IOMMU_SVA (Fenghua Yu) [Orabug: 38463999]

[5.15.0-317.197.1]
- LTS version: v5.15.197 (Vijayendra Suman)
- libbpf: Fix invalid return address register in s390 (Daniel T. Lee)
- libbpf, riscv: Use a0 for RC register (Yixun Lan)
- libbpf: Fix riscv register names (Ilya Leoshkevich)
- selftests/bpf: Don't rely on preserving volatile in PT_REGS macros in loop3 (Andrii Nakryiko)
- scsi: pm80xx: Set phy->enable_completion only when we (Igor Pylypiv) [Orabug: 37159744] {CVE-2024-47666}
- Bluetooth: Add more enc key size check (Alex Lu)
- usb: renesas_usbhs: Fix synchronous external abort on unbind (Claudiu Beznea) [Orabug: 38792571] {CVE-2025-68327}
- usb: renesas_usbhs: Convert to platform remove callback returning void (Uwe Kleine-König)
- smb: client: fix memory leak in cifs_construct_tcon() (Paulo Alcantara) [Orabug: 38773704] {CVE-2025-68295}
- mptcp: Fix proto fallback detection with BPF (Jiayuan Chen) [Orabug: 38773435] {CVE-2025-68227}
- mptcp: avoid unneeded subflow-level drops (Paolo Abeni)
- selftests: mptcp: join: rm: set backup flag (Matthieu Baerts)
- staging: rtl8712: Remove driver using deprecated API wext (Philipp Hortmann)
- libceph: prevent potential out-of-bounds writes in handle_auth_session_key() (Ziming Zhang) [Orabug: 38773649] {CVE-2025-68284}
- libceph: fix potential use-after-free in have_mon_and_osd_map() (Ilya Dryomov) [Orabug: 38773655] {CVE-2025-68285}
- drm/amd/display: Check NULL before accessing (Alex Hung) [Orabug: 38773664] {CVE-2025-68286}
- drm: sti: fix device leaks at component probe (Johan Hovold)
- USB: serial: option: add support for Rolling RW101R-GL (Vanillan Wang)
- USB: serial: ftdi_sio: add support for u-blox EVK-M101 (Oleksandr Suvorov)
- xhci: dbgtty: Fix data corruption when transmitting data form DbC to host (Mathias Nyman)
- usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths (Manish Nagar) [Orabug: 38773671] {CVE-2025-68287}
- usb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer (Owen Gu) [Orabug: 38792593] {CVE-2025-68331}
- usb: storage: sddr55: Reject out-of-bound new_pba (Tianchu Chen) [Orabug: 38762730] {CVE-2025-40345}
- usb: storage: Fix memory leak in USB bulk transport (Desnes Nunes) [Orabug: 38773677] {CVE-2018-1000204,CVE-2025-68288}
- usb: gadget: f_eem: Fix memory leak in eem_unwrap (Kuen-Han Tsai) [Orabug: 38773687] {CVE-2025-68289}
- usb: cdns3: Fix double resource release in cdns3_pci_probe (Miaoqian Lin)
- serial: amba-pl011: prefer dma_mapping_error() over explicit address checking (Miaoqian Lin)
- firmware: stratix10-svc: fix bug in saving controller data (Khairul Anuar Romli)
- slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves (Miaoqian Lin)
- thunderbolt: Add support for Intel Wildcat Lake (Alan Borzeszkowski)
- drivers/usb/dwc3: fix PCI parent check (Jamie Iles)
- dm-verity: fix unreliable memory allocation (Mikulas Patocka)
- can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling (Marc Kleine-Budde)
- can: sja1000: fix max irq loop handling (Thomas Mühlbacher)
- atm/fore200e: Fix possible data race in fore200e_open() (Gui-Dong Han)
- iio: accel: bmc150: Fix irq assumption regression (Linus Walleij) [Orabug: 38792587] {CVE-2025-68330}
- iio:common:ssp_sensors: Fix an error handling path ssp_probe() (Christophe Jaillet)
- iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields (Francesco Lavra)
- Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()" (Jiri Olsa)
- spi: bcm63xx: fix premature CS deassertion on RX-only transactions (Hang Zhou)
- mailbox: mailbox-test: Fix debugfs_create_dir error checking (Xu Wang)
- net: atlantic: fix fragment overflow handling in RX path (Jiefeng Zhang) [Orabug: 38773729] {CVE-2025-68301}
- net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic (Vladimir Oltean)
