{ "cves": [ "CVE-2025-40326", "CVE-2026-52988", "CVE-2026-72315", "CVE-2026-72463", "CVE-2026-74347", "CVE-2026-80937", "CVE-2026-80939", "CVE-2026-81015", "CVE-2026-81016", "CVE-2026-89441", "CVE-2026-89500", "CVE-2026-89503", "CVE-2026-89520", "CVE-2026-89754", "CVE-2026-89766", "CVE-2026-89827", "CVE-2026-89859", "CVE-2026-89971", "CVE-2026-89972", "CVE-2026-89996", "CVE-2026-90002", "CVE-2026-90013", "CVE-2026-90029", "CVE-2026-93134", "CVE-2026-93196", "CVE-2026-93231", "CVE-2026-93244", "CVE-2026-97527", "CVE-2026-97528", "CVE-2026-97529", "CVE-2026-97530", "CVE-2026-97531", "CVE-2026-97532", "CVE-2026-97535", "CVE-2026-97536", "CVE-2026-97537", "CVE-2026-97549", "CVE-2026-97559", "CVE-2026-97566", "CVE-2026-97571", "CVE-2026-97597", "CVE-2026-97603", "CVE-2026-97609", "CVE-2026-97615", "CVE-2026-97618", "CVE-2026-97619", "CVE-2026-97620", "CVE-2026-97901", "CVE-2026-97906", "CVE-2026-97918", "CVE-2026-97919", "CVE-2026-97933", "CVE-2026-97934", "CVE-2026-97935", "CVE-2026-97938", "CVE-2026-97939", "CVE-2026-97949", "CVE-2026-97950", "CVE-2026-98101", "CVE-2026-98161", "CVE-2026-98167", "CVE-2026-98168", "CVE-2026-98169", "CVE-2026-98170", "CVE-2026-98171", "CVE-2026-98172", "CVE-2026-98173", "CVE-2026-98174", "CVE-2026-98175", "CVE-2026-98179", "CVE-2026-98181", "CVE-2026-98182", "CVE-2026-98184", "CVE-2026-98185", "CVE-2026-98186", "CVE-2026-98187", "CVE-2026-98188", "CVE-2026-98191", "CVE-2026-98192", "CVE-2026-98193", "CVE-2026-98194", "CVE-2026-98195", "CVE-2026-98196", "CVE-2026-98197", "CVE-2026-98198", "CVE-2026-98199", "CVE-2026-98201", "CVE-2026-98202", "CVE-2026-98203", "CVE-2026-98204", "CVE-2026-98205", "CVE-2026-98207", "CVE-2026-98208", "CVE-2026-98211", "CVE-2026-98213", "CVE-2026-98214", "CVE-2026-98215", "CVE-2026-98216", "CVE-2026-98217", "CVE-2026-98221", "CVE-2026-98222", "CVE-2026-98229", "CVE-2026-98230", "CVE-2026-98231", "CVE-2026-98232", "CVE-2026-98233", "CVE-2026-98234", "CVE-2026-98235", "CVE-2026-98236", "CVE-2026-98237", "CVE-2026-98238", "CVE-2026-98239", "CVE-2026-98241", "CVE-2026-98245", "CVE-2026-98246", "CVE-2026-98247", "CVE-2026-98248", "CVE-2026-98249", "CVE-2026-98251", "CVE-2026-98252", "CVE-2026-98253", "CVE-2026-98254", "CVE-2026-98255", "CVE-2026-98260", "CVE-2026-98261", "CVE-2026-98262", "CVE-2026-98263", "CVE-2026-98264", "CVE-2026-98265", "CVE-2026-98266", "CVE-2026-98267", "CVE-2026-98269", "CVE-2026-98270", "CVE-2026-98271", "CVE-2026-98272", "CVE-2026-98276", "CVE-2026-98287", "CVE-2026-98290", "CVE-2026-98291", "CVE-2026-98293", "CVE-2026-98295", "CVE-2026-98297", "CVE-2026-98299", "CVE-2026-98300", "CVE-2026-98301", "CVE-2026-98303", "CVE-2026-98306", "CVE-2026-98307", "CVE-2026-98308", "CVE-2026-98309", "CVE-2026-98312", "CVE-2026-98314", "CVE-2026-98316", "CVE-2026-98319", "CVE-2026-98320", "CVE-2026-98322", "CVE-2026-98325", "CVE-2026-98326", "CVE-2026-98327", "CVE-2026-98328", "CVE-2026-98329", "CVE-2026-98331", "CVE-2026-98334", "CVE-2026-98335", "CVE-2026-98336", "CVE-2026-98337", "CVE-2026-98339", "CVE-2026-98340", "CVE-2026-98342", "CVE-2026-98343", "CVE-2026-98344", "CVE-2026-98345", "CVE-2026-98346", "CVE-2026-98347", "CVE-2026-98348", "CVE-2026-98349", "CVE-2026-98354", "CVE-2026-98357", "CVE-2026-98358", "CVE-2026-98359", "CVE-2026-98360", "CVE-2026-98362", "CVE-2026-98363", "CVE-2026-98365", "CVE-2026-98366", "CVE-2026-98368", "CVE-2026-98369", "CVE-2026-98370", "CVE-2026-98373", "CVE-2026-98374", "CVE-2026-98377", "CVE-2026-98378", "CVE-2026-98379", "CVE-2026-98380", "CVE-2026-98381", "CVE-2026-98382", "CVE-2026-98383", "CVE-2026-98384", "CVE-2026-98405", "CVE-2026-98428", "CVE-2026-98432", "CVE-2026-98441", "CVE-2026-98442", "CVE-2026-98448", "CVE-2026-98452", "CVE-2026-98454", "CVE-2026-98455", "CVE-2026-98456", "CVE-2026-98457", "CVE-2026-98459", "CVE-2026-98460", "CVE-2026-98461", "CVE-2026-98462", "CVE-2026-98468", "CVE-2026-98477", "CVE-2026-98479", "CVE-2026-98484", "CVE-2026-98485", "CVE-2026-98486", "CVE-2026-98487", "CVE-2026-98488", "CVE-2026-98489", "CVE-2026-98490", "CVE-2026-98491", "CVE-2026-98494", "CVE-2026-98495", "CVE-2026-98498", "CVE-2026-98499", "CVE-2026-98501", "CVE-2026-98502", "CVE-2026-98503", "CVE-2026-98505", "CVE-2026-98506", "CVE-2026-98507", "CVE-2026-98508", "CVE-2026-98509", "CVE-2026-98510", "CVE-2026-98511", "CVE-2026-98512", "CVE-2026-98513", "CVE-2026-98514", "CVE-2026-98515", "CVE-2026-98516", "CVE-2026-98517", "CVE-2026-98519", "CVE-2026-98521", "CVE-2026-98523", "CVE-2026-98528", "CVE-2026-98531", "CVE-2026-98532", "CVE-2026-98536", "CVE-2026-98537", "CVE-2026-98538", "CVE-2026-98541", "CVE-2026-98544", "CVE-2026-98545", "CVE-2026-98547", "CVE-2026-98548", "CVE-2026-98549", "CVE-2026-98550", "CVE-2026-98553", "CVE-2026-98554", "CVE-2026-98561", "CVE-2026-98565", "CVE-2026-98567", "CVE-2026-98568", "CVE-2026-98569", "CVE-2026-98573", "CVE-2026-98586", "CVE-2026-98588", "CVE-2026-98590", "CVE-2026-98591", "CVE-2026-98594", "CVE-2026-98596", "CVE-2026-98597", "CVE-2026-98600", "CVE-2026-98601", "CVE-2026-98602", "CVE-2026-98605", "CVE-2026-98606", "CVE-2026-98607", "CVE-2026-98608", "CVE-2026-98609", "CVE-2026-98610", "CVE-2026-98611", "CVE-2026-98612", "CVE-2026-98613", "CVE-2026-98614", "CVE-2026-98621", "CVE-2026-98622", "CVE-2026-98623", "CVE-2026-98624", "CVE-2026-98625", "CVE-2026-98626", "CVE-2026-98629", "CVE-2026-98631", "CVE-2026-98632", "CVE-2026-98634", "CVE-2026-98636", "CVE-2026-98640", "CVE-2026-98641", "CVE-2026-98643", "CVE-2026-98644", "CVE-2026-98646", "CVE-2026-98647", "CVE-2026-98925", "CVE-2026-99082", "CVE-2026-99999" ], "cvss": 0.0, "database_specific": { "severity": "IMPORTANT" }, "description": "[6.12.0-208.112.5]\n- NFSD: Define actions for the new time_deleg FATTR4 attributes (Chuck Lever) [Orabug: 39004166] {CVE-2025-40326}\n- vhost-scsi: fix page reference leak in misaligned I/O fallback (Jia Jia) [Orabug: 40193938] \n- vhost-scsi: zero misaligned I/O bounce pages (Shubham Antil) [Orabug: 40193938]\n\n[6.12.0-208.112.4]\n- KVM: x86: Use active memslots for the per-vCPU MMIO cache (Jinu Kim) [Orabug: 40180575]\n- rds: cong: fix race while clearing rs_cong_mask (Anand Khoje) [Orabug: 39519856]\n- uek-rpm/osp: Remove atda38740 and ar_pmbus_core (Vijay Kumar) [Orabug: 40147556]\n- Revert 'vrm: Import PMBus core from SONiC kernel' (Vijay Kumar) [Orabug: 40147556]\n- Revert 'vrm: Fork PMBus core into Arista namespace' (Vijay Kumar) [Orabug: 40147556]\n- Revert 'vrm: Add driver for Infineon POLs and controllers' (Vijay Kumar) [Orabug: 40147556]\n- ipv4: free inet_opt and ireq_opt after an RCU grace period (Eric Dumazet) [Orabug: 40165787] {CVE-2026-98432}\n- ipv4: validate checksum_start before completing checksum (Michael S. Tsirkin) [Orabug: 40165809] {CVE-2026-99999}\n- mm/pagewalk: fix stale walk-action escaping walk_pmd_range() (Hyunwoo Kim) [Orabug: 40022020] {CVE-2026-89754}\n\n[6.12.0-208.112.3]\n- net/rds: Don't drop bcopy portion of messages with successful RDMA completion (Gerd Rausch) [Orabug: 39360343]\n- net/rds: Get rid of RDS_CMSG_ATOMIC_* support (Gerd Rausch) [Orabug: 39360343]\n- printk: kthread: add note about failed trylock (Stephen Brennan) [Orabug: 40047816]\n- printk: fix missed kthread wakeup (Stephen Brennan) [Orabug: 40047816]\n- Reapply 'printk: add kthread for long-running print' (Stephen Brennan) [Orabug: 40047816]\n- printk: Fix possible console use-after-free (John Ogness) [Orabug: 40047816]\n- printk: Introduce console_flush_one_record (Andrew Murray) [Orabug: 40047816]\n- Revert 'printk: add kthread for long-running print' (Stephen Brennan) [Orabug: 40047816]\n- uek-rpm: Enable CONFIG_MSTFLINT_ACCESS for Bluefield-4 (Thomas Tai) [Orabug: 40055877]\n- uek-rpm: build embedded4h and embedded4s kernels (Joe Dobosenski) [Orabug: 40087815]\n- soc: pensando: select ARCH_HAS_DMA_OPS (Brad Larson) [Orabug: 40093708]\n- LTS version: v6.12.112 (Sherry Yang)\n- i2c: qcom-cci: fix device_node refcount leak in cci_probe()/cci_remove() (Liu Zhenlong)\n- i2c: qcom-cci: Remove the unused variable cci_clk_rate (Jiapeng Chong)\n- i2c: qcom-cci: Stop complaining about DT set clock rate (Bryan O'Donoghue)\n- arm64: percpu: Fix LSE operations on {8,16}-bit types (Mark Rutland)\n- arm64: Use load LSE atomics for the non-return per-CPU atomic operations (Catalin Marinas)\n- btrfs: take commit root semaphore when iterating in mark_block_group_to_copy() (Hongling Zeng)\n- net: phy: mediatek: do not report link and per-speed LED rules together (Ahmed Naseef)\n- swiotlb: use the adjusted address for the highmem page lookup (Donggeun Yoo)\n- ALSA: usb-audio: Clamp implicit feedback packet count to URB capacity (Xiang Mei)\n- ALSA: usb-audio: Optimize the copy of packet sizes for implicit fb handling (Takashi Iwai)\n- phy: renesas: rcar-gen3-usb2: Avoid long delay in atomic context (Claudiu Beznea)\n- 9p: Fix v9fs_issue_write() to update i_size and remote_i_size (David Howells)\n- cifs: Fix specification of function pointers (David Howells)\n- xfs: fix backwards mergeability logic in refcount scrubber (Darrick J. Wong)\n- xfs: fix under-reservation of blocks when repairing sf directories (Darrick J. Wong)\n- xfs: remove the i_ino field in struct xfs_inode (Christoph Hellwig)\n- xfs: strengthen the 'is cow staging' helpers in scrub (Darrick J. Wong)\n- xfs: fix short ifork reaping computation in xreap_bmapi_binval (Darrick J. Wong)\n- xfs: report healthy filesystem events in scrub stats (Darrick J. Wong)\n- smb: client: fail DACL rewrite when the new