elsa-2026-500574

{
  "cves": [
    "CVE-2024-41062",
    "CVE-2024-56545",
    "CVE-2025-21751",
    "CVE-2025-21759",
    "CVE-2025-38349",
    "CVE-2025-38590",
    "CVE-2025-39830",
    "CVE-2025-39832",
    "CVE-2025-39834",
    "CVE-2025-39947",
    "CVE-2025-40238",
    "CVE-2025-68190",
    "CVE-2026-23000",
    "CVE-2026-23035",
    "CVE-2026-43467",
    "CVE-2026-46242",
    "CVE-2026-52988",
    "CVE-2026-68236",
    "CVE-2026-74496",
    "CVE-2026-74743",
    "CVE-2026-89560",
    "CVE-2026-89796",
    "CVE-2026-93287",
    "CVE-2026-93288",
    "CVE-2026-93782",
    "CVE-2026-93783",
    "CVE-2026-93784",
    "CVE-2026-93785",
    "CVE-2026-93789",
    "CVE-2026-93795",
    "CVE-2026-93797",
    "CVE-2026-93798",
    "CVE-2026-93800",
    "CVE-2026-93802",
    "CVE-2026-93803",
    "CVE-2026-93805",
    "CVE-2026-93807",
    "CVE-2026-93808",
    "CVE-2026-93813",
    "CVE-2026-93820",
    "CVE-2026-93822",
    "CVE-2026-93825",
    "CVE-2026-97408",
    "CVE-2026-97416",
    "CVE-2026-97417",
    "CVE-2026-97419",
    "CVE-2026-97420",
    "CVE-2026-97421",
    "CVE-2026-97430",
    "CVE-2026-97438",
    "CVE-2026-97440",
    "CVE-2026-97441",
    "CVE-2026-97444",
    "CVE-2026-97445",
    "CVE-2026-97446",
    "CVE-2026-97448",
    "CVE-2026-97449",
    "CVE-2026-97450",
    "CVE-2026-97451",
    "CVE-2026-97452",
    "CVE-2026-97453",
    "CVE-2026-97454",
    "CVE-2026-97455",
    "CVE-2026-97456",
    "CVE-2026-97472",
    "CVE-2026-97481",
    "CVE-2026-97483",
    "CVE-2026-97484",
    "CVE-2026-97492",
    "CVE-2026-97507",
    "CVE-2026-97508",
    "CVE-2026-97510",
    "CVE-2026-97523",
    "CVE-2026-97524",
    "CVE-2026-97568",
    "CVE-2026-97572",
    "CVE-2026-97573",
    "CVE-2026-97576",
    "CVE-2026-97596",
    "CVE-2026-97598",
    "CVE-2026-97601",
    "CVE-2026-97604",
    "CVE-2026-97608",
    "CVE-2026-97611",
    "CVE-2026-97612",
    "CVE-2026-97899",
    "CVE-2026-97904",
    "CVE-2026-97905",
    "CVE-2026-97923",
    "CVE-2026-97930",
    "CVE-2026-97931",
    "CVE-2026-97940",
    "CVE-2026-97951",
    "CVE-2026-97957",
    "CVE-2026-97958",
    "CVE-2026-97959",
    "CVE-2026-97963",
    "CVE-2026-97964",
    "CVE-2026-97991",
    "CVE-2026-97993",
    "CVE-2026-97995",
    "CVE-2026-97998",
    "CVE-2026-98006",
    "CVE-2026-98009",
    "CVE-2026-98010",
    "CVE-2026-98011",
    "CVE-2026-98012",
    "CVE-2026-98014",
    "CVE-2026-98015",
    "CVE-2026-98016",
    "CVE-2026-98022",
    "CVE-2026-98023",
    "CVE-2026-98025",
    "CVE-2026-98027",
    "CVE-2026-98030",
    "CVE-2026-98031",
    "CVE-2026-98063",
    "CVE-2026-98064",
    "CVE-2026-98066",
    "CVE-2026-98074",
    "CVE-2026-98075",
    "CVE-2026-98076",
    "CVE-2026-98077",
    "CVE-2026-98078",
    "CVE-2026-98080",
    "CVE-2026-98088",
    "CVE-2026-98090",
    "CVE-2026-98091",
    "CVE-2026-98095",
    "CVE-2026-98096",
    "CVE-2026-98098",
    "CVE-2026-98108",
    "CVE-2026-98116",
    "CVE-2026-98123",
    "CVE-2026-98130",
    "CVE-2026-98154",
    "CVE-2026-98157",
    "CVE-2026-98158",
    "CVE-2026-98181",
    "CVE-2026-98185",
    "CVE-2026-98186",
    "CVE-2026-98187",
    "CVE-2026-98188",
    "CVE-2026-98191",
    "CVE-2026-98194",
    "CVE-2026-98195",
    "CVE-2026-98196",
    "CVE-2026-98197",
    "CVE-2026-98199",
    "CVE-2026-98201",
    "CVE-2026-98202",
    "CVE-2026-98203",
    "CVE-2026-98204",
    "CVE-2026-98205",
    "CVE-2026-98207",
    "CVE-2026-98208",
    "CVE-2026-98217",
    "CVE-2026-98221",
    "CVE-2026-98233",
    "CVE-2026-98234",
    "CVE-2026-98241",
    "CVE-2026-98251",
    "CVE-2026-98252",
    "CVE-2026-98253",
    "CVE-2026-98255",
    "CVE-2026-98260",
    "CVE-2026-98262",
    "CVE-2026-98272",
    "CVE-2026-98276",
    "CVE-2026-98287",
    "CVE-2026-98290",
    "CVE-2026-98299",
    "CVE-2026-98300",
    "CVE-2026-98306",
    "CVE-2026-98308",
    "CVE-2026-98314",
    "CVE-2026-98319",
    "CVE-2026-98320",
    "CVE-2026-98322",
    "CVE-2026-98339",
    "CVE-2026-98340",
    "CVE-2026-98342",
    "CVE-2026-98343",
    "CVE-2026-98344",
    "CVE-2026-98345",
    "CVE-2026-98347",
    "CVE-2026-98348",
    "CVE-2026-98349",
    "CVE-2026-98354",
    "CVE-2026-98357",
    "CVE-2026-98358",
    "CVE-2026-98362",
    "CVE-2026-98363",
    "CVE-2026-98369",
    "CVE-2026-98370",
    "CVE-2026-98374",
    "CVE-2026-98379",
    "CVE-2026-98380",
    "CVE-2026-98381",
    "CVE-2026-98383",
    "CVE-2026-98388",
    "CVE-2026-98404",
    "CVE-2026-98406",
    "CVE-2026-98407",
    "CVE-2026-98413",
    "CVE-2026-98419",
    "CVE-2026-98422",
    "CVE-2026-98426",
    "CVE-2026-98432",
    "CVE-2026-98455",
    "CVE-2026-98457",
    "CVE-2026-98460",
    "CVE-2026-98461",
    "CVE-2026-98479",
    "CVE-2026-98485",
    "CVE-2026-98488",
    "CVE-2026-98489",
    "CVE-2026-98491",
    "CVE-2026-98494",
    "CVE-2026-98495",
    "CVE-2026-98498",
    "CVE-2026-98499",
    "CVE-2026-98501",
    "CVE-2026-98511",
    "CVE-2026-98514",
    "CVE-2026-98515",
    "CVE-2026-98516",
    "CVE-2026-98531",
    "CVE-2026-98532",
    "CVE-2026-98536",
    "CVE-2026-98537",
    "CVE-2026-98541",
    "CVE-2026-98547",
    "CVE-2026-98548",
    "CVE-2026-98550",
    "CVE-2026-98553",
    "CVE-2026-98554",
    "CVE-2026-98567",
    "CVE-2026-98569",
    "CVE-2026-98573",
    "CVE-2026-98586",
    "CVE-2026-98588",
    "CVE-2026-98590",
    "CVE-2026-98594",
    "CVE-2026-98597",
    "CVE-2026-98600",
    "CVE-2026-98602",
    "CVE-2026-98606",
    "CVE-2026-98607",
    "CVE-2026-98608",
    "CVE-2026-98609",
    "CVE-2026-98610",
    "CVE-2026-98612",
    "CVE-2026-98614",
    "CVE-2026-98621",
    "CVE-2026-98622",
    "CVE-2026-98623",
    "CVE-2026-98624",
    "CVE-2026-98625",
    "CVE-2026-98626",
    "CVE-2026-98631",
    "CVE-2026-98636",
    "CVE-2026-98640",
    "CVE-2026-98643",
    "CVE-2026-98644",
    "CVE-2026-98647",
    "CVE-2026-98873",
    "CVE-2026-98876",
    "CVE-2026-98877",
    "CVE-2026-98879",
    "CVE-2026-98881",
    "CVE-2026-98884",
    "CVE-2026-98885",
    "CVE-2026-98886",
    "CVE-2026-98887",
    "CVE-2026-98888",
    "CVE-2026-98889",
    "CVE-2026-98890",
    "CVE-2026-98891",
    "CVE-2026-98896",
    "CVE-2026-98898",
    "CVE-2026-98899",
    "CVE-2026-98900",
    "CVE-2026-98902",
    "CVE-2026-98907",
    "CVE-2026-98909",
    "CVE-2026-98912",
    "CVE-2026-99082",
    "CVE-2026-99999"
  ],
  "cvss": 0.0,
  "database_specific": {
    "severity": "IMPORTANT"
  },
  "description": "[5.15.0-326.222.4]\n- rtnetlink: advertise allmulti counter (Nicolas Dichtel)  [Orabug: 40234417]\n\n[5.15.0-326.222.3]\n- vhost-scsi: fix page reference leak in misaligned I/O fallback (Jia Jia)  [Orabug: 40193939]\n- vhost-scsi: zero misaligned I/O bounce pages (Shubham Antil)  [Orabug: 40193939]\n- KVM: x86: Use active memslots for the per-vCPU MMIO cache (Jinu Kim)  [Orabug: 40180576]\n- rds: cong: fix race while clearing rs_cong_mask (Anand Khoje)  [Orabug: 39519859]\n- ipv4: validate checksum_start before completing checksum (Michael S. Tsirkin)  [Orabug: 40165811]  {CVE-2026-99999}\n- netfilter: nfnetlink_queue: unbreak SCTP traffic (Antonio Ojea)  [Orabug: 40165811]\n- ipv4: free inet_opt and ireq_opt after an RCU grace period (Eric Dumazet)  [Orabug: 40165788]  {CVE-2026-98432}\n- exec: Cleanup POSIX timers right after de_thread() (Hyunwoo Kim)  [Orabug: 40120750]  {CVE-2026-98260}\n\n[5.15.0-326.222.2]\n- perf/x86/rapl: Fix the energy-pkg event for AMD CPUs (Dhananjay Ugwekar)  [Orabug: 40067278]\n- LTS version: v5.15.222 (Vijayendra Suman)\n- drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked() (Guangshuo Li)\n- lan78xx: Enable Auto Speed and Auto Duplex configuration for LAN7801 if NO EEPROM is detected (Rengarajan S)\n- lan78xx: Enable 125 MHz CLK configuration for LAN7801 if NO EEPROM is detected (Rengarajan S)\n- tools/thermal/tmon: Fix compilation warning for wrong format (Florian Eckert)\n- perf test: Change all remaining #!