- net: dsa: sja1105: simplify static configuration reload (Russell King)
- net: dsa: sja1105: Convert to mdiobus_c45_read (Andrew Lunn)
- net: sxgbe: fix potential NULL dereference in sxgbe_rx() (Alexey Kodanev)
- net/mlx5e: Fix validation logic in rate limiting (Danielle Costantino)
- net: aquantia: Add missing descriptor cache invalidation on ATL2 (Kai-Heng Feng)
- platform/x86: intel: punit_ipc: fix memory corruption (Dan Carpenter)
- Bluetooth: SMP: Fix not generating mackey and ltk when repairing (Luiz Augusto von Dentz)
- can: kvaser_usb: leaf: Fix potential infinite loop in command parsers (Seungjin Bae) [Orabug: 38773760] {CVE-2025-68308}
- Revert "block: don't add or resize partition on the disk with GENHD_FL_NO_PART" (Gulam Mohamed) [Orabug: 38652797]
- Revert "block: Move checking GENHD_FL_NO_PART to bdev_add_partition()" (Gulam Mohamed) [Orabug: 38652797]
- mptcp: do not fallback when OoO is present (Paolo Abeni)
- mptcp: fix a race in mptcp_pm_del_add_timer() (Eric Dumazet) [Orabug: 38730656] {CVE-2025-40257}
- mptcp: fix premature close in case of fallback (Paolo Abeni)
- mptcp: fix ack generation for fallback msk (Paolo Abeni)
- dt-bindings: pinctrl: toshiba,visconti: Fix number of items in groups (Krzysztof Kozlowski)
- Input: pegasus-notetaker - fix potential out-of-bounds access (Seungjin Bae)
- Input: remove third argument of usb_maxpacket() (Vincent Mailhol)
- usb: deprecate the third argument of usb_maxpacket() (Vincent Mailhol)
- mptcp: Disallow MPTCP subflows from sockmap (Jiayuan Chen)
- selftests: mptcp: connect: fix fallback note due to OoO (Matthieu Baerts)
- pmdomain: samsung: plug potential memleak during probe (André Draszik)
- pmdomain: arm: scmi: Fix genpd leak on provider registration failure (Sudeep Holla)
- pmdomain: imx: Fix reference count leak in imx_gpc_remove (Miaoqian Lin)
- net: netpoll: fix incorrect refcount handling causing incorrect cleanup (Breno Leitao) [Orabug: 38773509] {CVE-2025-68245}
- mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4 (Shawn Lin)
- net: qede: Initialize qede_ll_ops with designated initializer (Nathan Chancellor)
- btrfs: fix crash on racing fsync and size-extending write into prealloc (Omar Sandoval) [Orabug: 36774582] {CVE-2024-37354}
- btrfs: add helper to truncate inode items when logging inode (Filipe Manana)
- Makefile.compiler: replace cc-ifversion with compiler-specific macros (Nick Desaulniers)
- tracing/tools: Fix incorrcet short option in usage text for --threads (Zhang Chujun)
- net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error (Nishanth Menon)
- ALSA: usb-audio: fix uac2 clock source at terminal parser (René Rebe)
- mm/secretmem: fix use-after-free race in fault handler (Lance Yang) [Orabug: 38737039] {CVE-2025-40272}
- mm/mm_init: fix hash table order logging in alloc_large_system_hash() (Isaac J. Manjarres)
- kconfig/nconf: Initialize the default locale at startup (Jakub Horký)
- kconfig/mconf: Initialize the default locale at startup (Jakub Horký)
- net: tls: Cancel RX async resync request on rcd_delta overflow (Shahar Shitrit)
- selftests: net: use BASH for bareudp testing (Po-Hsu Lin)
- scsi: core: Fix a regression triggered by scsi_host_busy() (Bart Van Assche) [Orabug: 38773426]
- vsock: Ignore signal/timeout on connect() if already established (Michal Luczaj) [Orabug: 38730611,38786193,38788594] {CVE-2025-40248}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Pavel Zhigulin) [Orabug: 38730629] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Alejandro Colomar)
- platform/x86/intel/speed_select_if: Convert PCIBIOS_* return codes to errnos (Xu Wang)
- s390/ctcm: Fix double-kfree (Aleksei Nikiforov)
- net: openvswitch: remove never-working support for setting nsh fields (Ilya Maximets) [Orabug: 38730648] {CVE-2025-40254}
