[El-errata] ELSA-2026-500572 Important: Oracle Linux 9 Unbreakable Enterprise kernel security update
Errata Announcements for Oracle Linux
el-errata at oss.oracle.com
Tue Nov 3 14:46:20 UTC 2026
Oracle Linux Security Advisory ELSA-2026-500572
http://linux.oracle.com/errata/ELSA-2026-500572.html
The following updated rpms for Oracle Linux 9 have been uploaded to the Unbreakable Linux Network:
x86_64:
kernel-uek-6.12.0-208.112.5.el9uek.x86_64.rpm
kernel-uek-core-6.12.0-208.112.5.el9uek.x86_64.rpm
kernel-uek-debug-6.12.0-208.112.5.el9uek.x86_64.rpm
kernel-uek-debug-core-6.12.0-208.112.5.el9uek.x86_64.rpm
kernel-uek-debug-devel-6.12.0-208.112.5.el9uek.x86_64.rpm
kernel-uek-debug-modules-6.12.0-208.112.5.el9uek.x86_64.rpm
kernel-uek-debug-modules-core-6.12.0-208.112.5.el9uek.x86_64.rpm
kernel-uek-debug-modules-deprecated-6.12.0-208.112.5.el9uek.x86_64.rpm
kernel-uek-debug-modules-desktop-6.12.0-208.112.5.el9uek.x86_64.rpm
kernel-uek-debug-modules-extra-6.12.0-208.112.5.el9uek.x86_64.rpm
kernel-uek-debug-modules-extra-netfilter-6.12.0-208.112.5.el9uek.x86_64.rpm
kernel-uek-debug-modules-usb-6.12.0-208.112.5.el9uek.x86_64.rpm
kernel-uek-debug-modules-wireless-6.12.0-208.112.5.el9uek.x86_64.rpm
kernel-uek-devel-6.12.0-208.112.5.el9uek.x86_64.rpm
kernel-uek-doc-6.12.0-208.112.5.el9uek.noarch.rpm
kernel-uek-modules-6.12.0-208.112.5.el9uek.x86_64.rpm
kernel-uek-modules-core-6.12.0-208.112.5.el9uek.x86_64.rpm
kernel-uek-modules-deprecated-6.12.0-208.112.5.el9uek.x86_64.rpm
kernel-uek-modules-desktop-6.12.0-208.112.5.el9uek.x86_64.rpm
kernel-uek-modules-extra-6.12.0-208.112.5.el9uek.x86_64.rpm
kernel-uek-modules-extra-netfilter-6.12.0-208.112.5.el9uek.x86_64.rpm
kernel-uek-modules-usb-6.12.0-208.112.5.el9uek.x86_64.rpm
kernel-uek-modules-wireless-6.12.0-208.112.5.el9uek.x86_64.rpm
kernel-uek-tools-6.12.0-208.112.5.el9uek.x86_64.rpm
aarch64:
kernel-uek-6.12.0-208.112.5.el9uek.aarch64.rpm
kernel-uek-core-6.12.0-208.112.5.el9uek.aarch64.rpm
kernel-uek-debug-6.12.0-208.112.5.el9uek.aarch64.rpm
kernel-uek-debug-core-6.12.0-208.112.5.el9uek.aarch64.rpm
kernel-uek-debug-devel-6.12.0-208.112.5.el9uek.aarch64.rpm
kernel-uek-debug-modules-6.12.0-208.112.5.el9uek.aarch64.rpm
kernel-uek-debug-modules-core-6.12.0-208.112.5.el9uek.aarch64.rpm
kernel-uek-debug-modules-deprecated-6.12.0-208.112.5.el9uek.aarch64.rpm
kernel-uek-debug-modules-desktop-6.12.0-208.112.5.el9uek.aarch64.rpm
kernel-uek-debug-modules-extra-6.12.0-208.112.5.el9uek.aarch64.rpm
kernel-uek-debug-modules-extra-netfilter-6.12.0-208.112.5.el9uek.aarch64.rpm
kernel-uek-debug-modules-usb-6.12.0-208.112.5.el9uek.aarch64.rpm
kernel-uek-debug-modules-wireless-6.12.0-208.112.5.el9uek.aarch64.rpm
kernel-uek-devel-6.12.0-208.112.5.el9uek.aarch64.rpm
kernel-uek-doc-6.12.0-208.112.5.el9uek.noarch.rpm
kernel-uek-modules-6.12.0-208.112.5.el9uek.aarch64.rpm
kernel-uek-modules-extra-6.12.0-208.112.5.el9uek.aarch64.rpm
kernel-uek-modules-core-6.12.0-208.112.5.el9uek.aarch64.rpm
kernel-uek-modules-deprecated-6.12.0-208.112.5.el9uek.aarch64.rpm
kernel-uek-modules-desktop-6.12.0-208.112.5.el9uek.aarch64.rpm
kernel-uek-modules-extra-netfilter-6.12.0-208.112.5.el9uek.aarch64.rpm
kernel-uek-modules-usb-6.12.0-208.112.5.el9uek.aarch64.rpm
kernel-uek-modules-wireless-6.12.0-208.112.5.el9uek.aarch64.rpm
kernel-uek-tools-6.12.0-208.112.5.el9uek.aarch64.rpm
kernel-uek64k-6.12.0-208.112.5.el9uek.aarch64.rpm
kernel-uek64k-core-6.12.0-208.112.5.el9uek.aarch64.rpm
kernel-uek64k-devel-6.12.0-208.112.5.el9uek.aarch64.rpm
kernel-uek64k-modules-6.12.0-208.112.5.el9uek.aarch64.rpm
kernel-uek64k-modules-core-6.12.0-208.112.5.el9uek.aarch64.rpm
kernel-uek64k-modules-deprecated-6.12.0-208.112.5.el9uek.aarch64.rpm
kernel-uek64k-modules-desktop-6.12.0-208.112.5.el9uek.aarch64.rpm
kernel-uek64k-modules-extra-6.12.0-208.112.5.el9uek.aarch64.rpm
kernel-uek64k-modules-extra-netfilter-6.12.0-208.112.5.el9uek.aarch64.rpm
kernel-uek64k-modules-usb-6.12.0-208.112.5.el9uek.aarch64.rpm
kernel-uek64k-modules-wireless-6.12.0-208.112.5.el9uek.aarch64.rpm
SRPMS:
http://oss.oracle.com/ol9/SRPMS-updates/kernel-uek-6.12.0-208.112.5.el9uek.src.rpm
Related CVEs:
CVE-2025-40326
CVE-2026-52988
CVE-2026-72315
CVE-2026-72463
CVE-2026-74347
CVE-2026-80937
CVE-2026-80939
CVE-2026-81015
CVE-2026-81016
CVE-2026-89441
CVE-2026-89500
CVE-2026-89503
CVE-2026-89520
CVE-2026-89754
CVE-2026-89766
CVE-2026-89827
CVE-2026-89859
CVE-2026-89971
CVE-2026-89972
CVE-2026-89996
CVE-2026-90002
CVE-2026-90013
CVE-2026-90029
CVE-2026-93134
CVE-2026-93196
CVE-2026-93231
CVE-2026-93244
CVE-2026-97527
CVE-2026-97528
CVE-2026-97529
CVE-2026-97530
CVE-2026-97531
CVE-2026-97532
CVE-2026-97535
CVE-2026-97536
CVE-2026-97537
CVE-2026-97549
CVE-2026-97559
CVE-2026-97566
CVE-2026-97571
CVE-2026-97597
CVE-2026-97603
CVE-2026-97609
CVE-2026-97615
CVE-2026-97618
CVE-2026-97619
CVE-2026-97620
CVE-2026-97901
CVE-2026-97906
CVE-2026-97918
CVE-2026-97919
CVE-2026-97933
CVE-2026-97934
CVE-2026-97935
CVE-2026-97938
CVE-2026-97939
CVE-2026-97949
CVE-2026-97950
CVE-2026-98101
CVE-2026-98161
CVE-2026-98167
CVE-2026-98168
CVE-2026-98169
CVE-2026-98170
CVE-2026-98171
CVE-2026-98172
CVE-2026-98173
CVE-2026-98174
CVE-2026-98175
CVE-2026-98179
CVE-2026-98181
CVE-2026-98182
CVE-2026-98184
CVE-2026-98185
CVE-2026-98186
CVE-2026-98187
CVE-2026-98188
CVE-2026-98191
CVE-2026-98192
CVE-2026-98193
CVE-2026-98194
CVE-2026-98195
CVE-2026-98196
CVE-2026-98197
CVE-2026-98198
CVE-2026-98199
CVE-2026-98201
CVE-2026-98202
CVE-2026-98203
CVE-2026-98204
CVE-2026-98205
CVE-2026-98207
CVE-2026-98208
CVE-2026-98211
CVE-2026-98213
CVE-2026-98214
CVE-2026-98215
CVE-2026-98216
CVE-2026-98217
CVE-2026-98221
CVE-2026-98222
CVE-2026-98229
CVE-2026-98230
CVE-2026-98231
CVE-2026-98232
CVE-2026-98233
CVE-2026-98234
CVE-2026-98235
CVE-2026-98236
CVE-2026-98237
CVE-2026-98238
CVE-2026-98239
CVE-2026-98241
CVE-2026-98245
CVE-2026-98246
CVE-2026-98247
CVE-2026-98248
CVE-2026-98249
CVE-2026-98251
CVE-2026-98252
CVE-2026-98253
CVE-2026-98254
CVE-2026-98255
CVE-2026-98260
CVE-2026-98261
CVE-2026-98262
CVE-2026-98263
CVE-2026-98264
CVE-2026-98265
CVE-2026-98266
CVE-2026-98267
CVE-2026-98269
CVE-2026-98270
CVE-2026-98271
CVE-2026-98272
CVE-2026-98276
CVE-2026-98287
CVE-2026-98290
CVE-2026-98291
CVE-2026-98293
CVE-2026-98295
CVE-2026-98297
CVE-2026-98299
CVE-2026-98300
CVE-2026-98301
CVE-2026-98303
CVE-2026-98306
CVE-2026-98307
CVE-2026-98308
CVE-2026-98309
CVE-2026-98312
CVE-2026-98314
CVE-2026-98316
CVE-2026-98319
CVE-2026-98320
CVE-2026-98322
CVE-2026-98325
CVE-2026-98326
CVE-2026-98327
CVE-2026-98328
CVE-2026-98329
CVE-2026-98331
CVE-2026-98334
CVE-2026-98335
CVE-2026-98336
CVE-2026-98337
CVE-2026-98339
CVE-2026-98340
CVE-2026-98342
CVE-2026-98343
CVE-2026-98344
CVE-2026-98345
CVE-2026-98346
CVE-2026-98347
CVE-2026-98348
CVE-2026-98349
CVE-2026-98354
CVE-2026-98357
CVE-2026-98358
CVE-2026-98359
CVE-2026-98360
CVE-2026-98362
CVE-2026-98363
CVE-2026-98365
CVE-2026-98366
CVE-2026-98368
CVE-2026-98369
CVE-2026-98370
CVE-2026-98373
CVE-2026-98374
CVE-2026-98377
CVE-2026-98378
CVE-2026-98379
CVE-2026-98380
CVE-2026-98381
CVE-2026-98382
CVE-2026-98383
CVE-2026-98384
CVE-2026-98405
CVE-2026-98428
CVE-2026-98432
CVE-2026-98441
CVE-2026-98442
CVE-2026-98448
CVE-2026-98452
CVE-2026-98454
CVE-2026-98455
CVE-2026-98456
CVE-2026-98457
CVE-2026-98459
CVE-2026-98460
CVE-2026-98461
CVE-2026-98462
CVE-2026-98468
CVE-2026-98477
CVE-2026-98479
CVE-2026-98484
CVE-2026-98485
CVE-2026-98486
CVE-2026-98487
CVE-2026-98488
CVE-2026-98489
CVE-2026-98490
CVE-2026-98491
CVE-2026-98494
CVE-2026-98495
CVE-2026-98498
CVE-2026-98499
CVE-2026-98501
CVE-2026-98502
CVE-2026-98503
CVE-2026-98505
CVE-2026-98506
CVE-2026-98507
CVE-2026-98508
CVE-2026-98509
CVE-2026-98510
CVE-2026-98511
CVE-2026-98512
CVE-2026-98513
CVE-2026-98514
CVE-2026-98515
CVE-2026-98516
CVE-2026-98517
CVE-2026-98519
CVE-2026-98521
CVE-2026-98523
CVE-2026-98528
CVE-2026-98531
CVE-2026-98532
CVE-2026-98536
CVE-2026-98537
CVE-2026-98538
CVE-2026-98541
CVE-2026-98544
CVE-2026-98545
CVE-2026-98547
CVE-2026-98548
CVE-2026-98549
CVE-2026-98550
CVE-2026-98553
CVE-2026-98554
CVE-2026-98561
CVE-2026-98565
CVE-2026-98567
CVE-2026-98568
CVE-2026-98569
CVE-2026-98573
CVE-2026-98586
CVE-2026-98588
CVE-2026-98590
CVE-2026-98591
CVE-2026-98594
CVE-2026-98596
CVE-2026-98597
CVE-2026-98600
CVE-2026-98601
CVE-2026-98602
CVE-2026-98605
CVE-2026-98606
CVE-2026-98607
CVE-2026-98608
CVE-2026-98609
CVE-2026-98610
CVE-2026-98611
CVE-2026-98612
CVE-2026-98613
CVE-2026-98614
CVE-2026-98621
CVE-2026-98622
CVE-2026-98623
CVE-2026-98624
CVE-2026-98625
CVE-2026-98626
CVE-2026-98629
CVE-2026-98631
CVE-2026-98632
CVE-2026-98634
CVE-2026-98636
CVE-2026-98640
CVE-2026-98641
CVE-2026-98643
CVE-2026-98644
CVE-2026-98646
CVE-2026-98647
CVE-2026-98925
CVE-2026-99082
CVE-2026-99999
Description of changes:
[6.12.0-208.112.5]
- NFSD: Define actions for the new time_deleg FATTR4 attributes (Chuck Lever) [Orabug: 39004166] {CVE-2025-40326}
- vhost-scsi: fix page reference leak in misaligned I/O fallback (Jia Jia) [Orabug: 40193938]
- vhost-scsi: zero misaligned I/O bounce pages (Shubham Antil) [Orabug: 40193938]
[6.12.0-208.112.4]
- KVM: x86: Use active memslots for the per-vCPU MMIO cache (Jinu Kim) [Orabug: 40180575]
- rds: cong: fix race while clearing rs_cong_mask (Anand Khoje) [Orabug: 39519856]
- uek-rpm/osp: Remove atda38740 and ar_pmbus_core (Vijay Kumar) [Orabug: 40147556]
- Revert "vrm: Import PMBus core from SONiC kernel" (Vijay Kumar) [Orabug: 40147556]
- Revert "vrm: Fork PMBus core into Arista namespace" (Vijay Kumar) [Orabug: 40147556]
- Revert "vrm: Add driver for Infineon POLs and controllers" (Vijay Kumar) [Orabug: 40147556]
- ipv4: free inet_opt and ireq_opt after an RCU grace period (Eric Dumazet) [Orabug: 40165787] {CVE-2026-98432}