/bin/sh to #!/bin/bash (James Clark)\n- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Christian Brauner)\n- eventpoll: move epi_fget() up (Christian Brauner)\n- eventpoll: rename ep_remove_safe() back to ep_remove() (Christian Brauner)\n- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Christian Brauner)\n- eventpoll: kill __ep_remove() (Christian Brauner)\n- eventpoll: split __ep_remove() (Christian Brauner)\n- eventpoll: use hlist_is_singular_node() in __ep_remove() (Christian Brauner)\n- file: add fput() cleanup helper (Christian Brauner)\n- eventpoll: don't decrement ep refcount while still holding the ep mutex (Linus Torvalds)\n- net: tls: fix silent data drop under pipe back-pressure (Jakub Kicinski)\n- xfs: fix blockgc group quota scanning when usrquota isn't enforced (Darrick J. Wong)\n- Bluetooth: RFCOMM: fix NULL dereference of dlc-session in RFCOMM_CONNINFO (Hui Peng)\n- Bluetooth: L2CAP: validate frame length before control and FCS access (Aldo Ariel Panzardo)\n- Bluetooth: hci_sock: reject out-of-range OCF values (Aldo Ariel Panzardo)\n- Bluetooth: hci_sock: validate event length before filtering (Aldo Ariel Panzardo)\n- s390/cio: Fix NULL pointer dereference in ccw_device_get_util_str() (Vineeth Vijayan)\n- pinctrl: single: free the IRQ on domain creation failure (Myeonghun Pak)\n- scsi: libiscsi_tcp: Check the data direction of a Data-In PDU (Yehyeong Lee)\n- nfc: port100: reject frames whose declared length exceeds the received data (Doruk Tan Ozturk)\n- nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc() (Aamir Ahmed)\n- nfc: fix use-after-free in nfc_get_local_general_bytes (Luxiao Xu)\n- netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read (Luxiao Xu)\n- netfilter: ip6t_rpfilter: reject routes without inet6_dev (Weiming Shi)\n- net: usb: cdc_mbim: add MeiG Smart SRM821 to ZLP whitelist (Ming Wang)\n- net: atl1e: fix soft lockup on out-of-range hw_next_to_clean read (Gajdos Tamas)\n- net: atl1c: fix soft lockup on out-of-range tpd_cons read (Gajdos Tamas)\n- net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry (Ilya Maximets)\n- net: hisilicon: hns_dsaf_mac: fix mdio device leak in hns_mac_register_phy() (Wentao Liang)\n- net: atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read (Gajdos Tamas)\n- net: arp: terminate device name before lookup (Zijie Huang)\n- net/sched: reject IDR error pointers when deleting actions (Weiming Shi)\n- net/mlx5: Fix rev_entry reference leak in mlx5_tc_ct_shared_counter_get() (Wentao Liang)\n- HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce() (Wei Jie LAW)\n- HID: quirks: add ALWAYS_POLL quirk for SDINNOVATION gaming keyboard (Junjie Cao)\n- HID: alps: fix use-after-free on input2 registration failure (Chen Changcheng)\n- drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked() (Peiyang He)\n- drm/nouveau: Fix gem reference leak in validate_init() (Wentao Liang)\n- drm/nouveau: fix double-free in nvif_vmm_dtor (Peiyang He)\n- drm/nouveau: Fix bridge reference leak in nv1a_ram_new() (Wentao Liang)\n- drm/nouveau: fix autosuspend cleanup during teardown (Guangshuo Li)\n- llc: reserve device headroom for allocated frames (Zixuan Chai)\n- gpio: zynq: fix runtime PM leak on request error path (Ridham Khurana)\n- gpio: arizona: Fix runtime PM leak in arizona_gpio_direction_out() (Wentao Liang)\n- ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST (Hui Peng)\n- ipv6: do not let ipv6_find_hdr() return an offset past the packet end (Norbert Szetei)\n- fsl/fman: Fix clk reference leak in read_dts_node() (Wentao Liang)\n- writeback: report a Tasks-RCU quiescent state per cgwb drain pass (Josef Bacik)\n- workqueue: Fix NULL current_pwq deref in flush dependency check (Pavankumar Kondeti)\n- fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT (Hui Peng)\n- af_packet: fix integer overflow in prb_calc_retire_blk_tmo() (Dairui Zhang)\n- sctp: discard the rest of the packet on a stale-cookie error (Aohan Mei)\n- tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow (Eric Dumazet)\n- x86/PCI: Disable enhanced atomics on AMD NBIO 7.7 and 7.11 (Mario Limonciello)\n- x86/mm: Fix check/use ordering in switch_mm_irqs_off() (Stephen Dolan)\n- KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page (Sean Christopherson)\n- KVM: MMU: update comment on the number of page role combinations (Paolo Bonzini)\n- netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Pablo Neira Ayuso)\n- rculist: add list_splice_rcu() for private lists (Pablo Neira Ayuso)\n- autofs: fix sbi-pipe file reference leak in autofs_kill_sb() (Hui Peng)\n- vlan: ensure sufficient headroom in vlan_dev_hard_header() (Eric Dumazet)\n- net/sched: sch_teql: fix shadowed err in __teql_resolve() (Eric Dumazet)\n- bridge: check llc_mac_hdr_init() return value in br_send_bpdu() (Eric Dumazet)\n- llc: fix skb UAF and leaks on llc_mac_hdr_init() failure (Eric Dumazet)\n- tipc: Fix a data race on mon-peer_cnt in mon_timeout() (Ginger Li)\n- net/smc: fix UAF on lgr list traversal in smcr_port_err() (Sidraya Jayagond)\n- net/smc: stop links when their GID is removed (Karsten Graul)\n- tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack() (Yilin Zhang)\n- net: xps: reject an out of range traffic class (Norbert Szetei)\n- ip_gre: Reject enabling collect metadata through changelink (Xuanqiang Luo)\n- net: bcmgenet: validate Ethernet address in bcmgenet_set_mac_addr (Florian Fainelli)\n- vrf: Stop corrupting skb-csum when capturing CHECKSUM_COMPLETE packets (Ido Schimmel)\n- net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6() (Shihuang Liu)\n- veth: manage XDP program pointers during channel resize (Jakub Kicinski)\n- nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid() (Deepanshu Kartikey)\n- nfc: llcp: fix slab-out-of-bounds reads when logging service names (Omer Mete Kaya)\n- nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap() (Omer Mete Kaya)\n- nfc: llcp: fix -ENOMEM on connect with zero-length service name (Omer Mete Kaya)\n- nfc: st21nfca: validate ISO15693 inventory length (Pengpeng Hou)\n- nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure (Cong Nguyen)\n- nfc: virtual_ncidev: Add missing ioctl compat handler (Chris Gellermann)\n- selftests/nci: Fix out-of-bounds store on thread join (Chris Gellermann)\n- selftests: nci: Fix uninitialized family ID on missing attribute (Chaithanya Lagisetty)\n- nfc: llcp: Fix race condition in accept_queue lifecycle (Lee Jones)\n- selftests: nci: Correct pthread_create return value check (Lei Zhu)\n- nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm() (Aldo Ariel Panzardo)\n- nfc: st21nfca: validate received frame size (Pengpeng Hou)\n- nfc: st21nfca: remove redundant assignment to variable i (Colin Ian King)\n- nfc: nfcmrvl: validate helper command length before pull (Pengpeng Hou)\n- net: stmmac: dwmac4: Use the correct bufzise when the len is exactly 8K (Maxime Chevallier)\n- net: stmmac: Remove some unnecessary void pointers (Andrew Halaney)\n- net: stmmac: selftests: Capture all packets for vlan checks (Maxime Chevallier)\n- net: stmmac: selftests: Check the dev-features for S-TAG offload testing (Maxime Chevallier)\n- net: stmmac: selftests: Support running selftests on DSA conduits (Maxime Chevallier)\n- sctp: hold asoc or transport before mod_timer() in timer handlers (Xin Long)\n- bpf, sockmap: Reject max_entries  INT_MAX in sock_map_alloc (Zhao Gongyi)\n- bpf: Fix bpf_sock context code generation (Emil Tsalapatis)\n- net: ethernet: ti: netcp: fix pm_runtime usage counter leak on error (bui duc phuc)\n- s390/debug: Fix NULL