{"cves":["CVE-2025-22121","CVE-2025-23129","CVE-2025-37860","CVE-2025-38643","CVE-2025-38678","CVE-2025-39981","CVE-2025-40083","CVE-2025-40209","CVE-2025-40211","CVE-2025-40212","CVE-2025-40213","CVE-2025-40214","CVE-2025-40230","CVE-2025-40231","CVE-2025-40233","CVE-2025-40235","CVE-2025-40237","CVE-2025-40238","CVE-2025-40239","CVE-2025-40240","CVE-2025-40242","CVE-2025-40250","CVE-2025-40268","CVE-2025-40269","CVE-2025-40271","CVE-2025-40272","CVE-2025-40273","CVE-2025-40274","CVE-2025-40275","CVE-2025-40277","CVE-2025-40279","CVE-2025-40280","CVE-2025-40281","CVE-2025-40283","CVE-2025-40284","CVE-2025-40287","CVE-2025-40288","CVE-2025-40289","CVE-2025-40292","CVE-2025-40293","CVE-2025-40294","CVE-2025-40297","CVE-2025-40301","CVE-2025-40304","CVE-2025-40305","CVE-2025-40307","CVE-2025-40308","CVE-2025-40309","CVE-2025-40310","CVE-2025-40318","CVE-2025-40319","CVE-2025-40320","CVE-2025-40321","CVE-2025-40322","CVE-2025-40323","CVE-2025-40324","CVE-2025-40328","CVE-2025-40329","CVE-2025-40331","CVE-2025-40332","CVE-2025-40337","CVE-2025-40339","CVE-2025-40341","CVE-2025-40342","CVE-2025-40343","CVE-2025-40344","CVE-2025-40346","CVE-2025-40348","CVE-2025-40350","CVE-2025-40354","CVE-2025-40359","CVE-2025-40360","CVE-2025-40361","CVE-2025-40362","CVE-2025-40363","CVE-2025-68167","CVE-2025-68170","CVE-2025-68171","CVE-2025-68173","CVE-2025-68178","CVE-2025-68180","CVE-2025-68181","CVE-2025-68183","CVE-2025-68185","CVE-2025-68188","CVE-2025-68190","CVE-2025-68191","CVE-2025-68192","CVE-2025-68194","CVE-2025-68198","CVE-2025-68199","CVE-2025-68200","CVE-2025-68201","CVE-2025-68202","CVE-2025-68208","CVE-2025-68211","CVE-2025-68241","CVE-2025-68242","CVE-2025-68244","CVE-2025-68245","CVE-2025-68312","CVE-2025-68313","CVE-2025-68317","CVE-2025-68321"],"cvss":0.0,"database_specific":{"severity":"IMPORTANT"},"description":"[6.12.0-107.59.3.2]\n- xfrm: delete x-tunnel as we delete x (Sabrina Dubroca)   {CVE-2025-40215}\n\n[6.12.0-107.59.3.1]\n- Revert 'iommu/amd: Skip enabling command/event buffers for kdump' (Dongli Zhang)  [Orabug: 38781323]\n\n[6.12.0-107.59.3]\n- rds: Add smp_rmb before reading c_destroy_in_prog (Hakon Bugge)  [Orabug: 38352483]\n- dma/pool: eliminate alloc_pages warning in atomic_pool_expand (Dave Kleikamp)  [Orabug: 38643312]\n- net/mlx5e: Add a miss level for ipsec crypto offload (Lama Kayal)  [Orabug: 38733231]\n\n[6.12.0-107.59.2]\n- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Pradyumn Rahar)  [Orabug: 38690527]\n- uek-rpm: Replace check-kabi tool with kabi (Yifei Liu)  [Orabug: 38656184]\n- uek-rpm: Introduce check function for uek-rpm/tools/kabi (Yifei Liu)  [Orabug: 38656184]\n- xfs: fix various problems in xfs_atomic_write_cow_iomap_begin (Darrick J. Wong)  [Orabug: 38654556]\n- xfs: fix delalloc write failures in software-provided atomic writes (Darrick J. Wong)  [Orabug: 38654556]\n- LTS version v6.12.59 (Jack Vogel)\n- Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete (Pauli Virtanen)\n- proc: proc_maps_open allow proc_mem_open to return NULL (Jialin Wang)\n- net: netpoll: ensure skb_pool list is always initialized (John Sperbeck)\n- net: phy: micrel: Fix lan8814_config_init (Horatiu Vultur)\n- isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe() (Abdun Nihaal)\n- mm/huge_memory: preserve PG_has_hwpoisoned if a folio is split to 0 order (Zi Yan)\n- mm/huge_memory: do not change split_huge_page*() target order silently (Zi Yan)\n- mm/secretmem: fix use-after-free race in fault handler (Lance Yang)\n- mm/truncate: unmap large folio on split failure (Kiryl Shutsemau)\n- mm/memory: do not populate page table entries beyond i_size (Kiryl Shutsemau)\n- uio_hv_generic: Set event for all channels on the device (Long Li)\n- rust: kbuild: workaround rustdoc doctests modifier bug (Miguel Ojeda)\n- rust: kbuild: treat build_error and rustdoc as kernel objects (Miguel Ojeda)\n- io_uring/napi: fix io_napi_entry RCU accesses (Olivier Langlois)\n- ALSA: hda: Fix missing pointer check in hda_component_manager_init function (Denis Arefev)\n- KVM: VMX: Fix check for valid GVA on an EPT violation (Sukrit Bhatnagar)\n- KVM: VMX: Split out guts of EPT violation to common/exposed function (Sean Christopherson)\n- net: netpoll: fix incorrect refcount handling causing incorrect cleanup (Breno Leitao)\n- net: netpoll: flush skb pool during cleanup (Breno Leitao)\n- net: netpoll: Individualize the skb pool (Breno Leitao)\n- KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying (Sean Christopherson)\n- KVM: guest_memfd: Remove RCU-protected attribute from slot-gmem.file (Yan Zhao)\n- KVM: guest_memfd: Pass index, not gfn, to __kvm_gmem_get_pfn() (Sean Christopherson)\n- mm, percpu: do not consider sleepable allocations atomic (Michal Hocko)\n- wifi: mac80211: use wiphy_hrtimer_work for csa.switch_work (Benjamin Berg)\n- wifi: cfg80211: add an hrtimer based delayed work item (Benjamin Berg)\n- mptcp: fix MSG_PEEK stream corruption (Paolo Abeni)\n- selftests: mptcp: join: properly kill background tasks (Matthieu Baerts (NGI0))\n- selftests: mptcp: join: userspace: longer transfer (Matthieu Baerts (NGI0))\n- selftests: mptcp: connect: trunc: read all recv data (Matthieu Baerts (NGI0))\n- selftests: mptcp: join: endpoints: longer transfer (Matthieu Baerts (NGI0))\n- selftests: mptcp: join: rm: set backup flag (Matthieu Baerts (NGI0))\n- selftests: mptcp: connect: fix fallback note due to OoO (Matthieu Baerts (NGI0))\n- pmdomain: samsung: plug potential memleak during probe (Andre Draszik)\n- pmdomain: imx: Fix reference count leak in imx_gpc_remove (Miaoqian Lin)\n- pmdomain: arm: scmi: Fix genpd leak on provider registration failure (Sudeep Holla)\n- drm/amdgpu: disable peer-to-peer access for DCC-enabled GC12 VRAM surfaces (Vitaly Prosyak)\n- drm/amdkfd: relax checks for over allocation of save area (Jonathan Kim)\n- btrfs: release root after error in data_reloc_print_warning_inode() (Zilin Guan)\n- btrfs: do not update last_log_commit when logging inode due to a new name (Filipe Manana)\n- btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe() (Zilin Guan)\n- btrfs: zoned: fix conventional zone capacity calculation (Naohiro Aota)\n- PM: hibernate: Use atomic64_t for compressed_size variable (Mario Limonciello (AMD))\n- PM: hibernate: Emit an error when image writing fails (Mario Limonciello (AMD))\n- EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection (Niravkumar L Rabara)\n- EDAC/altera: Handle OCRAM ECC enable after warm reset (Niravkumar L Rabara)\n- LoongArch: Use physical addresses for CSR_MERRENTRY/CSR_TLBRENTRY (Huacai Chen)\n- ftrace: Fix BPF fexit with livepatch (Song Liu)\n- selftests/user_events: fix type cast for write_index packed member in perf_test (Ankit Khushwaha)\n- x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev (Borislav Petkov (AMD))\n- spi: Try to get ACPI GPIO IRQ earlier (Hans de Goede)\n- smb: client: fix cifs_pick_channel when channel needs reconnect (Henrique Carvalho)\n- crypto: hisilicon/qm - Fix device reference leak in qm_get_qos_value (Miaoqian Lin)\n- crash: fix crashkernel resource shrink (Sourabh Jain)\n- codetag: debug: handle existing CODETAG_EMPTY in mark_objexts_empty for slabobj_ext (Hao Ge)\n- cifs: client: fix memory leak in smb3_fs_context_parse_param (Edward Adam Davis)\n- ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (Takashi Iwai)\n- mmc: dw_mmc-rockchip: Fix wrong internal phase calculate (Shawn Lin)\n- mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4 (Shawn Lin)\n- mm/shmem: fix THP allocation and fallback loop (Kairui Song)\n- mm/mm_init: fix hash table order logging in alloc_large_system_hash() (Isaac J. Manjarres)\n- fs/proc: fix uaf in proc_readdir_de() (Wei Yang)\n- wifi: mac80211: reject address change while connecting (Johannes Berg)\n- selftests/tracing: Run sample events to clear page cache events (Steven Rostedt)\n- nilfs2: avoid having an active sc_timer before freeing sci (Edward Adam Davis)\n- ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe (Chuang Wang)\n- LoongArch: Let {pte,pmd}_modify() record the status of _PAGE_DIRTY (Tianyang Zhang)\n- LoongArch: Use correct accessor to read FWPC/MWPC (Huacai Chen)\n- dma-mapping: benchmark: Restore padding to ensure uABI remained consistent (Qinxin Xia)\n- strparser: Fix signed/unsigned mismatch bug (Nate Karstens)\n- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Pedro Demarchi Gomes)\n- ksmbd: close accepted socket when per-IP limit rejects connection (Joshua Rogers)\n- gcov: add support for GCC 15 (Peter Oberparleiter)\n- NFSD: free copynotify stateid in nfs4_free_ol_stateid() (Olga Kornievskaia)\n- nfsd: add missing FATTR4_WORD2_CLONE_BLKSIZE from supported attributes (Olga Kornievskaia)\n- nfsd: fix refcount leak in nfsd_set_fh_dentry() (NeilBrown)\n- KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated (Yosry Ahmed)\n- LoongArch: KVM: Add delay until timer interrupt injected (Bibo Mao)\n- LoongArch: KVM: Restore guest PMU if it is enabled (Bibo Mao)\n- net: dsa: sja1105: fix kasan out-of-bounds warning in sja1105_table_delete_entry() (Vladimir