DACL exceeds 64K (Bjoern Doebel)\n- smb/client: fix security flag calculation when setting security descriptors (Ralph Boehme)\n- smb: client: refactor ACL setting control flow in id_mode_to_cifs_acl() (Ralph Boehme)\n- mm/hugetlb: keep max_huge_pages when dissolving surplus folios (Longlong Xia)\n- usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race condition (Pei Xiao)\n- platform/x86/amd/pmc: Fix LPS0 and debugfs leaks when STB init fails (Mario Limonciello)\n- mtd: rawnand: pl353: Fix debug prints (Miquel Raynal (DAVE))\n- tracing: Move d_max_latency out of CONFIG_FSNOTIFY protection (Steven Rostedt)\n- bootconfig: Fix negative seeks on 32-bit with LFS enabled (Ben Hutchings)\n- rose: cancel neighbour timers in rose_neigh_put() before freeing (Bernard Pidoux)\n- rose: drop CALL_REQUEST in loopback timer when device is not running (Bernard Pidoux)\n- rose: fix netdev double-hold in rose_make_new() (Bernard Pidoux)\n- rose: fix notifier unregistered too early in rose_exit() (Bernard Pidoux)\n- rose: fix netdev double-hold in rose_rx_call_request() (Bernard Pidoux)\n- rose: guard rose_neigh_put() against NULL in timer expiry (Bernard Pidoux)\n- rose: clear neighbour pointer after rose_neigh_put() in state machines (Bernard Pidoux)\n- rose: fix race between loopback timer and module removal (Bernard Pidoux)\n- rose: hold loopback neighbour reference across timer callback (Bernard Pidoux)\n- rose: fix dev_put() leak in rose_loopback_timer() (Bernard Pidoux)\n- RISC-V: KVM: Serialize IMSIC attributes with vCPU migration (Xie Bo)\n- RISC-V: KVM: Fix null pointer dereference in kvm_riscv_aia_imsic_rw_attr() (Jiakai Xu)\n- perf/x86/intel: Fix GRT PEBS load/store direction for latency events, to fix sample classification (Dapeng Mi)\n- perf/x86/intel: Update event constraints and cache_extra_regsfor ADL (Dapeng Mi)\n- perf/x86/intel: Remove incorrect LionCove PEBS data-source constraints (Dapeng Mi)\n- perf/x86/intel: Update event constraints and cache_extra_regsfor LNL (Dapeng Mi)\n- net: ena: fix MMIO read buffer leak on probe failure (Guangshuo Li)\n- net: ena: Remove autopolling mode (Dr. David Alan Gilbert)\n- net: ipconfig: bound DHCP option construction (Yuqi Xu)\n- net: ipconfig: Remove outdated comment and indent code block (Thorsten Blum)\n- net/sched: act_ct: avoid modifying shared unconfirmed ct entry (Ilya Maximets)\n- net/sched: act_ct: fix helper UAF due to extensions realloc (Ilya Maximets)\n- HID: alps: unregister DualPoint Stick input device on remove (Chen Changcheng)\n- HID: hid-alps: Use pm_ptr instead of #ifdef CONFIG_PM (Bastien Nocera)\n- packet: use ubuf_info completion for TX_RING packets (Willem de Bruijn)\n- PCI: Fix BAR resize for devices on a root bus (Liz Fong-Jones)\n- PCI: Fix Resizable BAR restore order (Ilpo Jarvinen)\n- super: make iterate_supers_type() deletion-safe (Christian Brauner)\n- mm/hugetlb: do not dissolve gigantic pages without runtime support (Longlong Xia)\n- mm/hugetlb: create hstate_is_gigantic_no_runtime helper (Usama Arif)\n- mm/hugetlb: fix surplus pages in dissolve_free_huge_page() (Jinjiang Tu)\n- mm/damon/vaddr: avoid hw-driven pte updates during damon_hugetlb_mkold() (SJ Park)\n- drm/xe/vm: nuke PTs only after unlinking contested VMAs (Matthew Auld)\n- mm/rmap: fix missing barrier between anon_vma init and vma-anon_vma publish (Jinjiang Tu)\n- mm/rmap: allocate anon_vma_chain objects unlocked when possible (Lorenzo Stoakes)\n- drm/i915/dp_mst: Fix configuring FEC for a disconnected stream (Imre Deak)\n- drm/i915/mst: add mst sub-struct to struct intel_dp (Jani Nikula)\n- drm/client: fix restore of partially initialized client (shechenglong)\n- drm/client: Pass force parameter to client restore (Thomas Zimmermann)\n- drm/amdgpu: Fix acpi device leak in amdgpu_acpi_enumerate_xcc() (Wentao Liang)\n- i2c: qcom-geni: Fix hardcoded clock index in SE_GENI_CLK_SEL (Viken Dadhaniya)\n- bna: prevent IOC timer rearm during teardown (Myeonghun Pak)\n- ipe: fix use-after-free when auditing a newly loaded policy (Fan Wu)\n- gpio: cdev: fix kernel stack leak to user-space in error path (Bartosz Golaszewski)\n- vlan: require the MAC header to be present in __vlan_insert_inner_tag() (Xiang Mei)\n- arm64/boot: Disable trapping of PMZR_EL0 writes to EL2 (Fuad Tabba)\n- smb/client: send lease break ACKs thru correct session for multiuser mounts (April Cardenas)\n- smb: client: fix reparse buffer bounds in cifs_query_reparse_point() (Frank Sorenson)\n- drm/amdgpu: hold a runtime PM reference for P2P dma-buf attachments (Mike Lothian)\n- drm: add drm_memory_stats_is_zero (Yunxiang Li)\n- smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs() (Frank Sorenson)\n- drm/amdgpu: fix rmmio iounmap skipped on device removal (Chengjun Yao)\n- drm/amdgpu: use GFP_NOWAIT for memory allocations (Christian Konig)\n- drm/amdgpu/umsch: remove vpe test from umsch (Saleemkhan Jamadar)\n- drm/amdgpu: Failed to check various return code (Andrew Martin)\n- smb: client: fix use-after-free of iface in cifs_try_adding_channels() (Joseph Qi)\n- smb: mark the new channel addition log as informational log with cifs_info (Bharath SM)\n- wifi: mac80211: refuse to make a monitor active when it has no queue (Devin Wittmayer)\n- wifi: mac80211: track MU-MIMO configuration on disabled interfaces (Benjamin Berg)\n- wifi: libipw: reject TKIP frames without a full MIC (Daehyeon Ko)\n- drm/msm/dpu: clear pending peripheral flush state (Saim Shujah)\n- hwmon: (pwm-fan) Stop RPM timer before freeing tach data (Yibo Tan)\n- wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown (Fan Wu)\n- Input: hp_sdc - shut down kicker timer on module exit (Runyu Xiao)\n- scsi: fnic: Fix missed link-up when critical IRQ targets offline CPU (Arun Easi)\n- mptcp: do not reschedule the RTX timer for fallback sockets (Paolo Abeni)\n- tcp: introduce icsk-icsk_keepalive_timer (Eric Dumazet)\n- mptcp: pm: kernel: drop pending ADD_ADDR when removing ID0 (Kalpan Jani)\n- mptcp: pm: rename add_entry structure to add_addr (Matthieu Baerts (NGI0))\n- mptcp: pm: use for_each_subflow helper (Matthieu Baerts (NGI0))\n- mptcp: pm: reset retrans_time when ADD_ADDR entry is reused (Matthieu Baerts (NGI0))\n- bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips (Michael Chan)\n- mptcp: pm: userspace: fix address ID overflow (Qing Luo)\n- mptcp: use sock_kmemdup for address entry (Geliang Tang)\n- sock: add sock_kmemdup helper (Geliang Tang)\n- mptcp: pm: drop match in userspace_pm_append_new_local_addr (Geliang Tang)\n- bnxt_en: Propagate TPA buffer allocation failures in bnxt_queue_mem_alloc() (Joe Damato)\n- landlock: Fix use-after-free of the source's parent directory (Norbert Szetei)\n- landlock: Clarify documentation for the IOCTL access right (Gunther Noack)\n- ipv6: flowlabel: cap duplicate leases per socket (Zhiling Zou)\n- ipv6: Move ipv6_fl_list from ipv6_pinfo to inet_sock. (Kuniyuki Iwashima)\n- ipv6: reorganise struct ipv6_pinfo (Eric Dumazet)\n- ipv6: make ipv6_pinfo.saddr_cache a boolean (Eric Dumazet)\n- idpf: disable DIM work before freeing q_vectors (Myeonghun Pak)\n- idpf: introduce idpf_q_vec_rsrc struct and move vector resources to it (Pavan Kumar Linga)\n- idpf: Fix kernel-doc descriptions to avoid warnings (Andy Shevchenko)\n- erofs: add sysfs feature entry for xattr prefixes (Jingbo Xu)\n- net: macb: initialize PTP state before registering clock (Runyu Xiao)\n- net: macb: unify device pointer naming convention (Theo Lebrun)\n- net: macb: Use netif_napi_add_tx() instead of netif_napi_add() for TX NAPI (Kevin Hao)\n- net: macb: Replace open-coded implementation with napi_schedule() (Kevin Hao)\n- netfilter: cttimeout: prevent UAF during module unload (Chengfeng Ye)\n- netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount (Pablo Neira Ayuso)\n- drm/xe: Flush LSC untyped L1 dataport cache after rcs/ccs batches (Thomas Hellstrom)\n- net: bridge: use option bits for CFM/MRP frame handlers (Zhiling Zou)\n- bootconfig: Fix integer overflow in initrd size check (Masami Hiramatsu (Google))\n- io_uring/net: don't overconsume buffers when using MSG_TRUNC (Gabriel Krisman Bertazi)\n- io_uring/rw: end write accounting from -ki_complete (Jens Axboe)\n- drm/bridge: tc358768: Enforce input bus flags via atomic_check (Leonardo Costa)\n- genetlink: pin family module during policy dump (XingWang Xiang)\n- EDAC/altera: Use parent device for devres in altr_portb_setup() (Dinh Nguyen)\n- EDAC/altera: Use ECC manager compatible to select A10/S10 IRQ layout (Rounak Das)\n- tracing: Undo the registration when enabling the histogram trigger fails (Donggeun Yoo)\n- tracing: Take the reference before publishing the named histogram trigger (Donggeun Yoo)\n- tracing: Take trace_array reference when opening a tracer options file (Steven Rostedt)\n- tools/bootconfig: Fix integer overflow and truncation in size checks (Masami Hiramatsu (Google))\n- tools/bootconfig: Cleanup bootconfig footer size calculations (Masami Hiramatsu (Google))\n- virtio_mmio: disable IRQ wake before free_irq (Xiong Weimin)\n- virtio-mmio: Remove virtqueue list from mmio device (Viresh Kumar)\n- tracing: Set the trace clock before registering the histogram trigger (Donggeun Yoo)\n- tracing: Merge struct event_trigger_ops into struct event_command (Steven Rostedt)\n- tracing: Remove get_trigger_ops() and add count_func() from trigger ops (Steven Rostedt)\n- tracing: Constify struct event_trigger_ops (Christophe JAILLET)\n- configfs: unhash