- ipv4: validate checksum_start before completing checksum (Michael S. Tsirkin) [Orabug: 40165809] {CVE-2026-99999}
- mm/pagewalk: fix stale walk->action escaping walk_pmd_range() (Hyunwoo Kim) [Orabug: 40022020] {CVE-2026-89754}
[6.12.0-208.112.3]
- net/rds: Don't drop bcopy portion of messages with successful RDMA completion (Gerd Rausch) [Orabug: 39360343]
- net/rds: Get rid of RDS_CMSG_ATOMIC_* support (Gerd Rausch) [Orabug: 39360343]
- printk: kthread: add note about failed trylock (Stephen Brennan) [Orabug: 40047816]
- printk: fix missed kthread wakeup (Stephen Brennan) [Orabug: 40047816]
- Reapply "printk: add kthread for long-running print" (Stephen Brennan) [Orabug: 40047816]
- printk: Fix possible console use-after-free (John Ogness) [Orabug: 40047816]
- printk: Introduce console_flush_one_record (Andrew Murray) [Orabug: 40047816]
- Revert "printk: add kthread for long-running print" (Stephen Brennan) [Orabug: 40047816]
- uek-rpm: Enable CONFIG_MSTFLINT_ACCESS for Bluefield-4 (Thomas Tai) [Orabug: 40055877]
- uek-rpm: build embedded4h and embedded4s kernels (Joe Dobosenski) [Orabug: 40087815]
- soc: pensando: select ARCH_HAS_DMA_OPS (Brad Larson) [Orabug: 40093708]
- LTS version: v6.12.112 (Sherry Yang)
- i2c: qcom-cci: fix device_node refcount leak in cci_probe()/cci_remove() (Liu Zhenlong)
- i2c: qcom-cci: Remove the unused variable cci_clk_rate (Jiapeng Chong)
- i2c: qcom-cci: Stop complaining about DT set clock rate (Bryan O'Donoghue)
- arm64: percpu: Fix LSE operations on {8,16}-bit types (Mark Rutland)
- arm64: Use load LSE atomics for the non-return per-CPU atomic operations (Catalin Marinas)
- btrfs: take commit root semaphore when iterating in mark_block_group_to_copy() (Hongling Zeng)
- net: phy: mediatek: do not report link and per-speed LED rules together (Ahmed Naseef)
- swiotlb: use the adjusted address for the highmem page lookup (Donggeun Yoo)
- ALSA: usb-audio: Clamp implicit feedback packet count to URB capacity (Xiang Mei)
- ALSA: usb-audio: Optimize the copy of packet sizes for implicit fb handling (Takashi Iwai)
- phy: renesas: rcar-gen3-usb2: Avoid long delay in atomic context (Claudiu Beznea)
- 9p: Fix v9fs_issue_write() to update i_size and remote_i_size (David Howells)
- cifs: Fix specification of function pointers (David Howells)
- xfs: fix backwards mergeability logic in refcount scrubber (Darrick J. Wong)
- xfs: fix under-reservation of blocks when repairing sf directories (Darrick J. Wong)
- xfs: remove the i_ino field in struct xfs_inode (Christoph Hellwig)
- xfs: strengthen the "is cow staging" helpers in scrub (Darrick J. Wong)
- xfs: fix short ifork reaping computation in xreap_bmapi_binval (Darrick J. Wong)
- xfs: report healthy filesystem events in scrub stats (Darrick J. Wong)
- smb: client: fail DACL rewrite when the new DACL exceeds 64K (Bjoern Doebel)
- smb/client: fix security flag calculation when setting security descriptors (Ralph Boehme)
- smb: client: refactor ACL setting control flow in id_mode_to_cifs_acl() (Ralph Boehme)
- mm/hugetlb: keep max_huge_pages when dissolving surplus folios (Longlong Xia)
- usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race condition (Pei Xiao)
- platform/x86/amd/pmc: Fix LPS0 and debugfs leaks when STB init fails (Mario Limonciello)
- mtd: rawnand: pl353: Fix debug prints (Miquel Raynal (DAVE))
- tracing: Move d_max_latency out of CONFIG_FSNOTIFY protection (Steven Rostedt)
- bootconfig: Fix negative seeks on 32-bit with LFS enabled (Ben Hutchings)
- rose: cancel neighbour timers in rose_neigh_put() before freeing (Bernard Pidoux)
- rose: drop CALL_REQUEST in loopback timer when device is not running (Bernard Pidoux)
- rose: fix netdev double-hold in rose_make_new() (Bernard Pidoux)
- rose: fix notifier unregistered too early in rose_exit() (Bernard Pidoux)
- rose: fix netdev double-hold in rose_rx_call_request() (Bernard Pidoux)
- rose: guard rose_neigh_put() against NULL in timer expiry (Bernard Pidoux)
- rose: clear neighbour pointer after rose_neigh_put() in state machines (Bernard Pidoux)
- rose: fix race between loopback timer and module removal (Bernard Pidoux)
- rose: hold loopback neighbour reference across timer callback (Bernard Pidoux)
- rose: fix dev_put() leak in rose_loopback_timer() (Bernard Pidoux)
- RISC-V: KVM: Serialize IMSIC attributes with vCPU migration (Xie Bo)
- RISC-V: KVM: Fix null pointer dereference in kvm_riscv_aia_imsic_rw_attr() (Jiakai Xu)
- perf/x86/intel: Fix GRT PEBS load/store direction for latency events, to fix sample classification (Dapeng Mi)
- perf/x86/intel: Update event constraints and cache_extra_regsfor ADL (Dapeng Mi)
- perf/x86/intel: Remove incorrect LionCove PEBS data-source constraints (Dapeng Mi)
- perf/x86/intel: Update event constraints and cache_extra_regsfor LNL (Dapeng Mi)
- net: ena: fix MMIO read buffer leak on probe failure (Guangshuo Li)
- net: ena: Remove autopolling mode (Dr. David Alan Gilbert)
- net: ipconfig: bound DHCP option construction (Yuqi Xu)
- net: ipconfig: Remove outdated comment and indent code block (Thorsten Blum)
- net/sched: act_ct: avoid modifying shared unconfirmed ct entry (Ilya Maximets)
- net/sched: act_ct: fix helper UAF due to extensions realloc (Ilya Maximets)
- HID: alps: unregister DualPoint Stick input device on remove (Chen Changcheng)
- HID: hid-alps: Use pm_ptr instead of #ifdef CONFIG_PM (Bastien Nocera)
- packet: use ubuf_info completion for TX_RING packets (Willem de Bruijn)
- PCI: Fix BAR resize for devices on a root bus (Liz Fong-Jones)
- PCI: Fix Resizable BAR restore order (Ilpo Järvinen)
- super: make iterate_supers_type() deletion-safe (Christian Brauner)
- mm/hugetlb: do not dissolve gigantic pages without runtime support (Longlong Xia)
- mm/hugetlb: create hstate_is_gigantic_no_runtime helper (Usama Arif)
- mm/hugetlb: fix surplus pages in dissolve_free_huge_page() (Jinjiang Tu)
- mm/damon/vaddr: avoid hw-driven pte updates during damon_hugetlb_mkold() (SJ Park)
- drm/xe/vm: nuke PTs only after unlinking contested VMAs (Matthew Auld)
- mm/rmap: fix missing barrier between anon_vma init and vma->anon_vma publish (Jinjiang Tu)
- mm/rmap: allocate anon_vma_chain objects unlocked when possible (Lorenzo Stoakes)
- drm/i915/dp_mst: Fix configuring FEC for a disconnected stream (Imre Deak)
- drm/i915/mst: add mst sub-struct to struct intel_dp (Jani Nikula)
- drm/client: fix restore of partially initialized client (shechenglong)
- drm/client: Pass force parameter to client restore (Thomas Zimmermann)
- drm/amdgpu: Fix acpi device leak in amdgpu_acpi_enumerate_xcc() (Wentao Liang)
- i2c: qcom-geni: Fix hardcoded clock index in SE_GENI_CLK_SEL (Viken Dadhaniya)
- bna: prevent IOC timer rearm during teardown (Myeonghun Pak)
- ipe: fix use-after-free when auditing a newly loaded policy (Fan Wu)
- gpio: cdev: fix kernel stack leak to user-space in error path (Bartosz Golaszewski)
- vlan: require the MAC header to be present in __vlan_insert_inner_tag() (Xiang Mei)
- arm64/boot: Disable trapping of PMZR_EL0 writes to EL2 (Fuad Tabba)
- smb/client: send lease break ACKs thru correct session for multiuser mounts (April Cardenas)
- smb: client: fix reparse buffer bounds in cifs_query_reparse_point() (Frank Sorenson)
- drm/amdgpu: hold a runtime PM reference for P2P dma-buf attachments (Mike Lothian)
- drm: add drm_memory_stats_is_zero (Yunxiang Li)
- smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs() (Frank Sorenson)
- drm/amdgpu: fix rmmio iounmap skipped on device removal (Chengjun Yao)
- drm/amdgpu: use GFP_NOWAIT for memory allocations (Christian König)
- drm/amdgpu/umsch: remove vpe test from umsch (Saleemkhan Jamadar)
- drm/amdgpu: Failed to check various return code (Andrew Martin)
- smb: client: fix use-after-free of iface in cifs_try_adding_channels() (Joseph Qi)
- smb: mark the new channel addition log as informational log with cifs_info (Bharath SM)
- wifi: mac80211: refuse to make a monitor active when it has no queue (Devin Wittmayer)
- wifi: mac80211: track MU-MIMO configuration on disabled interfaces (Benjamin Berg)
- wifi: libipw: reject TKIP frames without a full MIC (Daehyeon Ko)
- drm/msm/dpu: clear pending peripheral flush state (Saim Shujah)
- hwmon: (pwm-fan) Stop RPM timer before freeing tach data (Yibo Tan)
- wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown (Fan Wu)
- Input: hp_sdc - shut down kicker timer on module exit (Runyu Xiao)
- scsi: fnic: Fix missed link-up when critical IRQ targets offline CPU (Arun Easi)
- mptcp: do not reschedule the RTX timer for fallback sockets (Paolo Abeni)
- tcp: introduce icsk->icsk_keepalive_timer (Eric Dumazet)
- mptcp: pm: kernel: drop pending ADD_ADDR when removing ID0 (Kalpan Jani)
- mptcp: pm: rename add_entry structure to add_addr (Matthieu Baerts (NGI0))
- mptcp: pm: use for_each_subflow helper (Matthieu Baerts (NGI0))
- mptcp: pm: reset retrans_time when ADD_ADDR entry is reused (Matthieu Baerts (NGI0))
- bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips (Michael Chan)
- mptcp: pm: userspace: fix address ID overflow (Qing Luo)
- mptcp: use sock_kmemdup for address entry (Geliang Tang)
- sock: add sock_kmemdup helper (Geliang Tang)
- mptcp: pm: drop match in userspace_pm_append_new_local_addr (Geliang Tang)
- bnxt_en: Propagate TPA buffer allocation failures in bnxt_queue_mem_alloc() (Joe Damato)
- landlock: Fix use-after-free of the source's parent directory (Norbert Szetei)
- landlock: Clarify documentation for the IOCTL access right (Günther Noack)
- ipv6: flowlabel: cap duplicate leases per socket (Zhiling Zou)
- ipv6: Move ipv6_fl_list from ipv6_pinfo to inet_sock. (Kuniyuki Iwashima)
- ipv6: reorganise struct ipv6_pinfo (Eric Dumazet)