Oltean)\n- HID: uclogic: Fix potential memory leak in error path (Abdun Nihaal)\n- HID: playstation: Fix memory leak in dualshock4_get_calibration_data() (Abdun Nihaal)\n- ARM: dts: BCM53573: Fix address of Luxul XAP-1440's Ethernet PHY (Rafal Milecki)\n- HID: hid-ntrig: Prevent memory leak in ntrig_report_version() (Masami Ichikawa)\n- ARM: dts: imx51-zii-rdu1: Fix audmux node names (Jihed Chaibi)\n- arm64: dts: rockchip: Make RK3588 GPU OPP table naming less generic (Dragan Simic)\n- arm64: dts: rockchip: Set correct pinctrl for I2S1 8ch TX on odroid-m1 (Anand Moon)\n- netfilter: nf_tables: reject duplicate device on updates (Pablo Neira Ayuso)\n- Revert 'netfilter: nf_tables: Reintroduce shortened deletion notifications' (Pablo Neira Ayuso)\n- sched_ext: Fix unsafe locking in the scx_dump_state() (Zqiang)\n- fs/namespace: correctly handle errors returned by grab_requested_mnt_ns (Andrei Vagin)\n- virtio-fs: fix incorrect check for fsvq-kobj (Alok Tiwari)\n- mtd: onenand: Pass correct pointer to IRQ handler (Dan Carpenter)\n- hostfs: Fix only passing host root in boot stage with new mount (Hongbo Li)\n- f2fs: fix to avoid overflow while left shift operation (Chao Yu)\n- Bluetooth: MGMT: Fix possible UAFs (Luiz Augusto von Dentz)\n- ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() (Ye Bin)\n- lib/crypto: arm/curve25519: Disable on CPU_BIG_ENDIAN (Eric Biggers)\n- ext4: introduce ITAIL helper (Ye Bin)\n- proc: fix the issue of proc_mem_open returning NULL (Penglei Jiang)\n- wifi: ath11k: Clear affinity hint before calling ath11k_pcic_free_irq() in error path (Manivannan Sadhasivam)\n- irqchip/riscv-intc: Add missing free() callback in riscv_intc_domain_ops (Nick Hu)\n- bpf: account for current allocated stack depth in widen_imprecise_scalars() (Eduard Zingerman)\n- bpf: Add bpf_prog_run_data_pointers() (Eric Dumazet)\n- acpi/hmat: Fix lockdep warning for hmem_register_resource() (Dave Jiang)\n- ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd (Haein Lee)\n- NFS: Fix LTP test failures when timestamps are delegated (Dai Ngo)\n- NFSv4: Fix an incorrect parameter when calling nfs4_call_sync() (Trond Myklebust)\n- NFS: sysfs: fix leak when nfs_client kobject add fails (Yang Xiuwei)\n- NFSv2/v3: Fix error handling in nfs_atomic_open_v23() (Trond Myklebust)\n- simplify nfs_atomic_open_v23() (Al Viro)\n- pnfs: Set transport security policy to RPC_XPRTSEC_NONE unless using TLS (Trond Myklebust)\n- pnfs: Fix TLS logic in _nfs4_pnfs_v4_ds_connect() (Trond Myklebust)\n- ASoC: tas2781: fix getting the wrong device number (Shenghao Ding)\n- drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (Ian Forbes)\n- ASoC: codecs: va-macro: fix resource leak in probe error path (Haotian Zhang)\n- ASoC: cs4271: Fix regulator leak on probe failure (Haotian Zhang)\n- regulator: fixed: fix GPIO descriptor leak on register failure (Haotian Zhang)\n- acpi,srat: Fix incorrect device handle check for Generic Initiator (Shuai Xue)\n- Bluetooth: L2CAP: export l2cap_chan_hold for modules (Pauli Virtanen)\n- ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs (Gautham R. Shenoy)\n- ACPI: CPPC: Perform fast check switch only for online CPUs (Gautham R. Shenoy)\n- ACPI: CPPC: Check _CPC validity for only the online CPUs (Gautham R. Shenoy)\n- ACPI: CPPC: Detect preferred core availability on online CPUs (Gautham R. Shenoy)\n- hsr: Fix supervision frame sending on HSRv0 (Felix Maurer)\n- virtio-net: fix incorrect flags recording in big mode (Xuan Zhuo)\n- net_sched: limit try_bulk_dequeue_skb() batches (Eric Dumazet)\n- net/mlx5e: Fix potentially misleading debug message (Gal Pressman)\n- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Gal Pressman)\n- net/mlx5e: Fix maxrate wraparound in threshold between units (Gal Pressman)\n- net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak (Ranganath V N)\n- net: sched: act_connmark: initialize struct tc_ife to fix kernel leak (Ranganath V N)\n- net_sched: act_connmark: use RCU in tcf_connmark_dump() (Eric Dumazet)\n- af_unix: Initialise scc_index in unix_add_edge(). (Kuniyuki Iwashima)\n- wifi: mac80211: skip rate verification for not captured PSDUs (Benjamin Berg)\n- net: mdio: fix resource leak in mdiobus_register_device() (Buday Csaba)\n- tipc: Fix use-after-free in tipc_mon_reinit_self(). (Kuniyuki Iwashima)\n- net: ethernet: ti: am65-cpsw-qos: fix IET verify retry mechanism (Aksh Garg)\n- net: ethernet: ti: am65-cpsw-qos: fix IET verify/response timeout (Aksh Garg)\n- net/handshake: Fix memory leak in tls_handshake_accept() (Zilin Guan)\n- net/smc: fix mismatch between CLC header and proposal (D. Wythe)\n- sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto (Eric Dumazet)\n- Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions (Pauli Virtanen)\n- Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion (Pauli Virtanen)\n- Bluetooth: 6lowpan: reset link-local header on ipv6 recv path (Pauli Virtanen)\n- Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF (Raphael Pinsonneault-Thibeault)\n- Bluetooth: MGMT: cancel mesh send timer when hdev removed (Pauli Virtanen)\n- NFSD: Skip close replay processing if XDR encoding fails (Chuck Lever)\n- rust: Add -fno-isolate-erroneous-paths-dereference to bindgen_skip_c_flags (Xi Ruoyao)\n- net: phy: micrel: lan8814 fix reset of the QSGMII interface (Horatiu Vultur)\n- net: phy: micrel: Replace hardcoded pages with defines (Horatiu Vultur)\n- net: phy: micrel: Introduce lanphy_modify_page_reg (Horatiu Vultur)\n- net: fec: correct rx_bytes statistic for the case SHIFT16 is set (Wei Fang)\n- selftests: net: local_termination: Wait for interfaces to come up (Alexander Sverdlin)\n- erofs: avoid infinite loop due to incomplete zstd-compressed data (Gao Xiang)\n- wifi: ath11k: zero init info-status in wmi_process_mgmt_tx_comp() (Nicolas Escande)\n- ASoC: max98090/91: fixed max98091 ALSA widget powering up/down (Sharique Mohammad)\n- HID: logitech-hidpp: Add HIDPP_QUIRK_RESET_HI_RES_SCROLL (Stuart Hayhurst)\n- smb/server: fix possible refcount leak in smb2_sess_setup() (ZhangGuoDong)\n- smb/server: fix possible memory leak in smb2_read() (ZhangGuoDong)\n- exfat: fix improper check of dentry.stream.valid_size (Jaehun Gou)\n- HID: quirks: Add ALWAYS_POLL quirk for VRS R295 steering wheel (Oleg Makarenko)\n- NFS: check if suid/sgid was cleared after a write as needed (Scott Mayhew)\n- HID: nintendo: Wait longer for initial probe (Vicki Pfau)\n- HID: quirks: avoid Cooler Master MM712 dongle wakeup bug (Tristan Lobb)\n- NFS4: Apply delay_retrans to async operations (Joshua Watt)\n- NFS4: Fix state renewals missing after boot (Joshua Watt)\n- drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices (Jesse.Zhang)\n- drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM (Christian Konig)\n- drm/amd/pm: Disable MCLK switching on SI at high pixel clocks (Timur Kristof)\n- drm/amdgpu: remove two invalid BUG_ON()s (Christian Konig)\n- riscv: acpi: avoid errors caused by probing DT devices when ACPI is used (Han Gao)\n- RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid rfence errors (Danil Skrebenkov)\n- riscv: Build loader.bin exclusively for Canaan K210 (Feng Jiang)\n- compiler_types: Move unused static inline functions warning to W=2 (Peter Zijlstra)\n- arm64: kprobes: check the return value of set_memory_rox() (Yang Shi)\n- drm/xe: Do clean shutdown also when using flr (Jouni Hogander)\n- drm/xe: Move declarations under conditional branch (Tejas Upadhyay)\n- drm/xe/guc: Synchronize Dead CT worker with unbind (Balasubramani Vivekanandan)\n- drm/amd: Fix suspend failure with secure display TA (Mario Limonciello)\n- iommufd: Make vfio_compat's unmap succeed if the range is already empty (Jason Gunthorpe)\n- smb: client: fix refcount leak in smb2_set_path_attr (Shuhao Fu)\n- drm/i915: Fix conversion between clock ticks and nanoseconds (Umesh Nerlige Ramappa)\n- drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD (Janusz Krzysztofik)\n- drm/mediatek: Add pm_runtime support for GCE power control (Jason-JH Lin)\n\n[6.12.0-107.58.1]\n- sched/deadline: Stop dl_server before CPU goes offline (Peter Zijlstra (Intel))  [Orabug: 38609222]\n- sched/deadline: Don't count nr_running for dl_server proxy tasks (Yicong Yang)  [Orabug: 38609222]\n- sched/deadline: Fix dl_server behaviour (Peter Zijlstra)  [Orabug: 38609222]\n- sched/deadline: Fix dl_server_stopped() (Huacai Chen)  [Orabug: 38609222]\n- sched/deadline: Fix dl_server getting stuck (Peter Zijlstra)  [Orabug: 38609222]\n- sched/deadline: Fix RT task potential starvation when expiry time passed (kuyo chang)  [Orabug: 38609222]\n- sched/deadline: Less agressive dl_server handling (Peter Zijlstra)  [Orabug: 38609222]\n- LTS version: v6.12.58 (Jack Vogel)\n- drm/amd/display: Fix black screen with HDMI outputs (Alex Hung)\n- drm/amdgpu: Fix function header names in amdgpu_connectors.c (Srinivasan Shanmugam)\n- drm/amdgpu: Fix unintended error log in VCN5_0_0 (Sathishkumar S)\n- ACPI: SPCR: Check for table version when using precise baudrate (Punit Agrawal)\n- extcon: adc-jack: Cleanup wakeup