the dentry before dropping the item in rmdir (Vasileios Almpanis)\n- reboot: fix cad_pid use-after-free race (Cen Zhang (Microsoft))\n- sysctl: move the 'cad_pid' entry from pid_table[] to kern_reboot_table[] (Oleg Nesterov)\n- ipmr: account multicast table and route memory (Zihan Xi)\n- tracing: Fix memory corruption from a 'STACKTRACE' histogram key (Donggeun Yoo)\n- configfs: pin the symlink target's dirent instead of chasing -ci_dentry (Vasileios Almpanis)\n- configfs:get_target() - release path as soon as we grab configfs_item reference (Al Viro)\n- drm/sysfb: ofdrm: Fix is_avivo() constant comparison bug (Shixiong Ou)\n- drm/sysfb: ofdrm: Fix integer overflow in fb_size calculation (Shixiong Ou)\n- drm/sysfb: simpledrm: Improve framebuffer-size validation (Thomas Zimmermann)\n- firmware: sysfb: Move bpp-depth calculation into screen_info helper (Thomas Zimmermann)\n- drm/sysfb: simpledrm: Improve stride validation (Thomas Zimmermann)\n- drm/sysfb: simpledrm: Improve panel-size validation (Thomas Zimmermann)\n- drm/amd/display: Set gpuvm min page size to 4K on dcn35/36 (Roman Li)\n- drm/nouveau/disp/r535: Add scanline position support + head state support (Lyude Paul)\n- drm/amdgpu: avoid force-completing uninitialized UVD rings (Bob Zhou)\n- drm/amdgpu: plumb timedout fence through to force completion (Alex Deucher)\n- drm/amdgpu: add a helper to calculate ring distance (Alex Deucher)\n- drm/amdgpu: Fix missing unwind in amdgpu_ib_schedule() error path (Srinivasan Shanmugam)\n- f2fs: accurately adjust free_sections during free_segment_range (Daeho Jeong)\n- f2fs: fix to clear dirty flag on folio in error path (Chao Yu)\n- f2fs: Convert clear_node_page_dirty() to clear_node_folio_dirty() (Matthew Wilcox (Oracle))\n- f2fs: embed f2fs_gc_kthread in f2fs_sb_info (Chao Yu)\n- f2fs: fix dentry folio leak in find_in_level (Guanghui Yang)\n- f2fs: limit recovery filename logging to stored length (Wenjie Qi)\n- f2fs: dirty directory inodes on mtime/ctime update (Joanne Chang)\n- f2fs: fix to avoid potential section-unaligned pinfile (Chao Yu)\n- f2fs: don't allow unaligned truncation to smaller/equal size on pinned file (wangzijie)\n- f2fs: convert F2FS_I_SB to sbi in f2fs_setattr() (wangzijie)\n- f2fs: validate MOVE_RANGE destination size (Wenjie Qi)\n- scsi: qla2xxx: Validate BSG request_len before reading vendor_cmd[] (Nilesh Javali)\n- scsi: qla2xxx: Serialize NVMe unsol ctx list with a per-fcport lock (Nilesh Javali)\n- scsi: qla2xxx: Unlink NVMe unsol ctx before freeing on LS reject error (Nilesh Javali)\n- scsi: qla2xxx: Clamp max_npiv_vports to VP_CTRL bitmap capacity (Nilesh Javali)\n- scsi: qla2xxx: Fix soft lockup polling continuation IOCB signature (Nilesh Javali)\n- scsi: qla2xxx: Skip vport under deletion in report ID acquisition (Nilesh Javali)\n- scsi: qla2xxx: Fix 64G link speed reporting in get_data_rate (Nilesh Javali)\n- scsi: qla2xxx: Use memset_io() to clear QLAFX00 request ring slot (Nilesh Javali)\n- scsi: qla2xxx: Use ring-slot helpers in __qla2x00_alloc_iocbs (Nilesh Javali)\n- media: chips-media: wave5: Add timeout while stop_streaming (Jackson Lee)\n- scsi: qla2xxx: Bound VP index against VP_CTRL IOCB bitmap size (Nilesh Javali)\n- scsi: qla2xxx: Null out freed pointers in qla2x00_mem_alloc() error path (Nilesh Javali)\n- scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown (Nilesh Javali)\n- scsi: qla2xxx: Fix queue teardown NULL dma_free and bitmap locking (Nilesh Javali)\n- scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak (Nilesh Javali)\n- KVM: x86: Disallow EFER.LME and EFER.LMA if long mode is not supported (Yosry Ahmed)\n- KVM: s390: Zero initialize data structures for inject_pfault_token (Christian Borntraeger)\n- media: rkvdec: Propagate platform_get_irq() errors (Narasimharao Vadlamudi)\n- media: imx355: Avoid calling imx355_power_off twice in error path (Dave Stevenson)\n- media: i2c: imx355: Replace client-dev usage (Laurent Pinchart)\n- KVM: x86: Check EFER validity on KVM_SET_SREGS* (Yosry Ahmed)\n- KVM: x86: Move the bulk of register specific code from x86.c to regs.c (Sean Christopherson)\n- KVM: x86: Rename __{g,s}et_sregs2() = kvm_vcpu_ioctl_x86_{g,s}et_sregs2() (Sean Christopherson)\n- KVM: x86: Extract REGS and SREGS runtime sync code to helpers (Sean Christopherson)\n- KVM: x86/mmu: Split kvm_mmu_zap_all_fast() into 'front' and 'back' halves (Sean Christopherson)\n- KVM: x86/mmu: Dynamically allocate shadow MMU's hashed page list (Sean Christopherson)\n- mm/mremap: reset unfaulted VMA page offset for MREMAP_DONTUNMAP (Lorenzo Stoakes (ARM))\n- ASoC: tegra: Fix the MIXER enable default value (Jon Hunter)\n- ASoC: tegra210_mixer: sort the register default table (Peter Ujfalusi)\n- clk: qcom: Fix test_ctl_hi field for DEFAULT_EVO PLLs (Imran Shaik)\n- mtd: rawnand: pl353: Make sure we use the monolithic helpers for raw accesses (Miquel Raynal (DAVE))\n- mtd: rawnand: pl353: Add message about ECC mode (Andrea Scian)\n- nvdimm: virtio_pmem: refcount requests for token lifetime (Li Chen)\n- nvdimm: virtio_pmem: use READ_ONCE()/WRITE_ONCE() for wait flags (Li Chen)\n- nvdimm: virtio_pmem: always wake -ENOSPC waiters (Li Chen)\n- nvdimm: virtio_pmem: stop allocating child flush bio (Li Chen)\n- nvdimm: pmem: keep PREFLUSH before data writes (Li Chen)\n- nvdimm: preserve flush callback -ENOMEM (Li Chen)\n- mm: fix incorrect vm_flags usage when checking allowable orders for tmpfs (Baolin Wang)\n- s390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects (Anthony Krowiak)\n- nvme: skip the zoned limits update if the zone info query failed (Chao Shi)\n- nvme: add missing SRCU grace period in error path (Tristan Madani)\n- ring-buffer: Allow splice reads on static buffers (Vincent Donnefort)\n- ring-buffer: Show persistent buffer dropped events in trace_pipe file (Steven Rostedt)\n- perf/x86/intel: Remove anythread_deprecated bit from perf_capabilities (Dapeng Mi)\n- perf/aux: Allocate non-contiguous AUX pages by default (Yabin Cui)\n- rtc: rzn1: Handle unset alarm weekday in rzn1_rtc_read_alarm (Lad Prabhakar)\n- futex: Provide rt_mutex_.*_schedule() equivalents for futex scheduling (Sebastian Andrzej Siewior)\n- compiler_types: Move lock checking attributes to compiler-context-analysis.h (Marco Elver)\n- dma-buf: dma-heap: don't publish fd before copy_to_user() succeeds (Baineng Shou)\n- ftrace: Take trace_array reference before accessing its ftrace_ops (Steven Rostedt)\n- tracing: Take trace_array reference when opening options file (Steven Rostedt)\n- tracing: Clean up use of trace_create_maxlat_file() (Steven Rostedt)\n- tracing/probes: Fix BTF kflag check for anonymous struct member access (Masami Hiramatsu (Google))\n- Documentation: tracing: Add documentation about eprobes (Steven Rostedt)\n- tracing/probes: Fix anon_stack check for unnamed bitfields in btf_find_struct_member (Masami Hiramatsu (Google))\n- staging: sm750fb: fix mono image source stride mismatch in lynxfb_ops_imageblit() (Muhammad Bilal)\n- staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie() (Muhammad Bilal)\n- staging: rtl8723bs: fix spacing around operators (Vivek BalachandharTN)\n- usb: gadget: f_mass_storage: fix null pointer dereference in fsg_common_set_num_buffers() (Jeffin Philip)\n- usb: storage: realtek_cr: fix use-after-free on disconnect (Myeonghun Pak)\n- usb: cdnsp: fix wakeup from S3 after controller context loss (Pawel Laszczak)\n- usb: cdns3: rename hibernated argument of role-resume() to lost_power (Theo Lebrun)\n- xhci: Cleanup Candence controller PCI device and vendor ID usage (Mathias Nyman)\n- wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy (Bryam Vargas)\n- usb: typec: tcpm: constrain TCPM_SOURCING_VBUS event handling (Amit Sunil Dhamne)\n- usb: typec: tcpm: fix debug accessory mode detection for sink ports (Xu Yang)\n- wifi: rtw89: pci: add .shutdown callback to stop rfkill polling on reboot (Yuhang.chen)\n- wifi: rtw89: Hide some errors when the device is unplugged (Bitterblue Smith)\n- wifi: rtw89: cleanup unused rtwdev::roc_work (Zong-Zhe Yang)\n- usb: dwc3: clear forceRM when issuing EndTransfer (Elson Serrao)\n- usb: dwc3: gadget: Reinitiate stream for all host NoStream behavior (Thinh Nguyen)\n- udf: Fix data loss when converting inline inodes to out of line (Jan Kara)\n- udf: Move udf_map_block() up (Jan Kara)\n- i3c: master: Fix use-after-free of master-this (Adrian Hunter)\n- wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy (Bryam Vargas)\n- wifi: mt76: mt7915: set correct background radar capability (StanleyYP Wang)\n- i3c: master: Do not treat master device as a duplicate target (Adrian Hunter)\n- hwrng: stm32 - Fix runtime PM cleanup on registration failure (Can Peng)\n- hwrng: drivers - Switch back to struct platform_driver::remove() (Uwe Kleine-Konig)\n- ALSA: hda/ext: preserve PPLCCTL bits when clearing reset (Xu Rao)\n- net/mlx5e: do not HW-GRO coalesce small frames (Glenn Judd)\n- net/mlx5e: SHAMPO, Always calculate page size (Dragos Tatulea)\n- net/smc: stop killed, freed and out_of_sync sharing a byte (Hidayath Khan)\n- net/smc: Address spelling errors (Simon Horman)\n- power: supply: qcom_battmgr: fix use-after-free (Fan Wu)\n- io_uring/waitid: avoid siginfo copy during ring teardown (Hui Su)\n- io_uring/waitid: have io_waitid_complete() remove wait queue entry (Jens Axboe)\n- platform/x86/amd/pmc: Propagate SMU errors and validate S2D address (Mario Limonciello)\n- platform/x86/amd/pmc: Restore