- ipv6: make ipv6_pinfo.saddr_cache a boolean (Eric Dumazet)
- idpf: disable DIM work before freeing q_vectors (Myeonghun Pak)
- idpf: introduce idpf_q_vec_rsrc struct and move vector resources to it (Pavan Kumar Linga)
- idpf: Fix kernel-doc descriptions to avoid warnings (Andy Shevchenko)
- erofs: add sysfs feature entry for xattr prefixes (Jingbo Xu)
- net: macb: initialize PTP state before registering clock (Runyu Xiao)
- net: macb: unify device pointer naming convention (Théo Lebrun)
- net: macb: Use netif_napi_add_tx() instead of netif_napi_add() for TX NAPI (Kevin Hao)
- net: macb: Replace open-coded implementation with napi_schedule() (Kevin Hao)
- netfilter: cttimeout: prevent UAF during module unload (Chengfeng Ye)
- netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount (Pablo Neira Ayuso)
- drm/xe: Flush LSC untyped L1 dataport cache after rcs/ccs batches (Thomas Hellström)
- net: bridge: use option bits for CFM/MRP frame handlers (Zhiling Zou)
- bootconfig: Fix integer overflow in initrd size check (Masami Hiramatsu (Google))
- io_uring/net: don't overconsume buffers when using MSG_TRUNC (Gabriel Krisman Bertazi)
- io_uring/rw: end write accounting from ->ki_complete (Jens Axboe)
- drm/bridge: tc358768: Enforce input bus flags via atomic_check (Leonardo Costa)
- genetlink: pin family module during policy dump (XingWang Xiang)
- EDAC/altera: Use parent device for devres in altr_portb_setup() (Dinh Nguyen)
- EDAC/altera: Use ECC manager compatible to select A10/S10 IRQ layout (Rounak Das)
- tracing: Undo the registration when enabling the histogram trigger fails (Donggeun Yoo)
- tracing: Take the reference before publishing the named histogram trigger (Donggeun Yoo)
- tracing: Take trace_array reference when opening a tracer options file (Steven Rostedt)
- tools/bootconfig: Fix integer overflow and truncation in size checks (Masami Hiramatsu (Google))
- tools/bootconfig: Cleanup bootconfig footer size calculations (Masami Hiramatsu (Google))
- virtio_mmio: disable IRQ wake before free_irq (Xiong Weimin)
- virtio-mmio: Remove virtqueue list from mmio device (Viresh Kumar)
- tracing: Set the trace clock before registering the histogram trigger (Donggeun Yoo)
- tracing: Merge struct event_trigger_ops into struct event_command (Steven Rostedt)
- tracing: Remove get_trigger_ops() and add count_func() from trigger ops (Steven Rostedt)
- tracing: Constify struct event_trigger_ops (Christophe JAILLET)
- configfs: unhash the dentry before dropping the item in rmdir (Vasileios Almpanis)
- reboot: fix cad_pid use-after-free race (Cen Zhang (Microsoft))
- sysctl: move the "cad_pid" entry from pid_table[] to kern_reboot_table[] (Oleg Nesterov)
- ipmr: account multicast table and route memory (Zihan Xi)
- tracing: Fix memory corruption from a "STACKTRACE" histogram key (Donggeun Yoo)
- configfs: pin the symlink target's dirent instead of chasing ->ci_dentry (Vasileios Almpanis)
- configfs:get_target() - release path as soon as we grab configfs_item reference (Al Viro)
- drm/sysfb: ofdrm: Fix is_avivo() constant comparison bug (Shixiong Ou)
- drm/sysfb: ofdrm: Fix integer overflow in fb_size calculation (Shixiong Ou)
- drm/sysfb: simpledrm: Improve framebuffer-size validation (Thomas Zimmermann)
- firmware: sysfb: Move bpp-depth calculation into screen_info helper (Thomas Zimmermann)
- drm/sysfb: simpledrm: Improve stride validation (Thomas Zimmermann)
- drm/sysfb: simpledrm: Improve panel-size validation (Thomas Zimmermann)
- drm/amd/display: Set gpuvm min page size to 4K on dcn35/36 (Roman Li)
- drm/nouveau/disp/r535: Add scanline position support + head state support (Lyude Paul)
- drm/amdgpu: avoid force-completing uninitialized UVD rings (Bob Zhou)
- drm/amdgpu: plumb timedout fence through to force completion (Alex Deucher)
- drm/amdgpu: add a helper to calculate ring distance (Alex Deucher)
- drm/amdgpu: Fix missing unwind in amdgpu_ib_schedule() error path (Srinivasan Shanmugam)
- f2fs: accurately adjust free_sections during free_segment_range (Daeho Jeong)
- f2fs: fix to clear dirty flag on folio in error path (Chao Yu)
- f2fs: Convert clear_node_page_dirty() to clear_node_folio_dirty() (Matthew Wilcox (Oracle))
- f2fs: embed f2fs_gc_kthread in f2fs_sb_info (Chao Yu)
- f2fs: fix dentry folio leak in find_in_level (Guanghui Yang)
- f2fs: limit recovery filename logging to stored length (Wenjie Qi)
- f2fs: dirty directory inodes on mtime/ctime update (Joanne Chang)
- f2fs: fix to avoid potential section-unaligned pinfile (Chao Yu)
- f2fs: don't allow unaligned truncation to smaller/equal size on pinned file (wangzijie)
- f2fs: convert F2FS_I_SB to sbi in f2fs_setattr() (wangzijie)
- f2fs: validate MOVE_RANGE destination size (Wenjie Qi)
- scsi: qla2xxx: Validate BSG request_len before reading vendor_cmd[] (Nilesh Javali)
- scsi: qla2xxx: Serialize NVMe unsol ctx list with a per-fcport lock (Nilesh Javali)
- scsi: qla2xxx: Unlink NVMe unsol ctx before freeing on LS reject error (Nilesh Javali)
- scsi: qla2xxx: Clamp max_npiv_vports to VP_CTRL bitmap capacity (Nilesh Javali)
- scsi: qla2xxx: Fix soft lockup polling continuation IOCB signature (Nilesh Javali)
- scsi: qla2xxx: Skip vport under deletion in report ID acquisition (Nilesh Javali)
- scsi: qla2xxx: Fix 64G link speed reporting in get_data_rate (Nilesh Javali)
- scsi: qla2xxx: Use memset_io() to clear QLAFX00 request ring slot (Nilesh Javali)
- scsi: qla2xxx: Use ring-slot helpers in __qla2x00_alloc_iocbs (Nilesh Javali)
- media: chips-media: wave5: Add timeout while stop_streaming (Jackson Lee)
- scsi: qla2xxx: Bound VP index against VP_CTRL IOCB bitmap size (Nilesh Javali)
- scsi: qla2xxx: Null out freed pointers in qla2x00_mem_alloc() error path (Nilesh Javali)
- scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown (Nilesh Javali)
- scsi: qla2xxx: Fix queue teardown NULL dma_free and bitmap locking (Nilesh Javali)
- scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak (Nilesh Javali)
- KVM: x86: Disallow EFER.LME and EFER.LMA if long mode is not supported (Yosry Ahmed)
- KVM: s390: Zero initialize data structures for inject_pfault_token (Christian Borntraeger)
- media: rkvdec: Propagate platform_get_irq() errors (Narasimharao Vadlamudi)
- media: imx355: Avoid calling imx355_power_off twice in error path (Dave Stevenson)
- media: i2c: imx355: Replace client->dev usage (Laurent Pinchart)
- KVM: x86: Check EFER validity on KVM_SET_SREGS* (Yosry Ahmed)
- KVM: x86: Move the bulk of register specific code from x86.c to regs.c (Sean Christopherson)
- KVM: x86: Rename __{g,s}et_sregs2() => kvm_vcpu_ioctl_x86_{g,s}et_sregs2() (Sean Christopherson)
- KVM: x86: Extract REGS and SREGS runtime sync code to helpers (Sean Christopherson)
- KVM: x86/mmu: Split kvm_mmu_zap_all_fast() into "front" and "back" halves (Sean Christopherson)
- KVM: x86/mmu: Dynamically allocate shadow MMU's hashed page list (Sean Christopherson)
- mm/mremap: reset unfaulted VMA page offset for MREMAP_DONTUNMAP (Lorenzo Stoakes (ARM))
- ASoC: tegra: Fix the MIXER enable default value (Jon Hunter)
- ASoC: tegra210_mixer: sort the register default table (Peter Ujfalusi)
- clk: qcom: Fix test_ctl_hi field for DEFAULT_EVO PLLs (Imran Shaik)
- mtd: rawnand: pl353: Make sure we use the monolithic helpers for raw accesses (Miquel Raynal (DAVE))
- mtd: rawnand: pl353: Add message about ECC mode (Andrea Scian)
- nvdimm: virtio_pmem: refcount requests for token lifetime (Li Chen)
- nvdimm: virtio_pmem: use READ_ONCE()/WRITE_ONCE() for wait flags (Li Chen)
- nvdimm: virtio_pmem: always wake -ENOSPC waiters (Li Chen)
- nvdimm: virtio_pmem: stop allocating child flush bio (Li Chen)
- nvdimm: pmem: keep PREFLUSH before data writes (Li Chen)
- nvdimm: preserve flush callback -ENOMEM (Li Chen)
- mm: fix incorrect vm_flags usage when checking allowable orders for tmpfs (Baolin Wang)
- s390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects (Anthony Krowiak)
- nvme: skip the zoned limits update if the zone info query failed (Chao Shi)
- nvme: add missing SRCU grace period in error path (Tristan Madani)
- ring-buffer: Allow splice reads on static buffers (Vincent Donnefort)
- ring-buffer: Show persistent buffer dropped events in trace_pipe file (Steven Rostedt)
- perf/x86/intel: Remove anythread_deprecated bit from perf_capabilities (Dapeng Mi)
- perf/aux: Allocate non-contiguous AUX pages by default (Yabin Cui)
- rtc: rzn1: Handle unset alarm weekday in rzn1_rtc_read_alarm (Lad Prabhakar)
- futex: Provide rt_mutex_.*_schedule() equivalents for futex scheduling (Sebastian Andrzej Siewior)
- compiler_types: Move lock checking attributes to compiler-context-analysis.h (Marco Elver)
- dma-buf: dma-heap: don't publish fd before copy_to_user() succeeds (Baineng Shou)
- ftrace: Take trace_array reference before accessing its ftrace_ops (Steven Rostedt)
- tracing: Take trace_array reference when opening options file (Steven Rostedt)
- tracing: Clean up use of trace_create_maxlat_file() (Steven Rostedt)
- tracing/probes: Fix BTF kflag check for anonymous struct member access (Masami Hiramatsu (Google))
- Documentation: tracing: Add documentation about eprobes (Steven Rostedt)
- tracing/probes: Fix anon_stack check for unnamed bitfields in btf_find_struct_member (Masami Hiramatsu (Google))
- staging: sm750fb: fix mono image source stride mismatch in lynxfb_ops_imageblit() (Muhammad Bilal)
- staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie() (Muhammad Bilal)
- staging: rtl8723bs: fix spacing around operators (Vivek BalachandharTN)
- usb: gadget: f_mass_storage: fix null pointer dereference in fsg_common_set_num_buffers() (Jeffin Philip)
- usb: storage: realtek_cr: fix use-after-free on disconnect (Myeonghun Pak)