source only if it was enabled (Krzysztof Kozlowski)\n- drm/amd/display: update color on atomic commit time (Melissa Wen)\n- scsi: ufs: core: Add a quirk to suppress link_startup_again (Adrian Hunter)\n- scsi: ufs: ufs-pci: Set UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE for Intel ADL (Adrian Hunter)\n- scsi: ufs: ufs-pci: Fix S0ix/S3 for Intel controllers (Adrian Hunter)\n- lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC (Nathan Chancellor)\n- virtio-net: fix received length check in big packets (Bui Quang Minh)\n- drm/amd/display: Fix NULL deref in debugfs odm_combine_segments (Rong Zhang)\n- drm/amdgpu/smu: Handle S0ix for vangogh (Alex Deucher)\n- smb: client: fix potential UAF in smb2_close_cached_fid() (Henrique Carvalho)\n- smb: client: validate change notify buffer before copy (Joshua Rogers)\n- x86/microcode/AMD: Add more known models to entry sign checking (Mario Limonciello (AMD))\n- rtc: rx8025: fix incorrect register reference (Yuta Hayama)\n- parisc: Avoid crash due to unaligned access in unwinder (Helge Deller)\n- iommufd: Don't overflow during division for dirty tracking (Jason Gunthorpe)\n- Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern() (Ilia Gavrilov)\n- drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb (Pierre-Eric Pelloux-Prayer)\n- drm/amd/display: Enable mst when it's detected but yet to be initialized (Wayne Lin)\n- tracing: Fix memory leaks in create_field_var() (Zilin Guan)\n- net: bridge: fix MST static key usage (Nikolay Aleksandrov)\n- net: bridge: fix use-after-free due to MST port state bypass (Nikolay Aleksandrov)\n- lan966x: Fix sleeping in atomic context (Horatiu Vultur)\n- net: dsa: microchip: Fix reserved multicast address table programming (Tristram Ha)\n- net: wan: framer: pef2256: Switch to devm_mfd_add_devices() (Haotian Zhang)\n- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Dragos Tatulea)\n- net: ti: icssg-prueth: Fix fdb hash size configuration (Meghana Malladi)\n- net/mlx5e: Fix return value in case of module EEPROM read error (Gal Pressman)\n- wifi: mac80211_hwsim: Limit destroy_on_close radio removal to netgroup (Martin Willi)\n- bnxt_en: Fix a possible memory leak in bnxt_ptp_init (Kalesh AP)\n- net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup (Qendrim Maxhuni)\n- net: ionic: map SKB after pseudo-header checksum prep (Mohammad Heib)\n- net: ionic: add dma_wmb() before ringing TX doorbell (Mohammad Heib)\n- sctp: Hold sock lock while iterating over address list (Stefan Wiehler)\n- sctp: Prevent TOCTOU out-of-bounds write (Stefan Wiehler)\n- sctp: Hold RCU read lock while iterating over address list (Stefan Wiehler)\n- net: dsa: b53: stop reading ARL entries if search is done (Jonas Gorski)\n- net: dsa: b53: fix enabling ip multicast (Jonas Gorski)\n- net: dsa: b53: fix bcm63xx RGMII port link adjustment (Jonas Gorski)\n- net: dsa: b53: fix resetting speed and pause on forced link (Jonas Gorski)\n- gpiolib: fix invalid pointer access in debugfs (Bartosz Golaszewski)\n- gpio: swnode: don't use the swnode's name as the key for GPIO lookup (Bartosz Golaszewski)\n- net: vlan: sync VLAN features with lower device (Hangbin Liu)\n- selftests: netdevsim: Fix ethtool-coalesce.sh fail by installing ethtool-common.sh (Wang Liang)\n- selftests/net: use destination options instead of hop-by-hop (Anubhav Singh)\n- selftests/net: fix out-of-order delivery of FIN in gro:tcp test (Anubhav Singh)\n- net: dsa: tag_brcm: legacy: fix untagged rx on unbridged ports for bcm63xx (Jonas Gorski)\n- net: dsa: tag_brcm: legacy: reorganize functions (Alvaro Fernandez Rojas)\n- Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2() (Abdun Nihaal)\n- Bluetooth: hci_event: validate skb length for unknown CC opcode (Raphael Pinsonneault-Thibeault)\n- riscv: ptdump: use seq_puts() in pt_dump_seq_puts() macro (Josephine Pfeiffer)\n- riscv: stacktrace: Disable KASAN checks for non-current tasks (Chunyan Zhang)\n- net: libwx: fix device bus LAN ID (Jiawen Wu)\n- ring-buffer: Do not warn in ring_buffer_map_get_reader() when reader catches up (Steven Rostedt)\n- Revert 'wifi: ath10k: avoid unnecessary wait for service ready message' (Baochen Qiang)\n- drm/mediatek: Disable AFBC support on Mediatek DRM driver (Ariel D'Alessandro)\n- media: videobuf2: forbid remove_bufs when legacy fileio is active (Marek Szyprowski)\n- media: uvcvideo: Use heuristic to find stream entity (Ricardo Ribalda)\n- btrfs: ensure no dirty metadata is written back for an fs with errors (Qu Wenruo)\n- ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again (Kailang Yang)\n- x86: uaccess: don't use runtime-const rewriting in modules (Linus Torvalds)\n- x86/runtime-const: Add the RUNTIME_CONST_PTR assembly macro (Kirill A. Shutemov)\n- x86: use cmov for user address masking (Linus Torvalds)\n- ceph: fix multifs mds auth caps issue (Kotresh HR)\n- ceph: refactor wake_up_bit() pattern of calling (Viacheslav Dubeyko)\n- ceph: fix potential race condition in ceph_ioctl_lazyio() (Viacheslav Dubeyko)\n- ceph: add checking of wait_for_completion_killable() return value (Viacheslav Dubeyko)\n- drm/amdkfd: Fix mmap write lock not release (Philip Yang)\n- ASoC: meson: aiu-encoder-i2s: fix bit clock polarity (Valerio Setti)\n- kbuild: uapi: Strip comments before size type check (Geert Uytterhoeven)\n- net: wwan: t7xx: add support for HP DRMR-H01 (Sammy Hsu)\n- rtc: pcf2127: fix watchdog interrupt mask on pcf2131 (Bruno Thomsen)\n- fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (Albin Babu Varghese)\n- tools: lib: thermal: use pkg-config to locate libnl3 (Sascha Hauer)\n- tools: lib: thermal: don't preserve owner in install (Emil Dahl Juhl)\n- tools bitmap: Add missing asm-generic/bitsperlong.h include (Ian Rogers)\n- LoongArch: Handle new atomic instructions for probes (Tiezhu Yang)\n- ACPI: property: Return present device nodes only on fwnode interface (Sakari Ailus)\n- scsi: ufs: core: Include UTP error in INT_FATAL_ERRORS (Hoyoung Seo)\n- 9p: sysfs_init: don't hardcode error to ENOMEM (Randall P. Embry)\n- cpufreq: tegra186: Initialize all cores to max frequencies (Aaron Kling)\n- 9p: fix /sys/fs/9p/caches overwriting itself (Randall P. Embry)\n- NTB: epf: Allow arbitrary BAR mapping (Jerome Brunet)\n- clk: clocking-wizard: Fix output clock register offset for Versal platforms (Shubhrajyoti Datta)\n- clk: scmi: Add duty cycle ops only when duty cycle is supported (Jacky Bai)\n- clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled (Matthias Schiffer)\n- 9p/trans_fd: p9_fd_request: kick rx thread if EPOLLIN (Oleg Nesterov)\n- clk: at91: clk-sam9x60-pll: force write to PLL_UPDT register (Nicolas Ferre)\n- clk: at91: clk-master: Add check for divide by 3 (Ryan Wanner)\n- clk: at91: sam9x7: Add peripheral clock id for pmecc (Balamanikandan Gunasundar)\n- ARM: at91: pm: save and restore ACR during PLL disable/enable (Nicolas Ferre)\n- rtc: pcf2127: clear minute/second interrupt (Josua Mayer)\n- clk: sunxi-ng: sun6i-rtc: Add A523 specifics (Chen-Yu Tsai)\n- um: Fix help message for ssl-non-raw (Tiwei Bie)\n- fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink (Yikang Yue)\n- clk: qcom: gcc-ipq6018: rework nss_port5 clock to multiple conf (Marko Makela)\n- btrfs: mark dirty extent range for out of bound prealloc extents (austinchang)\n- btrfs: fix memory leak of qgroup_list in btrfs_add_qgroup_relation (Shardul Bankar)\n- RDMA/hns: Fix wrong WQE data when QP wraps around (Junxian Huang)\n- RDMA/hns: Fix the modification of max_send_sge (wenglianfa)\n- RDMA/hns: Fix recv CQ and QP cache affinity (Chengchang Tang)\n- RDMA/irdma: Set irdma_cq cq_num field during CQ create (Jacob Moroni)\n- RDMA/irdma: Remove unused struct irdma_cq fields (Jacob Moroni)\n- RDMA/irdma: Fix SD index calculation (Jacob Moroni)\n- ACPICA: Update dsmethod.c to get rid of unused variable warning (Saket Dumbre)\n- drm/amd/display: Add fallback path for YCBCR422 (Mario Limonciello)\n- char: misc: restrict the dynamic range to exclude reserved minors (Thadeu Lima de Souza Cascardo)\n- usb: xhci-pci: Fix USB2-only root hub registration (Michal Pecio)\n- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Coiby Xu)\n- smb: client: transport: avoid reconnects triggered by pending task work (Fiona Ebner)\n- ksmbd: use sock_create_kern interface to create kernel socket (Namjae Jeon)\n- ftrace: Fix softlockup in ftrace_module_enable (Vladimir Riabchun)\n- orangefs: fix xattr related buffer overflow... (Mike Marshall)\n- page_pool: Clamp pool size to max 16K pages (Dragos Tatulea)\n- 6pack: drop redundant locking and refcounting (Qingfang Deng)\n- exfat: validate cluster allocation bits of the allocation bitmap (Namjae Jeon)\n- exfat: limit log print for IO error (Chi Zhiling)\n- net: stmmac: est: Drop frames causing HLBS error (Rohan G Thomas)\n- ALSA: usb-audio: add mono main switch to Presonus S1824c (Roy Vegard Ovesen)\n- Bluetooth: bcsp: receive data only if registered (Ivan Pravdin)\n- Bluetooth: btusb: Add new VID/PID 13d3/3633 for MT7922 (Chris Lu)\n- Bluetooth: SCO: Fix UAF on sco_conn_free (Luiz Augusto von