msg_port on amd_stb_s2d_init() error paths (Mario Limonciello)\n- platform/x86/amd/pmc: Define enum for S2D/PMC msg_port and add helper function (Shyam Sundar S K)\n- platform/x86/amd/pmc: Move STB functionality to a new file for better code organization (Shyam Sundar S K)\n- platform/x86/amd/pmc: Move STB block into amd_pmc_s2d_init() (Shyam Sundar S K)\n- platform/x86: int1092: Fix potential memory leak in sar_probe() (Abdun Nihaal)\n- platform/x86: intel_sar: Check ACPI_HANDLE() against NULL (Rafael J. Wysocki)\n- platform/x86: think-lmi: Fix certificate thumbprint sysfs output (Thorsten Blum)\n- platform/x86: think-lmi: improve check if BIOS account security enabled (Mark Pearson)\n- platform/x86: think-lmi: Fix current password length check (Thorsten Blum)\n- PCI: Introduce PCI_SLOT_PLACEHOLDER constant for slot_nr placeholder value (Farhan Ali)\n- mmc: via-sdmmc: cancel card-detect work on remove (Fan Wu)\n- platform/x86: ISST: Validate max level for set feature (Srinivas Pandruvada)\n- platform/x86: ISST: Check for admin capability for write commands (Srinivas Pandruvada)\n- iommufd: Fix UAF in selftest IOPF reporting (Peiyang He)\n- iommu/msm: Unwind probe state on registration failure (Weimin Xiong)\n- iommu/msm: Use helper function devm_clk_get_prepared() (Zhang Heng)\n- PCI: starfive: Fix resource leaks on error paths in host_init() (Ali Tariq)\n- PCI: starfive: Use regulator APIs to control the 3v3 power supply of PCIe slots (Hal Feng)\n- power: supply: ab8500_fg: fix use-after-free on remove (Fan Wu)\n- power: supply: ab8500_fg: Remove redundant dev_err()/dev_err_probe() (Pan Chuang)\n- remoteproc: qcom: pas: Guard dtb metadata release with dtb_pas_id check (Mukesh Ojha)\n- remoteproc: pas: Replace metadata context with PAS context structure (Mukesh Ojha)\n- firmware: qcom_scm: Rename peripheral as pas_id (Mukesh Ojha)\n- lockd: fix swapped arguments in nlmsvc_match_ip() (Oscar Ou)\n- i2c: mxs: fix DMA channel leak on probe error (Ruoyu Wang)\n- dmaengine: Add devm_dma_request_chan() (Bence Csokas)\n- ring-buffer: Make cpu_buffer::free_page a buffer_data_read_page (Vincent Donnefort)\n- ASoC: codecs: aw88261: only check PLL and clock state at power-up (Jorijn van der Graaf)\n- ASoC: codecs: aw88261: reduce log spam (Val Packett)\n- sched/core: Make core-sched flips wait for in-flight selections (Tejun Heo)\n- sched: Rework prev_balance() to avoid stale prev references (John Stultz)\n- ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page() (Vincent Donnefort)\n- ring-buffer: Add helper functions for allocations (Steven Rostedt)\n- perf test: Change all remaining #!/bin/sh to #!/bin/bash (James Clark)\n- net: tls: fix silent data drop under pipe back-pressure (Jakub Kicinski)\n- xfs: fix blockgc group quota scanning when usrquota isn't enforced (Darrick J. Wong)\n- xfs: check di_forkoff correctly in scrub (Darrick J. Wong)\n- xfs: don't call xfs_exchange_range_finish for a dry run (Darrick J. Wong)\n- xfs: check padding field in xfs_ioc_commit_range (Darrick J. Wong)\n- xfs: use correct jiffies comparison function in xchk_maybe_relax (Darrick J. Wong)\n- xfs: release orphanage dir inode if chown fails (Darrick J. Wong)\n- xfs: fix attr fork block count checks in xrep_inode_blockcounts (Darrick J. Wong)\n- xfs: don't assert when XFS_SCRUB_TYPE_HEALTHY scans return corruption (Darrick J. Wong)\n- smb: client: validate POSIX create context length (Zihan Xi)\n- smb: client: clean up failed cached directory opens (Zihan Xi)\n- smb: client: fix create context out-of-bounds reads (Zihan Xi)\n- Bluetooth: RFCOMM: fix NULL dereference of dlc-session in RFCOMM_CONNINFO (Hui Peng)\n- Bluetooth: mgmt: fix race in read_unconf_index_list() (Aldo Ariel Panzardo)\n- Bluetooth: L2CAP: validate frame length before control and FCS access (Aldo Ariel Panzardo)\n- Bluetooth: ISO: balance the parent hold in hci_bind_bis() (Aldo Ariel Panzardo)\n- Bluetooth: hci_sock: reject out-of-range OCF values (Aldo Ariel Panzardo)\n- Bluetooth: hci_sock: validate event length before filtering (Aldo Ariel Panzardo)\n- Bluetooth: hci_conn: fix CIS hold ownership on reuse (Aldo Ariel Panzardo)\n- RISC-V: KVM: Fix HSM hart status error propagation (Tan Chi)\n- RISC-V: KVM: Synchronize hrtimer callback during teardown (Myeonghun Pak)\n- KVM: arm64: Fix spurious warning for benign stage 2 teardown race (Lorenzo Stoakes (ARM))\n- KVM: Don't treat reserved xarray entries as having memory attributes (Zeng Chi)\n- KVM: Ensure memory attributes xarray nodes are accounted to the caller's memcg (David Ballesteros)\n- s390/vfio-ap: fix KVM GISC and page leak when queue removed from host config (Anthony Krowiak)\n- s390/cmf: Fix virtual vs physical address confusion (Peter Oberparleiter)\n- s390/cio: Fix NULL pointer dereference in ccw_device_get_util_str() (Vineeth Vijayan)\n- pinctrl: sunxi: keep a shadow copy of the data register output latches (Ilya Titov)\n- pinctrl: single: free the IRQ on domain creation failure (Myeonghun Pak)\n- perf/core: Run sched_task() for PMUs with only CPU-wide events (Puranjay Mohan)\n- perf/core: Fix NULL pmu_ctx passed to pmu-sched_task() (Puranjay Mohan)\n- scsi: libiscsi_tcp: Check the data direction of a Data-In PDU (Yehyeong Lee)\n- nfc: port100: reject frames whose declared length exceeds the received data (Doruk Tan Ozturk)\n- nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc() (Aamir Ahmed)\n- nfc: fix use-after-free in nfc_get_local_general_bytes (Luxiao Xu)\n- netfilter: nf_tables: skip expired catchall elements on insert and delete (Aohan Mei)\n- netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read (Luxiao Xu)\n- netfilter: ip6t_rpfilter: reject routes without inet6_dev (Weiming Shi)\n- net: usb: lan78xx: Fix URB reference leak in lan78xx_submit_deferred_urbs() (Wentao Liang)\n- net: usb: cdc_mbim: add MeiG Smart SRM821 to ZLP whitelist (Ming Wang)\n- net: bridge: mdb: restart port group walk after deletion (Fourie Zhang)\n- net: atl1e: fix soft lockup on out-of-range hw_next_to_clean read (Gajdos Tamas)\n- net: atl1c: fix soft lockup on out-of-range tpd_cons read (Gajdos Tamas)\n- net: openvswitch: conntrack: fix helper UAF due to extensions realloc (Ilya Maximets)\n- net: openvswitch: conntrack: remove 'add_helper' dead code (Ilya Maximets)\n- net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry (Ilya Maximets)\n- net: hisilicon: hns_dsaf_mac: fix mdio device leak in hns_mac_register_phy() (Wentao Liang)\n- net: atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read (Gajdos Tamas)\n- net: arp: terminate device name before lookup (Zijie Huang)\n- net/sched: reject IDR error pointers when deleting actions (Weiming Shi)\n- net/mlx5e: advertise MACsec offload only when supported (Ralf Lici)\n- net/mlx5: Fix rev_entry reference leak in mlx5_tc_ct_shared_counter_get() (Wentao Liang)\n- HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce() (Wei Jie LAW)\n- HID: quirks: add ALWAYS_POLL quirk for SDINNOVATION gaming keyboard (Junjie Cao)\n- HID: alps: fix use-after-free on input2 registration failure (Chen Changcheng)\n- PCI: of_property: Omit bus properties without a subordinate bus (Angel J)\n- mm/hugetlb: preserve mremap address delta when skipping page tables (Jaewook You)\n- gpio: tps65219: Fix GPIO input value reads (Karl Mehltretter)\n- drm/virtio: fix NULL pointer dereference on fence allocation failure (Peiyang He)\n- drm/virtio: fix memory leak of fence event on execbuffer failure (Peiyang He)\n- drm/xe: Limit sg segment size to PAGE_SIZE on Xen PV (Szymon Acedanski)\n- drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked() (Peiyang He)\n- drm/nouveau: RCU-free the scheduler-containing nouveau_sched (Jonghyuk Kim(MalHyuk))\n- drm/nouveau: Fix runtime PM leak in nouveau_connector_detect() (Wentao Liang)\n- drm/nouveau: Fix gem reference leak in validate_init() (Wentao Liang)\n- drm/nouveau: fix double-free in nvif_vmm_dtor (Peiyang He)\n- drm/nouveau: Fix bridge reference leak in nv1a_ram_new() (Wentao Liang)\n- drm/nouveau: fix autosuspend cleanup during teardown (Guangshuo Li)\n- drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM (Peiyang He)\n- drm/amdgpu: Fix vmid_wait fence leak in amdgpu_ring_init() (Wentao Liang)\n- drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show() (Wentao Liang)\n- drm/amdgpu: Fix last_update fence leak in amdgpu_vm_init() (Wentao Liang)\n- drm/amd/display: Bump frame warning limit for clang builds of dml (Ivan Lipski)\n- drm/amd/display: Fix dc stream excess put in dm_update_crtc_state() (Wentao Liang)\n- drm/i915: fix incorrect RCU teardown order (Christian Konig)\n- drm/imagination: Fix page count for page table for map() interface (Brajesh Gupta)\n- drm/imagination: Propagate map failures correctly from pvr_mmu_map_sgl() (Brajesh Gupta)\n- mctp: route: iterate socket tag list in mctp_lookup_prealloc_tag() (Hui Peng)\n- llc: reserve device headroom for allocated frames (Zixuan Chai)\n- gpio: zynq: fix runtime PM leak on request error path (Ridham Khurana)\n- gpio: arizona: Fix runtime PM leak in arizona_gpio_direction_out() (Wentao Liang)\n- ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST (Hui Peng)\n- ipv6: do not let ipv6_find_hdr() return an offset past the packet end (Norbert Szetei)\n- ipe: protect the dm-verity root hash with RCU (Fan Wu)\n- fsl/fman: Fix clk reference leak in read_dts_node() (Wentao Liang)\n- writeback: report a Tasks-RCU quiescent state per cgwb drain pass (Josef Bacik)\n- workqueue: Fix NULL current_pwq deref in flush dependency check (Pavankumar Kondeti)\n- writeback: bound cleanup_offline_cgwb() rescans by rotating scanned inodes (Patrick Lu (Anthropic))\n- fs/ntfs3: use d_instantiate_new() in ntfs_create_inode() and murder syzbot's 'WARNING in do_new_mount' saga (Christian Brauner)\n- fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT (Hui Peng)\n- cgroup/pids: Restore pids.events notifications in local mode (Guopeng Zhang)\n- ata: libata-scsi: bound the ATA passthru sense descriptor writes (Matthias Goergens)\n- af_packet: fix integer overflow in prb_calc_retire_blk_tmo() (Dairui Zhang)\n- sctp: discard the rest of the packet on a stale-cookie error (Aohan Mei)\n- tcp: prevent collapsing skbs across boundary in rtx queue (Willem de Bruijn)\n- tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow (Eric Dumazet)\n- virtio_net: copy zerocopy frags in start_xmit without NAPI (Willem de Bruijn)\n- x86/PCI: Disable enhanced atomics on AMD NBIO 7.7 and 7.11 (Mario Limonciello)\n- x86/mce: Fix hardware debug register corruption on task migration (Masami Hiramatsu (Google))\n- netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Pablo Neira Ayuso)\n- rculist: add list_splice_rcu() for private lists (Pablo Neira Ayuso)\n- mptcp: return sk_wait_data() errors from recvmsg() (Mark Amirkan)\n- perf/x86/intel: Make @data a mandatory param for intel_guest_get_msrs() (Sean Christopherson)\n- perf/x86/intel: Don't pointlessly context switch DS_AREA (and PEBS config) if PEBS is unused (Sean Christopherson)\n- perf/x86/intel: Don't write PEBS_ENABLED on host=guest xfers if CPU has PEBS isolation, to fix stuck PEBS_ENABLED (Sean Christopherson)\n- perf/x86/intel: Ensure KVM guest PEBS path doesn't set unwanted PERF_GLOBAL_CTRL bits (Sean Christopherson)\n- autofs: fix sbi-pipe file reference leak in autofs_kill_sb() (Hui Peng)\n- vlan: ensure sufficient headroom in vlan_dev_hard_header() (Eric Dumazet)\n- net/sched: sch_teql: fix shadowed err in __teql_resolve() (Eric Dumazet)\n- bridge: check llc_mac_hdr_init() return value in br_send_bpdu() (Eric Dumazet)\n- llc: fix skb UAF and leaks on llc_mac_hdr_init() failure (Eric Dumazet)\n- net: ethernet: stmmac: dwmac-rk: fix bulk clock leak when the PHY clock fails (Coia Prant)\n- tipc: Fix a data race on mon-peer_cnt in mon_timeout() (Ginger Li)\n- net/smc: fix UAF on lgr list traversal in smcr_port_err() (Sidraya Jayagond)\n- nfp: hold IPsec RX state under the XArray lock (Sang-Hoon Choi)\n- tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack() (Yilin Zhang)\n- net: dsa: mt7530: fix NULL dereference on unbind of MT7531 and MT7621 (Aleksei Sviridkin)\n- bonding: crypto offload enabled, non-offload slave failover, rekey failed (David Dai)\n- drm/imagination: clamp freelist reconstruction requests (Pengpeng Hou)\n- net: xps: reject an out of range traffic class (Norbert Szetei)\n- vxlan: use one headroom snapshot for neighbour replies (Sanghyun Park)\n- ip_gre: Reject enabling collect metadata through changelink (Xuanqiang Luo)\n- net: bcmgenet: mask DMA_TIMEOUT_MASK when reading DMA_RING0_TIMEOUT (Florian Fainelli)\n- net: bcmgenet: validate Ethernet address in bcmgenet_set_mac_addr (Florian Fainelli)\n- net: bcmgenet: do not skip WoL power up on GENET V1 (Florian Fainelli)\n- net: bcmgenet: allow return of power up status (Doug Berger)\n- net: bcmgenet: move bcmgenet_power_up into resume_noirq (Doug Berger)\n- net: bcmgenet: initialize u64 stats seq counter for all queues (Florian Fainelli)\n- net: bcmgenet: fix 64-bit RTNL stats reading in ethtool on 32-bit systems (Florian Fainelli)\n- tg3: use random MAC address when tg3_get_device_address fails (Ivan Delalande)\n- driver core: Add device probe log helper dev_warn_probe() (Dragan Simic)\n- bpf: Fix BSWAP 32 and 16 on MIPS64 (Johan Almbladh)\n- bpf: Fix immediate JMP JEQ/JNE on MIPS32 (Johan Almbladh)\n- vrf: Stop corrupting skb-csum when capturing CHECKSUM_COMPLETE packets (Ido Schimmel)\n- net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6() (Shihuang Liu)\n- veth: manage XDP program pointers during channel resize (Jakub Kicinski)\n- net/sched: act_gate: budget the per-entry list in get_fill_size (Victor Nogueira)\n- nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid() (Deepanshu Kartikey)\n- nfc: llcp: fix slab-out-of-bounds reads when logging service names (Omer Mete Kaya)\n- nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap() (Omer Mete Kaya)\n- nfc: llcp: fix -ENOMEM on connect with zero-length service name (Omer Mete Kaya)\n- nfc: st21nfca: validate ISO15693 inventory length (Pengpeng Hou)\n- nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure (Cong Nguyen)\n- nfc: virtual_ncidev: Add missing ioctl compat handler (Chris Gellermann)\n- selftests/nci: Fix out-of-bounds store on thread join (Chris Gellermann)\n- selftests: nci: Fix uninitialized family ID on missing attribute (Chaithanya Lagisetty)\n- nfc: llcp: Fix race condition in accept_queue lifecycle (Lee Jones)\n- selftests: nci: Correct pthread_create return value check (Lei Zhu)\n- nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm() (Aldo Ariel Panzardo)\n- nfc: st21nfca: validate received frame size (Pengpeng Hou)\n- nfc: nfcmrvl: validate helper command length before pull (Pengpeng Hou)\n- bpf: Reject dev-bound-only programs on other devices (Weiming Shi)\n- net: stmmac: dwmac4: Use the correct bufzise when the len is exactly 8K (Maxime Chevallier)\n- net: stmmac: selftests: Capture all packets for vlan checks (Maxime Chevallier)\n- net: stmmac: selftests: Check the dev-features for S-TAG offload testing (Maxime Chevallier)\n- net: stmmac: selftests: Support running selftests on DSA conduits (Maxime Chevallier)\n- sctp: hold asoc or transport before mod_timer() in timer handlers (Xin Long)\n- net/mlx5: Bridge, don't fail unlink of untracked/unsupported peer ports (Bernardo Soares)\n- net/mlx5: Bridge, don't fail switchdev events of sibling eswitch ports (Bernardo Soares)\n- bpf, sockmap: Reject max_entries INT_MAX in sock_map_alloc (Zhao Gongyi)\n- bpf: Fix bpf_sock context code generation (Emil Tsalapatis)\n- bpf: Fix bounds check for skb-backed dynptrs (Emil Tsalapatis)\n- thermal: gov_step_wise: Fix stale mitigation vote with non-zero lower bounds (Manaf Meethalavalappu Pallikunhi)\n- net: pcs: xpcs: fix clock reference leak on xpcs_init_clks failure (Coia Prant)\n- genetlink: report the real command id for dump-only ops in policy dumps (Jakub Kicinski)\n- net: ethernet: ti: netcp: fix pm_runtime usage counter leak on error (bui duc phuc)\n- s390/debug: Fix NULL pointer dereference in debug_info_copy() (Mikhail Zaslonko)\n- s390/debug: Do not register views for failed static debug areas (Mikhail Zaslonko)\n- drm/i915/psr: Clear stale sel fetch enable bits on sel fetch disable (Nemesa Garg)\n- drm/i915/psr: Add new SU area calculation helper to apply workarounds (Jouni Hogander)\n- tg3: clean up PHYLIB resources on probe failure (Myeonghun Pak)\n- ipv6: Fix dst leak for uncached routes. (Kuniyuki Iwashima)\n- net: usb: sr9700: include receive overhead in the length check (Pengpeng Hou)\n- dpll: use exact lookup for reference sync pin id (Ivan Vecera)\n- octeontx2-af: Fix memory scaling limitation in SR-IOV mode (Ratheesh Kannoth)\n- Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame() (Hui Peng)\n- Bluetooth: btintel_pcie: validate device-supplied DMA indices (Ravindra)\n- Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough (Hui Peng)\n- drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach (Li Youhong)\n- drm/virtio: release the GEM object on virtio_gpu_vram_create() errors (Junrui Luo)\n- drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl() (Junrui Luo)\n- drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl() (Junrui Luo)\n- drm/virtio: fix object leak when drm_gem_handle_create() fails (Junrui Luo)\n- net/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget (Jamal Hadi Salim)\n- bpf: Check params size before reading reserved fields (Yuqi Xu)\n- net: usb: catc: bound the RX packet length in catc_rx_done() (Aamir Ahmed)\n- bpf: Bound ownership depth through local kptrs and graph roots (Kumar Kartikeya Dwivedi)\n- sctp: avoid livelock while updating retransmit path (Yiqi Sun)\n- eth: fbnic: Set AW_FLUSH_MODE alongside AW_FLUSH when flushing the mailbox (Alexander Duyck)\n- eth: fbnic: Handle maximum standalone channels (Bjorn Topel)\n- ip6_gre: Call ip6erspan_tunnel_unlink_md() in ip6erspan_changelink(). (Kuniyuki Iwashima)\n- net: ethernet: mtk_eth_soc: unregister net_devices in case of probe failure (Lorenzo Bianconi)\n- net: gue: reject invalid REMCSUM offsets (Jeremy Jean)\n- net/sched: act_ct: don't WARN on benign flow_offload_alloc() failure (Nguyen Ngoc Thang)\n- drm/nouveau/disp: don't reject HDMI config on cards without SCDC (Giuseppe Ranieri)\n- drm/nouveau/clk: don't clobber reclock status when restoring volt/fan (Francesco Magazzu)\n- drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update (Dan Carpenter)\n- ocfs2: make ocfs2_calc_xattr_init() return void (Joseph Qi)\n- netfilter: ctnetlink: fix suspicious RCU usage in expect_iter_name (Naman Gulati)\n- ipvs: revalidate ihl before icmp_send (Julian Anastasov)\n- netfilter: nft_synproxy: use the family-aware checksum helper (Karl Mehltretter)\n- netfilter: nfnetlink_queue: hold nfnl mutex in event notifier (Florian Westphal)\n- netfilter: flowtable: publish HW_DEAD after worker is done (Jeremy Jean)\n- libbpf: Reject truncated ldimm64 CO-RE relocations (Kumar Kartikeya Dwivedi)\n- bpf: Restrict CO-RE poisoning to relocatable instructions (Kumar Kartikeya Dwivedi)\n- net/mlx5: devcom, Base component size on linked devices (Shay Drory)\n- net/sched: cls_u32: fix manual hash table handle IDR aliasing (Jamal Hadi Salim)\n- bpf: Skip unsettled links in link iterator (Weiming Shi)\n- xsk: Use a 32-bit compare in xsk_map_gen_lookup (Zhiling Zou)\n- s390/cio: Guard PMCW field accesses with dnv check (Vineeth Vijayan)\n- s390/cio: Check pmcw.dnv before pmcw.ena in I/O entry points (Vineeth Vijayan)\n- s390/cio: Fix cio_update_schib() to not cache invalid schib (Vineeth Vijayan)\n- s390/pci/docs: Fix sriov_numvfs attribute name (Karl Mehltretter)\n- docs: s390/pci: Improve and update PCI documentation (Niklas Schnelle)\n- scsi: megaraid_sas: Protect megasas_get_ctrl_info() in megasas_resume() (Bart Van Assche)\n- selftests: cgroup: give the O_TMPFILE open in get_temp_fd() a mode (Eva Kurchatova)\n- cgroup: selftests: Move memcontrol specific helpers out of common cgroup_util.c (Sean Christopherson)\n- Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel (Lee Jones)\n- Bluetooth: SMP: reject Security Request over BR/EDR (Christiano Amora)\n- scsi: sd_zbc: Reject disks with too many zones (ZHOU Jiaxiang)\n- squashfs: Add dictionary size range check to prevent shift-out-of-bounds (Ran Hongyun)\n- KVM: arm64: Fix FGT mapping for HFGITR_EL2.nGCSEPP (Mark Brown)\n- KVM: arm64: Return -EINVAL for an empty SMCCC filter range at base 0 (Karl Mehltretter)\n- KVM: arm64: vgic-its: Skip unreachable devices instead of failing the save (Fuad Tabba)\n- KVM: arm64: vgic-its: Add stronger type-checking to the ITS entry sizes (Marc Zyngier)\n- KVM: arm64: vgic-its: Free the caches when GITS_BASER changes (Fuad Tabba)\n- RISC-V: KVM: Fix perf-backed counter accounting across stop and read (SeungJu Cheon)\n- RISC-V: KVM: Report snapshot write failure to the guest (SeungJu Cheon)\n- RISC-V: KVM: Preserve firmware counter value across stop/start (SeungJu Cheon)\n- HID: bpf: fix __hid_bpf_hw_check_params report length (Benjamin Tissoires)\n- HID: amd_sfh: Validate PCI BAR size before mapping (Slawomir Stepien)\n- pinctrl: meson: Fix typo in s4 group name (Sean Anderson)\n- bpf, arm64: set up the frame pointer for the exception callback (Donggeun Yoo)\n- bpf, sockmap: Fix self-redirect copied_seq double-counting (Geliang Tang)\n- bpf: Factor out htab_elem_value helper() (Hou Tao)\n- bpf: Bail out early in __htab_map_lookup_and_delete_elem() (Hou Tao)\n- bpf: Remove migrate_{disable|enable} in -map_for_each_callback (Hou Tao)\n- bpf: Fix out-of-bounds read of rtt_min in sock_ops (Jiayuan Chen)\n- bpf: Avoid soft lockup in __htab_map_lookup_and_delete_batch() (Jose Fernandez (Anthropic))\n- KVM: x86/pmu: Move Intel PMU global MSRs to intel_is_valid_msr() (Jim Mattson)\n- HID: elecom: fix bus type for M-XGL20DLBK (Oscar Priego Verdugo)\n- tcp: Skip cond_resched() in inet_csk_listen_stop() under BPF context (Jiayuan Chen)\n- bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destroy() (Jiayuan Chen)\n- bpf: Fix divide-by-zero in btf_struct_walk() (Jiayuan Chen)\n- selftests/ftrace: Fix unique symbol check in kprobe_non_uniq_symbol.tc (Sven Schnelle)\n- bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL (Weiming Shi)\n- bpf: Fix bpf_skb_change_tail wrt csum partial skbs (Daniel Borkmann)\n- KVM: s390: Fix IRQ injection with SIGP Stop and Store Status (Claudio Imbrenda)\n- remoteproc: qcom_q6v5_adsp: Fix iommu_unmap() usage (Mostafa Saleh)\n- xfrm: save input state data before secpath resets (Zhiling Zou)\n- xfrm: Fix dev use-after-free in xfrm async resumption (Dong Chenchen)\n- xfrm: Refactor xfrm_input lock to reduce contention with RSS (Jianbo Liu)\n- netfilter: nf_tables: Simplify chain netdev notifier (Phil Sutter)\n- netfilter: nf_tables: Tolerate chains with no remaining hooks (Phil Sutter)\n- ALSA: hda/realtek: Add StarFighter HDA SSID (Sean Rhodes)\n- ALSA: hda/realtek: Limit Star Labs internal mic boost (Sean Rhodes)\n- erofs: fix large folio race in erofs_fscache_req_complete (Wenwu Hou)\n- xfs: don't stash removename operations with unknown ftype (Darrick J. Wong)\n- smb: client: fix busy dentry warning on unmount after DIO (Zizhi Wo)\n- spi: spi-zynqmp-gqspi: stop the controller on shutdown (Itai Handler)\n- ksmbd: fix partial normalized name responses (Namjae Jeon)\n- HID: asus: fortify keyboard handshake (Antheas Kapenekakis)\n- smb: client: fix missing iov bounds check in parse_posix_sids() (Frank Sorenson)\n- smb: client: fix missing lower-bound check on DFS referral string offsets (Frank Sorenson)\n- smb: client: fix server-total_read for compound encrypted PDUs (Frank Sorenson)\n- smb: client: fix potential OOB read in smb3_enum_snapshots() (Frank Sorenson)\n- smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs (Frank Sorenson)\n- smb: client: fix unaligned access in WSL reparse point parser (Paulo Alcantara)\n- smb: client: fix smbd_connection leak on cifs_get_tcp_session() error (Paulo Alcantara)\n- smb: client: reject short Next offsets in parse_server_interfaces() (Frank Sorenson)\n- smb: client: fix rlist race and missing initialization (Paulo Alcantara)\n- smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara)\n- drm/msm/hdmi_phy: fix runtime PM cleanup on probe failure (Guangshuo Li)\n- drm/msm/adreno: fix autosuspend cleanup during teardown (Guangshuo Li)\n- drm/gud: fix out-of-bounds write in gud_plane_atomic_check() (Sajal Gupta)\n- wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver (Rik van Riel)\n- wifi: mwifiex: validate action frame fixed fields (Zhao Li)\n- wifi: mwifiex: prevent authentication frame length truncation (Linmao Li)\n- wifi: mwifiex: validate scan response extents (Pengpeng Hou)\n- wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length (Doruk Tan Ozturk)\n- wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST (Shengzhuo Wei)\n- wifi: p54: validate curve data length in the calibration curve converters (Shengzhuo Wei)\n- wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext() (Tianchu Chen)\n- wifi: wilc1000: fix out-of-bounds read in P2P public action frames (Ali Ahmet Memis)\n- wifi: wlcore: release runtime PM ref on regdomain config failure (Runyu Xiao)\n- wifi: rsi: fix heap OOB write on key removal (Tianchu Chen)\n- wifi: libertas_tf: fix UAF in lbtf_free_adapter() (Jiangshan Yi)\n- wifi: iwlegacy: fix broadcast stations deallocation (Stanislaw Gruszka)\n- wifi: brcmsmac: fix UAF in brcms_free_timer() (Jiangshan Yi)\n- watchdog: starfive-wdt: Fix runtime PM leak in starfive_wdt_pm_start() (Wentao Liang)\n- watchdog: sp5100_tco: Fix pci_dev reference leak in sp5100_tco_init() (Wentao Liang)\n- watchdog: rtd119x: Avoid division by zero (Tzung-Bi Shih)\n- watchdog: msc313e: Propagate error code in resume() (Tzung-Bi Shih)\n- watchdog: msc313e: Fix premature reset during timeout update (Tzung-Bi Shih)\n- watchdog: digicolor: Avoid division by zero (Tzung-Bi Shih)\n- watchdog: da9063: fix suspend/resume handling of HW_RUNNING watchdog (Li Jun)\n- hwmon: (w83793) release probe data through kref (Guangshuo Li)\n- hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove (Guangshuo Li)\n- hwmon: (pmbus/tps53679) Select page 0 for single-page TPS53676 (Sanman Pradhan)\n- hwmon: (pmbus/tps53679) Fix TPS53676 phase page decoding (Sanman Pradhan)\n- hwmon: (pmbus/core) increase number of phases and add new mask (Nuno Sa)\n- hwmon: (hp-wmi-sensors) Fix use-after-free in fungible_show() (Muhammad Bilal)\n- Input: zero ff_effect before compat copy in input_ff_effect_from_user (Ivan Ezequiel Rodriguez)\n- Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound (Dmitry Torokhov)\n- Input: synaptics - disable InterTouch on ThinkPad T440p (board id 2722) (Raphael Larocque)\n- Input: soc_button_array - check btns_desc-package.count (Hans de Goede)\n- Input: soc_button_array - fix MS Surface Pro 11 probe failure (Hans de Goede)\n- Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block() (Dmitry Torokhov)\n- Input: i8042 - add quirk for Acer Aspire Go 15 AG15-42P (Chris Sommers)\n- Input: evdev - zero absinfo before partial copy in EVIOCSABS (Ivan Ezequiel Rodriguez)\n- Input: cyttsp5 - clamp the HID report size before memcpy (Linkai Gong)\n- Input: atkbd - skip deactivate for Xiaomi Redmi Book Pro 16 2026 (Alexei Turtanov)\n- Input: adp5588-keys - cache GPIO state before registering the gpiochip (Alvin Sipraga)\n- mmc: sdhci_am654: Fallback to DT-provided itap delay on DDR50 tuning failure (Diogo Ivo (Schneider Electric))\n- mmc: sdhci_am654: Clear ITAPDLY on tuning failure (Diogo Ivo (Schneider Electric))\n- mmc: sdhci_am654: Reset command and data lines on failed tuning (Diogo Ivo (Schneider Electric))\n- mmc: sdhci_am654: Move tuning_loop to local variable (Diogo Ivo (Schneider Electric))\n- mmc: spi: reset bytes_xfered before retrying CRC failures (Xu Rao)\n- mmc: sh_mmcif: initialize IRQ-thread mutex before requesting interrupt (Runyu Xiao)\n- mmc: sdio_uart: fix xmit_fifo leak when the port table is full (Felix Gu)\n- mmc: sdhci-of-aspeed: Remove children before releasing SDC resources (Myeonghun Pak)\n- mmc: rtsx_pci_sdmmc: ignore broken write-protect on ThinkPad X260 (Florian Maillard)\n- mmc: mxcmmc: cancel data work and watchdog on remove (Fan Wu)\n- mmc: mmci: Fix use-after-free in