- usb: cdnsp: fix wakeup from S3 after controller context loss (Pawel Laszczak)
- usb: cdns3: rename hibernated argument of role->resume() to lost_power (Théo Lebrun)
- xhci: Cleanup Candence controller PCI device and vendor ID usage (Mathias Nyman)
- wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy (Bryam Vargas)
- usb: typec: tcpm: constrain TCPM_SOURCING_VBUS event handling (Amit Sunil Dhamne)
- usb: typec: tcpm: fix debug accessory mode detection for sink ports (Xu Yang)
- wifi: rtw89: pci: add .shutdown callback to stop rfkill polling on reboot (Yuhang.chen)
- wifi: rtw89: Hide some errors when the device is unplugged (Bitterblue Smith)
- wifi: rtw89: cleanup unused rtwdev::roc_work (Zong-Zhe Yang)
- usb: dwc3: clear forceRM when issuing EndTransfer (Elson Serrao)
- usb: dwc3: gadget: Reinitiate stream for all host NoStream behavior (Thinh Nguyen)
- udf: Fix data loss when converting inline inodes to out of line (Jan Kara)
- udf: Move udf_map_block() up (Jan Kara)
- i3c: master: Fix use-after-free of master->this (Adrian Hunter)
- wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy (Bryam Vargas)
- wifi: mt76: mt7915: set correct background radar capability (StanleyYP Wang)
- i3c: master: Do not treat master device as a duplicate target (Adrian Hunter)
- hwrng: stm32 - Fix runtime PM cleanup on registration failure (Can Peng)
- hwrng: drivers - Switch back to struct platform_driver::remove() (Uwe Kleine-König)
- ALSA: hda/ext: preserve PPLCCTL bits when clearing reset (Xu Rao)
- net/mlx5e: do not HW-GRO coalesce small frames (Glenn Judd)
- net/mlx5e: SHAMPO, Always calculate page size (Dragos Tatulea)
- net/smc: stop killed, freed and out_of_sync sharing a byte (Hidayath Khan)
- net/smc: Address spelling errors (Simon Horman)
- power: supply: qcom_battmgr: fix use-after-free (Fan Wu)
- io_uring/waitid: avoid siginfo copy during ring teardown (Hui Su)
- io_uring/waitid: have io_waitid_complete() remove wait queue entry (Jens Axboe)
- platform/x86/amd/pmc: Propagate SMU errors and validate S2D address (Mario Limonciello)
- platform/x86/amd/pmc: Restore msg_port on amd_stb_s2d_init() error paths (Mario Limonciello)
- platform/x86/amd/pmc: Define enum for S2D/PMC msg_port and add helper function (Shyam Sundar S K)
- platform/x86/amd/pmc: Move STB functionality to a new file for better code organization (Shyam Sundar S K)
- platform/x86/amd/pmc: Move STB block into amd_pmc_s2d_init() (Shyam Sundar S K)
- platform/x86: int1092: Fix potential memory leak in sar_probe() (Abdun Nihaal)
- platform/x86: intel_sar: Check ACPI_HANDLE() against NULL (Rafael J. Wysocki)
- platform/x86: think-lmi: Fix certificate thumbprint sysfs output (Thorsten Blum)
- platform/x86: think-lmi: improve check if BIOS account security enabled (Mark Pearson)
- platform/x86: think-lmi: Fix current password length check (Thorsten Blum)
- PCI: Introduce PCI_SLOT_PLACEHOLDER constant for slot_nr placeholder value (Farhan Ali)
- mmc: via-sdmmc: cancel card-detect work on remove (Fan Wu)
- platform/x86: ISST: Validate max level for set feature (Srinivas Pandruvada)
- platform/x86: ISST: Check for admin capability for write commands (Srinivas Pandruvada)
- iommufd: Fix UAF in selftest IOPF reporting (Peiyang He)
- iommu/msm: Unwind probe state on registration failure (Weimin Xiong)
- iommu/msm: Use helper function devm_clk_get_prepared() (Zhang Heng)
- PCI: starfive: Fix resource leaks on error paths in host_init() (Ali Tariq)
- PCI: starfive: Use regulator APIs to control the 3v3 power supply of PCIe slots (Hal Feng)
- power: supply: ab8500_fg: fix use-after-free on remove (Fan Wu)
- power: supply: ab8500_fg: Remove redundant dev_err()/dev_err_probe() (Pan Chuang)
- remoteproc: qcom: pas: Guard dtb metadata release with dtb_pas_id check (Mukesh Ojha)
- remoteproc: pas: Replace metadata context with PAS context structure (Mukesh Ojha)
- firmware: qcom_scm: Rename peripheral as pas_id (Mukesh Ojha)
- lockd: fix swapped arguments in nlmsvc_match_ip() (Oscar Ou)
- i2c: mxs: fix DMA channel leak on probe error (Ruoyu Wang)
- dmaengine: Add devm_dma_request_chan() (Bence Csókás)
- ring-buffer: Make cpu_buffer::free_page a buffer_data_read_page (Vincent Donnefort)
- ASoC: codecs: aw88261: only check PLL and clock state at power-up (Jorijn van der Graaf)
- ASoC: codecs: aw88261: reduce log spam (Val Packett)
- sched/core: Make core-sched flips wait for in-flight selections (Tejun Heo)
- sched: Rework prev_balance() to avoid stale prev references (John Stultz)
- ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page() (Vincent Donnefort)
- ring-buffer: Add helper functions for allocations (Steven Rostedt)
- perf test: Change all remaining #!/bin/sh to #!/bin/bash (James Clark)
- net: tls: fix silent data drop under pipe back-pressure (Jakub Kicinski)
- xfs: fix blockgc group quota scanning when usrquota isn't enforced (Darrick J. Wong)
- xfs: check di_forkoff correctly in scrub (Darrick J. Wong)
- xfs: don't call xfs_exchange_range_finish for a dry run (Darrick J. Wong)
- xfs: check padding field in xfs_ioc_commit_range (Darrick J. Wong)
- xfs: use correct jiffies comparison function in xchk_maybe_relax (Darrick J. Wong)
- xfs: release orphanage dir inode if chown fails (Darrick J. Wong)
- xfs: fix attr fork block count checks in xrep_inode_blockcounts (Darrick J. Wong)
- xfs: don't assert when XFS_SCRUB_TYPE_HEALTHY scans return corruption (Darrick J. Wong)
- smb: client: validate POSIX create context length (Zihan Xi)
- smb: client: clean up failed cached directory opens (Zihan Xi)
- smb: client: fix create context out-of-bounds reads (Zihan Xi)
- Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO (Hui Peng)
- Bluetooth: mgmt: fix race in read_unconf_index_list() (Aldo Ariel Panzardo)
- Bluetooth: L2CAP: validate frame length before control and FCS access (Aldo Ariel Panzardo)
- Bluetooth: ISO: balance the parent hold in hci_bind_bis() (Aldo Ariel Panzardo)
- Bluetooth: hci_sock: reject out-of-range OCF values (Aldo Ariel Panzardo)
- Bluetooth: hci_sock: validate event length before filtering (Aldo Ariel Panzardo)
- Bluetooth: hci_conn: fix CIS hold ownership on reuse (Aldo Ariel Panzardo)
- RISC-V: KVM: Fix HSM hart status error propagation (Tan Chi)
- RISC-V: KVM: Synchronize hrtimer callback during teardown (Myeonghun Pak)
- KVM: arm64: Fix spurious warning for benign stage 2 teardown race (Lorenzo Stoakes (ARM))
- KVM: Don't treat reserved xarray entries as having memory attributes (Zeng Chi)
- KVM: Ensure memory attributes xarray nodes are accounted to the caller's memcg (David Ballesteros)
- s390/vfio-ap: fix KVM GISC and page leak when queue removed from host config (Anthony Krowiak)
- s390/cmf: Fix virtual vs physical address confusion (Peter Oberparleiter)
- s390/cio: Fix NULL pointer dereference in ccw_device_get_util_str() (Vineeth Vijayan)
- pinctrl: sunxi: keep a shadow copy of the data register output latches (Ilya Titov)
- pinctrl: single: free the IRQ on domain creation failure (Myeonghun Pak)
- perf/core: Run sched_task() for PMUs with only CPU-wide events (Puranjay Mohan)
- perf/core: Fix NULL pmu_ctx passed to pmu->sched_task() (Puranjay Mohan)
- scsi: libiscsi_tcp: Check the data direction of a Data-In PDU (Yehyeong Lee)
- nfc: port100: reject frames whose declared length exceeds the received data (Doruk Tan Ozturk)
- nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc() (Aamir Ahmed)
- nfc: fix use-after-free in nfc_get_local_general_bytes (Luxiao Xu)
- netfilter: nf_tables: skip expired catchall elements on insert and delete (Aohan Mei)
- netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read (Luxiao Xu)
- netfilter: ip6t_rpfilter: reject routes without inet6_dev (Weiming Shi)
- net: usb: lan78xx: Fix URB reference leak in lan78xx_submit_deferred_urbs() (Wentao Liang)
- net: usb: cdc_mbim: add MeiG Smart SRM821 to ZLP whitelist (Ming Wang)
- net: bridge: mdb: restart port group walk after deletion (Fourie Zhang)
- net: atl1e: fix soft lockup on out-of-range hw_next_to_clean read (Gajdos Tamás)
- net: atl1c: fix soft lockup on out-of-range tpd_cons read (Gajdos Tamás)
- net: openvswitch: conntrack: fix helper UAF due to extensions realloc (Ilya Maximets)
- net: openvswitch: conntrack: remove 'add_helper' dead code (Ilya Maximets)
- net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry (Ilya Maximets)
- net: hisilicon: hns_dsaf_mac: fix mdio device leak in hns_mac_register_phy() (Wentao Liang)
- net: atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read (Gajdos Tamás)
- net: arp: terminate device name before lookup (Zijie Huang)
- net/sched: reject IDR error pointers when deleting actions (Weiming Shi)
- net/mlx5e: advertise MACsec offload only when supported (Ralf Lici)
- net/mlx5: Fix rev_entry reference leak in mlx5_tc_ct_shared_counter_get() (Wentao Liang)
- HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce() (Wei Jie LAW)
- HID: quirks: add ALWAYS_POLL quirk for SDINNOVATION gaming keyboard (Junjie Cao)
- HID: alps: fix use-after-free on input2 registration failure (Chen Changcheng)
- PCI: of_property: Omit bus properties without a subordinate bus (Angel J)
- mm/hugetlb: preserve mremap address delta when skipping page tables (Jaewook You)
- gpio: tps65219: Fix GPIO input value reads (Karl Mehltretter)
- drm/virtio: fix NULL pointer dereference on fence allocation failure (Peiyang He)
- drm/virtio: fix memory leak of fence event on execbuffer failure (Peiyang He)
- drm/xe: Limit sg segment size to PAGE_SIZE on Xen PV (Szymon Acedański)
- drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked() (Peiyang He)
- drm/nouveau: RCU-free the scheduler-containing nouveau_sched (Jonghyuk Kim(MalHyuk))