- net: dsa: hellcreek: fix missing error handling in LED registration (Pavel Zhigulin)
- mlxsw: spectrum: Fix memory leak in mlxsw_sp_flower_stats() (Zilin Guan)
- drm/tegra: dc: Fix reference leak in tegra_dc_couple() (Ma Ke)
- mptcp: fix race condition in mptcp_schedule_work() (Eric Dumazet) [Orabug: 38730659] {CVE-2025-40258}
- MIPS: Malta: Fix !EVA SOC-it PCI MMIO (Maciej W. Rozycki)
- scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show() (Hamza Mahfooz) [Orabug: 38773440] {CVE-2025-68229}
- scsi: sg: Do not sleep in atomic context (Bart Van Assche) [Orabug: 38730663] {CVE-2025-40259}
- nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [Orabug: 38730673] {CVE-2025-40261}
- Input: imx_sc_key - fix memory corruption on unload (Dan Carpenter)
- Input: cros_ec_keyb - fix an invalid memory access (Tzung-Bi Shih) [Orabug: 38730680] {CVE-2025-40263}
- be2net: pass wrb_params in case of OS2BMC (Andrey Vatoropin) [Orabug: 38730689] {CVE-2025-40264}
- exfat: check return value of sb_min_blocksize in exfat_read_boot_sector (Yongpeng Yang)
- mtd: rawnand: cadence: fix DMA device NULL pointer dereference (Niravkumar L Rabara)
- net/sched: act_connmark: handle errno on tcf_idr_check_alloc (Pedro Tammela)
- isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe() (Abdun Nihaal) [Orabug: 38798907] {CVE-2025-68734}
- EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection (Niravkumar L Rabara)
- EDAC/altera: Handle OCRAM ECC enable after warm reset (Niravkumar L Rabara)
- spi: Try to get ACPI GPIO IRQ earlier (Hans de Goede)
- ALSA: usb-audio: Fix missing unlock at error path of maxpacksize check (Takashi Iwai)
- ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (Takashi Iwai) [Orabug: 38737023] {CVE-2025-40269}
- fs/proc: fix uaf in proc_readdir_de() (Wei Yang) [Orabug: 38737033,38786194,38788587] {CVE-2025-40271}
- ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe (Chuang Wang) [Orabug: 38773495] {CVE-2025-68241}
- strparser: Fix signed/unsigned mismatch bug (Nate Karstens)
- gcov: add support for GCC 15 (Peter Oberparleiter)
- NFSD: free copynotify stateid in nfs4_free_ol_stateid() (Olga Kornievskaia) [Orabug: 38737042] {CVE-2025-40273}
- HID: hid-ntrig: Prevent memory leak in ntrig_report_version() (Masami Ichikawa)
- mtd: onenand: Pass correct pointer to IRQ handler (Dan Carpenter)
- lib/crypto: arm/curve25519: Disable on CPU_BIG_ENDIAN (Eric Biggers)
- mm/ksm: fix flag-dropping behavior in ksm_madvise (Jakub Acs) [Orabug: 38592026] {CVE-2025-40040}
- bpf: Add bpf_prog_run_data_pointers() (Eric Dumazet) [Orabug: 38773327] {CVE-2025-68200}
- ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd (Haein Lee) [Orabug: 38737051] {CVE-2025-40275}
- NFSv4: Fix an incorrect parameter when calling nfs4_call_sync() (Trond Myklebust)
- drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (Ian Forbes) [Orabug: 38737060] {CVE-2025-40277}
- ASoC: cs4271: Fix regulator leak on probe failure (Xu Wang)
- regulator: fixed: fix GPIO descriptor leak on register failure (Xu Wang)
- acpi,srat: Fix incorrect device handle check for Generic Initiator (Shuai Xue)
- Bluetooth: L2CAP: export l2cap_chan_hold for modules (Pauli Virtanen)
- hsr: Fix supervision frame sending on HSRv0 (Felix Maurer)
- net_sched: limit try_bulk_dequeue_skb() batches (Eric Dumazet)
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Gal Pressman)
- net/mlx5e: Fix maxrate wraparound in threshold between units (Gal Pressman)
- net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak (Ranganath V N)
- net: sched: act_connmark: initialize struct tc_ife to fix kernel leak (Ranganath V N) [Orabug: 38737072] {CVE-2025-40279}
- net_sched: act_connmark: use RCU in tcf_connmark_dump() (Eric Dumazet)