pointer dereference in debug_info_copy() (Mikhail Zaslonko)\n- s390/debug: Do not register views for failed static debug areas (Mikhail Zaslonko)\n- tg3: clean up PHYLIB resources on probe failure (Myeonghun Pak)\n- net: usb: sr9700: include receive overhead in the length check (Pengpeng Hou)\n- Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame() (Hui Peng)\n- Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough (Hui Peng)\n- drm/virtio: release the GEM object on virtio_gpu_vram_create() errors (Junrui Luo)\n- drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl() (Junrui Luo)\n- drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl() (Junrui Luo)\n- drm/virtio: fix object leak when drm_gem_handle_create() fails (Junrui Luo)\n- net/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget (Jamal Hadi Salim)\n- net: usb: catc: bound the RX packet length in catc_rx_done() (Aamir Ahmed)\n- sctp: avoid livelock while updating retransmit path (Yiqi Sun)\n- ip6_gre: Call ip6erspan_tunnel_unlink_md() in ip6erspan_changelink(). (Kuniyuki Iwashima)\n- net: gue: reject invalid REMCSUM offsets (Jeremy Jean)\n- net/sched: act_ct: don't WARN on benign flow_offload_alloc() failure (Nguyen Ngoc Thang)\n- drm/nouveau/clk: don't clobber reclock status when restoring volt/fan (Francesco Magazzu)\n- drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update (Dan Carpenter)\n- ocfs2: make ocfs2_calc_xattr_init() return void (Joseph Qi)\n- ipvs: revalidate ihl before icmp_send (Julian Anastasov)\n- netfilter: nft_synproxy: use the family-aware checksum helper (Karl Mehltretter)\n- netfilter: nfnetlink_queue: hold nfnl mutex in event notifier (Florian Westphal)\n- netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC - GFP_KERNEL_ACCOUNT allocation (Scott Mitchell)\n- netfilter: flowtable: publish HW_DEAD after worker is done (Jeremy Jean)\n- netfilter: flowtable: allow unidirectional rules (Vlad Buslov)\n- bpf: Restrict CO-RE poisoning to relocatable instructions (Kumar Kartikeya Dwivedi)\n- libbpf: Fix an error in 64bit relocation value computation (Yonghong Song)\n- xsk: Use a 32-bit compare in xsk_map_gen_lookup (Zhiling Zou)\n- s390/cio: Check pmcw.dnv before pmcw.ena in I/O entry points (Vineeth Vijayan)\n- s390/cio: Fix cio_update_schib() to not cache invalid schib (Vineeth Vijayan)\n- s390/pci/docs: Fix sriov_numvfs attribute name (Karl Mehltretter)\n- docs: s390/pci: Improve and update PCI documentation (Niklas Schnelle)\n- Documentation: s390: correct spelling (Randy Dunlap)\n- Bluetooth: SMP: reject Security Request over BR/EDR (Christiano Amora)\n- squashfs: Add dictionary size range check to prevent shift-out-of-bounds (Ran Hongyun)\n- HID: amd_sfh: Validate PCI BAR size before mapping (Slawomir Stepien)\n- HID: amd_sfh: Move common macros and structures (Basavaraj Natikar)\n- bpf: Fix out-of-bounds read of rtt_min in sock_ops (Jiayuan Chen)\n- bpf: Avoid soft lockup in __htab_map_lookup_and_delete_batch() (Jose Fernandez (Anthropic))\n- HID: elecom: fix bus type for M-XGL20DLBK (Oscar Priego Verdugo)\n- bpf: Fix divide-by-zero in btf_struct_walk() (Jiayuan Chen)\n- bpf: support access variable length array of integer type (Feng Zhou)\n- selftests/ftrace: Fix unique symbol check in kprobe_non_uniq_symbol.tc (Sven Schnelle)\n- bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL (Weiming Shi)\n- bpf: Fix bpf_skb_change_tail wrt csum partial skbs (Daniel Borkmann)\n- HID: hyperv: streamline driver probe to avoid devres issues (Vitaly Kuznetsov)\n- erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC (Junli Liu)\n- erofs: Fix detection of atomic context (Sandeep Dhavale)\n- spi: zynqmp-gqspi: Use devm_spi_alloc_host() (Jinjie Ruan)\n- spi: spi-zynqmp-gqspi: stop the controller on shutdown (Itai Handler)\n- HID: logitech-hidpp: fix race condition when accessing stale stack pointer (Benoit Sevens)\n- drm/msm/hdmi_phy: fix runtime PM cleanup on probe failure (Guangshuo Li)\n- drm/msm/adreno: fix autosuspend cleanup during teardown (Guangshuo Li)\n- drm/gud: fix out-of-bounds write in gud_plane_atomic_check() (Sajal Gupta)\n- wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver (Rik van Riel)\n- wifi: mwifiex: validate action frame fixed fields (Zhao Li)\n- wifi: mwifiex: validate scan response extents (Pengpeng Hou)\n- wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length (Doruk Tan Ozturk)\n- wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST (Shengzhuo Wei)\n- wifi: p54: validate curve data length in the calibration curve converters (Shengzhuo Wei)\n- wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext() (Tianchu Chen)\n- wifi: wilc1000: fix out-of-bounds read in P2P public action frames (Ali Ahmet Memis)\n- wifi: wlcore: release runtime PM ref on regdomain config failure (Runyu Xiao)\n- wifi: rsi: fix heap OOB write on key removal (Tianchu Chen)\n- wifi: libertas_tf: fix UAF in lbtf_free_adapter() (Jiangshan Yi)\n- wifi: iwlegacy: fix broadcast stations deallocation (Stanislaw Gruszka)\n- wifi: brcmsmac: fix UAF in brcms_free_timer() (Jiangshan Yi)\n- watchdog: sp5100_tco: Fix pci_dev reference leak in sp5100_tco_init() (Wentao Liang)\n- watchdog: msc313e: Fix premature reset during timeout update (Tzung-Bi Shih)\n- watchdog: digicolor: Avoid division by zero (Tzung-Bi Shih)\n- hwmon: (w83793) release probe data through kref (Guangshuo Li)\n- hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove (Guangshuo Li)\n- hwmon: (pmbus/tps53679) Select page 0 for single-page TPS53676 (Sanman Pradhan)\n- hwmon: (pmbus/tps53679) Fix TPS53676 phase page decoding (Sanman Pradhan)\n- hwmon: (pmbus/core) increase number of phases and add new mask (Nuno Sa)\n- Input: zero ff_effect before compat copy in input_ff_effect_from_user (Ivan Ezequiel Rodriguez)\n- Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound (Dmitry Torokhov)\n- Input: synaptics - disable InterTouch on ThinkPad T440p (board id 2722) (Raphael Larocque)\n- Input: soc_button_array - check btns_desc-package.count (Hans de Goede)\n- Input: soc_button_array - fix MS Surface Pro 11 probe failure (Hans de Goede)\n- Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block() (Dmitry Torokhov)\n- Input: i8042 - add quirk for Acer Aspire Go 15 AG15-42P (Chris Sommers)\n- Input: evdev - zero absinfo before partial copy in EVIOCSABS (Ivan Ezequiel Rodriguez)\n- Input: atkbd - skip deactivate for Xiaomi Redmi Book Pro 16 2026 (Alexei Turtanov)\n- mmc: sdhci_am654: Reset command and data lines on failed tuning (Diogo Ivo (Schneider Electric))\n- mmc: spi: reset bytes_xfered before retrying CRC failures (Xu Rao)\n- mmc: sh_mmcif: initialize IRQ-thread mutex before requesting interrupt (Runyu Xiao)\n- mmc: sdio_uart: fix xmit_fifo leak when the port table is full (Felix Gu)\n- mmc: sdhci-of-aspeed: Remove children before releasing SDC resources (Myeonghun Pak)\n- mmc: rtsx_pci_sdmmc: ignore broken write-protect on ThinkPad X260 (Florian Maillard)\n- mmc: mxcmmc: cancel data work and watchdog on remove (Fan Wu)\n- mmc: core: Fix OF node reference leak on card add failure (Zhu Ling)\n- selinux: always fill AVC decision in avc_has_perm_noaudit() (Christian Gottsche)\n- IB/mlx4: Fix use-after-free on pkey sysfs registration failure (Shuangpeng Bai)\n- i2c: imx: release DMA channels on probe error (Shengzhuo Wei)\n- i2c: at91: release DMA channels on remove and probe error (Shengzhuo Wei)\n- KEYS: trusted: Fix tpm2_load_cmd() boundary check (Jarkko Sakkinen)\n- keys: translate request_key_auth pid for the reading procfs instance (Maoyi Xie)\n- net/packet: avoid truncating TPACKET_V3 private size (Mark Amirkan)\n- net/packet: clear RX owner on VNET header error (Mark Amirkan)\n- net/sched: hhf: cap hh_flows_limit at change time (Jamal Hadi Salim)\n- net: wwan: mhi_wwan_mbim: check skb_copy_bits() return value (Guanglei Zhu)\n- net: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain (Guanglei Zhu)\n- ipv6: xfrm: use full sockets in local error paths (Zhiling Zou)\n- dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn() (Alexander Chesnokov)\n- dmaengine: sun6i: fix undefined behaviour in sun6i_dma_tx_status (Christian Lugnberg)\n- dmaengine: sun6i: fix non-atomic read of DMA position registers (Christian Lugnberg)\n- Bluetooth: btusb: fix NXP IW610 composite device handling (Nicolas Thibert)\n- arm64: percpu: Fix this_cpu_and() mask generation (Mark Rutland)\n- arm64: percpu: Fix this_cpu_write() casting (Mark Rutland)\n- kselftest/arm64: Fix size of thread_data values for pthread_join() (Thomas Huth)\n- net: xfrm: reject unrepresentable espintcp transport headers (Wyatt Feng)\n- openvswitch: avoid reallocating confirmed conntrack labels (Zhiling Zou)\n- RDMA/core: fix refcount bug in iwpm_get_nlmsg_request() (Jeffin Philip)\n- RDMA/ucma: Serialize join and leave on copy_to_user failure (Quanye Yang)\n- tcp: exclude old ACKs from tcp fast path (Inbal Schussheim)\n- ata: libahci: clear PxCLBU and PxFBU for AHCI_HFLAG_32BIT_ONLY (Niklas Cassel)\n- Input: xpad - fix PDP Marvel Xbox 360 controller (Jeremy Nyberg)\n- Input: xpad - add support for Azeron devices (Roberts Kursitis)\n- Input: xpad - add support for Victrix Pro BFG Controller (Erich Sartison)\n- drm/amdgpu: Fix integer overflow in amdgpu_cs_pass1 (hackyzh002)\n- Input: eeti_ts - publish the OF module alias (hpp.iscas)\n- net: mvpp2: prevent buffer overflow in page_pool allocation (Dmitriy Okunev)\n- net: ethernet: cortina: Ack RX overrun interrupt correctly (Linus Walleij)\n- net: lock the socket in sock_gettstamp() (Eric Dumazet)\n- net: netsec: fix device_node reference leak on phy_np (Yige Jiang)\n- ASoC: hdmi-codec: Report a change when the channel status moves (HyeongJun An)\n- ASoC: ux500: Parenthesize MSP_{RX,TX}_CLKPOL_BIT() arguments (Sasha Levin)\n- powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba (Shivaprasad G Bhat)\n- KVM: PPC: Book3S HV: fix secure device page leak on uv_page_in() failure (Amit Machhiwal)\n- drop_monitor: fix out-of-bounds write in reset_per_cpu_data() (Eric Dumazet)\n- drop_monitor: synchronize tracepoint unregistration on error path (Eric Dumazet)\n- pppoatm: ensure a writable skb header and linear data (Eric Dumazet)\n- Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup (Juan Perdomo)\n- Bluetooth: btmtksdio: Fix PM runtime reference leak in shutdown (Tzung-Bi Shih)\n- dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg() (Baineng Shou)\n- tcp: do not let tcp_rmem be set below 4096 (Eric Dumazet)\n- tcp: Don't call skb_clone_and_charge_r() for close()d listener in tcp_v6_do_rcv(). (Kuniyuki Iwashima)\n- wifi: brcmfmac: fix lost 802.1x TX completion wakeup (Karl Mehltretter)\n- net: fddi: skfp: fix NULL deref when setting the MAC address while down (Hohyun Sim)\n- seg6: set IPSKB_L3SLAVE from IP6SKB_L3SLAVE on IPIP decapsulation (Andrea Mayer)\n- drm/msm/dsi: round the byte clock rate after reparenting to the PHY PLL (Dmitry Baryshkov)\n- drm/msm/dsi: correct byte intf clock rate for 14nm DSI PHY (Dmitry Baryshkov)\n- btrfs: tree-checker: print dev extent offset in error message (Filipe Manana)\n- ALSA: hda: trace PCM open only after assigning a stream (Slavin Liu)\n- wifi: virt_wifi: don't transfer operstate before register (Zihan Xi)\n- Input: trackpoint - fix the inertia attribute name in the ABI document (Karl Mehltretter)\n- ALSA: pcm: set timer-private_data before registering the PCM timer (Nguyen Ngoc Thang)\n- keys: fix lost wakeup when reaping a dead key type (Karl Mehltretter)\n- drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr (Thadeu Lima de Souza Cascardo)\n- netfilter: flowtable: hold reference on ct until flow is released (Pablo Neira Ayuso)\n- netfilter: nft_nat: fully initialise new_addr in netmap setup (Theodor Arsenij Larionov Trichkine)\n- RDMA/siw: Bound fragmented header copies by the remaining length (Jeremy Jean)\n- dmaengine: xilinx_dma: Fix hardware buffer descriptor chain after cyclic DMA (Alex Bereza)\n- dmaengine: xilinx_dma: Fix hardware buffer descriptor reuse order (Alex Bereza)\n- wifi: mac80211: don't access the TSF of a down interface (Johannes Berg)\n- wifi: mac80211: don't RCU-dereference the mesh CSA settings we just set (Johannes Berg)\n- wifi: mac80211: reset the AP_VLAN tailroom counter on ifdown (Johannes Berg)\n- wifi: mac80211: suppress chanctx warning for debugfs reset (Johannes Berg)\n- wifi: cfg80211: don't filter by BSS type when removing stale entries (Johannes Berg)\n- wifi: cfg80211: only group hidden BSSes with beacon entries (Johannes Berg)\n- dmaengine: wait for RCU readers before releasing dma_device (Shivank Garg)\n- dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel() (Shivank Garg)\n- dmaengine: Fix device kref underflow in dma_chan_put() (Shivank Garg)\n- dma-coherent: report a failed reserved memory assignment (Donggeun Yoo)\n- dma-coherent: Warn if OF reserved memory is beyond current coherent DMA mask (Chen-Yu Tsai)\n- soundwire: cadence_master: wait and cancel cdns-work before clock stop (Bard Liao)\n- wifi: cfg80211: check IP header size in cfg80211_classify8021d() (Johannes Berg)\n- IB/IPoIB: Avoid restoring OPER_UP after multicast flush (Carolina Jubran)\n- wifi: libipw: reject too-short association responses (Shmulik Cohen)\n- wifi: libipw: reject too-short beacon and probe responses (Shmulik Cohen)\n- wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path (Peng Hao)\n- wifi: virt_wifi: free skb when disconnected (Mariano Baragiola)\n- dmaengine: sprd: Fix runtime PM reference leak in probe (Ruoyu Wang)\n- RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted (Quanye Yang)\n- RDMA/irdma: Enforce local fence for IB_WR_REG_MR (Jacob Moroni)\n- RDMA/mad: Fix receive buffer leak when PKey enforcement fails (Li RongQing)\n- IB/isert: wait for deferred control PDU completions before releasing the connection (Yehyeong Lee)\n- scsi: target: iscsi: Rename iscsi_cmd to iscsit_cmd (Max Gurtovoy)\n- IB/iser: reject a remote invalidation of an unregistered direction (Yehyeong Lee)\n- IB/iser: Use iser_fr_desc as registration context (Max Gurtovoy)\n- IB/iser: Remove iser_reg_data_sg helper function (Max Gurtovoy)\n- IB/iser: Align coding style across driver (Max Gurtovoy)\n- clk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate (Xixin Liu)\n- firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS (Xixin Liu)\n- RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept (Guoqing Jiang)\n- RDMA/siw: Cleanup siw_accept (Guoqing Jiang)\n- RDMA/siw: Introduce siw_cep_set_free_and_put (Guoqing Jiang)\n- ARM: socfpga: select the PL310 erratum 753970 workaround (Pengpeng Hou)\n- xfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for xfrm_trans_reinject() (Eric Dumazet)\n- xfrm: fix compat ALLOCSPI request use-after-free (Kyle Zeng)\n- xfrm: avoid RCU warnings around the per-netns netlink socket (Sabrina Dubroca)\n- xfrm: add extack to verify_one_alg, verify_auth_trunc, verify_aead (Sabrina Dubroca)\n- xfrm: add extack support to verify_newsa_info (Sabrina Dubroca)\n- xfrm: add extack to verify_sec_ctx_len (Sabrina Dubroca)\n- ipv6: Honor oif when choosing nexthop for locally generated traffic (Ido Schimmel)\n- ipv6: Select best matching nexthop object in fib6_table_lookup() (Ido Schimmel)\n- media: video-i2c: fix buffer queue ordering (Arash Golgol)\n- Revert 'perf cs-etm: Flush thread stacks after decoder reset' (Sasha Levin)\n- Revert 'perf cs-etm: Avoid truncating AUX buffer sizes to int' (Sasha Levin)\n- net/smc: check v2_ext_offset/eid_cnt/ism_gid_cnt when receiving proposal msg (Guangguan Wang)\n- sunvdc: fix -EIO issue due to lack of retries (Jens Axboe)\n- selftests/landlock: Add tests for whiteout object creation (Gunther Noack)\n- Revert 'alpha: fix ieee_swcr_to_fpcr setting FPCR_DNOD unconditionally' (Sasha Levin)\n- Revert 'alpha: don't leak hardware-fabricated FP exception bits to user space' (Sasha Levin)\n- landlock: Require LANDLOCK_ACCESS_FS_MAKE_REG for whiteout creation (Gunther Noack)\n- bluetooth/l2cap: sync sock recv cb and release (Edward Adam Davis)\n- Bluetooth: L2CAP: Fix deadlock (Luiz Augusto von Dentz)\n- ARM: ensure interrupts are enabled in __do_user_fault() (Russell King (Oracle))\n- ARM: fix branch predictor hardening (Russell King (Oracle))\n- ARM: fix hash_name() fault (Russell King (Oracle))\n- iomap: iomap: fix memory corruption when recording errors during writeback (Darrick J. Wong)\n- mptcp: close race between scheduler and state change (Paolo Abeni)\n- mptcp: avoid unneeded actions on subflow reset (Paolo Abeni)\n- netfilter: nft_set_pipapo_avx2: add missing vzeroupper (Eric Biggers)\n- crypto: sun8i-ss - Remove crypto_rng interface (Eric Biggers)\n- crypto: sun8i-ce - Remove crypto_rng interface (Eric Biggers)\n- fou: Fix use-after-free in fou_create() (Xuanqiang Luo)\n- net: appletalk: fix NULL pointer dereference in aarp_send_ddp() (Weiming Shi)\n- i2c: smbus: reject oversized block transfers in the common path (Weiming Shi)\n- ALSA: us122l: Prevent write upgrades for read mappings (Kazuki Hanai)\n- Revert 'perf tests: Fix flakiness in BPF counters test on hybrid systems' (Sasha Levin)\n- ipv6: mcast: extend RCU protection in igmp6_send() (Eric Dumazet)\n- mptcp: syncookies: remember the request backup flag (Matthieu Baerts (NGI0))\n- mptcp: options: handle MPC data + csum reqd + no csum (Matthieu Baerts (NGI0))\n- bnxt_en: Propagate RX ring init failures in bnxt_init_nic() (Joe Damato)\n- bnxt_en: Handle buffer allocation failure in bnxt_rx_ring_reset() (Joe Damato)\n- media: v4l2-ctrls: validate HEVC tile counts (Michael Bommarito)\n- media: v4l2-h264: Fix memcmp() size in B1 reference list comparison (Haotian Zhang)\n- media: hevc: add bounded tile-count helpers (Michael Bommarito)\n- hwmon: (pmbus) Clear generic status alarms with CLEAR_FAULTS (Vishnu Razdan)\n- hwmon: (gpio-fan) Fix use-after-free in alarm work (Fan Wu)\n- hwmon: (applesmc) fix key backlight workqueue leak on register failure (Cong Nguyen)\n- s390/crypto: Fix missing scrub of temp buffers with AES ctr and gcm algorithm (Harald Freudenberger)\n- s390/qeth: allow bridgeport queries despite OS_MISMATCH (Nagamani PV)\n- KVM: PPC: Book3S HV: Set irqfd-producer only on success (leixiang)\n- ipvs: reject invalid states in connection template sync records (Kyle Zeng)\n- ipv4: fib: bound automatic table ID allocation (Zihan Xi)\n- ieee802154: 6lowpan: fix NULL dereference in lowpan_newlink (Zhiling Zou)\n- fbdev: vfb: defer cleanup until the last reference (Weiming Shi)\n- netfilter: report NLM_F_DUMP_FILTERED when all is filtered out (Ilya Maximets)\n- netfilter: nf_log: unregister loggers before per-net teardown (Chengfeng Ye)\n- net: openvswitch: fix use-after-free of the flow table mask array (Norbert Szetei)\n- net: mpls: clear inner_protocol when the last label is popped (Fourie Zhang)\n- net: hso: fix TIOCMIWAIT race (Johan Hovold)\n- drm/i915: Fix memory leak in query_perf_config_list() (Thorsten Blum)\n- exec: do_close_on_exec() before taking exec_update_lock (Jann Horn)\n- cpufreq: initialize policy rwsem before sysfs publication (Runyu Xiao)\n- cpufreq: zero-initialize policy cpumask before sysfs publication (Zhongqiu Han)\n- ASoC: sti: initialize IRQ lock before requesting IRQ (Runyu Xiao)\n- ASoC: sprd: validate compress buffer sizes against fixed allocations (Tianchu Chen)\n- tracing: Free histogram the var ref when its initialization fails (Donggeun Yoo)\n- tunnels: Drop stale dst when building an ICMP error for PMTUD (Ido Schimmel)\n- ufs: validate cylinder group metadata before caching it (Ali Ahmet Memis)\n- ufs: create the root dentry after loading cylinder metadata (Ali Ahmet Memis)\n- watchdog: sunxi_wdt: preserve boot-enabled watchdog (James Hilliard)\n- dm/amdgpu: fix malformed link_settings debugfs output (Harry Wentland)\n- ALSA: usbusx2y: fix in04_last array size mismatch with in04_buf (Tristan Madani)\n- ALSA: ctxfi: Fix CA20K2 S/PDIF passthrough (Roman Prucha)\n- ipv6: fix fib6 walker UAF on seq stop (Zihan Xi)\n- powerpc/eeh: Fix recursive locking on devices without EEH sensitive driver (Shivaprasad G Bhat)\n- macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Eric Dumazet)\n- ksmbd: prevent out-of-bounds reads in share config responses (Namjae Jeon)\n- scsi: target: iscsi: Fix hang for aborted WRITE_PENDING commands (Maurizio Lombardi)\n- drm/amd/display: set new_stream to NULL after release (WenTao Liang)\n- sunvdc: unmap LDC cookies when the descriptor send fails (Stian Halseth)\n- octeontx2-af: fix PF/CGX debugfs PCI bus lookup (Ratheesh Kannoth)\n- net: hinic: fix mailbox segment buffer overflow (Aamir Ahmed)\n- net: sun4i-emac: fix missing of_node_put() for phy_node (Li Youhong)\n- net/sched: cls_api: Don't replay RTM_GETCHAIN in tc_ctl_chain(). (Kuniyuki Iwashima)\n- net/sched: cls_route: free emptied bucket on filter move (Victor Nogueira)\n- selftests/powerpc/tm: Fix tcheck() reading uninitialised CR value (Thibault Ferrante)\n- net: stmmac: initialize ptp_lock at probe time (Lorenzo Bianconi)\n- ppp_synctty: ensure a writeable skb header (Qingfang Deng)\n- hwmon: (aspeed-pwm-tacho) Propagate reset deassert errors (Pengpeng Hou)\n- hwmon: (gpio-fan) take fan_data-lock in gpio_fan_shutdown() (Cong Nguyen)\n- watchdog: msc313e: Fix clock leak and spurious timer in settimeout() (Tzung-Bi Shih)\n- watchdog: msc313e: Avoid division by zero (Tzung-Bi Shih)\n- watchdog: fix hrtimer start when pretimeout is zero (David Arcari)\n- net: ethernet: cortina: Count RX descriptors for freeq refill (Linus Walleij)\n- net: ethernet: cortina: Count RX drops once per frame (Linus Walleij)\n- net: ethernet: cortina: No mapping is a dropped rx (Linus Walleij)\n- net: ethernet: cortina: Count dropped frames as NAPI work (Linus Walleij)\n- net: ethernet: cortina: Finish RX updates before NAPI completion (Linus Walleij)\n- net: ethernet: cortina: Fix budget accounting (Linus Walleij)\n- net: ipv6: Clamp to IP6_MAX_MTU in ip6_dst_mtu_maybe_forward (Alice Mikityanska)\n- virtio-pci: return IRQ_HANDLED after non-zero ISR (Andrew Stellman)\n- vdpa_sim_blk: reject out-of-range sector starts (Linfeng Sun)\n- vdpa_sim_blk: make vdpasim_blk_check_range usable by other requests (Stefano Garzarella)\n- vhost-vdpa: don't install the eventfd_ctx_fdget() error in config_ctx (Yu Zhang)\n- virtio_console: do not free control-out buffers on remove (Jia Jia)\n- virtio-console: call scheduler when we free unused buffs (Xianting Tian)\n- ASoC: mt6351: Publish the OF module alias (hpp.iscas)\n- netfilter: ip6_tables: set F_PROTO when proto value is nonzero (Florian Westphal)\n- netfilter: nfnetlink_log: cope with concurrent instance destruction (Florian Westphal)\n- ASoC: Intel: SST: Publish the PCI module aliases (hpp.iscas)\n- ASoC: bcm: bcm63xx: Publish the OF module aliases (hpp.iscas)\n- ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev (Edward Adam Davis)\n- net/sched: ets: clamp quantum in parse and fallback paths (Jamal Hadi Salim)\n- net/sched: drr: clamp quantum in change class (Jamal Hadi Salim)\n- net/sched: pie: clamp psched_mtu in pie_drop_early (Jamal Hadi Salim)\n- net/sched: hhf: clamp quantum in change and init paths (Jamal Hadi Salim)\n- net/sched: sfq: clamp quantum in change path (Jamal Hadi Salim)\n- net/sched: fq_pie: clamp quantum in change path (Jamal Hadi Salim)\n- net_sched: sch_fq_pie: implement lockless fq_pie_dump() (Eric Dumazet)\n- net/mlx5: E-Switch, prevent mc_list repopulation during vport disable (Lama Kayal)\n- net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put (Yael Chemla)\n- net/mlx5e: Fix use-after-free race in sample_restore_put() (Carolina Jubran)\n- net/mlx5e: Fix ETS zero BW reporting when one TC holds 100% (Carolina Jubran)\n- net/mlx5e: Fix setting RS FEC after remapping (Shahar Shitrit)\n- powerpc/kexec_file: Use inclusive range checks in add_usable_mem() (Thorsten Blum)\n- net: cap tx_queue_len at S16_MAX to prevent oversized ring allocations (Jamal Hadi Salim)\n- vxlan: reject dynamic fdb entries that reference a nexthop id (Seungwon Bae)\n- net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow (Jason Winter)\n- net: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer size (Jakub Kicinski)\n- net: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size (Jakub Kicinski)\n- bonding: use skb_cow_head() in bond_do_alb_xmit() and rlb_arp_xmit() (Eric Dumazet)\n- nexthop: Initialize extack in remove_nh_grp_entry() (Ido Schimmel)\n- bpf: Fix NULL-ptr-deref in btf_var_show() (Jiayuan Chen)\n- bpf: Fix NULL-ptr-deref when showing a void BTF type (Jiayuan Chen)\n- ALSA: caiaq: Fix potential double-free at error path (Takashi Iwai)\n- net: stmmac: reconfigure RX packet parser table in stmmac_hw_setup() after reset (Lorenzo Bianconi)\n- bonding: do not clear curr_active_slave prematurely when releasing all slaves (Eric Dumazet)\n- bpf: reject BPF_PSEUDO_FUNC reference to the main program (Eduard Zingerman)\n- tracing/probes: Fix use-after-free on field name/type of events with multiple probes (Henry Martin)\n- netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace() (Joas Antonio dos Santos)\n- ipvs: fix reversed sequence option serialization (Kyle Zeng)\n- btrfs: do not force reloc root creation during qgroup_account_snapshot() (Qu Wenruo)\n- ASoC: ux500: Program the MSP FIFO watermarks (Linus Walleij)\n- ASoC: ux500: Request the MSP MMIO resource (Linus Walleij)\n- ASoC: ux500: remove stedma40 references (Arnd Bergmann)\n- ASoC: ux500: Validate MSP DAI configuration (Linus Walleij)\n- ASoC: ux500: Correct MSP frame and bit clock setup (Linus Walleij)\n- ASoC: ux500: Propagate MSP setup errors (Linus Walleij)\n- ASoC: ux500: remove platform_data support (Arnd Bergmann)\n- ASoC: ux500: Fix MSP stream lifecycle handling (Linus Walleij)\n- locking/lockdep: Invalidate stale class_cache entries for zapped classes (Eric Dumazet)\n- lockdep: Add lock_set_cmp_fn() annotation (Kent Overstreet)\n- locking/lockdep: Improve the deadlock scenario print for sync and read lock (Boqun Feng)\n- locking/lockdep: Introduce lock_sync() (Boqun Feng)\n- perf/core: Skip empty AUX records with only format flags (Leo Yan)\n- scsi: mpt3sas: Avoid out-of-bounds cpumask_of_node() call in _base_assign_reply_queues() (Ivy Lopez)\n- scsi: mpt3sas: Use irq_set_affinity_and_hint() (Nitesh Narayan Lal)\n- btrfs: restore active device pointers after failed sprout (Guanghui Yang)\n- btrfs: consolidate device_list_mutex in prepare_sprout to its parent (Anand Jain)\n- btrfs: detach failed sprout device from transaction update list (Guanghui Yang)\n- ASoC: amd: renoir: fix disable_pdm_interrupts() to clear mask bits (wangdicheng)\n- staging: fbtft: make dirty_lock IRQ-safe (Hui Su)\n- af_packet: Don't cast tpacket_hdr.tp_len to int in tpacket_parse_header(). (Kuniyuki Iwashima)\n- ipv6: sr: restore network header before routing and forwarding (Eric Dumazet)\n- tipc: fix NULL deref in tipc_named_node_up() on empty publication list (Tung Nguyen)\n- ppp: ppp_async: simplify tty disc_data access (Qingfang Deng)\n- tty: make tty_ldisc_ops::hangup return void (Jiri Slaby)\n- ASoC: ab8500: Validate and program TDM slots correctly (Linus Walleij)\n- ASoC: ab8500: Correct digital interface format setup (Linus Walleij)\n- ASoC: ab8500: Update to modern clocking terminology (Mark Brown)\n- ASoC: ab8500: Repair the DAPM capture graph (Linus Walleij)\n- ASoC: ab8500: Reset the audio block before configuring it (Linus Walleij)\n- Bluetooth: hci_mrvl: Fix wrong return value check of wait_on_bit_timeout() (Gongwei Li)\n- Bluetooth: L2CAP: clear FLAG_DEFER_SETUP only for same PID/PSM (Pauli Virtanen)\n- Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan (Pauli Virtanen)\n- ksmbd: rate limit unmapped SID errors (Namjae Jeon)\n- ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF (Yilin Zhang)\n- OPP: of: Fix potential multiplication overflow when calculating freq (Colin Ian King)\n- watchdog: msc313e: Fix NULL pointer dereference in PM callbacks (Tzung-Bi Shih)\n- net: amd-xgbe: discard rx packets with bad FCS (James Nugraha)\n- sctp: fix soft lockup from unpadded ASCONF-ACK parameter iteration (Henry Martin)\n- smb: client: transport: Fix debug printing in __release_mid() (Andy Shevchenko)\n- sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START (Xin Long)\n- net/sched: act_api: size the RTM_GETACTION reply from the actions (Victor Nogueira)\n- net/sched: act_api: budget all shared attributes in notify skbs (Victor Nogueira)\n- selftests/cgroup: Fix cg_run_in_subcgroups ignoring arg parameter (Hongfu Li)\n- nvme-rdma: fix -EIO cleanup order in queue_rq (Xixin Liu)\n- drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create() (Dan Carpenter)\n- EDAC/device_sysfs: Use kstrtouint() for poll_msec to prevent truncation (Jad Keskes)\n- EDAC/igen6: Fix channel address decode for non-hash mode (Qiuxu Zhuo)\n- EDAC/igen6: Fix channel selection hash (Qiuxu Zhuo)\n- EDAC/igen6: Fix interleave boundary condition (Qiuxu Zhuo)\n- ARM: 9484/1: enable interrupts when unhandled user faults are triggered (Xie Yuanbin)\n- Revert 'Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU' (Sasha Levin)\n- Revert 'Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU' (Sasha Levin)\n- mm/damon/core: avoid infinite kdamond_merge_regions() internal loop (SJ Park)\n- ppp_async: drop the errored frame instead of resetting its headroom (Vlatko Kosturjak)\n- clk: at91: pmc: #undef field_{get,prep}() before definition (Geert Uytterhoeven)\n- netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (Florian Westphal)\n- ASoC: rt5645: Perform the initial jack detect at probe (Rudi Heitbaum)\n- vhost-scsi: flush backend after device ioctls (Jia Jia)\n- ALSA: usb-audio: Add quirk for Corsair Virtuoso (later revision) (Robert Abrahamse)\n- Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (Jiale Yao)\n- wifi: cfg80211: validate IEs in cfg80211_wext_siwgenie() (Deepanshu Kartikey)\n- cifs: validate idmap key payload length (Li Qiang)\n- powerpc/pseries: Ensure vpa,slb_shadow  dtl are unregistered during crash (Vaibhav Jain)\n- ice: pass the return value of skb_checksum_help() (Michal Swiatkowski)\n- ALSA: hda/realtek: Add mute LED quirk for HP Laptop 14s-dr1xxx (Madhavender Singh)\n- phonet: check register_netdevice_notifier() error in phonet_device_init() (Minhong He)\n- drm/gma500: return errors from Oaktrail HDMI I2C reads (Pengpeng Hou)\n- wifi: mac80211_hwsim: reject undersized HWSIM_ATTR_TX_INFO (Ibrahim Hashimov)\n- regulator: core: clamp voltage constraints before applying apply_uV (Kamal Wadhwa)\n- wifi: mwifiex: replace one-element arrays with flexible array members (Georgi Valkov)\n- ALSA: usb-audio: Add FIXED_RATE quirk for JBL Quantum650 Wireless (Daniel C. Ribeiro)\n- wifi: iwlwifi: bound aligned TLV advance in FW parser (Emmanuel Grumbach)\n- drm/amd/pm/si: Don't schedule thermal work when queue isn't initialized (Timur Kristof)\n- arm64: kprobes: Allow reentering kprobes while single-stepping (Pu Hu)\n- arm64: fixmap: Allow 256K early_ioremap() at any offset (Yu Peng)\n- blk-cgroup: fix leaks and online flag on