- drm/nouveau: Fix runtime PM leak in nouveau_connector_detect() (Wentao Liang)
- drm/nouveau: Fix gem reference leak in validate_init() (Wentao Liang)
- drm/nouveau: fix double-free in nvif_vmm_dtor (Peiyang He)
- drm/nouveau: Fix bridge reference leak in nv1a_ram_new() (Wentao Liang)
- drm/nouveau: fix autosuspend cleanup during teardown (Guangshuo Li)
- drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM (Peiyang He)
- drm/amdgpu: Fix vmid_wait fence leak in amdgpu_ring_init() (Wentao Liang)
- drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show() (Wentao Liang)
- drm/amdgpu: Fix last_update fence leak in amdgpu_vm_init() (Wentao Liang)
- drm/amd/display: Bump frame warning limit for clang builds of dml (Ivan Lipski)
- drm/amd/display: Fix dc stream excess put in dm_update_crtc_state() (Wentao Liang)
- drm/i915: fix incorrect RCU teardown order (Christian König)
- drm/imagination: Fix page count for page table for map() interface (Brajesh Gupta)
- drm/imagination: Propagate map failures correctly from pvr_mmu_map_sgl() (Brajesh Gupta)
- mctp: route: iterate socket tag list in mctp_lookup_prealloc_tag() (Hui Peng)
- llc: reserve device headroom for allocated frames (Zixuan Chai)
- gpio: zynq: fix runtime PM leak on request error path (Ridham Khurana)
- gpio: arizona: Fix runtime PM leak in arizona_gpio_direction_out() (Wentao Liang)
- ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST (Hui Peng)
- ipv6: do not let ipv6_find_hdr() return an offset past the packet end (Norbert Szetei)
- ipe: protect the dm-verity root hash with RCU (Fan Wu)
- fsl/fman: Fix clk reference leak in read_dts_node() (Wentao Liang)
- writeback: report a Tasks-RCU quiescent state per cgwb drain pass (Josef Bacik)
- workqueue: Fix NULL current_pwq deref in flush dependency check (Pavankumar Kondeti)
- writeback: bound cleanup_offline_cgwb() rescans by rotating scanned inodes (Patrick Lu (Anthropic))
- fs/ntfs3: use d_instantiate_new() in ntfs_create_inode() and murder syzbot's "WARNING in do_new_mount" saga (Christian Brauner)
- fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT (Hui Peng)
- cgroup/pids: Restore pids.events notifications in local mode (Guopeng Zhang)
- ata: libata-scsi: bound the ATA passthru sense descriptor writes (Matthias Goergens)
- af_packet: fix integer overflow in prb_calc_retire_blk_tmo() (Dairui Zhang)
- sctp: discard the rest of the packet on a stale-cookie error (Aohan Mei)
- tcp: prevent collapsing skbs across boundary in rtx queue (Willem de Bruijn)
- tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow (Eric Dumazet)
- virtio_net: copy zerocopy frags in start_xmit without NAPI (Willem de Bruijn)
- x86/PCI: Disable enhanced atomics on AMD NBIO 7.7 and 7.11 (Mario Limonciello)
- x86/mce: Fix hardware debug register corruption on task migration (Masami Hiramatsu (Google))
- netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Pablo Neira Ayuso)
- rculist: add list_splice_rcu() for private lists (Pablo Neira Ayuso)
- mptcp: return sk_wait_data() errors from recvmsg() (Mark Amirkan)
- perf/x86/intel: Make @data a mandatory param for intel_guest_get_msrs() (Sean Christopherson)
- perf/x86/intel: Don't pointlessly context switch DS_AREA (and PEBS config) if PEBS is unused (Sean Christopherson)
- perf/x86/intel: Don't write PEBS_ENABLED on host<=>guest xfers if CPU has PEBS isolation, to fix stuck PEBS_ENABLED (Sean Christopherson)
- perf/x86/intel: Ensure KVM guest PEBS path doesn't set unwanted PERF_GLOBAL_CTRL bits (Sean Christopherson)
- autofs: fix sbi->pipe file reference leak in autofs_kill_sb() (Hui Peng)
- vlan: ensure sufficient headroom in vlan_dev_hard_header() (Eric Dumazet)
- net/sched: sch_teql: fix shadowed err in __teql_resolve() (Eric Dumazet)
- bridge: check llc_mac_hdr_init() return value in br_send_bpdu() (Eric Dumazet)
- llc: fix skb UAF and leaks on llc_mac_hdr_init() failure (Eric Dumazet)
- net: ethernet: stmmac: dwmac-rk: fix bulk clock leak when the PHY clock fails (Coia Prant)
- tipc: Fix a data race on mon->peer_cnt in mon_timeout() (Ginger Li)
- net/smc: fix UAF on lgr list traversal in smcr_port_err() (Sidraya Jayagond)
- nfp: hold IPsec RX state under the XArray lock (Sang-Hoon Choi)
- tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack() (Yilin Zhang)
- net: dsa: mt7530: fix NULL dereference on unbind of MT7531 and MT7621 (Aleksei Sviridkin)
- bonding: crypto offload enabled, non-offload slave failover, rekey failed (David Dai)
- drm/imagination: clamp freelist reconstruction requests (Pengpeng Hou)
- net: xps: reject an out of range traffic class (Norbert Szetei)
- vxlan: use one headroom snapshot for neighbour replies (Sanghyun Park)
- ip_gre: Reject enabling collect metadata through changelink (Xuanqiang Luo)
- net: bcmgenet: mask DMA_TIMEOUT_MASK when reading DMA_RING0_TIMEOUT (Florian Fainelli)
- net: bcmgenet: validate Ethernet address in bcmgenet_set_mac_addr (Florian Fainelli)
- net: bcmgenet: do not skip WoL power up on GENET V1 (Florian Fainelli)
- net: bcmgenet: allow return of power up status (Doug Berger)
- net: bcmgenet: move bcmgenet_power_up into resume_noirq (Doug Berger)
- net: bcmgenet: initialize u64 stats seq counter for all queues (Florian Fainelli)
- net: bcmgenet: fix 64-bit RTNL stats reading in ethtool on 32-bit systems (Florian Fainelli)
- tg3: use random MAC address when tg3_get_device_address fails (Ivan Delalande)
- driver core: Add device probe log helper dev_warn_probe() (Dragan Simic)
- bpf: Fix BSWAP 32 and 16 on MIPS64 (Johan Almbladh)
- bpf: Fix immediate JMP JEQ/JNE on MIPS32 (Johan Almbladh)
- vrf: Stop corrupting skb->csum when capturing CHECKSUM_COMPLETE packets (Ido Schimmel)
- net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6() (Shihuang Liu)
- veth: manage XDP program pointers during channel resize (Jakub Kicinski)
- net/sched: act_gate: budget the per-entry list in get_fill_size (Victor Nogueira)
- nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid() (Deepanshu Kartikey)
- nfc: llcp: fix slab-out-of-bounds reads when logging service names (Ömer Mete Kaya)
- nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap() (Ömer Mete Kaya)
- nfc: llcp: fix -ENOMEM on connect with zero-length service name (Ömer Mete Kaya)
- nfc: st21nfca: validate ISO15693 inventory length (Pengpeng Hou)
- nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure (Cong Nguyen)
- nfc: virtual_ncidev: Add missing ioctl compat handler (Chris Gellermann)
- selftests/nci: Fix out-of-bounds store on thread join (Chris Gellermann)
- selftests: nci: Fix uninitialized family ID on missing attribute (Chaithanya Lagisetty)
- nfc: llcp: Fix race condition in accept_queue lifecycle (Lee Jones)
- selftests: nci: Correct pthread_create return value check (Lei Zhu)
- nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm() (Aldo Ariel Panzardo)
- nfc: st21nfca: validate received frame size (Pengpeng Hou)
- nfc: nfcmrvl: validate helper command length before pull (Pengpeng Hou)
- bpf: Reject dev-bound-only programs on other devices (Weiming Shi)
- net: stmmac: dwmac4: Use the correct bufzise when the len is exactly 8K (Maxime Chevallier)
- net: stmmac: selftests: Capture all packets for vlan checks (Maxime Chevallier)
- net: stmmac: selftests: Check the dev->features for S-TAG offload testing (Maxime Chevallier)
- net: stmmac: selftests: Support running selftests on DSA conduits (Maxime Chevallier)
- sctp: hold asoc or transport before mod_timer() in timer handlers (Xin Long)
- net/mlx5: Bridge, don't fail unlink of untracked/unsupported peer ports (Bernardo Soares)
- net/mlx5: Bridge, don't fail switchdev events of sibling eswitch ports (Bernardo Soares)
- bpf, sockmap: Reject max_entries > INT_MAX in sock_map_alloc (Zhao Gongyi)
- bpf: Fix bpf_sock context code generation (Emil Tsalapatis)
- bpf: Fix bounds check for skb-backed dynptrs (Emil Tsalapatis)
- thermal: gov_step_wise: Fix stale mitigation vote with non-zero lower bounds (Manaf Meethalavalappu Pallikunhi)
- net: pcs: xpcs: fix clock reference leak on xpcs_init_clks failure (Coia Prant)
- genetlink: report the real command id for dump-only ops in policy dumps (Jakub Kicinski)
- net: ethernet: ti: netcp: fix pm_runtime usage counter leak on error (bui duc phuc)
- s390/debug: Fix NULL pointer dereference in debug_info_copy() (Mikhail Zaslonko)
- s390/debug: Do not register views for failed static debug areas (Mikhail Zaslonko)
- drm/i915/psr: Clear stale sel fetch enable bits on sel fetch disable (Nemesa Garg)
- drm/i915/psr: Add new SU area calculation helper to apply workarounds (Jouni Högander)
- tg3: clean up PHYLIB resources on probe failure (Myeonghun Pak)
- ipv6: Fix dst leak for uncached routes. (Kuniyuki Iwashima)
- net: usb: sr9700: include receive overhead in the length check (Pengpeng Hou)
- dpll: use exact lookup for reference sync pin id (Ivan Vecera)
- octeontx2-af: Fix memory scaling limitation in SR-IOV mode (Ratheesh Kannoth)
- Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame() (Hui Peng)
- Bluetooth: btintel_pcie: validate device-supplied DMA indices (Ravindra)
- Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough (Hui Peng)
- drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach (Li Youhong)
- drm/virtio: release the GEM object on virtio_gpu_vram_create() errors (Junrui Luo)
- drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl() (Junrui Luo)
- drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl() (Junrui Luo)
- drm/virtio: fix object leak when drm_gem_handle_create() fails (Junrui Luo)
- net/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget (Jamal Hadi Salim)
- bpf: Check params size before reading reserved fields (Yuqi Xu)
- net: usb: catc: bound the RX packet length in catc_rx_done() (Aamir Ahmed)