Dentz)\n- Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames (Arkadiusz Bokowy)\n- net: macb: avoid dealing with endianness in macb_set_hwaddr() (Theo Lebrun)\n- net/mlx5e: Don't query FEC statistics when FEC is disabled (Carolina Jubran)\n- vfio/pci: Fix INTx handling on legacy non-PCI 2.3 devices (Timothy Pearson)\n- ACPI: scan: Update honor list for RPMI System MSI (Sunil V L)\n- ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007 (Primoz Fiser)\n- ASoC: stm32: sai: manage context in set_sysclk callback (Olivier Moysan)\n- amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw (Yifan Zhang)\n- ext4: increase IO priority of fastcommit (Julian Sun)\n- fs: ext4: change GFP_KERNEL to GFP_NOFS to avoid deadlock (chuguangqing)\n- accel/habanalabs: support mapping cb with vmalloc-backed coherent memory (Moti Haimovski)\n- accel/habanalabs/gaudi2: read preboot status after recovering from dirty state (Konstantin Sinyuk)\n- accel/habanalabs: return ENOMEM if less than requested pages were pinned (Tomer Tayar)\n- scsi: mpt3sas: Add support for 22.5 Gbps SAS link rate (Ranjan Kumar)\n- accel/habanalabs/gaudi2: fix BMON disable configuration (Vered Yavniely)\n- scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill() (Alok Tiwari)\n- net: bridge: Install FDB for bridge MAC on VLAN 0 (Petr Machata)\n- nfs4_setup_readdir(): insufficient locking for -d_parent-d_inode dereferencing (Al Viro)\n- NFSv4.1: fix mount hang after CREATE_SESSION failure (Anthony Iliopoulos)\n- NFSv4: handle ERR_GRACE on delegation recalls (Olga Kornievskaia)\n- drm/amd/display: change dc stream color settings only in atomic commit (Melissa Wen)\n- drm/amd/display: Fix for test crash due to power gating (Sridevi Arvindekar)\n- drm/amd/display: Init dispclk from bootup clock for DCN314 (Lo-an Chen)\n- drm/amd/display: Add AVI infoframe copy in copy_stream_update_to_stream (Karthi Kandasamy)\n- net: dsa: microchip: Set SPI as bus interface during reset for KSZ8463 (Bastien Curutchet)\n- wifi: ath12k: Increase DP_REO_CMD_RING_SIZE to 256 (Nithyanantham Paramasivam)\n- remoteproc: qcom: q6v5: Avoid handling handover twice (Stephan Gerhold)\n- selftests: forwarding: Reorder (ar)ping arguments to obey POSIX getopt (David Yang)\n- PCI/PM: Skip resuming to D0 if device is disconnected (Mario Limonciello)\n- crypto: hisilicon/qm - clear all VF configurations in the hardware (Weili Qian)\n- crypto: hisilicon/qm - invalidate queues in use (Weili Qian)\n- vfio: return -ENOTTY for unsupported device feature (Alex Mastro)\n- sparc64: fix prototypes of reads[bwl]() (Al Viro)\n- sparc/module: Add R_SPARC_UA64 relocation handling (Koakuma)\n- PCI: cadence: Check for the existence of cdns_pcie::ops before using it (Chen Wang)\n- r8169: set EEE speed down ratio to 1 (ChunHao Lin)\n- net: intel: fm10k: Fix parameter idx set but not used (Brahmajit Das)\n- wifi: mac80211: Track NAN interface start/stop (Ilan Peer)\n- wifi: ath10k: Fix connection after GTK rekeying (Loic Poulain)\n- iommu/vt-d: Replace snprintf with scnprintf in dmar_latency_snapshot() (Seyediman Seyedarab)\n- bus: mhi: core: Improve mhi_sync_power_up handling for SYS_ERR state (Vivek Pernamitta)\n- net: ethernet: microchip: sparx5: make it selectable for ARCH_LAN969X (Robert Marko)\n- net: phy: clear link parameters on admin link down (Oleksij Rempel)\n- ASoC: qcom: sc8280xp: explicitly set S16LE format in sc8280xp_be_hw_params_fixup() (Alexey Klimov)\n- drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked() (Guangshuo Li)\n- jfs: fix uninitialized waitqueue in transaction manager (Shaurya Rane)\n- jfs: Verify inode mode when loading from disk (Tetsuo Handa)\n- IB/ipoib: Ignore L3 master device (Vlad Dumitrescu)\n- RDMA/irdma: Update Kconfig (Tatyana Nikolova)\n- ipv6: np-rxpmtu race annotation (Eric Dumazet)\n- usb: xhci-pci: add support for hosts with zero USB3 ports (Niklas Neronin)\n- wifi: rtw89: renew a completion for each H2C command waiting C2H event (Zong-Zhe Yang)\n- wifi: rtw89: obtain RX path from ppdu status IE00 (Chih-Kang Chang)\n- f2fs: fix infinite loop in __insert_extent_tree() (wangzijie)\n- usb: xhci: plat: Facilitate using autosuspend for xhci plat devices (Krishna Kurapati)\n- usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs (Forest Crossman)\n- allow finish_no_open(file, ERR_PTR(-E...)) (Al Viro)\n- scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology (Justin Tee)\n- scsi: lpfc: Define size of debugfs entry for xri rebalancing (Justin Tee)\n- scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup (Justin Tee)\n- scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET (Justin Tee)\n- scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted (Justin Tee)\n- scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail (Justin Tee)\n- scsi: ufs: core: Disable timestamp functionality if not supported (Bart Van Assche)\n- selftests/Makefile: include  in clean target to clean net/lib dependency (Nai-Chen Cheng)\n- drm/amdgpu: reject gang submissions under SRIOV (Christian Konig)\n- drm/xe/guc: Return an error code if the GuC load fails (John Harrison)\n- HID: i2c-hid: Resolve touchpad issues on Dell systems during S4 (Mario Limonciello (AMD))\n- ethernet: Extend device_get_mac_address() to use NVMEM (Stefan Wahren)\n- page_pool: always add GFP_NOWARN for ATOMIC allocations (Jakub Kicinski)\n- drm/amd/display/dml2: Guard dml21_map_dc_state_into_dml_display_cfg with DC_FP_START (Xi Ruoyao)\n- drm/amd/display: Disable VRR on DCE 6 (Timur Kristof)\n- drm/amd/display: Fix DVI-D/HDMI adapters (Timur Kristof)\n- drm/amd: Avoid evicting resources at S5 (Mario Limonciello (AMD))\n- drm/amd/display: fix dml ms order of operations (Ausef Yousof)\n- drm/amd/display: Set up pixel encoding for YCBCR422 (Mario Limonciello)\n- drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl (Tvrtko Ursulin)\n- wifi: mt76: mt7996: fix memory leak on mt7996_mcu_sta_key_tlv error (Felix Fietkau)\n- ALSA: serial-generic: remove shared static buffer (John Keeping)\n- wifi: mt76: mt76_eeprom_override to int (Rosen Penev)\n- wifi: mt76: mt7996: Temporarily disable EPCS (Benjamin Lin)\n- wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922 device (Quan Zhou)\n- net/cls_cgroup: Fix task_get_classid() during qdisc run (Yafang Shao)\n- crypto: caam - double the entropy delay interval for retry (Gaurav Jain)\n- crypto: ccp - Fix incorrect payload size calculation in psp_poulate_hsti() (Yunseong Kim)\n- PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify() (Niklas Cassel)\n- crypto: sun8i-ce - remove channel timeout field (Ovidiu Panait)\n- watchdog: s3c2410_wdt: Fix max_timeout being calculated larger (Sangwook Shin)\n- HID: asus: add Z13 folio to generic group for multitouch to work (Antheas Kapenekakis)\n- udp_tunnel: use netdev_warn() instead of netdev_WARN() (Alok Tiwari)\n- net: devmem: expose tcp_recvmsg_locked errors (Stanislav Fomichev)\n- selftests: Replace sleep with slowwait (David Ahern)\n- eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP (Daniel Palmer)\n- selftests: Disable dad for ipv6 in fcnal-test.sh (David Ahern)\n- x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of PV_UNHALT (Li RongQing)\n- netfilter: nf_reject: don't reply to icmp error messages (Florian Westphal)\n- openrisc: Add R_OR1K_32_PCREL relocation type module support (chenmiao)\n- selftests: traceroute: Return correct value on failure (Ido Schimmel)\n- selftests: traceroute: Use require_command() (Ido Schimmel)\n- media: redrat3: use int type to store negative error codes (Qianfeng Rong)\n- selftests: net: replace sleeps in fcnal-test with waits (Jakub Kicinski)\n- net: sh_eth: Disable WoL if system can not suspend (Niklas Soderlund)\n- drm/msm/registers: Generate _HI/LO builders for reg64 (Rob Clark)\n- phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0 (Michael Riesch)\n- phy: renesas: r8a779f0-ether-serdes: add new step added to latest datasheet (Michael Dege)\n- Fix access to video_is_primary_device() when compiled without CONFIG_VIDEO (Mario Limonciello (AMD))\n- phy: cadence: cdns-dphy: Enable lower resolutions in dphy (Harikrishna Shenoy)\n- wifi: mac80211: Fix HE capabilities element check (Ilan Peer)\n- ntfs3: pretend  records as regular files (Tetsuo Handa)\n- scsi: ufs: host: mediatek: Disable auto-hibern8 during power mode changes (Peter Wang)\n- scsi: ufs: host: mediatek: Correct system PM flow (Peter Wang)\n- net: phy: marvell: Fix 88e1510 downshift counter errata (Rohan G Thomas)\n- scsi: ufs: host: mediatek: Enhance recovery on hibernation exit failure (Peter Wang)\n- scsi: ufs: host: mediatek: Fix unbalanced IRQ enable issue (Peter Wang)\n- scsi: ufs: host: mediatek: Enhance recovery on resume failure (Peter Wang)\n- selftests: mptcp: join: allow more time to send ADD_ADDR (Matthieu Baerts (NGI0))\n- f2fs: fix wrong layout information on 16KB page (Jaegeuk Kim)\n- media: i2c: og01a1b: Specify monochrome media bus format instead of Bayer (Vladimir Zapolskiy)\n- media: ov08x40: Fix the horizontal flip control (Hao Yao)\n- wifi: iwlwifi: fw: Add ASUS to PPAG and TAS