- net/sched: act_connmark: transition to percpu stats and rcu (Pedro Tammela)
- net: sched: act_connmark: get rid of tcf_connmark_walker and tcf_connmark_search (Zhengchao Shao)
- net: sched: act: move global static variable net_id to tc_action_ops (Zhengchao Shao)
- wifi: mac80211: skip rate verification for not captured PSDUs (Benjamin Berg)
- net: mdio: fix resource leak in mdiobus_register_device() (Csaba Buday)
- tipc: Fix use-after-free in tipc_mon_reinit_self(). (Kuniyuki Iwashima) [Orabug: 38737082,38786195,38788585] {CVE-2025-40280}
- net/smc: fix mismatch between CLC header and proposal (D. Wythe)
- sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto (Eric Dumazet) [Orabug: 38737090] {CVE-2025-40281}
- Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions (Pauli Virtanen)
- Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion (Pauli Virtanen)
- Bluetooth: 6lowpan: reset link-local header on ipv6 recv path (Pauli Virtanen)
- Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF (Raphael Pinsonneault-Thibeault) [Orabug: 38737103] {CVE-2025-40283}
- net: fec: correct rx_bytes statistic for the case SHIFT16 is set (Wei Fang)
- ASoC: max98090/91: fixed max98091 ALSA widget powering up/down (Sharique Mohammad)
- NFS: check if suid/sgid was cleared after a write as needed (Scott Mayhew)
- HID: quirks: avoid Cooler Master MM712 dongle wakeup bug (Tristan Lobb)
- NFS4: Fix state renewals missing after boot (Joshua Watt)
- RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid rfence errors (Danil Skrebenkov)
- compiler_types: Move unused static inline functions warning to W=2 (Peter Zijlstra)
- drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD (Janusz Krzysztofik) [Orabug: 38773506] {CVE-2025-68244}
- selftests: netdevsim: set test timeout to 10 minutes (Jakub Kicinski)
- extcon: adc-jack: Cleanup wakeup source only if it was enabled (Krzysztof Kozlowski)
- lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC (Nathan Chancellor)
- rtc: rx8025: fix incorrect register reference (Yuta Hayama)
- tracing: Fix memory leaks in create_field_var() (Zilin Guan)
- bnxt_en: Fix a possible memory leak in bnxt_ptp_init (Kalesh Ap)
- net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup (Qendrim Maxhuni) [Orabug: 38773282] {CVE-2025-68192}
- sctp: Hold sock lock while iterating over address list (Stefan Wiehler)
- sctp: Prevent TOCTOU out-of-bounds write (Stefan Wiehler) [Orabug: 38747446] {CVE-2025-40331}
- sctp: Hold RCU read lock while iterating over address list (Stefan Wiehler)
- net: dsa: b53: stop reading ARL entries if search is done (Jonas Gorski)
- net: dsa: b53: fix enabling ip multicast (Jonas Gorski)
- net: dsa: b53: fix resetting speed and pause on forced link (Jonas Gorski)
- net: vlan: sync VLAN features with lower device (Hangbin Liu)
- selftests: netdevsim: Fix ethtool-coalesce.sh fail by installing ethtool-common.sh (Wang Liang)
- netdevsim: add Makefile for selftests (David Wei)
- selftests/net: use destination options instead of hop-by-hop (Anubhav Singh)
- selftests/net: fix GRO coalesce test and add ext header coalesce tests (Richard Gobert)
- selftests/net: fix out-of-order delivery of FIN in gro:tcp test (Anubhav Singh)
- net: dsa: tag_brcm: legacy: fix untagged rx on unbridged ports for bcm63xx (Jonas Gorski)
- riscv: ptdump: use seq_puts() in pt_dump_seq_puts() macro (Josephine Pfeiffer)
- Revert "wifi: ath10k: avoid unnecessary wait for service ready message" (Baochen Qiang)
- ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again (Kailang Yang)
- ceph: add checking of wait_for_completion_killable() return value (Viacheslav Dubeyko)
- ASoC: meson: aiu-encoder-i2s: fix bit clock polarity (Valerio Setti)
- fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (Albin Babu Varghese) [Orabug: 38737181] {CVE-2025-40304}
- ACPI: property: Return present device nodes only on fwnode interface (Sakari Ailus)
- 9p: sysfs_init: don't hardcode error to ENOMEM (Randall P. Embry)
- cpufreq: tegra186: Initialize all cores to max frequencies (Aaron Kling)
- 9p: fix /sys/fs/9p/caches overwriting itself (Randall P. Embry)
- clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled (Matthias Schiffer)
- clk: at91: clk-master: Add check for divide by 3 (Ryan Wanner)
- ARM: at91: pm: save and restore ACR during PLL disable/enable (Nicolas Ferre)
- rtc: pcf2127: clear minute/second interrupt (Josua Mayer)
- um: Fix help message for ssl-non-raw (Tiwei Bie)
- fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink (Yikang Yue)
- btrfs: mark dirty extent range for out of bound prealloc extents (Austinchang)
- RDMA/hns: Fix wrong WQE data when QP wraps around (Junxian Huang)
- RDMA/irdma: Set irdma_cq cq_num field during CQ create (Jacob Moroni)
- RDMA/irdma: Remove unused struct irdma_cq fields (Jacob Moroni)
- RDMA/irdma: Fix SD index calculation (Jacob Moroni)
- ACPICA: Update dsmethod.c to get rid of unused variable warning (Saket Dumbre)
- orangefs: fix xattr related buffer overflow... (Mike Marshall)
- page_pool: Clamp pool size to max 16K pages (Dragos Tatulea)
- exfat: limit log print for IO error (Chi Zhiling)
- ALSA: usb-audio: add mono main switch to Presonus S1824c (Roy Vegard Ovesen)
- Bluetooth: bcsp: receive data only if registered (Ivan Pravdin) [Orabug: 38737212] {CVE-2025-40308}
- Bluetooth: SCO: Fix UAF on sco_conn_free (Luiz Augusto von Dentz) [Orabug: 38737223] {CVE-2025-40309}
- net: macb: avoid dealing with endianness in macb_set_hwaddr() (Théo Lebrun)
- fs: ext4: change GFP_KERNEL to GFP_NOFS to avoid deadlock (Chuguangqing) [Orabug: 38773127] {CVE-2025-40361}
- scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill() (Alok Tiwari)
- nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode dereferencing (Al Viro) [Orabug: 38773244] {CVE-2025-68185}
- NFSv4.1: fix mount hang after CREATE_SESSION failure (Anthony Iliopoulos)
- NFSv4: handle ERR_GRACE on delegation recalls (Olga Kornievskaia)
- remoteproc: qcom: q6v5: Avoid handling handover twice (Stephan Gerhold)
- sparc/module: Add R_SPARC_UA64 relocation handling (Koakuma)
- PCI: cadence: Check for the existence of cdns_pcie::ops before using it (Chen Wang)
- r8169: set EEE speed down ratio to 1 (Chunhao Lin)
- net: intel: fm10k: Fix parameter idx set but not used (Brahmajit Das)
- wifi: ath10k: Fix connection after GTK rekeying (Loic Poulain)
- iommu/vt-d: Replace snprintf with scnprintf in dmar_latency_snapshot() (Seyediman Seyedarab)
- net: ethernet: microchip: sparx5: make it selectable for ARCH_LAN969X (Robert Marko)
- jfs: fix uninitialized waitqueue in transaction manager (Shaurya Rane)
- jfs: Verify inode mode when loading from disk (Tetsuo Handa)
- ipv6: np->rxpmtu race annotation (Eric Dumazet)
- usb: xhci: plat: Facilitate using autosuspend for xhci plat devices (Krishna Kurapati)
- usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs (Forest Crossman)
- allow finish_no_open(file, ERR_PTR(-E...)) (Al Viro)
- scsi: lpfc: Define size of debugfs entry for xri rebalancing (Justin Tee)
- scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup (Justin Tee)
- scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET (Justin Tee)
- selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency (Nai-Chen Cheng)
- page_pool: always add GFP_NOWARN for ATOMIC allocations (Jakub Kicinski) [Orabug: 38773835] {CVE-2025-68321}
- drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl (Tvrtko Ursulin)
- net/cls_cgroup: Fix task_get_classid() during qdisc run (Yafang Shao)