- bpf: Bound ownership depth through local kptrs and graph roots (Kumar Kartikeya Dwivedi)
- sctp: avoid livelock while updating retransmit path (Yiqi Sun)
- eth: fbnic: Set AW_FLUSH_MODE alongside AW_FLUSH when flushing the mailbox (Alexander Duyck)
- eth: fbnic: Handle maximum standalone channels (Björn Töpel)
- ip6_gre: Call ip6erspan_tunnel_unlink_md() in ip6erspan_changelink(). (Kuniyuki Iwashima)
- net: ethernet: mtk_eth_soc: unregister net_devices in case of probe failure (Lorenzo Bianconi)
- net: gue: reject invalid REMCSUM offsets (Jérémy Jean)
- net/sched: act_ct: don't WARN on benign flow_offload_alloc() failure (Nguyen Ngoc Thang)
- drm/nouveau/disp: don't reject HDMI config on cards without SCDC (Giuseppe Ranieri)
- drm/nouveau/clk: don't clobber reclock status when restoring volt/fan (Francesco Magazzu)
- drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update (Dan Carpenter)
- ocfs2: make ocfs2_calc_xattr_init() return void (Joseph Qi)
- netfilter: ctnetlink: fix suspicious RCU usage in expect_iter_name (Naman Gulati)
- ipvs: revalidate ihl before icmp_send (Julian Anastasov)
- netfilter: nft_synproxy: use the family-aware checksum helper (Karl Mehltretter)
- netfilter: nfnetlink_queue: hold nfnl mutex in event notifier (Florian Westphal)
- netfilter: flowtable: publish HW_DEAD after worker is done (Jérémy Jean)
- libbpf: Reject truncated ldimm64 CO-RE relocations (Kumar Kartikeya Dwivedi)
- bpf: Restrict CO-RE poisoning to relocatable instructions (Kumar Kartikeya Dwivedi)
- net/mlx5: devcom, Base component size on linked devices (Shay Drory)
- net/sched: cls_u32: fix manual hash table handle IDR aliasing (Jamal Hadi Salim)
- bpf: Skip unsettled links in link iterator (Weiming Shi)
- xsk: Use a 32-bit compare in xsk_map_gen_lookup (Zhiling Zou)
- s390/cio: Guard PMCW field accesses with dnv check (Vineeth Vijayan)
- s390/cio: Check pmcw.dnv before pmcw.ena in I/O entry points (Vineeth Vijayan)
- s390/cio: Fix cio_update_schib() to not cache invalid schib (Vineeth Vijayan)
- s390/pci/docs: Fix sriov_numvfs attribute name (Karl Mehltretter)
- docs: s390/pci: Improve and update PCI documentation (Niklas Schnelle)
- scsi: megaraid_sas: Protect megasas_get_ctrl_info() in megasas_resume() (Bart Van Assche)
- selftests: cgroup: give the O_TMPFILE open in get_temp_fd() a mode (Eva Kurchatova)
- cgroup: selftests: Move memcontrol specific helpers out of common cgroup_util.c (Sean Christopherson)
- Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel (Lee Jones)
- Bluetooth: SMP: reject Security Request over BR/EDR (Christiano Amora)
- scsi: sd_zbc: Reject disks with too many zones (ZHOU Jiaxiang)
- squashfs: Add dictionary size range check to prevent shift-out-of-bounds (Ran Hongyun)
- KVM: arm64: Fix FGT mapping for HFGITR_EL2.nGCSEPP (Mark Brown)
- KVM: arm64: Return -EINVAL for an empty SMCCC filter range at base 0 (Karl Mehltretter)
- KVM: arm64: vgic-its: Skip unreachable devices instead of failing the save (Fuad Tabba)
- KVM: arm64: vgic-its: Add stronger type-checking to the ITS entry sizes (Marc Zyngier)
- KVM: arm64: vgic-its: Free the caches when GITS_BASER changes (Fuad Tabba)
- RISC-V: KVM: Fix perf-backed counter accounting across stop and read (SeungJu Cheon)
- RISC-V: KVM: Report snapshot write failure to the guest (SeungJu Cheon)
- RISC-V: KVM: Preserve firmware counter value across stop/start (SeungJu Cheon)
- HID: bpf: fix __hid_bpf_hw_check_params report length (Benjamin Tissoires)
- HID: amd_sfh: Validate PCI BAR size before mapping (Slawomir Stepien)
- pinctrl: meson: Fix typo in s4 group name (Sean Anderson)
- bpf, arm64: set up the frame pointer for the exception callback (Donggeun Yoo)
- bpf, sockmap: Fix self-redirect copied_seq double-counting (Geliang Tang)
- bpf: Factor out htab_elem_value helper() (Hou Tao)
- bpf: Bail out early in __htab_map_lookup_and_delete_elem() (Hou Tao)
- bpf: Remove migrate_{disable|enable} in ->map_for_each_callback (Hou Tao)
- bpf: Fix out-of-bounds read of rtt_min in sock_ops (Jiayuan Chen)
- bpf: Avoid soft lockup in __htab_map_lookup_and_delete_batch() (Jose Fernandez (Anthropic))
- KVM: x86/pmu: Move Intel PMU global MSRs to intel_is_valid_msr() (Jim Mattson)
- HID: elecom: fix bus type for M-XGL20DLBK (Oscar Priego Verdugo)
- tcp: Skip cond_resched() in inet_csk_listen_stop() under BPF context (Jiayuan Chen)
- bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destroy() (Jiayuan Chen)
- bpf: Fix divide-by-zero in btf_struct_walk() (Jiayuan Chen)
- selftests/ftrace: Fix unique symbol check in kprobe_non_uniq_symbol.tc (Sven Schnelle)
- bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL (Weiming Shi)
- bpf: Fix bpf_skb_change_tail wrt csum partial skbs (Daniel Borkmann)
- KVM: s390: Fix IRQ injection with SIGP Stop and Store Status (Claudio Imbrenda)
- remoteproc: qcom_q6v5_adsp: Fix iommu_unmap() usage (Mostafa Saleh)
- xfrm: save input state data before secpath resets (Zhiling Zou)
- xfrm: Fix dev use-after-free in xfrm async resumption (Dong Chenchen)
- xfrm: Refactor xfrm_input lock to reduce contention with RSS (Jianbo Liu)
- netfilter: nf_tables: Simplify chain netdev notifier (Phil Sutter)
- netfilter: nf_tables: Tolerate chains with no remaining hooks (Phil Sutter)
- ALSA: hda/realtek: Add StarFighter HDA SSID (Sean Rhodes)
- ALSA: hda/realtek: Limit Star Labs internal mic boost (Sean Rhodes)
- erofs: fix large folio race in erofs_fscache_req_complete (Wenwu Hou)
- xfs: don't stash removename operations with unknown ftype (Darrick J. Wong)
- smb: client: fix busy dentry warning on unmount after DIO (Zizhi Wo)
- spi: spi-zynqmp-gqspi: stop the controller on shutdown (Itai Handler)
- ksmbd: fix partial normalized name responses (Namjae Jeon)
- HID: asus: fortify keyboard handshake (Antheas Kapenekakis)
- smb: client: fix missing iov bounds check in parse_posix_sids() (Frank Sorenson)
- smb: client: fix missing lower-bound check on DFS referral string offsets (Frank Sorenson)
- smb: client: fix server->total_read for compound encrypted PDUs (Frank Sorenson)
- smb: client: fix potential OOB read in smb3_enum_snapshots() (Frank Sorenson)
- smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs (Frank Sorenson)
- smb: client: fix unaligned access in WSL reparse point parser (Paulo Alcantara)
- smb: client: fix smbd_connection leak on cifs_get_tcp_session() error (Paulo Alcantara)
- smb: client: reject short Next offsets in parse_server_interfaces() (Frank Sorenson)
- smb: client: fix rlist race and missing initialization (Paulo Alcantara)
- smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara)
- drm/msm/hdmi_phy: fix runtime PM cleanup on probe failure (Guangshuo Li)
- drm/msm/adreno: fix autosuspend cleanup during teardown (Guangshuo Li)
- drm/gud: fix out-of-bounds write in gud_plane_atomic_check() (Sajal Gupta)
- wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver (Rik van Riel)
- wifi: mwifiex: validate action frame fixed fields (Zhao Li)
- wifi: mwifiex: prevent authentication frame length truncation (Linmao Li)
- wifi: mwifiex: validate scan response extents (Pengpeng Hou)
- wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length (Doruk Tan Ozturk)
- wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST (Shengzhuo Wei)
- wifi: p54: validate curve data length in the calibration curve converters (Shengzhuo Wei)
- wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext() (Tianchu Chen)
- wifi: wilc1000: fix out-of-bounds read in P2P public action frames (Ali Ahmet Memis)
- wifi: wlcore: release runtime PM ref on regdomain config failure (Runyu Xiao)
- wifi: rsi: fix heap OOB write on key removal (Tianchu Chen)
- wifi: libertas_tf: fix UAF in lbtf_free_adapter() (Jiangshan Yi)
- wifi: iwlegacy: fix broadcast stations deallocation (Stanislaw Gruszka)
- wifi: brcmsmac: fix UAF in brcms_free_timer() (Jiangshan Yi)
- watchdog: starfive-wdt: Fix runtime PM leak in starfive_wdt_pm_start() (Wentao Liang)
- watchdog: sp5100_tco: Fix pci_dev reference leak in sp5100_tco_init() (Wentao Liang)
- watchdog: rtd119x: Avoid division by zero (Tzung-Bi Shih)
- watchdog: msc313e: Propagate error code in resume() (Tzung-Bi Shih)
- watchdog: msc313e: Fix premature reset during timeout update (Tzung-Bi Shih)
- watchdog: digicolor: Avoid division by zero (Tzung-Bi Shih)
- watchdog: da9063: fix suspend/resume handling of HW_RUNNING watchdog (Li Jun)
- hwmon: (w83793) release probe data through kref (Guangshuo Li)
- hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove (Guangshuo Li)
- hwmon: (pmbus/tps53679) Select page 0 for single-page TPS53676 (Sanman Pradhan)
- hwmon: (pmbus/tps53679) Fix TPS53676 phase page decoding (Sanman Pradhan)
- hwmon: (pmbus/core) increase number of phases and add new mask (Nuno Sá)
- hwmon: (hp-wmi-sensors) Fix use-after-free in fungible_show() (Muhammad Bilal)
- Input: zero ff_effect before compat copy in input_ff_effect_from_user (Iván Ezequiel Rodriguez)
- Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound (Dmitry Torokhov)
- Input: synaptics - disable InterTouch on ThinkPad T440p (board id 2722) (Raphaël Larocque)
- Input: soc_button_array - check btns_desc->package.count (Hans de Goede)
- Input: soc_button_array - fix MS Surface Pro 11 probe failure (Hans de Goede)
- Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block() (Dmitry Torokhov)
- Input: i8042 - add quirk for Acer Aspire Go 15 AG15-42P (Chris Sommers)
- Input: evdev - zero absinfo before partial copy in EVIOCSABS (Iván Ezequiel Rodriguez)
- Input: cyttsp5 - clamp the HID report size before memcpy (Linkai Gong)
- Input: atkbd - skip deactivate for Xiaomi Redmi Book Pro 16 2026 (Alexei Turtanov)