list (Nidhish A N)\n- PCI: endpoint: pci-epf-test: Limit PCIe BAR size for fixed BARs (Marek Vasut)\n- char: Use list_del_init() in misc_deregister() to reinitialize list pointer (Xion Wang)\n- drm/msm: make sure to not queue up recovery more than once (Antonino Maniscalco)\n- tty/vt: Add missing return value for VT_RESIZE in vt_ioctl() (Zizhi Wo)\n- usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget (Chen Yufeng)\n- usb: gadget: f_hid: Fix zero length packet transfer (William Wu)\n- net: dsa: felix: support phy-mode = '10g-qxgmii' (Vladimir Oltean)\n- drm/amd/display: Fix pbn_div Calculation Error (Fangzhi Zuo)\n- drm/amdgpu: add support for cyan skillfish gpu_info (Alex Deucher)\n- drm/amdgpu: don't enable SMU on cyan skillfish (Alex Deucher)\n- drm/amd: add more cyan skillfish PCI ids (Alex Deucher)\n- iommu/apple-dart: Clear stream error indicator bits for T8110 DARTs (Hector Martin)\n- crypto: ccp: Skip SEV and SNP INIT for kdump boot (Ashish Kalra)\n- iommu/amd: Skip enabling command/event buffers for kdump (Ashish Kalra)\n- smsc911x: add second read of EEPROM mac when possible corruption seen (Colin Foster)\n- net: call cond_resched() less often in __release_sock() (Eric Dumazet)\n- drm/xe/guc: Set upper limit of H2G retries over CTB (Michal Wajdeczko)\n- PCI: imx6: Enable the Vaux supply if available (Richard Zhu)\n- ALSA: usb-audio: apply quirk for MOONDROP Quark2 (Cryolitia PukNgae)\n- wifi: mac80211: Fix 6 GHz Band capabilities element advertisement in lower bands (Ramya Gnanasekar)\n- media: verisilicon: Explicitly disable selection api ioctls for decoders (Paul Kocialkowski)\n- media: adv7180: Only validate format in querystd (Niklas Soderlund)\n- media: adv7180: Do not write format to device in set_fmt (Niklas Soderlund)\n- media: adv7180: Add missing lock in suspend callback (Niklas Soderlund)\n- net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms (Juraj Sarinay)\n- drm: panel-backlight-quirks: Make EDID match optional (Antheas Kapenekakis)\n- drm/panthor: check bo offset alignment in vm bind (Chia-I Wu)\n- ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled (Yue Haibing)\n- selftests: drv-net: rss_ctx: make the test pass with few queues (Jakub Kicinski)\n- drm/xe/guc: Increase GuC crash dump buffer size (Zhanjun Dong)\n- drm/amdgpu: Allow kfd CRIU with no buffer objects (David Francis)\n- drm/msm/dsi/phy_7nm: Fix missing initial VCO rate (Krzysztof Kozlowski)\n- drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL (Krzysztof Kozlowski)\n- dmaengine: dw-edma: Set status for callback_result (Devendra K Verma)\n- dmaengine: mv_xor: match alloc_wc and free_wc (Rosen Penev)\n- dmaengine: sh: setup_xref error handling (Thomas Andreatta)\n- ptp: Limit time setting of PTP clocks (Miroslav Lichvar)\n- scsi: ufs: exynos: fsd: Gate ref_clk and put UFS device in reset on suspend (Bharat Uppal)\n- scsi: pm8001: Use int instead of u32 to store error codes (Qianfeng Rong)\n- crypto: qat - use kcalloc() in qat_uclo_map_objs_from_mof() (Qianfeng Rong)\n- tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() (Eric Dumazet)\n- microchip: lan865x: add ndo_eth_ioctl handler to enable PHY ioctl support (Parthiban Veerasooran)\n- inet_diag: annotate data-races in inet_diag_bc_sk() (Eric Dumazet)\n- mips: lantiq: danube: rename stp node on EASY50712 reference board (Aleksander Jan Bajkowski)\n- mips: lantiq: xway: sysctrl: rename stp clock (Aleksander Jan Bajkowski)\n- mips: lantiq: danube: add missing device_type in pci node (Aleksander Jan Bajkowski)\n- mips: lantiq: danube: add model to EASY50712 dts (Aleksander Jan Bajkowski)\n- mips: lantiq: danube: add missing properties to cpu node (Aleksander Jan Bajkowski)\n- drm/amdgpu: Respect max pixel clock for HDMI and DVI-D (v2) (Timur Kristof)\n- drm/amdgpu: Avoid vcn v5.0.1 poison irq call trace on sriov guest (Mangesh Gadre)\n- drm/amd/display: incorrect conditions for failing dto calculations (Clay King)\n- drm/amd/display: Increase minimum clock for TMDS 420 with pipe splitting (Relja Vojvodic)\n- ASoC: SOF: ipc4-pcm: Add fixup for channels (Peter Ujfalusi)\n- media: pci: mgb4: Fix timings comparison in VIDIOC_S_DV_TIMINGS (Martin Tuma)\n- media: fix uninitialized symbol warnings (Chelsy Ratnawat)\n- selftests: drv-net: rss_ctx: fix the queue count check (Jakub Kicinski)\n- platform/x86/intel-uncore-freq: Fix warning in partitioned system (Srinivas Pandruvada)\n- drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption (Amber Lin)\n- drm/amd/display: Support HW cursor 180 rot for any number of pipe splits (Ivan Lipski)\n- drm/amdkfd: fix vram allocation failure for a special case (Eric Huang)\n- drm/amdgpu: Correct the counts of nr_banks and nr_errors (Ce Sun)\n- fuse: zero initialize inode private data (Miklos Szeredi)\n- net: phy: fixed_phy: let fixed_phy_unregister free the phy_device (Heiner Kallweit)\n- remoteproc: wkup_m3: Use devm_pm_runtime_enable() helper (Andrew Davis)\n- extcon: adc-jack: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)\n- scsi: pm80xx: Fix race condition caused by static variables (Francisco Gutierrez)\n- scsi: mpi3mr: Fix controller init failure on fault during queue creation (Chandrakanth Patil)\n- scsi: mpi3mr: Fix I/O failures during controller reset (Chandrakanth Patil)\n- net: ipv4: allow directed broadcast routes to use dst hint (Oscar Maes)\n- rpmsg: char: Export alias for RPMSG ID rpmsg-raw from table (Andrew Davis)\n- media: ipu6: isys: Set embedded data type correctly for metadata formats (Sakari Ailus)\n- net: wangxun: limit tx_max_coalesced_frames_irq (Jiawen Wu)\n- idpf: do not linearize big TSO packets (Eric Dumazet)\n- ALSA: usb-audio: Add validation of UAC2/UAC3 effect units (Takashi Iwai)\n- tty: serial: Modify the use of dev_err_probe() (Xichao Zhao)\n- bnxt_en: Add Hyper-V VF ID (Pavan Chebbi)\n- PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call (Sungho Kim)\n- f2fs: fix to detect potential corrupted nid in free_nid_list (Chao Yu)\n- net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV. (Kuniyuki Iwashima)\n- net: stmmac: Correctly handle Rx checksum offload errors (Oleksij Rempel)\n- net: When removing nexthops, don't call synchronize_net if it is not necessary (Christoph Paasch)\n- char: misc: Does not request module for miscdevice with dynamic minor (Zijun Hu)\n- char: misc: Make misc_register() reentry for miscdevice who wants dynamic minor (Zijun Hu)\n- dm error: mark as DM_TARGET_PASSES_INTEGRITY (Christoph Hellwig)\n- wifi: rtw89: fix BSSID comparison for non-transmitted BSSID (Kuan-Chung Chen)\n- wifi: rtw89: wow: remove notify during WoWLAN net-detect (Kuan-Chung Chen)\n- usb: gadget: f_ncm: Fix MAC assignment NCM ethernet (raub camaioni)\n- iio: adc: imx93_adc: load calibrated values even calibration failed (Haibo Chen)\n- iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register (Rodrigo Gobbi)\n- drm/amdkfd: Handle lack of READ permissions in SVM mapping (Kent Russell)\n- drm/amdgpu: fix nullptr err of vm_handle_moved (Heng Zhou)\n- drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts (Dmitry Baryshkov)\n- HID: pidff: PERMISSIVE_CONTROL quirk autodetection (Tomasz Pakula)\n- HID: pidff: Use direction fix only for conditional effects (Tomasz Pakula)\n- drm/panthor: Serialize GPU cache flush operations (Karunika Choo)\n- media: imon: make send_packet() more robust (Tetsuo Handa)\n- net: ipv6: fix field-spanning memcpy warning in AH output (Charalampos Mitrodimas)\n- scsi: ufs: host: mediatek: Fix invalid access in vccqx handling (Alice Chao)\n- scsi: ufs: host: mediatek: Change reset sequence for improved stability (Peter Wang)\n- scsi: ufs: host: mediatek: Assign power mode userdata before FASTAUTO mode change (Alice Chao)\n- scsi: ufs: host: mediatek: Fix PWM mode switch issue (Peter Wang)\n- scsi: ufs: host: mediatek: Fix auto-hibern8 timer configuration (Peter Wang)\n- bridge: Redirect to backup port when port is administratively down (Ido Schimmel)\n- s390/pci: Use pci_uevent_ers() in PCI recovery (Niklas Schnelle)\n- powerpc/eeh: Use result of error_detected() in uevent (Niklas Schnelle)\n- tty: serial: ip22zilog: Use platform device for probing (Thomas Bogendoerfer)\n- thunderbolt: Use is_pciehp instead of is_hotplug_bridge (Lukas Wunner)\n- ice: Don't use %pK through printk or tracepoints (Thomas Weissschuh)\n- net: stmmac: Check stmmac_hw_setup() in stmmac_resume() (Tiezhu Yang)\n- x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall (Kirill A. Shutemov)\n- PCI/ERR: Update device error_state already after reset (Lukas Wunner)\n- media: i2c: Kconfig: Ensure a dependency on HAVE_CLK for VIDEO_CAMERA_SENSOR (Mehdi Djait)\n- drm/tidss: Set crtc modesetting parameters with adjusted mode (Jayesh Choudhary)\n- drm/bridge: cdns-dsi: Don't fail on MIPI_DSI_MODE_VIDEO_BURST (Tomi Valkeinen)\n- drm/bridge: cdns-dsi: Fix REG_WAKEUP_TIME value (Tomi Valkeinen)\n- drm/tidss: Use the crtc_* timings when programming the HW (Tomi Valkeinen)\n- media: amphion: Delete v4l2_fh synchronously in .release() (Laurent Pinchart)\n- media: pci: ivtv: Don't create fake