- udp_tunnel: use netdev_warn() instead of netdev_WARN() (Alok Tiwari) [Orabug: 38773275] {CVE-2025-68191}
- selftests: Replace sleep with slowwait (David Ahern)
- eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP (Daniel Palmer)
- selftests: Disable dad for ipv6 in fcnal-test.sh (David Ahern)
- x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of PV_UNHALT (Li Rongqing)
- netfilter: nf_reject: don't reply to icmp error messages (Florian Westphal)
- selftests: traceroute: Use require_command() (Ido Schimmel)
- media: redrat3: use int type to store negative error codes (Rong Qianfeng)
- net: sh_eth: Disable WoL if system can not suspend (Niklas Söderlund)
- phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0 (Michael Riesch)
- phy: cadence: cdns-dphy: Enable lower resolutions in dphy (Harikrishna Shenoy)
- ntfs3: pretend $Extend records as regular files (Tetsuo Handa)
- net: phy: marvell: Fix 88e1510 downshift counter errata (Rohan G Thomas)
- drm/msm: make sure to not queue up recovery more than once (Antonino Maniscalco)
- usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget (Chen Yufeng)
- usb: gadget: f_hid: Fix zero length packet transfer (William Wu)
- iommu/amd: Skip enabling command/event buffers for kdump (Ashish Kalra)
- net: call cond_resched() less often in __release_sock() (Eric Dumazet)
- net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms (Juraj Šarinay)
- ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled (Yue Haibing)
- drm/msm/dsi/phy_7nm: Fix missing initial VCO rate (Krzysztof Kozlowski)
- drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL (Krzysztof Kozlowski)
- dmaengine: dw-edma: Set status for callback_result (Devendra K Verma)
- dmaengine: mv_xor: match alloc_wc and free_wc (Rosen Penev)
- dmaengine: sh: setup_xref error handling (Thomas Andreatta)
- ptp: Limit time setting of PTP clocks (Miroslav Lichvar)
- scsi: pm8001: Use int instead of u32 to store error codes (Rong Qianfeng)
- mips: lantiq: xway: sysctrl: rename stp clock (Aleksander Jan Bajkowski)
- mips: lantiq: danube: add missing device_type in pci node (Aleksander Jan Bajkowski)
- mips: lantiq: danube: add missing properties to cpu node (Aleksander Jan Bajkowski)
- media: fix uninitialized symbol warnings (Chelsy Ratnawat)
- drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption (Amber Lin)
- extcon: adc-jack: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- scsi: pm80xx: Fix race condition caused by static variables (Francisco Gutierrez)
- scsi: mpi3mr: Fix controller init failure on fault during queue creation (Chandrakanth Patil)
- ALSA: usb-audio: Add validation of UAC2/UAC3 effect units (Takashi Iwai)
- PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call (Sungho Kim)
- net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV. (Kuniyuki Iwashima)
- net: When removing nexthops, don't call synchronize_net if it is not necessary (Christoph Paasch)
- char: misc: Does not request module for miscdevice with dynamic minor (Zijun Hu)
- usb: gadget: f_ncm: Fix MAC assignment NCM ethernet (Raub Camaioni)
- iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register (Rodrigo Gobbi)
- drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts (Dmitry Baryshkov)
- media: imon: make send_packet() more robust (Tetsuo Handa) [Orabug: 38773297] {CVE-2025-68194}
- net: ipv6: fix field-spanning memcpy warning in AH output (Charalampos Mitrodimas) [Orabug: 38773140] {CVE-2025-40363}
- bridge: Redirect to backup port when port is administratively down (Ido Schimmel)
- powerpc/eeh: Use result of error_detected() in uevent (Niklas Schnelle)
- thunderbolt: Use is_pciehp instead of is_hotplug_bridge (Lukas Wunner)
- net: stmmac: Check stmmac_hw_setup() in stmmac_resume() (Tiezhu Yang)