- Input: adp5588-keys - cache GPIO state before registering the gpiochip (Alvin Šipraga)
- mmc: sdhci_am654: Fallback to DT-provided itap delay on DDR50 tuning failure (Diogo Ivo (Schneider Electric))
- mmc: sdhci_am654: Clear ITAPDLY on tuning failure (Diogo Ivo (Schneider Electric))
- mmc: sdhci_am654: Reset command and data lines on failed tuning (Diogo Ivo (Schneider Electric))
- mmc: sdhci_am654: Move tuning_loop to local variable (Diogo Ivo (Schneider Electric))
- mmc: spi: reset bytes_xfered before retrying CRC failures (Xu Rao)
- mmc: sh_mmcif: initialize IRQ-thread mutex before requesting interrupt (Runyu Xiao)
- mmc: sdio_uart: fix xmit_fifo leak when the port table is full (Felix Gu)
- mmc: sdhci-of-aspeed: Remove children before releasing SDC resources (Myeonghun Pak)
- mmc: rtsx_pci_sdmmc: ignore broken write-protect on ThinkPad X260 (Florian Maillard)
- mmc: mxcmmc: cancel data work and watchdog on remove (Fan Wu)
- mmc: mmci: Fix use-after-free in busy-timeout work (Fan Wu)
- mmc: hsq: Fix use-after-free in retry work (Fan Wu)
- mmc: core: Fix OF node reference leak on card add failure (Zhu Ling)
- mmc: core: Cancel SDIO IRQ work before freeing host (Fan Wu)
- power: sequencing: fix NULL-pointer dereference in pwrseq_device_register() (Bartosz Golaszewski)
- power: sequencing: fix NULL-pointer dereference in pwrseq_unit_new() (Bartosz Golaszewski)
- power: sequencing: don't call .post_enable() if pwrseq_unit_enable() failed (Bartosz Golaszewski)
- selinux: always fill AVC decision in avc_has_perm_noaudit() (Christian Göttsche)
- selinux: recheck intermediate backing files on mprotect() (Karl Mehltretter)
- selinux: preserve user SID across nested backing files (Karl Mehltretter)
- IB/hfi1: Fix the PIO_CRED credit-return mmap (Shuhei Takeshita)
- IB/hfi1: Resolve the credit-return buffer through the send context's node (Shuhei Takeshita)
- IB/mlx4: Fix use-after-free on pkey sysfs registration failure (Shuangpeng Bai)
- i2c: imx: disable autosuspend on remove (Guangshuo Li)
- i2c: imx: release DMA channels on probe error (Shengzhuo Wei)
- i2c: atr: fix dangling adapter pointer on add failure (Linkai Gong)
- i2c: at91: release DMA channels on remove and probe error (Shengzhuo Wei)
- KEYS: trusted: Fix tpm2_load_cmd() boundary check (Jarkko Sakkinen)
- keys: translate request_key_auth pid for the reading procfs instance (Maoyi Xie)
- KEYS: encrypted: fix integer overflow of datablob_len (Cen Zhang)
- mm/mlock: use the IRQ-safe accessor for NR_MLOCK in __munlock_folio() (Shakeel Butt)
- memstick: ms_block: destroy io_queue workqueue on removal (Yifei Gao)
- xfrm: use hlist_del_init_rcu for state_cache and state_cache_input (Siwei Zhang)
- xfrm: serialize state GC with device state flush (Chengfeng Ye)
- scsi: core: Validate MODE SENSE lengths in scsi_cdl_enable() (Alberto Carboneri)
- net/packet: avoid truncating TPACKET_V3 private size (Mark Amirkan)
- net/packet: clear RX owner on VNET header error (Mark Amirkan)
- net/sched: hhf: cap hh_flows_limit at change time (Jamal Hadi Salim)
- net/sched: act_api: release tail references on DELACTION failure (Xuanqiang Luo)
- net: wwan: mhi_wwan_mbim: check skb_copy_bits() return value (Guanglei Zhu)
- net: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain (Guanglei Zhu)
- net: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb() (Guanglei Zhu)
- net: lan743x: fix RX checksum use-after-free (Mark Amirkan)
- ipv6: xfrm: use full sockets in local error paths (Zhiling Zou)
- dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn() (Alexander Chesnokov)
- dmaengine: sun6i: fix undefined behaviour in sun6i_dma_tx_status (Christian Lugnberg)
- dmaengine: sun6i: fix non-atomic read of DMA position registers (Christian Lugnberg)
- Bluetooth: hci_sync: Serialize local codec list cleanup (Chengfeng Ye)
- Bluetooth: hci_codec: validate vendor codec count length (Laxman Acharya Padhya)
- Bluetooth: eir: validate service data length before reading UUID (Aamir Ahmed)
- Bluetooth: btusb: fix NXP IW610 composite device handling (Nicolas Thibert)
- arm64: percpu: Fix this_cpu_and() mask generation (Mark Rutland)
- arm64: percpu: Fix this_cpu_write() casting (Mark Rutland)
- arm64: dts: renesas: r8a779f0: Set UFS lane count (Koichiro Den)
- arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc (Bradley Morgan)
- kselftest/arm64: Fix size of thread_data values for pthread_join() (Thomas Huth)
- HID: logitech-hidpp: fix race condition when accessing stale stack pointer (Benoît Sevens)
- net: xfrm: reject unrepresentable espintcp transport headers (Wyatt Feng)
- openvswitch: avoid reallocating confirmed conntrack labels (Zhiling Zou)
- RDMA/core: fix refcount bug in iwpm_get_nlmsg_request() (Jeffin Philip)
- RDMA/ucma: Serialize join and leave on copy_to_user failure (Quanye Yang)
- tcp: exclude old ACKs from tcp fast path (Inbal Schussheim)
- x86/microcode/intel: Reject problematic loading on Granite Rapids systems (Chang S. Bae)
- exec: Cleanup POSIX timers right after de_thread() (Hyunwoo Kim)
- cifs: Fix server use-after-free in cifs_chan_skip_or_disable() (Wentao Liang)
- ata: libahci_platform: Fix device reference leak in ahci_platform_get_resources() (Wentao Liang)
- ata: libahci: clear PxCLBU and PxFBU for AHCI_HFLAG_32BIT_ONLY (Niklas Cassel)
- ASoC: codecs: rt712-sdca-dmic: fix uninitialized stream_config->type (Jiangshan Yi)
- ALSA: virtio: reset device before deleting virtqueues (Yuho Choi)
- ALSA: core: Fix potential UAF after asynchronous card release (Takashi Iwai)
- Input: xpad - fix PDP Marvel Xbox 360 controller (Jeremy Nyberg)
- Input: xpad - add support for Azeron devices (Roberts Kursitis)
- Input: xpad - add support for Victrix Pro BFG Controller (Erich Sartison)
- wifi: rtw88: Fix the random "error beacon valid" messages for USB (Bitterblue Smith)
- wifi: rtw88: TX QOS Null data the same way as Null data (Bitterblue Smith)
- mm/huge_memory: use folio's memcg inside __folio_split() (Zi Yan)
- x86/fred: Reconstruct the #GP context for rejected INT instructions (Matthew Schwartz)
- btrfs: abort transaction on failure to update inode for hole punching and reflinking (Filipe Manana)
- drm/amdgpu: check ras and obj before dereference (Dmitriy Chumachenko)
- net: skbuff: do not leave stale header offsets after pskb_carve() (Eric Dumazet)
- net: mvpp2: prevent buffer overflow in page_pool allocation (Dmitriy Okunev)
- net: macb: fix ordering around PTP timestamp read (James Clark)
- net: stmmac: propagate FPE preemption-class mapping errors (Lorenzo Bianconi)
- net: ethernet: cortina: Ack RX overrun interrupt correctly (Linus Walleij)
- net: lock the socket in sock_gettstamp() (Eric Dumazet)
- net: netsec: fix device_node reference leak on phy_np (Yige Jiang)
- ASoC: hdmi-codec: Report a change when the channel status moves (HyeongJun An)
- ASoC: ux500: Parenthesize MSP_{RX,TX}_CLKPOL_BIT() arguments (Sasha Levin)
- powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba (Shivaprasad G Bhat)
- KVM: PPC: Book3S HV: fix secure device page leak on uv_page_in() failure (Amit Machhiwal)
- KVM: PPC: Book3S HV: fix use-after-free in kvmhv_emulate_tlbie_all_lpid() (Amit Machhiwal)
- net: stmmac: do not overwrite phc_index when no PTP clock is registered (Lorenzo Bianconi)
- drop_monitor: fix out-of-bounds write in reset_per_cpu_data() (Eric Dumazet)
- drop_monitor: synchronize tracepoint unregistration on error path (Eric Dumazet)
- pppoatm: ensure a writable skb header and linear data (Eric Dumazet)
- Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup (Juan Perdomo)
- Bluetooth: btintel_pcie: fix off-by-one bounds check in RX submit (Sai Teja Aluvala)
- Bluetooth: btmtksdio: Fix PM runtime reference leak in shutdown (Tzung-Bi Shih)
- Bluetooth: btmtk: fix wrong status for short WMT FUNC_CTRL events (Chris Lu)
- Bluetooth: ISO: set BT_LISTEN before requesting a BIG sync (Luiz Augusto von Dentz)
- Bluetooth: ISO: Fix parent socket leak in iso_conn_ready() (Luiz Augusto von Dentz)
- Bluetooth: coredump: Quiesce dump work on unregister (Weiming Shi)
- Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (ThangNN99)
- Bluetooth: hci_core: Print number of packets in conn->data_q (Luiz Augusto von Dentz)
- dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg() (Baineng Shou)
- ksmbd: keep compound responses on query info errors (Namjae Jeon)
- ksmbd: fix partial file information responses (Namjae Jeon)
- ksmbd: return buffer overflow for partial filesystem info (Namjae Jeon)
- tcp: do not let tcp_rmem be set below 4096 (Eric Dumazet)
- tcp: Don't call skb_clone_and_charge_r() for close()d listener in tcp_v6_do_rcv(). (Kuniyuki Iwashima)
- net: bridge: mst: move switchdev call outside rcu (Nikolay Aleksandrov)
- wifi: brcmfmac: fix lost 802.1x TX completion wakeup (Karl Mehltretter)
- net: fddi: skfp: fix NULL deref when setting the MAC address while down (Hohyun Sim)
- ipv4: icmp: reject RTN_UNREACHABLE input routes in icmp_route_lookup (Dong Chenchen)
- seg6: set IPSKB_L3SLAVE from IP6SKB_L3SLAVE on IPIP decapsulation (Andrea Mayer)
- drm/msm/dsi: round the byte clock rate after reparenting to the PHY PLL (Dmitry Baryshkov)
- btrfs: tree-checker: print dev extent offset in error message (Filipe Manana)
- wifi: ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all() (Nicolas Escande)
- ALSA: hda: trace PCM open only after assigning a stream (Slavin Liu)
- drm/vc4: Use managed KMS polling to fix UAF on unbind (Karl Mehltretter)
- wifi: virt_wifi: don't transfer operstate before register (Zihan Xi)
- ALSA: 6fire: fix OOB write from device-reported iso length (Xiang Mei)
- ALSA: usb: 6fire: Avoid embedded URBs (Takashi Iwai)
- ALSA: 6fire: Clean ups with guard() (Takashi Iwai)