v4l2_fh (Laurent Pinchart)\n- drm/amdkfd: return -ENOTTY for unsupported IOCTLs (Geoffrey McRae)\n- wifi: rtw88: sdio: use indirect IO for device registers before power-on (Ping-Ke Shih)\n- wifi: rtw89: print just once for unknown C2H events (Ping-Ke Shih)\n- selftests/net: Ensure assert() triggers in psock_tpacket.c (Wake Liu)\n- selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8 (Wake Liu)\n- PCI: Disable MSI on RDC PCI to PCIe bridges (Marcos Del Sol Vives)\n- drm/amd/display: Wait until OTG enable state is cleared (TungYu Lu)\n- drm/amd/display: Reset apply_eamless_boot_optimization when dpms_off (Danny Wang)\n- ASoC: mediatek: Use SND_JACK_AVOUT for HDMI/DP jacks (Terry Cheong)\n- drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() (Seyediman Seyedarab)\n- drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff (Sathishkumar S)\n- drm/amd/pm: Use cached metrics data on arcturus (Lijo Lazar)\n- drm/amd/pm: Use cached metrics data on aldebaran (Lijo Lazar)\n- drm/amd/display: update dpp/disp clock from smu clock table (Paul Hsieh)\n- drm/amd/display: add more cyan skillfish devices (Alex Deucher)\n- drm/amdgpu: Skip poison aca bank from UE channel (Xiang Liu)\n- drm/amd/amdgpu: Release xcp drm memory after unplug (Meng Li)\n- drm/amdgpu: Avoid rma causes GPU duplicate reset (Ce Sun)\n- drm/xe: Fix oops in xe_gem_fault when running core_hotunplug test. (Maarten Lankhorst)\n- drm/xe/guc: Add more GuC load error status codes (John Harrison)\n- drm/amd/display: Increase AUX Intra-Hop Done Max Wait Duration (Michael Strauss)\n- drm/amd/display: Move setup_stream_attribute (Michael Strauss)\n- drm/amdgpu: Check vcn sram load return value (Sathishkumar S)\n- drm/amdgpu: add range check for RAS bad page address (Tao Zhou)\n- drm/amd/display: ensure committing streams is seamless (Clay King)\n- drm/amd/display: fix condition for setting timing_adjust_pending (Aurabindo Pillai)\n- mfd: intel-lpss: Add Intel Wildcat Lake LPSS PCI IDs (Ilpo Jarvinen)\n- mfd: core: Increment of_node's refcount before linking it to the platform device (Bastien Curutchet)\n- mfd: da9063: Split chip variant reading in two bus transactions (Jens Kehne)\n- mfd: madera: Work around false-positive -Wininitialized warning (Arnd Bergmann)\n- mfd: stmpe-i2c: Add missing MODULE_LICENSE (Alexander Stein)\n- mfd: stmpe: Remove IRQ domain upon removal (Alexander Stein)\n- tools/power x86_energy_perf_policy: Prefer driver HWP limits (Len Brown)\n- tools/power x86_energy_perf_policy: Enhance HWP enable (Len Brown)\n- tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage (Kaushlendra Kumar)\n- selftests/bpf: Fix flaky bpf_cookie selftest (Mykyta Yatsenko)\n- tools/cpupower: Fix incorrect size in cpuidle_state_disable() (Kaushlendra Kumar)\n- hwmon: (dell-smm) Remove Dell Precision 490 custom config data (Armin Wolf)\n- hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex (Ben Copeland)\n- uprobe: Do not emulate/sstep original instruction when ip is changed (Jiri Olsa)\n- nvme: Use non zero KATO for persistent discovery connections (Alistair Francis)\n- bpf: Clear pfmemalloc flag when freeing all fragments (Amery Hung)\n- riscv: bpf: Fix uninitialized symbol 'retval_off' (Chenghao Duan)\n- blk-cgroup: fix possible deadlock while configuring policy (Yu Kuai)\n- clocksource/drivers/timer-rtl-otto: Do not interfere with interrupts (Markus Stockhausen)\n- clocksource/drivers/timer-rtl-otto: Work around dying timers (Markus Stockhausen)\n- clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Daniel Lezcano)\n- ACPI: SPCR: Support Precise Baud Rate field (Chen Pei)\n- spi: rpc-if: Add resume support for RZ/G3E (Biju Das)\n- selftests/bpf: Fix selftest verifier_arena_large failure (Yonghong Song)\n- futex: Don't leak robust_list pointer on exec race (Pranav Tyagi)\n- cpuidle: Fail cpuidle device registration if there is one already (Rafael J. Wysocki)\n- bpftool: Fix -Wuninitialized-const-pointer warnings with clang = 21 (Tom Stellard)\n- power: supply: qcom_battmgr: handle charging state change notifications (Fenglin Wu)\n- pmdomain: apple: Add 'apple,t8103-pmgr-pwrstate' (Janne Grunau)\n- tools/cpupower: fix error return value in cpupower_write_sysfs() (Kaushlendra Kumar)\n- video: backlight: lp855x_bl: Set correct EPROM start for LP8556 (Svyatoslav Ryhel)\n- i3c: mipi-i3c-hci-pci: Add support for Intel Wildcat Lake-U I3C (Jarkko Nikula)\n- bpf: Do not limit bpf_cgroup_from_id to current's namespace (Kumar Kartikeya Dwivedi)\n- nvme-fc: use lock accessing port_state and rport state (Daniel Wagner)\n- nvmet-fc: avoid scheduling association deletion twice (Daniel Wagner)\n- tee: allow a driver to allocate a tee_device without a pool (Amirreza Zarrabi)\n- ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() (Hans de Goede)\n- pwm: pca9685: Use bulk write to atomicially update registers (Uwe Kleine-Konig)\n- mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card (Sarthak Garg)\n- firmware: qcom: tzmem: disable sc7180 platform (Nikita Travkin)\n- ARM: tegra: transformer-20: fix audio-codec interrupt (Svyatoslav Ryhel)\n- ARM: tegra: transformer-20: add missing magnetometer interrupt (Svyatoslav Ryhel)\n- ARM: tegra: p880: set correct touchscreen clipping (Jonas Schwobel)\n- soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups (Svyatoslav Ryhel)\n- arm64: zynqmp: Revert usb node drive strength and slew rate for zcu106 (Radhey Shyam Pandey)\n- arm64: zynqmp: Disable coresight by default (Quanyang Wang)\n- cpufreq: ondemand: Update the efficient idle check for Intel extended Families (Sohil Mehta)\n- irqchip/loongson-pch-lpc: Use legacy domain for PCH-LPC IRQ controller (Ming Wang)\n- hwmon: sy7636a: add alias (Andreas Kemnade)\n- power: supply: sbs-charger: Support multiple devices (Fabien Proriol)\n- pinctrl: keembay: release allocated memory in detach path (Bartosz Golaszewski)\n- hwmon: (sbtsi_temp) AMD CPU extended temperature range support (Chuande Chen)\n- hwmon: (lenovo-ec-sensors) Update P8 supprt (David Ober)\n- hwmon: (k10temp) Add device ID for Strix Halo (Rong Zhang)\n- hwmon: (k10temp) Add thermal support for AMD Family 1Ah-based models (Avadhut Naik)\n- power: supply: qcom_battmgr: add OOI chemistry (Christopher Ruehl)\n- thermal: intel: selftests: workload_hint: Mask unsupported types (Srinivas Pandruvada)\n- thermal: gov_step_wise: Allow cooling level to be reduced earlier (Rafael J. Wysocki)\n- ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[] (Hans de Goede)\n- ACPI: resource: Skip IRQ override on ASUS Vivobook Pro N6506CU (Sam van Kampen)\n- ACPI: PRM: Skip handlers with NULL handler_address or NULL VA (Shang song (Lenovo))\n- irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment (Christian Bruel)\n- selftests/bpf: Upon failures, exit with code 1 in test_xsk.sh (Ricardo B. Marliere)\n- arc: Fix __fls() const-foldability via __builtin_clzl() (Kees Cook)\n- cpufreq/longhaul: handle NULL policy in longhaul_exit (Dennis Beier)\n- selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2 (Ricardo B. Marliere)\n- libbpf: Fix USDT SIB argument handling causing unrecognized register error (Jiawei Zhao)\n- ACPI: video: force native for Lenovo 82K8 (Mario Limonciello (AMD))\n- ACPI: sysfs: Use ACPI_FREE() for freeing an ACPI object (Kaushlendra Kumar)\n- io_uring/zctx: check chained notif contexts (Pavel Begunkov)\n- irqchip/sifive-plic: Respect mask state when setting affinity (Inochi Amaoto)\n- firewire: ohci: move self_id_complete tracepoint after validating register (Takashi Sakamoto)\n- bpf: Use tnums for JEQ/JNE is_branch_taken logic (Paul Chaignon)\n- cpufreq: ti: Add support for AM62D2 (Paresh Bhagat)\n- memstick: Add timeout to prevent indefinite waiting (Jiayi Li)\n- mmc: host: renesas_sdhi: Fix the actual clock (Biju Das)\n- pinctrl: single: fix bias pull up/down handling in pin_config_set (Chi Zhang)\n- bpf: Don't use %pK through printk (Thomas Weissschuh)\n- soc: ti: pruss: don't use %pK through printk (Thomas Weissschuh)\n- spi: loopback-test: Don't use %pK through printk (Thomas Weissschuh)\n- soc: qcom: smem: Fix endian-unaware access of num_entries (Jens Reidel)\n- firmware: qcom: scm: preserve assign_mem() error return value (Mukesh Ojha)\n- soc: aspeed: socinfo: Add AST27xx silicon IDs (Ryan Chen)\n- s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP (Heiko Carstens)\n- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Gerd Bayer)\n- drm/sched: Fix race in drm_sched_entity_select_rq() (Philipp Stanner)\n- drm/sched: Re-group and rename the entity run-queue lock (Tvrtko Ursulin)\n- drm/sched: Optimise drm_sched_entity_push_job (Tvrtko Ursulin)\n- usb: gadget: f_fs: Fix epfile null pointer access after ep enable. (Owen Gu)\n- x86/CPU/AMD: Add RDSEED fix for Zen5 (Gregory Price)\n- mfd: kempld: Switch back to earlier -init() behavior (Heijligen, Thomas)\n- cpuidle: governors: menu: Select polling state in some more cases (Rafael J. Wysocki)\n- cpuidle: governors: menu: Rearrange main loop in menu_select() (Rafael J. Wysocki)\n- sched_ext: Mark scx_bpf_dsq_move_set_[slice|vtime]() with KF_RCU (Tejun