- x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall (Kirill A. Shutemov)
- drm/tidss: Set crtc modesetting parameters with adjusted mode (Jayesh Choudhary)
- drm/tidss: Use the crtc_* timings when programming the HW (Tomi Valkeinen)
- media: pci: ivtv: Don't create fake v4l2_fh (Laurent Pinchart)
- drm/amdkfd: return -ENOTTY for unsupported IOCTLs (Geoffrey Mcrae)
- selftests/net: Ensure assert() triggers in psock_tpacket.c (Wake Liu)
- selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8 (Wake Liu)
- PCI: Disable MSI on RDC PCI to PCIe bridges (Marcos Del Sol Vives)
- drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() (Seyediman Seyedarab)
- drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff (Sathishkumar S)
- drm/amd/pm: Use cached metrics data on arcturus (Lijo Lazar)
- drm/amd/pm: Use cached metrics data on aldebaran (Lijo Lazar)
- mfd: da9063: Split chip variant reading in two bus transactions (Jens Kehne)
- mfd: madera: Work around false-positive -Wininitialized warning (Arnd Bergmann)
- mfd: stmpe-i2c: Add missing MODULE_LICENSE (Alexander Stein)
- mfd: stmpe: Remove IRQ domain upon removal (Alexander Stein)
- tools/power x86_energy_perf_policy: Prefer driver HWP limits (Len Brown)
- tools/power x86_energy_perf_policy: Enhance HWP enable (Len Brown)
- tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage (Kaushlendra Kumar)
- tools/cpupower: Fix incorrect size in cpuidle_state_disable() (Kaushlendra Kumar)
- hwmon: (dell-smm) Add support for Dell OptiPlex 7040 (Armin Wolf)
- uprobe: Do not emulate/sstep original instruction when ip is changed (Jiri Olsa)
- clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Daniel Lezcano)
- cpuidle: Fail cpuidle device registration if there is one already (Rafael J. Wysocki)
- tools/cpupower: fix error return value in cpupower_write_sysfs() (Kaushlendra Kumar)
- video: backlight: lp855x_bl: Set correct EPROM start for LP8556 (Svyatoslav Ryhel)
- nvme-fc: use lock accessing port_state and rport state (Daniel Wagner) [Orabug: 38747531] {CVE-2025-40342}
- nvmet-fc: avoid scheduling association deletion twice (Daniel Wagner) [Orabug: 38747538] {CVE-2025-40343}
- tee: allow a driver to allocate a tee_device without a pool (Amirreza Zarrabi)
- ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() (Hans de Goede)
- mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card (Sarthak Garg)
- power: supply: sbs-charger: Support multiple devices (Fabien Proriol)
- hwmon: (sbtsi_temp) AMD CPU extended temperature range support (Chuande Chen)
- ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[] (Hans de Goede)
- ACPI: PRM: Skip handlers with NULL handler_address or NULL VA (Shang Song)
- irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment (Christian Bruel)
- arc: Fix __fls() const-foldability via __builtin_clzl() (Kees Cook)
- cpufreq/longhaul: handle NULL policy in longhaul_exit (Dennis Beier)
- selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2 (Ricardo B. Marlière)
- ACPI: video: force native for Lenovo 82K8 (Mario Limonciello)
- memstick: Add timeout to prevent indefinite waiting (Jiayi Li)
- mmc: host: renesas_sdhi: Fix the actual clock (Biju Das)
- pinctrl: single: fix bias pull up/down handling in pin_config_set (Chi Zhang)
- bpf: Don't use %pK through printk (Thomas Weißschuh)
- soc: ti: pruss: don't use %pK through printk (Thomas Weißschuh)
- spi: loopback-test: Don't use %pK through printk (Thomas Weißschuh)
- soc: qcom: smem: Fix endian-unaware access of num_entries (Jens Reidel)
- soc: aspeed: socinfo: Add AST27xx silicon IDs (Ryan Chen)
- block: make REQ_OP_ZONE_OPEN a write operation (Damien Le Moal)
- drm/sysfb: Do not dereference NULL pointer in plane reset (Thomas Zimmermann) [Orabug: 38773123] {CVE-2025-40360}