radix_tree_insert failure (Tao Cui)\n- wifi: iwlwifi: mvm: fix sched scan IE sizing (Emmanuel Grumbach)\n- wifi: iwlwifi: mvm: fix an off-by-1 boundary check (Emmanuel Grumbach)\n- btrfs: fix reloc root cleanup in merge_reloc_roots() (Filipe Manana)\n- btrfs: fix use-after-free on reloc root after error in insert_dirty_subvol() (Filipe Manana)\n- btrfs: only account delalloc bytes for regular file inodes in btrfs_getattr() (Dave Chen)\n- wifi: rsi: validate beacon length before fixed buffer copy (Pengpeng Hou)\n- netfilter: ipset: mark the rcu locked areas properly (Jozsef Kadlecsik)\n- wifi: libipw: fix key index receive bound checks (Pengpeng Hou)\n- gpio: dwapb: Mask interrupts at hardware initialization (Liang Hao)\n- wifi: cfg80211: validate rx/tx MLME callback frame lengths before access (Zhao Li)\n- ksmbd: validate SID namespace before mapping IDs (Namjae Jeon)\n- ksmbd: mark invalid session responses as signed (Namjae Jeon)\n- ksmbd: find bound sessions during reauthentication (Namjae Jeon)\n- wifi: libertas: reject short monitor TX frames (Pengpeng Hou)\n- wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers (Pengpeng Hou)\n- wifi: mac80211: validate deauth frame length before reason access (Zhao Li)\n- wifi: ralink: RT2X00: init EEPROM properly (Corentin Labbe)\n- ALSA: usb-audio: caiaq: validate EP1 reply lengths (Pengpeng Hou)\n- ksmbd: fix credit charge calculation for SMB2 QUERY_INFO (Namjae Jeon)\n- xen/gntalloc: validate grant count before allocation (Yousef Alhouseen)\n- freevxfs: don't BUG() on unknown typed-extent type (Farhad Alemi)\n- xen/front-pgdir-shbuf: free grant reference head on errors (Yousef Alhouseen)\n- ksmbd: Fix acl.sd_buf memory leak and invalid sd_size error handling (Qiang Liu)\n- ksmbd: fix n.data memory leak in ksmbd_vfs_set_dos_attrib_xattr (Qiang Liu)\n- drm/arm/komeda: fix error handling for clk_prepare_enable() and callers (Gustavo Kenji Mendonca Kaneko)\n- ksmbd: fix sd_ndr.data memory leak in ksmbd_vfs_set_sd_xattr (Qiang Liu)\n- netfilter: nf_conntrack_expect: zero at allocation time (Florian Westphal)\n- drm/arm/malidp: use clk_bulk API in runtime PM resume and suspend (Gustavo Kenji Mendonca Kaneko)\n- btrfs: tree-checker: validate INODE_REF's namelen (Weiming Shi)\n- fbdev: pm2fb: unwind WC setup on probe failure (Haoxiang Li)\n- rtc: bq32000: add delay between RTC reads (Adriana Stancu)\n- net: au1000: move free_irq out of the close-time spinlocked section (Runyu Xiao)\n- PCI/sysfs: Use kstrtobool() to parse the ROM attribute input (Krzysztof Wilczynski)\n- ksmbd: break RH leases before delete-on-close (Namjae Jeon)\n- ksmbd: apply create security descriptor first (Namjae Jeon)\n- ksmbd: treat unnamed DATA stream as base file (Namjae Jeon)\n- ksmbd: use connection ClientGUID for lease lookup (Namjae Jeon)\n- rtc: aspeed: add AST2700 compatible (Tommy Huang)\n- f2fs: validate inline dentry name lengths before conversion (Samuel Moelius)\n- md/raid5: let stripe batch bm_seq comparison wrap-safe (Chen Cheng)\n- md/raid5: account discard IO (Yu Kuai)\n- PCI: mediatek: Protect root bus removal with rescan lock (Hans Zhang)\n- PCI: rockchip: Protect root bus removal with rescan lock (Hans Zhang)\n- PCI: altera: Protect root bus removal with rescan lock (Hans Zhang)\n- PCI: iproc: Protect root bus removal with rescan lock (Hans Zhang)\n- ALSA: usb-audio: Add quirk for YAMAHA CDS3000 (Jean-Louis Colaco)\n- mfd: rsmu: Add 8a34002 support (Matthew Bystrin)\n- leds: pca9532: Don't stop blinking for non-zero brightness (Tobias Deiminger)\n- leds: uleds: Return -EFAULT on copy_to_user() failure (Yousef Alhouseen)\n- ALSA: hda/conexant: Add pin config quirk for Lenovo IdeaPad Slim 5 16AKP10 (Galen Hassen)\n- spi: Add NULL check for spi_get_device_id() in spi_get_device_match_data() (guoqi0226)\n- gpio: pisosr: Read 'ngpios' as u32 (Rob Herring (Arm))\n- scsi: bfa: Reduce kernel stack usage in bfa_fcs_lport_fdmi_build_portattr_block() (Arnd Bergmann)\n- fuse: set ff-flock only on success (Zhang Tianci)\n- sparc: Disable compat support with LLD (Rosen Penev)\n- i3c: mipi-i3c-hci: Tolerate i3c_master_add_i3c_dev_locked() failures in DAA (Adrian Hunter)\n- net/sched: act_csum: don't mangle UDP tunnel GSO packets (Alice Mikityanska)\n- e1000e: limit endianness conversion to boundary words (Agalakov Daniil)\n- vsock: use sk_acceptq_is_full() helper in all transports (Raf Dickson)\n- ptp: ocp: add shutdown callback (Vadim Fedorenko)\n- net: stmmac: xgmac2: disable RBUE in default RX interrupt mask (Nazim Amirul)\n- sparc64: uprobes: add missing break (Rosen Penev)\n- ASoC: rockchip: spdif: Restore regcache cache-only mode on sync failure (bui duc phuc)\n- ASoC: rockchip: rockchip_pdm: Reorder clock enable sequence (bui duc phuc)\n- ASoC: rockchip: rockchip_pdm: Handle runtime PM resume failures in set_fmt (bui duc phuc)\n- Bluetooth: L2CAP: validate connectionless PSM length (Samuel Moelius)\n- hwmon: (pmbus/lm25066) Fix PMBus coefficients for LM5064/5066/5066i (Potin Lai)\n- dmaengine: dw-axi-dmac: fix PM for system sleep and channel alloc (Tze Yee Ng)\n- PCI: Avoid SBR for Qualcomm WCN6855/WCN7850 WiFi, SDX62/SDX65 modems (Jose Ignacio Tornos Martinez)\n- sctp: Unwind address notifier registration on failure (Yuho Choi)\n- platform/x86: intel-hid: Add HP ProBook x360 440 G1 to button_array_table (Nikolay Metchev)\n- ata: libata-pmp: add JMicron JMS562 quirk (Xu Rao)\n- hwmon: (adt7462) Add of_match_table to support devicetree (Kory Maincent)\n- btrfs: protect sb_write_pointer() with invalidate lock (KangNing Liao)\n- wifi: mt76: transform aspm_conf for pci_disable_link_state (Jiajia Liu)\n- platform/x86: dell-laptop: add Inspiron N5110 to touchpad LED quirk table (Gleb Sonichev)\n- net: ibm: emac: mal: fix potential system hang in mal_remove() (Rosen Penev)\n- configfs_depend_prep(): pass configfs_dirent instead of dentry (Al Viro)\n- xprtrdma: Add request-pool slack for delayed recycling (Chuck Lever)\n- RDMA/rtrs-srv: Fix integer underflow in process_read and process_write (Aurelien DESBRIERES)\n- btrfs: balance: fix potential bg lookup failure in btrfs_may_alloc_data_chunk() (ZhengYuan Huang)\n- netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (Rosen Penev)\n- ALSA: es18xx: check control allocation before private data setup (Ruoyu Wang)\n- hsr: broadcast netlink notifications in the device's net namespace (Maoyi Xie)\n- net: cpsw_new: unregister devlink on port registration failure (Guangshuo Li)\n- bpf: NUL-terminate replaced sysctl value (Dawei Feng)\n- RDMA/mlx5: Fix state and counter desync on loopback enable failure (Li RongQing)\n- RDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz() (Jason Gunthorpe)\n- wifi: nl80211: Increase ie_len size to prevent truncated IEs in new peer notifications (Thiyagarajan Pandiyan)\n- ipmi: si: Use platform_get_irq_optional() to retrieve interrupt (Rosen Penev)\n- ALSA: hda/realtek: Add quirk for ASUS VivoBook X509DAP (Andrei Faleichyk)\n- clk: keystone: don't cache clock rate (Michael Walle)\n- xhci: Prevent queuing new commands if xhci is inaccessible (Mathias Nyman)\n- dpaa2-switch: fix handling of NAPI on the remove path (Ioana Ciornei)\n- net: dsa: sja1105: flower: reject cross-chip redirect (David Yang)\n- dpaa2-switch: fix the error path in dpaa2_switch_rx() (Ioana Ciornei)\n- dpaa2-switch: rework FDB management on the bridge leave path (Ioana Ciornei)\n- ALSA: seq: oss: Reject reads that cannot fit the next event (Cassio Gabriel)\n- ASoC: codecs: rk3328: Use managed GPIO and clock helpers (Cassio Gabriel)\n- ntfs3: fix out-of-bounds read in ntfs_dir_emit() and hdr_find_e() (Alessandro Schino)\n- fs/ntfs3: validate index entry key bounds (ZhengYuan Huang)\n- fs/ntfs3: preserve non-DOS attribute bits in system.dos_attrib (ZhengYuan