Heo)\n- ACPI: fan: Use platform device for devres-related actions (Armin Wolf)\n- ACPI: fan: Add fan speed reporting for fans with only _FST (Joshua Grisham)\n- drm/amd/display: Fix incorrect return of vblank enable on unconfigured crtc (Ivan Lipski)\n- drm/amd: Check that VPE has reached DPM0 in idle handler (Mario Limonciello)\n- drm/ast: Clear preserved bits from register output value (Thomas Zimmermann)\n- drm/mediatek: Fix device use-after-free on unbind (Johan Hovold)\n- drm/nouveau: Fix race in nouveau_sched_fini() (Philipp Stanner)\n- drm/sched: avoid killing parent entity on child SIGKILL (David Rosca)\n- drm/sysfb: Do not dereference NULL pointer in plane reset (Thomas Zimmermann)\n- drm/xe: Do not wake device during a GT reset (Matthew Brost)\n- s390/mm: Fix memory leak in add_marker() when kvrealloc() fails (Miaoqian Lin)\n- regmap: slimbus: fix bus_context pointer in regmap init calls (Alexey Klimov)\n- perf/x86/intel: Fix KASAN global-out-of-bounds warning (Dapeng Mi)\n- block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL (Damien Le Moal)\n- ACPI: fan: Use ACPI handle when retrieving _FST (Armin Wolf)\n- drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland (John Smith)\n- drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji (John Smith)\n- drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() (Yang Wang)\n- drm/radeon: Remove calls to drm_put_dev() (Daniel Palmer)\n- drm/radeon: Do not kfree() devres managed rdev (Daniel Palmer)\n- ASoC: fsl_sai: Fix sync error in consumer mode (Maarten Zanders)\n- dpll: spec: add missing module-name and clock-id to pin-get reply (Petr Oros)\n- sfc: fix potential memory leak in efx_mae_process_mport() (Abdun Nihaal)\n- net: hns3: return error code when function fails (Jijie Shao)\n- tools: ynl: fix string attribute length to include null terminator (Petr Oros)\n- drm/etnaviv: fix flush sequence logic (Tomeu Vizoso)\n- Bluetooth: hci_core: Fix tracking of periodic advertisement (Luiz Augusto von Dentz)\n- Bluetooth: ISO: Fix another instance of dst_type handling (Luiz Augusto von Dentz)\n- Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 (Luiz Augusto von Dentz)\n- Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during reset (Chris Lu)\n- Bluetooth: ISO: Fix BIS connection dst_type handling (Luiz Augusto von Dentz)\n- Bluetooth: ISO: Update hci_conn_hash_lookup_big for Broadcast slave (Iulia Tanasescu)\n- Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (Cen Zhang)\n- usbnet: Prevents free active kevent (Lizhi Xu)\n- libbpf: Fix powerpc's stack register definition in bpf_tracing.h (Andrii Nakryiko)\n- ASoC: fsl_sai: fix bit order for DSD format (Shengjiu Wang)\n- ASoC: Intel: avs: Disable periods-elapsed work when closing PCM (Cezary Rojewski)\n- ASoC: Intel: avs: Unprepare a stream when XRUN occurs (Cezary Rojewski)\n- crypto: aspeed - fix double free caused by devm (Haotian Zhang)\n- bpf: Do not audit capability check in do_jit() (Ondrej Mosnacek)\n- bpf, x86: Avoid repeated usage of bpf_prog-aux-stack_depth (Yonghong Song)\n- bpf: Find eligible subprogs for private stack support (Yonghong Song)\n- scsi: ufs: core: Initialize value of an attribute returned by uic cmd (Wonkon Kim)\n- bpf: Sync pending IRQ work before freeing ring buffer (Noorain Eqbal)\n- kunit: test_dev_action: Correctly cast 'priv' pointer to long* (Florian Schmaus)\n- wifi: mac80211: fix key tailroom accounting leak (Johannes Berg)\n- wifi: mac80211: don't mark keys for inactive links as uploaded (Miri Korenblit)\n- ASoC: cs-amp-lib-test: Fix missing include of kunit/test-bug.h (Richard Fitzgerald)\n- ALSA: usb-audio: fix control pipe direction (Roy Vegard Ovesen)\n- drm/msm/a6xx: Fix GMU firmware parser (Akhil P Oommen)\n- wifi: ath11k: avoid bit operation on key flags (Rameshkumar Sundaram)\n- wifi: ath11k: add support for MU EDCA (Yu Zhang(Yuriy))\n- wifi: ath12k: free skb during idr cleanup callback (Karthik M)\n- wifi: ath11k: Add missing platform IDs for quirk table (Mark Pearson)\n- wifi: ath10k: Fix memory leak on unsupported WMI command (Loic Poulain)\n- x86/fpu: Ensure XFD state on signal delivery (Chang S. Bae)\n- smb: client: fix potential cfid UAF in smb2_query_info_compound (Henrique Carvalho)\n- s390/pci: Restore IRQ unconditionally for the zPCI device (Farhan Ali)\n- ASoC: qdsp6: q6asm: do not sleep while atomic (Srinivas Kandagatla)\n- mptcp: restore window probe (Paolo Abeni)\n- mptcp: drop bogus optimization in __mptcp_check_push() (Paolo Abeni)\n- fbdev: valkyriefb: Fix reference count leak in valkyriefb_init (Miaoqian Lin)\n- fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS (Florian Fuchs)\n- wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode (Gokul Sivakumar)\n- Bluetooth: rfcomm: fix modem control handling (Johan Hovold)\n- fbdev: bitblit: bound-check glyph index in bit_putcs* (Junjie Cao)\n- virtio-net: drop the multi-buffer XDP packet in zerocopy (Bui Quang Minh)\n- ACPI: button: Call input_free_device() on failing input device registration (Kaushlendra Kumar)\n- ACPI: video: Fix use-after-free in acpi_video_switch_brightness() (Yuhao Jiang)\n- fbdev: atyfb: Check if pll_ops-init_pll failed (Daniel Palmer)\n- fbcon: Set fb_display[i]-mode to NULL when the mode is released (Quanmin Yan)\n- net: usb: asix_devices: Check return value of usbnet_get_endpoints (Miaoqian Lin)\n- NFSD: Fix crash in nfsd4_read_release() (Chuck Lever)\n- LTS version: v6.12.57 (Jack Vogel)\n- btrfs: tree-checker: fix bounds check in check_inode_extref() (Dan Carpenter)\n- sfc: fix NULL dereferences in ef100_process_design_param() (Edward Cree)\n- udmabuf: fix a buf size overflow issue during udmabuf creation (Xiaogang Chen)\n- wifi: ath12k: fix read pointer after free in ath12k_mac_assign_vif_to_vdev() (Aditya Kumar Singh)\n- iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE (Kees Bakker)\n- gpio: idio-16: Define fixed direction of the GPIO lines (William Breathitt Gray)\n- gpio: regmap: add the .fixed_direction_output configuration parameter (Ioana Ciornei)\n- gpio: regmap: Allow to allocate regmap-irq device (Mathieu Dubois-Briand)\n- bits: introduce fixed-type GENMASK_U*() (Vincent Mailhol)\n- bits: add comments and newlines to #if, #else and #endif directives (Vincent Mailhol)\n- bonding: check xdp prog when set bond mode (Wang Liang)\n- bonding: return detailed error when loading native XDP fails (Hangbin Liu)\n- wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() (Alexander Wetzel)\n- f2fs: fix to avoid panic once fallocation fails for pinfile (Chao Yu)\n- mptcp: pm: in-kernel: C-flag: handle late ADD_ADDR (Matthieu Baerts (NGI0))\n- selftests: mptcp: join: mark 'delete re-add signal' as skipped if not supported (Matthieu Baerts (NGI0))\n- selftests: mptcp: disable add_addr retrans in endpoint_tests (Geliang Tang)\n- docs: kdoc: handle the obsolescensce of docutils.ErrorString() (Jonathan Corbet)\n- arch: Add the macro COMPILE_OFFSETS to all the asm-offsets.c (Menglong Dong)\n- sched_ext: Make qmap dump operation non-destructive (Tejun Heo)\n- btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() (Filipe Manana)\n- btrfs: tree-checker: add inode extref checks (Qu Wenruo)\n- btrfs: abort transaction if we fail to update inode in log replay dir fixup (Filipe Manana)\n- btrfs: use level argument in log tree walk callback replay_one_buffer() (Filipe Manana)\n- btrfs: always drop log root tree reference in btrfs_replay_log() (Filipe Manana)\n- btrfs: scrub: replace max_t()/min_t() with clamp() in scrub_throttle_dev_io() (Thorsten Blum)\n- btrfs: zoned: refine extent allocator hint selection (Naohiro Aota)\n- btrfs: zoned: return error from btrfs_zone_finish_endio() (Johannes Thumshirn)\n- btrfs: abort transaction in the process_one_buffer() log tree walk callback (Filipe Manana)\n- btrfs: abort transaction on specific error places when walking log tree (Filipe Manana)\n- cpuset: Use new excpus for nocpu error check when enabling root partition (Chen Ridong)\n- EDAC/mc_sysfs: Increase legacy channel support to 16 (Avadhut Naik)\n- x86/bugs: Fix reporting of LFENCE retpoline (David Kaplan)\n- x86/bugs: Report correct retbleed mitigation status (David Kaplan)\n- seccomp: passthrough uprobe systemcall without filtering (Jiri Olsa)\n- perf: Skip user unwind if the task is a kernel thread (Josh Poimboeuf)\n- perf: Have get_perf_callchain() return NULL if crosstask and user are set (Josh Poimboeuf)\n- perf: Use current-flags  PF_KTHREAD|PF_USER_WORKER instead of current-mm == NULL (Steven Rostedt)\n- perf/x86/intel: Add ICL_FIXED_0_ADAPTIVE bit into INTEL_FIXED_BITS_MASK (Dapeng Mi)\n- audit: record fanotify event regardless of presence of rules (Richard Guy Briggs)\n- net/sched: sch_qfq: Fix null-deref in agg_dequeue (Xiang Mei)\n- LTS version: v6.12.56 (Jack Vogel)\n- platform/x86/amd/hsmp: Ensure sock-metric_tbl_addr is non-NULL (Suma Hegde)\n- ksmbd: transport_ipc: validate payload size before reading handle (Qianchang Zhao)\n- xfs: always warn about deprecated mount options (Darrick J. Wong)\n- devcoredump: Fix circular locking dependency with