busy-timeout work (Fan Wu)\n- mmc: hsq: Fix use-after-free in retry work (Fan Wu)\n- mmc: core: Fix OF node reference leak on card add failure (Zhu Ling)\n- mmc: core: Cancel SDIO IRQ work before freeing host (Fan Wu)\n- power: sequencing: fix NULL-pointer dereference in pwrseq_device_register() (Bartosz Golaszewski)\n- power: sequencing: fix NULL-pointer dereference in pwrseq_unit_new() (Bartosz Golaszewski)\n- power: sequencing: don't call .post_enable() if pwrseq_unit_enable() failed (Bartosz Golaszewski)\n- selinux: always fill AVC decision in avc_has_perm_noaudit() (Christian Gottsche)\n- selinux: recheck intermediate backing files on mprotect() (Karl Mehltretter)\n- selinux: preserve user SID across nested backing files (Karl Mehltretter)\n- IB/hfi1: Fix the PIO_CRED credit-return mmap (Shuhei Takeshita)\n- IB/hfi1: Resolve the credit-return buffer through the send context's node (Shuhei Takeshita)\n- IB/mlx4: Fix use-after-free on pkey sysfs registration failure (Shuangpeng Bai)\n- i2c: imx: disable autosuspend on remove (Guangshuo Li)\n- i2c: imx: release DMA channels on probe error (Shengzhuo Wei)\n- i2c: atr: fix dangling adapter pointer on add failure (Linkai Gong)\n- i2c: at91: release DMA channels on remove and probe error (Shengzhuo Wei)\n- KEYS: trusted: Fix tpm2_load_cmd() boundary check (Jarkko Sakkinen)\n- keys: translate request_key_auth pid for the reading procfs instance (Maoyi Xie)\n- KEYS: encrypted: fix integer overflow of datablob_len (Cen Zhang)\n- mm/mlock: use the IRQ-safe accessor for NR_MLOCK in __munlock_folio() (Shakeel Butt)\n- memstick: ms_block: destroy io_queue workqueue on removal (Yifei Gao)\n- xfrm: use hlist_del_init_rcu for state_cache and state_cache_input (Siwei Zhang)\n- xfrm: serialize state GC with device state flush (Chengfeng Ye)\n- scsi: core: Validate MODE SENSE lengths in scsi_cdl_enable() (Alberto Carboneri)\n- net/packet: avoid truncating TPACKET_V3 private size (Mark Amirkan)\n- net/packet: clear RX owner on VNET header error (Mark Amirkan)\n- net/sched: hhf: cap hh_flows_limit at change time (Jamal Hadi Salim)\n- net/sched: act_api: release tail references on DELACTION failure (Xuanqiang Luo)\n- net: wwan: mhi_wwan_mbim: check skb_copy_bits() return value (Guanglei Zhu)\n- net: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain (Guanglei Zhu)\n- net: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb() (Guanglei Zhu)\n- net: lan743x: fix RX checksum use-after-free (Mark Amirkan)\n- ipv6: xfrm: use full sockets in local error paths (Zhiling Zou)\n- dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn() (Alexander Chesnokov)\n- dmaengine: sun6i: fix undefined behaviour in sun6i_dma_tx_status (Christian Lugnberg)\n- dmaengine: sun6i: fix non-atomic read of DMA position registers (Christian Lugnberg)\n- Bluetooth: hci_sync: Serialize local codec list cleanup (Chengfeng Ye)\n- Bluetooth: hci_codec: validate vendor codec count length (Laxman Acharya Padhya)\n- Bluetooth: eir: validate service data length before reading UUID (Aamir Ahmed)\n- Bluetooth: btusb: fix NXP IW610 composite device handling (Nicolas Thibert)\n- arm64: percpu: Fix this_cpu_and() mask generation (Mark Rutland)\n- arm64: percpu: Fix this_cpu_write() casting (Mark Rutland)\n- arm64: dts: renesas: r8a779f0: Set UFS lane count (Koichiro Den)\n- arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc (Bradley Morgan)\n- kselftest/arm64: Fix size of thread_data values for pthread_join() (Thomas Huth)\n- HID: logitech-hidpp: fix race condition when accessing stale stack pointer (Benoit Sevens)\n- net: xfrm: reject unrepresentable espintcp transport headers (Wyatt Feng)\n- openvswitch: avoid reallocating confirmed conntrack labels (Zhiling Zou)\n- RDMA/core: fix refcount bug in iwpm_get_nlmsg_request() (Jeffin Philip)\n- RDMA/ucma: Serialize join and leave on copy_to_user failure (Quanye Yang)\n- tcp: exclude old ACKs from tcp fast path (Inbal Schussheim)\n- x86/microcode/intel: Reject problematic loading on Granite Rapids systems (Chang S. Bae)\n- exec: Cleanup POSIX timers right after de_thread() (Hyunwoo Kim)\n- cifs: Fix server use-after-free in cifs_chan_skip_or_disable() (Wentao Liang)\n- ata: libahci_platform: Fix device reference leak in ahci_platform_get_resources() (Wentao Liang)\n- ata: libahci: clear PxCLBU and PxFBU for AHCI_HFLAG_32BIT_ONLY (Niklas Cassel)\n- ASoC: codecs: rt712-sdca-dmic: fix uninitialized stream_config-type (Jiangshan Yi)\n- ALSA: virtio: reset device before deleting virtqueues (Yuho Choi)\n- ALSA: core: Fix potential UAF after asynchronous card release (Takashi Iwai)\n- Input: xpad - fix PDP Marvel Xbox 360 controller (Jeremy Nyberg)\n- Input: xpad - add support for Azeron devices (Roberts Kursitis)\n- Input: xpad - add support for Victrix Pro BFG Controller (Erich Sartison)\n- wifi: rtw88: Fix the random 'error beacon valid' messages for USB (Bitterblue Smith)\n- wifi: rtw88: TX QOS Null data the same way as Null data (Bitterblue Smith)\n- mm/huge_memory: use folio's memcg inside __folio_split() (Zi Yan)\n- x86/fred: Reconstruct the #GP context for rejected INT instructions (Matthew Schwartz)\n- btrfs: abort transaction on failure to update inode for hole punching and reflinking (Filipe Manana)\n- drm/amdgpu: check ras and obj before dereference (Dmitriy Chumachenko)\n- net: skbuff: do not leave stale header offsets after pskb_carve() (Eric Dumazet)\n- net: mvpp2: prevent buffer overflow in page_pool allocation (Dmitriy Okunev)\n- net: macb: fix ordering around PTP timestamp read (James Clark)\n- net: stmmac: propagate FPE preemption-class mapping errors (Lorenzo Bianconi)\n- net: ethernet: cortina: Ack RX overrun interrupt correctly (Linus Walleij)\n- net: lock the socket in sock_gettstamp() (Eric Dumazet)\n- net: netsec: fix device_node reference leak on phy_np (Yige Jiang)\n- ASoC: hdmi-codec: Report a change when the channel status moves (HyeongJun An)\n- ASoC: ux500: Parenthesize MSP_{RX,TX}_CLKPOL_BIT() arguments (Sasha Levin)\n- powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba (Shivaprasad G Bhat)\n- KVM: PPC: Book3S HV: fix secure device page leak on uv_page_in() failure (Amit Machhiwal)\n- KVM: PPC: Book3S HV: fix use-after-free in kvmhv_emulate_tlbie_all_lpid() (Amit Machhiwal)\n- net: stmmac: do not overwrite phc_index when no PTP clock is registered (Lorenzo Bianconi)\n- drop_monitor: fix out-of-bounds write in reset_per_cpu_data() (Eric Dumazet)\n- drop_monitor: synchronize tracepoint unregistration on error path (Eric Dumazet)\n- pppoatm: ensure a writable skb header and linear data (Eric Dumazet)\n- Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup (Juan Perdomo)\n- Bluetooth: btintel_pcie: fix off-by-one bounds check in RX submit (Sai Teja Aluvala)\n- Bluetooth: btmtksdio: Fix PM runtime reference leak in shutdown (Tzung-Bi Shih)\n- Bluetooth: btmtk: fix wrong status for short WMT FUNC_CTRL events (Chris Lu)\n- Bluetooth: ISO: set BT_LISTEN before requesting a BIG sync (Luiz Augusto von Dentz)\n- Bluetooth: ISO: Fix parent socket leak in iso_conn_ready() (Luiz Augusto von Dentz)\n- Bluetooth: coredump: Quiesce dump work on unregister (Weiming Shi)\n- Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (ThangNN99)\n- Bluetooth: hci_core: Print number of packets in conn-data_q (Luiz Augusto von Dentz)\n- dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg() (Baineng Shou)\n- ksmbd: keep compound responses on query info errors (Namjae Jeon)\n- ksmbd: fix partial file information responses (Namjae Jeon)\n- ksmbd: return buffer overflow for partial filesystem info (Namjae Jeon)\n- tcp: do not let tcp_rmem be set below 4096 (Eric Dumazet)\n- tcp: Don't call skb_clone_and_charge_r() for close()d listener in tcp_v6_do_rcv(). (Kuniyuki Iwashima)\n- net: bridge: mst: move switchdev call outside rcu (Nikolay Aleksandrov)\n- wifi: brcmfmac: fix lost 802.1x TX completion wakeup (Karl Mehltretter)\n- net: fddi: skfp: fix NULL deref when setting the MAC address while down (Hohyun Sim)\n- ipv4: icmp: reject RTN_UNREACHABLE input routes in icmp_route_lookup (Dong Chenchen)\n- seg6: set IPSKB_L3SLAVE from IP6SKB_L3SLAVE on IPIP decapsulation (Andrea Mayer)\n- drm/msm/dsi: round the byte clock rate after reparenting to the PHY PLL (Dmitry Baryshkov)\n- btrfs: tree-checker: print dev extent offset in error message (Filipe Manana)\n- wifi: ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all() (Nicolas Escande)\n- ALSA: hda: trace PCM open only after assigning a stream (Slavin Liu)\n- drm/vc4: Use managed KMS polling to fix UAF on unbind (Karl Mehltretter)\n- wifi: virt_wifi: don't transfer operstate before register (Zihan Xi)\n- ALSA: 6fire: fix OOB write from device-reported iso length (Xiang Mei)\n- ALSA: usb: 6fire: Avoid embedded URBs (Takashi Iwai)\n- ALSA: 6fire: Clean ups with guard() (Takashi Iwai)\n- gpio: virtuser: skip free_irq when no IRQ is installed (Runyu Xiao)\n- Input: trackpoint - fix the inertia attribute name in the ABI document (Karl Mehltretter)\n- ASoC: soc-pcm: Apply snd_soc_dai_link_ch_map.codec_ch_mask to codec params (Richard Fitzgerald)\n- ASoC: Add codec_ch_mask to snd_soc_dai_link_ch_map (Richard Fitzgerald)\n- ASoC: Rename snd_soc_dai_link_ch_map.ch_mask to cpu_ch_mask (Richard Fitzgerald)\n- ALSA: pcm: set timer-private_data before registering the PCM timer (Nguyen Ngoc Thang)\n- phy: mediatek: phy-mtk-hdmi-mt8195: Fix TMDS clk bit ratio setting (AngeloGioacchino Del Regno)\n- phy: mediatek: phy-mtk-hdmi-mt8195: Fix PLL calc divisor overflow (AngeloGioacchino Del Regno)\n- ALSA: bcd2000: Fix race between rawmidi and disconnect (Takashi Iwai)\n- keys: fix lost wakeup when reaping a dead key type (Karl Mehltretter)\n- drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr (Thadeu Lima de Souza Cascardo)\n- arm64: hibernate: clone only the linear map that exists at runtime (Breno Leitao)\n- perf/arm-cmn: Fix wp_dev_sel2 setting for multi-DTM configurations (Shouping Wang)\n- netfilter: flowtable: hold reference on ct until flow is released (Pablo Neira Ayuso)\n- netfilter: nft_nat: fully initialise new_addr in netmap setup (Theodor Arsenij Larionov Trichkine)\n- RDMA/siw: Bound fragmented header copies by the remaining length (Jeremy Jean)\n- RDMA/efa: Keep EQ resources alive while IRQ is registered (Leon Romanovsky)\n- RDMA/efa: Keep admin queues alive while IRQ is registered (Leon Romanovsky)\n- dmaengine: xilinx_dma: Fix hardware buffer descriptor chain after cyclic DMA (Alex Bereza)\n- dmaengine: xilinx_dma: Fix hardware buffer descriptor reuse order (Alex Bereza)\n- scsi: qla2xxx: Fix the ql2xfc2target parameter description (Karl Mehltretter)\n- mm: memblock: show all region flags in debugfs (Meijing Zhao)\n- wifi: mac80211: set up the TX info early to fix failure paths (Johannes Berg)\n- wifi: mac80211: mesh: release the channel if start fails (Johannes Berg)\n- wifi: mac80211: mesh: reset the CSA state when leaving (Johannes Berg)\n- wifi: mac80211: add HE 6 GHz capability in the scan elems len (Johannes Berg)\n- wifi: mac80211: don't access the TSF of a down interface (Johannes Berg)\n- wifi: mac80211: don't RCU-dereference the mesh CSA settings we just set (Johannes Berg)\n- wifi: mac80211: don't allow link changes when iface is down (Johannes Berg)\n- wifi: mac80211: require a peer station for TDLS setup confirm (Johannes Berg)\n- wifi: mac80211: reset the AP_VLAN tailroom counter on ifdown (Johannes Berg)\n- wifi: mac80211: don't allow injecting frames wider than the chanctx (Johannes Berg)\n- wifi: cfg80211: expose cfg80211_chandef_get_width() (Johannes Berg)\n- wifi: cfg80211: skip regulatory for punctured subchannels (Kavita Kavita)\n- wifi: mac80211_hwsim: don't hand frames to mac80211 while stopping (Johannes Berg)\n- wifi: mac80211: unlist vifs when their netdev is unregistered (Johannes Berg)\n- wifi: mac80211: reset state when starting AP fails (Johannes Berg)\n- wifi: mac80211: abort chanswitch when leaving a mesh (Johannes Berg)\n- wifi: mac80211: suppress chanctx warning for debugfs reset (Johannes Berg)\n- wifi: mac80211: don't offload TC setup on AP_VLAN interfaces (Johannes Berg)\n- wifi: mac80211: don't warn when an IBSS has no channel to scan (Johannes Berg)\n- wifi: mac80211: use vif radio mask to limit ibss scan frequencies (Felix Fietkau)\n- wifi: cfg80211: add option for vif allowed radios (Felix Fietkau)\n- wifi: mac80211: don't start a ROC while scanning (Johannes Berg)\n- wifi: cfg80211: don't filter by BSS type when removing stale entries (Johannes Berg)\n- wifi: cfg80211: only group hidden BSSes with beacon entries (Johannes Berg)\n- dmaengine: wait for RCU readers before releasing dma_device (Shivank Garg)\n- dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel() (Shivank Garg)\n- dmaengine: Fix device kref underflow in dma_chan_put() (Shivank Garg)\n- dma-coherent: report a failed reserved memory assignment (Donggeun Yoo)\n- dma-coherent: Warn if OF reserved memory is beyond current coherent DMA mask (Chen-Yu Tsai)\n- MIPS: Octeon: apply USB FDT fixups also when USB is modular (Orgad Shaneh)\n- soundwire: cadence_master: wait and cancel cdns-work before clock stop (Bard Liao)\n- wifi: cfg80211: check IP header size in cfg80211_classify8021d() (Johannes Berg)\n- wifi: cfg80211: don't get the radio mask for netdev-less wdevs (Johannes Berg)\n- IB/IPoIB: Avoid restoring OPER_UP after multicast flush (Carolina Jubran)\n- wifi: libipw: reject too-short association responses (Shmulik Cohen)\n- wifi: libipw: reject too-short beacon and probe responses (Shmulik Cohen)\n- wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path (Peng Hao)\n- wifi: virt_wifi: free skb when disconnected (Mariano Baragiola)\n- dmaengine: sprd: Fix runtime PM reference leak in probe (Ruoyu Wang)\n- RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted (Quanye Yang)\n- RDMA/irdma: Enforce local fence for IB_WR_REG_MR (Jacob Moroni)\n- RDMA/mad: Fix receive buffer leak when PKey enforcement fails (Li RongQing)\n- IB/isert: wait for deferred control PDU completions before releasing the connection (Yehyeong Lee)\n- IB/iser: reject a remote invalidation of an unregistered direction (Yehyeong Lee)\n- RDMA/core: Reject unregistering netdevs in ib_get_eth_speed (Krystian Kaniewski)\n- RDMA/rxe: insert mcg into mcg_tree only after rxe_mcast_add() succeeds (Michael Bommarito)\n- clk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate (Xixin Liu)\n- firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS (Xixin Liu)\n- RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access (Gang Yan)\n- RDMA/rxe: validate access flags before swapping the MR's PD (Norbert Szetei)\n- RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept (Guoqing Jiang)\n- ARM: socfpga: select the PL310 erratum 753970 workaround (Pengpeng Hou)\n- esp: downgrade zerocopy managed frags before mutating skb frags (Maher Azzouzi)\n- xfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for xfrm_trans_reinject() (Eric Dumazet)\n- xfrm: fix compat ALLOCSPI request use-after-free (Kyle Zeng)\n- xfrm: avoid RCU warnings around the per-netns netlink socket (Sabrina Dubroca)\n- pidfd: hold exec_update_lock around namespace ioctl (Chen Linxuan)\n- ipv6: Honor oif when choosing nexthop for locally generated traffic (Ido Schimmel)\n- ipv6: Select best matching nexthop object in fib6_table_lookup() (Ido Schimmel)\n- media: video-i2c: fix buffer queue ordering (Arash Golgol)\n- ipv6: mcast: use copy-on-write RCU updates in ip6_mc_source() (Eric Dumazet)\n- ipv6: mcast: Don't hold RTNL for MCAST_ socket options. (Kuniyuki Iwashima)\n- ipv6: mcast: Don't hold RTNL for IPV6_DROP_MEMBERSHIP and MCAST_LEAVE_GROUP. (Kuniyuki Iwashima)\n- ipv6: mcast: Don't hold RTNL for IPV6_ADD_MEMBERSHIP and MCAST_JOIN_GROUP. (Kuniyuki Iwashima)\n- ipv6: mcast: Use in6_dev_get() in ipv6_dev_mc_dec(). (Kuniyuki Iwashima)\n- net: cpsw: Execute ndo_set_rx_mode callback in a work queue (Kevin Hao)\n- net: cpsw_new: Execute ndo_set_rx_mode callback in a work queue (Kevin Hao)\n- sunvdc: fix -EIO issue due to lack of retries (Jens Axboe)\n- selftests/landlock: Add tests for whiteout object creation (Gunther Noack)\n- s390/boot: Avoid IPL parameter append past command line (Vasily Gorbik)\n- s390/boot: Add sized_strscpy() to enable strscpy() usage (Vasily Gorbik)\n- selftests/landlock: Add disconnected leafs and branch test suites (Mickael Salaun)\n- selftests/landlock: Add tests for access through disconnected paths (Tingmao Wang)\n- selftests/landlock: Add missing connect(minimal AF_UNSPEC) test (Matthieu Buffet)\n- selftests/landlock: Add test for TCP fast open (Matthieu Buffet)\n- landlock: Fix TCP Fast Open connection bypass (Matthieu Buffet)\n- Revert 'hwmon: (emc1403) Rely on subsystem locking' (Sasha Levin)\n- Revert 'hwmon: (emc1403) Drop hysteresis for low limit temperature' (Sasha Levin)\n\n[6.12.0-208.111.2]\n- perf script: Fix hangup in offline flamegraph report (Namhyung Kim) [Orabug: 38290523]\n- perf script: force stdin for flamegraph in live mode (Anubhav Shelat) [Orabug: 38290523]\n- selftests/mm/khugepaged: include kselftest.h in khugepaged (Sherry Yang) [Orabug: 40091146]\n- net/rds: Avoid losing sendmsg reconnect requests at conn shutdown (Sharath Srinivasan) [Orabug: 40105600]\n- RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Edward Srouji) [Orabug: 40108272]\n\n[6.12.0-208.111.1]\n- scsi: target: iblock: Allow iblock devices to be shared (Mike Christie) [Orabug: 39226784]\n- scsi: target: core: Fix complete_type use (Mike Christie) [Orabug: 39226784]\n- scsi: vhost-scsi: Report direction completion support (Mike Christie) [Orabug: 39226784]\n- scsi: target: Allow userspace to set the completion type (Mike Christie) [Orabug: 39226784]\n- scsi: target: Use driver completion preference by default (Mike Christie) [Orabug: 39226784]\n- scsi: target: Add support for completing commands from backend context (Mike Christie) [Orabug: 39226784]\n- scsi: target: Move LUN stats to per-CPU (Mike Christie) [Orabug: 39226784]\n- scsi: target: Create and use macro helpers for per-CPU stats (Mike Christie) [Orabug: 39226784]\n- scsi: target: Fix LUN/device R/W and total command stats (Mike Christie) [Orabug: 39226784]\n- scsi: target: Move delayed/ordered tracking to per CPU (Mike Christie) [Orabug: 39226784]\n- scsi: target: Move I/O path stats to per CPU (Mike Christie) [Orabug: 39226784]\n- uek-rpm: emb4 trim bump in the wire config (Joseph Dobosenski) [Orabug: 39871695]\n- IB/mlx4: delete allocated id_map_entry while sending REJ (Praveen Kumar Kannoju) [Orabug: 40002251]\n- KVM: x86: Reset last_steal on vCPU pid change (Dongli Zhang) [Orabug: 40040208]", "id": "ELSA-2026-500572", "ovalId": "oval:com.oracle.elsa:def:2026500572", "source": "oracle_linux", "title": "ELSA-2026-500572: Unbreakable Enterprise kernel security update (IMPORTANT)", "url": "https://linux.oracle.com/errata/ELSA-2026-500572.html" }