Huang)\n- iommu/rockchip: disable fetch dte time limit (Simon Xue)\n- net: qrtr: fix node refcount leak on ctrl packet alloc failure (Wentao Liang)\n- ACPI: PCI: Clear _DEP dependencies after PCI root bridge attach (Chen Pei)\n- ata: ahci: fail probe if BAR too small for claimed ports (liyouhong)\n- ASoC: codecs: pcm3168a: Drop CONFIG_PM-conditional preproc directive (Cezary Rojewski)\n- net: ibm: emac: Reserve VLAN header in MJS limit (Rosen Penev)\n- libbpf: Also reset {insn,data}_cur on realloc failure (Daniel Borkmann)\n- iio: accel: mma8452: switch to non-devm request_threaded_irq() (Sanjay Chitroda)\n- perf/ftrace: Fix WARNING in __unregister_ftrace_function (Rik van Riel)\n- mmc: renesas_sdhi: Add OF entry for RZ/G2E SoC (Lad Prabhakar)\n- mmc: renesas_sdhi: Add OF entry for RZ/G2N SoC (Lad Prabhakar)\n- mmc: davinci: fix mmc_add_host order in probe (Osama Abdelkader)\n- soundwire: only handle alert events when the peripheral is attached (Bard Liao)\n- ASoC: Intel: catpt: Complete coredump handling (Cezary Rojewski)\n- scripts: modpost: detect and report truncated buf_printf() output (Alexandre Courbot)\n- host1x: bus: Fix missing ops null check in error teardown (shayderrr)\n- hfs: rework hfsplus_readdir() logic (Viacheslav Dubeyko)\n- ACPICA: add boundary checks in two places (ikaros)\n- ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources() (ikaros)\n- ACPICA: Fix NULL pointer dereference in acpi_ns_custom_package() (Weiming Shi)\n- ACPICA: Add validation for node in acpi_ns_build_normalized_path() (ikaros)\n- ACPICA: Add package limit checks in parser functions (ikaros)\n- ACPICA: validate handler object type in two places (ikaros)\n- ACPICA: Improve argument parsing in acpi_ps_get_next_simple_arg() (ikaros)\n- ACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op) (ikaros)\n- ACPICA: Prevent adding invalid references (ikaros)\n- ACPICA: validate byte_count in acpi_ps_get_next_package_length() (ikaros)\n- ACPICA: add boundary checks in acpi_ps_get_next_field() (ikaros)\n- ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() (ikaros)\n- ACPICA: Fix condition check in acpi_ps_parse_loop() (ikaros)\n- drm/amd/pm/si: Fix updating clock limits from power states (Jeremy Klarenbeek)\n- ipv6: addrconf: fix temp address generation after prefix deprecation (Fernando Fernandez Mancera)\n- ALSA: usb-audio: Add quirk for Novation Mininova (Uwe Kuchler)\n- irqchip/gic-v4: Don't advertise VLPIs if no ITS is probed (Mostafa Saleh)\n- iio: adc: qcom-spmi-iadc: balance enable_irq_wake() on driver unbind (Stepan Ionichev)\n- mips: cps: Assemble jr.hb with an R2 ISA level (Rosen Penev)\n- drm/panel: simple: Add AM-1280800W8TZQW-T00H (Dario Binacchi)\n- thermal/drivers/tegra/soctherma: Switch to devm cooling device registration (Daniel Lezcano)\n- clk: socfpga: agilex: implement l3_main_free_clk (Adrian Ng Ho Yin)\n- s390/zcore: Removed unused variables (Heiko Carstens)\n- netlabel: fix IPv6 unlabeled address add error handling (Chenguang Zhao)\n- char/nvram: Remove redundant nvram_mutex (Venkat Rao Bagalkote)\n- usb: host: add ARCH_AIROHA in XHCI MTK dependency (Christian Marangi)\n- serial: 8250: fix possible ISR soft lockup (Marco Felsch)\n- usb: gadget: goku_udc: avoid NULL deref of dev-driver in INT_USBRESET log (Stepan Ionichev)\n- usb: core: hcd: fix possible deadlock in rh control transfers (Oliver Neukum)\n- usbip: vhci_hcd: fix NULL deref in status_show_vhci (Adrian Wowk)\n- isofs: handle set_blocksize failures (Christoph Hellwig)\n- omfs: handle set_blocksize failures (Christoph Hellwig)\n- hpfs: handle set_blocksize failures (Christoph Hellwig)\n- jfs: handle set_blocksize failures (Christoph Hellwig)\n- qnx4: handle set_blocksize failures (Christoph Hellwig)\n- minix: handle set_blocksize failures (Christoph Hellwig)\n- bfs: handle set_blocksize failures (Christoph Hellwig)\n- affs: handle set_blocksize failures (Christoph Hellwig)\n- befs: handle set_blocksize failures (Christoph Hellwig)\n- net/sched: sch_drr: make cl-quantum lockless (Eric Dumazet)\n- net: bridge: remove stale rcu_barrier() in br_multicast_dev_del() (Eric Dumazet)\n- net: usb: qmi_wwan: add MeiG SRM813Q (Jan Volckaert)\n- bitfield: wire __bf_shf to __builtin_ctzll (Yury Norov)\n- wifi: mac80211: don't call ieee80211_handle_reconfig_failure when not needed (Miri Korenblit)\n- firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size (Sudeep Holla)\n- firmware: arm_scmi: Validate SENSOR_UPDATE payload size (Sudeep Holla)\n- arm64/daifflags: Make local_daif_*() helpers __always_inline (Leonardo Bras)\n- 9p: invalidate readdir buffer on seek (Pierre Barre)\n- ALSA: usx2y: Drain pending US-428 pipe-4 output commands (Cassio Gabriel)\n- mailbox: Make mbox_send_message() return error code when tx fails (Joonwon Kang)\n- RDMA/mlx5: Use QP port when decoding responder CQEs (Chenguang Zhao)\n- media: imon: Add iMON VFD HID OEM v1.2 key mappings (Alessandro Baldi)\n- crypto: atmel-ecc - add support for atecc608b (Thorsten Blum)\n- crypto: ecc - Unbreak the build on arm with CONFIG_KASAN_STACK=y (Lukas Wunner)\n- scsi: pm8001: Reject non-fatal dump when controller is crashed (Kumar Meiyappan)\n- scsi: pm8001: Reject firmware update in fatal error state (Kumar Meiyappan)\n- integrity: Check for NULL returned by asymmetric_key_public_key (Stefan Berger)\n- drm/gud: Add RCade Display Adapter VID/PID pair (Sophie D)\n- hfsplus: rework hfsplus_readdir() logic (Viacheslav Dubeyko)\n- drm/amd/display: Fix CRC open failure during active rendering (Tom Chung)\n- mmc: davinci: avoid NULL deref of host-data in IRQ handler (Stepan Ionichev)\n- mmc: core: Add validation for host-provided max_segs (Shawn Lin)\n- ASoC: ti: omap3pandora: update board check to use DT compatible (Ethan Nelson-Moore)\n- clk: renesas: cpg-mssr: Add number of clock cells check (Geert Uytterhoeven)\n- crypto: ixp4xx - fix buffer chain unwind on allocation failure (Ruoyu Wang)\n- media: em28xx-video: fix missing res_free() on init_usb_xfer failure (Haoxiang Li)\n- net: dsa: mv88e6xxx: enable .rmu_disable() for 6320 family (Marek Behun)\n- net: dsa: mv88e6xxx: define .pot_clear() for 6321 (Marek Behun)\n- net: dsa: mv88e6xxx: fix number of g1 interrupts for 6320 family (Marek Behun)\n- media: dm1105: fix missing error check for dma_alloc_coherent (Zhaoyang Yu)\n- thunderbolt: Set tb-root_switch to NULL when domain is stopped (Mika Westerberg)\n- thunderbolt: Keep the domain reference while processing hotplug (Mika Westerberg)\n- thunderbolt: Release request if tb_cfg_request() fails in __tb_xdomain_response() (Mika Westerberg)\n- s390/cio: Purge based on the cdev's online status (Vineeth Vijayan)\n- media: rc: mceusb: Add support for 04eb:e033 (Riccardo Boninsegna)\n- soundwire: validate DT compatible before parsing it (Pengpeng Hou)\n- bridge: Do not suppress ARP probes and DAD NS unconditionally (Danielle Ratson)\n- kcsan: Silence -Wmaybe-uninitialized when calling __kcsan_check_access() (Marco Elver)\n- wifi: mac80211: always allow transmitting null-data on TXQs (Johannes Berg)\n- hfsplus: fix issue of direct writes beyond end-of-file (Viacheslav Dubeyko)\n- PCI: Stop setting cached power state to 'unknown' on unbind (Lukas Wunner)\n- tee: optee: Allow MT_NORMAL_TAGGED shared memory (Hirokazu Honda)\n- ima: return error early if file xattr cannot be changed (Goldwyn Rodrigues)\n- ALSA: usb-audio: Propagate write errors in generic mixer put callbacks (Cassio Gabriel)\n- bus: fsl-mc: wait for the MC firmware to complete its boot (Ioana Ciornei)",
  "id": "ELSA-2026-500574",
  "ovalId": "oval:com.oracle.elsa:def:2026500574",
  "source": "oracle_linux",
  "title": "ELSA-2026-500574: Unbreakable Enterprise kernel security update (IMPORTANT)",
  "url": "https://linux.oracle.com/errata/ELSA-2026-500574.html"
}