devcd-mutex. (Maarten Lankhorst)\n- serial: sc16is7xx: remove useless enable of enhanced features (Hugo Villeneuve)\n- serial: 8250_mtk: Enable baud clock and manage in runtime PM (Daniel Golle)\n- serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018 (Florian Eckert)\n- serial: 8250_dw: handle reset control deassert error (Artem Shimko)\n- dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp (Xu Yang)\n- tcpm: switch check for role_sw device with fw_node (Michael Grzeschik)\n- most: usb: hdm_probe: Fix calling put_device() before device initialization (Victoria Votokina)\n- most: usb: Fix use-after-free in hdm_disconnect (Victoria Votokina)\n- misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup (Junhao Xie)\n- objtool/rust: add one more noreturn Rust function (Miguel Ojeda)\n- mei: me: add wildcat lake P DID (Alexander Usyskin)\n- comedi: fix divide-by-zero in comedi_buf_munge() (Deepanshu Kartikey)\n- binder: remove 'invalid inc weak' check (Alice Ryhl)\n- x86/microcode: Fix Entrysign revision check for Zen1/Naples (Andrew Cooper)\n- xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event (Mathias Nyman)\n- xhci: dbc: enable back DbC in resume if it was enabled before suspend (Mathias Nyman)\n- usb: raw-gadget: do not limit transfer length (Andrey Konovalov)\n- usb/core/quirks: Add Huawei ME906S to wakeup quirk (Tim Guttzeit)\n- USB: serial: option: add Telit FN920C04 ECM compositions (LI Qingwu)\n- USB: serial: option: add Quectel RG255C (Reinhard Speyerer)\n- USB: serial: option: add UNISOC UIS7720 (Renjun Wang)\n- Bluetooth: btintel: Add DSBR support for BlazarIW, BlazarU and GaP (Kiran K)\n- io_uring/sqpoll: be smarter on when to update the stime usage (Jens Axboe)\n- io_uring/sqpoll: switch away from getrusage() for CPU accounting (Jens Axboe)\n- sched: Remove never used code in mm_cid_get() (Andy Shevchenko)\n- io_uring: correct __must_hold annotation in io_install_fixed_file (Alok Tiwari)\n- gpio: ljca: Fix duplicated IRQ mapping (Haotian Zhang)\n- drm/panic: Fix qr_code, ensure vmargin is positive (Jocelyn Falempe)\n- drm/panic: Fix drawing the logo on a small narrow screen (Jocelyn Falempe)\n- nbd: override creds to kernel when calling sock_{send,recv}msg() (Ondrej Mosnacek)\n- hwmon: (sht3x) Fix error handling (Guenter Roeck)\n- riscv: hwprobe: avoid uninitialized variable use in hwprobe_arch_id() (Paul Walmsley)\n- RISC-V: Don't print details of CPUs disabled in DT (Anup Patel)\n- RISC-V: Define pgprot_dmacoherent() for non-coherent devices (Anup Patel)\n- drm/panthor: Fix kernel panic on partial unmap of a GPU VA region (Akash Goel)\n- spi: airoha: fix reading/writing of flashes with more than one plane per lun (Mikhail Kshevetskiy)\n- spi: airoha: switch back to non-dma mode in the case of error (Mikhail Kshevetskiy)\n- spi: airoha: do not keep {tx,rx} dma buffer always mapped (Lorenzo Bianconi)\n- spi: airoha: add support of dual/quad wires spi modes to exec_op() handler (Mikhail Kshevetskiy)\n- spi: airoha: return an error for continuous mode dirmap creation cases (Mikhail Kshevetskiy)\n- firmware: arm_scmi: Fix premature SCMI_XFER_FLAG_IS_RAW clearing in raw mode (Artem Shimko)\n- firmware: arm_scmi: Account for failed debug initialization (Cristian Marussi)\n- arm64: dts: broadcom: bcm2712: Define VGIC interrupt (Peter Robinson)\n- arm64: dts: broadcom: bcm2712: Add default GIC address cells (Krzysztof Kozlowski)\n- spi: spi-nxp-fspi: add extra delay after dll locked (Han Xu)\n- drm/amd/display: increase max link count and fix link-enc NULL pointer access (Charlene Liu)\n- mm: prevent poison consumption when splitting THP (Qiuxu Zhuo)\n- selftests: mptcp: join: mark implicit tests as skipped if not supported (Matthieu Baerts (NGI0))\n- selftests: mptcp: join: mark 'flush re-add' as skipped if not supported (Matthieu Baerts (NGI0))\n- net: ravb: Ensure memory write completes before ringing TX doorbell (Lad Prabhakar)\n- net: ravb: Enforce descriptor type ordering (Lad Prabhakar)\n- net: usb: rtl8150: Fix frame padding (Michal Pecio)\n- net: stmmac: dwmac-rk: Fix disabling set_clock_selection (Sebastian Reichel)\n- vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella)\n- ocfs2: clear extent cache after moving/defragmenting extents (Deepanshu Kartikey)\n- MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering (Maciej W. Rozycki)\n- cifs: Fix TCP_Server_Info::credits to be signed (David Howells)\n- can: netlink: can_changelink(): allow disabling of automatic restart (Marc Kleine-Budde)\n- ACPICA: Work around bogus -Wstringop-overread warning since GCC 11 (Xi Ruoyao)\n- slab: Fix obj_ext mistakenly considered NULL due to race condition (Hao Ge)\n- slab: Avoid race on slab-obj_exts in alloc_slab_obj_exts (Hao Ge)\n- Revert 'cpuidle: menu: Avoid discarding useful information' (Rafael J. Wysocki)\n- xfs: fix locking in xchk_nlinks_collect_dir (Darrick J. Wong)\n- gpio: 104-idio-16: Define maximum valid register address offset (William Breathitt Gray)\n- gpio: pci-idio-16: Define maximum valid register address offset (William Breathitt Gray)\n- btrfs: directly free partially initialized fs_info in btrfs_check_leaked_roots() (Dewei Meng)\n- arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() (Kaushlendra Kumar)\n- dma-debug: don't report false positives with DMA_BOUNCE_UNALIGNED_KMALLOC (Marek Szyprowski)\n- net: bonding: fix possible peer notify event loss or dup issue (Tonghao Zhang)\n- fs/notify: call exportfs_encode_fid with s_umount (Jakub Acs)\n- net/mlx5: Fix IPsec cleanup over MPV device (Patrisious Haddad)\n- net: phy: micrel: always set shared-phydev for LAN8814 (Robert Marko)\n- sctp: avoid NULL dereference when chunk data buffer is missing (Alexey Simakov)\n- ptp: ocp: Fix typo using index 1 instead of i in SMA initialization loop (Jiasheng Jiang)\n- arm64, mm: avoid always making PTE dirty in pte_mkwrite() (Huang Ying)\n- net: ethernet: ti: am65-cpts: fix timestamp loss due to race conditions (Aksh Garg)\n- net/smc: fix general protection fault in __smc_diag_dump (Wang Liang)\n- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Amery Hung)\n- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Amery Hung)\n- net/mlx5e: Reuse per-RQ XDP buffer to avoid stack zeroing overhead (Carolina Jubran)\n- selftests: net: fix server bind failure in sctp_vrf.sh (Xin Long)\n- can: rockchip-canfd: rkcanfd_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() (Marc Kleine-Budde)\n- can: esd: acc_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() (Marc Kleine-Budde)\n- can: bxcan: bxcan_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() (Marc Kleine-Budde)\n- dpaa2-eth: fix the pointer passed to PTR_ALIGN on Tx path (Ioana Ciornei)\n- net: enetc: correct the value of ENETC_RXB_TRUESIZE (Wei Fang)\n- net: enetc: fix the deadlock of enetc_mdio_lock (Jianpeng Chang)\n- rtnetlink: Allow deleting FDB entries in user namespace (Johannes Wiesbock)\n- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Nathan Chancellor)\n- PM: EM: Fix late boot with holes in CPU topology (Christian Loehle)\n- PM: EM: Move CPU capacity check to em_adjust_new_capacity() (Rafael J. Wysocki)\n- PM: EM: Slightly reduce em_check_capacity_update() overhead (Rafael J. Wysocki)\n- PM: EM: Drop unused parameter from em_adjust_new_capacity() (Rafael J. Wysocki)\n- Unbreak 'make tools/*' for user-space targets (Linus Torvalds)\n- smb: server: let smb_direct_flush_send_list() invalidate a remote key first (Stefan Metzmacher)\n- s390/mm: Use __GFP_ACCOUNT for user page table allocations (Heiko Carstens)\n- drivers/perf: hisi: Relax the event ID check in the framework (Yicong Yang)\n- powerpc/32: Remove PAGE_KERNEL_TEXT to fix startup failure (Christophe Leroy)\n- m68k: bitops: Fix find_*_bit() signatures (Geert Uytterhoeven)\n- gfs2: Fix unlikely race in gdlm_put_lock (Andreas Gruenbacher)\n- arm64: sysreg: Correct sign definitions for EIESB and DoubleLock (Fuad Tabba)\n- lkdtm: fortify: Fix potential NULL dereference on kmalloc failure (Junjie Cao)\n- PCI: Test for bit underflow in pcie_set_readrq() (Kees Cook)\n- hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super() (Yangtao Li)\n- hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits() (Viacheslav Dubeyko)\n- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring)\n- hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat() (Viacheslav Dubeyko)\n- hfs: validate record offset in hfsplus_bmap_alloc (Yang Chenzhi)\n- hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent() (Viacheslav Dubeyko)\n- hfs: make proper initalization of struct hfs_find_data (Viacheslav Dubeyko)\n- hfs: clear offset and space out of valid records in b-tree node (Viacheslav Dubeyko)\n- nios2: ensure that memblock.current_limit is set when setting pfn limits (Simon Schuster)\n- exec: Fix incorrect type for ret (Xichao Zhao)","id":"ELSA-2026-50006","ovalId":"oval:com.oracle.elsa:def:202650006","source":"oracle_linux","title":"ELSA-2026-50006: Unbreakable Enterprise kernel security update (IMPORTANT)","url":"https://linux.oracle.com/errata/ELSA-2026-50006.html"}