- gpio: virtuser: skip free_irq when no IRQ is installed (Runyu Xiao)
- Input: trackpoint - fix the inertia attribute name in the ABI document (Karl Mehltretter)
- ASoC: soc-pcm: Apply snd_soc_dai_link_ch_map.codec_ch_mask to codec params (Richard Fitzgerald)
- ASoC: Add codec_ch_mask to snd_soc_dai_link_ch_map (Richard Fitzgerald)
- ASoC: Rename snd_soc_dai_link_ch_map.ch_mask to cpu_ch_mask (Richard Fitzgerald)
- ALSA: pcm: set timer->private_data before registering the PCM timer (Nguyen Ngoc Thang)
- phy: mediatek: phy-mtk-hdmi-mt8195: Fix TMDS clk bit ratio setting (AngeloGioacchino Del Regno)
- phy: mediatek: phy-mtk-hdmi-mt8195: Fix PLL calc divisor overflow (AngeloGioacchino Del Regno)
- ALSA: bcd2000: Fix race between rawmidi and disconnect (Takashi Iwai)
- keys: fix lost wakeup when reaping a dead key type (Karl Mehltretter)
- drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr (Thadeu Lima de Souza Cascardo)
- arm64: hibernate: clone only the linear map that exists at runtime (Breno Leitao)
- perf/arm-cmn: Fix wp_dev_sel2 setting for multi-DTM configurations (Shouping Wang)
- netfilter: flowtable: hold reference on ct until flow is released (Pablo Neira Ayuso)
- netfilter: nft_nat: fully initialise new_addr in netmap setup (Theodor Arsenij Larionov Trichkine)
- RDMA/siw: Bound fragmented header copies by the remaining length (Jérémy Jean)
- RDMA/efa: Keep EQ resources alive while IRQ is registered (Leon Romanovsky)
- RDMA/efa: Keep admin queues alive while IRQ is registered (Leon Romanovsky)
- dmaengine: xilinx_dma: Fix hardware buffer descriptor chain after cyclic DMA (Alex Bereza)
- dmaengine: xilinx_dma: Fix hardware buffer descriptor reuse order (Alex Bereza)
- scsi: qla2xxx: Fix the ql2xfc2target parameter description (Karl Mehltretter)
- mm: memblock: show all region flags in debugfs (Meijing Zhao)
- wifi: mac80211: set up the TX info early to fix failure paths (Johannes Berg)
- wifi: mac80211: mesh: release the channel if start fails (Johannes Berg)
- wifi: mac80211: mesh: reset the CSA state when leaving (Johannes Berg)
- wifi: mac80211: add HE 6 GHz capability in the scan elems len (Johannes Berg)
- wifi: mac80211: don't access the TSF of a down interface (Johannes Berg)
- wifi: mac80211: don't RCU-dereference the mesh CSA settings we just set (Johannes Berg)
- wifi: mac80211: don't allow link changes when iface is down (Johannes Berg)
- wifi: mac80211: require a peer station for TDLS setup confirm (Johannes Berg)
- wifi: mac80211: reset the AP_VLAN tailroom counter on ifdown (Johannes Berg)
- wifi: mac80211: don't allow injecting frames wider than the chanctx (Johannes Berg)
- wifi: cfg80211: expose cfg80211_chandef_get_width() (Johannes Berg)
- wifi: cfg80211: skip regulatory for punctured subchannels (Kavita Kavita)
- wifi: mac80211_hwsim: don't hand frames to mac80211 while stopping (Johannes Berg)
- wifi: mac80211: unlist vifs when their netdev is unregistered (Johannes Berg)
- wifi: mac80211: reset state when starting AP fails (Johannes Berg)
- wifi: mac80211: abort chanswitch when leaving a mesh (Johannes Berg)
- wifi: mac80211: suppress chanctx warning for debugfs reset (Johannes Berg)
- wifi: mac80211: don't offload TC setup on AP_VLAN interfaces (Johannes Berg)
- wifi: mac80211: don't warn when an IBSS has no channel to scan (Johannes Berg)
- wifi: mac80211: use vif radio mask to limit ibss scan frequencies (Felix Fietkau)
- wifi: cfg80211: add option for vif allowed radios (Felix Fietkau)
- wifi: mac80211: don't start a ROC while scanning (Johannes Berg)
- wifi: cfg80211: don't filter by BSS type when removing stale entries (Johannes Berg)
- wifi: cfg80211: only group hidden BSSes with beacon entries (Johannes Berg)
- dmaengine: wait for RCU readers before releasing dma_device (Shivank Garg)
- dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel() (Shivank Garg)
- dmaengine: Fix device kref underflow in dma_chan_put() (Shivank Garg)
- dma-coherent: report a failed reserved memory assignment (Donggeun Yoo)
- dma-coherent: Warn if OF reserved memory is beyond current coherent DMA mask (Chen-Yu Tsai)
- MIPS: Octeon: apply USB FDT fixups also when USB is modular (Orgad Shaneh)
- soundwire: cadence_master: wait and cancel cdns->work before clock stop (Bard Liao)
- wifi: cfg80211: check IP header size in cfg80211_classify8021d() (Johannes Berg)
- wifi: cfg80211: don't get the radio mask for netdev-less wdevs (Johannes Berg)
- IB/IPoIB: Avoid restoring OPER_UP after multicast flush (Carolina Jubran)
- wifi: libipw: reject too-short association responses (Shmulik Cohen)
- wifi: libipw: reject too-short beacon and probe responses (Shmulik Cohen)
- wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path (Peng Hao)
- wifi: virt_wifi: free skb when disconnected (Mariano Baragiola)
- dmaengine: sprd: Fix runtime PM reference leak in probe (Ruoyu Wang)
- RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted (Quanye Yang)
- RDMA/irdma: Enforce local fence for IB_WR_REG_MR (Jacob Moroni)
- RDMA/mad: Fix receive buffer leak when PKey enforcement fails (Li RongQing)
- IB/isert: wait for deferred control PDU completions before releasing the connection (Yehyeong Lee)
- IB/iser: reject a remote invalidation of an unregistered direction (Yehyeong Lee)
- RDMA/core: Reject unregistering netdevs in ib_get_eth_speed (Krystian Kaniewski)
- RDMA/rxe: insert mcg into mcg_tree only after rxe_mcast_add() succeeds (Michael Bommarito)
- clk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate (Xixin Liu)
- firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS (Xixin Liu)
- RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access (Gang Yan)
- RDMA/rxe: validate access flags before swapping the MR's PD (Norbert Szetei)
- RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept (Guoqing Jiang)
- ARM: socfpga: select the PL310 erratum 753970 workaround (Pengpeng Hou)
- esp: downgrade zerocopy managed frags before mutating skb frags (Maher Azzouzi)
- xfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for xfrm_trans_reinject() (Eric Dumazet)
- xfrm: fix compat ALLOCSPI request use-after-free (Kyle Zeng)
- xfrm: avoid RCU warnings around the per-netns netlink socket (Sabrina Dubroca)
- pidfd: hold exec_update_lock around namespace ioctl (Chen Linxuan)
- ipv6: Honor oif when choosing nexthop for locally generated traffic (Ido Schimmel)
- ipv6: Select best matching nexthop object in fib6_table_lookup() (Ido Schimmel)
- media: video-i2c: fix buffer queue ordering (Arash Golgol)
- ipv6: mcast: use copy-on-write RCU updates in ip6_mc_source() (Eric Dumazet)
- ipv6: mcast: Don't hold RTNL for MCAST_ socket options. (Kuniyuki Iwashima)
- ipv6: mcast: Don't hold RTNL for IPV6_DROP_MEMBERSHIP and MCAST_LEAVE_GROUP. (Kuniyuki Iwashima)
- ipv6: mcast: Don't hold RTNL for IPV6_ADD_MEMBERSHIP and MCAST_JOIN_GROUP. (Kuniyuki Iwashima)
- ipv6: mcast: Use in6_dev_get() in ipv6_dev_mc_dec(). (Kuniyuki Iwashima)
- net: cpsw: Execute ndo_set_rx_mode callback in a work queue (Kevin Hao)
- net: cpsw_new: Execute ndo_set_rx_mode callback in a work queue (Kevin Hao)
- sunvdc: fix -EIO issue due to lack of retries (Jens Axboe)
- selftests/landlock: Add tests for whiteout object creation (Günther Noack)
- s390/boot: Avoid IPL parameter append past command line (Vasily Gorbik)
- s390/boot: Add sized_strscpy() to enable strscpy() usage (Vasily Gorbik)
- selftests/landlock: Add disconnected leafs and branch test suites (Mickaël Salaün)
- selftests/landlock: Add tests for access through disconnected paths (Tingmao Wang)
- selftests/landlock: Add missing connect(minimal AF_UNSPEC) test (Matthieu Buffet)
- selftests/landlock: Add test for TCP fast open (Matthieu Buffet)
- landlock: Fix TCP Fast Open connection bypass (Matthieu Buffet)
- Revert "hwmon: (emc1403) Rely on subsystem locking" (Sasha Levin)
- Revert "hwmon: (emc1403) Drop hysteresis for low limit temperature" (Sasha Levin)
[6.12.0-208.111.2]
- perf script: Fix hangup in offline flamegraph report (Namhyung Kim) [Orabug: 38290523]
- perf script: force stdin for flamegraph in live mode (Anubhav Shelat) [Orabug: 38290523]
- selftests/mm/khugepaged: include kselftest.h in khugepaged (Sherry Yang) [Orabug: 40091146]
- net/rds: Avoid losing sendmsg reconnect requests at conn shutdown (Sharath Srinivasan) [Orabug: 40105600]
- RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Edward Srouji) [Orabug: 40108272]
[6.12.0-208.111.1]
- scsi: target: iblock: Allow iblock devices to be shared (Mike Christie) [Orabug: 39226784]
- scsi: target: core: Fix complete_type use (Mike Christie) [Orabug: 39226784]
- scsi: vhost-scsi: Report direction completion support (Mike Christie) [Orabug: 39226784]
- scsi: target: Allow userspace to set the completion type (Mike Christie) [Orabug: 39226784]
- scsi: target: Use driver completion preference by default (Mike Christie) [Orabug: 39226784]
- scsi: target: Add support for completing commands from backend context (Mike Christie) [Orabug: 39226784]
- scsi: target: Move LUN stats to per-CPU (Mike Christie) [Orabug: 39226784]
- scsi: target: Create and use macro helpers for per-CPU stats (Mike Christie) [Orabug: 39226784]
- scsi: target: Fix LUN/device R/W and total command stats (Mike Christie) [Orabug: 39226784]
- scsi: target: Move delayed/ordered tracking to per CPU (Mike Christie) [Orabug: 39226784]
- scsi: target: Move I/O path stats to per CPU (Mike Christie) [Orabug: 39226784]
- uek-rpm: emb4 trim bump in the wire config (Joseph Dobosenski) [Orabug: 39871695]
- IB/mlx4: delete allocated id_map_entry while sending REJ (Praveen Kumar Kannoju) [Orabug: 40002251]
- KVM: x86: Reset last_steal on vCPU pid change (Dongli Zhang) [Orabug: 40040208]
More information about the El-errata
mailing list