- drm/sched: Fix race in drm_sched_entity_select_rq() (Philipp Stanner)
- usb: gadget: f_fs: Fix epfile null pointer access after ep enable. (Owen Gu)
- Revert "docs/process/howto: Replace C89 with C11" (Matthieu Baerts)
- arch: back to -std=gnu89 in < v5.18 (Matthieu Baerts)
- x86/boot: Compile boot code with -std=gnu11 too (Alexey Dobriyan)
- xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event (Mathias Nyman)
- xhci: dbc: Avoid event polling busyloop if pending rx transfers are inactive. (Mathias Nyman)
- xhci: dbc: Improve performance by removing delay in transfer event polling. (Mathias Nyman)
- xhci: dbc: Allow users to modify DbC poll interval via sysfs (Uday M Bhat)
- xhci: dbc: poll at different rate depending on data transfer activity (Mathias Nyman)
- xhci: dbc: Provide sysfs option to configure dbc descriptors (Mathias Nyman)
- x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID (Babu Moger)
- net: phy: dp83867: Disable EEE support as not implemented (Emanuele Ghidoli)
- can: gs_usb: increase max interface to U8_MAX (Celeste Liu)
- net: ravb: Enforce descriptor type ordering (Lad Prabhakar)
- ravb: Exclude gPTP feature support for RZ/G2L (Biju Das)
- dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp (Xu Yang)
- serial: 8250_dw: handle reset control deassert error (Artem Shimko)
- serial: 8250_dw: Use devm_add_action_or_reset() (Andy Shevchenko)
- block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL (Damien Le Moal)
- drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland (John Smith)
- drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji (John Smith)
- drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() (Yang Wang)
- net: hns3: return error code when function fails (Jijie Shao)
- drm/etnaviv: fix flush sequence logic (Tomeu Vizoso)
- usbnet: Prevents free active kevent (Lizhi Xu) [Orabug: 38773783] {CVE-2025-68312}
- libbpf: Fix powerpc's stack register definition in bpf_tracing.h (Andrii Nakryiko)
- libbpf: Normalize PT_REGS_xxx() macro definitions (Andrii Nakryiko)
- riscv, libbpf: Add RISC-V (RV64) support to bpf_tracing.h (Björn Töpel)
- bpf: Do not audit capability check in do_jit() (Ondrej Mosnacek)
- bpf: Sync pending IRQ work before freeing ring buffer (Noorain Eqbal) [Orabug: 38737284] {CVE-2025-40319}
- ALSA: usb-audio: fix control pipe direction (Roy Vegard Ovesen)
- drm/msm/a6xx: Fix GMU firmware parser (Akhil P Oommen)
- wifi: ath10k: Fix memory leak on unsupported WMI command (Loic Poulain)
- ASoC: qdsp6: q6asm: do not sleep while atomic (Srinivas Kandagatla)
- mptcp: restore window probe (Paolo Abeni)
- fbdev: valkyriefb: Fix reference count leak in valkyriefb_init (Miaoqian Lin)
- fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS (Florian Fuchs)
- wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode (Gokul Sivakumar) [Orabug: 38737291] {CVE-2025-40321}
- fbdev: bitblit: bound-check glyph index in bit_putcs* (Junjie Cao) [Orabug: 38737300] {CVE-2025-40322}
- ACPI: video: Fix use-after-free in acpi_video_switch_brightness() (Yuhao Jiang) [Orabug: 38687004] {CVE-2025-40211}
- fbdev: atyfb: Check if pll_ops->init_pll failed (Daniel Palmer)
- net: usb: asix_devices: Check return value of usbnet_get_endpoints (Miaoqian Lin)
- NFSD: Fix crash in nfsd4_read_release() (Chuck Lever) [Orabug: 38737315] {CVE-2025-40324}
- btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() (Filipe Manana)
- btrfs: always drop log root tree reference in btrfs_replay_log() (Filipe Manana)
- btrfs: scrub: replace max_t()/min_t() with clamp() in scrub_throttle_dev_io() (Thorsten Blum)
- x86/bugs: Fix reporting of LFENCE retpoline (David Kaplan)
- net/sched: sch_qfq: Fix null-deref in agg_dequeue (Xiang Mei) [Orabug: 38597084] {CVE-2025-40083}